kontrola
Napsal: 17 říj 2018 15:47
Prosím o kontrolu
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 10.10.2018
Ran by 60352 (17-10-2018 16:44:28)
Running from C:\Users\60352\Desktop
Windows 10 Home Version 1803 17134.286 (X64) (2018-07-25 11:43:35)
Boot Mode: Normal
==========================================================
==================== Accounts: =============================
60352 (S-1-5-21-1438566064-2572893099-2627160239-1001 - Administrator - Enabled) => C:\Users\60352
Administrator (S-1-5-21-1438566064-2572893099-2627160239-500 - Administrator - Disabled)
DefaultAccount (S-1-5-21-1438566064-2572893099-2627160239-503 - Limited - Disabled)
defaultuser0 (S-1-5-21-1438566064-2572893099-2627160239-1000 - Limited - Disabled) => C:\Users\defaultuser0
Guest (S-1-5-21-1438566064-2572893099-2627160239-501 - Limited - Disabled)
WDAGUtilityAccount (S-1-5-21-1438566064-2572893099-2627160239-504 - Limited - Disabled)
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AV: ESET Security (Enabled - Up to date) {EC1D6F37-E411-475A-DF50-12FF7FE4AC70}
AS: ESET Security (Enabled - Up to date) {577C8ED3-C22B-48D4-E5E0-298D0463E6CD}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
FW: ESET Firewall (Enabled) {D426EE12-AE7E-4602-F40F-BBCA8137EB0B}
==================== Installed Programs ======================
(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
Adobe Acrobat Reader DC - Czech (HKLM-x32\...\{AC76BA86-7AD7-1029-7B44-AC0F074E4100}) (Version: 19.008.20074 - Adobe Systems Incorporated)
CCleaner (HKLM\...\CCleaner) (Version: 5.46 - Piriform)
ESET Security (HKLM\...\{0813F772-F554-4DA9-9CEA-ABCE6321BDFD}) (Version: 11.2.63.0 - ESET, spol. s r.o.)
Intel(R) Chipset Device Software (HKLM-x32\...\{fb610cea-ba50-4d4b-a717-cf025419035c}) (Version: 10.1.1.13 - Intel(R) Corporation) Hidden
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 20.19.15.4531 - Intel Corporation)
Lenovo App Explorer (HKU\S-1-5-19\...\Host App Service) (Version: 0.271.1.400 - SweetLabs for Lenovo) <==== ATTENTION
Lenovo App Explorer (HKU\S-1-5-20\...\Host App Service) (Version: 0.271.1.400 - SweetLabs for Lenovo) <==== ATTENTION
Lenovo OneKey Recovery (HKLM\...\{46F4D124-20E5-4D12-BE52-EC177A7A4B42}) (Version: 8.1.0.4706 - CyberLink Corp.) Hidden
Lenovo OneKey Recovery (HKLM-x32\...\InstallShield_{46F4D124-20E5-4D12-BE52-EC177A7A4B42}) (Version: 8.1.0.4706 - CyberLink Corp.)
Lenovo Photo Master (HKLM-x32\...\{BC94C56A-3649-420C-8756-2ADEBE399D33}) (Version: 2.1.5222.01 - CyberLink Corp.)
Lenovo PowerDVD12 (HKLM-x32\...\{B46BEA36-0B71-4A4E-AE41-87241643FA0A}) (Version: 12.0.5709.60 - CyberLink Corp.) Hidden
Lenovo PowerDVD12 (HKLM-x32\...\InstallShield_{B46BEA36-0B71-4A4E-AE41-87241643FA0A}) (Version: 12.0.5709.60 - CyberLink Corp.)
LenovoUtility (HKLM-x32\...\{6ADA7E88-8D16-4D0D-BC90-2B93AC5E56DA}) (Version: 3.0.0.4 - Lenovo) Hidden
LenovoUtility (HKLM-x32\...\InstallShield_{6ADA7E88-8D16-4D0D-BC90-2B93AC5E56DA}) (Version: 3.0.0.4 - Lenovo)
LibreOffice 6.1.0.3 (HKLM\...\{DD50CAE9-27C5-452F-A910-1E7A00D8EEE2}) (Version: 6.1.0.3 - The Document Foundation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (HKLM-x32\...\{050d4fc8-5d48-4b8f-8972-47c82c46020f}) (Version: 12.0.30501.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 (HKLM-x32\...\{f65db027-aff3-4070-886a-0d87064aabb1}) (Version: 12.0.30501.0 - Microsoft Corporation)
Opera Stable 56.0.3051.43 (HKLM-x32\...\Opera 56.0.3051.43) (Version: 56.0.3051.43 - Opera Software)
Qualcomm Atheros 11ac Wireless LAN Installer (HKLM-x32\...\{20CA507E-24AA-4741-87CF-CC1B250790B7}) (Version: 11.0.10374 - Qualcomm Atheros)
Qualcomm Atheros Bluetooth Installer (64) (HKLM\...\{628988B4-3FA5-4EA6-BAA3-DA640F6718BD}) (Version: 10.0.0.260 - Qualcomm Atheros)
Realtek Card Reader (HKLM-x32\...\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}) (Version: 10.0.10586.31225 - Realtek Semiconductor Corp.)
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 10.6.1001.2015 - Realtek)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7738 - Realtek Semiconductor Corp.)
Update for Windows 10 for x64-based Systems (KB4023057) (HKLM\...\{479E8CC7-CD68-4EB4-BB04-34A5C2C74102}) (Version: 2.46.0.0 - Microsoft Corporation)
UpdateAssistant (HKLM-x32\...\{B7AFAF92-D1C8-49A0-B34A-B5DAF9C9D5C6}) (Version: 1.9.0.0 - Microsoft Corporation) Hidden
VLC media player (HKLM\...\VLC media player) (Version: 3.0.4 - VideoLAN)
==================== Custom CLSID (Whitelisted): ==========================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
ContextMenuHandlers1: [ESET Security Shell] -> {B089FE88-FB52-11D3-BDF1-0050DA34150D} => C:\Program Files\ESET\ESET Security\shellExt.dll [2018-09-04] (ESET)
ContextMenuHandlers2: [ESET Security Shell] -> {B089FE88-FB52-11D3-BDF1-0050DA34150D} => C:\Program Files\ESET\ESET Security\shellExt.dll [2018-09-04] (ESET)
ContextMenuHandlers5: [igfxcui] -> {3AB1675A-CCFF-11D2-8B20-00A0C93CB1F4} => -> No File
ContextMenuHandlers5: [igfxDTCM] -> {9B5F5829-A529-4B12-814A-E81BCB8D93FC} => C:\WINDOWS\system32\igfxDTCM.dll [2016-11-02] (Intel Corporation)
ContextMenuHandlers6: [ESET Security Shell] -> {B089FE88-FB52-11D3-BDF1-0050DA34150D} => C:\Program Files\ESET\ESET Security\shellExt.dll [2018-09-04] (ESET)
==================== Scheduled Tasks (Whitelisted) =============
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
Task: {0B8FAE09-CC44-405F-A1E8-DBD89AAA1D9F} - System32\Tasks\Microsoft\Windows\Setup\Notifier => C:\WINDOWS\system32\Notifier.exe
Task: {3364776C-569F-4C0B-888A-8B4A489829C1} - System32\Tasks\Lenovo\ImController\Lenovo iM Controller Monitor => C:\WINDOWS\system32\ImController.InfInstaller.exe [2018-05-16] (Lenovo Group Limited)
Task: {4603386B-6140-4D95-A181-F1432AD91CCC} - System32\Tasks\Lenovo\ImController\TimeBasedEvents\d725cafd-c768-4aa3-99eb-0eed57ef72a6 => C:\Program Files\Lenovo\ImController\Service\Lenovo.Modern.ImController.exe [2018-05-16] (Lenovo Group Limited)
Task: {4D3325EB-37E4-4EA4-B00C-D694178D2AE2} - System32\Tasks\Lenovo\ImController\TimeBasedEvents\f63e8105-d075-453b-8b86-5c378f67ca4e => C:\Program Files\Lenovo\ImController\Service\Lenovo.Modern.ImController.exe [2018-05-16] (Lenovo Group Limited)
Task: {53DDAF71-6A8D-4939-9C5D-B87AB9D3D9FB} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2018-08-14] (Adobe Systems Incorporated)
Task: {65B85F6F-35B3-4459-A179-28255D5B7B25} - System32\Tasks\Microsoft\Windows\HelloFace\FODCleanupTask => C:\WINDOWS\System32\WinBioPlugIns\FaceFodUninstaller.exe [2018-04-12] ()
Task: {7188557F-4F02-47EB-AAFE-354966E22C0F} - System32\Tasks\Lenovo\ImController\Plugins\LenovoSystemUpdatePlugin_WeeklyTask => %windir%\System32\reg.exe add hklm\SOFTWARE\Lenovo\SystemUpdatePlugin\scheduler /v start /t reg_dword /d 1 /f /reg:32
Task: {790D079F-CC4E-4924-AD3C-E98007EE5DA7} - System32\Tasks\Opera scheduled Autoupdate 1513235940 => C:\Program Files\Opera\launcher.exe [2018-10-10] (Opera Software)
Task: {7E6E041B-F30E-4046-A856-8BC7620A47E1} - \Microsoft\Windows\UNP\RunCampaignManager -> No File <==== ATTENTION
Task: {82A0BBDE-6C88-43EB-8473-82016E563B01} - System32\Tasks\Lenovo\ImController\TimeBasedEvents\185e519a-2dc1-4a3b-b2f3-4d7ac75e23df => C:\Program Files\Lenovo\ImController\Service\Lenovo.Modern.ImController.exe [2018-05-16] (Lenovo Group Limited)
Task: {94B5228C-46B9-4409-9CA4-EDB0AA231E7E} - System32\Tasks\Lenovo\ImController\TimeBasedEvents\0b6877b4-22b9-45bf-80c3-9d8a784e13f7 => C:\Program Files\Lenovo\ImController\Service\Lenovo.Modern.ImController.exe [2018-05-16] (Lenovo Group Limited)
Task: {A870C2F2-52F0-4FD4-8631-28EBED587DBB} - System32\Tasks\CCleaner Update => C:\Program Files\CCleaner\CCUpdate.exe [2018-08-24] (Piriform Ltd)
Task: {DA7D0981-58CC-4AC4-AAFC-78C8743E7C60} - System32\Tasks\CyberLink\Photo Master Gadget startup => C:\Program Files (x86)\Lenovo\Lenovo Photo Master\PhotoMasterWorker.exe [2016-04-22] (CyberLink Corp.)
Task: {FE45ED4B-C8EF-4D48-9B97-C6C569CC37DE} - System32\Tasks\Lenovo\ImController\Lenovo iM Controller Scheduled Maintenance => %windir%\system32\sc.exe START ImControllerService
(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)
==================== Shortcuts & WMI ========================
(The entries could be listed to be restored or removed.)
==================== Loaded Modules (Whitelisted) ==============
2018-04-12 01:34 - 2018-04-12 01:34 - 000491744 _____ () C:\Windows\System32\InputHost.dll
2016-11-02 00:05 - 2016-11-02 00:05 - 000401896 _____ () C:\WINDOWS\system32\igfxTray.exe
2018-04-12 01:34 - 2018-04-12 01:34 - 000472064 _____ () C:\Windows\ShellExperiences\TileControl.dll
2018-04-12 01:34 - 2018-04-12 01:34 - 002759168 _____ () C:\Windows\ShellComponents\TaskFlowUI.dll
2018-09-24 08:32 - 2018-09-15 04:17 - 002185728 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.Core.dll
2018-10-16 14:51 - 2018-10-16 14:51 - 104143960 _____ () C:\Program Files\Opera\56.0.3051.43\opera_browser.dll
2018-10-16 14:51 - 2018-10-16 14:51 - 005082200 _____ () C:\Program Files\Opera\56.0.3051.43\libglesv2.dll
2018-10-16 14:51 - 2018-10-16 14:51 - 000116824 _____ () C:\Program Files\Opera\56.0.3051.43\libegl.dll
==================== Alternate Data Streams (Whitelisted) =========
(If an entry is included in the fixlist, only the ADS will be removed.)
==================== Safe Mode (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\McMPFSvc => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MCODS => ""="Service"
==================== Association (Whitelisted) ===============
(If an entry is included in the fixlist, the registry item will be restored to default or removed.)
==================== Internet Explorer trusted/restricted ===============
(If an entry is included in the fixlist, it will be removed from the registry.)
==================== Hosts content: ===============================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2016-07-16 13:47 - 2016-07-16 13:45 - 000000824 _____ C:\WINDOWS\system32\Drivers\etc\hosts
==================== Other Areas ============================
(Currently there is no automatic fix for this section.)
HKU\S-1-5-21-1438566064-2572893099-2627160239-1001\Control Panel\Desktop\\Wallpaper -> C:\Windows\Web\Wallpaper\Lenovo\LenovoWallPaper.jpg
DNS Servers: 8.8.8.8 - 1.1.1.1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer => (SmartScreenEnabled: RequireAdmin)
Windows Firewall is enabled.
==================== MSCONFIG/TASK MANAGER disabled items ==
If an entry is included in the fixlist, it will be removed.
HKLM\...\StartupApproved\Run: => "LenovoUtility"
HKLM\...\StartupApproved\Run: => "RTHDVCPL"
HKLM\...\StartupApproved\Run: => "RtHDVBg_LENOVO_DOLBYDRAGON"
HKLM\...\StartupApproved\Run: => "RtHDVBg_LENOVO_MICPKEY"
HKLM\...\StartupApproved\Run32: => "CLMLServer_For_P2G8"
HKLM\...\StartupApproved\Run32: => "CLVirtualDrive"
==================== FirewallRules (Whitelisted) ===============
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
FirewallRules: [{08446500-E961-46D7-8DCC-41EC167C1BF5}] => (Allow) C:\Program Files (x86)\Lenovo\Lenovo Photo Master\subsys\AdvPhotoEditor\PhotoDirector5.exe
FirewallRules: [{299A0AE4-54D8-4A0F-A7E0-8186D54A2448}] => (Allow) C:\Program Files\CCleaner\CCUpdate.exe
FirewallRules: [{FA6927DE-8053-4F8D-A9B0-8AD6C68F53B3}] => (Allow) C:\Program Files\CCleaner\CCUpdate.exe
FirewallRules: [{8AF28333-3D6E-4607-BD7A-E6EB7FF6A6A4}] => (Allow) C:\Program Files\Opera\56.0.3051.36\opera.exe
FirewallRules: [{96531FEC-563D-4180-A27A-BBB4CFB85833}] => (Allow) C:\Program Files\Opera\56.0.3051.43\opera.exe
==================== Restore Points =========================
05-10-2018 14:17:57 Windows Update
10-10-2018 09:24:01 Windows Update
==================== Faulty Device Manager Devices =============
Name: EasyCamera
Description: EasyCamera
Class Guid: {6bdd1fc6-810f-11d0-bec7-08002be2092f}
Manufacturer: Azurewave
Service: rtsuvc
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.
==================== Event log errors: =========================
Application errors:
==================
Error: (10/17/2018 04:39:18 PM) (Source: Microsoft-Windows-SpellChecker) (EventID: 33) (User: LAPTOP-PHGDM54V)
Description: httphttp-2147467263
Error: (10/05/2018 02:34:31 PM) (Source: Microsoft-Windows-SpellChecker) (EventID: 33) (User: LAPTOP-PHGDM54V)
Description: httphttp-2147467263
Error: (10/05/2018 02:24:58 PM) (Source: Microsoft-Windows-SpellChecker) (EventID: 33) (User: LAPTOP-PHGDM54V)
Description: httphttp-2147467263
Error: (08/22/2018 07:26:11 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Název chybující aplikace: CCSDK.exe, verze: 1.3.0.3, časové razítko: 0x56ef5fb7
Název chybujícího modulu: CCSDK.exe, verze: 1.3.0.3, časové razítko: 0x56ef5fb7
Kód výjimky: 0xc0000005
Posun chyby: 0x000137d9
ID chybujícího procesu: 0x1764
Čas spuštění chybující aplikace: 0x01d43a3d07129f7f
Cesta k chybující aplikaci: C:\Program Files (x86)\Lenovo\CCSDK\CCSDK.exe
Cesta k chybujícímu modulu: C:\Program Files (x86)\Lenovo\CCSDK\CCSDK.exe
ID zprávy: a3fb60dc-adf3-427c-a25c-45e6d852f3fb
Úplný název chybujícího balíčku:
ID aplikace související s chybujícím balíčkem:
Error: (08/20/2018 05:19:23 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Název chybující aplikace: SettingSyncHost.exe, verze: 10.0.17134.1, časové razítko: 0x60b0bd37
Název chybujícího modulu: OneDriveSettingSyncProvider.dll, verze: 10.0.17134.1, časové razítko: 0x84e6685e
Kód výjimky: 0xc0000409
Posun chyby: 0x000000000006588e
ID chybujícího procesu: 0x22b4
Čas spuštění chybující aplikace: 0x01d430c09c91306d
Cesta k chybující aplikaci: C:\WINDOWS\system32\SettingSyncHost.exe
Cesta k chybujícímu modulu: C:\Windows\System32\OneDriveSettingSyncProvider.dll
ID zprávy: 973f4e8c-5ded-4415-9df3-b41bed9a8130
Úplný název chybujícího balíčku:
ID aplikace související s chybujícím balíčkem:
Error: (08/10/2018 05:42:10 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Název chybující aplikace: CCSDK.exe, verze: 1.3.0.3, časové razítko: 0x56ef5fb7
Název chybujícího modulu: CCSDK.exe, verze: 1.3.0.3, časové razítko: 0x56ef5fb7
Kód výjimky: 0xc0000005
Posun chyby: 0x000137d9
ID chybujícího procesu: 0xca0
Čas spuštění chybující aplikace: 0x01d430c082ebc3d8
Cesta k chybující aplikaci: C:\Program Files (x86)\Lenovo\CCSDK\CCSDK.exe
Cesta k chybujícímu modulu: C:\Program Files (x86)\Lenovo\CCSDK\CCSDK.exe
ID zprávy: 50c9356c-3af4-430c-8c4b-0c84ab05882c
Úplný název chybujícího balíčku:
ID aplikace související s chybujícím balíčkem:
Error: (08/10/2018 05:33:53 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Název chybující aplikace: svchost.exe_UsoSvc, verze: 10.0.17134.1, časové razítko: 0xa38b9ab2
Název chybujícího modulu: wuaueng.dll, verze: 10.0.17134.112, časové razítko: 0x16019f1b
Kód výjimky: 0xc0000005
Posun chyby: 0x000000000011241f
ID chybujícího procesu: 0x8e0
Čas spuštění chybující aplikace: 0x01d4240a9a0c5c67
Cesta k chybující aplikaci: c:\windows\system32\svchost.exe
Cesta k chybujícímu modulu: c:\windows\system32\wuaueng.dll
ID zprávy: f6b364da-f049-42e8-8ec1-ba070cce19b3
Úplný název chybujícího balíčku:
ID aplikace související s chybujícím balíčkem:
Error: (08/10/2018 05:18:17 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Název chybující aplikace: svchost.exe_WpnUserService, verze: 10.0.17134.1, časové razítko: 0xa38b9ab2
Název chybujícího modulu: NotificationController.dll, verze: 10.0.17134.1, časové razítko: 0x498118f8
Kód výjimky: 0xc0000005
Posun chyby: 0x000000000007a25d
ID chybujícího procesu: 0x3040
Čas spuštění chybující aplikace: 0x01d4295e8866cd12
Cesta k chybující aplikaci: C:\WINDOWS\system32\svchost.exe
Cesta k chybujícímu modulu: C:\Windows\System32\NotificationController.dll
ID zprávy: e2acfbeb-9c51-43f1-8893-3e30107ec49c
Úplný název chybujícího balíčku:
ID aplikace související s chybujícím balíčkem:
System errors:
=============
Error: (10/17/2018 04:30:05 PM) (Source: DCOM) (EventID: 10016) (User: LAPTOP-PHGDM54V)
Description: Nastavení oprávnění application-specific neuděluje oprávnění Local Activation pro serverovou aplikaci COM s identifikátorem CLSID
{D63B10C5-BB46-4990-A94F-E40B9D520160}
a APPID
{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}
uživateli LAPTOP-PHGDM54V\60352 (SID: S-1-5-21-1438566064-2572893099-2627160239-1001) z adresy LocalHost (Using LRPC) běžící v kontejneru aplikací Unavailable – SID (Unavailable). Toto oprávnění zabezpečení lze změnit pomocí nástroje správy Služba komponent.
Error: (10/17/2018 02:14:15 PM) (Source: DCOM) (EventID: 10016) (User: LAPTOP-PHGDM54V)
Description: Nastavení oprávnění application-specific neuděluje oprávnění Local Activation pro serverovou aplikaci COM s identifikátorem CLSID
{D63B10C5-BB46-4990-A94F-E40B9D520160}
a APPID
{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}
uživateli LAPTOP-PHGDM54V\60352 (SID: S-1-5-21-1438566064-2572893099-2627160239-1001) z adresy LocalHost (Using LRPC) běžící v kontejneru aplikací Unavailable – SID (Unavailable). Toto oprávnění zabezpečení lze změnit pomocí nástroje správy Služba komponent.
Error: (10/16/2018 02:50:52 PM) (Source: DCOM) (EventID: 10016) (User: LAPTOP-PHGDM54V)
Description: Nastavení oprávnění application-specific neuděluje oprávnění Local Activation pro serverovou aplikaci COM s identifikátorem CLSID
{D63B10C5-BB46-4990-A94F-E40B9D520160}
a APPID
{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}
uživateli LAPTOP-PHGDM54V\60352 (SID: S-1-5-21-1438566064-2572893099-2627160239-1001) z adresy LocalHost (Using LRPC) běžící v kontejneru aplikací Unavailable – SID (Unavailable). Toto oprávnění zabezpečení lze změnit pomocí nástroje správy Služba komponent.
Error: (10/11/2018 06:15:30 PM) (Source: DCOM) (EventID: 10016) (User: LAPTOP-PHGDM54V)
Description: Nastavení oprávnění application-specific neuděluje oprávnění Local Activation pro serverovou aplikaci COM s identifikátorem CLSID
{D63B10C5-BB46-4990-A94F-E40B9D520160}
a APPID
{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}
uživateli LAPTOP-PHGDM54V\60352 (SID: S-1-5-21-1438566064-2572893099-2627160239-1001) z adresy LocalHost (Using LRPC) běžící v kontejneru aplikací Unavailable – SID (Unavailable). Toto oprávnění zabezpečení lze změnit pomocí nástroje správy Služba komponent.
Error: (10/10/2018 09:03:53 AM) (Source: DCOM) (EventID: 10016) (User: LAPTOP-PHGDM54V)
Description: Nastavení oprávnění application-specific neuděluje oprávnění Local Activation pro serverovou aplikaci COM s identifikátorem CLSID
{D63B10C5-BB46-4990-A94F-E40B9D520160}
a APPID
{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}
uživateli LAPTOP-PHGDM54V\60352 (SID: S-1-5-21-1438566064-2572893099-2627160239-1001) z adresy LocalHost (Using LRPC) běžící v kontejneru aplikací Unavailable – SID (Unavailable). Toto oprávnění zabezpečení lze změnit pomocí nástroje správy Služba komponent.
Error: (10/05/2018 02:40:34 PM) (Source: DCOM) (EventID: 10016) (User: LAPTOP-PHGDM54V)
Description: Nastavení oprávnění application-specific neuděluje oprávnění Local Activation pro serverovou aplikaci COM s identifikátorem CLSID
{D63B10C5-BB46-4990-A94F-E40B9D520160}
a APPID
{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}
uživateli LAPTOP-PHGDM54V\60352 (SID: S-1-5-21-1438566064-2572893099-2627160239-1001) z adresy LocalHost (Using LRPC) běžící v kontejneru aplikací Unavailable – SID (Unavailable). Toto oprávnění zabezpečení lze změnit pomocí nástroje správy Služba komponent.
Error: (10/05/2018 02:38:51 PM) (Source: DCOM) (EventID: 10010) (User: LAPTOP-PHGDM54V)
Description: Server {D63B10C5-BB46-4990-A94F-E40B9D520160} se v daném časovém limitu neregistroval u služby DCOM.
Error: (10/05/2018 02:35:48 PM) (Source: DCOM) (EventID: 10016) (User: LAPTOP-PHGDM54V)
Description: Nastavení oprávnění application-specific neuděluje oprávnění Local Activation pro serverovou aplikaci COM s identifikátorem CLSID
{D63B10C5-BB46-4990-A94F-E40B9D520160}
a APPID
{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}
uživateli LAPTOP-PHGDM54V\60352 (SID: S-1-5-21-1438566064-2572893099-2627160239-1001) z adresy LocalHost (Using LRPC) běžící v kontejneru aplikací Unavailable – SID (Unavailable). Toto oprávnění zabezpečení lze změnit pomocí nástroje správy Služba komponent.
Windows Defender:
===================================
Date: 2018-08-30 09:46:53.798
Description:
Prohledávání Antivirová ochrana v programu Windows Defender bylo zastaveno pred dokoncením.
ID prohledávání: {0719BA39-C7EE-4D14-8B68-93D16505E782}
Typ prohledávání: Antimalwarový program
Parametry prohledávání: Rychlé prohledávání
Uživatel: NT AUTHORITY\SYSTEM
Date: 2018-08-22 19:15:20.062
Description:
Prohledávání Antivirová ochrana v programu Windows Defender bylo zastaveno pred dokoncením.
ID prohledávání: {92838CA7-A1AE-4B42-9E45-F80E5D3AE4E2}
Typ prohledávání: Antimalwarový program
Parametry prohledávání: Rychlé prohledávání
Uživatel: NT AUTHORITY\SYSTEM
Date: 2018-08-15 17:26:33.100
Description:
Prohledávání Antivirová ochrana v programu Windows Defender bylo zastaveno pred dokoncením.
ID prohledávání: {A88E0095-D9AC-453A-B278-9B013DC84F98}
Typ prohledávání: Antimalwarový program
Parametry prohledávání: Rychlé prohledávání
Uživatel: NT AUTHORITY\SYSTEM
Date: 2018-08-10 17:33:50.414
Description:
Prohledávání Antivirová ochrana v programu Windows Defender bylo zastaveno pred dokoncením.
ID prohledávání: {F2AE4763-5D06-4D69-8902-0D18C98BB36B}
Typ prohledávání: Antimalwarový program
Parametry prohledávání: Rychlé prohledávání
Uživatel: NT AUTHORITY\SYSTEM
Date: 2018-08-10 08:05:16.451
Description:
Prohledávání Antivirová ochrana v programu Windows Defender bylo zastaveno pred dokoncením.
ID prohledávání: {36D008A2-BC68-4D65-87E9-B7603CFB5CF1}
Typ prohledávání: Antimalwarový program
Parametry prohledávání: Rychlé prohledávání
Uživatel: NT AUTHORITY\SYSTEM
Date: 2018-08-22 19:22:21.402
Description:
Prohledávání Antivirová ochrana v programu Windows Defender zjistilo chybu pri pokusu o nactení podpisu a pokusí se o obnovení sady podpisu, jejichž správnost je potvrzena.
Podpisy, které se mely nacíst: Aktuální
Kód chyby: 0x80070002
Popis chyby: The system cannot find the file specified.
Verze podpisu: 0.0.0.0;0.0.0.0
Verze modulu: 0.0.0.0
Date: 2018-08-22 18:58:03.152
Description:
Funkce Ochrana v reálném case u prohledávání Antivirová ochrana v programu Windows Defender zjistila chybu a došlo k jejímu selhání.
Funkce: Pri prístupu
Kód chyby: 0x80004005
Popis chyby: Unspecified error
Duvod: Ovladac filtru preskocil prohledávání položek a je v režimu pruchodu. Prícinou muže být nízký stav prostredku.
Date: 2018-08-22 17:41:20.617
Description:
Prohledávání Antivirová ochrana v programu Windows Defender zjistilo chybu pri pokusu o aktualizaci podpisu.
Nová verze podpisu:
Predchozí verze podpisu: 1.273.1826.0
Zdroj aktualizace: Server Microsoft Update
Typ podpisu: Antivirový program
Typ aktualizace: Úplné
Uživatel: NT AUTHORITY\SYSTEM
Aktuální verze modulu:
Predchozí verze modulu: 1.1.15100.1
Kód chyby: 0x80240016
Popis chyby :An unexpected problem occurred while checking for updates. For information on installing or troubleshooting updates, see Help and Support.
Date: 2018-08-04 18:37:39.351
Description:
Prohledávání Antivirová ochrana v programu Windows Defender zjistilo chybu pri pokusu o aktualizaci podpisu.
Nová verze podpisu:
Predchozí verze podpisu:
Zdroj aktualizace: Uživatel
Typ podpisu:
Typ aktualizace:
Uživatel: NT AUTHORITY\SYSTEM
Aktuální verze modulu:
Predchozí verze modulu:
Kód chyby: 0x80070652
Popis chyby :Another installation is already in progress. Complete that installation before proceeding with this install.
CodeIntegrity:
===================================
Date: 2018-09-11 17:22:55.115
Description:
Windows is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\drivers\wd\WdBoot.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.
==================== Memory info ===========================
Processor: Intel(R) Pentium(R) CPU N3710 @ 1.60GHz
Percentage of memory in use: 53%
Total physical RAM: 4009.14 MB
Available physical RAM: 1865.07 MB
Total Virtual: 4713.14 MB
Available Virtual: 2543.55 MB
==================== Drives ================================
Drive c: (Windows) (Fixed) (Total:887.17 GB) (Free:841.44 GB) NTFS
Drive d: (LENOVO) (Fixed) (Total:25 GB) (Free:23.65 GB) NTFS
\\?\Volume{44be0e24-1745-4e52-90fe-297b024c4204}\ (WINRE_DRV) (Fixed) (Total:0.98 GB) (Free:0.51 GB) NTFS
\\?\Volume{d1f12f51-767b-462b-bfac-23bded52704d}\ (LENOVO_PART) (Fixed) (Total:17.12 GB) (Free:6.63 GB) NTFS
\\?\Volume{74234a81-a499-4dd7-bc5b-2803ae0472e0}\ (SYSTEM_DRV) (Fixed) (Total:0.25 GB) (Free:0.22 GB) FAT32
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (Size: 931.5 GB) (Disk ID: B6C54A9C)
Partition: GPT.
==================== End of Addition.txt ============================
Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 10.10.2018
Ran by 60352 (administrator) on LAPTOP-PHGDM54V (17-10-2018 16:41:51)
Running from C:\Users\60352\Desktop
Loaded Profiles: 60352 (Available Profiles: defaultuser0 & 60352)
Platform: Windows 10 Home Version 1803 17134.286 (X64) Language: Angličtina (Spojené státy)
Internet Explorer Version 11 (Default browser: Opera)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/33 ... scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(ESET) C:\Program Files\ESET\ESET Security\ekrn.exe
(Intel Corporation) C:\Windows\System32\igfxCUIService.exe
(Windows (R) Win 7 DDK provider) C:\Program Files (x86)\Bluetooth Suite\AdminService.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\ImController\Service\Lenovo.Modern.ImController.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnhService.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Lenovo) C:\Program Files (x86)\Lenovo\GDCAgentSetupRed\GDCAgent.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Intel Corporation) C:\Windows\System32\igfxEM.exe
(Intel Corporation) C:\Windows\System32\igfxHK.exe
() C:\Windows\System32\igfxTray.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MSASCuiL.exe
(ESET) C:\Program Files\ESET\ESET Security\egui.exe
(Microsoft Corporation) C:\Windows\SystemApps\Microsoft.LockApp_cw5n1h2txyewy\LockApp.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Opera Software) C:\Program Files\Opera\56.0.3051.43\opera.exe
(Opera Software) C:\Program Files\Opera\56.0.3051.43\opera_crashreporter.exe
(Opera Software) C:\Program Files\Opera\56.0.3051.43\opera.exe
(Opera Software) C:\Program Files\Opera\56.0.3051.43\opera.exe
(Opera Software) C:\Program Files\Opera\56.0.3051.43\opera.exe
(Opera Software) C:\Program Files\Opera\56.0.3051.43\opera.exe
(Opera Software) C:\Program Files\Opera\56.0.3051.43\opera.exe
(Opera Software) C:\Program Files\Opera\56.0.3051.43\opera.exe
(Opera Software) C:\Program Files\Opera\56.0.3051.43\opera.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\ImController\PluginHost\Lenovo.Modern.ImController.PluginHost.Device.exe
(Microsoft Corporation) C:\Windows\System32\smartscreen.exe
==================== Registry (Whitelisted) ===========================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [SecurityHealth] => C:\Program Files\Windows Defender\MSASCuiL.exe [638872 2018-04-12] (Microsoft Corporation)
HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [16418560 2016-02-05] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg_LENOVO_DOLBYDRAGON] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1419008 2016-02-05] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg_LENOVO_MICPKEY] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1419008 2016-02-05] (Realtek Semiconductor)
HKLM\...\Run: [egui] => C:\Program Files\ESET\ESET Security\ecmds.exe [177928 2018-09-04] (ESET)
HKU\S-1-5-19\...\RunOnce: [WAB Migrate] => C:\Program Files\Windows Mail\wab.exe [518144 2018-04-12] (Microsoft Corporation)
HKU\S-1-5-20\...\RunOnce: [WAB Migrate] => C:\Program Files\Windows Mail\wab.exe [518144 2018-04-12] (Microsoft Corporation)
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
Tcpip\Parameters: [DhcpNameServer] 10.255.255.10 10.255.255.20
Tcpip\..\Interfaces\{288b6405-e1f4-44b8-8f25-b4cf8a452932}: [NameServer] 8.8.8.8,1.1.1.1
Tcpip\..\Interfaces\{288b6405-e1f4-44b8-8f25-b4cf8a452932}: [DhcpNameServer] 10.255.255.10 10.255.255.20
Tcpip\..\Interfaces\{d747dcff-956d-4bf5-8667-21f4e60f6913}: [DhcpNameServer] 150.212.1.2
Internet Explorer:
==================
HKU\S-1-5-21-1438566064-2572893099-2627160239-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://lenovo17win10.msn.com/?pc=LCTE
HKU\S-1-5-21-1438566064-2572893099-2627160239-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://lenovo17win10.msn.com/?pc=LCTE
HKU\S-1-5-21-1438566064-2572893099-2627160239-1001\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://mystart.lenovo.com
SearchScopes: HKU\S-1-5-21-1438566064-2572893099-2627160239-1001 -> DefaultScope {82FD5906-7444-4A2D-B0F3-73828A0F9C25} URL =
FireFox:
========
FF Plugin: @videolan.org/vlc,version=3.0.4 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2018-08-10] (VideoLAN)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2018-09-20] (Adobe Systems Inc.)
Opera:
=======
OPR StartupUrls: "hxxp://seznam.cz/"
==================== Services (Whitelisted) ====================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
R2 AtherosSvc; C:\Program Files (x86)\Bluetooth Suite\adminservice.exe [338312 2016-06-29] (Windows (R) Win 7 DDK provider)
R2 ekrn; C:\Program Files\ESET\ESET Security\ekrn.exe [2260144 2018-09-04] (ESET)
R3 ekrnEpfw; C:\Program Files\ESET\ESET Security\ekrn.exe [2260144 2018-09-04] (ESET)
R2 GDCAgent; C:\Program Files (x86)\Lenovo\GDCAgentSetupRed\GDCAgent.exe [1210352 2016-03-23] (Lenovo)
R2 igfxCUIService2.0.0.0; C:\WINDOWS\system32\igfxCUIService.exe [373744 2016-11-02] (Intel Corporation)
R2 ImControllerService; C:\Program Files\Lenovo\ImController\Service\Lenovo.Modern.ImController.exe [71408 2018-05-16] (Lenovo Group Limited)
S4 ssh-agent; C:\WINDOWS\System32\OpenSSH\ssh-agent.exe [495616 2018-03-10] ()
R2 SynTPEnhService; C:\Program Files\Synaptics\SynTP\SynTPEnhService.exe [276616 2018-03-14] (Synaptics Incorporated)
S3 WdNisSvc; C:\ProgramData\Microsoft\Windows Defender\platform\4.18.1807.18075-0\NisSrv.exe [3905952 2018-08-01] (Microsoft Corporation)
S3 WinDefend; C:\ProgramData\Microsoft\Windows Defender\platform\4.18.1807.18075-0\MsMpEng.exe [110944 2018-08-01] (Microsoft Corporation)
===================== Drivers (Whitelisted) ======================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
R1 eamonm; C:\WINDOWS\System32\DRIVERS\eamonm.sys [141512 2018-09-04] (ESET)
R0 edevmon; C:\WINDOWS\System32\DRIVERS\edevmon.sys [109232 2018-09-04] (ESET)
S0 eelam; C:\WINDOWS\System32\DRIVERS\eelam.sys [15872 2018-09-04] (ESET)
R1 ehdrv; C:\WINDOWS\system32\DRIVERS\ehdrv.sys [188824 2018-09-04] (ESET)
R2 ekbdflt; C:\WINDOWS\system32\DRIVERS\ekbdflt.sys [50144 2018-09-04] (ESET)
R1 epfw; C:\WINDOWS\system32\DRIVERS\epfw.sys [82304 2018-09-04] (ESET)
R1 epfwwfp; C:\WINDOWS\system32\DRIVERS\epfwwfp.sys [109864 2018-09-04] (ESET)
R3 igfxLP; C:\WINDOWS\system32\DRIVERS\igdkmd64lp.sys [7402992 2016-11-02] (Intel Corporation)
R3 rt640x64; C:\WINDOWS\System32\drivers\rt640x64.sys [935168 2016-01-22] (Realtek )
R3 RTSUER; C:\WINDOWS\system32\Drivers\RtsUer.sys [416472 2016-05-17] (Realsil Semiconductor Corporation)
S3 rtsuvc; C:\WINDOWS\system32\DRIVERS\rtsuvc.sys [3118848 2016-05-12] (Realtek Semiconductor Corp.)
R3 TXEIx64; C:\WINDOWS\System32\drivers\TXEIx64.sys [146200 2015-10-15] (Intel Corporation)
S3 WdBoot; C:\WINDOWS\system32\drivers\wd\WdBoot.sys [46584 2018-08-01] (Microsoft Corporation)
S3 WdFilter; C:\WINDOWS\system32\drivers\wd\WdFilter.sys [340008 2018-08-01] (Microsoft Corporation)
S3 WdNisDrv; C:\WINDOWS\System32\drivers\wd\WdNisDrv.sys [61992 2018-08-01] (Microsoft Corporation)
S3 wsvd; C:\WINDOWS\system32\DRIVERS\wsvd.sys [102376 2012-06-14] ("CyberLink)
==================== NetSvcs (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
==================== One Month Created files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2018-10-17 16:41 - 2018-10-17 16:43 - 000008307 _____ C:\Users\60352\Desktop\FRST.txt
2018-10-17 16:41 - 2018-10-17 16:41 - 000000000 ____D C:\FRST
2018-10-17 16:39 - 2018-10-17 16:40 - 002414592 _____ (Farbar) C:\Users\60352\Desktop\FRST64.exe
2018-10-05 14:25 - 2018-09-05 00:36 - 001476904 _____ (Microsoft Corporation) C:\WINDOWS\system32\mcupdate_GenuineIntel.dll
2018-09-24 09:10 - 2018-10-16 14:52 - 000003958 _____ C:\WINDOWS\System32\Tasks\Opera scheduled Autoupdate 1513235940
2018-09-24 08:32 - 2018-09-15 10:46 - 000344576 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iedkcs32.dll
2018-09-24 08:32 - 2018-09-15 10:32 - 000392192 _____ (Microsoft Corporation) C:\WINDOWS\system32\iedkcs32.dll
2018-09-24 08:32 - 2018-09-15 10:31 - 001364992 _____ (Microsoft Corporation) C:\WINDOWS\system32\bcastdvruserservice.dll
2018-09-24 08:32 - 2018-09-15 04:57 - 000272408 _____ (Microsoft Corporation) C:\WINDOWS\system32\SgrmEnclave.dll
2018-09-24 08:32 - 2018-09-15 04:56 - 000269320 _____ (Microsoft Corporation) C:\WINDOWS\system32\SgrmEnclave_secure.dll
2018-09-24 08:32 - 2018-09-15 04:51 - 001220920 _____ (Microsoft Corporation) C:\WINDOWS\system32\hvix64.exe
2018-09-24 08:32 - 2018-09-15 04:51 - 000076288 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\hvservice.sys
2018-09-24 08:32 - 2018-09-15 04:50 - 001029432 _____ (Microsoft Corporation) C:\WINDOWS\system32\hvax64.exe
2018-09-24 08:32 - 2018-09-15 04:50 - 000567080 _____ (Microsoft Corporation) C:\WINDOWS\system32\tcblaunch.exe
2018-09-24 08:32 - 2018-09-15 04:50 - 000134968 _____ (Microsoft Corporation) C:\WINDOWS\system32\hvloader.dll
2018-09-24 08:32 - 2018-09-15 04:49 - 009090064 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntoskrnl.exe
2018-09-24 08:32 - 2018-09-15 04:49 - 007519896 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.Protection.PlayReady.dll
2018-09-24 08:32 - 2018-09-15 04:49 - 001097760 _____ (Microsoft Corporation) C:\WINDOWS\system32\msvproc.dll
2018-09-24 08:32 - 2018-09-15 04:48 - 000885968 _____ (Microsoft Corporation) C:\WINDOWS\system32\CoreMessaging.dll
2018-09-24 08:32 - 2018-09-15 04:48 - 000713504 _____ (Microsoft Corporation) C:\WINDOWS\system32\MSVideoDSP.dll
2018-09-24 08:32 - 2018-09-15 04:33 - 006567984 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.Protection.PlayReady.dll
2018-09-24 08:32 - 2018-09-15 04:33 - 001129760 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msvproc.dll
2018-09-24 08:32 - 2018-09-15 04:33 - 000581808 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MSVideoDSP.dll
2018-09-24 08:32 - 2018-09-15 04:33 - 000567280 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\CoreMessaging.dll
2018-09-24 08:32 - 2018-09-15 04:33 - 000357064 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\bcryptprimitives.dll
2018-09-24 08:32 - 2018-09-15 04:20 - 001627136 _____ (Microsoft Corporation) C:\WINDOWS\system32\enterprisecsps.dll
2018-09-24 08:32 - 2018-09-15 04:19 - 004382720 _____ (Microsoft Corporation) C:\WINDOWS\system32\EdgeContent.dll
2018-09-24 08:32 - 2018-09-15 04:19 - 000154112 _____ (Microsoft Corporation) C:\WINDOWS\system32\Chakradiag.dll
2018-09-24 08:32 - 2018-09-15 04:17 - 007577088 _____ (Microsoft Corporation) C:\WINDOWS\system32\Chakra.dll
2018-09-24 08:32 - 2018-09-15 04:16 - 005777920 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Chakra.dll
2018-09-24 08:32 - 2018-09-15 02:59 - 000001310 _____ C:\WINDOWS\system32\tcbres.wim
==================== One Month Modified files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2018-10-17 16:29 - 2017-12-14 09:18 - 000000000 ____D C:\Program Files\Opera
2018-10-17 16:28 - 2018-07-25 13:11 - 000000000 ____D C:\WINDOWS\system32\SleepStudy
2018-10-17 15:39 - 2018-09-11 15:38 - 000004210 _____ C:\WINDOWS\System32\Tasks\CCleaner Update
2018-10-17 14:19 - 2018-04-12 01:38 - 000000000 ____D C:\WINDOWS\system32\NDF
2018-10-17 14:07 - 2018-04-12 01:36 - 000000000 ____D C:\WINDOWS\INF
2018-10-16 15:22 - 2018-04-12 01:30 - 000000000 ____D C:\WINDOWS\CbsTemp
2018-10-16 15:21 - 2018-04-12 01:38 - 000000000 ____D C:\ProgramData\regid.1991-06.com.microsoft
2018-10-16 14:56 - 2018-04-12 01:38 - 000000000 ___HD C:\Program Files\WindowsApps
2018-10-16 14:56 - 2018-04-12 01:38 - 000000000 ____D C:\WINDOWS\AppReadiness
2018-10-16 14:52 - 2017-12-14 09:19 - 000001085 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Prohlížeč Opera.lnk
2018-10-11 18:29 - 2017-12-08 03:00 - 000000000 ____D C:\WINDOWS\system32\MRT
2018-10-11 18:16 - 2017-12-08 03:00 - 136745976 ____C (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2018-10-10 09:16 - 2018-07-25 19:36 - 000000000 ____D C:\ProgramData\Packages
2018-10-10 09:15 - 2017-12-08 09:52 - 000000000 ____D C:\Users\60352\AppData\Local\Packages
2018-10-10 09:08 - 2018-09-11 15:48 - 000002457 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acrobat Reader DC.lnk
2018-10-05 14:44 - 2017-11-01 19:00 - 000000000 ____D C:\Users\60352\AppData\Local\ConnectedDevicesPlatform
2018-10-05 14:38 - 2017-11-01 19:00 - 000000000 __SHD C:\Users\60352\IntelGraphicsProfiles
2018-10-05 14:38 - 2017-11-01 17:23 - 000000180 _____ C:\WINDOWS\system32\{A6D608F0-0BDE-491A-97AE-5C4B05D86E01}.bat
2018-10-05 14:33 - 2018-07-25 13:42 - 000000006 ____H C:\WINDOWS\Tasks\SA.DAT
2018-10-05 14:31 - 2018-04-11 23:04 - 000524288 _____ C:\WINDOWS\system32\config\BBI
2018-10-05 14:13 - 2018-09-11 15:48 - 000004562 _____ C:\WINDOWS\System32\Tasks\Adobe Acrobat Update Task
2018-10-05 13:56 - 2018-07-25 13:11 - 000571440 _____ C:\WINDOWS\system32\FNTCACHE.DAT
2018-10-05 13:53 - 2018-04-12 01:38 - 000000000 ____D C:\WINDOWS\TextInput
2018-10-05 13:53 - 2018-04-12 01:38 - 000000000 ____D C:\WINDOWS\SysWOW64\Dism
2018-10-05 13:52 - 2018-04-12 01:38 - 000000000 ____D C:\WINDOWS\system32\oobe
2018-10-05 13:52 - 2018-04-12 01:38 - 000000000 ____D C:\WINDOWS\bcastdvr
2018-10-05 13:52 - 2018-04-11 23:04 - 000000000 ____D C:\WINDOWS\system32\Dism
2018-10-02 22:13 - 2018-08-10 17:39 - 000835152 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe
2018-10-02 22:13 - 2018-08-10 17:39 - 000179792 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl
==================== Bamital & volsnap ======================
(There is no automatic fix for files that do not pass verification.)
C:\WINDOWS\system32\winlogon.exe => File is digitally signed
C:\WINDOWS\system32\wininit.exe => File is digitally signed
C:\WINDOWS\explorer.exe => File is digitally signed
C:\WINDOWS\SysWOW64\explorer.exe => File is digitally signed
C:\WINDOWS\system32\svchost.exe => File is digitally signed
C:\WINDOWS\SysWOW64\svchost.exe => File is digitally signed
C:\WINDOWS\system32\services.exe => File is digitally signed
C:\WINDOWS\system32\User32.dll => File is digitally signed
C:\WINDOWS\SysWOW64\User32.dll => File is digitally signed
C:\WINDOWS\system32\userinit.exe => File is digitally signed
C:\WINDOWS\SysWOW64\userinit.exe => File is digitally signed
C:\WINDOWS\system32\rpcss.dll => File is digitally signed
C:\WINDOWS\system32\dnsapi.dll => File is digitally signed
C:\WINDOWS\SysWOW64\dnsapi.dll => File is digitally signed
C:\WINDOWS\system32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2018-07-25 13:11
==================== End of FRST.txt ============================
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 10.10.2018
Ran by 60352 (17-10-2018 16:44:28)
Running from C:\Users\60352\Desktop
Windows 10 Home Version 1803 17134.286 (X64) (2018-07-25 11:43:35)
Boot Mode: Normal
==========================================================
==================== Accounts: =============================
60352 (S-1-5-21-1438566064-2572893099-2627160239-1001 - Administrator - Enabled) => C:\Users\60352
Administrator (S-1-5-21-1438566064-2572893099-2627160239-500 - Administrator - Disabled)
DefaultAccount (S-1-5-21-1438566064-2572893099-2627160239-503 - Limited - Disabled)
defaultuser0 (S-1-5-21-1438566064-2572893099-2627160239-1000 - Limited - Disabled) => C:\Users\defaultuser0
Guest (S-1-5-21-1438566064-2572893099-2627160239-501 - Limited - Disabled)
WDAGUtilityAccount (S-1-5-21-1438566064-2572893099-2627160239-504 - Limited - Disabled)
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AV: ESET Security (Enabled - Up to date) {EC1D6F37-E411-475A-DF50-12FF7FE4AC70}
AS: ESET Security (Enabled - Up to date) {577C8ED3-C22B-48D4-E5E0-298D0463E6CD}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
FW: ESET Firewall (Enabled) {D426EE12-AE7E-4602-F40F-BBCA8137EB0B}
==================== Installed Programs ======================
(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
Adobe Acrobat Reader DC - Czech (HKLM-x32\...\{AC76BA86-7AD7-1029-7B44-AC0F074E4100}) (Version: 19.008.20074 - Adobe Systems Incorporated)
CCleaner (HKLM\...\CCleaner) (Version: 5.46 - Piriform)
ESET Security (HKLM\...\{0813F772-F554-4DA9-9CEA-ABCE6321BDFD}) (Version: 11.2.63.0 - ESET, spol. s r.o.)
Intel(R) Chipset Device Software (HKLM-x32\...\{fb610cea-ba50-4d4b-a717-cf025419035c}) (Version: 10.1.1.13 - Intel(R) Corporation) Hidden
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 20.19.15.4531 - Intel Corporation)
Lenovo App Explorer (HKU\S-1-5-19\...\Host App Service) (Version: 0.271.1.400 - SweetLabs for Lenovo) <==== ATTENTION
Lenovo App Explorer (HKU\S-1-5-20\...\Host App Service) (Version: 0.271.1.400 - SweetLabs for Lenovo) <==== ATTENTION
Lenovo OneKey Recovery (HKLM\...\{46F4D124-20E5-4D12-BE52-EC177A7A4B42}) (Version: 8.1.0.4706 - CyberLink Corp.) Hidden
Lenovo OneKey Recovery (HKLM-x32\...\InstallShield_{46F4D124-20E5-4D12-BE52-EC177A7A4B42}) (Version: 8.1.0.4706 - CyberLink Corp.)
Lenovo Photo Master (HKLM-x32\...\{BC94C56A-3649-420C-8756-2ADEBE399D33}) (Version: 2.1.5222.01 - CyberLink Corp.)
Lenovo PowerDVD12 (HKLM-x32\...\{B46BEA36-0B71-4A4E-AE41-87241643FA0A}) (Version: 12.0.5709.60 - CyberLink Corp.) Hidden
Lenovo PowerDVD12 (HKLM-x32\...\InstallShield_{B46BEA36-0B71-4A4E-AE41-87241643FA0A}) (Version: 12.0.5709.60 - CyberLink Corp.)
LenovoUtility (HKLM-x32\...\{6ADA7E88-8D16-4D0D-BC90-2B93AC5E56DA}) (Version: 3.0.0.4 - Lenovo) Hidden
LenovoUtility (HKLM-x32\...\InstallShield_{6ADA7E88-8D16-4D0D-BC90-2B93AC5E56DA}) (Version: 3.0.0.4 - Lenovo)
LibreOffice 6.1.0.3 (HKLM\...\{DD50CAE9-27C5-452F-A910-1E7A00D8EEE2}) (Version: 6.1.0.3 - The Document Foundation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (HKLM-x32\...\{050d4fc8-5d48-4b8f-8972-47c82c46020f}) (Version: 12.0.30501.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 (HKLM-x32\...\{f65db027-aff3-4070-886a-0d87064aabb1}) (Version: 12.0.30501.0 - Microsoft Corporation)
Opera Stable 56.0.3051.43 (HKLM-x32\...\Opera 56.0.3051.43) (Version: 56.0.3051.43 - Opera Software)
Qualcomm Atheros 11ac Wireless LAN Installer (HKLM-x32\...\{20CA507E-24AA-4741-87CF-CC1B250790B7}) (Version: 11.0.10374 - Qualcomm Atheros)
Qualcomm Atheros Bluetooth Installer (64) (HKLM\...\{628988B4-3FA5-4EA6-BAA3-DA640F6718BD}) (Version: 10.0.0.260 - Qualcomm Atheros)
Realtek Card Reader (HKLM-x32\...\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}) (Version: 10.0.10586.31225 - Realtek Semiconductor Corp.)
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 10.6.1001.2015 - Realtek)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7738 - Realtek Semiconductor Corp.)
Update for Windows 10 for x64-based Systems (KB4023057) (HKLM\...\{479E8CC7-CD68-4EB4-BB04-34A5C2C74102}) (Version: 2.46.0.0 - Microsoft Corporation)
UpdateAssistant (HKLM-x32\...\{B7AFAF92-D1C8-49A0-B34A-B5DAF9C9D5C6}) (Version: 1.9.0.0 - Microsoft Corporation) Hidden
VLC media player (HKLM\...\VLC media player) (Version: 3.0.4 - VideoLAN)
==================== Custom CLSID (Whitelisted): ==========================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
ContextMenuHandlers1: [ESET Security Shell] -> {B089FE88-FB52-11D3-BDF1-0050DA34150D} => C:\Program Files\ESET\ESET Security\shellExt.dll [2018-09-04] (ESET)
ContextMenuHandlers2: [ESET Security Shell] -> {B089FE88-FB52-11D3-BDF1-0050DA34150D} => C:\Program Files\ESET\ESET Security\shellExt.dll [2018-09-04] (ESET)
ContextMenuHandlers5: [igfxcui] -> {3AB1675A-CCFF-11D2-8B20-00A0C93CB1F4} => -> No File
ContextMenuHandlers5: [igfxDTCM] -> {9B5F5829-A529-4B12-814A-E81BCB8D93FC} => C:\WINDOWS\system32\igfxDTCM.dll [2016-11-02] (Intel Corporation)
ContextMenuHandlers6: [ESET Security Shell] -> {B089FE88-FB52-11D3-BDF1-0050DA34150D} => C:\Program Files\ESET\ESET Security\shellExt.dll [2018-09-04] (ESET)
==================== Scheduled Tasks (Whitelisted) =============
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
Task: {0B8FAE09-CC44-405F-A1E8-DBD89AAA1D9F} - System32\Tasks\Microsoft\Windows\Setup\Notifier => C:\WINDOWS\system32\Notifier.exe
Task: {3364776C-569F-4C0B-888A-8B4A489829C1} - System32\Tasks\Lenovo\ImController\Lenovo iM Controller Monitor => C:\WINDOWS\system32\ImController.InfInstaller.exe [2018-05-16] (Lenovo Group Limited)
Task: {4603386B-6140-4D95-A181-F1432AD91CCC} - System32\Tasks\Lenovo\ImController\TimeBasedEvents\d725cafd-c768-4aa3-99eb-0eed57ef72a6 => C:\Program Files\Lenovo\ImController\Service\Lenovo.Modern.ImController.exe [2018-05-16] (Lenovo Group Limited)
Task: {4D3325EB-37E4-4EA4-B00C-D694178D2AE2} - System32\Tasks\Lenovo\ImController\TimeBasedEvents\f63e8105-d075-453b-8b86-5c378f67ca4e => C:\Program Files\Lenovo\ImController\Service\Lenovo.Modern.ImController.exe [2018-05-16] (Lenovo Group Limited)
Task: {53DDAF71-6A8D-4939-9C5D-B87AB9D3D9FB} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2018-08-14] (Adobe Systems Incorporated)
Task: {65B85F6F-35B3-4459-A179-28255D5B7B25} - System32\Tasks\Microsoft\Windows\HelloFace\FODCleanupTask => C:\WINDOWS\System32\WinBioPlugIns\FaceFodUninstaller.exe [2018-04-12] ()
Task: {7188557F-4F02-47EB-AAFE-354966E22C0F} - System32\Tasks\Lenovo\ImController\Plugins\LenovoSystemUpdatePlugin_WeeklyTask => %windir%\System32\reg.exe add hklm\SOFTWARE\Lenovo\SystemUpdatePlugin\scheduler /v start /t reg_dword /d 1 /f /reg:32
Task: {790D079F-CC4E-4924-AD3C-E98007EE5DA7} - System32\Tasks\Opera scheduled Autoupdate 1513235940 => C:\Program Files\Opera\launcher.exe [2018-10-10] (Opera Software)
Task: {7E6E041B-F30E-4046-A856-8BC7620A47E1} - \Microsoft\Windows\UNP\RunCampaignManager -> No File <==== ATTENTION
Task: {82A0BBDE-6C88-43EB-8473-82016E563B01} - System32\Tasks\Lenovo\ImController\TimeBasedEvents\185e519a-2dc1-4a3b-b2f3-4d7ac75e23df => C:\Program Files\Lenovo\ImController\Service\Lenovo.Modern.ImController.exe [2018-05-16] (Lenovo Group Limited)
Task: {94B5228C-46B9-4409-9CA4-EDB0AA231E7E} - System32\Tasks\Lenovo\ImController\TimeBasedEvents\0b6877b4-22b9-45bf-80c3-9d8a784e13f7 => C:\Program Files\Lenovo\ImController\Service\Lenovo.Modern.ImController.exe [2018-05-16] (Lenovo Group Limited)
Task: {A870C2F2-52F0-4FD4-8631-28EBED587DBB} - System32\Tasks\CCleaner Update => C:\Program Files\CCleaner\CCUpdate.exe [2018-08-24] (Piriform Ltd)
Task: {DA7D0981-58CC-4AC4-AAFC-78C8743E7C60} - System32\Tasks\CyberLink\Photo Master Gadget startup => C:\Program Files (x86)\Lenovo\Lenovo Photo Master\PhotoMasterWorker.exe [2016-04-22] (CyberLink Corp.)
Task: {FE45ED4B-C8EF-4D48-9B97-C6C569CC37DE} - System32\Tasks\Lenovo\ImController\Lenovo iM Controller Scheduled Maintenance => %windir%\system32\sc.exe START ImControllerService
(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)
==================== Shortcuts & WMI ========================
(The entries could be listed to be restored or removed.)
==================== Loaded Modules (Whitelisted) ==============
2018-04-12 01:34 - 2018-04-12 01:34 - 000491744 _____ () C:\Windows\System32\InputHost.dll
2016-11-02 00:05 - 2016-11-02 00:05 - 000401896 _____ () C:\WINDOWS\system32\igfxTray.exe
2018-04-12 01:34 - 2018-04-12 01:34 - 000472064 _____ () C:\Windows\ShellExperiences\TileControl.dll
2018-04-12 01:34 - 2018-04-12 01:34 - 002759168 _____ () C:\Windows\ShellComponents\TaskFlowUI.dll
2018-09-24 08:32 - 2018-09-15 04:17 - 002185728 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.Core.dll
2018-10-16 14:51 - 2018-10-16 14:51 - 104143960 _____ () C:\Program Files\Opera\56.0.3051.43\opera_browser.dll
2018-10-16 14:51 - 2018-10-16 14:51 - 005082200 _____ () C:\Program Files\Opera\56.0.3051.43\libglesv2.dll
2018-10-16 14:51 - 2018-10-16 14:51 - 000116824 _____ () C:\Program Files\Opera\56.0.3051.43\libegl.dll
==================== Alternate Data Streams (Whitelisted) =========
(If an entry is included in the fixlist, only the ADS will be removed.)
==================== Safe Mode (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\McMPFSvc => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MCODS => ""="Service"
==================== Association (Whitelisted) ===============
(If an entry is included in the fixlist, the registry item will be restored to default or removed.)
==================== Internet Explorer trusted/restricted ===============
(If an entry is included in the fixlist, it will be removed from the registry.)
==================== Hosts content: ===============================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2016-07-16 13:47 - 2016-07-16 13:45 - 000000824 _____ C:\WINDOWS\system32\Drivers\etc\hosts
==================== Other Areas ============================
(Currently there is no automatic fix for this section.)
HKU\S-1-5-21-1438566064-2572893099-2627160239-1001\Control Panel\Desktop\\Wallpaper -> C:\Windows\Web\Wallpaper\Lenovo\LenovoWallPaper.jpg
DNS Servers: 8.8.8.8 - 1.1.1.1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer => (SmartScreenEnabled: RequireAdmin)
Windows Firewall is enabled.
==================== MSCONFIG/TASK MANAGER disabled items ==
If an entry is included in the fixlist, it will be removed.
HKLM\...\StartupApproved\Run: => "LenovoUtility"
HKLM\...\StartupApproved\Run: => "RTHDVCPL"
HKLM\...\StartupApproved\Run: => "RtHDVBg_LENOVO_DOLBYDRAGON"
HKLM\...\StartupApproved\Run: => "RtHDVBg_LENOVO_MICPKEY"
HKLM\...\StartupApproved\Run32: => "CLMLServer_For_P2G8"
HKLM\...\StartupApproved\Run32: => "CLVirtualDrive"
==================== FirewallRules (Whitelisted) ===============
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
FirewallRules: [{08446500-E961-46D7-8DCC-41EC167C1BF5}] => (Allow) C:\Program Files (x86)\Lenovo\Lenovo Photo Master\subsys\AdvPhotoEditor\PhotoDirector5.exe
FirewallRules: [{299A0AE4-54D8-4A0F-A7E0-8186D54A2448}] => (Allow) C:\Program Files\CCleaner\CCUpdate.exe
FirewallRules: [{FA6927DE-8053-4F8D-A9B0-8AD6C68F53B3}] => (Allow) C:\Program Files\CCleaner\CCUpdate.exe
FirewallRules: [{8AF28333-3D6E-4607-BD7A-E6EB7FF6A6A4}] => (Allow) C:\Program Files\Opera\56.0.3051.36\opera.exe
FirewallRules: [{96531FEC-563D-4180-A27A-BBB4CFB85833}] => (Allow) C:\Program Files\Opera\56.0.3051.43\opera.exe
==================== Restore Points =========================
05-10-2018 14:17:57 Windows Update
10-10-2018 09:24:01 Windows Update
==================== Faulty Device Manager Devices =============
Name: EasyCamera
Description: EasyCamera
Class Guid: {6bdd1fc6-810f-11d0-bec7-08002be2092f}
Manufacturer: Azurewave
Service: rtsuvc
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.
==================== Event log errors: =========================
Application errors:
==================
Error: (10/17/2018 04:39:18 PM) (Source: Microsoft-Windows-SpellChecker) (EventID: 33) (User: LAPTOP-PHGDM54V)
Description: httphttp-2147467263
Error: (10/05/2018 02:34:31 PM) (Source: Microsoft-Windows-SpellChecker) (EventID: 33) (User: LAPTOP-PHGDM54V)
Description: httphttp-2147467263
Error: (10/05/2018 02:24:58 PM) (Source: Microsoft-Windows-SpellChecker) (EventID: 33) (User: LAPTOP-PHGDM54V)
Description: httphttp-2147467263
Error: (08/22/2018 07:26:11 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Název chybující aplikace: CCSDK.exe, verze: 1.3.0.3, časové razítko: 0x56ef5fb7
Název chybujícího modulu: CCSDK.exe, verze: 1.3.0.3, časové razítko: 0x56ef5fb7
Kód výjimky: 0xc0000005
Posun chyby: 0x000137d9
ID chybujícího procesu: 0x1764
Čas spuštění chybující aplikace: 0x01d43a3d07129f7f
Cesta k chybující aplikaci: C:\Program Files (x86)\Lenovo\CCSDK\CCSDK.exe
Cesta k chybujícímu modulu: C:\Program Files (x86)\Lenovo\CCSDK\CCSDK.exe
ID zprávy: a3fb60dc-adf3-427c-a25c-45e6d852f3fb
Úplný název chybujícího balíčku:
ID aplikace související s chybujícím balíčkem:
Error: (08/20/2018 05:19:23 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Název chybující aplikace: SettingSyncHost.exe, verze: 10.0.17134.1, časové razítko: 0x60b0bd37
Název chybujícího modulu: OneDriveSettingSyncProvider.dll, verze: 10.0.17134.1, časové razítko: 0x84e6685e
Kód výjimky: 0xc0000409
Posun chyby: 0x000000000006588e
ID chybujícího procesu: 0x22b4
Čas spuštění chybující aplikace: 0x01d430c09c91306d
Cesta k chybující aplikaci: C:\WINDOWS\system32\SettingSyncHost.exe
Cesta k chybujícímu modulu: C:\Windows\System32\OneDriveSettingSyncProvider.dll
ID zprávy: 973f4e8c-5ded-4415-9df3-b41bed9a8130
Úplný název chybujícího balíčku:
ID aplikace související s chybujícím balíčkem:
Error: (08/10/2018 05:42:10 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Název chybující aplikace: CCSDK.exe, verze: 1.3.0.3, časové razítko: 0x56ef5fb7
Název chybujícího modulu: CCSDK.exe, verze: 1.3.0.3, časové razítko: 0x56ef5fb7
Kód výjimky: 0xc0000005
Posun chyby: 0x000137d9
ID chybujícího procesu: 0xca0
Čas spuštění chybující aplikace: 0x01d430c082ebc3d8
Cesta k chybující aplikaci: C:\Program Files (x86)\Lenovo\CCSDK\CCSDK.exe
Cesta k chybujícímu modulu: C:\Program Files (x86)\Lenovo\CCSDK\CCSDK.exe
ID zprávy: 50c9356c-3af4-430c-8c4b-0c84ab05882c
Úplný název chybujícího balíčku:
ID aplikace související s chybujícím balíčkem:
Error: (08/10/2018 05:33:53 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Název chybující aplikace: svchost.exe_UsoSvc, verze: 10.0.17134.1, časové razítko: 0xa38b9ab2
Název chybujícího modulu: wuaueng.dll, verze: 10.0.17134.112, časové razítko: 0x16019f1b
Kód výjimky: 0xc0000005
Posun chyby: 0x000000000011241f
ID chybujícího procesu: 0x8e0
Čas spuštění chybující aplikace: 0x01d4240a9a0c5c67
Cesta k chybující aplikaci: c:\windows\system32\svchost.exe
Cesta k chybujícímu modulu: c:\windows\system32\wuaueng.dll
ID zprávy: f6b364da-f049-42e8-8ec1-ba070cce19b3
Úplný název chybujícího balíčku:
ID aplikace související s chybujícím balíčkem:
Error: (08/10/2018 05:18:17 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Název chybující aplikace: svchost.exe_WpnUserService, verze: 10.0.17134.1, časové razítko: 0xa38b9ab2
Název chybujícího modulu: NotificationController.dll, verze: 10.0.17134.1, časové razítko: 0x498118f8
Kód výjimky: 0xc0000005
Posun chyby: 0x000000000007a25d
ID chybujícího procesu: 0x3040
Čas spuštění chybující aplikace: 0x01d4295e8866cd12
Cesta k chybující aplikaci: C:\WINDOWS\system32\svchost.exe
Cesta k chybujícímu modulu: C:\Windows\System32\NotificationController.dll
ID zprávy: e2acfbeb-9c51-43f1-8893-3e30107ec49c
Úplný název chybujícího balíčku:
ID aplikace související s chybujícím balíčkem:
System errors:
=============
Error: (10/17/2018 04:30:05 PM) (Source: DCOM) (EventID: 10016) (User: LAPTOP-PHGDM54V)
Description: Nastavení oprávnění application-specific neuděluje oprávnění Local Activation pro serverovou aplikaci COM s identifikátorem CLSID
{D63B10C5-BB46-4990-A94F-E40B9D520160}
a APPID
{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}
uživateli LAPTOP-PHGDM54V\60352 (SID: S-1-5-21-1438566064-2572893099-2627160239-1001) z adresy LocalHost (Using LRPC) běžící v kontejneru aplikací Unavailable – SID (Unavailable). Toto oprávnění zabezpečení lze změnit pomocí nástroje správy Služba komponent.
Error: (10/17/2018 02:14:15 PM) (Source: DCOM) (EventID: 10016) (User: LAPTOP-PHGDM54V)
Description: Nastavení oprávnění application-specific neuděluje oprávnění Local Activation pro serverovou aplikaci COM s identifikátorem CLSID
{D63B10C5-BB46-4990-A94F-E40B9D520160}
a APPID
{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}
uživateli LAPTOP-PHGDM54V\60352 (SID: S-1-5-21-1438566064-2572893099-2627160239-1001) z adresy LocalHost (Using LRPC) běžící v kontejneru aplikací Unavailable – SID (Unavailable). Toto oprávnění zabezpečení lze změnit pomocí nástroje správy Služba komponent.
Error: (10/16/2018 02:50:52 PM) (Source: DCOM) (EventID: 10016) (User: LAPTOP-PHGDM54V)
Description: Nastavení oprávnění application-specific neuděluje oprávnění Local Activation pro serverovou aplikaci COM s identifikátorem CLSID
{D63B10C5-BB46-4990-A94F-E40B9D520160}
a APPID
{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}
uživateli LAPTOP-PHGDM54V\60352 (SID: S-1-5-21-1438566064-2572893099-2627160239-1001) z adresy LocalHost (Using LRPC) běžící v kontejneru aplikací Unavailable – SID (Unavailable). Toto oprávnění zabezpečení lze změnit pomocí nástroje správy Služba komponent.
Error: (10/11/2018 06:15:30 PM) (Source: DCOM) (EventID: 10016) (User: LAPTOP-PHGDM54V)
Description: Nastavení oprávnění application-specific neuděluje oprávnění Local Activation pro serverovou aplikaci COM s identifikátorem CLSID
{D63B10C5-BB46-4990-A94F-E40B9D520160}
a APPID
{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}
uživateli LAPTOP-PHGDM54V\60352 (SID: S-1-5-21-1438566064-2572893099-2627160239-1001) z adresy LocalHost (Using LRPC) běžící v kontejneru aplikací Unavailable – SID (Unavailable). Toto oprávnění zabezpečení lze změnit pomocí nástroje správy Služba komponent.
Error: (10/10/2018 09:03:53 AM) (Source: DCOM) (EventID: 10016) (User: LAPTOP-PHGDM54V)
Description: Nastavení oprávnění application-specific neuděluje oprávnění Local Activation pro serverovou aplikaci COM s identifikátorem CLSID
{D63B10C5-BB46-4990-A94F-E40B9D520160}
a APPID
{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}
uživateli LAPTOP-PHGDM54V\60352 (SID: S-1-5-21-1438566064-2572893099-2627160239-1001) z adresy LocalHost (Using LRPC) běžící v kontejneru aplikací Unavailable – SID (Unavailable). Toto oprávnění zabezpečení lze změnit pomocí nástroje správy Služba komponent.
Error: (10/05/2018 02:40:34 PM) (Source: DCOM) (EventID: 10016) (User: LAPTOP-PHGDM54V)
Description: Nastavení oprávnění application-specific neuděluje oprávnění Local Activation pro serverovou aplikaci COM s identifikátorem CLSID
{D63B10C5-BB46-4990-A94F-E40B9D520160}
a APPID
{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}
uživateli LAPTOP-PHGDM54V\60352 (SID: S-1-5-21-1438566064-2572893099-2627160239-1001) z adresy LocalHost (Using LRPC) běžící v kontejneru aplikací Unavailable – SID (Unavailable). Toto oprávnění zabezpečení lze změnit pomocí nástroje správy Služba komponent.
Error: (10/05/2018 02:38:51 PM) (Source: DCOM) (EventID: 10010) (User: LAPTOP-PHGDM54V)
Description: Server {D63B10C5-BB46-4990-A94F-E40B9D520160} se v daném časovém limitu neregistroval u služby DCOM.
Error: (10/05/2018 02:35:48 PM) (Source: DCOM) (EventID: 10016) (User: LAPTOP-PHGDM54V)
Description: Nastavení oprávnění application-specific neuděluje oprávnění Local Activation pro serverovou aplikaci COM s identifikátorem CLSID
{D63B10C5-BB46-4990-A94F-E40B9D520160}
a APPID
{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}
uživateli LAPTOP-PHGDM54V\60352 (SID: S-1-5-21-1438566064-2572893099-2627160239-1001) z adresy LocalHost (Using LRPC) běžící v kontejneru aplikací Unavailable – SID (Unavailable). Toto oprávnění zabezpečení lze změnit pomocí nástroje správy Služba komponent.
Windows Defender:
===================================
Date: 2018-08-30 09:46:53.798
Description:
Prohledávání Antivirová ochrana v programu Windows Defender bylo zastaveno pred dokoncením.
ID prohledávání: {0719BA39-C7EE-4D14-8B68-93D16505E782}
Typ prohledávání: Antimalwarový program
Parametry prohledávání: Rychlé prohledávání
Uživatel: NT AUTHORITY\SYSTEM
Date: 2018-08-22 19:15:20.062
Description:
Prohledávání Antivirová ochrana v programu Windows Defender bylo zastaveno pred dokoncením.
ID prohledávání: {92838CA7-A1AE-4B42-9E45-F80E5D3AE4E2}
Typ prohledávání: Antimalwarový program
Parametry prohledávání: Rychlé prohledávání
Uživatel: NT AUTHORITY\SYSTEM
Date: 2018-08-15 17:26:33.100
Description:
Prohledávání Antivirová ochrana v programu Windows Defender bylo zastaveno pred dokoncením.
ID prohledávání: {A88E0095-D9AC-453A-B278-9B013DC84F98}
Typ prohledávání: Antimalwarový program
Parametry prohledávání: Rychlé prohledávání
Uživatel: NT AUTHORITY\SYSTEM
Date: 2018-08-10 17:33:50.414
Description:
Prohledávání Antivirová ochrana v programu Windows Defender bylo zastaveno pred dokoncením.
ID prohledávání: {F2AE4763-5D06-4D69-8902-0D18C98BB36B}
Typ prohledávání: Antimalwarový program
Parametry prohledávání: Rychlé prohledávání
Uživatel: NT AUTHORITY\SYSTEM
Date: 2018-08-10 08:05:16.451
Description:
Prohledávání Antivirová ochrana v programu Windows Defender bylo zastaveno pred dokoncením.
ID prohledávání: {36D008A2-BC68-4D65-87E9-B7603CFB5CF1}
Typ prohledávání: Antimalwarový program
Parametry prohledávání: Rychlé prohledávání
Uživatel: NT AUTHORITY\SYSTEM
Date: 2018-08-22 19:22:21.402
Description:
Prohledávání Antivirová ochrana v programu Windows Defender zjistilo chybu pri pokusu o nactení podpisu a pokusí se o obnovení sady podpisu, jejichž správnost je potvrzena.
Podpisy, které se mely nacíst: Aktuální
Kód chyby: 0x80070002
Popis chyby: The system cannot find the file specified.
Verze podpisu: 0.0.0.0;0.0.0.0
Verze modulu: 0.0.0.0
Date: 2018-08-22 18:58:03.152
Description:
Funkce Ochrana v reálném case u prohledávání Antivirová ochrana v programu Windows Defender zjistila chybu a došlo k jejímu selhání.
Funkce: Pri prístupu
Kód chyby: 0x80004005
Popis chyby: Unspecified error
Duvod: Ovladac filtru preskocil prohledávání položek a je v režimu pruchodu. Prícinou muže být nízký stav prostredku.
Date: 2018-08-22 17:41:20.617
Description:
Prohledávání Antivirová ochrana v programu Windows Defender zjistilo chybu pri pokusu o aktualizaci podpisu.
Nová verze podpisu:
Predchozí verze podpisu: 1.273.1826.0
Zdroj aktualizace: Server Microsoft Update
Typ podpisu: Antivirový program
Typ aktualizace: Úplné
Uživatel: NT AUTHORITY\SYSTEM
Aktuální verze modulu:
Predchozí verze modulu: 1.1.15100.1
Kód chyby: 0x80240016
Popis chyby :An unexpected problem occurred while checking for updates. For information on installing or troubleshooting updates, see Help and Support.
Date: 2018-08-04 18:37:39.351
Description:
Prohledávání Antivirová ochrana v programu Windows Defender zjistilo chybu pri pokusu o aktualizaci podpisu.
Nová verze podpisu:
Predchozí verze podpisu:
Zdroj aktualizace: Uživatel
Typ podpisu:
Typ aktualizace:
Uživatel: NT AUTHORITY\SYSTEM
Aktuální verze modulu:
Predchozí verze modulu:
Kód chyby: 0x80070652
Popis chyby :Another installation is already in progress. Complete that installation before proceeding with this install.
CodeIntegrity:
===================================
Date: 2018-09-11 17:22:55.115
Description:
Windows is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\drivers\wd\WdBoot.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.
==================== Memory info ===========================
Processor: Intel(R) Pentium(R) CPU N3710 @ 1.60GHz
Percentage of memory in use: 53%
Total physical RAM: 4009.14 MB
Available physical RAM: 1865.07 MB
Total Virtual: 4713.14 MB
Available Virtual: 2543.55 MB
==================== Drives ================================
Drive c: (Windows) (Fixed) (Total:887.17 GB) (Free:841.44 GB) NTFS
Drive d: (LENOVO) (Fixed) (Total:25 GB) (Free:23.65 GB) NTFS
\\?\Volume{44be0e24-1745-4e52-90fe-297b024c4204}\ (WINRE_DRV) (Fixed) (Total:0.98 GB) (Free:0.51 GB) NTFS
\\?\Volume{d1f12f51-767b-462b-bfac-23bded52704d}\ (LENOVO_PART) (Fixed) (Total:17.12 GB) (Free:6.63 GB) NTFS
\\?\Volume{74234a81-a499-4dd7-bc5b-2803ae0472e0}\ (SYSTEM_DRV) (Fixed) (Total:0.25 GB) (Free:0.22 GB) FAT32
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (Size: 931.5 GB) (Disk ID: B6C54A9C)
Partition: GPT.
==================== End of Addition.txt ============================
Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 10.10.2018
Ran by 60352 (administrator) on LAPTOP-PHGDM54V (17-10-2018 16:41:51)
Running from C:\Users\60352\Desktop
Loaded Profiles: 60352 (Available Profiles: defaultuser0 & 60352)
Platform: Windows 10 Home Version 1803 17134.286 (X64) Language: Angličtina (Spojené státy)
Internet Explorer Version 11 (Default browser: Opera)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/33 ... scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(ESET) C:\Program Files\ESET\ESET Security\ekrn.exe
(Intel Corporation) C:\Windows\System32\igfxCUIService.exe
(Windows (R) Win 7 DDK provider) C:\Program Files (x86)\Bluetooth Suite\AdminService.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\ImController\Service\Lenovo.Modern.ImController.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnhService.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Lenovo) C:\Program Files (x86)\Lenovo\GDCAgentSetupRed\GDCAgent.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Intel Corporation) C:\Windows\System32\igfxEM.exe
(Intel Corporation) C:\Windows\System32\igfxHK.exe
() C:\Windows\System32\igfxTray.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MSASCuiL.exe
(ESET) C:\Program Files\ESET\ESET Security\egui.exe
(Microsoft Corporation) C:\Windows\SystemApps\Microsoft.LockApp_cw5n1h2txyewy\LockApp.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Opera Software) C:\Program Files\Opera\56.0.3051.43\opera.exe
(Opera Software) C:\Program Files\Opera\56.0.3051.43\opera_crashreporter.exe
(Opera Software) C:\Program Files\Opera\56.0.3051.43\opera.exe
(Opera Software) C:\Program Files\Opera\56.0.3051.43\opera.exe
(Opera Software) C:\Program Files\Opera\56.0.3051.43\opera.exe
(Opera Software) C:\Program Files\Opera\56.0.3051.43\opera.exe
(Opera Software) C:\Program Files\Opera\56.0.3051.43\opera.exe
(Opera Software) C:\Program Files\Opera\56.0.3051.43\opera.exe
(Opera Software) C:\Program Files\Opera\56.0.3051.43\opera.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\ImController\PluginHost\Lenovo.Modern.ImController.PluginHost.Device.exe
(Microsoft Corporation) C:\Windows\System32\smartscreen.exe
==================== Registry (Whitelisted) ===========================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [SecurityHealth] => C:\Program Files\Windows Defender\MSASCuiL.exe [638872 2018-04-12] (Microsoft Corporation)
HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [16418560 2016-02-05] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg_LENOVO_DOLBYDRAGON] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1419008 2016-02-05] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg_LENOVO_MICPKEY] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1419008 2016-02-05] (Realtek Semiconductor)
HKLM\...\Run: [egui] => C:\Program Files\ESET\ESET Security\ecmds.exe [177928 2018-09-04] (ESET)
HKU\S-1-5-19\...\RunOnce: [WAB Migrate] => C:\Program Files\Windows Mail\wab.exe [518144 2018-04-12] (Microsoft Corporation)
HKU\S-1-5-20\...\RunOnce: [WAB Migrate] => C:\Program Files\Windows Mail\wab.exe [518144 2018-04-12] (Microsoft Corporation)
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
Tcpip\Parameters: [DhcpNameServer] 10.255.255.10 10.255.255.20
Tcpip\..\Interfaces\{288b6405-e1f4-44b8-8f25-b4cf8a452932}: [NameServer] 8.8.8.8,1.1.1.1
Tcpip\..\Interfaces\{288b6405-e1f4-44b8-8f25-b4cf8a452932}: [DhcpNameServer] 10.255.255.10 10.255.255.20
Tcpip\..\Interfaces\{d747dcff-956d-4bf5-8667-21f4e60f6913}: [DhcpNameServer] 150.212.1.2
Internet Explorer:
==================
HKU\S-1-5-21-1438566064-2572893099-2627160239-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://lenovo17win10.msn.com/?pc=LCTE
HKU\S-1-5-21-1438566064-2572893099-2627160239-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://lenovo17win10.msn.com/?pc=LCTE
HKU\S-1-5-21-1438566064-2572893099-2627160239-1001\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://mystart.lenovo.com
SearchScopes: HKU\S-1-5-21-1438566064-2572893099-2627160239-1001 -> DefaultScope {82FD5906-7444-4A2D-B0F3-73828A0F9C25} URL =
FireFox:
========
FF Plugin: @videolan.org/vlc,version=3.0.4 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2018-08-10] (VideoLAN)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2018-09-20] (Adobe Systems Inc.)
Opera:
=======
OPR StartupUrls: "hxxp://seznam.cz/"
==================== Services (Whitelisted) ====================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
R2 AtherosSvc; C:\Program Files (x86)\Bluetooth Suite\adminservice.exe [338312 2016-06-29] (Windows (R) Win 7 DDK provider)
R2 ekrn; C:\Program Files\ESET\ESET Security\ekrn.exe [2260144 2018-09-04] (ESET)
R3 ekrnEpfw; C:\Program Files\ESET\ESET Security\ekrn.exe [2260144 2018-09-04] (ESET)
R2 GDCAgent; C:\Program Files (x86)\Lenovo\GDCAgentSetupRed\GDCAgent.exe [1210352 2016-03-23] (Lenovo)
R2 igfxCUIService2.0.0.0; C:\WINDOWS\system32\igfxCUIService.exe [373744 2016-11-02] (Intel Corporation)
R2 ImControllerService; C:\Program Files\Lenovo\ImController\Service\Lenovo.Modern.ImController.exe [71408 2018-05-16] (Lenovo Group Limited)
S4 ssh-agent; C:\WINDOWS\System32\OpenSSH\ssh-agent.exe [495616 2018-03-10] ()
R2 SynTPEnhService; C:\Program Files\Synaptics\SynTP\SynTPEnhService.exe [276616 2018-03-14] (Synaptics Incorporated)
S3 WdNisSvc; C:\ProgramData\Microsoft\Windows Defender\platform\4.18.1807.18075-0\NisSrv.exe [3905952 2018-08-01] (Microsoft Corporation)
S3 WinDefend; C:\ProgramData\Microsoft\Windows Defender\platform\4.18.1807.18075-0\MsMpEng.exe [110944 2018-08-01] (Microsoft Corporation)
===================== Drivers (Whitelisted) ======================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
R1 eamonm; C:\WINDOWS\System32\DRIVERS\eamonm.sys [141512 2018-09-04] (ESET)
R0 edevmon; C:\WINDOWS\System32\DRIVERS\edevmon.sys [109232 2018-09-04] (ESET)
S0 eelam; C:\WINDOWS\System32\DRIVERS\eelam.sys [15872 2018-09-04] (ESET)
R1 ehdrv; C:\WINDOWS\system32\DRIVERS\ehdrv.sys [188824 2018-09-04] (ESET)
R2 ekbdflt; C:\WINDOWS\system32\DRIVERS\ekbdflt.sys [50144 2018-09-04] (ESET)
R1 epfw; C:\WINDOWS\system32\DRIVERS\epfw.sys [82304 2018-09-04] (ESET)
R1 epfwwfp; C:\WINDOWS\system32\DRIVERS\epfwwfp.sys [109864 2018-09-04] (ESET)
R3 igfxLP; C:\WINDOWS\system32\DRIVERS\igdkmd64lp.sys [7402992 2016-11-02] (Intel Corporation)
R3 rt640x64; C:\WINDOWS\System32\drivers\rt640x64.sys [935168 2016-01-22] (Realtek )
R3 RTSUER; C:\WINDOWS\system32\Drivers\RtsUer.sys [416472 2016-05-17] (Realsil Semiconductor Corporation)
S3 rtsuvc; C:\WINDOWS\system32\DRIVERS\rtsuvc.sys [3118848 2016-05-12] (Realtek Semiconductor Corp.)
R3 TXEIx64; C:\WINDOWS\System32\drivers\TXEIx64.sys [146200 2015-10-15] (Intel Corporation)
S3 WdBoot; C:\WINDOWS\system32\drivers\wd\WdBoot.sys [46584 2018-08-01] (Microsoft Corporation)
S3 WdFilter; C:\WINDOWS\system32\drivers\wd\WdFilter.sys [340008 2018-08-01] (Microsoft Corporation)
S3 WdNisDrv; C:\WINDOWS\System32\drivers\wd\WdNisDrv.sys [61992 2018-08-01] (Microsoft Corporation)
S3 wsvd; C:\WINDOWS\system32\DRIVERS\wsvd.sys [102376 2012-06-14] ("CyberLink)
==================== NetSvcs (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
==================== One Month Created files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2018-10-17 16:41 - 2018-10-17 16:43 - 000008307 _____ C:\Users\60352\Desktop\FRST.txt
2018-10-17 16:41 - 2018-10-17 16:41 - 000000000 ____D C:\FRST
2018-10-17 16:39 - 2018-10-17 16:40 - 002414592 _____ (Farbar) C:\Users\60352\Desktop\FRST64.exe
2018-10-05 14:25 - 2018-09-05 00:36 - 001476904 _____ (Microsoft Corporation) C:\WINDOWS\system32\mcupdate_GenuineIntel.dll
2018-09-24 09:10 - 2018-10-16 14:52 - 000003958 _____ C:\WINDOWS\System32\Tasks\Opera scheduled Autoupdate 1513235940
2018-09-24 08:32 - 2018-09-15 10:46 - 000344576 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iedkcs32.dll
2018-09-24 08:32 - 2018-09-15 10:32 - 000392192 _____ (Microsoft Corporation) C:\WINDOWS\system32\iedkcs32.dll
2018-09-24 08:32 - 2018-09-15 10:31 - 001364992 _____ (Microsoft Corporation) C:\WINDOWS\system32\bcastdvruserservice.dll
2018-09-24 08:32 - 2018-09-15 04:57 - 000272408 _____ (Microsoft Corporation) C:\WINDOWS\system32\SgrmEnclave.dll
2018-09-24 08:32 - 2018-09-15 04:56 - 000269320 _____ (Microsoft Corporation) C:\WINDOWS\system32\SgrmEnclave_secure.dll
2018-09-24 08:32 - 2018-09-15 04:51 - 001220920 _____ (Microsoft Corporation) C:\WINDOWS\system32\hvix64.exe
2018-09-24 08:32 - 2018-09-15 04:51 - 000076288 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\hvservice.sys
2018-09-24 08:32 - 2018-09-15 04:50 - 001029432 _____ (Microsoft Corporation) C:\WINDOWS\system32\hvax64.exe
2018-09-24 08:32 - 2018-09-15 04:50 - 000567080 _____ (Microsoft Corporation) C:\WINDOWS\system32\tcblaunch.exe
2018-09-24 08:32 - 2018-09-15 04:50 - 000134968 _____ (Microsoft Corporation) C:\WINDOWS\system32\hvloader.dll
2018-09-24 08:32 - 2018-09-15 04:49 - 009090064 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntoskrnl.exe
2018-09-24 08:32 - 2018-09-15 04:49 - 007519896 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.Protection.PlayReady.dll
2018-09-24 08:32 - 2018-09-15 04:49 - 001097760 _____ (Microsoft Corporation) C:\WINDOWS\system32\msvproc.dll
2018-09-24 08:32 - 2018-09-15 04:48 - 000885968 _____ (Microsoft Corporation) C:\WINDOWS\system32\CoreMessaging.dll
2018-09-24 08:32 - 2018-09-15 04:48 - 000713504 _____ (Microsoft Corporation) C:\WINDOWS\system32\MSVideoDSP.dll
2018-09-24 08:32 - 2018-09-15 04:33 - 006567984 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.Protection.PlayReady.dll
2018-09-24 08:32 - 2018-09-15 04:33 - 001129760 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msvproc.dll
2018-09-24 08:32 - 2018-09-15 04:33 - 000581808 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MSVideoDSP.dll
2018-09-24 08:32 - 2018-09-15 04:33 - 000567280 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\CoreMessaging.dll
2018-09-24 08:32 - 2018-09-15 04:33 - 000357064 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\bcryptprimitives.dll
2018-09-24 08:32 - 2018-09-15 04:20 - 001627136 _____ (Microsoft Corporation) C:\WINDOWS\system32\enterprisecsps.dll
2018-09-24 08:32 - 2018-09-15 04:19 - 004382720 _____ (Microsoft Corporation) C:\WINDOWS\system32\EdgeContent.dll
2018-09-24 08:32 - 2018-09-15 04:19 - 000154112 _____ (Microsoft Corporation) C:\WINDOWS\system32\Chakradiag.dll
2018-09-24 08:32 - 2018-09-15 04:17 - 007577088 _____ (Microsoft Corporation) C:\WINDOWS\system32\Chakra.dll
2018-09-24 08:32 - 2018-09-15 04:16 - 005777920 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Chakra.dll
2018-09-24 08:32 - 2018-09-15 02:59 - 000001310 _____ C:\WINDOWS\system32\tcbres.wim
==================== One Month Modified files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2018-10-17 16:29 - 2017-12-14 09:18 - 000000000 ____D C:\Program Files\Opera
2018-10-17 16:28 - 2018-07-25 13:11 - 000000000 ____D C:\WINDOWS\system32\SleepStudy
2018-10-17 15:39 - 2018-09-11 15:38 - 000004210 _____ C:\WINDOWS\System32\Tasks\CCleaner Update
2018-10-17 14:19 - 2018-04-12 01:38 - 000000000 ____D C:\WINDOWS\system32\NDF
2018-10-17 14:07 - 2018-04-12 01:36 - 000000000 ____D C:\WINDOWS\INF
2018-10-16 15:22 - 2018-04-12 01:30 - 000000000 ____D C:\WINDOWS\CbsTemp
2018-10-16 15:21 - 2018-04-12 01:38 - 000000000 ____D C:\ProgramData\regid.1991-06.com.microsoft
2018-10-16 14:56 - 2018-04-12 01:38 - 000000000 ___HD C:\Program Files\WindowsApps
2018-10-16 14:56 - 2018-04-12 01:38 - 000000000 ____D C:\WINDOWS\AppReadiness
2018-10-16 14:52 - 2017-12-14 09:19 - 000001085 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Prohlížeč Opera.lnk
2018-10-11 18:29 - 2017-12-08 03:00 - 000000000 ____D C:\WINDOWS\system32\MRT
2018-10-11 18:16 - 2017-12-08 03:00 - 136745976 ____C (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2018-10-10 09:16 - 2018-07-25 19:36 - 000000000 ____D C:\ProgramData\Packages
2018-10-10 09:15 - 2017-12-08 09:52 - 000000000 ____D C:\Users\60352\AppData\Local\Packages
2018-10-10 09:08 - 2018-09-11 15:48 - 000002457 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acrobat Reader DC.lnk
2018-10-05 14:44 - 2017-11-01 19:00 - 000000000 ____D C:\Users\60352\AppData\Local\ConnectedDevicesPlatform
2018-10-05 14:38 - 2017-11-01 19:00 - 000000000 __SHD C:\Users\60352\IntelGraphicsProfiles
2018-10-05 14:38 - 2017-11-01 17:23 - 000000180 _____ C:\WINDOWS\system32\{A6D608F0-0BDE-491A-97AE-5C4B05D86E01}.bat
2018-10-05 14:33 - 2018-07-25 13:42 - 000000006 ____H C:\WINDOWS\Tasks\SA.DAT
2018-10-05 14:31 - 2018-04-11 23:04 - 000524288 _____ C:\WINDOWS\system32\config\BBI
2018-10-05 14:13 - 2018-09-11 15:48 - 000004562 _____ C:\WINDOWS\System32\Tasks\Adobe Acrobat Update Task
2018-10-05 13:56 - 2018-07-25 13:11 - 000571440 _____ C:\WINDOWS\system32\FNTCACHE.DAT
2018-10-05 13:53 - 2018-04-12 01:38 - 000000000 ____D C:\WINDOWS\TextInput
2018-10-05 13:53 - 2018-04-12 01:38 - 000000000 ____D C:\WINDOWS\SysWOW64\Dism
2018-10-05 13:52 - 2018-04-12 01:38 - 000000000 ____D C:\WINDOWS\system32\oobe
2018-10-05 13:52 - 2018-04-12 01:38 - 000000000 ____D C:\WINDOWS\bcastdvr
2018-10-05 13:52 - 2018-04-11 23:04 - 000000000 ____D C:\WINDOWS\system32\Dism
2018-10-02 22:13 - 2018-08-10 17:39 - 000835152 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe
2018-10-02 22:13 - 2018-08-10 17:39 - 000179792 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl
==================== Bamital & volsnap ======================
(There is no automatic fix for files that do not pass verification.)
C:\WINDOWS\system32\winlogon.exe => File is digitally signed
C:\WINDOWS\system32\wininit.exe => File is digitally signed
C:\WINDOWS\explorer.exe => File is digitally signed
C:\WINDOWS\SysWOW64\explorer.exe => File is digitally signed
C:\WINDOWS\system32\svchost.exe => File is digitally signed
C:\WINDOWS\SysWOW64\svchost.exe => File is digitally signed
C:\WINDOWS\system32\services.exe => File is digitally signed
C:\WINDOWS\system32\User32.dll => File is digitally signed
C:\WINDOWS\SysWOW64\User32.dll => File is digitally signed
C:\WINDOWS\system32\userinit.exe => File is digitally signed
C:\WINDOWS\SysWOW64\userinit.exe => File is digitally signed
C:\WINDOWS\system32\rpcss.dll => File is digitally signed
C:\WINDOWS\system32\dnsapi.dll => File is digitally signed
C:\WINDOWS\SysWOW64\dnsapi.dll => File is digitally signed
C:\WINDOWS\system32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2018-07-25 13:11
==================== End of FRST.txt ============================