Odvirování PC, zrychlení počítače, vzdálená pomoc prostřednictvím služby neslape.cz

Zašifrované soubory a přepsané na .doc

Máte problém s virem? Vložte sem log z FRST nebo RSIT.

Moderátor: Moderátoři

Pravidla fóra
Pokud chcete pomoc, vložte log z FRST [návod zde] nebo RSIT [návod zde]

Jednotlivé thready budou po vyřešení uzamčeny. Stejně tak ty, které budou nečinné déle než 14 dní. Vizte Pravidlo o zamykání témat. Děkujeme za pochopení.

!NOVINKA!
Nově lze využívat služby vzdálené pomoci, kdy se k vašemu počítači připojí odborník a bližší informace o problému si od vás získá telefonicky! Více na www.neslape.cz
Odpovědět
Zpráva
Autor
acheron
Návštěvník
Návštěvník
Příspěvky: 1
Registrován: 11 pro 2017 12:03

Zašifrované soubory a přepsané na .doc

#1 Příspěvek od acheron »

Zdravím, stalo se, že část dokumentů jsou zašifrované a byla jim přidána koncovka .doc
Pouhé umazání přípony nestačí k nápravě. V jednom adresáři jsem našel soubor Read___ME.html, který mi říká, že si musím koupit decryptor.
Je nějaká šance na obnovu dokumentů?

Logfile of random's system information tool 1.10 (written by random/random)
Run by Libor at 2017-12-11 11:50:50
Microsoft Windows 10 Home
System drive C: has 53 GB (54%) free of 99 GB
Total RAM: 8071 MB (61% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 11:50:53, on 11.12.2017
Platform: Unknown Windows (WinNT 6.02.1008)
MSIE: Internet Explorer v11.0 (11.00.15063.0608)
Boot mode: Normal

Running processes:
C:\Program Files (x86)\TeamViewer\TeamViewer.exe
C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe
C:\Program Files (x86)\HP\StatusAlerts\bin\HPStatusAlerts.exe
C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
C:\Program Files\Lenovo\Lenovo Solution Center\LSCNotify.exe
C:\Program Files (x86)\Lenovo\iMController\PluginHost\Lenovo.Modern.ImController.PluginHost.SettingsApp.exe
C:\Program Files (x86)\totalcmd\TOTALCMD.EXE
C:\Drivers\teamviewer.exe
C:\Program Files\trend micro\Libor.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://lenovo15.msn.com/?pc=LCTE
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.cz/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/p/?LinkId=255141
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/p/?LinkId=255141
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = %11%\blank.htm
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F2 - REG:system.ini: UserInit=
O2 - BHO: URLRedirectionBHO - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [StatusAlerts] "C:\Program Files (x86)\HP\StatusAlerts\bin\HPStatusAlerts.exe" /enum:on /alerts:on /notifications:on /fl:on /fr:on /appData:on /tmcp:on
O4 - HKUS\S-1-5-19\..\Run: [OneDriveSetup] C:\Windows\SysWOW64\OneDriveSetup.exe /thfirstsetup (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [OneDriveSetup] C:\Windows\SysWOW64\OneDriveSetup.exe /thfirstsetup (User 'NETWORK SERVICE')
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\Program Files (x86)\Microsoft Office\Root\Office16\EXCEL.EXE/3000
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~2\MICROS~1\Office14\EXCEL.EXE/3000
O8 - Extra context menu item: Se&nd to OneNote - res://C:\Program Files (x86)\Microsoft Office\Root\Office16\ONBttnIE.dll/105
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O18 - Protocol: tbauth - {14654CA6-5711-491D-B89A-58E571679951} - C:\Windows\SysWOW64\tbauth.dll
O18 - Protocol: windows.tbauth - {14654CA6-5711-491D-B89A-58E571679951} - C:\Windows\SysWOW64\tbauth.dll
O18 - Filter hijack: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\WINDOWS\SysWoW64\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\WINDOWS\System32\alg.exe (file missing)
O23 - Service: AtherosSvc - Unknown owner - C:\WINDOWS\system32\AdminService.exe (file missing)
O23 - Service: CCSDK - Lenovo - C:\Program Files (x86)\Lenovo\CCSDK\CCSDK.exe
O23 - Service: Intel(R) Content Protection HECI Service (cphs) - Intel Corporation - C:\WINDOWS\System32\DriverStore\FileRepository\igdlh64.inf_amd64_bde03d8af75e6be5\IntelCpHeciSvc.exe
O23 - Service: Intel(R) Content Protection HDCP Service (cplspcon) - Intel Corporation - C:\WINDOWS\System32\DriverStore\FileRepository\igdlh64.inf_amd64_bde03d8af75e6be5\IntelCpHDCPSvc.exe
O23 - Service: Conexant Audio Message Service (CxAudMsg) - Unknown owner - C:\Windows\system32\CxAudMsg64.exe (file missing)
O23 - Service: Dolby DAX2 API Service (DAX2API) - Unknown owner - C:\Program Files\Dolby\Dolby DAX2\DAX2_API\DolbyDAX2API.exe
O23 - Service: @%SystemRoot%\system32\DiagSvcs\DiagnosticsHub.StandardCollector.ServiceRes.dll,-1000 (diagnosticshub.standardcollector.service) - Unknown owner - C:\WINDOWS\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe (file missing)
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\WINDOWS\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\WINDOWS\system32\fxssvc.exe (file missing)
O23 - Service: GDCAgent - Lenovo - C:\Program Files (x86)\Lenovo\GDCAgentSetupRed\GDCAgent.exe
O23 - Service: HP DS Service - Hewlett-Packard Company - C:\Program Files (x86)\HP\HPBDSService\HPBDSService.exe
O23 - Service: HP LaserJet Service - HP - C:\Program Files (x86)\HP\HPLaserJetService\HPLaserJetService.exe
O23 - Service: Intel(R) Rapid Storage Technology (IAStorDataMgrSvc) - Intel Corporation - C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
O23 - Service: Intel(R) HD Graphics Control Panel Service (igfxCUIService2.0.0.0) - Intel Corporation - C:\WINDOWS\System32\DriverStore\FileRepository\igdlh64.inf_amd64_bde03d8af75e6be5\igfxCUIService.exe
O23 - Service: @oem37.inf,%ImcSvcDisplayName%;System Interface Foundation Service (ImControllerService) - Lenovo Group Limited - C:\Program Files\Lenovo\ImController\Service\Lenovo.Modern.ImController.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\WINDOWS\system32\lsass.exe (file missing)
O23 - Service: LSCWinService - Lenovo - C:\Program Files\Lenovo\Lenovo Solution Center\App\LSCWinService.exe
O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\WINDOWS\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\WINDOWS\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\WINDOWS\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\WINDOWS\system32\lsass.exe (file missing)
O23 - Service: Conexant SmartAudio service (SAService) - Conexant Systems, Inc. - C:\Windows\system32\SAsrv.exe
O23 - Service: @%systemroot%\system32\SecurityHealthAgent.dll,-1002 (SecurityHealthService) - Unknown owner - C:\WINDOWS\system32\SecurityHealthService.exe (file missing)
O23 - Service: @%SystemRoot%\system32\SensorDataService.exe,-101 (SensorDataService) - Unknown owner - C:\WINDOWS\System32\SensorDataService.exe (file missing)
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\WINDOWS\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spectrum.exe,-101 (spectrum) - Unknown owner - C:\WINDOWS\system32\spectrum.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\WINDOWS\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\WINDOWS\system32\sppsvc.exe (file missing)
O23 - Service: SynTPEnh Caller Service (SynTPEnhService) - Synaptics Incorporated - C:\Program Files\Synaptics\SynTP\SynTPEnhService.exe
O23 - Service: TeamViewer 12 (TeamViewer) - TeamViewer GmbH - C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
O23 - Service: @%SystemRoot%\system32\TieringEngineService.exe,-702 (TieringEngineService) - Unknown owner - C:\WINDOWS\system32\TieringEngineService.exe (file missing)
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\WINDOWS\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\WINDOWS\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\WINDOWS\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\WINDOWS\system32\vssvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\WINDOWS\system32\wbengine.exe (file missing)
O23 - Service: @%ProgramFiles%\Windows Defender\MpAsDesc.dll,-320 (WdNisSvc) - Unknown owner - C:\Program Files (x86)\Windows Defender\NisSrv.exe (file missing)
O23 - Service: @%ProgramFiles%\Windows Defender\MpAsDesc.dll,-310 (WinDefend) - Unknown owner - C:\Program Files (x86)\Windows Defender\MsMpEng.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\WINDOWS\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--
End of file - 9626 bytes

======Listing Processes======







winlogon.exe

C:\WINDOWS\system32\lsass.exe
c:\windows\system32\svchost.exe -k dcomlaunch -s PlugPlay
C:\WINDOWS\system32\svchost.exe -k DcomLaunch
"fontdrvhost.exe"
"fontdrvhost.exe"
c:\windows\system32\svchost.exe -k rpcss
c:\windows\system32\svchost.exe -k dcomlaunch -s LSM
"dwm.exe"
C:\WINDOWS\system32\svchost.exe -k LocalSystemNetworkRestricted
c:\windows\system32\svchost.exe -k localservice -s bthserv
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s NcbService
c:\windows\system32\svchost.exe -k localservicenetworkrestricted -s TimeBrokerSvc
c:\windows\system32\svchost.exe -k netsvcs -s Schedule
"C:\Windows\System32\WUDFHost.exe" -HostGUID:{193a1820-d9ac-4997-8c55-be817523f6aa} -IoEventPortName:HostProcess-ecf1198c-40ed-4a41-8407-43b8f38962ac -SystemEventPortName:HostProcess-69bf9901-288c-45a6-bef3-ef159537e4ef -IoCancelEventPortName:HostProcess-f5be6374-0980-4af6-b27c-88bfae850a7b -NonStateChangingEventPortName:HostProcess-adbd06ed-7144-45d1-8203-4fda6e51f5db -ServiceSID:S-1-5-80-2652678385-582572993-1835434367-1344795993-749280709 -LifetimeId:53312465-91d2-4c32-a0b3-628155a9aa21 -DeviceGroupId:WudfDefaultDevicePool
c:\windows\system32\svchost.exe -k netsvcs -s ProfSvc
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s hidserv
C:\WINDOWS\system32\svchost.exe -k LocalServiceNoNetwork
c:\windows\system32\svchost.exe -k netsvcs -s UserManager
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s DeviceAssociationService
"C:\Windows\System32\WUDFHost.exe" -HostGUID:{193a1820-d9ac-4997-8c55-be817523f6aa} -IoEventPortName:HostProcess-e08fbd5b-e2a7-468e-8881-78383fd12cc2 -SystemEventPortName:HostProcess-ddd2f91a-74a9-4071-bfd0-02c01233ddbf -IoCancelEventPortName:HostProcess-091d56fd-f39b-48bb-ae35-12be72d80455 -NonStateChangingEventPortName:HostProcess-a151616d-aab2-4817-9505-301221508c29 -ServiceSID:S-1-5-80-2652678385-582572993-1835434367-1344795993-749280709 -LifetimeId:4209369a-d273-424b-9b96-52c2d4c33767 -DeviceGroupId:
c:\windows\system32\svchost.exe -k localservicenetworkrestricted -s EventLog
c:\windows\system32\svchost.exe -k localservice -s nsi
c:\windows\system32\svchost.exe -k localservice -s EventSystem
c:\windows\system32\svchost.exe -k netsvcs -s Themes
c:\windows\system32\svchost.exe -k appmodel -s StateRepository
c:\windows\system32\svchost.exe -k localservicenetworkrestricted -s Dhcp
dashost.exe {67145b27-7a96-42b6-af0454578e412878}
c:\windows\system32\svchost.exe -k netsvcs -s SENS
C:\WINDOWS\System32\DriverStore\FileRepository\igdlh64.inf_amd64_bde03d8af75e6be5\igfxCUIService.exe
c:\windows\system32\svchost.exe -k networkservice -s NlaSvc
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s AudioEndpointBuilder
c:\windows\system32\svchost.exe -k localservice -s FontCache
c:\windows\system32\svchost.exe -k localservice -s netprofm
C:\WINDOWS\System32\svchost.exe -k LocalServiceNetworkRestricted
c:\windows\system32\svchost.exe -k networkservice -s Dnscache
C:\WINDOWS\system32\svchost.exe -k LocalServiceNetworkRestricted
C:\WINDOWS\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\WINDOWS\system32\svchost.exe -k LocalSystemNetworkRestricted
c:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection
C:\WINDOWS\System32\spoolsv.exe
c:\windows\system32\svchost.exe -k localserviceandnoimpersonation -s SSDPSRV
c:\windows\system32\svchost.exe -k networkservice -s LanmanWorkstation
C:\WINDOWS\system32\SearchIndexer.exe /Embedding
c:\windows\system32\svchost.exe -k appmodel -s tiledatamodelsvc
c:\windows\system32\svchost.exe -k localservice -s WinHttpAutoProxySvc
C:\Windows\system32\CxAudMsg64.exe
"C:\Program Files\Lenovo\ImController\Service\Lenovo.Modern.ImController.exe"
"C:\Program Files (x86)\HP\HPLaserJetService\HPLaserJetService.exe"
"C:\Program Files\Dolby\Dolby DAX2\DAX2_API\DolbyDAX2API.exe"
C:\WINDOWS\System32\svchost.exe -k utcsvc
C:\WINDOWS\system32\AdminService.exe
"C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe"
c:\windows\system32\svchost.exe -k networkservice -s CryptSvc
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s PcaSvc
"C:\Program Files\Synaptics\SynTP\SynTPEnhService.exe"
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s SysMain
c:\windows\system32\svchost.exe -k localservicenonetwork -s DPS

c:\windows\system32\svchost.exe -k netsvcs -s LanmanServer
C:\WINDOWS\system32\svchost.exe -k imgsvc
"C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe"
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s TrkWks
c:\windows\system32\svchost.exe -k netsvcs -s Winmgmt

c:\windows\system32\svchost.exe -k netsvcs -s WpnService

c:\windows\system32\svchost.exe -k netsvcs -s iphlpsvc
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s WdiSystemHost
c:\windows\system32\svchost.exe -k localservice -s WdiServiceHost
sihost.exe
c:\windows\system32\svchost.exe -k unistacksvcgroup -s CDPUserSvc
c:\windows\system32\svchost.exe -k unistacksvcgroup -s WpnUserService
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
C:\WINDOWS\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
c:\windows\system32\svchost.exe -k netsvcs -s TokenBroker
"C:\WINDOWS\System32\DriverStore\FileRepository\igdlh64.inf_amd64_bde03d8af75e6be5\igfxEM.exe"
C:\WINDOWS\Explorer.EXE
"C:\WINDOWS\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mca
C:\Windows\System32\RuntimeBroker.exe -Embedding
"C:\Program Files\Synaptics\SynTP\SynTPEnh.exe"
c:\windows\system32\svchost.exe -k netsvcs -s Appinfo
c:\windows\system32\svchost.exe -k netsvcs -s Browser
"C:\Program Files (x86)\TeamViewer\TeamViewer.exe"
"C:\PROGRAM FILES\SYNAPTICS\SYNTP\SYNTPHELPER.EXE"
"C:\Program Files (x86)\TeamViewer\tv_w32.exe" --action hooks --deferlog --log
"C:\Program Files (x86)\TeamViewer\tv_x64.exe" --action hooks --deferlog --log
c:\windows\system32\svchost.exe -k localservice -s LicenseManager
"C:\Program Files\WindowsApps\Microsoft.SkypeApp_12.9.604.0_x64__kzf8qxf38zg5c\SkypeHost.exe" -ServerName:SkypeHost.ServerServer
c:\windows\system32\svchost.exe -k localservice -s CDPSvc
C:\WINDOWS\System32\DriverStore\FileRepository\igdlh64.inf_amd64_bde03d8af75e6be5\IntelCpHeciSvc.exe
"C:\Program Files\Windows Defender\MSASCuiL.exe"
"C:\Program Files\CONEXANT\ForteConfig\fmapp.exe"
"C:\Program Files\Dolby\Dolby DAX2\DAX2_APP\DolbyDAX2TrayIcon.exe" -Hide
"C:\Program Files\CONEXANT\cAudioFilterAgent\CAudioFilterAgent64.exe"
"C:\ProgramData\Lenovo\ImController\Plugins\IdeaOSDPackage\x64\utility.exe"
"C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe"
"C:\Program Files (x86)\HP\StatusAlerts\bin\HPStatusAlerts.exe" /enum:on /alerts:on /notifications:on /fl:on /fr:on /appData:on /tmcp:on
C:\WINDOWS\system32\wbem\wmiprvse.exe
"C:\Users\Libor\AppData\Local\Host App Service\Engine\HostAppServiceUpdater.exe" /LOGON
"C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe"
c:\windows\system32\svchost.exe -k localserviceandnoimpersonation -s wcncsvc
"C:\Program Files\Lenovo\Lenovo Solution Center\LSCNotify.exe" /showasync
C:\WINDOWS\system32\wbem\wmiprvse.exe
c:\windows\system32\svchost.exe -k unistacksvcgroup
"C:\Program Files (x86)\Lenovo\GDCAgentSetupRed\GDCAgent.exe"
"C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe"
c:\windows\system32\svchost.exe -k localservicenetworkrestricted -s wscsvc
"C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"
C:\WINDOWS\system32\svchost.exe -k netsvcs -s wlidsvc
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s StorSvc
C:\WINDOWS\system32\ApplicationFrameHost.exe -Embedding
"C:\Program Files\WindowsApps\Microsoft.WindowsStore_11711.1001.5.0_x64__8wekyb3d8bbwe\WinStore.App.exe" -ServerName:App.AppXc75wvwned5vhz4xyxxecvgdjhdkgsdza.mca
"C:\WINDOWS\ImmersiveControlPanel\SystemSettings.exe" -ServerName:microsoft.windows.immersivecontrolpanel
c:\windows\system32\svchost.exe -k netsvcs -s lfsvc
C:\WINDOWS\system32\DllHost.exe /Processid:{973D20D7-562D-44B9-B70B-5A0F49CCDF3F}
c:\windows\system32\svchost.exe -k netsvcs -s BITS
"C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca
taskhostw.exe
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s SensorService
"C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.17102.13911.0_x64__8wekyb3d8bbwe\Video.UI.exe" -ServerName:Microsoft.ZuneVideo.AppX758ya5sqdjd98rx6z7g95nw6jy7bqx9y.mca
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s DsSvc
C:\WINDOWS\System32\svchost.exe -k LocalServiceNetworkRestricted -s lmhosts
-name f5a2026a-878b-4509-8fd5-55b5a15d04d5 -runas -pluginName LenovoAudioPlugin -pluginVersion 1.2.211.0
C:\WINDOWS\system32\svchost.exe -k LocalService -s W32Time
"C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.8730.21155.0_x64__8wekyb3d8bbwe\HxOutlook.exe" -ServerName:microsoft.windowslive.mail.AppXfbjsbkxvprcgqg6q4c9jfr0pn3kv9x5s.mca
"C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.8730.21155.0_x64__8wekyb3d8bbwe\HxTsr.exe" -ServerName:Hx.IPC.Server
C:\WINDOWS\system32\svchost.exe -k SDRSVC
"C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2017.39091.16340.0_x64__8wekyb3d8bbwe\Microsoft.Photos.exe" -ServerName:App.AppXzst44mncqdg84v7sv6p7yznqwssy6f7f.mca
C:\Windows\System32\smartscreen.exe -Embedding
"C:\Program Files (x86)\totalcmd\TOTALCMD.EXE"
"C:\WINDOWS\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
C:\WINDOWS\system32\browser_broker.exe -Embedding
"C:\WINDOWS\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
"C:\WINDOWS\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
"C:\Program Files (x86)\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Libor\Desktop\DOKUMENTY\JTA\Read___ME.html"
"C:\Program Files (x86)\Mozilla Firefox\firefox.exe" -contentproc --channel="6664.0.797617453\249708479" -greomni "C:\Program Files (x86)\Mozilla Firefox\omni.ja" -appomni "C:\Program Files (x86)\Mozilla Firefox\browser\omni.ja" -appdir "C:\Program Files (x86)\Mozilla Firefox\browser" "C:\Users\Libor\AppData\LocalLow\Mozilla\Temp-{c8923366-9400-4864-b47a-febd4cc86780}" 6664 "\\.\pipe\gecko-crash-server-pipe.6664" gpu
"C:\Program Files (x86)\Mozilla Firefox\firefox.exe" -contentproc --channel="6664.13.1440697485\95396828" -childID 2 -isForBrowser -intPrefs 5:50|6:-1|28:1000|34:20|35:5|36:10|45:128|46:10000|51:0|53:400|54:1|55:0|56:0|61:0|62:120|63:120|98:2|99:1|114:5000|124:0|126:0|137:10000|149:-1|154:128|155:10000|156:0|162:24|163:32768|165:0|166:0|174:5|178:1048576|179:100|180:5000|182:600|184:1|193:3|197:0|206:60000| -boolPrefs 1:0|2:0|4:0|26:1|27:1|30:0|33:1|37:1|38:0|39:0|40:0|43:1|44:1|47:0|48:0|49:0|50:0|52:0|57:1|58:1|59:0|60:1|64:1|65:1|66:0|67:1|68:1|69:0|70:1|73:0|74:0|77:1|78:1|82:1|83:1|84:1|85:0|86:0|88:0|89:0|90:1|91:0|92:1|95:1|97:0|100:1|101:0|108:0|113:0|116:1|119:1|121:1|125:0|128:1|131:1|132:1|138:1|139:0|140:1|142:0|148:0|150:1|151:0|152:1|153:1|160:0|161:0|164:1|167:0|169:1|171:1|172:0|177:0|181:1|186:0|187:0|188:0|189:1|190:0|191:1|192:1|195:0|198:0|199:0|200:1|201:1|202:0|203:1|204:1|205:1|207:0|208:0|210:0|218:1|219:1|220:0|221:0|222:0| -stringPrefs "3:7;release|96:0;|141:3;1.0|158:332; ¼½¾ǃː̷̸։֊׃״؉؊٪۔܁܂܃܄ᅟᅠ᜵           ‎‏‐’․‧

‪‫‬‭‮ ‹›⁁⁄⁒ ⅓⅔⅕⅖⅗⅘⅙⅚⅛⅜⅝⅞⅟∕∶⎮╱⧶⧸⫻⫽⿰⿱⿲⿳⿴⿵⿶⿷⿸⿹⿺⿻ 。〔〕〳゠ㅤ㈝㈞㎮㎯㏆㏟꞉︔︕︿﹝﹞./。ᅠ |159:4;high|194:38;{c8923366-9400-4864-b47a-febd4cc86780}|" -schedulerPrefs 0001,2 -greomni "C:\Program Files (x86)\Mozilla Firefox\omni.ja" -appomni "C:\Program Files (x86)\Mozilla Firefox\browser\omni.ja" -appdir "C:\Program Files (x86)\Mozilla Firefox\browser" 6664 "\\.\pipe\gecko-crash-server-pipe.6664" tab
"C:\Program Files (x86)\Mozilla Firefox\firefox.exe" -contentproc --channel="6664.20.1616297337\151906760" -childID 3 -isForBrowser -intPrefs 5:50|6:-1|28:1000|34:20|35:5|36:10|45:128|46:10000|51:0|53:400|54:1|55:0|56:0|61:0|62:120|63:120|98:2|99:1|114:5000|124:0|126:0|137:10000|149:-1|154:128|155:10000|156:0|162:24|163:32768|165:0|166:0|174:5|178:1048576|179:100|180:5000|182:600|184:1|193:3|197:0|206:60000| -boolPrefs 1:0|2:0|4:0|26:1|27:1|30:0|33:1|37:1|38:0|39:0|40:0|43:1|44:1|47:0|48:0|49:0|50:0|52:0|57:1|58:1|59:0|60:1|64:1|65:1|66:0|67:1|68:1|69:0|70:1|73:0|74:0|77:1|78:1|82:1|83:1|84:1|85:0|86:0|88:0|89:0|90:1|91:0|92:1|95:1|97:0|100:1|101:0|108:0|113:0|116:1|119:1|121:1|125:0|128:1|131:1|132:1|138:1|139:0|140:1|142:0|148:0|150:1|151:0|152:1|153:1|160:0|161:0|164:1|167:0|169:1|171:1|172:0|177:0|181:1|186:0|187:0|188:0|189:1|190:0|191:1|192:1|195:0|198:0|199:0|200:1|201:1|202:0|203:1|204:1|205:1|207:0|208:0|210:0|218:1|219:1|220:0|221:0|222:0| -stringPrefs "3:7;release|96:0;|141:3;1.0|158:332; ¼½¾ǃː̷̸։֊׃״؉؊٪۔܁܂܃܄ᅟᅠ᜵           ‎‏‐’․‧

‪‫‬‭‮ ‹›⁁⁄⁒ ⅓⅔⅕⅖⅗⅘⅙⅚⅛⅜⅝⅞⅟∕∶⎮╱⧶⧸⫻⫽⿰⿱⿲⿳⿴⿵⿶⿷⿸⿹⿺⿻ 。〔〕〳゠ㅤ㈝㈞㎮㎯㏆㏟꞉︔︕︿﹝﹞./。ᅠ |159:4;high|194:38;{c8923366-9400-4864-b47a-febd4cc86780}|" -schedulerPrefs 0001,2 -greomni "C:\Program Files (x86)\Mozilla Firefox\omni.ja" -appomni "C:\Program Files (x86)\Mozilla Firefox\browser\omni.ja" -appdir "C:\Program Files (x86)\Mozilla Firefox\browser" 6664 "\\.\pipe\gecko-crash-server-pipe.6664" tab
C:\WINDOWS\system32\DllHost.exe /Processid:{7E55A26D-EF95-4A45-9F55-21E52ADF9887}
"C:\Program Files (x86)\Mozilla Firefox\firefox.exe" -contentproc --channel="6664.34.1809958214\578952058" -childID 5 -isForBrowser -intPrefs 5:50|6:-1|28:1000|34:20|35:5|36:10|45:128|46:10000|51:0|53:400|54:1|55:0|56:0|61:0|62:120|63:120|98:2|99:1|114:5000|124:0|126:0|137:10000|149:-1|154:128|155:10000|156:0|162:24|163:32768|165:0|166:0|174:5|178:1048576|179:100|180:5000|182:600|184:1|193:3|197:0|206:60000| -boolPrefs 1:0|2:0|4:0|26:1|27:1|30:0|33:1|37:1|38:0|39:0|40:0|43:1|44:1|47:0|48:0|49:0|50:0|52:0|57:1|58:1|59:0|60:1|64:1|65:1|66:0|67:1|68:1|69:0|70:1|73:0|74:0|77:1|78:1|82:1|83:1|84:1|85:0|86:0|88:0|89:0|90:1|91:0|92:1|95:1|97:0|100:1|101:0|108:0|113:0|116:1|119:1|121:1|125:0|128:1|131:1|132:1|138:1|139:0|140:1|142:0|148:0|150:1|151:0|152:1|153:1|160:0|161:0|164:1|167:0|169:1|171:1|172:0|177:0|181:1|186:0|187:0|188:0|189:1|190:0|191:1|192:1|195:0|198:0|199:0|200:1|201:1|202:0|203:1|204:1|205:1|207:0|208:0|210:0|218:1|219:1|220:0|221:0|222:0| -stringPrefs "3:7;release|96:0;|141:3;1.0|158:332; ¼½¾ǃː̷̸։֊׃״؉؊٪۔܁܂܃܄ᅟᅠ᜵           ‎‏‐’․‧

‪‫‬‭‮ ‹›⁁⁄⁒ ⅓⅔⅕⅖⅗⅘⅙⅚⅛⅜⅝⅞⅟∕∶⎮╱⧶⧸⫻⫽⿰⿱⿲⿳⿴⿵⿶⿷⿸⿹⿺⿻ 。〔〕〳゠ㅤ㈝㈞㎮㎯㏆㏟꞉︔︕︿﹝﹞./。ᅠ |159:4;high|194:38;{c8923366-9400-4864-b47a-febd4cc86780}|" -schedulerPrefs 0001,2 -greomni "C:\Program Files (x86)\Mozilla Firefox\omni.ja" -appomni "C:\Program Files (x86)\Mozilla Firefox\browser\omni.ja" -appdir "C:\Program Files (x86)\Mozilla Firefox\browser" 6664 "\\.\pipe\gecko-crash-server-pipe.6664" tab
"C:\Windows\SystemApps\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\SecHealthUI.exe" -ServerName:SecHealthUI.AppXep4x2tbtjws1v9qqs0rmb3hxykvkpqtn.mca
C:\WINDOWS\system32\svchost.exe -k netsvcs -s gpsvc
C:\WINDOWS\system32\AUDIODG.EXE 0x5a0
c:\windows\system32\svchost.exe -k netsvcs
C:\WINDOWS\system32\svchost.exe -k LocalService
"C:\WINDOWS\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3780425845-2968498933-620653400-10013_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3780425845-2968498933-620653400-10013 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
"C:\WINDOWS\system32\SearchFilterHost.exe" 0 688 692 700 8192 696
"C:\WINDOWS\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
C:\Windows\System32\InstallAgent.exe -Embedding
"C:\WINDOWS\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
"C:\WINDOWS\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
"C:\Users\Libor\Desktop\RSITx64.exe"
C:\Drivers\teamviewer.exe

=========Mozilla firefox=========

ProfilePath - C:\Users\Libor\AppData\Roaming\Mozilla\Firefox\Profiles\l5f9lrhm.default

prefs.js - "browser.startup.homepage" - "www.seznam.cz"

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 27.0.0.187 Plugin
"Path"=C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_27_0_0_187.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0]
"Description"=Office Authorization plug-in for NPAPI browsers
"Path"=C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@microsoft.com/SharePoint,version=14.0]
"Description"=Microsoft SharePoint Plug-in for Firefox
"Path"=C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\Adobe Reader]
"Description"=Handles PDFs in-place in Firefox
"Path"=C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll


[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 27.0.0.187 Plugin
"Path"=C:\WINDOWS\system32\Macromed\Flash\NPSWF64_27_0_0_187.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0]
"Description"=Office Authorization plug-in for NPAPI browsers
"Path"=C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL


======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF}]
Office Document Cache Handler - C:\PROGRA~1\MICROS~1\Office14\URLREDIR.DLL [2013-03-06 690392]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF}]
Office Document Cache Handler - C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL [2013-03-06 562904]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"SecurityHealth"=C:\Program Files\Windows Defender\MSASCuiL.exe [2017-03-18 629152]
"ForteConfig"=C:\Program Files\Conexant\ForteConfig\fmapp.exe [2010-10-26 49056]
"DAX2_APP"=C:\Program Files\Dolby\Dolby DAX2\DAX2_APP\DolbyDAX2TrayIcon.exe [2016-02-04 736768]
"SmartAudio"=C:\Program Files\CONEXANT\SAII\SACpl.exe [2016-01-08 1831256]
"cAudioFilterAgent"=C:\Program Files\Conexant\cAudioFilterAgent\cAudioFilterAgent64.exe [2015-12-08 602968]
"IAStorIcon"=C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIconLaunch.exe [2015-11-18 71168]
"LenovoUtility"=C:\ProgramData\Lenovo\ImController\Plugins\IdeaOSDPackage\x64\utility.exe [2017-07-27 911272]

[HKEY_LOCAL_MACHINE\Software\wow6432node\Microsoft\Windows\CurrentVersion\Run]
"HP Software Update"=C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe [2014-08-13 49904]
"StatusAlerts"=C:\Program Files (x86)\HP\StatusAlerts\bin\HPStatusAlerts.exe [2013-04-18 313656]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Ahcache.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\CoreMessagingRegistrar]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\iai2c.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SpbCx.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\StateRepository]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\TileDataModelSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\uefi.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\UserManager]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{F2E7DD72-6468-4E36-B6F1-6488F42C1B52}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Ahcache.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\CoreMessagingRegistrar]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\NetSetupSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\SpbCx.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\StateRepository]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\TileDataModelSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\uefi.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\UserManager]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{F2E7DD72-6468-4E36-B6F1-6488F42C1B52}]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"DSCAutomationHostEnabled"=2
"PromptOnSecureDesktop"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"midimapper"=midimap.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.l3acm"=C:\Windows\System32\l3codeca.acm
"msacm.msadpcm"=msadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"vidc.i420"=iyuv_32.dll
"vidc.iyuv"=iyuv_32.dll
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"vidc.uyvy"=msyuv.dll
"vidc.yuy2"=msyuv.dll
"vidc.yvu9"=tsbyuv.dll
"vidc.yvyu"=msyuv.dll
"wavemapper"=msacm32.drv
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv
"wave1"=wdmaud.drv
"midi1"=wdmaud.drv
"mixer1"=wdmaud.drv
"aux1"=wdmaud.drv
"MSVideo8"=VfWWDM32.dll

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*

======List of files/folders created in the last 1 month======

2017-12-11 11:50:50 ----D---- C:\rsit
2017-12-11 11:50:50 ----D---- C:\Program Files\trend micro
2017-12-11 06:56:44 ----D---- C:\WINDOWS\LastGood
2017-12-06 14:55:22 ----D---- C:\WINDOWS\Microsoft Antimalware
2017-12-06 06:53:22 ----SHD---- C:\Config.Msi
2017-11-15 14:06:37 ----A---- C:\WINDOWS\SYSWOW64\DWWIN.EXE
2017-11-15 14:06:37 ----A---- C:\WINDOWS\SYSWOW64\aepic.dll
2017-11-15 14:06:36 ----A---- C:\WINDOWS\SYSWOW64\wudriver.dll
2017-11-15 14:06:36 ----A---- C:\WINDOWS\SYSWOW64\werui.dll
2017-11-15 14:06:36 ----A---- C:\WINDOWS\SYSWOW64\wermgr.exe
2017-11-15 14:06:36 ----A---- C:\WINDOWS\SYSWOW64\WerFault.exe
2017-11-15 14:06:36 ----A---- C:\WINDOWS\SYSWOW64\wer.dll
2017-11-15 14:06:36 ----A---- C:\WINDOWS\SYSWOW64\vbscript.dll
2017-11-15 14:06:36 ----A---- C:\WINDOWS\SYSWOW64\PCPKsp.dll
2017-11-15 14:06:36 ----A---- C:\WINDOWS\SYSWOW64\olepro32.dll
2017-11-15 14:06:36 ----A---- C:\WINDOWS\SYSWOW64\odbcconf.dll
2017-11-15 14:06:36 ----A---- C:\WINDOWS\SYSWOW64\MSVPXENC.dll
2017-11-15 14:06:36 ----A---- C:\WINDOWS\SYSWOW64\FirewallAPI.dll
2017-11-15 14:06:36 ----A---- C:\WINDOWS\SYSWOW64\Faultrep.dll
2017-11-15 14:06:36 ----A---- C:\WINDOWS\SYSWOW64\CoreMessaging.dll
2017-11-15 14:06:36 ----A---- C:\WINDOWS\SYSWOW64\cldapi.dll
2017-11-15 14:06:36 ----A---- C:\WINDOWS\SYSWOW64\bcryptprimitives.dll
2017-11-15 14:06:36 ----A---- C:\WINDOWS\SYSWOW64\aadtb.dll
2017-11-15 14:06:35 ----A---- C:\WINDOWS\SYSWOW64\Windows.Media.Protection.PlayReady.dll
2017-11-15 14:06:35 ----A---- C:\WINDOWS\SYSWOW64\win32kfull.sys
2017-11-15 14:06:35 ----A---- C:\WINDOWS\SYSWOW64\user32.dll
2017-11-15 14:06:35 ----A---- C:\WINDOWS\SYSWOW64\ExplorerFrame.dll
2017-11-15 14:06:35 ----A---- C:\WINDOWS\SYSWOW64\ActiveSyncProvider.dll
2017-11-15 14:06:34 ----A---- C:\WINDOWS\SYSWOW64\wuapi.dll
2017-11-15 14:06:34 ----A---- C:\WINDOWS\SYSWOW64\WerFaultSecure.exe
2017-11-15 14:06:34 ----A---- C:\WINDOWS\SYSWOW64\mstscax.dll
2017-11-15 14:06:34 ----A---- C:\WINDOWS\SYSWOW64\KernelBase.dll
2017-11-15 14:06:34 ----A---- C:\WINDOWS\SYSWOW64\dbgeng.dll
2017-11-15 14:06:33 ----A---- C:\WINDOWS\SYSWOW64\winhttp.dll
2017-11-15 14:06:33 ----A---- C:\WINDOWS\SYSWOW64\shell32.dll
2017-11-15 14:06:33 ----A---- C:\WINDOWS\SYSWOW64\CoreUIComponents.dll
2017-11-15 14:06:33 ----A---- C:\WINDOWS\system32\tquery.dll
2017-11-15 14:06:32 ----A---- C:\WINDOWS\SYSWOW64\wininet.dll
2017-11-15 14:06:32 ----A---- C:\WINDOWS\SYSWOW64\Windows.Data.Pdf.dll
2017-11-15 14:06:32 ----A---- C:\WINDOWS\SYSWOW64\tquery.dll
2017-11-15 14:06:32 ----A---- C:\WINDOWS\SYSWOW64\msIso.dll
2017-11-15 14:06:32 ----A---- C:\WINDOWS\SYSWOW64\d2d1.dll
2017-11-15 14:06:31 ----A---- C:\WINDOWS\SYSWOW64\Windows.Media.dll
2017-11-15 14:06:31 ----A---- C:\WINDOWS\SYSWOW64\D3DCompiler_47.dll
2017-11-15 14:06:31 ----A---- C:\WINDOWS\SYSWOW64\AzureSettingSyncProvider.dll
2017-11-15 14:06:31 ----A---- C:\WINDOWS\SYSWOW64\AppXDeploymentClient.dll
2017-11-15 14:06:30 ----A---- C:\WINDOWS\SYSWOW64\WpcWebFilter.dll
2017-11-15 14:06:30 ----A---- C:\WINDOWS\SYSWOW64\Windows.System.Launcher.dll
2017-11-15 14:06:30 ----A---- C:\WINDOWS\SYSWOW64\Windows.AccountsControl.dll
2017-11-15 14:06:30 ----A---- C:\WINDOWS\SYSWOW64\msexcl40.dll
2017-11-15 14:06:30 ----A---- C:\WINDOWS\SYSWOW64\efswrt.dll
2017-11-15 14:06:30 ----A---- C:\WINDOWS\SYSWOW64\dsreg.dll
2017-11-15 14:06:30 ----A---- C:\WINDOWS\SYSWOW64\daxexec.dll
2017-11-15 14:06:30 ----A---- C:\WINDOWS\system32\VPNv2CSP.dll
2017-11-15 14:06:30 ----A---- C:\WINDOWS\system32\mssprxy.dll
2017-11-15 14:06:30 ----A---- C:\WINDOWS\system32\drivers\stornvme.sys
2017-11-15 14:06:29 ----A---- C:\WINDOWS\SYSWOW64\tzres.dll
2017-11-15 14:06:29 ----A---- C:\WINDOWS\SYSWOW64\OnDemandConnRouteHelper.dll
2017-11-15 14:06:29 ----A---- C:\WINDOWS\SYSWOW64\CertPKICmdlet.dll
2017-11-15 14:06:29 ----A---- C:\WINDOWS\system32\utcutil.dll
2017-11-15 14:06:29 ----A---- C:\WINDOWS\system32\storewuauth.dll
2017-11-15 14:06:28 ----A---- C:\WINDOWS\system32\mstscax.dll
2017-11-15 14:06:28 ----A---- C:\WINDOWS\system32\drivers\storport.sys
2017-11-15 14:06:28 ----A---- C:\WINDOWS\system32\diagtrack.dll
2017-11-15 14:06:26 ----A---- C:\WINDOWS\SYSWOW64\wpdshext.dll
2017-11-15 14:06:26 ----A---- C:\WINDOWS\system32\wuautoappupdate.dll
2017-11-15 14:06:26 ----A---- C:\WINDOWS\system32\wpdshext.dll
2017-11-15 14:06:26 ----A---- C:\WINDOWS\system32\MusNotificationUx.exe
2017-11-15 14:06:26 ----A---- C:\WINDOWS\system32\MusNotification.exe
2017-11-15 14:06:25 ----A---- C:\WINDOWS\SYSWOW64\edgehtml.dll
2017-11-15 14:06:24 ----A---- C:\WINDOWS\SYSWOW64\mshtml.dll
2017-11-15 14:06:24 ----A---- C:\WINDOWS\SYSWOW64\jscript.dll
2017-11-15 14:06:24 ----A---- C:\WINDOWS\SYSWOW64\Chakradiag.dll
2017-11-15 14:06:23 ----A---- C:\WINDOWS\SYSWOW64\jscript9.dll
2017-11-15 14:06:23 ----A---- C:\WINDOWS\SYSWOW64\ieproxy.dll
2017-11-15 14:06:23 ----A---- C:\WINDOWS\SYSWOW64\Chakra.dll
2017-11-15 14:06:23 ----A---- C:\WINDOWS\system32\vbscript.dll
2017-11-15 14:06:23 ----A---- C:\WINDOWS\system32\jscript9.dll
2017-11-15 14:06:23 ----A---- C:\WINDOWS\system32\ieproxy.dll
2017-11-15 14:06:22 ----A---- C:\WINDOWS\system32\KernelBase.dll
2017-11-15 14:06:22 ----A---- C:\WINDOWS\system32\jscript.dll
2017-11-15 14:06:22 ----A---- C:\WINDOWS\system32\Chakradiag.dll
2017-11-15 14:06:22 ----A---- C:\WINDOWS\system32\Chakra.dll
2017-11-15 14:06:21 ----A---- C:\WINDOWS\system32\Windows.Media.dll
2017-11-15 14:06:21 ----A---- C:\WINDOWS\system32\rdpudd.dll
2017-11-15 14:06:21 ----A---- C:\WINDOWS\system32\MSVPXENC.dll
2017-11-15 14:06:20 ----A---- C:\WINDOWS\system32\mshtml.dll
2017-11-15 14:06:19 ----A---- C:\WINDOWS\system32\edgehtml.dll
2017-11-15 14:06:19 ----A---- C:\WINDOWS\system32\drivers\ndis.sys
2017-11-15 14:06:18 ----A---- C:\WINDOWS\system32\wmpps.dll
2017-11-15 14:06:18 ----A---- C:\WINDOWS\system32\SEMgrPS.dll
2017-11-15 14:06:17 ----A---- C:\WINDOWS\SYSWOW64\wmp.dll
2017-11-15 14:06:17 ----A---- C:\WINDOWS\system32\wmp.dll
2017-11-15 14:06:16 ----A---- C:\WINDOWS\SYSWOW64\msfeeds.dll
2017-11-15 14:06:16 ----A---- C:\WINDOWS\SYSWOW64\iedkcs32.dll
2017-11-15 14:06:16 ----A---- C:\WINDOWS\system32\msfeeds.dll
2017-11-15 14:06:16 ----A---- C:\WINDOWS\system32\iedkcs32.dll
2017-11-15 14:06:16 ----A---- C:\WINDOWS\system32\ie4uinit.exe
2017-11-15 14:06:15 ----A---- C:\WINDOWS\SYSWOW64\ieframe.dll
2017-11-15 14:06:15 ----A---- C:\WINDOWS\system32\wudriver.dll
2017-11-15 14:06:15 ----A---- C:\WINDOWS\system32\ieframe.dll
2017-11-15 14:06:15 ----A---- C:\WINDOWS\system32\CoreUIComponents.dll
2017-11-15 14:06:15 ----A---- C:\WINDOWS\system32\AppXDeploymentClient.dll
2017-11-15 14:06:14 ----A---- C:\WINDOWS\system32\wersvc.dll
2017-11-15 14:06:14 ----A---- C:\WINDOWS\system32\wermgr.exe
2017-11-15 14:06:14 ----A---- C:\WINDOWS\system32\WerFaultSecure.exe
2017-11-15 14:06:14 ----A---- C:\WINDOWS\system32\WerFault.exe
2017-11-15 14:06:14 ----A---- C:\WINDOWS\system32\wer.dll
2017-11-15 14:06:14 ----A---- C:\WINDOWS\system32\odbcconf.dll
2017-11-15 14:06:14 ----A---- C:\WINDOWS\system32\Faultrep.dll
2017-11-15 14:06:14 ----A---- C:\WINDOWS\system32\drivers\ntfs.sys
2017-11-15 14:06:14 ----A---- C:\WINDOWS\system32\dbgeng.dll
2017-11-15 14:06:14 ----A---- C:\WINDOWS\system32\browserbroker.dll
2017-11-15 14:06:13 ----A---- C:\WINDOWS\system32\ntoskrnl.exe
2017-11-15 14:06:13 ----A---- C:\WINDOWS\system32\D3DCompiler_47.dll
2017-11-15 14:06:11 ----A---- C:\WINDOWS\system32\Windows.AccountsControl.dll
2017-11-15 14:06:11 ----A---- C:\WINDOWS\system32\FlightSettings.dll
2017-11-15 14:06:10 ----A---- C:\WINDOWS\system32\bcryptprimitives.dll
2017-11-15 14:06:09 ----A---- C:\WINDOWS\system32\Windows.Media.Protection.PlayReady.dll
2017-11-15 14:06:09 ----A---- C:\WINDOWS\system32\wcmsvc.dll
2017-11-15 14:06:09 ----A---- C:\WINDOWS\system32\vss_ps.dll
2017-11-15 14:06:09 ----A---- C:\WINDOWS\system32\LocationFrameworkInternalPS.dll
2017-11-15 14:06:09 ----A---- C:\WINDOWS\system32\CoreMessaging.dll
2017-11-15 14:06:08 ----A---- C:\WINDOWS\system32\Windows.Data.Pdf.dll
2017-11-15 14:06:08 ----A---- C:\WINDOWS\system32\win32kfull.sys
2017-11-15 14:06:08 ----A---- C:\WINDOWS\system32\drivers\WdiWiFi.sys
2017-11-15 14:06:07 ----A---- C:\WINDOWS\system32\wininet.dll
2017-11-15 14:06:07 ----A---- C:\WINDOWS\system32\winhttp.dll
2017-11-15 14:06:07 ----A---- C:\WINDOWS\system32\usocore.dll
2017-11-15 14:06:07 ----A---- C:\WINDOWS\system32\updatehandlers.dll
2017-11-15 14:06:07 ----A---- C:\WINDOWS\system32\SettingsHandlers_nt.dll
2017-11-15 14:06:07 ----A---- C:\WINDOWS\system32\NetworkMobileSettings.dll
2017-11-15 14:06:07 ----A---- C:\WINDOWS\system32\msIso.dll
2017-11-15 14:06:07 ----A---- C:\WINDOWS\system32\AzureSettingSyncProvider.dll
2017-11-15 14:06:06 ----A---- C:\WINDOWS\SYSWOW64\UIRibbonRes.dll
2017-11-15 14:06:06 ----A---- C:\WINDOWS\system32\wuuhosdeployment.dll
2017-11-15 14:06:06 ----A---- C:\WINDOWS\system32\wuuhext.dll
2017-11-15 14:06:06 ----A---- C:\WINDOWS\system32\wuaueng.dll
2017-11-15 14:06:06 ----A---- C:\WINDOWS\system32\UIRibbonRes.dll
2017-11-15 14:06:06 ----A---- C:\WINDOWS\system32\SIHClient.exe
2017-11-15 14:06:06 ----A---- C:\WINDOWS\system32\ExplorerFrame.dll
2017-11-15 14:06:06 ----A---- C:\WINDOWS\system32\drivers\dxgmms2.sys
2017-11-15 14:06:06 ----A---- C:\WINDOWS\system32\drivers\dxgmms1.sys
2017-11-15 14:06:06 ----A---- C:\WINDOWS\system32\aitstatic.exe
2017-11-15 14:06:05 ----A---- C:\WINDOWS\system32\wsqmcons.exe
2017-11-15 14:06:05 ----A---- C:\WINDOWS\system32\wercplsupport.dll
2017-11-15 14:06:05 ----A---- C:\WINDOWS\system32\securekernel.exe
2017-11-15 14:06:05 ----A---- C:\WINDOWS\system32\hvloader.exe
2017-11-15 14:06:05 ----A---- C:\WINDOWS\system32\DWWIN.EXE
2017-11-15 14:06:05 ----A---- C:\WINDOWS\system32\dsreg.dll
2017-11-15 14:06:05 ----A---- C:\WINDOWS\system32\drivers\dxgkrnl.sys
2017-11-15 14:06:05 ----A---- C:\WINDOWS\system32\drivers\cng.sys
2017-11-15 14:06:05 ----A---- C:\WINDOWS\system32\ci.dll
2017-11-15 14:06:05 ----A---- C:\WINDOWS\system32\AppXDeploymentServer.dll
2017-11-15 14:06:05 ----A---- C:\WINDOWS\system32\AppXDeploymentExtensions.onecore.dll
2017-11-15 14:06:05 ----A---- C:\WINDOWS\system32\AppXDeploymentExtensions.desktop.dll
2017-11-15 14:06:04 ----A---- C:\WINDOWS\system32\wuapi.dll
2017-11-15 14:06:04 ----A---- C:\WINDOWS\system32\winsrv.dll
2017-11-15 14:06:04 ----A---- C:\WINDOWS\system32\werui.dll
2017-11-15 14:06:04 ----A---- C:\WINDOWS\system32\werconcpl.dll
2017-11-15 14:06:04 ----A---- C:\WINDOWS\system32\PCPKsp.dll
2017-11-15 14:06:04 ----A---- C:\WINDOWS\system32\hvax64.exe
2017-11-15 14:06:04 ----A---- C:\WINDOWS\system32\drivers\fvevol.sys
2017-11-15 14:06:04 ----A---- C:\WINDOWS\system32\ActiveSyncProvider.dll
2017-11-15 14:06:03 ----A---- C:\WINDOWS\system32\win32kbase.sys
2017-11-15 14:06:03 ----A---- C:\WINDOWS\system32\user32.dll
2017-11-15 14:06:03 ----A---- C:\WINDOWS\system32\shell32.dll
2017-11-15 14:06:03 ----A---- C:\WINDOWS\system32\hvix64.exe
2017-11-15 14:06:03 ----A---- C:\WINDOWS\system32\ClipSVC.dll
2017-11-15 14:06:01 ----A---- C:\WINDOWS\system32\wups.dll
2017-11-15 14:06:01 ----A---- C:\WINDOWS\system32\win32appinventorycsp.dll
2017-11-15 14:06:01 ----A---- C:\WINDOWS\system32\OneCoreUAPCommonProxyStub.dll
2017-11-15 14:06:01 ----A---- C:\WINDOWS\system32\invagent.dll
2017-11-15 14:06:01 ----A---- C:\WINDOWS\system32\generaltel.dll
2017-11-15 14:06:01 ----A---- C:\WINDOWS\system32\devinv.dll
2017-11-15 14:06:01 ----A---- C:\WINDOWS\system32\DeviceCensus.exe
2017-11-15 14:06:01 ----A---- C:\WINDOWS\system32\dcntel.dll
2017-11-15 14:06:01 ----A---- C:\WINDOWS\system32\CompatTelRunner.exe
2017-11-15 14:06:01 ----A---- C:\WINDOWS\system32\appraiser.dll
2017-11-15 14:06:01 ----A---- C:\WINDOWS\system32\aepic.dll
2017-11-15 14:06:01 ----A---- C:\WINDOWS\system32\aeinv.dll
2017-11-15 14:06:00 ----A---- C:\WINDOWS\system32\WpcWebFilter.dll
2017-11-15 14:06:00 ----A---- C:\WINDOWS\system32\MPSSVC.dll
2017-11-15 14:06:00 ----A---- C:\WINDOWS\system32\GamePanel.exe
2017-11-15 14:06:00 ----A---- C:\WINDOWS\system32\aadtb.dll
2017-11-15 14:05:59 ----A---- C:\WINDOWS\system32\Windows.System.Launcher.dll
2017-11-15 14:05:59 ----A---- C:\WINDOWS\system32\profsvc.dll
2017-11-15 14:05:59 ----A---- C:\WINDOWS\system32\pcasvc.dll
2017-11-15 14:05:59 ----A---- C:\WINDOWS\system32\daxexec.dll
2017-11-15 14:05:59 ----A---- C:\WINDOWS\system32\acmigration.dll
2017-11-15 14:05:59 ----A---- C:\WINDOWS\system32\aadcloudap.dll
2017-11-15 14:05:58 ----A---- C:\WINDOWS\system32\wuauclt.exe
2017-11-15 14:05:58 ----A---- C:\WINDOWS\system32\wow64win.dll
2017-11-15 14:05:58 ----A---- C:\WINDOWS\system32\Windows.UI.Storage.dll
2017-11-15 14:05:58 ----A---- C:\WINDOWS\system32\ubpm.dll
2017-11-15 14:05:58 ----A---- C:\WINDOWS\system32\schedsvc.dll
2017-11-15 14:05:58 ----A---- C:\WINDOWS\system32\SharedPCCSP.dll
2017-11-15 14:05:58 ----A---- C:\WINDOWS\system32\RMapi.dll
2017-11-15 14:05:58 ----A---- C:\WINDOWS\system32\ipnathlp.dll
2017-11-15 14:05:58 ----A---- C:\WINDOWS\system32\efswrt.dll
2017-11-15 14:05:58 ----A---- C:\WINDOWS\system32\drivers\Diskdump.sys
2017-11-15 14:05:58 ----A---- C:\WINDOWS\system32\cldapi.dll
2017-11-15 14:05:57 ----A---- C:\WINDOWS\system32\tzres.dll
2017-11-15 14:05:57 ----A---- C:\WINDOWS\system32\OnDemandConnRouteHelper.dll
2017-11-15 14:05:57 ----A---- C:\WINDOWS\system32\drivers\luafv.sys
2017-11-15 14:05:57 ----A---- C:\WINDOWS\system32\drivers\Dumpstorport.sys
2017-11-15 14:05:57 ----A---- C:\WINDOWS\system32\DataUsageLiveTileTask.exe
2017-11-15 14:05:57 ----A---- C:\WINDOWS\system32\DataUsageHandlers.dll
2017-11-15 14:05:57 ----A---- C:\WINDOWS\system32\CertPKICmdlet.dll

======List of files/folders modified in the last 1 month======

2017-12-11 11:50:50 ----RD---- C:\Program Files
2017-12-11 11:50:49 ----D---- C:\WINDOWS\Prefetch
2017-12-11 11:42:35 ----D---- C:\WINDOWS\Temp
2017-12-11 11:29:47 ----D---- C:\WINDOWS\system32\SleepStudy
2017-12-11 10:54:00 ----D---- C:\WINDOWS\system32\sru
2017-12-11 10:15:46 ----RD---- C:\WINDOWS\Microsoft.NET
2017-12-11 09:44:17 ----D---- C:\Program Files (x86)\Mozilla Maintenance Service
2017-12-11 09:44:16 ----AD---- C:\Program Files (x86)\Mozilla Firefox
2017-12-11 06:56:45 ----D---- C:\WINDOWS\SysWOW64
2017-12-11 06:56:45 ----D---- C:\WINDOWS\System32
2017-12-11 06:56:44 ----D---- C:\WINDOWS\system32\drivers
2017-12-11 06:56:44 ----D---- C:\Windows
2017-12-11 06:56:42 ----D---- C:\WINDOWS\INF
2017-12-11 06:56:40 ----D---- C:\WINDOWS\system32\DriverStore
2017-12-11 06:55:48 ----HD---- C:\Program Files\WindowsApps
2017-12-11 06:55:47 ----D---- C:\WINDOWS\AppReadiness
2017-12-06 16:21:13 ----D---- C:\WINDOWS\system32\catroot2
2017-12-06 15:02:53 ----RSD---- C:\WINDOWS\assembly
2017-12-06 15:01:55 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2017-12-06 14:57:29 ----D---- C:\WINDOWS\system32\config
2017-12-06 06:53:29 ----SHDC---- C:\WINDOWS\Installer
2017-12-06 06:53:28 ----D---- C:\ProgramData\Microsoft Help
2017-12-04 07:46:59 ----DC---- C:\WINDOWS\Panther
2017-12-04 07:41:54 ----D---- C:\WINDOWS\Registration
2017-12-04 07:41:43 ----HD---- C:\$WINDOWS.~BT
2017-11-22 10:00:12 ----D---- C:\WINDOWS\system32\MRT
2017-11-22 09:58:36 ----AC---- C:\WINDOWS\system32\MRT-KB890830.exe
2017-11-22 09:58:32 ----AC---- C:\WINDOWS\system32\MRT.exe
2017-11-21 08:37:50 ----N---- C:\WINDOWS\system32\MpSigStub.exe
2017-11-21 07:03:01 ----D---- C:\Users\Libor\AppData\Roaming\Mozilla
2017-11-16 14:49:33 ----D---- C:\WINDOWS\WinSxS
2017-11-16 14:03:52 ----D---- C:\WINDOWS\rescache
2017-11-16 07:52:12 ----D---- C:\WINDOWS\system32\Tasks
2017-11-15 14:26:38 ----D---- C:\WINDOWS\SYSWOW64\en-US
2017-11-15 14:26:38 ----D---- C:\WINDOWS\SYSWOW64\cs-CZ
2017-11-15 14:26:38 ----D---- C:\WINDOWS\system32\wbem
2017-11-15 14:26:38 ----D---- C:\WINDOWS\system32\en-US
2017-11-15 14:26:38 ----D---- C:\WINDOWS\system32\cs-CZ
2017-11-15 14:26:38 ----D---- C:\WINDOWS\system32\appraiser
2017-11-15 14:26:37 ----D---- C:\WINDOWS\ShellExperiences
2017-11-15 14:26:37 ----D---- C:\WINDOWS\Provisioning
2017-11-15 14:26:37 ----D---- C:\WINDOWS\AppPatch
2017-11-15 14:26:37 ----D---- C:\Program Files\Windows Photo Viewer
2017-11-15 14:26:37 ----D---- C:\Program Files (x86)\Windows Photo Viewer
2017-11-15 14:09:07 ----D---- C:\WINDOWS\CbsTemp
2017-11-15 10:00:17 ----D---- C:\WINDOWS\SYSWOW64\Macromed
2017-11-15 10:00:17 ----D---- C:\WINDOWS\system32\Macromed

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 iaStorA;iaStorA; C:\WINDOWS\System32\drivers\iaStorA.sys [2015-11-13 1467912]
R0 iorate;@%SystemRoot%\system32\drivers\iorate.sys,-101; C:\WINDOWS\system32\drivers\iorate.sys [2017-03-18 49568]
R1 FileCrypt;@%systemroot%\system32\drivers\filecrypt.sys,-100; C:\WINDOWS\system32\drivers\filecrypt.sys [2017-03-18 54272]
R1 GpuEnergyDrv;@%SystemRoot%\system32\drivers\gpuenergydrv.sys,-100; C:\WINDOWS\System32\drivers\gpuenergydrv.sys [2017-03-18 8192]
R1 MpKsld442fd86;MpKsld442fd86; \??\C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{B5BCE7F6-2382-40F1-9041-76EA3A0D1B02}\MpKsld442fd86.sys [2017-12-11 58120]
R2 clreg;@%SystemRoot%\system32\drivers\registry.sys,-100; C:\WINDOWS\System32\drivers\registry.sys [2017-03-18 14336]
R2 MMCSS;@%systemroot%\system32\drivers\mmcss.sys,-100; C:\WINDOWS\system32\drivers\mmcss.sys [2017-03-18 50688]
R2 storqosflt;@%SystemRoot%\System32\drivers\storqosflt.sys,-101; C:\WINDOWS\system32\drivers\storqosflt.sys [2017-03-18 79872]
R3 ACPIVPC;@oem3.inf,%ACPIVPC.SvcDesc%;Lenovo Virtual Power Controller Driver; C:\WINDOWS\System32\drivers\AcpiVpc.sys [2015-07-29 42328]
R3 BtFilter;BtFilter; C:\WINDOWS\system32\DRIVERS\btfilter.sys [2016-06-26 610656]
R3 BthEnum;@bth.inf,%BthEnum.SVCDESC%;Služba Bluetooth Enumerator; C:\WINDOWS\System32\drivers\BthEnum.sys [2017-07-28 105472]
R3 BthLEEnum;@BthLEEnum.inf,%BthLEEnum.SVCDESC%;Bluetooth Low Energy Driver; C:\WINDOWS\System32\drivers\Microsoft.Bluetooth.Legacy.LEEnumerator.sys [2017-07-28 97280]
R3 BthPan;@bthpan.inf,%BthPan.DisplayName%;Bluetooth Device (Personal Area Network); C:\WINDOWS\System32\drivers\bthpan.sys [2017-09-05 130560]
R3 BTHUSB;@bth.inf,%BTHUSB.SvcDesc%;Ovladač rozhraní USB radiostanice Bluetooth; C:\WINDOWS\System32\drivers\BTHUSB.sys [2017-03-18 85504]
R3 CAD;@ChargeArbitration.inf,%CAD_DevDesc%;Charge Arbitration Driver; C:\WINDOWS\System32\drivers\CAD.sys [2017-03-18 53664]
R3 CnxtHdAudService;@oem1.inf,%UAAFunctionDriverForHdAudio.SvcDesc%;Conexant UAA Function Driver for High Definition Audio Service; C:\WINDOWS\system32\drivers\CHDRT64.sys [2016-01-27 1550328]
R3 igfx;igfx; C:\WINDOWS\System32\DriverStore\FileRepository\igdlh64.inf_amd64_bde03d8af75e6be5\igdkmd64.sys [2017-01-04 11039680]
R3 IntcDAud;@oem6.inf,%IntcAud.SvcDesc%;Intel(R) Display Audio; C:\WINDOWS\system32\DRIVERS\IntcDAud.sys [2016-10-07 822248]
R3 MEIx64;@oem32.inf,%TEE_SvcDesc%;Intel(R) Management Engine Interface ; C:\WINDOWS\System32\drivers\TeeDriverW8x64.sys [2015-10-09 185600]
R3 Qcamain10x64;@oem26.inf,%ATHR.Service.DispName%;Qualcomm Atheros Extensible Wireless LAN 11AC device driver; C:\WINDOWS\system32\DRIVERS\Qcamain10x64.sys [2017-04-23 2412976]
R3 RFCOMM;@tdibth.inf,%RFCOMM.DisplayName%;Bluetooth Device (RFCOMM Protocol TDI); C:\WINDOWS\System32\drivers\rfcomm.sys [2017-08-01 180736]
R3 rt640x64;@oem20.inf,%rt640.Service.DispName%;Realtek RT640 NT Driver; C:\WINDOWS\System32\drivers\rt640x64.sys [2015-12-22 935168]
R3 RTSUER;@oem18.inf,%RtsUER%;Realtek USB Card Reader - UER; C:\WINDOWS\system32\Drivers\RtsUer.sys [2015-10-15 408280]
R3 rtsuvc;@oem4.inf,%rtsuvc.DeviceDesc%;EasyCamera; C:\WINDOWS\system32\DRIVERS\rtsuvc.sys [2015-12-30 3094272]
R3 StillCam;@sti.inf,%StillCam.SvcDesc%;Ovladač digitálního fotoaparátu pro sériový port; C:\WINDOWS\system32\DRIVERS\serscan.sys [2017-03-18 13312]
R3 SynTP;@oem41.inf,%SynTP.SvcDesc%;Synaptics TouchPad Driver; C:\WINDOWS\system32\DRIVERS\SynTP.sys [2017-05-16 912960]
S0 LSI_SAS2i;LSI_SAS2i; C:\WINDOWS\System32\drivers\lsi_sas2i.sys [2017-03-18 123808]
S0 LSI_SAS3i;LSI_SAS3i; C:\WINDOWS\System32\drivers\lsi_sas3i.sys [2017-03-18 103328]
S0 megasas2i;megasas2i; C:\WINDOWS\System32\drivers\MegaSas2i.sys [2017-03-18 64416]
S0 percsas2i;percsas2i; C:\WINDOWS\System32\drivers\percsas2i.sys [2017-03-18 58784]
S0 percsas3i;percsas3i; C:\WINDOWS\System32\drivers\percsas3i.sys [2017-03-18 61848]
S0 scmbus;@scmbus.inf,%scmbus.SvcDesc%;Microsoft Storage Class Memory Bus Driver; C:\WINDOWS\System32\drivers\scmbus.sys [2017-03-18 91040]
S0 storufs;@storufs.inf,%UfsServiceDesc%;Microsoft Universal Flash Storage (UFS) Driver; C:\WINDOWS\System32\drivers\storufs.sys [2017-03-18 36760]
S2 CldFlt;Windows Cloud Files Filter Driver; C:\WINDOWS\system32\drivers\cldflt.sys [2017-03-18 12288]
S3 AcpiDev;@acpidev.inf,%AcpiDev.SvcDesc%;ACPI Devices driver; C:\WINDOWS\System32\drivers\AcpiDev.sys [2017-03-18 20480]
S3 applockerfltr;@%systemroot%\system32\srpapi.dll,-102; C:\WINDOWS\system32\drivers\applockerfltr.sys [2017-03-18 17920]
S3 BTHPORT;@bth.inf,%BTHPORT.SvcDesc%;Ovladač portu Bluetooth; C:\WINDOWS\System32\drivers\BTHport.sys [2017-07-28 982016]
S3 buttonconverter;@buttonconverter.inf,%btnconv.SvcDesc%;Service for Portable Device Control devices; C:\WINDOWS\System32\drivers\buttonconverter.sys [2017-09-05 39424]
S3 CapImg;@capimg.inf,%CapImgHid_Service%;HID driver for CapImg touch screen; C:\WINDOWS\System32\drivers\capimg.sys [2017-03-18 122880]
S3 dg_ssudbus;@oem38.inf,%ssud.Service.DeviceDesc%;SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.); C:\WINDOWS\system32\DRIVERS\ssudbus.sys [2016-09-05 131712]
S3 genericusbfn;@genericusbfn.inf,%genericusbfn.ServiceName%;Generic USB Function Class; C:\WINDOWS\System32\drivers\genericusbfn.sys [2017-03-18 21504]
S3 hidinterrupt;@hidinterrupt.inf,%HID_Interrupt.SvcDesc%;Common Driver for HID Buttons implemented with interrupts; C:\WINDOWS\System32\drivers\hidinterrupt.sys [2017-03-18 51104]
S3 hvservice;@%SystemRoot%\system32\drivers\hvservice.sys,-16; C:\WINDOWS\system32\drivers\hvservice.sys [2017-03-18 74648]
S3 cht4iscsi;cht4iscsi; C:\WINDOWS\System32\drivers\cht4sx64.sys [2017-03-18 347032]
S3 cht4vbd;@cht4vx64.inf,%cht4vbd.generic%;Chelsio Virtual Bus Driver; C:\WINDOWS\System32\drivers\cht4vx64.sys [2017-03-18 2104224]
S3 iagpio;@iagpio.inf,%iagpio.SVCDESC%;Intel Serial IO GPIO Controller Driver; C:\WINDOWS\System32\drivers\iagpio.sys [2017-03-18 33280]
S3 iai2c;@iai2c.inf,%iai2c.SVCDESC%;Intel(R) Serial IO I2C Host Controller; C:\WINDOWS\System32\drivers\iai2c.sys [2017-03-18 81408]
S3 iaLPSS2i_GPIO2;@iaLPSS2i_GPIO2_SKL.inf,%iaLPSS2i_GPIO2.SVCDESC%;Intel(R) Serial IO GPIO Driver v2; C:\WINDOWS\System32\drivers\iaLPSS2i_GPIO2.sys [2017-03-18 70656]
S3 iaLPSS2i_GPIO2_BXT_P;@iaLPSS2i_GPIO2_BXT_P.inf,%iaLPSS2i_GPIO2_BXT_P.SVCDESC%;Intel(R) Serial IO GPIO Driver v2; C:\WINDOWS\System32\drivers\iaLPSS2i_GPIO2_BXT_P.sys [2017-03-18 85504]
S3 iaLPSS2i_I2C;@iaLPSS2i_I2C_SKL.inf,%iaLPSS2i_I2C.SVCDESC%;Intel(R) Serial IO I2C Driver v2; C:\WINDOWS\System32\drivers\iaLPSS2i_I2C.sys [2017-03-18 165376]
S3 iaLPSS2i_I2C_BXT_P;@iaLPSS2i_I2C_BXT_P.inf,%iaLPSS2i_I2C_BXT_P.SVCDESC%;Intel(R) Serial IO I2C Driver v2; C:\WINDOWS\System32\drivers\iaLPSS2i_I2C_BXT_P.sys [2017-03-18 168448]
S3 ibbus;@mlx4_bus.inf,%Ibbus.ServiceDesc%;Mellanox InfiniBand Bus/AL (Filter Driver); C:\WINDOWS\System32\drivers\ibbus.sys [2017-03-18 526240]
S3 IndirectKmd;@%SystemRoot%\system32\drivers\IndirectKmd.sys,-100; C:\WINDOWS\System32\drivers\IndirectKmd.sys [2017-03-18 36864]
S3 irda;IrDA; C:\WINDOWS\system32\drivers\irda.sys [2017-03-18 120320]
S3 mausbhost;@mausbhost.inf,%MAUSBHost.ServiceName%;MA-USB Host Controller Driver; C:\WINDOWS\System32\drivers\mausbhost.sys [2017-03-18 405408]
S3 mausbip;@mausbhost.inf,%MAUSBIP.ServiceName%;MA-USB IP Filter Driver; C:\WINDOWS\System32\drivers\mausbip.sys [2017-03-18 51104]
S3 mlx4_bus;@mlx4_bus.inf,%MLX4BUS.ServiceDesc%;Mellanox ConnectX Bus Enumerator; C:\WINDOWS\System32\drivers\mlx4_bus.sys [2017-03-18 842656]
S3 ndfltr;@mlx4_bus.inf,%ndfltr.ServiceDesc%;NetworkDirect Service; C:\WINDOWS\System32\drivers\ndfltr.sys [2017-03-18 108960]
S3 NetAdapterCx;Network Adapter Wdf Class Extension Library; C:\WINDOWS\system32\drivers\NetAdapterCx.sys [2017-03-18 122368]
S3 nvdimmn;@nvdimmn.inf,%nvdimmn.SvcDesc%;Microsoft NVDIMM-N device driver; C:\WINDOWS\System32\drivers\nvdimmn.sys [2017-03-18 80896]
S3 pmem;@pmem.inf,%pmem.SvcDesc%;Microsoft persistent memory disk driver; C:\WINDOWS\System32\drivers\pmem.sys [2017-03-18 101376]
S3 ReFSv1;ReFSv1; C:\WINDOWS\system32\drivers\ReFSv1.sys [2017-03-18 936864]
S3 SDFRd;@SDFRd.inf,%SDFRd.ServiceDesc%;SDF Reflector; C:\WINDOWS\System32\drivers\SDFRd.sys [2017-03-18 31128]
S3 SmbDrvI;SmbDrvI; C:\WINDOWS\system32\DRIVERS\Smb_driver_Intel.sys [2015-06-03 42696]
S3 SpatialGraphFilter;Holographic Spatial Graph Filter; C:\WINDOWS\System32\drivers\SpatialGraphFilter.sys [2017-03-20 40352]
S3 ssudmdm;@oem24.inf,%ssud.Service.Name%;SAMSUNG Mobile USB Modem Drivers (DEVGURU Ver.); C:\WINDOWS\system32\DRIVERS\ssudmdm.sys [2016-09-05 165504]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AdobeARMservice;Adobe Acrobat Update Service; C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2017-09-27 83984]
R2 AtherosSvc;AtherosSvc; C:\WINDOWS\system32\AdminService.exe [2016-06-26 355760]
R2 CDPSvc;@%SystemRoot%\system32\cdpsvc.dll,-100; C:\WINDOWS\system32\svchost.exe [2017-03-18 47664]
R2 CDPUserSvc_382dc;Uživatelská služba platformy připojených zařízení_382dc; C:\WINDOWS\system32\svchost.exe [2017-03-18 47664]
R2 CoreMessagingRegistrar;@%SystemRoot%\system32\coremessaging.dll,-1; C:\WINDOWS\system32\svchost.exe [2017-03-18 47664]
R2 CxAudMsg;Conexant Audio Message Service; C:\Windows\system32\CxAudMsg64.exe [2015-09-16 225624]
R2 DAX2API;Dolby DAX2 API Service; C:\Program Files\Dolby\Dolby DAX2\DAX2_API\DolbyDAX2API.exe [2016-01-27 163328]
R2 DiagTrack;@%SystemRoot%\system32\diagtrack.dll,-3001; C:\WINDOWS\System32\svchost.exe [2017-03-18 47664]
R2 DusmSvc;@%SystemRoot%\System32\dusmsvc.dll,-1; C:\WINDOWS\System32\svchost.exe [2017-03-18 47664]
R2 GDCAgent;GDCAgent; C:\Program Files (x86)\Lenovo\GDCAgentSetupRed\GDCAgent.exe [2015-07-30 1155512]
R2 HP LaserJet Service;HP LaserJet Service; C:\Program Files (x86)\HP\HPLaserJetService\HPLaserJetService.exe [2012-12-04 174592]
R2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology; C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [2015-11-04 19440]
R2 igfxCUIService2.0.0.0;Intel(R) HD Graphics Control Panel Service; C:\WINDOWS\System32\DriverStore\FileRepository\igdlh64.inf_amd64_bde03d8af75e6be5\igfxCUIService.exe [2017-01-04 341952]
R2 ImControllerService;@oem37.inf,%ImcSvcDisplayName%;System Interface Foundation Service; C:\Program Files\Lenovo\ImController\Service\Lenovo.Modern.ImController.exe [2017-09-08 68416]
R2 OneSyncSvc_382dc;Hostitel synchronizace_382dc; C:\WINDOWS\system32\svchost.exe [2017-03-18 47664]
R2 SecurityHealthService;@%systemroot%\system32\SecurityHealthAgent.dll,-1002; C:\WINDOWS\system32\SecurityHealthService.exe [2017-09-30 336320]
R2 SynTPEnhService;SynTPEnh Caller Service; C:\Program Files\Synaptics\SynTP\SynTPEnhService.exe [2017-05-16 267328]
R2 TeamViewer;TeamViewer 12; C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe [2016-12-15 10351856]
R2 tiledatamodelsvc;@%SystemRoot%\system32\tileobjserver.dll,-1; C:\WINDOWS\system32\svchost.exe [2017-03-18 47664]
R3 cphs;Intel(R) Content Protection HECI Service; C:\WINDOWS\System32\DriverStore\FileRepository\igdlh64.inf_amd64_bde03d8af75e6be5\IntelCpHeciSvc.exe [2017-01-04 301504]
R3 DsSvc;@%SystemRoot%\system32\dssvc.dll,-10003; C:\WINDOWS\System32\svchost.exe [2017-03-18 47664]
R3 FontCache3.0.0.0;@%SystemRoot%\system32\PresentationHost.exe,-3309; C:\WINDOWS\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe [2017-02-10 43696]
R3 LicenseManager;@%SystemRoot%\system32\licensemanagersvc.dll,-200; C:\WINDOWS\System32\svchost.exe [2017-03-18 47664]
R3 osppsvc;Office Software Protection Platform; C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4925184]
R3 PimIndexMaintenanceSvc_382dc;Data kontaktů_382dc; C:\WINDOWS\system32\svchost.exe [2017-03-18 47664]
R3 SensorService;@%SystemRoot%\System32\sensorservice.dll,-1000; C:\WINDOWS\system32\svchost.exe [2017-03-18 47664]
R3 StateRepository;@%SystemRoot%\system32\windows.staterepository.dll,-1; C:\WINDOWS\system32\svchost.exe [2017-03-18 47664]
R3 TimeBrokerSvc;@%windir%\system32\TimeBrokerServer.dll,-1001; C:\WINDOWS\system32\svchost.exe [2017-03-18 47664]
R3 TokenBroker;@%systemroot%\system32\tokenbroker.dll,-100; C:\WINDOWS\system32\svchost.exe [2017-03-18 47664]
S2 CCSDK;CCSDK; C:\Program Files (x86)\Lenovo\CCSDK\CCSDK.exe [2017-02-27 688992]
S2 CDPUserSvc;@%SystemRoot%\system32\cdpusersvc.dll,-100; C:\WINDOWS\system32\svchost.exe [2017-03-18 47664]
S2 DoSvc;@%systemroot%\system32\dosvc.dll,-100; C:\WINDOWS\system32\svchost.exe [2017-03-18 47664]
S2 MapsBroker;@%SystemRoot%\System32\moshost.dll,-100; C:\WINDOWS\System32\svchost.exe [2017-03-18 47664]
S2 OneSyncSvc;@%SystemRoot%\system32\APHostRes.dll,-10002; C:\WINDOWS\system32\svchost.exe [2017-03-18 47664]
S2 SAService;Conexant SmartAudio service; C:\WINDOWS\syswow64\SAsrv.exe [2015-09-15 431960]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service; C:\WINDOWS\SysWoW64\Macromed\Flash\FlashPlayerUpdateService.exe [2017-11-15 272384]
S3 AJRouter;@%SystemRoot%\system32\AJRouter.dll,-2; C:\WINDOWS\system32\svchost.exe [2017-03-18 47664]
S3 BthHFSrv;@%SystemRoot%\System32\BthHFSrv.dll,-103; C:\WINDOWS\System32\svchost.exe [2017-03-18 47664]
S3 ClipSVC;@%SystemRoot%\system32\ClipSVC.dll,-103; C:\WINDOWS\System32\svchost.exe [2017-03-18 47664]
S3 cplspcon;Intel(R) Content Protection HDCP Service; C:\WINDOWS\System32\DriverStore\FileRepository\igdlh64.inf_amd64_bde03d8af75e6be5\IntelCpHDCPSvc.exe [2017-01-04 480192]
S3 DevicesFlowUserSvc;@%SystemRoot%\system32\DevicesFlowBroker.dll,-103; C:\WINDOWS\system32\svchost.exe [2017-03-18 47664]
S3 DevicesFlowUserSvc_382dc;Tok zařízení_382dc; C:\WINDOWS\system32\svchost.exe [2017-03-18 47664]
S3 DevQueryBroker;@%SystemRoot%\system32\DevQueryBroker.dll,-100; C:\WINDOWS\system32\svchost.exe [2017-03-18 47664]
S3 diagnosticshub.standardcollector.service;@%SystemRoot%\system32\DiagSvcs\DiagnosticsHub.StandardCollector.ServiceRes.dll,-1000; C:\WINDOWS\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe [2017-03-18 86528]
S3 DmEnrollmentSvc;@%systemroot%\system32\Windows.Internal.Management.dll,-100; C:\WINDOWS\system32\svchost.exe [2017-03-18 47664]
S3 dmwappushservice;@%SystemRoot%\system32\dmwappushsvc.dll,-200; C:\WINDOWS\system32\svchost.exe [2017-03-18 47664]
S3 embeddedmode;@%SystemRoot%\system32\embeddedmodesvc.dll,-201; C:\WINDOWS\System32\svchost.exe [2017-03-18 47664]
S3 EntAppSvc;@EnterpriseAppMgmtSvc.dll,-1; C:\WINDOWS\system32\svchost.exe [2017-03-18 47664]
S3 FrameServer;@%systemroot%\system32\FrameServer.dll,-100; C:\WINDOWS\System32\svchost.exe [2017-03-18 47664]
S3 HP DS Service;HP DS Service; C:\Program Files (x86)\HP\HPBDSService\HPBDSService.exe [2011-10-17 13824]
S3 HvHost;@%SystemRoot%\system32\hvhostsvc.dll,-100; C:\WINDOWS\system32\svchost.exe [2017-03-18 47664]
S3 icssvc;@%SystemRoot%\System32\tetheringservice.dll,-4097; C:\WINDOWS\system32\svchost.exe [2017-03-18 47664]
S3 IpxlatCfgSvc;@%Systemroot%\system32\ipxlatcfg.dll,-500; C:\WINDOWS\System32\svchost.exe [2017-03-18 47664]
S3 irmon;@%SystemRoot%\System32\irmon.dll,-2000; C:\WINDOWS\system32\svchost.exe [2017-03-18 47664]
S3 LSCWinService;LSCWinService; C:\Program Files\Lenovo\Lenovo Solution Center\App\LSCWinService.exe [2016-01-25 271328]
S3 MessagingService;@%SystemRoot%\system32\MessagingService.dll,-100; C:\WINDOWS\system32\svchost.exe [2017-03-18 47664]
S3 MessagingService_382dc;Služba zasílání zpráv_382dc; C:\WINDOWS\system32\svchost.exe [2017-03-18 47664]
S3 MozillaMaintenance;Mozilla Maintenance Service; C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2017-12-11 194000]
S3 NaturalAuthentication;@%systemroot%\system32\NaturalAuth.dll,-100; C:\WINDOWS\system32\svchost.exe [2017-03-18 47664]
S3 NetSetupSvc;@%SystemRoot%\system32\NetSetupSvc.dll,-3; C:\WINDOWS\System32\svchost.exe [2017-03-18 47664]
S3 NgcCtnrSvc;@%SystemRoot%\System32\NgcCtnrSvc.dll,-1; C:\WINDOWS\system32\svchost.exe [2017-03-18 47664]
S3 NgcSvc;@%SystemRoot%\System32\ngcsvc.dll,-100; C:\WINDOWS\system32\svchost.exe [2017-03-18 47664]
S3 ose;Office Source Engine; C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2017-09-12 159960]
S3 PhoneSvc;@%SystemRoot%\system32\PhoneserviceRes.dll,-10000; C:\WINDOWS\system32\svchost.exe [2017-03-18 47664]
S3 PimIndexMaintenanceSvc;@%SystemRoot%\system32\UserDataAccessRes.dll,-15001; C:\WINDOWS\system32\svchost.exe [2017-03-18 47664]
S3 RetailDemo;@%SystemRoot%\System32\RDXService.dll,-256; C:\WINDOWS\System32\svchost.exe [2017-03-18 47664]
S3 RmSvc;@%SystemRoot%\system32\RMapi.dll,-1001; C:\WINDOWS\System32\svchost.exe [2017-03-18 47664]
S3 SEMgrSvc;@%SystemRoot%\System32\SEMgrSvc.dll,-1001; C:\WINDOWS\system32\svchost.exe [2017-03-18 47664]
S3 SensorDataService;@%SystemRoot%\system32\SensorDataService.exe,-101; C:\WINDOWS\System32\SensorDataService.exe [2017-03-18 1284608]
S3 SmsRouter;@%SystemRoot%\System32\SmsRouterSvc.dll,-10001; C:\WINDOWS\system32\svchost.exe [2017-03-18 47664]
S3 spectrum;@%systemroot%\system32\spectrum.exe,-101; C:\WINDOWS\system32\spectrum.exe [2017-03-18 891904]
S3 TieringEngineService;@%SystemRoot%\system32\TieringEngineService.exe,-702; C:\WINDOWS\system32\TieringEngineService.exe [2017-03-18 302592]
S4 shpamsvc;@%SystemRoot%\System32\Windows.SharedPC.AccountManager.dll,-100; C:\WINDOWS\System32\svchost.exe [2017-03-18 47664]
S4 tzautoupdate;@%SystemRoot%\system32\tzautoupdate.dll,-200; C:\WINDOWS\system32\svchost.exe [2017-03-18 47664]

-----------------EOF-----------------

Uživatelský avatar
Rudy
Site Admin
Site Admin
Příspěvky: 118200
Registrován: 30 říj 2003 13:42
Bydliště: Plzeň
Kontaktovat uživatele:

Re: Zašifrované soubory a přepsané na .doc

#2 Příspěvek od Rudy »

Zdravím!
Šance je, pokud existuje přístupný dekryptovací klíč. Toto fórum ovše dekryptování neřeší, je k němu třeby přímý přístup do PC, což nemáme právně ošetřeno. Obraťte se, prosím, na naše kolegy: https://neslape.cz/?utm_campaign=neslap ... ium=banner .
Dotazy a logy vkládejte pouze do vašich threadů. Soukromé zprávy, icq a e-maily neslouží k řešení vašich problémů.

Podpořte, prosím, naše fórum : https://platba.viry.cz/payment/.

Navštivte: Obrázek

e-mail: rudy(zavináč)forum.viry.cz

Varování:
Před odvirováním PC si udělejte zálohy svých důležitých dat (pošta, kontakty, dokumenty, fotografie, videa, hudba apod.). Virus mimo svých "viditelných" aktivit může poškodit systém!


Po dořešení vašeho problému bude vlákno zamknuto. Stejně tak tehdy, pokud bude nečinné více než 14dnů. Pokud budete chtít vlákno aktivovat, napište mi na mail uvedený výše.

Odpovědět