VIRY.CZ

Ahoj,
mam ted od kamrada k dispozici jeho PC, na kterym se vyskytoval YeaDesktop.exe, ktery se vymazalo, ale kdovico tam jeste je. Kompl je vseobecne strasne zpomalenej, kdyz taham oknem po plose tak se pohyb vylozene cuka a neda se s tim moc dobre pracovat.

Tady je log z RSIT.

Logfile of random's system information tool 1.10 (written by random/random)
Run by Master at 2017-06-17 23:39:52
Microsoft Windows 10 Pro
System drive C: has 153 GB (67%) free of 228 GB
Total RAM: 8102 MB (57% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 23:40:05, on 17.06.2017
Platform: Unknown Windows (WinNT 6.02.1008)
MSIE: Internet Explorer v11.0 (11.00.14393.0953)
Boot mode: Normal

Running processes:
C:\Program Files (x86)\IObit\IObit Uninstaller\UninstallMonitor.exe
C:\Program Files (x86)\TeamViewer\TeamViewer.exe
C:\Program Files\trend micro\Master.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/p/?LinkId=255141
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/p/?LinkId=255141
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/p/?LinkId=255141
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = %11%\blank.htm
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F2 - REG:system.ini: UserInit=
O4 - HKUS\S-1-5-19\..\Run: [OneDriveSetup] C:\Windows\SysWOW64\OneDriveSetup.exe /thfirstsetup (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [OneDriveSetup] C:\Windows\SysWOW64\OneDriveSetup.exe /thfirstsetup (User 'NETWORK SERVICE')
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O15 - Trusted Zone: http://help.eset.com (HKLM)
O15 - ESC Trusted Zone: http://help.eset.com (HKLM)
O18 - Protocol: tbauth - {14654CA6-5711-491D-B89A-58E571679951} - C:\Windows\SysWOW64\tbauth.dll
O18 - Protocol: windows.tbauth - {14654CA6-5711-491D-B89A-58E571679951} - C:\Windows\SysWOW64\tbauth.dll
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: Intel(R) Content Protection HECI Service (cphs) - Intel Corporation - C:\Windows\System32\DriverStore\FileRepository\igdlh64.inf_amd64_0745f11ce6fc197c\IntelCpHeciSvc.exe
O23 - Service: Intel(R) Content Protection HDCP Service (cplspcon) - Intel Corporation - C:\Windows\System32\DriverStore\FileRepository\igdlh64.inf_amd64_0745f11ce6fc197c\IntelCpHDCPSvc.exe
O23 - Service: @%SystemRoot%\system32\DiagSvcs\DiagnosticsHub.StandardCollector.ServiceRes.dll,-1000 (diagnosticshub.standardcollector.service) - Unknown owner - C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe (file missing)
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: ESET Service (ekrn) - Unknown owner - C:\Program Files\ESET\ESET Security\ekrn.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: Intel(R) HD Graphics Control Panel Service (igfxCUIService2.0.0.0) - Intel Corporation - C:\Windows\System32\DriverStore\FileRepository\igdlh64.inf_amd64_0745f11ce6fc197c\igfxCUIService.exe
O23 - Service: IObit Uninstaller Service (IObitUnSvr) - IObit - C:\Program Files (x86)\IObit\IObit Uninstaller\IUService.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%ProgramFiles%\Windows Defender Advanced Threat Protection\MsSense.exe,-1001 (Sense) - Unknown owner - C:\Program Files (x86)\Windows Defender Advanced Threat Protection\MsSense.exe (file missing)
O23 - Service: @%SystemRoot%\system32\SensorDataService.exe,-101 (SensorDataService) - Unknown owner - C:\Windows\System32\SensorDataService.exe (file missing)
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: TeamViewer 12 (TeamViewer) - TeamViewer GmbH - C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
O23 - Service: @%SystemRoot%\system32\TieringEngineService.exe,-702 (TieringEngineService) - Unknown owner - C:\Windows\system32\TieringEngineService.exe (file missing)
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%ProgramFiles%\Windows Defender\MpAsDesc.dll,-320 (WdNisSvc) - Unknown owner - C:\Program Files (x86)\Windows Defender\NisSrv.exe (file missing)
O23 - Service: @%ProgramFiles%\Windows Defender\MpAsDesc.dll,-310 (WinDefend) - Unknown owner - C:\Program Files (x86)\Windows Defender\MsMpEng.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--
End of file - 6695 bytes

======Listing Processes======








C:\Windows\system32\lsass.exe
winlogon.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k RPCSS
"dwm.exe"
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\System32\DriverStore\FileRepository\igdlh64.inf_amd64_0745f11ce6fc197c\igfxCUIService.exe
C:\Windows\system32\rundll32.exe "C:\Program Files\The PC Chiener\The PC Chiener.dll",OQvuPagcvMEF
C:\Windows\system32\rundll32.exe "C:\Program Files\Checking Downloader\Checking Downloader.dll",qvzDzvS
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\System32\spoolsv.exe
C:\Windows\System32\svchost.exe -k utcsvc
"C:\Program Files (x86)\IObit\IObit Uninstaller\IUService.exe"
C:\Windows\system32\svchost.exe -k appmodel
C:\Windows\system32\svchost.exe -k imgsvc


sihost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
C:\Windows\Explorer.EXE
"C:\Windows\System32\DriverStore\FileRepository\igdlh64.inf_amd64_0745f11ce6fc197c\igfxEM.exe"
"C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mca
C:\Windows\system32\SearchIndexer.exe /Embedding
"C:\Windows\System32\WUDFHost.exe" -HostGUID:{193a1820-d9ac-4997-8c55-be817523f6aa} -IoEventPortName:HostProcess-e0bfdddf-c167-4a0e-ba07-221f0c1bec5e -SystemEventPortName:HostProcess-93f5239c-1866-4135-9c34-9b398d06836c -IoCancelEventPortName:HostProcess-36740d38-4619-4f79-afe5-8f4ec2d3b591 -NonStateChangingEventPortName:HostProcess-526d2fd5-8933-4894-8e0a-b96e2747b172 -ServiceSID:S-1-5-80-2652678385-582572993-1835434367-1344795993-749280709 -LifetimeId:b78b59b5-b462-4807-90f2-746348a6eae8 -DeviceGroupId:WpdFsGroup

C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
dashost.exe {ba272018-70bb-43ec-ad47a510b3d72996}
"C:\Program Files\Windows Defender\MSASCuiL.exe"
C:\Windows\system32\AUDIODG.EXE 0x2ec
C:\Windows\System32\InstallAgent.exe -Embedding
"C:\Program Files (x86)\IObit\IObit Uninstaller\UninstallMonitor.exe"
C:\Windows\system32\DllHost.exe /Processid:{49F6E667-6658-4BD1-9DE9-6AF87F9FAF85}
C:\Windows\system32\ApplicationFrameHost.exe -Embedding
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
C:\Windows\system32\browser_broker.exe -Embedding
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\microsoftedgecp.exe" SCODEF:6272 CREDAT:140559 /prefetch:2
"C:\Windows\System32\Taskmgr.exe" /3
"C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1705.1301.0_x64__8wekyb3d8bbwe\Calculator.exe" -ServerName:App.AppXsm3pg4n7er43kdh1qp4e79f1j7am68r8.mca
"C:\Windows\ImmersiveControlPanel\SystemSettings.exe" -ServerName:microsoft.windows.immersivecontrolpanel
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\microsoftedgecp.exe" SCODEF:6272 CREDAT:140560 /prefetch:2
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\microsoftedgecp.exe" SCODEF:6272 CREDAT:206125 /prefetch:2
"C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.17042.14211.0_x64__8wekyb3d8bbwe\Video.UI.exe" -ServerName:Microsoft.ZuneVideo.AppX758ya5sqdjd98rx6z7g95nw6jy7bqx9y.mca
"C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca
"fontdrvhost.exe"
"C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe"
"C:\Program Files (x86)\TeamViewer\TeamViewer.exe"
"C:\Program Files (x86)\TeamViewer\tv_w32.exe" --action hooks --log C:\Program Files (x86)\TeamViewer\TeamViewer12_Logfile.log
"C:\Program Files (x86)\TeamViewer\tv_x64.exe" --action hooks --log C:\Program Files (x86)\TeamViewer\TeamViewer12_Logfile.log
"c:\program files (x86)\teamviewer\TeamViewer_Desktop.exe" --IPCport 5939
"C:\Program Files\WindowsApps\Microsoft.Windows.Photos_17.524.10020.0_x64__8wekyb3d8bbwe\Microsoft.Photos.exe" -ServerName:App.AppXzst44mncqdg84v7sv6p7yznqwssy6f7f.mca
"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe26_ Global\UsGthrCtrlFltPipeMssGthrPipe26 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
"C:\Windows\system32\SearchFilterHost.exe" 0 640 644 652 8192 648
"C:\Users\Master\Desktop\ČISTICI UTILITY\RSITx64.exe"
C:\Windows\system32\wbem\wmiprvse.exe

======Scheduled tasks folder======

C:\Windows\tasks\Uninstaller_SkipUac_Master.job - C:\Program Files (x86)\IObit\IObit Uninstaller\IObitUninstaler.exe /UninstallExplorer

=========Mozilla firefox=========

ProfilePath - C:\Users\Master\AppData\Roaming\Mozilla\Firefox\Profiles\v8rbm51q.default

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 25.0.0.171 Plugin
"Path"=C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_25_0_0_171.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@videolan.org/vlc,version=2.2.3]
"Description"=VLC Multimedia Plugin
"Path"=C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll


[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 25.0.0.171 Plugin
"Path"=C:\Windows\system32\Macromed\Flash\NPSWF64_25_0_0_171.dll


======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{10921475-03CE-4E04-90CE-E2E7EF20C814}]
ExplorerWnd Helper - C:\Program Files (x86)\IObit\IObit Uninstaller\UninstallExplorer.dll [2017-03-28 2478880]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"WindowsDefender"=C:\Program Files\Windows Defender\MSASCuiL.exe [2017-03-28 631808]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Ahcache.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\CoreMessagingRegistrar]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\hitmanpro37]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\hitmanpro37.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\HitmanPro37Crusader]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\HitmanPro37CrusaderBoot]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\iai2c.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SpbCx.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\StateRepository]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\TileDataModelSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\uefi.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\UserManager]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{F2E7DD72-6468-4E36-B6F1-6488F42C1B52}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Ahcache.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\CoreMessagingRegistrar]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\hitmanpro37]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\hitmanpro37.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\HitmanPro37Crusader]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\HitmanPro37CrusaderBoot]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\SpbCx.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\StateRepository]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\TileDataModelSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\uefi.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\UserManager]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{F2E7DD72-6468-4E36-B6F1-6488F42C1B52}]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"DSCAutomationHostEnabled"=2

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"midimapper"=midimap.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.l3acm"=C:\Windows\System32\l3codeca.acm
"msacm.msadpcm"=msadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"vidc.i420"=iyuv_32.dll
"vidc.iyuv"=iyuv_32.dll
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"vidc.uyvy"=msyuv.dll
"vidc.yuy2"=msyuv.dll
"vidc.yvu9"=tsbyuv.dll
"vidc.yvyu"=msyuv.dll
"wavemapper"=msacm32.drv
"wave1"=wdmaud.drv
"midi1"=wdmaud.drv
"mixer1"=wdmaud.drv
"aux1"=wdmaud.drv
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*

======List of files/folders created in the last 1 month======

2017-06-17 23:39:52 ----D---- C:\rsit
2017-06-17 23:39:52 ----D---- C:\Program Files\trend micro
2017-06-17 19:00:18 ----D---- C:\Users\Master\AppData\Roaming\TeamViewer
2017-06-17 15:48:15 ----D---- C:\Program Files (x86)\TeamViewer
2017-06-16 16:35:08 ----D---- C:\Windows\Minidump
2017-06-11 05:15:00 ----D---- C:\Users\Master\AppData\Roaming\ESET
2017-06-11 05:12:35 ----D---- C:\Users\Master\AppData\Roaming\WinRAR
2017-06-11 05:12:02 ----AD---- C:\Program Files\WinRAR
2017-06-11 05:07:58 ----A---- C:\Windows\system32\bootdelete.exe
2017-06-11 05:06:22 ----A---- C:\Windows\system32\drivers\hitmanpro37.sys
2017-06-11 05:05:58 ----D---- C:\ProgramData\HitmanPro
2017-06-11 05:05:13 ----ASH---- C:\swapfile.sys
2017-06-11 04:59:40 ----D---- C:\AdwCleaner
2017-06-11 04:51:41 ----A---- C:\Windows\system32\drivers\zamguard64.sys
2017-06-11 04:28:53 ----D---- C:\ProgramData\ProductData
2017-06-11 04:28:46 ----D---- C:\Program Files (x86)\IObit
2017-06-11 04:28:38 ----D---- C:\Users\Master\AppData\Roaming\IObit
2017-06-11 04:28:38 ----D---- C:\ProgramData\IObit
2017-06-11 04:01:42 ----D---- C:\ProgramData\ESET
2017-06-11 04:01:42 ----D---- C:\Program Files\ESET
2017-06-11 03:56:31 ----A---- C:\Windows\system32\drivers\vcdrom.sys
2017-06-11 03:56:20 ----D---- C:\Program Files (x86)\mgdisk
2017-06-11 03:11:18 ----D---- C:\Users\Master\AppData\Roaming\uTorrent
2017-06-08 09:23:41 ----AD---- C:\Program Files (x86)\Copay
2017-05-28 20:02:34 ----D---- C:\Program Files (x86)\Seznam.cz
2017-05-28 20:02:23 ----D---- C:\Users\Master\AppData\Roaming\Seznam.cz
2017-05-25 03:43:54 ----A---- C:\Windows\system32\drivers\cryptfd.sys
2017-05-22 12:22:47 ----D---- C:\Users\Master\AppData\Roaming\LibreOffice
2017-05-22 12:20:55 ----AD---- C:\Program Files (x86)\LibreOffice 5

======List of files/folders modified in the last 1 month======

2017-06-17 23:39:56 ----D---- C:\Windows\Prefetch
2017-06-17 23:39:52 ----RD---- C:\Program Files
2017-06-17 23:36:40 ----D---- C:\Windows\Temp
2017-06-17 23:36:40 ----D---- C:\Windows\system32\SleepStudy
2017-06-17 22:42:00 ----D---- C:\Windows\system32\sru
2017-06-17 19:00:19 ----RSD---- C:\Windows\Fonts
2017-06-17 18:21:06 ----D---- C:\Windows\AppReadiness
2017-06-17 17:00:16 ----HD---- C:\Program Files\WindowsApps
2017-06-17 15:48:15 ----RD---- C:\Program Files (x86)
2017-06-17 15:48:15 ----D---- C:\Windows\system32\Tasks
2017-06-17 15:42:27 ----D---- C:\Windows\System32
2017-06-17 15:42:27 ----A---- C:\Windows\system32\PerfStringBackup.INI
2017-06-17 15:38:00 ----D---- C:\Windows
2017-06-17 12:39:20 ----D---- C:\Users\Master\AppData\Roaming\vlc
2017-06-16 21:13:01 ----RD---- C:\Windows\Microsoft.NET
2017-06-16 16:35:15 ----D---- C:\Windows\INF
2017-06-15 15:37:19 ----AD---- C:\Windows\system32\drivers
2017-06-15 15:37:07 ----SHD---- C:\System Volume Information
2017-06-15 15:35:54 ----D---- C:\Program Files (x86)\Mozilla Maintenance Service
2017-06-14 12:26:56 ----AD---- C:\Program Files (x86)\Blizzard App
2017-06-14 11:41:18 ----AD---- C:\Program Files\Mozilla Firefox
2017-06-14 02:38:37 ----SHD---- C:\Windows\Installer
2017-06-14 02:22:17 ----AD---- C:\Program Files (x86)\Hearthstone
2017-06-11 05:05:58 ----HD---- C:\ProgramData
2017-06-11 04:58:45 ----D---- C:\Windows\system32\WDI
2017-06-11 04:53:20 ----D---- C:\Windows\system32\catroot2
2017-06-11 04:53:01 ----D---- C:\Windows\Tasks
2017-06-11 04:53:01 ----D---- C:\Windows\AutoKMS
2017-06-11 04:28:58 ----D---- C:\Program Files (x86)\Common Files
2017-06-11 04:06:42 ----D---- C:\Program Files\The PC Chiener
2017-06-11 04:06:32 ----D---- C:\Program Files\Checking Downloader
2017-06-11 04:01:57 ----D---- C:\Windows\system32\DriverStore
2017-06-11 04:01:54 ----HD---- C:\Windows\ELAMBKUP
2017-06-05 14:18:41 ----SD---- C:\Users\Master\AppData\Roaming\Microsoft
2017-05-31 20:57:59 ----N---- C:\Windows\system32\MpSigStub.exe
2017-05-22 12:21:12 ----RD---- C:\Windows\assembly
2017-05-22 12:21:07 ----D---- C:\Windows\SysWOW64

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 iorate;@%SystemRoot%\system32\drivers\iorate.sys,-100; C:\Windows\system32\drivers\iorate.sys [2016-11-02 48992]
R1 cryptfd;cryptfd; C:\Windows\system32\drivers\cryptfd.sys [2017-05-25 195496]
R1 eamonm;eamonm; C:\Windows\system32\DRIVERS\eamonm.sys [2017-03-09 132848]
R1 epfwwfpr;epfwwfpr; C:\Windows\system32\DRIVERS\epfwwfpr.sys [2017-03-09 77224]
R1 FileCrypt;@%systemroot%\system32\drivers\filecrypt.sys,-100; C:\Windows\system32\drivers\filecrypt.sys [2016-07-16 88576]
R1 GpuEnergyDrv;@%SystemRoot%\system32\drivers\gpuenergydrv.sys,-100; C:\Windows\System32\drivers\gpuenergydrv.sys [2016-07-16 8192]
R1 MpKsl15fc372a;MpKsl15fc372a; \??\C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{8EDD5F69-A6EA-406D-8EFB-AE39D0DE9AF6}\MpKsl15fc372a.sys [2017-06-17 44928]
R2 clreg;@%SystemRoot%\system32\drivers\registry.sys,-100; C:\Windows\System32\drivers\registry.sys [2016-07-16 70144]
R2 MMCSS;@%systemroot%\system32\drivers\mmcss.sys,-100; C:\Windows\system32\drivers\mmcss.sys [2016-07-16 48128]
R2 storqosflt;@%SystemRoot%\System32\drivers\storqosflt.sys,-101; C:\Windows\system32\drivers\storqosflt.sys [2016-07-16 78336]
R3 iaLPSS2_UART2;@oem6.inf,%iaLPSS2_UART2.SVCDESC%;Intel(R) Serial IO UART Driver v2; C:\Windows\System32\drivers\iaLPSS2_UART2.sys [2016-10-26 287032]
R3 iaLPSS2i_GPIO2;@iaLPSS2i_GPIO2_SKL.inf,%iaLPSS2i_GPIO2.SVCDESC%;Intel(R) Serial IO GPIO Driver v2; C:\Windows\System32\drivers\iaLPSS2i_GPIO2.sys [2016-07-16 64512]
R3 iaLPSS2i_I2C;@iaLPSS2i_I2C_SKL.inf,%iaLPSS2i_I2C.SVCDESC%;Intel(R) Serial IO I2C Driver v2; C:\Windows\System32\drivers\iaLPSS2i_I2C.sys [2016-07-16 176384]
R3 igfx;igfx; C:\Windows\System32\DriverStore\FileRepository\igdlh64.inf_amd64_0745f11ce6fc197c\igdkmd64.sys [2016-11-01 11033056]
R3 IntcDAud;@oem8.inf,%IntcAud.SvcDesc%;Intel(R) Display Audio; C:\Windows\system32\DRIVERS\IntcDAud.sys [2016-09-16 821224]
R3 iwdbus;@oem11.inf,%iwdbus.SVCDESC%;IWD Bus Enumerator; C:\Windows\System32\drivers\iwdbus.sys [2015-12-07 39920]
R3 MEIx64;@oem3.inf,%TEE_SvcDesc%;Intel(R) Management Engine Interface ; C:\Windows\System32\drivers\TeeDriverW8x64.sys [2016-12-02 204920]
R3 rt640x64;@rt640x64.inf,%rt640.Service.DispName%;Realtek RT640 NT Driver; C:\Windows\System32\drivers\rt640x64.sys [2016-07-16 589824]
S0 eelam;eelam; C:\Windows\system32\DRIVERS\eelam.sys [2017-03-09 14880]
S0 LSI_SAS2i;LSI_SAS2i; C:\Windows\System32\drivers\lsi_sas2i.sys [2016-07-16 105824]
S0 LSI_SAS3i;LSI_SAS3i; C:\Windows\System32\drivers\lsi_sas3i.sys [2016-07-16 101216]
S0 megasas2i;megasas2i; C:\Windows\System32\drivers\MegaSas2i.sys [2016-10-05 64352]
S0 percsas2i;percsas2i; C:\Windows\System32\drivers\percsas2i.sys [2016-07-16 58720]
S0 percsas3i;percsas3i; C:\Windows\System32\drivers\percsas3i.sys [2016-07-16 61792]
S0 scmbus;@scmbus.inf,%scmbus.SvcDesc%;Microsoft Storage Class Memory Bus Driver; C:\Windows\System32\drivers\scmbus.sys [2016-07-16 88416]
S0 storufs;@storufs.inf,%UfsServiceDesc%;Microsoft Universal Flash Storage (UFS) Driver; C:\Windows\System32\drivers\storufs.sys [2016-07-16 32096]
S3 AcpiDev;@acpidev.inf,%AcpiDev.SvcDesc%;ACPI Devices driver; C:\Windows\System32\drivers\AcpiDev.sys [2016-07-16 18432]
S3 applockerfltr;@%systemroot%\system32\srpapi.dll,-102; C:\Windows\system32\drivers\applockerfltr.sys [2016-07-16 15360]
S3 AppvStrm;@%systemroot%\system32\drivers\AppvStrm.sys,-101; C:\Windows\system32\drivers\AppvStrm.sys [2016-09-15 127328]
S3 AppvVemgr;@%systemroot%\system32\drivers\AppvVemgr.sys,-101; C:\Windows\system32\drivers\AppvVemgr.sys [2016-07-17 157024]
S3 AppvVfs;@%systemroot%\system32\drivers\AppvVfs.sys,-101; C:\Windows\system32\drivers\AppvVfs.sys [2016-07-17 141152]
S3 bcmfn;@bcmfn.inf,%bcmfn.SVCDESC%;bcmfn Service; C:\Windows\System32\drivers\bcmfn.sys [2016-07-16 9728]
S3 buttonconverter;@buttonconverter.inf,%btnconv.SvcDesc%;Service for Portable Device Control devices; C:\Windows\System32\drivers\buttonconverter.sys [2016-07-16 38912]
S3 CapImg;@capimg.inf,%CapImgHid_Service%;HID driver for CapImg touch screen; C:\Windows\System32\drivers\capimg.sys [2016-09-10 118272]
S3 genericusbfn;@genericusbfn.inf,%genericusbfn.ServiceName%;Generic USB Function Class; C:\Windows\System32\drivers\genericusbfn.sys [2016-07-16 20480]
S3 hidinterrupt;@hidinterrupt.inf,%HID_Interrupt.SvcDesc%;Common Driver for HID Buttons implemented with interrupts; C:\Windows\System32\drivers\hidinterrupt.sys [2016-07-16 50016]
S3 hvservice;@%SystemRoot%\system32\drivers\hvservice.sys,-16; C:\Windows\system32\drivers\hvservice.sys [2016-08-06 73568]
S3 cht4iscsi;cht4iscsi; C:\Windows\System32\drivers\cht4sx64.sys [2016-07-16 346976]
S3 cht4vbd;@cht4vx64.inf,%cht4vbd.generic%;Chelsio Virtual Bus Driver; C:\Windows\System32\drivers\cht4vx64.sys [2016-07-16 2104160]
S3 iagpio;@iagpio.inf,%iagpio.SVCDESC%;Intel Serial IO GPIO Controller Driver; C:\Windows\System32\drivers\iagpio.sys [2016-07-16 33280]
S3 iai2c;@iai2c.inf,%iai2c.SVCDESC%;Intel(R) Serial IO I2C Host Controller; C:\Windows\System32\drivers\iai2c.sys [2016-07-16 81408]
S3 ibbus;@mlx4_bus.inf,%Ibbus.ServiceDesc%;Mellanox InfiniBand Bus/AL (Filter Driver); C:\Windows\System32\drivers\ibbus.sys [2016-07-16 526176]
S3 IndirectKmd;@%SystemRoot%\system32\drivers\IndirectKmd.sys,-100; C:\Windows\System32\drivers\IndirectKmd.sys [2016-07-16 35840]
S3 intaud_WaveExtensible;@oem10.inf,%INTAUD_WEX.SvcDesc%;Intel WiDi Audio Device; C:\Windows\system32\drivers\intelaud.sys [2015-12-07 51704]
S3 irda;IrDA; C:\Windows\system32\drivers\irda.sys [2016-07-16 120320]
S3 mlx4_bus;@mlx4_bus.inf,%MLX4BUS.ServiceDesc%;Mellanox ConnectX Bus Enumerator; C:\Windows\System32\drivers\mlx4_bus.sys [2016-07-16 842584]
S3 MsSecFlt;@%SystemRoot%\System32\Drivers\mssecflt.sys,-1001; C:\Windows\system32\drivers\mssecflt.sys [2016-07-17 179040]
S3 ndfltr;@mlx4_bus.inf,%ndfltr.ServiceDesc%;NetworkDirect Service; C:\Windows\System32\drivers\ndfltr.sys [2016-07-16 108896]
S3 NetAdapterCx;Network Adapter Wdf Class Extension Library; C:\Windows\system32\drivers\NetAdapterCx.sys [2016-07-16 90624]
S3 ReFSv1;ReFSv1; C:\Windows\system32\drivers\ReFSv1.sys [2016-07-16 928608]
S3 scmdisk0101;@scmdisk0101.inf,%scmdisk0101.SvcDesc%;Microsoft NVDIMM-N disk driver; C:\Windows\System32\drivers\scmdisk0101.sys [2016-07-16 123904]
S3 UcmCx0101;USB Connector Manager KMDF Class Extension; C:\Windows\System32\Drivers\UcmCx.sys [2016-07-16 95744]
S3 UcmTcpciCx0101;UCM-TCPCI KMDF Class Extension; C:\Windows\System32\Drivers\UcmTcpciCx.sys [2016-07-16 108544]
S3 UcmUcsi;@UcmUcsi.inf,%UcmUcsi.ServiceName%;USB Connector Manager UCSI Client; C:\Windows\System32\drivers\UcmUcsi.sys [2016-07-16 50688]
S3 UdeCx;USB Device Emulation Support Library; C:\Windows\system32\drivers\udecx.sys [2016-07-16 45568]
S3 Ufx01000;USB Function Class Extension; C:\Windows\system32\drivers\ufx01000.sys [2016-07-16 263008]
S3 UfxChipidea;@ufxchipidea.inf,%UfxChipidea.ServiceName%;USB Chipidea Controller; C:\Windows\System32\drivers\UfxChipidea.sys [2016-07-16 96608]
S3 ufxsynopsys;@ufxsynopsys.inf,%ufxsynopsys.ServiceName%;USB Synopsys Controller; C:\Windows\System32\drivers\ufxsynopsys.sys [2016-07-16 137056]
S3 UrsCx01000;USB Role-Switch Support Library; C:\Windows\system32\drivers\urscx01000.sys [2016-07-16 57696]
S3 UrsChipidea;@urschipidea.inf,%UrsChipidea.ServiceName%;Chipidea USB Role-Switch Driver; C:\Windows\System32\drivers\urschipidea.sys [2016-07-16 28512]
S3 UrsSynopsys;@urssynopsys.inf,%UrsSynopsys.ServiceName%;Synopsys USB Role-Switch Driver; C:\Windows\System32\drivers\urssynopsys.sys [2016-07-16 27488]
S4 UevAgentDriver;@%systemroot%\system32\drivers\UevAgentDriver.sys,-101; C:\Windows\system32\drivers\UevAgentDriver.sys [2016-07-17 40288]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 CDPSvc;@%SystemRoot%\system32\cdpsvc.dll,-100; C:\Windows\system32\svchost.exe [2016-07-16 44496]
R2 CDPUserSvc_258e3;CDPUserSvc_258e3; C:\Windows\system32\svchost.exe [2016-07-16 44496]
R2 CoreMessagingRegistrar;@%SystemRoot%\system32\coremessaging.dll,-1; C:\Windows\system32\svchost.exe [2016-07-16 44496]
R2 DiagTrack;@%SystemRoot%\system32\diagtrack.dll,-3001; C:\Windows\System32\svchost.exe [2016-07-16 44496]
R2 igfxCUIService2.0.0.0;Intel(R) HD Graphics Control Panel Service; C:\Windows\System32\DriverStore\FileRepository\igdlh64.inf_amd64_0745f11ce6fc197c\igfxCUIService.exe [2016-11-01 341984]
R2 IObitUnSvr;IObit Uninstaller Service; C:\Program Files (x86)\IObit\IObit Uninstaller\IUService.exe [2017-03-28 360736]
R2 OneSyncSvc_258e3;Hostitel synchronizace_258e3; C:\Windows\system32\svchost.exe [2016-07-16 44496]
R2 TeamViewer;TeamViewer 12; C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe [2017-05-23 10884848]
R2 tiledatamodelsvc;@%SystemRoot%\system32\tileobjserver.dll,-1; C:\Windows\system32\svchost.exe [2016-07-16 44496]
R3 FontCache3.0.0.0;@%SystemRoot%\system32\PresentationHost.exe,-3309; C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe [2016-05-25 43696]
R3 LicenseManager;@%SystemRoot%\system32\licensemanagersvc.dll,-200; C:\Windows\System32\svchost.exe [2016-07-16 44496]
R3 StateRepository;@%SystemRoot%\system32\windows.staterepository.dll,-1; C:\Windows\system32\svchost.exe [2016-07-16 44496]
R3 TimeBrokerSvc;@%windir%\system32\TimeBrokerServer.dll,-1001; C:\Windows\system32\svchost.exe [2016-07-16 44496]
S2 CDPUserSvc;@%SystemRoot%\system32\cdpusersvc.dll,-100; C:\Windows\system32\svchost.exe [2016-07-16 44496]
S2 DoSvc;@%systemroot%\system32\dosvc.dll,-100; C:\Windows\system32\svchost.exe [2016-07-16 44496]
S2 ekrn;ESET Service; C:\Program Files\ESET\ESET Security\ekrn.exe []
S2 MapsBroker;@%SystemRoot%\System32\moshost.dll,-100; C:\Windows\System32\svchost.exe [2016-07-16 44496]
S2 OneSyncSvc;@%SystemRoot%\system32\APHostRes.dll,-10002; C:\Windows\system32\svchost.exe [2016-07-16 44496]
S3 AJRouter;@%SystemRoot%\system32\AJRouter.dll,-2; C:\Windows\system32\svchost.exe [2016-07-16 44496]
S3 BthHFSrv;@%SystemRoot%\System32\BthHFSrv.dll,-103; C:\Windows\System32\svchost.exe [2016-07-16 44496]
S3 ClipSVC;@%SystemRoot%\system32\ClipSVC.dll,-103; C:\Windows\System32\svchost.exe [2016-07-16 44496]
S3 cphs;Intel(R) Content Protection HECI Service; C:\Windows\System32\DriverStore\FileRepository\igdlh64.inf_amd64_0745f11ce6fc197c\IntelCpHeciSvc.exe [2016-11-01 301536]
S3 cplspcon;Intel(R) Content Protection HDCP Service; C:\Windows\System32\DriverStore\FileRepository\igdlh64.inf_amd64_0745f11ce6fc197c\IntelCpHDCPSvc.exe [2016-11-01 480224]
S3 DcpSvc;@%SystemRoot%\system32\dcpsvc.dll,-3001; C:\Windows\System32\svchost.exe [2016-07-16 44496]
S3 DevQueryBroker;@%SystemRoot%\system32\DevQueryBroker.dll,-100; C:\Windows\system32\svchost.exe [2016-07-16 44496]
S3 diagnosticshub.standardcollector.service;@%SystemRoot%\system32\DiagSvcs\DiagnosticsHub.StandardCollector.ServiceRes.dll,-1000; C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe [2016-07-16 93184]
S3 DmEnrollmentSvc;@%systemroot%\system32\Windows.Internal.Management.dll,-100; C:\Windows\system32\svchost.exe [2016-07-16 44496]
S3 dmwappushservice;@%SystemRoot%\system32\dmwappushsvc.dll,-200; C:\Windows\system32\svchost.exe [2016-07-16 44496]
S3 DsSvc;@%SystemRoot%\system32\dssvc.dll,-10003; C:\Windows\System32\svchost.exe [2016-07-16 44496]
S3 embeddedmode;@%SystemRoot%\system32\embeddedmodesvc.dll,-201; C:\Windows\System32\svchost.exe [2016-07-16 44496]
S3 EntAppSvc;@EnterpriseAppMgmtSvc.dll,-1; C:\Windows\system32\svchost.exe [2016-07-16 44496]
S3 FrameServer;@%systemroot%\system32\FrameServer.dll,-100; C:\Windows\System32\svchost.exe [2016-07-16 44496]
S3 HvHost;@%SystemRoot%\system32\hvhostsvc.dll,-100; C:\Windows\system32\svchost.exe [2016-07-16 44496]
S3 icssvc;@%SystemRoot%\System32\tetheringservice.dll,-4097; C:\Windows\system32\svchost.exe [2016-07-16 44496]
S3 irmon;@%SystemRoot%\System32\irmon.dll,-2000; C:\Windows\system32\svchost.exe [2016-07-16 44496]
S3 MessagingService;@%SystemRoot%\system32\MessagingService.dll,-100; C:\Windows\system32\svchost.exe [2016-07-16 44496]
S3 MessagingService_258e3;Služba zasílání zpráv_258e3; C:\Windows\system32\svchost.exe [2016-07-16 44496]
S3 MozillaMaintenance;Mozilla Maintenance Service; C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2017-06-14 193992]
S3 NetSetupSvc;@%SystemRoot%\system32\NetSetupSvc.dll,-3; C:\Windows\System32\svchost.exe [2016-07-16 44496]
S3 NgcCtnrSvc;@%SystemRoot%\System32\NgcCtnrSvc.dll,-1; C:\Windows\system32\svchost.exe [2016-07-16 44496]
S3 NgcSvc;@%SystemRoot%\System32\ngcsvc.dll,-100; C:\Windows\system32\svchost.exe [2016-07-16 44496]
S3 PhoneSvc;@%SystemRoot%\system32\PhoneserviceRes.dll,-10000; C:\Windows\system32\svchost.exe [2016-07-16 44496]
S3 PimIndexMaintenanceSvc;@%SystemRoot%\system32\UserDataAccessRes.dll,-15001; C:\Windows\system32\svchost.exe [2016-07-16 44496]
S3 PimIndexMaintenanceSvc_258e3;Data kontaktů_258e3; C:\Windows\system32\svchost.exe [2016-07-16 44496]
S3 RetailDemo;@%SystemRoot%\System32\RDXService.dll,-256; C:\Windows\System32\svchost.exe [2016-07-16 44496]
S3 RmSvc;@%SystemRoot%\system32\RMapi.dll,-1001; C:\Windows\System32\svchost.exe [2016-07-16 44496]
S3 Sense;@%ProgramFiles%\Windows Defender Advanced Threat Protection\MsSense.exe,-1001; C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe [2016-09-15 2889896]
S3 SensorDataService;@%SystemRoot%\system32\SensorDataService.exe,-101; C:\Windows\System32\SensorDataService.exe [2017-03-04 1312768]
S3 SensorService;@%SystemRoot%\System32\sensorservice.dll,-1000; C:\Windows\system32\svchost.exe [2016-07-16 44496]
S3 SmsRouter;@%SystemRoot%\System32\SmsRouterSvc.dll,-10001; C:\Windows\system32\svchost.exe [2016-07-16 44496]
S3 TieringEngineService;@%SystemRoot%\system32\TieringEngineService.exe,-702; C:\Windows\system32\TieringEngineService.exe [2016-07-16 287744]
S3 UnistoreSvc;@%SystemRoot%\system32\UserDataAccessRes.dll,-10003; C:\Windows\System32\svchost.exe [2016-07-16 44496]
S3 UnistoreSvc_258e3;Úložiště uživatelských dat_258e3; C:\Windows\System32\svchost.exe [2016-07-16 44496]
S4 AppVClient;@%systemroot%\system32\AppVClient.exe,-102; C:\Windows\system32\AppVClient.exe [2016-12-14 822624]
S4 shpamsvc;@%SystemRoot%\System32\Windows.SharedPC.AccountManager.dll,-100; C:\Windows\System32\svchost.exe [2016-07-16 44496]
S4 tzautoupdate;@%SystemRoot%\system32\tzautoupdate.dll,-200; C:\Windows\system32\svchost.exe [2016-07-16 44496]
S4 UCBrowserSvc;UC浏览器基础服务; C:\Program Files (x86)\UCBrowser\Application\UCService.exe []
S4 UevAgentService;@%systemroot%\system32\AgentService.exe,-102; C:\Windows\system32\AgentService.exe [2016-07-17 1227264]

-----------------EOF-----------------



Predem diky za tipy.

Jeste jsem cistil AdwCleanerem, tady log:

# AdwCleaner v6.047 - Log vytvořen 17/06/2017 v 23:51:45
# Aktualizováno dne 19/05/2017 z Malwarebytes
# Databáze : 2017-06-16.2 [Server]
# Operační systém : Windows 10 Pro (X64)
# Uživatelské jméno : Master - DOMA
# Spuštěno z : C:\Users\Master\Desktop\ČISTICI UTILITY\AdwCleaner.exe
# Mod: Čištění
# Podpora : https://www.malwarebytes.com/support



***** [ Služby ] *****



***** [ Složky ] *****

[-] Složka smazána: C:\Users\Master\AppData\Roaming\IObit\Advanced SystemCare


***** [ Soubory ] *****

[#] Soubor smazán: C:\Windows\SysNative\DRIVERS:UCDRV-X64.SYS
[#] Soubor smazán: C:\Windows\SysNative\DRIVERS:X64
[#] Soubor smazán: C:\Windows\SysNative\DRIVERS:X86


***** [ DLL ] *****



***** [ WMI ] *****



***** [ Zástupci ] *****



***** [ Naplánované úlohy ] *****



***** [ Registry ] *****



***** [ Prohlížeče ] *****



*************************

:: "Tracing" klíče smazány
:: Winsock nastavení vyčištěno

*************************

C:\AdwCleaner\AdwCleaner[C0].txt - [22388 Bajty] - [11/06/2017 05:04:50]
C:\AdwCleaner\AdwCleaner[C2].txt - [1127 Bajty] - [17/06/2017 23:51:45]
C:\AdwCleaner\AdwCleaner[S0].txt - [19552 Bajty] - [11/06/2017 05:00:47]
C:\AdwCleaner\AdwCleaner[S1].txt - [19557 Bajty] - [11/06/2017 05:04:13]
C:\AdwCleaner\AdwCleaner[S2].txt - [1738 Bajty] - [17/06/2017 23:49:52]

########## EOF - C:\AdwCleaner\AdwCleaner[C2].txt - [1421 Bajty] ##########









Po tom jsem zase rozjel RSIT, tady log:




Logfile of random's system information tool 1.10 (written by random/random)
Run by Master at 2017-06-18 00:15:40
Microsoft Windows 10 Pro
System drive C: has 153 GB (67%) free of 228 GB
Total RAM: 8102 MB (81% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 0:15:41, on 18.06.2017
Platform: Unknown Windows (WinNT 6.02.1008)
MSIE: Internet Explorer v11.0 (11.00.14393.0953)
Boot mode: Normal

Running processes:
C:\Program Files (x86)\TeamViewer\TeamViewer.exe
C:\Program Files\trend micro\Master.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/p/?LinkId=255141
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/p/?LinkId=255141
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/p/?LinkId=255141
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = %11%\blank.htm
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F2 - REG:system.ini: UserInit=
O4 - HKUS\S-1-5-19\..\Run: [OneDriveSetup] C:\Windows\SysWOW64\OneDriveSetup.exe /thfirstsetup (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [OneDriveSetup] C:\Windows\SysWOW64\OneDriveSetup.exe /thfirstsetup (User 'NETWORK SERVICE')
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O15 - Trusted Zone: http://help.eset.com (HKLM)
O15 - ESC Trusted Zone: http://help.eset.com (HKLM)
O18 - Protocol: tbauth - {14654CA6-5711-491D-B89A-58E571679951} - C:\Windows\SysWOW64\tbauth.dll
O18 - Protocol: windows.tbauth - {14654CA6-5711-491D-B89A-58E571679951} - C:\Windows\SysWOW64\tbauth.dll
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: Intel(R) Content Protection HECI Service (cphs) - Intel Corporation - C:\Windows\System32\DriverStore\FileRepository\igdlh64.inf_amd64_0745f11ce6fc197c\IntelCpHeciSvc.exe
O23 - Service: Intel(R) Content Protection HDCP Service (cplspcon) - Intel Corporation - C:\Windows\System32\DriverStore\FileRepository\igdlh64.inf_amd64_0745f11ce6fc197c\IntelCpHDCPSvc.exe
O23 - Service: @%SystemRoot%\system32\DiagSvcs\DiagnosticsHub.StandardCollector.ServiceRes.dll,-1000 (diagnosticshub.standardcollector.service) - Unknown owner - C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe (file missing)
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: ESET Service (ekrn) - Unknown owner - C:\Program Files\ESET\ESET Security\ekrn.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: Intel(R) HD Graphics Control Panel Service (igfxCUIService2.0.0.0) - Intel Corporation - C:\Windows\System32\DriverStore\FileRepository\igdlh64.inf_amd64_0745f11ce6fc197c\igfxCUIService.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%ProgramFiles%\Windows Defender Advanced Threat Protection\MsSense.exe,-1001 (Sense) - Unknown owner - C:\Program Files (x86)\Windows Defender Advanced Threat Protection\MsSense.exe (file missing)
O23 - Service: @%SystemRoot%\system32\SensorDataService.exe,-101 (SensorDataService) - Unknown owner - C:\Windows\System32\SensorDataService.exe (file missing)
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: TeamViewer 12 (TeamViewer) - TeamViewer GmbH - C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
O23 - Service: @%SystemRoot%\system32\TieringEngineService.exe,-702 (TieringEngineService) - Unknown owner - C:\Windows\system32\TieringEngineService.exe (file missing)
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%ProgramFiles%\Windows Defender\MpAsDesc.dll,-320 (WdNisSvc) - Unknown owner - C:\Program Files (x86)\Windows Defender\NisSrv.exe (file missing)
O23 - Service: @%ProgramFiles%\Windows Defender\MpAsDesc.dll,-310 (WinDefend) - Unknown owner - C:\Program Files (x86)\Windows Defender\MsMpEng.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--
End of file - 6499 bytes

======Listing Processes======







winlogon.exe

C:\Windows\system32\lsass.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k RPCSS
"dwm.exe"
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\system32\svchost.exe -k LocalService
"C:\Windows\System32\WUDFHost.exe" -HostGUID:{193a1820-d9ac-4997-8c55-be817523f6aa} -IoEventPortName:HostProcess-ba436374-4baa-4ed7-8865-bf28a196679d -SystemEventPortName:HostProcess-f3a98232-d908-49b3-9090-9ff371c81286 -IoCancelEventPortName:HostProcess-47e6f5eb-ee3d-45a3-9d4a-13c64eef78ed -NonStateChangingEventPortName:HostProcess-6fb5ea5f-a9cf-498a-b1a9-087767978892 -ServiceSID:S-1-5-80-2652678385-582572993-1835434367-1344795993-749280709 -LifetimeId:a87c4cc3-3524-4865-a234-526d745a4a89 -DeviceGroupId:WpdFsGroup
C:\Windows\System32\svchost.exe -k NetworkService
C:\Windows\System32\DriverStore\FileRepository\igdlh64.inf_amd64_0745f11ce6fc197c\igfxCUIService.exe
C:\Windows\system32\rundll32.exe "C:\Program Files\The PC Chiener\The PC Chiener.dll",OQvuPagcvMEF
C:\Windows\system32\rundll32.exe "C:\Program Files\Checking Downloader\Checking Downloader.dll",qvzDzvS
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Windows\System32\svchost.exe -k utcsvc
C:\Windows\system32\svchost.exe -k imgsvc
C:\Windows\system32\svchost.exe -k appmodel
"C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe"


dashost.exe {d7f896d4-c95b-472a-bbaeb58e76842d30}
C:\Windows\system32\SearchIndexer.exe /Embedding
sihost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup
C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
C:\Windows\System32\RuntimeBroker.exe -Embedding
C:\Windows\Explorer.EXE
"C:\Windows\System32\DriverStore\FileRepository\igdlh64.inf_amd64_0745f11ce6fc197c\igfxEM.exe"
"C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mca
"C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca

"C:\Program Files (x86)\TeamViewer\TeamViewer.exe"
"C:\Program Files (x86)\TeamViewer\tv_w32.exe" --action hooks --log C:\Program Files (x86)\TeamViewer\TeamViewer12_Logfile.log
"C:\Program Files (x86)\TeamViewer\tv_x64.exe" --action hooks --log C:\Program Files (x86)\TeamViewer\TeamViewer12_Logfile.log
"c:\program files (x86)\teamviewer\TeamViewer_Desktop.exe" --IPCport 5939
"C:\Program Files\Windows Defender\MSASCuiL.exe"
C:\Windows\system32\ApplicationFrameHost.exe -Embedding
"C:\Program Files\WindowsApps\Microsoft.Windows.Photos_17.524.10020.0_x64__8wekyb3d8bbwe\Microsoft.Photos.exe" -ServerName:App.AppXzst44mncqdg84v7sv6p7yznqwssy6f7f.mca
"C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1705.1301.0_x64__8wekyb3d8bbwe\Calculator.exe" -ServerName:App.AppXsm3pg4n7er43kdh1qp4e79f1j7am68r8.mca
"C:\Windows\ImmersiveControlPanel\SystemSettings.exe" -ServerName:microsoft.windows.immersivecontrolpanel
"C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.17042.14211.0_x64__8wekyb3d8bbwe\Video.UI.exe" -ServerName:Microsoft.ZuneVideo.AppX758ya5sqdjd98rx6z7g95nw6jy7bqx9y.mca
C:\Windows\system32\DllHost.exe /Processid:{49F6E667-6658-4BD1-9DE9-6AF87F9FAF85}
C:\Windows\system32\AUDIODG.EXE 0x30c
C:\Windows\system32\DllHost.exe /Processid:{E10F6C3A-F1AE-4ADC-AA9D-2FE65525666E}
C:\Windows\system32\DllHost.exe /Processid:{E10F6C3A-F1AE-4ADC-AA9D-2FE65525666E}
"C:\Users\Master\Desktop\ČISTICI UTILITY\RSITx64.exe"
C:\Windows\system32\wbem\wmiprvse.exe

=========Mozilla firefox=========

ProfilePath - C:\Users\Master\AppData\Roaming\Mozilla\Firefox\Profiles\v8rbm51q.default

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 25.0.0.171 Plugin
"Path"=C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_25_0_0_171.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@videolan.org/vlc,version=2.2.3]
"Description"=VLC Multimedia Plugin
"Path"=C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll


[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 25.0.0.171 Plugin
"Path"=C:\Windows\system32\Macromed\Flash\NPSWF64_25_0_0_171.dll


======Registry dump======

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"WindowsDefender"=C:\Program Files\Windows Defender\MSASCuiL.exe [2017-03-28 631808]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Ahcache.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\CoreMessagingRegistrar]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\hitmanpro37]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\hitmanpro37.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\HitmanPro37Crusader]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\HitmanPro37CrusaderBoot]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\iai2c.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SpbCx.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\StateRepository]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\TileDataModelSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\uefi.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\UserManager]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{F2E7DD72-6468-4E36-B6F1-6488F42C1B52}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Ahcache.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\CoreMessagingRegistrar]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\hitmanpro37]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\hitmanpro37.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\HitmanPro37Crusader]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\HitmanPro37CrusaderBoot]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\SpbCx.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\StateRepository]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\TileDataModelSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\uefi.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\UserManager]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{F2E7DD72-6468-4E36-B6F1-6488F42C1B52}]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"DSCAutomationHostEnabled"=2

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"midimapper"=midimap.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.l3acm"=C:\Windows\System32\l3codeca.acm
"msacm.msadpcm"=msadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"vidc.i420"=iyuv_32.dll
"vidc.iyuv"=iyuv_32.dll
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"vidc.uyvy"=msyuv.dll
"vidc.yuy2"=msyuv.dll
"vidc.yvu9"=tsbyuv.dll
"vidc.yvyu"=msyuv.dll
"wavemapper"=msacm32.drv
"wave1"=wdmaud.drv
"midi1"=wdmaud.drv
"mixer1"=wdmaud.drv
"aux1"=wdmaud.drv
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*

======List of files/folders created in the last 1 month======

2017-06-17 23:39:52 ----D---- C:\rsit
2017-06-17 23:39:52 ----D---- C:\Program Files\trend micro
2017-06-17 19:00:18 ----D---- C:\Users\Master\AppData\Roaming\TeamViewer
2017-06-17 15:48:15 ----D---- C:\Program Files (x86)\TeamViewer
2017-06-16 16:35:08 ----D---- C:\Windows\Minidump
2017-06-11 05:15:00 ----D---- C:\Users\Master\AppData\Roaming\ESET
2017-06-11 05:12:35 ----D---- C:\Users\Master\AppData\Roaming\WinRAR
2017-06-11 05:12:02 ----AD---- C:\Program Files\WinRAR
2017-06-11 05:07:58 ----A---- C:\Windows\system32\bootdelete.exe
2017-06-11 05:06:22 ----A---- C:\Windows\system32\drivers\hitmanpro37.sys
2017-06-11 05:05:58 ----D---- C:\ProgramData\HitmanPro
2017-06-11 05:05:13 ----ASH---- C:\swapfile.sys
2017-06-11 04:59:40 ----D---- C:\AdwCleaner
2017-06-11 04:51:41 ----A---- C:\Windows\system32\drivers\zamguard64.sys
2017-06-11 04:28:53 ----D---- C:\ProgramData\ProductData
2017-06-11 04:28:46 ----D---- C:\Program Files (x86)\IObit
2017-06-11 04:28:38 ----D---- C:\Users\Master\AppData\Roaming\IObit
2017-06-11 04:28:38 ----D---- C:\ProgramData\IObit
2017-06-11 04:01:42 ----D---- C:\ProgramData\ESET
2017-06-11 04:01:42 ----D---- C:\Program Files\ESET
2017-06-11 03:56:31 ----A---- C:\Windows\system32\drivers\vcdrom.sys
2017-06-11 03:56:20 ----D---- C:\Program Files (x86)\mgdisk
2017-06-11 03:11:18 ----D---- C:\Users\Master\AppData\Roaming\uTorrent
2017-06-08 09:23:41 ----AD---- C:\Program Files (x86)\Copay
2017-05-28 20:02:34 ----D---- C:\Program Files (x86)\Seznam.cz
2017-05-28 20:02:23 ----D---- C:\Users\Master\AppData\Roaming\Seznam.cz
2017-05-25 03:43:54 ----A---- C:\Windows\system32\drivers\cryptfd.sys
2017-05-22 12:22:47 ----D---- C:\Users\Master\AppData\Roaming\LibreOffice
2017-05-22 12:20:55 ----AD---- C:\Program Files (x86)\LibreOffice 5

======List of files/folders modified in the last 1 month======

2017-06-18 00:12:49 ----D---- C:\Windows\Temp
2017-06-18 00:12:49 ----D---- C:\Windows\system32\SleepStudy
2017-06-17 23:56:30 ----D---- C:\Windows\System32
2017-06-17 23:56:30 ----A---- C:\Windows\system32\PerfStringBackup.INI
2017-06-17 23:53:00 ----D---- C:\Windows\Prefetch
2017-06-17 23:52:20 ----D---- C:\Windows\system32\sru
2017-06-17 23:52:17 ----D---- C:\Windows
2017-06-17 23:45:36 ----D---- C:\Windows\Tasks
2017-06-17 23:45:36 ----D---- C:\Windows\system32\Tasks
2017-06-17 23:39:52 ----RD---- C:\Program Files
2017-06-17 19:00:19 ----RSD---- C:\Windows\Fonts
2017-06-17 18:21:06 ----D---- C:\Windows\AppReadiness
2017-06-17 17:00:16 ----HD---- C:\Program Files\WindowsApps
2017-06-17 15:48:15 ----RD---- C:\Program Files (x86)
2017-06-17 12:39:20 ----D---- C:\Users\Master\AppData\Roaming\vlc
2017-06-16 21:13:01 ----RD---- C:\Windows\Microsoft.NET
2017-06-16 16:35:15 ----D---- C:\Windows\INF
2017-06-15 15:37:19 ----AD---- C:\Windows\system32\drivers
2017-06-15 15:37:07 ----SHD---- C:\System Volume Information
2017-06-15 15:35:54 ----D---- C:\Program Files (x86)\Mozilla Maintenance Service
2017-06-14 12:26:56 ----AD---- C:\Program Files (x86)\Blizzard App
2017-06-14 11:41:18 ----AD---- C:\Program Files\Mozilla Firefox
2017-06-14 02:38:37 ----SHD---- C:\Windows\Installer
2017-06-14 02:22:17 ----AD---- C:\Program Files (x86)\Hearthstone
2017-06-11 05:05:58 ----HD---- C:\ProgramData
2017-06-11 04:58:45 ----D---- C:\Windows\system32\WDI
2017-06-11 04:53:20 ----D---- C:\Windows\system32\catroot2
2017-06-11 04:53:01 ----D---- C:\Windows\AutoKMS
2017-06-11 04:28:58 ----D---- C:\Program Files (x86)\Common Files
2017-06-11 04:06:42 ----D---- C:\Program Files\The PC Chiener
2017-06-11 04:06:32 ----D---- C:\Program Files\Checking Downloader
2017-06-11 04:01:57 ----D---- C:\Windows\system32\DriverStore
2017-06-11 04:01:54 ----HD---- C:\Windows\ELAMBKUP
2017-06-05 14:18:41 ----SD---- C:\Users\Master\AppData\Roaming\Microsoft
2017-05-31 20:57:59 ----N---- C:\Windows\system32\MpSigStub.exe
2017-05-22 12:21:12 ----RD---- C:\Windows\assembly
2017-05-22 12:21:07 ----D---- C:\Windows\SysWOW64

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 iorate;@%SystemRoot%\system32\drivers\iorate.sys,-100; C:\Windows\system32\drivers\iorate.sys [2016-11-02 48992]
R1 cryptfd;cryptfd; C:\Windows\system32\drivers\cryptfd.sys [2017-05-25 195496]
R1 eamonm;eamonm; C:\Windows\system32\DRIVERS\eamonm.sys [2017-03-09 132848]
R1 epfwwfpr;epfwwfpr; C:\Windows\system32\DRIVERS\epfwwfpr.sys [2017-03-09 77224]
R1 FileCrypt;@%systemroot%\system32\drivers\filecrypt.sys,-100; C:\Windows\system32\drivers\filecrypt.sys [2016-07-16 88576]
R1 GpuEnergyDrv;@%SystemRoot%\system32\drivers\gpuenergydrv.sys,-100; C:\Windows\System32\drivers\gpuenergydrv.sys [2016-07-16 8192]
R2 clreg;@%SystemRoot%\system32\drivers\registry.sys,-100; C:\Windows\System32\drivers\registry.sys [2016-07-16 70144]
R2 MMCSS;@%systemroot%\system32\drivers\mmcss.sys,-100; C:\Windows\system32\drivers\mmcss.sys [2016-07-16 48128]
R2 storqosflt;@%SystemRoot%\System32\drivers\storqosflt.sys,-101; C:\Windows\system32\drivers\storqosflt.sys [2016-07-16 78336]
R3 iaLPSS2_UART2;@oem6.inf,%iaLPSS2_UART2.SVCDESC%;Intel(R) Serial IO UART Driver v2; C:\Windows\System32\drivers\iaLPSS2_UART2.sys [2016-10-26 287032]
R3 iaLPSS2i_GPIO2;@iaLPSS2i_GPIO2_SKL.inf,%iaLPSS2i_GPIO2.SVCDESC%;Intel(R) Serial IO GPIO Driver v2; C:\Windows\System32\drivers\iaLPSS2i_GPIO2.sys [2016-07-16 64512]
R3 iaLPSS2i_I2C;@iaLPSS2i_I2C_SKL.inf,%iaLPSS2i_I2C.SVCDESC%;Intel(R) Serial IO I2C Driver v2; C:\Windows\System32\drivers\iaLPSS2i_I2C.sys [2016-07-16 176384]
R3 igfx;igfx; C:\Windows\System32\DriverStore\FileRepository\igdlh64.inf_amd64_0745f11ce6fc197c\igdkmd64.sys [2016-11-01 11033056]
R3 IntcDAud;@oem8.inf,%IntcAud.SvcDesc%;Intel(R) Display Audio; C:\Windows\system32\DRIVERS\IntcDAud.sys [2016-09-16 821224]
R3 iwdbus;@oem11.inf,%iwdbus.SVCDESC%;IWD Bus Enumerator; C:\Windows\System32\drivers\iwdbus.sys [2015-12-07 39920]
R3 MEIx64;@oem3.inf,%TEE_SvcDesc%;Intel(R) Management Engine Interface ; C:\Windows\System32\drivers\TeeDriverW8x64.sys [2016-12-02 204920]
R3 rt640x64;@rt640x64.inf,%rt640.Service.DispName%;Realtek RT640 NT Driver; C:\Windows\System32\drivers\rt640x64.sys [2016-07-16 589824]
S0 eelam;eelam; C:\Windows\system32\DRIVERS\eelam.sys [2017-03-09 14880]
S0 LSI_SAS2i;LSI_SAS2i; C:\Windows\System32\drivers\lsi_sas2i.sys [2016-07-16 105824]
S0 LSI_SAS3i;LSI_SAS3i; C:\Windows\System32\drivers\lsi_sas3i.sys [2016-07-16 101216]
S0 megasas2i;megasas2i; C:\Windows\System32\drivers\MegaSas2i.sys [2016-10-05 64352]
S0 percsas2i;percsas2i; C:\Windows\System32\drivers\percsas2i.sys [2016-07-16 58720]
S0 percsas3i;percsas3i; C:\Windows\System32\drivers\percsas3i.sys [2016-07-16 61792]
S0 scmbus;@scmbus.inf,%scmbus.SvcDesc%;Microsoft Storage Class Memory Bus Driver; C:\Windows\System32\drivers\scmbus.sys [2016-07-16 88416]
S0 storufs;@storufs.inf,%UfsServiceDesc%;Microsoft Universal Flash Storage (UFS) Driver; C:\Windows\System32\drivers\storufs.sys [2016-07-16 32096]
S3 AcpiDev;@acpidev.inf,%AcpiDev.SvcDesc%;ACPI Devices driver; C:\Windows\System32\drivers\AcpiDev.sys [2016-07-16 18432]
S3 applockerfltr;@%systemroot%\system32\srpapi.dll,-102; C:\Windows\system32\drivers\applockerfltr.sys [2016-07-16 15360]
S3 AppvStrm;@%systemroot%\system32\drivers\AppvStrm.sys,-101; C:\Windows\system32\drivers\AppvStrm.sys [2016-09-15 127328]
S3 AppvVemgr;@%systemroot%\system32\drivers\AppvVemgr.sys,-101; C:\Windows\system32\drivers\AppvVemgr.sys [2016-07-17 157024]
S3 AppvVfs;@%systemroot%\system32\drivers\AppvVfs.sys,-101; C:\Windows\system32\drivers\AppvVfs.sys [2016-07-17 141152]
S3 bcmfn;@bcmfn.inf,%bcmfn.SVCDESC%;bcmfn Service; C:\Windows\System32\drivers\bcmfn.sys [2016-07-16 9728]
S3 buttonconverter;@buttonconverter.inf,%btnconv.SvcDesc%;Service for Portable Device Control devices; C:\Windows\System32\drivers\buttonconverter.sys [2016-07-16 38912]
S3 CapImg;@capimg.inf,%CapImgHid_Service%;HID driver for CapImg touch screen; C:\Windows\System32\drivers\capimg.sys [2016-09-10 118272]
S3 genericusbfn;@genericusbfn.inf,%genericusbfn.ServiceName%;Generic USB Function Class; C:\Windows\System32\drivers\genericusbfn.sys [2016-07-16 20480]
S3 hidinterrupt;@hidinterrupt.inf,%HID_Interrupt.SvcDesc%;Common Driver for HID Buttons implemented with interrupts; C:\Windows\System32\drivers\hidinterrupt.sys [2016-07-16 50016]
S3 hvservice;@%SystemRoot%\system32\drivers\hvservice.sys,-16; C:\Windows\system32\drivers\hvservice.sys [2016-08-06 73568]
S3 cht4iscsi;cht4iscsi; C:\Windows\System32\drivers\cht4sx64.sys [2016-07-16 346976]
S3 cht4vbd;@cht4vx64.inf,%cht4vbd.generic%;Chelsio Virtual Bus Driver; C:\Windows\System32\drivers\cht4vx64.sys [2016-07-16 2104160]
S3 iagpio;@iagpio.inf,%iagpio.SVCDESC%;Intel Serial IO GPIO Controller Driver; C:\Windows\System32\drivers\iagpio.sys [2016-07-16 33280]
S3 iai2c;@iai2c.inf,%iai2c.SVCDESC%;Intel(R) Serial IO I2C Host Controller; C:\Windows\System32\drivers\iai2c.sys [2016-07-16 81408]
S3 ibbus;@mlx4_bus.inf,%Ibbus.ServiceDesc%;Mellanox InfiniBand Bus/AL (Filter Driver); C:\Windows\System32\drivers\ibbus.sys [2016-07-16 526176]
S3 IndirectKmd;@%SystemRoot%\system32\drivers\IndirectKmd.sys,-100; C:\Windows\System32\drivers\IndirectKmd.sys [2016-07-16 35840]
S3 intaud_WaveExtensible;@oem10.inf,%INTAUD_WEX.SvcDesc%;Intel WiDi Audio Device; C:\Windows\system32\drivers\intelaud.sys [2015-12-07 51704]
S3 irda;IrDA; C:\Windows\system32\drivers\irda.sys [2016-07-16 120320]
S3 mlx4_bus;@mlx4_bus.inf,%MLX4BUS.ServiceDesc%;Mellanox ConnectX Bus Enumerator; C:\Windows\System32\drivers\mlx4_bus.sys [2016-07-16 842584]
S3 MsSecFlt;@%SystemRoot%\System32\Drivers\mssecflt.sys,-1001; C:\Windows\system32\drivers\mssecflt.sys [2016-07-17 179040]
S3 ndfltr;@mlx4_bus.inf,%ndfltr.ServiceDesc%;NetworkDirect Service; C:\Windows\System32\drivers\ndfltr.sys [2016-07-16 108896]
S3 NetAdapterCx;Network Adapter Wdf Class Extension Library; C:\Windows\system32\drivers\NetAdapterCx.sys [2016-07-16 90624]
S3 ReFSv1;ReFSv1; C:\Windows\system32\drivers\ReFSv1.sys [2016-07-16 928608]
S3 scmdisk0101;@scmdisk0101.inf,%scmdisk0101.SvcDesc%;Microsoft NVDIMM-N disk driver; C:\Windows\System32\drivers\scmdisk0101.sys [2016-07-16 123904]
S3 UcmCx0101;USB Connector Manager KMDF Class Extension; C:\Windows\System32\Drivers\UcmCx.sys [2016-07-16 95744]
S3 UcmTcpciCx0101;UCM-TCPCI KMDF Class Extension; C:\Windows\System32\Drivers\UcmTcpciCx.sys [2016-07-16 108544]
S3 UcmUcsi;@UcmUcsi.inf,%UcmUcsi.ServiceName%;USB Connector Manager UCSI Client; C:\Windows\System32\drivers\UcmUcsi.sys [2016-07-16 50688]
S3 UdeCx;USB Device Emulation Support Library; C:\Windows\system32\drivers\udecx.sys [2016-07-16 45568]
S3 Ufx01000;USB Function Class Extension; C:\Windows\system32\drivers\ufx01000.sys [2016-07-16 263008]
S3 UfxChipidea;@ufxchipidea.inf,%UfxChipidea.ServiceName%;USB Chipidea Controller; C:\Windows\System32\drivers\UfxChipidea.sys [2016-07-16 96608]
S3 ufxsynopsys;@ufxsynopsys.inf,%ufxsynopsys.ServiceName%;USB Synopsys Controller; C:\Windows\System32\drivers\ufxsynopsys.sys [2016-07-16 137056]
S3 UrsCx01000;USB Role-Switch Support Library; C:\Windows\system32\drivers\urscx01000.sys [2016-07-16 57696]
S3 UrsChipidea;@urschipidea.inf,%UrsChipidea.ServiceName%;Chipidea USB Role-Switch Driver; C:\Windows\System32\drivers\urschipidea.sys [2016-07-16 28512]
S3 UrsSynopsys;@urssynopsys.inf,%UrsSynopsys.ServiceName%;Synopsys USB Role-Switch Driver; C:\Windows\System32\drivers\urssynopsys.sys [2016-07-16 27488]
S4 UevAgentDriver;@%systemroot%\system32\drivers\UevAgentDriver.sys,-101; C:\Windows\system32\drivers\UevAgentDriver.sys [2016-07-17 40288]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 CDPUserSvc_2e753;CDPUserSvc_2e753; C:\Windows\system32\svchost.exe [2016-07-16 44496]
R2 CoreMessagingRegistrar;@%SystemRoot%\system32\coremessaging.dll,-1; C:\Windows\system32\svchost.exe [2016-07-16 44496]
R2 DiagTrack;@%SystemRoot%\system32\diagtrack.dll,-3001; C:\Windows\System32\svchost.exe [2016-07-16 44496]
R2 igfxCUIService2.0.0.0;Intel(R) HD Graphics Control Panel Service; C:\Windows\System32\DriverStore\FileRepository\igdlh64.inf_amd64_0745f11ce6fc197c\igfxCUIService.exe [2016-11-01 341984]
R2 OneSyncSvc_2e753;Hostitel synchronizace_2e753; C:\Windows\system32\svchost.exe [2016-07-16 44496]
R2 TeamViewer;TeamViewer 12; C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe [2017-05-23 10884848]
R2 tiledatamodelsvc;@%SystemRoot%\system32\tileobjserver.dll,-1; C:\Windows\system32\svchost.exe [2016-07-16 44496]
R3 FontCache3.0.0.0;@%SystemRoot%\system32\PresentationHost.exe,-3309; C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe [2016-05-25 43696]
R3 StateRepository;@%SystemRoot%\system32\windows.staterepository.dll,-1; C:\Windows\system32\svchost.exe [2016-07-16 44496]
R3 TimeBrokerSvc;@%windir%\system32\TimeBrokerServer.dll,-1001; C:\Windows\system32\svchost.exe [2016-07-16 44496]
S2 CDPSvc;@%SystemRoot%\system32\cdpsvc.dll,-100; C:\Windows\system32\svchost.exe [2016-07-16 44496]
S2 CDPUserSvc;@%SystemRoot%\system32\cdpusersvc.dll,-100; C:\Windows\system32\svchost.exe [2016-07-16 44496]
S2 DoSvc;@%systemroot%\system32\dosvc.dll,-100; C:\Windows\system32\svchost.exe [2016-07-16 44496]
S2 ekrn;ESET Service; C:\Program Files\ESET\ESET Security\ekrn.exe []
S2 MapsBroker;@%SystemRoot%\System32\moshost.dll,-100; C:\Windows\System32\svchost.exe [2016-07-16 44496]
S2 OneSyncSvc;@%SystemRoot%\system32\APHostRes.dll,-10002; C:\Windows\system32\svchost.exe [2016-07-16 44496]
S3 AJRouter;@%SystemRoot%\system32\AJRouter.dll,-2; C:\Windows\system32\svchost.exe [2016-07-16 44496]
S3 BthHFSrv;@%SystemRoot%\System32\BthHFSrv.dll,-103; C:\Windows\System32\svchost.exe [2016-07-16 44496]
S3 ClipSVC;@%SystemRoot%\system32\ClipSVC.dll,-103; C:\Windows\System32\svchost.exe [2016-07-16 44496]
S3 cphs;Intel(R) Content Protection HECI Service; C:\Windows\System32\DriverStore\FileRepository\igdlh64.inf_amd64_0745f11ce6fc197c\IntelCpHeciSvc.exe [2016-11-01 301536]
S3 cplspcon;Intel(R) Content Protection HDCP Service; C:\Windows\System32\DriverStore\FileRepository\igdlh64.inf_amd64_0745f11ce6fc197c\IntelCpHDCPSvc.exe [2016-11-01 480224]
S3 DcpSvc;@%SystemRoot%\system32\dcpsvc.dll,-3001; C:\Windows\System32\svchost.exe [2016-07-16 44496]
S3 DevQueryBroker;@%SystemRoot%\system32\DevQueryBroker.dll,-100; C:\Windows\system32\svchost.exe [2016-07-16 44496]
S3 diagnosticshub.standardcollector.service;@%SystemRoot%\system32\DiagSvcs\DiagnosticsHub.StandardCollector.ServiceRes.dll,-1000; C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe [2016-07-16 93184]
S3 DmEnrollmentSvc;@%systemroot%\system32\Windows.Internal.Management.dll,-100; C:\Windows\system32\svchost.exe [2016-07-16 44496]
S3 dmwappushservice;@%SystemRoot%\system32\dmwappushsvc.dll,-200; C:\Windows\system32\svchost.exe [2016-07-16 44496]
S3 DsSvc;@%SystemRoot%\system32\dssvc.dll,-10003; C:\Windows\System32\svchost.exe [2016-07-16 44496]
S3 embeddedmode;@%SystemRoot%\system32\embeddedmodesvc.dll,-201; C:\Windows\System32\svchost.exe [2016-07-16 44496]
S3 EntAppSvc;@EnterpriseAppMgmtSvc.dll,-1; C:\Windows\system32\svchost.exe [2016-07-16 44496]
S3 FrameServer;@%systemroot%\system32\FrameServer.dll,-100; C:\Windows\System32\svchost.exe [2016-07-16 44496]
S3 HvHost;@%SystemRoot%\system32\hvhostsvc.dll,-100; C:\Windows\system32\svchost.exe [2016-07-16 44496]
S3 icssvc;@%SystemRoot%\System32\tetheringservice.dll,-4097; C:\Windows\system32\svchost.exe [2016-07-16 44496]
S3 irmon;@%SystemRoot%\System32\irmon.dll,-2000; C:\Windows\system32\svchost.exe [2016-07-16 44496]
S3 LicenseManager;@%SystemRoot%\system32\licensemanagersvc.dll,-200; C:\Windows\System32\svchost.exe [2016-07-16 44496]
S3 MessagingService;@%SystemRoot%\system32\MessagingService.dll,-100; C:\Windows\system32\svchost.exe [2016-07-16 44496]
S3 MessagingService_2e753;Služba zasílání zpráv_2e753; C:\Windows\system32\svchost.exe [2016-07-16 44496]
S3 MozillaMaintenance;Mozilla Maintenance Service; C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2017-06-14 193992]
S3 NetSetupSvc;@%SystemRoot%\system32\NetSetupSvc.dll,-3; C:\Windows\System32\svchost.exe [2016-07-16 44496]
S3 NgcCtnrSvc;@%SystemRoot%\System32\NgcCtnrSvc.dll,-1; C:\Windows\system32\svchost.exe [2016-07-16 44496]
S3 NgcSvc;@%SystemRoot%\System32\ngcsvc.dll,-100; C:\Windows\system32\svchost.exe [2016-07-16 44496]
S3 PhoneSvc;@%SystemRoot%\system32\PhoneserviceRes.dll,-10000; C:\Windows\system32\svchost.exe [2016-07-16 44496]
S3 PimIndexMaintenanceSvc;@%SystemRoot%\system32\UserDataAccessRes.dll,-15001; C:\Windows\system32\svchost.exe [2016-07-16 44496]
S3 PimIndexMaintenanceSvc_2e753;Data kontaktů_2e753; C:\Windows\system32\svchost.exe [2016-07-16 44496]
S3 RetailDemo;@%SystemRoot%\System32\RDXService.dll,-256; C:\Windows\System32\svchost.exe [2016-07-16 44496]
S3 RmSvc;@%SystemRoot%\system32\RMapi.dll,-1001; C:\Windows\System32\svchost.exe [2016-07-16 44496]
S3 Sense;@%ProgramFiles%\Windows Defender Advanced Threat Protection\MsSense.exe,-1001; C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe [2016-09-15 2889896]
S3 SensorDataService;@%SystemRoot%\system32\SensorDataService.exe,-101; C:\Windows\System32\SensorDataService.exe [2017-03-04 1312768]
S3 SensorService;@%SystemRoot%\System32\sensorservice.dll,-1000; C:\Windows\system32\svchost.exe [2016-07-16 44496]
S3 SmsRouter;@%SystemRoot%\System32\SmsRouterSvc.dll,-10001; C:\Windows\system32\svchost.exe [2016-07-16 44496]
S3 TieringEngineService;@%SystemRoot%\system32\TieringEngineService.exe,-702; C:\Windows\system32\TieringEngineService.exe [2016-07-16 287744]
S3 UnistoreSvc;@%SystemRoot%\system32\UserDataAccessRes.dll,-10003; C:\Windows\System32\svchost.exe [2016-07-16 44496]
S3 UnistoreSvc_2e753;Úložiště uživatelských dat_2e753; C:\Windows\System32\svchost.exe [2016-07-16 44496]
S4 AppVClient;@%systemroot%\system32\AppVClient.exe,-102; C:\Windows\system32\AppVClient.exe [2016-12-14 822624]
S4 shpamsvc;@%SystemRoot%\System32\Windows.SharedPC.AccountManager.dll,-100; C:\Windows\System32\svchost.exe [2016-07-16 44496]
S4 tzautoupdate;@%SystemRoot%\system32\tzautoupdate.dll,-200; C:\Windows\system32\svchost.exe [2016-07-16 44496]
S4 UCBrowserSvc;UC浏览器基础服务; C:\Program Files (x86)\UCBrowser\Application\UCService.exe []
S4 UevAgentService;@%systemroot%\system32\AgentService.exe,-102; C:\Windows\system32\AgentService.exe [2016-07-17 1227264]

-----------------EOF-----------------

Zdravím!
V desítkách nelze mazat z logu RSIT, hrozí poškození systému. Dejte log FRST: http://forum.viry.cz/viewtopic.php?f=13&t=133100 .

Ahoj, omlouvam se, tady je log z FRST.


Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 18-06-2017 01
Ran by Master (administrator) on DOMA (18-06-2017 23:24:37)
Running from C:\Users\Master\Desktop\ČISTICI UTILITY
Loaded Profiles: Master (Available Profiles: defaultuser0 & Master)
Platform: Windows 10 Pro Version 1607 (X64) Language: Čeština (Česká republika)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/33 ... scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Intel Corporation) C:\Windows\System32\DriverStore\FileRepository\igdlh64.inf_amd64_0745f11ce6fc197c\igfxCUIService.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MsMpEng.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Intel Corporation) C:\Windows\System32\DriverStore\FileRepository\igdlh64.inf_amd64_0745f11ce6fc197c\igfxEM.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\NisSrv.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MSASCuiL.exe
() C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.17042.14211.0_x64__8wekyb3d8bbwe\Video.UI.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Microsoft Corporation) C:\Windows\ImmersiveControlPanel\SystemSettings.exe
() C:\Program Files\WindowsApps\Microsoft.Windows.Photos_17.524.10020.0_x64__8wekyb3d8bbwe\Microsoft.Photos.exe
() C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1705.1301.0_x64__8wekyb3d8bbwe\Calculator.exe
(VideoLAN) C:\Program Files (x86)\VideoLAN\VLC\vlc.exe
(Microsoft Corporation) C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
(Microsoft Corporation) C:\Windows\System32\browser_broker.exe
(Microsoft Corporation) C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
(Microsoft Corporation) C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
(Microsoft Corporation) C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
(Microsoft Corporation) C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
(Microsoft Corporation) C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
(Microsoft Corporation) C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
(Microsoft Corporation) C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\TeamViewer.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\tv_w32.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\tv_x64.exe
(Microsoft Corporation) C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\TeamViewer_Desktop.exe

==================== Registry (Whitelisted) ====================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [WindowsDefender] => C:\Program Files\Windows Defender\MSASCuiL.exe [631808 2017-03-28] (Microsoft Corporation)
ShellIconOverlayIdentifiers: [JzShlobj] -> {9A0700D2-920A-4E52-8697-9B5230C92612} => -> No File

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Tcpip\Parameters: [DhcpNameServer] 213.46.172.37 213.46.172.36
Tcpip\..\Interfaces\{bc815b7c-687a-4c99-8911-f6718de70f50}: [DhcpNameServer] 213.46.172.37 213.46.172.36

Internet Explorer:
==================

Edge:
======
Edge Session Restore: HKU\S-1-5-21-487511854-2213860806-3226803095-1001 -> is enabled.

FireFox:
========
FF DefaultProfile: v8rbm51q.default
FF ProfilePath: C:\Users\Master\AppData\Roaming\Mozilla\Firefox\Profiles\v8rbm51q.default [2017-06-18]
FF user.js: detected! => C:\Users\Master\AppData\Roaming\Mozilla\Firefox\Profiles\v8rbm51q.default\user.js [2017-04-12]
FF SelectedSearchEngine: Mozilla\Firefox\Profiles\v8rbm51q.default ->
FF Session Restore: Mozilla\Firefox\Profiles\v8rbm51q.default -> is enabled.
FF Extension: (AdBlock) - C:\Users\Master\AppData\Roaming\Mozilla\Firefox\Profiles\v8rbm51q.default\Extensions\jid1-NIfFY2CA8fy1tg@jetpack.xpi [2017-06-11]
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_25_0_0_171.dll [2017-05-17] ()
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_25_0_0_171.dll [2017-05-17] ()
FF Plugin-x32: @videolan.org/vlc,version=2.2.3 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2016-04-26] (VideoLAN)

==================== Services (Whitelisted) ====================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

S3 cphs; C:\Windows\System32\DriverStore\FileRepository\igdlh64.inf_amd64_0745f11ce6fc197c\IntelCpHeciSvc.exe [301536 2016-11-01] (Intel Corporation)
S3 cplspcon; C:\Windows\System32\DriverStore\FileRepository\igdlh64.inf_amd64_0745f11ce6fc197c\IntelCpHDCPSvc.exe [480224 2016-11-01] (Intel Corporation)
R2 igfxCUIService2.0.0.0; C:\Windows\System32\DriverStore\FileRepository\igdlh64.inf_amd64_0745f11ce6fc197c\igfxCUIService.exe [341984 2016-11-01] (Intel Corporation)
S3 Sense; C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe [2889896 2016-09-15] (Microsoft Corporation)
R2 TeamViewer; C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe [10884848 2017-05-23] (TeamViewer GmbH)
R3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [347328 2017-03-28] (Microsoft Corporation)
R2 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [103720 2017-03-28] (Microsoft Corporation)
S2 ekrn; "C:\Program Files\ESET\ESET Security\ekrn.exe" [X]
S4 UCBrowserSvc; "C:\Program Files (x86)\UCBrowser\Application\UCService.exe" [X] <==== ATTENTION

===================== Drivers (Whitelisted) ======================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R1 cryptfd; C:\Windows\System32\drivers\cryptfd.sys [195496 2017-05-25] ()
R1 eamonm; C:\Windows\System32\DRIVERS\eamonm.sys [132848 2017-03-09] (ESET)
S0 eelam; C:\Windows\System32\DRIVERS\eelam.sys [14880 2017-03-09] (ESET)
R1 epfwwfpr; C:\Windows\system32\DRIVERS\epfwwfpr.sys [77224 2017-03-09] (ESET)
R3 igfx; C:\Windows\System32\DriverStore\FileRepository\igdlh64.inf_amd64_0745f11ce6fc197c\igdkmd64.sys [11033056 2016-11-01] (Intel Corporation)
R1 MpKsl7a171fba; C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{8EDD5F69-A6EA-406D-8EFB-AE39D0DE9AF6}\MpKsl7a171fba.sys [44928 2017-06-18] (Microsoft Corporation)
S3 NetAdapterCx; C:\Windows\System32\drivers\NetAdapterCx.sys [90624 2016-07-16] ()
R3 rt640x64; C:\Windows\System32\drivers\rt640x64.sys [589824 2016-07-16] (Realtek )
S0 WdBoot; C:\Windows\System32\drivers\WdBoot.sys [44056 2016-07-16] (Microsoft Corporation)
R0 WdFilter; C:\Windows\System32\drivers\WdFilter.sys [290144 2016-07-16] (Microsoft Corporation)
R3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [123232 2016-07-16] (Microsoft Corporation)
R1 ZAM_Guard; C:\Windows\System32\drivers\zamguard64.sys [203680 2017-06-11] (Zemana Ltd.)
S1 ZAM; \??\C:\Windows\System32\drivers\zam64.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2017-06-18 23:24 - 2017-06-18 23:24 - 00000000 ____D C:\FRST
2017-06-18 21:03 - 2017-06-18 21:03 - 00001609 _____ C:\Users\Master\Desktop\Microsoft Edge.lnk
2017-06-18 12:47 - 2017-06-18 12:47 - 00064980 _____ C:\Users\Master\Downloads\My-Fair-Lady(0000192546).zip
2017-06-18 01:02 - 2017-06-18 01:02 - 00000000 ____D C:\Users\Master\Desktop\Potápění 17.6.17
2017-06-17 23:39 - 2017-06-18 23:24 - 00000000 ____D C:\Users\Master\Desktop\ČISTICI UTILITY
2017-06-17 23:39 - 2017-06-18 00:15 - 00000000 ____D C:\Program Files\trend micro
2017-06-17 23:39 - 2017-06-17 23:40 - 00000000 ____D C:\rsit
2017-06-17 19:00 - 2017-06-17 19:00 - 00001112 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TeamViewer 12.lnk
2017-06-17 19:00 - 2017-06-17 19:00 - 00001100 _____ C:\Users\Public\Desktop\TeamViewer 12.lnk
2017-06-17 19:00 - 2017-06-17 19:00 - 00000000 ____D C:\Users\Master\AppData\Roaming\TeamViewer
2017-06-17 15:48 - 2017-06-17 23:51 - 00000000 ____D C:\Program Files (x86)\TeamViewer
2017-06-17 15:41 - 2017-06-17 15:45 - 03910208 _____ C:\Users\Master\Downloads\adwcleaner(1).exe
2017-06-17 15:40 - 2017-06-17 15:31 - 15507008 _____ (TeamViewer GmbH) C:\Users\Master\Desktop\TeamViewer_Setup.exe
2017-06-17 15:19 - 2017-06-17 15:31 - 15507008 _____ (TeamViewer GmbH) C:\Users\Master\Downloads\TeamViewer_Setup.exe
2017-06-17 14:59 - 2017-06-17 15:01 - 00094512 _____ C:\Users\Master\Desktop\divnokarty2017-06.ods
2017-06-17 11:50 - 2017-06-17 12:35 - 361734144 _____ C:\Users\Master\Downloads\Byl-jednou-jeden-objevitel-02---Alexandr-Veliky-DVDRIP-CZ.avi
2017-06-17 10:16 - 2017-06-17 10:36 - 361302016 _____ C:\Users\Master\Downloads\Byl-jednou-jeden-objevitel-03---Erik-Rudy-a-objeveni-Ameriky-DVDRIP-CZ.avi
2017-06-17 09:48 - 2017-06-17 10:11 - 41460694 _____ C:\Users\Master\Downloads\Byl-jednou-jeden-objevitel-04---Cingischan-DVDRIP-CZ.avi.part
2017-06-17 07:53 - 2017-06-17 08:12 - 01627499 _____ C:\Users\Master\Downloads\Byl-jednou-jeden-objevitel-12---Cabeza-de-Vaca-DVDRIP-CZ.avi.part
2017-06-16 16:35 - 2017-06-16 16:35 - 00000000 ____D C:\Windows\Minidump
2017-06-15 17:47 - 2017-06-15 17:47 - 00033362 _____ C:\Users\Master\Desktop\archenemy + comander anthology.ods
2017-06-15 17:46 - 2017-06-15 17:46 - 00023963 _____ C:\Users\Master\Desktop\archenemy + comander anthology.csv
2017-06-14 13:16 - 2017-06-14 13:19 - 00029446 _____ C:\Users\Master\Desktop\commander anthology new.ods
2017-06-14 13:16 - 2017-06-14 13:16 - 00060170 _____ C:\Users\Master\Desktop\Commander-Anthology.ods
2017-06-14 13:15 - 2017-06-14 13:15 - 00016256 _____ C:\Users\Master\Desktop\commander anthology new.csv
2017-06-13 22:16 - 2017-06-13 22:47 - 00012760 _____ C:\Users\Master\Desktop\Nový Textový dokument OpenDocument.odt
2017-06-11 10:21 - 2017-06-11 10:21 - 00030324 _____ C:\Users\Master\Downloads\Surplus-Terrorized-Into-Being-Consumers(0000064707).srt
2017-06-11 09:26 - 2017-06-11 10:13 - 857050185 _____ C:\Users\Master\Downloads\Surplus-Terrorized-Into-Being-Consumers.mp4
2017-06-11 05:15 - 2017-06-11 05:15 - 00000000 ____D C:\Users\Master\AppData\Roaming\ESET
2017-06-11 05:12 - 2017-06-11 05:12 - 00000000 ____D C:\Users\Master\Downloads\TNod-1.6.1-final-setup(1)
2017-06-11 05:12 - 2017-06-11 05:12 - 00000000 ____D C:\Users\Master\AppData\Roaming\WinRAR
2017-06-11 05:12 - 2017-06-11 05:12 - 00000000 ____D C:\Users\Master\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR
2017-06-11 05:12 - 2017-06-11 05:12 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinRAR
2017-06-11 05:12 - 2017-06-11 05:12 - 00000000 ____D C:\Program Files\WinRAR
2017-06-11 05:11 - 2017-06-11 05:11 - 02377944 _____ C:\Users\Master\Downloads\winrar-x64-540cz.exe
2017-06-11 05:11 - 2017-06-11 05:11 - 02315081 _____ C:\Users\Master\Downloads\TNod-1.6.1-final-setup(1).rar
2017-06-11 05:07 - 2017-06-11 05:07 - 00012872 _____ (SurfRight B.V.) C:\Windows\system32\bootdelete.exe
2017-06-11 05:06 - 2017-06-11 05:06 - 00055232 _____ C:\Windows\system32\Drivers\hitmanpro37.sys
2017-06-11 05:05 - 2017-06-11 05:08 - 00000000 ____D C:\ProgramData\HitmanPro
2017-06-11 05:04 - 2017-06-11 05:06 - 11584088 _____ (SurfRight B.V.) C:\Users\Master\Downloads\HitmanPro_x64.exe
2017-06-11 04:59 - 2017-06-17 23:51 - 00000000 ____D C:\AdwCleaner
2017-06-11 04:51 - 2017-06-18 23:24 - 00180899 _____ C:\Windows\ZAM_Guard.krnl.trace
2017-06-11 04:51 - 2017-06-15 15:37 - 00041756 _____ C:\Windows\ZAM.krnl.trace
2017-06-11 04:51 - 2017-06-11 04:51 - 05774688 _____ (Zemana Ltd. ) C:\Users\Master\Downloads\Zemana.AntiMalware.Setup.exe
2017-06-11 04:51 - 2017-06-11 04:51 - 00203680 _____ (Zemana Ltd.) C:\Windows\system32\Drivers\zamguard64.sys
2017-06-11 04:51 - 2017-06-11 04:51 - 00000000 ____D C:\Users\Master\AppData\Local\Zemana
2017-06-11 04:49 - 2017-06-11 05:01 - 00003828 _____ C:\Users\Master\Desktop\Rkill.txt
2017-06-11 04:49 - 2017-06-11 04:49 - 02030536 _____ (Bleeping Computer, LLC) C:\Users\Master\Downloads\iExplore.exe
2017-06-11 04:35 - 2017-06-11 04:35 - 00001499 _____ C:\Users\Master\Desktop\firefox.exe – zástupce.lnk
2017-06-11 04:28 - 2017-06-17 23:51 - 00000000 ____D C:\Users\Master\AppData\Roaming\IObit
2017-06-11 04:28 - 2017-06-14 02:30 - 00000000 ____D C:\ProgramData\IObit
2017-06-11 04:28 - 2017-06-11 04:28 - 14435104 _____ (IObit) C:\Users\Master\Downloads\iobituninstaller.exe
2017-06-11 04:28 - 2017-06-11 04:28 - 00000000 ____D C:\Users\Master\AppData\LocalLow\IObit
2017-06-11 04:28 - 2017-06-11 04:28 - 00000000 ____D C:\ProgramData\ProductData
2017-06-11 04:05 - 2017-06-11 04:05 - 00000000 ____D C:\Users\Master\AppData\Local\ESET
2017-06-11 04:04 - 2017-06-11 04:04 - 02315081 _____ C:\Users\Master\Downloads\TNod-1.6.1-final-setup.rar
2017-06-11 04:01 - 2017-06-14 03:37 - 00000000 ____D C:\Program Files\ESET
2017-06-11 04:01 - 2017-06-11 04:01 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ESET
2017-06-11 04:01 - 2017-06-11 04:01 - 00000000 ____D C:\ProgramData\ESET
2017-06-11 04:00 - 2017-06-11 05:11 - 00000000 ____D C:\Users\Master\AppData\LocalLow\uTorrent
2017-06-11 03:57 - 2017-06-11 03:57 - 00016826 _____ C:\Windows\System32\Tasks\The PC Chiener
2017-06-11 03:56 - 2017-06-11 03:56 - 00930816 _____ C:\Users\Master\AppData\Local\test_db_cara.db
2017-06-11 03:56 - 2017-06-11 03:56 - 00016846 _____ C:\Windows\System32\Tasks\Checking Downloader
2017-06-11 03:56 - 2017-06-11 03:56 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\mgdisk
2017-06-11 03:56 - 2017-06-11 03:56 - 00000000 ____D C:\Program Files (x86)\mgdisk
2017-06-11 03:56 - 2016-12-27 04:34 - 00025432 _____ C:\Windows\system32\Drivers\vcdrom.sys
2017-06-11 03:51 - 2017-06-11 03:51 - 00031360 _____ C:\Users\Master\Desktop\Planet-Earth-II-S01E06(0000280258).srt
2017-06-11 03:12 - 2017-06-11 03:15 - 1182070719 _____ C:\Users\Master\Desktop\Planet.Earth.II.2016.S01E06.Cities.720p.BluRay.HEVC.x265.sharpysword.mkv
2017-06-11 03:11 - 2017-06-12 01:00 - 00000000 ____D C:\Users\Master\AppData\Roaming\uTorrent
2017-06-11 03:11 - 2017-06-11 03:11 - 00000877 _____ C:\Users\Master\AppData\Roaming\Microsoft\Windows\Start Menu\µTorrent.lnk
2017-06-11 03:09 - 2017-06-11 03:09 - 02684920 _____ (BitTorrent Inc.) C:\Users\Master\Downloads\uTorrent.exe
2017-06-10 19:08 - 2017-06-10 19:08 - 00000000 ____D C:\Users\Master\Desktop\Turbosanson
2017-06-08 10:51 - 2017-06-08 10:57 - 00000000 ____D C:\Users\Master\Desktop\Nová složka
2017-06-08 09:24 - 2017-06-08 09:24 - 00000000 ____D C:\Users\Master\AppData\Local\Chromium
2017-06-08 09:24 - 2017-06-08 09:24 - 00000000 ____D C:\Users\Master\AppData\Local\copay
2017-06-08 09:23 - 2017-06-08 09:23 - 00001102 _____ C:\Users\Public\Desktop\Copay.lnk
2017-06-08 09:23 - 2017-06-08 09:23 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Copay
2017-06-08 09:23 - 2017-06-08 09:23 - 00000000 ____D C:\Program Files (x86)\Copay
2017-06-08 09:20 - 2017-06-08 09:20 - 65138153 _____ (BitPay ) C:\Users\Master\Downloads\Copay.exe
2017-06-07 10:06 - 2017-06-07 10:06 - 00000865 _____ C:\Users\Master\Desktop\Start Tor Browser.lnk
2017-06-07 10:04 - 2017-06-07 10:04 - 00000000 ____D C:\Users\Master\Desktop\Tor Browser
2017-06-05 21:58 - 2017-06-05 21:58 - 00012141 _____ C:\Users\Master\Desktop\archenemy.ods
2017-06-05 17:32 - 2017-06-05 17:52 - 01675180 _____ C:\Users\Master\Desktop\kontrola.ods
2017-06-05 17:26 - 2017-06-05 17:26 - 01503651 _____ C:\Users\Master\Desktop\kvoty.csv
2017-06-05 14:15 - 2017-06-05 14:15 - 00001072 _____ C:\Users\Master\Desktop\Wizards Event Reporter.lnk
2017-06-05 10:33 - 2017-06-05 17:11 - 01033180 _____ C:\Users\Master\Desktop\kvoty.ods
2017-06-05 10:22 - 2017-06-05 17:28 - 01478846 _____ C:\Users\Master\Desktop\kontrola.csv
2017-06-05 10:18 - 2017-06-05 10:18 - 00006838 _____ C:\Users\Master\Desktop\vykupy-zkontroluj-rucne.csv
2017-06-05 10:17 - 2017-06-05 10:17 - 00025592 _____ C:\Users\Master\Desktop\vykupy-zkontroluj-rucne.ods
2017-06-03 08:37 - 2017-06-03 08:38 - 88686452 _____ C:\Users\Master\Desktop\Turbosanson.zip
2017-06-02 22:17 - 2017-06-02 22:28 - 00203441 _____ C:\Users\Master\Desktop\vykupy base sets patek vecer.csv
2017-06-02 21:08 - 2017-06-02 21:08 - 00172170 _____ C:\Users\Master\Desktop\rishada-170602-export-db.csv
2017-06-02 09:31 - 2017-06-02 09:31 - 00024286 _____ C:\Users\Master\Desktop\vykupy zkontroluj rucne.ods
2017-06-01 16:22 - 2017-06-18 04:43 - 00000000 ____D C:\Users\Master\Desktop\hour of devastqation
2017-06-01 15:46 - 2017-06-01 15:47 - 602111644 _____ C:\Users\Master\Downloads\ArneLMirkoMilanoTribute.WAV
2017-06-01 14:25 - 2017-06-01 14:26 - 711429602 _____ C:\Users\Master\Downloads\VANDAL - RAGGA HARDTEK 2017 MIX.wav
2017-05-28 20:02 - 2017-06-07 10:06 - 00000913 _____ C:\Users\Master\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Start Tor Browser.lnk
2017-05-28 20:02 - 2017-05-31 11:40 - 00000000 ____D C:\Users\Master\AppData\Roaming\Seznam.cz
2017-05-28 20:02 - 2017-05-31 11:40 - 00000000 ____D C:\Program Files (x86)\Seznam.cz
2017-05-28 20:01 - 2017-05-28 20:01 - 58241936 _____ C:\Users\Master\Downloads\torbrowser-install-7.0a2_en-US.exe
2017-05-26 20:36 - 2017-06-02 21:08 - 00000000 ____D C:\Users\Master\Desktop\vykupy
2017-05-25 03:43 - 2017-05-25 03:43 - 00195496 _____ C:\Windows\system32\Drivers\cryptfd.sys
2017-05-22 18:03 - 2017-05-22 18:03 - 00433845 _____ C:\Users\Master\Desktop\Top_6_Things_Small_Businesses_Q12015.pdf
2017-05-22 12:22 - 2017-05-22 12:22 - 00000000 ____D C:\Users\Master\AppData\Roaming\LibreOffice
2017-05-22 12:21 - 2017-05-22 12:21 - 00001219 _____ C:\Users\Public\Desktop\LibreOffice 5.3.lnk
2017-05-22 12:21 - 2017-05-22 12:21 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LibreOffice 5.3
2017-05-22 12:20 - 2017-05-22 12:21 - 00000000 ____D C:\Program Files (x86)\LibreOffice 5
2017-05-22 12:17 - 2017-05-22 12:17 - 221102080 _____ C:\Users\Master\Downloads\LibreOffice_5.3.3_Win_x86.msi
2017-05-22 12:13 - 2017-05-22 20:16 - 00000000 ____D C:\Users\Master\Desktop\cenik

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2017-06-18 22:58 - 2017-04-20 03:23 - 00000000 ____D C:\Users\Master\AppData\Local\Battle.net
2017-06-18 22:11 - 2017-04-14 18:57 - 00000000 ____D C:\Windows\system32\SleepStudy
2017-06-18 17:38 - 2017-04-23 09:11 - 00000000 ____D C:\Users\Master\AppData\Roaming\vlc
2017-06-18 17:01 - 2016-07-16 13:47 - 00000000 ____D C:\Windows\AppReadiness
2017-06-18 06:25 - 2017-04-20 03:22 - 00000000 ____D C:\Program Files (x86)\Blizzard App
2017-06-18 01:02 - 2017-04-14 18:59 - 00000000 ____D C:\Users\Master
2017-06-18 00:34 - 2017-04-14 20:26 - 00000000 ____D C:\Users\Master\AppData\LocalLow\Mozilla
2017-06-17 23:56 - 2017-04-14 20:05 - 01913388 _____ C:\Windows\system32\PerfStringBackup.INI
2017-06-17 23:56 - 2016-07-17 00:25 - 00683150 _____ C:\Windows\system32\perfh005.dat
2017-06-17 23:56 - 2016-07-17 00:25 - 00156608 _____ C:\Windows\system32\perfc005.dat
2017-06-17 23:52 - 2017-04-15 15:13 - 00000000 __SHD C:\Users\Master\IntelGraphicsProfiles
2017-06-17 23:52 - 2017-04-14 18:57 - 00269248 _____ C:\Windows\system32\FNTCACHE.DAT
2017-06-17 23:52 - 2017-04-14 18:57 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2017-06-17 23:52 - 2016-07-16 08:04 - 00262144 _____ C:\Windows\system32\config\BBI
2017-06-17 17:00 - 2016-07-16 13:47 - 00000000 ___HD C:\Program Files\WindowsApps
2017-06-16 16:35 - 2017-04-14 18:57 - 01330482 ____N C:\Windows\Minidump\061617-4796-01.dmp
2017-06-16 16:35 - 2016-07-16 13:45 - 00000000 ____D C:\Windows\INF
2017-06-15 15:35 - 2017-04-14 20:25 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2017-06-15 11:05 - 2017-05-01 09:27 - 00000000 ____D C:\Users\Master\Desktop\draft camp
2017-06-14 11:41 - 2017-04-14 20:25 - 00000000 ____D C:\Program Files\Mozilla Firefox
2017-06-14 02:22 - 2017-04-20 03:24 - 00000000 ____D C:\Program Files (x86)\Hearthstone
2017-06-11 04:53 - 2017-04-14 20:12 - 00000000 ____D C:\Windows\AutoKMS
2017-06-11 04:06 - 2016-07-16 08:04 - 00000000 ____D C:\Program Files\The PC Chiener
2017-06-11 04:06 - 2016-07-16 08:04 - 00000000 ____D C:\Program Files\Checking Downloader
2017-06-11 04:01 - 2016-07-16 13:47 - 00000000 ___HD C:\Windows\ELAMBKUP
2017-05-31 20:57 - 2017-04-15 15:18 - 00565416 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2017-05-25 16:33 - 2017-04-14 19:13 - 00011362 _____ C:\Users\Master\Desktop\blbiny.txt

==================== Files in the root of some directories =======

2017-06-11 03:56 - 2017-06-11 03:56 - 0930816 _____ () C:\Users\Master\AppData\Local\test_db_cara.db

Some files in TEMP:
====================
2017-04-14 20:07 - 2017-04-14 20:07 - 1066336 _____ (Microsoft Corporation) C:\Users\Master\AppData\Local\Temp\PidGenX.dll
2017-06-10 06:30 - 2017-06-10 06:30 - 25638972 _____ () C:\Users\Master\AppData\Local\Temp\setup.dll
2017-05-30 18:33 - 2017-05-31 11:40 - 0534528 _____ () C:\Users\Master\AppData\Local\Temp\{E638ABC1-0067-474b-A379-87CFE81E7848}.exe

==================== Bamital & volsnap ======================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\dnsapi.dll => File is digitally signed
C:\Windows\SysWOW64\dnsapi.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed

LastRegBack: 2017-06-12 19:27

==================== End of FRST.txt ============================

Otevřte poznámkový blok a zkopírujte do něj:

Start
ShellIconOverlayIdentifiers: [JzShlobj] -> {9A0700D2-920A-4E52-8697-9B5230C92612} => -> No File
S4 UCBrowserSvc; "C:\Program Files (x86)\UCBrowser\Application\UCService.exe" [X] <==== ATTENTION
R1 ZAM_Guard; C:\Windows\System32\drivers\zamguard64.sys [203680 2017-06-11] (Zemana Ltd.)
S1 ZAM; \??\C:\Windows\System32\drivers\zam64.sys [X]
C:\Windows\ZAM_Guard.krnl.trace
C:\Windows\ZAM.krnl.trace
C:\Users\Master\AppData\Local\Temp
C:\Windows\AutoKMS
C:\Users\Master\Downloads\TNod-1.6.1-final-setup.rar

EmptyTemp:
End

Uložte na plochu jako fixlist.txt. Spusťte znovu FRST a klikněte na >Fix<. Po skončení akce se objeví log, který sem zkopírujte.

Zdravim,
diky za reakci, udelal jsem jak pisete, chvili se neco dela a pak na me vyskocilo:





Dale tady je log co se pritom stihnul udelat, ale predpokladam ze neni kompletni.

Fix result of Farbar Recovery Scan Tool (x64) Version: 18-06-2017 01
Ran by Master (19-06-2017 18:22:54) Run:2
Running from C:\Users\Master\Desktop\ČISTICI UTILITY
Loaded Profiles: Master (Available Profiles: defaultuser0 & Master)
Boot Mode: Normal
==============================================

fixlist content:
*****************
Start
ShellIconOverlayIdentifiers: [JzShlobj] -> {9A0700D2-920A-4E52-8697-9B5230C92612} => -> No File
S4 UCBrowserSvc; "C:\Program Files (x86)\UCBrowser\Application\UCService.exe" [X] <==== ATTENTION
R1 ZAM_Guard; C:\Windows\System32\drivers\zamguard64.sys [203680 2017-06-11] (Zemana Ltd.)
S1 ZAM; \??\C:\Windows\System32\drivers\zam64.sys [X]
C:\Windows\ZAM_Guard.krnl.trace
C:\Windows\ZAM.krnl.trace
C:\Users\Master\AppData\Local\Temp
C:\Windows\AutoKMS
C:\Users\Master\Downloads\TNod-1.6.1-final-setup.rar

EmptyTemp:
End
*****************

HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\JzShlobj => key not found.
HKLM\Software\Classes\CLSID\{9A0700D2-920A-4E52-8697-9B5230C92612} => key not found.
UCBrowserSvc => service not found.
ZAM_Guard => service not found.
ZAM => service not found.
C:\Windows\ZAM_Guard.krnl.trace => moved successfully
"C:\Windows\ZAM.krnl.trace" => not found.
C:\Users\Master\AppData\Local\Temp => moved successfully
"C:\Windows\AutoKMS" => not found.
"C:\Users\Master\Downloads\TNod-1.6.1-final-setup.rar" => not found.

=========== EmptyTemp: ==========

BITS transfer queue => 0 B
DOMStore, IE Recovery, AppCache, Feeds Cache, Thumbcache, IconCache => 1048864 B
Java, Flash, Steam htmlcache => 0 B
Windows/system/drivers => 0 B
Edge => 0 B
Chrome => 0 B
Firefox => 0 B
Opera => 0 B

Temp, IE cache, history, cookies, recent:
Default => 0 B
Users => 0 B
ProgramData => 0 B
Public => 0 B
systemprofile => 0 B
systemprofile32 => 0 B
LocalService => 0 B
NetworkService => 0 B
defaultuser0 => 0 B

Nic to nesmazalo, přestože jsou tam zbytky po takových "lahůdkách" jako je UCBrowser a jiné. Zkuste to v nouz. režimu a před tím vypněte antivir.