Prosím o kontrolu logu Vyřešeno

Místo pro vaše HiJackThis logy a logy z dalších programů…

Moderátoři: Mods_senior, Security team

Uživatelský avatar
jaro3
člen Security týmu
Guru Level 15
Guru Level 15
Příspěvky: 43292
Registrován: červen 07
Bydliště: Jižní Čechy
Pohlaví: Muž
Stav:
Offline

Re: Prosím o kontrolu logu

Příspěvekod jaro3 » 16 úno 2016 14:23

Zavři všechny programy a prohlížeče. Deaktivuj antivir a firewall.
Prosím, odpoj všechny USB (kromě myši s klávesnice) nebo externí disky z počítače před spuštěním tohoto programu.
Spusť znovu RogueKiller ( Pro Windows Vista nebo Windows 7, klepni pravým a vyber "Spustit jako správce", ve Windows XP poklepej ke spuštění).
- Počkej, až Prescan dokončí práci...
- Pak klikni na "Prohledat " ,po jeho skončení:

- V záložkách (Registry , Tasks , Web Browser apod.) vše zatrhni (dej zatržítka)
(musíš dát myší zatržítko do toho čtverečku vlevo od registru ap.)


- Klikni na "Smazat"
- Počkej, dokud Status box nezobrazí " Mazání dokončeno "
- Klikni na "Zpráva " a zkopíruj a vlož obsah té zprávy prosím sem. Log je možno nalézt v RKreport [číslo]. txt na ploše.
- Zavři RogueKiller

Vypni antivir i firewall.
Stáhni
Zoek.exe

a uloz si ho na plochu.
Zavři všechny ostatní programy , okna i prohlížeče.
Spusť Zoek.exe ( u win vista , win7, 8 klikni na něj pravým a vyber : „Spustit jako správce“
- pozor , náběh programu může trvat déle.

Do okna programu vlož skript níže:

Kód: Vybrat vše

autoclean;
emptyclsid;
iedefaults;
FFdefaults;
CHRdefaults;
emptyalltemp;
resethosts;


klikni na Run Script
Program provede sken , opravu, sken i oprava může trvat i více minut ,je třeba posečkat do konce. Do okna neklikej!
Program nabídne restart , potvrď .

Po restartu se může nějaký čas ukázat pouze černá plocha , to je normální. Je třeba počkat až se vytvoří log. Ten si můžeš uložit třeba do dokumentů , jinak se sám ukládá do:
C:\zoek-results.log
Zkopíruj sem celý obsah toho logu.

Vlož nový log z HJT + informuj o problémech.
Při práci s programy HJT, ComboFix,MbAM, SDFix aj. zavřete všechny ostatní aplikace a prohlížeče!
Neposílejte logy do soukromých zpráv.Po dobu mé nepřítomnosti mě zastupuje memphisto , Žbeky a Orcus.
Pokud budete spokojeni , můžete podpořit naše forum:Podpora fóra

Reklama
Tondys01
nováček
Příspěvky: 22
Registrován: únor 16
Pohlaví: Nespecifikováno
Stav:
Offline

Re: Prosím o kontrolu logu

Příspěvekod Tondys01 » 17 úno 2016 18:55

RogueKiller V11.0.12.0 (x64) [Feb 15 2016] (Free) by Adlice Software
mail : http://www.adlice.com/contact/
Feedback : http://forum.adlice.com
Webová stránka : http://www.adlice.com/software/roguekiller/
Blog : http://www.adlice.com

Operační systém : Windows 10 (10.0.10240) 64 bits version
Spuštěno : Normální režim
Uživatel : Tonda [Práva správce]
Started from : E:\Sta?ené soubory\RogueKillerX64.exe
Mód : Smazat -- Datum : 02/17/2016 17:36:35

¤¤¤ Procesy : 0 ¤¤¤

¤¤¤ Registry : 7 ¤¤¤
[PUP] (X64) HKEY_LOCAL_MACHINE\Software\Partner -> Smazáno
[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters | DhcpNameServer : 10.0.0.138 ([X]) -> Nahrazeno ()
[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Tcpip\Parameters | DhcpNameServer : 10.0.0.138 ([X]) -> Nahrazeno ()
[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{643bf372-00a3-46ea-9922-4ebd335a13ad} | DhcpNameServer : 10.0.0.138 ([X]) -> Nahrazeno ()
[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Tcpip\Parameters\Interfaces\{643bf372-00a3-46ea-9922-4ebd335a13ad} | DhcpNameServer : 10.0.0.138 ([X]) -> Nahrazeno ()
[PUM.StartMenu] (X64) HKEY_USERS\S-1-5-21-1060879729-762033656-2367951757-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced | Start_TrackProgs : 0 -> Nahrazeno (1)
[PUM.StartMenu] (X86) HKEY_USERS\S-1-5-21-1060879729-762033656-2367951757-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced | Start_TrackProgs : 0 -> Nahrazeno (1)

¤¤¤ Úlohy : 0 ¤¤¤

¤¤¤ Soubory : 2 ¤¤¤
[PUP][Soubor] C:\Windows\SECOH-QAD.exe -> Smazáno
[PUP][Soubor] C:\Users\Tonda\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\StartMenu\Picexa (2).lnk [LNK@] C:\Program Files (x86)\Picexa\Picexa.exe -> Smazáno

¤¤¤ Soubor HOSTS : 0 [Too big!] ¤¤¤

¤¤¤ Antirootkit : 0 (Driver: Nahrán) ¤¤¤

¤¤¤ Webové prohlížeče : 0 ¤¤¤

¤¤¤ Kontrola MBR : ¤¤¤
+++++ PhysicalDrive0: Samsung SSD 850 EVO 120GB +++++
--- User ---
[MBR] 5f822de9c28709e64b84103272b09b40
[BSP] d57a880f1986c00405c7bcb0f0263230 : Empty|VT.Unknown MBR Code
Partition table:
0 - [SYSTEM][MAN-MOUNT] Basic data partition | Offset (sectors): 2048 | Size: 450 MB
1 - [MAN-MOUNT] EFI system partition | Offset (sectors): 923648 | Size: 100 MB
2 - [MAN-MOUNT] Microsoft reserved partition | Offset (sectors): 1128448 | Size: 16 MB
3 - Basic data partition | Offset (sectors): 1161216 | Size: 113906 MB
User = LL1 ... OK
User = LL2 ... OK

+++++ PhysicalDrive1: ST1000DM003-1CH162 +++++
--- User ---
[MBR] eb217020f8f17f906d4b760fe834fb15
[BSP] 8e9349d6291d6dba980ec32cc8bd2669 : Empty|VT.Unknown MBR Code
Partition table:
0 - LDM metadata partition | Offset (sectors): 34 | Size: 1 MB
1 - Microsoft reserved partition | Offset (sectors): 2082 | Size: 99 MB
2 - LDM data partition | Offset (sectors): 206848 | Size: 953768 MB
User = LL1 ... OK
User = LL2 ... OK


Zoek.exe v5.0.0.1 Updated 31-December-2015
Tool run by Tonda on 17.02.2016 at 18:31:02,50.
Microsoft Windows 10 Home 10.0.10240 x64
Running in: Normal Mode Internet Access Detected
Launched: E:\Stažené soubory\zoek.exe [Scan all users] [Script inserted]

==== System Restore Info ======================

17.02.2016 18:32:54 Zoek.exe System Restore Point Created Successfully.

==== Reset Hosts File ======================

# Copyright (c) 1993-2006 Microsoft Corp.
#
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
#
# This file contains the mappings of IP addresses to host names. Each
# entry should be kept on an individual line. The IP address should
# be placed in the first column followed by the corresponding host name.
# The IP address and the host name should be separated by at least one
# space.
#
# Additionally, comments (such as these) may be inserted on individual
# lines or following the machine name denoted by a '#' symbol.
#
# For example:
#
# 102.54.94.97 rhino.acme.com # source server
# 38.25.63.10 x.acme.com # x client host

127.0.0.1 localhost

==== Empty Folders Check ======================

C:\PROGRA~2\ATI Technologies deleted successfully
C:\PROGRA~2\COMMON~1\DVBViewer Shared deleted successfully
C:\PROGRA~3\CMUV deleted successfully
C:\PROGRA~3\Comms deleted successfully
C:\PROGRA~3\dbg deleted successfully
C:\PROGRA~3\SoftwareDistribution deleted successfully
C:\Users\Tonda\AppData\Local\DevelopmentFiles deleted successfully
C:\Users\Tonda\AppData\Local\Opera Software deleted successfully

==== Deleting CLSID Registry Keys ======================


==== Deleting CLSID Registry Values ======================


==== Deleting Services ======================


==== Deleting Files \ Folders ======================

C:\PROGRA~2\ATI Technologies not found
C:\Users\Tonda\.android deleted
C:\PROGRA~3\Package Cache deleted
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Search.lnk deleted
C:\windows\SysNative\GroupPolicy\machine deleted
C:\windows\SysNative\GroupPolicy\gpt.ini deleted
C:\Windows\SysWow64\AI_RecycleBin deleted
"C:\Users\Tonda\AppData\Roaming\dlg" deleted
"C:\Users\Tonda\AppData\Roaming\MPC-HC" deleted

==== Firefox Extensions Registry ======================

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Mozilla\Firefox\Extensions]
"sp@avast.com"="C:\Program Files\AVAST Software\Avast\SafePrice\FF" [02.12.2015 16:13]

==== Chromium Look ======================

HKEY_LOCAL_MACHINE\SOFTWARE\Google\Chrome\Extensions
bknbnapaddjdnbilpmlacdkjdkjmbjhd - No path found[]
eofcbnmajmjmplflapaojjnihcjkigck - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChromeSp.crx[16.11.2015 22:36]
gomekmidlodglbbmalcneegieacbdmki - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx[16.11.2015 22:36]

HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\Extensions
bknbnapaddjdnbilpmlacdkjdkjmbjhd - No path found[]

AdBlock - Tonda\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\gighmmpiobklfepjocnamgkkbiglidom
Avast Online Security - Tonda\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\gomekmidlodglbbmalcneegieacbdmki
F.B. Purity - Tonda\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\ncdlagniojmheiklojdcpdaeepochckl

==== Set IE to Default ======================

Old Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes]
No DefaultScope Set For HKCU

New Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"="http://go.microsoft.com/fwlink/?LinkId=69157"
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes]
"DefaultScope"="{012E1000-F331-11DB-8314-0800200C9A66}"

==== All HKLM and HKCU SearchScopes ======================

HKLM\SearchScopes "DefaultScope"="{0633EE93-D776-472f-A0FF-E1416B8B2E3A}"
HKLM\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} - http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
HKLM\Wow6432Node\SearchScopes "DefaultScope"="{0633EE93-D776-472f-A0FF-E1416B8B2E3A}"
HKLM\Wow6432Node\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} - http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
HKCU\SearchScopes "DefaultScope"="{012E1000-F331-11DB-8314-0800200C9A66}"
HKCU\SearchScopes\{012E1000-F331-11DB-8314-0800200C9A66} - http://www.google.com/search?q={searchTerms}
HKCU\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} - http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC

==== Reset Google Chrome ======================

C:\Users\Tonda\AppData\Local\Google\Chrome\User Data\Profile 1\Preferences was reset successfully
C:\Users\Tonda\AppData\Local\Google\Chrome\User Data\Profile 1\Secure Preferences was reset successfully
C:\Users\Tonda\AppData\Local\Google\Chrome\User Data\Profile 1\Web Data was reset successfully
C:\Users\Tonda\AppData\Local\Google\Chrome\User Data\Profile 1\Web Data-journal was reset successfully

==== Deleting Registry Keys ======================

HKEY_LOCAL_MACHINE\Software\wow6432node\Policies\Google deleted successfully

==== Empty IE Cache ======================

C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\Tonda\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 emptied successfully
C:\Users\Tonda\AppData\Local\Microsoft\Windows\INetCache\Low\Content.IE5 emptied successfully
C:\Windows\SysNative\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 emptied successfully
C:\Windows\sysWoW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 emptied successfully
C:\Windows\sysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 emptied successfully
C:\Users\Tonda\AppData\Local\Microsoft\Windows\INetCache\IE emptied successfully
C:\Users\Tonda\AppData\Local\Microsoft\Windows\INetCache\Low\IE emptied successfully
C:\Windows\SysNative\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE emptied successfully
C:\Windows\sysWoW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE emptied successfully

==== Empty FireFox Cache ======================

No FireFox Profiles found

==== Empty Chrome Cache ======================

C:\Users\Tonda\AppData\Local\Google\Chrome\User Data\Profile 1\Cache emptied successfully

==== Empty All Flash Cache ======================

No Flash Cache Found

==== Empty All Java Cache ======================

No Java Cache Found

==== C:\zoek_backup content ======================

C:\zoek_backup (files=37 folders=52 41297770 bytes)

==== Empty Temp Folders ======================

C:\Windows\Temp will be emptied at reboot

==== After Reboot ======================

==== Empty Temp Folders ======================

C:\Windows\Temp successfully emptied
C:\Users\Tonda\AppData\Local\Temp successfully emptied

==== Empty Recycle Bin ======================

C:\$RECYCLE.BIN successfully emptied

==== EOF on 17.02.2016 at 18:44:48,34 ======================

Logfile of Trend Micro HijackThis v2.0.5
Scan saved at 18:51:33, on 17.02.2016
Platform: Unknown Windows (WinNT 6.02.1008)
MSIE: Unable to get Internet Explorer version!


Boot mode: Normal

Running processes:
C:\Program Files\AVAST Software\Avast\AvastUI.exe
C:\Program Files (x86)\MSI\Super Charger\Super Charger.exe
C:\Program Files (x86)\Samsung\Samsung Magician\Samsung Magician.exe
E:\Stažené soubory\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = %11%\blank.htm
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: Lync Click to Call BHO - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files (x86)\Microsoft Office\Office15\OCHelper.dll
O2 - BHO: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
O4 - HKLM\..\Run: [AvastUI.exe] "C:\Program Files\AVAST Software\Avast\AvastUI.exe" /nogui
O4 - HKLM\..\Run: [SwitchBoard] C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
O4 - HKLM\..\Run: [AdobeCS6ServiceManager] "C:\Program Files (x86)\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe" -launchedbylogin
O4 - HKLM\..\Run: [Raptr] C:\PROGRA~2\Raptr\raptrstub.exe --startup
O4 - HKLM\..\Run: [Super Charger] C:\Program Files (x86)\MSI\Super Charger\Super Charger.exe
O4 - HKCU\..\Run: [SpybotPostWindows10UpgradeReInstall] "C:\Program Files\Common Files\AV\Spybot - Search and Destroy\Test.exe"
O4 - HKUS\S-1-5-19\..\Run: [OneDriveSetup] C:\Windows\SysWOW64\OneDriveSetup.exe /thfirstsetup (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [OneDriveSetup] C:\Windows\SysWOW64\OneDriveSetup.exe /thfirstsetup (User 'NETWORK SERVICE')
O4 - Global Startup: Killer Network Manager.lnk = C:\Program Files\Killer Networking\Network Manager\NetworkManager.exe
O8 - Extra context menu item: E&xportovat do Microsoft Excelu - res://C:\PROGRA~1\MICROS~1\Office15\EXCEL.EXE/3000
O9 - Extra button: Volání kliknutím v Lyncu - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files (x86)\Microsoft Office\Office15\OCHelper.dll
O9 - Extra 'Tools' menuitem: Volání kliknutím v Lyncu - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files (x86)\Microsoft Office\Office15\OCHelper.dll
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O18 - Protocol: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files (x86)\Microsoft Office\Office15\MSOSB.DLL
O18 - Protocol: tbauth - {14654CA6-5711-491D-B89A-58E571679951} - C:\Windows\SysWOW64\tbauth.dll
O18 - Filter hijack: text/xml - {807583E5-5146-11D5-A672-00B0D022E945} - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE15\MSOXMLMF.DLL
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: AMD External Events Utility - Unknown owner - C:\Windows\system32\atiesrxx.exe (file missing)
O23 - Service: Avast Antivirus (avast! Antivirus) - AVAST Software - C:\Program Files\AVAST Software\Avast\AvastSvc.exe
O23 - Service: @%SystemRoot%\system32\DiagSvcs\DiagnosticsHub.StandardCollector.ServiceRes.dll,-1000 (diagnosticshub.standardcollector.service) - Unknown owner - C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe (file missing)
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: Služba Google Update (gupdate) (gupdate) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Služba Google Update (gupdatem) (gupdatem) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: @%SystemRoot%\system32\ieetwcollectorres.dll,-1000 (IEEtwCollectorService) - Unknown owner - C:\Windows\system32\IEEtwCollector.exe (file missing)
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Killer Service V2 - Rivet Networks - C:\Program Files\Killer Networking\Network Manager\KillerService.exe
O23 - Service: MBAMService - Malwarebytes - C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: MSI_SuperCharger - MSI - C:\Program Files (x86)\MSI\Super Charger\ChargeService.exe
O23 - Service: MySQL - Unknown owner - C:\Program Files\MySQL\MySQL Server 5.6\bin\mysqld.exe
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\System32\ngcsvc.dll,-100 (NgcSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Samsung RAPID Mode Service (SamsungRapidSvc) - Unknown owner - C:\Windows\system32\RAPID\SamsungRapidSvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\SensorDataService.exe,-101 (SensorDataService) - Unknown owner - C:\Windows\System32\SensorDataService.exe (file missing)
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: SwitchBoard - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
O23 - Service: TVService - Team MediaPortal - C:\Program Files (x86)\Team MediaPortal\MediaPortal TV Server\TVService.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%ProgramFiles%\Windows Defender\MpAsDesc.dll,-320 (WdNisSvc) - Unknown owner - C:\Program Files (x86)\Windows Defender\NisSrv.exe (file missing)
O23 - Service: @%ProgramFiles%\Windows Defender\MpAsDesc.dll,-310 (WinDefend) - Unknown owner - C:\Program Files (x86)\Windows Defender\MsMpEng.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--
End of file - 8329 bytes


Nových problémů jsem si zatím nevšiml, ale ty staré bohužel přetrvávají.

Uživatelský avatar
Orcus
člen Security týmu
Elite Level 10.5
Elite Level 10.5
Příspěvky: 10645
Registrován: duben 10
Bydliště: Okolo rostou 3 růže =o)
Pohlaví: Muž
Stav:
Offline

Re: Prosím o kontrolu logu

Příspěvekod Orcus » 17 úno 2016 22:42

Odinstaluj Spybot - Search and Destroy.

Prosím stáhni příslušnou verzi programu pro Tvůj systém 32-bit/64-bit FarbarRecovery Scan Tool (FrSt)
32bit.:
http://www.bleepingcomputer.com/downloa ... ool/dl/81/
64bit.:
http://www.bleepingcomputer.com/downloa ... ool/dl/82/
a ulož jej na plochu. ,pak spusť FrSt.
Potvrď způsob užití.
Neměň žádné z výchozích nastavení a klikni na položku „Scan“ („Skenovat“) .Když je skenování dokončeno, ukážou se dva logy = FRST.txt a Addition.txt a uloží se na ploše.Prosím zkopíruj sem celý jejich obsah.
Láska hřeje, ale uhlí je uhlí. :fire:



Log z HJT vkládejte do HJT sekce. Je-li moc dlouhý, rozděl jej do více zpráv.

Pár rad k bezpečnosti PC.

Po dobu mé nepřítomnosti mě zastupuje memphisto, jaro3 a Diallix

Pokud budete spokojeni , můžete podpořit naše fórum.

Tondys01
nováček
Příspěvky: 22
Registrován: únor 16
Pohlaví: Nespecifikováno
Stav:
Offline

Re: Prosím o kontrolu logu

Příspěvekod Tondys01 » 18 úno 2016 00:04

U programu Spybot - Search and Destroy po odinstalaci se nabídl restart, po startu systému se program sám dal do programů "po spuštění" a potom se IMHO ukazoval ještě v tom logu, ač jsem jej ve správci úloh zakázal. Zkusil jsem jej tedy znovu nainstalovat a odinstalovat a problém se opakoval znovu. Takže jsem jej vymazal na hrubo...

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version:17-02-2016
Ran by Tonda (administrator) on TONDA (17-02-2016 23:52:01)
Running from C:\Users\Tonda\Desktop
Loaded Profiles: Tonda (Available Profiles: Tonda)
Platform: Windows 8.1 Single Language (X64) Language: Čeština (Česká republika)
Internet Explorer Version 11 (Default browser: Chrome)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/33 ... scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(Rivet Networks) C:\Program Files\Killer Networking\Network Manager\KillerService.exe
(MSI) C:\Program Files (x86)\MSI\Super Charger\ChargeService.exe
() C:\Program Files\MySQL\MySQL Server 5.6\bin\mysqld.exe
(Samsung Electronics Co., Ltd.) C:\Windows\System32\RAPID\SamsungRapidSvc.exe
(Team MediaPortal) C:\Program Files (x86)\Team MediaPortal\MediaPortal TV Server\TvService.exe
(Microsoft Corporation) C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\RemindersServer.exe
(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Samsung Electronics Co., Ltd.) C:\Program Files (x86)\Samsung\RAPID\CacheFilter\SamsungRapidApp.exe
(Advanced Micro Devices, Inc.) C:\Program Files\AMD\CNext\CNext\cnext.exe
(Rivet Networks) C:\Program Files\Killer Networking\Network Manager\NetworkManager.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastUI.exe
(MSI) C:\Program Files (x86)\MSI\Super Charger\Super Charger.exe
(Samsung Electronics.) C:\Program Files (x86)\Samsung\Samsung Magician\Samsung Magician.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office\Office15\MSOSYNC.EXE
(Microsoft Corporation) C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\ActionUriServer.exe
(Microsoft Corporation) C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.10240.16565_none_1162030161f5c19b\TiWorker.exe
(Microsoft Corporation) C:\Windows\System32\wbem\WMIADAP.exe


==================== Registry (Whitelisted) ===========================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [AdobeAAMUpdater-1.0] => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [446392 2012-04-04] (Adobe Systems Incorporated)
HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [8484056 2015-06-12] (Realtek Semiconductor)
HKLM\...\Run: [SamsungRapidApp] => C:\Program Files (x86)\Samsung\RAPID\CacheFilter\SamsungRapidApp.exe [282288 2015-02-04] (Samsung Electronics Co., Ltd.)
HKLM\...\Run: [StartCN] => C:\Program Files\AMD\CNext\CNext\cnext.exe [4867784 2015-12-04] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [7021880 2015-12-02] (AVAST Software)
HKLM-x32\...\Run: [SwitchBoard] => C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [AdobeCS6ServiceManager] => C:\Program Files (x86)\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe [1073312 2012-03-09] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Raptr] => C:\Program Files (x86)\Raptr\raptrstub.exe [56080 2015-12-11] (Raptr, Inc)
HKLM-x32\...\Run: [Super Charger] => C:\Program Files (x86)\MSI\Super Charger\Super Charger.exe [1027024 2015-09-09] (MSI)
HKLM\...\runonceex: [Flags] => 128
HKLM\...\runonceex: [Title] => RAPID uninstall cleanup using key [0001]
HKU\S-1-5-21-1060879729-762033656-2367951757-1001\...\Run: [AdobeBridge] => [X]
ShellIconOverlayIdentifiers: [ OneDrive1] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} => No File
ShellIconOverlayIdentifiers: [ OneDrive2] -> {5AB7172C-9C11-405C-8DD5-AF20F3606282} => No File
ShellIconOverlayIdentifiers: [ OneDrive3] -> {A78ED123-AB77-406B-9962-2A5D9D2F7F30} => No File
ShellIconOverlayIdentifiers: [ OneDrive4] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} => No File
ShellIconOverlayIdentifiers: [ OneDrive5] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} => No File
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll [2015-12-02] (AVAST Software)
ShellIconOverlayIdentifiers-x32: [ OneDrive1] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} => No File
ShellIconOverlayIdentifiers-x32: [ OneDrive2] -> {5AB7172C-9C11-405C-8DD5-AF20F3606282} => No File
ShellIconOverlayIdentifiers-x32: [ OneDrive3] -> {A78ED123-AB77-406B-9962-2A5D9D2F7F30} => No File
ShellIconOverlayIdentifiers-x32: [ OneDrive4] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} => No File
ShellIconOverlayIdentifiers-x32: [ OneDrive5] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} => No File
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Killer Network Manager.lnk [2015-07-30]
ShortcutTarget: Killer Network Manager.lnk -> C:\Program Files\Killer Networking\Network Manager\NetworkManager.exe (Rivet Networks)
BootExecute: autocheck autochk * sh4native Sh4Removalsdnclean64.exe

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Tcpip\Parameters: [DhcpNameServer] 10.0.0.138
Tcpip\..\Interfaces\{643bf372-00a3-46ea-9922-4ebd335a13ad}: [DhcpNameServer] 10.0.0.138

Internet Explorer:
==================
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page =
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL =
HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Local Page =
SearchScopes: HKU\S-1-5-21-1060879729-762033656-2367951757-1001 -> DefaultScope {012E1000-F331-11DB-8314-0800200C9A66} URL = hxxp://www.google.com/search?q={searchTerms}
SearchScopes: HKU\S-1-5-21-1060879729-762033656-2367951757-1001 -> {012E1000-F331-11DB-8314-0800200C9A66} URL = hxxp://www.google.com/search?q={searchTerms}
BHO: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office\Office15\OCHelper.dll [2015-02-10] (Microsoft Corporation)
BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll [2015-11-16] (AVAST Software)
BHO-x32: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files (x86)\Microsoft Office\Office15\OCHelper.dll [2015-02-10] (Microsoft Corporation)
BHO-x32: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll [2015-11-16] (AVAST Software)
Handler: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office\Office15\MSOSB.DLL [2014-01-23] (Microsoft Corporation)

Edge:
======
Edge HomeButtonPage: HKU\S-1-5-21-1060879729-762033656-2367951757-1001 -> hxxp://www.google.com
Edge Session Restore: HKU\S-1-5-21-1060879729-762033656-2367951757-1001 -> is enabled.

FireFox:
========
FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~1\MICROS~1\Office15\NPSPWRAP.DLL [2014-01-23] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/Lync,version=15.0 -> C:\Program Files (x86)\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll [2015-02-10] (Microsoft Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-13] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office15\NPSPWRAP.DLL [2014-01-22] (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.29.5\npGoogleUpdate3.dll [2016-02-14] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.29.5\npGoogleUpdate3.dll [2016-02-14] (Google Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2015-12-18] (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npMeetingJoinPluginOC.dll [2015-02-10] (Microsoft Corporation)
FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: Avast Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2015-12-02]
FF HKLM-x32\...\Firefox\Extensions: [sp@avast.com] - C:\Program Files\AVAST Software\Avast\SafePrice\FF
FF Extension: Avast SafePrice - C:\Program Files\AVAST Software\Avast\SafePrice\FF [2015-12-02]

Chrome:
=======
CHR HomePage: Profile 1 -> hxxp://www.facebook.com/
CHR Session Restore: Profile 1 -> is enabled.
CHR Profile: C:\Users\Tonda\AppData\Local\Google\Chrome\User Data\Profile 1
CHR Extension: (Prezentace Google) - C:\Users\Tonda\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2016-02-17]
CHR Extension: (Dokumenty Google) - C:\Users\Tonda\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\aohghmighlieiainnegkcijnfilokake [2016-02-17]
CHR Extension: (Disk Google) - C:\Users\Tonda\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\apdfllckaahabafndbhieahigkjlhalf [2016-02-17]
CHR Extension: (Video AdBlock for Chrome) - C:\Users\Tonda\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\bknbnapaddjdnbilpmlacdkjdkjmbjhd [2016-02-17]
CHR Extension: (YouTube) - C:\Users\Tonda\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2016-02-17]
CHR Extension: (Vyhledávání Google) - C:\Users\Tonda\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2016-02-17]
CHR Extension: (Tabulky Google) - C:\Users\Tonda\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2016-02-17]
CHR Extension: (Dokumenty Google offline) - C:\Users\Tonda\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2016-02-17]
CHR Extension: (AdBlock) - C:\Users\Tonda\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2016-02-17]
CHR Extension: (Avast Online Security) - C:\Users\Tonda\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\gomekmidlodglbbmalcneegieacbdmki [2016-02-17]
CHR Extension: (Kontrola e-mailu Google) - C:\Users\Tonda\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\mihcahmgecmbnbcchbopgniflfhgnkff [2016-02-17]
CHR Extension: (F.B Purity-Clean Up Facebook) - C:\Users\Tonda\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\ncdlagniojmheiklojdcpdaeepochckl [2016-02-17]
CHR Extension: (Platby Internetového obchodu Chrome) - C:\Users\Tonda\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2016-02-17]
CHR Extension: (Gmail) - C:\Users\Tonda\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2016-02-17]
CHR HKU\S-1-5-21-1060879729-762033656-2367951757-1001\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [bknbnapaddjdnbilpmlacdkjdkjmbjhd] - hxxp://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [bknbnapaddjdnbilpmlacdkjdkjmbjhd] - hxxp://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [eofcbnmajmjmplflapaojjnihcjkigck] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChromeSp.crx [2015-11-16]
CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2015-11-16]

==================== Services (Whitelisted) ========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [226440 2015-12-02] (AVAST Software)
R2 Killer Service V2; C:\Program Files\Killer Networking\Network Manager\KillerService.exe [402432 2015-07-07] (Rivet Networks) [File not signed]
S2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [1135416 2015-10-05] (Malwarebytes)
R2 MSI_SuperCharger; C:\Program Files (x86)\MSI\Super Charger\ChargeService.exe [163280 2015-05-18] (MSI)
R2 MySQL; C:\Program Files\MySQL\MySQL Server 5.6\bin\mysqld.exe [12907520 2013-02-01] () [File not signed]
R2 SamsungRapidSvc; C:\Windows\System32\RAPID\SamsungRapidSvc.exe [28848 2015-02-04] (Samsung Electronics Co., Ltd.)
S3 SwitchBoard; C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated) [File not signed]
R2 TVService; C:\Program Files (x86)\Team MediaPortal\MediaPortal TV Server\TVService.exe [233984 2015-06-22] (Team MediaPortal) [File not signed]
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [362928 2015-07-10] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [24864 2015-07-10] (Microsoft Corporation)

===================== Drivers (Whitelisted) ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

S0 amdkmafd; C:\Windows\System32\drivers\amdkmafd.sys [40720 2015-07-28] (Advanced Micro Devices, Inc.)
R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [28656 2015-12-02] (AVAST Software)
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [97648 2015-12-19] (AVAST Software)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93528 2015-12-02] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65224 2015-12-02] (AVAST Software)
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1065208 2016-01-20] (AVAST Software)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [464256 2016-01-20] (AVAST Software)
R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [155304 2015-12-02] (AVAST Software)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [273784 2015-12-02] (AVAST Software)
R3 AtiHDAudioService; C:\Windows\system32\drivers\AtihdWT6.sys [102912 2015-09-18] (Advanced Micro Devices)
R1 BfLwf; C:\Windows\system32\DRIVERS\bwcW10x64.sys [114736 2015-07-07] (Rivet Networks, LLC.)
R3 IT9135BDA; C:\Windows\System32\Drivers\IT9135BDA.sys [165504 2015-07-30] (ITE )
R3 KillerEth; C:\Windows\System32\drivers\e22w10x64.sys [124464 2015-04-27] (Qualcomm Atheros, Inc.)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2015-10-05] (Malwarebytes)
S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [64216 2015-10-05] (Malwarebytes Corporation)
R3 NTIOLib_1_0_3; C:\Program Files (x86)\MSI\Super Charger\NTIOLib_X64.sys [13368 2012-10-25] (MSI)
R0 pwdrvio; C:\Windows\System32\pwdrvio.sys [19152 2013-09-30] ()
S3 pwdspio; C:\Windows\system32\pwdspio.sys [12504 2013-09-30] ()
R0 SamsungRapidDiskFltr; C:\Windows\System32\DRIVERS\SamsungRapidDiskFltr.sys [271024 2015-02-04] (Samsung Electronics Co., Ltd.)
R0 SamsungRapidFSFltr; C:\Windows\System32\DRIVERS\SamsungRapidFSFltr.sys [111280 2015-02-04] (Samsung Electronics Co., Ltd.)
S3 UdeCx; C:\Windows\System32\drivers\udecx.sys [44032 2015-07-10] ()
S3 WdBoot; C:\Windows\system32\drivers\WdBoot.sys [44568 2015-07-10] (Microsoft Corporation)
S3 WdFilter; C:\Windows\system32\drivers\WdFilter.sys [291680 2015-07-10] (Microsoft Corporation)
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [119648 2015-07-10] (Microsoft Corporation)
S3 usbbus; \SystemRoot\System32\drivers\lgx64bus.sys [X]
S3 UsbDiag; \SystemRoot\system32\DRIVERS\lgx64diag.sys [X]
S3 USBModem; \SystemRoot\system32\DRIVERS\lgx64modem.sys [X]
S3 USBPNPA; \SystemRoot\system32\drivers\CM10864.sys [X]
S3 wfpcapture; \SystemRoot\System32\drivers\wfpcapture.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2016-02-17 23:52 - 2016-02-17 23:52 - 00016980 _____ C:\Users\Tonda\Desktop\FRST.txt
2016-02-17 23:51 - 2016-02-17 23:52 - 00000000 ____D C:\FRST
2016-02-17 23:50 - 2016-02-17 23:50 - 02371072 _____ (Farbar) C:\Users\Tonda\Desktop\FRST64.exe
2016-02-17 23:47 - 2016-02-17 23:47 - 00016148 _____ C:\Windows\system32\TONDA_Tonda_HistoryPrediction.bin
2016-02-17 23:47 - 2016-02-17 23:47 - 00000085 _____ C:\Windows\wininit.ini
2016-02-17 18:44 - 2016-02-17 18:44 - 00004608 _____ C:\Windows\SECOH-QAD.exe
2016-02-17 18:44 - 2016-02-17 18:30 - 00024064 _____ C:\Windows\zoek-delete.exe
2016-02-17 18:30 - 2016-02-17 18:42 - 00000000 ____D C:\zoek_backup
2016-02-16 11:06 - 2016-02-17 17:24 - 00028272 _____ C:\Windows\system32\Drivers\TrueSight.sys
2016-02-16 11:06 - 2016-02-16 11:20 - 00000000 ____D C:\ProgramData\RogueKiller
2016-02-15 20:08 - 2016-02-16 13:05 - 00192216 _____ (Malwarebytes) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2016-02-15 20:07 - 2016-02-15 20:07 - 00001171 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2016-02-15 20:07 - 2016-02-15 20:07 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2016-02-15 20:07 - 2016-02-15 20:07 - 00000000 ____D C:\ProgramData\Malwarebytes
2016-02-15 20:07 - 2016-02-15 20:07 - 00000000 ____D C:\Program Files (x86)\Malwarebytes Anti-Malware
2016-02-15 20:07 - 2015-10-05 09:50 - 00109272 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbamchameleon.sys
2016-02-15 20:07 - 2015-10-05 09:50 - 00064216 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2016-02-15 20:07 - 2015-10-05 09:50 - 00025816 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbam.sys
2016-02-15 20:04 - 2016-02-16 13:13 - 00000000 ____D C:\AdwCleaner
2016-02-14 21:10 - 2016-02-14 21:10 - 00000000 ____D C:\Windows\System32\Tasks\Safer-Networking
2016-02-14 19:56 - 2016-02-14 19:56 - 00002344 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2016-02-14 19:55 - 2016-02-17 23:47 - 00000958 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2016-02-14 19:55 - 2016-02-17 23:00 - 00000962 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2016-02-14 19:55 - 2016-02-14 21:01 - 00000000 ____D C:\Users\Tonda\AppData\Local\Google
2016-02-14 19:55 - 2016-02-14 19:55 - 00004020 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2016-02-14 19:55 - 2016-02-14 19:55 - 00003788 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2016-02-10 10:55 - 2016-01-31 07:04 - 01811360 _____ (Microsoft Corporation) C:\Windows\SysWOW64\combase.dll
2016-02-10 10:54 - 2016-01-31 07:25 - 01951872 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2016-02-10 10:54 - 2016-01-31 07:25 - 01248896 _____ (Microsoft Corporation) C:\Windows\system32\WinTypes.dll
2016-02-10 10:54 - 2016-01-31 07:24 - 01824880 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2016-02-10 10:54 - 2016-01-31 07:23 - 02601160 _____ (Microsoft Corporation) C:\Windows\system32\combase.dll
2016-02-10 10:54 - 2016-01-31 07:23 - 01420392 _____ (Microsoft Corporation) C:\Windows\system32\msctf.dll
2016-02-10 10:54 - 2016-01-31 07:06 - 01535032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2016-02-10 10:54 - 2016-01-31 07:06 - 01531368 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll
2016-02-10 10:54 - 2016-01-31 07:06 - 00809336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WinTypes.dll
2016-02-10 10:54 - 2016-01-31 07:04 - 01180696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msctf.dll
2016-02-10 10:54 - 2016-01-31 06:38 - 21873152 _____ (Microsoft Corporation) C:\Windows\system32\edgehtml.dll
2016-02-10 10:54 - 2016-01-31 06:34 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\ngckeyenum.dll
2016-02-10 10:54 - 2016-01-31 06:33 - 24593920 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2016-02-10 10:54 - 2016-01-31 06:33 - 00057856 _____ (Microsoft Corporation) C:\Windows\system32\IoTAssignedAccessLockFramework.dll
2016-02-10 10:54 - 2016-01-31 06:29 - 11557888 _____ (Microsoft Corporation) C:\Windows\system32\twinui.dll
2016-02-10 10:54 - 2016-01-31 06:29 - 00141312 _____ (Microsoft Corporation) C:\Windows\system32\rasman.dll
2016-02-10 10:54 - 2016-01-31 06:26 - 06787072 _____ (Microsoft Corporation) C:\Windows\system32\Windows.Data.Pdf.dll
2016-02-10 10:54 - 2016-01-31 06:26 - 03793408 _____ (Microsoft Corporation) C:\Windows\system32\rdpcorets.dll
2016-02-10 10:54 - 2016-01-31 06:25 - 12504576 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2016-02-10 10:54 - 2016-01-31 06:25 - 02237952 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll
2016-02-10 10:54 - 2016-01-31 06:25 - 00366592 _____ (Microsoft Corporation) C:\Windows\system32\wuuhext.dll
2016-02-10 10:54 - 2016-01-31 06:25 - 00143872 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxdav.sys
2016-02-10 10:54 - 2016-01-31 06:24 - 00784384 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll
2016-02-10 10:54 - 2016-01-31 06:24 - 00047616 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll
2016-02-10 10:54 - 2016-01-31 06:24 - 00033280 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll
2016-02-10 10:54 - 2016-01-31 06:23 - 00079360 _____ (Microsoft Corporation) C:\Windows\system32\rdpudd.dll
2016-02-10 10:54 - 2016-01-31 06:22 - 00680448 _____ (Microsoft Corporation) C:\Windows\system32\rasmans.dll
2016-02-10 10:54 - 2016-01-31 06:20 - 02849792 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2016-02-10 10:54 - 2016-01-31 06:19 - 01602560 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2016-02-10 10:54 - 2016-01-31 06:19 - 00237056 _____ (Microsoft Corporation) C:\Windows\system32\NetworkDesktopSettings.dll
2016-02-10 10:54 - 2016-01-31 06:19 - 00046592 _____ (Microsoft Corporation) C:\Windows\SysWOW64\IoTAssignedAccessLockFramework.dll
2016-02-10 10:54 - 2016-01-31 06:18 - 00771072 _____ (Microsoft Corporation) C:\Windows\system32\Chakradiag.dll
2016-02-10 10:54 - 2016-01-31 06:18 - 00147456 _____ (Microsoft Corporation) C:\Windows\system32\mtxoci.dll
2016-02-10 10:54 - 2016-01-31 06:17 - 19324928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2016-02-10 10:54 - 2016-01-31 06:17 - 00109056 _____ (Microsoft Corporation) C:\Windows\system32\hlink.dll
2016-02-10 10:54 - 2016-01-31 06:16 - 09889280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\twinui.dll
2016-02-10 10:54 - 2016-01-31 06:16 - 00950272 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2016-02-10 10:54 - 2016-01-31 06:14 - 07525376 _____ (Microsoft Corporation) C:\Windows\system32\Chakra.dll
2016-02-10 10:54 - 2016-01-31 06:14 - 03588096 _____ (Microsoft Corporation) C:\Windows\system32\win32kfull.sys
2016-02-10 10:54 - 2016-01-31 06:13 - 04791808 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2016-02-10 10:54 - 2016-01-31 06:13 - 00123392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rasman.dll
2016-02-10 10:54 - 2016-01-31 06:13 - 00034816 _____ (Microsoft Corporation) C:\Windows\system32\ztrace_maps.dll
2016-02-10 10:54 - 2016-01-31 06:11 - 05156352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.Data.Pdf.dll
2016-02-10 10:54 - 2016-01-31 06:11 - 00678400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapi.dll
2016-02-10 10:54 - 2016-01-31 06:11 - 00291840 _____ (Microsoft Corporation) C:\Windows\system32\microsoft-windows-system-events.dll
2016-02-10 10:54 - 2016-01-31 06:11 - 00162304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msorcl32.dll
2016-02-10 10:54 - 2016-01-31 06:07 - 18802176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\edgehtml.dll
2016-02-10 10:54 - 2016-01-31 06:06 - 02316800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2016-02-10 10:54 - 2016-01-31 06:05 - 01380864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2016-02-10 10:54 - 2016-01-31 06:05 - 00574464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Chakradiag.dll
2016-02-10 10:54 - 2016-01-31 06:05 - 00118272 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mtxoci.dll
2016-02-10 10:54 - 2016-01-31 06:04 - 00100352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\hlink.dll
2016-02-10 10:54 - 2016-01-31 06:02 - 03580416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2016-02-10 10:54 - 2016-01-31 06:02 - 00768000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2016-02-10 10:54 - 2016-01-31 06:00 - 11263488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2016-02-10 10:54 - 2016-01-31 05:59 - 05457408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Chakra.dll
2016-02-10 10:54 - 2016-01-31 05:58 - 00029696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ztrace_maps.dll
2016-02-09 16:31 - 2016-02-09 16:31 - 00000000 ____D C:\Users\Tonda\AppData\Roaming\uplay
2016-02-04 15:29 - 2016-02-04 15:29 - 00000000 ____D C:\Users\Tonda\AppData\Roaming\iDealshare VideoGo 6
2016-02-02 11:50 - 2016-02-02 11:50 - 00000001 _____ C:\Windows\SysWOW64\en.html
2016-01-28 12:14 - 2016-01-28 11:43 - 00006530 _____ C:\Users\Tonda\OneDrive\Dokumenty\mKonto_13150247_151228_160128.html

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2016-02-17 23:47 - 2015-07-10 13:21 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2016-02-17 23:47 - 2015-07-10 10:05 - 01572864 ___SH C:\Windows\system32\config\BBI
2016-02-17 18:51 - 2015-07-30 00:11 - 01762290 _____ C:\Windows\system32\PerfStringBackup.INI
2016-02-17 18:51 - 2015-07-10 17:02 - 00745406 _____ C:\Windows\system32\perfh005.dat
2016-02-17 18:51 - 2015-07-10 17:02 - 00149344 _____ C:\Windows\system32\perfc005.dat
2016-02-17 18:51 - 2015-07-10 12:02 - 00000000 ____D C:\Windows\INF
2016-02-17 18:44 - 2015-07-30 07:28 - 00000008 __RSH C:\ProgramData\ntuser.pol
2016-02-17 18:42 - 2015-07-30 00:07 - 00000000 ____D C:\Users\Tonda
2016-02-17 18:42 - 2015-07-10 12:04 - 00000000 ____D C:\Windows\system32\GroupPolicy
2016-02-17 17:43 - 2015-07-30 06:52 - 00004210 _____ C:\Windows\System32\Tasks\User_Feed_Synchronization-{4F461AB3-2C59-49B5-BEEA-9831E95E9FCF}
2016-02-17 13:29 - 2015-07-31 11:43 - 00005204 _____ C:\Windows\System32\Tasks\Microsoft Office 15 Sync Maintenance for TONDA-Tonda Tonda
2016-02-17 11:26 - 2015-07-31 11:33 - 00002457 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acrobat Reader DC.lnk
2016-02-17 11:22 - 2015-07-10 12:04 - 00000000 ____D C:\Windows\AppReadiness
2016-02-17 11:16 - 2015-07-10 12:04 - 00000000 ___HD C:\Program Files\WindowsApps
2016-02-16 22:09 - 2015-11-01 14:56 - 00000000 ____D C:\Program Files (x86)\Sid Meiers Civilization - Beyond Earth
2016-02-16 09:47 - 2015-07-31 22:10 - 01577472 ___SH C:\Users\Tonda\Desktop\Thumbs.db
2016-02-16 09:47 - 2015-07-31 11:19 - 00001480 _____ C:\Users\Tonda\AppData\Local\Adobe Uložit pro web 13.0 Prefs
2016-02-15 23:04 - 2015-08-11 15:23 - 00000000 ____D C:\Users\Tonda\AppData\Roaming\MPC-BE
2016-02-15 11:47 - 2015-07-30 01:09 - 00004280 _____ C:\Windows\System32\Tasks\avast! Emergency Update
2016-02-14 20:05 - 2015-11-25 10:10 - 00084350 _____ C:\Users\Tonda\OneDrive\Dokumenty\cc_20151125_101022.reg
2016-02-14 19:56 - 2015-07-30 00:34 - 00000000 ____D C:\Program Files (x86)\Google
2016-02-14 01:51 - 2015-07-30 00:38 - 00000000 ____D C:\Users\Tonda\AppData\Roaming\uTorrent
2016-02-12 18:38 - 2015-07-10 12:04 - 00000000 ____D C:\Windows\rescache
2016-02-11 00:10 - 2015-07-10 17:05 - 00000000 ____D C:\Program Files\Windows Journal
2016-02-10 11:14 - 2015-07-10 11:55 - 00000000 ____D C:\Windows\CbsTemp
2016-02-09 16:30 - 2015-09-20 06:08 - 00000000 ____D C:\Users\Tonda\OneDrive\Dokumenty\My Games
2016-02-06 19:35 - 2015-08-08 13:36 - 00007605 _____ C:\Users\Tonda\AppData\Local\Resmon.ResmonCfg
2016-02-04 15:03 - 2015-08-11 15:23 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MPC-BE x64
2016-02-04 15:03 - 2015-08-11 15:23 - 00000000 ____D C:\Program Files\MPC-BE x64
2016-02-02 23:47 - 2015-10-01 09:49 - 00828920 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2016-02-02 23:47 - 2015-10-01 09:49 - 00176632 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2016-01-20 15:57 - 2015-07-30 01:09 - 01065208 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsnx.sys
2016-01-20 15:57 - 2015-07-30 01:09 - 00464256 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsp.sys

==================== Files in the root of some directories =======

2015-07-31 11:19 - 2016-02-16 09:47 - 0001480 _____ () C:\Users\Tonda\AppData\Local\Adobe Uložit pro web 13.0 Prefs
2015-07-30 00:30 - 2015-07-30 00:30 - 0000000 _____ () C:\Users\Tonda\AppData\Local\Driver_LOM_8161Present.flag
2015-12-08 20:43 - 2015-12-08 20:43 - 0000001 _____ () C:\Users\Tonda\AppData\Local\llftool.4.40.agreement
2015-08-08 13:36 - 2016-02-06 19:35 - 0007605 _____ () C:\Users\Tonda\AppData\Local\Resmon.ResmonCfg

==================== Bamital & volsnap =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\dnsapi.dll => File is digitally signed
C:\Windows\SysWOW64\dnsapi.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2016-02-11 13:22

==================== End of FRST.txt ============================


Additional scan result of Farbar Recovery Scan Tool (x64) Version:17-02-2016
Ran by Tonda (2016-02-17 23:52:25)
Running from C:\Users\Tonda\Desktop
Windows 8.1 Single Language (X64) (2015-07-29 23:07:33)
Boot Mode: Normal
==========================================================


==================== Accounts: =============================

Administrator (S-1-5-21-1060879729-762033656-2367951757-500 - Administrator - Disabled)
DefaultAccount (S-1-5-21-1060879729-762033656-2367951757-503 - Limited - Disabled)
Guest (S-1-5-21-1060879729-762033656-2367951757-501 - Limited - Enabled)
HomeGroupUser$ (S-1-5-21-1060879729-762033656-2367951757-1006 - Limited - Enabled)
Tonda (S-1-5-21-1060879729-762033656-2367951757-1001 - Administrator - Enabled) => C:\Users\Tonda

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AV: avast! Antivirus (Enabled - Up to date) {17AD7D40-BA12-9C46-7131-94903A54AD8B}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: avast! Antivirus (Enabled - Up to date) {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}

==================== Installed Programs ======================

(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

Adobe Acrobat Reader DC - Czech (HKLM-x32\...\{AC76BA86-7AD7-1029-7B44-AC0F074E4100}) (Version: 15.010.20059 - Adobe Systems Incorporated)
Adobe Photoshop CS6 (HKLM-x32\...\{74EB3499-8B95-4B5C-96EB-7B342F3FD0C6}) (Version: 13.0 - Adobe Systems Incorporated)
AMD Install Manager (HKLM\...\AMD Catalyst Install Manager) (Version: 5.00 - Advanced Micro Devices, Inc.)
Avast Free Antivirus (HKLM-x32\...\Avast) (Version: 11.1.2245 - AVAST Software)
Bigasoft Total Video Converter 4.5.2.5491 (HKLM-x32\...\{A72CE741-1F32-4D79-BFFB-A714375C678D}_is1) (Version: - Bigasoft Corporation)
Catalyst Control Center Next Localization BR (Version: 2015.1204.1216.22046 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization CS (Version: 2015.1204.1216.22046 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization DA (Version: 2015.1204.1216.22046 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization DE (Version: 2015.1204.1216.22046 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization EL (Version: 2015.1204.1216.22046 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization ES (Version: 2015.1204.1216.22046 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization FI (Version: 2015.1204.1216.22046 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization FR (Version: 2015.1204.1216.22046 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization HU (Version: 2015.1204.1216.22046 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization CHS (Version: 2015.1204.1216.22046 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization CHT (Version: 2015.1204.1216.22046 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization IT (Version: 2015.1204.1216.22046 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization JA (Version: 2015.1204.1216.22046 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization KO (Version: 2015.1204.1216.22046 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization NL (Version: 2015.1204.1216.22046 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization NO (Version: 2015.1204.1216.22046 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization PL (Version: 2015.1204.1216.22046 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization RU (Version: 2015.1204.1216.22046 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization SV (Version: 2015.1204.1216.22046 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization TH (Version: 2015.1204.1216.22046 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization TR (Version: 2015.1204.1216.22046 - Advanced Micro Devices, Inc.) Hidden
CCleaner (HKLM\...\CCleaner) (Version: 5.14 - Piriform)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 48.0.2564.109 - Google Inc.)
Google Update Helper (x32 Version: 1.3.29.5 - Google Inc.) Hidden
HWiNFO64 Version 5.02 (HKLM\...\HWiNFO64_is1) (Version: 5.02 - Martin Malík - REALiX)
Killer Bandwidth Control Filter Driver (Version: 1.1.54.1095 - Rivet Networks) Hidden
Killer E220x Drivers (Version: 1.1.54.1095 - Rivet Networks) Hidden
Killer Network Manager (Version: 1.1.54.1095 - Rivet Networks) Hidden
Killer Performance Suite (HKLM-x32\...\{E70DB50B-10B4-46BC-9DE2-AB8B49E061EE}) (Version: 1.1.54.1095 - Rivet Networks)
K-Lite Mega Codec Pack 11.5.0 (HKLM-x32\...\KLiteCodecPack_is1) (Version: 11.5.0 - )
Life Is Strange (HKLM-x32\...\Life Is Strange_is1) (Version: - )
Life Is Strange Episode 4 (HKLM-x32\...\Life Is Strange Episode 4_is1) (Version: - )
Life Is Strange Episode 5 (HKLM-x32\...\Life Is Strange Episode 5_is1) (Version: - )
Malwarebytes Anti-Malware verze 2.2.0.1024 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.2.0.1024 - Malwarebytes)
Manažer napájení (HKLM-x32\...\{F5663E7F-79CA-4022-8B39-D855A4E0BF58}) (Version: 1.1.0 - David Čapek)
Media Preview (HKLM\...\{A122AD66-B765-4B61-8B2B-EFEDE5BB9779}) (Version: 1.2.5.264 - BabelSoft)
MediaPortal (HKLM-x32\...\MediaPortal) (Version: 1.12.0 - Team MediaPortal)
MediaPortal TV Server / Client (HKLM-x32\...\MediaPortal TV Server) (Version: 1.12.0 - Team MediaPortal)
Microsoft Office Professional Plus 2013 (HKLM\...\Office15.PROPLUSR) (Version: 15.0.4569.1506 - Microsoft Corporation)
Microsoft Silverlight (HKLM-x32\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.21005 (HKLM-x32\...\{7f51bdb9-ee21-49ee-94d6-90afc321780e}) (Version: 12.0.21005.1 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005 (HKLM-x32\...\{ce085a78-074e-4823-8dc1-8a721b94b76d}) (Version: 12.0.21005.1 - Microsoft Corporation)
MPC-BE x64 1.4.6.1034 (HKLM\...\{FE09AF6D-78B2-4093-B012-FCDAF78693CE}_is1) (Version: 1.4.6.1034 - MPC-BE Team)
MSI Super Charger (HKLM-x32\...\{7CDF10DD-A9B5-4DA3-AB95-E193248D4369}_is1) (Version: 1.3.0.02 - MSI)
MySQL Server 5.6 (HKLM\...\{56DA0CB5-ABD2-4318-BEAB-62FDBC9B12CC}) (Version: 5.6.10 - Oracle Corporation)
Nástroje kontroly pravopisu pro Microsoft Office 2013 – čeština (Version: 15.0.4569.1506 - Microsoft Corporation) Hidden
Nástroje korektúry balíka Microsoft Office 2013 - slovenčina (Version: 15.0.4569.1506 - Microsoft Corporation) Hidden
NVIDIA PhysX (HKLM-x32\...\{B455E95A-B804-439F-B533-336B1635AE97}) (Version: 9.14.0702 - NVIDIA Corporation)
PDF Settings CS6 (x32 Version: 11.0 - Adobe Systems Incorporated) Hidden
RAPID Mode (Version: 1.0.1.91 - Samsung Electronics Co., Ltd.) Hidden
Raptr (HKLM-x32\...\Raptr) (Version: - )
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7541 - Realtek Semiconductor Corp.)
Samsung Magician (HKLM-x32\...\{29AE3F9F-7158-4ca7-B1ED-28A73ECDB215}_is1) (Version: 4.8 - Samsung Electronics)
Service Pack 1 for Microsoft Office 2013 (KB2850036) 64-Bit Edition (HKLM\...\{91150000-0011-0000-1000-0000000FF1CE}_Office15.PROPLUSR_{D82063A8-7C8C-4C3B-A9BB-95138CA55D26}) (Version: - Microsoft)
Service Pack 1 for Microsoft Office 2013 (KB2850036) 64-Bit Edition (Version: - Microsoft) Hidden
Sid Meiers Civilization - Beyond Earth (HKLM-x32\...\{A0FE4F89-F3E5-44D0-89AC-4AEA99C91693}_is1) (Version: 1.1.0.1043 - 2K)
The Sims 4 (HKLM-x32\...\VGhlU2ltczQ=_is1) (Version: 1 - )
The Sims™ 4 (HKLM-x32\...\{48EBEBBF-B9F8-4520-A3CF-89A730721917}) (Version: 1.0.732.20 - Electronic Arts Inc.)
WinRAR 5.21 (64-bit) (HKLM\...\WinRAR archiver) (Version: 5.21.0 - win.rar GmbH)

==================== Custom CLSID (Whitelisted): ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== Scheduled Tasks (Whitelisted) =============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

Task: {075B27F0-60E5-4D66-A542-6ED27B1093E0} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2015-12-13] (Adobe Systems Incorporated)
Task: {1364C731-3728-49B4-8F8E-495C73C961DA} - System32\Tasks\AutoPico Daily Restart => C:\Program Files\KMSpico\AutoPico.exe [2015-11-01] (@ByELDI)
Task: {2A776280-EC24-47C0-8DB3-BE0B1F1EAE06} - System32\Tasks\Microsoft\Office\Office 15 Subscription Heartbeat => C:\Program Files\Common Files\Microsoft Shared\Office15\OLicenseHeartbeat.exe [2014-01-23] (Microsoft Corporation)
Task: {4D1B5DCE-1A8B-447B-9108-A95CBEF20F78} - System32\Tasks\SamsungMagician => C:\Program Files (x86)\Samsung\Samsung Magician\Samsung Magician.exe [2015-10-16] (Samsung Electronics.)
Task: {5BCBD982-3149-4098-8838-E3694BFC985F} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2016-02-14] (Google Inc.)
Task: {79774C7F-781D-4E75-8354-598B1B115778} - System32\Tasks\avast! Emergency Update => C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe [2015-12-02] (AVAST Software)
Task: {902C6D6B-5A68-4FBC-B6E2-198B42047F41} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2016-01-15] (Piriform Ltd)
Task: {95873D0C-E319-4F3B-8F9C-B308394DBDDD} - System32\Tasks\AMD Updater => C:\Program Files\AMD\CIM\\Bin64\InstallManagerApp.exe [2015-12-04] (Advanced Micro Devices, Inc.)
Task: {BC7FE504-2085-4D70-B728-B7D6C4E02937} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\Windows\system32\MRT.exe [2016-01-13] (Microsoft Corporation)
Task: {C2DA6C5B-2531-4317-8236-6CC4278FFFCB} - System32\Tasks\Microsoft Office 15 Sync Maintenance for TONDA-Tonda Tonda => C:\Program Files\Microsoft Office\Office15\MsoSync.exe [2014-01-23] (Microsoft Corporation)
Task: {CAB1A3B1-0734-401E-8F94-3CD87E2823BB} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2016-02-14] (Google Inc.)
Task: {D42024BD-91B8-46AC-BB78-EE01BC283460} - System32\Tasks\{A688F226-6069-4C33-A59D-F586CDE46FB9} => pcalua.exe -a "E:\Grand Theft Auto V\unins000.exe"

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

==================== Shortcuts =============================

(The entries could be listed to be restored or removed.)

==================== Loaded Modules (Whitelisted) ==============

2015-07-30 07:16 - 2015-07-15 03:04 - 00032768 _____ () C:\Windows\SYSTEM32\licensemanagerapi.dll
2015-08-19 11:20 - 2015-08-11 10:14 - 00404480 _____ () C:\Windows\System32\diagtrack_wininternal.dll
2013-02-01 14:09 - 2013-02-01 14:09 - 12907520 _____ () C:\Program Files\MySQL\MySQL Server 5.6\bin\mysqld.exe
2015-10-01 09:42 - 2015-09-17 07:48 - 02494712 _____ () C:\Windows\system32\CoreUIComponents.dll
2015-10-01 09:42 - 2015-09-17 07:48 - 02494712 _____ () C:\Windows\System32\CoreUIComponents.dll
2015-10-01 09:42 - 2015-09-17 06:43 - 02028544 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\RulesService.dll
2015-12-09 00:50 - 2015-11-25 05:17 - 00471040 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.Core.dll
2015-12-09 00:50 - 2015-11-25 05:17 - 00619008 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SignalsManager.dll
2015-12-09 00:50 - 2015-11-25 05:18 - 00928768 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\RulesBackgroundTasks.dll
2015-10-01 09:42 - 2015-09-17 06:48 - 00429056 _____ () C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\QuickActions.dll
2015-12-09 00:50 - 2015-11-25 05:20 - 06569472 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\CortanaApi.dll
2015-12-09 00:50 - 2015-11-25 05:17 - 01808384 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.BackgroundTask.dll
2015-10-01 09:42 - 2015-09-17 06:43 - 02274816 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\RemindersUI.dll
2015-12-02 12:58 - 2015-12-02 12:58 - 00103888 _____ () C:\Program Files\AVAST Software\Avast\log.dll
2015-12-02 12:58 - 2015-12-02 12:58 - 00125512 _____ () C:\Program Files\AVAST Software\Avast\JsonRpcServer.dll
2016-02-17 22:45 - 2016-02-17 22:45 - 02835968 _____ () C:\Program Files\AVAST Software\Avast\defs\16021701\algo.dll
2015-12-02 12:58 - 2015-12-02 12:58 - 00469008 _____ () C:\Program Files\AVAST Software\Avast\ffl2.dll
2015-06-22 19:16 - 2015-06-22 19:16 - 00131584 _____ () C:\Program Files (x86)\Team MediaPortal\MediaPortal TV Server\StreamingServer.dll
2015-12-02 12:58 - 2015-12-02 12:58 - 40539648 _____ () C:\Program Files\AVAST Software\Avast\libcef.dll
2015-10-30 12:02 - 2015-10-16 00:46 - 00021600 _____ () C:\Program Files (x86)\Samsung\Samsung Magician\SAMSUNG_SSD.dll

==================== Alternate Data Streams (Whitelisted) =========

(If an entry is included in the fixlist, only the ADS will be removed.)


==================== Safe Mode (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== EXE Association (Whitelisted) ===============

(If an entry is included in the fixlist, the registry item will be restored to default or removed.)


==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, it will be removed from the registry.)


==================== Hosts content: ===============================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2015-07-10 12:04 - 2016-02-17 18:33 - 00000753 ____A C:\Windows\system32\Drivers\etc\hosts


127.0.0.1 localhost

==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-1060879729-762033656-2367951757-1001\Control Panel\Desktop\\Wallpaper -> E:\Stažené soubory\mountain_landscape-wallpaper-1920x1080.jpg
DNS Servers: 10.0.0.138
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
Windows Firewall is enabled.

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)

HKLM\...\StartupApproved\Run32: => "AdobeCS6ServiceManager"
HKLM\...\StartupApproved\Run32: => "SwitchBoard"
HKLM\...\StartupApproved\Run32: => "ArcSoft Connection Service"
HKLM\...\StartupApproved\Run32: => "Raptr"

==================== FirewallRules (Whitelisted) ===============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

FirewallRules: [vm-monitoring-nb-session] => (Allow) LPort=139
FirewallRules: [TCP Query User{6259F23A-787A-4D15-ABBB-9145B3D18B7A}C:\users\tonda\appdata\roaming\utorrent\utorrent.exe] => (Allow) C:\users\tonda\appdata\roaming\utorrent\utorrent.exe
FirewallRules: [UDP Query User{53A6A0A7-2FF2-44B5-92C6-87ADAE273134}C:\users\tonda\appdata\roaming\utorrent\utorrent.exe] => (Allow) C:\users\tonda\appdata\roaming\utorrent\utorrent.exe
FirewallRules: [{AD792A3E-8849-4997-8543-16129758FD49}] => (Allow) C:\Program Files\Microsoft Office\Office15\lync.exe
FirewallRules: [{5B11A20B-0CF7-45A6-A903-3ADFD43E0E64}] => (Allow) C:\Program Files\Microsoft Office\Office15\lync.exe
FirewallRules: [{B49E0F70-5044-47FB-AE0E-7581CC66D815}] => (Allow) C:\Program Files\Microsoft Office\Office15\UcMapi.exe
FirewallRules: [{16C66F90-01CA-412D-8F9E-CB07B7ACA2B8}] => (Allow) C:\Program Files\Microsoft Office\Office15\UcMapi.exe
FirewallRules: [{B3D8A075-0A07-4DFD-8EF8-7C62919DE468}] => (Allow) C:\Program Files (x86)\Team MediaPortal\MediaPortal TV Server\TvService.exe
FirewallRules: [{E01B45F5-6A37-46E1-BD0B-090DDF7DB811}] => (Allow) C:\Program Files (x86)\Team MediaPortal\MediaPortal TV Server\TvService.exe
FirewallRules: [{96572DA0-6DA5-4610-90AA-87A538E8750F}] => (Allow) C:\Program Files (x86)\Team MediaPortal\MediaPortal TV Server\SetupTv.exe
FirewallRules: [{54A756D8-9BF9-4CC6-A3DF-C6173BA7C656}] => (Allow) C:\Program Files (x86)\Team MediaPortal\MediaPortal TV Server\SetupTv.exe
FirewallRules: [{63842A75-8F64-4D94-BEF5-67427BEBE974}] => (Allow) C:\Program Files (x86)\Team MediaPortal\MediaPortal\MediaPortal.exe
FirewallRules: [{4663B54D-7531-4D5A-B4B5-6C5BD917588C}] => (Allow) C:\Program Files (x86)\Team MediaPortal\MediaPortal\MediaPortal.exe
FirewallRules: [{06D0F54B-54FD-42BC-89C0-F07C57022353}] => (Allow) LPort=3306
FirewallRules: [TCP Query User{7DA39AA9-A68B-4716-BB82-E1FB96D982C4}C:\program files (x86)\team mediaportal\mediaportal\configuration.exe] => (Allow) C:\program files (x86)\team mediaportal\mediaportal\configuration.exe
FirewallRules: [UDP Query User{399531C9-4303-4433-A141-205156917D1B}C:\program files (x86)\team mediaportal\mediaportal\configuration.exe] => (Allow) C:\program files (x86)\team mediaportal\mediaportal\configuration.exe
FirewallRules: [{1053DE6F-1589-4997-8736-E0D78F2FA92A}] => (Allow) E:\The Sims 4\Game\Bin\TS4.exe
FirewallRules: [{E67D4AB8-5EB1-4BC0-9C77-8A7852C7849B}] => (Allow) E:\The Sims 4\Game\Bin\TS4.exe
FirewallRules: [{DC4F0C72-8D50-478F-B6A4-70EAC6CE3530}] => (Allow) C:\Program Files (x86)\Raptr\raptr.exe
FirewallRules: [{54A65FAC-3AA5-45FA-B8F7-7CF089561752}] => (Allow) C:\Program Files (x86)\Raptr\raptr.exe
FirewallRules: [{19E2F760-6890-44CA-8AFA-46F261D4FDE3}] => (Allow) C:\Program Files (x86)\Raptr\raptr_im.exe
FirewallRules: [{1AF0CAA3-9B30-4BEB-BA84-255E3B1486F7}] => (Allow) C:\Program Files (x86)\Raptr\raptr_im.exe
FirewallRules: [{9856EAB7-F5F2-44A0-AB37-95C58CD2A1BD}] => (Allow) LPort=1688
FirewallRules: [{29CB26FF-49E1-4CCC-A57A-0111978FF8C5}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

==================== Restore Points =========================

17-02-2016 18:32:44 zoek.exe restore point

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (02/17/2016 11:42:27 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: TONDA)
Description: Aplikaci Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy!App se nepovedlo aktivovat, protože došlo k chybě: -2144927141. Další informace najdete v protokolu Microsoft-Windows-TWinUI/Operational.

Error: (02/17/2016 11:42:27 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: TONDA)
Description: Aplikaci Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy!App se nepovedlo aktivovat, protože došlo k chybě: -2144927141. Další informace najdete v protokolu Microsoft-Windows-TWinUI/Operational.

Error: (02/17/2016 06:32:46 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )
Description: Služba Šifrování selhala při volání OnIdentity() v objektu System Writer.

Details:
AddLegacyDriverFiles: Unable to back up image of binary Protokol Microsoft LLDP (Link-Layer Discovery Protocol).

System Error:
Přístup byl odepřen.
.

Error: (02/17/2016 11:26:30 AM) (Source: MsiInstaller) (EventID: 1024) (User: TONDA)
Description: Aktualizaci {AC76BA86-7AD7-0000-2550-AC0F0A4E5B00} produktu Adobe Acrobat Reader DC - Czech nebylo možné nainstalovat. Kód chyby: 1625. Instalační služba systému Windows může vytvořit soubor protokolu s informacemi, které usnadní řešení potíží při instalaci softwaru. Další informace naleznete na webu na adrese http://go.microsoft.com/fwlink/?LinkId=23127

Error: (02/17/2016 01:10:47 AM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: TONDA)
Description: Aplikaci Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy!App se nepovedlo aktivovat, protože došlo k chybě: -2144927141. Další informace najdete v protokolu Microsoft-Windows-TWinUI/Operational.

Error: (02/17/2016 01:10:47 AM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: TONDA)
Description: Aplikaci Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy!App se nepovedlo aktivovat, protože došlo k chybě: -2144927141. Další informace najdete v protokolu Microsoft-Windows-TWinUI/Operational.

Error: (02/16/2016 02:11:14 AM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: TONDA)
Description: Aplikaci Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUI se nepovedlo aktivovat, protože došlo k chybě: -2144927141. Další informace najdete v protokolu Microsoft-Windows-TWinUI/Operational.

Error: (02/16/2016 02:11:13 AM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: TONDA)
Description: Aplikaci Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy!App se nepovedlo aktivovat, protože došlo k chybě: -2144927141. Další informace najdete v protokolu Microsoft-Windows-TWinUI/Operational.

Error: (02/16/2016 02:11:13 AM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: TONDA)
Description: Aplikaci Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy!App se nepovedlo aktivovat, protože došlo k chybě: -2144927141. Další informace najdete v protokolu Microsoft-Windows-TWinUI/Operational.

Error: (02/15/2016 08:02:31 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: TONDA)
Description: Aplikaci Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy!App se nepovedlo aktivovat, protože došlo k chybě: -2144927141. Další informace najdete v protokolu Microsoft-Windows-TWinUI/Operational.


System errors:
=============
Error: (02/17/2016 11:47:07 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Služba Přístup k uživatelským datům_Session1 byla nečekaně ukončena. Stalo se to 1 krát. Následující opravná akce bude spuštěna za 10000 milisekund: Restartovat službu.

Error: (02/17/2016 11:47:07 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Služba Úložiště uživatelských dat_Session1 byla nečekaně ukončena. Stalo se to 1 krát. Následující opravná akce bude spuštěna za 10000 milisekund: Restartovat službu.

Error: (02/17/2016 11:47:07 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Služba Data kontaktů_Session1 byla nečekaně ukončena. Stalo se to 1 krát. Následující opravná akce bude spuštěna za 10000 milisekund: Restartovat službu.

Error: (02/17/2016 11:47:07 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Služba Hostitel synchronizace_Session1 byla nečekaně ukončena. Stalo se to 1 krát. Následující opravná akce bude spuštěna za 10000 milisekund: Restartovat službu.

Error: (02/17/2016 11:42:27 PM) (Source: DCOM) (EventID: 10010) (User: TONDA)
Description: Windows.Security.Authentication.Web.Core.BackgroundGetTokenTask.ClassId.WebAccountProvider

Error: (02/17/2016 11:42:27 PM) (Source: DCOM) (EventID: 10010) (User: TONDA)
Description: Windows.Security.Authentication.Web.Core.BackgroundGetTokenTask.ClassId.WebAccountProvider

Error: (02/17/2016 11:42:27 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Služba Přístup k uživatelským datům_Session1 byla nečekaně ukončena. Stalo se to 1 krát. Následující opravná akce bude spuštěna za 10000 milisekund: Restartovat službu.

Error: (02/17/2016 11:42:27 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Služba Úložiště uživatelských dat_Session1 byla nečekaně ukončena. Stalo se to 1 krát. Následující opravná akce bude spuštěna za 10000 milisekund: Restartovat službu.

Error: (02/17/2016 11:42:27 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Služba Data kontaktů_Session1 byla nečekaně ukončena. Stalo se to 1 krát. Následující opravná akce bude spuštěna za 10000 milisekund: Restartovat službu.

Error: (02/17/2016 11:42:27 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Služba Hostitel synchronizace_Session1 byla nečekaně ukončena. Stalo se to 1 krát. Následující opravná akce bude spuštěna za 10000 milisekund: Restartovat službu.


CodeIntegrity:
===================================
Date: 2016-02-16 13:20:51.828
Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Common Files\microsoft shared\OFFICE15\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements.

Date: 2015-08-09 20:27:33.390
Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Common Files\microsoft shared\OFFICE15\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements.


==================== Memory info ===========================

Processor: AMD FX(tm)-6300 Six-Core Processor
Percentage of memory in use: 33%
Total physical RAM: 8140.24 MB
Available physical RAM: 5448.02 MB

Uživatelský avatar
jerabina
člen Security týmu
Level 6
Level 6
Příspěvky: 3647
Registrován: březen 13
Bydliště: Litoměřice
Pohlaví: Muž
Stav:
Offline

Re: Prosím o kontrolu logu

Příspěvekod jerabina » 18 úno 2016 00:19

Prosím, postupuj následujícím způsobem:
Otevřít poznámkový blok (Start => Všechny programy => Příslušenství => Poznámkový blok).
Prosím, zkopíruj do něj celý obsah níže.

Kód: Vybrat vše

Start
CloseProcesses:

HKLM\...\Run: [AdobeAAMUpdater-1.0] => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [446392 2012-04-04] (Adobe Systems Incorporated)
HKLM\...\runonceex: [Flags] => 128
HKLM\...\runonceex: [Title] => RAPID uninstall cleanup using key [0001]
HKU\S-1-5-21-1060879729-762033656-2367951757-1001\...\Run: [AdobeBridge] => [X]
ShellIconOverlayIdentifiers: [ OneDrive1] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} => No File
ShellIconOverlayIdentifiers: [ OneDrive2] -> {5AB7172C-9C11-405C-8DD5-AF20F3606282} => No File
ShellIconOverlayIdentifiers: [ OneDrive3] -> {A78ED123-AB77-406B-9962-2A5D9D2F7F30} => No File
ShellIconOverlayIdentifiers: [ OneDrive4] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} => No File
ShellIconOverlayIdentifiers: [ OneDrive5] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} => No File
ShellIconOverlayIdentifiers-x32: [ OneDrive1] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} => No File
ShellIconOverlayIdentifiers-x32: [ OneDrive2] -> {5AB7172C-9C11-405C-8DD5-AF20F3606282} => No File
ShellIconOverlayIdentifiers-x32: [ OneDrive3] -> {A78ED123-AB77-406B-9962-2A5D9D2F7F30} => No File
ShellIconOverlayIdentifiers-x32: [ OneDrive4] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} => No File
ShellIconOverlayIdentifiers-x32: [ OneDrive5] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} => No File
BootExecute: autocheck autochk * sh4native Sh4Removalsdnclean64.exe

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page =
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL =
HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Local Page =

FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.29.5\npGoogleUpdate3.dll [2016-02-14] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.29.5\npGoogleUpdate3.dll [2016-02-14] (Google Inc.)

C:\ProgramData\RogueKiller

Task: {075B27F0-60E5-4D66-A542-6ED27B1093E0} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2015-12-13] (Adobe Systems Incorporated)
Task: {1364C731-3728-49B4-8F8E-495C73C961DA} - System32\Tasks\AutoPico Daily Restart => C:\Program Files\KMSpico\AutoPico.exe [2015-11-01] (@ByELDI)
Task: {5BCBD982-3149-4098-8838-E3694BFC985F} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2016-02-14] (Google Inc.)
Task: {CAB1A3B1-0734-401E-8F94-3CD87E2823BB} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2016-02-14] (Google Inc.)
Task: {D42024BD-91B8-46AC-BB78-EE01BC283460} - System32\Tasks\{A688F226-6069-4C33-A59D-F586CDE46FB9} => pcalua.exe -a "E:\Grand Theft Auto V\unins000.exe"
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

C:\Program Files\KMSpico
C:\Program Files (x86)\Google\Update

EmptyTemp:
End


(Můžeš použít funkci „vybrat vše“, klepni pravým tlačítkem myši na levé horní políčko v otevřeném poznámkovém bloku a zvol „ Vložit“).

Ulož jej na na plochu jako fixlist.txt

Spusťt FRST a stiskni tlačítko „Fix“ (Opravit) jen jednou a čekej.
Nástroj vypracuje log na ploše (Fixlog.txt), prosím zkopíruj sem celý jeho obsah.

V možnostech složky si povol zobrazování skrytých souborů a složek+ odškrtni zatržítko skrýt chráněné soubory operačního systému

Toto otestuj na Virustotal:
C:\Windows\wininit.ini
C:\Windows\SECOH-QAD.exe


Klikni vpravo od okénka na Vybrat a v Exploreru najdi požadovaný soubor v Tvém PC. Označ ho myší a klikni na Otevřít , poté klikni na Send File. Pokud už byl soubor testován , objeví se okno ve kterém klikni na Reanalyze. Soubor se začne postupně testovat více antivirovými programy. Až skončí test posledního antiviru , objeví se nahoře result a červeně počet nákaz , např. 0/43 , nebo 1/43. Pak zkopíruj myší odkaz na tuto stránku a vlož ji do svého příspěvku.
Když nevíš jak dál, přichází na řadu prostudovat manuál!
HJT návod

Pokud neodpovídám do vašich témat v sekci HJT když jsem online, tak je to jen proto, že jsem na mobilu kde je studování logů a psaní skriptů nemožné. Neberte to tedy prosím jako ignoraci.

Tondys01
nováček
Příspěvky: 22
Registrován: únor 16
Pohlaví: Nespecifikováno
Stav:
Offline

Re: Prosím o kontrolu logu

Příspěvekod Tondys01 » 18 úno 2016 01:31

Tak to vypadá že byly všechny problémy tímto postupem, za pomocí programu FRST, vyřešeny! :) Tak moc děkuji všem, kteří jste mi pomohli za vyřešení problému! Už jsem se začal smiřovat s tím, že počítač budu muset nechat převézt švagrovi, který ale žije až na druhé straně Česka, aby mi počítač přeinstaloval a už to funguje jak má! Mám moc velkou radost. Ještě jednou díky! :)

Tondys01
nováček
Příspěvky: 22
Registrován: únor 16
Pohlaví: Nespecifikováno
Stav:
Offline

Re: Prosím o kontrolu logu

Příspěvekod Tondys01 » 18 úno 2016 18:15

Tak bohužel stále stejný problém. Je to zajímavé, ale včera v noci mi vše fungovalo. Dnes jsem to vyzkoušel znovu a problémy jsou zpět. Přidávám tedy log + odkaz, ale k souboru C:\Windows\SECOH-QAD.exe mi Windows píše že soubor nebylo možné nalézt.

Fix result of Farbar Recovery Scan Tool (x64) Version:17-02-2016
Ran by Tonda (2016-02-18 18:18:21) Run:3
Running from C:\Users\Tonda\Desktop
Loaded Profiles: Tonda (Available Profiles: Tonda)
Boot Mode: Normal
==============================================

fixlist content:
*****************
Start
CloseProcesses:

HKLM\...\Run: [AdobeAAMUpdater-1.0] => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [446392 2012-04-04] (Adobe Systems Incorporated)
HKLM\...\runonceex: [Flags] => 128
HKLM\...\runonceex: [Title] => RAPID uninstall cleanup using key [0001]
HKU\S-1-5-21-1060879729-762033656-2367951757-1001\...\Run: [AdobeBridge] => [X]
ShellIconOverlayIdentifiers: [ OneDrive1] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} => No File
ShellIconOverlayIdentifiers: [ OneDrive2] -> {5AB7172C-9C11-405C-8DD5-AF20F3606282} => No File
ShellIconOverlayIdentifiers: [ OneDrive3] -> {A78ED123-AB77-406B-9962-2A5D9D2F7F30} => No File
ShellIconOverlayIdentifiers: [ OneDrive4] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} => No File
ShellIconOverlayIdentifiers: [ OneDrive5] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} => No File
ShellIconOverlayIdentifiers-x32: [ OneDrive1] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} => No File
ShellIconOverlayIdentifiers-x32: [ OneDrive2] -> {5AB7172C-9C11-405C-8DD5-AF20F3606282} => No File
ShellIconOverlayIdentifiers-x32: [ OneDrive3] -> {A78ED123-AB77-406B-9962-2A5D9D2F7F30} => No File
ShellIconOverlayIdentifiers-x32: [ OneDrive4] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} => No File
ShellIconOverlayIdentifiers-x32: [ OneDrive5] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} => No File
BootExecute: autocheck autochk * sh4native Sh4Removalsdnclean64.exe

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page =
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL =
HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Local Page =

FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.29.5\npGoogleUpdate3.dll [2016-02-14] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.29.5\npGoogleUpdate3.dll [2016-02-14] (Google Inc.)

C:\ProgramData\RogueKiller

Task: {075B27F0-60E5-4D66-A542-6ED27B1093E0} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2015-12-13] (Adobe Systems Incorporated)
Task: {1364C731-3728-49B4-8F8E-495C73C961DA} - System32\Tasks\AutoPico Daily Restart => C:\Program Files\KMSpico\AutoPico.exe [2015-11-01] (@ByELDI)
Task: {5BCBD982-3149-4098-8838-E3694BFC985F} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2016-02-14] (Google Inc.)
Task: {CAB1A3B1-0734-401E-8F94-3CD87E2823BB} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2016-02-14] (Google Inc.)
Task: {D42024BD-91B8-46AC-BB78-EE01BC283460} - System32\Tasks\{A688F226-6069-4C33-A59D-F586CDE46FB9} => pcalua.exe -a "E:\Grand Theft Auto V\unins000.exe"
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

C:\Program Files\KMSpico
C:\Program Files (x86)\Google\Update

EmptyTemp:
End
*****************

Processes closed successfully.
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\\AdobeAAMUpdater-1.0 => value not found.
HKLM\Software\Microsoft\Windows\CurrentVersion\runonceex\\Flags => value not found.
HKLM\Software\Microsoft\Windows\CurrentVersion\runonceex\\Title => value not found.
HKU\S-1-5-21-1060879729-762033656-2367951757-1001\Software\Microsoft\Windows\CurrentVersion\Run\\AdobeBridge => value not found.
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\ OneDrive1 => key not found.
HKCR\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524} => key not found.
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\ OneDrive2 => key not found.
HKCR\CLSID\{5AB7172C-9C11-405C-8DD5-AF20F3606282} => key not found.
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\ OneDrive3 => key not found.
HKCR\CLSID\{A78ED123-AB77-406B-9962-2A5D9D2F7F30} => key not found.
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\ OneDrive4 => key not found.
HKCR\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A} => key not found.
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\ OneDrive5 => key not found.
HKCR\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} => key not found.
HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\ OneDrive1 => key not found.
HKCR\Wow6432Node\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524} => key not found.
HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\ OneDrive2 => key not found.
HKCR\Wow6432Node\CLSID\{5AB7172C-9C11-405C-8DD5-AF20F3606282} => key not found.
HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\ OneDrive3 => key not found.
HKCR\Wow6432Node\CLSID\{A78ED123-AB77-406B-9962-2A5D9D2F7F30} => key not found.
HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\ OneDrive4 => key not found.
HKCR\Wow6432Node\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A} => key not found.
HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\ OneDrive5 => key not found.
HKCR\Wow6432Node\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} => key not found.
hklm\System\CurrentControlSet\Control\Session Manager\\BootExecute => value restored successfully
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main\\Start Page => value restored successfully
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main\\Search Page => value restored successfully
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main\\Default_Page_URL => value restored successfully
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main\\Default_Search_URL => value restored successfully
HKLM\Software\\Microsoft\Internet Explorer\Main\\Local Page => value restored successfully
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main\\Local Page => value restored successfully
HKLM\Software\Wow6432Node\MozillaPlugins\@tools.google.com/Google Update;version=3 => key not found.
C:\Program Files (x86)\Google\Update\1.3.29.5\npGoogleUpdate3.dll => not found.
HKLM\Software\Wow6432Node\MozillaPlugins\@tools.google.com/Google Update;version=9 => key not found.
C:\Program Files (x86)\Google\Update\1.3.29.5\npGoogleUpdate3.dll => not found.
"C:\ProgramData\RogueKiller" => not found.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{075B27F0-60E5-4D66-A542-6ED27B1093E0} => key not found.
C:\Windows\System32\Tasks\Adobe Acrobat Update Task => not found.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Adobe Acrobat Update Task => key not found.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{1364C731-3728-49B4-8F8E-495C73C961DA} => key not found.
C:\Windows\System32\Tasks\AutoPico Daily Restart => not found.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\AutoPico Daily Restart => key not found.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{5BCBD982-3149-4098-8838-E3694BFC985F} => key not found.
C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore => not found.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\GoogleUpdateTaskMachineCore => key not found.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{CAB1A3B1-0734-401E-8F94-3CD87E2823BB} => key not found.
C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA => not found.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\GoogleUpdateTaskMachineUA => key not found.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{D42024BD-91B8-46AC-BB78-EE01BC283460} => key not found.
C:\Windows\System32\Tasks\{A688F226-6069-4C33-A59D-F586CDE46FB9} => not found.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{A688F226-6069-4C33-A59D-F586CDE46FB9} => key not found.
C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => not found.
C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => not found.
"C:\Program Files\KMSpico" => not found.
"C:\Program Files (x86)\Google\Update" => not found.
EmptyTemp: => 1.7 GB temporary data Removed.


The system needed a reboot.

==== End of Fixlog 18:18:34 ====

https://www.virustotal.com/cs/file/851f ... 455805236/

Uživatelský avatar
jerabina
člen Security týmu
Level 6
Level 6
Příspěvky: 3647
Registrován: březen 13
Bydliště: Litoměřice
Pohlaví: Muž
Stav:
Offline

Re: Prosím o kontrolu logu

Příspěvekod jerabina » 20 úno 2016 23:14

Stáhni si OTL by OldTimer
na plochu. Ujisti se , že máš zavřena všechna ostatní okna a poklepej na ikonu OTL.Nahoře v okně pod Výstup klikni na minimální výstup.Pod Běžné registry změň na Vše. Zatrhni Kontrola na havěť “LOP“ a Kontrola na havěť “ Purity“ . Klikni na Prohledat. Všechny ostatní nastavení ponech jak jsou. Sken může trvat dlouho, až skončí otevřou se dva logy:
OTL.Txt
Extras.Txt

Jsou uloženy ve stejném místě jako OTL. Oba logy sem prosím zkopíruj.
Když nevíš jak dál, přichází na řadu prostudovat manuál!
HJT návod

Pokud neodpovídám do vašich témat v sekci HJT když jsem online, tak je to jen proto, že jsem na mobilu kde je studování logů a psaní skriptů nemožné. Neberte to tedy prosím jako ignoraci.

Tondys01
nováček
Příspěvky: 22
Registrován: únor 16
Pohlaví: Nespecifikováno
Stav:
Offline

Re: Prosím o kontrolu logu

Příspěvekod Tondys01 » 20 úno 2016 23:41

OTL logfile created on: 20.02.2016 23:32:12 - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Tonda\Desktop
64bit- An unknown product (Version = 6.2.9200) - Type = NTWorkstation
Internet Explorer (Version = 9.11.10240.16384)
Locale: 00000405 | Country: Česká republika | Language: CSY | Date Format: dd.MM.yyyy

7,95 Gb Total Physical Memory | 5,16 Gb Available Physical Memory | 64,88% Memory free
8,34 Gb Paging File | 4,94 Gb Available in Paging File | 59,22% Paging File free
Paging file location(s): c:\pagefile.sys 400 4000 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 111,24 Gb Total Space | 60,79 Gb Free Space | 54,65% Space Free | Partition Type: NTFS
Drive E: | 931,41 Gb Total Space | 350,32 Gb Free Space | 37,61% Space Free | Partition Type: NTFS

Computer Name: TONDA | User Name: Tonda | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - File not found
PRC - C:\Users\Tonda\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files (x86)\Avira\Antivirus\sched.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Program Files (x86)\Avira\Antivirus\avgnt.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Program Files (x86)\Avira\Antivirus\avguard.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Program Files (x86)\Avira\Launcher\Avira.ServiceHost.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Program Files (x86)\Avira\Launcher\Avira.Systray.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
PRC - C:\Program Files (x86)\Samsung\Samsung Magician\Samsung Magician.exe (Samsung Electronics.)
PRC - C:\Program Files (x86)\MSI\Super Charger\Super Charger.exe (MSI)
PRC - C:\Program Files (x86)\Team MediaPortal\MediaPortal TV Server\TvService.exe (Team MediaPortal)
PRC - C:\Program Files (x86)\MSI\Super Charger\ChargeService.exe (MSI)


========== Modules (No Company Name) ==========

MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Data.Linq\381c7253617841fe7d6b849e880abe4d\System.Data.Linq.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Compba577418#\db8400b3f8ef08b385419631867950a0\System.ComponentModel.Composition.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.ServiceModel\9ad07ecbe474ba88c5b794d6bc71c5e2\System.ServiceModel.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Transactions\3f645ad9aa637934d3790305477db435\System.Transactions.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Data\5cb1a70a9d682bbf83eb4e2f7e18c6cc\System.Data.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Serv759bfb78#\8bb25d8c9c1e8b90ebfec437d333fabb\System.ServiceProcess.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\c147132100f7aa5342722c9026da51f6\System.Windows.Forms.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Drawing\bc7fd9cc1a3f6170ae99f5e7ae037511\System.Drawing.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\c5a38599d574510c595460255db6052a\System.Xml.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml.Linq\a78f9d07867ccd0a4a1623a67d0e6bd8\System.Xml.Linq.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xaml\52b5ae6e1d00919ebe28833789fcc0e5\System.Xaml.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Runteb92aa12#\949a916b24e026b9665048ab18c12a38\System.Runtime.Serialization.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\6c6d41c539624549b8e52a074befda66\System.Core.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\af959f7201f0e676870df804d6c1f7d1\System.Configuration.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\Presentatioaec034ca#\6a65046927d96e63475b3678ff69c224\PresentationFramework.Aero2.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\Presentatio5ae0f00f#\8021cc1836777df58ffaab6037980a8d\PresentationFramework.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\PresentationCore\22deb06b2739748bf9c8c66d0b4e74a5\PresentationCore.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\WindowsBase\e0ab573bb825f8e2e8ca12f072a00f3b\WindowsBase.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System\141950bbb0b97c04e39b8c1097eb38b4\System.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Numerics\f57add249116cd17cc52e34ab6fa92f2\System.Numerics.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\68b0897c4cade2a6a72889bff2bd0904\mscorlib.ni.dll ()
MOD - C:\Program Files (x86)\Samsung\Samsung Magician\SAMSUNG_SSD.dll ()


========== Services (SafeList) ==========

SRV:64bit: - (UserManager) -- C:\Windows\SysNative\usermgr.dll (Microsoft Corporation)
SRV:64bit: - (AMD External Events Utility) -- C:\Windows\SysNative\atiesrxx.exe (AMD)
SRV:64bit: - (AppXSvc) -- C:\Windows\SysNative\AppXDeploymentServer.dll (Microsoft Corporation)
SRV:64bit: - (RetailDemo) -- C:\Windows\SysNative\RDXService.dll (Microsoft Corporation)
SRV:64bit: - (StateRepository) -- C:\Windows\SysNative\Windows.StateRepository.dll (Microsoft Corporation)
SRV:64bit: - (DsSvc) -- C:\Windows\SysNative\dssvc.dll (Microsoft Corporation)
SRV:64bit: - (UserDataSvc) -- C:\Windows\SysNative\UserDataService.dll (Microsoft Corporation)
SRV:64bit: - (PimIndexMaintenanceSvc) -- C:\Windows\SysNative\PimIndexMaintenance.dll (Microsoft Corporation)
SRV:64bit: - (UnistoreSvc) -- C:\Windows\SysNative\Unistore.dll (Microsoft Corporation)
SRV:64bit: - (CoreMessagingRegistrar) -- C:\Windows\SysNative\CoreMessaging.dll (Microsoft Corporation)
SRV:64bit: - (icssvc) -- C:\Windows\SysNative\tetheringservice.dll (Microsoft Corporation)
SRV:64bit: - (DmEnrollmentSvc) -- C:\Windows\SysNative\Windows.Internal.Management.dll (Microsoft Corporation)
SRV:64bit: - (tiledatamodelsvc) -- C:\Windows\SysNative\tileobjserver.dll (Microsoft Corporation)
SRV:64bit: - (Wcmsvc) -- C:\Windows\SysNative\wcmsvc.dll (Microsoft Corporation)
SRV:64bit: - (wlidsvc) -- C:\Windows\SysNative\wlidsvc.dll (Microsoft Corporation)
SRV:64bit: - (NgcSvc) -- C:\Windows\SysNative\ngcsvc.dll (Microsoft Corporation)
SRV:64bit: - (BrokerInfrastructure) -- C:\Windows\SysNative\bisrv.dll (Microsoft Corporation)
SRV:64bit: - (workfolderssvc) -- C:\Windows\SysNative\workfolderssvc.dll (Microsoft Corporation)
SRV:64bit: - (SystemEventsBroker) -- C:\Windows\SysNative\SystemEventsBrokerServer.dll (Microsoft Corporation)
SRV:64bit: - (NetSetupSvc) -- C:\Windows\SysNative\NetSetupSvc.dll (Microsoft Corporation)
SRV:64bit: - (VaultSvc) -- C:\Windows\SysNative\vaultsvc.dll (Microsoft Corporation)
SRV:64bit: - (DiagTrack) -- C:\Windows\SysNative\diagtrack.dll (Microsoft Corporation)
SRV:64bit: - (AudioEndpointBuilder) -- C:\Windows\SysNative\AudioEndpointBuilder.dll (Microsoft Corporation)
SRV:64bit: - (SensorService) -- C:\Windows\SysNative\SensorService.dll (Microsoft Corporation)
SRV:64bit: - (UsoSvc) -- C:\Windows\SysNative\usocore.dll (Microsoft Corporation)
SRV:64bit: - (ClipSVC) -- C:\Windows\SysNative\ClipSVC.dll (Microsoft Corporation)
SRV:64bit: - (SensorDataService) -- C:\Windows\SysNative\SensorDataService.exe (Microsoft Corporation)
SRV:64bit: - (AppReadiness) -- C:\Windows\SysNative\AppReadiness.dll (Microsoft Corporation)
SRV:64bit: - (WalletService) -- C:\Windows\SysNative\WalletService.dll (Microsoft Corporation)
SRV:64bit: - (WiaRpc) -- C:\Windows\SysNative\wiarpc.dll (Microsoft Corporation)
SRV:64bit: - (NcaSvc) -- C:\Windows\SysNative\NcaSvc.dll (Microsoft Corporation)
SRV:64bit: - (IEEtwCollectorService) -- C:\Windows\SysNative\IEEtwCollector.exe (Microsoft Corporation)
SRV:64bit: - (LSM) -- C:\Windows\SysNative\lsm.dll (Microsoft Corporation)
SRV:64bit: - (NcdAutoSetup) -- C:\Windows\SysNative\NcdAutoSetup.dll (Microsoft Corporation)
SRV:64bit: - (NcbService) -- C:\Windows\SysNative\ncbservice.dll (Microsoft Corporation)
SRV:64bit: - (WpnService) -- C:\Windows\SysNative\wpnservice.dll (Microsoft Corporation)
SRV:64bit: - (DevQueryBroker) -- C:\Windows\SysNative\DevQueryBroker.dll (Microsoft Corporation)
SRV:64bit: - (lfsvc) -- C:\Windows\SysNative\lfsvc.dll (Microsoft Corporation)
SRV:64bit: - (XblGameSave) -- C:\Windows\SysNative\XblGameSave.dll (Microsoft Corporation)
SRV:64bit: - (XboxNetApiSvc) -- C:\Windows\SysNative\XboxNetApiSvc.dll (Microsoft Corporation)
SRV:64bit: - (NgcCtnrSvc) -- C:\Windows\SysNative\NgcCtnrSvc.dll (Microsoft Corporation)
SRV:64bit: - (MapsBroker) -- C:\Windows\SysNative\moshost.dll (Microsoft Corporation)
SRV:64bit: - (AJRouter) -- C:\Windows\SysNative\AJRouter.dll (Microsoft Corporation)
SRV:64bit: - (LicenseManager) -- C:\Windows\SysNative\LicenseManagerSvc.dll (Microsoft Corporation)
SRV:64bit: - (CDPSvc) -- C:\Windows\SysNative\cdpsvc.dll (Microsoft Corporation)
SRV:64bit: - (embeddedmode) -- C:\Windows\SysNative\embeddedmodesvc.dll (Microsoft Corporation)
SRV:64bit: - (WSService) -- C:\Windows\SysNative\WSService.dll (Microsoft Corporation)
SRV:64bit: - (XblAuthManager) -- C:\Windows\SysNative\XblAuthManager.dll (Microsoft Corporation)
SRV:64bit: - (Netlogon) -- C:\Windows\SysNative\netlogon.dll (Microsoft Corporation)
SRV:64bit: - (EFS) -- C:\Windows\SysNative\efssvc.dll (Microsoft Corporation)
SRV:64bit: - (KeyIso) -- C:\Windows\SysNative\keyiso.dll (Microsoft Corporation)
SRV:64bit: - (WEPHOSTSVC) -- C:\Windows\SysNative\wephostsvc.dll (Microsoft Corporation)
SRV:64bit: - (ScDeviceEnum) -- C:\Windows\SysNative\ScDeviceEnum.dll (Microsoft Corporation)
SRV:64bit: - (OneSyncSvc) -- C:\Windows\SysNative\APHostService.dll (Microsoft Corporation)
SRV:64bit: - (DcpSvc) -- C:\Windows\SysNative\dcpsvc.dll (Microsoft Corporation)
SRV:64bit: - (diagnosticshub.standardcollector.service) -- C:\Windows\SysNative\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe (Microsoft Corporation)
SRV:64bit: - (UserDataSvc_Session1) -- C:\Windows\SysNative\svchost.exe (Microsoft Corporation)
SRV:64bit: - (UnistoreSvc_Session1) -- C:\Windows\SysNative\svchost.exe (Microsoft Corporation)
SRV:64bit: - (PimIndexMaintenanceSvc_Session1) -- C:\Windows\SysNative\svchost.exe (Microsoft Corporation)
SRV:64bit: - (OneSyncSvc_Session1) -- C:\Windows\SysNative\svchost.exe (Microsoft Corporation)
SRV:64bit: - (DeviceAssociationService) -- C:\Windows\SysNative\das.dll (Microsoft Corporation)
SRV:64bit: - (DsmSvc) -- C:\Windows\SysNative\DeviceSetupManager.dll (Microsoft Corporation)
SRV:64bit: - (smphost) -- C:\Windows\SysNative\smphost.dll (Microsoft Corporation)
SRV:64bit: - (fhsvc) -- C:\Windows\SysNative\fhsvc.dll (Microsoft Corporation)
SRV:64bit: - (svsvc) -- C:\Windows\SysNative\svsvc.dll (Microsoft Corporation)
SRV:64bit: - (EntAppSvc) -- C:\Windows\SysNative\EnterpriseAppMgmtSvc.dll (Microsoft Corporation)
SRV:64bit: - (dmwappushservice) -- C:\Windows\SysNative\dmwappushsvc.dll (Microsoft Corporation)
SRV:64bit: - (SmsRouter) -- C:\Windows\SysNative\SmsRouterSvc.dll (Microsoft Corporation)
SRV:64bit: - (netprofm) -- C:\Windows\SysNative\netprofmsvc.dll (Microsoft Corporation)
SRV:64bit: - (WdNisSvc) -- C:\Program Files\Windows Defender\NisSrv.exe (Microsoft Corporation)
SRV:64bit: - (TimeBroker) -- C:\Windows\SysNative\TimeBrokerServer.dll (Microsoft Corporation)
SRV:64bit: - (vmicheartbeat) -- C:\Windows\SysNative\icsvc.dll (Microsoft Corporation)
SRV:64bit: - (vmicvss) -- C:\Windows\SysNative\icsvc.dll (Microsoft Corporation)
SRV:64bit: - (vmicvmsession) -- C:\Windows\SysNative\icsvc.dll (Microsoft Corporation)
SRV:64bit: - (vmictimesync) -- C:\Windows\SysNative\icsvc.dll (Microsoft Corporation)
SRV:64bit: - (vmicshutdown) -- C:\Windows\SysNative\icsvc.dll (Microsoft Corporation)
SRV:64bit: - (vmicrdv) -- C:\Windows\SysNative\icsvc.dll (Microsoft Corporation)
SRV:64bit: - (vmickvpexchange) -- C:\Windows\SysNative\icsvc.dll (Microsoft Corporation)
SRV:64bit: - (vmicguestinterface) -- C:\Windows\SysNative\icsvc.dll (Microsoft Corporation)
SRV:64bit: - (WinDefend) -- C:\Program Files\Windows Defender\MsMpEng.exe (Microsoft Corporation)
SRV:64bit: - (PrintNotify) -- C:\Windows\SysNative\spool\drivers\x64\3\PrintConfig.dll (Microsoft Corporation)
SRV:64bit: - (BthHFSrv) -- C:\Windows\SysNative\BthHFSrv.dll (Microsoft Corporation)
SRV:64bit: - (DoSvc) -- C:\Windows\SysNative\dosvc.dll (Microsoft Corporation)
SRV:64bit: - (Killer Service V2) -- C:\Program Files\Killer Networking\Network Manager\KillerService.exe (Rivet Networks)
SRV:64bit: - (SamsungRapidSvc) -- C:\Windows\SysNative\RAPID\SamsungRapidSvc.exe (Samsung Electronics Co., Ltd.)
SRV:64bit: - (MySQL) -- C:\Program Files\MySQL\MySQL Server 5.6\bin\mysqld.exe ()
SRV - (AntiVirWebService) -- C:\Program Files (x86)\Avira\Antivirus\avwebg7.exe (Avira Operations GmbH & Co. KG)
SRV - (AntiVirSchedulerService) -- C:\Program Files (x86)\Avira\Antivirus\sched.exe (Avira Operations GmbH & Co. KG)
SRV - (AntiVirMailService) -- C:\Program Files (x86)\Avira\Antivirus\avmailc7.exe (Avira Operations GmbH & Co. KG)
SRV - (AntiVirService) -- C:\Program Files (x86)\Avira\Antivirus\avguard.exe (Avira Operations GmbH & Co. KG)
SRV - (Avira.ServiceHost) -- C:\Program Files (x86)\Avira\Launcher\Avira.ServiceHost.exe (Avira Operations GmbH & Co. KG)
SRV - (AdobeARMservice) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
SRV - (StateRepository) -- C:\Windows\SysWOW64\Windows.StateRepository.dll (Microsoft Corporation)
SRV - (UnistoreSvc) -- C:\Windows\SysWOW64\Unistore.dll (Microsoft Corporation)
SRV - (DmEnrollmentSvc) -- C:\Windows\SysWOW64\Windows.Internal.Management.dll (Microsoft Corporation)
SRV - (CoreMessagingRegistrar) -- C:\Windows\SysWOW64\CoreMessaging.dll (Microsoft Corporation)
SRV - (lfsvc) -- C:\Windows\SysWOW64\lfsvc.dll (Microsoft Corporation)
SRV - (smphost) -- C:\Windows\SysWOW64\smphost.dll (Microsoft Corporation)
SRV - (PrintNotify) -- C:\Windows\system32\spool\drivers\x64\3\PrintConfig.dll (Microsoft Corporation)
SRV - (TVService) -- C:\Program Files (x86)\Team MediaPortal\MediaPortal TV Server\TvService.exe (Team MediaPortal)
SRV - (MSI_SuperCharger) -- C:\Program Files (x86)\MSI\Super Charger\ChargeService.exe (MSI)
SRV - (SwitchBoard) -- C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe (Adobe Systems Incorporated)


========== Driver Services (SafeList) ==========

DRV:64bit: - (avipbb) -- C:\Windows\SysNative\drivers\avipbb.sys (Avira Operations GmbH & Co. KG)
DRV:64bit: - (avgntflt) -- C:\Windows\SysNative\drivers\avgntflt.sys (Avira Operations GmbH & Co. KG)
DRV:64bit: - (avnetflt) -- C:\Windows\SysNative\drivers\avnetflt.sys (Avira Operations GmbH & Co. KG)
DRV:64bit: - (avkmgr) -- C:\Windows\SysNative\drivers\avkmgr.sys (Avira Operations GmbH & Co. KG)
DRV:64bit: - (amdkmdap) -- C:\Windows\SysNative\drivers\atikmpag.sys (Advanced Micro Devices, Inc.)
DRV:64bit: - (amdkmdag) -- C:\Windows\SysNative\drivers\atikmdag.sys (Advanced Micro Devices, Inc.)
DRV:64bit: - (GpuEnergyDrv) -- C:\Windows\SysNative\drivers\gpuenergydrv.sys (Microsoft Corporation)
DRV:64bit: - (USBHUB3) -- C:\Windows\SysNative\drivers\USBHUB3.SYS (Microsoft Corporation)
DRV:64bit: - (ssudmdm) -- C:\Windows\SysNative\drivers\ssudmdm.sys (DEVGURU Co., LTD.(www.devguru.co.kr))
DRV:64bit: - (dg_ssudbus) -- C:\Windows\SysNative\drivers\ssudbus.sys (DEVGURU Co., LTD.(www.devguru.co.kr))
DRV:64bit: - (AtiHDAudioService) -- C:\Windows\SysNative\drivers\AtihdWT6.sys (Advanced Micro Devices)
DRV:64bit: - (pdc) -- C:\Windows\SysNative\drivers\pdc.sys (Microsoft Corporation)
DRV:64bit: - (sdbus) -- C:\Windows\SysNative\drivers\sdbus.sys (Microsoft Corporation)
DRV:64bit: - (buttonconverter) -- C:\Windows\SysNative\drivers\buttonconverter.sys (Microsoft Corporation)
DRV:64bit: - (USBXHCI) -- C:\Windows\SysNative\drivers\USBXHCI.SYS (Microsoft Corporation)
DRV:64bit: - (stornvme) -- C:\Windows\SysNative\drivers\stornvme.sys (Microsoft Corporation)
DRV:64bit: - (Wof) -- C:\Windows\SysNative\drivers\wof.sys (Microsoft Corporation)
DRV:64bit: - (wdiwifi) -- C:\Windows\SysNative\drivers\WdiWiFi.sys (Microsoft Corporation)
DRV:64bit: - (msgpiowin32) -- C:\Windows\SysNative\drivers\msgpiowin32.sys (Microsoft Corporation)
DRV:64bit: - (wpcfltr) -- C:\Windows\SysNative\drivers\wpcfltr.sys (Microsoft Corporation)
DRV:64bit: - (IT9135BDA) -- C:\Windows\SysNative\drivers\IT9135BDA.sys (ITE )
DRV:64bit: - (BthHFEnum) -- C:\Windows\SysNative\drivers\bthhfenum.sys (Microsoft Corporation)
DRV:64bit: - (amdkmafd) -- C:\Windows\SysNative\drivers\amdkmafd.sys (Advanced Micro Devices, Inc.)
DRV:64bit: - (usbser) -- C:\Windows\SysNative\drivers\usbser.sys (Microsoft Corporation)
DRV:64bit: - (ReFSv1) -- C:\Windows\SysNative\drivers\refsv1.sys (Microsoft Corporation)
DRV:64bit: - (dam) -- C:\Windows\SysNative\drivers\dam.sys (Microsoft Corporation)
DRV:64bit: - (UcmUcsi) -- C:\Windows\SysNative\drivers\UcmUcsi.sys (Microsoft Corporation)
DRV:64bit: - (terminpt) -- C:\Windows\SysNative\drivers\terminpt.sys (Microsoft Corporation)
DRV:64bit: - (RdpVideoMiniport) -- C:\Windows\SysNative\drivers\rdpvideominiport.sys (Microsoft Corporation)
DRV:64bit: - (WpdUpFltr) -- C:\Windows\SysNative\drivers\WpdUpFltr.sys (Microsoft Corporation)
DRV:64bit: - (CLFS) -- C:\Windows\SysNative\drivers\clfs.sys (Microsoft Corporation)
DRV:64bit: - (ahcache) -- C:\Windows\SysNative\drivers\ahcache.sys (Microsoft Corporation)
DRV:64bit: - (WindowsTrustedRT) -- C:\Windows\SysNative\drivers\WindowsTrustedRT.sys (Microsoft Corporation)
DRV:64bit: - (UcmCx0101) -- C:\Windows\SysNative\drivers\UcmCx.sys (Microsoft Corporation)
DRV:64bit: - (Fs_Rec) -- C:\Windows\SysNative\drivers\fs_rec.sys (Microsoft Corporation)
DRV:64bit: - (VerifierExt) -- C:\Windows\SysNative\drivers\VerifierExt.sys (Microsoft Corporation)
DRV:64bit: - (WFPLWFS) -- C:\Windows\SysNative\drivers\wfplwfs.sys (Microsoft Corporation)
DRV:64bit: - (storqosflt) -- C:\Windows\SysNative\drivers\storqosflt.sys (Microsoft Corporation)
DRV:64bit: - (condrv) -- C:\Windows\SysNative\drivers\condrv.sys (Microsoft Corporation)
DRV:64bit: - (IoQos) -- C:\Windows\SysNative\drivers\ioqos.sys (Microsoft Corporation)
DRV:64bit: - (MMCSS) -- C:\Windows\SysNative\drivers\mmcss.sys (Microsoft Corporation)
DRV:64bit: - (Ufx01000) -- C:\Windows\SysNative\drivers\ufx01000.sys (Microsoft Corporation)
DRV:64bit: - (GPIOClx0101) -- C:\Windows\SysNative\drivers\msgpioclx.sys (Microsoft Corporation)
DRV:64bit: - (SpbCx) -- C:\Windows\SysNative\drivers\SpbCx.sys (Microsoft Corporation)
DRV:64bit: - (SerCx) -- C:\Windows\SysNative\drivers\SerCx.sys (Microsoft Corporation)
DRV:64bit: - (UrsCx01000) -- C:\Windows\SysNative\drivers\urscx01000.sys (Microsoft Corporation)
DRV:64bit: - (cnghwassist) -- C:\Windows\SysNative\drivers\cnghwassist.sys (Microsoft Corporation)
DRV:64bit: - (SerCx2) -- C:\Windows\SysNative\drivers\SerCx2.sys (Microsoft Corporation)
DRV:64bit: - (EhStorClass) -- C:\Windows\SysNative\drivers\EhStorClass.sys (Microsoft Corporation)
DRV:64bit: - (mshidumdf) -- C:\Windows\SysNative\drivers\mshidumdf.sys (Microsoft Corporation)
DRV:64bit: - (NdisImPlatform) -- C:\Windows\SysNative\drivers\NdisImPlatform.sys (Microsoft Corporation)
DRV:64bit: - (Ndu) -- C:\Windows\SysNative\drivers\Ndu.sys (Microsoft Corporation)
DRV:64bit: - (NdisVirtualBus) -- C:\Windows\SysNative\drivers\NdisVirtualBus.sys (Microsoft Corporation)
DRV:64bit: - (WdNisDrv) -- C:\Windows\SysNative\drivers\WdNisDrv.sys (Microsoft Corporation)
DRV:64bit: - (MsLldp) -- C:\Windows\SysNative\drivers\mslldp.sys (Microsoft Corporation)
DRV:64bit: - (WdFilter) -- C:\Windows\SysNative\drivers\WdFilter.sys (Microsoft Corporation)
DRV:64bit: - (Ucx01000) -- C:\Windows\SysNative\drivers\Ucx01000.sys (Microsoft Corporation)
DRV:64bit: - (acpiex) -- C:\Windows\SysNative\drivers\acpiex.sys (Microsoft Corporation)
DRV:64bit: - (FileCrypt) -- C:\Windows\SysNative\drivers\filecrypt.sys (Microsoft Corporation)
DRV:64bit: - (TsUsbFlt) -- C:\Windows\SysNative\drivers\TsUsbFlt.sys (Microsoft Corporation)
DRV:64bit: - (WdBoot) -- C:\Windows\SysNative\drivers\WdBoot.sys (Microsoft Corporation)
DRV:64bit: - (UdeCx) -- C:\Windows\SysNative\drivers\Udecx.sys ()
DRV:64bit: - (vhf) -- C:\Windows\SysNative\drivers\vhf.sys (Microsoft Corporation)
DRV:64bit: - (TsUsbGD) -- C:\Windows\SysNative\drivers\TsUsbGD.sys (Microsoft Corporation)
DRV:64bit: - (UrsChipidea) -- C:\Windows\SysNative\drivers\urschipidea.sys (Microsoft Corporation)
DRV:64bit: - (UrsSynopsys) -- C:\Windows\SysNative\drivers\urssynopsys.sys (Microsoft Corporation)
DRV:64bit: - (npsvctrig) -- C:\Windows\SysNative\drivers\npsvctrig.sys (Microsoft Corporation)
DRV:64bit: - (WindowsTrustedRTProxy) -- C:\Windows\SysNative\drivers\WindowsTrustedRTProxy.sys (Microsoft Corporation)
DRV:64bit: - (mlx4_bus) -- C:\Windows\SysNative\drivers\mlx4_bus.sys (Mellanox)
DRV:64bit: - (spaceport) -- C:\Windows\SysNative\drivers\spaceport.sys (Microsoft Corporation)
DRV:64bit: - (ibbus) -- C:\Windows\SysNative\drivers\ibbus.sys (Mellanox)
DRV:64bit: - (VSTXRAID) -- C:\Windows\SysNative\drivers\VSTXRAID.SYS (VIA Corporation)
DRV:64bit: - (storahci) -- C:\Windows\SysNative\drivers\storahci.sys (Microsoft Corporation)
DRV:64bit: - (ufxsynopsys) -- C:\Windows\SysNative\drivers\ufxsynopsys.sys (Microsoft Corporation)
DRV:64bit: - (UfxChipidea) -- C:\Windows\SysNative\drivers\UfxChipidea.sys (Microsoft Corporation)
DRV:64bit: - (UASPStor) -- C:\Windows\SysNative\drivers\uaspstor.sys (Microsoft Corporation)
DRV:64bit: - (ndfltr) -- C:\Windows\SysNative\drivers\ndfltr.sys (Mellanox)
DRV:64bit: - (mvumis) -- C:\Windows\SysNative\drivers\mvumis.sys (Marvell Semiconductor, Inc.)
DRV:64bit: - (WinVerbs) -- C:\Windows\SysNative\drivers\winverbs.sys (Mellanox)
DRV:64bit: - (percsas3i) -- C:\Windows\SysNative\drivers\percsas3i.sys (Avago Technologies)
DRV:64bit: - (percsas2i) -- C:\Windows\SysNative\drivers\percsas2i.sys (LSI Corporation)
DRV:64bit: - (BasicDisplay) -- C:\Windows\SysNative\drivers\BasicDisplay.sys (Microsoft Corporation)
DRV:64bit: - (BasicRender) -- C:\Windows\SysNative\drivers\BasicRender.sys (Microsoft Corporation)
DRV:64bit: - (storufs) -- C:\Windows\SysNative\drivers\storufs.sys (Microsoft Corporation)
DRV:64bit: - (stexstor) -- C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology, Inc.)
DRV:64bit: - (UEFI) -- C:\Windows\SysNative\drivers\uefi.sys (Microsoft Corporation)
DRV:64bit: - (WinMad) -- C:\Windows\SysNative\drivers\winmad.sys (Mellanox)
DRV:64bit: - (swenum) -- C:\Windows\SysNative\DriverStore\FileRepository\swenum.inf_amd64_2a699e44676b7781\swenum.sys (Microsoft Corporation)
DRV:64bit: - (ebdrv) -- C:\Windows\SysNative\drivers\evbda.sys (QLogic Corporation)
DRV:64bit: - (ADP80XX) -- C:\Windows\SysNative\drivers\adp80xx.sys (PMC-Sierra)
DRV:64bit: - (iaStorAV) -- C:\Windows\SysNative\drivers\iaStorAV.sys (Intel Corporation)
DRV:64bit: - (b06bdrv) -- C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation)
DRV:64bit: - (amdsbs) -- C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.)
DRV:64bit: - (xboxgip) -- C:\Windows\SysNative\drivers\xboxgip.sys (Microsoft Corporation)
DRV:64bit: - (TPM) -- C:\Windows\SysNative\drivers\tpm.sys (Microsoft Corporation)
DRV:64bit: - (CapImg) -- C:\Windows\SysNative\drivers\capimg.sys (Microsoft Corporation)
DRV:64bit: - (3ware) -- C:\Windows\SysNative\drivers\3ware.sys (LSI)
DRV:64bit: - (LSI_SAS2i) -- C:\Windows\SysNative\drivers\lsi_sas2i.sys (LSI Corporation)
DRV:64bit: - (LSI_SAS3i) -- C:\Windows\SysNative\drivers\lsi_sas3i.sys (Avago Technologies)
DRV:64bit: - (amdsata) -- C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices)
DRV:64bit: - (LSI_SSS) -- C:\Windows\SysNative\drivers\lsi_sss.sys (LSI Corporation)
DRV:64bit: - (HpSAMD) -- C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company)
DRV:64bit: - (hidinterrupt) -- C:\Windows\SysNative\drivers\hidinterrupt.sys (Microsoft Corporation)
DRV:64bit: - (amdxata) -- C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices)
DRV:64bit: - (xinputhid) -- C:\Windows\SysNative\drivers\xinputhid.sys (Microsoft Corporation)
DRV:64bit: - (kdnic) -- C:\Windows\SysNative\drivers\kdnic.sys (Microsoft Corporation)
DRV:64bit: - (genericusbfn) -- C:\Windows\SysNative\drivers\genericusbfn.sys (Microsoft Corporation)
DRV:64bit: - (bcmfn2) -- C:\Windows\SysNative\drivers\bcmfn2.sys (Windows (R) Win 7 DDK provider)
DRV:64bit: - (acpitime) -- C:\Windows\SysNative\drivers\acpitime.sys (Microsoft Corporation)
DRV:64bit: - (acpipagr) -- C:\Windows\SysNative\drivers\acpipagr.sys (Microsoft Corporation)
DRV:64bit: - (iaLPSSi_I2C) -- C:\Windows\SysNative\drivers\iaLPSSi_I2C.sys (Intel Corporation)
DRV:64bit: - (EhStorTcgDrv) -- C:\Windows\SysNative\drivers\EhStorTcgDrv.sys (Microsoft Corporation)
DRV:64bit: - (netvsc) -- C:\Windows\SysNative\drivers\netvsc.sys (Microsoft Corporation)
DRV:64bit: - (sdstor) -- C:\Windows\SysNative\drivers\sdstor.sys (Microsoft Corporation)
DRV:64bit: - (vpci) -- C:\Windows\SysNative\drivers\vpci.sys (Microsoft Corporation)
DRV:64bit: - (Synth3dVsc) -- C:\Windows\SysNative\drivers\Synth3dVsc.sys (Microsoft Corporation)
DRV:64bit: - (hidi2c) -- C:\Windows\SysNative\drivers\hidi2c.sys (Microsoft Corporation)
DRV:64bit: - (intelpep) -- C:\Windows\SysNative\drivers\intelpep.sys (Microsoft Corporation)
DRV:64bit: - (BthAvrcpTg) -- C:\Windows\SysNative\drivers\BthAvrcpTg.sys (Microsoft Corporation)
DRV:64bit: - (CompositeBus) -- C:\Windows\SysNative\DriverStore\FileRepository\compositebus.inf_amd64_98334ba6e76853ba\CompositeBus.sys (Microsoft Corporation)
DRV:64bit: - (iaLPSSi_GPIO) -- C:\Windows\SysNative\drivers\iaLPSSi_GPIO.sys (Intel Corporation)
DRV:64bit: - (dmvsc) -- C:\Windows\SysNative\drivers\dmvsc.sys (Microsoft Corporation)
DRV:64bit: - (fcvsc) -- C:\Windows\SysNative\drivers\fcvsc.sys (Microsoft Corporation)
DRV:64bit: - (bthhfhid) -- C:\Windows\SysNative\drivers\BthhfHid.sys (Microsoft Corporation)
DRV:64bit: - (HyperVideo) -- C:\Windows\SysNative\drivers\HyperVideo.sys (Microsoft Corporation)
DRV:64bit: - (hyperkbd) -- C:\Windows\SysNative\drivers\hyperkbd.sys (Microsoft Corporation)
DRV:64bit: - (gencounter) -- C:\Windows\SysNative\drivers\vmgencounter.sys (Microsoft Corporation)
DRV:64bit: - (BfLwf) -- C:\Windows\SysNative\drivers\bwcW10x64.sys (Rivet Networks, LLC.)
DRV:64bit: - (KillerEth) -- C:\Windows\SysNative\drivers\e22w10x64.sys (Qualcomm Atheros, Inc.)
DRV:64bit: - (SamsungRapidFSFltr) -- C:\Windows\SysNative\drivers\SamsungRapidFSFltr.sys (Samsung Electronics Co., Ltd.)
DRV:64bit: - (SamsungRapidDiskFltr) -- C:\Windows\SysNative\drivers\SamsungRapidDiskFltr.sys (Samsung Electronics Co., Ltd.)
DRV:64bit: - (pwdrvio) -- C:\Windows\SysNative\pwdrvio.sys ()
DRV:64bit: - (pwdspio) -- C:\Windows\SysNative\pwdspio.sys ()
DRV:64bit: - (MBfilt) -- C:\Windows\SysNative\drivers\MBfilt64.sys (Creative Technology Ltd.)
DRV - (swenum) -- C:\Windows\System32\DriverStore\FileRepository\swenum.inf_amd64_2a699e44676b7781\swenum.sys (Microsoft Corporation)
DRV - (CompositeBus) -- C:\Windows\System32\DriverStore\FileRepository\compositebus.inf_amd64_98334ba6e76853ba\CompositeBus.sys (Microsoft Corporation)
DRV - (NTIOLib_1_0_3) -- C:\Program Files (x86)\MSI\Super Charger\NTIOLib_X64.sys (MSI)


========== Standard Registry (All) ==========


========== Internet Explorer ==========

IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\System32\blank.htm
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE:64bit: - HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %11%\blank.htm
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
IE - HKCU\..\URLSearchHook: {CFBFAE00-17A6-11D0-99CB-00C04FD64497} - C:\Windows\SysWOW64\ieframe.dll (Microsoft Corporation)
IE - HKCU\..\SearchScopes,DefaultScope = {012E1000-F331-11DB-8314-0800200C9A66}
IE - HKCU\..\SearchScopes\{012E1000-F331-11DB-8314-0800200C9A66}: "URL" = http://www.google.com/search?q={searchTerms}
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0


========== FireFox ==========

FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~1\MICROS~1\Office15\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/Lync,version=15.0: C:\Program Files (x86)\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\MICROS~1\Office15\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)


[2015.07.30 07:02:54 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Tonda\AppData\Roaming\Mozilla\Firefox\extensions
[2015.07.30 07:02:54 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Tonda\AppData\Roaming\Mozilla\Firefox\extensions\staged
[2016.02.18 16:54:43 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Tonda\AppData\Roaming\Mozilla\Firefox\Profiles\BIfP54uG.default\extensions
[2016.02.18 17:33:21 | 000,875,387 | ---- | M] () (No name found) -- C:\Users\Tonda\AppData\Roaming\Mozilla\Firefox\Profiles\BIfP54uG.default\extensions\abs@avira.com.xpi
[2015.02.10 13:12:50 | 000,034,072 | ---- | M] (Microsoft Corporation) -- C:\Program Files (x86)\mozilla firefox\plugins\npMeetingJoinPluginOC.dll

Tondys01
nováček
Příspěvky: 22
Registrován: únor 16
Pohlaví: Nespecifikováno
Stav:
Offline

Re: Prosím o kontrolu logu

Příspěvekod Tondys01 » 20 úno 2016 23:41

O1 HOSTS File: ([2016.02.17 18:33:14 | 000,000,753 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2:64bit: - BHO: (Lync Browser Helper) - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation)
O2 - BHO: (Lync Browser Helper) - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files (x86)\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation)
O4:64bit: - HKLM..\Run: [RTHDVCPL] C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe (Realtek Semiconductor)
O4:64bit: - HKLM..\Run: [SamsungRapidApp] C:\Program Files (x86)\Samsung\RAPID\CacheFilter\SamsungRapidApp.exe (Samsung Electronics Co., Ltd.)
O4:64bit: - HKLM..\Run: [StartCN] C:\Program Files\AMD\CNext\CNext\cnext.exe (Advanced Micro Devices, Inc.)
O4 - HKLM..\Run: [AdobeCS6ServiceManager] C:\Program Files (x86)\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\Antivirus\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [Avira SystrayStartTrigger] C:\Program Files (x86)\Avira\Launcher\Avira.SystrayStartTrigger.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [Raptr] C:\Program Files (x86)\Raptr\raptrstub.exe (Raptr, Inc)
O4 - HKLM..\Run: [Super Charger] C:\Program Files (x86)\MSI\Super Charger\Super Charger.exe (MSI)
O4 - HKLM..\Run: [SwitchBoard] C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe (Adobe Systems Incorporated)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: ForceActiveDesktopOn = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoRecentDocsHistory = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DSCAutomationHostEnabled = 2
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableCursorSuppression = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableInstallerDetection = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableSecureUIAPaths = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableUIADesktopToggle = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableVirtualization = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ValidateAdminCodeSignatures = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: dontdisplaylastusername = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticecaption =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticetext =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: scforceoption = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: shutdownwithoutlogon = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: undockwithoutlogon = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: FilterAdministratorToken = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: SoftwareSASGeneration = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_BITMAP = 2
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_DIB = 8
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_DIBV5 = 17
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_OEMTEXT = 7
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_PALETTE = 9
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_TEXT = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_UNICODETEXT = 13
O8:64bit: - Extra context menu item: E&xportovat do Microsoft Excelu - C:\Program Files\Microsoft Office\Office15\EXCEL.EXE (Microsoft Corporation)
O8 - Extra context menu item: E&xportovat do Microsoft Excelu - C:\Program Files\Microsoft Office\Office15\EXCEL.EXE (Microsoft Corporation)
O9:64bit: - Extra Button: Volání kliknutím v Lyncu - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation)
O9:64bit: - Extra 'Tools' menuitem : Volání kliknutím v Lyncu - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation)
O9 - Extra Button: Volání kliknutím v Lyncu - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files (x86)\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Volání kliknutím v Lyncu - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files (x86)\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000001 [] - C:\Windows\SysNative\NapiNSP.dll (Microsoft Corporation)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000002 [] - C:\Windows\SysNative\pnrpnsp.dll (Microsoft Corporation)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000003 [] - C:\Windows\SysNative\pnrpnsp.dll (Microsoft Corporation)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000004 [] - C:\Windows\SysNative\nlaapi.dll (Microsoft Corporation)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000005 [] - C:\Windows\SysNative\mswsock.dll (Microsoft Corporation)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000006 [] - C:\Windows\SysNative\winrnr.dll (Microsoft Corporation)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000001 - C:\Windows\SysNative\mswsock.dll (Microsoft Corporation)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000002 - C:\Windows\SysNative\mswsock.dll (Microsoft Corporation)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000003 - C:\Windows\SysNative\mswsock.dll (Microsoft Corporation)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000004 - C:\Windows\SysNative\mswsock.dll (Microsoft Corporation)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000005 - C:\Windows\SysNative\mswsock.dll (Microsoft Corporation)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000006 - C:\Windows\SysNative\mswsock.dll (Microsoft Corporation)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000007 - C:\Windows\SysNative\mswsock.dll (Microsoft Corporation)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000008 - C:\Windows\SysNative\mswsock.dll (Microsoft Corporation)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000009 - C:\Windows\SysNative\mswsock.dll (Microsoft Corporation)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000010 - C:\Windows\SysNative\mswsock.dll (Microsoft Corporation)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000011 - C:\Windows\SysNative\mswsock.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000001 [] - C:\Windows\SysWOW64\NapiNSP.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000002 [] - C:\Windows\SysWOW64\pnrpnsp.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000003 [] - C:\Windows\SysWOW64\pnrpnsp.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Windows\SysWOW64\nlaapi.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000005 [] - C:\Windows\SysWOW64\mswsock.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000006 [] - C:\Windows\SysWOW64\winrnr.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Windows\SysWOW64\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Windows\SysWOW64\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\Windows\SysWOW64\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\Windows\SysWOW64\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - C:\Windows\SysWOW64\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - C:\Windows\SysWOW64\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000007 - C:\Windows\SysWOW64\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000008 - C:\Windows\SysWOW64\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000009 - C:\Windows\SysWOW64\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000010 - C:\Windows\SysWOW64\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000011 - C:\Windows\SysWOW64\mswsock.dll (Microsoft Corporation)
O13 - gopher Prefix: missing
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 10.0.0.138
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{643bf372-00a3-46ea-9922-4ebd335a13ad}: DhcpNameServer = 10.0.0.138
O18:64bit: - Protocol\Handler\about {3050F406-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\SysNative\mshtml.dll (Microsoft Corporation)
O18:64bit: - Protocol\Handler\cdl {3dd53d40-7b8b-11D0-b013-00aa0059ce02} - C:\Windows\SysNative\urlmon.dll (Microsoft Corporation)
O18:64bit: - Protocol\Handler\dvd {12D51199-0DB5-46FE-A120-47A3D7D937CC} - C:\Windows\SysNative\MSVidCtl.dll (Microsoft Corporation)
O18:64bit: - Protocol\Handler\file {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\SysNative\urlmon.dll (Microsoft Corporation)
O18:64bit: - Protocol\Handler\ftp {79eac9e3-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\SysNative\urlmon.dll (Microsoft Corporation)
O18:64bit: - Protocol\Handler\http {79eac9e2-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\SysNative\urlmon.dll (Microsoft Corporation)
O18:64bit: - Protocol\Handler\https {79eac9e5-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\SysNative\urlmon.dll (Microsoft Corporation)
O18:64bit: - Protocol\Handler\its {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\Windows\SysNative\itss.dll (Microsoft Corporation)
O18:64bit: - Protocol\Handler\javascript {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\SysNative\mshtml.dll (Microsoft Corporation)
O18:64bit: - Protocol\Handler\local {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\SysNative\urlmon.dll (Microsoft Corporation)
O18:64bit: - Protocol\Handler\mailto {3050f3DA-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\SysNative\mshtml.dll (Microsoft Corporation)
O18:64bit: - Protocol\Handler\mhtml {05300401-BCBC-11d0-85E3-00C04FD85AB4} - C:\Windows\SysNative\inetcomm.dll (Microsoft Corporation)
O18:64bit: - Protocol\Handler\mk {79eac9e6-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\SysNative\urlmon.dll (Microsoft Corporation)
O18:64bit: - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation)
O18:64bit: - Protocol\Handler\ms-its {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\Windows\SysNative\itss.dll (Microsoft Corporation)
O18:64bit: - Protocol\Handler\osf {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office\Office15\MSOSB.DLL (Microsoft Corporation)
O18:64bit: - Protocol\Handler\res {3050F3BC-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\SysNative\mshtml.dll (Microsoft Corporation)
O18:64bit: - Protocol\Handler\tbauth {14654CA6-5711-491D-B89A-58E571679951} - C:\Windows\SysNative\tbauth.dll (Microsoft Corporation)
O18:64bit: - Protocol\Handler\tv {CBD30858-AF45-11D2-B6D6-00C04FBBDE6E} - C:\Windows\SysNative\MSVidCtl.dll (Microsoft Corporation)
O18:64bit: - Protocol\Handler\vbscript {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\SysNative\mshtml.dll (Microsoft Corporation)
O18 - Protocol\Handler\about {3050F406-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\SysWOW64\mshtml.dll (Microsoft Corporation)
O18 - Protocol\Handler\cdl {3dd53d40-7b8b-11D0-b013-00aa0059ce02} - C:\Windows\SysWOW64\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\dvd {12D51199-0DB5-46FE-A120-47A3D7D937CC} - C:\Windows\SysWOW64\MSVidCtl.dll (Microsoft Corporation)
O18 - Protocol\Handler\file {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\SysWOW64\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\ftp {79eac9e3-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\SysWOW64\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\http {79eac9e2-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\SysWOW64\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\https {79eac9e5-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\SysWOW64\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\its {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\Windows\SysWOW64\itss.dll (Microsoft Corporation)
O18 - Protocol\Handler\javascript {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\SysWOW64\mshtml.dll (Microsoft Corporation)
O18 - Protocol\Handler\local {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\SysWOW64\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\mailto {3050f3DA-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\SysWOW64\mshtml.dll (Microsoft Corporation)
O18 - Protocol\Handler\mhtml {05300401-BCBC-11d0-85E3-00C04FD85AB4} - C:\Windows\SysWOW64\inetcomm.dll (Microsoft Corporation)
O18 - Protocol\Handler\mk {79eac9e6-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\SysWOW64\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\ms-help - No CLSID value found
O18 - Protocol\Handler\ms-its {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\Windows\SysWOW64\itss.dll (Microsoft Corporation)
O18 - Protocol\Handler\osf {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files (x86)\Microsoft Office\Office15\MSOSB.DLL (Microsoft Corporation)
O18 - Protocol\Handler\res {3050F3BC-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\SysWOW64\mshtml.dll (Microsoft Corporation)
O18 - Protocol\Handler\tbauth {14654CA6-5711-491D-B89A-58E571679951} - C:\Windows\SysWOW64\tbauth.dll (Microsoft Corporation)
O18 - Protocol\Handler\tv {CBD30858-AF45-11D2-B6D6-00C04FBBDE6E} - C:\Windows\SysWOW64\MSVidCtl.dll (Microsoft Corporation)
O18 - Protocol\Handler\vbscript {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\SysWOW64\mshtml.dll (Microsoft Corporation)
O18:64bit: - Protocol\Filter\application/octet-stream {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\Windows\SysNative\mscoree.dll (Microsoft Corporation)
O18:64bit: - Protocol\Filter\application/x-complus {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\Windows\SysNative\mscoree.dll (Microsoft Corporation)
O18:64bit: - Protocol\Filter\application/x-msdownload {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\Windows\SysNative\mscoree.dll (Microsoft Corporation)
O18:64bit: - Protocol\Filter\text/xml {807583E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\microsoft shared\OFFICE15\MSOXMLMF.DLL (Microsoft Corporation)
O18 - Protocol\Filter\application/octet-stream {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\Windows\SysWOW64\mscoree.dll (Microsoft Corporation)
O18 - Protocol\Filter\application/x-complus {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\Windows\SysWOW64\mscoree.dll (Microsoft Corporation)
O18 - Protocol\Filter\application/x-msdownload {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\Windows\SysWOW64\mscoree.dll (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807583E5-5146-11D5-A672-00B0D022E945} - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE15\MSOXMLMF.DLL (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\System32\Userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\System32\Userinit.exe) - C:\Windows\SysWOW64\userinit.exe (Microsoft Corporation)
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O29:64bit: - HKLM SecurityProviders - (credssp.dll) - C:\Windows\SysWow64\credssp.dll (Microsoft Corporation)
O29 - HKLM SecurityProviders - (credssp.dll) - C:\Windows\SysWow64\credssp.dll (Microsoft Corporation)
O30:64bit: - LSA: Authentication Packages - (msv1_0) - C:\Windows\SysNative\msv1_0.dll (Microsoft Corporation)
O30 - LSA: Authentication Packages - (msv1_0) - C:\Windows\SysWow64\msv1_0.dll (Microsoft Corporation)
O31 - SafeBoot: AlternateShell - cmd.exe
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2015.10.12 13:45:07 | 000,000,000 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

========== Files/Folders - Created Within 30 Days ==========

[2016.02.20 23:30:38 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\Tonda\Desktop\OTL.exe
[2016.02.20 11:26:59 | 000,000,000 | ---D | C] -- C:\MSI
[2016.02.18 17:34:00 | 000,000,000 | -HSD | C] -- C:\Config.Msi
[2016.02.18 17:07:31 | 000,000,000 | --SD | C] -- C:\Windows\SysWow64\Microsoft
[2016.02.18 16:54:52 | 000,000,000 | ---D | C] -- C:\Users\Tonda\AppData\Roaming\Avira
[2016.02.18 16:54:03 | 000,073,032 | ---- | C] (Avira Operations GmbH & Co. KG) -- C:\Windows\SysNative\drivers\avnetflt.sys
[2016.02.18 16:54:02 | 000,146,704 | ---- | C] (Avira Operations GmbH & Co. KG) -- C:\Windows\SysNative\drivers\avipbb.sys
[2016.02.18 16:54:02 | 000,135,880 | ---- | C] (Avira Operations GmbH & Co. KG) -- C:\Windows\SysNative\drivers\avgntflt.sys
[2016.02.18 16:54:02 | 000,035,488 | ---- | C] (Avira Operations GmbH & Co. KG) -- C:\Windows\SysNative\drivers\avkmgr.sys
[2016.02.18 16:49:54 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
[2016.02.18 16:49:52 | 000,000,000 | ---D | C] -- C:\ProgramData\Avira
[2016.02.18 16:49:52 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Avira
[2016.02.18 16:49:48 | 000,000,000 | ---D | C] -- C:\ProgramData\Package Cache
[2016.02.18 11:44:50 | 002,371,072 | ---- | C] (Farbar) -- C:\Users\Tonda\Desktop\FRST64.exe
[2016.02.17 23:51:32 | 000,000,000 | ---D | C] -- C:\FRST
[2016.02.17 18:44:49 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN
[2016.02.17 18:44:05 | 000,000,000 | ---D | C] -- C:\Windows\Temp
[2016.02.17 18:44:05 | 000,000,000 | ---D | C] -- C:\Users\Tonda\AppData\Local\Temp
[2016.02.15 20:07:38 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2016.02.14 21:10:40 | 000,000,000 | ---D | C] -- C:\ProgramData\Spybot - Search & Destroy
[2016.02.14 19:55:53 | 000,000,000 | ---D | C] -- C:\Users\Tonda\AppData\Local\Google
[2016.02.10 10:55:00 | 001,811,360 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\combase.dll
[2016.02.10 10:54:59 | 021,873,152 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\edgehtml.dll
[2016.02.10 10:54:59 | 002,601,160 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\combase.dll
[2016.02.10 10:54:58 | 006,787,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\Windows.Data.Pdf.dll
[2016.02.10 10:54:58 | 005,156,352 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\Windows.Data.Pdf.dll
[2016.02.10 10:54:57 | 011,557,888 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\twinui.dll
[2016.02.10 10:54:57 | 003,793,408 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\rdpcorets.dll
[2016.02.10 10:54:57 | 000,109,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\hlink.dll
[2016.02.10 10:54:56 | 009,889,280 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\twinui.dll
[2016.02.10 10:54:56 | 001,951,872 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\KernelBase.dll
[2016.02.10 10:54:55 | 001,420,392 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msctf.dll
[2016.02.10 10:54:54 | 004,791,808 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript9.dll
[2016.02.10 10:54:54 | 001,248,896 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\WinTypes.dll
[2016.02.10 10:54:53 | 007,525,376 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\Chakra.dll
[2016.02.10 10:54:53 | 000,809,336 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\WinTypes.dll
[2016.02.10 10:54:52 | 000,162,304 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\msorcl32.dll
[2016.02.10 10:54:51 | 018,802,176 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\edgehtml.dll
[2016.02.10 10:54:51 | 003,588,096 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\win32kfull.sys
[2016.02.10 10:54:50 | 005,457,408 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\Chakra.dll
[2016.02.10 10:54:50 | 001,824,880 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ntdll.dll
[2016.02.10 10:54:50 | 000,237,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\NetworkDesktopSettings.dll
[2016.02.10 10:54:49 | 000,784,384 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wuapi.dll
[2016.02.10 10:54:49 | 000,678,400 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\wuapi.dll
[2016.02.10 10:54:49 | 000,147,456 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mtxoci.dll
[2016.02.10 10:54:49 | 000,141,312 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\rasman.dll
[2016.02.10 10:54:49 | 000,118,272 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mtxoci.dll
[2016.02.10 10:54:48 | 000,366,592 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wuuhext.dll
[2016.02.10 10:54:48 | 000,291,840 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\microsoft-windows-system-events.dll
[2016.02.10 10:54:48 | 000,079,360 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\rdpudd.dll
[2016.02.10 10:54:48 | 000,057,856 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\IoTAssignedAccessLockFramework.dll
[2016.02.10 10:54:47 | 000,046,592 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\IoTAssignedAccessLockFramework.dll
[2016.02.10 10:54:47 | 000,034,816 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ztrace_maps.dll
[2016.02.10 10:54:47 | 000,033,280 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wups2.dll
[2016.02.10 10:54:47 | 000,029,696 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ztrace_maps.dll
[2016.02.10 10:54:46 | 000,771,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\Chakradiag.dll
[2016.02.10 10:54:46 | 000,574,464 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\Chakradiag.dll
[2016.02.10 10:54:46 | 000,088,064 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ngckeyenum.dll
[2016.02.10 10:54:46 | 000,047,616 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wups.dll
[2016.02.09 16:31:07 | 000,000,000 | ---D | C] -- C:\Users\Tonda\AppData\Roaming\uplay
[2016.02.04 15:29:36 | 000,000,000 | ---D | C] -- C:\Users\Tonda\AppData\Roaming\iDealshare VideoGo 6

========== Files - Modified Within 30 Days ==========

[2016.02.20 23:30:31 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Tonda\Desktop\OTL.exe
[2016.02.20 22:45:28 | 000,016,148 | ---- | M] () -- C:\Windows\SysNative\TONDA_Tonda_HistoryPrediction.bin
[2016.02.20 11:33:41 | 002,075,596 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2016.02.20 11:33:41 | 000,973,612 | ---- | M] () -- C:\Windows\SysNative\perfh005.dat
[2016.02.20 11:33:41 | 000,731,134 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2016.02.20 11:33:41 | 000,230,318 | ---- | M] () -- C:\Windows\SysNative\perfc005.dat
[2016.02.20 11:33:41 | 000,137,964 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2016.02.20 11:26:44 | 016,777,216 | -HS- | M] () -- C:\swapfile.sys
[2016.02.19 12:21:12 | 000,004,608 | ---- | M] () -- C:\Windows\SECOH-QAD.exe
[2016.02.18 17:21:31 | 000,007,605 | ---- | M] () -- C:\Users\Tonda\AppData\Local\Resmon.ResmonCfg
[2016.02.18 16:54:22 | 000,146,704 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Windows\SysNative\drivers\avipbb.sys
[2016.02.18 16:54:22 | 000,135,880 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Windows\SysNative\drivers\avgntflt.sys
[2016.02.18 16:54:22 | 000,073,032 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Windows\SysNative\drivers\avnetflt.sys
[2016.02.18 16:54:22 | 000,035,488 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Windows\SysNative\drivers\avkmgr.sys
[2016.02.17 23:50:25 | 002,371,072 | ---- | M] (Farbar) -- C:\Users\Tonda\Desktop\FRST64.exe
[2016.02.17 23:47:02 | 000,000,085 | ---- | M] () -- C:\Windows\wininit.ini
[2016.02.17 18:44:45 | 000,000,008 | RHS- | M] () -- C:\ProgramData\ntuser.pol
[2016.02.17 18:33:14 | 000,000,753 | ---- | M] () -- C:\Windows\SysNative\drivers\etc\hosts
[2016.02.17 18:30:59 | 000,024,064 | ---- | M] () -- C:\Windows\zoek-delete.exe
[2016.02.17 17:24:29 | 000,028,272 | ---- | M] () -- C:\Windows\SysNative\drivers\TrueSight.sys
[2016.02.16 09:47:36 | 000,001,480 | ---- | M] () -- C:\Users\Tonda\AppData\Local\Adobe Uložit pro web 13.0 Prefs
[2016.02.14 20:05:54 | 000,084,350 | ---- | M] () -- C:\Users\Tonda\OneDrive\Dokumenty\cc_20151125_101022.reg
[2016.02.02 23:47:29 | 000,828,920 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerApp.exe
[2016.02.02 23:47:29 | 000,176,632 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
[2016.02.02 11:50:13 | 000,000,001 | ---- | M] () -- C:\Windows\SysWow64\en.html
[2016.01.31 07:25:57 | 001,248,896 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\WinTypes.dll
[2016.01.31 07:25:52 | 001,951,872 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\KernelBase.dll
[2016.01.31 07:24:08 | 001,824,880 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\ntdll.dll
[2016.01.31 07:23:57 | 002,601,160 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\combase.dll
[2016.01.31 07:23:50 | 001,420,392 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\msctf.dll
[2016.01.31 07:06:45 | 000,809,336 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\WinTypes.dll
[2016.01.31 07:04:27 | 001,811,360 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\combase.dll
[2016.01.31 06:38:07 | 021,873,152 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\edgehtml.dll
[2016.01.31 06:34:34 | 000,088,064 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\ngckeyenum.dll
[2016.01.31 06:33:38 | 000,057,856 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\IoTAssignedAccessLockFramework.dll
[2016.01.31 06:29:56 | 000,141,312 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\rasman.dll
[2016.01.31 06:29:36 | 011,557,888 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\twinui.dll
[2016.01.31 06:26:49 | 003,793,408 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\rdpcorets.dll
[2016.01.31 06:26:38 | 006,787,072 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\Windows.Data.Pdf.dll
[2016.01.31 06:25:13 | 000,366,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\wuuhext.dll
[2016.01.31 06:24:58 | 000,784,384 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\wuapi.dll
[2016.01.31 06:24:16 | 000,047,616 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\wups.dll
[2016.01.31 06:24:16 | 000,033,280 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\wups2.dll
[2016.01.31 06:23:37 | 000,079,360 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\rdpudd.dll
[2016.01.31 06:19:51 | 000,237,056 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\NetworkDesktopSettings.dll
[2016.01.31 06:19:47 | 000,046,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\IoTAssignedAccessLockFramework.dll
[2016.01.31 06:18:41 | 000,771,072 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\Chakradiag.dll
[2016.01.31 06:18:35 | 000,147,456 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\mtxoci.dll
[2016.01.31 06:17:47 | 000,109,056 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\hlink.dll
[2016.01.31 06:16:36 | 009,889,280 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\twinui.dll
[2016.01.31 06:14:37 | 007,525,376 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\Chakra.dll
[2016.01.31 06:14:19 | 003,588,096 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\win32kfull.sys
[2016.01.31 06:13:54 | 004,791,808 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\jscript9.dll
[2016.01.31 06:13:17 | 000,034,816 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\ztrace_maps.dll
[2016.01.31 06:11:51 | 000,678,400 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\wuapi.dll
[2016.01.31 06:11:48 | 005,156,352 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\Windows.Data.Pdf.dll
[2016.01.31 06:11:25 | 000,162,304 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\msorcl32.dll
[2016.01.31 06:11:14 | 000,291,840 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\microsoft-windows-system-events.dll
[2016.01.31 06:07:17 | 018,802,176 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\edgehtml.dll
[2016.01.31 06:05:11 | 000,118,272 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\mtxoci.dll
[2016.01.31 06:05:07 | 000,574,464 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\Chakradiag.dll
[2016.01.31 05:59:40 | 005,457,408 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\Chakra.dll
[2016.01.31 05:58:44 | 000,029,696 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\ztrace_maps.dll
[2016.01.28 11:43:03 | 000,006,530 | ---- | M] () -- C:\Users\Tonda\OneDrive\Dokumenty\mKonto_13150247_151228_160128.html

========== Files Created - No Company Name ==========

[2016.02.20 22:45:28 | 000,016,148 | ---- | C] () -- C:\Windows\SysNative\TONDA_Tonda_HistoryPrediction.bin
[2016.02.19 12:21:12 | 000,004,608 | ---- | C] () -- C:\Windows\SECOH-QAD.exe
[2016.02.17 23:47:00 | 000,000,085 | ---- | C] () -- C:\Windows\wininit.ini
[2016.02.17 18:44:05 | 000,024,064 | ---- | C] () -- C:\Windows\zoek-delete.exe
[2016.02.16 11:06:29 | 000,028,272 | ---- | C] () -- C:\Windows\SysNative\drivers\TrueSight.sys
[2016.02.14 19:56:19 | 000,002,344 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
[2016.02.02 11:50:13 | 000,000,001 | ---- | C] () -- C:\Windows\SysWow64\en.html
[2016.01.28 12:14:07 | 000,006,530 | ---- | C] () -- C:\Users\Tonda\OneDrive\Dokumenty\mKonto_13150247_151228_160128.html
[2015.12.16 20:41:12 | 000,183,312 | ---- | C] () -- C:\Windows\SysWow64\hsa-thunk.dll
[2015.12.16 20:28:56 | 000,154,128 | ---- | C] () -- C:\Windows\SysWow64\atieah32.exe
[2015.12.16 20:13:50 | 000,132,112 | ---- | C] () -- C:\Windows\SysWow64\amdhdl32.dll
[2015.12.16 20:13:48 | 000,198,672 | ---- | C] () -- C:\Windows\SysWow64\amdgfxinfo32.dll
[2015.12.08 20:43:28 | 000,000,001 | ---- | C] () -- C:\Users\Tonda\AppData\Local\llftool.4.40.agreement
[2015.11.25 23:00:04 | 000,053,248 | ---- | C] () -- C:\Windows\SysWow64\CommonDL.dll
[2015.11.25 23:00:04 | 000,002,760 | ---- | C] () -- C:\Windows\SysWow64\lgAxconfig.ini
[2015.10.12 16:08:22 | 000,021,888 | ---- | C] () -- C:\Windows\SysWow64\sh4native.exe
[2015.10.12 09:36:42 | 000,000,380 | ---- | C] () -- C:\Windows\SysWow64\data.bin
[2015.10.07 16:28:08 | 001,004,032 | ---- | C] () -- C:\Windows\SysWow64\amdocl_as32.exe
[2015.10.07 16:28:08 | 000,807,424 | ---- | C] () -- C:\Windows\SysWow64\amdocl_ld32.exe
[2015.10.01 09:42:30 | 001,766,952 | ---- | C] () -- C:\Windows\SysWow64\CoreUIComponents.dll
[2015.08.19 11:20:30 | 001,823,232 | ---- | C] () -- C:\Windows\SysWow64\InputService.dll
[2015.08.19 11:20:27 | 000,200,704 | ---- | C] () -- C:\Windows\SysWow64\TextInputFramework.dll
[2015.08.08 13:36:41 | 000,007,605 | ---- | C] () -- C:\Users\Tonda\AppData\Local\Resmon.ResmonCfg
[2015.07.31 11:19:47 | 000,001,480 | ---- | C] () -- C:\Users\Tonda\AppData\Local\Adobe Uložit pro web 13.0 Prefs
[2015.07.30 12:59:54 | 000,655,872 | ---- | C] () -- C:\Windows\SysWow64\xvidcore.dll
[2015.07.30 12:59:54 | 000,240,128 | ---- | C] () -- C:\Windows\SysWow64\xvidvfw.dll
[2015.07.30 12:59:54 | 000,216,064 | ---- | C] ( ) -- C:\Windows\SysWow64\lagarith.dll
[2015.07.30 12:59:53 | 000,112,128 | ---- | C] () -- C:\Windows\SysWow64\ff_vfw.dll
[2015.07.30 07:28:46 | 000,000,008 | RHS- | C] () -- C:\ProgramData\ntuser.pol
[2015.07.30 00:45:03 | 000,003,584 | ---- | C] () -- C:\Windows\SECOH-QAD.dll
[2015.07.30 00:37:19 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin
[2015.07.30 00:36:57 | 000,204,952 | ---- | C] () -- C:\Windows\SysWow64\ativvsvl.dat
[2015.07.30 00:36:57 | 000,157,144 | ---- | C] () -- C:\Windows\SysWow64\ativvsva.dat
[2015.07.30 00:30:42 | 000,000,000 | ---- | C] () -- C:\Users\Tonda\AppData\Local\Driver_LOM_8161Present.flag
[2015.07.10 13:20:52 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat
[2015.07.10 12:04:39 | 000,000,741 | ---- | C] () -- C:\Windows\SysWow64\NOISE.DAT
[2015.07.10 12:04:38 | 000,215,943 | ---- | C] () -- C:\Windows\SysWow64\dssec.dat
[2015.07.10 12:00:35 | 000,161,632 | ---- | C] () -- C:\Windows\SysWow64\weretw.dll
[2015.07.10 12:00:33 | 000,673,088 | ---- | C] () -- C:\Windows\SysWow64\mlang.dat
[2015.07.10 12:00:32 | 000,047,104 | ---- | C] () -- C:\Windows\SysWow64\BWContextHandler.dll
[2015.07.10 12:00:31 | 000,156,672 | ---- | C] () -- C:\Windows\SysWow64\MTF.dll
[2015.07.10 12:00:30 | 000,028,672 | ---- | C] () -- C:\Windows\SysWow64\dtdump.exe
[2015.07.10 12:00:29 | 000,081,408 | ---- | C] () -- C:\Windows\SysWow64\InputLocaleManager.dll
[2015.07.10 12:00:29 | 000,057,344 | ---- | C] () -- C:\Windows\SysWow64\EditBufferTestHook.dll
[2015.07.10 12:00:29 | 000,053,760 | ---- | C] () -- C:\Windows\SysWow64\WpKbdLayout.dll
[2015.07.10 12:00:29 | 000,022,016 | ---- | C] () -- C:\Windows\SysWow64\WordBreakers.dll
[2015.07.10 12:00:28 | 000,270,848 | ---- | C] () -- C:\Windows\SysWow64\HrtfApo.dll
[2015.07.10 12:00:27 | 000,364,544 | ---- | C] () -- C:\Windows\SysWow64\msjetoledb40.dll
[2015.07.10 12:00:26 | 000,022,528 | ---- | C] () -- C:\Windows\SysWow64\efsext.dll
[2015.07.10 12:00:25 | 000,002,269 | ---- | C] () -- C:\Windows\SysWow64\WimBootCompress.ini
[2015.07.10 12:00:24 | 000,167,640 | ---- | C] () -- C:\Windows\SysWow64\chs_singlechar_pinyin.dat
[2015.07.10 11:59:51 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin
[2014.11.20 20:35:00 | 000,038,912 | ---- | C] () -- C:\Windows\SysWow64\kdbsdk32.dll

========== ZeroAccess Check ==========

[2015.07.30 15:33:36 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
"" = C:\Windows\SysNative\windows.storage.dll -- [2015.09.17 07:49:11 | 006,487,248 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\windows.storage.dll -- [2015.09.17 07:28:40 | 005,120,056 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\fastprox.dll -- [2015.07.10 11:59:53 | 000,995,328 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2015.07.10 12:00:23 | 000,754,688 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\wbemess.dll -- [2015.07.10 11:59:55 | 000,516,096 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]

========== LOP Check ==========

[2015.08.21 23:33:00 | 000,000,000 | ---D | M] -- C:\Users\Tonda\AppData\Roaming\A
[2015.07.30 05:53:20 | 000,000,000 | ---D | M] -- C:\Users\Tonda\AppData\Roaming\AMD
[2015.08.09 18:48:41 | 000,000,000 | ---D | M] -- C:\Users\Tonda\AppData\Roaming\Bigasoft Total Video Converter 4
[2015.08.09 18:38:03 | 000,000,000 | ---D | M] -- C:\Users\Tonda\AppData\Roaming\Bigasoft Total Video Converter 5
[2015.11.25 10:29:14 | 000,000,000 | ---D | M] -- C:\Users\Tonda\AppData\Roaming\Enigma Software Group
[2015.11.01 15:04:59 | 000,000,000 | ---D | M] -- C:\Users\Tonda\AppData\Roaming\FiraxisLive
[2016.02.04 15:29:37 | 000,000,000 | ---D | M] -- C:\Users\Tonda\AppData\Roaming\iDealshare VideoGo 6
[2015.07.30 01:06:34 | 000,000,000 | ---D | M] -- C:\Users\Tonda\AppData\Roaming\library_dir
[2015.07.30 17:08:19 | 000,000,000 | ---D | M] -- C:\Users\Tonda\AppData\Roaming\Mirillis
[2016.02.15 23:04:26 | 000,000,000 | ---D | M] -- C:\Users\Tonda\AppData\Roaming\MPC-BE
[2015.07.30 06:52:10 | 000,000,000 | ---D | M] -- C:\Users\Tonda\AppData\Roaming\Opera Software
[2015.12.25 12:12:02 | 000,000,000 | ---D | M] -- C:\Users\Tonda\AppData\Roaming\Raptr
[2015.07.30 15:38:29 | 000,000,000 | ---D | M] -- C:\Users\Tonda\AppData\Roaming\Seznam.cz
[2015.07.30 17:57:26 | 000,000,000 | ---D | M] -- C:\Users\Tonda\AppData\Roaming\Soft4Boost
[2015.07.30 07:48:03 | 000,000,000 | ---D | M] -- C:\Users\Tonda\AppData\Roaming\Steam
[2015.09.10 13:18:04 | 000,000,000 | ---D | M] -- C:\Users\Tonda\AppData\Roaming\The Creative Assembly
[2016.02.09 16:31:07 | 000,000,000 | ---D | M] -- C:\Users\Tonda\AppData\Roaming\uplay
[2016.02.20 20:25:09 | 000,000,000 | ---D | M] -- C:\Users\Tonda\AppData\Roaming\uTorrent

========== Purity Check ==========



========== Alternate Data Streams ==========

@Alternate Data Stream - 64 bytes -> C:\Program Files (x86)\Avira\Antivirus\avgnt.exe:$CmdTcID

< End of report >

Tondys01
nováček
Příspěvky: 22
Registrován: únor 16
Pohlaví: Nespecifikováno
Stav:
Offline

Re: Prosím o kontrolu logu

Příspěvekod Tondys01 » 20 úno 2016 23:42

OTL Extras logfile created on: 20.02.2016 23:32:12 - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Tonda\Desktop
64bit- An unknown product (Version = 6.2.9200) - Type = NTWorkstation
Internet Explorer (Version = 9.11.10240.16384)
Locale: 00000405 | Country: Česká republika | Language: CSY | Date Format: dd.MM.yyyy

7,95 Gb Total Physical Memory | 5,16 Gb Available Physical Memory | 64,88% Memory free
8,34 Gb Paging File | 4,94 Gb Available in Paging File | 59,22% Paging File free
Paging file location(s): c:\pagefile.sys 400 4000 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 111,24 Gb Total Space | 60,79 Gb Free Space | 54,65% Space Free | Partition Type: NTFS
Drive E: | 931,41 Gb Total Space | 350,32 Gb Free Space | 37,61% Space Free | Partition Type: NTFS

Computer Name: TONDA | User Name: Tonda | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.html[@ = htmlfile] -- Reg Error: Key error. File not found
.url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)
.js[@ = JSFile] -- C:\Windows\SysWow64\CScript.exe (Microsoft Corporation)
.jse[@ = JSEFile] -- C:\Windows\SysWow64\CScript.exe (Microsoft Corporation)
.vbe[@ = VBEFile] -- C:\Windows\SysWow64\CScript.exe (Microsoft Corporation)
.vbs[@ = VBSFile] -- C:\Windows\SysWow64\CScript.exe (Microsoft Corporation)
.wsf[@ = WSFFile] -- C:\Windows\SysWow64\CScript.exe (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)
.html [@ = htmlfile] -- Reg Error: Key error. File not found
.js [@ = JSFile] -- C:\Windows\SysWow64\CScript.exe (Microsoft Corporation)
.jse [@ = JSEFile] -- C:\Windows\SysWow64\CScript.exe (Microsoft Corporation)
.vbe [@ = VBEFile] -- C:\Windows\SysWow64\CScript.exe (Microsoft Corporation)
.vbs [@ = VBSFile] -- C:\Windows\SysWow64\CScript.exe (Microsoft Corporation)
.wsf [@ = WSFFile] -- C:\Windows\SysWow64\CScript.exe (Microsoft Corporation)

========== Shell Spawning ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [open] -- Reg Error: Key error.
htmlfile [opennew] -- Reg Error: Key error.
http [open] -- Reg Error: Key error.
https [open] -- Reg Error: Key error.
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
jsfile [open] -- %SystemRoot%\SysWow64\CScript.exe "%1" %* (Microsoft Corporation)
jsefile [open] -- %SystemRoot%\SysWow64\CScript.exe "%1" %* (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
vbefile [open] -- %SystemRoot%\SysWow64\CScript.exe "%1" %* (Microsoft Corporation)
vbsfile [open] -- %SystemRoot%\SysWow64\CScript.exe "%1" %* (Microsoft Corporation)
wsffile [open] -- %SystemRoot%\SysWow64\CScript.exe "%1" %* (Microsoft Corporation)
Unknown [openas] -- %SystemRoot%\system32\OpenWith.exe "%1" (Microsoft Corporation)
Directory [Bridge] -- C:\Program Files\Adobe\Adobe Bridge CS6 (64 Bit)\Bridge.exe "%L" (Adobe Systems, Inc.)
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Applications\iexplore.exe [open] -- Reg Error: Key error.
CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] -- Reg Error: Key error.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [open] -- Reg Error: Key error.
htmlfile [opennew] -- Reg Error: Key error.
http [open] -- Reg Error: Key error.
https [open] -- Reg Error: Key error.
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
jsfile [open] -- %SystemRoot%\SysWow64\CScript.exe "%1" %* (Microsoft Corporation)
jsefile [open] -- %SystemRoot%\SysWow64\CScript.exe "%1" %* (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
vbefile [open] -- %SystemRoot%\SysWow64\CScript.exe "%1" %* (Microsoft Corporation)
vbsfile [open] -- %SystemRoot%\SysWow64\CScript.exe "%1" %* (Microsoft Corporation)
wsffile [open] -- %SystemRoot%\SysWow64\CScript.exe "%1" %* (Microsoft Corporation)
Unknown [openas] -- %SystemRoot%\system32\OpenWith.exe "%1" (Microsoft Corporation)
Directory [Bridge] -- C:\Program Files\Adobe\Adobe Bridge CS6 (64 Bit)\Bridge.exe "%L" (Adobe Systems, Inc.)
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Applications\iexplore.exe [open] -- Reg Error: Key error.
CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] -- Reg Error: Key error.

========== Security Center Settings ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 23 47 0E 9C 53 CA D0 01 [binary data]

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Upgrade]
"UpgradeTime" = [binary data]

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Upgrade]
"UpgradeTime" = Reg Error: Unknown registry data type -- File not found

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
"DoNotAllowExceptions" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
"DoNotAllowExceptions" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
"DoNotAllowExceptions" = 0

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]


========== Vista Active Open Ports Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{06D0F54B-54FD-42BC-89C0-F07C57022353}" = lport=3306 | protocol=6 | dir=in | name=mysql |
"{1A0AB41B-F7D9-4D9F-AE7F-BFD0D7ABAB4A}" = lport=2869 | protocol=6 | dir=in | app=system |
"{2937D79E-4701-4DF5-999F-8F27BAAB5752}" = lport=139 | protocol=6 | dir=in | app=system |
"{29CB26FF-49E1-4CCC-A57A-0111978FF8C5}" = lport=5353 | protocol=17 | dir=in | app=c:\program files (x86)\google\chrome\application\chrome.exe |
"{3CBF450F-1871-4D87-8AFF-C817C2C94DFE}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{4490ADA1-187F-421F-B3C3-EE8811EB8BAA}" = lport=10243 | protocol=6 | dir=in | app=system |
"{4A23ABBF-3A94-4618-AACA-C036B438DC84}" = rport=445 | protocol=6 | dir=out | app=system |
"{51E9EFF7-BED5-48B0-8FE6-538C3BE99909}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{53963758-0642-4A67-A912-F398DD03406F}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{65FC2999-EAAC-49EA-B421-43EA17665E0D}" = rport=139 | protocol=6 | dir=out | app=system |
"{763C25CA-B516-494C-87D3-846472179E4B}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{77EF3D72-A9D9-4D3E-90C1-7D746414B69E}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{80ADFB48-849B-4F62-B219-6EF9BB33A47B}" = rport=10243 | protocol=6 | dir=out | app=system |
"{84CC0EF3-A1B9-420B-94B3-A6DE23E44A89}" = rport=137 | protocol=17 | dir=out | app=system |
"{A3A74359-674F-4226-8B85-5AFB56C3F969}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{AEB4B56B-AD92-4D01-8353-1B9940EBB540}" = lport=445 | protocol=6 | dir=in | app=system |
"{BFBEF56F-8580-43A0-81A1-3168C3384A70}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{D280646E-C431-426E-A1BD-98672AB1054D}" = lport=137 | protocol=17 | dir=in | app=system |
"{D7B3F142-FEB0-43F1-8F43-998ED61384EF}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |
"{F07CC72A-669E-465D-97EF-B98A4F5ADEC9}" = lport=138 | protocol=17 | dir=in | app=system |
"{F7BFA584-0D81-4605-9AC1-53189811F3ED}" = rport=138 | protocol=17 | dir=out | app=system |
"{F90599D9-C1A9-4705-AAA0-3326802AC04A}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{FBA3BF1F-5F39-4322-982F-C51298A70ADE}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |

========== Vista Active Application Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{023422CB-32FB-4B9C-8C8F-151D54DF7A23}" = protocol=17 | dir=in | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{04A01699-20FB-40B1-A135-7DC0B96D5BCF}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
"{0614BC62-0F98-4230-A1DF-6A616D5CD198}" = dir=out | name=xbox |
"{0D0ED486-6D2A-406B-B750-F5F45EAAB784}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"{137B6E77-2D3E-4755-BFA2-C3AE4E382859}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{140402A0-1AE1-4AC1-B53A-7E7DEE68C7C2}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{14A6BBE1-903D-4554-9F50-C3F0A318CEED}" = dir=in | name=@{microsoft.windows.cloudexperiencehost_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy?ms-resource://microsoft.windows.cloudexperiencehost/resources/appdescription} |
"{159C8009-7BE8-4ED0-A56E-B060778D650B}" = dir=in | name=@{microsoft.windowscommunicationsapps_17.6568.46051.0_x64__8wekyb3d8bbwe?ms-resource://microsoft.windowscommunicationsapps/hxcommintl/appmanifest_outlookdesktop_displayname} |
"{16C66F90-01CA-412D-8F9E-CB07B7ACA2B8}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office15\ucmapi.exe |
"{19E2F760-6890-44CA-8AFA-46F261D4FDE3}" = protocol=6 | dir=in | app=c:\program files (x86)\raptr\raptr_im.exe |
"{1AF0CAA3-9B30-4BEB-BA84-255E3B1486F7}" = protocol=17 | dir=in | app=c:\program files (x86)\raptr\raptr_im.exe |
"{1C44732B-440E-4C10-B315-FA288081BB3F}" = dir=in | name=@{microsoft.windows.photos_16.201.11370.0_x64__8wekyb3d8bbwe?ms-resource://microsoft.windows.photos/resources/appstorename} |
"{1D9AD486-370E-4887-AF5D-CFA1D2D74C81}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"{29E1DA47-8CA0-43C1-8AF5-D994B55D0F62}" = dir=out | name=@{microsoft.getstarted_2.6.12.0_x64__8wekyb3d8bbwe?ms-resource://microsoft.getstarted/resources/appstorename} |
"{2CE7A052-15CF-4FFD-B4A8-F9FC7756A1AB}" = dir=out | name=@{microsoft.microsoftedge_20.10240.16384.0_neutral__8wekyb3d8bbwe?ms-resource://microsoft.microsoftedge/resources/appname} |
"{36B7D53D-4A08-4505-9C25-977CD9CD09C2}" = dir=out | name=@{windows.purchasedialog_6.2.0.0_neutral_neutral_cw5n1h2txyewy?ms-resource://windows.purchasedialog/resources/displayname} |
"{370AF76A-ED4A-41A4-9F39-B40349C61CB4}" = dir=out | name=@{microsoft.zunemusic_3.6.15131.0_x64__8wekyb3d8bbwe?ms-resource://microsoft.zunemusic/resources/ids_manifest_music_app_name} |
"{37DA43AC-BF1C-4959-9BD4-EDB43C1EA966}" = dir=out | name=@{microsoft.windowsfeedback_10.0.10240.16393_neutral_neutral_cw5n1h2txyewy?ms-resource://microsoft.windowsfeedback/feedbackapp.resources/appname/text} |
"{38F9FE86-3FBB-46F1-BA0A-5F0809861D3E}" = dir=out | name=@{microsoft.windows.parentalcontrols_1000.10240.16384.0_neutral_neutral_cw5n1h2txyewy?ms-resource://microsoft.windows.parentalcontrols/resources/displayname} |
"{3A07C93E-A0E9-4BEC-9561-1053F1D02394}" = protocol=58 | dir=in | app=system |
"{3D46A6BA-BDDA-4BC9-B289-330AE9D1A7EE}" = dir=out | name=@{microsoft.lockapp_10.0.10240.16384_neutral__cw5n1h2txyewy?ms-resource://microsoft.lockapp/resources/appdisplayname} |
"{3F6380F4-FFE9-4ED7-B249-F39770A702E5}" = dir=out | name=@{microsoft.windows.cloudexperiencehost_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy?ms-resource://microsoft.windows.cloudexperiencehost/resources/appdescription} |
"{41223ADF-FAAC-4329-8C7C-5421AE244165}" = dir=in | name=@{microsoft.aad.brokerplugin_1000.10240.16384.0_neutral_neutral_cw5n1h2txyewy?ms-resource://microsoft.aad.brokerplugin/resources/packagedisplayname} |
"{42408683-394B-4D59-A890-DFE1E8366109}" = dir=out | name=@{microsoft.windowscommunicationsapps_17.6568.46051.0_x64__8wekyb3d8bbwe?ms-resource://microsoft.windowscommunicationsapps/hxcommintl/appmanifest_outlookdesktop_displayname} |
"{45905CA2-998E-4D72-89BE-582A0B82F65A}" = dir=in | name=onenote |
"{4663B54D-7531-4D5A-B4B5-6C5BD917588C}" = protocol=17 | dir=in | app=c:\program files (x86)\team mediaportal\mediaportal\mediaportal.exe |
"{4745419B-70AA-4046-AAAB-E3C458A36C34}" = dir=in | name=@{microsoft.bingweather_4.8.239.0_x86__8wekyb3d8bbwe?ms-resource://microsoft.bingweather/resources/applicationtitlewithbranding} |
"{476CA55A-E856-4173-9870-9ED0CECF8B25}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{4D721F01-4DAF-49C3-8B68-ADA6EF5D8992}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{5189A784-7212-46AF-A152-B913CF101270}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{54A65FAC-3AA5-45FA-B8F7-7CF089561752}" = protocol=17 | dir=in | app=c:\program files (x86)\raptr\raptr.exe |
"{54A756D8-9BF9-4CC6-A3DF-C6173BA7C656}" = protocol=17 | dir=in | app=c:\program files (x86)\team mediaportal\mediaportal tv server\setuptv.exe |
"{58E1BC05-EAD7-46FA-8E6D-E25B61C32B1A}" = dir=out | name=@{microsoft.aad.brokerplugin_1000.10240.16384.0_neutral_neutral_cw5n1h2txyewy?ms-resource://microsoft.aad.brokerplugin/resources/packagedisplayname} |
"{595F97F3-C444-45E1-95E2-688FA9AF7D9E}" = dir=out | name=@{microsoft.accountscontrol_10.0.10240.16384_neutral__cw5n1h2txyewy?ms-resource://microsoft.accountscontrol/resources/displayname} |
"{5A62A7B2-A79E-41B9-BBD6-0D64A68E9292}" = dir=in | name=@{microsoft.windows.cortana_1.4.8.152_neutral_neutral_cw5n1h2txyewy?ms-resource://microsoft.windows.cortana/resources/displayname} |
"{5B11A20B-0CF7-45A6-A903-3ADFD43E0E64}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office15\lync.exe |
"{63842A75-8F64-4D94-BEF5-67427BEBE974}" = protocol=6 | dir=in | app=c:\program files (x86)\team mediaportal\mediaportal\mediaportal.exe |
"{65A1495E-E25E-4970-962E-65D4D72105B9}" = dir=out | name=@{microsoft.windowsstore_2016.27.2.0_x64__8wekyb3d8bbwe?ms-resource://microsoft.windowsstore/resources/storetitle} |
"{6850E319-35EB-4623-A800-77C478B39618}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{693DF36D-1590-449F-8107-61FFA90184CF}" = dir=out | name=@{microsoft.windowsfeedback_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy?ms-resource://microsoft.windowsfeedback/feedbackapp.resources/appname/text} |
"{6C7C2A88-FD0C-4893-AD9B-E06045F86A66}" = dir=in | name=@{windows.contactsupport_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy?ms-resource://windows.contactsupport/resources/appdisplayname} |
"{6DFE6088-749F-4732-8991-F6A11330B6B1}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{6E95D7E3-6636-4B6F-BB4A-902384E96D01}" = dir=out | name=@{windows.contactsupport_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy?ms-resource://windows.contactsupport/resources/appdisplayname} |
"{706617EE-7E8D-4B55-95D8-5A44E397380D}" = dir=out | name=@{microsoft.windows.cortana_1.4.8.152_neutral_neutral_cw5n1h2txyewy?ms-resource://microsoft.windows.cortana/resources/displayname} |
"{7A4E5FCB-7A7B-4224-AEC7-70C388A6DC3F}" = dir=out | name=@{microsoft.xboxidentityprovider_1000.10240.16384.0_neutral_neutral_cw5n1h2txyewy?ms-resource://microsoft.xboxidentityprovider/resources/pkgdisplayname} |
"{7A9C9F85-6FC2-488C-912F-87FFE61E04FF}" = dir=in | name=@{microsoft.microsoftedge_20.10240.16384.0_neutral__8wekyb3d8bbwe?ms-resource://microsoft.microsoftedge/resources/appname} |
"{7C661E3F-379D-40A2-AC12-2664B4B4B302}" = dir=in | name=@{microsoft.windows.cortana_1.4.8.176_neutral_neutral_cw5n1h2txyewy?ms-resource://microsoft.windows.cortana/resources/displayname} |
"{7FFE7C11-01AC-423B-BAE6-CF4A8DF7A3D5}" = dir=out | name=@{microsoft.windows.contentdeliverymanager_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy?ms-resource://microsoft.windows.contentdeliverymanager/resources/appdisplayname} |
"{84F39358-8D7A-4709-8660-7A05CFC1A35D}" = dir=out | name=@{microsoft.windows.photos_16.201.11370.0_x64__8wekyb3d8bbwe?ms-resource://microsoft.windows.photos/resources/appstorename} |
"{86A2B3E0-F1C3-47AB-8C05-0B2295F63E06}" = dir=out | name=@{microsoft.windows.cloudexperiencehost_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy?ms-resource://microsoft.windows.cloudexperiencehost/resources/appdescription} |
"{8AAD902F-7EB6-4013-A338-A75A1CBE584E}" = dir=in | name=@{microsoft.windows.cloudexperiencehost_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy?ms-resource://microsoft.windows.cloudexperiencehost/resources/appdescription} |
"{8E3D66D8-ECEE-4E2E-86FA-C721A5730F48}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{961C1A72-056D-4E57-A141-16BB25DCF82B}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{96572DA0-6DA5-4610-90AA-87A538E8750F}" = protocol=6 | dir=in | app=c:\program files (x86)\team mediaportal\mediaportal tv server\setuptv.exe |
"{9E32F5A5-B6CC-47F6-B1A6-7AF22096F9F0}" = protocol=6 | dir=out | app=system |
"{AD792A3E-8849-4997-8543-16129758FD49}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office15\lync.exe |
"{AEB60F0E-0FC5-42CC-AB34-C68E8C41C876}" = dir=out | name=@{microsoft.xboxgamecallableui_1000.10240.16384.0_neutral_neutral_cw5n1h2txyewy?ms-resource://microsoft.xboxgamecallableui/resources/pkgdisplayname} |
"{B3D8A075-0A07-4DFD-8EF8-7C62919DE468}" = protocol=6 | dir=in | app=c:\program files (x86)\team mediaportal\mediaportal tv server\tvservice.exe |
"{B49E0F70-5044-47FB-AE0E-7581CC66D815}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office15\ucmapi.exe |
"{BC2EB7F6-F51A-4DD5-9D96-A2340FB671C0}" = dir=in | name=xbox |
"{BDECD302-1E9D-4EE1-A6E5-783A1C25A4AB}" = dir=out | name=@{microsoft.appconnector_1.3.3.0_neutral__8wekyb3d8bbwe?ms-resource://microsoft.appconnector/resources/connectorstubtitle} |
"{C3AA42CE-F028-445A-BEAF-08891DE589FC}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{C728D5C0-D222-49E3-B96B-24801ED4EA03}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{C934F939-1145-4855-8E4E-644518B77D71}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"{CA2CCFE5-4920-4F3A-AF6B-BCA393D9BCDC}" = protocol=6 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{CE59934F-07AE-42D6-9FC7-ED2EC818AE7B}" = dir=out | name=@{microsoft.zunevideo_3.6.16941.0_x64__8wekyb3d8bbwe?ms-resource://microsoft.zunevideo/resources/ids_manifest_video_app_name} |
"{D737AC7A-2488-4C8F-9777-45BB2DD0411D}" = dir=out | name=@{microsoft.windowsmaps_4.1601.10150.0_x64__8wekyb3d8bbwe?ms-resource://microsoft.windowsmaps/resources/appstorename} |
"{DC4F0C72-8D50-478F-B6A4-70EAC6CE3530}" = protocol=6 | dir=in | app=c:\program files (x86)\raptr\raptr.exe |
"{DC699DC8-2D47-4D3E-AC07-3F8D0405BC7F}" = dir=out | name=@{microsoft.windowsphone_10.1602.3010.0_x64__8wekyb3d8bbwe?ms-resource://microsoft.windowsphone/resources/appstorename} |
"{DCDC31AD-C208-40F8-A7E6-98EC789D3D93}" = dir=out | name=onenote |
"{DF828B58-5C5C-484C-88A8-9C0A3CF4BD05}" = dir=in | name=@{microsoft.zunevideo_3.6.16941.0_x64__8wekyb3d8bbwe?ms-resource://microsoft.zunevideo/resources/ids_manifest_video_app_name} |
"{E01B45F5-6A37-46E1-BD0B-090DDF7DB811}" = protocol=17 | dir=in | app=c:\program files (x86)\team mediaportal\mediaportal tv server\tvservice.exe |
"{E9B793FC-E5B6-4EA1-BF0E-E54F42CB689B}" = dir=out | name=@{microsoft.bingweather_4.8.239.0_x86__8wekyb3d8bbwe?ms-resource://microsoft.bingweather/resources/applicationtitlewithbranding} |
"{EA35FD74-0A72-45F1-84B2-31CDB73E9134}" = dir=out | name=@{microsoft.windows.cortana_1.4.8.176_neutral_neutral_cw5n1h2txyewy?ms-resource://microsoft.windows.cortana/resources/displayname} |
"{ECA8AD97-7C06-4651-AFE0-A1F060A6A572}" = protocol=58 | dir=out | name=@iphlpsvc.dll,-503 |
"{F38B87BA-CB35-4845-8A37-4C8647B64209}" = protocol=17 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{FA2FC0D3-9FA6-40DB-847F-DF3B0BD85F0C}" = dir=out | name=@{microsoft.people_10.0.10220.0_x64__8wekyb3d8bbwe?ms-resource://microsoft.people/resources/appstorename} |
"{FD568D73-A22B-43D0-BF50-D0B9996D6EE6}" = dir=in | name=@{microsoft.windowsstore_2016.27.2.0_x64__8wekyb3d8bbwe?ms-resource://microsoft.windowsstore/resources/storetitle} |
"TCP Query User{6259F23A-787A-4D15-ABBB-9145B3D18B7A}C:\users\tonda\appdata\roaming\utorrent\utorrent.exe" = protocol=6 | dir=in | app=c:\users\tonda\appdata\roaming\utorrent\utorrent.exe |
"TCP Query User{7DA39AA9-A68B-4716-BB82-E1FB96D982C4}C:\program files (x86)\team mediaportal\mediaportal\configuration.exe" = protocol=6 | dir=in | app=c:\program files (x86)\team mediaportal\mediaportal\configuration.exe |
"UDP Query User{399531C9-4303-4433-A141-205156917D1B}C:\program files (x86)\team mediaportal\mediaportal\configuration.exe" = protocol=17 | dir=in | app=c:\program files (x86)\team mediaportal\mediaportal\configuration.exe |
"UDP Query User{53A6A0A7-2FF2-44B5-92C6-87ADAE273134}C:\users\tonda\appdata\roaming\utorrent\utorrent.exe" = protocol=17 | dir=in | app=c:\users\tonda\appdata\roaming\utorrent\utorrent.exe |

========== HKEY_LOCAL_MACHINE Uninstall List ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{005A39B4-C104-C892-8E36-F00926DF37B2}" = Catalyst Control Center Next Localization RU
"{00953243-411E-294C-6B7B-1BEDB868EA39}" = Catalyst Control Center Next Localization DA
"{0CEFD072-4694-36C9-333E-C77BFBDC9DAB}" = Catalyst Control Center Next Localization KO
"{196988EC-1E8E-4BDD-BF58-AB7C14338BDD}" = Killer Network Manager
"{1D1CB210-D05E-5BF4-F998-2B1903EE4323}" = AMD Accelerated Video Transcoding
"{1D8E6291-B0D5-35EC-8441-6616F567A0F7}" = Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219
"{1F9C1993-4706-4A72-B231-B092CF517C1D}" = Killer E220x Drivers
"{37B8F9C7-03FB-3253-8781-2517C99D7C00}" = Microsoft Visual C++ 2012 x64 Additional Runtime - 11.0.61030
"{3A6B2719-1BD0-D01A-3F65-269955A3B21B}" = AMD Install Manager
"{3C0237F9-A94D-B08F-00E5-D47E6EAE2FBA}" = AMD Fuel
"{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148
"{56DA0CB5-ABD2-4318-BEAB-62FDBC9B12CC}" = MySQL Server 5.6
"{598E3EC4-B4A4-3CE3-ED42-26D8A29210B5}" = Catalyst Control Center Next Localization TH
"{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161
"{724A76E5-F967-25B3-C2CD-36BEBBB10A40}" = Catalyst Control Center Next Localization DE
"{74351A4C-172D-47DF-9ED5-3243C2E56310}" = Killer Bandwidth Control Filter Driver
"{78ACE60E-0CB7-4935-BCD4-F33422105607}" = AMD Settings - Branding
"{7C8B1070-4C8E-6323-D7D9-ABCF4FAE8ECF}" = ccc-utility64
"{8220EEFE-38CD-377E-8595-13398D740ACE}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17
"{83D51B96-9433-356B-EB77-F26F4DB6B622}" = Catalyst Control Center Next Localization NO
"{84EBEE85-44DC-4301-A5E0-ACDEDC0D345E}" = RAPID Mode
"{90150000-0015-0405-1000-0000000FF1CE}" = Microsoft Access MUI (Czech) 2013
"{90150000-0016-0405-1000-0000000FF1CE}" = Microsoft Excel MUI (Czech) 2013
"{90150000-0018-0405-1000-0000000FF1CE}" = Microsoft PowerPoint MUI (Czech) 2013
"{90150000-0019-0405-1000-0000000FF1CE}" = Microsoft Publisher MUI (Czech) 2013
"{90150000-001A-0405-1000-0000000FF1CE}" = Microsoft Outlook MUI (Czech) 2013
"{90150000-001B-0405-1000-0000000FF1CE}" = Microsoft Word MUI (Czech) 2013
"{90150000-001F-0405-1000-0000000FF1CE}" = Nástroje kontroly pravopisu pro Microsoft Office 2013 – čeština
"{90150000-001F-0407-1000-0000000FF1CE}" = Microsoft Office Korrekturhilfen 2013 - Deutsch
"{90150000-001F-0409-1000-0000000FF1CE}" = Microsoft Office Proofing Tools 2013 - English
"{90150000-001F-041B-1000-0000000FF1CE}" = Nástroje korektúry balíka Microsoft Office 2013 - slovenčina
"{90150000-002C-0405-1000-0000000FF1CE}" = Microsoft Office Proofing (Czech) 2013
"{90150000-0044-0405-1000-0000000FF1CE}" = Microsoft InfoPath MUI (Czech) 2013
"{90150000-006E-0405-1000-0000000FF1CE}" = Microsoft Office Shared MUI (Czech) 2013
"{90150000-0090-0405-1000-0000000FF1CE}" = Microsoft DCF MUI (Czech) 2013
"{90150000-00A1-0405-1000-0000000FF1CE}" = Microsoft OneNote MUI (Czech) 2013
"{90150000-00BA-0405-1000-0000000FF1CE}" = Microsoft Groove MUI (Czech) 2013
"{90150000-00C1-0000-1000-0000000FF1CE}" = Microsoft Office 32-bit Components 2013
"{90150000-00C1-0405-1000-0000000FF1CE}" = Microsoft Office Shared 32-bit MUI (Czech) 2013
"{90150000-00E1-0405-1000-0000000FF1CE}" = Microsoft Office OSM MUI (Czech) 2013
"{90150000-00E2-0405-1000-0000000FF1CE}" = Microsoft Office OSM UX MUI (Czech) 2013
"{90150000-012B-0405-1000-0000000FF1CE}" = Microsoft Lync MUI (Czech) 2013
"{91150000-0011-0000-1000-0000000FF1CE}" = Microsoft Office Professional Plus 2013
"{929FBD26-9020-399B-9A7A-751D61F0B942}" = Microsoft Visual C++ 2013 x64 Additional Runtime - 12.0.21005
"{A0C43CD7-AE8C-B0F3-4031-7565481DA451}" = Catalyst Control Center Next Localization JA
"{A122AD66-B765-4B61-8B2B-EFEDE5BB9779}" = Media Preview
"{A2CB1ACB-94A2-32BA-A15E-7D80319F7589}" = Microsoft Visual C++ 2012 x64 Minimum Runtime - 11.0.50727
"{A4525810-2BB6-4989-0E35-6D78826561BB}" = Catalyst Control Center Next Localization NL
"{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}" = Microsoft Visual C++ 2013 x64 Minimum Runtime - 12.0.21005
"{AC53FC8B-EE18-3F9C-9B59-60937D0B182C}" = Microsoft Visual C++ 2012 x64 Additional Runtime - 11.0.50727
"{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}" = Microsoft Visual C++ 2005 Redistributable (x64)
"{BB3FA5E5-3652-4EDD-1229-0487E93EE950}" = Catalyst Control Center Next Localization TR
"{C0BE1CF5-F93D-2641-314B-85E2EB4A9256}" = Catalyst Control Center Next Localization CS
"{C1EB1702-1520-5BB2-9DED-5827FA12CB86}" = Catalyst Control Center Next Localization CHS
"{C2CE1F6B-1866-DB80-2AD6-FD50E056821D}" = Catalyst Control Center Next Localization FR
"{C70FDFA1-4B45-FDCD-708B-CC97C3D8033A}" = Catalyst Control Center Next Localization FI
"{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}" = Microsoft Visual C++ 2012 x64 Minimum Runtime - 11.0.61030
"{CF858C19-75B3-513C-188F-A87FEF8B4A01}" = Catalyst Control Center Next Localization SV
"{D94BE2C8-8669-855D-BE73-EBDBA25ABBFE}" = ccc-utility64
"{D99BA8BB-CCA8-204C-1867-E904459A8B73}" = Catalyst Control Center Next Localization BR
"{DAC228C5-C688-1F91-EEFA-EAA15002639F}" = Catalyst Control Center Next Localization ES
"{DB27CA77-C209-BFF6-700D-88E3FFAFE63D}" = Catalyst Control Center Next Localization CHT
"{DDE72527-3C06-BA09-66A2-BCF04BFFD908}" = AMD Fuel
"{DEE5903A-E570-D884-8B6B-5A076A79212C}" = AMD Radeon Settings
"{DF47369F-DBEA-8AB1-B562-0A815ED0C454}" = Catalyst Control Center Next Localization PL
"{EBC36C18-E293-C3AC-9E8E-BA4BAC09346B}" = Catalyst Control Center Next Localization IT
"{EEEDD350-B86B-0FD7-CFF2-EF425C9443A7}" = Catalyst Control Center Next Localization EL
"{F937AF00-B63F-E9F4-1B52-4C903E347FCD}" = Catalyst Control Center Next Localization HU
"AMD Catalyst Install Manager" = AMD Install Manager
"CCleaner" = CCleaner
"Office15.PROPLUSR" = Microsoft Office Professional Plus 2013
"WinRAR archiver" = WinRAR 5.21 (64-bit)

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{03EB717E-7AF5-1D59-CD9B-CA7A6DBAA9AF}" = Catalyst Control Center Graphics Previews Common
"{083E4B17-EF54-4FD6-A3C8-CA2069FC1315}" = Avira Launcher
"{08D2E121-7F6A-43EB-97FD-629B44903403}" = Microsoft_VC90_CRT_x86
"{0921F489-493D-D0DA-2D45-FDE6C97362FA}" = CCC Help Hungarian
"{0E1BA7B8-38C7-7C07-5A30-C36C2D4987B4}" = CCC Help Russian
"{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}" = Microsoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005
"{1421F102-2BDA-39D6-CCF0-9F4B3D6564E4}" = CCC Help German
"{17BAD009-B4B2-8320-9159-AF7DD087D672}" = CCC Help Czech
"{17D0F297-2B7C-E59F-4B62-5E505CF3159B}" = Catalyst Control Center Localization All
"{1AAD994E-2A06-3F04-A7DD-8C8AE98ECB32}" = CCC Help Portuguese
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{236120EE-D0C5-E909-191C-CC321B15269A}" = CCC Help Swedish
"{2865326D-9A90-C0E3-2A54-C55E9C3E9945}" = CCC Help Turkish
"{2F73A7B2-E50E-39A6-9ABC-EF89E4C62E36}" = Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.50727
"{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}" = Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030
"{391CC42A-6DAC-D0D9-C155-3B275A731D67}" = CCC Help Swedish
"{39E1C2BE-D6DB-608F-D28F-ECE143F858E3}" = CCC Help Greek
"{3A6E64DC-A067-0C8A-B794-F0E9CD0DA537}" = CCC Help Russian
"{3b87484e-d70b-4b4f-ad59-2ae89571e2cf}" = Avira Launcher
"{41042F55-42EC-90CD-FEF3-26741B73E546}" = CCC Help Norwegian
"{41ED8BA7-FC73-25DD-037E-8F8BDD645228}" = CCC Help Japanese
"{4642052A-C2D4-541B-AC98-3F494682D51E}" = CCC Help English
"{4860E1E1-0860-3A85-4C5E-F4E009138F93}" = CCC Help Thai
"{503CDCAD-100E-5F9A-F15C-0EDDA1460071}" = CCC Help Czech
"{5CAE7D98-7D67-3121-AE6F-30831D109286}" = CCC Help Polish
"{60D8228D-16E5-29A0-87DA-8070AF5DE35E}" = Catalyst Control Center Graphics Previews Common
"{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}" = Google Update Helper
"{610FE6C7-A37E-AE3A-31BD-4663976116D8}" = Catalyst Control Center Localization All
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{73B373AE-228C-DA67-82FC-8B9618E61216}" = CCC Help Dutch
"{74EB3499-8B95-4B5C-96EB-7B342F3FD0C6}" = Adobe Photoshop CS6
"{78DC2EB8-2609-BA11-25AA-2CADD8D70A4E}" = CCC Help Chinese Traditional
"{7A4DBF6C-F182-7A08-7143-553DBB396E5F}" = CCC Help Portuguese
"{7f51bdb9-ee21-49ee-94d6-90afc321780e}" = Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.21005
"{8871FE83-B6A4-45AC-257F-1082F42466BC}" = CCC Help German
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8B130A5A-C724-7BE4-3B4D-4CB06FDC891E}" = CCC Help Korean
"{8FA6AFC5-8DCD-7C04-C0DF-A9769336EFEC}" = CCC Help Finnish
"{904FC5BA-57A0-47AD-4669-BE3F5D9457C8}" = CCC Help Polish
"{92D58719-BBC1-4CC3-A08B-56C9E884CC2C}" = Microsoft_VC80_CRT_x86
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9E9E775E-DA39-B534-DB4C-AA16CA3FD189}" = CCC Help Finnish
"{A467B938-9780-978E-0397-CEB7A827B446}" = CCC Help Korean
"{AA144318-60C2-24EB-7563-DE1B0D13CCC9}" = CCC Help Italian
"{AA274218-25A7-BC16-1995-42111EE7371E}" = AMD Settings
"{AC76BA86-0804-1033-1959-001824166751}" = Adobe Refresh Manager
"{AC76BA86-7AD7-1029-7B44-AC0F074E4100}" = Adobe Acrobat Reader DC - Czech
"{B175520C-86A2-35A7-8619-86DC379688B9}" = Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030
"{B455E95A-B804-439F-B533-336B1635AE97}" = NVIDIA PhysX
"{B5BE6E09-9120-A176-CB43-6B488797468A}" = CCC Help English
"{BB4B2A48-8A24-2F68-93BE-E21C22829F02}" = CCC Help Japanese
"{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}" = Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.61030
"{BFEAAE77-BD7F-4534-B286-9C5CB4697EB1}" = PDF Settings CS6
"{C28E8D4A-C424-71CF-DFBE-597810641712}" = Catalyst Control Center InstallProxy
"{C79C2FE1-0702-6128-8DCB-5B623601DACC}" = CCC Help Danish
"{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}" = Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030
"{CA9C83CD-2712-2AEC-BF09-4FDB86B38FFD}" = CCC Help Greek
"{ce085a78-074e-4823-8dc1-8a721b94b76d}" = Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005
"{CE1798D0-E5CC-B5A9-FAD5-94B30F6ADAFC}" = CCC Help Spanish
"{D1469C7F-7AA2-1691-7071-64BAA5DFF58E}" = CCC Help French
"{D3E1F3C6-3FB9-A5CA-B99C-A7BFA220E22C}" = CCC Help Hungarian
"{D404B889-DA48-2679-BDB9-7EF7F713793F}" = CCC Help Chinese Standard
"{D93841F5-E1E4-A3E5-67E1-981A2247AE25}" = CCC Help Chinese Traditional
"{E1A2E051-585A-D7B1-A461-79424494ACF9}" = CCC Help Turkish
"{E3763D79-64F2-7CD2-06E6-D8BCE6390613}" = CCC Help Norwegian
"{E3827F8B-56EA-C716-5284-07A1786DBBE2}" = Catalyst Control Center InstallProxy
"{E3E0C380-EBCE-8872-5C82-E977214B000F}" = CCC Help Thai
"{E70DB50B-10B4-46BC-9DE2-AB8B49E061EE}" = Killer Performance Suite
"{EC949E53-E0D0-8CC2-E315-5688675425A7}" = CCC Help Spanish
"{ECB5BACC-2C32-5CF4-7541-F18080CC352E}" = CCC Help Dutch
"{EDDC46EA-DF0A-E6CB-4C1A-285B40A72339}" = CCC Help Italian
"{EE2E5B41-C4BF-99E5-9DA6-488D36FF0D41}" = CCC Help Chinese Standard
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F1596E55-74AC-C362-905A-8E5F079DAF6C}" = CCC Help French
"{F3E3E7AA-BAD5-FE05-5665-8C2AB3F79AB2}" = CCC Help Danish
"{F5663E7F-79CA-4022-8B39-D855A4E0BF58}" = Manažer napájení
"{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}" = Microsoft Visual C++ 2013 x86 Additional Runtime - 12.0.21005
"{FDB30193-FDA0-3DAA-ACCA-A75EEFE53607}" = Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.50727
"{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
"Avira Antivirus" = Avira Antivirus
"Google Chrome" = Google Chrome
"MediaPortal" = MediaPortal
"MediaPortal TV Server" = MediaPortal TV Server / Client
"Raptr" = Raptr

========== Last 20 Event Log Errors ==========

[ Application Events ]
Error - 18.11.2015 20:20:46 | Computer Name = Tonda | Source = Microsoft-Windows-Immersive-Shell | ID = 5973
Description = Aplikaci Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy!App se
nepovedlo aktivovat, protože došlo k chybě: -2144927141. Další informace najdete
v protokolu Microsoft-Windows-TWinUI/Operational.

Error - 18.11.2015 20:20:46 | Computer Name = Tonda | Source = Microsoft-Windows-Immersive-Shell | ID = 5973
Description = Aplikaci Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy!App se
nepovedlo aktivovat, protože došlo k chybě: -2144927141. Další informace najdete
v protokolu Microsoft-Windows-TWinUI/Operational.

Error - 19.11.2015 8:38:20 | Computer Name = Tonda | Source = Software Protection Platform Service | ID = 8198
Description = Aktivace licence (slui.exe) se nezdařila s následujícím kódem chyby:
hr=0xC004F074
Argument
příkazového řádku: RuleId=dca14e37-0c5c-444f-9b35-1e2f161f5ac3;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=58e97c99-f377-4ef1-81d5-4ad5522b5fd8;NotificationInterval=1440;Trigger=NetworkAvailable

Error - 19.11.2015 8:38:28 | Computer Name = Tonda | Source = Software Protection Platform Service | ID = 8198
Description = Aktivace licence (slui.exe) se nezdařila s následujícím kódem chyby:
hr=0xC004F074
Argument
příkazového řádku: RuleId=dca14e37-0c5c-444f-9b35-1e2f161f5ac3;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=58e97c99-f377-4ef1-81d5-4ad5522b5fd8;NotificationInterval=1440;Trigger=NetworkAvailable

Error - 19.11.2015 20:11:54 | Computer Name = Tonda | Source = Microsoft-Windows-Immersive-Shell | ID = 5973
Description = Aplikaci Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUI se nepovedlo
aktivovat, protože došlo k chybě: -2144927141. Další informace najdete v protokolu
Microsoft-Windows-TWinUI/Operational.

Error - 19.11.2015 20:11:57 | Computer Name = Tonda | Source = Microsoft-Windows-Immersive-Shell | ID = 5973
Description = Aplikaci Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy!App se
nepovedlo aktivovat, protože došlo k chybě: -2144927141. Další informace najdete
v protokolu Microsoft-Windows-TWinUI/Operational.

Error - 19.11.2015 20:11:57 | Computer Name = Tonda | Source = Microsoft-Windows-Immersive-Shell | ID = 5973
Description = Aplikaci Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy!App se
nepovedlo aktivovat, protože došlo k chybě: -2144927141. Další informace najdete
v protokolu Microsoft-Windows-TWinUI/Operational.

Error - 20.11.2015 19:28:12 | Computer Name = Tonda | Source = Microsoft-Windows-Immersive-Shell | ID = 5973
Description = Aplikaci Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy!App se
nepovedlo aktivovat, protože došlo k chybě: -2144927141. Další informace najdete
v protokolu Microsoft-Windows-TWinUI/Operational.

Error - 20.11.2015 19:28:12 | Computer Name = Tonda | Source = Microsoft-Windows-Immersive-Shell | ID = 5973
Description = Aplikaci Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy!App se
nepovedlo aktivovat, protože došlo k chybě: -2144927141. Další informace najdete
v protokolu Microsoft-Windows-TWinUI/Operational.

Error - 20.11.2015 19:28:13 | Computer Name = Tonda | Source = Microsoft-Windows-Immersive-Shell | ID = 5973
Description = Aplikaci Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUI se nepovedlo
aktivovat, protože došlo k chybě: -2144927141. Další informace najdete v protokolu
Microsoft-Windows-TWinUI/Operational.

[ System Events ]
Error - 08.12.2015 14:11:58 | Computer Name = Tonda | Source = disk | ID = 262151
Description = Zařízení \Device\Harddisk2\DR4 má chybný blok.

Error - 08.12.2015 14:11:58 | Computer Name = Tonda | Source = disk | ID = 262151
Description = Zařízení \Device\Harddisk2\DR4 má chybný blok.

Error - 08.12.2015 14:11:58 | Computer Name = Tonda | Source = disk | ID = 262151
Description = Zařízení \Device\Harddisk2\DR4 má chybný blok.

Error - 08.12.2015 14:11:58 | Computer Name = Tonda | Source = disk | ID = 262151
Description = Zařízení \Device\Harddisk2\DR4 má chybný blok.

Error - 08.12.2015 14:11:59 | Computer Name = Tonda | Source = disk | ID = 262151
Description = Zařízení \Device\Harddisk2\DR4 má chybný blok.

Error - 08.12.2015 14:11:59 | Computer Name = Tonda | Source = disk | ID = 262151
Description = Zařízení \Device\Harddisk2\DR4 má chybný blok.

Error - 08.12.2015 14:11:59 | Computer Name = Tonda | Source = disk | ID = 262151
Description = Zařízení \Device\Harddisk2\DR4 má chybný blok.

Error - 08.12.2015 14:11:59 | Computer Name = Tonda | Source = disk | ID = 262151
Description = Zařízení \Device\Harddisk2\DR4 má chybný blok.

Error - 08.12.2015 14:12:00 | Computer Name = Tonda | Source = disk | ID = 262151
Description = Zařízení \Device\Harddisk2\DR4 má chybný blok.

Error - 08.12.2015 14:12:00 | Computer Name = Tonda | Source = disk | ID = 262151
Description = Zařízení \Device\Harddisk2\DR4 má chybný blok.


< End of report >

Uživatelský avatar
jerabina
člen Security týmu
Level 6
Level 6
Příspěvky: 3647
Registrován: březen 13
Bydliště: Litoměřice
Pohlaví: Muž
Stav:
Offline

Re: Prosím o kontrolu logu

Příspěvekod jerabina » 21 úno 2016 11:08

Poklepej na ikonu OTL na ploše. Ujisti se , že máš všechny ostatní aplikace a prohlížeče zavřeny.
Pod Vlastní skenování/opravy do okénka vlož následující text, zobrazený zeleně:

Kód: Vybrat vše

:OTL
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\System32\blank.htm
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE:64bit: - HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %11%\blank.htm
IE - HKCU\..\SearchScopes,DefaultScope = {012E1000-F331-11DB-8314-0800200C9A66}
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
[2015.07.30 07:02:54 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Tonda\AppData\Roaming\Mozilla\Firefox\extensions
[2015.07.30 07:02:54 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Tonda\AppData\Roaming\Mozilla\Firefox\extensions\staged
[2016.02.18 16:54:43 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Tonda\AppData\Roaming\Mozilla\Firefox\Profiles\BIfP54uG.default\extensions
[2016.02.18 17:33:21 | 000,875,387 | ---- | M] () (No name found) --
O13 - gopher Prefix: missing
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.


:Files
C:\WINDOWS\System32\*.tmp
C:\WINDOWS\*.tmp
C:\WINDOWS\system32\*.tmp.dll
C:\WINDOWS\System32\dllcache\*.tmp
C:\WINDOWS\system32\SET*.tmp
C:\WINDOWS\system32\DUMP*.tmp
c:\windows\Tasks\*.job /s
C:\*.tmp
C:\WINDOWS\System32\drivers\*.tmp
C:\Program Files\*.tmp
C:\Documents and Settings\All Users\Data aplikací\*.tmp
C:\Windows\SysNative\drivers\*.tmp
C:\Windows\SysWow64\drivers\*.tmp
C:\Program Files (x86)\*.tmp
C:\Windows\SysWow64\*.tmp
C:\Windows\SysNative\*.tmp
C:\Program Files (x86)\*.tmp
C:\ProgramData\Spybot - Search & Destroy
C:\Windows\SECOH-QAD.exe
C:\Program Files\KMSpico

:Reg
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
""=""%1" %*"

:commands
[Purity]
[Emptytemp]
[Emptyjava]
[Emptyflash]
[start explorer]
[Reboot]


Poté klikni nahoře na Opravit. Nech program nerušeně běžet, na konci se provede restart PC.
Po restartu se objeví log , prosím zkopíruj sem celý jeho obsah.
Když nevíš jak dál, přichází na řadu prostudovat manuál!
HJT návod

Pokud neodpovídám do vašich témat v sekci HJT když jsem online, tak je to jen proto, že jsem na mobilu kde je studování logů a psaní skriptů nemožné. Neberte to tedy prosím jako ignoraci.


Zpět na “HiJackThis”

Kdo je online

Uživatelé prohlížející si toto fórum: Žádní registrovaní uživatelé a 118 hostů