prosím o kontrolu logu

[jaro3]

Zavři ostatní aplikace a prohlížeče, odpoj se od netu a fixni v HJT:
Návod

Kód: Vybrat vše

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = %11%\blank.htm
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

Stáhni si zde DelFix
https://toolslib.net/downloads/viewdownload/2-delfix/

ulož si soubor na plochu.
Poklepáním na ikonu spusť nástroj Delfix.exe
( Ve Windows Vista, Windows 7 a 8, musíš spustit soubor pravým tlačítkem myši -> Spustit jako správce .
V hlavním menu, zkontroluj tyto možnosti - Odstranění dezinfekce nástrojů (Remove desinfection tools) – Vyčistit body obnovy (Purge System Restore)
Poté klikněte na tlačítko Spustit (Run) a nech nástroj dělat svoji práci

Poté se zpráva se otevře (DelFix.txt). Vlož celý obsah zprávy sem.Jinak je zpráva zde:
v C: \ DelFix.txt

Pokud nejsou problémy , je to vše a můžeš dát vyřešeno , zelenou fajfku.

[Reklama]

[kokabura]

# DelFix v1.013 - Logfile created 01/04/2017 at 23:15:25
# Updated 17/04/2016 by Xplode
# Username : psosk - DESKTOP-4KG2J6A
# Operating System : Windows 10 Pro (64 bits)

~ Removing disinfection tools ...

Deleted : C:\zoek_backup
Deleted : C:\AdwCleaner
Deleted : C:\Users\psosk\Desktop\AdwCleaner.exe
Deleted : C:\Users\psosk\Desktop\JRT.exe
Deleted : C:\Users\psosk\Desktop\HijackThis (1).exe
Deleted : C:\Users\psosk\Desktop\RogueKillerX64.exe
Deleted : C:\Users\psosk\Desktop\TFC.exe
Deleted : C:\Users\psosk\Desktop\zoek.exe
Deleted : HKLM\SOFTWARE\OldTimer Tools
Deleted : HKLM\SOFTWARE\TrendMicro\Hijackthis

########## - EOF - ##########

# DelFix v1.013 - Logfile created 01/04/2017 at 23:16:29
# Updated 17/04/2016 by Xplode
# Username : psosk - DESKTOP-4KG2J6A
# Operating System : Windows 10 Pro (64 bits)

~ Removing disinfection tools ...


~ Cleaning system restore ...

Deleted : RP #2 [Windows Update | 03/26/2017 18:09:06]
Deleted : RP #3 [Windows Update | 03/29/2017 19:41:31]

New restore point created !

########## - EOF - ##########



bohužel, jsem si všiml, že se mi nechtějí nainstalovat aktualizace, stáhnou se pak mi to nabídně restart.. a po spuštění opět aktualizace, vpravo dole okno "instalace aktualizací se nezdařila ... "

[jaro3]

Prosím stáhni příslušnou verzi programu pro Tvůj systém 32-bit/64-bit FarbarRecovery Scan Tool (FrSt)
32bit.:
http://www.bleepingcomputer.com/downloa ... ool/dl/81/
64bit.:
http://www.bleepingcomputer.com/downloa ... ool/dl/82/
a ulož jej na plochu. ,pak spusť FrSt.
Potvrď způsob užití.
Neměň žádné z výchozích nastavení a klikni na položku „Scan“ („Skenovat“) .Když je skenování dokončeno, ukážou se dva logy = FRST.txt a Addition.txt a uloží se na ploše.Prosím zkopíruj sem celý jejich obsah.

[kokabura]

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 15-03-2017
Ran by psosk (administrator) on DESKTOP-4KG2J6A (03-04-2017 20:17:17)
Running from C:\Users\psosk\Desktop
Loaded Profiles: psosk (Available Profiles: defaultuser0 & psosk)
Platform: Windows 10 Pro Version 1607 (X64) Language: Čeština (Česká republika)
Internet Explorer Version 11 (Default browser: Chrome)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/33 ... scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Intel Corporation) C:\Windows\System32\igfxCUIService.exe
(COMODO) C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(COMODO) C:\Program Files (x86)\Comodo\Internet Security Essentials\isesrv.exe
(Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
(Copyright 2017.) C:\Program Files (x86)\Zemana AntiMalware\ZAM.exe
(COMODO) C:\Program Files\COMODO\COMODO Internet Security\cavwp.exe
(COMODO) C:\Program Files\COMODO\COMODO Internet Security\CisTray.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Intel Corporation) C:\Windows\System32\igfxEM.exe
(Intel Corporation) C:\Windows\System32\igfxHK.exe
() C:\Windows\System32\igfxTray.exe
() C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.12.112.0_x64__kzf8qxf38zg5c\SkypeHost.exe
(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe
(Microsoft Corporation) C:\Windows\System32\smartscreen.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
(Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe
(Copyright 2017.) C:\Program Files (x86)\Zemana AntiMalware\ZAM.exe
(COMODO) C:\Program Files\COMODO\COMODO Internet Security\cis.exe
(Apple Inc.) C:\Program Files\iTunes\iTunesHelper.exe
(Disc Soft Ltd) C:\Program Files\DAEMON Tools Lite\DTAgent.exe
(Spotify Ltd) C:\Users\psosk\AppData\Roaming\Spotify\SpotifyWebHelper.exe
(Disc Soft Ltd) C:\Program Files\DAEMON Tools Lite\DiscSoftBusServiceLite.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudDrive.exe
(Apple, Inc.) C:\Program Files (x86)\Common Files\Apple\Apple Application Support\secd.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudPhotos.exe
(COMODO) C:\Program Files (x86)\Comodo\Internet Security Essentials\vkise.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.1051_none_7f2bf7ea21d201b2\TiWorker.exe
(Microsoft Corporation) C:\Windows\System32\cmd.exe
(COMODO) C:\Program Files\COMODO\COMODO Internet Security\cmdvirth.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\AppleChromeDAV.exe
() C:\Program Files (x86)\Splashtop\Splashtop Software Updater\SSUService.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Windows\syswow64\backgroundTaskHost.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

==================== Registry (Whitelisted) ====================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [8822528 2016-06-17] (Realtek Semiconductor)
HKLM\...\Run: [COMODO Autostart {D5EFF3B3-E126-4AF6-BCE9-852A72129E10}] => C:\Program Files\COMODO\COMODO Internet Security\cistray.exe [1519800 2016-12-28] (COMODO)
HKLM\...\Run: [Malwarebytes TrayApp] => C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\mbamtray.exe [2780112 2017-01-20] (Malwarebytes)
HKLM\...\Run: [ZAM] => C:\Program Files (x86)\Zemana AntiMalware\ZAM.exe [14471408 2017-03-06] (Copyright 2017.)
HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [303928 2017-03-22] (Apple Inc.)
HKLM-x32\...\Run: [IseUI] => C:\Program Files (x86)\COMODO\Internet Security Essentials\vkise.exe [3386576 2017-03-30] (COMODO)
HKU\S-1-5-21-3249506284-3394159516-870956781-1001\...\Run: [DAEMON Tools Lite Automount] => C:\Program Files\DAEMON Tools Lite\DTAgent.exe [4701888 2017-02-07] (Disc Soft Ltd)
HKU\S-1-5-21-3249506284-3394159516-870956781-1001\...\Run: [AirParrot2] => [X]
HKU\S-1-5-21-3249506284-3394159516-870956781-1001\...\Run: [Spotify Web Helper] => C:\Users\psosk\AppData\Roaming\Spotify\SpotifyWebHelper.exe [1446000 2017-03-27] (Spotify Ltd)
HKU\S-1-5-21-3249506284-3394159516-870956781-1001\...\Run: [Spotify] => C:\Users\psosk\AppData\Roaming\Spotify\Spotify.exe [7089776 2017-03-27] (Spotify Ltd)
HKU\S-1-5-21-3249506284-3394159516-870956781-1001\...\Run: [iCloudServices] => C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe [67384 2017-01-17] (Apple Inc.)
HKU\S-1-5-21-3249506284-3394159516-870956781-1001\...\Run: [iCloudDrive] => C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudDrive.exe [110392 2017-01-17] (Apple Inc.)
HKU\S-1-5-21-3249506284-3394159516-870956781-1001\...\Run: [iCloudPhotos] => C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudPhotos.exe [356664 2017-01-17] (Apple Inc.)
HKU\S-1-5-21-3249506284-3394159516-870956781-1001\...\MountPoints2: {76be502b-f974-11e6-a310-74d435bea2a6} - "F:\WD SmartWare.exe" autoplay=true
ShellExecuteHooks: No Name - {60828C92-F449-11E6-B17D-64006A5CFC23} - C:\Program Files (x86)\Rokaphdruzitain\Fersetainzuvage.dll -> No File

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Tcpip\Parameters: [DhcpNameServer] 192.168.1.254
Tcpip\..\Interfaces\{7007d305-aa62-408c-a5e2-2e32985f5cf6}: [DhcpNameServer] 192.168.1.254

Internet Explorer:
==================
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.msn.com/
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page =
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL =
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL =
SearchScopes: HKU\S-1-5-21-3249506284-3394159516-870956781-1001 -> DefaultScope {012E1000-F331-11DB-8314-0800200C9A66} URL = hxxp://www.google.com/search?q={searchTerms}
SearchScopes: HKU\S-1-5-21-3249506284-3394159516-870956781-1001 -> {012E1000-F331-11DB-8314-0800200C9A66} URL = hxxp://www.google.com/search?q={searchTerms}

Edge:
======
Edge HomeButtonPage: HKU\S-1-5-21-3249506284-3394159516-870956781-1001 -> hxxp://www.google.com

FireFox:
========
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.32.7\npGoogleUpdate3.dll [2017-02-22] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.32.7\npGoogleUpdate3.dll [2017-02-22] (Google Inc.)

Chrome:
=======
CHR HomePage: Default -> hxxp://www.google.com/
CHR StartupUrls: Default -> "hxxp://www.google.com/","hxxp://www.google.com","hxxp://www.yessearches.com/?mode=nnnb&ptid=dam&uid=009C44AE9156AC61664D4A885154E3D4&v=20160315&ts=AHEpC3MoC3YtA0..","hxxp://www.youndoo.com/?z=bbf89e408b6336203faaee4g2z8b5mcm8bctdg7zec&from=dam&uid=KINGSTONXSV300S37A120G_50026B774A01A9C8&type=hp","hxxp://www.startpageing123.com/?type=hp&ts=1488568164&z=514e3583ed2551ee3e12f2bgdzfb8b8w7q1bag6q7z&from=che0812&uid=KINGSTONXSV300S37A120G_50026B774A01A9C8","hxxp://www.startpageing123.com/?type=hp&ts=1489430147&z=e4687c88a22c936418ffd3fg6zebbtaz6c2e3g4zft&from=che0812&uid=KINGSTONXSV300S37A120G_50026B774A01A9C8"
CHR Profile: C:\Users\psosk\AppData\Local\Google\Chrome\User Data\Default [2017-04-03]
CHR Extension: (Google Slides) - C:\Users\psosk\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2017-03-22]
CHR Extension: (Google Docs) - C:\Users\psosk\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2017-03-22]
CHR Extension: (Google Drive) - C:\Users\psosk\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2017-03-22]
CHR Extension: (YouTube) - C:\Users\psosk\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2017-03-22]
CHR Extension: (Google Sheets) - C:\Users\psosk\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2017-03-22]
CHR Extension: (iCloud Bookmarks) - C:\Users\psosk\AppData\Local\Google\Chrome\User Data\Default\Extensions\fkepacicchenbjecpbpbclokcabebhah [2017-03-22]
CHR Extension: (Google Docs Offline) - C:\Users\psosk\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2017-03-22]
CHR Extension: (Superblock Extended - Adblocker) - C:\Users\psosk\AppData\Local\Google\Chrome\User Data\Default\Extensions\kmljjoddjjkoidiahlgbgjjgodcajhgf [2017-03-22]
CHR Extension: (Google Mail Checker) - C:\Users\psosk\AppData\Local\Google\Chrome\User Data\Default\Extensions\mihcahmgecmbnbcchbopgniflfhgnkff [2017-03-22]
CHR Extension: (Chrome Web Store Payments) - C:\Users\psosk\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2017-03-22]
CHR Extension: (Gmail) - C:\Users\psosk\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2017-03-22]
CHR Extension: (Chrome Media Router) - C:\Users\psosk\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2017-03-31]

==================== Services (Whitelisted) ====================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 Apple Mobile Device Service; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [83768 2017-03-17] (Apple Inc.)
R2 CmdAgent; C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe [6758568 2016-12-28] (COMODO)
R3 cmdvirth; C:\Program Files\COMODO\COMODO Internet Security\cmdvirth.exe [2876088 2016-12-28] (COMODO)
R3 Disc Soft Lite Bus Service; C:\Program Files\DAEMON Tools Lite\DiscSoftBusServiceLite.exe [1471168 2017-02-07] (Disc Soft Ltd)
R2 igfxCUIService2.0.0.0; C:\WINDOWS\system32\igfxCUIService.exe [373744 2016-11-02] (Intel Corporation)
R2 isesrv; C:\Program Files (x86)\COMODO\Internet Security Essentials\isesrv.exe [118480 2017-03-30] (COMODO)
R2 MBAMService; C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe [4355024 2017-01-20] (Malwarebytes)
S3 Sense; C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe [2889896 2016-09-15] (Microsoft Corporation)
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [347328 2016-07-16] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [103720 2016-07-16] (Microsoft Corporation)
R2 ZAMSvc; C:\Program Files (x86)\Zemana AntiMalware\ZAM.exe [14471408 2017-03-06] (Copyright 2017.)

===================== Drivers (Whitelisted) ======================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R1 cmderd; C:\WINDOWS\System32\DRIVERS\cmderd.sys [40952 2016-12-16] (COMODO)
R1 cmdGuard; C:\WINDOWS\System32\DRIVERS\cmdguard.sys [828360 2016-12-16] (COMODO)
R1 cmdhlp; C:\WINDOWS\system32\DRIVERS\cmdhlp.sys [50288 2016-12-16] (COMODO)
S3 dg_ssudbus; C:\WINDOWS\System32\drivers\ssudbus.sys [129152 2016-04-25] (Samsung Electronics Co., Ltd.)
R3 dtlitescsibus; C:\WINDOWS\System32\drivers\dtlitescsibus.sys [30264 2017-02-22] (Disc Soft Ltd)
R3 dtliteusbbus; C:\WINDOWS\System32\drivers\dtliteusbbus.sys [47672 2017-02-22] (Disc Soft Ltd)
S3 GeneStor; C:\WINDOWS\System32\drivers\GeneStor.sys [111336 2015-11-25] (GenesysLogic)
R1 inspect; C:\WINDOWS\system32\DRIVERS\inspect.sys [127144 2016-12-16] (COMODO)
R3 IntcAudioBus; C:\WINDOWS\System32\drivers\IntcAudioBus.sys [210488 2016-06-13] (Intel(R) Corporation)
R1 isedrv; C:\WINDOWS\system32\drivers\isedrv.sys [62208 2017-03-29] (COMODO)
S3 LECs6022; C:\WINDOWS\System32\drivers\LECs6022.sys [17408 2010-11-05] (Primax Electronics Ltd.)
S3 LEMo6022; C:\WINDOWS\System32\drivers\LEMo6022.sys [24064 2012-06-06] (Primax Electronics Ltd.)
S3 LEub6022; C:\WINDOWS\System32\drivers\LEub6022.sys [18432 2011-01-05] (Primax Electronics Ltd.)
R0 MBAMSwissArmy; C:\WINDOWS\System32\drivers\MBAMSwissArmy.sys [251840 2017-04-03] (Malwarebytes)
S3 MBAMWebProtection; C:\WINDOWS\system32\drivers\mwac.sys [92088 2017-04-01] (Malwarebytes)
S3 NetAdapterCx; C:\WINDOWS\System32\drivers\NetAdapterCx.sys [90624 2016-07-16] ()
S3 NVSWCFilter; C:\WINDOWS\System32\drivers\nvswcfilter.sys [28344 2015-10-10] (Windows (R) Win 7 DDK provider)
S3 pelmouse; C:\WINDOWS\System32\drivers\pelmouse.sys [23040 2015-12-17] (TPMX Electronics Ltd.)
S3 pelusblf; C:\WINDOWS\System32\drivers\pelusblf.sys [35328 2016-01-14] (TPMX Electronics Ltd.)
S3 pelvendr; C:\WINDOWS\System32\drivers\pelvendr.sys [11776 2009-11-02] (TPMX Electronics Ltd.)
S3 phidmice; C:\WINDOWS\System32\drivers\phidmice.sys [35328 2015-12-17] (TPMX Electronics Ltd.)
S3 pmouself; C:\WINDOWS\System32\drivers\pmouself.sys [23040 2013-03-26] (TPMX Electronics Ltd.)
S3 pvendrlf; C:\WINDOWS\System32\drivers\pvendrlf.sys [12288 2013-03-26] (TPMX Electronics Ltd.)
R3 rt640x64; C:\WINDOWS\System32\drivers\rt640x64.sys [936192 2016-06-13] (Realtek )
S3 SNTUSB64; C:\WINDOWS\System32\drivers\SNTUSB64.SYS [63528 2011-05-27] (SafeNet, Inc.)
S3 ssudqcfilter; C:\WINDOWS\System32\drivers\ssudqcfilter.sys [64640 2016-04-25] (QUALCOMM Incorporated)
U5 UnlockerDriver5; C:\Program Files\Unlocker\UnlockerDriver5.sys [12352 2010-07-01] ()
S3 WdBoot; C:\WINDOWS\system32\drivers\WdBoot.sys [44056 2016-07-16] (Microsoft Corporation)
S3 WdFilter; C:\WINDOWS\system32\drivers\WdFilter.sys [290144 2016-07-16] (Microsoft Corporation)
S3 WdNisDrv; C:\WINDOWS\System32\Drivers\WdNisDrv.sys [123232 2016-07-16] (Microsoft Corporation)
R1 ZAM; C:\WINDOWS\System32\drivers\zam64.sys [203680 2017-03-22] (Zemana Ltd.)
R1 ZAM_Guard; C:\WINDOWS\System32\drivers\zamguard64.sys [203680 2017-03-22] (Zemana Ltd.)

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2017-04-03 20:17 - 2017-04-03 20:17 - 00015593 _____ C:\Users\psosk\Desktop\FRST.txt
2017-04-03 20:17 - 2017-04-03 20:17 - 00000000 ____D C:\FRST
2017-04-03 20:16 - 2017-04-03 20:17 - 02424832 _____ (Farbar) C:\Users\psosk\Desktop\FRST64.exe
2017-04-03 20:15 - 2017-04-03 20:15 - 00000000 ___HD C:\OneDriveTemp
2017-04-01 23:16 - 2017-04-01 23:16 - 00000668 _____ C:\Users\psosk\Desktop\DelFix.txt
2017-04-01 23:16 - 2017-04-01 23:16 - 00000426 _____ C:\Users\psosk\Desktop\DelFix1.txt
2017-04-01 23:15 - 2017-04-01 23:16 - 00000426 _____ C:\DelFix.txt
2017-04-01 23:15 - 2017-04-01 23:15 - 00797760 _____ C:\Users\psosk\Desktop\delfix_1.013.exe
2017-04-01 23:14 - 2017-04-01 23:14 - 00000000 ____D C:\Users\psosk\Desktop\backups
2017-03-28 19:38 - 2017-04-03 20:15 - 00000000 ___RD C:\Users\psosk\iCloudDrive
2017-03-28 19:38 - 2017-03-28 19:39 - 00000000 ____D C:\Users\psosk\AppData\Local\Apple Inc
2017-03-28 19:38 - 2017-03-28 19:38 - 00000000 ____D C:\Users\psosk\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\iCloud
2017-03-27 20:49 - 2017-03-27 20:49 - 00001822 _____ C:\Users\Public\Desktop\iTunes.lnk
2017-03-27 20:49 - 2017-03-27 20:49 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
2017-03-27 20:49 - 2017-03-27 20:49 - 00000000 ____D C:\Program Files\iTunes
2017-03-27 20:49 - 2017-03-27 20:49 - 00000000 ____D C:\Program Files\iPod
2017-03-27 20:48 - 2017-03-27 20:48 - 00000000 ____D C:\WINDOWS\System32\Tasks\Apple
2017-03-27 20:48 - 2017-03-27 20:48 - 00000000 ____D C:\Program Files (x86)\Apple Software Update
2017-03-27 20:43 - 2017-03-27 20:43 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iCloud
2017-03-23 21:01 - 2017-03-23 21:01 - 00000000 ____D C:\Users\psosk\AppData\Local\PeerDistRepub
2017-03-22 15:26 - 2017-04-03 20:17 - 00047387 _____ C:\WINDOWS\ZAM.krnl.trace
2017-03-22 15:26 - 2017-04-03 20:17 - 00022612 _____ C:\WINDOWS\ZAM_Guard.krnl.trace
2017-03-22 15:26 - 2017-03-22 15:26 - 00203680 _____ (Zemana Ltd.) C:\WINDOWS\system32\Drivers\zamguard64.sys
2017-03-22 15:26 - 2017-03-22 15:26 - 00203680 _____ (Zemana Ltd.) C:\WINDOWS\system32\Drivers\zam64.sys
2017-03-22 15:26 - 2017-03-22 15:26 - 00001217 _____ C:\Users\Public\Desktop\Zemana AntiMalware.lnk
2017-03-22 15:26 - 2017-03-22 15:26 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Zemana AntiMalware
2017-03-22 15:26 - 2017-03-22 15:26 - 00000000 ____D C:\Program Files (x86)\Zemana AntiMalware
2017-03-22 15:25 - 2017-03-22 15:25 - 05755024 _____ (Zemana Ltd. ) C:\Users\psosk\Downloads\Zemana.AntiMalware.Setup.exe
2017-03-22 15:25 - 2017-03-22 15:25 - 00000000 ____D C:\Users\psosk\AppData\Local\Zemana
2017-03-22 15:18 - 2017-03-22 15:18 - 00000000 ____D C:\ProgramData\Shared Space
2017-03-22 15:15 - 2017-03-22 14:50 - 00024064 _____ C:\WINDOWS\zoek-delete.exe
2017-03-22 15:11 - 2017-03-22 15:15 - 00000000 ____D C:\zoek
2017-03-21 23:32 - 2017-03-22 14:25 - 00028272 _____ C:\WINDOWS\system32\Drivers\TrueSight.sys
2017-03-21 22:44 - 2017-03-21 22:44 - 00002775 _____ C:\Users\Public\Desktop\Sophos Virus Removal Tool.lnk
2017-03-21 22:44 - 2017-03-21 22:44 - 00000000 ____D C:\ProgramData\Sophos
2017-03-21 22:44 - 2017-03-21 22:44 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Sophos
2017-03-21 22:44 - 2017-03-21 22:44 - 00000000 ____D C:\Program Files (x86)\Sophos
2017-03-21 22:32 - 2017-03-21 22:33 - 00000000 ____D C:\ProgramData\RogueKiller
2017-03-19 23:31 - 2017-03-19 23:31 - 00000000 ____D C:\Users\psosk\AppData\Roaming\Macromedia
2017-03-19 20:34 - 2017-03-19 20:34 - 00000000 ____D C:\Users\TEMP.DESKTOP-4KG2J6A.004\AppData\Local\Comms
2017-03-19 20:33 - 2017-03-19 20:34 - 00002444 _____ C:\Users\TEMP.DESKTOP-4KG2J6A.004\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OneDrive.lnk
2017-03-19 20:33 - 2017-03-19 20:34 - 00000000 ___RD C:\Users\TEMP.DESKTOP-4KG2J6A.004\OneDrive
2017-03-19 20:33 - 2017-03-19 20:34 - 00000000 ____D C:\Users\TEMP.DESKTOP-4KG2J6A.004\AppData\Roaming\Apple Computer
2017-03-19 20:33 - 2017-03-19 20:33 - 00000000 ____D C:\Users\TEMP.DESKTOP-4KG2J6A.004\AppData\Roaming\Skype
2017-03-19 20:33 - 2017-03-19 20:33 - 00000000 ____D C:\Users\TEMP.DESKTOP-4KG2J6A.004\AppData\Local\Apple Computer
2017-03-19 20:32 - 2017-03-19 20:49 - 00000000 ____D C:\Users\TEMP.DESKTOP-4KG2J6A.004
2017-03-19 20:32 - 2017-03-19 20:41 - 00000000 ____D C:\Users\TEMP.DESKTOP-4KG2J6A.004\AppData\Local\Google
2017-03-19 20:32 - 2017-03-19 20:34 - 00000000 ____D C:\Users\TEMP.DESKTOP-4KG2J6A.004\AppData\Local\Packages
2017-03-19 20:32 - 2017-03-19 20:33 - 00000000 ____D C:\Users\TEMP.DESKTOP-4KG2J6A.004\AppData\Local\ConnectedDevicesPlatform
2017-03-19 20:32 - 2017-03-19 20:32 - 00000020 ___SH C:\Users\TEMP.DESKTOP-4KG2J6A.004\ntuser.ini
2017-03-19 20:32 - 2017-03-19 20:32 - 00000000 _SHDL C:\Users\TEMP.DESKTOP-4KG2J6A.004\Šablony
2017-03-19 20:32 - 2017-03-19 20:32 - 00000000 _SHDL C:\Users\TEMP.DESKTOP-4KG2J6A.004\Soubory cookie
2017-03-19 20:32 - 2017-03-19 20:32 - 00000000 _SHDL C:\Users\TEMP.DESKTOP-4KG2J6A.004\Poslední
2017-03-19 20:32 - 2017-03-19 20:32 - 00000000 _SHDL C:\Users\TEMP.DESKTOP-4KG2J6A.004\Okolní tiskárny
2017-03-19 20:32 - 2017-03-19 20:32 - 00000000 _SHDL C:\Users\TEMP.DESKTOP-4KG2J6A.004\Okolní síť
2017-03-19 20:32 - 2017-03-19 20:32 - 00000000 _SHDL C:\Users\TEMP.DESKTOP-4KG2J6A.004\Nabídka Start
2017-03-19 20:32 - 2017-03-19 20:32 - 00000000 _SHDL C:\Users\TEMP.DESKTOP-4KG2J6A.004\Dokumenty
2017-03-19 20:32 - 2017-03-19 20:32 - 00000000 _SHDL C:\Users\TEMP.DESKTOP-4KG2J6A.004\Documents\Obrázky
2017-03-19 20:32 - 2017-03-19 20:32 - 00000000 _SHDL C:\Users\TEMP.DESKTOP-4KG2J6A.004\Documents\Hudba
2017-03-19 20:32 - 2017-03-19 20:32 - 00000000 _SHDL C:\Users\TEMP.DESKTOP-4KG2J6A.004\Documents\Filmy
2017-03-19 20:32 - 2017-03-19 20:32 - 00000000 _SHDL C:\Users\TEMP.DESKTOP-4KG2J6A.004\Data aplikací
2017-03-19 20:32 - 2017-03-19 20:32 - 00000000 _SHDL C:\Users\TEMP.DESKTOP-4KG2J6A.004\AppData\Roaming\Microsoft\Windows\Start Menu\Programy
2017-03-19 20:32 - 2017-03-19 20:32 - 00000000 _SHDL C:\Users\TEMP.DESKTOP-4KG2J6A.004\AppData\Local\Data aplikací
2017-03-19 20:32 - 2017-03-19 20:32 - 00000000 ____D C:\Users\TEMP.DESKTOP-4KG2J6A.004\AppData\Roaming\Adobe
2017-03-19 20:32 - 2017-03-19 20:32 - 00000000 ____D C:\Users\TEMP.DESKTOP-4KG2J6A.004\AppData\Local\TileDataLayer
2017-03-19 20:27 - 2017-03-19 20:30 - 00000000 ____D C:\Users\TEMP.DESKTOP-4KG2J6A.003\AppData\Local\Comms
2017-03-19 20:27 - 2017-03-19 20:30 - 00000000 ____D C:\Users\TEMP.DESKTOP-4KG2J6A.003
2017-03-19 20:26 - 2017-03-22 15:12 - 00000000 ____D C:\Users\TEMP.DESKTOP-4KG2J6A.002\AppData\Local\Google
2017-03-19 20:26 - 2017-03-19 20:27 - 00000000 ____D C:\Users\TEMP.DESKTOP-4KG2J6A.002
2017-03-19 20:22 - 2017-03-19 20:26 - 00000000 ____D C:\Users\TEMP.DESKTOP-4KG2J6A.001
2017-03-19 19:49 - 2017-03-19 19:49 - 775779908 _____ C:\WINDOWS\MEMORY.DMP
2017-03-19 19:49 - 2017-03-19 19:49 - 00412652 _____ C:\WINDOWS\Minidump\031917-10875-01.dmp
2017-03-19 19:49 - 2017-03-19 19:49 - 00000000 ____D C:\WINDOWS\Minidump
2017-03-18 19:53 - 2017-03-18 19:54 - 00000000 ____D C:\Users\TEMP.DESKTOP-4KG2J6A.000\AppData\Local\Comms
2017-03-18 19:50 - 2017-03-18 19:54 - 00000000 ____D C:\Users\TEMP.DESKTOP-4KG2J6A.000
2017-03-18 19:49 - 2017-03-18 19:50 - 00000000 ____D C:\Users\TEMP.DESKTOP-4KG2J6A
2017-03-18 19:34 - 2017-03-18 19:35 - 00000000 ____D C:\Users\TEMP
2017-03-18 00:25 - 2017-03-18 01:21 - 00000000 ____D C:\ESD
2017-03-18 00:24 - 2017-03-18 00:24 - 00000000 ___HD C:\$Windows.~WS
2017-03-18 00:24 - 2017-03-18 00:24 - 00000000 ____D C:\$WINDOWS.~BT
2017-03-17 23:55 - 2017-04-03 20:14 - 00251840 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys
2017-03-17 23:55 - 2017-04-01 23:09 - 00092088 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mwac.sys
2017-03-17 23:55 - 2017-04-01 23:08 - 00186304 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\MBAMChameleon.sys
2017-03-17 23:55 - 2017-04-01 23:08 - 00111544 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\farflt.sys
2017-03-17 23:55 - 2017-04-01 23:08 - 00043968 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mbam.sys
2017-03-17 23:55 - 2017-03-17 23:55 - 00001912 _____ C:\Users\Public\Desktop\Malwarebytes.lnk
2017-03-17 23:55 - 2017-03-17 23:55 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes
2017-03-17 23:55 - 2017-03-17 23:55 - 00000000 ____D C:\ProgramData\Malwarebytes
2017-03-17 23:55 - 2017-03-17 23:55 - 00000000 ____D C:\Program Files\Malwarebytes
2017-03-17 23:55 - 2017-02-24 07:23 - 00077408 _____ C:\WINDOWS\system32\Drivers\mbae64.sys
2017-03-17 23:39 - 2017-03-31 20:21 - 00002260 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2017-03-17 23:39 - 2017-03-27 22:04 - 00000000 ____D C:\Users\psosk\AppData\Local\CrashDumps
2017-03-16 11:20 - 2012-02-08 17:36 - 00363520 _____ (CANON INC.) C:\WINDOWS\system32\CNC_B9L.dll
2017-03-16 11:20 - 2012-01-26 11:25 - 00081664 _____ C:\WINDOWS\system32\CNC1763D.TBL
2017-03-16 11:20 - 2012-01-16 15:21 - 00287744 _____ (CANON INC.) C:\WINDOWS\system32\CNC_B9C.dll
2017-03-16 11:20 - 2012-01-16 15:20 - 00106496 _____ (CANON INC.) C:\WINDOWS\system32\CNC_B9I.dll
2017-03-16 11:20 - 2008-08-25 19:02 - 00017920 _____ (CANON INC.) C:\WINDOWS\system32\CNHMCA6.dll
2017-03-16 11:19 - 2017-03-16 11:19 - 00000000 ___HD C:\ProgramData\CanonBJ
2017-03-16 11:19 - 2012-03-26 06:00 - 00389120 _____ (CANON INC.) C:\WINDOWS\system32\CNMLMB9.DLL
2017-03-14 01:23 - 2017-04-03 20:16 - 00326004 _____ C:\WINDOWS\system32\Drivers\fvstore.dat
2017-03-14 01:23 - 2017-03-17 22:49 - 00000000 ___HD C:\VTRoot
2017-03-13 22:01 - 2017-03-13 22:01 - 01060864 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfc71.dll
2017-03-13 22:01 - 2017-03-13 22:01 - 00348160 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msvcr71.dll
2017-03-13 21:39 - 2017-03-13 21:43 - 00000000 ___RD C:\Users\psosk\Desktop\Camera Roll
2017-03-13 21:35 - 2017-03-13 21:35 - 00000000 ____D C:\Users\psosk\Desktop\Nová složka
2017-03-13 21:18 - 2017-04-02 00:52 - 01474832 _____ C:\WINDOWS\system32\Drivers\sfi.dat
2017-03-13 21:18 - 2017-03-13 21:18 - 00001904 _____ C:\Users\Public\Desktop\COMODO Internet Security.lnk
2017-03-13 21:18 - 2017-03-13 21:18 - 00000000 ____D C:\WINDOWS\System32\Tasks\COMODO
2017-03-13 21:17 - 2017-03-30 05:10 - 00307960 _____ (COMODO) C:\WINDOWS\system32\iseguard64.dll
2017-03-13 21:17 - 2017-03-30 05:10 - 00236792 _____ (COMODO) C:\WINDOWS\SysWOW64\iseguard32.dll
2017-03-13 21:17 - 2017-03-29 23:49 - 00062208 _____ (COMODO) C:\WINDOWS\system32\Drivers\isedrv.sys
2017-03-13 21:17 - 2017-03-13 23:31 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Comodo
2017-03-13 21:17 - 2017-03-13 23:31 - 00000000 ____D C:\Program Files\COMODO
2017-03-13 21:17 - 2017-03-13 21:17 - 03858824 _____ (COMODO) C:\WINDOWS\SysWOW64\ise_installer.exe
2017-03-13 21:17 - 2017-03-13 21:17 - 00000000 ____D C:\Users\psosk\AppData\Local\Comodo
2017-03-13 21:16 - 2017-03-13 23:29 - 00000000 ____D C:\Program Files (x86)\Comodo
2017-03-13 21:11 - 2017-03-31 20:10 - 00000000 ____D C:\ProgramData\Comodo
2017-03-13 21:11 - 2017-03-13 21:11 - 00000000 ____D C:\ProgramData\Comodo Downloader
2017-03-13 21:00 - 2017-03-13 21:35 - 00000000 ____D C:\Users\psosk\Desktop\hudba
2017-03-08 23:17 - 2017-04-03 20:15 - 00000000 ____D C:\Users\psosk\AppData\Local\Spotify
2017-03-08 23:17 - 2017-03-13 22:00 - 00002037 _____ C:\Users\psosk\Desktop\Spotify.lnk
2017-03-08 23:17 - 2017-03-08 23:17 - 00001836 _____ C:\Users\psosk\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Spotify.lnk
2017-03-08 23:16 - 2017-04-03 20:15 - 00000000 ____D C:\Users\psosk\AppData\Roaming\Spotify
2017-03-07 21:10 - 2017-03-07 21:10 - 00000000 ____D C:\Users\psosk\AppData\Local\AirParrot 2
2017-03-07 21:10 - 2017-03-07 21:10 - 00000000 ____D C:\ProgramData\AirParrot 2
2017-03-07 14:56 - 2017-03-07 14:56 - 00001388 _____ C:\Program Files (x86)\metadata
2017-03-07 14:55 - 2017-03-17 23:39 - 00002069 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2017-03-07 14:52 - 2017-03-07 14:52 - 00000000 ____D C:\Users\psosk\Documents\aMule Downloads
2017-03-07 12:07 - 2017-03-07 12:07 - 00000000 ____D C:\Users\psosk\AppData\Roaming\Wargaming.net

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2017-04-03 20:15 - 2017-02-23 05:01 - 00000180 _____ C:\WINDOWS\system32\{A6D608F0-0BDE-491A-97AE-5C4B05D86E01}.bat
2017-04-03 20:15 - 2017-02-22 20:23 - 00000000 ___RD C:\Users\psosk\OneDrive
2017-04-03 20:15 - 2017-02-22 20:21 - 00000000 __SHD C:\Users\psosk\IntelGraphicsProfiles
2017-04-03 20:14 - 2017-02-23 05:00 - 00000006 ____H C:\WINDOWS\Tasks\SA.DAT
2017-04-02 00:52 - 2017-02-22 18:23 - 00262144 _____ C:\WINDOWS\system32\config\BBI
2017-04-02 00:34 - 2017-02-23 05:00 - 00000000 ____D C:\WINDOWS\system32\SleepStudy
2017-04-01 23:32 - 2017-02-22 18:23 - 00000000 ____D C:\WINDOWS\CbsTemp
2017-04-01 23:15 - 2017-02-22 20:06 - 02681866 _____ C:\WINDOWS\system32\PerfStringBackup.INI
2017-04-01 23:15 - 2017-02-22 18:28 - 01211394 _____ C:\WINDOWS\system32\perfh005.dat
2017-04-01 23:15 - 2017-02-22 18:28 - 00293202 _____ C:\WINDOWS\system32\perfc005.dat
2017-04-01 23:10 - 2017-02-22 18:26 - 00000000 ____D C:\WINDOWS\AppReadiness
2017-03-31 20:21 - 2017-02-22 20:26 - 00002272 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2017-03-31 20:16 - 2017-02-22 18:26 - 00000000 ___HD C:\Program Files\WindowsApps
2017-03-31 20:10 - 2017-02-22 20:40 - 00000000 ____D C:\KMPlayer
2017-03-28 19:38 - 2017-03-02 23:34 - 00000000 ____D C:\Users\psosk\AppData\Roaming\Apple Computer
2017-03-28 19:38 - 2017-02-22 20:20 - 00000000 ____D C:\Users\psosk
2017-03-27 20:49 - 2017-03-02 23:51 - 00000000 ____D C:\Program Files\Common Files\Apple
2017-03-27 20:48 - 2017-03-02 23:51 - 00002535 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Apple Software Update.lnk
2017-03-27 20:43 - 2017-03-02 23:51 - 00000000 ____D C:\Users\psosk\AppData\Local\Apple Computer
2017-03-26 21:09 - 2017-02-22 18:26 - 00000000 ____D C:\WINDOWS\INF
2017-03-22 15:11 - 2017-02-22 18:26 - 00000000 ___HD C:\WINDOWS\system32\GroupPolicy
2017-03-21 22:29 - 2017-02-24 20:59 - 00000000 ____D C:\WINDOWS\system32\MRT
2017-03-21 22:28 - 2017-02-24 20:59 - 138634176 ____C (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2017-03-19 20:49 - 2017-02-22 20:19 - 00000000 ____D C:\Users\defaultuser0
2017-03-19 20:34 - 2017-02-22 20:24 - 00003290 _____ C:\WINDOWS\System32\Tasks\OneDrive Standalone Update Task v2
2017-03-19 20:32 - 2017-02-22 20:21 - 00000000 __RHD C:\Users\Public\AccountPictures
2017-03-18 19:41 - 2017-03-02 00:42 - 00000000 ____D C:\WINDOWS\system32\log
2017-03-18 01:08 - 2017-02-22 18:31 - 00000000 ___DC C:\WINDOWS\Panther
2017-03-17 23:39 - 2017-03-02 00:43 - 00000000 ____D C:\Users\psosk\AppData\LocalLow\Mozilla
2017-03-17 23:39 - 2017-03-02 00:43 - 00000000 ____D C:\ProgramData\Apple
2017-03-17 23:38 - 2017-03-02 00:42 - 00000000 _____ C:\WINDOWS\SysWOW64\4
2017-03-17 23:38 - 2017-03-02 00:42 - 00000000 _____ C:\WINDOWS\SysWOW64\3
2017-03-17 22:47 - 2017-02-22 20:21 - 00000000 ____D C:\Users\psosk\AppData\Local\Packages
2017-03-17 22:45 - 2017-02-22 18:26 - 00000000 ____D C:\WINDOWS\LiveKernelReports
2017-03-16 11:20 - 2017-02-22 18:26 - 00000000 ____D C:\WINDOWS\system32\FxsTmp
2017-03-13 22:00 - 2017-02-22 20:42 - 00002847 _____ C:\Users\psosk\Desktop\µTorrent.lnk
2017-03-10 07:17 - 2017-02-25 18:56 - 00835576 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe
2017-03-10 07:17 - 2017-02-25 18:56 - 00177656 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl
2017-03-09 20:32 - 2017-02-22 20:25 - 00000000 ____D C:\Users\psosk\AppData\Local\Google
2017-03-09 20:32 - 2017-02-22 20:25 - 00000000 ____D C:\Program Files (x86)\Google
2017-03-07 21:47 - 2017-03-03 21:07 - 00000000 _____ C:\WINDOWS\SysWOW64\1
2017-03-07 21:46 - 2017-02-24 20:20 - 00034328 _____ (Sysinternals - www.sysinternals.com) C:\WINDOWS\system32\Drivers\PROCEXP152.SYS
2017-03-07 11:44 - 2017-02-22 20:21 - 00000000 ____D C:\Users\psosk\AppData\Local\VirtualStore

==================== Files in the root of some directories =======

2017-03-07 14:56 - 2017-03-07 14:56 - 0001388 _____ () C:\Program Files (x86)\metadata

Some files in TEMP:
====================
2014-08-06 17:47 - 2014-08-06 17:47 - 0157696 _____ () C:\Users\psosk\AppData\Local\Temp\ERUNT.exe
2017-03-31 20:10 - 2017-03-31 20:10 - 3866608 _____ (COMODO) C:\Users\psosk\AppData\Local\Temp\ise_installer.exe

==================== Bamital & volsnap ======================

(There is no automatic fix for files that do not pass verification.)

C:\WINDOWS\system32\winlogon.exe => File is digitally signed
C:\WINDOWS\system32\wininit.exe => File is digitally signed
C:\WINDOWS\explorer.exe => File is digitally signed
C:\WINDOWS\SysWOW64\explorer.exe => File is digitally signed
C:\WINDOWS\system32\svchost.exe => File is digitally signed
C:\WINDOWS\SysWOW64\svchost.exe => File is digitally signed
C:\WINDOWS\system32\services.exe => File is digitally signed
C:\WINDOWS\system32\User32.dll => File is digitally signed
C:\WINDOWS\SysWOW64\User32.dll => File is digitally signed
C:\WINDOWS\system32\userinit.exe => File is digitally signed
C:\WINDOWS\SysWOW64\userinit.exe => File is digitally signed
C:\WINDOWS\system32\rpcss.dll => File is digitally signed
C:\WINDOWS\system32\dnsapi.dll => File is digitally signed
C:\WINDOWS\SysWOW64\dnsapi.dll => File is digitally signed
C:\WINDOWS\system32\Drivers\volsnap.sys => File is digitally signed

LastRegBack: 2017-03-31 20:25

==================== End of FRST.txt ============================

[kokabura]

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 15-03-2017
Ran by psosk (03-04-2017 20:17:47)
Running from C:\Users\psosk\Desktop
Windows 10 Pro Version 1607 (X64) (2017-02-22 18:19:51)
Boot Mode: Normal
==========================================================


==================== Accounts: =============================

Administrator (S-1-5-21-3249506284-3394159516-870956781-500 - Administrator - Disabled)
DefaultAccount (S-1-5-21-3249506284-3394159516-870956781-503 - Limited - Disabled)
defaultuser0 (S-1-5-21-3249506284-3394159516-870956781-1000 - Limited - Disabled) => C:\Users\defaultuser0
Guest (S-1-5-21-3249506284-3394159516-870956781-501 - Limited - Disabled)
psosk (S-1-5-21-3249506284-3394159516-870956781-1001 - Administrator - Enabled) => C:\Users\psosk

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: COMODO Antivirus (Enabled - Up to date) {D0CC7563-ABD2-DEBE-138E-FDD553335AF2}
AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AV: Malwarebytes (Disabled - Up to date) {23007AD3-69FE-687C-2629-D584AFFAF72B}
AS: Comodo Defense+ (Enabled - Up to date) {6BAD9487-8DE8-D130-293E-C6A728B4104F}
AS: Malwarebytes (Disabled - Out of date) {98619B37-4FC4-67F2-1C99-EEF6D47DBD96}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
FW: COMODO Firewall (Enabled) {E8F7F446-E1BD-DFE6-38D1-54E0ADE01D89}

==================== Installed Programs ======================

(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

µTorrent (HKU\S-1-5-21-3249506284-3394159516-870956781-1001\...\uTorrent) (Version: 3.4.9.43295 - BitTorrent Inc.)
Apple Mobile Device Support (HKLM\...\{DB18F1C0-846F-46F5-A074-5B97C8AF5C8E}) (Version: 10.3.1.2 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{52D87F32-70E4-4348-8148-C0B9F35B1314}) (Version: 2.3.0.177 - Apple Inc.)
Battle.net (HKLM-x32\...\Battle.net) (Version: - Blizzard Entertainment)
Bonjour (HKLM\...\{56DDDFB8-7F79-4480-89D5-25E1F52AB28F}) (Version: 3.1.0.1 - Apple Inc.)
COMODO Internet Security Pro (HKLM\...\COMODO Internet Security) (Version: 10.0.0.6092 - COMODO Security Solutions Inc.)
COMODO Internet Security Pro (Version: 10.0.0.6092 - COMODO Security Solutions Inc.) Hidden
COMODO Secure Shopping (HKLM-x32\...\Comodo Secure_Shopping_list_uninstall) (Version: 1.1.405760.79 - Comodo)
Crysis 3 (HKLM-x32\...\Q3J5c2lzMw==_is1) (Version: 1 - )
DAEMON Tools Lite (HKLM\...\DAEMON Tools Lite) (Version: 10.5.1.0230 - Disc Soft Ltd)
Diablo III (HKLM-x32\...\Diablo III) (Version: - Blizzard Entertainment)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 57.0.2987.133 - Google Inc.)
Google Update Helper (x32 Version: 1.3.32.7 - Google Inc.) Hidden
iCloud (HKLM\...\{0493048C-CB1A-44B7-8BB3-8467AF7BA9E4}) (Version: 6.1.2.13 - Apple Inc.)
iMyFone Umate 3.5.0.0 (HKLM-x32\...\{5284F901-9F62-4462-A0E6-2E4373A64454}_is1) (Version: 3.5.0.0 - Shenzhen iMyFone Technology Co., Ltd.)
Internet Security Essentials (HKLM-x32\...\ComodoIse) (Version: 1.1.413499.43 - Comodo)
iTunes (HKLM\...\{164600BE-9CEC-44E6-9B38-2B12D5FE2342}) (Version: 12.6.0.100 - Apple Inc.)
KMPlayer (remove only) (HKLM-x32\...\The KMPlayer) (Version: 4.1.5.8 - PandoraTV)
Malwarebytes verze 3.0.6.1469 (HKLM\...\{35065F43-4BB2-439A-BFF7-0F1014F2E0CD}_is1) (Version: 3.0.6.1469 - Malwarebytes)
Microsoft OneDrive (HKU\S-1-5-21-3249506284-3394159516-870956781-1001\...\OneDriveSetup.exe) (Version: 17.3.6798.0207 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Podpora aplikací Apple (32bitová) (HKLM-x32\...\{05E07D23-91E9-4E70-A4CC-EF505088F967}) (Version: 5.4.1 - Apple Inc.)
Podpora aplikací Apple (64bitová) (HKLM\...\{741291DA-2B34-4D44-8FB6-58EDE21261D8}) (Version: 5.4.1 - Apple Inc.)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7829 - Realtek Semiconductor Corp.)
Sophos Virus Removal Tool (HKLM-x32\...\{B829E117-D072-41EA-9606-9826A38D34C1}) (Version: 2.5.6 - Sophos Limited)
Spotify (HKU\S-1-5-21-3249506284-3394159516-870956781-1001\...\Spotify) (Version: 1.0.51.693.g6ea1e7f6 - Spotify AB)
Unlocker 1.9.2 (HKLM\...\Unlocker) (Version: 1.9.2 - Cedrick Collomb)
WinRAR 5.40 (64-bit) (HKLM\...\WinRAR archiver) (Version: 5.40.0 - win.rar GmbH)
World of Tanks (HKU\S-1-5-21-3249506284-3394159516-870956781-1001\...\{1EAC1D02-C6AC-4FA6-9A44-96258C37C812eu}_is1) (Version: - Wargaming.net)
Zemana AntiMalware (HKLM-x32\...\{8F0CD7D1-42F3-4195-95CD-833578D45057}_is1) (Version: 2.72.0.176 - Zemana Ltd.)

==================== Custom CLSID (Whitelisted): ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== Scheduled Tasks (Whitelisted) =============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

Task: {33B7908C-F97C-4AD9-8B38-F345B9F2238F} - System32\Tasks\COMODO\COMODO Update {A6D52E4F-569B-4756-B3D8-DF217313DA85} => C:\Program Files\COMODO\COMODO Internet Security\cfpconfg.exe [2016-12-28] (COMODO)
Task: {45E34F3C-0238-45C9-B1BD-E1C073ACADB1} - System32\Tasks\COMODO\COMODO Scan {F140D794-60B6-4F00-9235-D6457AA25B22} => C:\Program Files\COMODO\COMODO Internet Security\cfpconfg.exe [2016-12-28] (COMODO)
Task: {6C6F0A64-CEBE-40CC-AF94-F9AC08389159} - System32\Tasks\COMODO\COMODO Maintenance {947247B5-026A-4437-9371-770782BE839D} => C:\Program Files\COMODO\COMODO Internet Security\cfpconfg.exe [2016-12-28] (COMODO)
Task: {80D1578F-3E4C-48F2-88B6-B97C863D17C5} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2017-02-22] (Google Inc.)
Task: {A7FF7F1E-E9B9-4263-85DD-123305531687} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2017-02-22] (Google Inc.)
Task: {AA67CE89-C5BC-4D56-9F8C-04902D5F3F3B} - System32\Tasks\COMODO\COMODO Autostart {D5EFF3B3-E126-4AF6-BCE9-852A72129E10} => C:\Program Files\COMODO\COMODO Internet Security\cistray.exe [2016-12-28] (COMODO)
Task: {C809CDFC-0F0B-40AB-8F88-9496B4140FAA} - System32\Tasks\COMODO\COMODO Signature Update {B9D5C6F9-17D2-4917-8BD0-614BAA1C6A59} => C:\Program Files\COMODO\COMODO Internet Security\cfpconfg.exe [2016-12-28] (COMODO)
Task: {E9E9F522-BFAE-4E5B-9032-9231C8A2C02A} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2017-02-14] (Apple Inc.)
Task: {F3B98A50-3D03-492F-81C7-08F4F9444421} - System32\Tasks\COMODO\COMODO CMC {06A09C0F-DD9C-4191-A670-71115CD78627} => C:\Program Files\COMODO\COMODO Internet Security\cfpconfg.exe [2016-12-28] (COMODO)

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)


==================== Shortcuts =============================

(The entries could be listed to be restored or removed.)

==================== Loaded Modules (Whitelisted) ==============

2016-07-16 13:42 - 2016-07-16 13:42 - 00231424 _____ () C:\WINDOWS\SYSTEM32\ism32k.dll
2016-12-17 21:17 - 2016-12-09 12:29 - 02681200 _____ () C:\WINDOWS\system32\CoreUIComponents.dll
2016-12-28 01:17 - 2016-12-28 01:17 - 00155320 _____ () C:\Program Files\COMODO\COMODO Internet Security\cmdwrhlp.dll
2016-12-28 01:16 - 2016-12-28 01:16 - 00107704 _____ () C:\Program Files\COMODO\COMODO Internet Security\cavwpps.dll
2016-12-28 01:16 - 2016-12-28 01:16 - 00179896 _____ () C:\Program Files\COMODO\COMODO Internet Security\cmdcomps.dll
2017-01-13 14:56 - 2017-01-13 14:56 - 00092472 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
2017-03-16 16:08 - 2017-03-16 16:08 - 01354040 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll
2017-03-17 23:55 - 2017-02-24 07:23 - 02264352 _____ () C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\PoliciesControllerImpl.dll
2016-03-16 11:25 - 2016-03-16 11:25 - 00073912 _____ () C:\Program Files\COMODO\COMODO Internet Security\scanners\smart.cav
2016-12-17 21:17 - 2016-12-09 12:29 - 02681200 _____ () C:\WINDOWS\SYSTEM32\CoreUIComponents.dll
2016-11-02 00:05 - 2016-11-02 00:05 - 00401896 _____ () C:\WINDOWS\system32\igfxTray.exe
2016-09-27 20:16 - 2016-09-27 20:16 - 00134656 _____ () C:\Windows\ShellExperiences\Windows.UI.Shell.SharedUtilities.dll
2017-01-10 22:55 - 2016-12-21 09:09 - 00474112 _____ () C:\Windows\ShellExperiences\QuickActions.dll
2017-01-10 22:55 - 2016-12-21 08:54 - 09760768 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\CortanaApi.dll
2017-01-10 22:55 - 2016-12-21 08:48 - 01401856 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.Core.dll
2017-01-10 22:55 - 2016-12-21 08:48 - 00757248 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\CSGSuggestLib.dll
2017-01-10 22:55 - 2016-12-21 08:48 - 02424320 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.BackgroundTask.dll
2017-01-10 22:55 - 2016-12-21 08:53 - 04853760 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\RemindersUI.dll
2017-03-13 20:27 - 2017-03-13 20:28 - 00077312 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.12.112.0_x64__kzf8qxf38zg5c\SkypeHost.exe
2017-03-13 20:27 - 2017-03-13 20:28 - 00182784 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.12.112.0_x64__kzf8qxf38zg5c\SkypeBackgroundTasks.dll
2017-03-13 20:27 - 2017-03-13 20:28 - 41048064 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.12.112.0_x64__kzf8qxf38zg5c\SkyWrap.dll
2017-03-13 20:27 - 2017-03-13 20:28 - 02236896 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.12.112.0_x64__kzf8qxf38zg5c\roottools.dll
2017-03-22 18:14 - 2017-03-22 18:14 - 00092472 _____ () C:\Program Files\iTunes\zlib1.dll
2017-03-22 18:14 - 2017-03-22 18:14 - 01354040 _____ () C:\Program Files\iTunes\libxml2.dll
2017-03-31 20:21 - 2017-03-29 10:47 - 02885464 _____ () C:\Program Files (x86)\Google\Chrome\Application\57.0.2987.133\libglesv2.dll
2017-03-31 20:21 - 2017-03-29 10:47 - 00099672 _____ () C:\Program Files (x86)\Google\Chrome\Application\57.0.2987.133\libegl.dll
2017-03-12 19:48 - 2017-03-12 19:49 - 00055808 _____ () C:\Program Files\WindowsApps\Microsoft.WindowsStore_11701.1001.79.0_x64__8wekyb3d8bbwe\WinStoreTasksWrapper.dll
2017-03-07 20:39 - 2017-03-07 20:40 - 02561536 _____ () C:\Program Files\WindowsApps\Microsoft.People_10.2.431.0_x64__8wekyb3d8bbwe\People.BackgroundTasks.dll
2017-03-07 20:39 - 2017-03-07 20:40 - 00138752 _____ () C:\Program Files\WindowsApps\Microsoft.People_10.2.431.0_x64__8wekyb3d8bbwe\PeopleUtilRT.Windows.dll
2017-03-16 16:09 - 2017-03-16 16:09 - 01041720 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
2017-03-16 16:08 - 2017-03-16 16:08 - 00189752 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxslt.dll
2017-01-13 14:56 - 2017-01-13 14:56 - 00080184 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
2017-03-26 20:09 - 2017-03-26 20:09 - 16058368 _____ () C:\Program Files\WindowsApps\9E2F88E3.Twitter_5.6.1.0_x86__wgeqdkkx372wm\Twitter.Windows.dll

==================== Alternate Data Streams (Whitelisted) =========

(If an entry is included in the fixlist, only the ADS will be removed.)


==================== Safe Mode (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MBAMService => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MBAMService => ""="Service"

==================== Association (Whitelisted) ===============

(If an entry is included in the fixlist, the registry item will be restored to default or removed.)


==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, it will be removed from the registry.)


==================== Hosts content: ===============================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2017-02-22 18:26 - 2017-03-22 14:51 - 00000753 ____A C:\WINDOWS\system32\Drivers\etc\hosts


127.0.0.1 localhost

==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-3249506284-3394159516-870956781-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\psosk\AppData\Local\Packages\Microsoft.Windows.Photos_8wekyb3d8bbwe\LocalState\PhotosAppBackground\{195ad8f5-310c-427f-9c9d-7c93855f85b1}.jpg
DNS Servers: 192.168.1.254
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
Windows Firewall is enabled.

==================== MSCONFIG/TASK MANAGER disabled items ==


==================== FirewallRules (Whitelisted) ===============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

FirewallRules: [vm-monitoring-nb-session] => (Allow) LPort=139
FirewallRules: [TCP Query User{D0AEADFA-B52B-488B-97FE-34394A5D1857}D:\hry\battlefield 4\bf4.exe] => (Allow) D:\hry\battlefield 4\bf4.exe
FirewallRules: [UDP Query User{652F1928-682A-427F-B04A-5015A6F2A399}D:\hry\battlefield 4\bf4.exe] => (Allow) D:\hry\battlefield 4\bf4.exe
FirewallRules: [{C57BF9D8-0721-41D6-B281-332ECE40CCEC}] => (Allow) D:\steam\Steam.exe
FirewallRules: [{64088FB4-A47F-49B9-8859-C4F85AEAA555}] => (Allow) D:\steam\Steam.exe
FirewallRules: [{F8AFADC4-C74E-4CF1-9C78-CB4C375C41E6}] => (Allow) D:\steam\bin\cef\cef.win7\steamwebhelper.exe
FirewallRules: [{F6A7B196-D6B0-42A7-984F-4848034B57AF}] => (Allow) D:\steam\bin\cef\cef.win7\steamwebhelper.exe
FirewallRules: [{E9F92656-D9CB-4AD9-ABDE-19B150E1D515}] => (Allow) D:\steam\steamapps\common\Path of Exile\PathOfExileSteam.exe
FirewallRules: [{7720C179-052F-453E-A3F9-3C5B23BEDB16}] => (Allow) D:\steam\steamapps\common\Path of Exile\PathOfExileSteam.exe
FirewallRules: [{92D03C57-1D29-40CA-B792-03BB7C734C8A}] => (Allow) C:\Users\psosk\AppData\Roaming\uTorrent\uTorrent.exe
FirewallRules: [{986C6728-D55F-4C5C-9F21-BF12C3174A75}] => (Allow) C:\Users\psosk\AppData\Roaming\uTorrent\uTorrent.exe
FirewallRules: [{28D85032-442F-48CE-AE67-C89A3BB929B1}] => (Allow) C:\Users\psosk\AppData\Roaming\uTorrent\uTorrent.exe
FirewallRules: [{2E5DD08A-FB08-4DFC-AB66-6EE5364FE273}] => (Allow) C:\Users\psosk\AppData\Roaming\uTorrent\uTorrent.exe
FirewallRules: [{AC172D71-C9B5-4693-90A1-B55CB1F7EA00}] => (Allow) C:\Users\psosk\AppData\Roaming\uTorrent\uTorrent.exe
FirewallRules: [{A466C159-220E-454A-919F-62B4C7B61CE4}] => (Allow) C:\Users\psosk\AppData\Roaming\uTorrent\uTorrent.exe
FirewallRules: [{959BAB98-DA77-4081-99CC-2B6243CD8B34}] => (Allow) D:\steam\steamapps\common\Counter-Strike Global Offensive\csgo.exe
FirewallRules: [{EF1E4DC7-4428-4459-8A16-5F1FC520D4C2}] => (Allow) D:\steam\steamapps\common\Counter-Strike Global Offensive\csgo.exe
FirewallRules: [{3223A7DE-9881-4B98-9288-CEB638589F11}] => (Allow) D:\steam\steamapps\common\Paladins\Binaries\Win32\HirezBridge.exe
FirewallRules: [{30B2A5EF-1F39-4B46-9FE9-31287145C022}] => (Allow) D:\steam\steamapps\common\Paladins\Binaries\Win32\HirezBridge.exe
FirewallRules: [TCP Query User{D4FE55F6-8089-4480-9AEB-41C6408F404F}D:\hry\gta 5\gta5.exe] => (Allow) D:\hry\gta 5\gta5.exe
FirewallRules: [UDP Query User{5320B0CC-85DA-42DD-942E-2FFBE1856D9E}D:\hry\gta 5\gta5.exe] => (Allow) D:\hry\gta 5\gta5.exe
FirewallRules: [{4AD43834-D456-475B-AAAA-6425DEF1C54C}] => (Allow) D:\hry\WoT\WoTLauncher.exe
FirewallRules: [{E5E7B039-F955-4F61-B31A-2E2B85E5B547}] => (Allow) D:\hry\WoT\WoTLauncher.exe
FirewallRules: [{3DEBA283-3A16-45BB-80C4-5312C9CB6855}] => (Allow) D:\hry\WoT\worldoftanks.exe
FirewallRules: [{DA959A5A-7453-4559-AE6A-CB4B2DC29A62}] => (Allow) D:\hry\WoT\worldoftanks.exe
FirewallRules: [TCP Query User{CED1616D-981F-4F1E-869C-0D6DE6CA5556}D:\steam\steamapps\common\half-life\hl.exe] => (Allow) D:\steam\steamapps\common\half-life\hl.exe
FirewallRules: [UDP Query User{BD3B9BB2-14AC-4E02-9AE8-99A4CD543085}D:\steam\steamapps\common\half-life\hl.exe] => (Allow) D:\steam\steamapps\common\half-life\hl.exe
FirewallRules: [{DAC3C11F-AC73-4600-AAF2-717F722B167B}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{3FC0B02A-A5A8-4A27-88D6-C4F8902950ED}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{ADCC3B13-84B3-4C2A-ABDF-E50971A7E4BB}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{6318EAAD-C00F-4E9E-A360-0665B82ED483}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [TCP Query User{836EA00F-1BCF-464D-B6A1-CA4D88ABAE0E}C:\program files (x86)\amulell\amule.exe] => (Block) C:\program files (x86)\amulell\amule.exe
FirewallRules: [UDP Query User{DED02F03-739A-4B38-B94F-4A07B33DF023}C:\program files (x86)\amulell\amule.exe] => (Block) C:\program files (x86)\amulell\amule.exe
FirewallRules: [TCP Query User{2BCA03E2-A31E-4D87-BB9C-EA40EB3DFC4D}C:\users\psosk\appdata\roaming\spotify\spotify.exe] => (Allow) C:\users\psosk\appdata\roaming\spotify\spotify.exe
FirewallRules: [UDP Query User{264FE8C1-7E69-4A2C-8816-60A4D20AF085}C:\users\psosk\appdata\roaming\spotify\spotify.exe] => (Allow) C:\users\psosk\appdata\roaming\spotify\spotify.exe
FirewallRules: [{DEFF99B8-457C-41D2-9037-1AE33FFAB196}] => (Allow) C:\Program Files (x86)\Ballduck\Application\chrome.exe
FirewallRules: [{6714DE9A-E02C-4390-B79B-00BA0189C6FA}] => (Allow) C:\Program Files\iTunes\iTunes.exe
FirewallRules: [{E12238AD-2F3A-4850-B28A-BA6C297BA528}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

==================== Restore Points =========================

01-04-2017 23:16:30 End of disinfection

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (04/01/2017 11:16:32 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )
Description: Služba Šifrování selhala při volání OnIdentity() v objektu System Writer.

Details:
AddLegacyDriverFiles: Unable to back up image of binary Protokol Microsoft LLDP (Link-Layer Discovery Protocol).

System Error:
Přístup byl odepřen.
.

Error: (04/01/2017 11:16:30 PM) (Source: VSS) (EventID: 8193) (User: )
Description: Chyba služby Stínová kopie svazků: Při volání rutiny ConvertStringSidToSid(S-1-5-21-3249506284-3394159516-870956781-1001.bak) došlo k neočekávané chybě. hr= 0x80070539, Struktura ID zabezpečení není platná.
.


Operace:
Událost OnIdentify
Shromažďování dat modulu pro zápis

Kontext:
Kontext spuštění: Shadow Copy Optimization Writer
ID třídy modulu pro zápis: {4dc3bdd4-ab48-4d07-adb0-3bee2926fd7f}
Název modulu pro zápis: Shadow Copy Optimization Writer
ID instance modulu pro zápis: {3ea10327-1cc0-4a2c-a0be-42d59d2781aa}

Error: (04/01/2017 11:11:08 PM) (Source: SecurityCenter) (EventID: 16) (User: )
Description: Při aktualizaci stavu na SECURITY_PRODUCT_STATE_EXPIRED došlo k chybě (chyba %3).

Error: (03/29/2017 09:41:34 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )
Description: Služba Šifrování selhala při volání OnIdentity() v objektu System Writer.

Details:
AddLegacyDriverFiles: Unable to back up image of binary Protokol Microsoft LLDP (Link-Layer Discovery Protocol).

System Error:
Přístup byl odepřen.
.

Error: (03/29/2017 09:41:31 PM) (Source: VSS) (EventID: 8193) (User: )
Description: Chyba služby Stínová kopie svazků: Při volání rutiny ConvertStringSidToSid(S-1-5-21-3249506284-3394159516-870956781-1001.bak) došlo k neočekávané chybě. hr= 0x80070539, Struktura ID zabezpečení není platná.
.


Operace:
Událost OnIdentify
Shromažďování dat modulu pro zápis

Kontext:
Kontext spuštění: Shadow Copy Optimization Writer
ID třídy modulu pro zápis: {4dc3bdd4-ab48-4d07-adb0-3bee2926fd7f}
Název modulu pro zápis: Shadow Copy Optimization Writer
ID instance modulu pro zápis: {dcfd720d-a8d7-482a-b550-05be0fc3cc3e}

Error: (03/27/2017 10:04:26 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Název chybující aplikace: GTAVLauncher.exe, verze: 1.0.877.1, časové razítko: 0x57eb8c55
Název chybujícího modulu: unknown, verze: 0.0.0.0, časové razítko: 0x00000000
Kód výjimky: 0xc0000005
Posun chyby: 0x0000000000022626
ID chybujícího procesu: 0x1664
Čas spuštění chybující aplikace: 0x01d2a73554fc7824
Cesta k chybující aplikaci: D:\hry\GTA 5\GTAVLauncher.exe
Cesta k chybujícímu modulu: unknown
ID zprávy: e3ee9523-7a2a-4eb5-8785-4d430f3790e5
Úplný název chybujícího balíčku:
ID aplikace související s chybujícím balíčkem:

Error: (03/27/2017 10:04:02 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Název chybující aplikace: GTAVLauncher.exe, verze: 1.0.877.1, časové razítko: 0x57eb8c55
Název chybujícího modulu: unknown, verze: 0.0.0.0, časové razítko: 0x00000000
Kód výjimky: 0xc0000005
Posun chyby: 0x0000000000022626
ID chybujícího procesu: 0x454
Čas spuštění chybující aplikace: 0x01d2a73542942b0d
Cesta k chybující aplikaci: D:\hry\GTA 5\GTAVLauncher.exe
Cesta k chybujícímu modulu: unknown
ID zprávy: 075bc2c7-5bd4-42c4-80a4-0f1fe5c897f0
Úplný název chybujícího balíčku:
ID aplikace související s chybujícím balíčkem:

Error: (03/27/2017 08:43:23 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Název chybující aplikace: MsiExec.exe, verze: 5.0.14393.0, časové razítko: 0x57899002
Název chybujícího modulu: MSI3A85.tmp, verze: 1.0.0.1, časové razítko: 0x585a4cf2
Kód výjimky: 0xc0000005
Posun chyby: 0x00009d70
ID chybujícího procesu: 0x2604
Čas spuštění chybující aplikace: 0x01d2a729ffbc63bd
Cesta k chybující aplikaci: C:\Windows\syswow64\MsiExec.exe
Cesta k chybujícímu modulu: C:\WINDOWS\Installer\MSI3A85.tmp
ID zprávy: c741c446-f8e7-4721-916a-d88067b111a3
Úplný název chybujícího balíčku:
ID aplikace související s chybujícím balíčkem:

Error: (03/26/2017 08:09:09 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )
Description: Služba Šifrování selhala při volání OnIdentity() v objektu System Writer.

Details:
AddLegacyDriverFiles: Unable to back up image of binary Protokol Microsoft LLDP (Link-Layer Discovery Protocol).

System Error:
Přístup byl odepřen.
.

Error: (03/26/2017 08:09:06 PM) (Source: VSS) (EventID: 8193) (User: )
Description: Chyba služby Stínová kopie svazků: Při volání rutiny ConvertStringSidToSid(S-1-5-21-3249506284-3394159516-870956781-1001.bak) došlo k neočekávané chybě. hr= 0x80070539, Struktura ID zabezpečení není platná.
.


Operace:
Událost OnIdentify
Shromažďování dat modulu pro zápis

Kontext:
Kontext spuštění: Shadow Copy Optimization Writer
ID třídy modulu pro zápis: {4dc3bdd4-ab48-4d07-adb0-3bee2926fd7f}
Název modulu pro zápis: Shadow Copy Optimization Writer
ID instance modulu pro zápis: {d8c4747f-a4f0-4361-af2d-244c6c336e6d}


System errors:
=============
Error: (04/03/2017 08:18:11 PM) (Source: DCOM) (EventID: 10010) (User: DESKTOP-4KG2J6A)
Description: Server {9E6E74C7-0E85-4D14-8851-7635E2C1C528} se v daném časovém limitu neregistroval u služby DCOM.

Error: (04/03/2017 08:17:40 PM) (Source: DCOM) (EventID: 10010) (User: DESKTOP-4KG2J6A)
Description: Server {9E6E74C7-0E85-4D14-8851-7635E2C1C528} se v daném časovém limitu neregistroval u služby DCOM.

Error: (04/03/2017 08:17:09 PM) (Source: DCOM) (EventID: 10010) (User: DESKTOP-4KG2J6A)
Description: Server {9E6E74C7-0E85-4D14-8851-7635E2C1C528} se v daném časovém limitu neregistroval u služby DCOM.

Error: (04/03/2017 08:16:53 PM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT AUTHORITY)
Description: Instalace se nezdařila: Instalování následující aktualizace se nezdařilo z důvodu chyby (0x80070057): Kumulativní aktualizace pro Windows 10 Version 1607 pro systémy x64 (KB4013429).

Error: (04/03/2017 08:16:39 PM) (Source: DCOM) (EventID: 10010) (User: DESKTOP-4KG2J6A)
Description: Server {9E6E74C7-0E85-4D14-8851-7635E2C1C528} se v daném časovém limitu neregistroval u služby DCOM.

Error: (04/03/2017 08:15:21 PM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: Nastavení oprávnění specifické pro aplikaci neuděluje oprávnění Místní Aktivace pro serverovou aplikaci COM s identifikátorem CLSID
{8D8F4F83-3594-4F07-8369-FC3C3CAE4919}
a APPID
{F72671A9-012C-4725-9D2F-2A4D32D65169}
uživateli NT AUTHORITY\SYSTEM (SID: S-1-5-18) z adresy LocalHost (pomocí LRPC) běžící v kontejneru aplikací Není k dispozici – SID (Není k dispozici). Toto oprávnění zabezpečení lze změnit pomocí nástroje správy Služba komponent.

Error: (04/02/2017 12:50:50 AM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: Nastavení oprávnění specifické pro aplikaci neuděluje oprávnění Místní Aktivace pro serverovou aplikaci COM s identifikátorem CLSID
{D63B10C5-BB46-4990-A94F-E40B9D520160}
a APPID
{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}
uživateli NT AUTHORITY\SYSTEM (SID: S-1-5-18) z adresy LocalHost (pomocí LRPC) běžící v kontejneru aplikací Není k dispozici – SID (Není k dispozici). Toto oprávnění zabezpečení lze změnit pomocí nástroje správy Služba komponent.

Error: (04/02/2017 12:48:14 AM) (Source: DCOM) (EventID: 10010) (User: DESKTOP-4KG2J6A)
Description: Server {9E6E74C7-0E85-4D14-8851-7635E2C1C528} se v daném časovém limitu neregistroval u služby DCOM.

Error: (04/02/2017 12:47:44 AM) (Source: DCOM) (EventID: 10010) (User: DESKTOP-4KG2J6A)
Description: Server {9E6E74C7-0E85-4D14-8851-7635E2C1C528} se v daném časovém limitu neregistroval u služby DCOM.

Error: (04/02/2017 12:42:13 AM) (Source: DCOM) (EventID: 10010) (User: DESKTOP-4KG2J6A)
Description: Server {9E6E74C7-0E85-4D14-8851-7635E2C1C528} se v daném časovém limitu neregistroval u služby DCOM.


CodeIntegrity:
===================================
Date: 2017-03-31 20:25:35.758
Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe) attempted to load \Device\HarddiskVolume4\Windows\syswow64\iseguard32.dll that did not meet the Microsoft signing level requirements.

Date: 2017-03-31 20:25:34.544
Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe) attempted to load \Device\HarddiskVolume4\Windows\System32\iseguard64.dll that did not meet the Microsoft signing level requirements.

Date: 2017-03-31 20:25:30.909
Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Windows\System32\svchost.exe) attempted to load \Device\HarddiskVolume4\Windows\System32\iseguard64.dll that did not meet the Windows signing level requirements.

Date: 2017-03-31 20:16:20.481
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume4\Windows\System32\iseguard64.dll because the set of per-page image hashes could not be found on the system.

Date: 2017-03-31 20:11:25.059
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume4\Windows\System32\iseguard64.dll because the set of per-page image hashes could not be found on the system.

Date: 2017-03-31 20:10:32.806
Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Windows\System32\svchost.exe) attempted to load \Device\HarddiskVolume4\Windows\System32\iseguard64.dll that did not meet the Windows signing level requirements.

Date: 2017-03-31 20:09:14.826
Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Windows\System32\services.exe) attempted to load \Device\HarddiskVolume4\Windows\System32\iseguard64.dll that did not meet the Windows signing level requirements.

Date: 2017-03-31 20:09:14.632
Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Windows\System32\wininit.exe) attempted to load \Device\HarddiskVolume4\Windows\syswow64\iseguard32.dll that did not meet the Windows signing level requirements.

Date: 2017-03-29 22:21:12.855
Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Windows\System32\svchost.exe) attempted to load \Device\HarddiskVolume4\Windows\System32\iseguard64.dll that did not meet the Windows signing level requirements.

Date: 2017-03-29 21:20:03.774
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume4\Windows\System32\iseguard64.dll because the set of per-page image hashes could not be found on the system.


==================== Memory info ===========================

Processor: Intel(R) Core(TM) i7-4790 CPU @ 3.60GHz
Percentage of memory in use: 17%
Total physical RAM: 16244.93 MB
Available physical RAM: 13411.95 MB
Total Virtual: 17268.93 MB
Available Virtual: 14482.3 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:110.83 GB) (Free:44.97 GB) NTFS
Drive d: (Krakonošovo) (Fixed) (Total:931.39 GB) (Free:553.8 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or (Size: 111.8 GB) (Disk ID: B3BFC4EA)

Partition: GPT.

========================================================
Disk: 1 (MBR Code: Windows 7 or (Size: 931.5 GB) (Disk ID: 00000000)

Partition: GPT.

==================== End of Addition.txt ============================

[jaro3]

Prosím, postupuj následujícím způsobem:
Otevřít poznámkový blok (Start => Všechny programy => Příslušenství => Poznámkový blok).
Prosím, zkopíruj do něj celý obsah níže.

Kód: Vybrat vše

Start
CloseProcesses:
HKU\S-1-5-21-3249506284-3394159516-870956781-1001\...\Run: [AirParrot2] => [X]
HKU\S-1-5-21-3249506284-3394159516-870956781-1001\...\Run: [AirParrot2] => [X]
HKU\S-1-5-21-3249506284-3394159516-870956781-1001\...\MountPoints2: {76be502b-f974-11e6-a310-74d435bea2a6} - "F:\WD SmartWare.exe" autoplay=true
ShellExecuteHooks: No Name - {60828C92-F449-11E6-B17D-64006A5CFC23} - C:\Program Files (x86)\Rokaphdruzitain\Fersetainzuvage.dll -> No File
SearchScopes: HKU\S-1-5-21-3249506284-3394159516-870956781-1001 -> DefaultScope {012E1000-F331-11DB-8314-0800200C9A66} URL = hxxp://www.google.com/search?q={searchTerms}
SearchScopes: HKU\S-1-5-21-3249506284-3394159516-870956781-1001 -> {012E1000-F331-11DB-8314-0800200C9A66} URL = hxxp://www.google.com/search?q={searchTerms}
CHR StartupUrls: Default -> "hxxp://www.google.com/","hxxp://www.google.com","hxxp://www.yessearches.com/?mode=nnnb&ptid=dam&uid=009C44AE9156AC61664D4A885154E3D4&v=20160315&ts=AHEpC3MoC3YtA0..","hxxp://www.youndoo.com/?z=bbf89e408b6336203faaee4g2z8b5mcm8bctdg7zec&from=dam&uid=KINGSTONXSV300S37A120G_50026B774A01A9C8&type=hp","hxxp://www.startpageing123.com/?type=hp&ts=1488568164&z=514e3583ed2551ee3e12f2bgdzfb8b8w7q1bag6q7z&from=che0812&uid=KINGSTONXSV300S37A120G_50026B774A01A9C8","hxxp://www.startpageing123.com/?type=hp&ts=1489430147&z=e4687c88a22c936418ffd3fg6zebbtaz6c2e3g4zft&from=che0812&uid=KINGSTONXSV300S37A120G_50026B774A01A9C8"
C:\Users\psosk\AppData\Local\Temp\ERUNT.exe
Task: {80D1578F-3E4C-48F2-88B6-B97C863D17C5} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2017-02-22] (Google Inc.)
Task: {A7FF7F1E-E9B9-4263-85DD-123305531687} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2017-02-22] (Google Inc.)

EmptyTemp:
End

(Můžeš použít funkci „vybrat vše“, klepni pravým tlačítkem myši na levé horní políčko v otevřeném poznámkovém bloku a zvol „ Vložit“).

Ulož jej na na plochu jako fixlist.txt


Spusťt FRST a stiskni tlačítko „Fix“ (Opravit) jen jednou a čekej.
Nástroj vypracuje log na ploše (Fixlog.txt), prosím zkopíruj sem celý jeho obsah.

AV: Malwarebytes trvale vypni rez. ochranu v reálném čase


C:\Users\TEMP.DESKTOP-4KG2J6A.004 to je název Tvého účtu?

C:\WINDOWS\SysWOW64\1
C:\Program Files (x86)\metadata
Podívej se , co je v těch složkách.

Windows 10 Anniversary update máš nainstalované?

[kokabura]

Fix result of Farbar Recovery Scan Tool (x64) Version: 15-03-2017
Ran by psosk (07-04-2017 13:57:34) Run:2
Running from C:\Users\psosk\Desktop
Loaded Profiles: psosk (Available Profiles: defaultuser0 & psosk)
Boot Mode: Normal
==============================================

fixlist content:
*****************
Start
CloseProcesses:
HKU\S-1-5-21-3249506284-3394159516-870956781-1001\...\Run: [AirParrot2] => [X]
HKU\S-1-5-21-3249506284-3394159516-870956781-1001\...\Run: [AirParrot2] => [X]
HKU\S-1-5-21-3249506284-3394159516-870956781-1001\...\MountPoints2: {76be502b-f974-11e6-a310-74d435bea2a6} - "F:\WD SmartWare.exe" autoplay=true
ShellExecuteHooks: No Name - {60828C92-F449-11E6-B17D-64006A5CFC23} - C:\Program Files (x86)\Rokaphdruzitain\Fersetainzuvage.dll -> No File
SearchScopes: HKU\S-1-5-21-3249506284-3394159516-870956781-1001 -> DefaultScope {012E1000-F331-11DB-8314-0800200C9A66} URL = hxxp://www.google.com/search?q={searchTerms}
SearchScopes: HKU\S-1-5-21-3249506284-3394159516-870956781-1001 -> {012E1000-F331-11DB-8314-0800200C9A66} URL = hxxp://www.google.com/search?q={searchTerms}
CHR StartupUrls: Default -> "hxxp://www.google.com/","hxxp://www.google.com","hxxp://www.yessearches.com/?mode=nnnb&ptid=dam&uid=009C44AE9156AC61664D4A885154E3D4&v=20160315&ts=AHEpC3MoC3YtA0..","hxxp://www.youndoo.com/?z=bbf89e408b6336203faaee4g2z8b5mcm8bctdg7zec&from=dam&uid=KINGSTONXSV300S37A120G_50026B774A01A9C8&type=hp","hxxp://www.startpageing123.com/?type=hp&ts=1488568164&z=514e3583ed2551ee3e12f2bgdzfb8b8w7q1bag6q7z&from=che0812&uid=KINGSTONXSV300S37A120G_50026B774A01A9C8","hxxp://www.startpageing123.com/?type=hp&ts=1489430147&z=e4687c88a22c936418ffd3fg6zebbtaz6c2e3g4zft&from=che0812&uid=KINGSTONXSV300S37A120G_50026B774A01A9C8"
C:\Users\psosk\AppData\Local\Temp\ERUNT.exe
Task: {80D1578F-3E4C-48F2-88B6-B97C863D17C5} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2017-02-22] (Google Inc.)
Task: {A7FF7F1E-E9B9-4263-85DD-123305531687} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2017-02-22] (Google Inc.)

EmptyTemp:
End
*****************

Processes closed successfully.
HKU\S-1-5-21-3249506284-3394159516-870956781-1001\Software\Microsoft\Windows\CurrentVersion\Run\\AirParrot2 => value not found.
HKU\S-1-5-21-3249506284-3394159516-870956781-1001\Software\Microsoft\Windows\CurrentVersion\Run\\AirParrot2 => value not found.
HKU\S-1-5-21-3249506284-3394159516-870956781-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{76be502b-f974-11e6-a310-74d435bea2a6} => key not found.
HKCR\CLSID\{76be502b-f974-11e6-a310-74d435bea2a6} => key not found.
HKLM\Software\Microsoft\Windows\CurrentVersion\explorer\ShellExecuteHooks\\{60828C92-F449-11E6-B17D-64006A5CFC23} => value not found.
HKCR\CLSID\{60828C92-F449-11E6-B17D-64006A5CFC23} => key not found.
HKU\S-1-5-21-3249506284-3394159516-870956781-1001\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value not found.
HKU\S-1-5-21-3249506284-3394159516-870956781-1001\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{012E1000-F331-11DB-8314-0800200C9A66} => key not found.
HKCR\CLSID\{012E1000-F331-11DB-8314-0800200C9A66} => key not found.
Chrome StartupUrls => removed successfully
"C:\Users\psosk\AppData\Local\Temp\ERUNT.exe" => not found.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{80D1578F-3E4C-48F2-88B6-B97C863D17C5} => key removed successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{80D1578F-3E4C-48F2-88B6-B97C863D17C5} => key removed successfully
C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineCore => moved successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\GoogleUpdateTaskMachineCore => key removed successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{A7FF7F1E-E9B9-4263-85DD-123305531687} => key removed successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{A7FF7F1E-E9B9-4263-85DD-123305531687} => key removed successfully
C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineUA => moved successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\GoogleUpdateTaskMachineUA => key removed successfully

=========== EmptyTemp: ==========

BITS transfer queue => 852417 B
DOMStore, IE Recovery, AppCache, Feeds Cache, Thumbcache, IconCache => 173287066 B
Java, Flash, Steam htmlcache => 7629399 B
Windows/system/drivers => 1864528 B
Edge => 1138506 B
Chrome => 772206033 B
Firefox => 0 B
Opera => 0 B

Temp, IE cache, history, cookies, recent:
Default => 0 B
Users => 0 B
ProgramData => 0 B
Public => 0 B
systemprofile => 128 B
systemprofile32 => 128 B
LocalService => 31798 B
NetworkService => 76482 B
defaultuser0 => 0 B
psosk => 113179969 B
TEMP.DESKTOP-4KG2J6A.004 => 21431855 B

RecycleBin => 225527783 B
EmptyTemp: => 1.2 GB temporary data Removed.

================================


The system needed a reboot.

==== End of Fixlog 13:57:42 ====

[kokabura]

C:\WINDOWS\SysWOW64\1 složku nemám, nebo jí nevidím
Windows 10 Anniversary nemám a dřív jsem neměl
C:\Users\TEMP.DESKTOP-4KG2J6A.004 toto by neměl být výchozí účet, ale během této diskuse mi něšlo lognout se, pouze mě to dočasně přihlísilo do profilu kde jsem neměl svá data, někde na internetu jsem našel co se má kde přepsat aby to šlo.. (poté už mi logování normálně fungovalo), nevím jestli problém s aktualizacemi nastal až poté

[jaro3]

Windows 10 Anniversary update bych doporučil nainstalovat ručně. Můžeš si zadat nové téma do sekce Windows.