Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 09-09-2026
Ran by linco (administrator) on DESKTOP-J0PJPO6 (ASUSTeK COMPUTER INC. FX502VE) (13-09-2026 11:55:48)
Running from C:\Users\linco\OneDrive\Počítač\FRST64.exe
Loaded Profiles: defaultuser0 & linco
Platform: Microsoft Windows 10 Home Version 22H2 19045.7725 (X64) Language: Čeština (Česká republika) -> Slovenčina (Slovensko)
Default browser: Brave
Boot Mode: Normal

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(24803D75-212C-471A-BC57-9EF86AB91435 -> ) C:\Program Files\WindowsApps\5319275A.WhatsAppDesktop_2.2635.100.0_x64__cv1g1gvanyjgm\WhatsApp.Root.exe
(Brave Software, Inc. -> BraveSoftware Inc.) C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe
(C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe ->) (Brave Software, Inc. -> BraveSoftware Inc.) C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\BraveCrashHandler.exe
(C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe ->) (Brave Software, Inc. -> BraveSoftware Inc.) C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\BraveCrashHandler64.exe
(C:\Program Files (x86)\Intel\Driver and Support Assistant\x86\DSAService.exe ->) (Intel Corporation -> Intel) C:\Program Files (x86)\Intel\Driver and Support Assistant\x86\DSATray.exe
(C:\Program Files\AVAST Software\Suite\AvastSvc.exe ->) (Gen Digital Inc. -> Gen Digital Inc.) C:\Program Files\AVAST Software\Suite\aswEngSrv.exe
(C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe ->) (NVIDIA Corporation -> NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NVIDIA App\CEF\NVIDIA Overlay.exe
(C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe ->) (NVIDIA Corporation -> NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NVIDIA App\ShadowPlay\nvsphelper64.exe
(C:\Program Files\WindowsApps\5319275A.WhatsAppDesktop_2.2635.100.0_x64__cv1g1gvanyjgm\WhatsApp.Root.exe ->) (Microsoft Corporation -> Microsoft Corporation) C:\Program Files (x86)\Microsoft\EdgeWebView\Application\152.0.4191.66\msedgewebview2.exe
(D:\Steam\steam.exe ->) (Valve Corp. -> Valve Corporation) D:\Steam\bin\cef\cef.win64\steamwebhelper.exe
(DriverStore\FileRepository\cui_dch.inf_amd64_b787c039819e9d91\igfxCUIService.exe ->) (Intel Corporation -> Intel Corporation) C:\Windows\System32\DriverStore\FileRepository\cui_dch.inf_amd64_b787c039819e9d91\igfxEM.exe
(Gen Digital Inc. -> Gen Digital Inc.) C:\Program Files\AVAST Software\Suite\AvastUI.exe <4>
(Gen Digital Inc. -> Gen Digital Inc.) C:\Program Files\AVAST Software\Suite\bgapp.exe
(Intel\DPTF\esif_uf.exe ->) (Intel Corporation -> Intel Corporation) C:\Windows\Temp\DPTF\esif_assist_64.exe
(Microsoft Corporation -> Microsoft Corporation) C:\Program Files (x86)\Microsoft\EdgeWebView\Application\152.0.4191.66\msedgewebview2.exe <11>
(nordvpn s.a. -> NordVPN) C:\Program Files\NordVPN\NordVPN.exe
(NVIDIA Corporation -> NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe <3>
(NVIDIA Corporation -> NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NVIDIA App\CEF\NVIDIA Overlay.exe <4>
(NVIDIA Corporation -> NVIDIA Corporation) C:\Windows\System32\DriverStore\FileRepository\nvami.inf_amd64_e30f053f80c001f3\Display.NvContainer\NVDisplay.Container.exe
(services.exe ->) (ASUSTeK COMPUTER INC. -> ASUSTek Computer Inc.) C:\Windows\System32\DriverStore\FileRepository\asusptpfilter.inf_amd64_7c6805cea91175e4\AsusPTPService.exe
(services.exe ->) (Avast Software s.r.o. -> AVAST Software) C:\Program Files\AVAST Software\Suite\wsc_proxy.exe
(services.exe ->) (Gen Digital Inc. -> Gen Digital Inc.) C:\Program Files\AVAST Software\Suite\afwServ.exe
(services.exe ->) (Gen Digital Inc. -> Gen Digital Inc.) C:\Program Files\AVAST Software\Suite\aswidsagent.exe
(services.exe ->) (Gen Digital Inc. -> Gen Digital Inc.) C:\Program Files\AVAST Software\Suite\aswToolsSvc.exe
(services.exe ->) (Gen Digital Inc. -> Gen Digital Inc.) C:\Program Files\AVAST Software\Suite\AvastSvc.exe
(services.exe ->) (Gen Digital Inc. -> Gen Digital Inc.) C:\Program Files\AVAST Software\Suite\bgsvc.exe
(services.exe ->) (Gen Digital Inc. -> Gen Digital Inc.) C:\Program Files\AVAST Software\Suite\DriverUpdSvc.exe
(services.exe ->) (Gen Digital Inc. -> Gen Digital Inc.) C:\Program Files\AVAST Software\Suite\TuneupSvc.exe
(services.exe ->) (Gen Digital Inc. -> Gen Digital Inc.) C:\Program Files\AVAST Software\Suite\VpnSvc.exe
(services.exe ->) (Gen Digital Inc. -> Gen Digital Inc.) C:\Program Files\Piriform\CCleaner 7\CCleaner_service.exe
(services.exe ->) (ICEpower a/s -> ICEpower A/S) C:\Windows\System32\ICEsoundService64.exe
(services.exe ->) (Intel Corporation - pGFX -> Intel Corporation) C:\Windows\System32\Intel\DPTF\esif_uf.exe
(services.exe ->) (Intel Corporation -> Intel Corporation) C:\Windows\System32\DriverStore\FileRepository\cui_dch.inf_amd64_b787c039819e9d91\igfxCUIService.exe
(services.exe ->) (Intel Corporation -> Intel Corporation) C:\Windows\System32\DriverStore\FileRepository\dal.inf_amd64_af50fdb80983f7bc\jhi_service.exe
(services.exe ->) (Intel Corporation -> Intel Corporation) C:\Windows\System32\DriverStore\FileRepository\igcc_dch.inf_amd64_a5f2152e4806694a\OneApp.IGCC.WinService.exe
(services.exe ->) (Intel Corporation -> Intel Corporation) C:\Windows\System32\DriverStore\FileRepository\iigd_dch.inf_amd64_5579cd97fbcd455d\IntelCpHDCPSvc.exe
(services.exe ->) (Intel Corporation -> Intel Corporation) C:\Windows\System32\DriverStore\FileRepository\iigd_dch.inf_amd64_5579cd97fbcd455d\IntelCpHeciSvc.exe
(services.exe ->) (Intel Corporation -> Intel Corporation) C:\Windows\System32\DriverStore\FileRepository\mewmiprov.inf_amd64_d51901c26227fb29\WMIRegistrationService.exe
(services.exe ->) (Intel Corporation -> Intel) C:\Program Files (x86)\Intel\Driver and Support Assistant\x86\DSAService.exe
(services.exe ->) (Intel Corporation -> Intel) C:\Program Files (x86)\Intel\Driver and Support Assistant\x86\DSAUpdateService.exe
(services.exe ->) (Intel Corporation-Wireless Connectivity Solutions -> Intel Corporation) C:\Windows\System32\ibtsiva.exe
(services.exe ->) (Intel(R) Rapid Storage Technology -> Intel Corporation) C:\Windows\System32\DriverStore\FileRepository\iaahcic.inf_amd64_7ed3bacbb0a8cc67\RstMwService.exe
(services.exe ->) (Microsoft Corporation -> Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(services.exe ->) (Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\dllhost.exe
(services.exe ->) (nordvpn s.a. -> NordVPN) C:\Program Files\NordVPN\NordSec ThreatProtection\nordsec-threatprotection-service.exe
(services.exe ->) (nordvpn s.a. -> NordVPN) C:\Program Files\NordVPN\nordvpn-service.exe
(services.exe ->) (NVIDIA Corporation -> NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe
(services.exe ->) (NVIDIA Corporation -> NVIDIA Corporation) C:\Windows\System32\DriverStore\FileRepository\nvami.inf_amd64_e30f053f80c001f3\Display.NvContainer\NVDisplay.Container.exe
(services.exe ->) (Valve Corp. -> Valve Corporation) C:\Program Files (x86)\Common Files\Steam\SteamService.exe
(svchost.exe ->) (Gen Digital Inc. -> Gen Digital Inc.) C:\Program Files\Piriform\CCleaner 7\CCleaner.exe
(svchost.exe ->) (Microsoft Corporation -> Microsoft Corporation) C:\Program Files\WindowsApps\Microsoft.ZuneMusic_11.2607.16.0_x64__8wekyb3d8bbwe\Microsoft.Media.Player.exe
(svchost.exe ->) (Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\dllhost.exe
(svchost.exe ->) (Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\LocationNotificationWindows.exe
(svchost.exe ->) (Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\MoUsoCoreWorker.exe
(svchost.exe ->) (Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\smartscreen.exe
(svchost.exe ->) (Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\spaceman.exe
(Valve Corp. -> Valve Corporation) D:\Steam\bin\cef\cef.win64\steamwebhelper.exe <8>
(Valve Corp. -> Valve Corporation) D:\Steam\steam.exe

==================== Registry (Whitelisted) ===================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [Avast BreachGuard] => C:\Program Files\Avast Software\Suite\bgapp.exe [8121784 2026-08-18] (Gen Digital Inc. -> Gen Digital Inc.)
HKLM\...\Run: [AvastUI.exe] => C:\Program Files\Avast Software\Suite\AvLaunch.exe [1078200 2026-08-18] (Gen Digital Inc. -> Gen Digital Inc.)
HKLM\...\RunOnce: [msedge_cleanup_{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}] => C:\Program Files (x86)\Microsoft\Edge\Application\153.0.4234.32\Installer\setup.exe [5914952 2026-09-12] (Microsoft Corporation -> Microsoft Corporation)
HKLM\SOFTWARE\Microsoft\Windows Defender: [DisableAntiSpyware] Restriction <==== ATTENTION
HKLM\SOFTWARE\Microsoft\Windows Defender: [DisableAntiVirus] Restriction <==== ATTENTION
HKLM\SOFTWARE\Policies\Microsoft\Windows Defender: Restriction <==== ATTENTION
HKU\S-1-5-21-2298117505-976418258-3832342613-1001\...\Run: [VideoPadRunOnStartup] => C:\Program Files (x86)\NCH Software\VideoPad\videopad.exe [18811376 2025-08-08] (NCH Software, Inc. -> NCH Software)
HKU\S-1-5-21-2298117505-976418258-3832342613-1001\...\Run: [Steam] => D:\Steam\steam.exe [5775512 2026-09-03] (Valve Corp. -> Valve Corporation)
HKU\S-1-5-21-2298117505-976418258-3832342613-1001\...\Run: [NordVPN] => C:\Program Files\NordVPN\NordVPN.exe [588720 2025-04-02] (nordvpn s.a. -> NordVPN)
HKU\S-1-5-21-2298117505-976418258-3832342613-1001\...\Run: [org.whispersystems.signal-desktop] => C:\Users\linco\AppData\Local\Programs\signal-desktop\Signal.exe [238302640 2026-09-10] (Signal Messenger, LLC -> Signal Messenger, LLC)
HKU\S-1-5-21-2298117505-976418258-3832342613-1001\...\Run: [MicrosoftEdgeAutoLaunch_E80CA25EB6CBA45C8EE4426DC76AE1DD] => "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start [5417288 2026-09-10] (Microsoft Corporation -> Microsoft Corporation)
HKLM\...\Windows x64\Print Processors\Canon MG3600 series Print Processor: C:\Windows\System32\spool\prtprocs\x64\CNMPDCT.DLL [30208 2023-07-20] (Microsoft Windows Hardware Compatibility Publisher -> CANON INC.)
HKLM\...\Print\Monitors\Canon BJ Language Monitor MG3600 series: C:\Windows\system32\CNMLMCT.DLL [406528 2023-07-20] (Microsoft Windows Hardware Compatibility Publisher -> CANON INC.)
HKLM\Software\Microsoft\Active Setup\Installed Components: [{AFE6A462-C574-4B8A-AF43-4CC60DF4563B}] -> C:\Program Files\BraveSoftware\Brave-Browser\Application\153.1.95.101\Installer\chrmstp.exe [6541392 2026-09-12] (Brave Software, Inc. -> Brave Software, Inc.)
GroupPolicy-Firefox: Restriction <==== ATTENTION
HKLM\SOFTWARE\Policies\Mozilla\Firefox: Restriction <==== ATTENTION

==================== Scheduled Tasks (Whitelisted) =================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

Task: {188876BF-EDEE-4E8A-9387-CE265DA9046E} - System32\Tasks\ASUS Battery Health Charging Notification => C:\Program Files (x86)\ASUS\ASUS Battery Health Charging\BhcMgr.exe [2478776 2016-11-28] (ASUSTeK Computer Inc. -> ASUSTek Computer Inc.)
Task: {AEB63488-B184-44F6-9A95-2FD682825BE1} - System32\Tasks\ASUS USB Charger Plus => C:\Program Files (x86)\ASUS\USBChargerPlus\USBChargerPlus.exe [19967504 2016-11-14] (ASUSTeK Computer Inc. -> ASUSTek Computer Inc.)
Task: {95B6C707-EEC3-4992-9DAE-1C9189872243} - System32\Tasks\ATK Package 36D18D69AFC3 => C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\SimAppExec.exe [122552 2016-11-14] (ASUSTeK Computer Inc. -> ASUSTek Computer Inc.)
Task: {CC41892C-860D-4898-A9DB-8C98DC996881} - System32\Tasks\ATK Package A22126881260 => C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\SimAppExec.exe [122552 2016-11-14] (ASUSTeK Computer Inc. -> ASUSTek Computer Inc.)
Task: {3B350895-10DE-4667-89D1-93B0F2702070} - System32\Tasks\Avast Software\Avast Suite Patcher => C:\Program Files\Common Files\Avast Software\Icarus\avast-suite\icarus.exe [9920504 2026-08-31] (Gen Digital Inc. -> Gen Digital Inc.)
Task: {09E31EE8-C9A7-4F93-8D3B-A8173744AF15} - System32\Tasks\Avast Software\Overseer => C:\Program Files\Common Files\Avast Software\Overseer\overseer.exe [3710456 2026-09-09] (Gen Digital Inc. -> Gen Digital Inc.)
Task: {F718C56C-68F4-4A25-8EA7-88C2CE4FE323} - System32\Tasks\Avast Software\Suite Emergency Update => C:\Program Files\Avast Software\Suite\AvEmUpdate.exe [5817784 2026-08-18] (Gen Digital Inc. -> Gen Digital Inc.)
Task: {5757F8BE-F039-44FC-91B8-9C5EF64B73AE} - System32\Tasks\AvastUpdateTaskMachineCore => C:\Program Files (x86)\AVAST Software\Browser\Update\AvastBrowserUpdate.exe [193056 2025-07-21] (Avast Software s.r.o. -> Gen Digital Inc.)
Task: {281D56F6-E9D8-4954-A118-E7EFBD339E27} - System32\Tasks\AvastUpdateTaskMachineUA => C:\Program Files (x86)\AVAST Software\Browser\Update\AvastBrowserUpdate.exe [193056 2025-07-21] (Avast Software s.r.o. -> Gen Digital Inc.)
Task: {F20C9781-B428-4E9A-8920-8892411784BD} - System32\Tasks\BraveSoftwareUpdateTaskMachineCore{1A63B601-05A5-4EFB-877B-8863ACE30DC3} => C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe [167504 2026-08-13] (Brave Software, Inc. -> BraveSoftware Inc.)
Task: {5FA2A2C4-0EB7-4CBB-AD60-EEBEF0613C50} - System32\Tasks\BraveSoftwareUpdateTaskMachineCore{5D75A83D-A0B9-48A0-BBD8-5CB9470F4F68} => C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe [167504 2026-08-13] (Brave Software, Inc. -> BraveSoftware Inc.)
Task: {6CAF5655-250D-4C95-B98A-E9E756EDE374} - System32\Tasks\BraveSoftwareUpdateTaskMachineUA{67E6C4B4-2A43-4FE2-8A18-0D5AB1C0DE16} => C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe [167504 2026-08-13] (Brave Software, Inc. -> BraveSoftware Inc.)
Task: {2C8C5A34-CC5A-4E71-BACD-887FF853D46B} - System32\Tasks\BraveSoftwareUpdateTaskMachineUA{8DECBEF2-2BC5-4FA4-95B8-DB538322E5A1} => C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe [167504 2026-08-13] (Brave Software, Inc. -> BraveSoftware Inc.)
Task: {FD324855-5DD8-4A0A-935E-449A2CEC6FE8} - System32\Tasks\CCleaner 7 - Skip UAC - S-1-5-21-2298117505-976418258-3832342613-1001 => C:\Program Files\Piriform\CCleaner 7\CCleaner.exe [7286672 2026-09-07] (Gen Digital Inc. -> Gen Digital Inc.)
Task: {4DB39ECE-F046-4418-95C0-CFADD607E0FC} - System32\Tasks\IntelSURQC-Upgrade-86621605-2a0b-4128-8ffc-15514c247132 => C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\IntelSoftwareAssetManagerService.exe [6466256 2026-01-16] (Intel Corporation -> Intel Corporation)
Task: {93D1B234-F24E-4496-9A0D-1269DB00360B} - System32\Tasks\IntelSURQC-Upgrade-86621605-2a0b-4128-8ffc-15514c247132-Logon => C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\IntelSoftwareAssetManagerService.exe [6466256 2026-01-16] (Intel Corporation -> Intel Corporation)
Task: {99812A47-D735-4FD6-96AB-05945B1E6E92} - System32\Tasks\Microsoft\Office\Microsoft Office Touchless Attach Notification => C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe [3861192 2017-01-31] (Microsoft Corporation -> Microsoft Corporation)
Task: {5A63B57D-8023-4DD2-AFF3-02F08322F581} - System32\Tasks\Microsoft\Office\Office Automatic Updates => C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe [3861192 2017-01-31] (Microsoft Corporation -> Microsoft Corporation)
Task: {58F644B9-E99F-4334-9350-C9CC57FBB7E6} - System32\Tasks\Microsoft\Office\Office ClickToRun Service Monitor => C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe [3861192 2017-01-31] (Microsoft Corporation -> Microsoft Corporation)
Task: {C8B3D1C8-DC56-41A4-8F10-6002AC7DE6DE} - System32\Tasks\NVIDIA App SelfUpdate_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files\NVIDIA Corporation\NVIDIA App\CEF\NVIDIA App.exe [3324528 2025-10-15] (NVIDIA Corporation -> NVIDIA Corporation)
Task: {950F33B8-EFB1-48E4-A824-CDEE4B86F519} - System32\Tasks\Piriform\CCleaner 7 - S-1-5-21-2298117505-976418258-3832342613-1000 => C:\Program Files\Piriform\CCleaner 7\CCleaner.exe [7286672 2026-09-07] (Gen Digital Inc. -> Gen Digital Inc.)
Task: {EF1DC07B-F1DE-48B3-A169-850CFB6E41E4} - System32\Tasks\Piriform\CCleaner 7 - S-1-5-21-2298117505-976418258-3832342613-1001 => C:\Program Files\Piriform\CCleaner 7\CCleaner.exe [7286672 2026-09-07] (Gen Digital Inc. -> Gen Digital Inc.)
Task: {AFF9FDA8-9AF4-4095-B612-08984C6FF0F6} - System32\Tasks\Piriform\CCleaner 7 - Scheduled Cleaning - default - S-1-5-21-2298117505-976418258-3832342613-1001 => C:\Program Files\Piriform\CCleaner 7\CCleaner.exe [7286672 2026-09-07] (Gen Digital Inc. -> Gen Digital Inc.)
Task: {0273DB4D-44FC-45B2-911B-0156522DF7C6} - System32\Tasks\Piriform\CCleaner 7 BugReport => C:\Program Files\Piriform\CCleaner 7\CCleanerBugReport.exe [6558608 2026-09-07] (Gen Digital Inc. -> Gen Digital Inc.) -> --send "dumps|report" --product 234 --programpath "C:\Program Files\Piriform\CCleaner 7" --configpath "C:\Program Files\Piriform\CCleaner 7\data" --path "C:\Program Files\Piriform\CCleaner 7\log" --path "C:\Program Files\Piriform\CCleaner 7\data\dumps" --logpath "C:\Program Files\Piriform\CCleaner 7 (the data entry has 58 more characters).
Task: {BE060F39-105F-45E3-AE14-DC47C15337FB} - System32\Tasks\Piriform\CCleaner 7 Update => C:\Program Files\Common Files\Piriform\Icarus\piriform-ccl\icarus.exe [9274080 2026-01-19] (Gen Digital Inc. -> Gen Digital Inc.)
Task: {5B5BE701-00A8-4956-905F-D627C26FF2BF} - System32\Tasks\RtHDVBg_ListenToDevice => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [3617864 2021-09-26] (Realtek Semiconductor Corp. -> Realtek Semiconductor)
Task: {2C0CCFD1-EDA2-45A9-937C-863688139CA6} - System32\Tasks\RTKCPL => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [3617864 2021-09-26] (Realtek Semiconductor Corp. -> Realtek Semiconductor)
Task: {8BD61145-5D9A-4C0E-8517-80EA1628E6B7} - System32\Tasks\USER_ESRV_SVC_QUEENCREEK => C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe [455680 2024-01-25] (Microsoft Windows -> Microsoft Corporation) -> C:\Program Files\Intel\SUR\QUEENCREEK\x64\-Command "Start-Process -WindowStyle Hidden task.bat"
Task: {F1BF6F52-19A1-4349-A55B-CB0E78E8B23A} - System32\Tasks\WpsExternal_20161114022915 => C:\Program Files (x86)\Kingsoft\WPS Office\ksolaunch.exe  /wpscloudlaunch /wpsexternal /from=task (No File)

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

Task: C:\WINDOWS\Tasks\CreateExplorerShellUnelevatedTask.job => C:\WINDOWS\explorer.exe
Task: C:\WINDOWS\Tasks\WpsExternal_20161114022915.job => C:\Program Files (x86)\Kingsoft\WPS Office\ksolaunch.exe

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
Tcpip\..\Interfaces\{cb788683-62bb-49bd-a2bd-8c95f035c6d8}: [DhcpNameServer] 192.168.1.1
Tcpip\..\Interfaces\{cb788683-62bb-49bd-a2bd-8c95f035c6d8}: [DhcpDomain] home
Tcpip\..\Interfaces\{cb788683-62bb-49bd-a2bd-8c95f035c6d8}\255646D696021323: [DhcpNameServer] 10.234.164.36
Tcpip\..\Interfaces\{ce166e0c-1abd-4573-a63b-a0ac72c5ca8a}: [DhcpNameServer] 10.66.0.1
Tcpip\..\Interfaces\{fc01fcd5-2b9d-2fd8-78d8-cb78b313e2b2}: [NameServer] 103.86.96.100,103.86.99.100
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <==== ATTENTION

FireFox:
========
FF TaskBarID: 308046B0AF4A39CB -> C:\Program Files\Mozilla Firefox
FF DefaultProfile: 1iruhvdm.default-release -> 308046B0AF4A39CB
FF ProfilePath: C:\Users\linco\AppData\Roaming\Mozilla\Firefox\Profiles\6fn0tf4y.default [2026-06-05]
FF ProfilePath: C:\Users\linco\AppData\Roaming\Mozilla\Firefox\Profiles\1iruhvdm.default-release [2026-09-12]
FF Extension: (New Tab) - C:\Users\linco\AppData\Roaming\Mozilla\Firefox\Profiles\1iruhvdm.default-release\Extensions\newtab@mozilla.org.xpi [2026-06-05]
FF Extension: (NordVPN) - C:\Users\linco\AppData\Roaming\Mozilla\Firefox\Profiles\1iruhvdm.default-release\Extensions\nordvpnproxy@nordvpn.com.xpi [2026-06-05]
FF Plugin: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/pdf -> C:\Program Files\Foxit Software\Foxit PDF Reader\plugins\npFoxitPDFReaderPlugin.dll [2026-08-24] (FOXIT SOFTWARE INC. -> Foxit Corporation)
FF Plugin: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/vnd.fdf -> C:\Program Files\Foxit Software\Foxit PDF Reader\plugins\npFoxitPDFReaderPlugin.dll [2026-08-24] (FOXIT SOFTWARE INC. -> Foxit Corporation)
FF Plugin: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/vnd.xdp -> C:\Program Files\Foxit Software\Foxit PDF Reader\plugins\npFoxitPDFReaderPlugin.dll [2026-08-24] (FOXIT SOFTWARE INC. -> Foxit Corporation)
FF Plugin: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/vnd.xfdf -> C:\Program Files\Foxit Software\Foxit PDF Reader\plugins\npFoxitPDFReaderPlugin.dll [2026-08-24] (FOXIT SOFTWARE INC. -> Foxit Corporation)
FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office\root\Office16\NPSPWRAP.DLL [2017-07-04] (Microsoft Corporation -> Microsoft Corporation)
FF Plugin-x32: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/pdf -> C:\Program Files\Foxit Software\Foxit PDF Reader\plugins\npFoxitPDFReaderPlugin.dll [2026-08-24] (FOXIT SOFTWARE INC. -> Foxit Corporation)
FF Plugin-x32: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/vnd.fdf -> D:\Foxit PDF Reader\plugins\npFoxitPDFReaderPlugin.dll [No File]
FF Plugin-x32: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/vnd.xdp -> D:\Foxit PDF Reader\plugins\npFoxitPDFReaderPlugin.dll [No File]
FF Plugin-x32: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/vnd.xfdf -> D:\Foxit PDF Reader\plugins\npFoxitPDFReaderPlugin.dll [No File]
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\NPSPWRAP.DLL [2017-07-04] (Microsoft Corporation -> Microsoft Corporation)
FF Plugin-x32: @update.avastbrowser.com/Avast Browser;version=3 -> C:\Program Files (x86)\AVAST Software\Browser\Update\1.8.1993.6\npAvastBrowserUpdate3.dll [2025-07-21] (Avast Software s.r.o. -> Gen Digital Inc.)
FF Plugin-x32: @update.avastbrowser.com/Avast Browser;version=9 -> C:\Program Files (x86)\AVAST Software\Browser\Update\1.8.1993.6\npAvastBrowserUpdate3.dll [2025-07-21] (Avast Software s.r.o. -> Gen Digital Inc.)

Edge: 
=======
Edge Profile: C:\Users\linco\AppData\Local\Microsoft\Edge\User Data\Default [2026-08-23]
Edge Extension: (Avira Password Manager) - C:\Users\linco\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\emgfgdclgfeldebanedpihppahgngnle [2025-11-20]
Edge Extension: (Dokumenty Google v režime offline) - C:\Users\linco\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2026-08-22]
Edge Extension: (Edge relevant text changes) - C:\Users\linco\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha [2025-07-22]
Edge HKU\S-1-5-21-2298117505-976418258-3832342613-1001\SOFTWARE\Microsoft\Edge\Extensions\...\Edge\Extension: [fjoaledfpmneenckfbpdfhkmimnjocfa]
Edge HKLM-x32\...\Edge\Extension: [caiblelclndcckfafdaggpephhgfpoip]
Edge HKLM-x32\...\Edge\Extension: [emgfgdclgfeldebanedpihppahgngnle]

Chrome: 
=======
CHR HKLM-x32\...\Chrome\Extension: [caljgklbbfbcjjanaijlacgncafpegll]
CHR HKLM-x32\...\Chrome\Extension: [ccbpbkebodcjkknkfkpmfeciinhidaeh]
CHR HKLM-x32\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk]

Brave: 
=======
BRA Profile: C:\Users\linco\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default [2026-09-13]
BRA Extension: (Avira Password Manager) - C:\Users\linco\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Extensions\caljgklbbfbcjjanaijlacgncafpegll [2026-08-13]
BRA Extension: (Avira Safe Shopping) - C:\Users\linco\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Extensions\ccbpbkebodcjkknkfkpmfeciinhidaeh [2026-09-12]
BRA Extension: (Avira Browser Safety) - C:\Users\linco\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Extensions\flliilndjeohchalpbbcdekjklbdgfkk [2026-08-13]
BRA Extension: (Bitwarden – správca hesiel) - C:\Users\linco\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Extensions\nngceckbapebfimnlniiiahkandclblb [2026-08-13]
BRA Extension: (Brave Ad Block Updater (Brave First Party Adblock Filters (plaintext))) - C:\Users\linco\AppData\Local\BraveSoftware\Brave-Browser\User Data\adcocjohghhfpidemphmcmlmhnfgikei [2026-09-09]
BRA Extension: (Brave Local Data Files Updater) - C:\Users\linco\AppData\Local\BraveSoftware\Brave-Browser\User Data\afalakplffnnnlkncjhbmahjfjhmlkal [2026-09-12]
BRA Extension: (Brave NTP background images) - C:\Users\linco\AppData\Local\BraveSoftware\Brave-Browser\User Data\aoojcmojmmcbpfgoecoadbdpnagfchel [2026-08-13]
BRA Extension: (Brave Ad Block Updater (Mobile app promo blocker (plaintext))) - C:\Users\linco\AppData\Local\BraveSoftware\Brave-Browser\User Data\bfpgedeaaibpoidldhjcknekahbikncb [2026-09-04]
BRA Extension: (Brave Ad Block Updater (Cookie notice blocker (plaintext))) - C:\Users\linco\AppData\Local\BraveSoftware\Brave-Browser\User Data\cdbbhgbmjhfnhnmgeddbliobbofkgdhe [2026-09-13]
BRA Extension: (Query Filter) - C:\Users\linco\AppData\Local\BraveSoftware\Brave-Browser\User Data\cemdlagocoimleflkfkjoihojfainiho [2026-09-13]
BRA Extension: (Brave Ad Block Updater (Allow X/Twitter Embeds (plaintext))) - C:\Users\linco\AppData\Local\BraveSoftware\Brave-Browser\User Data\dkpggglmbjhgjhachikgmohmecomjndo [2026-08-13]
BRA Extension: (Brave WebMCP Tool Scripts) - C:\Users\linco\AppData\Local\BraveSoftware\Brave-Browser\User Data\eingdhelnaolbpcdkgddekhifcjfkalf [2026-09-12]
BRA Extension: (Brave Ad Block Updater (Regional Catalog)) - C:\Users\linco\AppData\Local\BraveSoftware\Brave-Browser\User Data\gkboaolpopklhgplhaaiboijnklogmbc [2026-09-02]
BRA Extension: (Brave Ad Block Updater (Brave Default Adblock Filters (plaintext))) - C:\Users\linco\AppData\Local\BraveSoftware\Brave-Browser\User Data\iodkpdagapdfkphljnddpjlldadblomo [2026-09-13]
BRA Extension: (Brave Ad Block Updater (Allow Facebook Embeds (plaintext))) - C:\Users\linco\AppData\Local\BraveSoftware\Brave-Browser\User Data\jmfhneobcdckobmonkfjkbknnjjnegoh [2026-08-13]
BRA Extension: (Brave Ad Block Updater (Brave Default Privacy Filters (plaintext))) - C:\Users\linco\AppData\Local\BraveSoftware\Brave-Browser\User Data\kihnoaefogbkmblfimmibknnmkllbhlf [2026-09-13]
BRA Extension: (Brave Ads Resources) - C:\Users\linco\AppData\Local\BraveSoftware\Brave-Browser\User Data\kmfkbonhconlbieplamnikedgfbggail [2026-08-13]
BRA Extension: (Brave Ad Block Updater (Resources)) - C:\Users\linco\AppData\Local\BraveSoftware\Brave-Browser\User Data\mfddibmblmbccpadfndgakiopmmhebop [2026-09-04]
BRA Extension: (Brave User Agent) - C:\Users\linco\AppData\Local\BraveSoftware\Brave-Browser\User Data\nlpaeekllejnmhoonlpcefpfnpbajbpe [2026-09-12]
BRA Extension: (Brave NTP sponsored images) - C:\Users\linco\AppData\Local\BraveSoftware\Brave-Browser\User Data\npgnikmkgjfghbkdbfijbiekedekaebh [2026-09-13]
BRA Extension: (Brave Ad Block Updater (Czech and Slovak website ad blocker (plaintext))) - C:\Users\linco\AppData\Local\BraveSoftware\Brave-Browser\User Data\oegebjahecghlckbhkmojgnpcgdeajdi [2026-08-13]
BRA Extension: (P3A Configuration) - C:\Users\linco\AppData\Local\BraveSoftware\Brave-Browser\User Data\P3AConfig [2026-08-13]

==================== Services (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

S4 AsBhcService; C:\Program Files (x86)\ASUS\ASUS Battery Health Charging\AsBhcSrv.exe [114360 2016-10-20] (ASUSTeK Computer Inc. -> ASUSTek Computer Inc.)
R2 AsusPTPService; C:\WINDOWS\System32\DriverStore\FileRepository\asusptpfilter.inf_amd64_7c6805cea91175e4\AsusPTPService.exe [1702448 2026-02-25] (ASUSTeK COMPUTER INC. -> ASUSTek Computer Inc.)
R3 aswbIDSAgent; C:\Program Files\Avast Software\Suite\aswidsagent.exe [8089528 2026-08-18] (Gen Digital Inc. -> Gen Digital Inc.)
S2 avast; C:\Program Files (x86)\AVAST Software\Browser\Update\AvastBrowserUpdate.exe [193056 2025-07-21] (Avast Software s.r.o. -> Gen Digital Inc.)
R2 Avast BreachGuard Service; C:\Program Files\Avast Software\Suite\bgsvc.exe [11458488 2026-08-18] (Gen Digital Inc. -> Gen Digital Inc.)
R2 avast! Antivirus; C:\Program Files\Avast Software\Suite\AvastSvc.exe [1050552 2026-08-18] (Gen Digital Inc. -> Gen Digital Inc.)
R2 avast! Firewall; C:\Program Files\Avast Software\Suite\afwServ.exe [2781112 2026-08-18] (Gen Digital Inc. -> Gen Digital Inc.)
R2 avast! Tools; C:\Program Files\Avast Software\Suite\aswToolsSvc.exe [1103288 2026-08-18] (Gen Digital Inc. -> Gen Digital Inc.)
R2 AvastCleanupSvc; C:\Program Files\Avast Software\Suite\TuneupSvc.exe [22396344 2026-08-18] (Gen Digital Inc. -> Gen Digital Inc.)
R2 AvastDriverUpdSvc; C:\Program Files\Avast Software\Suite\DriverUpdSvc.exe [20561848 2026-08-18] (Gen Digital Inc. -> Gen Digital Inc.)
S3 avastm; C:\Program Files (x86)\AVAST Software\Browser\Update\AvastBrowserUpdate.exe [193056 2025-07-21] (Avast Software s.r.o. -> Gen Digital Inc.)
R2 AvastWscReporter; C:\Program Files\Avast Software\Suite\wsc_proxy.exe [56912 2026-08-05] (Avast Software s.r.o. -> AVAST Software)
S2 brave; C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe [167504 2026-08-13] (Brave Software, Inc. -> BraveSoftware Inc.)
S3 BraveElevationService; C:\Program Files\BraveSoftware\Brave-Browser\Application\153.1.95.101\elevation_service.exe [5112912 2026-09-11] (Brave Software, Inc. -> Brave Software, Inc.)
S3 bravem; C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe [167504 2026-08-13] (Brave Software, Inc. -> BraveSoftware Inc.)
R2 CCleaner7; C:\Program Files\Piriform\CCleaner 7\CCleaner_service.exe [31302032 2026-09-07] (Gen Digital Inc. -> Gen Digital Inc.)
S4 ClickToRunSvc; C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe [3699912 2017-01-31] (Microsoft Corporation -> Microsoft Corporation)
R2 DSAService; C:\Program Files (x86)\Intel\Driver and Support Assistant\x86\DSAService.exe [132616 2026-07-08] (Intel Corporation -> Intel)
R2 DSAUpdateService; C:\Program Files (x86)\Intel\Driver and Support Assistant\x86\DSAUpdateService.exe [132112 2026-07-08] (Intel Corporation -> Intel)
S4 FoxitReaderUpdateService; C:\Program Files\Common Files\Foxit\Foxit PDF Reader\FoxitPDFReaderUpdateService.exe [3241568 2026-08-20] (FOXIT SOFTWARE INC. -> Foxit Software Inc.)
S3 MDCoreSvc; C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26070.9-0\MpDefenderCoreService.exe [2113568 2026-08-05] (Microsoft Windows Publisher -> Microsoft Corporation)
R2 nordsec-threatprotection-service; C:\Program Files\NordVPN\NordSec ThreatProtection\nordsec-threatprotection-service.exe [2542112 2025-04-02] (nordvpn s.a. -> NordVPN)
S4 NordUpdaterService; C:\Program Files\NordUpdater\NordUpdateService.exe [297848 2022-12-21] (nordvpn s.a. -> nordvpn S.A.)
R2 nordvpn-service; C:\Program Files\NordVPN\nordvpn-service.exe [2542112 2025-04-02] (nordvpn s.a. -> NordVPN)
R2 NVDisplay.ContainerLocalSystem; C:\WINDOWS\System32\DriverStore\FileRepository\nvami.inf_amd64_e30f053f80c001f3\Display.NvContainer\NVDisplay.Container.exe [1275624 2026-06-11] (NVIDIA Corporation -> NVIDIA Corporation)
S4 RichVideo64; C:\Program Files\CyberLink\Shared files\RichVideo64.exe [389896 2014-04-14] (CyberLink Corp. -> )
R2 SecureLine; C:\Program Files\Avast Software\Suite\VpnSvc.exe [15068088 2026-08-18] (Gen Digital Inc. -> Gen Digital Inc.)
S4 TeamViewer; C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe [7809648 2025-06-17] (TeamViewer Germany GmbH -> TeamViewer Germany GmbH)
S3 WdNisSvc; C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26070.9-0\NisSrv.exe [5183648 2026-08-05] (Microsoft Windows Publisher -> Microsoft Corporation)
S3 WinDefend; C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26070.9-0\MsMpEng.exe [291352 2026-08-05] (Microsoft Windows Publisher -> Microsoft Corporation)
S3 DevActSvc; C:\Program Files (x86)\ASUS\ASUS Device Activation\DevActSvc.exe (No File)

===================== Drivers (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R3 AiCharger; C:\WINDOWS\system32\DRIVERS\AiCharger.sys [29312 2016-11-14] (Microsoft Windows Hardware Compatibility Publisher -> ASUSTek Computer Inc.)
R3 AsusHFilter; C:\WINDOWS\System32\drivers\AsusHFilter.sys [30200 2016-12-22] (ASUSTeK Computer Inc. -> )
R3 AsusPTPDrv; C:\WINDOWS\System32\DriverStore\FileRepository\asusptpfilter.inf_amd64_7c6805cea91175e4\AsusPTPFilter.sys [224304 2026-02-25] (ASUSTeK COMPUTER INC. -> ASUSTek COMPUTER INC.)
R0 aswArDisk; C:\WINDOWS\System32\drivers\aswArDisk.sys [21088 2026-08-05] (Microsoft Windows Hardware Compatibility Publisher -> Gen Digital Inc.)
R1 aswArPot; C:\WINDOWS\System32\drivers\aswArPot.sys [249952 2026-08-18] (Microsoft Windows Hardware Compatibility Publisher -> Gen Digital Inc.)
R1 aswbidsdriver; C:\WINDOWS\System32\drivers\aswbidsdriver.sys [395360 2026-08-18] (Microsoft Windows Hardware Compatibility Publisher -> Gen Digital Inc.)
R0 aswbidsh; C:\WINDOWS\System32\drivers\aswbidsh.sys [317024 2026-08-18] (Microsoft Windows Hardware Compatibility Publisher -> Gen Digital Inc.)
R0 aswbuniv; C:\WINDOWS\System32\drivers\aswbuniv.sys [80992 2026-08-18] (Microsoft Windows Hardware Compatibility Publisher -> Gen Digital Inc.)
R1 aswDrvBrg; C:\WINDOWS\System32\drivers\aswDrvBrg.sys [86112 2026-08-18] (Microsoft Windows Hardware Compatibility Publisher -> Gen Digital Inc.)
R0 aswElam; C:\WINDOWS\System32\drivers\aswElam.sys [29144 2026-08-05] (Microsoft Windows Early Launch Anti-malware Publisher -> Gen Digital Inc.)
R1 aswKbd; C:\WINDOWS\System32\drivers\aswKbd.sys [34912 2026-08-18] (Microsoft Windows Hardware Compatibility Publisher -> Gen Digital Inc.)
R1 aswMonFlt; C:\WINDOWS\System32\drivers\aswMonFlt.sys [299616 2026-08-18] (Microsoft Windows Hardware Compatibility Publisher -> Gen Digital Inc.)
R1 aswNetHub; C:\WINDOWS\System32\drivers\aswNetHub.sys [637536 2026-08-18] (Microsoft Windows Hardware Compatibility Publisher -> Gen Digital Inc.)
R1 aswRdr; C:\WINDOWS\System32\drivers\aswRdr2.sys [100960 2026-08-18] (Microsoft Windows Hardware Compatibility Publisher -> Gen Digital Inc.)
R0 aswRvrt; C:\WINDOWS\System32\drivers\aswRvrt.sys [71776 2026-08-18] (Microsoft Windows Hardware Compatibility Publisher -> Gen Digital Inc.)
R1 aswSnx; C:\WINDOWS\System32\drivers\aswSnx.sys [858208 2026-09-04] (Microsoft Windows Hardware Compatibility Publisher -> Gen Digital Inc.)
R1 aswSP; C:\WINDOWS\System32\drivers\aswSP.sys [1301088 2026-08-18] (Microsoft Windows Hardware Compatibility Publisher -> Gen Digital Inc.)
R3 aswStm; C:\WINDOWS\System32\drivers\aswStm.sys [253536 2026-08-18] (Microsoft Windows Hardware Compatibility Publisher -> Gen Digital Inc.)
R0 aswVmm; C:\WINDOWS\System32\drivers\aswVmm.sys [474720 2026-08-18] (Microsoft Windows Hardware Compatibility Publisher -> Gen Digital Inc.)
S3 aswVpnRdr; C:\WINDOWS\System32\drivers\aswVpnRdr.sys [76384 2026-08-18] (Microsoft Windows Hardware Compatibility Publisher -> Gen Digital Inc.)
R1 ATKWMIACPIIO; \??\C:\Program Files (x86)\ASUS\ATK Package\ATK WMIACPI\atkwmiacpi64.sys [20096 2015-05-08] (Microsoft Windows Hardware Compatibility Publisher -> )
S3 GeneStor; C:\WINDOWS\System32\drivers\GeneStor.sys [159632 2025-02-24] (GENESYS LOGIC, INC. -> Genesys Logic)
R3 HIDSwitch; C:\WINDOWS\System32\drivers\AsRadioControl.sys [32696 2020-11-19] (ASUSTek Computer Inc. -> ASUS)
R3 iaLPSS2_I2C; C:\WINDOWS\System32\DriverStore\FileRepository\ialpss2_i2c_skl.inf_amd64_363c7132639e12a6\iaLPSS2_I2C_ICL.sys [200456 2020-04-27] (Intel Corporation -> Intel Corporation)
U5 iaStorA; C:\Windows\System32\Drivers\iaStorA.sys [795648 2016-11-24] (Intel(R) Rapid Storage Technology -> Intel Corporation)
S3 KslD; C:\WINDOWS\System32\drivers\wd\KslD.sys [82312 2026-08-05] (Microsoft Windows -> Microsoft Corporation)
R3 mshield; \??\C:\Program Files\NordVPN\NordSec ThreatProtection\8.10.9.0\mshield.sys [46632 2026-06-22] (nordvpn s.a. -> )
R2 NDivert; \??\C:\Program Files\NordVPN\8.10.3.0\Drivers\NDivert.sys [296488 2026-07-21] (nordvpn s.a. -> )
R3 ovpn-dco; C:\WINDOWS\System32\drivers\ovpn-dco.sys [99984 2026-01-07] (WDKTestCert lev,133391533294737317 -> OpenVPN, Inc)
S3 semav6msr64; \??\C:\WINDOWS\system32\drivers\semav6msr64.sys [49872 2026-01-27] (Intel Corporation -> )
R3 tapnordvpn; C:\WINDOWS\System32\drivers\tapnordvpn.sys [53088 2025-03-12] (Microsoft Windows Hardware Compatibility Publisher -> The OpenVPN Project)
R3 travis; \??\C:\Program Files\NordVPN\NordSec ThreatProtection\8.10.9.0\travis.sys [64552 2026-07-08] (nordvpn s.a. -> )
S4 WdAiNisDrv; C:\WINDOWS\System32\drivers\wd\WdAiNisDrv.sys [51224 2026-08-05] (Microsoft Windows -> Microsoft Corporation)
S3 WdBoot; C:\WINDOWS\system32\drivers\wd\WdBoot.sys [21632 2026-08-05] (Microsoft Windows Early Launch Anti-malware Publisher -> Microsoft Corporation)
S3 WdFilter; C:\WINDOWS\system32\drivers\wd\WdFilter.sys [625688 2026-08-05] (Microsoft Windows -> Microsoft Corporation)
S3 WdNisDrv; C:\WINDOWS\System32\drivers\wd\WdNisDrv.sys [111640 2026-08-05] (Microsoft Windows -> Microsoft Corporation)
S3 wintun; C:\WINDOWS\System32\drivers\wintun.sys [29592 2022-03-13] (Microsoft Windows Hardware Compatibility Publisher -> WireGuard LLC)
R3 WireGuard; C:\WINDOWS\System32\drivers\wireguard.sys [489368 2025-03-09] (Microsoft Windows Hardware Compatibility Publisher -> WireGuard LLC)
U2 DriverUpdSvc.exe; no ImagePath
U2 TuneupSvc.exe; no ImagePath

==================== SvcHost (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== One month (created) (Whitelisted) =========

(If an entry is included in the fixlist, the file/folder will be moved.)

2026-09-13 11:55 - 2026-09-13 11:57 - 000038742 _____ C:\Users\linco\OneDrive\Počítač\FRST.txt
2026-09-13 11:50 - 2026-09-13 11:50 - 000000202 _____ C:\Users\linco\OneDrive\Počítač\Car Mechanic Simulator 2018.url
2026-09-12 23:27 - 2026-09-12 23:27 - 000000000 ____D C:\ProgramData\FileOpen
2026-09-10 23:03 - 2026-09-10 23:03 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Foxit PDF Reader
2026-09-10 23:02 - 2026-09-10 23:02 - 000000000 ____D C:\Program Files\Common Files\Foxit
2026-09-01 00:41 - 2026-08-18 19:40 - 000325560 _____ (Gen Digital Inc.) C:\WINDOWS\system32\aswBoot.exe
2026-08-22 13:43 - 2026-08-24 00:36 - 000000000 ____D C:\Users\linco\AppData\Local\NVIDIA
2026-08-21 11:28 - 2026-08-21 11:28 - 000000000 ____D C:\Users\linco\AppData\LocalLow\NVIDIA
2026-08-21 11:27 - 2026-08-22 23:03 - 000000000 ____D C:\Users\linco\AppData\Local\NVIDIA Corporation
2026-08-21 11:26 - 2026-09-10 23:15 - 000003070 _____ C:\WINDOWS\system32\Tasks\NVIDIA App SelfUpdate_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}
2026-08-21 11:26 - 2026-08-21 11:26 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NVIDIA Corporation
2026-08-21 11:25 - 2025-10-16 00:22 - 001310832 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvspcap64.dll
2026-08-21 11:25 - 2025-10-16 00:22 - 001115248 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvspcap.dll
2026-08-21 11:25 - 2025-10-16 00:05 - 000180760 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvaudcap64v.dll
2026-08-21 11:25 - 2025-10-16 00:05 - 000159768 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvaudcap32v.dll
2026-08-21 10:52 - 2026-09-12 12:35 - 000000000 ____D C:\ProgramData\NVIDIA
2026-08-21 10:52 - 2026-08-22 15:57 - 000000000 ____D C:\WINDOWS\system32\Drivers\NVIDIA Corporation
2026-08-21 10:52 - 2026-08-21 11:27 - 000000000 ____D C:\ProgramData\NVIDIA Corporation
2026-08-21 10:48 - 2026-09-12 21:07 - 000000000 ____D C:\Users\linco\AppData\Local\D3DSCache
2026-08-21 10:42 - 2026-08-21 10:44 - 000000214 _____ C:\WINDOWS\Tasks\CreateExplorerShellUnelevatedTask.job
2026-08-16 12:43 - 2026-09-10 22:53 - 000000000 ____D C:\Users\linco\AppData\Local\Programs\signal-desktop

==================== One month (modified) ==================

(If an entry is included in the fixlist, the file/folder will be moved.)

2026-09-13 11:56 - 2020-08-22 14:05 - 000000000 ____D C:\FRST
2026-09-13 11:53 - 2025-07-22 09:35 - 000000000 ____D C:\Users\linco\AppData\Local\NordVPN
2026-09-13 11:53 - 2025-07-21 18:08 - 000000000 ____D C:\WINDOWS\SystemTemp
2026-09-13 11:52 - 2025-07-22 09:35 - 000000000 ____D C:\ProgramData\NordVPN
2026-09-13 11:52 - 2025-07-21 18:08 - 000000000 ____D C:\WINDOWS\Registration
2026-09-13 11:45 - 2026-08-05 23:44 - 000000000 ____D C:\WINDOWS\system32\Tasks\Avast Software
2026-09-13 11:45 - 2025-07-21 17:33 - 000003558 _____ C:\WINDOWS\system32\Tasks\MicrosoftEdgeUpdateTaskMachineUA
2026-09-13 11:45 - 2025-07-21 17:33 - 000003332 _____ C:\WINDOWS\system32\Tasks\MicrosoftEdgeUpdateTaskMachineCore
2026-09-13 10:11 - 2025-07-21 17:30 - 000000000 ____D C:\WINDOWS\system32\SleepStudy
2026-09-12 20:04 - 2025-07-21 18:08 - 000000000 ____D C:\ProgramData\regid.1991-06.com.microsoft
2026-09-12 12:42 - 2025-01-13 18:33 - 000002438 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Edge.lnk
2026-09-12 12:40 - 2025-07-21 18:11 - 000457904 _____ C:\WINDOWS\system32\perfh006.dat
2026-09-12 12:40 - 2025-07-21 18:11 - 000079812 _____ C:\WINDOWS\system32\perfc006.dat
2026-09-12 12:40 - 2025-07-21 18:10 - 000709094 _____ C:\WINDOWS\system32\perfh005.dat
2026-09-12 12:40 - 2025-07-21 18:10 - 000145426 _____ C:\WINDOWS\system32\perfc005.dat
2026-09-12 12:40 - 2025-07-21 18:07 - 000000000 ____D C:\WINDOWS\INF
2026-09-12 12:40 - 2025-07-21 18:04 - 002225314 _____ C:\WINDOWS\system32\PerfStringBackup.INI
2026-09-12 12:35 - 2018-09-15 20:55 - 000000000 __SHD C:\Users\linco\IntelGraphicsProfiles
2026-09-12 12:33 - 2025-09-20 22:43 - 000000000 ____D C:\ProgramData\Avast Software
2026-09-12 12:33 - 2025-07-21 18:08 - 000000000 ____D C:\WINDOWS\ServiceState
2026-09-12 12:33 - 2025-07-21 18:03 - 000786432 _____ C:\WINDOWS\system32\config\BBI
2026-09-12 12:33 - 2025-07-21 17:33 - 000000006 ____H C:\WINDOWS\Tasks\SA.DAT
2026-09-12 12:33 - 2025-07-21 17:30 - 000008192 ___SH C:\DumpStack.log.tmp
2026-09-12 12:33 - 2017-07-04 19:59 - 000000000 ___HD C:\Intel
2026-09-12 12:31 - 2025-07-21 17:30 - 000262944 _____ C:\WINDOWS\system32\FNTCACHE.DAT
2026-09-12 12:30 - 2025-07-21 18:12 - 000000000 ____D C:\WINDOWS\system32\OpenSSH
2026-09-12 12:30 - 2025-07-21 18:08 - 000000000 ___RD C:\WINDOWS\ImmersiveControlPanel
2026-09-12 12:30 - 2025-07-21 18:08 - 000000000 ____D C:\WINDOWS\SysWOW64\setup
2026-09-12 12:30 - 2025-07-21 18:08 - 000000000 ____D C:\WINDOWS\SysWOW64\oobe
2026-09-12 12:30 - 2025-07-21 18:08 - 000000000 ____D C:\WINDOWS\SystemResources
2026-09-12 12:30 - 2025-07-21 18:08 - 000000000 ____D C:\WINDOWS\system32\setup
2026-09-12 12:30 - 2025-07-21 18:08 - 000000000 ____D C:\WINDOWS\system32\SecureBootUpdates
2026-09-12 12:30 - 2025-07-21 18:08 - 000000000 ____D C:\WINDOWS\system32\oobe
2026-09-12 12:30 - 2025-07-21 18:08 - 000000000 ____D C:\WINDOWS\system32\compatrel
2026-09-12 12:30 - 2025-07-21 18:08 - 000000000 ____D C:\WINDOWS\bcastdvr
2026-09-12 12:30 - 2025-07-21 18:03 - 000000000 ____D C:\WINDOWS\servicing
2026-09-12 11:49 - 2025-07-21 18:04 - 000000000 ____D C:\WINDOWS\CbsTemp
2026-09-12 11:31 - 2026-08-13 10:21 - 000002366 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Brave.lnk
2026-09-12 11:16 - 2025-07-21 18:08 - 000000000 ____D C:\WINDOWS\AppReadiness
2026-09-11 12:32 - 2025-07-21 17:35 - 003017728 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\PrintConfig.dll
2026-09-10 23:42 - 2025-07-21 18:08 - 000000000 ___HD C:\Program Files\WindowsApps
2026-09-10 23:15 - 2026-07-10 20:08 - 000000000 ____D C:\Users\linco\AppData\Roaming\Signal
2026-09-10 23:09 - 2025-07-21 18:49 - 000000000 ____D C:\WINDOWS\system32\MRT
2026-09-10 23:02 - 2025-07-21 18:49 - 230964456 ____C (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2026-09-10 23:01 - 2017-07-04 19:59 - 000000000 ____D C:\ProgramData\Package Cache
2026-09-10 22:59 - 2018-09-15 20:54 - 000000000 ___SD C:\Users\linco\AppData\Roaming\Microsoft\Credentials
2026-09-10 22:58 - 2025-02-08 11:52 - 002455552 _____ (Farbar) C:\Users\linco\OneDrive\Počítač\FRST64.exe
2026-09-10 22:58 - 2024-08-09 07:03 - 000000000 ____D C:\Users\linco\OneDrive\Počítač\FRST-OlderVersion
2026-09-10 22:55 - 2026-03-26 23:05 - 000001178 _____ C:\Users\linco\OneDrive\Počítač\Core Temp.lnk
2026-09-09 00:20 - 2025-07-22 09:34 - 000000000 ____D C:\Program Files\dotnet
2026-09-09 00:18 - 2025-12-01 00:40 - 000000000 ____D C:\Program Files (x86)\dotnet
2026-09-06 21:27 - 2025-08-31 16:27 - 000000000 ____D C:\Users\linco\AppData\Roaming\avidemux
2026-09-04 21:36 - 2026-08-05 23:44 - 000858208 _____ (Gen Digital Inc.) C:\WINDOWS\system32\Drivers\aswSnx.sys
2026-09-01 00:42 - 2025-07-21 17:54 - 000000000 ____D C:\Users\linco
2026-09-01 00:42 - 2025-07-21 17:54 - 000000000 ____D C:\Users\defaultuser0
2026-09-01 00:41 - 2025-07-21 18:08 - 000000000 ___HD C:\WINDOWS\ELAMBKUP
2026-08-31 20:11 - 2017-07-04 20:01 - 000000000 ____D C:\Program Files\NVIDIA Corporation
2026-08-28 11:25 - 2016-11-14 04:29 - 000000448 _____ C:\WINDOWS\Tasks\WpsExternal_20161114022915.job
2026-08-28 11:24 - 2026-03-03 22:11 - 000002668 _____ C:\WINDOWS\system32\Tasks\USER_ESRV_SVC_QUEENCREEK
2026-08-28 11:24 - 2025-10-11 16:38 - 000002462 _____ C:\WINDOWS\system32\Tasks\CCleaner 7 - Skip UAC - S-1-5-21-2298117505-976418258-3832342613-1001
2026-08-28 11:24 - 2025-07-21 19:55 - 000003086 _____ C:\WINDOWS\system32\Tasks\WpsExternal_20161114022915
2026-08-27 23:10 - 2025-07-22 09:35 - 000000000 ____D C:\Program Files\NordVPN
2026-08-27 23:10 - 2025-07-22 09:34 - 000000000 ____D C:\Program Files\NordUpdater
2026-08-27 23:10 - 2025-06-10 15:50 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NordSec
2026-08-22 15:31 - 2026-07-04 12:47 - 000000000 ____D C:\WINDOWS\Minidump
2026-08-21 11:25 - 2025-07-21 18:18 - 000000000 ____D C:\Users\linco\AppData\Local\Packages
2026-08-21 11:25 - 2017-07-04 20:03 - 000000000 ____D C:\Program Files (x86)\NVIDIA Corporation
2026-08-18 19:40 - 2026-08-05 23:44 - 001301088 _____ (Gen Digital Inc.) C:\WINDOWS\system32\Drivers\aswSP.sys
2026-08-18 19:40 - 2026-08-05 23:44 - 000637536 _____ (Gen Digital Inc.) C:\WINDOWS\system32\Drivers\aswNetHub.sys
2026-08-18 19:40 - 2026-08-05 23:44 - 000474720 _____ (Gen Digital Inc.) C:\WINDOWS\system32\Drivers\aswVmm.sys
2026-08-18 19:40 - 2026-08-05 23:44 - 000395360 _____ (Gen Digital Inc.) C:\WINDOWS\system32\Drivers\aswbidsdriver.sys
2026-08-18 19:40 - 2026-08-05 23:44 - 000317024 _____ (Gen Digital Inc.) C:\WINDOWS\system32\Drivers\aswbidsh.sys
2026-08-18 19:40 - 2026-08-05 23:44 - 000299616 _____ (Gen Digital Inc.) C:\WINDOWS\system32\Drivers\aswMonFlt.sys
2026-08-18 19:40 - 2026-08-05 23:44 - 000249952 _____ (Gen Digital Inc.) C:\WINDOWS\system32\Drivers\aswArPot.sys
2026-08-18 19:40 - 2026-08-05 23:44 - 000100960 _____ (Gen Digital Inc.) C:\WINDOWS\system32\Drivers\aswRdr2.sys
2026-08-18 19:40 - 2026-08-05 23:44 - 000086112 _____ (Gen Digital Inc.) C:\WINDOWS\system32\Drivers\aswDrvBrg.sys
2026-08-18 19:40 - 2026-08-05 23:44 - 000080992 _____ (Gen Digital Inc.) C:\WINDOWS\system32\Drivers\aswbuniv.sys
2026-08-18 19:40 - 2026-08-05 23:44 - 000071776 _____ (Gen Digital Inc.) C:\WINDOWS\system32\Drivers\aswRvrt.sys
2026-08-18 19:40 - 2026-08-05 23:44 - 000034912 _____ (Gen Digital Inc.) C:\WINDOWS\system32\Drivers\aswKbd.sys
2026-08-14 11:54 - 2026-08-13 10:19 - 000003328 _____ C:\WINDOWS\system32\Tasks\BraveSoftwareUpdateTaskMachineCore{1A63B601-05A5-4EFB-877B-8863ACE30DC3}
2026-08-14 09:00 - 2026-08-13 10:19 - 000003552 _____ C:\WINDOWS\system32\Tasks\BraveSoftwareUpdateTaskMachineUA{67E6C4B4-2A43-4FE2-8A18-0D5AB1C0DE16}

==================== SigCheck ============================

(There is no automatic fix for files that do not pass verification.)

==================== End of FRST.txt ========================