Kontrola logu Vyřešeno

[jaro3]

Zavři ostatní aplikace a prohlížeče, odpoj se od netu a fixni v HJT:
Návod

Kód: Vybrat vše

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = %11%\blank.htm
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F2 - REG:system.ini: UserInit=

V možnostech složky si povol zobrazování skrytých souborů a složek+ odškrtni zatržítko skrýt chráněné soubory operačního systému

Toto otestuj na Virustotal
C:\Users\PC\AppData\Local\Ohbsics\lbhqikpc.dll


Klikni vpravo od okénka na Vybrat a v Exploreru najdi požadovaný soubor v Tvém PC. Označ ho myší a klikni na Otevřít , poté klikni na Send File. Pokud už byl soubor testován , objeví se okno ve kterém klikni na Reanalyze. Soubor se začne postupně testovat více antivirovými programy. Až skončí test posledního antiviru , objeví se nahoře result a červeně počet nákaz , např. 0/43 , nebo 1/43. Pak zkopíruj myší odkaz na tuto stránku a vlož ji do svého příspěvku.

Nebo na:
http://www.virscan.org/

[Reklama]

[volvo1971]

Omlouvám se za pozdní reakci. Udělal jsem vše, jak jste mi řekl, ale soubor lbhqikpc.dll se mi neukázal.. ukázal se mi pouze lbhqikpc.lck , tak jsem ho oskenoval, zde je odkaz : https://www.virustotal.com/cs/file/d49d ... 456732714/

[jaro3]

Stáhni si z některého odkazu SystemLook
SystemLook (32-bit)
http://jpshortstuff.247fixes.com/SystemLook.exe

SystemLook (64-bit)
http://jpshortstuff.247fixes.com/SystemLook_x64.exe

a ulož si ho na plochu.

Poklepej na stažený SystemLook , zkopíruj do hlavního text. okna tento následující text:

Kód: Vybrat vše

:filefind
lbhqikpc.dll.*
lbhqikpc.*


Klikni na Look ke startu skenu. Když program skončí objeví se v poznámkovém bloku zpráva skenu. Zkopíruj sem celý jeho obsah. Log se také nachází na ploše pod názvem SystemLook.txt.

[volvo1971]

SystemLook 30.07.11 by jpshortstuff
Log created at 09:27 on 29/02/2016 by PC
Administrator - Elevation successful

========== filefind ==========

Searching for "lbhqikpc.dll.*"
No files found.

Searching for "lbhqikpc.*"
C:\Users\PC\AppData\Local\Ohbsics\lbhqikpc.lck --a---- 61972 bytes [11:29 16/01/2016] [11:29 16/01/2016] 8AEF8AAE58F30E04B0784DD586CE44CC
C:\Users\PC\AppData\Roaming\Microsoft\Windows\Recent\lbhqikpc.lck.lnk --a---- 944 bytes [07:55 29/02/2016] [07:58 29/02/2016] F6139555F2EC0759FCBD38FF85719AB5

-= EOF =-

[volvo1971]

Prosím vás, vymazal jsem historii v google chromu, měl jsem u toho stránku vítejte na facebooku, odstranil jsem celou historii chtěl jsem se přihlásit a na mobil mi vždy příjde kod, přišel mi kod, ale eset mi napsal něco s trojským koněm...... nepřihlásil jsem se na fb, může to být tím, že jsem měl zaplý fb a zrovna jsem vymazal historii , např. nějaká chyba? Mám teď strach, že se mi někdo např. dostane na fb, internetové bankovnictví apod.... když tak koukám do karantény, tak to tam je https://ctrlv.cz/1Csc když to dalo do karantény, je to v pohodě nebo ne?.. děkuji moc..

[volvo1971]

https://ctrlv.cz/4wcn píše mi, že to můžu dát do karantény, ale vždyť to tam už je, ne ?

[volvo1971]

Pro jistotu dávám log... Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 14:05:47, on 29.02.2016
Platform: Unknown Windows (WinNT 6.02.1008)
MSIE: Internet Explorer v11.0 (11.00.10586.0020)


Boot mode: Normal

Running processes:
C:\Users\PC\AppData\Local\Microsoft\OneDrive\OneDrive.exe
C:\Program Files (x86)\Gaming Keyboard\Monitor.EXE
C:\Program Files (x86)\Gaming Keyboard\OSD.exe
C:\Users\PC\Downloads\HijackThis.exe
C:\Windows\SysWOW64\DllHost.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/p/?LinkId=255141
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/p/?LinkId=255141
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/p/?LinkId=255141
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\amd64\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [VICTORY Gaming Keyboard] "C:\Program Files (x86)\Gaming Keyboard\Monitor.exe"
O4 - HKCU\..\Run: [OneDrive] "C:\Users\PC\AppData\Local\Microsoft\OneDrive\OneDrive.exe" /background
O4 - HKCU\..\Run: [Otmics] C:\Windows\SysWOW64\regsvr32.exe C:\Users\PC\AppData\Local\Ohbsics\lbhqikpc.dll
O4 - HKCU\..\Run: [Steam] "E:\Steam\steam.exe" -silent
O4 - HKCU\..\Run: [CCleaner Monitoring] "C:\Program Files\CCleaner\CCleaner64.exe" /MONITOR
O4 - HKUS\S-1-5-19\..\Run: [OneDriveSetup] C:\Windows\SysWOW64\OneDriveSetup.exe /thfirstsetup (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [OneDriveSetup] C:\Windows\SysWOW64\OneDriveSetup.exe /thfirstsetup (User 'NETWORK SERVICE')
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O15 - Trusted Zone: http://help.eset.com (HKLM)
O15 - ESC Trusted Zone: http://help.eset.com (HKLM)
O18 - Protocol: tbauth - {14654CA6-5711-491D-B89A-58E571679951} - C:\Windows\SysWOW64\tbauth.dll
O18 - Protocol: windows.tbauth - {14654CA6-5711-491D-B89A-58E571679951} - C:\Windows\SysWOW64\tbauth.dll
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: AMD External Events Utility - Unknown owner - C:\Windows\system32\atiesrxx.exe (file missing)
O23 - Service: AMD FUEL Service - Advanced Micro Devices, Inc. - C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe
O23 - Service: AODService - Unknown owner - C:\Program Files (x86)\AMD\OverDrive\AODAssist.exe
O23 - Service: BattlEye Service (BEService) - Unknown owner - C:\Program Files (x86)\Common Files\BattlEye\BEService.exe
O23 - Service: @%SystemRoot%\system32\DiagSvcs\DiagnosticsHub.StandardCollector.ServiceRes.dll,-1000 (diagnosticshub.standardcollector.service) - Unknown owner - C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe (file missing)
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: ESET Service (ekrn) - ESET - C:\Program Files\ESET\ESET Smart Security\ekrn.exe
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: Služba Google Update (gupdate) (gupdate) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Služba Google Update (gupdatem) (gupdatem) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: @%SystemRoot%\system32\ieetwcollectorres.dll,-1000 (IEEtwCollectorService) - Unknown owner - C:\Windows\system32\IEEtwCollector.exe (file missing)
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: MBAMService - Malwarebytes - C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Origin Client Service - Electronic Arts - E:\Origin\OriginClientService.exe
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\SensorDataService.exe,-101 (SensorDataService) - Unknown owner - C:\Windows\System32\SensorDataService.exe (file missing)
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files (x86)\Common Files\Steam\SteamService.exe
O23 - Service: @%SystemRoot%\system32\TieringEngineService.exe,-702 (TieringEngineService) - Unknown owner - C:\Windows\system32\TieringEngineService.exe (file missing)
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%ProgramFiles%\Windows Defender\MpAsDesc.dll,-320 (WdNisSvc) - Unknown owner - C:\Program Files (x86)\Windows Defender\NisSrv.exe (file missing)
O23 - Service: @%ProgramFiles%\Windows Defender\MpAsDesc.dll,-310 (WinDefend) - Unknown owner - C:\Program Files (x86)\Windows Defender\MsMpEng.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--
End of file - 7032 bytes

[jaro3]

Zavři ostatní aplikace a prohlížeče, odpoj se od netu a fixni v HJT:
Návod

Kód: Vybrat vše

O4 - HKCU\..\Run: [Otmics] C:\Windows\SysWOW64\regsvr32.exe C:\Users\PC\AppData\Local\Ohbsics\lbhqikpc.dll


C:\Users\PC\AppData\Local\Ohbsics\lbhqikpc.lck
C:\Users\PC\AppData\Roaming\Microsoft\Windows\Recent\lbhqikpc.lck.lnk
tohle smažeme v FRST

Prosím stáhni příslušnou verzi programu pro Tvůj systém 32-bit/64-bit FarbarRecovery Scan Tool (FrSt)
32bit.:
http://www.bleepingcomputer.com/downloa ... ool/dl/81/
64bit.:
http://www.bleepingcomputer.com/downloa ... ool/dl/82/
a ulož jej na plochu. ,pak spusť FrSt.
Potvrď způsob užití.
Neměň žádné z výchozích nastavení a klikni na položku „Scan“ („Skenovat“) .Když je skenování dokončeno, ukážou se dva logy = FRST.txt a Addition.txt a uloží se na ploše.Prosím zkopíruj sem celý jejich obsah.

[volvo1971]

Půjdu to udělat, ale předem se chci zeptat, co je Frst?

[volvo1971]

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version:27-02-2016
Ran by PC (administrator) on DESKTOP-TLFI1DH (29-02-2016 16:54:21)
Running from C:\Users\PC\Downloads
Loaded Profiles: PC (Available Profiles: PC & Administrator)
Platform: Windows 10 Pro Version 1511 (X64) Language: Čeština (Česká republika)
Internet Explorer Version 11 (Default browser: Chrome)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/33 ... scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(ESET) C:\Program Files\ESET\ESET Smart Security\ekrn.exe
(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Advanced Micro Devices, Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
() C:\Program Files (x86)\Gaming Keyboard\Monitor.EXE
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
() C:\Program Files (x86)\Gaming Keyboard\OSD.exe
(Piriform Ltd) C:\Program Files\CCleaner\CCleaner64.exe
(ESET) C:\Program Files\ESET\ESET Smart Security\egui.exe
() C:\Program Files\WindowsApps\Microsoft.Windows.Photos_16.201.11370.0_x64__8wekyb3d8bbwe\Microsoft.Photos.exe
(Microsoft Corporation) C:\Windows\ImmersiveControlPanel\SystemSettings.exe
(ESET) C:\Program Files\ESET\ESET Smart Security\eOPPFrame.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe


==================== Registry (Whitelisted) ===========================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\amd64\CLIStart.exe [767176 2015-11-04] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [VICTORY Gaming Keyboard] => C:\Program Files (x86)\Gaming Keyboard\Monitor.exe [270336 2013-04-09] ()
HKU\S-1-5-21-2147877735-359279648-2659264140-1001\...\Run: [Steam] => E:\Steam\steam.exe [3014224 2016-02-04] (Valve Corporation)
HKU\S-1-5-21-2147877735-359279648-2659264140-1001\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [8590760 2015-12-08] (Piriform Ltd)
HKU\S-1-5-21-2147877735-359279648-2659264140-1001\...\MountPoints2: {794d799f-da67-11e5-9479-14dae95240b1} - "D:\Startme.exe"
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => No File

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Tcpip\Parameters: [DhcpNameServer] 213.46.172.37 213.46.172.36
Tcpip\..\Interfaces\{c00a372b-7e15-403b-9780-691d14cb2757}: [DhcpNameServer] 213.46.172.37 213.46.172.36

Internet Explorer:
==================
SearchScopes: HKU\S-1-5-21-2147877735-359279648-2659264140-1001 -> {012E1000-F331-11DB-8314-0800200C9A66} URL = hxxp://www.google.com/search?q={searchTerms}

Edge:
======
Edge HomeButtonPage: HKU\S-1-5-21-2147877735-359279648-2659264140-1001 -> hxxp://google.cz/

FireFox:
========
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.29.5\npGoogleUpdate3.dll [2016-02-02] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.29.5\npGoogleUpdate3.dll [2016-02-02] (Google Inc.)

Chrome:
=======
CHR Profile: C:\Users\PC\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Prezentace Google) - C:\Users\PC\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2016-02-23]
CHR Extension: (Dokumenty Google) - C:\Users\PC\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2016-02-23]
CHR Extension: (Disk Google) - C:\Users\PC\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2016-02-23]
CHR Extension: (YouTube) - C:\Users\PC\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2016-02-23]
CHR Extension: (Vyhledávání Google) - C:\Users\PC\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2016-02-23]
CHR Extension: (Tabulky Google) - C:\Users\PC\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2016-02-23]
CHR Extension: (Dokumenty Google offline) - C:\Users\PC\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2016-02-24]
CHR Extension: (AdBlock) - C:\Users\PC\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2016-02-23]
CHR Extension: (Platby Internetového obchodu Chrome) - C:\Users\PC\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2016-02-23]
CHR Extension: (Gmail) - C:\Users\PC\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2016-02-23]

==================== Services (Whitelisted) ========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [351944 2015-11-04] (Advanced Micro Devices, Inc.)
S2 AODService; C:\Program Files (x86)\AMD\OverDrive\AODAssist.exe [137584 2014-09-19] ()
S3 BEService; C:\Program Files (x86)\Common Files\BattlEye\BEService.exe [1290784 2016-01-08] ()
R2 ekrn; C:\Program Files\ESET\ESET Smart Security\ekrn.exe [2522616 2015-11-20] (ESET)
S2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [1135416 2015-10-05] (Malwarebytes)
S3 Origin Client Service; E:\Origin\OriginClientService.exe [2104840 2016-02-13] (Electronic Arts)
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [364464 2015-10-30] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [24864 2015-10-30] (Microsoft Corporation)

===================== Drivers (Whitelisted) ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 AODDriver4.3; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys [59616 2014-02-11] (Advanced Micro Devices)
R2 AODDriver4.3.0; C:\Program Files (x86)\AMD\OverDrive\amd64\AODDriver2.sys [60104 2014-09-19] (Advanced Micro Devices)
R3 AtiHDAudioService; C:\Windows\system32\drivers\AtihdWT6.sys [102912 2015-07-21] (Advanced Micro Devices)
R1 eamonm; C:\Windows\System32\DRIVERS\eamonm.sys [263528 2015-11-20] (ESET)
S0 eelam; C:\Windows\System32\DRIVERS\eelam.sys [14976 2015-11-20] (ESET)
R1 ehdrv; C:\Windows\system32\DRIVERS\ehdrv.sys [186784 2015-11-20] (ESET)
R2 ekbdflt; C:\Windows\system32\DRIVERS\ekbdflt.sys [142976 2015-11-20] (ESET)
R1 epfw; C:\Windows\system32\DRIVERS\epfw.sys [206312 2015-11-20] (ESET)
R1 EpfwLWF; C:\Windows\system32\DRIVERS\EpfwLWF.sys [52872 2015-11-20] (ESET)
R0 epfwwfp; C:\Windows\System32\DRIVERS\epfwwfp.sys [69840 2015-11-20] (ESET)
S3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2015-10-05] (Malwarebytes)
S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [64216 2015-10-05] (Malwarebytes Corporation)
R3 MTsensor; C:\Windows\system32\DRIVERS\ASACPI.sys [17280 2013-05-17] ()
R3 rt640x64; C:\Windows\System32\drivers\rt640x64.sys [589824 2015-10-30] (Realtek )
S3 WdBoot; C:\Windows\system32\drivers\WdBoot.sys [44568 2015-10-30] (Microsoft Corporation)
S3 WdFilter; C:\Windows\system32\drivers\WdFilter.sys [293216 2015-10-30] (Microsoft Corporation)
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [118112 2015-10-30] (Microsoft Corporation)
S1 bpgehonb; \??\C:\Windows\system32\drivers\bpgehonb.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2016-02-29 16:54 - 2016-02-29 16:54 - 00008807 _____ C:\Users\PC\Downloads\FRST.txt
2016-02-29 16:54 - 2016-02-29 16:54 - 00000000 ____D C:\FRST
2016-02-29 16:52 - 2016-02-29 16:54 - 02371072 _____ (Farbar) C:\Users\PC\Downloads\FRST64.exe
2016-02-29 16:45 - 2016-02-29 16:46 - 01722368 _____ (Farbar) C:\Users\PC\Downloads\FRST.exe
2016-02-29 12:22 - 2016-02-29 12:22 - 00001171 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2016-02-29 12:21 - 2016-02-29 12:21 - 22908888 _____ (Malwarebytes ) C:\Users\PC\Downloads\mbam-setup-2.2.0.1024.exe
2016-02-29 09:27 - 2016-02-29 09:27 - 00001084 _____ C:\Users\PC\Desktop\SystemLook.txt
2016-02-29 09:23 - 2016-02-29 09:24 - 00165376 _____ C:\Users\PC\Desktop\SystemLook_x64.exe
2016-02-29 08:51 - 2016-02-29 16:49 - 00000000 ____D C:\Users\PC\Downloads\backups
2016-02-29 08:48 - 2016-02-29 08:50 - 00388608 _____ (Trend Micro Inc.) C:\Users\PC\Downloads\HijackThis.exe
2016-02-29 08:25 - 2016-02-29 08:25 - 00000000 ___HD C:\OneDriveTemp
2016-02-28 21:22 - 2016-02-28 22:58 - 1687214868 _____ C:\Users\PC\Downloads\Mysli-taky-jako-chlap-(2014)-CZ.avi
2016-02-28 19:59 - 2016-02-28 19:59 - 00009771 _____ C:\Users\PC\Downloads\Happz.cfg
2016-02-28 15:12 - 2016-02-28 15:12 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information
2016-02-28 15:12 - 2016-02-28 15:12 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Gaming Keyboard
2016-02-28 15:12 - 2016-02-28 15:12 - 00000000 ____D C:\Program Files (x86)\Gaming Keyboard
2016-02-28 15:11 - 2016-02-28 15:11 - 04686155 _____ C:\Users\PC\Downloads\ci-147-battle-keyboard-software.zip
2016-02-28 15:11 - 2016-02-28 15:11 - 00455600 _____ (Macrovision Corporation) C:\Users\PC\Desktop\setup.exe
2016-02-28 15:04 - 2016-02-28 15:06 - 00000000 ____D C:\Users\PC\Documents\Assassin's Creed III
2016-02-28 14:40 - 2016-02-28 15:03 - 00000122 _____ C:\Users\PC\Desktop\Nový textový dokument.txt
2016-02-28 14:05 - 2016-02-28 14:05 - 00000232 _____ C:\Users\PC\Desktop\Assassin's Creed III.url
2016-02-28 14:05 - 2016-02-28 14:05 - 00000232 _____ C:\Users\PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Assassin's Creed III.url
2016-02-26 19:19 - 2016-02-26 19:19 - 00106098 _____ C:\Users\PC\Downloads\facebook-100009582282784.zip
2016-02-26 18:32 - 2016-02-26 18:32 - 02968213 _____ C:\Users\PC\Downloads\battle-wallpapers.zip
2016-02-26 18:32 - 2016-02-26 18:32 - 00000000 ____D C:\Users\PC\AppData\LocalLow\Temp
2016-02-26 14:33 - 2016-02-26 14:33 - 00000000 ___RD C:\Users\PC\3D Objects
2016-02-26 14:25 - 2016-02-26 14:25 - 00000000 ____H C:\Windows\system32\Drivers\Msft_User_WpdMtpDr_01_11_00.Wdf
2016-02-24 18:43 - 2016-02-29 16:53 - 00000000 ____D C:\Users\PC\AppData\Local\CrashDumps
2016-02-24 05:39 - 2016-02-29 08:21 - 00000000 ____D C:\Users\PC\AppData\Local\VirtualStore
2016-02-23 21:20 - 2016-02-23 21:20 - 00000000 ____D C:\Users\PC\AppData\Local\PeerDistRepub
2016-02-23 20:58 - 2016-02-23 20:58 - 00000000 ____D C:\Users\PC\AppData\Local\ActiveSync
2016-02-23 20:52 - 2016-02-23 20:42 - 00024064 _____ C:\Windows\zoek-delete.exe
2016-02-23 20:42 - 2016-02-23 20:51 - 00000000 ____D C:\zoek_backup
2016-02-23 18:30 - 2016-02-23 20:28 - 00028272 _____ C:\Windows\system32\Drivers\TrueSight.sys
2016-02-23 18:30 - 2016-02-23 18:30 - 00000000 ____D C:\ProgramData\RogueKiller
2016-02-23 15:05 - 2016-02-23 15:05 - 00000000 ____D C:\Users\PC\Desktop\kioshima
2016-02-23 15:03 - 2016-02-29 09:26 - 00000000 ____D C:\Users\PC\Desktop\pyth
2016-02-23 15:03 - 2016-02-23 15:03 - 00000000 ____D C:\Users\PC\Desktop\friberg
2016-02-23 14:36 - 2016-02-23 14:36 - 00000000 ____D C:\Users\PC\Desktop\cfg
2016-02-23 14:08 - 2016-02-23 14:08 - 01298434 _____ C:\Users\PC\Downloads\simple radar.rar
2016-02-23 14:03 - 2016-02-29 12:24 - 00192216 _____ (Malwarebytes) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2016-02-23 14:00 - 2016-02-29 12:22 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2016-02-23 14:00 - 2016-02-29 12:22 - 00000000 ____D C:\Program Files (x86)\Malwarebytes Anti-Malware
2016-02-23 14:00 - 2016-02-23 14:00 - 00000000 ____D C:\ProgramData\Malwarebytes
2016-02-23 14:00 - 2015-10-05 09:50 - 00109272 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbamchameleon.sys
2016-02-23 14:00 - 2015-10-05 09:50 - 00064216 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2016-02-23 14:00 - 2015-10-05 09:50 - 00025816 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbam.sys
2016-02-23 13:50 - 2016-02-23 13:50 - 00000000 ____D C:\AdwCleaner
2016-02-23 13:49 - 2016-02-23 13:50 - 01511936 _____ C:\Users\PC\Desktop\adwcleaner_5.036.exe
2016-02-22 21:43 - 2016-02-26 15:02 - 00000000 ____D C:\Users\PC\Desktop\svatba
2016-02-15 17:28 - 2016-02-15 17:28 - 00000000 ____D C:\Users\PC\AppData\Local\ESET
2016-02-15 17:27 - 2016-02-15 17:27 - 00002100 _____ C:\Users\Public\Desktop\ESET Ochrana bankovnictví a online plateb.lnk
2016-02-15 17:27 - 2016-02-15 17:27 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ESET
2016-02-15 17:27 - 2016-02-15 17:27 - 00000000 ____D C:\ProgramData\ESET
2016-02-15 17:27 - 2016-02-15 17:27 - 00000000 ____D C:\Program Files\ESET
2016-02-15 16:22 - 2016-02-15 16:22 - 02861880 _____ (ESET) C:\Users\PC\Downloads\eset_smart_security_live_installer_.exe
2016-02-14 09:22 - 2016-02-14 09:22 - 00002291 _____ C:\Users\PC\Downloads\csgo_bananagaming.7z
2016-02-14 09:16 - 2016-02-14 09:16 - 00699192 _____ C:\Users\PC\Downloads\de_overpass_radar.dds
2016-02-14 09:16 - 2016-02-14 09:16 - 00699192 _____ C:\Users\PC\Downloads\de_mirage_radar.dds
2016-02-14 09:16 - 2016-02-14 09:16 - 00699192 _____ C:\Users\PC\Downloads\de_inferno_radar.dds
2016-02-14 09:16 - 2016-02-14 09:16 - 00699192 _____ C:\Users\PC\Downloads\de_dust2_radar.dds
2016-02-14 09:16 - 2016-02-14 09:16 - 00699192 _____ C:\Users\PC\Downloads\de_cbble_radar.dds
2016-02-13 17:26 - 2016-02-21 09:00 - 00002260 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2016-02-13 16:15 - 2016-02-13 16:15 - 00000000 ____D C:\Users\PC\Documents\Criterion Games
2016-02-13 16:13 - 2016-02-13 17:32 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Need for Speed™ Most Wanted
2016-02-13 15:59 - 2016-02-14 10:28 - 00000000 ____D C:\Users\PC\AppData\Roaming\Origin
2016-02-13 15:59 - 2016-02-13 16:00 - 00000000 ____D C:\Users\PC\AppData\Local\Origin
2016-02-13 15:57 - 2016-02-14 17:13 - 00000000 ____D C:\ProgramData\Origin
2016-02-13 15:57 - 2016-02-13 16:15 - 00000000 ____D C:\ProgramData\Electronic Arts
2016-02-13 15:57 - 2016-02-13 15:57 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Origin
2016-02-10 17:02 - 2016-01-29 07:57 - 04502352 _____ (Microsoft Corporation) C:\Windows\explorer.exe
2016-02-10 17:02 - 2016-01-29 07:33 - 04064320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\explorer.exe
2016-02-10 17:02 - 2016-01-27 07:15 - 01557776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll
2016-02-10 17:02 - 2016-01-27 07:15 - 01542816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2016-02-10 17:02 - 2016-01-27 07:01 - 07476064 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2016-02-10 17:02 - 2016-01-27 07:01 - 01997328 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2016-02-10 17:02 - 2016-01-27 07:01 - 01819720 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2016-02-10 17:02 - 2016-01-27 06:59 - 00304752 _____ (Microsoft Corporation) C:\Windows\system32\systemreset.exe
2016-02-10 17:02 - 2016-01-27 06:57 - 02919320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2016-02-10 17:02 - 2016-01-27 06:57 - 01824264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\combase.dll
2016-02-10 17:02 - 2016-01-27 06:57 - 00820704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WinTypes.dll
2016-02-10 17:02 - 2016-01-27 06:56 - 21124344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2016-02-10 17:02 - 2016-01-27 06:55 - 05242496 _____ (Microsoft Corporation) C:\Windows\SysWOW64\windows.storage.dll
2016-02-10 17:02 - 2016-01-27 06:55 - 00081112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\OpenWith.exe
2016-02-10 17:02 - 2016-01-27 06:54 - 00295264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2016-02-10 17:02 - 2016-01-27 06:46 - 02606824 _____ (Microsoft Corporation) C:\Windows\system32\combase.dll
2016-02-10 17:02 - 2016-01-27 06:46 - 01270072 _____ (Microsoft Corporation) C:\Windows\system32\WinTypes.dll
2016-02-10 17:02 - 2016-01-27 06:45 - 22564328 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2016-02-10 17:02 - 2016-01-27 06:45 - 06605544 _____ (Microsoft Corporation) C:\Windows\system32\windows.storage.dll
2016-02-10 17:02 - 2016-01-27 06:44 - 00604928 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys
2016-02-10 17:02 - 2016-01-27 06:44 - 00085320 _____ (Microsoft Corporation) C:\Windows\system32\OpenWith.exe
2016-02-10 17:02 - 2016-01-27 06:43 - 00359776 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2016-02-10 17:02 - 2016-01-27 06:37 - 01998176 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgkrnl.sys
2016-02-10 17:02 - 2016-01-27 06:37 - 00576352 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgmms2.sys
2016-02-10 17:02 - 2016-01-27 06:21 - 00162816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msorcl32.dll
2016-02-10 17:02 - 2016-01-27 06:15 - 00031232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ztrace_maps.dll
2016-02-10 17:02 - 2016-01-27 06:11 - 00118272 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mtxoci.dll
2016-02-10 17:02 - 2016-01-27 06:10 - 22394368 _____ (Microsoft Corporation) C:\Windows\system32\edgehtml.dll
2016-02-10 17:02 - 2016-01-27 06:08 - 00299008 _____ (Microsoft Corporation) C:\Windows\system32\microsoft-windows-system-events.dll
2016-02-10 17:02 - 2016-01-27 06:08 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\ztrace_maps.dll
2016-02-10 17:02 - 2016-01-27 06:07 - 00203264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iassam.dll
2016-02-10 17:02 - 2016-01-27 06:05 - 19339776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2016-02-10 17:02 - 2016-01-27 06:05 - 18678272 _____ (Microsoft Corporation) C:\Windows\SysWOW64\edgehtml.dll
2016-02-10 17:02 - 2016-01-27 06:05 - 00052224 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2016-02-10 17:02 - 2016-01-27 06:04 - 09918976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\twinui.dll
2016-02-10 17:02 - 2016-01-27 06:04 - 00147456 _____ (Microsoft Corporation) C:\Windows\system32\mtxoci.dll
2016-02-10 17:02 - 2016-01-27 06:02 - 00109056 _____ (Microsoft Corporation) C:\Windows\system32\hlink.dll
2016-02-10 17:02 - 2016-01-27 06:01 - 00792064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2016-02-10 17:02 - 2016-01-27 05:59 - 00258048 _____ (Microsoft Corporation) C:\Windows\system32\iassam.dll
2016-02-10 17:02 - 2016-01-27 05:58 - 11545088 _____ (Microsoft Corporation) C:\Windows\system32\twinui.dll
2016-02-10 17:02 - 2016-01-27 05:55 - 12125696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2016-02-10 17:02 - 2016-01-27 05:55 - 03666432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2016-02-10 17:02 - 2016-01-27 05:54 - 24603136 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2016-02-10 17:02 - 2016-01-27 05:52 - 00970752 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2016-02-10 17:02 - 2016-01-27 05:50 - 02230784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2016-02-10 17:02 - 2016-01-27 05:50 - 01504768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2016-02-10 17:02 - 2016-01-27 05:50 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxdav.sys
2016-02-10 17:02 - 2016-01-27 05:49 - 05662208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Chakra.dll
2016-02-10 17:02 - 2016-01-27 05:48 - 13382656 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2016-02-10 17:02 - 2016-01-27 05:44 - 00063488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cfgbkend.dll
2016-02-10 17:02 - 2016-01-27 05:42 - 01387520 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2016-02-10 17:02 - 2016-01-27 05:41 - 03592704 _____ (Microsoft Corporation) C:\Windows\system32\win32kfull.sys
2016-02-10 17:02 - 2016-01-27 05:39 - 02275328 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll
2016-02-10 17:02 - 2016-01-27 05:38 - 07835648 _____ (Microsoft Corporation) C:\Windows\system32\Chakra.dll
2016-02-10 17:02 - 2016-01-27 05:38 - 01734656 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2016-02-10 17:02 - 2016-01-27 05:37 - 04894720 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2016-02-10 17:02 - 2016-01-27 05:36 - 02757120 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2016-02-10 17:02 - 2016-01-27 05:31 - 00079360 _____ (Microsoft Corporation) C:\Windows\system32\cfgbkend.dll
2016-02-10 17:01 - 2016-01-27 06:13 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininetlui.dll
2016-02-10 17:01 - 2016-01-27 06:12 - 00045568 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2016-02-10 17:01 - 2016-01-27 06:10 - 00099840 _____ (Microsoft Corporation) C:\Windows\SysWOW64\hlink.dll
2016-02-10 17:01 - 2016-01-27 06:05 - 00069632 _____ (Microsoft Corporation) C:\Windows\system32\wininetlui.dll
2016-02-10 17:01 - 2016-01-27 06:03 - 00099328 _____ (Microsoft Corporation) C:\Windows\system32\ngckeyenum.dll
2016-02-10 17:01 - 2016-01-27 05:57 - 00764928 _____ (Microsoft Corporation) C:\Windows\system32\Chakradiag.dll
2016-02-10 17:01 - 2016-01-27 05:32 - 01087488 _____ (Microsoft Corporation) C:\Windows\system32\reseteng.dll
2016-02-07 20:40 - 2016-02-23 18:25 - 00000000 ____D C:\Program Files (x86)\SpeedFan
2016-02-07 20:13 - 2016-02-23 18:07 - 00000045 _____ C:\Windows\SysWOW64\initdebug.nfo
2016-02-07 09:14 - 2016-02-07 09:14 - 00001274 _____ C:\Users\PC\Desktop\Uplay.lnk
2016-02-07 09:14 - 2016-02-07 09:14 - 00000000 ____D C:\Users\PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Ubisoft
2016-02-07 09:14 - 2016-02-07 09:14 - 00000000 ____D C:\Program Files (x86)\Ubisoft
2016-02-07 09:10 - 2016-02-07 09:59 - 00000000 ____D C:\Users\PC\Documents\Assassin's Creed IV Black Flag
2016-02-07 08:58 - 2016-02-07 08:58 - 66007832 _____ (Ubisoft) C:\Users\PC\Downloads\UplayInstaller.exe
2016-02-06 10:56 - 2016-02-06 10:56 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AMD Catalyst Control Center
2016-02-06 10:56 - 2016-02-06 10:56 - 00000000 ____D C:\ProgramData\ATI
2016-02-06 10:56 - 2016-02-06 10:56 - 00000000 ____D C:\Program Files\ATI Technologies
2016-02-06 10:55 - 2016-02-06 10:56 - 00000000 ____D C:\Program Files (x86)\ATI Technologies
2016-02-06 10:55 - 2016-02-06 10:55 - 00000000 ____D C:\Users\Default\AppData\Roaming\ATI
2016-02-06 10:55 - 2016-02-06 10:55 - 00000000 ____D C:\Users\Default\AppData\Local\ATI
2016-02-06 10:55 - 2016-02-06 10:55 - 00000000 ____D C:\Users\Default User\AppData\Roaming\ATI
2016-02-06 10:55 - 2016-02-06 10:55 - 00000000 ____D C:\Users\Default User\AppData\Local\ATI
2016-02-05 07:03 - 2016-02-28 08:34 - 00000000 ____D C:\Users\PC\Desktop\Nová složka
2016-01-31 16:34 - 2016-01-31 16:34 - 00000000 ____D C:\Users\PC\AppData\LocalLow\WARTEAM

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2016-02-29 16:52 - 2015-10-30 08:24 - 00000000 ____D C:\Windows\system32\NDF
2016-02-29 16:48 - 2016-01-16 16:21 - 00000000 ____D C:\Users\PC\AppData\Roaming\TS3Client
2016-02-29 15:59 - 2016-01-16 14:43 - 00000992 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2016-02-29 11:55 - 2016-01-23 09:30 - 00000000 ____D C:\Users\PC\BrawlhallaReplays
2016-02-29 08:25 - 2016-01-16 14:43 - 00000988 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2016-02-29 08:25 - 2016-01-16 12:04 - 00000000 ___RD C:\Users\PC\OneDrive
2016-02-29 08:24 - 2016-01-16 11:52 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2016-02-29 08:23 - 2016-01-16 12:01 - 00000000 ____D C:\Users\PC
2016-02-29 08:23 - 2015-10-30 07:28 - 00262144 ___SH C:\Windows\system32\config\BBI
2016-02-28 15:10 - 2015-10-30 08:11 - 00000000 ____D C:\Windows\CbsTemp
2016-02-28 13:47 - 2016-01-16 12:21 - 00004204 _____ C:\Windows\System32\Tasks\User_Feed_Synchronization-{5EDB5663-4A5D-4386-8AA6-556BFCE679DF}
2016-02-28 13:44 - 2016-01-23 08:56 - 00000000 ____D C:\Users\PC\AppData\Local\ElevatedDiagnostics
2016-02-27 12:39 - 2016-01-16 12:01 - 01683934 _____ C:\Windows\system32\PerfStringBackup.INI
2016-02-27 12:39 - 2015-10-30 19:31 - 00715612 _____ C:\Windows\system32\perfh005.dat
2016-02-27 12:39 - 2015-10-30 19:31 - 00142874 _____ C:\Windows\system32\perfc005.dat
2016-02-27 12:39 - 2015-10-30 08:21 - 00000000 ____D C:\Windows\INF
2016-02-27 07:52 - 2015-10-30 08:24 - 00000000 ____D C:\Windows\AppReadiness
2016-02-26 05:31 - 2015-10-30 08:24 - 00000000 ___HD C:\Program Files\WindowsApps
2016-02-25 22:14 - 2016-01-16 15:09 - 00000000 ____D C:\Users\PC\Desktop\darin
2016-02-23 20:51 - 2015-10-30 08:24 - 00000000 ___HD C:\Windows\system32\GroupPolicy
2016-02-21 09:00 - 2016-01-16 14:43 - 00002272 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2016-02-15 18:29 - 2016-01-16 12:18 - 00000000 ____D C:\Program Files (x86)\Microsoft Toolkit Final
2016-02-15 17:34 - 2016-01-16 12:23 - 00000000 ____D C:\Users\PC\AppData\Local\Ohbsics
2016-02-15 17:28 - 2015-10-30 08:24 - 00000000 ___HD C:\Windows\ELAMBKUP
2016-02-15 16:36 - 2016-01-16 15:30 - 00000000 ____D C:\ProgramData\AVAST Software
2016-02-12 14:10 - 2015-10-30 08:24 - 00000000 ____D C:\Windows\rescache
2016-02-11 18:14 - 2016-01-16 12:04 - 00002378 _____ C:\Users\PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OneDrive.lnk
2016-02-10 22:00 - 2016-01-16 12:01 - 00000000 __RHD C:\Users\Public\AccountPictures
2016-02-10 21:58 - 2015-10-30 19:35 - 00000000 ____D C:\Program Files\Windows Journal
2016-02-10 19:10 - 2016-01-16 15:14 - 00000000 ____D C:\Windows\system32\MRT
2016-02-10 19:06 - 2016-01-16 15:14 - 146614896 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2016-02-07 09:14 - 2016-01-23 08:40 - 00000000 ____D C:\Users\PC\AppData\Local\Ubisoft Game Launcher
2016-02-06 10:56 - 2016-01-16 12:04 - 00000000 ____D C:\ProgramData\AMD
2016-02-06 10:54 - 2016-01-16 12:03 - 00000000 ____D C:\AMD
2016-02-03 20:01 - 2015-10-30 08:26 - 00828920 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2016-02-03 20:01 - 2015-10-30 08:26 - 00176632 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2016-02-02 19:54 - 2016-01-16 14:43 - 00004050 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2016-02-02 19:54 - 2016-01-16 14:43 - 00003818 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2016-02-01 20:13 - 2016-01-16 14:15 - 00000000 ____D C:\Users\PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Steam

==================== Bamital & volsnap =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\dnsapi.dll => File is digitally signed
C:\Windows\SysWOW64\dnsapi.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2016-02-19 12:39

==================== End of FRST.txt ============================

[volvo1971]

Additional scan result of Farbar Recovery Scan Tool (x64) Version:27-02-2016
Ran by PC (2016-02-29 16:55:18)
Running from C:\Users\PC\Downloads
Windows 10 Pro Version 1511 (X64) (2016-01-16 10:57:04)
Boot Mode: Normal
==========================================================


==================== Accounts: =============================

Administrator (S-1-5-21-2147877735-359279648-2659264140-500 - Administrator - Disabled) => C:\Users\Administrator
DefaultAccount (S-1-5-21-2147877735-359279648-2659264140-503 - Limited - Disabled)
Guest (S-1-5-21-2147877735-359279648-2659264140-501 - Limited - Disabled)
PC (S-1-5-21-2147877735-359279648-2659264140-1001 - Administrator - Enabled) => C:\Users\PC

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: ESET Smart Security 9.0.351.2 (Enabled - Up to date) {19259FAE-8396-A113-46DB-15B0E7DFA289}
AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: ESET Smart Security 9.0.351.2 (Enabled - Up to date) {A2447E4A-A5AC-AE9D-7C6B-2EC29C58E834}
FW: ESET Personální firewall (Enabled) {211E1E8B-C9F9-A04B-6D84-BC85190CE5F2}

==================== Installed Programs ======================

(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

AMD Catalyst Control Center (HKLM-x32\...\WUCCCApp) (Version: 1.00.0000 - AMD)
AMD OverDrive (HKLM-x32\...\{EEB605FD-C5F5-4946-90F3-D65C604A9187}) (Version: 4.3.1.0698 - Advanced Micro Devices, Inc.)
Assassin's Creed III (HKLM-x32\...\Uplay Install 54) (Version: - Ubisoft)
Assassin's Creed IV Black Flag (HKLM-x32\...\Uplay Install 273) (Version: - Ubisoft)
Brawlhalla (HKLM-x32\...\Steam App 291550) (Version: - Blue Mammoth Games)
CCleaner (HKLM\...\CCleaner) (Version: 5.13 - Piriform)
Counter-Strike: Global Offensive (HKLM-x32\...\Steam App 730) (Version: - Valve)
CPUID HWMonitor 1.28 (HKLM\...\CPUID HWMonitor_is1) (Version: - )
ESET Smart Security (HKLM\...\{E8EA6A18-4085-4E67-AC9C-F8E9AEB53F4F}) (Version: 9.0.351.2 - ESET, spol. s r.o.)
Gaming Keyboard Driver (HKLM-x32\...\{B3CDED64-7DC2-429D-A325-BBC3CF793AA6}) (Version: 1.0 - Senbiz)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 48.0.2564.116 - Google Inc.)
Google Update Helper (x32 Version: 1.3.21.169 - Google Inc.) Hidden
Google Update Helper (x32 Version: 1.3.29.5 - Google Inc.) Hidden
Malwarebytes Anti-Malware verze 2.2.0.1024 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.2.0.1024 - Malwarebytes)
Microsoft Games for Windows - LIVE Redistributable (HKLM-x32\...\{832D9DE0-8AFC-4689-9819-4DBBDEBD3E4F}) (Version: 3.5.92.0 - Microsoft Corporation)
Microsoft Games for Windows Marketplace (HKLM-x32\...\{67F42018-F647-4D3C-BE62-F8CB4FE2FCD5}) (Version: 3.5.67.0 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.50727 (HKLM-x32\...\{15134cb0-b767-4960-a911-f2d16ae54797}) (Version: 11.0.50727.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.50727 (HKLM-x32\...\{22154f09-719a-4619-bb71-5b3356999fbf}) (Version: 11.0.50727.1 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (HKLM-x32\...\{050d4fc8-5d48-4b8f-8972-47c82c46020f}) (Version: 12.0.30501.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 (HKLM-x32\...\{f65db027-aff3-4070-886a-0d87064aabb1}) (Version: 12.0.30501.0 - Microsoft Corporation)
Need for Speed™ Most Wanted (HKLM-x32\...\{FB0127F3-985B-44CE-AE29-378CAF60B361}) (Version: 1.5.0.0 - Electronic Arts)
Origin (HKLM-x32\...\Origin) (Version: 9.11.6.18139 - Electronic Arts, Inc.)
Speccy (HKLM\...\Speccy) (Version: 1.29 - Piriform)
Steam (HKLM-x32\...\Steam) (Version: 2.10.91.91 - Valve Corporation)
Team Fortress 2 (HKLM-x32\...\Steam App 440) (Version: - Valve)
TeamSpeak 3 Client (HKU\S-1-5-21-2147877735-359279648-2659264140-1001\...\TeamSpeak 3 Client) (Version: 3.0.18 - TeamSpeak Systems GmbH)
Uplay (HKLM-x32\...\Uplay) (Version: 15.0 - Ubisoft)
WinRAR 5.30 (64-bit) (HKLM\...\WinRAR archiver) (Version: 5.30.0 - win.rar GmbH)

==================== Custom CLSID (Whitelisted): ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

CustomCLSID: HKU\S-1-5-21-2147877735-359279648-2659264140-1001_Classes\CLSID\{71DCE5D6-4B57-496B-AC21-CD5B54EB93FD}\localserver32 -> C:\Users\PC\AppData\Local\Microsoft\OneDrive\17.3.6301.0127\FileCoAuth.exe (Microsoft Corporation)

==================== Scheduled Tasks (Whitelisted) =============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

Task: {322FA739-D340-460D-BC4E-ABD8791E9662} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2015-12-08] (Piriform Ltd)
Task: {608FA6EC-4C84-4B25-AE77-834EE103A7BE} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2016-01-16] (Google Inc.)
Task: {7ADD6369-04F7-4EA4-89D0-CE11F7F83BEE} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\Windows\system32\MRT.exe [2016-02-10] (Microsoft Corporation)
Task: {BCAA8F71-0948-41C1-821C-F5FC42065F5B} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2016-01-16] (Google Inc.)

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

==================== Shortcuts =============================

(The entries could be listed to be restored or removed.)

==================== Loaded Modules (Whitelisted) ==============

2015-10-30 08:18 - 2015-10-30 08:18 - 00185856 _____ () C:\Windows\SYSTEM32\ism32k.dll
2015-11-04 16:43 - 2015-11-04 16:43 - 00214528 _____ () C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Container.PerformanceTuning.dll
2014-02-11 06:08 - 2014-02-11 06:08 - 00817152 _____ () C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Device.dll
2014-02-11 06:08 - 2014-02-11 06:08 - 03650560 _____ () C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Platform.dll
2016-01-16 15:14 - 2015-11-22 11:47 - 02653816 _____ () C:\Windows\system32\CoreUIComponents.dll
2016-01-16 15:14 - 2015-11-22 11:47 - 02653816 _____ () C:\Windows\System32\CoreUIComponents.dll
2016-02-28 15:12 - 2013-04-09 12:13 - 00270336 _____ () C:\Program Files (x86)\Gaming Keyboard\Monitor.EXE
2015-11-04 16:43 - 2015-11-04 16:43 - 00102400 _____ () C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Proxy.Native.dll
2016-02-28 15:12 - 2013-01-09 11:47 - 00151552 _____ () C:\Program Files (x86)\Gaming Keyboard\OSD.exe
2015-12-08 20:25 - 2015-12-08 20:25 - 00047616 _____ () C:\Program Files\CCleaner\lang\lang-1029.dll
2016-01-16 15:12 - 2015-12-07 05:14 - 00093696 _____ () C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\Windows.UI.Shell.SharedUtilities.dll
2016-01-16 15:12 - 2015-12-07 05:00 - 00472064 _____ () C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\QuickActions.dll
2016-02-05 06:01 - 2016-02-05 06:02 - 00015872 _____ () C:\Program Files\WindowsApps\Microsoft.Windows.Photos_16.201.11370.0_x64__8wekyb3d8bbwe\Microsoft.Photos.exe
2016-02-05 06:01 - 2016-02-05 06:02 - 14869504 _____ () C:\Program Files\WindowsApps\Microsoft.Windows.Photos_16.201.11370.0_x64__8wekyb3d8bbwe\Microsoft.Photos.dll
2016-01-16 12:42 - 2016-01-16 12:42 - 00258560 _____ () C:\Program Files\WindowsApps\Microsoft.Windows.Photos_16.201.11370.0_x64__8wekyb3d8bbwe\StoreRatingPromotion.dll
2015-10-30 08:18 - 2015-10-30 08:18 - 00218456 _____ () c:\windows\system32\WerEtw.dll
2016-01-16 15:14 - 2016-01-05 02:29 - 07992832 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\CortanaApi.dll
2016-01-16 15:13 - 2016-01-05 02:23 - 00591360 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.Core.dll
2016-01-28 17:45 - 2016-01-16 06:10 - 02483200 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.BackgroundTask.dll
2016-01-28 17:45 - 2016-01-16 06:13 - 04089856 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\RemindersUI.dll
2016-02-28 15:12 - 2012-11-05 08:09 - 00057344 _____ () C:\Program Files (x86)\Gaming Keyboard\lan.dll
2016-02-28 15:12 - 2012-11-05 08:37 - 00061440 _____ () C:\Program Files (x86)\Gaming Keyboard\hiddriver.dll
2016-02-21 09:00 - 2016-02-18 05:14 - 01630360 _____ () C:\Program Files (x86)\Google\Chrome\Application\48.0.2564.116\libglesv2.dll
2016-02-21 09:00 - 2016-02-18 05:14 - 00085656 _____ () C:\Program Files (x86)\Google\Chrome\Application\48.0.2564.116\libegl.dll
2016-02-21 09:00 - 2016-02-18 05:15 - 16808600 _____ () C:\Program Files (x86)\Google\Chrome\Application\48.0.2564.116\PepperFlash\pepflashplayer.dll

==================== Alternate Data Streams (Whitelisted) =========

(If an entry is included in the fixlist, only the ADS will be removed.)


==================== Safe Mode (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== EXE Association (Whitelisted) ===============

(If an entry is included in the fixlist, the registry item will be restored to default or removed.)


==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, it will be removed from the registry.)


==================== Hosts content: ===============================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2015-10-30 08:24 - 2016-02-23 20:43 - 00000753 ____A C:\Windows\system32\Drivers\etc\hosts


127.0.0.1 localhost

==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-2147877735-359279648-2659264140-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\PC\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper
DNS Servers: 213.46.172.37 - 213.46.172.36
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
Windows Firewall is enabled.

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)


==================== FirewallRules (Whitelisted) ===============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

FirewallRules: [vm-monitoring-nb-session] => (Allow) LPort=139
FirewallRules: [{6C077B25-F33E-4336-B48E-C202E3BC5C23}] => (Allow) E:\Steam\Steam.exe
FirewallRules: [{FF7C2DE6-5192-414B-85D7-E5B55F8F7EF8}] => (Allow) E:\Steam\Steam.exe
FirewallRules: [{A7398395-E6E1-43E3-A04F-0807A7C3BE99}] => (Allow) E:\Steam\bin\steamwebhelper.exe
FirewallRules: [{8DED3437-D15A-4C6D-B6E1-6908186D703B}] => (Allow) E:\Steam\bin\steamwebhelper.exe
FirewallRules: [{B9056E6E-CA2C-48E3-B73B-BF036F18A840}] => (Allow) E:\Steam\steamapps\common\Counter-Strike Global Offensive\csgo.exe
FirewallRules: [{6650AB54-C413-4ADA-8FC9-DFDB42804123}] => (Allow) E:\Steam\steamapps\common\Counter-Strike Global Offensive\csgo.exe
FirewallRules: [{1AC5F25A-0115-4DCC-B62A-4D015FAD8ED3}] => (Allow) E:\Steam\steamapps\common\Brawlhalla\Brawlhalla.exe
FirewallRules: [{B9F3ED67-9FF6-437A-A260-A969AAB8B5E3}] => (Allow) E:\Steam\steamapps\common\Brawlhalla\Brawlhalla.exe
FirewallRules: [{B90E7A91-4EBC-4735-B1BE-55F789350680}] => (Allow) E:\Steam\steamapps\common\Team Fortress 2\hl2.exe
FirewallRules: [{7730EBF0-C825-44FC-99B2-0847413EC659}] => (Allow) E:\Steam\steamapps\common\Team Fortress 2\hl2.exe
FirewallRules: [{B3476180-21B1-4D6C-8619-1EB8872495A9}] => (Allow) E:\Ubisoft Game Launcher\games\Assassin's Creed IV Black Flag\AC4BFSP.exe
FirewallRules: [{A3A701AB-86B7-48CD-81A8-1A128B2FE6A3}] => (Allow) E:\Ubisoft Game Launcher\games\Assassin's Creed IV Black Flag\AC4BFSP.exe
FirewallRules: [{3913A8EE-5403-47A0-A1BA-735A260E66D8}] => (Allow) E:\Ubisoft Game Launcher\games\Assassin's Creed IV Black Flag\AC4BFMP.exe
FirewallRules: [{9B9E3679-15E1-41C2-B22E-ED2B2E3F07B4}] => (Allow) E:\Ubisoft Game Launcher\games\Assassin's Creed IV Black Flag\AC4BFMP.exe
FirewallRules: [{A4E40247-8086-4925-9CA1-9DFFE2473223}] => (Allow) E:\Program Files (x86)\Origin Games\Need for Speed(TM) Most Wanted\NFS13.exe
FirewallRules: [{764D0E86-3EA6-440F-A044-EB2319EC1AB8}] => (Allow) E:\Program Files (x86)\Origin Games\Need for Speed(TM) Most Wanted\NFS13.exe
FirewallRules: [{E91B2885-1FB9-4839-9157-2F3FE2408B65}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
FirewallRules: [{4E2549C3-68F3-4700-AC9B-7AA1CD6F4305}] => (Allow) E:\Ubisoft Game Launcher\games\Assassin's Creed III\AC3SP.exe
FirewallRules: [{1EE586F4-612B-4759-9CC4-F6386ACD327D}] => (Allow) E:\Ubisoft Game Launcher\games\Assassin's Creed III\AC3SP.exe
FirewallRules: [{4265C840-312D-405F-826F-E6F8167E41B3}] => (Allow) E:\Ubisoft Game Launcher\games\Assassin's Creed III\AC3MP.exe
FirewallRules: [{6AE98A3B-70E9-4621-8B9B-AE72283C6D9E}] => (Allow) E:\Ubisoft Game Launcher\games\Assassin's Creed III\AC3MP.exe

==================== Restore Points =========================

23-02-2016 20:42:43 zoek.exe restore point
28-02-2016 15:04:16 Nainstalováno rozhraní DirectX

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (02/29/2016 04:53:49 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Název chybující aplikace: SearchUI.exe, verze: 10.0.10586.63, časové razítko: 0x568b1fdc
Název chybujícího modulu: Windows.UI.Xaml.dll, verze: 10.0.10586.71, časové razítko: 0x5699d8e0
Kód výjimky: 0xc000027b
Posun chyby: 0x00000000006fce8b
ID chybujícího procesu: 0x794
Čas spuštění chybující aplikace: 0xSearchUI.exe0
Cesta k chybující aplikaci: SearchUI.exe1
Cesta k chybujícímu modulu: SearchUI.exe2
ID zprávy: SearchUI.exe3
Úplný název chybujícího balíčku: SearchUI.exe4
ID aplikace související s chybujícím balíčkem: SearchUI.exe5

Error: (02/29/2016 04:52:47 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Název chybující aplikace: csgo.exe, verze: 0.0.0.0, časové razítko: 0x5653d523
Název chybujícího modulu: tier0.dll, verze: 0.0.0.0, časové razítko: 0x5653d3d1
Kód výjimky: 0xc0000005
Posun chyby: 0x000093c4
ID chybujícího procesu: 0xc6c
Čas spuštění chybující aplikace: 0xcsgo.exe0
Cesta k chybující aplikaci: csgo.exe1
Cesta k chybujícímu modulu: csgo.exe2
ID zprávy: csgo.exe3
Úplný název chybujícího balíčku: csgo.exe4
ID aplikace související s chybujícím balíčkem: csgo.exe5

Error: (02/29/2016 04:38:46 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Název chybující aplikace: SearchUI.exe, verze: 10.0.10586.63, časové razítko: 0x568b1fdc
Název chybujícího modulu: Windows.UI.Xaml.dll, verze: 10.0.10586.71, časové razítko: 0x5699d8e0
Kód výjimky: 0xc000027b
Posun chyby: 0x00000000006fce8b
ID chybujícího procesu: 0x8d4
Čas spuštění chybující aplikace: 0xSearchUI.exe0
Cesta k chybující aplikaci: SearchUI.exe1
Cesta k chybujícímu modulu: SearchUI.exe2
ID zprávy: SearchUI.exe3
Úplný název chybujícího balíčku: SearchUI.exe4
ID aplikace související s chybujícím balíčkem: SearchUI.exe5

Error: (02/29/2016 02:05:52 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Název chybující aplikace: SearchUI.exe, verze: 10.0.10586.63, časové razítko: 0x568b1fdc
Název chybujícího modulu: Windows.UI.Xaml.dll, verze: 10.0.10586.71, časové razítko: 0x5699d8e0
Kód výjimky: 0xc000027b
Posun chyby: 0x00000000006fce8b
ID chybujícího procesu: 0x1284
Čas spuštění chybující aplikace: 0xSearchUI.exe0
Cesta k chybující aplikaci: SearchUI.exe1
Cesta k chybujícímu modulu: SearchUI.exe2
ID zprávy: SearchUI.exe3
Úplný název chybujícího balíčku: SearchUI.exe4
ID aplikace související s chybujícím balíčkem: SearchUI.exe5

Error: (02/29/2016 01:10:55 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Název chybující aplikace: SearchUI.exe, verze: 10.0.10586.63, časové razítko: 0x568b1fdc
Název chybujícího modulu: Windows.UI.Xaml.dll, verze: 10.0.10586.71, časové razítko: 0x5699d8e0
Kód výjimky: 0xc000027b
Posun chyby: 0x00000000006fce8b
ID chybujícího procesu: 0x1578
Čas spuštění chybující aplikace: 0xSearchUI.exe0
Cesta k chybující aplikaci: SearchUI.exe1
Cesta k chybujícímu modulu: SearchUI.exe2
ID zprávy: SearchUI.exe3
Úplný název chybujícího balíčku: SearchUI.exe4
ID aplikace související s chybujícím balíčkem: SearchUI.exe5

Error: (02/29/2016 11:24:54 AM) (Source: Perflib) (EventID: 1008) (User: )
Description: BITSC:\Windows\System32\bitsperf.dll8

Error: (02/29/2016 11:13:01 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Název chybující aplikace: SearchUI.exe, verze: 10.0.10586.63, časové razítko: 0x568b1fdc
Název chybujícího modulu: Windows.UI.Xaml.dll, verze: 10.0.10586.71, časové razítko: 0x5699d8e0
Kód výjimky: 0xc000027b
Posun chyby: 0x00000000006fce8b
ID chybujícího procesu: 0xd20
Čas spuštění chybující aplikace: 0xSearchUI.exe0
Cesta k chybující aplikaci: SearchUI.exe1
Cesta k chybujícímu modulu: SearchUI.exe2
ID zprávy: SearchUI.exe3
Úplný název chybujícího balíčku: SearchUI.exe4
ID aplikace související s chybujícím balíčkem: SearchUI.exe5

Error: (02/29/2016 08:56:55 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Název chybující aplikace: SearchUI.exe, verze: 10.0.10586.63, časové razítko: 0x568b1fdc
Název chybujícího modulu: Windows.UI.Xaml.dll, verze: 10.0.10586.71, časové razítko: 0x5699d8e0
Kód výjimky: 0xc000027b
Posun chyby: 0x00000000006fce8b
ID chybujícího procesu: 0x51c
Čas spuštění chybující aplikace: 0xSearchUI.exe0
Cesta k chybující aplikaci: SearchUI.exe1
Cesta k chybujícímu modulu: SearchUI.exe2
ID zprávy: SearchUI.exe3
Úplný název chybujícího balíčku: SearchUI.exe4
ID aplikace související s chybujícím balíčkem: SearchUI.exe5

Error: (02/29/2016 08:25:18 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Název chybující aplikace: SearchUI.exe, verze: 10.0.10586.63, časové razítko: 0x568b1fdc
Název chybujícího modulu: Windows.UI.Xaml.dll, verze: 10.0.10586.71, časové razítko: 0x5699d8e0
Kód výjimky: 0xc000027b
Posun chyby: 0x00000000006fce8b
ID chybujícího procesu: 0xe30
Čas spuštění chybující aplikace: 0xSearchUI.exe0
Cesta k chybující aplikaci: SearchUI.exe1
Cesta k chybujícímu modulu: SearchUI.exe2
ID zprávy: SearchUI.exe3
Úplný název chybujícího balíčku: SearchUI.exe4
ID aplikace související s chybujícím balíčkem: SearchUI.exe5

Error: (02/28/2016 11:19:38 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Název chybující aplikace: SearchUI.exe, verze: 10.0.10586.63, časové razítko: 0x568b1fdc
Název chybujícího modulu: Windows.UI.Xaml.dll, verze: 10.0.10586.71, časové razítko: 0x5699d8e0
Kód výjimky: 0xc000027b
Posun chyby: 0x00000000006fce8b
ID chybujícího procesu: 0x4c0
Čas spuštění chybující aplikace: 0xSearchUI.exe0
Cesta k chybující aplikaci: SearchUI.exe1
Cesta k chybujícímu modulu: SearchUI.exe2
ID zprávy: SearchUI.exe3
Úplný název chybujícího balíčku: SearchUI.exe4
ID aplikace související s chybujícím balíčkem: SearchUI.exe5


System errors:
=============
Error: (02/29/2016 04:48:23 PM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: specifické pro aplikaciMístníAktivace{D63B10C5-BB46-4990-A94F-E40B9D520160}{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}NT AUTHORITYSYSTEMS-1-5-18LocalHost (pomocí LRPC)Není k dispoziciNení k dispozici

Error: (02/29/2016 02:04:48 PM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: specifické pro aplikaciMístníAktivace{D63B10C5-BB46-4990-A94F-E40B9D520160}{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}NT AUTHORITYSYSTEMS-1-5-18LocalHost (pomocí LRPC)Není k dispoziciNení k dispozici

Error: (02/29/2016 10:45:31 AM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: specifické pro aplikaciMístníAktivace{D63B10C5-BB46-4990-A94F-E40B9D520160}{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}NT AUTHORITYSYSTEMS-1-5-18LocalHost (pomocí LRPC)Není k dispoziciNení k dispozici

Error: (02/29/2016 08:23:20 AM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Služba Hostitel synchronizace_58136ba byla nečekaně ukončena. Stalo se to 1 krát. Následující opravná akce bude spuštěna za 10000 milisekund: Restartovat službu.

Error: (02/29/2016 08:23:20 AM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: specifické pro aplikaciMístníAktivace{D63B10C5-BB46-4990-A94F-E40B9D520160}{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}NT AUTHORITYSYSTEMS-1-5-18LocalHost (pomocí LRPC)Není k dispoziciNení k dispozici

Error: (02/28/2016 11:21:55 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Při čekání na připojení služby Hostitel synchronizace_41b911b bylo dosaženo časového limitu (30000 ms).

Error: (02/28/2016 11:21:45 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Služba Hostitel synchronizace_41b911b byla nečekaně ukončena. Stalo se to 1 krát. Následující opravná akce bude spuštěna za 10000 milisekund: Restartovat službu.

Error: (02/28/2016 11:21:43 PM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: specifické pro aplikaciMístníAktivace{D63B10C5-BB46-4990-A94F-E40B9D520160}{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}NT AUTHORITYSYSTEMS-1-5-18LocalHost (pomocí LRPC)Není k dispoziciNení k dispozici

Error: (02/28/2016 03:11:32 PM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: specifické pro aplikaciMístníAktivace{D63B10C5-BB46-4990-A94F-E40B9D520160}{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}NT AUTHORITYSYSTEMS-1-5-18LocalHost (pomocí LRPC)Není k dispoziciNení k dispozici

Error: (02/28/2016 03:10:30 PM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: specifické pro aplikaciMístníAktivace{D63B10C5-BB46-4990-A94F-E40B9D520160}{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}NT AUTHORITYSYSTEMS-1-5-18LocalHost (pomocí LRPC)Není k dispoziciNení k dispozici


CodeIntegrity:
===================================
Date: 2016-02-29 08:26:40.206
Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\Program Files\ESET\ESET Smart Security\Drivers\ehdrv\ehdrv.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

Date: 2016-02-29 08:26:40.080
Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\Program Files\ESET\ESET Smart Security\Drivers\ehdrv\ehdrv.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

Date: 2016-02-29 08:26:39.931
Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\eelam.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

Date: 2016-02-29 08:26:39.858
Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\eelam.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

Date: 2016-02-29 08:26:39.779
Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\Program Files\ESET\ESET Smart Security\Drivers\eelam\eelam.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

Date: 2016-02-29 08:25:59.488
Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\Program Files\ESET\ESET Smart Security\Drivers\eelam\eelam.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

Date: 2016-02-23 20:56:29.044
Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\Program Files\ESET\ESET Smart Security\Drivers\ehdrv\ehdrv.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

Date: 2016-02-23 20:56:28.923
Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\Program Files\ESET\ESET Smart Security\Drivers\ehdrv\ehdrv.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

Date: 2016-02-23 20:56:28.792
Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\eelam.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

Date: 2016-02-23 20:56:28.735
Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\eelam.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.


==================== Memory info ===========================

Processor: AMD Phenom(tm) II X4 965 Processor
Percentage of memory in use: 50%
Total physical RAM: 4094.11 MB
Available physical RAM: 2022.3 MB
Total Virtual: 5950.11 MB
Available Virtual: 3463.67 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:97.66 GB) (Free:49.62 GB) NTFS
Drive e: () (Fixed) (Total:368.01 GB) (Free:237.3 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or (Size: 465.8 GB) (Disk ID: 91B2CDBE)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=97.7 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=368 GB) - (Type=07 NTFS)

==================== End of Addition.txt ============================

[jerabina]

Prosím, postupuj následujícím způsobem:
Otevřít poznámkový blok (Start => Všechny programy => Příslušenství => Poznámkový blok).
Prosím, zkopíruj do něj celý obsah níže.

Kód: Vybrat vše

Start
CloseProcesses:

HKU\S-1-5-21-2147877735-359279648-2659264140-1001\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [8590760 2015-12-08] (Piriform Ltd)
HKU\S-1-5-21-2147877735-359279648-2659264140-1001\...\MountPoints2: {794d799f-da67-11e5-9479-14dae95240b1} - "D:\Startme.exe"
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => No File

FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.29.5\npGoogleUpdate3.dll [2016-02-02] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.29.5\npGoogleUpdate3.dll [2016-02-02] (Google Inc.)

C:\ProgramData\RogueKiller

Task: {608FA6EC-4C84-4B25-AE77-834EE103A7BE} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2016-01-16] (Google Inc.)
Task: {BCAA8F71-0948-41C1-821C-F5FC42065F5B} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2016-01-16] (Google Inc.)
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

C:\Program Files (x86)\Google\Update

EmptyTemp:
End

(Můžeš použít funkci „vybrat vše“, klepni pravým tlačítkem myši na levé horní políčko v otevřeném poznámkovém bloku a zvol „ Vložit“).

Ulož jej na na plochu jako fixlist.txt

Spusťt FRST a stiskni tlačítko „Fix“ (Opravit) jen jednou a čekej.
Nástroj vypracuje log na ploše (Fixlog.txt), prosím zkopíruj sem celý jeho obsah.

V možnostech složky si povol zobrazování skrytých souborů a složek+ odškrtni zatržítko skrýt chráněné soubory operačního systému.

Toto otestuj na Virustotal
C:\Windows\system32\drivers\bpgehonb.sys

Klikni vpravo od okénka na Vybrat a v Exploreru najdi požadovaný soubor v Tvém PC. Označ ho myší a klikni na Otevřít , poté klikni na Send File. Pokud už byl soubor testován , objeví se okno ve kterém klikni na Reanalyze. Soubor se začne postupně testovat více antivirovými programy. Až skončí test posledního antiviru , objeví se nahoře result a červeně počet nákaz , např. 0/43 , nebo 1/43. Pak zkopíruj myší odkaz na tuto stránku a vlož ji do svého příspěvku.