Odvirování PC, zrychlení počítače, vzdálená pomoc prostřednictvím služby neslape.cz

Žádost o kontrolu logů

Nemáte v tuto chvíli žádný problém s pc a chcete se jen ujistit, že je vše v pořádku?
Vložte log z FRST nebo RSIT.

Moderátor: Moderátoři

Pravidla fóra
Pokud chcete pomoc, vložte log z FRST [návod zde] nebo RSIT [návod zde]

Jednotlivé thready budou po vyřešení uzamčeny. Stejně tak ty, které budou nečinné déle než 14 dní. Vizte Pravidlo o zamykání témat. Děkujeme za pochopení.

!NOVINKA!
Nově lze využívat služby vzdálené pomoci, kdy se k vašemu počítači připojí odborník a bližší informace o problému si od vás získá telefonicky! Více na www.neslape.cz
Odpovědět
Zpráva
Autor
vejce4444
Návštěvník
Návštěvník
Příspěvky: 47
Registrován: 23 říj 2012 10:24

Žádost o kontrolu logů

#1 Příspěvek od vejce4444 »

Dobrý den,

prosím Vás zda by jste mě nezkonrtolovali 2 logy 2 PC :) Jen preventivně. Děkuji moc:

PC1 log:

Logfile of random's system information tool 1.16 (written by random/random)
Run by Ecjev at 2017-09-02 12:10:30
Microsoft Windows 7 Professional Service Pack 1
System drive C: has 35 GB (31%) free of 114 GB
Total RAM: 8088 MB (57% free)
X64

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 12:10:33, on 2.9.2017
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v11.0 (11.00.9600.18763)
Boot mode: Normal

Running processes:
C:\Windows\WebCam\S6000\S6000Mnt.exe
C:\Windows\SysWOW64\rundll32.exe
C:\drivers\RocketDock\RocketDock.exe
D:\Hry\WoT\WargamingGameUpdater.exe
C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe
C:\drivers\Intel_Rapid_tech\IAStorIcon.exe
C:\Program Files\trend micro\Ecjev_RSITx64.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/p/?LinkId=255141
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/p/?LinkId=255141
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F2 - REG:system.ini: UserInit=userinit.exe,
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre1.8.0_121\bin\ssv.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre1.8.0_121\bin\jp2ssv.dll
O4 - HKLM\..\Run: [USB3MON] "C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe"
O4 - HKCU\..\Run: [RocketDock] "C:\drivers\RocketDock\RocketDock.exe"
O4 - HKCU\..\Run: [World of Tanks] "D:\Hry\WoT\WargamingGameUpdater.exe"
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O4 - Startup: Rainmeter.lnk = C:\drivers\Rainmeter\Rainmeter.exe
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://D:\Programy\OFFICE~1\Office12\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\Programy\OFFICE~1\Office12\REFIEBAR.DLL
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O15 - Trusted Zone: http://help.eset.com (HKLM)
O15 - ESC Trusted Zone: http://help.eset.com (HKLM)
O17 - HKLM\System\CCS\Services\Tcpip\..\{4130FDA9-33F0-4C37-9C06-44BCE79AD2A2}: NameServer = 192.168.0.1,8.8.8.8
O17 - HKLM\System\CCS\Services\Tcpip\..\{F236742D-D4F8-4C22-AEAC-E4904C803F32}: NameServer = 10.0.4.1,8.8.8.8
O17 - HKLM\System\CS1\Services\Tcpip\..\{4130FDA9-33F0-4C37-9C06-44BCE79AD2A2}: NameServer = 192.168.0.1,8.8.8.8
O17 - HKLM\System\CS2\Services\Tcpip\..\{4130FDA9-33F0-4C37-9C06-44BCE79AD2A2}: NameServer = 192.168.0.1,8.8.8.8
O20 - AppInit_DLLs: C:\Windows\SysWOW64\nvinit.dll
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: Intel(R) Content Protection HECI Service (cphs) - Intel Corporation - C:\Windows\SysWow64\IntelCpHeciSvc.exe
O23 - Service: @C:\Windows\system32\CxAudMsg64.exe,-100 (CxAudMsg) - Unknown owner - C:\Windows\system32\CxAudMsg64.exe (file missing)
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: ESET Service (ekrn) - ESET - C:\drivers\ESET_smart\ekrn.exe
O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel(R) Corporation - C:\drivers\PROSet_wireless\WiFi\bin\EvtEng.exe
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: Intel(R) Rapid Storage Technology (IAStorDataMgrSvc) - Intel Corporation - C:\drivers\Intel_Rapid_tech\IAStorDataMgrSvc.exe
O23 - Service: @%SystemRoot%\system32\ieetwcollectorres.dll,-1000 (IEEtwCollectorService) - Unknown owner - C:\Windows\system32\IEEtwCollector.exe (file missing)
O23 - Service: Intel(R) HD Graphics Control Panel Service (igfxCUIService1.0.0.0) - Unknown owner - C:\Windows\system32\igfxCUIService.exe (file missing)
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: Wireless PAN DHCP Server (MyWiFiDHCPDNS) - Unknown owner - C:\drivers\PROSet_wireless\WiFi\bin\PanDhcpDns.exe
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: NetLimiter 4 Service (nlsvc) - Locktime Software - D:\Programy\net_limiter\NLSvc.exe
O23 - Service: NVIDIA Display Container LS (NVDisplay.ContainerLocalSystem) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\Display.NvContainer\NVDisplay.Container.exe
O23 - Service: Sony Ericsson OMSI download service (OMSI download service) - Unknown owner - D:\Programy\K800i\SupServ.exe
O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel(R) Corporation - C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Conexant SmartAudio service (SAService) - Conexant Systems, Inc. - C:\Windows\system32\SAsrv.exe
O23 - Service: Skype Updater (SkypeUpdate) - Skype Technologies - D:\Programy\skype\Updater\Updater.exe
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: TeamViewer 12 (TeamViewer) - TeamViewer GmbH - c:\users\ecjev\appdata\local\temp\teamviewer\TeamViewer_Service.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: ASUS Virtual MFP Service (UsbService) - Unknown owner - C:\Program Files (x86)\ASUS\Printer Utilities\UsbService64.exe
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)
O23 - Service: Intel(R) PROSet/Wireless Zero Configuration Service (ZeroConfigService) - Intel® Corporation - C:\drivers\PROSet_wireless\WiFi\bin\ZeroConfigService.exe

--
End of file - 9041 bytes

====== Enumerating Processes ======

C:\Windows\system32\csrss.exe
C:\Windows\system32\wininit.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\winlogon.exe
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k GPSvcGroup
C:\Windows\system32\igfxCUIService.exe
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\system32\WLANExt.exe 26488112
\??\C:\Windows\system32\conhost.exe "-19575253841280496799684096674-7502038-404121218786907928-2067512612-801248196
C:\Windows\System32\spoolsv.exe
"C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe"
C:\Windows\system32\CxAudMsg64.exe
C:\Windows\System32\svchost.exe -k utcsvc
"C:\drivers\PROSet_wireless\WiFi\bin\EvtEng.exe"
D:\Programy\net_limiter\NLSvc.exe
"C:\Program Files\NVIDIA Corporation\Display.NvContainer\NVDisplay.Container.exe" -s NVDisplay.ContainerLocalSystem -f "C:\ProgramData\NVIDIA\NVDisplay.ContainerLocalSystem.log" -l 3 -d "C:\Program Files\NVIDIA Corporation\Display.NvContainer\plugins\LocalSystem"
D:\Programy\K800i\SupServ.exe
C:\Windows\SysWOW64\PnkBstrA.exe
"C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe"
C:\Windows\SysWOW64\SAsrv.exe
C:\Windows\system32\svchost.exe -k imgsvc
"c:\users\ecjev\appdata\local\temp\teamviewer\TeamViewer_Service.exe"
"C:\Program Files (x86)\ASUS\Printer Utilities\UsbService64.exe"
"C:\drivers\PROSet_wireless\WiFi\bin\ZeroConfigService.exe"
C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe -first
C:\Windows\system32\wbem\unsecapp.exe -Embedding
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\System32\svchost.exe -k secsvcs
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Windows\system32\taskhost.exe
"C:\Windows\system32\Dwm.exe"
C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
C:\Windows\Explorer.EXE
"C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe" /tf Intel PROSet/Wireless
"C:\Program Files\CONEXANT\cAudioFilterAgent\CAudioFilterAgent64.exe"
"C:\Program Files\CONEXANT\ForteConfig\fmapp.exe"
"C:\Windows\WebCam\S6000\S6000Mnt.exe"
"C:\Program Files\Elantech\ETDCtrl.exe"
"C:\Program Files (x86)\Lenovo\Energy Management\Energy Management.exe"
"C:\Program Files (x86)\Lenovo\Energy Management\utility.exe"
"C:\Program Files\SmartTechnology\Software\ProfilerU.exe"
"C:\Program Files\SmartTechnology\Software\SaiMfd.exe"
"C:\Windows\SysWOW64\rundll32.exe" C:\Windows\Syswow64\cm108.dll,CMICtrlWnd
"C:\Program Files\Microsoft Xbox 360 Accessories\XBoxStat.exe" silentrun
"C:\drivers\RocketDock\RocketDock.exe"
"D:\Hry\WoT\WargamingGameUpdater.exe"
"C:\drivers\Rainmeter\Rainmeter.exe"
C:\Windows\system32\igfxEM.exe
C:\Windows\system32\igfxHK.exe
C:\Windows\system32\igfxTray.exe
"C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe"
"C:\Program Files\Elantech\ETDCtrlHelper.exe"
"C:\Program Files\Elantech\ETDIntelligent.exe"
C:\Windows\system32\wbem\unsecapp.exe -Embedding
C:\Windows\system32\SearchIndexer.exe /Embedding
"C:\Program Files\Windows Media Player\wmpnetwk.exe"
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\drivers\Intel_Rapid_tech\IAStorDataMgrSvc.exe
"C:\drivers\Intel_Rapid_tech\IAStorIcon.exe"
"C:\drivers\Mozilla_firefox\firefox.exe"
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\servicing\TrustedInstaller.exe
"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe9_ Global\UsGthrCtrlFltPipeMssGthrPipe9 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
"C:\Windows\system32\SearchFilterHost.exe" 0 520 524 532 65536 528
C:\Windows\system32\msiexec.exe /V
C:\Windows\system32\vssvc.exe
C:\Windows\System32\svchost.exe -k swprv
C:\drivers\ESET_smart\ekrn.exe
"C:\drivers\ESET_smart\egui.exe" /hide
"C:\Users\Ecjev\Desktop\RSITx64.exe"
C:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}

====== Scheduled tasks folder ======

C:\Windows\system32\tasks\Adobe Acrobat Update Task - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
C:\Windows\system32\tasks\Adobe Flash Player Updater - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
C:\Windows\system32\tasks\AIDA64 AutoStart - C:\drivers\AIDA64 Extreme\aida64.exe
C:\Windows\system32\tasks\NvProfileUpdaterDaily_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} - C:\Program Files\NVIDIA Corporation\Update Core\NvProfileUpdater64.exe
C:\Windows\system32\tasks\NvProfileUpdaterOnLogon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} - C:\Program Files\NVIDIA Corporation\Update Core\NvProfileUpdater64.exe
C:\Windows\system32\tasks\NvTmMon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} - C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvTmMon.exe
C:\Windows\system32\tasks\NvTmRepOnLogon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} - C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvTmRep.exe --logon
C:\Windows\system32\tasks\NvTmRep_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} - C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvTmRep.exe
C:\Windows\system32\tasks\WPD\SqmUpload_S-1-5-21-58873803-3009850163-3451747300-1000 - %windir%\system32\rundll32.exe portabledeviceapi.dll,#1
C:\Windows\system32\tasks\Microsoft\Windows Defender\MP Scheduled Scan - c:\program files\windows defender\MpCmdRun.exe Scan -ScheduleJob -WinTask -RestrictPrivilegesScan
C:\Windows\system32\tasks\Microsoft\Windows\WindowsBackup\ConfigNotification - %systemroot%\System32\sdclt.exe /CONFIGNOTIFICATION
C:\Windows\system32\tasks\Microsoft\Windows\Windows Media Sharing\UpdateLibrary - "%ProgramFiles%\Windows Media Player\wmpnscfg.exe"
C:\Windows\system32\tasks\Microsoft\Windows\Windows Filtering Platform\BfeOnServiceStartTypeChange - %windir%\system32\rundll32.exe bfe.dll,BfeOnServiceStartTypeChange
C:\Windows\system32\tasks\Microsoft\Windows\Windows Error Reporting\QueueReporting - %windir%\system32\wermgr.exe -queuereporting
C:\Windows\system32\tasks\Microsoft\Windows\Windows Activation Technologies\ValidationTask - %SystemRoot%\system32\Wat\WatAdminSvc.exe /run
C:\Windows\system32\tasks\Microsoft\Windows\Windows Activation Technologies\ValidationTaskDeadline - %SystemRoot%\system32\schtasks.exe /run /I /TN "\Microsoft\Windows\Windows Activation Technologies\ValidationTask"
C:\Windows\system32\tasks\Microsoft\Windows\UPnP\UPnPHostConfig - sc.exe config upnphost start= auto
C:\Windows\system32\tasks\Microsoft\Windows\Time Synchronization\SynchronizeTime - %windir%\system32\sc.exe start w32time task_started
C:\Windows\system32\tasks\Microsoft\Windows\Tcpip\IpAddressConflict1 - %windir%\system32\rundll32.exe ndfapi.dll,NdfRunDllDuplicateIPOffendingSystem
C:\Windows\system32\tasks\Microsoft\Windows\Tcpip\IpAddressConflict2 - %windir%\system32\rundll32.exe ndfapi.dll,NdfRunDllDuplicateIPDefendingSystem
C:\Windows\system32\tasks\Microsoft\Windows\SystemRestore\SR - %windir%\system32\rundll32.exe /d srrstr.dll,ExecuteScheduledSPPCreation
C:\Windows\system32\tasks\Microsoft\Windows\SoftwareProtectionPlatform\SvcRestartTask - sc.exe start sppsvc
C:\Windows\system32\tasks\Microsoft\Windows\RemoteAssistance\RemoteAssistanceTask - %windir%\system32\RAServer.exe /offerraupdate
C:\Windows\system32\tasks\Microsoft\Windows\Power Efficiency Diagnostics\AnalyzeSystem - %SystemRoot%\System32\powercfg.exe -energy -auto
C:\Windows\system32\tasks\Microsoft\Windows\NetTrace\GatherNetworkInfo - %windir%\system32\gatherNetworkInfo.vbs
C:\Windows\system32\tasks\Microsoft\Windows\MUI\LPRemove - %windir%\system32\lpremove.exe
C:\Windows\system32\tasks\Microsoft\Windows\Media Center\ActivateWindowsSearch - %SystemRoot%\ehome\ehPrivJob.exe /DoActivateWindowsSearch
C:\Windows\system32\tasks\Microsoft\Windows\Media Center\ConfigureInternetTimeService - %SystemRoot%\ehome\ehPrivJob.exe /DoConfigureInternetTimeService
C:\Windows\system32\tasks\Microsoft\Windows\Media Center\DispatchRecoveryTasks - %SystemRoot%\ehome\ehPrivJob.exe /DoRecoveryTasks $(Arg0)
C:\Windows\system32\tasks\Microsoft\Windows\Media Center\ehDRMInit - %SystemRoot%\ehome\ehPrivJob.exe /DRMInit
C:\Windows\system32\tasks\Microsoft\Windows\Media Center\InstallPlayReady - %SystemRoot%\ehome\ehPrivJob.exe /InstallPlayReady $(Arg0)
C:\Windows\system32\tasks\Microsoft\Windows\Media Center\mcupdate - %SystemRoot%\ehome\mcupdate $(Arg0)
C:\Windows\system32\tasks\Microsoft\Windows\Media Center\MediaCenterRecoveryTask - %SystemRoot%\ehome\mcupdate.exe -MediaCenterRecoveryTask
C:\Windows\system32\tasks\Microsoft\Windows\Media Center\ObjectStoreRecoveryTask - %SystemRoot%\ehome\mcupdate.exe -ObjectStoreRecoveryTask
C:\Windows\system32\tasks\Microsoft\Windows\Media Center\OCURActivate - %SystemRoot%\ehome\ehPrivJob.exe /OCURActivate
C:\Windows\system32\tasks\Microsoft\Windows\Media Center\OCURDiscovery - %SystemRoot%\ehome\ehPrivJob.exe /OCURDiscovery $(Arg0)
C:\Windows\system32\tasks\Microsoft\Windows\Media Center\PBDADiscovery - %SystemRoot%\ehome\ehPrivJob.exe /PBDADiscovery
C:\Windows\system32\tasks\Microsoft\Windows\Media Center\PBDADiscoveryW1 - %SystemRoot%\ehome\ehPrivJob.exe /wait:7 /PBDADiscovery
C:\Windows\system32\tasks\Microsoft\Windows\Media Center\PBDADiscoveryW2 - %SystemRoot%\ehome\ehPrivJob.exe /wait:90 /PBDADiscovery
C:\Windows\system32\tasks\Microsoft\Windows\Media Center\PeriodicScanRetry - %windir%\ehome\MCUpdate.exe -pscn 0
C:\Windows\system32\tasks\Microsoft\Windows\Media Center\PvrRecoveryTask - %SystemRoot%\ehome\mcupdate.exe -PvrRecoveryTask
C:\Windows\system32\tasks\Microsoft\Windows\Media Center\PvrScheduleTask - %SystemRoot%\ehome\mcupdate.exe -PvrSchedule
C:\Windows\system32\tasks\Microsoft\Windows\Media Center\RecordingRestart - %SystemRoot%\ehome\ehrec /RestartRecording
C:\Windows\system32\tasks\Microsoft\Windows\Media Center\RegisterSearch - %SystemRoot%\ehome\ehPrivJob.exe /DoRegisterSearch $(Arg0)
C:\Windows\system32\tasks\Microsoft\Windows\Media Center\ReindexSearchRoot - %SystemRoot%\ehome\ehPrivJob.exe /DoReindexSearchRoot
C:\Windows\system32\tasks\Microsoft\Windows\Media Center\SqlLiteRecoveryTask - %SystemRoot%\ehome\mcupdate.exe -SqlLiteRecoveryTask
C:\Windows\system32\tasks\Microsoft\Windows\Media Center\UpdateRecordPath - %SystemRoot%\ehome\ehPrivJob.exe /DoUpdateRecordPath $(Arg0)
C:\Windows\system32\tasks\Microsoft\Windows\Location\Notifications - %windir%\System32\LocationNotifications.exe
C:\Windows\system32\tasks\Microsoft\Windows\DiskDiagnostic\Microsoft-Windows-DiskDiagnosticDataCollector - %windir%\system32\rundll32.exe dfdts.dll,DfdGetDefaultPolicyAndSMART
C:\Windows\system32\tasks\Microsoft\Windows\DiskDiagnostic\Microsoft-Windows-DiskDiagnosticResolver - %windir%\system32\DFDWiz.exe
C:\Windows\system32\tasks\Microsoft\Windows\Defrag\ScheduledDefrag - %windir%\system32\defrag.exe -c
C:\Windows\system32\tasks\Microsoft\Windows\Customer Experience Improvement Program\Consolidator - %SystemRoot%\System32\wsqmcons.exe
C:\Windows\system32\tasks\Microsoft\Windows\Bluetooth\UninstallDeviceTask - BthUdTask.exe $(Arg0)
C:\Windows\system32\tasks\Microsoft\Windows\Autochk\Proxy - %windir%\system32\rundll32.exe /d acproxy.dll,PerformAutochkOperations
C:\Windows\system32\tasks\Microsoft\Windows\Application Experience\AitAgent - aitagent
C:\Windows\system32\tasks\Microsoft\Windows\Application Experience\Microsoft Compatibility Appraiser - %windir%\system32\compattel\DiagTrackRunner.exe /UploadEtlFilesOnly
C:\Windows\system32\tasks\Microsoft\Windows\Application Experience\ProgramDataUpdater - %windir%\system32\compattelrunner.exe -maintenance
C:\Windows\system32\tasks\Microsoft\Windows\AppID\PolicyConverter - %windir%\system32\appidpolicyconverter.exe
C:\Windows\system32\tasks\Microsoft\Windows\AppID\VerifiedPublisherCertStoreCheck - %windir%\system32\appidcertstorecheck.exe

=========Mozilla firefox=========

ProfilePath - C:\Users\Ecjev\AppData\Roaming\Mozilla\Firefox\Profiles\cd0d3xug.default

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 26.0.0.151 Plugin
"Path"=C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_26_0_0_151.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@java.com/DTPlugin,version=11.121.2]
"Description"=Java™ Deployment Toolkit
"Path"=C:\Program Files (x86)\Java\jre1.8.0_121\bin\dtplugin\npDeployJava1.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@java.com/JavaPlugin,version=11.121.2]
"Description"=Oracle® Next Generation Java™ Plug-In
"Path"=C:\Program Files (x86)\Java\jre1.8.0_121\bin\plugin2\npjp2.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@microsoft.com/GENUINE]
"Description"=
"Path"=disabled

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@videolan.org/vlc,version=2.2.4]
"Description"=VLC Multimedia Plugin
"Path"=C:\drivers\VLC\npvlc.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@videolan.org/vlc,version=2.2.6]
"Description"=VLC Multimedia Plugin
"Path"=C:\drivers\VLC\npvlc.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\Adobe Reader]
"Description"=Handles PDFs in-place in Firefox
"Path"=C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll


[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 26.0.0.151 Plugin
"Path"=C:\Windows\system32\Macromed\Flash\NPSWF64_26_0_0_151.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/GENUINE]
"Description"=
"Path"=disabled


C:\Users\Ecjev\AppData\Roaming\Mozilla\Firefox\Profiles\cd0d3xug.default\addons.json
Adblock Plus - extension - {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}

C:\Users\Ecjev\AppData\Roaming\Mozilla\Firefox\Profiles\cd0d3xug.default\extensions.json
Adblock Plus Pop-up Addon - extension - adblockpopups@jessehakanen.net -
Adblock Plus - extension - {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d} -
Multi-process staged rollout - extension - e10srollout@mozilla.org -
Pocket - extension - firefox@getpocket.com -
Web Compat - extension - webcompat@mozilla.org -
Application Update Service Helper - extension - aushelper@mozilla.org -
Firefox Screenshots - extension - screenshots@mozilla.org -
Click-to-Play staged rollout - extension - clicktoplay-rollout@mozilla.org -
Follow-on Search Telemetry - extension - followonsearch@mozilla.com -
Shield Recipe Client - extension - shield-recipe-client@mozilla.org -
Default - theme - {972ce4c6-7e08-4474-a285-3208198ce6fd} -

C:\Users\Ecjev\AppData\Roaming\Mozilla\Firefox\Profiles\cd0d3xug.default\pluginreg.dat
Plugin - Shockwave Flash - 26.0.0.151 - C:\Windows\system32\Macromed\Flash\NPSWF64_26_0_0_151.dll

======Registry dump ======


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes]
"DefaultScope"={0633EE93-D776-472f-A0FF-E1416B8B2E3A}
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}]
"URL"=http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC


[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Internet Explorer\SearchScopes]
"DefaultScope"={0633EE93-D776-472f-A0FF-E1416B8B2E3A}
[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}]
"URL"=http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
Java(tm) Plug-In SSV Helper - C:\Program Files (x86)\Java\jre1.8.0_121\bin\ssv.dll [2017-01-19 473152]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files (x86)\Java\jre1.8.0_121\bin\jp2ssv.dll [2017-01-19 186944]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"IntelPROSet"=C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe [2014-01-17 4876528]
"IAStorIcon"=C:\drivers\Intel_Rapid_tech\IAStorIconLaunch.exe [2013-11-21 36352]
"cAudioFilterAgent"=C:\Program Files\Conexant\cAudioFilterAgent\cAudioFilterAgent64.exe [2013-09-04 907480]
"ForteConfig"=C:\Program Files\Conexant\ForteConfig\fmapp.exe [2010-10-26 49056]
"SmartAudio"=C:\Program Files\CONEXANT\SAII\SACpl.exe [2012-06-13 1647616]
"S6000Mnt"=C:\Windows\WebCam\S6000\S6000Mnt.exe [2015-05-21 516608]
"ETDCtrl"=C:\Program Files\Elantech\ETDCtrl.exe [2013-10-17 2891080]
"Energy Management"=C:\Program Files (x86)\Lenovo\Energy Management\Energy Management.exe [2017-01-19 8079408]
"EnergyUtility"=C:\Program Files (x86)\Lenovo\Energy Management\Utility.exe [2017-01-19 6200368]
"ProfilerU"=C:\Program Files\SmartTechnology\Software\ProfilerU.exe [2015-10-01 454144]
"SaiMfd"=C:\Program Files\SmartTechnology\Software\SaiMfd.exe [2015-10-01 157696]
"Cm108Sound"=C:\Windows\syswow64\RunDll32.exe [2017-03-30 45056]
"XboxStat"=C:\Program Files\Microsoft Xbox 360 Accessories\XboxStat.exe [2009-09-30 825184]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"RocketDock"=C:\drivers\RocketDock\RocketDock.exe [2007-09-02 495616]
"World of Tanks"=D:\Hry\WoT\WargamingGameUpdater.exe [2017-02-28 3135752]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CCleaner Monitoring]
D:\Programy\CCleaner\CCleaner64.exe /MONITOR []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NetLimiter]
D:\Programy\net_limiter\nlclientapp.exe [2016-12-06 56368]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Sony Ericsson PC Suite]
D:\Programy\K800i\SEPCSuite.exe [2009-11-20 434176]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VirtualCloneDrive]
D:\Programy\VirtualCloneDrive\VCDDaemon.exe [2013-03-10 88984]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\World of Tanks]
D:\Hry\WoT\WargamingGameUpdater.exe [2017-02-28 3135752]

[HKEY_LOCAL_MACHINE\Software\wow6432node\Microsoft\Windows\CurrentVersion\Run]
"USB3MON"=C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [2014-01-06 292848]

C:\Users\Ecjev\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
Rainmeter.lnk - C:\drivers\Rainmeter\Rainmeter.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"="C:\Windows\system32\nvinitx.dll"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders" = credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\hitmanpro37]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\hitmanpro37.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\HitmanPro37Crusader]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\HitmanPro37CrusaderBoot]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MBAMService]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\hitmanpro37]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\hitmanpro37.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\HitmanPro37Crusader]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\HitmanPro37CrusaderBoot]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\MBAMService]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorUser"=3
"EnableLUA"=0
"EnableUIADesktopToggle"=0
"PromptOnSecureDesktop"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoActiveDesktop"=1
"NoActiveDesktopChanges"=1
"ForceActiveDesktopOn"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.msadpcm"=msadp32.acm
"midimapper"=midimap.dll
"wavemapper"=msacm32.drv
"VIDC.UYVY"=msyuv.dll
"VIDC.YUY2"=msyuv.dll
"VIDC.YVYU"=msyuv.dll
"VIDC.IYUV"=iyuv_32.dll
"vidc.i420"=iyuv_32.dll
"VIDC.YVU9"=tsbyuv.dll
"msacm.l3acm"=l3codeca.acm
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv
"MSVideo8"=VfWWDM32.dll
"wave1"=wdmaud.drv
"midi1"=wdmaud.drv
"mixer1"=wdmaud.drv
"aux1"=wdmaud.drv
"VIDC.LAGS"=lagarith.dll
"VIDC.X264"=x264vfw64.dll
"VIDC.XVID"=xvidvfw.dll
"VIDC.FFDS"=ff_vfw.dll
"msacm.ac3acm"=ac3acm.acm
"msacm.l3codecp"=l3codecp.acm
"wave2"=wdmaud.drv
"midi2"=wdmaud.drv
"mixer2"=wdmaud.drv
"wave3"=wdmaud.drv
"midi3"=wdmaud.drv
"mixer3"=wdmaud.drv
"wave4"=wdmaud.drv
"midi4"=wdmaud.drv
"mixer4"=wdmaud.drv

====== File associations ======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*

====== List of files/folders created in the last 1 month ======

2017-09-02 12:10:30 ----D---- C:\rsit
2017-09-02 12:09:00 ----D---- C:\ProgramData\ESET
2017-09-02 12:08:51 ----SHD---- C:\Config.Msi
2017-08-09 18:32:41 ----D---- C:\Users\Ecjev\AppData\Roaming\vlc
2017-08-09 15:24:07 ----A---- C:\Windows\system32\mshtml.dll
2017-08-09 15:24:06 ----A---- C:\Windows\SYSWOW64\mshtml.dll
2017-08-09 15:24:06 ----A---- C:\Windows\system32\ieframe.dll
2017-08-09 15:24:05 ----A---- C:\Windows\SYSWOW64\jscript9.dll
2017-08-09 15:24:05 ----A---- C:\Windows\system32\jscript9.dll
2017-08-09 15:24:04 ----A---- C:\Windows\SYSWOW64\tquery.dll
2017-08-09 15:24:04 ----A---- C:\Windows\SYSWOW64\msxbde40.dll
2017-08-09 15:24:04 ----A---- C:\Windows\SYSWOW64\msrepl40.dll
2017-08-09 15:24:04 ----A---- C:\Windows\SYSWOW64\msrd3x40.dll
2017-08-09 15:24:04 ----A---- C:\Windows\SYSWOW64\msrd2x40.dll
2017-08-09 15:24:04 ----A---- C:\Windows\SYSWOW64\mspbde40.dll
2017-08-09 15:24:04 ----A---- C:\Windows\SYSWOW64\msltus40.dll
2017-08-09 15:24:04 ----A---- C:\Windows\SYSWOW64\msjtes40.dll
2017-08-09 15:24:04 ----A---- C:\Windows\SYSWOW64\msjetoledb40.dll
2017-08-09 15:24:04 ----A---- C:\Windows\SYSWOW64\msjet40.dll
2017-08-09 15:24:04 ----A---- C:\Windows\SYSWOW64\msexcl40.dll
2017-08-09 15:24:04 ----A---- C:\Windows\system32\win32k.sys
2017-08-09 15:24:04 ----A---- C:\Windows\system32\tquery.dll
2017-08-09 15:24:04 ----A---- C:\Windows\system32\Query.dll
2017-08-09 15:24:04 ----A---- C:\Windows\system32\ntoskrnl.exe
2017-08-09 15:24:03 ----A---- C:\Windows\SYSWOW64\wermgr.exe
2017-08-09 15:24:03 ----A---- C:\Windows\SYSWOW64\werdiagcontroller.dll
2017-08-09 15:24:03 ----A---- C:\Windows\SYSWOW64\wer.dll
2017-08-09 15:24:03 ----A---- C:\Windows\SYSWOW64\t2embed.dll
2017-08-09 15:24:03 ----A---- C:\Windows\SYSWOW64\Query.dll
2017-08-09 15:24:03 ----A---- C:\Windows\SYSWOW64\ntoskrnl.exe
2017-08-09 15:24:03 ----A---- C:\Windows\SYSWOW64\ntkrnlpa.exe
2017-08-09 15:24:03 ----A---- C:\Windows\SYSWOW64\ntdll.dll
2017-08-09 15:24:03 ----A---- C:\Windows\SYSWOW64\mswstr10.dll
2017-08-09 15:24:03 ----A---- C:\Windows\SYSWOW64\mswdat10.dll
2017-08-09 15:24:03 ----A---- C:\Windows\SYSWOW64\msjter40.dll
2017-08-09 15:24:03 ----A---- C:\Windows\SYSWOW64\msjint40.dll
2017-08-09 15:24:03 ----A---- C:\Windows\SYSWOW64\iedkcs32.dll
2017-08-09 15:24:03 ----A---- C:\Windows\SYSWOW64\certcli.dll
2017-08-09 15:24:03 ----A---- C:\Windows\system32\wermgr.exe
2017-08-09 15:24:03 ----A---- C:\Windows\system32\werdiagcontroller.dll
2017-08-09 15:24:03 ----A---- C:\Windows\system32\wer.dll
2017-08-09 15:24:03 ----A---- C:\Windows\system32\t2embed.dll
2017-08-09 15:24:03 ----A---- C:\Windows\system32\ntdll.dll
2017-08-09 15:24:03 ----A---- C:\Windows\system32\MsSpellCheckingFacility.exe
2017-08-09 15:24:03 ----A---- C:\Windows\system32\mshtmlmedia.dll
2017-08-09 15:24:03 ----A---- C:\Windows\system32\iedkcs32.dll
2017-08-09 15:24:03 ----A---- C:\Windows\system32\drivers\volmgrx.sys
2017-08-09 15:24:03 ----A---- C:\Windows\system32\drivers\tdx.sys
2017-08-09 15:24:03 ----A---- C:\Windows\system32\drivers\ksecpkg.sys
2017-08-09 15:24:03 ----A---- C:\Windows\system32\drivers\ksecdd.sys
2017-08-09 15:24:03 ----A---- C:\Windows\system32\clfs.sys
2017-08-09 15:24:03 ----A---- C:\Windows\system32\certcli.dll
2017-08-09 15:24:02 ----A---- C:\Windows\SYSWOW64\wininet.dll
2017-08-09 15:24:02 ----A---- C:\Windows\SYSWOW64\vbscript.dll
2017-08-09 15:24:02 ----A---- C:\Windows\SYSWOW64\urlmon.dll
2017-08-09 15:24:02 ----A---- C:\Windows\SYSWOW64\mshtmlmedia.dll
2017-08-09 15:24:02 ----A---- C:\Windows\SYSWOW64\msfeeds.dll
2017-08-09 15:24:02 ----A---- C:\Windows\SYSWOW64\jscript.dll
2017-08-09 15:24:02 ----A---- C:\Windows\SYSWOW64\iertutil.dll
2017-08-09 15:24:02 ----A---- C:\Windows\SYSWOW64\ieframe.dll
2017-08-09 15:24:02 ----A---- C:\Windows\system32\wininet.dll
2017-08-09 15:24:02 ----A---- C:\Windows\system32\vbscript.dll
2017-08-09 15:24:02 ----A---- C:\Windows\system32\urlmon.dll
2017-08-09 15:24:02 ----A---- C:\Windows\system32\rpcrt4.dll
2017-08-09 15:24:02 ----A---- C:\Windows\system32\mssrch.dll
2017-08-09 15:24:02 ----A---- C:\Windows\system32\msfeeds.dll
2017-08-09 15:24:02 ----A---- C:\Windows\system32\jscript.dll
2017-08-09 15:24:02 ----A---- C:\Windows\system32\ieui.dll
2017-08-09 15:24:02 ----A---- C:\Windows\system32\iertutil.dll
2017-08-09 15:24:01 ----A---- C:\Windows\SYSWOW64\webcheck.dll
2017-08-09 15:24:01 ----A---- C:\Windows\SYSWOW64\rpcrt4.dll
2017-08-09 15:24:01 ----A---- C:\Windows\SYSWOW64\occache.dll
2017-08-09 15:24:01 ----A---- C:\Windows\SYSWOW64\mssvp.dll
2017-08-09 15:24:01 ----A---- C:\Windows\SYSWOW64\mssrch.dll
2017-08-09 15:24:01 ----A---- C:\Windows\SYSWOW64\msrating.dll
2017-08-09 15:24:01 ----A---- C:\Windows\SYSWOW64\mshtmled.dll
2017-08-09 15:24:01 ----A---- C:\Windows\SYSWOW64\kerberos.dll
2017-08-09 15:24:01 ----A---- C:\Windows\SYSWOW64\jsproxy.dll
2017-08-09 15:24:01 ----A---- C:\Windows\SYSWOW64\jscript9diag.dll
2017-08-09 15:24:01 ----A---- C:\Windows\SYSWOW64\ieui.dll
2017-08-09 15:24:01 ----A---- C:\Windows\SYSWOW64\ieapfltr.dll
2017-08-09 15:24:01 ----A---- C:\Windows\SYSWOW64\dxtrans.dll
2017-08-09 15:24:01 ----A---- C:\Windows\SYSWOW64\dxtmsft.dll
2017-08-09 15:24:01 ----A---- C:\Windows\system32\webcheck.dll
2017-08-09 15:24:01 ----A---- C:\Windows\system32\smss.exe
2017-08-09 15:24:01 ----A---- C:\Windows\system32\schannel.dll
2017-08-09 15:24:01 ----A---- C:\Windows\system32\occache.dll
2017-08-09 15:24:01 ----A---- C:\Windows\system32\ncrypt.dll
2017-08-09 15:24:01 ----A---- C:\Windows\system32\msv1_0.dll
2017-08-09 15:24:01 ----A---- C:\Windows\system32\mssvp.dll
2017-08-09 15:24:01 ----A---- C:\Windows\system32\mssprxy.dll
2017-08-09 15:24:01 ----A---- C:\Windows\system32\mssphtb.dll
2017-08-09 15:24:01 ----A---- C:\Windows\system32\mssph.dll
2017-08-09 15:24:01 ----A---- C:\Windows\system32\mssitlb.dll
2017-08-09 15:24:01 ----A---- C:\Windows\system32\msrating.dll
2017-08-09 15:24:01 ----A---- C:\Windows\system32\mshtmled.dll
2017-08-09 15:24:01 ----A---- C:\Windows\system32\MshtmlDac.dll
2017-08-09 15:24:01 ----A---- C:\Windows\system32\lsasrv.dll
2017-08-09 15:24:01 ----A---- C:\Windows\system32\kernel32.dll
2017-08-09 15:24:01 ----A---- C:\Windows\system32\kerberos.dll
2017-08-09 15:24:01 ----A---- C:\Windows\system32\jsproxy.dll
2017-08-09 15:24:01 ----A---- C:\Windows\system32\jscript9diag.dll
2017-08-09 15:24:01 ----A---- C:\Windows\system32\JavaScriptCollectionAgent.dll
2017-08-09 15:24:01 ----A---- C:\Windows\system32\inseng.dll
2017-08-09 15:24:01 ----A---- C:\Windows\system32\ieUnatt.exe
2017-08-09 15:24:01 ----A---- C:\Windows\system32\ieetwproxystub.dll
2017-08-09 15:24:01 ----A---- C:\Windows\system32\ieapfltr.dll
2017-08-09 15:24:01 ----A---- C:\Windows\system32\dxtrans.dll
2017-08-09 15:24:01 ----A---- C:\Windows\system32\dxtmsft.dll
2017-08-09 15:24:01 ----A---- C:\Windows\system32\drivers\mrxsmb10.sys
2017-08-09 15:24:01 ----A---- C:\Windows\system32\drivers\mrxsmb.sys
2017-08-09 15:24:01 ----A---- C:\Windows\system32\advapi32.dll
2017-08-09 15:24:00 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
2017-08-09 15:24:00 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-synch-l1-1-0.dll
2017-08-09 15:24:00 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-string-l1-1-0.dll
2017-08-09 15:24:00 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-misc-l1-1-0.dll
2017-08-09 15:24:00 ----AH---- C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2017-08-09 15:24:00 ----AH---- C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2017-08-09 15:24:00 ----AH---- C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2017-08-09 15:24:00 ----AH---- C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2017-08-09 15:24:00 ----AH---- C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2017-08-09 15:24:00 ----A---- C:\Windows\SYSWOW64\wow32.dll
2017-08-09 15:24:00 ----A---- C:\Windows\SYSWOW64\wdigest.dll
2017-08-09 15:24:00 ----A---- C:\Windows\SYSWOW64\TSpkg.dll
2017-08-09 15:24:00 ----A---- C:\Windows\SYSWOW64\sspicli.dll
2017-08-09 15:24:00 ----A---- C:\Windows\SYSWOW64\srclient.dll
2017-08-09 15:24:00 ----A---- C:\Windows\SYSWOW64\schannel.dll
2017-08-09 15:24:00 ----A---- C:\Windows\SYSWOW64\secur32.dll
2017-08-09 15:24:00 ----A---- C:\Windows\SYSWOW64\SearchProtocolHost.exe
2017-08-09 15:24:00 ----A---- C:\Windows\SYSWOW64\SearchIndexer.exe
2017-08-09 15:24:00 ----A---- C:\Windows\SYSWOW64\SearchFilterHost.exe
2017-08-09 15:24:00 ----A---- C:\Windows\SYSWOW64\rpchttp.dll
2017-08-09 15:24:00 ----A---- C:\Windows\SYSWOW64\ntvdm64.dll
2017-08-09 15:24:00 ----A---- C:\Windows\SYSWOW64\ncrypt.dll
2017-08-09 15:24:00 ----A---- C:\Windows\SYSWOW64\msv1_0.dll
2017-08-09 15:24:00 ----A---- C:\Windows\SYSWOW64\mssprxy.dll
2017-08-09 15:24:00 ----A---- C:\Windows\SYSWOW64\mssphtb.dll
2017-08-09 15:24:00 ----A---- C:\Windows\SYSWOW64\mssph.dll
2017-08-09 15:24:00 ----A---- C:\Windows\SYSWOW64\mssitlb.dll
2017-08-09 15:24:00 ----A---- C:\Windows\SYSWOW64\msshooks.dll
2017-08-09 15:24:00 ----A---- C:\Windows\SYSWOW64\msscntrs.dll
2017-08-09 15:24:00 ----A---- C:\Windows\SYSWOW64\MshtmlDac.dll
2017-08-09 15:24:00 ----A---- C:\Windows\SYSWOW64\KernelBase.dll
2017-08-09 15:24:00 ----A---- C:\Windows\SYSWOW64\kernel32.dll
2017-08-09 15:24:00 ----A---- C:\Windows\SYSWOW64\JavaScriptCollectionAgent.dll
2017-08-09 15:24:00 ----A---- C:\Windows\SYSWOW64\inseng.dll
2017-08-09 15:24:00 ----A---- C:\Windows\SYSWOW64\ieUnatt.exe
2017-08-09 15:24:00 ----A---- C:\Windows\SYSWOW64\iesetup.dll
2017-08-09 15:24:00 ----A---- C:\Windows\SYSWOW64\iernonce.dll
2017-08-09 15:24:00 ----A---- C:\Windows\SYSWOW64\ieetwproxystub.dll
2017-08-09 15:24:00 ----A---- C:\Windows\SYSWOW64\cryptbase.dll
2017-08-09 15:24:00 ----A---- C:\Windows\SYSWOW64\credssp.dll
2017-08-09 15:24:00 ----A---- C:\Windows\SYSWOW64\bcrypt.dll
2017-08-09 15:24:00 ----A---- C:\Windows\SYSWOW64\auditpol.exe
2017-08-09 15:24:00 ----A---- C:\Windows\SYSWOW64\appidapi.dll
2017-08-09 15:24:00 ----A---- C:\Windows\SYSWOW64\advapi32.dll
2017-08-09 15:24:00 ----A---- C:\Windows\system32\wow64win.dll
2017-08-09 15:24:00 ----A---- C:\Windows\system32\wow64cpu.dll
2017-08-09 15:24:00 ----A---- C:\Windows\system32\wow64.dll
2017-08-09 15:24:00 ----A---- C:\Windows\system32\winsrv.dll
2017-08-09 15:24:00 ----A---- C:\Windows\system32\wdigest.dll
2017-08-09 15:24:00 ----A---- C:\Windows\system32\TSpkg.dll
2017-08-09 15:24:00 ----A---- C:\Windows\system32\sspisrv.dll
2017-08-09 15:24:00 ----A---- C:\Windows\system32\sspicli.dll
2017-08-09 15:24:00 ----A---- C:\Windows\system32\srcore.dll
2017-08-09 15:24:00 ----A---- C:\Windows\system32\srclient.dll
2017-08-09 15:24:00 ----A---- C:\Windows\system32\setbcdlocale.dll
2017-08-09 15:24:00 ----A---- C:\Windows\system32\secur32.dll
2017-08-09 15:24:00 ----A---- C:\Windows\system32\SearchProtocolHost.exe
2017-08-09 15:24:00 ----A---- C:\Windows\system32\SearchIndexer.exe
2017-08-09 15:24:00 ----A---- C:\Windows\system32\SearchFilterHost.exe
2017-08-09 15:24:00 ----A---- C:\Windows\system32\rstrui.exe
2017-08-09 15:24:00 ----A---- C:\Windows\system32\rpchttp.dll
2017-08-09 15:24:00 ----A---- C:\Windows\system32\ntvdm64.dll
2017-08-09 15:24:00 ----A---- C:\Windows\system32\msshooks.dll
2017-08-09 15:24:00 ----A---- C:\Windows\system32\msscntrs.dll
2017-08-09 15:24:00 ----A---- C:\Windows\system32\lsass.exe
2017-08-09 15:24:00 ----A---- C:\Windows\system32\KernelBase.dll
2017-08-09 15:24:00 ----A---- C:\Windows\system32\iesetup.dll
2017-08-09 15:24:00 ----A---- C:\Windows\system32\iernonce.dll
2017-08-09 15:24:00 ----A---- C:\Windows\system32\ieetwcollector.exe
2017-08-09 15:24:00 ----A---- C:\Windows\system32\ie4uinit.exe
2017-08-09 15:24:00 ----A---- C:\Windows\system32\drivers\mrxsmb20.sys
2017-08-09 15:24:00 ----A---- C:\Windows\system32\drivers\appid.sys
2017-08-09 15:24:00 ----A---- C:\Windows\system32\csrsrv.dll
2017-08-09 15:24:00 ----A---- C:\Windows\system32\cryptbase.dll
2017-08-09 15:24:00 ----A---- C:\Windows\system32\credssp.dll
2017-08-09 15:24:00 ----A---- C:\Windows\system32\conhost.exe
2017-08-09 15:24:00 ----A---- C:\Windows\system32\bcrypt.dll
2017-08-09 15:24:00 ----A---- C:\Windows\system32\auditpol.exe
2017-08-09 15:24:00 ----A---- C:\Windows\system32\appidsvc.dll
2017-08-09 15:24:00 ----A---- C:\Windows\system32\appidpolicyconverter.exe
2017-08-09 15:24:00 ----A---- C:\Windows\system32\appidcertstorecheck.exe
2017-08-09 15:24:00 ----A---- C:\Windows\system32\appidapi.dll
2017-08-09 15:23:59 ----AH---- C:\Windows\SYSWOW64\api-ms-win-security-base-l1-1-0.dll
2017-08-09 15:23:59 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-xstate-l1-1-0.dll
2017-08-09 15:23:59 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-util-l1-1-0.dll
2017-08-09 15:23:59 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-threadpool-l1-1-0.dll
2017-08-09 15:23:59 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
2017-08-09 15:23:59 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-profile-l1-1-0.dll
2017-08-09 15:23:59 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-processthreads-l1-1-0.dll
2017-08-09 15:23:59 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
2017-08-09 15:23:59 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
2017-08-09 15:23:59 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-memory-l1-1-0.dll
2017-08-09 15:23:59 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-localregistry-l1-1-0.dll
2017-08-09 15:23:59 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-localization-l1-1-0.dll
2017-08-09 15:23:59 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
2017-08-09 15:23:59 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-io-l1-1-0.dll
2017-08-09 15:23:59 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-interlocked-l1-1-0.dll
2017-08-09 15:23:59 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-heap-l1-1-0.dll
2017-08-09 15:23:59 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-handle-l1-1-0.dll
2017-08-09 15:23:59 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-file-l1-1-0.dll
2017-08-09 15:23:59 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-fibers-l1-1-0.dll
2017-08-09 15:23:59 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
2017-08-09 15:23:59 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-delayload-l1-1-0.dll
2017-08-09 15:23:59 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-debug-l1-1-0.dll
2017-08-09 15:23:59 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-datetime-l1-1-0.dll
2017-08-09 15:23:59 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-console-l1-1-0.dll
2017-08-09 15:23:59 ----AH---- C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2017-08-09 15:23:59 ----AH---- C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2017-08-09 15:23:59 ----AH---- C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2017-08-09 15:23:59 ----AH---- C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2017-08-09 15:23:59 ----AH---- C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2017-08-09 15:23:59 ----AH---- C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2017-08-09 15:23:59 ----AH---- C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2017-08-09 15:23:59 ----AH---- C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2017-08-09 15:23:59 ----AH---- C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2017-08-09 15:23:59 ----AH---- C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2017-08-09 15:23:59 ----AH---- C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2017-08-09 15:23:59 ----AH---- C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2017-08-09 15:23:59 ----AH---- C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2017-08-09 15:23:59 ----AH---- C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2017-08-09 15:23:59 ----AH---- C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2017-08-09 15:23:59 ----AH---- C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2017-08-09 15:23:59 ----AH---- C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2017-08-09 15:23:59 ----AH---- C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2017-08-09 15:23:59 ----AH---- C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2017-08-09 15:23:59 ----AH---- C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2017-08-09 15:23:59 ----AH---- C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2017-08-09 15:23:59 ----AH---- C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2017-08-09 15:23:59 ----AH---- C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2017-08-09 15:23:59 ----A---- C:\Windows\SYSWOW64\user.exe
2017-08-09 15:23:59 ----A---- C:\Windows\SYSWOW64\setup16.exe
2017-08-09 15:23:59 ----A---- C:\Windows\SYSWOW64\mstext40.dll
2017-08-09 15:23:59 ----A---- C:\Windows\SYSWOW64\msobjs.dll
2017-08-09 15:23:59 ----A---- C:\Windows\SYSWOW64\msexch40.dll
2017-08-09 15:23:59 ----A---- C:\Windows\SYSWOW64\msaudite.dll
2017-08-09 15:23:59 ----A---- C:\Windows\SYSWOW64\instnm.exe
2017-08-09 15:23:59 ----A---- C:\Windows\SYSWOW64\apisetschema.dll
2017-08-09 15:23:59 ----A---- C:\Windows\SYSWOW64\adtschema.dll
2017-08-09 15:23:59 ----A---- C:\Windows\system32\msobjs.dll
2017-08-09 15:23:59 ----A---- C:\Windows\system32\msaudite.dll
2017-08-09 15:23:59 ----A---- C:\Windows\system32\ieetwcollectorres.dll
2017-08-09 15:23:59 ----A---- C:\Windows\system32\apisetschema.dll
2017-08-09 15:23:59 ----A---- C:\Windows\system32\adtschema.dll
2017-08-05 17:44:50 ----D---- C:\Users\Ecjev\AppData\Roaming\dvdcss

====== List of files/folders modified in the last 1 month ======

2017-09-02 12:10:33 ----D---- C:\Program Files\trend micro
2017-09-02 12:10:32 ----D---- C:\Windows\Temp
2017-09-02 12:09:15 ----D---- C:\Windows\system32\DriverStore
2017-09-02 12:09:14 ----SHD---- C:\Windows\Installer
2017-09-02 12:09:14 ----D---- C:\Windows\inf
2017-09-02 12:09:00 ----HD---- C:\ProgramData
2017-09-02 12:09:00 ----D---- C:\drivers
2017-09-02 12:08:43 ----SHD---- C:\System Volume Information
2017-09-02 12:07:25 ----D---- C:\Windows\system32\config
2017-09-02 10:04:20 ----D---- C:\Windows\System32
2017-09-02 10:04:20 ----A---- C:\Windows\system32\PerfStringBackup.INI
2017-09-02 09:59:48 ----HD---- C:\Windows\system32\WLANProfiles
2017-09-02 09:58:14 ----D---- C:\ProgramData\NVIDIA
2017-09-01 22:11:38 ----D---- C:\Program Files (x86)\Mozilla Maintenance Service
2017-08-31 20:40:42 ----D---- C:\Windows\SysWOW64
2017-08-12 11:14:40 ----D---- C:\Windows\rescache
2017-08-10 22:49:21 ----D---- C:\Windows\system32\Tasks
2017-08-10 15:35:54 ----D---- C:\Windows\winsxs
2017-08-10 15:35:14 ----D---- C:\Windows\SYSWOW64\migration
2017-08-10 15:35:14 ----D---- C:\Windows\SYSWOW64\en-US
2017-08-10 15:35:14 ----D---- C:\Windows\SYSWOW64\cs-CZ
2017-08-10 15:35:14 ----D---- C:\Windows\system32\migration
2017-08-10 15:35:14 ----D---- C:\Windows\system32\en-US
2017-08-10 15:35:14 ----D---- C:\Windows\system32\drivers
2017-08-10 15:35:14 ----D---- C:\Windows\system32\cs-CZ
2017-08-10 15:35:14 ----D---- C:\Program Files\Internet Explorer
2017-08-10 15:35:14 ----D---- C:\Program Files (x86)\Internet Explorer
2017-08-10 15:35:13 ----D---- C:\Windows\system32\Boot
2017-08-10 15:35:13 ----D---- C:\Windows\AppPatch
2017-08-09 20:37:58 ----D---- C:\Windows\system32\MRT
2017-08-09 20:36:49 ----AC---- C:\Windows\system32\MRT.exe
2017-08-09 15:23:11 ----D---- C:\Windows\system32\catroot2
2017-08-08 20:14:11 ----A---- C:\Windows\SYSWOW64\FlashPlayerApp.exe
2017-08-08 20:14:07 ----D---- C:\Windows\system32\Macromed
2017-08-08 20:14:03 ----D---- C:\Windows\SYSWOW64\Macromed

File C:\Windows\system32\winlogon.exe is digitally signed
File C:\Windows\system32\wininit.exe is digitally signed
File C:\Windows\explorer.exe is digitally signed
File C:\Windows\SysWOW64\explorer.exe is digitally signed
File C:\Windows\system32\svchost.exe is digitally signed
File C:\Windows\SysWOW64\svchost.exe is digitally signed
File C:\Windows\system32\services.exe is digitally signed
File C:\Windows\system32\User32.dll is digitally signed
File C:\Windows\SysWOW64\User32.dll is digitally signed
File C:\Windows\system32\userinit.exe is digitally signed
File C:\Windows\SysWOW64\userinit.exe is digitally signed
File C:\Windows\system32\rpcss.dll is digitally signed
File C:\Windows\system32\Drivers\volsnap.sys is digitally signed

====== List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled) ======

R0 edevmon;edevmon; C:\Windows\system32\DRIVERS\edevmon.sys [2017-05-04 107344]
R0 iastora;iastora; C:\Windows\system32\DRIVERS\iaStorA.sys [2013-11-21 632168]
R0 iaStorF;iaStorF; C:\Windows\system32\DRIVERS\iaStorF.sys [2013-11-21 28008]
R0 iusb3hcs;Ovladač přepínání hostitelského řadiče Intel(R) USB 3.0; C:\Windows\system32\DRIVERS\iusb3hcs.sys [2014-01-06 20464]
R0 LHDmgr;LHDmgr; C:\Windows\System32\DRIVERS\LhdX64.sys [2017-01-19 39008]
R0 nldrv;nldrv; C:\Windows\system32\drivers\nldrv.sys [2016-12-06 142888]
R0 nvpciflt;nvpciflt; C:\Windows\system32\DRIVERS\nvpciflt.sys [2016-10-25 39992]
R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2010-11-21 213888]
R1 CSC;@%systemroot%\system32\cscsvc.dll,-202; C:\Windows\system32\drivers\csc.sys [2010-11-21 514560]
R1 eamonm;eamonm; C:\Windows\system32\DRIVERS\eamonm.sys [2017-06-22 132824]
R1 ehdrv;ehdrv; C:\Windows\system32\DRIVERS\ehdrv.sys [2017-05-04 178056]
R1 ElbyCDIO;ElbyCDIO Driver; C:\Windows\System32\Drivers\ElbyCDIO.sys [2014-12-21 40344]
R1 epfw;epfw; C:\Windows\system32\DRIVERS\epfw.sys [2017-05-04 78192]
R1 EpfwLWF;ESET Personal Firewall; C:\Windows\system32\DRIVERS\EpfwLWF.sys [2017-05-04 60544]
R1 epfwwfp;epfwwfp; C:\Windows\system32\DRIVERS\epfwwfp.sys [2017-05-04 101648]
R1 vwififlt;Virtual WiFi Filter Driver; C:\Windows\system32\DRIVERS\vwififlt.sys [2009-07-14 59904]
R2 ekbdflt;ekbdflt; C:\Windows\system32\DRIVERS\ekbdflt.sys [2017-05-04 50752]
R3 ACPIVPC;Lenovo Virtual Power Controller Driver; C:\Windows\system32\DRIVERS\AcpiVpc.sys [2017-01-19 30816]
R3 CnxtHdAudService;Conexant UAA Function Driver for High Definition Audio Service; C:\Windows\system32\drivers\CHDRT64.sys [2014-01-27 1692376]
R3 ETD;ELAN PS/2 Port Input Device; C:\Windows\system32\DRIVERS\ETD.sys [2013-10-17 377608]
R3 igfx;igfx; C:\Windows\system32\DRIVERS\igdkmd64.sys [2015-08-09 4928256]
R3 iusb3hub;Ovladač rozbočovače Intel(R) USB 3.0; C:\Windows\system32\DRIVERS\iusb3hub.sys [2014-01-06 369648]
R3 iusb3xhc;Ovladač rozšiřitelného hostitelského řadiče Intel(R) USB 3.0; C:\Windows\system32\DRIVERS\iusb3xhc.sys [2014-01-06 790512]
R3 MEIx64;Intel(R) Management Engine Interface ; C:\Windows\system32\DRIVERS\TeeDriverx64.sys [2013-09-17 99288]
R3 NETwNs64;___ Ovladač adaptéru Intel(R) Wireless pro systém Windows 7 64 Bit; C:\Windows\system32\DRIVERS\Netwsw02.sys [2014-05-04 3438048]
R3 RSUSBVSTOR;RtsUVStor.Sys Realtek USB Card Reader; C:\Windows\System32\Drivers\RtsUVStor.sys [2013-08-08 329944]
R3 RTL8167;Realtek 8167 NT Driver; C:\Windows\system32\DRIVERS\Rt64win7.sys [2013-08-28 883928]
R3 S6000KNT;Alcor WebCam Driver; C:\Windows\System32\Drivers\S6000KNT.sys [2015-05-21 899712]
R3 SaiMini;SaiMini; C:\Windows\system32\DRIVERS\SaiMini.sys [2016-07-18 24152]
R3 SaiNtBus;SaiNtBus; C:\Windows\system32\drivers\SaiBus.sys [2016-07-18 59736]
R3 VClone;VClone; C:\Windows\system32\DRIVERS\VClone.sys [2013-07-24 36864]
R3 vuhub;Virtual Usb Hub; C:\Windows\system32\DRIVERS\vuhub.sys [2007-12-17 47616]
R3 vwifimp;Microsoft Virtual WiFi Miniport Service; C:\Windows\system32\DRIVERS\vwifimp.sys [2009-07-14 17920]
S3 BthEnum;Ovladač pro Bluetooth Request Block; C:\Windows\system32\drivers\BthEnum.sys [2009-07-14 41984]
S3 BthPan;Zařízení Bluetooth (síť PAN); C:\Windows\system32\drivers\bthpan.sys [2017-07-06 119296]
S3 BTHPORT;Ovladač portu Bluetooth; C:\Windows\System32\Drivers\BTHport.sys [2012-07-06 552960]
S3 BTHUSB;Ovladač rozhraní USB radiostanice Bluetooth; C:\Windows\System32\Drivers\BTHUSB.sys [2011-04-28 80384]
S3 dmvsc;dmvsc; C:\Windows\system32\drivers\dmvsc.sys [2010-11-21 71168]
S3 ew_hwusbdev;Huawei MobileBroadband USB PNP Device; C:\Windows\system32\DRIVERS\ew_hwusbdev.sys []
S3 ew_usbenumfilter;huawei_CompositeFilter; C:\Windows\system32\DRIVERS\ew_usbenumfilter.sys []
S3 huawei_enumerator;huawei_enumerator; C:\Windows\system32\DRIVERS\ew_jubusenum.sys []
S3 hwusb_cdcacm;hwusb_cdcacm; C:\Windows\system32\DRIVERS\ew_cdcacm.sys []
S3 hwusb_wwanecm;hwusb_wwanecm; C:\Windows\system32\DRIVERS\ew_wwanecm.sys []
S3 pciide;pciide; C:\Windows\system32\drivers\pciide.sys [2009-07-14 12352]
S3 RDPDR;Terminal Server Device Redirector Driver; C:\Windows\System32\drivers\rdpdr.sys [2010-11-21 165888]
S3 RdpVideoMiniport;Remote Desktop Video Miniport Driver; C:\Windows\System32\drivers\rdpvideominiport.sys [2012-08-23 19456]
S3 RFCOMM;Zařízení Bluetooth (RFCOMM protokol TDI); C:\Windows\system32\DRIVERS\rfcomm.sys [2009-07-14 158720]
S3 s0016bus;Sony Ericsson Device 0016 driver (WDM); C:\Windows\system32\DRIVERS\s0016bus.sys [2008-05-16 115240]
S3 s0016mdfl;Sony Ericsson Device 0016 USB WMC Modem Filter; C:\Windows\system32\DRIVERS\s0016mdfl.sys [2008-05-16 19496]
S3 s0016mdm;Sony Ericsson Device 0016 USB WMC Modem Driver; C:\Windows\system32\DRIVERS\s0016mdm.sys [2008-05-16 158760]
S3 s0016mgmt;Sony Ericsson Device 0016 USB WMC Device Management Drivers (WDM); C:\Windows\system32\DRIVERS\s0016mgmt.sys [2008-05-16 137256]
S3 s0016nd5;Sony Ericsson Device 0016 USB Ethernet Emulation SEMC0016 (NDIS); C:\Windows\system32\DRIVERS\s0016nd5.sys [2008-05-16 34344]
S3 s0016obex;Sony Ericsson Device 0016 USB WMC OBEX Interface; C:\Windows\system32\DRIVERS\s0016obex.sys [2008-05-16 136744]
S3 s0016unic;Sony Ericsson Device 0016 USB Ethernet Emulation SEMC0016 (WDM); C:\Windows\system32\DRIVERS\s0016unic.sys [2008-05-16 151592]
S3 s3cap;s3cap; C:\Windows\system32\drivers\vms3cap.sys [2010-11-21 6656]
S3 storvsc;storvsc; C:\Windows\system32\drivers\storvsc.sys [2010-11-21 34688]
S3 TsUsbFlt;TsUsbFlt; C:\Windows\system32\drivers\tsusbflt.sys [2013-10-02 56832]
S3 TsUsbGD;Remote Desktop Generic USB Device; C:\Windows\system32\drivers\TsUsbGD.sys [2012-08-23 30208]
S3 USBPNPA;USB PnP Sound Device Interface; C:\Windows\system32\drivers\CM10864.sys [2013-02-01 4333568]
S3 vmbus;vmbus; C:\Windows\system32\drivers\vmbus.sys [2010-11-21 199552]
S3 VMBusHID;VMBusHID; C:\Windows\system32\drivers\VMBusHID.sys [2010-11-21 21760]
S3 WDC_SAM;WD SCSI Pass Thru driver; C:\Windows\system32\DRIVERS\wdcsam64.sys [2015-04-30 23200]

====== List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled) ======

R2 AdobeARMservice;Adobe Acrobat Update Service; C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2017-07-19 83032]
R2 CscService;@%systemroot%\system32\cscsvc.dll,-200; %SystemRoot%\System32\svchost.exe -k LocalSystemNetworkRestricted;"ServiceDll" = %SystemRoot%\System32\cscsvc.dll
R2 CxAudMsg;@C:\Windows\system32\CxAudMsg64.exe,-100; C:\Windows\system32\CxAudMsg64.exe [2013-07-25 206552]
R2 DiagTrack;@%SystemRoot%\system32\UtcResources.dll,-3001; %SystemRoot%\System32\svchost.exe -k utcsvc;"ServiceDll" = %SystemRoot%\system32\diagtrack.dll
R2 ekrn;ESET Service; C:\drivers\ESET_smart\ekrn.exe [2017-06-13 2625368]
R2 EvtEng;Intel(R) PROSet/Wireless Event Log; C:\drivers\PROSet_wireless\WiFi\bin\EvtEng.exe [2014-01-17 632048]
R2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology; C:\drivers\Intel_Rapid_tech\IAStorDataMgrSvc.exe [2013-11-21 15720]
R2 igfxCUIService1.0.0.0;Intel(R) HD Graphics Control Panel Service; C:\Windows\system32\igfxCUIService.exe [2015-08-09 355232]
R2 nlsvc;NetLimiter 4 Service; D:\Programy\net_limiter\NLSvc.exe [2016-12-06 323632]
R2 NVDisplay.ContainerLocalSystem;NVIDIA Display Container LS; C:\Program Files\NVIDIA Corporation\Display.NvContainer\NVDisplay.Container.exe [2016-10-25 458176]
R2 OMSI download service;Sony Ericsson OMSI download service; D:\Programy\K800i\SupServ.exe [2009-04-30 90112]
R2 PnkBstrA;PnkBstrA; C:\Windows\syswow64\PnkBstrA.exe [2017-01-22 76888]
R2 RegSrvc;Intel(R) PROSet/Wireless Registry Service; C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe [2014-01-17 154864]
R2 SAService;Conexant SmartAudio service; C:\Windows\system32\SAsrv.exe []
R2 TeamViewer;TeamViewer 12; c:\users\ecjev\appdata\local\temp\teamviewer\TeamViewer_Service.exe [2017-05-31 10885360]
R2 UsbService;ASUS Virtual MFP Service; C:\Program Files (x86)\ASUS\Printer Utilities\UsbService64.exe [2010-08-10 334848]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2017-04-21 107656]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2017-04-21 128648]
S2 MbnExt;Mobile Broadband Extension Service; %SystemRoot%\system32\svchost.exe -k MbnExt;"ServiceDll" = C:\Program Files (x86)\T-Mobile\T-Mobile Internet Manager\MbnExt.dll
S2 SkypeUpdate;Skype Updater; D:\Programy\skype\Updater\Updater.exe [2017-02-27 317400]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service; C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2017-08-08 272384]
S3 AppMgmt;@appmgmts.dll,-3250; %SystemRoot%\system32\svchost.exe -k netsvcs;"ServiceDll" = %SystemRoot%\System32\appmgmts.dll
S3 cphs;Intel(R) Content Protection HECI Service; C:\Windows\SysWow64\IntelCpHeciSvc.exe [2015-08-09 288688]
S3 IEEtwCollectorService;@%SystemRoot%\system32\ieetwcollectorres.dll,-1000; C:\Windows\system32\IEEtwCollector.exe [2017-07-14 116224]
S3 MozillaMaintenance;Mozilla Maintenance Service; C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2017-09-01 194000]
S3 MyWiFiDHCPDNS;Wireless PAN DHCP Server; C:\drivers\PROSet_wireless\WiFi\bin\PanDhcpDns.exe [2014-01-17 284912]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2006-10-26 441136]
S3 ose;Office Source Engine; C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 PeerDistSvc;@%SystemRoot%\system32\peerdistsvc.dll,-9000; %SystemRoot%\System32\svchost.exe -k PeerDist;"ServiceDll" = %SystemRoot%\system32\peerdistsvc.dll
S3 StorSvc;@%SystemRoot%\System32\StorSvc.dll,-100; %SystemRoot%\System32\svchost.exe -k LocalSystemNetworkRestricted;"ServiceDll" = %SystemRoot%\system32\storsvc.dll
S3 UmRdpService;@%SystemRoot%\system32\umrdp.dll,-1000; %SystemRoot%\System32\svchost.exe -k LocalSystemNetworkRestricted;"ServiceDll" = %SystemRoot%\System32\umrdp.dll
S3 WatAdminSvc;@%SystemRoot%\system32\Wat\WatUX.exe,-601; C:\Windows\system32\Wat\WatAdminSvc.exe [2017-01-19 1255736]
S4 aspnet_state;ASP.NET State Service; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe [2017-04-21 52856]
S4 NetMsmqActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8195; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2017-04-21 136312]
S4 NetPipeActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8197; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2017-04-21 136312]
S4 NetTcpActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8199; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2017-04-21 136312]

-----------------EOF-----------------

vejce4444
Návštěvník
Návštěvník
Příspěvky: 47
Registrován: 23 říj 2012 10:24

Re: Žádost o kontrolu logů

#2 Příspěvek od vejce4444 »

PC 2 log:

Logfile of random's system information tool 1.16 (written by random/random)
Run by Denča at 2017-09-02 12:13:50
Microsoft Windows 10 Education
System drive C: has 196 GB (43%) free of 457 GB
Total RAM: 4012 MB (59% free)
X64

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 12:13:54, on 02.09.2017
Platform: Unknown Windows (WinNT 6.02.1008)
MSIE: Internet Explorer v11.0 (11.00.15063.0000)
Boot mode: Normal

Running processes:
C:\Program Files (x86)\Common Files\Microsoft Shared\Ink\TabTip32.exe
C:\Programy\RocketDock\RocketDock.exe
C:\Program Files\trend micro\Denča_RSITx64.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/p/?LinkId=255141
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/p/?LinkId=255141
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/p/?LinkId=255141
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = %11%\blank.htm
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F2 - REG:system.ini: UserInit=
O2 - BHO: Lync Click to Call BHO - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\OCHelper.dll
O2 - BHO: Microsoft OneDrive for Business Browser Helper - {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} - C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\GROOVEEX.DLL
O4 - HKCU\..\Run: [RocketDock] "C:\Programy\RocketDock\RocketDock.exe"
O4 - HKUS\S-1-5-19\..\Run: [OneDriveSetup] C:\Windows\SysWOW64\OneDriveSetup.exe /thfirstsetup (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [OneDriveSetup] C:\Windows\SysWOW64\OneDriveSetup.exe /thfirstsetup (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\RunOnce: [Application Restart #1] C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe /Crashed (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [Application Restart #1] C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe /Crashed (User 'Default user')
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE/3000
O8 - Extra context menu item: Se&nd to OneNote - res://C:\Program Files\Microsoft Office\Root\Office16\ONBttnIE.dll/105
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Se&nd to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\ONBttnIE.dll
O9 - Extra button: Lync Click to Call - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\OCHelper.dll
O9 - Extra 'Tools' menuitem: Lync Click to Call - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\OCHelper.dll
O9 - Extra button: OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\ONBttnIELinkedNotes.dll
O9 - Extra 'Tools' menuitem: OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\ONBttnIELinkedNotes.dll
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O15 - Trusted Zone: http://help.eset.com (HKLM)
O15 - ESC Trusted Zone: http://help.eset.com (HKLM)
O18 - Protocol: mso-minsb-roaming.16 - {83C25742-A9F7-49FB-9138-434302C88D07} - C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\MSOSB.DLL
O18 - Protocol: mso-minsb.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\MSOSB.DLL
O18 - Protocol: osf-roaming.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\MSOSB.DLL
O18 - Protocol: osf.16 - {5504BE45-A83B-4808-900A-3A5C36E7F77A} - C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\MSOSB.DLL
O18 - Protocol: tbauth - {14654CA6-5711-491D-B89A-58E571679951} - C:\Windows\SysWOW64\tbauth.dll
O18 - Protocol: windows.tbauth - {14654CA6-5711-491D-B89A-58E571679951} - C:\Windows\SysWOW64\tbauth.dll
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\WINDOWS\System32\alg.exe (file missing)
O23 - Service: Intel(R) Content Protection HECI Service (cphs) - Intel Corporation - C:\WINDOWS\SysWow64\IntelCpHeciSvc.exe
O23 - Service: @%SystemRoot%\system32\DiagSvcs\DiagnosticsHub.StandardCollector.ServiceRes.dll,-1000 (diagnosticshub.standardcollector.service) - Unknown owner - C:\WINDOWS\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe (file missing)
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\WINDOWS\System32\lsass.exe (file missing)
O23 - Service: ESET Service (ekrn) - ESET - C:\Program Files\ESET\ESET Smart Security\ekrn.exe
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\WINDOWS\system32\fxssvc.exe (file missing)
O23 - Service: @oem9.inf,%SERVICE_NAME%;Intel Bluetooth Service (ibtsiva) - Unknown owner - C:\WINDOWS\system32\ibtsiva (file missing)
O23 - Service: Intel(R) HD Graphics Control Panel Service (igfxCUIService2.0.0.0) - Unknown owner - C:\WINDOWS\system32\igfxCUIService.exe (file missing)
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\WINDOWS\system32\lsass.exe (file missing)
O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\WINDOWS\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\WINDOWS\system32\lsass.exe (file missing)
O23 - Service: NVIDIA Display Container LS (NVDisplay.ContainerLocalSystem) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\Display.NvContainer\NVDisplay.Container.exe
O23 - Service: NVIDIA Telemetry Container (NvTelemetryContainer) - NVIDIA Corporation - C:\Program Files (x86)\NVIDIA Corporation\NvTelemetry\NvTelemetryContainer.exe
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\WINDOWS\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\WINDOWS\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\SecurityHealthAgent.dll,-1002 (SecurityHealthService) - Unknown owner - C:\WINDOWS\system32\SecurityHealthService.exe (file missing)
O23 - Service: @%ProgramFiles%\Windows Defender Advanced Threat Protection\MsSense.exe,-1001 (Sense) - Unknown owner - C:\Program Files (x86)\Windows Defender Advanced Threat Protection\MsSense.exe (file missing)
O23 - Service: @%SystemRoot%\system32\SensorDataService.exe,-101 (SensorDataService) - Unknown owner - C:\WINDOWS\System32\SensorDataService.exe (file missing)
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\WINDOWS\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spectrum.exe,-101 (spectrum) - Unknown owner - C:\WINDOWS\system32\spectrum.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\WINDOWS\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\WINDOWS\system32\sppsvc.exe (file missing)
O23 - Service: SynTPEnh Caller Service (SynTPEnhService) - Synaptics Incorporated - C:\Program Files\Synaptics\SynTP\SynTPEnhService.exe
O23 - Service: @%SystemRoot%\system32\TieringEngineService.exe,-702 (TieringEngineService) - Unknown owner - C:\WINDOWS\system32\TieringEngineService.exe (file missing)
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\WINDOWS\system32\UI0Detect.exe (file missing)
O23 - Service: ASUS Virtual MFP Service (UsbService) - Unknown owner - C:\Program Files (x86)\ASUS\Printer Utilities\UsbService64.exe
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\WINDOWS\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\WINDOWS\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\WINDOWS\system32\vssvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\WINDOWS\system32\wbengine.exe (file missing)
O23 - Service: @%ProgramFiles%\Windows Defender\MpAsDesc.dll,-320 (WdNisSvc) - Unknown owner - C:\Program Files (x86)\Windows Defender\NisSrv.exe (file missing)
O23 - Service: @%ProgramFiles%\Windows Defender\MpAsDesc.dll,-310 (WinDefend) - Unknown owner - C:\Program Files (x86)\Windows Defender\MsMpEng.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\WINDOWS\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--
End of file - 10315 bytes

====== Enumerating Processes ======

C:\WINDOWS\system32\lsass.exe
c:\windows\system32\svchost.exe -k dcomlaunch -s PlugPlay
C:\WINDOWS\system32\svchost.exe -k DcomLaunch
C:\WINDOWS\system32\fontdrvhost.exe
c:\windows\system32\svchost.exe -k rpcss
c:\windows\system32\svchost.exe -k dcomlaunch -s LSM
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\fontdrvhost.exe
C:\WINDOWS\system32\svchost.exe -k LocalSystemNetworkRestricted
C:\WINDOWS\system32\dwm.exe
c:\windows\system32\svchost.exe -k localservice -s bthserv
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s NcbService
c:\windows\system32\svchost.exe -k localservicenetworkrestricted -s TimeBrokerSvc
"C:\Windows\System32\WUDFHost.exe" -HostGUID:{193a1820-d9ac-4997-8c55-be817523f6aa} -IoEventPortName:HostProcess-8d741dde-35c9-4cbe-873c-af415572571a -SystemEventPortName:HostProcess-443674b1-dc26-4e19-8387-c71f7906297b -IoCancelEventPortName:HostProcess-d64c4676-f682-4038-9c24-fc5b449cb275 -NonStateChangingEventPortName:HostProcess-448aae11-c8e1-4a2f-94f7-7ee9ffa00100 -ServiceSID:S-1-5-80-2652678385-582572993-1835434367-1344795993-749280709 -LifetimeId:7f3d47d5-35ac-46f0-8bc0-ddbfa3a20724 -DeviceGroupId:WudfDefaultDevicePool
c:\windows\system32\svchost.exe -k netsvcs -s Schedule
c:\windows\system32\svchost.exe -k localservice -s EventSystem
c:\windows\system32\svchost.exe -k netsvcs -s ProfSvc
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s TabletInputService
c:\windows\system32\svchost.exe -k netsvcs -s SENS
c:\windows\system32\svchost.exe -k netsvcs -s UserManager
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s SensorService
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s DeviceAssociationService
C:\WINDOWS\system32\igfxCUIService.exe
c:\windows\system32\svchost.exe -k appmodel -s StateRepository
c:\windows\system32\svchost.exe -k localservicenetworkrestricted -s EventLog
C:\WINDOWS\system32\dashost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Winmgmt
c:\windows\system32\svchost.exe -k localservice -s nsi
c:\windows\system32\svchost.exe -k localservicenetworkrestricted -s Dhcp
c:\windows\system32\svchost.exe -k networkservice -s NlaSvc
"C:\Program Files\NVIDIA Corporation\Display.NvContainer\NVDisplay.Container.exe" -s NVDisplay.ContainerLocalSystem -f "C:\ProgramData\NVIDIA\NVDisplay.ContainerLocalSystem.log" -l 3 -d "C:\Program Files\NVIDIA Corporation\Display.NvContainer\plugins\LocalSystem" -r -p 30000
c:\windows\system32\svchost.exe -k netsvcs -s Themes
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s AudioEndpointBuilder
c:\windows\system32\svchost.exe -k localservice -s FontCache
"C:\Program Files\NVIDIA Corporation\Display.NvContainer\NVDisplay.Container.exe" -f "C:\ProgramData\NVIDIA\DisplaySessionContainer%d.log" -d "C:\Program Files\NVIDIA Corporation\Display.NvContainer\plugins\Session" -r -l 3 -p 30000 -c
c:\windows\system32\svchost.exe -k localservice -s netprofm
C:\WINDOWS\system32\svchost.exe -k LocalServiceNoNetwork
C:\WINDOWS\System32\svchost.exe -k LocalServiceNetworkRestricted
c:\windows\system32\svchost.exe -k networkservice -s Dnscache
C:\WINDOWS\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\WINDOWS\system32\svchost.exe -k LocalServiceNetworkRestricted
c:\windows\system32\svchost.exe -k netsvcs
C:\WINDOWS\system32\AUDIODG.EXE 0x3e4
C:\WINDOWS\system32\svchost.exe -k LocalSystemNetworkRestricted
c:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection
C:\WINDOWS\System32\spoolsv.exe
c:\windows\system32\svchost.exe -k networkservice -s LanmanWorkstation
c:\windows\system32\svchost.exe -k localservice -s WinHttpAutoProxySvc
c:\windows\system32\svchost.exe -k netsvcs -s iphlpsvc
C:\WINDOWS\System32\svchost.exe -k utcsvc
C:\WINDOWS\system32\ibtsiva.exe
"C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe"
c:\windows\system32\svchost.exe -k localservicenonetwork -s DPS
c:\windows\system32\svchost.exe -k networkservice -s CryptSvc
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
c:\windows\system32\svchost.exe -k netsvcs -s IKEEXT
"C:\Program Files (x86)\NVIDIA Corporation\NvTelemetry\NvTelemetryContainer.exe" -s NvTelemetryContainer -f "C:\ProgramData\NVIDIA\NvTelemetryContainer.log" -l 3 -d "C:\Program Files (x86)\NVIDIA Corporation\NvTelemetry\plugin"
c:\windows\system32\svchost.exe -k netsvcs -s LanmanServer
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s PcaSvc
"C:\Program Files\Synaptics\SynTP\SynTPEnhService.exe"
C:\WINDOWS\system32\svchost.exe -k imgsvc
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s SysMain
"C:\Program Files (x86)\ASUS\Printer Utilities\UsbService64.exe"
c:\windows\system32\svchost.exe -k appmodel -s tiledatamodelsvc
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s TrkWks
c:\windows\system32\svchost.exe -k netsvcs -s WpnService
c:\windows\system32\svchost.exe -k localservice -s WdiServiceHost
c:\windows\system32\svchost.exe -k localservicenetworkrestricted -s lmhosts
c:\windows\system32\svchost.exe -k networkservicenetworkrestricted -s PolicyAgent
c:\windows\system32\sihost.exe
c:\windows\system32\svchost.exe -k unistacksvcgroup -s WpnUserService
C:\WINDOWS\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
c:\windows\system32\taskhostw.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\igfxEM.exe
C:\WINDOWS\system32\igfxHK.exe
C:\WINDOWS\system32\igfxTray.exe
"C:\Program Files\Synaptics\SynTP\SynTPEnh.exe"
c:\windows\system32\svchost.exe -k netsvcs -s TokenBroker
c:\windows\system32\svchost.exe -k netsvcs -s Appinfo
"C:\PROGRAM FILES\SYNAPTICS\SYNTP\SYNTPHELPER.EXE"
C:\WINDOWS\system32\SearchIndexer.exe /Embedding
"C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca
"C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_1.8.0.0_x64__8wekyb3d8bbwe\Microsoft.StickyNotes.exe" -ServerName:App.AppXqx982emnayc5vbja1mrpk9zh4r774nd8.mca
"C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mca
C:\Windows\System32\RuntimeBroker.exe -Embedding
c:\windows\system32\svchost.exe -k localservice -s LicenseManager
C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe
C:\Program Files (x86)\Common Files\Microsoft Shared\Ink\TabTip32.exe
C:\WINDOWS\system32\DllHost.exe /Processid:{973D20D7-562D-44B9-B70B-5A0F49CCDF3F}
C:\WINDOWS\system32\ApplicationFrameHost.exe -Embedding
"C:\Program Files\Windows Defender\MSASCuiL.exe"
"C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe" -s
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s WdiSystemHost
"C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe" /FORPCEE4
"C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe" /LENOVO_DOLBYDRAGON
"C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe" /LENOVO_MICPKEY
"C:\Windows\RTFTrack.exe"
"C:\Program Files\Common Files\Common Desktop Agent\CDASrv.exe"
"C:\Programy\RocketDock\RocketDock.exe"
c:\windows\system32\svchost.exe -k netsvcs -s lfsvc
C:\WINDOWS\system32\wbem\wmiprvse.exe
c:\windows\system32\svchost.exe -k localservicenetworkrestricted -s wscsvc
c:\windows\system32\svchost.exe -k unistacksvcgroup
c:\windows\system32\svchost.exe -k localservice -s CDPSvc
C:\WINDOWS\system32\svchost.exe -k netsvcs -s DoSvc
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s StorSvc
c:\windows\system32\svchost.exe -k dcomlaunch -s DeviceInstall
"C:\Program Files\ESET\ESET Smart Security\egui.exe" /hide
C:\Windows\System32\smartscreen.exe -Embedding
"C:\Program Files\WindowsApps\Microsoft.WindowsStore_11707.1001.23.0_x64__8wekyb3d8bbwe\WinStore.App.exe" -ServerName:App.AppXc75wvwned5vhz4xyxxecvgdjhdkgsdza.mca
C:\WINDOWS\system32\wbem\wmiprvse.exe
"C:\WINDOWS\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
"C:\WINDOWS\system32\SearchFilterHost.exe" 0 708 712 720 8192 716
"C:\Users\Denča\Desktop\RSITx64.exe"

====== Scheduled tasks folder ======

C:\WINDOWS\system32\tasks\Adobe Acrobat Update Task - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
C:\WINDOWS\system32\tasks\Adobe Flash Player Updater - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
C:\WINDOWS\system32\tasks\AutoPico Daily Restart - C:\Users\Denča\Desktop\KMSpico 10.1.8 FINAL + Portable (Office and Windows 10 Activator) [TechTools.net]\Portable\AutoPico.exe /silent
C:\WINDOWS\system32\tasks\NvProfileUpdaterDaily_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} - C:\Program Files\NVIDIA Corporation\Update Core\NvProfileUpdater64.exe
C:\WINDOWS\system32\tasks\NvProfileUpdaterOnLogon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} - C:\Program Files\NVIDIA Corporation\Update Core\NvProfileUpdater64.exe
C:\WINDOWS\system32\tasks\NvTmMon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} - C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvTmMon.exe
C:\WINDOWS\system32\tasks\NvTmRepOnLogon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} - C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvTmRep.exe --logon
C:\WINDOWS\system32\tasks\NvTmRep_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} - C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvTmRep.exe
C:\WINDOWS\system32\tasks\OneDrive Standalone Update Task v2 - %localappdata%\Microsoft\OneDrive\OneDriveStandaloneUpdater.exe
C:\WINDOWS\system32\tasks\Microsoft\XblGameSave\XblGameSaveTask - %windir%\System32\XblGameSaveTask.exe standby
C:\WINDOWS\system32\tasks\Microsoft\XblGameSave\XblGameSaveTaskLogon - %windir%\System32\XblGameSaveTask.exe logon
C:\WINDOWS\system32\tasks\Microsoft\Windows\WwanSvc\NotificationTask - %SystemRoot%\System32\WiFiTask.exe wwan
C:\WINDOWS\system32\tasks\Microsoft\Windows\Workplace Join\Automatic-Device-Join - %SystemRoot%\System32\dsregcmd.exe
C:\WINDOWS\system32\tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start - C:\WINDOWS\system32\sc.exe start wuauserv
C:\WINDOWS\system32\tasks\Microsoft\Windows\WindowsUpdate\sih - %systemroot%\System32\sihclient.exe
C:\WINDOWS\system32\tasks\Microsoft\Windows\WindowsUpdate\sihboot - %systemroot%\System32\sihclient.exe /boot
C:\WINDOWS\system32\tasks\Microsoft\Windows\Windows Media Sharing\UpdateLibrary - "%ProgramFiles%\Windows Media Player\wmpnscfg.exe"
C:\WINDOWS\system32\tasks\Microsoft\Windows\Windows Filtering Platform\BfeOnServiceStartTypeChange - %windir%\system32\rundll32.exe bfe.dll,BfeOnServiceStartTypeChange
C:\WINDOWS\system32\tasks\Microsoft\Windows\Windows Error Reporting\QueueReporting - %windir%\system32\wermgr.exe -upload
C:\WINDOWS\system32\tasks\Microsoft\Windows\WCM\WiFiTask - %SystemRoot%\System32\WiFiTask.exe
C:\WINDOWS\system32\tasks\Microsoft\Windows\UPnP\UPnPHostConfig - sc.exe config upnphost start= auto
C:\WINDOWS\system32\tasks\Microsoft\Windows\UpdateOrchestrator\Combined Scan Download Install - %systemroot%\system32\usoclient.exe ScanInstallWait
C:\WINDOWS\system32\tasks\Microsoft\Windows\UpdateOrchestrator\Maintenance Install - %systemroot%\system32\usoclient.exe StartInstall
C:\WINDOWS\system32\tasks\Microsoft\Windows\UpdateOrchestrator\MusUx_UpdateInterval - %systemroot%\system32\MusNotification.exe Display
C:\WINDOWS\system32\tasks\Microsoft\Windows\UpdateOrchestrator\Policy Install - %systemroot%\system32\usoclient.exe StartInstall
C:\WINDOWS\system32\tasks\Microsoft\Windows\UpdateOrchestrator\Reboot - %systemroot%\system32\MusNotification.exe Reboot
C:\WINDOWS\system32\tasks\Microsoft\Windows\UpdateOrchestrator\Refresh Settings - %systemroot%\system32\usoclient.exe RefreshSettings
C:\WINDOWS\system32\tasks\Microsoft\Windows\UpdateOrchestrator\Resume On Boot - %systemroot%\system32\usoclient.exe ResumeUpdate
C:\WINDOWS\system32\tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Scan - %systemroot%\system32\usoclient.exe StartScan
C:\WINDOWS\system32\tasks\Microsoft\Windows\UpdateOrchestrator\USO_UxBroker_Display - %systemroot%\system32\MusNotification.exe Display
C:\WINDOWS\system32\tasks\Microsoft\Windows\UpdateOrchestrator\USO_UxBroker_ReadyToReboot - %systemroot%\system32\MusNotification.exe ReadyToReboot
C:\WINDOWS\system32\tasks\Microsoft\Windows\UNP\RunCampaignManager - %windir%\System32\UNP\UNPCampaignManager.exe
C:\WINDOWS\system32\tasks\Microsoft\Windows\Time Zone\SynchronizeTimeZone - %windir%\system32\tzsync.exe
C:\WINDOWS\system32\tasks\Microsoft\Windows\Time Synchronization\SynchronizeTime - %windir%\system32\sc.exe start w32time task_started
C:\WINDOWS\system32\tasks\Microsoft\Windows\SystemRestore\SR - %windir%\system32\srtasks.exe ExecuteScheduledSPPCreation
C:\WINDOWS\system32\tasks\Microsoft\Windows\Sysmain\WsSwapAssessmentTask - %windir%\system32\rundll32.exe sysmain.dll,PfSvWsSwapAssessmentTask
C:\WINDOWS\system32\tasks\Microsoft\Windows\Storage Tiers Management\Storage Tiers Optimization - %windir%\system32\defrag.exe -c -h -g -# -m 8 -i 13500
C:\WINDOWS\system32\tasks\Microsoft\Windows\Speech\SpeechModelDownloadTask - %windir%\system32\speech_onecore\common\SpeechModelDownload.exe
C:\WINDOWS\system32\tasks\Microsoft\Windows\SpacePort\SpaceAgentTask - %windir%\system32\SpaceAgent.exe
C:\WINDOWS\system32\tasks\Microsoft\Windows\SpacePort\SpaceManagerTask - %windir%\system32\spaceman.exe /Work
C:\WINDOWS\system32\tasks\Microsoft\Windows\Shell\FamilySafetyMonitor - %windir%\System32\wpcmon.exe
C:\WINDOWS\system32\tasks\Microsoft\Windows\SharedPC\Account Cleanup - %windir%\System32\rundll32.exe %windir%\System32\Windows.SharedPC.AccountManager.dll,StartMaintenance
C:\WINDOWS\system32\tasks\Microsoft\Windows\RemoteAssistance\RemoteAssistanceTask - %windir%\system32\RAServer.exe /offerraupdate
C:\WINDOWS\system32\tasks\Microsoft\Windows\Plug and Play\Sysprep Generalize Drivers - %SystemRoot%\System32\drvinst.exe 6
C:\WINDOWS\system32\tasks\Microsoft\Windows\NlaSvc\WiFiTask - %SystemRoot%\System32\WiFiTask.exe nla
C:\WINDOWS\system32\tasks\Microsoft\Windows\NetTrace\GatherNetworkInfo - %windir%\system32\gatherNetworkInfo.vbs
C:\WINDOWS\system32\tasks\Microsoft\Windows\MUI\LPRemove - %windir%\system32\lpremove.exe
C:\WINDOWS\system32\tasks\Microsoft\Windows\Mobile Broadband Accounts\MNO Metadata Parser - %SystemRoot%\System32\MbaeParserTask.exe
C:\WINDOWS\system32\tasks\Microsoft\Windows\Management\Provisioning\Cellular - %windir%\system32\ProvTool.exe /turn 7 /source CellStateChangeTask
C:\WINDOWS\system32\tasks\Microsoft\Windows\Management\Provisioning\Logon - %windir%\system32\ProvTool.exe /turn 5 /source LogonIdleTask
C:\WINDOWS\system32\tasks\Microsoft\Windows\Location\Notifications - %windir%\System32\LocationNotificationWindows.exe
C:\WINDOWS\system32\tasks\Microsoft\Windows\Location\WindowsActionDialog - %windir%\System32\WindowsActionDialog.exe
C:\WINDOWS\system32\tasks\Microsoft\Windows\Feedback\Siuf\DmClient - %windir%\system32\dmclient.exe
C:\WINDOWS\system32\tasks\Microsoft\Windows\Feedback\Siuf\DmClientOnScenarioDownload - %windir%\system32\dmclient.exe utcwnf
C:\WINDOWS\system32\tasks\Microsoft\Windows\EnterpriseMgmt\MDMMaintenenceTask - %windir%\system32\MDMAgent.exe
C:\WINDOWS\system32\tasks\Microsoft\Windows\DUSM\dusmtask - %SystemRoot%\System32\dusmtask.exe
C:\WINDOWS\system32\tasks\Microsoft\Windows\DiskFootprint\Diagnostics - %windir%\system32\disksnapshot.exe -z
C:\WINDOWS\system32\tasks\Microsoft\Windows\DiskDiagnostic\Microsoft-Windows-DiskDiagnosticDataCollector - %windir%\system32\rundll32.exe dfdts.dll,DfdGetDefaultPolicyAndSMART
C:\WINDOWS\system32\tasks\Microsoft\Windows\DiskDiagnostic\Microsoft-Windows-DiskDiagnosticResolver - %windir%\system32\DFDWiz.exe
C:\WINDOWS\system32\tasks\Microsoft\Windows\DiskCleanup\SilentCleanup - %windir%\system32\cleanmgr.exe /autoclean /d %systemdrive%
C:\WINDOWS\system32\tasks\Microsoft\Windows\Device Information\Device - %windir%\system32\devicecensus.exe
C:\WINDOWS\system32\tasks\Microsoft\Windows\Defrag\ScheduledDefrag - %windir%\system32\defrag.exe -c -h -o -$
C:\WINDOWS\system32\tasks\Microsoft\Windows\Customer Experience Improvement Program\Consolidator - %SystemRoot%\System32\wsqmcons.exe
C:\WINDOWS\system32\tasks\Microsoft\Windows\Clip\License Validation - %SystemRoot%\system32\ClipUp.exe -p -s -o
C:\WINDOWS\system32\tasks\Microsoft\Windows\Bluetooth\UninstallDeviceTask - BthUdTask.exe $(Arg0)
C:\WINDOWS\system32\tasks\Microsoft\Windows\Autochk\Proxy - %windir%\system32\rundll32.exe /d acproxy.dll,PerformAutochkOperations
C:\WINDOWS\system32\tasks\Microsoft\Windows\AppxDeploymentClient\Pre-staged app cleanup - %windir%\system32\rundll32.exe %windir%\system32\AppxDeploymentClient.dll,AppxPreStageCleanupRunTask
C:\WINDOWS\system32\tasks\Microsoft\Windows\ApplicationData\appuriverifierdaily - %windir%\system32\AppHostRegistrationVerifier.exe
C:\WINDOWS\system32\tasks\Microsoft\Windows\ApplicationData\appuriverifierinstall - %windir%\system32\AppHostRegistrationVerifier.exe
C:\WINDOWS\system32\tasks\Microsoft\Windows\ApplicationData\CleanupTemporaryState - %windir%\system32\rundll32.exe Windows.Storage.ApplicationData.dll,CleanupTemporaryState
C:\WINDOWS\system32\tasks\Microsoft\Windows\ApplicationData\DsSvcCleanup - %windir%\system32\dstokenclean.exe
C:\WINDOWS\system32\tasks\Microsoft\Windows\Application Experience\Microsoft Compatibility Appraiser - %windir%\system32\compattelrunner.exe
C:\WINDOWS\system32\tasks\Microsoft\Windows\Application Experience\ProgramDataUpdater - %windir%\system32\compattelrunner.exe -maintenance
C:\WINDOWS\system32\tasks\Microsoft\Windows\Application Experience\StartupAppTask - %windir%\system32\rundll32.exe Startupscan.dll,SusRunTask
C:\WINDOWS\system32\tasks\Microsoft\Windows\AppID\PolicyConverter - %windir%\system32\appidpolicyconverter.exe
C:\WINDOWS\system32\tasks\Microsoft\Windows\AppID\VerifiedPublisherCertStoreCheck - %windir%\system32\appidcertstorecheck.exe
C:\WINDOWS\system32\tasks\Microsoft\Office\Office Automatic Updates - C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe /update SCHEDULEDTASK displaylevel=False
C:\WINDOWS\system32\tasks\Microsoft\Office\Office ClickToRun Service Monitor - C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe /WatchService
C:\WINDOWS\system32\tasks\Microsoft\Office\OfficeBackgroundTaskHandlerLogon - C:\Program Files\Microsoft Office\root\Office16\officebackgroundtaskhandler.exe
C:\WINDOWS\system32\tasks\Microsoft\Office\OfficeBackgroundTaskHandlerRegistration - C:\Program Files\Microsoft Office\root\Office16\officebackgroundtaskhandler.exe
C:\WINDOWS\system32\tasks\Microsoft\Office\OfficeTelemetryAgentFallBack2016 - C:\Program Files\Microsoft Office\root\Office16\msoia.exe scan upload mininterval:2880
C:\WINDOWS\system32\tasks\Microsoft\Office\OfficeTelemetryAgentLogOn2016 - C:\Program Files\Microsoft Office\root\Office16\msoia.exe scan upload

=========Mozilla firefox=========

ProfilePath - C:\Users\Denča\AppData\Roaming\Mozilla\Firefox\Profiles\f1xvws6z.default

prefs.js - "browser.startup.homepage" - "https://www.seznam.cz/"

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 26.0.0.151 Plugin
"Path"=C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_26_0_0_151.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@microsoft.com/Lync,version=15.0]
"Description"=Microsoft Lync Plug-in for Firefox
"Path"=C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@microsoft.com/SharePoint,version=14.0]
"Description"=Microsoft SharePoint Plug-in for Firefox
"Path"=C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\NPSPWRAP.DLL

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@videolan.org/vlc,version=2.2.4]
"Description"=VLC Multimedia Plugin
"Path"=C:\Programy\VLC\npvlc.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\Adobe Reader]
"Description"=Handles PDFs in-place in Firefox
"Path"=C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll


[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 26.0.0.151 Plugin
"Path"=C:\WINDOWS\system32\Macromed\Flash\NPSWF64_26_0_0_151.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/SharePoint,version=14.0]
"Description"=Microsoft SharePoint Plug-in for Firefox
"Path"=C:\Program Files\Microsoft Office\root\Office16\NPSPWRAP.DLL


C:\Users\Denča\AppData\Roaming\Mozilla\Firefox\Profiles\f1xvws6z.default\addons.json
Givt.cz - extension - @givt-toolbar-cz

C:\Users\Denča\AppData\Roaming\Mozilla\Firefox\Profiles\f1xvws6z.default\extensions.json
GIVT.cz - webextension - @givt-toolbar-cz -
Application Update Service Helper - extension - aushelper@mozilla.org -
Multi-process staged rollout - extension - e10srollout@mozilla.org -
Pocket - extension - firefox@getpocket.com -
Web Compat - extension - webcompat@mozilla.org -
Firefox Screenshots - extension - screenshots@mozilla.org -
Click-to-Play staged rollout - extension - clicktoplay-rollout@mozilla.org -
Follow-on Search Telemetry - extension - followonsearch@mozilla.com -
Shield Recipe Client - extension - shield-recipe-client@mozilla.org -
Default - theme - {972ce4c6-7e08-4474-a285-3208198ce6fd} -
Firefox Screenshots - extension - screenshots@mozilla.org -

C:\Users\Denča\AppData\Roaming\Mozilla\Firefox\Profiles\f1xvws6z.default\pluginreg.dat
Plugin - Shockwave Flash - 26.0.0.151 - C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_26_0_0_151.dll

======Registry dump ======


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes]
"DefaultScope"={0633EE93-D776-472f-A0FF-E1416B8B2E3A}
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}]
"URL"=http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC


[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Internet Explorer\SearchScopes]
"DefaultScope"={0633EE93-D776-472f-A0FF-E1416B8B2E3A}
[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}]
"URL"=http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA}]
Lync Browser Helper - C:\Program Files\Microsoft Office\root\Office16\OCHelper.dll [2017-08-24 210120]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF}]
Microsoft OneDrive for Business Browser Helper - C:\Program Files\Microsoft Office\root\Office16\GROOVEEX.DLL [2017-08-24 3226824]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA}]
Lync Browser Helper - C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\OCHelper.dll [2017-08-24 149696]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF}]
Microsoft OneDrive for Business Browser Helper - C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\GROOVEEX.DLL [2017-08-24 2178248]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"SecurityHealth"=C:\Program Files\Windows Defender\MSASCuiL.exe [2017-03-18 629152]
"RtHDVCpl"=C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [2015-06-04 13885696]
"RtHDVBg_Dolby"=C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [2015-06-04 1402624]
"RtHDVBg_LENOVO_DOLBYDRAGON"=C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [2015-06-04 1402624]
"RtHDVBg_LENOVO_MICPKEY"=C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [2015-06-04 1402624]
"RtsFT"=C:\WINDOWS\RTFTrack.exe [2015-10-08 9308416]
"CDAServer"=C:\Program Files\Common Files\Common Desktop Agent\CDASrv.exe [2014-09-08 464608]
"SynTPEnh"=C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2015-06-03 3944136]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"RocketDock"=C:\Programy\RocketDock\RocketDock.exe [2007-09-02 495616]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED}

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders" = credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\NetSetupSvc]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorUser"=3
"DSCAutomationHostEnabled"=2
"EnableCursorSuppression"=1
"EnableUIADesktopToggle"=0
"undockwithoutlogon"=1
"ConsentPromptBehaviorAdmin"=0
"PromptOnSecureDesktop"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"ForceActiveDesktopOn"=0
"NoActiveDesktop"=1
"NoActiveDesktopChanges"=1
"NoDriveTypeAutorun"=158

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]


[HKEY_LOCAL_MACHINE\Software\Microsoft\Active Setup\Installed Components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}]
"StubPath" = %SystemRoot%\inf\unregmp2.exe /ShowWMP

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"midimapper"=midimap.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.l3acm"=C:\Windows\System32\l3codeca.acm
"msacm.msadpcm"=msadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"vidc.i420"=iyuv_32.dll
"vidc.iyuv"=iyuv_32.dll
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"vidc.uyvy"=msyuv.dll
"vidc.yuy2"=msyuv.dll
"vidc.yvu9"=tsbyuv.dll
"vidc.yvyu"=msyuv.dll
"wavemapper"=msacm32.drv
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv
"MSVideo8"=VfWWDM32.dll
"wave1"=wdmaud.drv
"midi1"=wdmaud.drv
"mixer1"=wdmaud.drv
"aux1"=wdmaud.drv

====== File associations ======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*

====== List of files/folders created in the last 1 month ======

2017-09-02 12:13:51 ----D---- C:\Program Files\trend micro
2017-09-02 12:13:50 ----D---- C:\rsit
2017-09-02 12:08:26 ----N---- C:\WINDOWS\system32\MpSigStub.exe
2017-09-02 12:08:08 ----D---- C:\ProgramData\ESET
2017-09-02 12:08:08 ----D---- C:\Program Files\ESET
2017-09-02 12:07:42 ----SHD---- C:\Config.Msi
2017-08-24 08:07:35 ----AD---- C:\Program Files\Common Files\DESIGNER
2017-08-09 20:08:58 ----A---- C:\WINDOWS\SYSWOW64\WWAHost.exe
2017-08-09 20:08:58 ----A---- C:\WINDOWS\SYSWOW64\urlmon.dll
2017-08-09 20:08:58 ----A---- C:\WINDOWS\system32\tquery.dll
2017-08-09 20:08:57 ----A---- C:\WINDOWS\SYSWOW64\tquery.dll
2017-08-09 20:08:57 ----A---- C:\WINDOWS\SYSWOW64\msIso.dll
2017-08-09 20:08:57 ----A---- C:\WINDOWS\SYSWOW64\iertutil.dll
2017-08-09 20:08:56 ----A---- C:\WINDOWS\SYSWOW64\Windows.UI.Xaml.Resources.dll
2017-08-09 20:08:56 ----A---- C:\WINDOWS\SYSWOW64\win32kfull.sys
2017-08-09 20:08:55 ----A---- C:\WINDOWS\SYSWOW64\Windows.UI.Xaml.dll
2017-08-09 20:08:54 ----A---- C:\WINDOWS\SYSWOW64\Windows.Data.Pdf.dll
2017-08-09 20:08:54 ----A---- C:\WINDOWS\SYSWOW64\msrd2x40.dll
2017-08-09 20:08:54 ----A---- C:\WINDOWS\SYSWOW64\msjtes40.dll
2017-08-09 20:08:53 ----A---- C:\WINDOWS\SYSWOW64\TokenBroker.dll
2017-08-09 20:08:53 ----A---- C:\WINDOWS\SYSWOW64\msxbde40.dll
2017-08-09 20:08:53 ----A---- C:\WINDOWS\SYSWOW64\msv1_0.dll
2017-08-09 20:08:53 ----A---- C:\WINDOWS\SYSWOW64\mstext40.dll
2017-08-09 20:08:53 ----A---- C:\WINDOWS\SYSWOW64\msrepl40.dll
2017-08-09 20:08:53 ----A---- C:\WINDOWS\SYSWOW64\msrd3x40.dll
2017-08-09 20:08:53 ----A---- C:\WINDOWS\SYSWOW64\mspbde40.dll
2017-08-09 20:08:53 ----A---- C:\WINDOWS\SYSWOW64\msltus40.dll
2017-08-09 20:08:53 ----A---- C:\WINDOWS\SYSWOW64\msjetoledb40.dll
2017-08-09 20:08:53 ----A---- C:\WINDOWS\SYSWOW64\msjet40.dll
2017-08-09 20:08:53 ----A---- C:\WINDOWS\SYSWOW64\msexcl40.dll
2017-08-09 20:08:52 ----A---- C:\WINDOWS\SYSWOW64\Windows.Internal.Management.dll
2017-08-09 20:08:52 ----A---- C:\WINDOWS\SYSWOW64\scksp.dll
2017-08-09 20:08:52 ----A---- C:\WINDOWS\SYSWOW64\policymanager.dll
2017-08-09 20:08:52 ----A---- C:\WINDOWS\SYSWOW64\mswstr10.dll
2017-08-09 20:08:52 ----A---- C:\WINDOWS\SYSWOW64\mswdat10.dll
2017-08-09 20:08:52 ----A---- C:\WINDOWS\SYSWOW64\msjter40.dll
2017-08-09 20:08:52 ----A---- C:\WINDOWS\SYSWOW64\basecsp.dll
2017-08-09 20:08:51 ----A---- C:\WINDOWS\SYSWOW64\werui.dll
2017-08-09 20:08:51 ----A---- C:\WINDOWS\SYSWOW64\wermgr.exe
2017-08-09 20:08:51 ----A---- C:\WINDOWS\SYSWOW64\WerFaultSecure.exe
2017-08-09 20:08:51 ----A---- C:\WINDOWS\SYSWOW64\WerFault.exe
2017-08-09 20:08:51 ----A---- C:\WINDOWS\SYSWOW64\wer.dll
2017-08-09 20:08:51 ----A---- C:\WINDOWS\SYSWOW64\tokenbinding.dll
2017-08-09 20:08:51 ----A---- C:\WINDOWS\SYSWOW64\sscore.dll
2017-08-09 20:08:51 ----A---- C:\WINDOWS\SYSWOW64\ncryptprov.dll
2017-08-09 20:08:51 ----A---- C:\WINDOWS\SYSWOW64\msjint40.dll
2017-08-09 20:08:51 ----A---- C:\WINDOWS\SYSWOW64\fdeploy.dll
2017-08-09 20:08:51 ----A---- C:\WINDOWS\SYSWOW64\Faultrep.dll
2017-08-09 20:08:51 ----A---- C:\WINDOWS\SYSWOW64\DWWIN.EXE
2017-08-09 20:08:50 ----A---- C:\WINDOWS\system32\WWAHost.exe
2017-08-09 20:08:50 ----A---- C:\WINDOWS\system32\diagtrack.dll
2017-08-09 20:08:49 ----A---- C:\WINDOWS\system32\drivers\tdx.sys
2017-08-09 20:08:48 ----A---- C:\WINDOWS\SYSWOW64\ieproxy.dll
2017-08-09 20:08:47 ----A---- C:\WINDOWS\SYSWOW64\edgehtml.dll
2017-08-09 20:08:47 ----A---- C:\WINDOWS\system32\ieproxy.dll
2017-08-09 20:08:45 ----A---- C:\WINDOWS\SYSWOW64\jscript9.dll
2017-08-09 20:08:44 ----A---- C:\WINDOWS\SYSWOW64\mshtml.dll
2017-08-09 20:08:43 ----A---- C:\WINDOWS\system32\Chakradiag.dll
2017-08-09 20:08:42 ----A---- C:\WINDOWS\SYSWOW64\Chakra.dll
2017-08-09 20:08:42 ----A---- C:\WINDOWS\system32\jscript9.dll
2017-08-09 20:08:41 ----A---- C:\WINDOWS\system32\jscript9diag.dll
2017-08-09 20:08:41 ----A---- C:\WINDOWS\system32\edgehtml.dll
2017-08-09 20:08:40 ----A---- C:\WINDOWS\system32\Chakra.dll
2017-08-09 20:08:39 ----A---- C:\WINDOWS\system32\mshtml.dll
2017-08-09 20:08:37 ----A---- C:\WINDOWS\SYSWOW64\ieframe.dll
2017-08-09 20:08:37 ----A---- C:\WINDOWS\SYSWOW64\Chakradiag.dll
2017-08-09 20:08:37 ----A---- C:\WINDOWS\system32\drivers\clfs.sys
2017-08-09 20:08:36 ----A---- C:\WINDOWS\system32\ntoskrnl.exe
2017-08-09 20:08:35 ----A---- C:\WINDOWS\system32\ieframe.dll
2017-08-09 20:08:35 ----A---- C:\WINDOWS\system32\browserbroker.dll
2017-08-09 20:08:34 ----A---- C:\WINDOWS\system32\wersvc.dll
2017-08-09 20:08:34 ----A---- C:\WINDOWS\system32\wermgr.exe
2017-08-09 20:08:34 ----A---- C:\WINDOWS\system32\WerFaultSecure.exe
2017-08-09 20:08:34 ----A---- C:\WINDOWS\system32\WerFault.exe
2017-08-09 20:08:34 ----A---- C:\WINDOWS\system32\wer.dll
2017-08-09 20:08:34 ----A---- C:\WINDOWS\system32\Faultrep.dll
2017-08-09 20:08:34 ----A---- C:\WINDOWS\system32\drivers\rfcomm.sys
2017-08-09 20:08:34 ----A---- C:\WINDOWS\system32\drivers\dxgmms2.sys
2017-08-09 20:08:33 ----A---- C:\WINDOWS\system32\wwansvc.dll
2017-08-09 20:08:33 ----A---- C:\WINDOWS\system32\win32kbase.sys
2017-08-09 20:08:33 ----A---- C:\WINDOWS\system32\TokenBroker.dll
2017-08-09 20:08:33 ----A---- C:\WINDOWS\system32\msIso.dll
2017-08-09 20:08:33 ----A---- C:\WINDOWS\system32\drivers\dxgkrnl.sys
2017-08-09 20:08:32 ----A---- C:\WINDOWS\system32\urlmon.dll
2017-08-09 20:08:32 ----A---- C:\WINDOWS\system32\SettingsHandlers_nt.dll
2017-08-09 20:08:31 ----A---- C:\WINDOWS\system32\Windows.UI.Xaml.Resources.dll
2017-08-09 20:08:31 ----A---- C:\WINDOWS\system32\win32kfull.sys
2017-08-09 20:08:30 ----A---- C:\WINDOWS\system32\Windows.Data.Pdf.dll
2017-08-09 20:08:29 ----A---- C:\WINDOWS\system32\OneCoreUAPCommonProxyStub.dll
2017-08-09 20:08:28 ----A---- C:\WINDOWS\system32\Windows.UI.Xaml.dll
2017-08-09 20:08:27 ----A---- C:\WINDOWS\system32\iertutil.dll
2017-08-09 20:08:26 ----A---- C:\WINDOWS\system32\policymanager.dll
2017-08-09 20:08:26 ----A---- C:\WINDOWS\system32\enterprisecsps.dll
2017-08-09 20:08:25 ----A---- C:\WINDOWS\system32\scksp.dll
2017-08-09 20:08:25 ----A---- C:\WINDOWS\system32\msv1_0.dll
2017-08-09 20:08:25 ----A---- C:\WINDOWS\system32\basecsp.dll
2017-08-09 20:08:24 ----A---- C:\WINDOWS\system32\werui.dll
2017-08-09 20:08:24 ----A---- C:\WINDOWS\system32\wercplsupport.dll
2017-08-09 20:08:24 ----A---- C:\WINDOWS\system32\werconcpl.dll
2017-08-09 20:08:24 ----A---- C:\WINDOWS\system32\sscore.dll
2017-08-09 20:08:24 ----A---- C:\WINDOWS\system32\srvsvc.dll
2017-08-09 20:08:24 ----A---- C:\WINDOWS\system32\profsvcext.dll
2017-08-09 20:08:24 ----A---- C:\WINDOWS\system32\policymanagerprecheck.dll
2017-08-09 20:08:24 ----A---- C:\WINDOWS\system32\ncryptprov.dll
2017-08-09 20:08:24 ----A---- C:\WINDOWS\system32\fdeploy.dll
2017-08-09 20:08:24 ----A---- C:\WINDOWS\system32\drivers\vmbkmclr.sys
2017-08-09 20:08:24 ----A---- C:\WINDOWS\system32\drivers\vmbkmcl.sys
2017-08-09 20:08:24 ----A---- C:\WINDOWS\system32\dmenterprisediagnostics.dll
2017-08-09 20:08:24 ----A---- C:\WINDOWS\system32\coredpus.dll
2017-08-09 20:08:23 ----A---- C:\WINDOWS\system32\wsqmcons.exe
2017-08-09 20:08:23 ----A---- C:\WINDOWS\system32\tokenbinding.dll
2017-08-09 20:08:23 ----A---- C:\WINDOWS\system32\SmsRouterSvc.dll
2017-08-09 20:08:23 ----A---- C:\WINDOWS\system32\mdmregistration.dll
2017-08-09 20:08:23 ----A---- C:\WINDOWS\system32\DWWIN.EXE
2017-08-09 20:08:23 ----A---- C:\WINDOWS\system32\dmenrollengine.dll
2017-08-09 20:08:23 ----A---- C:\WINDOWS\system32\dmcsps.dll
2017-08-09 20:08:23 ----A---- C:\WINDOWS\system32\DeviceEnroller.exe
2017-08-09 20:08:23 ----A---- C:\WINDOWS\system32\configmanager2.dll
2017-08-07 07:23:42 ----A---- C:\WINDOWS\SYSWOW64\WpcWebFilter.dll
2017-08-07 07:23:42 ----A---- C:\WINDOWS\SYSWOW64\rasapi32.dll
2017-08-07 07:23:42 ----A---- C:\WINDOWS\SYSWOW64\IpNatHlpClient.dll
2017-08-07 07:23:42 ----A---- C:\WINDOWS\SYSWOW64\InstallAgentUserBroker.exe
2017-08-07 07:23:42 ----A---- C:\WINDOWS\SYSWOW64\InstallAgent.exe
2017-08-07 07:23:42 ----A---- C:\WINDOWS\SYSWOW64\dmcmnutils.dll
2017-08-07 07:23:42 ----A---- C:\WINDOWS\SYSWOW64\BluetoothApis.dll
2017-08-07 07:23:41 ----A---- C:\WINDOWS\SYSWOW64\mfmp4srcsnk.dll
2017-08-07 07:23:41 ----A---- C:\WINDOWS\SYSWOW64\MFMediaEngine.dll
2017-08-07 07:23:41 ----A---- C:\WINDOWS\SYSWOW64\AudioSes.dll
2017-08-07 07:23:40 ----A---- C:\WINDOWS\SYSWOW64\Windows.UI.dll
2017-08-07 07:23:40 ----A---- C:\WINDOWS\SYSWOW64\BingMaps.dll
2017-08-07 07:23:40 ----A---- C:\WINDOWS\SYSWOW64\AudioEng.dll
2017-08-07 07:23:39 ----A---- C:\WINDOWS\SYSWOW64\d2d1.dll
2017-08-07 07:23:39 ----A---- C:\WINDOWS\SYSWOW64\aadtb.dll
2017-08-07 07:23:38 ----A---- C:\WINDOWS\SYSWOW64\D3DCompiler_47.dll
2017-08-07 07:23:37 ----A---- C:\WINDOWS\SYSWOW64\MSVPXENC.dll
2017-08-07 07:23:36 ----A---- C:\WINDOWS\SYSWOW64\dbgeng.dll
2017-08-07 07:23:36 ----A---- C:\WINDOWS\SYSWOW64\CoreMessaging.dll
2017-08-07 07:23:35 ----A---- C:\WINDOWS\SYSWOW64\Windows.Media.dll
2017-08-07 07:23:35 ----A---- C:\WINDOWS\SYSWOW64\ole32.dll
2017-08-07 07:23:34 ----A---- C:\WINDOWS\SYSWOW64\KernelBase.dll
2017-08-07 07:23:34 ----A---- C:\WINDOWS\SYSWOW64\ActivationManager.dll
2017-08-07 07:23:32 ----A---- C:\WINDOWS\SYSWOW64\Windows.UI.Immersive.dll
2017-08-07 07:23:32 ----A---- C:\WINDOWS\SYSWOW64\Windows.Media.Protection.PlayReady.dll
2017-08-07 07:23:32 ----A---- C:\WINDOWS\SYSWOW64\AzureSettingSyncProvider.dll
2017-08-07 07:23:31 ----A---- C:\WINDOWS\SYSWOW64\InputService.dll
2017-08-07 07:23:31 ----A---- C:\WINDOWS\SYSWOW64\CoreUIComponents.dll
2017-08-07 07:23:30 ----A---- C:\WINDOWS\SYSWOW64\wudriver.dll
2017-08-07 07:23:30 ----A---- C:\WINDOWS\SYSWOW64\windows.storage.dll
2017-08-07 07:23:29 ----A---- C:\WINDOWS\SYSWOW64\twinui.dll
2017-08-07 07:23:29 ----A---- C:\WINDOWS\SYSWOW64\comdlg32.dll
2017-08-07 07:23:28 ----A---- C:\WINDOWS\SYSWOW64\wuapi.dll
2017-08-07 07:23:28 ----A---- C:\WINDOWS\SYSWOW64\shell32.dll
2017-08-07 07:23:26 ----A---- C:\WINDOWS\SYSWOW64\ExplorerFrame.dll
2017-08-07 07:23:24 ----A---- C:\WINDOWS\system32\drivers\USBHUB3.SYS
2017-08-07 07:23:23 ----A---- C:\WINDOWS\SYSWOW64\TpmCoreProvisioning.dll
2017-08-07 07:23:23 ----A---- C:\WINDOWS\SYSWOW64\AppXDeploymentClient.dll
2017-08-07 07:23:23 ----A---- C:\WINDOWS\system32\drivers\msiscsi.sys
2017-08-07 07:23:22 ----A---- C:\WINDOWS\SYSWOW64\rastls.dll
2017-08-07 07:23:21 ----A---- C:\WINDOWS\SYSWOW64\Windows.StateRepository.dll
2017-08-07 07:23:21 ----A---- C:\WINDOWS\SYSWOW64\DolbyDecMFT.dll
2017-08-07 07:23:21 ----A---- C:\WINDOWS\SYSWOW64\autochk.exe
2017-08-07 07:23:20 ----A---- C:\WINDOWS\SYSWOW64\Windows.Security.Authentication.Web.Core.dll
2017-08-07 07:23:20 ----A---- C:\WINDOWS\SYSWOW64\untfs.dll
2017-08-07 07:23:20 ----A---- C:\WINDOWS\SYSWOW64\TextInputFramework.dll
2017-08-07 07:23:20 ----A---- C:\WINDOWS\SYSWOW64\ReAgent.dll
2017-08-07 07:23:20 ----A---- C:\WINDOWS\SYSWOW64\PCPKsp.dll
2017-08-07 07:23:20 ----A---- C:\WINDOWS\SYSWOW64\mfsensorgroup.dll
2017-08-07 07:23:20 ----A---- C:\WINDOWS\SYSWOW64\autofmt.exe
2017-08-07 07:23:20 ----A---- C:\WINDOWS\system32\drivers\acpi.sys
2017-08-07 07:23:19 ----A---- C:\WINDOWS\SYSWOW64\Windows.StateRepositoryUpgrade.dll
2017-08-07 07:23:19 ----A---- C:\WINDOWS\SYSWOW64\shlwapi.dll
2017-08-07 07:23:19 ----A---- C:\WINDOWS\SYSWOW64\netlogon.dll
2017-08-07 07:23:19 ----A---- C:\WINDOWS\SYSWOW64\msacm32.dll
2017-08-07 07:23:19 ----A---- C:\WINDOWS\SYSWOW64\GamePanel.exe
2017-08-07 07:23:19 ----A---- C:\WINDOWS\SYSWOW64\dxgi.dll
2017-08-07 07:23:19 ----A---- C:\WINDOWS\SYSWOW64\cmintegrator.dll
2017-08-07 07:23:19 ----A---- C:\WINDOWS\SYSWOW64\autoconv.exe
2017-08-07 07:23:19 ----A---- C:\WINDOWS\system32\cmintegrator.dll
2017-08-07 07:23:18 ----A---- C:\WINDOWS\SYSWOW64\VCardParser.dll
2017-08-07 07:23:18 ----A---- C:\WINDOWS\SYSWOW64\spbcd.dll
2017-08-07 07:23:18 ----A---- C:\WINDOWS\SYSWOW64\rastlsext.dll
2017-08-07 07:23:18 ----A---- C:\WINDOWS\SYSWOW64\qasf.dll
2017-08-07 07:23:18 ----A---- C:\WINDOWS\system32\drivers\UcmUcsi.sys
2017-08-07 07:23:18 ----A---- C:\WINDOWS\system32\drivers\bthhfenum.sys
2017-08-07 07:23:17 ----A---- C:\WINDOWS\SYSWOW64\shsvcs.dll
2017-08-07 07:23:08 ----A---- C:\WINDOWS\system32\drivers\tcpip.sys
2017-08-07 07:22:47 ----A---- C:\WINDOWS\system32\wbiosrvc.dll
2017-08-07 07:22:46 ----A---- C:\WINDOWS\system32\InstallAgentUserBroker.exe
2017-08-07 07:22:46 ----A---- C:\WINDOWS\system32\InstallAgent.exe
2017-08-07 07:22:45 ----A---- C:\WINDOWS\system32\storewuauth.dll
2017-08-07 07:22:42 ----A---- C:\WINDOWS\system32\VCardParser.dll
2017-08-07 07:22:34 ----A---- C:\WINDOWS\system32\mfmp4srcsnk.dll
2017-08-07 07:22:33 ----A---- C:\WINDOWS\system32\Windows.Media.dll
2017-08-07 07:22:32 ----A---- C:\WINDOWS\system32\MFMediaEngine.dll
2017-08-07 07:22:31 ----A---- C:\WINDOWS\system32\KernelBase.dll
2017-08-07 07:22:31 ----A---- C:\WINDOWS\system32\drivers\bridge.sys
2017-08-07 07:22:30 ----A---- C:\WINDOWS\system32\BingMaps.dll
2017-08-07 07:22:29 ----A---- C:\WINDOWS\system32\InputService.dll
2017-08-07 07:22:22 ----A---- C:\WINDOWS\system32\wmpps.dll
2017-08-07 07:22:22 ----A---- C:\WINDOWS\system32\TextInputFramework.dll
2017-08-07 07:22:22 ----A---- C:\WINDOWS\system32\rastlsext.dll
2017-08-07 07:22:22 ----A---- C:\WINDOWS\system32\drivers\ntfs.sys
2017-08-07 07:22:21 ----A---- C:\WINDOWS\system32\dbgeng.dll
2017-08-07 07:22:21 ----A---- C:\WINDOWS\system32\D3DCompiler_47.dll
2017-08-07 07:22:20 ----A---- C:\WINDOWS\system32\CoreUIComponents.dll
2017-08-07 07:22:19 ----A---- C:\WINDOWS\system32\wudriver.dll
2017-08-07 07:22:19 ----A---- C:\WINDOWS\system32\psmsrv.dll
2017-08-07 07:22:18 ----A---- C:\WINDOWS\system32\ole32.dll
2017-08-07 07:22:18 ----A---- C:\WINDOWS\system32\bisrv.dll
2017-08-07 07:22:18 ----A---- C:\WINDOWS\system32\AppReadiness.dll
2017-08-07 07:22:18 ----A---- C:\WINDOWS\system32\ActivationManager.dll
2017-08-07 07:22:17 ----A---- C:\WINDOWS\system32\windows.storage.dll
2017-08-07 07:22:15 ----A---- C:\WINDOWS\system32\AppXDeploymentClient.dll
2017-08-07 07:22:14 ----A---- C:\WINDOWS\system32\workfolderssvc.dll
2017-08-07 07:22:14 ----A---- C:\WINDOWS\system32\Windows.StateRepository.dll
2017-08-07 07:22:13 ----A---- C:\WINDOWS\SYSWOW64\bcd.dll
2017-08-07 07:22:13 ----A---- C:\WINDOWS\system32\Windows.StateRepositoryUpgrade.dll
2017-08-07 07:22:13 ----A---- C:\WINDOWS\system32\services.exe
2017-08-07 07:22:13 ----A---- C:\WINDOWS\system32\RjvMDMConfig.dll
2017-08-07 07:22:13 ----A---- C:\WINDOWS\system32\MDMAppInstaller.exe
2017-08-07 07:22:13 ----A---- C:\WINDOWS\system32\hal.dll
2017-08-07 07:22:13 ----A---- C:\WINDOWS\system32\FlightSettings.dll
2017-08-07 07:22:13 ----A---- C:\WINDOWS\system32\EnterpriseDesktopAppMgmtCSP.dll
2017-08-07 07:22:13 ----A---- C:\WINDOWS\system32\dxgi.dll
2017-08-07 07:22:13 ----A---- C:\WINDOWS\system32\DolbyDecMFT.dll
2017-08-07 07:22:13 ----A---- C:\WINDOWS\system32\DmApiSetExtImplDesktop.dll
2017-08-07 07:22:13 ----A---- C:\WINDOWS\system32\bcd.dll
2017-08-07 07:22:12 ----A---- C:\WINDOWS\system32\Windows.Media.Protection.PlayReady.dll
2017-08-07 07:22:12 ----A---- C:\WINDOWS\system32\DolbyMATEnc.dll
2017-08-07 07:22:11 ----A---- C:\WINDOWS\system32\Windows.Shell.BlueLightReduction.dll
2017-08-07 07:22:11 ----A---- C:\WINDOWS\system32\SettingsHandlers_Display.dll
2017-08-07 07:22:11 ----A---- C:\WINDOWS\system32\DolbyHrtfEnc.dll
2017-08-07 07:22:11 ----A---- C:\WINDOWS\system32\AudioSes.dll
2017-08-07 07:22:11 ----A---- C:\WINDOWS\system32\AudioEndpointBuilder.dll
2017-08-07 07:22:10 ----A---- C:\WINDOWS\system32\officecsp.dll
2017-08-07 07:22:10 ----A---- C:\WINDOWS\system32\GamePanel.exe
2017-08-07 07:22:10 ----A---- C:\WINDOWS\system32\AudioEng.dll
2017-08-07 07:22:09 ----A---- C:\WINDOWS\system32\dosvc.dll
2017-08-07 07:22:09 ----A---- C:\WINDOWS\system32\audiosrv.dll
2017-08-07 07:22:08 ----A---- C:\WINDOWS\system32\Microsoft.Bluetooth.Profiles.Gatt.dll
2017-08-07 07:22:08 ----A---- C:\WINDOWS\system32\dwmredir.dll
2017-08-07 07:22:06 ----A---- C:\WINDOWS\system32\aadcloudap.dll
2017-08-07 07:21:59 ----A---- C:\WINDOWS\system32\Windows.UI.dll
2017-08-07 07:21:59 ----A---- C:\WINDOWS\system32\BluetoothApis.dll
2017-08-07 07:21:58 ----A---- C:\WINDOWS\system32\CoreMessaging.dll
2017-08-07 07:21:58 ----A---- C:\WINDOWS\system32\AzureSettingSyncProvider.dll
2017-08-07 07:21:56 ----A---- C:\WINDOWS\system32\twinui.dll
2017-08-07 07:21:56 ----A---- C:\WINDOWS\system32\drivers\bthport.sys
2017-08-07 07:21:55 ----A---- C:\WINDOWS\system32\ExplorerFrame.dll
2017-08-07 07:21:54 ----A---- C:\WINDOWS\system32\wuuhosdeployment.dll
2017-08-07 07:21:54 ----A---- C:\WINDOWS\system32\wuuhext.dll
2017-08-07 07:21:54 ----A---- C:\WINDOWS\system32\Windows.UI.Immersive.dll
2017-08-07 07:21:54 ----A---- C:\WINDOWS\system32\SIHClient.exe
2017-08-07 07:21:53 ----A---- C:\WINDOWS\system32\wuaueng.dll
2017-08-07 07:21:53 ----A---- C:\WINDOWS\system32\AppXDeploymentExtensions.onecore.dll
2017-08-07 07:21:53 ----A---- C:\WINDOWS\system32\AppXDeploymentExtensions.desktop.dll
2017-08-07 07:21:52 ----A---- C:\WINDOWS\system32\Windows.Internal.Management.dll
2017-08-07 07:21:52 ----A---- C:\WINDOWS\system32\TileDataRepository.dll
2017-08-07 07:21:52 ----A---- C:\WINDOWS\system32\rastls.dll
2017-08-07 07:21:52 ----A---- C:\WINDOWS\system32\AppXDeploymentServer.dll
2017-08-07 07:21:51 ----A---- C:\WINDOWS\system32\rasapi32.dll
2017-08-07 07:21:51 ----A---- C:\WINDOWS\system32\LogonController.dll
2017-08-07 07:21:51 ----A---- C:\WINDOWS\system32\comdlg32.dll
2017-08-07 07:21:50 ----A---- C:\WINDOWS\system32\winsrv.dll
2017-08-07 07:21:50 ----A---- C:\WINDOWS\system32\FrameServer.dll
2017-08-07 07:21:49 ----A---- C:\WINDOWS\system32\wuapi.dll
2017-08-07 07:21:49 ----A---- C:\WINDOWS\system32\ClipSVC.dll
2017-08-07 07:21:48 ----A---- C:\WINDOWS\system32\shell32.dll
2017-08-07 07:21:46 ----A---- C:\WINDOWS\system32\bcdedit.exe
2017-08-07 07:21:46 ----A---- C:\WINDOWS\system32\bcdboot.exe
2017-08-07 07:21:45 ----A---- C:\WINDOWS\system32\efscore.dll
2017-08-07 07:21:45 ----A---- C:\WINDOWS\system32\dmcmnutils.dll
2017-08-07 07:21:45 ----A---- C:\WINDOWS\system32\aadtb.dll
2017-08-07 07:21:44 ----A---- C:\WINDOWS\SYSWOW64\UIRibbonRes.dll
2017-08-07 07:21:44 ----A---- C:\WINDOWS\system32\WpcWebFilter.dll
2017-08-07 07:21:44 ----A---- C:\WINDOWS\system32\UIRibbonRes.dll
2017-08-07 07:21:44 ----A---- C:\WINDOWS\system32\reseteng.dll
2017-08-07 07:21:43 ----A---- C:\WINDOWS\system32\wininit.exe
2017-08-07 07:21:43 ----A---- C:\WINDOWS\system32\TpmCoreProvisioning.dll
2017-08-07 07:21:43 ----A---- C:\WINDOWS\system32\SettingsHandlers_Notifications.dll
2017-08-07 07:21:43 ----A---- C:\WINDOWS\system32\MBR2GPT.EXE
2017-08-07 07:21:42 ----A---- C:\WINDOWS\system32\XblAuthManager.dll
2017-08-07 07:21:42 ----A---- C:\WINDOWS\system32\Windows.Security.Authentication.Web.Core.dll
2017-08-07 07:21:42 ----A---- C:\WINDOWS\system32\MPSSVC.dll
2017-08-07 07:21:42 ----A---- C:\WINDOWS\system32\lpasvc.dll
2017-08-07 07:21:42 ----A---- C:\WINDOWS\system32\autochk.exe
2017-08-07 07:21:41 ----A---- C:\WINDOWS\system32\ReAgent.dll
2017-08-07 07:21:41 ----A---- C:\WINDOWS\system32\msacm32.dll
2017-08-07 07:21:41 ----A---- C:\WINDOWS\system32\autofmt.exe
2017-08-07 07:21:41 ----A---- C:\WINDOWS\system32\autoconv.exe
2017-08-07 07:21:40 ----A---- C:\WINDOWS\system32\untfs.dll
2017-08-07 07:21:40 ----A---- C:\WINDOWS\system32\shlwapi.dll
2017-08-07 07:21:40 ----A---- C:\WINDOWS\system32\SettingsHandlers_Flights.dll
2017-08-07 07:21:40 ----A---- C:\WINDOWS\system32\PCPKsp.dll
2017-08-07 07:21:40 ----A---- C:\WINDOWS\system32\ofdeploy.exe
2017-08-07 07:21:40 ----A---- C:\WINDOWS\system32\mfsensorgroup.dll
2017-08-07 07:21:40 ----A---- C:\WINDOWS\system32\drivers\Microsoft.Bluetooth.Legacy.LEEnumerator.sys
2017-08-07 07:21:40 ----A---- C:\WINDOWS\system32\drivers\fvevol.sys
2017-08-07 07:21:39 ----A---- C:\WINDOWS\system32\Windows.Networking.UX.EapRequestHandler.dll
2017-08-07 07:21:39 ----A---- C:\WINDOWS\system32\TpmTasks.dll
2017-08-07 07:21:39 ----A---- C:\WINDOWS\system32\spbcd.dll
2017-08-07 07:21:39 ----A---- C:\WINDOWS\system32\setbcdlocale.dll
2017-08-07 07:21:39 ----A---- C:\WINDOWS\system32\RecoveryDrive.exe
2017-08-07 07:21:39 ----A---- C:\WINDOWS\system32\qasf.dll
2017-08-07 07:21:39 ----A---- C:\WINDOWS\system32\netlogon.dll
2017-08-07 07:21:39 ----A---- C:\WINDOWS\system32\dui70.dll
2017-08-07 07:21:39 ----A---- C:\WINDOWS\system32\BootMenuUX.dll
2017-08-07 07:21:38 ----A---- C:\WINDOWS\SYSWOW64\UIRibbon.dll
2017-08-07 07:21:38 ----A---- C:\WINDOWS\system32\UIRibbon.dll
2017-08-07 07:21:38 ----A---- C:\WINDOWS\system32\shsvcs.dll
2017-08-07 07:21:38 ----A---- C:\WINDOWS\system32\facecredentialprovider.dll
2017-08-07 07:21:38 ----A---- C:\WINDOWS\system32\drivers\bthenum.sys
2017-08-07 07:21:37 ----A---- C:\WINDOWS\system32\IpNatHlpClient.dll

====== List of files/folders modified in the last 1 month ======

2017-09-02 12:13:51 ----RD---- C:\Program Files
2017-09-02 12:13:37 ----D---- C:\WINDOWS\Temp
2017-09-02 12:08:42 ----D---- C:\WINDOWS\Prefetch
2017-09-02 12:08:40 ----SHD---- C:\WINDOWS\Installer
2017-09-02 12:08:38 ----D---- C:\WINDOWS\system32\DriverStore
2017-09-02 12:08:38 ----D---- C:\WINDOWS\system32\CatRoot
2017-09-02 12:08:38 ----D---- C:\WINDOWS\INF
2017-09-02 12:08:37 ----D---- C:\WINDOWS\system32\drivers
2017-09-02 12:08:28 ----D---- C:\WINDOWS\system32\catroot2
2017-09-02 12:08:26 ----D---- C:\WINDOWS\System32
2017-09-02 12:08:08 ----HD---- C:\ProgramData
2017-09-02 12:07:24 ----SHD---- C:\System Volume Information
2017-09-02 12:05:49 ----D---- C:\WINDOWS\system32\sru
2017-09-02 12:04:51 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2017-09-02 12:00:37 ----A---- C:\WINDOWS\system32\{A6D608F0-0BDE-491A-97AE-5C4B05D86E01}.bat
2017-09-02 12:00:32 ----D---- C:\ProgramData\NVIDIA
2017-09-02 11:39:02 ----D---- C:\WINDOWS\system32\SleepStudy
2017-09-02 11:16:29 ----RD---- C:\WINDOWS\Microsoft.NET
2017-09-01 08:18:02 ----HD---- C:\Program Files\WindowsApps
2017-09-01 08:17:50 ----D---- C:\WINDOWS\AppReadiness
2017-08-31 10:07:57 ----D---- C:\WINDOWS\SysWOW64
2017-08-24 12:05:14 ----AD---- C:\Program Files\Microsoft Office
2017-08-24 08:07:51 ----AD---- C:\ProgramData\regid.1991-06.com.microsoft
2017-08-24 08:07:35 ----D---- C:\Program Files\Common Files
2017-08-24 08:07:35 ----AD---- C:\Program Files\Common Files\microsoft shared
2017-08-14 17:11:13 ----D---- C:\WINDOWS\system32\config
2017-08-10 16:42:28 ----D---- C:\WINDOWS\WinSxS
2017-08-10 16:10:55 ----D---- C:\WINDOWS\rescache
2017-08-09 22:10:02 ----D---- C:\WINDOWS\system32\WDI
2017-08-09 22:08:20 ----D---- C:\WINDOWS\system32\en-US
2017-08-09 22:08:20 ----D---- C:\WINDOWS\AppPatch
2017-08-09 20:12:46 ----D---- C:\WINDOWS\CbsTemp
2017-08-09 20:12:41 ----D---- C:\WINDOWS\system32\MRT
2017-08-09 20:10:29 ----AC---- C:\WINDOWS\system32\MRT.exe
2017-08-09 12:09:36 ----D---- C:\WINDOWS\system32\Macromed
2017-08-09 12:09:31 ----D---- C:\WINDOWS\SYSWOW64\Macromed
2017-08-09 07:37:17 ----D---- C:\WINDOWS\system32\Tasks
2017-08-09 07:24:56 ----D---- C:\Programy
2017-08-08 11:24:02 ----RSD---- C:\WINDOWS\assembly
2017-08-07 17:46:13 ----D---- C:\WINDOWS\SYSWOW64\WinMetadata
2017-08-07 17:46:13 ----D---- C:\WINDOWS\SYSWOW64\en-US
2017-08-07 17:46:13 ----D---- C:\WINDOWS\SYSWOW64\cs-CZ
2017-08-07 17:46:13 ----D---- C:\WINDOWS\system32\WinMetadata
2017-08-07 17:46:13 ----D---- C:\WINDOWS\system32\WinBioPlugIns
2017-08-07 17:46:13 ----D---- C:\WINDOWS\system32\oobe
2017-08-07 17:46:13 ----D---- C:\WINDOWS\system32\cs-CZ
2017-08-07 17:46:12 ----RD---- C:\WINDOWS\ImmersiveControlPanel
2017-08-07 17:46:12 ----D---- C:\WINDOWS\ShellExperiences
2017-08-07 17:46:12 ----D---- C:\Program Files\Windows Photo Viewer
2017-08-07 17:46:12 ----D---- C:\Program Files (x86)\Windows Photo Viewer
2017-08-07 17:45:55 ----D---- C:\WINDOWS\system32\drivers\UMDF
2017-08-07 07:13:57 ----D---- C:\Windows

File C:\WINDOWS\system32\winlogon.exe is digitally signed
File C:\WINDOWS\system32\wininit.exe is digitally signed
File C:\WINDOWS\explorer.exe is digitally signed
File C:\WINDOWS\SysWOW64\explorer.exe is digitally signed
File C:\WINDOWS\system32\svchost.exe is digitally signed
File C:\WINDOWS\SysWOW64\svchost.exe is digitally signed
File C:\WINDOWS\system32\services.exe is digitally signed
File C:\WINDOWS\system32\User32.dll is digitally signed
File C:\WINDOWS\SysWOW64\User32.dll is digitally signed
File C:\WINDOWS\system32\userinit.exe is digitally signed
File C:\WINDOWS\SysWOW64\userinit.exe is digitally signed
File C:\WINDOWS\system32\rpcss.dll is digitally signed
File C:\WINDOWS\system32\Drivers\volsnap.sys is digitally signed

====== List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled) ======

R0 edevmon;edevmon; C:\WINDOWS\system32\DRIVERS\edevmon.sys [2017-05-04 107344]
R0 iorate;@%SystemRoot%\system32\drivers\iorate.sys,-101; C:\WINDOWS\system32\drivers\iorate.sys [2017-03-18 49568]
R1 eamonm;eamonm; C:\WINDOWS\system32\DRIVERS\eamonm.sys [2017-06-22 132824]
R1 ehdrv;ehdrv; C:\WINDOWS\system32\DRIVERS\ehdrv.sys [2017-05-04 178056]
R1 epfw;epfw; C:\WINDOWS\system32\DRIVERS\epfw.sys [2017-05-04 78192]
R1 epfwwfp;epfwwfp; C:\WINDOWS\system32\DRIVERS\epfwwfp.sys [2017-05-04 101648]
R2 clreg;@%SystemRoot%\system32\drivers\registry.sys,-100; C:\WINDOWS\System32\drivers\registry.sys [2017-03-18 14336]
R2 ekbdflt;ekbdflt; C:\WINDOWS\system32\DRIVERS\ekbdflt.sys [2017-05-04 50752]
R2 SSPORT;SSPORT; \??\C:\Windows\system32\Drivers\SSPORT.sys [2014-05-07 11576]
R3 acpials;@sensorsalsdriver.inf,%kbfiltr.SvcDesc%;ALS Sensor Filter; C:\WINDOWS\System32\drivers\acpials.sys [2017-03-20 12288]
R3 ACPIVPC;@oem18.inf,%ACPIVPC.SvcDesc%;Lenovo Virtual Power Controller Driver; C:\WINDOWS\System32\drivers\AcpiVpc.sys [2016-10-18 45048]
R3 BthEnum;@bth.inf,%BthEnum.SVCDESC%;Služba Bluetooth Enumerator; C:\WINDOWS\System32\drivers\BthEnum.sys [2017-07-28 105472]
R3 BthLEEnum;@BthLEEnum.inf,%BthLEEnum.SVCDESC%;Bluetooth Low Energy Driver; C:\WINDOWS\System32\drivers\Microsoft.Bluetooth.Legacy.LEEnumerator.sys [2017-07-28 97280]
R3 BthPan;@bthpan.inf,%BthPan.DisplayName%;Bluetooth Device (Personal Area Network); C:\WINDOWS\System32\drivers\bthpan.sys [2017-07-15 130048]
R3 BTHUSB;@bth.inf,%BTHUSB.SvcDesc%;Ovladač rozhraní USB radiostanice Bluetooth; C:\WINDOWS\System32\drivers\BTHUSB.sys [2017-03-18 85504]
R3 CAD;@ChargeArbitration.inf,%CAD_DevDesc%;Charge Arbitration Driver; C:\WINDOWS\System32\drivers\CAD.sys [2017-03-18 53664]
R3 ibtusb;@oem9.inf,%ibtusb.SVCDESC_IBT%;Intel(R) Wireless Bluetooth(R); C:\WINDOWS\system32\DRIVERS\ibtusb.sys [2017-01-13 231168]
R3 NETwNb64;___ Intel(R) Wireless Adapter Driver for Windows 8.1 - 64 Bit; C:\WINDOWS\System32\drivers\Netwbw02.sys [2017-03-18 3485696]
R3 nvlddmkm;nvlddmkm; C:\WINDOWS\System32\DriverStore\FileRepository\nvlti.inf_amd64_c0fc5649d3139cf5\nvlddmkm.sys [2017-07-19 15668664]
R3 RFCOMM;@tdibth.inf,%RFCOMM.DisplayName%;Bluetooth Device (RFCOMM Protocol TDI); C:\WINDOWS\System32\drivers\rfcomm.sys [2017-08-01 180736]
R3 rt640x64;@rt640x64.inf,%rt640.Service.DispName%;Realtek RT640 NT Driver; C:\WINDOWS\System32\drivers\rt640x64.sys [2017-03-18 604160]
R3 rtsuvc;@oem23.inf,%rtsuvc.DeviceDesc%;Lenovo EasyCamera; C:\WINDOWS\system32\DRIVERS\rtsuvc.sys [2015-10-08 3057920]
R3 SensorsAlsDriver;@sensorsalsdriver.inf,%WudfSensorsAlsDriverDisplayName%;UMDF Reflector service for SensorsAlsDriver; C:\WINDOWS\System32\drivers\WUDFRd.sys [2017-03-18 220672]
R3 SmbDrvI;SmbDrvI; C:\WINDOWS\system32\DRIVERS\Smb_driver_Intel.sys [2015-06-03 42696]
R3 SynTP;@oem24.inf,%SynTP.SvcDesc%;Synaptics TouchPad Driver; C:\WINDOWS\system32\DRIVERS\SynTP.sys [2015-06-03 613576]
S0 eelam;eelam; C:\WINDOWS\system32\DRIVERS\eelam.sys [2017-05-04 14880]
S0 megasas2i;megasas2i; C:\WINDOWS\System32\drivers\MegaSas2i.sys [2017-03-18 64416]
S0 scmbus;@scmbus.inf,%scmbus.SvcDesc%;Microsoft Storage Class Memory Bus Driver; C:\WINDOWS\System32\drivers\scmbus.sys [2017-03-18 91040]
S2 CldFlt;Windows Cloud Files Filter Driver; C:\WINDOWS\system32\drivers\cldflt.sys [2017-03-18 12288]
S3 AcpiDev;@acpidev.inf,%AcpiDev.SvcDesc%;ACPI Devices driver; C:\WINDOWS\System32\drivers\AcpiDev.sys [2017-03-18 20480]
S3 applockerfltr;@%systemroot%\system32\srpapi.dll,-102; C:\WINDOWS\system32\drivers\applockerfltr.sys [2017-03-18 17920]
S3 AppvStrm;@%systemroot%\system32\drivers\AppvStrm.sys,-101; C:\WINDOWS\system32\drivers\AppvStrm.sys [2017-03-20 127904]
S3 AppvVemgr;@%systemroot%\system32\drivers\AppvVemgr.sys,-101; C:\WINDOWS\system32\drivers\AppvVemgr.sys [2017-03-20 161696]
S3 AppvVfs;@%systemroot%\system32\drivers\AppvVfs.sys,-101; C:\WINDOWS\system32\drivers\AppvVfs.sys [2017-03-20 143776]
S3 BTHPORT;@bth.inf,%BTHPORT.SvcDesc%;Ovladač portu Bluetooth; C:\WINDOWS\System32\drivers\BTHport.sys [2017-07-28 982016]
S3 dg_ssudbus;@oem19.inf,%ssud.Service.DeviceDesc%;SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.); C:\WINDOWS\system32\DRIVERS\ssudbus.sys [2017-05-18 131984]
S3 hvservice;@%SystemRoot%\system32\drivers\hvservice.sys,-16; C:\WINDOWS\system32\drivers\hvservice.sys [2017-03-18 74648]
S3 cht4iscsi;cht4iscsi; C:\WINDOWS\System32\drivers\cht4sx64.sys [2017-03-18 347032]
S3 cht4vbd;@cht4vx64.inf,%cht4vbd.generic%;Chelsio Virtual Bus Driver; C:\WINDOWS\System32\drivers\cht4vx64.sys [2017-03-18 2104224]
S3 iagpio;@iagpio.inf,%iagpio.SVCDESC%;Intel Serial IO GPIO Controller Driver; C:\WINDOWS\System32\drivers\iagpio.sys [2017-03-18 33280]
S3 iaLPSS2i_GPIO2;@iaLPSS2i_GPIO2_SKL.inf,%iaLPSS2i_GPIO2.SVCDESC%;Intel(R) Serial IO GPIO Driver v2; C:\WINDOWS\System32\drivers\iaLPSS2i_GPIO2.sys [2017-03-18 70656]
S3 iaLPSS2i_GPIO2_BXT_P;@iaLPSS2i_GPIO2_BXT_P.inf,%iaLPSS2i_GPIO2_BXT_P.SVCDESC%;Intel(R) Serial IO GPIO Driver v2; C:\WINDOWS\System32\drivers\iaLPSS2i_GPIO2_BXT_P.sys [2017-03-18 85504]
S3 iaLPSS2i_I2C_BXT_P;@iaLPSS2i_I2C_BXT_P.inf,%iaLPSS2i_I2C_BXT_P.SVCDESC%;Intel(R) Serial IO I2C Driver v2; C:\WINDOWS\System32\drivers\iaLPSS2i_I2C_BXT_P.sys [2017-03-18 168448]
S3 IndirectKmd;@%SystemRoot%\system32\drivers\IndirectKmd.sys,-100; C:\WINDOWS\System32\drivers\IndirectKmd.sys [2017-03-18 36864]
S3 irda;IrDA; C:\WINDOWS\system32\drivers\irda.sys [2017-03-18 120320]
S3 mausbhost;@mausbhost.inf,%MAUSBHost.ServiceName%;MA-USB Host Controller Driver; C:\WINDOWS\System32\drivers\mausbhost.sys [2017-03-18 405408]
S3 mausbip;@mausbhost.inf,%MAUSBIP.ServiceName%;MA-USB IP Filter Driver; C:\WINDOWS\System32\drivers\mausbip.sys [2017-03-18 51104]
S3 MsSecFlt;@%SystemRoot%\System32\Drivers\mssecflt.sys,-1001; C:\WINDOWS\system32\drivers\mssecflt.sys [2017-03-20 230816]
S3 NetAdapterCx;Network Adapter Wdf Class Extension Library; C:\WINDOWS\system32\drivers\NetAdapterCx.sys [2017-03-18 122368]
S3 netvsc;netvsc; C:\WINDOWS\System32\drivers\netvsc.sys [2017-07-15 118784]
S3 nvdimmn;@nvdimmn.inf,%nvdimmn.SvcDesc%;Microsoft NVDIMM-N device driver; C:\WINDOWS\System32\drivers\nvdimmn.sys [2017-03-18 80896]
S3 pmem;@pmem.inf,%pmem.SvcDesc%;Microsoft persistent memory disk driver; C:\WINDOWS\System32\drivers\pmem.sys [2017-03-18 101376]
S3 ReFS;ReFS; C:\WINDOWS\system32\drivers\ReFS.sys [2017-03-18 1735584]
S3 SDFRd;@SDFRd.inf,%SDFRd.ServiceDesc%;SDF Reflector; C:\WINDOWS\System32\drivers\SDFRd.sys [2017-03-18 31128]
S3 ssudmdm;@oem20.inf,%ssud.Service.Name%;SAMSUNG Mobile USB Modem Drivers (DEVGURU Ver.); C:\WINDOWS\system32\DRIVERS\ssudmdm.sys [2017-05-18 166288]

====== List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled) ======

R2 ClickToRunSvc;Služba Microsoft Office Klikni a spusť; C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe [2017-08-12 4424392]
R2 DusmSvc;@%SystemRoot%\System32\dusmsvc.dll,-1; %SystemRoot%\System32\svchost.exe -k LocalServiceNetworkRestricted;"ServiceDll" = %SystemRoot%\System32\dusmsvc.dll
R2 ekrn;ESET Service; C:\Program Files\ESET\ESET Smart Security\ekrn.exe [2017-06-13 2625368]
R2 ibtsiva;@oem9.inf,%SERVICE_NAME%;Intel Bluetooth Service; C:\WINDOWS\system32\ibtsiva []
R2 NVDisplay.ContainerLocalSystem;NVIDIA Display Container LS; C:\Program Files\NVIDIA Corporation\Display.NvContainer\NVDisplay.Container.exe [2017-07-19 462968]
R2 NvTelemetryContainer;NVIDIA Telemetry Container; C:\Program Files (x86)\NVIDIA Corporation\NvTelemetry\NvTelemetryContainer.exe [2017-07-19 449984]
R2 OneSyncSvc_48ce3;Hostitel synchronizace_48ce3; C:\WINDOWS\system32\svchost.exe -k UnistackSvcGroup;"ServiceDll" =
R2 SecurityHealthService;@%systemroot%\system32\SecurityHealthAgent.dll,-1002; C:\WINDOWS\system32\SecurityHealthService.exe [2017-07-15 336320]
R2 SynTPEnhService;SynTPEnh Caller Service; C:\Program Files\Synaptics\SynTP\SynTPEnhService.exe [2015-06-03 249032]
R3 FontCache3.0.0.0;@%SystemRoot%\system32\PresentationHost.exe,-3309; C:\WINDOWS\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe [2017-02-10 43696]
R3 TimeBrokerSvc;@%windir%\system32\TimeBrokerServer.dll,-1001; %SystemRoot%\system32\svchost.exe -k LocalServiceNetworkRestricted;"ServiceDll" = %SystemRoot%\System32\TimeBrokerServer.dll
R3 TokenBroker;@%systemroot%\system32\tokenbroker.dll,-100; %SystemRoot%\system32\svchost.exe -k netsvcs;"ServiceDll" = %SystemRoot%\System32\TokenBroker.dll
S2 CDPUserSvc;@%SystemRoot%\system32\cdpusersvc.dll,-100; %SystemRoot%\system32\svchost.exe -k UnistackSvcGroup;"ServiceDll" = %SystemRoot%\System32\CDPUserSvc.dll
S2 CDPUserSvc_48ce3;Uživatelská služba platformy připojených zařízení_48ce3; C:\WINDOWS\system32\svchost.exe -k UnistackSvcGroup;"ServiceDll" =
S3 DevicesFlowUserSvc;@%SystemRoot%\system32\DevicesFlowBroker.dll,-103; %SystemRoot%\system32\svchost.exe -k DevicesFlow;"ServiceDll" = %SystemRoot%\System32\DevicesFlowBroker.dll
S3 DevicesFlowUserSvc_48ce3;Tok zařízení_48ce3; C:\WINDOWS\system32\svchost.exe -k DevicesFlow;"ServiceDll" =
S3 FrameServer;@%systemroot%\system32\FrameServer.dll,-100; %SystemRoot%\System32\svchost.exe -k Camera;"ServiceDll" = %SystemRoot%\system32\FrameServer.dll
S3 HvHost;@%SystemRoot%\system32\hvhostsvc.dll,-100; %SystemRoot%\system32\svchost.exe -k LocalSystemNetworkRestricted;"ServiceDll" = %SystemRoot%\System32\hvhostsvc.dll
S3 IpxlatCfgSvc;@%Systemroot%\system32\ipxlatcfg.dll,-500; %SystemRoot%\System32\svchost.exe -k LocalSystemNetworkRestricted;"ServiceDll" = %SystemRoot%\System32\IpxlatCfg.dll
S3 irmon;@%SystemRoot%\System32\irmon.dll,-2000; %SystemRoot%\system32\svchost.exe -k LocalSystemNetworkRestricted;"ServiceDll" = %SystemRoot%\System32\irmon.dll
S3 MessagingService_48ce3;Služba zasílání zpráv_48ce3; C:\WINDOWS\system32\svchost.exe -k UnistackSvcGroup;"ServiceDll" =
S3 MozillaMaintenance;Mozilla Maintenance Service; C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2017-04-14 173512]
S3 NaturalAuthentication;@%systemroot%\system32\NaturalAuth.dll,-100; %SystemRoot%\system32\svchost.exe -k netsvcs;"ServiceDll" = %SystemRoot%\System32\NaturalAuth.dll
S3 ose64;Office 64 Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2017-08-12 260296]
S3 PimIndexMaintenanceSvc_48ce3;Data kontaktů_48ce3; C:\WINDOWS\system32\svchost.exe -k UnistackSvcGroup;"ServiceDll" =
S3 RmSvc;@%SystemRoot%\system32\RMapi.dll,-1001; %SystemRoot%\System32\svchost.exe -k LocalServiceNetworkRestricted;"ServiceDll" = %SystemRoot%\System32\RMapi.dll
S3 SEMgrSvc;@%SystemRoot%\System32\SEMgrSvc.dll,-1001; %SystemRoot%\system32\svchost.exe -k LocalService;"ServiceDll" = %SystemRoot%\system32\SEMgrSvc.dll
S3 Sense;@%ProgramFiles%\Windows Defender Advanced Threat Protection\MsSense.exe,-1001; C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe [2017-03-20 3913064]
S3 spectrum;@%systemroot%\system32\spectrum.exe,-101; C:\WINDOWS\system32\spectrum.exe [2017-03-18 891904]
S4 AppVClient;@%systemroot%\system32\AppVClient.exe,-102; C:\WINDOWS\system32\AppVClient.exe [2017-07-15 846752]
S4 shpamsvc;@%SystemRoot%\System32\Windows.SharedPC.AccountManager.dll,-100; %SystemRoot%\System32\svchost.exe -k netsvcs;"ServiceDll" = %systemroot%\system32\Windows.SharedPC.AccountManager.dll

-----------------EOF-----------------

Uživatelský avatar
Rudy
Site Admin
Site Admin
Příspěvky: 118192
Registrován: 30 říj 2003 13:42
Bydliště: Plzeň
Kontaktovat uživatele:

Re: Žádost o kontrolu logů

#3 Příspěvek od Rudy »

Zdravím!
Nejprve budeme řešit ten první log. Spusťte tuto utilitu:
Stáhněte AdwCleaner https://toolslib.net/downloads/viewdown ... dwcleaner/
Uložte na plochu
Ukončete všechny programy
Klikněte nejprve na >Scan<(hledání) a pak na >Clean< (mazání).
Proběhne skenováni a pak se objeví log, který sem vložte.
Dotazy a logy vkládejte pouze do vašich threadů. Soukromé zprávy, icq a e-maily neslouží k řešení vašich problémů.

Podpořte, prosím, naše fórum : https://platba.viry.cz/payment/.

Navštivte: Obrázek

e-mail: rudy(zavináč)forum.viry.cz

Varování:
Před odvirováním PC si udělejte zálohy svých důležitých dat (pošta, kontakty, dokumenty, fotografie, videa, hudba apod.). Virus mimo svých "viditelných" aktivit může poškodit systém!


Po dořešení vašeho problému bude vlákno zamknuto. Stejně tak tehdy, pokud bude nečinné více než 14dnů. Pokud budete chtít vlákno aktivovat, napište mi na mail uvedený výše.

vejce4444
Návštěvník
Návštěvník
Příspěvky: 47
Registrován: 23 říj 2012 10:24

Re: Žádost o kontrolu logů

#4 Příspěvek od vejce4444 »

Zdravím, zde je log z cleaneru:

# AdwCleaner 7.0.2.1 - Logfile created on Thu Sep 14 17:48:03 2017
# Updated on 2017/29/08 by Malwarebytes
# Running on Windows 7 Professional (X64)
# Mode: clean
# Support: https://www.malwarebytes.com/support

***** [ Services ] *****

No malicious services deleted.

***** [ Folders ] *****

No malicious folders deleted.

***** [ Files ] *****

Deleted: C:\Users\Ecjev\AppData\Local\Temp\Utils.dll


***** [ DLL ] *****

No malicious DLLs cleaned.

***** [ WMI ] *****

No malicious WMI cleaned.

***** [ Shortcuts ] *****

No malicious shortcuts cleaned.

***** [ Tasks ] *****

No malicious tasks deleted.

***** [ Registry ] *****

No malicious registry entries deleted.

***** [ Firefox (and derivatives) ] *****

No malicious Firefox entries deleted.

***** [ Chromium (and derivatives) ] *****

No malicious Chromium entries deleted.

*************************

::Tracing keys deleted
::Winsock settings cleared
::Additional Actions: 0



*************************

C:/AdwCleaner/AdwCleaner[S0].txt - [993 B] - [2017/9/14 17:47:46]


########## EOF - C:\AdwCleaner\AdwCleaner[C0].txt ##########

Uživatelský avatar
Rudy
Site Admin
Site Admin
Příspěvky: 118192
Registrován: 30 říj 2003 13:42
Bydliště: Plzeň
Kontaktovat uživatele:

Re: Žádost o kontrolu logů

#5 Příspěvek od Rudy »

Dotazy a logy vkládejte pouze do vašich threadů. Soukromé zprávy, icq a e-maily neslouží k řešení vašich problémů.

Podpořte, prosím, naše fórum : https://platba.viry.cz/payment/.

Navštivte: Obrázek

e-mail: rudy(zavináč)forum.viry.cz

Varování:
Před odvirováním PC si udělejte zálohy svých důležitých dat (pošta, kontakty, dokumenty, fotografie, videa, hudba apod.). Virus mimo svých "viditelných" aktivit může poškodit systém!


Po dořešení vašeho problému bude vlákno zamknuto. Stejně tak tehdy, pokud bude nečinné více než 14dnů. Pokud budete chtít vlákno aktivovat, napište mi na mail uvedený výše.

vejce4444
Návštěvník
Návštěvník
Příspěvky: 47
Registrován: 23 říj 2012 10:24

Re: Žádost o kontrolu logů

#6 Příspěvek od vejce4444 »

Dobrý den zde je log (vkladam i addition v zipu):

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 17-09-2017 01
Ran by Ecjev (administrator) on ECJEV-NTB (18-09-2017 20:02:14)
Running from C:\Users\Ecjev\Desktop
Loaded Profiles: Ecjev (Available Profiles: Ecjev)
Platform: Windows 7 Professional Service Pack 1 (X64) Language: Čeština (Česká republika)
Internet Explorer Version 11 (Default browser: "C:\drivers\Mozilla_firefox\firefox.exe" -osint -url "%1")
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/33 ... scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(ESET) C:\drivers\ESET_smart\ekrn.exe
(Intel Corporation) C:\Windows\System32\igfxCUIService.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Conexant Systems Inc.) C:\Windows\System32\CxAudMsg64.exe
(Intel(R) Corporation) C:\drivers\PROSet_wireless\WiFi\bin\EvtEng.exe
(Locktime Software) D:\Programy\net_limiter\NLSvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display.NvContainer\NVDisplay.Container.exe
() D:\Programy\K800i\SupServ.exe
() C:\Windows\SysWOW64\PnkBstrA.exe
(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
(Conexant Systems, Inc.) C:\Windows\SysWOW64\SASrv.exe
(TeamViewer GmbH) C:\Users\Ecjev\AppData\Local\Temp\TeamViewer\TeamViewer_Service.exe
() C:\Program Files (x86)\ASUS\Printer Utilities\UsbService64.exe
(Intel® Corporation) C:\drivers\PROSet_wireless\WiFi\bin\ZeroConfigService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(ESET) C:\drivers\ESET_smart\egui.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe
(Conexant Systems, Inc.) C:\Program Files\CONEXANT\cAudioFilterAgent\CAudioFilterAgent64.exe
() C:\Program Files\CONEXANT\ForteConfig\fmapp.exe
(Alcor) C:\Windows\WebCam\S6000\S6000Mnt.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrl.exe
(Lenovo (Beijing) Limited) C:\Program Files (x86)\Lenovo\Energy Management\Energy Management.exe
(Lenovo(beijing) Limited) C:\Program Files (x86)\Lenovo\Energy Management\utility.exe
(Saitek) C:\Program Files\SmartTechnology\Software\ProfilerU.exe
(Saitek) C:\Program Files\SmartTechnology\Software\SaiMfd.exe
(Microsoft Corporation) C:\Windows\SysWOW64\rundll32.exe
(Microsoft Corporation) C:\Program Files\Microsoft Xbox 360 Accessories\XBoxStat.exe
() C:\drivers\RocketDock\RocketDock.exe
(Intel Corporation) C:\Windows\System32\igfxEM.exe
(Intel Corporation) C:\Windows\System32\igfxHK.exe
() C:\Windows\System32\igfxTray.exe
(Wargaming.net) D:\Hry\WoT\WargamingGameUpdater.exe
(Rainmeter) C:\drivers\Rainmeter\Rainmeter.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrlHelper.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDIntelligent.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe
(Intel Corporation) C:\drivers\Intel_Rapid_tech\IAStorIcon.exe
(Intel Corporation) C:\drivers\Intel_Rapid_tech\IAStorDataMgrSvc.exe
(Mozilla Corporation) C:\drivers\Mozilla_firefox\firefox.exe
(ESET) C:\drivers\ESET_smart\eOPPFrame.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe

==================== Registry (Whitelisted) ====================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [IntelPROSet] => C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe [4876528 2014-01-17] (Intel(R) Corporation)
HKLM\...\Run: [IAStorIcon] => C:\drivers\Intel_Rapid_tech\IAStorIcon.exe [287592 2013-11-21] (Intel Corporation)
HKLM\...\Run: [cAudioFilterAgent] => C:\Program Files\Conexant\cAudioFilterAgent\cAudioFilterAgent64.exe [907480 2013-09-04] (Conexant Systems, Inc.)
HKLM\...\Run: [ForteConfig] => C:\Program Files\Conexant\ForteConfig\fmapp.exe [49056 2010-10-26] ()
HKLM\...\Run: [SmartAudio] => C:\Program Files\CONEXANT\SAII\SACpl.exe [1647616 2012-06-13] (Conexant Systems, Inc.)
HKLM\...\Run: [S6000Mnt] => C:\Windows\WebCam\S6000\S6000Mnt.exe [516608 2015-05-21] (Alcor)
HKLM\...\Run: [ETDCtrl] => C:\Program Files\Elantech\ETDCtrl.exe [2891080 2013-10-17] (ELAN Microelectronics Corp.)
HKLM\...\Run: [Energy Management] => C:\Program Files (x86)\Lenovo\Energy Management\Energy Management.exe [8079408 2017-01-19] (Lenovo (Beijing) Limited)
HKLM\...\Run: [EnergyUtility] => C:\Program Files (x86)\Lenovo\Energy Management\Utility.exe [6200368 2017-01-19] (Lenovo(beijing) Limited)
HKLM\...\Run: [ProfilerU] => C:\Program Files\SmartTechnology\Software\ProfilerU.exe [454144 2015-10-01] (Saitek)
HKLM\...\Run: [SaiMfd] => C:\Program Files\SmartTechnology\Software\SaiMfd.exe [157696 2015-10-01] (Saitek)
HKLM\...\Run: [Cm108Sound] => C:\Windows\syswow64\RunDll32.exe C:\Windows\Syswow64\cm108.dll,CMICtrlWnd
HKLM\...\Run: [XboxStat] => C:\Program Files\Microsoft Xbox 360 Accessories\XboxStat.exe [825184 2009-09-30] (Microsoft Corporation)
HKLM-x32\...\Run: [USB3MON] => C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [292848 2014-01-06] (Intel Corporation)
HKU\S-1-5-21-58873803-3009850163-3451747300-1000\...\Run: [RocketDock] => C:\drivers\RocketDock\RocketDock.exe [495616 2007-09-02] ()
HKU\S-1-5-21-58873803-3009850163-3451747300-1000\...\Run: [World of Tanks] => D:\Hry\WoT\WargamingGameUpdater.exe [3135752 2017-02-28] (Wargaming.net)
HKU\S-1-5-21-58873803-3009850163-3451747300-1000\...\MountPoints2: {1bd35c76-3bd9-11e7-b9eb-303a64ce94ab} - F:\Autorun.exe
HKU\S-1-5-21-58873803-3009850163-3451747300-1000\...\MountPoints2: {1bd35c87-3bd9-11e7-b9eb-303a64ce94ab} - F:\Autorun.exe
AppInit_DLLs: C:\Windows\system32\nvinitx.dll => C:\Windows\system32\nvinitx.dll [170688 2016-10-25] (NVIDIA Corporation)
AppInit_DLLs-x32: C:\Windows\SysWOW64\nvinit.dll => C:\Windows\SysWOW64\nvinit.dll [148200 2016-10-25] (NVIDIA Corporation)
Startup: C:\Users\Ecjev\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Rainmeter.lnk [2017-03-22]
ShortcutTarget: Rainmeter.lnk -> C:\drivers\Rainmeter\Rainmeter.exe (Rainmeter)
GroupPolicy: Restriction <==== ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Tcpip\..\Interfaces\{4130FDA9-33F0-4C37-9C06-44BCE79AD2A2}: [NameServer] 192.168.0.1,8.8.8.8
Tcpip\..\Interfaces\{F236742D-D4F8-4C22-AEAC-E4904C803F32}: [NameServer] 10.0.4.1,8.8.8.8

Internet Explorer:
==================
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_121\bin\ssv.dll [2017-01-19] (Oracle Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_121\bin\jp2ssv.dll [2017-01-19] (Oracle Corporation)

FireFox:
========
FF DefaultProfile: cd0d3xug.default
FF ProfilePath: C:\Users\Ecjev\AppData\Roaming\Mozilla\Firefox\Profiles\cd0d3xug.default [2017-09-18]
FF Extension: (Adblock Plus Pop-up Addon) - C:\Users\Ecjev\AppData\Roaming\Mozilla\Firefox\Profiles\cd0d3xug.default\Extensions\adblockpopups@jessehakanen.net.xpi [2016-07-10]
FF Extension: (Adblock Plus) - C:\Users\Ecjev\AppData\Roaming\Mozilla\Firefox\Profiles\cd0d3xug.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2017-06-07]
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_27_0_0_130.dll [2017-09-14] ()
FF Plugin: @microsoft.com/GENUINE -> disabled [No File]
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_27_0_0_130.dll [2017-09-14] ()
FF Plugin-x32: @java.com/DTPlugin,version=11.121.2 -> C:\Program Files (x86)\Java\jre1.8.0_121\bin\dtplugin\npDeployJava1.dll [2017-01-19] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.121.2 -> C:\Program Files (x86)\Java\jre1.8.0_121\bin\plugin2\npjp2.dll [2017-01-19] (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled [No File]
FF Plugin-x32: @videolan.org/vlc,version=2.2.4 -> C:\drivers\VLC\npvlc.dll [2017-05-24] (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.2.6 -> C:\drivers\VLC\npvlc.dll [2017-05-24] (VideoLAN)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2017-08-01] (Adobe Systems Inc.)
StartMenuInternet: FIREFOX.EXE - C:\drivers\Mozilla_firefox\firefox.exe

==================== Services (Whitelisted) ====================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 ekrn; C:\drivers\ESET_smart\ekrn.exe [2625368 2017-06-13] (ESET)
R2 EvtEng; C:\drivers\PROSet_wireless\WiFi\bin\EvtEng.exe [632048 2014-01-17] (Intel(R) Corporation)
R2 IAStorDataMgrSvc; C:\drivers\Intel_Rapid_tech\IAStorDataMgrSvc.exe [15720 2013-11-21] (Intel Corporation)
R2 igfxCUIService1.0.0.0; C:\Windows\system32\igfxCUIService.exe [355232 2015-08-09] (Intel Corporation)
S2 MbnExt; C:\Program Files (x86)\T-Mobile\T-Mobile Internet Manager\MbnExt.dll [417128 2013-11-22] (Gemfor s.r.o.)
S3 MyWiFiDHCPDNS; C:\drivers\PROSet_wireless\WiFi\bin\PanDhcpDns.exe [284912 2014-01-17] ()
R2 nlsvc; D:\Programy\net_limiter\NLSvc.exe [323632 2016-12-06] (Locktime Software)
R2 NVDisplay.ContainerLocalSystem; C:\Program Files\NVIDIA Corporation\Display.NvContainer\NVDisplay.Container.exe [458176 2016-10-25] (NVIDIA Corporation)
R2 OMSI download service; D:\Programy\K800i\SupServ.exe [90112 2009-04-30] () [File not signed]
R2 PnkBstrA; C:\Windows\SysWOW64\PnkBstrA.exe [76888 2017-01-22] ()
S2 SkypeUpdate; D:\Programy\skype\Updater\Updater.exe [317400 2017-02-27] (Skype Technologies)
R2 TeamViewer; c:\users\ecjev\appdata\local\temp\teamviewer\TeamViewer_Service.exe [10885360 2017-05-31] (TeamViewer GmbH) <==== ATTENTION
R2 UsbService; C:\Program Files (x86)\ASUS\Printer Utilities\UsbService64.exe [334848 2010-08-10] () [File not signed]
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)
R2 ZeroConfigService; C:\drivers\PROSet_wireless\WiFi\bin\ZeroConfigService.exe [3816176 2014-01-17] (Intel® Corporation)

===================== Drivers (Whitelisted) ======================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R1 eamonm; C:\Windows\System32\DRIVERS\eamonm.sys [132824 2017-06-22] (ESET)
R0 edevmon; C:\Windows\System32\DRIVERS\edevmon.sys [107344 2017-05-04] (ESET)
R1 ehdrv; C:\Windows\System32\DRIVERS\ehdrv.sys [178056 2017-05-04] (ESET)
R2 ekbdflt; C:\Windows\System32\DRIVERS\ekbdflt.sys [50752 2017-05-04] (ESET)
R1 epfw; C:\Windows\System32\DRIVERS\epfw.sys [78192 2017-05-04] (ESET)
R1 EpfwLWF; C:\Windows\System32\DRIVERS\EpfwLWF.sys [60544 2017-05-04] (ESET)
R1 epfwwfp; C:\Windows\System32\DRIVERS\epfwwfp.sys [101648 2017-05-04] (ESET)
R0 iaStorF; C:\Windows\System32\DRIVERS\iaStorF.sys [28008 2013-11-21] (Intel Corporation)
R3 MEIx64; C:\Windows\System32\DRIVERS\TeeDriverx64.sys [99288 2013-09-17] (Intel Corporation)
R3 NETwNs64; C:\Windows\System32\DRIVERS\Netwsw02.sys [3438048 2014-05-04] (Intel Corporation)
R0 nldrv; C:\Windows\System32\drivers\nldrv.sys [142888 2016-12-06] (Locktime Software)
S3 s0016bus; C:\Windows\System32\DRIVERS\s0016bus.sys [115240 2008-05-16] (MCCI Corporation)
S3 s0016mdfl; C:\Windows\System32\DRIVERS\s0016mdfl.sys [19496 2008-05-16] (MCCI Corporation)
S3 s0016mdm; C:\Windows\System32\DRIVERS\s0016mdm.sys [158760 2008-05-16] (MCCI Corporation)
S3 s0016mgmt; C:\Windows\System32\DRIVERS\s0016mgmt.sys [137256 2008-05-16] (MCCI Corporation)
S3 s0016nd5; C:\Windows\System32\DRIVERS\s0016nd5.sys [34344 2008-05-16] (MCCI Corporation)
S3 s0016obex; C:\Windows\System32\DRIVERS\s0016obex.sys [136744 2008-05-16] (MCCI Corporation)
S3 s0016unic; C:\Windows\System32\DRIVERS\s0016unic.sys [151592 2008-05-16] (MCCI Corporation)
R3 S6000KNT; C:\Windows\System32\Drivers\S6000KNT.sys [899712 2015-05-21] (Bison)
R3 SaiMini; C:\Windows\System32\DRIVERS\SaiMini.sys [24152 2016-07-18] (Saitek)
R3 SaiNtBus; C:\Windows\System32\drivers\SaiBus.sys [59736 2016-07-18] (Saitek)
R3 vuhub; C:\Windows\System32\DRIVERS\vuhub.sys [47616 2007-12-17] ()
R3 _hid_0738_1703; C:\Windows\System32\DRIVERS\_hid_0738_1703.sys [210408 2016-07-18] (Saitek)
R3 _usb_0738_1703; C:\Windows\System32\DRIVERS\_usb_0738_1703.sys [46824 2016-07-18] (Saitek)
S3 ew_hwusbdev; system32\DRIVERS\ew_hwusbdev.sys [X]
S3 ew_usbenumfilter; system32\DRIVERS\ew_usbenumfilter.sys [X]
S3 huawei_enumerator; system32\DRIVERS\ew_jubusenum.sys [X]
S3 hwusb_cdcacm; system32\DRIVERS\ew_cdcacm.sys [X]
S3 hwusb_wwanecm; system32\DRIVERS\ew_wwanecm.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2017-09-18 20:02 - 2017-09-18 20:02 - 002399744 _____ (Farbar) C:\Users\Ecjev\Desktop\FRST64.exe
2017-09-18 20:02 - 2017-09-18 20:02 - 000013443 _____ C:\Users\Ecjev\Desktop\FRST.txt
2017-09-18 20:02 - 2017-09-18 20:02 - 000000000 ____D C:\FRST
2017-09-18 20:01 - 2017-09-18 20:01 - 000015327 _____ C:\Users\Ecjev\Desktop\LM.bat
2017-09-18 19:53 - 2017-09-18 19:53 - 000000640 _____ C:\Users\Ecjev\Desktop\lasane.txt
2017-09-17 18:38 - 2016-11-18 21:08 - 000098405 _____ C:\Users\Ecjev\Desktop\Suicide.Squad.2016.720p.WEBRip.x264.AAC.ETRG.srt
2017-09-17 18:29 - 2017-09-17 18:30 - 3027471667 _____ C:\Users\Ecjev\Desktop\Suicide.Squad.2016.720p.WEB-DL.X264.AC3-EVO.mkv
2017-09-14 19:48 - 2017-09-14 19:48 - 000000993 _____ C:\Users\Ecjev\Desktop\AdwCleaner[S0].txt
2017-09-14 19:46 - 2017-09-14 19:48 - 000000000 ____D C:\AdwCleaner
2017-09-13 23:39 - 2017-08-19 17:28 - 000197120 _____ (Microsoft Corporation) C:\Windows\system32\shdocvw.dll
2017-09-13 23:39 - 2017-08-19 17:10 - 000180224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shdocvw.dll
2017-09-13 23:39 - 2017-08-16 17:29 - 000806912 _____ (Microsoft Corporation) C:\Windows\system32\usp10.dll
2017-09-13 23:39 - 2017-08-16 17:10 - 000629760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\usp10.dll
2017-09-13 23:39 - 2017-08-16 16:57 - 003224576 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2017-09-13 23:39 - 2017-08-16 03:10 - 000395976 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2017-09-13 23:39 - 2017-08-16 02:25 - 000347336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2017-09-13 23:39 - 2017-08-15 17:29 - 014182400 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2017-09-13 23:39 - 2017-08-15 17:29 - 001867264 _____ (Microsoft Corporation) C:\Windows\system32\ExplorerFrame.dll
2017-09-13 23:39 - 2017-08-15 17:10 - 012880896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2017-09-13 23:39 - 2017-08-15 17:10 - 001499648 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ExplorerFrame.dll
2017-09-13 23:39 - 2017-08-15 16:06 - 015260160 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2017-09-13 23:39 - 2017-08-15 16:01 - 000416256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2017-09-13 23:39 - 2017-08-15 16:01 - 000279040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2017-09-13 23:39 - 2017-08-15 16:01 - 000076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2017-09-13 23:39 - 2017-08-15 15:58 - 013673984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2017-09-13 23:39 - 2017-08-14 19:35 - 003203584 _____ (Microsoft Corporation) C:\Windows\system32\mmcndmgr.dll
2017-09-13 23:39 - 2017-08-14 19:35 - 002150912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mmcndmgr.dll
2017-09-13 23:39 - 2017-08-14 19:35 - 000355328 _____ (Microsoft Corporation) C:\Windows\system32\mmcbase.dll
2017-09-13 23:39 - 2017-08-14 19:35 - 000303104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mmcbase.dll
2017-09-13 23:39 - 2017-08-14 19:35 - 000172544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cic.dll
2017-09-13 23:39 - 2017-08-14 19:35 - 000131072 _____ (Microsoft Corporation) C:\Windows\system32\mmcshext.dll
2017-09-13 23:39 - 2017-08-14 19:35 - 000128512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mmcshext.dll
2017-09-13 23:39 - 2017-08-14 19:34 - 000211968 _____ (Microsoft Corporation) C:\Windows\system32\cic.dll
2017-09-13 23:39 - 2017-08-13 23:37 - 002144256 _____ (Microsoft Corporation) C:\Windows\system32\mmc.exe
2017-09-13 23:39 - 2017-08-13 23:30 - 001401344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mmc.exe
2017-09-13 23:39 - 2017-08-13 20:58 - 025730560 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2017-09-13 23:39 - 2017-08-13 19:24 - 002724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2017-09-13 23:39 - 2017-08-13 19:24 - 000004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2017-09-13 23:39 - 2017-08-13 19:06 - 000066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2017-09-13 23:39 - 2017-08-13 19:05 - 000576512 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2017-09-13 23:39 - 2017-08-13 19:05 - 000417792 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2017-09-13 23:39 - 2017-08-13 19:05 - 000088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2017-09-13 23:39 - 2017-08-13 19:05 - 000048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2017-09-13 23:39 - 2017-08-13 19:04 - 002899968 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2017-09-13 23:39 - 2017-08-13 18:56 - 000054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2017-09-13 23:39 - 2017-08-13 18:55 - 000034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2017-09-13 23:39 - 2017-08-13 18:54 - 020269056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2017-09-13 23:39 - 2017-08-13 18:52 - 000615936 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2017-09-13 23:39 - 2017-08-13 18:51 - 005981696 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2017-09-13 23:39 - 2017-08-13 18:51 - 000144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2017-09-13 23:39 - 2017-08-13 18:51 - 000116224 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2017-09-13 23:39 - 2017-08-13 18:50 - 000817664 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2017-09-13 23:39 - 2017-08-13 18:50 - 000814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2017-09-13 23:39 - 2017-08-13 18:46 - 002724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2017-09-13 23:39 - 2017-08-13 18:41 - 000968704 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2017-09-13 23:39 - 2017-08-13 18:38 - 000489984 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2017-09-13 23:39 - 2017-08-13 18:30 - 000062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2017-09-13 23:39 - 2017-08-13 18:29 - 000499200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2017-09-13 23:39 - 2017-08-13 18:29 - 000341504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2017-09-13 23:39 - 2017-08-13 18:29 - 000087552 _____ (Microsoft Corporation) C:\Windows\system32\tdc.ocx
2017-09-13 23:39 - 2017-08-13 18:29 - 000077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2017-09-13 23:39 - 2017-08-13 18:29 - 000047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2017-09-13 23:39 - 2017-08-13 18:28 - 000064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2017-09-13 23:39 - 2017-08-13 18:27 - 000107520 _____ (Microsoft Corporation) C:\Windows\system32\inseng.dll
2017-09-13 23:39 - 2017-08-13 18:24 - 002291200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2017-09-13 23:39 - 2017-08-13 18:24 - 000199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2017-09-13 23:39 - 2017-08-13 18:23 - 000092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2017-09-13 23:39 - 2017-08-13 18:22 - 000047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2017-09-13 23:39 - 2017-08-13 18:21 - 000030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2017-09-13 23:39 - 2017-08-13 18:20 - 000315392 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2017-09-13 23:39 - 2017-08-13 18:19 - 000476160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2017-09-13 23:39 - 2017-08-13 18:18 - 000152064 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll
2017-09-13 23:39 - 2017-08-13 18:17 - 000663552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2017-09-13 23:39 - 2017-08-13 18:17 - 000620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2017-09-13 23:39 - 2017-08-13 18:17 - 000115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2017-09-13 23:39 - 2017-08-13 18:07 - 000262144 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll
2017-09-13 23:39 - 2017-08-13 18:04 - 000807936 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2017-09-13 23:39 - 2017-08-13 18:04 - 000726528 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2017-09-13 23:39 - 2017-08-13 18:02 - 001359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2017-09-13 23:39 - 2017-08-13 18:01 - 002134528 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2017-09-13 23:39 - 2017-08-13 18:01 - 000073216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdc.ocx
2017-09-13 23:39 - 2017-08-13 18:01 - 000060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2017-09-13 23:39 - 2017-08-13 18:00 - 000091136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inseng.dll
2017-09-13 23:39 - 2017-08-13 17:57 - 000168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2017-09-13 23:39 - 2017-08-13 17:53 - 000130048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\occache.dll
2017-09-13 23:39 - 2017-08-13 17:48 - 004547072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2017-09-13 23:39 - 2017-08-13 17:46 - 000230400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll
2017-09-13 23:39 - 2017-08-13 17:44 - 000694784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2017-09-13 23:39 - 2017-08-13 17:43 - 002058752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2017-09-13 23:39 - 2017-08-13 17:43 - 001155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2017-09-13 23:39 - 2017-08-13 17:40 - 003241472 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2017-09-13 23:39 - 2017-08-13 17:27 - 001544704 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2017-09-13 23:39 - 2017-08-13 17:18 - 000800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2017-09-13 23:39 - 2017-08-13 17:17 - 002767872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2017-09-13 23:39 - 2017-08-13 17:14 - 000710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2017-09-13 23:39 - 2017-08-13 17:13 - 001314816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2017-09-13 23:39 - 2017-08-11 08:42 - 000631176 _____ (Microsoft Corporation) C:\Windows\system32\winresume.efi
2017-09-13 23:39 - 2017-08-11 08:38 - 005547752 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2017-09-13 23:39 - 2017-08-11 08:38 - 000706792 _____ (Microsoft Corporation) C:\Windows\system32\winload.efi
2017-09-13 23:39 - 2017-08-11 08:38 - 000154856 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2017-09-13 23:39 - 2017-08-11 08:38 - 000095464 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2017-09-13 23:39 - 2017-08-11 08:36 - 001732864 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2017-09-13 23:39 - 2017-08-11 08:35 - 002065408 _____ (Microsoft Corporation) C:\Windows\system32\ole32.dll
2017-09-13 23:39 - 2017-08-11 08:35 - 001212928 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2017-09-13 23:39 - 2017-08-11 08:35 - 000757248 _____ (Microsoft Corporation) C:\Windows\system32\win32spl.dll
2017-09-13 23:39 - 2017-08-11 08:35 - 000512000 _____ (Microsoft Corporation) C:\Windows\system32\rpcss.dll
2017-09-13 23:39 - 2017-08-11 08:35 - 000503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
2017-09-13 23:39 - 2017-08-11 08:35 - 000362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll
2017-09-13 23:39 - 2017-08-11 08:35 - 000346112 _____ (Microsoft Corporation) C:\Windows\system32\ntprint.dll
2017-09-13 23:39 - 2017-08-11 08:35 - 000345600 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2017-09-13 23:39 - 2017-08-11 08:35 - 000313856 _____ (Microsoft Corporation) C:\Windows\system32\Wldap32.dll
2017-09-13 23:39 - 2017-08-11 08:35 - 000243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2017-09-13 23:39 - 2017-08-11 08:35 - 000215552 _____ (Microsoft Corporation) C:\Windows\system32\winsrv.dll
2017-09-13 23:39 - 2017-08-11 08:35 - 000210432 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2017-09-13 23:39 - 2017-08-11 08:35 - 000190464 _____ (Microsoft Corporation) C:\Windows\system32\rpchttp.dll
2017-09-13 23:39 - 2017-08-11 08:35 - 000135680 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2017-09-13 23:39 - 2017-08-11 08:35 - 000086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2017-09-13 23:39 - 2017-08-11 08:35 - 000063488 _____ (Microsoft Corporation) C:\Windows\system32\setbcdlocale.dll
2017-09-13 23:39 - 2017-08-11 08:35 - 000050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll
2017-09-13 23:39 - 2017-08-11 08:35 - 000028672 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2017-09-13 23:39 - 2017-08-11 08:35 - 000028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2017-09-13 23:39 - 2017-08-11 08:35 - 000026112 _____ (Microsoft Corporation) C:\Windows\system32\oleres.dll
2017-09-13 23:39 - 2017-08-11 08:35 - 000026112 _____ (Microsoft Corporation) C:\Windows\system32\nsisvc.dll
2017-09-13 23:39 - 2017-08-11 08:35 - 000025600 _____ (Microsoft Corporation) C:\Windows\system32\winnsi.dll
2017-09-13 23:39 - 2017-08-11 08:35 - 000016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll
2017-09-13 23:39 - 2017-08-11 08:35 - 000013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll
2017-09-13 23:39 - 2017-08-11 08:35 - 000013312 _____ (Microsoft Corporation) C:\Windows\system32\nsi.dll
2017-09-13 23:39 - 2017-08-11 08:34 - 001460736 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2017-09-13 23:39 - 2017-08-11 08:34 - 001163264 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2017-09-13 23:39 - 2017-08-11 08:34 - 000971776 _____ (Microsoft Corporation) C:\Windows\system32\localspl.dll
2017-09-13 23:39 - 2017-08-11 08:34 - 000880640 _____ (Microsoft Corporation) C:\Windows\system32\advapi32.dll
2017-09-13 23:39 - 2017-08-11 08:34 - 000731648 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2017-09-13 23:39 - 2017-08-11 08:34 - 000690688 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2017-09-13 23:39 - 2017-08-11 08:34 - 000463872 _____ (Microsoft Corporation) C:\Windows\system32\certcli.dll
2017-09-13 23:39 - 2017-08-11 08:34 - 000419840 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2017-09-13 23:39 - 2017-08-11 08:34 - 000316928 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2017-09-13 23:39 - 2017-08-11 08:34 - 000312320 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2017-09-13 23:39 - 2017-08-11 08:34 - 000166400 _____ (Microsoft Corporation) C:\Windows\system32\inetpp.dll
2017-09-13 23:39 - 2017-08-11 08:34 - 000146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2017-09-13 23:39 - 2017-08-11 08:34 - 000123904 _____ (Microsoft Corporation) C:\Windows\system32\bcrypt.dll
2017-09-13 23:39 - 2017-08-11 08:34 - 000060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll
2017-09-13 23:39 - 2017-08-11 08:34 - 000059904 _____ (Microsoft Corporation) C:\Windows\system32\appidapi.dll
2017-09-13 23:39 - 2017-08-11 08:34 - 000044032 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
2017-09-13 23:39 - 2017-08-11 08:34 - 000043520 _____ (Microsoft Corporation) C:\Windows\system32\cryptbase.dll
2017-09-13 23:39 - 2017-08-11 08:34 - 000034816 _____ (Microsoft Corporation) C:\Windows\system32\appidsvc.dll
2017-09-13 23:39 - 2017-08-11 08:34 - 000022528 _____ (Microsoft Corporation) C:\Windows\system32\inetppui.dll
2017-09-13 23:39 - 2017-08-11 08:34 - 000022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2017-09-13 23:39 - 2017-08-11 08:34 - 000008704 _____ (Microsoft Corporation) C:\Windows\system32\comcat.dll
2017-09-13 23:39 - 2017-08-11 08:34 - 000006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll
2017-09-13 23:39 - 2017-08-11 08:34 - 000006144 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2017-09-13 23:39 - 2017-08-11 08:34 - 000005120 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2017-09-13 23:39 - 2017-08-11 08:34 - 000004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2017-09-13 23:39 - 2017-08-11 08:34 - 000004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2017-09-13 23:39 - 2017-08-11 08:34 - 000004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2017-09-13 23:39 - 2017-08-11 08:34 - 000004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2017-09-13 23:39 - 2017-08-11 08:34 - 000004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2017-09-13 23:39 - 2017-08-11 08:34 - 000004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2017-09-13 23:39 - 2017-08-11 08:34 - 000003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2017-09-13 23:39 - 2017-08-11 08:34 - 000003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2017-09-13 23:39 - 2017-08-11 08:34 - 000003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2017-09-13 23:39 - 2017-08-11 08:34 - 000003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2017-09-13 23:39 - 2017-08-11 08:34 - 000003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2017-09-13 23:39 - 2017-08-11 08:34 - 000003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2017-09-13 23:39 - 2017-08-11 08:34 - 000003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2017-09-13 23:39 - 2017-08-11 08:34 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2017-09-13 23:39 - 2017-08-11 08:34 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2017-09-13 23:39 - 2017-08-11 08:34 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2017-09-13 23:39 - 2017-08-11 08:34 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2017-09-13 23:39 - 2017-08-11 08:34 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2017-09-13 23:39 - 2017-08-11 08:34 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2017-09-13 23:39 - 2017-08-11 08:34 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2017-09-13 23:39 - 2017-08-11 08:34 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2017-09-13 23:39 - 2017-08-11 08:34 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2017-09-13 23:39 - 2017-08-11 08:34 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2017-09-13 23:39 - 2017-08-11 08:34 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2017-09-13 23:39 - 2017-08-11 08:34 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2017-09-13 23:39 - 2017-08-11 08:34 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2017-09-13 23:39 - 2017-08-11 08:24 - 004001000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2017-09-13 23:39 - 2017-08-11 08:24 - 003945704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2017-09-13 23:39 - 2017-08-11 08:21 - 001314112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2017-09-13 23:39 - 2017-08-11 08:20 - 000071680 _____ C:\Windows\system32\PrintBrmUi.exe
2017-09-13 23:39 - 2017-08-11 08:20 - 000061952 _____ (Microsoft Corporation) C:\Windows\system32\ntprint.exe
2017-09-13 23:39 - 2017-08-11 08:20 - 000048640 _____ (Microsoft Corporation) C:\Windows\system32\wpnpinst.exe
2017-09-13 23:39 - 2017-08-11 08:19 - 001417728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ole32.dll
2017-09-13 23:39 - 2017-08-11 08:19 - 001114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
2017-09-13 23:39 - 2017-08-11 08:19 - 000690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll
2017-09-13 23:39 - 2017-08-11 08:19 - 000666112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll
2017-09-13 23:39 - 2017-08-11 08:19 - 000644096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\advapi32.dll
2017-09-13 23:39 - 2017-08-11 08:19 - 000554496 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2017-09-13 23:39 - 2017-08-11 08:19 - 000497664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\win32spl.dll
2017-09-13 23:39 - 2017-08-11 08:19 - 000342528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\certcli.dll
2017-09-13 23:39 - 2017-08-11 08:19 - 000299008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntprint.dll
2017-09-13 23:39 - 2017-08-11 08:19 - 000275456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll
2017-09-13 23:39 - 2017-08-11 08:19 - 000271360 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Wldap32.dll
2017-09-13 23:39 - 2017-08-11 08:19 - 000261120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2017-09-13 23:39 - 2017-08-11 08:19 - 000254464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2017-09-13 23:39 - 2017-08-11 08:19 - 000223232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2017-09-13 23:39 - 2017-08-11 08:19 - 000172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2017-09-13 23:39 - 2017-08-11 08:19 - 000146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll
2017-09-13 23:39 - 2017-08-11 08:19 - 000141312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpchttp.dll
2017-09-13 23:39 - 2017-08-11 08:19 - 000096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2017-09-13 23:39 - 2017-08-11 08:19 - 000082944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\bcrypt.dll
2017-09-13 23:39 - 2017-08-11 08:19 - 000065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2017-09-13 23:39 - 2017-08-11 08:19 - 000060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msobjs.dll
2017-09-13 23:39 - 2017-08-11 08:19 - 000050688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\appidapi.dll
2017-09-13 23:39 - 2017-08-11 08:19 - 000043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll
2017-09-13 23:39 - 2017-08-11 08:19 - 000026112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\oleres.dll
2017-09-13 23:39 - 2017-08-11 08:19 - 000022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2017-09-13 23:39 - 2017-08-11 08:19 - 000017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2017-09-13 23:39 - 2017-08-11 08:19 - 000016384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\winnsi.dll
2017-09-13 23:39 - 2017-08-11 08:19 - 000008704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\nsi.dll
2017-09-13 23:39 - 2017-08-11 08:19 - 000006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apisetschema.dll
2017-09-13 23:39 - 2017-08-11 08:19 - 000005120 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll
2017-09-13 23:39 - 2017-08-11 08:19 - 000005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2017-09-13 23:39 - 2017-08-11 08:19 - 000004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll
2017-09-13 23:39 - 2017-08-11 08:19 - 000004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
2017-09-13 23:39 - 2017-08-11 08:19 - 000004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll
2017-09-13 23:39 - 2017-08-11 08:19 - 000004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll
2017-09-13 23:39 - 2017-08-11 08:19 - 000004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll
2017-09-13 23:39 - 2017-08-11 08:19 - 000004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll
2017-09-13 23:39 - 2017-08-11 08:19 - 000003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
2017-09-13 23:39 - 2017-08-11 08:19 - 000003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
2017-09-13 23:39 - 2017-08-11 08:19 - 000003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll
2017-09-13 23:39 - 2017-08-11 08:19 - 000003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
2017-09-13 23:39 - 2017-08-11 08:19 - 000003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll
2017-09-13 23:39 - 2017-08-11 08:19 - 000003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll
2017-09-13 23:39 - 2017-08-11 08:19 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll
2017-09-13 23:39 - 2017-08-11 08:19 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
2017-09-13 23:39 - 2017-08-11 08:19 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll
2017-09-13 23:39 - 2017-08-11 08:19 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll
2017-09-13 23:39 - 2017-08-11 08:19 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll
2017-09-13 23:39 - 2017-08-11 08:19 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll
2017-09-13 23:39 - 2017-08-11 08:19 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
2017-09-13 23:39 - 2017-08-11 08:19 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll
2017-09-13 23:39 - 2017-08-11 08:19 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll
2017-09-13 23:39 - 2017-08-11 08:19 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll
2017-09-13 23:39 - 2017-08-11 08:19 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll
2017-09-13 23:39 - 2017-08-11 08:12 - 000025088 _____ (Microsoft Corporation) C:\Windows\system32\netbtugc.exe
2017-09-13 23:39 - 2017-08-11 08:09 - 000061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntprint.exe
2017-09-13 23:39 - 2017-08-11 08:07 - 000148480 _____ (Microsoft Corporation) C:\Windows\system32\appidpolicyconverter.exe
2017-09-13 23:39 - 2017-08-11 08:07 - 000062464 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\appid.sys
2017-09-13 23:39 - 2017-08-11 08:07 - 000017920 _____ (Microsoft Corporation) C:\Windows\system32\appidcertstorecheck.exe
2017-09-13 23:39 - 2017-08-11 08:06 - 000064000 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe
2017-09-13 23:39 - 2017-08-11 08:03 - 000338432 _____ (Microsoft Corporation) C:\Windows\system32\conhost.exe
2017-09-13 23:39 - 2017-08-11 08:03 - 000026624 _____ (Microsoft Corporation) C:\Windows\SysWOW64\netbtugc.exe
2017-09-13 23:39 - 2017-08-11 08:02 - 000296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
2017-09-13 23:39 - 2017-08-11 08:01 - 000007168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\comcat.dll
2017-09-13 23:39 - 2017-08-11 08:00 - 000262656 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\netbt.sys
2017-09-13 23:39 - 2017-08-11 08:00 - 000159744 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb.sys
2017-09-13 23:39 - 2017-08-11 08:00 - 000050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\auditpol.exe
2017-09-13 23:39 - 2017-08-11 07:59 - 000460800 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\srv.sys
2017-09-13 23:39 - 2017-08-11 07:59 - 000405504 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\srv2.sys
2017-09-13 23:39 - 2017-08-11 07:59 - 000291328 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb10.sys
2017-09-13 23:39 - 2017-08-11 07:59 - 000168448 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\srvnet.sys
2017-09-13 23:39 - 2017-08-11 07:59 - 000129536 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb20.sys
2017-09-13 23:39 - 2017-08-11 07:58 - 000112640 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
2017-09-13 23:39 - 2017-08-11 07:58 - 000030720 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2017-09-13 23:39 - 2017-08-11 07:58 - 000026112 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\nsiproxy.sys
2017-09-13 23:39 - 2017-08-11 07:56 - 000025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2017-09-13 23:39 - 2017-08-11 07:56 - 000014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2017-09-13 23:39 - 2017-08-11 07:56 - 000007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2017-09-13 23:39 - 2017-08-11 07:56 - 000002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2017-09-13 23:39 - 2017-08-11 07:55 - 000036352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptbase.dll
2017-09-13 23:39 - 2017-08-11 07:55 - 000006144 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll
2017-09-13 23:39 - 2017-08-11 07:55 - 000004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll
2017-09-13 23:39 - 2017-08-11 07:55 - 000003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll
2017-09-13 23:39 - 2017-08-11 07:55 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll
2017-09-13 23:39 - 2017-07-07 17:29 - 001143296 _____ (Microsoft Corporation) C:\Windows\system32\DXPTaskRingtone.dll
2017-09-13 23:39 - 2017-07-07 17:10 - 000973312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DXPTaskRingtone.dll
2017-09-11 19:08 - 2017-09-11 19:08 - 002111582 _____ C:\Users\Ecjev\Desktop\scripts.zip
2017-09-02 12:10 - 2017-09-02 12:10 - 000000000 ____D C:\rsit
2017-09-02 12:09 - 2017-09-02 12:09 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ESET
2017-09-02 12:09 - 2017-09-02 12:09 - 000000000 ____D C:\ProgramData\ESET
2017-09-02 11:53 - 2017-09-02 11:57 - 000000697 _____ C:\Users\Ecjev\Desktop\Nový textový dokument.txt
2017-09-02 11:41 - 2017-09-02 11:41 - 001517440 _____ (Lenovo Group Limited ) C:\Users\Ecjev\Desktop\wwet020e.exe

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2017-09-18 20:01 - 2017-03-21 18:11 - 000029696 _____ C:\Users\Ecjev\AppData\Local\MSGBOX.EXE
2017-09-18 18:35 - 2017-08-09 18:32 - 000000000 ____D C:\Users\Ecjev\AppData\Roaming\vlc
2017-09-18 17:43 - 2009-07-14 06:45 - 000022096 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2017-09-18 17:43 - 2009-07-14 06:45 - 000022096 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2017-09-18 17:42 - 2011-04-12 10:34 - 000682260 _____ C:\Windows\system32\perfh005.dat
2017-09-18 17:42 - 2011-04-12 10:34 - 000146172 _____ C:\Windows\system32\perfc005.dat
2017-09-18 17:42 - 2009-07-14 07:13 - 001612386 _____ C:\Windows\system32\PerfStringBackup.INI
2017-09-18 17:42 - 2009-07-14 05:20 - 000000000 ____D C:\Windows\inf
2017-09-18 17:37 - 2017-01-19 20:10 - 000000000 __SHD C:\Users\Ecjev\IntelGraphicsProfiles
2017-09-18 17:37 - 2017-01-19 18:33 - 000000000 ___HD C:\Windows\system32\WLANProfiles
2017-09-18 17:36 - 2017-01-19 21:27 - 000000000 ____D C:\ProgramData\NVIDIA
2017-09-18 17:36 - 2009-07-14 07:08 - 000000006 ____H C:\Windows\Tasks\SA.DAT
2017-09-17 18:16 - 2017-01-20 08:03 - 000000000 ____D C:\Users\Ecjev\AppData\Local\Deployment
2017-09-17 16:22 - 2017-04-16 17:08 - 000000000 ____D C:\Users\Ecjev\AppData\Roaming\Skype
2017-09-14 20:43 - 2009-07-14 05:20 - 000000000 ____D C:\Windows\rescache
2017-09-14 19:49 - 2009-07-14 06:45 - 000361608 _____ C:\Windows\system32\FNTCACHE.DAT
2017-09-14 18:11 - 2017-04-16 21:05 - 000803328 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2017-09-14 18:11 - 2017-04-16 21:05 - 000144896 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2017-09-14 18:11 - 2017-04-16 21:05 - 000004408 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2017-09-14 18:11 - 2017-01-20 10:02 - 000000000 ____D C:\Windows\SysWOW64\Macromed
2017-09-14 18:11 - 2017-01-20 10:02 - 000000000 ____D C:\Windows\system32\Macromed
2017-09-14 18:10 - 2017-01-19 19:05 - 000000000 ____D C:\Windows\system32\MRT
2017-09-14 18:09 - 2017-01-19 19:05 - 138202976 ____C (Microsoft Corporation) C:\Windows\system32\MRT.exe
2017-09-14 18:03 - 2017-01-19 18:52 - 001588036 _____ C:\Windows\SysWOW64\PerfStringBackup.INI
2017-09-02 13:11 - 2017-01-19 18:38 - 000000000 ____D C:\Users\Ecjev\AppData\LocalLow\Mozilla
2017-09-02 12:10 - 2017-03-20 00:58 - 000000000 ____D C:\Program Files\trend micro
2017-09-02 12:09 - 2017-01-19 19:45 - 000000000 ____D C:\Users\Ecjev\AppData\Local\ESET
2017-09-01 22:11 - 2017-01-19 18:38 - 000000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2017-08-31 20:40 - 2017-01-20 10:01 - 000002441 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acrobat Reader DC.lnk
2017-08-20 17:27 - 2009-07-14 07:08 - 000032570 _____ C:\Windows\Tasks\SCHEDLGU.TXT

==================== Files in the root of some directories =======

2017-03-21 18:11 - 2017-09-18 20:01 - 000029696 _____ () C:\Users\Ecjev\AppData\Local\MSGBOX.EXE
2017-01-20 20:20 - 2017-01-21 12:06 - 000007610 _____ () C:\Users\Ecjev\AppData\Local\Resmon.ResmonCfg
2017-01-19 18:55 - 2017-01-19 18:55 - 000000000 ____H () C:\ProgramData\DP45977C.lfl
2017-06-07 18:22 - 2017-06-07 18:22 - 000148736 _____ (Avanquest Software) C:\ProgramData\hpeD865.dll

Files to move or delete:
====================
C:\ProgramData\hpeD865.dll


Some files in TEMP:
====================
2017-07-15 16:54 - 2017-07-15 16:54 - 000011264 _____ ( ) C:\Users\Ecjev\AppData\Local\Temp\34gmln4k.dll
2017-07-15 17:43 - 2017-07-15 17:43 - 000011264 _____ ( ) C:\Users\Ecjev\AppData\Local\Temp\h3mbk4z2.dll
2017-07-15 17:17 - 2017-07-15 17:17 - 000011264 _____ ( ) C:\Users\Ecjev\AppData\Local\Temp\r2aultnk.dll
2017-06-20 19:31 - 2017-09-10 18:08 - 058881488 _____ (Skype Technologies S.A.) C:\Users\Ecjev\AppData\Local\Temp\SkypeSetup.exe
2017-04-16 17:07 - 2017-04-16 17:07 - 014456872 _____ (Microsoft Corporation) C:\Users\Ecjev\AppData\Local\Temp\vc_redist.x86.exe
2017-06-21 17:58 - 2017-06-21 17:58 - 030950664 _____ () C:\Users\Ecjev\AppData\Local\Temp\vlc-2.2.6-win32.exe
2017-07-15 17:55 - 2017-07-15 17:55 - 000011264 _____ ( ) C:\Users\Ecjev\AppData\Local\Temp\xyidubrf.dll
2017-07-15 17:53 - 2017-07-15 17:53 - 000011264 _____ ( ) C:\Users\Ecjev\AppData\Local\Temp\ycghseph.dll

==================== Bamital & volsnap ======================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\dnsapi.dll => File is digitally signed
C:\Windows\SysWOW64\dnsapi.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed

LastRegBack: 2017-09-14 20:36

==================== End of FRST.txt ============================
Přílohy
Addition.zip
(9.27 KiB) Staženo 57 x

Uživatelský avatar
Rudy
Site Admin
Site Admin
Příspěvky: 118192
Registrován: 30 říj 2003 13:42
Bydliště: Plzeň
Kontaktovat uživatele:

Re: Žádost o kontrolu logů

#7 Příspěvek od Rudy »

Otevřte poznámkový blok a zkopírujte do něj:
Start
HKU\S-1-5-21-58873803-3009850163-3451747300-1000\...\MountPoints2: {1bd35c76-3bd9-11e7-b9eb-303a64ce94ab} - F:\Autorun.exe
HKU\S-1-5-21-58873803-3009850163-3451747300-1000\...\MountPoints2: {1bd35c87-3bd9-11e7-b9eb-303a64ce94ab} - F:\Autorun.exe
GroupPolicy: Restriction <==== ATTENTION
FF Plugin: @microsoft.com/GENUINE -> disabled [No File]
FF Plugin-x32: @microsoft.com/GENUINE -> disabled [No File]
C:\ProgramData\DP45977C.lfl
C:\ProgramData\hpeD865.dll
C:\Users\Ecjev\AppData\Local\Temp

EmptyTemp:
End
Uložte na plochu jako fixlist.txt. Spusťte znovu FRST a klikněte na >Fix<. Po skončení akce se objeví log, který sem zkopírujte.
Dotazy a logy vkládejte pouze do vašich threadů. Soukromé zprávy, icq a e-maily neslouží k řešení vašich problémů.

Podpořte, prosím, naše fórum : https://platba.viry.cz/payment/.

Navštivte: Obrázek

e-mail: rudy(zavináč)forum.viry.cz

Varování:
Před odvirováním PC si udělejte zálohy svých důležitých dat (pošta, kontakty, dokumenty, fotografie, videa, hudba apod.). Virus mimo svých "viditelných" aktivit může poškodit systém!


Po dořešení vašeho problému bude vlákno zamknuto. Stejně tak tehdy, pokud bude nečinné více než 14dnů. Pokud budete chtít vlákno aktivovat, napište mi na mail uvedený výše.

vejce4444
Návštěvník
Návštěvník
Příspěvky: 47
Registrován: 23 říj 2012 10:24

Re: Žádost o kontrolu logů

#8 Příspěvek od vejce4444 »

Dobrý večer zde je log:

Fix result of Farbar Recovery Scan Tool (x64) Version: 20-09-2017
Ran by Ecjev (22-09-2017 19:46:56) Run:1
Running from C:\Users\Ecjev\Desktop
Loaded Profiles: Ecjev (Available Profiles: Ecjev)
Boot Mode: Normal
==============================================

fixlist content:
*****************
Start
HKU\S-1-5-21-58873803-3009850163-3451747300-1000\...\MountPoints2: {1bd35c76-3bd9-11e7-b9eb-303a64ce94ab} - F:\Autorun.exe
HKU\S-1-5-21-58873803-3009850163-3451747300-1000\...\MountPoints2: {1bd35c87-3bd9-11e7-b9eb-303a64ce94ab} - F:\Autorun.exe
GroupPolicy: Restriction <==== ATTENTION
FF Plugin: @microsoft.com/GENUINE -> disabled [No File]
FF Plugin-x32: @microsoft.com/GENUINE -> disabled [No File]
C:\ProgramData\DP45977C.lfl
C:\ProgramData\hpeD865.dll
C:\Users\Ecjev\AppData\Local\Temp

EmptyTemp:
End
*****************

HKU\S-1-5-21-58873803-3009850163-3451747300-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{1bd35c76-3bd9-11e7-b9eb-303a64ce94ab} => key removed successfully
HKLM\Software\Classes\CLSID\{1bd35c76-3bd9-11e7-b9eb-303a64ce94ab} => key not found.
HKU\S-1-5-21-58873803-3009850163-3451747300-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{1bd35c87-3bd9-11e7-b9eb-303a64ce94ab} => key removed successfully
HKLM\Software\Classes\CLSID\{1bd35c87-3bd9-11e7-b9eb-303a64ce94ab} => key not found.
C:\Windows\system32\GroupPolicy\Machine => moved successfully
C:\Windows\system32\GroupPolicy\GPT.ini => moved successfully
C:\Windows\SysWOW64\GroupPolicy\GPT.ini => moved successfully
HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE => key removed successfully
HKLM\Software\Wow6432Node\MozillaPlugins\@microsoft.com/GENUINE => key removed successfully
C:\ProgramData\DP45977C.lfl => moved successfully
C:\ProgramData\hpeD865.dll => moved successfully

"C:\Users\Ecjev\AppData\Local\Temp" folder move:

Could not move "C:\Users\Ecjev\AppData\Local\Temp" => Scheduled to move on reboot.


=========== EmptyTemp: ==========

BITS transfer queue => 8388608 B
DOMStore, IE Recovery, AppCache, Feeds Cache, Thumbcache, IconCache => 187654290 B
Java, Flash, Steam htmlcache => 379918415 B
Windows/system/drivers => 389993788 B
Edge => 0 B
Chrome => 0 B
Firefox => 407385265 B
Opera => 0 B

Temp, IE cache, history, cookies, recent:
Users => 0 B
Default => 0 B
Public => 0 B
ProgramData => 0 B
systemprofile => 0 B
systemprofile32 => 128 B
LocalService => 0 B
NetworkService => 126244 B
Ecjev => 6005384715 B

RecycleBin => 2071436390 B
EmptyTemp: => 8.8 GB temporary data Removed.

================================

Result of scheduled files to move (Boot Mode: Normal) (Date&Time: 22-09-2017 19:47:57)

C:\Users\Ecjev\AppData\Local\Temp => moved successfully

==== End of Fixlog 19:47:57 ====

Uživatelský avatar
Rudy
Site Admin
Site Admin
Příspěvky: 118192
Registrován: 30 říj 2003 13:42
Bydliště: Plzeň
Kontaktovat uživatele:

Re: Žádost o kontrolu logů

#9 Příspěvek od Rudy »

Smazáno. Log by již měl být OK.
Dotazy a logy vkládejte pouze do vašich threadů. Soukromé zprávy, icq a e-maily neslouží k řešení vašich problémů.

Podpořte, prosím, naše fórum : https://platba.viry.cz/payment/.

Navštivte: Obrázek

e-mail: rudy(zavináč)forum.viry.cz

Varování:
Před odvirováním PC si udělejte zálohy svých důležitých dat (pošta, kontakty, dokumenty, fotografie, videa, hudba apod.). Virus mimo svých "viditelných" aktivit může poškodit systém!


Po dořešení vašeho problému bude vlákno zamknuto. Stejně tak tehdy, pokud bude nečinné více než 14dnů. Pokud budete chtít vlákno aktivovat, napište mi na mail uvedený výše.

vejce4444
Návštěvník
Návštěvník
Příspěvky: 47
Registrován: 23 říj 2012 10:24

Re: Žádost o kontrolu logů

#10 Příspěvek od vejce4444 »

Dobrý den,

to je skvělé, můžeme se ještě vrhnout na druhy log prosím? :) Děkuji ještě jednou za kontrolu předchozího.

Uživatelský avatar
Rudy
Site Admin
Site Admin
Příspěvky: 118192
Registrován: 30 říj 2003 13:42
Bydliště: Plzeň
Kontaktovat uživatele:

Re: Žádost o kontrolu logů

#11 Příspěvek od Rudy »

Jistě. Spusťte tuto utilitu:
Stáhněte AdwCleaner https://toolslib.net/downloads/viewdown ... dwcleaner/
Uložte na plochu
Ukončete všechny programy
Klikněte nejprve na >Scan<(hledání) a pak na >Clean< (mazání).
Proběhne skenováni a pak se objeví log, který sem vložte.
Dotazy a logy vkládejte pouze do vašich threadů. Soukromé zprávy, icq a e-maily neslouží k řešení vašich problémů.

Podpořte, prosím, naše fórum : https://platba.viry.cz/payment/.

Navštivte: Obrázek

e-mail: rudy(zavináč)forum.viry.cz

Varování:
Před odvirováním PC si udělejte zálohy svých důležitých dat (pošta, kontakty, dokumenty, fotografie, videa, hudba apod.). Virus mimo svých "viditelných" aktivit může poškodit systém!


Po dořešení vašeho problému bude vlákno zamknuto. Stejně tak tehdy, pokud bude nečinné více než 14dnů. Pokud budete chtít vlákno aktivovat, napište mi na mail uvedený výše.

Odpovědět