Že by vir?

[Miroslav Hubata]

Zdravím,
byl jsem na netu, měl jsem otevřeno víc oken, v googlu jsem dal vyhledat jednu ZŠ bratří Venclíků, vyplivlo to odkazy, já na ten první kliknul, ale ten nijak podezřele nevypadal a lup, skočilo jakýsi oranžový okno, chtělo to přihlášení, furt se to načítalo, psalo to o nějakým kontaktu na Windows či co, to jsem přes to okno neviděl, takže jsem to natvrdo vypnul...ono s tím nic moc jinýho nešlo udělat...Nechal jsem to projet Defenderem, aspoň rychlou kontrolou, ale nic nenašel. Nevím...
Nicméně...po nahození se všechno tváří normálně, ale chtěl bych to radši zkontrolovat, jsem absolutní laik, tak rady prosím "polopaticky", díky

Log:
Logfile of random's system information tool 1.10 (written by random/random)
Run by Miroslav Hubata at 2018-06-03 22:07:58
Microsoft Windows 10 Pro
System drive C: has 124 GB (29%) free of 432 GB
Total RAM: 3829 MB (50% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 22:08:04, on 3.6.2018
Platform: Unknown Windows (WinNT 6.02.1008)
MSIE: Internet Explorer v11.0 (11.00.17134.0001)
Boot mode: Normal

Running processes:
C:\Users\Miroslav Hubata\AppData\Local\Microsoft\OneDrive\OneDrive.exe
C:\Program Files (x86)\USB Camera2\VM332_STI.EXE
C:\Program Files (x86)\EgisTec BioExcess\EgisTSR.exe
C:\Program Files (x86)\Lenovo\YouCam\YouCamTray.exe
C:\Program Files (x86)\EgisTec Port Locker\EgisPLTSR.exe
C:\Program Files\trend micro\Miroslav Hubata.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.seznam.cz/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/p/?LinkId=255141
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/p/?LinkId=255141
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F2 - REG:system.ini: UserInit=
O2 - BHO: IEPwdBankBHO - {56CBB761-DA41-4E31-B270-B13B4B0A61D0} - C:\Program Files (x86)\EgisTec BioExcess\EgisIEPwdBank.dll
O4 - HKLM\..\Run: [332BigDog] C:\Program Files (x86)\USB Camera2\VM332_STI.EXE
O4 - HKLM\..\Run: [IMSS] "C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PIconStartup.exe"
O4 - HKLM\..\Run: [VitaKeyTSR] "C:\Program Files (x86)\EgisTec BioExcess\EgisTSR.exe"
O4 - HKLM\..\Run: [UCam_Menu] "C:\Program Files (x86)\Lenovo\YouCam\MUITransfer\MUIStartMenu.exe" "C:\Program Files (x86)\Lenovo\YouCam" UpdateWithCreateOnce "Software\CyberLink\YouCam\3.0"
O4 - HKLM\..\Run: [YouCam Mirror Tray icon] "C:\Program Files (x86)\Lenovo\YouCam\YouCamTray.exe" /s
O4 - HKLM\..\Run: [PLTSR] "C:\Program Files (x86)\EgisTec Port Locker\EgisPLTSR.exe"
O4 - HKCU\..\Run: [OneDrive] "C:\Users\Miroslav Hubata\AppData\Local\Microsoft\OneDrive\OneDrive.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [OneDriveSetup] C:\Windows\SysWOW64\OneDriveSetup.exe /thfirstsetup (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [WAB Migrate] %ProgramFiles%\Windows Mail\wab.exe /Upgrade (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [OneDriveSetup] C:\Windows\SysWOW64\OneDriveSetup.exe /thfirstsetup (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [WAB Migrate] %ProgramFiles%\Windows Mail\wab.exe /Upgrade (User 'NETWORK SERVICE')
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\Program Files (x86)\Microsoft Office\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Odeslat obrázek do zařízení &Bluetooth... - C:\Program Files\Lenovo\Bluetooth Software\btsendto_ie_ctx.htm
O8 - Extra context menu item: Odeslat stránku do zařízení &Bluetooth... - C:\Program Files\Lenovo\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: @C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1004 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: @C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1003 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Odeslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\MIF5BA~1\Office12\ONBttnIE.dll (file missing)
O9 - Extra 'Tools' menuitem: Od&eslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\MIF5BA~1\Office12\ONBttnIE.dll (file missing)
O9 - Extra button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (file missing)
O9 - Extra 'Tools' menuitem: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (file missing)
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files (x86)\MIF5BA~1\Office12\REFIEBAR.DLL (file missing)
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - (no file)
O18 - Protocol: tbauth - {14654CA6-5711-491D-B89A-58E571679951} - C:\Windows\SysWOW64\tbauth.dll
O18 - Protocol: windows.tbauth - {14654CA6-5711-491D-B89A-58E571679951} - C:\Windows\SysWOW64\tbauth.dll
O18 - Protocol: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\WINDOWS\System32\alg.exe (file missing)
O23 - Service: @%SystemRoot%\system32\DiagSvcs\DiagnosticsHub.StandardCollector.ServiceRes.dll,-1000 (diagnosticshub.standardcollector.service) - Unknown owner - C:\WINDOWS\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe (file missing)
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\WINDOWS\System32\lsass.exe (file missing)
O23 - Service: EgisTec Data Security Service - Egis Technology Inc. - C:\Program Files (x86)\EgisTec BioExcess\EgisDSService.exe
O23 - Service: EgisTec Service - Egis Technology Inc. - C:\Program Files (x86)\EgisTec BioExcess\EgisService.exe
O23 - Service: EgisTec Service Help - Egis Technology Inc. - C:\Program Files (x86)\EgisTec Port Locker\Egishlpsvc.exe
O23 - Service: EPSON V5 Service4(01) (EPSON_EB_RPCV4_01) - SEIKO EPSON CORPORATION - C:\ProgramData\EPSON\EPW!3 SSRP\E_S40STB.EXE
O23 - Service: EPSON V3 Service4(01) (EPSON_PM_RPCV4_01) - SEIKO EPSON CORPORATION - C:\ProgramData\EPSON\EPW!3 SSRP\E_S40RPB.EXE
O23 - Service: Elan Service (ETDService) - ELAN Microelectronics Corp. - C:\Program Files\Elantech\ETDService.exe
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\WINDOWS\system32\fxssvc.exe (file missing)
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\WINDOWS\system32\lsass.exe (file missing)
O23 - Service: Intel(R) Management and Security Application Local Management Service (LMS) - Intel Corporation - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\WINDOWS\System32\msdtc.exe (file missing)
O23 - Service: @mqutil.dll,-6102 (MSMQ) - Unknown owner - C:\WINDOWS\system32\mqsvc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\WINDOWS\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\WINDOWS\system32\locator.exe (file missing)
O23 - Service: RtLedService Installer (RtLedService) - Realtek Semiconductor Corp. - C:\Program Files\Realtek\RtLED\RtLEDService.exe
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\WINDOWS\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\SecurityHealthAgent.dll,-1002 (SecurityHealthService) - Unknown owner - C:\WINDOWS\system32\SecurityHealthService.exe (file missing)
O23 - Service: @%ProgramFiles%\Windows Defender Advanced Threat Protection\MsSense.exe,-1001 (Sense) - Unknown owner - C:\Program Files (x86)\Windows Defender Advanced Threat Protection\MsSense.exe (file missing)
O23 - Service: @%SystemRoot%\system32\SensorDataService.exe,-101 (SensorDataService) - Unknown owner - C:\WINDOWS\System32\SensorDataService.exe (file missing)
O23 - Service: @%SystemRoot%\System32\SgrmBroker.exe,-100 (SgrmBroker) - Unknown owner - C:\WINDOWS\system32\SgrmBroker.exe (file missing)
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\WINDOWS\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spectrum.exe,-101 (spectrum) - Unknown owner - C:\WINDOWS\system32\spectrum.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\WINDOWS\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\WINDOWS\system32\sppsvc.exe (file missing)
O23 - Service: OpenSSH Authentication Agent (ssh-agent) - Unknown owner - C:\WINDOWS\System32\OpenSSH\ssh-agent.exe (file missing)
O23 - Service: @%SystemRoot%\system32\TieringEngineService.exe,-702 (TieringEngineService) - Unknown owner - C:\WINDOWS\system32\TieringEngineService.exe (file missing)
O23 - Service: ThinkPad HDD APS Logging Service (TPHDEXLGSVC) - Unknown owner - C:\WINDOWS\System32\TPHDEXLG64.exe (file missing)
O23 - Service: Intel(R) Management & Security Application User Notification Service (UNS) - Intel Corporation - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\WINDOWS\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\WINDOWS\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\WINDOWS\system32\vssvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\WINDOWS\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\WINDOWS\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)
O23 - Service: @%systemroot%\system32\xbgmsvc.exe,-100 (xbgm) - Unknown owner - C:\WINDOWS\system32\xbgmsvc.exe (file missing)

--
End of file - 10715 bytes

======Listing Processes======









C:\WINDOWS\system32\lsass.exe
winlogon.exe
c:\windows\system32\svchost.exe -k dcomlaunch -p -s PlugPlay
"fontdrvhost.exe"
"fontdrvhost.exe"
C:\WINDOWS\system32\svchost.exe -k DcomLaunch -p
c:\windows\system32\svchost.exe -k rpcss -p
c:\windows\system32\svchost.exe -k dcomlaunch -p -s LSM
"dwm.exe"
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -p -s NcbService
c:\windows\system32\svchost.exe -k netsvcs -p -s Schedule
c:\windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
c:\windows\system32\svchost.exe -k netsvcs -p -s UserManager
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -p -s SysMain
c:\windows\system32\svchost.exe -k netsvcs -p -s Themes
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -p -s CscService

c:\windows\system32\svchost.exe -k localservicenetworkrestricted -p -s TimeBrokerSvc
c:\windows\system32\svchost.exe -k localservicenetworkrestricted -p -s lmhosts
c:\windows\system32\svchost.exe -k localservicenetworkrestricted -p -s EventLog
C:\WINDOWS\system32\svchost.exe -k LocalServiceNoNetwork -p
c:\windows\system32\svchost.exe -k localservice -p -s EventSystem
c:\windows\system32\svchost.exe -k netsvcs -p -s SENS
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -p -s AudioEndpointBuilder
c:\windows\system32\svchost.exe -k localservice -p -s FontCache
c:\windows\system32\svchost.exe -k netsvcs -p -s lfsvc
c:\windows\system32\svchost.exe -k localservice -p -s nsi
c:\windows\system32\svchost.exe -k localservicenetworkrestricted -p -s Dhcp
c:\windows\system32\svchost.exe -k networkservice -p -s NlaSvc
C:\WINDOWS\System32\svchost.exe -k LocalServiceNetworkRestricted -p
C:\WINDOWS\system32\svchost.exe -k LocalService -p
"C:\Program Files (x86)\EgisTec BioExcess\EgisService.exe"
"C:\Program Files (x86)\EgisTec Port Locker\Egishlpsvc.exe"
c:\windows\system32\svchost.exe -k appmodel -p -s StateRepository
c:\windows\system32\svchost.exe -k localservice -p -s netprofm
C:\WINDOWS\system32\svchost.exe -k LocalServiceNetworkRestricted -p
C:\WINDOWS\System32\svchost.exe -k LocalServiceNetworkRestricted -p
c:\windows\system32\svchost.exe -k networkservice -p -s Dnscache
c:\windows\system32\svchost.exe -k localservicenetworkrestricted -p -s WinHttpAutoProxySvc
C:\WINDOWS\system32\svchost.exe -k LocalSystemNetworkRestricted -p
c:\windows\system32\svchost.exe -k netsvcs -p -s ShellHWDetection
C:\WINDOWS\System32\spoolsv.exe
c:\windows\system32\svchost.exe -k networkservice -p -s LanmanWorkstation
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -p -s DeviceAssociationService
"C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe"
"C:\Program Files (x86)\EgisTec BioExcess\EgisDSService.exe"
c:\windows\system32\svchost.exe -k networkservice -p -s CryptSvc
C:\WINDOWS\System32\svchost.exe -k utcsvc -p

"C:\Program Files\Elantech\ETDService.exe"
c:\windows\system32\svchost.exe -k localservicenonetwork -p -s DPS
c:\windows\system32\svchost.exe -k localservice -p -s SstpSvc
"C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe"
"C:\Program Files\Realtek\RtLED\RtLEDService.exe"
c:\windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
"C:\ProgramData\EPSON\EPW!3 SSRP\E_S40RPB.EXE"
"C:\ProgramData\EPSON\EPW!3 SSRP\E_S40STB.EXE"
c:\windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
c:\windows\system32\svchost.exe -k iissvcs
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -p -s TrkWks
c:\windows\microsoft.net\framework64\v4.0.30319\smsvchost.exe
c:\windows\system32\svchost.exe -k apphost -s AppHostSvc
System32\TPHDEXLG64.exe
c:\windows\system32\svchost.exe -k netsvcs -p -s WpnService
C:\WINDOWS\system32\mqsvc.exe
c:\windows\system32\svchost.exe -k netsvcs -p -s iphlpsvc

c:\windows\system32\svchost.exe -k netsvcs
c:\windows\system32\svchost.exe -k localservice -p -s WdiServiceHost
c:\windows\system32\svchost.exe -k netsvcs -p -s Browser
c:\windows\system32\svchost.exe -k networkservicenetworkrestricted -p -s PolicyAgent
"c:\windows\microsoft.net\framework64\v4.0.30319\smsvchost.exe" -netmsmqactivator
"C:\Program Files\Realtek\RtLED\RtLED.exe"
C:\WINDOWS\system32\SearchIndexer.exe /Embedding

"C:\Program Files\Elantech\ETDCtrl.exe"
c:\windows\system32\svchost.exe -k unistacksvcgroup -s CDPUserSvc
sihost.exe
c:\windows\system32\svchost.exe -k unistacksvcgroup -s WpnUserService
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -p -s TabletInputService
"ctfmon.exe"
C:\WINDOWS\Explorer.EXE
c:\windows\system32\svchost.exe -k netsvcs -p -s Appinfo
c:\windows\system32\svchost.exe -k localservice -p -s CDPSvc
"C:\Program Files\Elantech\ETDCtrlHelper.exe"
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -p -s PcaSvc
c:\windows\system32\svchost.exe -k netsvcs -p -s TokenBroker
C:\WINDOWS\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
"C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mca
"C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca
C:\Windows\System32\RuntimeBroker.exe -Embedding
C:\Windows\System32\RuntimeBroker.exe -Embedding
C:\Windows\System32\RuntimeBroker.exe -Embedding
c:\windows\system32\svchost.exe -k localservice -p -s LicenseManager
"C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.18041.14611.0_x64__8wekyb3d8bbwe\Video.UI.exe" -ServerName:Microsoft.ZuneVideo.AppX758ya5sqdjd98rx6z7g95nw6jy7bqx9y.mca
"C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.9330.20915.0_x64__8wekyb3d8bbwe\HxTsr.exe" -ServerName:Hx.IPC.Server
"C:\Program Files\WindowsApps\Microsoft.SkypeApp_12.1815.209.0_x64__kzf8qxf38zg5c\SkypeHost.exe" -ServerName:SkypeHost.ServerServer
"C:\Program Files\Windows Defender\MSASCuiL.exe"
"C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe" -s
"C:\Windows\System32\TpShocks.exe"
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -p -s WdiSystemHost
"C:\Program Files (x86)\Lenovo\Energy Management\utility.exe"
"C:\Program Files (x86)\Lenovo\Energy Management\Energy Management.exe"
"C:\Windows\System32\hkcmd.exe"
"C:\Windows\System32\igfxpers.exe"
"C:\Users\Miroslav Hubata\AppData\Local\Microsoft\OneDrive\OneDrive.exe" /background
"C:\Program Files (x86)\USB Camera2\VM332_STI.EXE"
"C:\Program Files (x86)\EgisTec BioExcess\EgisTSR.exe"
"C:\Program Files (x86)\Lenovo\YouCam\YouCamTray.exe" /s
"C:\Program Files (x86)\EgisTec Port Locker\EgisPLTSR.exe"
C:\Windows\System32\RuntimeBroker.exe -Embedding
C:\Windows\System32\RuntimeBroker.exe -Embedding
C:\Windows\System32\SystemSettingsBroker.exe -Embedding
c:\windows\system32\svchost.exe -k localservicenetworkrestricted -s RmSvc
c:\windows\system32\svchost.exe -k unistacksvcgroup
"C:\Program Files (x86)\Mozilla Firefox\firefox.exe"
"C:\Program Files (x86)\Mozilla Firefox\firefox.exe" -contentproc --channel="8620.0.626101544\1820066778" -greomni "C:\Program Files (x86)\Mozilla Firefox\omni.ja" -appomni "C:\Program Files (x86)\Mozilla Firefox\browser\omni.ja" -appdir "C:\Program Files (x86)\Mozilla Firefox\browser" "C:\Users\Miroslav Hubata\AppData\LocalLow\Mozilla\Temp-{9e57ff0c-942d-4511-a845-77178bbe560c}" 8620 "\\.\pipe\gecko-crash-server-pipe.8620" 1472 gpu
"C:\Program Files (x86)\Mozilla Firefox\firefox.exe" -contentproc --channel="8620.3.293265229\1916404166" -childID 1 -isForBrowser -boolPrefs 299:0| -stringPrefs 285:38;{9e57ff0c-942d-4511-a845-77178bbe560c}| -schedulerPrefs 0001,2 -greomni "C:\Program Files (x86)\Mozilla Firefox\omni.ja" -appomni "C:\Program Files (x86)\Mozilla Firefox\browser\omni.ja" -appdir "C:\Program Files (x86)\Mozilla Firefox\browser" 8620 "\\.\pipe\gecko-crash-server-pipe.8620" 1320 tab
"C:\Program Files (x86)\Mozilla Firefox\firefox.exe" -contentproc --channel="8620.20.2002104258\167318423" -childID 3 -isForBrowser -boolPrefs 299:0| -stringPrefs 285:38;{9e57ff0c-942d-4511-a845-77178bbe560c}| -schedulerPrefs 0001,2 -greomni "C:\Program Files (x86)\Mozilla Firefox\omni.ja" -appomni "C:\Program Files (x86)\Mozilla Firefox\browser\omni.ja" -appdir "C:\Program Files (x86)\Mozilla Firefox\browser" 8620 "\\.\pipe\gecko-crash-server-pipe.8620" 3580 tab
c:\windows\system32\svchost.exe -k localserviceandnoimpersonation -p -s SSDPSRV
c:\windows\system32\svchost.exe -k networkservice -p -s DoSvc
"C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe"
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -p -s StorSvc

c:\windows\system32\svchost.exe -k netsvcs -p
c:\windows\system32\svchost.exe -k localservicenetworkrestricted -p -s wscsvc
C:\Windows\System32\RuntimeBroker.exe -Embedding
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -p -s Netman
c:\windows\system32\svchost.exe -k netsvcs -p -s BITS
C:\WINDOWS\system32\DllHost.exe /Processid:{973D20D7-562D-44B9-B70B-5A0F49CCDF3F}
"C:\Windows\SystemApps\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\SecHealthUI.exe" -ServerName:SecHealthUI.AppXep4x2tbtjws1v9qqs0rmb3hxykvkpqtn.mca
C:\WINDOWS\system32\ApplicationFrameHost.exe -Embedding
C:\WINDOWS\system32\DllHost.exe /Processid:{7E55A26D-EF95-4A45-9F55-21E52ADF9887}
"C:\Program Files (x86)\Mozilla Firefox\firefox.exe" -contentproc --channel="8620.34.865325558\2013193437" -childID 5 -isForBrowser -boolPrefs 299:0| -stringPrefs 285:38;{9e57ff0c-942d-4511-a845-77178bbe560c}| -schedulerPrefs 0001,2 -greomni "C:\Program Files (x86)\Mozilla Firefox\omni.ja" -appomni "C:\Program Files (x86)\Mozilla Firefox\browser\omni.ja" -appdir "C:\Program Files (x86)\Mozilla Firefox\browser" 8620 "\\.\pipe\gecko-crash-server-pipe.8620" 4232 tab
C:\Windows\System32\smartscreen.exe -Embedding
C:\WINDOWS\system32\AUDIODG.EXE 0x554
"C:\Users\Miroslav Hubata\Desktop\RSITx64.exe"
C:\WINDOWS\system32\wbem\wmiprvse.exe

=========Mozilla firefox=========

ProfilePath - C:\Users\Miroslav Hubata\AppData\Roaming\Mozilla\Firefox\Profiles\26b90t9b.default

prefs.js - "browser.startup.homepage" - "https://www.seznam.cz/"

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 29.0.0.171 Plugin
"Path"=C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_29_0_0_171.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0]
"Description"=Ag Player Plugin
"Path"=c:\Program Files (x86)\Microsoft Silverlight\5.1.50907.0\npctrl.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922]
"Description"=WLPG Install MIME type
"Path"=C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3508.1109]
"Description"=WLPG Install MIME type
"Path"=C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\Adobe Reader]
"Description"=Handles PDFs in-place in Firefox
"Path"=C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll


[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 29.0.0.171 Plugin
"Path"=C:\WINDOWS\system32\Macromed\Flash\NPSWF64_29_0_0_171.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0]
"Description"=Ag Player Plugin
"Path"=c:\Program Files\Microsoft Silverlight\5.1.50907.0\npctrl.dll

C:\Program Files (x86)\Mozilla Firefox\extensions\
{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}

C:\Program Files (x86)\Mozilla Firefox\plugins\
nppdf32.dll

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{56CBB761-DA41-4E31-B270-B13B4B0A61D0}]
IEPwdBankBHO Class - C:\Program Files (x86)\EgisTec BioExcess\EgisIEPwdBank.dll [2010-05-28 53616]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"SecurityHealth"=C:\Program Files\Windows Defender\MSASCuiL.exe [2018-04-12 638872]
"ETDCtrl"=C:\Program Files\Elantech\ETDCtrl.exe [2015-10-07 3242696]
"RtHDVCpl"=C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [2010-06-02 10821224]
"ETDWare"=C:\Program Files\Elantech\ETDCtrl.exe [2015-10-07 3242696]
"TpShocks"=C:\Windows\System32\TpShocks.exe [2010-03-15 231328]
"UpdatePRCShortCut"=C:\Program Files\Lenovo\OneKey App\OneKey Recovery\MUITransfer\MUIStartMenu.exe [2009-05-13 222504]
"EnergyUtility"=C:\Program Files (x86)\Lenovo\Energy Management\utility.exe [2010-04-12 4462496]
"Energy Management"=C:\Program Files (x86)\Lenovo\Energy Management\Energy Management.exe [2010-03-18 7056800]
"IgfxTray"=C:\WINDOWS\system32\igfxtray.exe [2012-11-27 168480]
"HotKeysCmds"=C:\WINDOWS\system32\hkcmd.exe [2012-11-27 393760]
"Persistence"=C:\WINDOWS\system32\igfxpers.exe [2012-11-27 418336]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"OneDrive"=C:\Users\Miroslav Hubata\AppData\Local\Microsoft\OneDrive\OneDrive.exe [2018-05-29 1628832]

[HKEY_LOCAL_MACHINE\Software\wow6432node\Microsoft\Windows\CurrentVersion\Run]
"332BigDog"=C:\Program Files (x86)\USB Camera2\VM332_STI.EXE [2010-01-19 536576]
"IMSS"=C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PIconStartup.exe [2009-09-30 111640]
"VitaKeyTSR"=C:\Program Files (x86)\EgisTec BioExcess\EgisTSR.exe [2010-05-28 376176]
"UCam_Menu"=C:\Program Files (x86)\Lenovo\YouCam\MUITransfer\MUIStartMenu.exe [2009-05-20 222504]
"YouCam Mirror Tray icon"=C:\Program Files (x86)\Lenovo\YouCam\YouCamTray.exe [2010-03-03 171104]
"PLTSR"=C:\Program Files (x86)\EgisTec Port Locker\EgisPLTSR.exe [2010-09-11 364400]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
C:\WINDOWS\system32\igfxdev.dll [2012-11-26 390144]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Ahcache.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\AudioEndpointBuilder]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\AudioSrv]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\CoreMessagingRegistrar]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\HdAudAddService.Sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\HdAudBus.Sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\iai2c.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SerCx2.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SpbCx.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\StateRepository]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\uefi.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\usbaudio.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\UserManager]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E96C-E325-11CE-BFC1-08002BE10318}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{F2E7DD72-6468-4E36-B6F1-6488F42C1B52}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Ahcache.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AudioEndpointBuilder]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AudioSrv]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\CoreMessagingRegistrar]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\HdAudAddService.Sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\HdAudBus.Sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\NetSetupSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\SerCx2.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\SpbCx.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\StateRepository]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\uefi.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\usbaudio.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\UserManager]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{4D36E96C-E325-11CE-BFC1-08002BE10318}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{F2E7DD72-6468-4E36-B6F1-6488F42C1B52}]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"DSCAutomationHostEnabled"=2
"EnableFullTrustStartupTasks"=2
"EnableUwpStartupTasks"=2
"SupportFullTrustStartupTasks"=1
"SupportUwpStartupTasks"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDrives"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDrives"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"midimapper"=midimap.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.l3acm"=C:\Windows\System32\l3codeca.acm
"msacm.msadpcm"=msadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"vidc.i420"=iyuv_32.dll
"vidc.iyuv"=iyuv_32.dll
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"vidc.uyvy"=msyuv.dll
"vidc.yuy2"=msyuv.dll
"vidc.yvu9"=tsbyuv.dll
"vidc.yvyu"=msyuv.dll
"wavemapper"=msacm32.drv
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv
"MSVideo8"=VfWWDM32.dll

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*

======List of files/folders created in the last 1 month======

2018-05-23 12:38:09 ----D---- C:\ProgramData\Microsoft OneDrive
2018-05-23 12:08:53 ----ASH---- C:\hiberfil.sys
2018-05-23 12:05:28 ----SD---- C:\Users\Miroslav Hubata\AppData\Roaming\Microsoft
2018-05-23 12:05:28 ----D---- C:\Users\Miroslav Hubata\AppData\Roaming\Media Center Programs
2018-05-23 12:00:52 ----D---- C:\ProgramData\USOShared
2018-05-23 12:00:31 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2018-05-23 12:00:06 ----A---- C:\WINDOWS\SYSWOW64\PrintConfig.dll
2018-05-23 11:57:07 ----D---- C:\WINDOWS\Prefetch
2018-05-23 11:55:29 ----D---- C:\WINDOWS\system32\SleepStudy
2018-05-23 11:55:24 ----A---- C:\WINDOWS\system32\FNTCACHE.DAT
2018-05-22 14:25:40 ----D---- C:\Program Files\Common Files\SpeechEngines
2018-05-22 14:23:35 ----AS---- C:\WINDOWS\bootstat.dat
2018-05-22 14:21:32 ----D---- C:\WINDOWS\system32\Microsoft
2018-05-22 14:21:32 ----D---- C:\WINDOWS\ServiceProfiles
2018-05-22 14:14:23 ----A---- C:\WINDOWS\SYSWOW64\wmp.dll
2018-05-22 14:14:23 ----A---- C:\WINDOWS\system32\wmp.dll
2018-05-22 14:13:57 ----A---- C:\WINDOWS\SYSWOW64\jscript.dll
2018-05-22 14:13:55 ----A---- C:\WINDOWS\SYSWOW64\mshtml.dll
2018-05-22 14:13:55 ----A---- C:\WINDOWS\SYSWOW64\jscript9diag.dll
2018-05-22 14:13:55 ----A---- C:\WINDOWS\SYSWOW64\jscript9.dll
2018-05-22 14:13:55 ----A---- C:\WINDOWS\SYSWOW64\ieapfltr.dll
2018-05-22 14:13:55 ----A---- C:\WINDOWS\SYSWOW64\EdgeManager.dll
2018-05-22 14:13:54 ----A---- C:\WINDOWS\SYSWOW64\edgehtml.dll
2018-05-22 14:13:53 ----A---- C:\WINDOWS\SYSWOW64\webplatstorageserver.dll
2018-05-22 14:13:53 ----A---- C:\WINDOWS\SYSWOW64\Chakra.dll
2018-05-22 14:13:52 ----A---- C:\WINDOWS\SYSWOW64\msfeeds.dll
2018-05-22 14:13:52 ----A---- C:\WINDOWS\SYSWOW64\ieframe.dll
2018-05-22 14:13:52 ----A---- C:\WINDOWS\SYSWOW64\iedkcs32.dll
2018-05-22 14:13:52 ----A---- C:\WINDOWS\system32\jscript.dll
2018-05-22 14:13:51 ----A---- C:\WINDOWS\system32\mshtml.dll
2018-05-22 14:13:50 ----A---- C:\WINDOWS\system32\jscript9diag.dll
2018-05-22 14:13:50 ----A---- C:\WINDOWS\system32\ieapfltr.dll
2018-05-22 14:13:50 ----A---- C:\WINDOWS\system32\Chakradiag.dll
2018-05-22 14:13:50 ----A---- C:\WINDOWS\system32\Chakra.dll
2018-05-22 14:13:49 ----A---- C:\WINDOWS\system32\jscript9.dll
2018-05-22 14:13:49 ----A---- C:\WINDOWS\system32\EdgeManager.dll
2018-05-22 14:13:49 ----A---- C:\WINDOWS\system32\edgehtml.dll
2018-05-22 14:13:48 ----A---- C:\WINDOWS\system32\webplatstorageserver.dll
2018-05-22 14:13:48 ----A---- C:\WINDOWS\system32\msfeeds.dll
2018-05-22 14:13:48 ----A---- C:\WINDOWS\system32\ieframe.dll
2018-05-22 14:13:48 ----A---- C:\WINDOWS\system32\iedkcs32.dll
2018-05-22 14:13:45 ----A---- C:\WINDOWS\system32\MixedReality.Broker.dll
2018-05-22 14:13:42 ----A---- C:\WINDOWS\system32\Windows.Cortana.Analog.dll
2018-05-22 14:13:42 ----A---- C:\WINDOWS\system32\Hydrogen.dll
2018-05-22 14:13:42 ----A---- C:\WINDOWS\system32\HologramCompositor.dll
2018-05-22 14:13:40 ----A---- C:\WINDOWS\SYSWOW64\WpcWebFilter.dll
2018-05-22 14:13:40 ----A---- C:\WINDOWS\SYSWOW64\rpcrt4.dll
2018-05-22 14:13:39 ----A---- C:\WINDOWS\SYSWOW64\Windows.Mirage.dll
2018-05-22 14:13:38 ----A---- C:\WINDOWS\SYSWOW64\Windows.Mirage.Internal.dll
2018-05-22 14:13:37 ----A---- C:\WINDOWS\SYSWOW64\mstscax.dll
2018-05-22 14:13:36 ----A---- C:\WINDOWS\SYSWOW64\shell32.dll
2018-05-22 14:13:34 ----A---- C:\WINDOWS\SYSWOW64\Windows.Media.Protection.PlayReady.dll
2018-05-22 14:13:34 ----A---- C:\WINDOWS\SYSWOW64\vbscript.dll
2018-05-22 14:13:34 ----A---- C:\WINDOWS\SYSWOW64\rasapi32.dll
2018-05-22 14:13:34 ----A---- C:\WINDOWS\SYSWOW64\iertutil.dll
2018-05-22 14:13:33 ----A---- C:\WINDOWS\SYSWOW64\wininet.dll
2018-05-22 14:13:33 ----A---- C:\WINDOWS\SYSWOW64\urlmon.dll
2018-05-22 14:13:33 ----A---- C:\WINDOWS\SYSWOW64\gdi32full.dll
2018-05-22 14:13:32 ----A---- C:\WINDOWS\SYSWOW64\itss.dll
2018-05-22 14:13:32 ----A---- C:\WINDOWS\SYSWOW64\dwmcore.dll
2018-05-22 14:13:32 ----A---- C:\WINDOWS\SYSWOW64\comsvcs.dll
2018-05-22 14:13:25 ----A---- C:\WINDOWS\SYSWOW64\windows.storage.dll
2018-05-22 14:13:25 ----A---- C:\WINDOWS\SYSWOW64\rdpbase.dll
2018-05-22 14:13:25 ----A---- C:\WINDOWS\SYSWOW64\AppxPackaging.dll
2018-05-22 14:13:25 ----A---- C:\WINDOWS\SYSWOW64\AppXDeploymentClient.dll
2018-05-22 14:13:24 ----A---- C:\WINDOWS\SYSWOW64\Windows.Data.Pdf.dll
2018-05-22 14:13:24 ----A---- C:\WINDOWS\SYSWOW64\tquery.dll
2018-05-22 14:13:24 ----A---- C:\WINDOWS\SYSWOW64\CoreUIComponents.dll
2018-05-22 14:13:24 ----A---- C:\WINDOWS\SYSWOW64\cdp.dll
2018-05-22 14:13:23 ----A---- C:\WINDOWS\system32\WpcWebFilter.dll
2018-05-22 14:13:23 ----A---- C:\WINDOWS\system32\Spectrum.exe
2018-05-22 14:13:22 ----A---- C:\WINDOWS\system32\wininet.dll
2018-05-22 14:13:22 ----A---- C:\WINDOWS\system32\Windows.Mirage.Internal.dll
2018-05-22 14:13:22 ----A---- C:\WINDOWS\system32\Windows.Mirage.dll
2018-05-22 14:13:22 ----A---- C:\WINDOWS\system32\urlmon.dll
2018-05-22 14:13:21 ----A---- C:\WINDOWS\system32\StorSvc.dll
2018-05-22 14:13:21 ----A---- C:\WINDOWS\system32\iertutil.dll
2018-05-22 14:13:21 ----A---- C:\WINDOWS\system32\gdi32full.dll
2018-05-22 14:13:20 ----A---- C:\WINDOWS\system32\WebRuntimeManager.dll
2018-05-22 14:13:20 ----A---- C:\WINDOWS\system32\itss.dll
2018-05-22 14:13:20 ----A---- C:\WINDOWS\system32\EdgeContent.dll
2018-05-22 14:13:17 ----A---- C:\WINDOWS\system32\winload.exe
2018-05-22 14:13:17 ----A---- C:\WINDOWS\system32\rpcrt4.dll
2018-05-22 14:13:17 ----A---- C:\WINDOWS\system32\ntoskrnl.exe
2018-05-22 14:13:17 ----A---- C:\WINDOWS\system32\drivers\ntfs.sys
2018-05-22 14:13:16 ----A---- C:\WINDOWS\system32\SharedPCCSP.dll
2018-05-22 14:13:16 ----A---- C:\WINDOWS\system32\dwmcore.dll
2018-05-22 14:13:16 ----A---- C:\WINDOWS\system32\comsvcs.dll
2018-05-22 14:13:15 ----A---- C:\WINDOWS\system32\Windows.Media.Protection.PlayReady.dll
2018-05-22 14:13:14 ----A---- C:\WINDOWS\system32\AppXDeploymentServer.dll
2018-05-22 14:13:14 ----A---- C:\WINDOWS\system32\AppXDeploymentExtensions.desktop.dll
2018-05-22 14:13:14 ----A---- C:\WINDOWS\system32\ApplyTrustOffline.exe
2018-05-22 14:13:13 ----A---- C:\WINDOWS\system32\mstscax.dll
2018-05-22 14:13:13 ----A---- C:\WINDOWS\system32\AppXDeploymentExtensions.onecore.dll
2018-05-22 14:13:11 ----A---- C:\WINDOWS\system32\shell32.dll
2018-05-22 14:13:10 ----A---- C:\WINDOWS\system32\vbscript.dll
2018-05-22 14:13:10 ----A---- C:\WINDOWS\system32\UIRibbonRes.dll
2018-05-22 14:13:10 ----A---- C:\WINDOWS\system32\TSpkg.dll
2018-05-22 14:13:10 ----A---- C:\WINDOWS\system32\rasapi32.dll
2018-05-22 14:13:10 ----A---- C:\WINDOWS\system32\credssp.dll
2018-05-22 14:13:08 ----A---- C:\WINDOWS\system32\msxml3.dll
2018-05-22 14:13:08 ----A---- C:\WINDOWS\system32\msi.dll
2018-05-22 14:13:07 ----A---- C:\WINDOWS\system32\Windows.UI.Xaml.Resources.rs3.dll
2018-05-22 14:13:07 ----A---- C:\WINDOWS\system32\win32kfull.sys
2018-05-22 14:13:07 ----A---- C:\WINDOWS\system32\rdpbase.dll
2018-05-22 14:13:06 ----A---- C:\WINDOWS\system32\Windows.UI.Xaml.Resources.win8rtm.dll
2018-05-22 14:13:06 ----A---- C:\WINDOWS\system32\Windows.UI.Xaml.Resources.win81.dll
2018-05-22 14:13:06 ----A---- C:\WINDOWS\system32\Windows.UI.Xaml.Resources.th.dll
2018-05-22 14:13:06 ----A---- C:\WINDOWS\system32\Windows.UI.Xaml.Resources.rs4.dll
2018-05-22 14:13:06 ----A---- C:\WINDOWS\system32\Windows.UI.Xaml.Resources.rs2.dll
2018-05-22 14:13:06 ----A---- C:\WINDOWS\system32\Windows.UI.Xaml.Resources.rs1.dll
2018-05-22 14:13:06 ----A---- C:\WINDOWS\system32\win32kbase.sys
2018-05-22 14:13:06 ----A---- C:\WINDOWS\system32\PsmServiceExtHost.dll
2018-05-22 14:13:06 ----A---- C:\WINDOWS\system32\drivers\dxgkrnl.sys
2018-05-22 14:13:05 ----A---- C:\WINDOWS\system32\Windows.Data.Pdf.dll
2018-05-22 14:13:05 ----A---- C:\WINDOWS\system32\tquery.dll
2018-05-22 14:13:05 ----A---- C:\WINDOWS\system32\mssprxy.dll
2018-05-22 14:13:05 ----A---- C:\WINDOWS\system32\CoreUIComponents.dll
2018-05-22 14:13:05 ----A---- C:\WINDOWS\system32\cdp.dll
2018-05-22 14:13:04 ----A---- C:\WINDOWS\system32\SgrmEnclave_secure.dll
2018-05-22 14:13:04 ----A---- C:\WINDOWS\system32\SgrmEnclave.dll
2018-05-22 14:13:04 ----A---- C:\WINDOWS\system32\PerceptionSimulationExtensions.dll
2018-05-22 14:13:02 ----A---- C:\WINDOWS\SYSWOW64\dbgeng.dll
2018-05-22 14:13:02 ----A---- C:\WINDOWS\system32\AppVScripting.dll
2018-05-22 14:13:02 ----A---- C:\WINDOWS\system32\AppVReporting.dll
2018-05-22 14:13:02 ----A---- C:\WINDOWS\system32\AppVPublishing.dll
2018-05-22 14:13:02 ----A---- C:\WINDOWS\system32\AppVClient.exe
2018-05-22 14:13:01 ----A---- C:\WINDOWS\SYSWOW64\WerFault.exe
2018-05-22 14:13:01 ----A---- C:\WINDOWS\SYSWOW64\wer.dll
2018-05-22 14:13:01 ----A---- C:\WINDOWS\system32\wuaueng.dll
2018-05-22 14:13:01 ----A---- C:\WINDOWS\system32\WerFault.exe
2018-05-22 14:13:01 ----A---- C:\WINDOWS\system32\wer.dll
2018-05-22 14:13:01 ----A---- C:\WINDOWS\system32\updatehandlers.dll
2018-05-22 14:13:01 ----A---- C:\WINDOWS\system32\dbgeng.dll
2018-05-22 14:13:00 ----A---- C:\WINDOWS\SYSWOW64\tzres.dll
2018-05-22 14:13:00 ----A---- C:\WINDOWS\SYSWOW64\oleaut32.dll
2018-05-22 14:13:00 ----A---- C:\WINDOWS\system32\wuapi.dll
2018-05-22 14:13:00 ----A---- C:\WINDOWS\system32\tzres.dll
2018-05-22 14:13:00 ----A---- C:\WINDOWS\system32\securekernel.exe
2018-05-22 14:13:00 ----A---- C:\WINDOWS\system32\rpcss.dll
2018-05-22 14:13:00 ----A---- C:\WINDOWS\system32\lsasrv.dll
2018-05-22 14:13:00 ----A---- C:\WINDOWS\system32\drivers\ksecpkg.sys
2018-05-22 14:13:00 ----A---- C:\WINDOWS\system32\drivers\cng.sys
2018-05-22 14:13:00 ----A---- C:\WINDOWS\system32\drivers\clfs.sys
2018-05-22 14:13:00 ----A---- C:\WINDOWS\system32\diagtrack.dll
2018-05-22 14:13:00 ----A---- C:\WINDOWS\system32\dcntel.dll
2018-05-22 14:12:59 ----A---- C:\WINDOWS\system32\windows.storage.dll
2018-05-22 14:12:59 ----A---- C:\WINDOWS\system32\wcimage.dll
2018-05-22 14:12:59 ----A---- C:\WINDOWS\system32\oleaut32.dll
2018-05-22 14:12:59 ----A---- C:\WINDOWS\system32\AppxPackaging.dll
2018-05-22 14:12:59 ----A---- C:\WINDOWS\system32\AppXDeploymentClient.dll
2018-05-22 14:12:58 ----A---- C:\WINDOWS\SYSWOW64\wuapi.dll
2018-05-22 14:12:58 ----A---- C:\WINDOWS\SYSWOW64\win32kfull.sys
2018-05-22 14:12:58 ----A---- C:\WINDOWS\SYSWOW64\TSpkg.dll
2018-05-22 14:12:58 ----A---- C:\WINDOWS\SYSWOW64\msxml3.dll
2018-05-22 14:12:58 ----A---- C:\WINDOWS\SYSWOW64\credssp.dll
2018-05-22 14:12:57 ----A---- C:\WINDOWS\system32\rdpnano.dll
2018-05-22 14:12:57 ----A---- C:\WINDOWS\system32\hvloader.dll
2018-05-22 14:12:57 ----A---- C:\WINDOWS\system32\hvix64.exe
2018-05-22 14:12:57 ----A---- C:\WINDOWS\system32\hvax64.exe
2018-05-22 14:12:56 ----A---- C:\WINDOWS\SYSWOW64\CoreMessaging.dll
2018-05-22 14:12:56 ----A---- C:\WINDOWS\system32\drivers\vhdmp.sys
2018-05-22 14:12:56 ----A---- C:\WINDOWS\system32\CoreMessaging.dll
2018-05-22 14:01:31 ----D---- C:\WINDOWS\SYSWOW64\BestPractices
2018-05-22 14:01:31 ----D---- C:\WINDOWS\system32\msmq
2018-05-22 14:01:31 ----D---- C:\WINDOWS\system32\BestPractices
2018-05-22 14:01:31 ----D---- C:\inetpub
2018-05-22 14:00:30 ----A---- C:\WINDOWS\SYSWOW64\NlsLexicons0009.dll
2018-05-22 14:00:29 ----A---- C:\WINDOWS\SYSWOW64\NlsData0009.dll
2018-05-22 14:00:27 ----A---- C:\WINDOWS\system32\prm0009.dll
2018-05-22 14:00:27 ----A---- C:\WINDOWS\system32\NlsLexicons0009.dll
2018-05-22 14:00:27 ----A---- C:\WINDOWS\system32\NlsData0009.dll
2018-05-22 13:59:55 ----A---- C:\WINDOWS\SYSWOW64\xpsrchvw.exe
2018-05-22 13:59:54 ----A---- C:\WINDOWS\SYSWOW64\XpsFilt.dll
2018-05-22 13:59:52 ----A---- C:\WINDOWS\SYSWOW64\XPSSHHDR.dll
2018-05-22 13:59:51 ----A---- C:\WINDOWS\system32\XPSSHHDR.dll
2018-05-22 13:59:50 ----A---- C:\WINDOWS\system32\xpsrchvw.exe
2018-05-22 13:59:48 ----A---- C:\WINDOWS\system32\XpsFilt.dll
2018-05-22 13:59:08 ----D---- C:\WINDOWS\SYSWOW64\XPSViewer
2018-05-22 13:59:02 ----D---- C:\Program Files\Reference Assemblies
2018-05-22 13:59:02 ----D---- C:\Program Files\MSBuild
2018-05-22 13:59:02 ----D---- C:\Program Files (x86)\Reference Assemblies
2018-05-22 13:59:02 ----D---- C:\Program Files (x86)\MSBuild
2018-05-22 13:57:15 ----A---- C:\WINDOWS\SYSWOW64\PresentationNative_v0300.dll
2018-05-22 13:57:13 ----A---- C:\WINDOWS\SYSWOW64\TsWpfWrp.exe
2018-05-22 13:57:12 ----A---- C:\WINDOWS\SYSWOW64\PresentationCFFRasterizerNative_v0300.dll
2018-05-22 13:57:11 ----A---- C:\WINDOWS\system32\PresentationCFFRasterizerNative_v0300.dll
2018-05-22 13:57:08 ----A---- C:\WINDOWS\system32\PresentationNative_v0300.dll
2018-05-22 13:57:05 ----A---- C:\WINDOWS\system32\TsWpfWrp.exe
2018-05-22 12:05:34 ----DC---- C:\WINDOWS\Panther
2018-05-08 14:06:17 ----A---- C:\WINDOWS\SYSWOW64\FlashPlayerInstaller.exe

======List of files/folders modified in the last 1 month======

2018-06-03 22:08:02 ----D---- C:\WINDOWS\Temp
2018-06-03 22:08:01 ----D---- C:\Program Files\trend micro
2018-06-03 21:43:53 ----D---- C:\WINDOWS\System32
2018-06-03 21:43:52 ----D---- C:\WINDOWS\INF
2018-06-03 21:39:33 ----D---- C:\WINDOWS\AppReadiness
2018-06-03 21:39:32 ----D---- C:\ProgramData\regid.1991-06.com.microsoft
2018-06-03 21:38:39 ----D---- C:\WINDOWS\Logs
2018-06-03 21:38:39 ----A---- C:\WINDOWS\SYSWOW64\log.txt
2018-06-03 21:06:00 ----D---- C:\WINDOWS\system32\sru
2018-06-03 16:45:13 ----D---- C:\WINDOWS\system32\LogFiles
2018-06-03 16:43:26 ----HD---- C:\Program Files\WindowsApps
2018-06-03 16:37:24 ----RD---- C:\WINDOWS\Microsoft.NET
2018-06-01 20:54:54 ----D---- C:\WINDOWS\system32\config
2018-06-01 20:45:39 ----D---- C:\WINDOWS\WinSxS
2018-06-01 20:39:51 ----D---- C:\WINDOWS\system32\WinBioPlugIns
2018-06-01 20:39:28 ----D---- C:\WINDOWS\CbsTemp
2018-06-01 18:42:45 ----D---- C:\WINDOWS\system32\drivers\wd
2018-05-29 21:09:33 ----D---- C:\WINDOWS\system32\Tasks
2018-05-25 19:45:41 ----RD---- C:\WINDOWS\assembly
2018-05-24 16:11:17 ----D---- C:\WINDOWS\SysWOW64
2018-05-24 16:11:12 ----D---- C:\WINDOWS\system32\catroot2
2018-05-24 16:10:51 ----SHD---- C:\System Volume Information
2018-05-24 16:10:16 ----D---- C:\WINDOWS\system32\restore
2018-05-24 16:06:58 ----D---- C:\WINDOWS\appcompat
2018-05-24 16:03:56 ----D---- C:\WINDOWS\system32\WDI
2018-05-23 12:54:35 ----D---- C:\WINDOWS\system32\Tasks_Migrated
2018-05-23 12:54:34 ----RSD---- C:\WINDOWS\Fonts
2018-05-23 12:54:34 ----D---- C:\WINDOWS\system32\WinBioDatabase
2018-05-23 12:54:34 ----D---- C:\WINDOWS\system32\drivers\etc
2018-05-23 12:54:33 ----D---- C:\WINDOWS\twain_32
2018-05-23 12:54:33 ----D---- C:\WINDOWS\SYSWOW64\migration
2018-05-23 12:54:33 ----D---- C:\WINDOWS\SYSWOW64\Macromed
2018-05-23 12:54:33 ----D---- C:\WINDOWS\SYSWOW64\IME
2018-05-23 12:54:33 ----D---- C:\WINDOWS\SYSWOW64\en-US
2018-05-23 12:54:33 ----D---- C:\WINDOWS\SYSWOW64\drivers
2018-05-23 12:54:29 ----D---- C:\WINDOWS\SYSWOW64\cs-CZ
2018-05-23 12:54:29 ----D---- C:\WINDOWS\SYSWOW64\Atheros_L1e
2018-05-23 12:54:28 ----D---- C:\WINDOWS\system32\zh-HK
2018-05-23 12:54:28 ----D---- C:\WINDOWS\system32\SPReview
2018-05-23 12:54:27 ----D---- C:\WINDOWS\system32\spool
2018-05-23 12:54:26 ----D---- C:\WINDOWS\system32\OEM
2018-05-23 12:54:26 ----D---- C:\WINDOWS\system32\NDF
2018-05-23 12:54:26 ----D---- C:\WINDOWS\system32\migration
2018-05-23 12:54:26 ----D---- C:\WINDOWS\system32\Macromed
2018-05-23 12:54:26 ----D---- C:\WINDOWS\system32\IME
2018-05-23 12:54:26 ----D---- C:\WINDOWS\system32\EventProviders
2018-05-23 12:54:25 ----D---- C:\WINDOWS\system32\en-US
2018-05-23 12:54:25 ----D---- C:\WINDOWS\system32\drivers\cs-CZ
2018-05-23 12:54:25 ----D---- C:\WINDOWS\system32\cs-CZ
2018-05-23 12:54:24 ----D---- C:\WINDOWS\system32\appmgmt
2018-05-23 12:54:23 ----D---- C:\WINDOWS\sk
2018-05-23 12:54:23 ----D---- C:\WINDOWS\ShellNew
2018-05-23 12:54:22 ----D---- C:\WINDOWS\schemas
2018-05-23 12:54:22 ----D---- C:\WINDOWS\PolicyDefinitions
2018-05-23 12:54:21 ----HD---- C:\WINDOWS\Installer
2018-05-23 12:54:21 ----D---- C:\WINDOWS\ModemLogs
2018-05-23 12:54:21 ----D---- C:\WINDOWS\LiveKernelReports
2018-05-23 12:54:10 ----SD---- C:\WINDOWS\Downloaded Program Files
2018-05-23 12:54:10 ----D---- C:\WINDOWS\en
2018-05-23 12:54:10 ----D---- C:\WINDOWS\cs
2018-05-23 12:54:08 ----SHD---- C:\Program Files (x86)\Windows Sidebar
2018-05-23 12:54:08 ----RD---- C:\Program Files (x86)
2018-05-23 12:54:08 ----D---- C:\Program Files (x86)\Microsoft.NET
2018-05-23 12:54:08 ----D---- C:\Program Files (x86)\Common Files
2018-05-23 12:54:07 ----SHD---- C:\Program Files\Windows Sidebar
2018-05-23 12:54:07 ----RD---- C:\Program Files
2018-05-23 12:54:07 ----D---- C:\Program Files\Realtek
2018-05-23 12:54:07 ----D---- C:\Program Files\Common Files\microsoft shared
2018-05-23 12:54:07 ----D---- C:\Program Files\Common Files
2018-05-23 12:54:07 ----AD---- C:\Program Files\UNP
2018-05-23 12:54:05 ----D---- C:\WINDOWS\system32\Recovery
2018-05-23 12:54:00 ----D---- C:\WINDOWS\Setup
2018-05-23 12:38:09 ----HD---- C:\ProgramData
2018-05-23 12:23:57 ----D---- C:\WINDOWS\SoftwareDistribution
2018-05-23 12:23:26 ----D---- C:\WINDOWS\Tasks
2018-05-23 12:23:25 ----D---- C:\Program Files\Windows Defender
2018-05-23 12:22:22 ----D---- C:\Windows
2018-05-23 12:15:32 ----RD---- C:\WINDOWS\ImmersiveControlPanel
2018-05-23 12:15:26 ----D---- C:\WINDOWS\Registration
2018-05-23 12:14:49 ----D---- C:\WINDOWS\SYSWOW64\wbem
2018-05-23 12:14:48 ----D---- C:\WINDOWS\system32\wbem
2018-05-23 12:14:42 ----SD---- C:\ProgramData\Microsoft
2018-05-23 12:14:35 ----RSD---- C:\WINDOWS\media
2018-05-23 12:12:05 ----D---- C:\WINDOWS\system32\DriverStore
2018-05-23 12:07:14 ----D---- C:\WINDOWS\SYSWOW64\inetsrv
2018-05-23 12:06:07 ----D---- C:\WINDOWS\system32\CodeIntegrity
2018-05-23 12:05:28 ----RD---- C:\Users
2018-05-23 12:00:52 ----D---- C:\ProgramData\USOPrivate
2018-05-23 12:00:22 ----A---- C:\WINDOWS\SYSWOW64\PerfStringBackup.INI
2018-05-23 11:59:53 ----D---- C:\WINDOWS\system32\drivers
2018-05-23 11:59:53 ----D---- C:\WINDOWS\System
2018-05-23 11:59:53 ----D---- C:\WINDOWS\debug
2018-05-23 11:59:53 ----D---- C:\Program Files (x86)\USB Camera2
2018-05-23 11:59:47 ----D---- C:\Program Files\Elantech
2018-05-23 11:59:37 ----D---- C:\WINDOWS\SYSWOW64\RTCOM
2018-05-23 11:57:22 ----SHD---- C:\Recovery
2018-05-22 14:27:57 ----D---- C:\WINDOWS\SYSWOW64\drivers\UMDF
2018-05-22 14:27:32 ----D---- C:\WINDOWS\system32\oobe
2018-05-22 14:26:02 ----D---- C:\WINDOWS\ehome
2018-05-22 14:25:48 ----D---- C:\Program Files (x86)\Windows Mail
2018-05-22 14:25:42 ----D---- C:\Program Files\Windows Mail
2018-05-22 14:25:41 ----D---- C:\Program Files\Microsoft Games
2018-05-22 14:16:40 ----D---- C:\WINDOWS\TextInput
2018-05-22 14:16:40 ----D---- C:\WINDOWS\SYSWOW64\zu-ZA
2018-05-22 14:16:40 ----D---- C:\WINDOWS\SYSWOW64\yo-NG
2018-05-22 14:16:40 ----D---- C:\WINDOWS\SYSWOW64\xh-ZA
2018-05-22 14:16:40 ----D---- C:\WINDOWS\SYSWOW64\wo-SN
2018-05-22 14:16:40 ----D---- C:\WINDOWS\SYSWOW64\vi-VN
2018-05-22 14:16:40 ----D---- C:\WINDOWS\SYSWOW64\uz-Latn-UZ
2018-05-22 14:16:40 ----D---- C:\WINDOWS\SYSWOW64\ur-PK
2018-05-22 14:16:40 ----D---- C:\WINDOWS\SYSWOW64\ug-CN
2018-05-22 14:16:40 ----D---- C:\WINDOWS\SYSWOW64\tt-RU
2018-05-22 14:16:40 ----D---- C:\WINDOWS\SYSWOW64\tn-ZA
2018-05-22 14:16:40 ----D---- C:\WINDOWS\SYSWOW64\tk-TM
2018-05-22 14:16:40 ----D---- C:\WINDOWS\SYSWOW64\ti-ET
2018-05-22 14:16:40 ----D---- C:\WINDOWS\SYSWOW64\tg-Cyrl-TJ
2018-05-22 14:16:40 ----D---- C:\WINDOWS\SYSWOW64\te-IN
2018-05-22 14:16:40 ----D---- C:\WINDOWS\SYSWOW64\ta-IN
2018-05-22 14:16:40 ----D---- C:\WINDOWS\SYSWOW64\sw-KE
2018-05-22 14:16:40 ----D---- C:\WINDOWS\SYSWOW64\sr-Cyrl-RS
2018-05-22 14:16:40 ----D---- C:\WINDOWS\SYSWOW64\sr-Cyrl-BA
2018-05-22 14:16:40 ----D---- C:\WINDOWS\SYSWOW64\sq-AL
2018-05-22 14:16:40 ----D---- C:\WINDOWS\SYSWOW64\si-LK
2018-05-22 14:16:40 ----D---- C:\WINDOWS\SYSWOW64\setup
2018-05-22 14:16:40 ----D---- C:\WINDOWS\SYSWOW64\sd-Arab-PK
2018-05-22 14:16:40 ----D---- C:\WINDOWS\SYSWOW64\rw-RW
2018-05-22 14:16:40 ----D---- C:\WINDOWS\SYSWOW64\quz-PE
2018-05-22 14:16:40 ----D---- C:\WINDOWS\SYSWOW64\quc-Latn-GT
2018-05-22 14:16:40 ----D---- C:\WINDOWS\SYSWOW64\prs-AF
2018-05-22 14:16:40 ----D---- C:\WINDOWS\SYSWOW64\pa-IN
2018-05-22 14:16:40 ----D---- C:\WINDOWS\SYSWOW64\pa-Arab-PK
2018-05-22 14:16:40 ----D---- C:\WINDOWS\SYSWOW64\or-IN
2018-05-22 14:16:40 ----D---- C:\WINDOWS\SYSWOW64\nso-ZA
2018-05-22 14:16:40 ----D---- C:\WINDOWS\SYSWOW64\nn-NO
2018-05-22 14:16:40 ----D---- C:\WINDOWS\SYSWOW64\ne-NP
2018-05-22 14:16:40 ----D---- C:\WINDOWS\SYSWOW64\mt-MT
2018-05-22 14:16:40 ----D---- C:\WINDOWS\SYSWOW64\ms-MY
2018-05-22 14:16:40 ----D---- C:\WINDOWS\SYSWOW64\mr-IN
2018-05-22 14:16:40 ----D---- C:\WINDOWS\SYSWOW64\mn-MN
2018-05-22 14:16:40 ----D---- C:\WINDOWS\SYSWOW64\ml-IN
2018-05-22 14:16:40 ----D---- C:\WINDOWS\SYSWOW64\mk-MK
2018-05-22 14:16:40 ----D---- C:\WINDOWS\SYSWOW64\mi-NZ
2018-05-22 14:16:40 ----D---- C:\WINDOWS\SYSWOW64\lo-LA
2018-05-22 14:16:40 ----D---- C:\WINDOWS\SYSWOW64\lb-LU
2018-05-22 14:16:40 ----D---- C:\WINDOWS\SYSWOW64\ky-KG
2018-05-22 14:16:40 ----D---- C:\WINDOWS\SYSWOW64\ku-Arab-IQ
2018-05-22 14:16:40 ----D---- C:\WINDOWS\SYSWOW64\kok-IN
2018-05-22 14:16:40 ----D---- C:\WINDOWS\SYSWOW64\kn-IN
2018-05-22 14:16:40 ----D---- C:\WINDOWS\SYSWOW64\km-KH
2018-05-22 14:16:40 ----D---- C:\WINDOWS\SYSWOW64\kk-KZ
2018-05-22 14:16:40 ----D---- C:\WINDOWS\SYSWOW64\ka-GE
2018-05-22 14:16:40 ----D---- C:\WINDOWS\SYSWOW64\is-IS
2018-05-22 14:16:40 ----D---- C:\WINDOWS\SYSWOW64\ig-NG
2018-05-22 14:16:40 ----D---- C:\WINDOWS\SYSWOW64\id-ID
2018-05-22 14:16:40 ----D---- C:\WINDOWS\SYSWOW64\chr-CHER-US
2018-05-22 14:16:40 ----D---- C:\WINDOWS\SYSWOW64\hy-AM
2018-05-22 14:16:40 ----D---- C:\WINDOWS\SYSWOW64\ha-Latn-NG
2018-05-22 14:16:40 ----D---- C:\WINDOWS\SYSWOW64\gu-IN
2018-05-22 14:16:40 ----D---- C:\WINDOWS\SYSWOW64\gd-GB
2018-05-22 14:16:40 ----D---- C:\WINDOWS\SYSWOW64\ga-IE
2018-05-22 14:16:40 ----D---- C:\WINDOWS\SYSWOW64\fil-PH
2018-05-22 14:16:40 ----D---- C:\WINDOWS\SYSWOW64\fa-IR
2018-05-22 14:16:40 ----D---- C:\WINDOWS\SYSWOW64\cy-GB
2018-05-22 14:16:40 ----D---- C:\WINDOWS\SYSWOW64\ca-ES-valencia
2018-05-22 14:16:40 ----D---- C:\WINDOWS\SYSWOW64\bs-Latn-BA
2018-05-22 14:16:40 ----D---- C:\WINDOWS\SYSWOW64\bn-IN
2018-05-22 14:16:40 ----D---- C:\WINDOWS\SYSWOW64\bn-BD
2018-05-22 14:16:40 ----D---- C:\WINDOWS\SYSWOW64\be-BY
2018-05-22 14:16:40 ----D---- C:\WINDOWS\SYSWOW64\az-Latn-AZ
2018-05-22 14:16:40 ----D---- C:\WINDOWS\SYSWOW64\as-IN
2018-05-22 14:16:40 ----D---- C:\WINDOWS\SYSWOW64\am-ET
2018-05-22 14:16:40 ----D---- C:\WINDOWS\SYSWOW64\af-ZA
2018-05-22 14:16:39 ----D---- C:\WINDOWS\system32\zu-ZA
2018-05-22 14:16:39 ----D---- C:\WINDOWS\system32\yo-NG
2018-05-22 14:16:39 ----D---- C:\WINDOWS\system32\xh-ZA
2018-05-22 14:16:39 ----D---- C:\WINDOWS\system32\wo-SN
2018-05-22 14:16:39 ----D---- C:\WINDOWS\system32\vi-VN
2018-05-22 14:16:39 ----D---- C:\WINDOWS\system32\uz-Latn-UZ
2018-05-22 14:16:39 ----D---- C:\WINDOWS\system32\ur-PK
2018-05-22 14:16:39 ----D---- C:\WINDOWS\system32\ug-CN
2018-05-22 14:16:39 ----D---- C:\WINDOWS\system32\tt-RU
2018-05-22 14:16:39 ----D---- C:\WINDOWS\system32\tn-ZA
2018-05-22 14:16:39 ----D---- C:\WINDOWS\system32\tk-TM
2018-05-22 14:16:39 ----D---- C:\WINDOWS\system32\ti-ET
2018-05-22 14:16:39 ----D---- C:\WINDOWS\system32\tg-Cyrl-TJ
2018-05-22 14:16:39 ----D---- C:\WINDOWS\system32\te-IN
2018-05-22 14:16:39 ----D---- C:\WINDOWS\system32\ta-in
2018-05-22 14:16:39 ----D---- C:\WINDOWS\system32\sw-KE
2018-05-22 14:16:39 ----D---- C:\WINDOWS\system32\sr-Cyrl-RS
2018-05-22 14:16:39 ----D---- C:\WINDOWS\system32\sr-Cyrl-BA
2018-05-22 14:16:39 ----D---- C:\WINDOWS\system32\sq-AL
2018-05-22 14:16:39 ----D---- C:\WINDOWS\system32\si-lk
2018-05-22 14:16:39 ----D---- C:\WINDOWS\system32\setup
2018-05-22 14:16:39 ----D---- C:\WINDOWS\system32\sd-Arab-PK
2018-05-22 14:16:39 ----D---- C:\WINDOWS\system32\rw-RW
2018-05-22 14:16:39 ----D---- C:\WINDOWS\system32\quz-PE
2018-05-22 14:16:39 ----D---- C:\WINDOWS\system32\quc-Latn-GT
2018-05-22 14:16:39 ----D---- C:\WINDOWS\system32\prs-AF
2018-05-22 14:16:39 ----D---- C:\WINDOWS\system32\pa-IN
2018-05-22 14:16:39 ----D---- C:\WINDOWS\system32\pa-Arab-PK
2018-05-22 14:16:39 ----D---- C:\WINDOWS\system32\or-IN
2018-05-22 14:16:39 ----D---- C:\WINDOWS\system32\nso-ZA
2018-05-22 14:16:39 ----D---- C:\WINDOWS\system32\nn-NO
2018-05-22 14:16:39 ----D---- C:\WINDOWS\system32\ne-NP
2018-05-22 14:16:39 ----D---- C:\WINDOWS\system32\mt-MT
2018-05-22 14:16:39 ----D---- C:\WINDOWS\system32\ms-MY
2018-05-22 14:16:39 ----D---- C:\WINDOWS\system32\mr-IN
2018-05-22 14:16:39 ----D---- C:\WINDOWS\system32\mn-MN
2018-05-22 14:16:39 ----D---- C:\WINDOWS\system32\ml-IN
2018-05-22 14:16:39 ----D---- C:\WINDOWS\system32\mk-MK
2018-05-22 14:16:39 ----D---- C:\WINDOWS\system32\mi-NZ
2018-05-22 14:16:39 ----D---- C:\WINDOWS\system32\lo-LA
2018-05-22 14:16:39 ----D---- C:\WINDOWS\system32\lb-LU
2018-05-22 14:16:39 ----D---- C:\WINDOWS\system32\ky-KG
2018-05-22 14:16:39 ----D---- C:\WINDOWS\system32\ku-Arab-IQ
2018-05-22 14:16:39 ----D---- C:\WINDOWS\system32\kok-IN
2018-05-22 14:16:39 ----D---- C:\WINDOWS\system32\kn-IN
2018-05-22 14:16:39 ----D---- C:\WINDOWS\system32\km-KH
2018-05-22 14:16:39 ----D---- C:\WINDOWS\system32\kk-KZ
2018-05-22 14:16:39 ----D---- C:\WINDOWS\system32\ka-GE
2018-05-22 14:16:39 ----D---- C:\WINDOWS\system32\is-IS
2018-05-22 14:16:39 ----D---- C:\WINDOWS\system32\ig-NG
2018-05-22 14:16:39 ----D---- C:\WINDOWS\system32\id-ID
2018-05-22 14:16:39 ----D---- C:\WINDOWS\system32\chr-CHER-US
2018-05-22 14:16:39 ----D---- C:\WINDOWS\system32\hy-AM
2018-05-22 14:16:39 ----D---- C:\WINDOWS\system32\ha-Latn-NG
2018-05-22 14:16:39 ----D---- C:\WINDOWS\system32\gu-IN
2018-05-22 14:16:39 ----D---- C:\WINDOWS\system32\gd-GB
2018-05-22 14:16:39 ----D---- C:\WINDOWS\system32\ga-IE
2018-05-22 14:16:39 ----D---- C:\WINDOWS\system32\fil-PH
2018-05-22 14:16:39 ----D---- C:\WINDOWS\system32\fa-IR
2018-05-22 14:16:39 ----D---- C:\WINDOWS\system32\cy-GB
2018-05-22 14:16:39 ----D---- C:\WINDOWS\system32\ca-ES-valencia
2018-05-22 14:16:39 ----D---- C:\WINDOWS\system32\bs-Latn-BA
2018-05-22 14:16:39 ----D---- C:\WINDOWS\system32\Boot
2018-05-22 14:16:39 ----D---- C:\WINDOWS\system32\bn-IN
2018-05-22 14:16:39 ----D---- C:\WINDOWS\system32\bn-BD
2018-05-22 14:16:39 ----D---- C:\WINDOWS\system32\be-BY
2018-05-22 14:16:39 ----D---- C:\WINDOWS\system32\az-Latn-AZ
2018-05-22 14:16:39 ----D---- C:\WINDOWS\system32\as-IN
2018-05-22 14:16:39 ----D---- C:\WINDOWS\system32\appraiser
2018-05-22 14:16:39 ----D---- C:\WINDOWS\system32\am-et
2018-05-22 14:16:39 ----D---- C:\WINDOWS\system32\af-ZA
2018-05-22 14:16:38 ----D---- C:\WINDOWS\Provisioning
2018-05-22 14:16:36 ----D---- C:\WINDOWS\bcastdvr
2018-05-22 14:16:36 ----D---- C:\WINDOWS\apppatch
2018-05-22 14:16:36 ----D---- C:\Program Files\Windows Photo Viewer
2018-05-22 14:16:36 ----D---- C:\Program Files (x86)\Windows Photo Viewer
2018-05-22 14:16:34 ----D---- C:\WINDOWS\Containers
2018-05-22 14:01:32 ----D---- C:\WINDOWS\system32\inetsrv
2018-05-22 14:01:32 ----D---- C:\WINDOWS\system32\drivers\en-US
2018-05-22 14:00:11 ----D---- C:\WINDOWS\SYSWOW64\zh-TW
2018-05-22 14:00:11 ----D---- C:\WINDOWS\SYSWOW64\zh-CN
2018-05-22 14:00:11 ----D---- C:\WINDOWS\SYSWOW64\uk-UA
2018-05-22 14:00:11 ----D---- C:\WINDOWS\SYSWOW64\tr-TR
2018-05-22 14:00:11 ----D---- C:\WINDOWS\SYSWOW64\th-TH
2018-05-22 14:00:11 ----D---- C:\WINDOWS\SYSWOW64\sv-SE
2018-05-22 14:00:11 ----D---- C:\WINDOWS\SYSWOW64\sr-Latn-RS
2018-05-22 14:00:11 ----D---- C:\WINDOWS\SYSWOW64\sl-SI
2018-05-22 14:00:11 ----D---- C:\WINDOWS\SYSWOW64\sk-SK
2018-05-22 14:00:11 ----D---- C:\WINDOWS\SYSWOW64\ru-RU
2018-05-22 14:00:11 ----D---- C:\WINDOWS\SYSWOW64\ro-RO
2018-05-22 14:00:11 ----D---- C:\WINDOWS\SYSWOW64\pt-PT
2018-05-22 14:00:11 ----D---- C:\WINDOWS\SYSWOW64\pt-BR
2018-05-22 14:00:11 ----D---- C:\WINDOWS\SYSWOW64\pl-PL
2018-05-22 14:00:11 ----D---- C:\WINDOWS\SYSWOW64\nl-NL
2018-05-22 14:00:11 ----D---- C:\WINDOWS\SYSWOW64\nb-NO
2018-05-22 14:00:11 ----D---- C:\WINDOWS\SYSWOW64\lv-LV
2018-05-22 14:00:11 ----D---- C:\WINDOWS\SYSWOW64\lt-LT
2018-05-22 14:00:11 ----D---- C:\WINDOWS\SYSWOW64\ko-KR
2018-05-22 14:00:11 ----D---- C:\WINDOWS\SYSWOW64\ja-JP
2018-05-22 14:00:11 ----D---- C:\WINDOWS\SYSWOW64\it-IT
2018-05-22 14:00:11 ----D---- C:\WINDOWS\SYSWOW64\hu-HU
2018-05-22 14:00:11 ----D---- C:\WINDOWS\SYSWOW64\hr-HR
2018-05-22 14:00:11 ----D---- C:\WINDOWS\SYSWOW64\he-IL
2018-05-22 14:00:11 ----D---- C:\WINDOWS\SYSWOW64\fr-FR
2018-05-22 14:00:11 ----D---- C:\WINDOWS\SYSWOW64\fr-CA
2018-05-22 14:00:11 ----D---- C:\WINDOWS\SYSWOW64\fi-FI
2018-05-22 14:00:11 ----D---- C:\WINDOWS\SYSWOW64\et-EE
2018-05-22 14:00:11 ----D---- C:\WINDOWS\SYSWOW64\es-MX
2018-05-22 14:00:11 ----D---- C:\WINDOWS\SYSWOW64\es-ES
2018-05-22 14:00:11 ----D---- C:\WINDOWS\SYSWOW64\en-GB
2018-05-22 14:00:11 ----D---- C:\WINDOWS\SYSWOW64\el-GR
2018-05-22 14:00:11 ----D---- C:\WINDOWS\SYSWOW64\de-DE
2018-05-22 14:00:11 ----D---- C:\WINDOWS\SYSWOW64\da-DK
2018-05-22 14:00:11 ----D---- C:\WINDOWS\SYSWOW64\bg-BG
2018-05-22 14:00:11 ----D---- C:\WINDOWS\SYSWOW64\ar-SA
2018-05-22 14:00:11 ----D---- C:\WINDOWS\system32\zh-TW
2018-05-22 14:00:11 ----D---- C:\WINDOWS\system32\zh-CN
2018-05-22 14:00:11 ----D---- C:\WINDOWS\system32\uk-UA
2018-05-22 14:00:11 ----D---- C:\WINDOWS\system32\tr-TR
2018-05-22 14:00:11 ----D---- C:\WINDOWS\system32\th-TH
2018-05-22 14:00:11 ----D---- C:\WINDOWS\system32\sv-SE
2018-05-22 14:00:11 ----D---- C:\WINDOWS\system32\sr-Latn-RS
2018-05-22 14:00:11 ----D---- C:\WINDOWS\system32\sl-SI
2018-05-22 14:00:11 ----D---- C:\WINDOWS\system32\sk-SK
2018-05-22 14:00:10 ----D---- C:\WINDOWS\system32\ru-RU
2018-05-22 14:00:10 ----D---- C:\WINDOWS\system32\ro-RO
2018-05-22 14:00:10 ----D---- C:\WINDOWS\system32\pt-PT
2018-05-22 14:00:10 ----D---- C:\WINDOWS\system32\pt-BR
2018-05-22 14:00:10 ----D---- C:\WINDOWS\system32\pl-PL
2018-05-22 14:00:10 ----D---- C:\WINDOWS\system32\nl-NL
2018-05-22 14:00:10 ----D---- C:\WINDOWS\system32\nb-NO
2018-05-22 14:00:10 ----D---- C:\WINDOWS\system32\lv-LV
2018-05-22 14:00:10 ----D---- C:\WINDOWS\system32\lt-LT
2018-05-22 14:00:10 ----D---- C:\WINDOWS\system32\ko-KR
2018-05-22 14:00:10 ----D---- C:\WINDOWS\system32\ja-jp
2018-05-22 14:00:10 ----D---- C:\WINDOWS\system32\it-IT
2018-05-22 14:00:10 ----D---- C:\WINDOWS\system32\hu-HU
2018-05-22 14:00:10 ----D---- C:\WINDOWS\system32\hr-HR
2018-05-22 14:00:10 ----D---- C:\WINDOWS\system32\he-IL
2018-05-22 14:00:10 ----D---- C:\WINDOWS\system32\fr-FR
2018-05-22 14:00:10 ----D---- C:\WINDOWS\system32\fr-CA
2018-05-22 14:00:10 ----D---- C:\WINDOWS\system32\fi-FI
2018-05-22 14:00:10 ----D---- C:\WINDOWS\system32\et-EE
2018-05-22 14:00:10 ----D---- C:\WINDOWS\system32\es-MX
2018-05-22 14:00:10 ----D---- C:\WINDOWS\system32\es-ES
2018-05-22 14:00:10 ----D---- C:\WINDOWS\system32\en-GB
2018-05-22 14:00:10 ----D---- C:\WINDOWS\system32\el-GR
2018-05-22 14:00:10 ----D---- C:\WINDOWS\system32\de-DE
2018-05-22 14:00:10 ----D---- C:\WINDOWS\system32\da-DK
2018-05-22 14:00:08 ----D---- C:\WINDOWS\system32\bg-BG
2018-05-22 14:00:07 ----D---- C:\WINDOWS\system32\ar-SA
2018-05-22 13:59:08 ----D---- C:\WINDOWS\SYSWOW64\MUI
2018-05-22 13:59:08 ----D---- C:\WINDOWS\system32\MUI
2018-05-22 13:54:44 ----D---- C:\WINDOWS\OCR
2018-05-22 11:57:47 ----D---- C:\Program Files (x86)\Mozilla Maintenance Service
2018-05-22 11:57:43 ----AD---- C:\Program Files (x86)\Mozilla Firefox
2018-05-10 20:52:29 ----D---- C:\WINDOWS\system32\MRT
2018-05-10 20:52:21 ----AC---- C:\WINDOWS\system32\MRT-KB890830.exe
2018-05-10 20:52:09 ----AC---- C:\WINDOWS\system32\MRT.exe

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 iaStor;@oem0.inf,%*PNP0600.DeviceDesc%;Intel AHCI Controller; C:\WINDOWS\System32\drivers\iaStor.sys [2010-03-03 540696]
R0 iorate;@%SystemRoot%\system32\drivers\iorate.sys,-101; C:\WINDOWS\system32\drivers\iorate.sys [2018-04-12 58272]
R0 LHDmgr;LHDmgr; C:\WINDOWS\System32\DRIVERS\LhdX64.sys [2010-01-15 39008]
R0 MsSecFlt;@%SystemRoot%\System32\Drivers\mssecflt.sys,-1001; C:\WINDOWS\system32\drivers\mssecflt.sys [2018-04-12 304032]
R0 SgrmAgent;@%SystemRoot%\System32\Drivers\SgrmAgent.sys,-1001; C:\WINDOWS\system32\drivers\SgrmAgent.sys [2018-04-12 63896]
R0 Shockprf;Shockprf; C:\WINDOWS\System32\DRIVERS\Apsx64.sys [2009-12-09 135264]
R1 afunix;afunix; C:\WINDOWS\system32\drivers\afunix.sys [2018-04-12 39424]
R1 bam;@%SystemRoot%\system32\drivers\bam.sys,-100; C:\WINDOWS\system32\drivers\bam.sys [2018-04-12 60320]
R1 EgisTecFF;EgisTecFF; C:\WINDOWS\system32\DRIVERS\EgisTecFF.sys [2010-12-08 55880]
R1 FileCrypt;@%systemroot%\system32\drivers\filecrypt.sys,-100; C:\WINDOWS\system32\drivers\filecrypt.sys [2018-04-12 55808]
R1 GpuEnergyDrv;@%SystemRoot%\system32\drivers\gpuenergydrv.sys,-100; C:\WINDOWS\System32\drivers\gpuenergydrv.sys [2018-04-12 8192]
R1 MpKsl58caf688;MpKsl58caf688; \??\C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{4A40B0EA-B367-4EAD-8B5B-4E418007FAF1}\MpKsl58caf688.sys [2018-06-03 58120]
R1 mwlPSDFilter;mwlPSDFilter; C:\WINDOWS\system32\DRIVERS\mwlPSDFilter.sys [2010-12-08 22576]
R1 mwlPSDNServ;mwlPSDNServ; C:\WINDOWS\system32\DRIVERS\mwlPSDNServ.sys [2010-12-08 20016]
R1 mwlPSDVDisk;mwlPSDVDisk; C:\WINDOWS\system32\DRIVERS\mwlPSDVDisk.sys [2010-12-08 60464]
R2 CldFlt;Windows Cloud Files Filter Driver; C:\WINDOWS\system32\drivers\cldflt.sys [2018-04-12 414208]
R2 FPSensor;@oem1.inf,%FPSensor.SvcDesc%;EgisTec-Corp Fingerprint Reader Driver (FPSensor.sys); C:\WINDOWS\System32\Drivers\FPSensor.sys [2010-12-08 35888]
R2 MMCSS;@%systemroot%\system32\drivers\mmcss.sys,-100; C:\WINDOWS\system32\drivers\mmcss.sys [2018-04-12 43520]
R2 MQAC;@mqutil.dll,-6101; C:\WINDOWS\system32\drivers\mqac.sys [2018-04-12 178688]
R3 ACPIVPC;@oem13.inf,%ACPIVPC.SvcDesc%;Lenovo Virtual Power Controller Driver; C:\WINDOWS\System32\drivers\AcpiVpc.sys [2009-10-19 28176]
R3 BCM43XX;@netbc64.inf,%BCM43XX_Service_DispName%;Broadcom 802.11 – ovladač síťového adaptéru; C:\WINDOWS\system32\DRIVERS\bcmwl63a.sys [2018-04-12 7585280]
R3 CAD;@ChargeArbitration.inf,%CAD_DevDesc%;Charge Arbitration Driver; C:\WINDOWS\System32\drivers\CAD.sys [2018-04-12 60320]
R3 ETD;@oem22.inf,%PS2.DeviceDesc%;ELAN Input Device; C:\WINDOWS\system32\DRIVERS\ETD.sys [2015-10-07 525512]
R3 HECIx64;@oem30.inf,%HECI_SvcDesc%;Intel(R) Management Engine Interface; C:\WINDOWS\System32\drivers\HECIx64.sys [2009-09-17 56344]
R3 igfx;igfx; C:\WINDOWS\system32\DRIVERS\igdkmd64.sys [2012-11-27 12311776]
R3 Impcd;Impcd; C:\WINDOWS\System32\drivers\Impcd.sys [2010-02-25 158976]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\WINDOWS\system32\drivers\RTKVHD64.sys [2010-06-02 2392296]
R3 L1C;@netl1c63x64.inf,%L1C.Service.DispName%;NDIS Miniport Driver for Qualcomm Atheros AR81xx PCI-E Ethernet Controller; C:\WINDOWS\System32\drivers\L1C63x64.sys [2018-04-12 121344]
S0 bttflt;@virtdisk.inf,%service_desc%;Microsoft Hyper-V VHDPMEM BTT Filter; C:\WINDOWS\System32\drivers\bttflt.sys [2018-04-12 38304]
S0 cht4iscsi;cht4iscsi; C:\WINDOWS\System32\drivers\cht4sx64.sys [2018-04-12 321432]
S0 iaStorAVC;@iastorav.inf,%iaStorAVC.DeviceDesc%;Intel Chipset SATA RAID Controller; C:\WINDOWS\System32\drivers\iaStorAVC.sys [2018-04-12 885144]
S0 ItSas35i;ItSas35i; C:\WINDOWS\System32\drivers\ItSas35i.sys [2018-04-12 145816]
S0 LSI_SAS2i;LSI_SAS2i; C:\WINDOWS\System32\drivers\lsi_sas2i.sys [2018-04-12 124312]
S0 LSI_SAS3i;LSI_SAS3i; C:\WINDOWS\System32\drivers\lsi_sas3i.sys [2018-04-12 128408]
S0 megasas2i;megasas2i; C:\WINDOWS\System32\drivers\MegaSas2i.sys [2018-04-12 75160]
S0 megasas35i;megasas35i; C:\WINDOWS\System32\drivers\megasas35i.sys [2018-04-12 82328]
S0 percsas2i;percsas2i; C:\WINDOWS\System32\drivers\percsas2i.sys [2018-04-12 58776]
S0 percsas3i;percsas3i; C:\WINDOWS\System32\drivers\percsas3i.sys [2018-04-12 61848]
S0 Ramdisk;Windows RAM Disk Driver; C:\WINDOWS\system32\DRIVERS\ramdisk.sys [2018-04-12 39840]
S0 scmbus;@scmbus.inf,%scmbus.SvcDesc%;Microsoft Storage Class Memory Bus Driver; C:\WINDOWS\System32\drivers\scmbus.sys [2018-04-12 128416]
S3 AcpiDev;@acpidev.inf,%AcpiDev.SvcDesc%;ACPI Devices driver; C:\WINDOWS\System32\drivers\AcpiDev.sys [2018-04-12 20480]
S3 applockerfltr;@%systemroot%\system32\srpapi.dll,-102; C:\WINDOWS\system32\drivers\applockerfltr.sys [2018-04-12 18432]
S3 AppvStrm;@%systemroot%\system32\drivers\AppvStrm.sys,-101; C:\WINDOWS\system32\drivers\AppvStrm.sys [2018-04-12 127384]
S3 AppvVemgr;@%systemroot%\system32\drivers\AppvVemgr.sys,-101; C:\WINDOWS\system32\drivers\AppvVemgr.sys [2018-04-12 162712]
S3 AppvVfs;@%systemroot%\system32\drivers\AppvVfs.sys,-101; C:\WINDOWS\system32\drivers\AppvVfs.sys [2018-04-12 143768]
S3 bindflt;@%systemroot%\system32\drivers\bindflt.sys,-100; C:\WINDOWS\system32\drivers\bindflt.sys [2018-04-12 92056]
S3 buttonconverter;@buttonconverter.inf,%btnconv.SvcDesc%;Service for Portable Device Control devices; C:\WINDOWS\System32\drivers\buttonconverter.sys [2018-04-12 39936]
S3 CapImg;@capimg.inf,%CapImgHid_Service%;HID driver for CapImg touch screen; C:\WINDOWS\System32\drivers\capimg.sys [2018-04-12 123392]
S3 genericusbfn;@genericusbfn.inf,%genericusbfn.ServiceName%;Generic USB Function Class; C:\WINDOWS\System32\drivers\genericusbfn.sys [2018-04-12 20992]
S3 hidinterrupt;@hidinterrupt.inf,%HID_Interrupt.SvcDesc%;Common Driver for HID Buttons implemented with interrupts; C:\WINDOWS\System32\drivers\hidinterrupt.sys [2018-04-12 50592]
S3 hvservice;@%SystemRoot%\system32\drivers\hvservice.sys,-16; C:\WINDOWS\system32\drivers\hvservice.sys [2018-04-12 73632]
S3 HwNClx0101;Microsoft Hardware Notifications Class Extension Driver; C:\WINDOWS\System32\Drivers\mshwnclx.sys [2018-04-12 27136]
S3 cht4vbd;@cht4vx64.inf,%cht4vbd.generic%;Chelsio Virtual Bus Driver; C:\WINDOWS\System32\drivers\cht4vx64.sys [2018-04-12 1836952]
S3 iagpio;@iagpio.inf,%iagpio.SVCDESC%;Intel Serial IO GPIO Controller Driver; C:\WINDOWS\System32\drivers\iagpio.sys [2018-04-12 36864]
S3 iai2c;@iai2c.inf,%iai2c.SVCDESC%;Intel(R) Serial IO I2C Host Controller; C:\WINDOWS\System32\drivers\iai2c.sys [2018-04-12 91648]
S3 iaLPSS2i_GPIO2;@iaLPSS2i_GPIO2_SKL.inf,%iaLPSS2i_GPIO2.SVCDESC%;Intel(R) Serial IO GPIO Driver v2; C:\WINDOWS\System32\drivers\iaLPSS2i_GPIO2.sys [2018-04-12 79360]
S3 iaLPSS2i_GPIO2_BXT_P;@iaLPSS2i_GPIO2_BXT_P.inf,%iaLPSS2i_GPIO2_BXT_P.SVCDESC%;Intel(R) Serial IO GPIO Driver v2; C:\WINDOWS\System32\drivers\iaLPSS2i_GPIO2_BXT_P.sys [2018-04-12 88576]
S3 iaLPSS2i_I2C;@iaLPSS2i_I2C_SKL.inf,%iaLPSS2i_I2C.SVCDESC%;Intel(R) Serial IO I2C Driver v2; C:\WINDOWS\System32\drivers\iaLPSS2i_I2C.sys [2018-04-12 171520]
S3 iaLPSS2i_I2C_BXT_P;@iaLPSS2i_I2C_BXT_P.inf,%iaLPSS2i_I2C_BXT_P.SVCDESC%;Intel(R) Serial IO I2C Driver v2; C:\WINDOWS\System32\drivers\iaLPSS2i_I2C_BXT_P.sys [2018-04-12 174592]
S3 ibbus;@mlx4_bus.inf,%Ibbus.ServiceDesc%;Mellanox InfiniBand Bus/AL (Filter Driver); C:\WINDOWS\System32\drivers\ibbus.sys [2018-04-12 526232]
S3 IndirectKmd;@%SystemRoot%\system32\drivers\IndirectKmd.sys,-100; C:\WINDOWS\System32\drivers\IndirectKmd.sys [2018-04-12 38912]
S3 IPT;IPT; C:\WINDOWS\System32\drivers\ipt.sys [2018-04-12 32256]
S3 irda;IrDA; C:\WINDOWS\system32\drivers\irda.sys [2018-04-12 119808]
S3 mausbhost;@mausbhost.inf,%MAUSBHost.ServiceName%;MA-USB Host Controller Driver; C:\WINDOWS\System32\drivers\mausbhost.sys [2018-04-12 505240]
S3 mausbip;@mausbhost.inf,%MAUSBIP.ServiceName%;MA-USB IP Filter Driver; C:\WINDOWS\System32\drivers\mausbip.sys [2018-04-12 56736]
S3 mlx4_bus;@mlx4_bus.inf,%MLX4BUS.ServiceDesc%;Mellanox ConnectX Bus Enumerator; C:\WINDOWS\System32\drivers\mlx4_bus.sys [2018-04-12 842648]
S3 ndfltr;@mlx4_bus.inf,%ndfltr.ServiceDesc%;NetworkDirect Service; C:\WINDOWS\System32\drivers\ndfltr.sys [2018-04-12 108952]
S3 NetAdapterCx;Network Adapter Wdf Class Extension Library; C:\WINDOWS\system32\drivers\NetAdapterCx.sys [2018-04-12 175104]
S3 nvdimm;@nvdimm.inf,%nvdimm.SvcDesc%;Microsoft NVDIMM device driver; C:\WINDOWS\System32\drivers\nvdimm.sys [2018-04-12 104448]
S3 pmem;@pmem.inf,%pmem.SvcDesc%;Microsoft persistent memory disk driver; C:\WINDOWS\System32\drivers\pmem.sys [2018-04-12 105984]
S3 PNPMEM;@memory.inf,%PNPMEM.SvcDesc%;Microsoft Memory Module Driver; C:\WINDOWS\System32\drivers\pnpmem.sys [2018-04-12 16896]
S3 ReFSv1;ReFSv1; C:\WINDOWS\system32\drivers\ReFSv1.sys [2018-04-12 945560]
S3 rhproxy;@rhproxy.inf,%rhproxy.SVCDESC%;Resource Hub proxy driver; C:\WINDOWS\System32\drivers\rhproxy.sys [2018-04-12 104448]
S3 SDFRd;@SDFRd.inf,%SDFRd.ServiceDesc%;SDF Reflector; C:\WINDOWS\System32\drivers\SDFRd.sys [2018-04-12 33176]
S3 SpatialGraphFilter;Holographic Spatial Graph Filter; C:\WINDOWS\System32\drivers\SpatialGraphFilter.sys [2018-04-12 57752]
S4 hvcrash;hvcrash; C:\WINDOWS\System32\drivers\hvcrash.sys [2018-04-12 33184]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AdobeARMservice;Adobe Acrobat Update Service; C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2018-02-09 83984]
R2 AppHostSvc;@%windir%\system32\inetsrv\iisres.dll,-30011; C:\WINDOWS\system32\svchost.exe [2018-04-12 51288]
R2 CDPSvc;@%SystemRoot%\system32\cdpsvc.dll,-100; C:\WINDOWS\system32\svchost.exe [2018-04-12 51288]
R2 CDPUserSvc_43602;CDPUserSvc_43602; C:\WINDOWS\system32\svchost.exe [2018-04-12 51288]
R2 CoreMessagingRegistrar;@%SystemRoot%\system32\coremessaging.dll,-1; C:\WINDOWS\system32\svchost.exe [2018-04-12 51288]
R2 DiagTrack;@%SystemRoot%\system32\diagtrack.dll,-3001; C:\WINDOWS\System32\svchost.exe [2018-04-12 51288]
R2 DoSvc;@%systemroot%\system32\dosvc.dll,-100; C:\WINDOWS\System32\svchost.exe [2018-04-12 51288]
R2 DusmSvc;@%SystemRoot%\System32\dusmsvc.dll,-1; C:\WINDOWS\System32\svchost.exe [2018-04-12 51288]
R2 EgisTec Data Security Service;EgisTec Data Security Service; C:\Program Files (x86)\EgisTec BioExcess\EgisDSService.exe [2010-05-28 314736]
R2 EgisTec Service Help;EgisTec Service Help; C:\Program Files (x86)\EgisTec Port Locker\Egishlpsvc.exe [2010-09-11 327024]
R2 EgisTec Service;EgisTec Service; C:\Program Files (x86)\EgisTec BioExcess\EgisService.exe [2010-05-28 709488]
R2 EPSON_EB_RPCV4_01;EPSON V5 Service4(01); C:\ProgramData\EPSON\EPW!3 SSRP\E_S40STB.EXE [2007-12-17 163840]
R2 EPSON_PM_RPCV4_01;EPSON V3 Service4(01); C:\ProgramData\EPSON\EPW!3 SSRP\E_S40RPB.EXE [2007-01-11 126464]
R2 ETDService;Elan Service; C:\Program Files\Elantech\ETDService.exe [2015-10-07 144072]
R2 LMS;Intel(R) Management and Security Application Local Management Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe [2009-09-30 268824]
R2 MSMQ;@mqutil.dll,-6102; C:\WINDOWS\system32\mqsvc.exe [2018-04-12 26112]
R2 NetMsmqActivator;@%systemroot%\Microsoft.NET\Framework64\v4.0.30319\ServiceModelInstallRC.dll,-8195; C:\WINDOWS\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2018-04-12 136296]
R2 NetPipeActivator;@%systemroot%\Microsoft.NET\Framework64\v4.0.30319\ServiceModelInstallRC.dll,-8197; C:\WINDOWS\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2018-04-12 136296]
R2 NetTcpActivator;@%systemroot%\Microsoft.NET\Framework64\v4.0.30319\ServiceModelInstallRC.dll,-8199; C:\WINDOWS\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2018-04-12 136296]
R2 OneSyncSvc_43602;OneSyncSvc_43602; C:\WINDOWS\system32\svchost.exe [2018-04-12 51288]
R2 RtLedService;RtLedService Installer; C:\Program Files\Realtek\RtLED\RtLEDService.exe [2010-02-05 311296]
R2 SecurityHealthService;@%systemroot%\system32\SecurityHealthAgent.dll,-1002; C:\WINDOWS\system32\SecurityHealthService.exe [2018-04-12 761440]
R2 SgrmBroker;@%SystemRoot%\System32\SgrmBroker.exe,-100; C:\WINDOWS\system32\SgrmBroker.exe [2018-04-12 163336]
R3 LicenseManager;@%SystemRoot%\system32\licensemanagersvc.dll,-200; C:\WINDOWS\System32\svchost.exe [2018-04-12 51288]
R3 RmSvc;@%SystemRoot%\system32\RMapi.dll,-1001; C:\WINDOWS\System32\svchost.exe [2018-04-12 51288]
R3 SEMgrSvc;@%SystemRoot%\System32\SEMgrSvc.dll,-1001; C:\WINDOWS\system32\svchost.exe [2018-04-12 51288]
S2 CDPUserSvc;@%SystemRoot%\system32\cdpusersvc.dll,-100; C:\WINDOWS\system32\svchost.exe [2018-04-12 51288]
S2 MapsBroker;@%SystemRoot%\System32\moshost.dll,-100; C:\WINDOWS\System32\svchost.exe [2018-04-12 51288]
S2 OneSyncSvc;@%SystemRoot%\system32\APHostRes.dll,-10002; C:\WINDOWS\system32\svchost.exe [2018-04-12 51288]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service; C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2018-05-08 272384]
S3 AJRouter;@%SystemRoot%\system32\AJRouter.dll,-2; C:\WINDOWS\system32\svchost.exe [2018-04-12 51288]
S3 AssignedAccessManagerSvc;@%SystemRoot%\system32\assignedaccessmanagersvc.dll,-100; C:\WINDOWS\system32\svchost.exe [2018-04-12 51288]
S3 BcastDVRUserService;@%SystemRoot%\system32\BcastDVRUserService.dll,-100; C:\WINDOWS\system32\svchost.exe [2018-04-12 51288]
S3 BcastDVRUserService_43602;BcastDVRUserService_43602; C:\WINDOWS\system32\svchost.exe [2018-04-12 51288]
S3 BluetoothUserService;@%SystemRoot%\system32\Microsoft.Bluetooth.UserService.dll,-101; C:\WINDOWS\system32\svchost.exe [2018-04-12 51288]
S3 BluetoothUserService_43602;BluetoothUserService_43602; C:\WINDOWS\system32\svchost.exe [2018-04-12 51288]
S3 BTAGService;@%SystemRoot%\system32\BTAGService.dll,-101; C:\WINDOWS\system32\svchost.exe [2018-04-12 51288]
S3 BthAvctpSvc;@%SystemRoot%\system32\BthAvctpSvc.dll,-101; C:\WINDOWS\system32\svchost.exe [2018-04-12 51288]
S3 camsvc;@%SystemRoot%\system32\CapabilityAccessManager.dll,-1; C:\WINDOWS\system32\svchost.exe [2018-04-12 51288]
S3 CaptureService;@%SystemRoot%\system32\CaptureService.dll,-100; C:\WINDOWS\system32\svchost.exe [2018-04-12 51288]
S3 CaptureService_43602;CaptureService_43602; C:\WINDOWS\system32\svchost.exe [2018-04-12 51288]
S3 ClipSVC;@%SystemRoot%\system32\ClipSVC.dll,-103; C:\WINDOWS\System32\svchost.exe [2018-04-12 51288]
S3 DevicePickerUserSvc;@%SystemRoot%\system32\Windows.Devices.Picker.dll,-1006; C:\WINDOWS\system32\svchost.exe [2018-04-12 51288]
S3 DevicePickerUserSvc_43602;DevicePickerUserSvc_43602; C:\WINDOWS\system32\svchost.exe [2018-04-12 51288]
S3 DevicesFlowUserSvc;@%SystemRoot%\system32\DevicesFlowBroker.dll,-103; C:\WINDOWS\system32\svchost.exe [2018-04-12 51288]
S3 DevicesFlowUserSvc_43602;DevicesFlowUserSvc_43602; C:\WINDOWS\system32\svchost.exe [2018-04-12 51288]
S3 DevQueryBroker;@%SystemRoot%\system32\DevQueryBroker.dll,-100; C:\WINDOWS\system32\svchost.exe [2018-04-12 51288]
S3 diagnosticshub.standardcollector.service;@%SystemRoot%\system32\DiagSvcs\DiagnosticsHub.StandardCollector.ServiceRes.dll,-1000; C:\WINDOWS\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe [2018-04-12 90624]
S3 diagsvc;@%systemroot%\system32\DiagSvc.dll,-100; C:\WINDOWS\System32\svchost.exe [2018-04-12 51288]
S3 DmEnrollmentSvc;@%systemroot%\system32\Windows.Internal.Management.dll,-100; C:\WINDOWS\system32\svchost.exe [2018-04-12 51288]
S3 dmwappushservice;@%SystemRoot%\system32\dmwappushsvc.dll,-200; C:\WINDOWS\system32\svchost.exe [2018-04-12 51288]
S3 DsSvc;@%SystemRoot%\system32\dssvc.dll,-10003; C:\WINDOWS\System32\svchost.exe [2018-04-12 51288]
S3 embeddedmode;@%SystemRoot%\system32\embeddedmodesvc.dll,-201; C:\WINDOWS\System32\svchost.exe [2018-04-12 51288]
S3 EntAppSvc;@EnterpriseAppMgmtSvc.dll,-1; C:\WINDOWS\system32\svchost.exe [2018-04-12 51288]
S3 FontCache3.0.0.0;@%SystemRoot%\system32\PresentationHost.exe,-3309; C:\WINDOWS\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe [2018-05-22 43648]
S3 FrameServer;@%systemroot%\system32\FrameServer.dll,-100; C:\WINDOWS\System32\svchost.exe [2018-04-12 51288]
S3 GraphicsPerfSvc;@%SystemRoot%\system32\GraphicsPerfSvc.dll,-100; C:\WINDOWS\System32\svchost.exe [2018-04-12 51288]
S3 HvHost;@%SystemRoot%\system32\hvhostsvc.dll,-100; C:\WINDOWS\system32\svchost.exe [2018-04-12 51288]
S3 icssvc;@%SystemRoot%\System32\tetheringservice.dll,-4097; C:\WINDOWS\system32\svchost.exe [2018-04-12 51288]
S3 InstallService;@%SystemRoot%\system32\InstallService.dll,-200; C:\WINDOWS\System32\svchost.exe [2018-04-12 51288]
S3 IpxlatCfgSvc;@%Systemroot%\system32\ipxlatcfg.dll,-500; C:\WINDOWS\System32\svchost.exe [2018-04-12 51288]
S3 irmon;@%SystemRoot%\System32\irmon.dll,-2000; C:\WINDOWS\system32\svchost.exe [2018-04-12 51288]
S3 LxpSvc;@%SystemRoot%\system32\LanguageOverlayServer.dll,-100; C:\WINDOWS\system32\svchost.exe [2018-04-12 51288]
S3 MessagingService;@%SystemRoot%\system32\MessagingService.dll,-100; C:\WINDOWS\system32\svchost.exe [2018-04-12 51288]
S3 MessagingService_43602;MessagingService_43602; C:\WINDOWS\system32\svchost.exe [2018-04-12 51288]
S3 MozillaMaintenance;Mozilla Maintenance Service; C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2018-05-22 194512]
S3 NaturalAuthentication;@%systemroot%\system32\NaturalAuth.dll,-100; C:\WINDOWS\system32\svchost.exe [2018-04-12 51288]
S3 NetSetupSvc;@%SystemRoot%\system32\NetSetupSvc.dll,-3; C:\WINDOWS\System32\svchost.exe [2018-04-12 51288]
S3 NgcCtnrSvc;@%SystemRoot%\System32\NgcCtnrSvc.dll,-1; C:\WINDOWS\system32\svchost.exe [2018-04-12 51288]
S3 NgcSvc;@%SystemRoot%\System32\ngcsvc.dll,-100; C:\WINDOWS\system32\svchost.exe [2018-04-12 51288]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2011-07-20 440696]
S3 ose;Office Source Engine; C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 PhoneSvc;@%SystemRoot%\system32\PhoneserviceRes.dll,-10000; C:\WINDOWS\system32\svchost.exe [2018-04-12 51288]
S3 PimIndexMaintenanceSvc;@%SystemRoot%\system32\UserDataAccessRes.dll,-15001; C:\WINDOWS\system32\svchost.exe [2018-04-12 51288]
S3 PimIndexMaintenanceSvc_43602;PimIndexMaintenanceSvc_43602; C:\WINDOWS\system32\svchost.exe [2018-04-12 51288]
S3 PrintWorkflowUserSvc;@%SystemRoot%\system32\PrintWorkflowService.dll,-100; C:\WINDOWS\system32\svchost.exe [2018-04-12 51288]
S3 PrintWorkflowUserSvc_43602;PrintWorkflowUserSvc_43602; C:\WINDOWS\system32\svchost.exe [2018-04-12 51288]
S3 PushToInstall;@%SystemRoot%\system32\pushtoinstall.dll,-200; C:\WINDOWS\System32\svchost.exe [2018-04-12 51288]
S3 RetailDemo;@%SystemRoot%\System32\RDXService.dll,-256; C:\WINDOWS\System32\svchost.exe [2018-04-12 51288]
S3 Sense;@%ProgramFiles%\Windows Defender Advanced Threat Protection\MsSense.exe,-1001; C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe [2018-04-12 4737448]
S3 SensorDataService;@%SystemRoot%\system32\SensorDataService.exe,-101; C:\WINDOWS\System32\SensorDataService.exe [2018-04-12 1273344]
S3 SensorService;@%SystemRoot%\System32\sensorservice.dll,-1000; C:\WINDOWS\system32\svchost.exe [2018-04-12 51288]
S3 SharedRealitySvc;@%SystemRoot%\system32\SharedRealitySvc.dll,-100; C:\WINDOWS\system32\svchost.exe [2018-04-12 51288]
S3 SmsRouter;@%SystemRoot%\System32\SmsRouterSvc.dll,-10001; C:\WINDOWS\system32\svchost.exe [2018-04-12 51288]
S3 spectrum;@%systemroot%\system32\spectrum.exe,-101; C:\WINDOWS\system32\spectrum.exe [2018-05-22 976384]
S4 AppVClient;@%systemroot%\system32\AppVClient.exe,-102; C:\WINDOWS\system32\AppVClient.exe [2018-05-22 826776]
S4 aspnet_state;@%SystemRoot%\Microsoft.NET\Framework64\v4.0.30319\aspnet_rc.dll,-1; C:\WINDOWS\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe [2018-04-12 52832]
S4 shpamsvc;@%SystemRoot%\System32\Windows.SharedPC.AccountManager.dll,-100; C:\WINDOWS\System32\svchost.exe [2018-04-12 51288]

-----------------EOF-----------------

[Miroslav Hubata]

Ještě doplnění, zkoušel jsem to znova a už jsem se na ty stránky dostal...ale nevím, fakt se to stalo při nich...

vypadalo to takhle nějak podobně: https://www.pcrisk.com/removal-guides/1 ... ately-scam

[Rudy]

Zdravím!
Zkusíme vyčistit. Spusťte tuto utilitu:

Ulozte na plochu AdwCleaner https://malwarebytes.com/adwcleaner/ nebo http://www.bleepingcomputer.com/download/adwcleaner/

ukoncete vsechny programy
odsouhlaste licencni podmiky (EULA) klikem na Souhlasim
kliknete pravym na ikonu AdwCleaneru a vyberte Spustit jako spravce (v pripade Win XP spustte obycejne dvojklikem)
kliknete na Skenovat nyni (Scan now), pote na Cisteni a opravy (Clean and Repair)
po restartu na Vas vyskoci log (pripadne jej najdete v C:\AdwCleaner\Logs\AdwCleaner[Cxx].txt), jehoz obsah zkopirujte do pristi odpovedi

[Miroslav Hubata]

Tak na Céčku pod Adwarem mi vyběhly dva soubory s koncovkou C00 a pak taky S00, vkládám to C00
Našlo to nějakej Pop.Up s dlouhým názvem...tak jsem to dal odstranit podle návodu

# -------------------------------
# Malwarebytes AdwCleaner 7.1.1.0
# -------------------------------
# Build: 04-27-2018
# Database: 2018-06-01.1
# Support: https://www.malwarebytes.com/support
#
# -------------------------------
# Mode: Clean
# -------------------------------
# Start: 06-04-2018
# Duration: 00:00:01
# OS: Windows 10 Pro
# Cleaned: 1
# Failed: 0


***** [ Services ] *****

No malicious services cleaned.

***** [ Folders ] *****

No malicious folders cleaned.

***** [ Files ] *****

No malicious files cleaned.

***** [ DLL ] *****

No malicious DLLs cleaned.

***** [ WMI ] *****

No malicious WMI cleaned.

***** [ Shortcuts ] *****

No malicious shortcuts cleaned.

***** [ Tasks ] *****

No malicious tasks cleaned.

***** [ Registry ] *****

Deleted HKLM\Software\Wow6432Node\Auslogics

***** [ Chromium (and derivatives) ] *****

No malicious Chromium entries cleaned.

***** [ Chromium URLs ] *****

No malicious Chromium URLs cleaned.

***** [ Firefox (and derivatives) ] *****

No malicious Firefox entries cleaned.

***** [ Firefox URLs ] *****

No malicious Firefox URLs cleaned.


*************************

[+] Delete Tracing Keys
[+] Reset Winsock

*************************


########## EOF - C:\AdwCleaner\Logs\AdwCleaner[C00].txt ##########

[Rudy]

OK. Teď dejte log FRST: https://forum.viry.cz/viewtopic.php?f=13&t=152707 .

[Miroslav Hubata]

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 03.06.2018
Ran by Miroslav Hubata (administrator) on IDEAPAD-V560 (04-06-2018 20:05:15)
Running from C:\Users\Miroslav Hubata\Desktop
Loaded Profiles: Miroslav Hubata (Available Profiles: Miroslav Hubata & DefaultAppPool)
Platform: Windows 10 Pro Version 1803 17134.48 (X64) Language: Čeština (Česko)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/33 ... scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Egis Technology Inc. ) C:\Program Files (x86)\EgisTec BioExcess\EgisService.exe
(Egis Technology Inc. ) C:\Program Files (x86)\EgisTec Port Locker\Egishlpsvc.exe
(Egis Technology Inc. ) C:\Program Files (x86)\EgisTec BioExcess\EgisDSService.exe
(SEIKO EPSON CORPORATION) C:\ProgramData\EPSON\EPW!3 SSRP\E_S40RPB.EXE
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDService.exe
(SEIKO EPSON CORPORATION) C:\ProgramData\EPSON\EPW!3 SSRP\E_S40STB.EXE
(Microsoft Corporation) C:\Windows\System32\mqsvc.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
(Realtek Semiconductor Corp.) C:\Program Files\Realtek\RtLED\RtLEDService.exe
(Lenovo.) C:\Windows\System32\TPHDEXLG64.exe
(Microsoft Corporation) C:\ProgramData\Microsoft\Windows Defender\Platform\4.16.17656.18052-0\MsMpEng.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
(Realtek Semiconductor Corp.) C:\Program Files\Realtek\RtLED\RtLED.exe
(Microsoft Corporation) C:\ProgramData\Microsoft\Windows Defender\Platform\4.16.17656.18052-0\NisSrv.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrl.exe
(Malwarebytes) C:\Users\Miroslav Hubata\Desktop\adwcleaner_7.1.1.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrlHelper.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
() C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.18041.14611.0_x64__8wekyb3d8bbwe\Video.UI.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.9330.20915.0_x64__8wekyb3d8bbwe\HxTsr.exe
() C:\Program Files\WindowsApps\Microsoft.SkypeApp_12.1815.209.0_x64__kzf8qxf38zg5c\SkypeHost.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MSASCuiL.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Lenovo.) C:\Windows\System32\TpShocks.exe
(Lenovo(beijing) Limited) C:\Program Files (x86)\Lenovo\Energy Management\utility.exe
(Lenovo (Beijing) Limited) C:\Program Files (x86)\Lenovo\Energy Management\Energy Management.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Vimicro) C:\Program Files (x86)\USB Camera2\VM332_STI.EXE
(Egis Technology Inc. ) C:\Program Files (x86)\EgisTec BioExcess\EgisTSR.exe
(CyberLink Corp.) C:\Program Files (x86)\Lenovo\YouCam\YouCamTray.exe
(Egis Technology Inc. ) C:\Program Files (x86)\EgisTec Port Locker\EgisPLTSR.exe
(Microsoft Corporation) C:\Windows\SysWOW64\notepad.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\Microsoft.WindowsStore_11804.1001.10.0_x64__8wekyb3d8bbwe\WinStore.App.exe
() C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2018.18041.15210.0_x64__8wekyb3d8bbwe\Microsoft.Photos.exe
(Microsoft Corporation) C:\Windows\SystemApps\Microsoft.LockApp_cw5n1h2txyewy\LockApp.exe
(Microsoft Corporation) C:\Windows\System32\smartscreen.exe

==================== Registry (Whitelisted) ===========================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [SecurityHealth] => C:\Program Files\Windows Defender\MSASCuiL.exe [638872 2018-04-12] (Microsoft Corporation)
HKLM\...\Run: [ETDCtrl] => C:\Program Files\Elantech\ETDCtrl.exe [3242696 2015-10-07] (ELAN Microelectronics Corp.)
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [10821224 2010-06-02] (Realtek Semiconductor)
HKLM\...\Run: [ETDWare] => C:\Program Files\Elantech\ETDCtrl.exe [3242696 2015-10-07] (ELAN Microelectronics Corp.)
HKLM\...\Run: [TpShocks] => C:\Windows\System32\TpShocks.exe [231328 2010-03-15] (Lenovo.)
HKLM\...\Run: [UpdatePRCShortCut] => "C:\Program Files\Lenovo\OneKey App\OneKey Recovery\MUITransfer\MUIStartMenu.exe" "C:\Program Files\Lenovo\OneKey App\OneKey Recovery" UpdateWithCreateOnce "Software\Lenovo\OneKey App\OneKey Recovery"
HKLM\...\Run: [EnergyUtility] => C:\Program Files (x86)\Lenovo\Energy Management\utility.exe [4462496 2010-04-12] (Lenovo(beijing) Limited)
HKLM\...\Run: [Energy Management] => C:\Program Files (x86)\Lenovo\Energy Management\Energy Management.exe [7056800 2010-03-18] (Lenovo (Beijing) Limited)
HKLM-x32\...\Run: [332BigDog] => C:\Program Files (x86)\USB Camera2\VM332_STI.EXE [536576 2010-01-19] (Vimicro)
HKLM-x32\...\Run: [IMSS] => C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PIconStartup.exe [111640 2009-09-30] ()
HKLM-x32\...\Run: [VitaKeyTSR] => C:\Program Files (x86)\EgisTec BioExcess\EgisTSR.exe [376176 2010-05-28] (Egis Technology Inc. )
HKLM-x32\...\Run: [UCam_Menu] => C:\Program Files (x86)\Lenovo\YouCam\MUITransfer\MUIStartMenu.exe [222504 2009-05-20] (CyberLink Corp.)
HKLM-x32\...\Run: [YouCam Mirror Tray icon] => C:\Program Files (x86)\Lenovo\YouCam\YouCamTray.exe [171104 2010-03-03] (CyberLink Corp.)
HKLM-x32\...\Run: [PLTSR] => C:\Program Files (x86)\EgisTec Port Locker\EgisPLTSR.exe [364400 2010-09-11] (Egis Technology Inc. )
Winlogon\Notify\igfxcui: C:\WINDOWS\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-19\...\RunOnce: [WAB Migrate] => C:\Program Files\Windows Mail\wab.exe [518144 2018-04-12] (Microsoft Corporation)
HKU\S-1-5-20\...\RunOnce: [WAB Migrate] => C:\Program Files\Windows Mail\wab.exe [518144 2018-04-12] (Microsoft Corporation)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Tcpip\Parameters: [DhcpNameServer] 213.46.172.36 213.46.172.37
Tcpip\..\Interfaces\{3f2eb8f9-06d9-4d84-9c73-ce96c6a4585c}: [DhcpNameServer] 213.46.172.36 213.46.172.37
Tcpip\..\Interfaces\{df624ac1-2f7a-496a-8e1c-e05b5c5fe890}: [DhcpNameServer] 213.46.172.36 213.46.172.37

Internet Explorer:
==================
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
HKU\S-1-5-21-1710102897-3723813563-2687980958-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.seznam.cz/
HKU\S-1-5-21-1710102897-3723813563-2687980958-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
BHO-x32: IEPwdBankBHO Class -> {56CBB761-DA41-4E31-B270-B13B4B0A61D0} -> C:\Program Files (x86)\EgisTec BioExcess\EgisIEPwdBank.dll [2010-05-28] (Egis Technology Inc. )
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - No File

FireFox:
========
FF DefaultProfile: 26b90t9b.default
FF ProfilePath: C:\Users\Miroslav Hubata\AppData\Roaming\Mozilla\Firefox\Profiles\26b90t9b.default [2018-06-04]
FF Homepage: Mozilla\Firefox\Profiles\26b90t9b.default -> hxxps://www.seznam.cz/
FF Extension: (TLS 1.3 gradual roll-out fallback-limit) - C:\Users\Miroslav Hubata\AppData\Roaming\Mozilla\Firefox\Profiles\26b90t9b.default\features\{90b2d5a9-ce67-4557-96f6-61ebc25b75de}\tls13-version-fallback-rollout-bug1462099@mozilla.org.xpi [2018-06-01] [Legacy]
FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF64_29_0_0_171.dll [2018-05-08] ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.50907.0\npctrl.dll [2017-05-03] ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_29_0_0_171.dll [2018-05-08] ()
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.50907.0\npctrl.dll [2017-05-03] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2010-11-10] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2010-11-10] (Microsoft Corporation)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2018-05-11] (Adobe Systems Inc.)

==================== Services (Whitelisted) ====================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 EgisTec Data Security Service; C:\Program Files (x86)\EgisTec BioExcess\EgisDSService.exe [314736 2010-05-28] (Egis Technology Inc. )
R2 EgisTec Service Help; C:\Program Files (x86)\EgisTec Port Locker\Egishlpsvc.exe [327024 2010-09-11] (Egis Technology Inc. )
R2 ETDService; C:\Program Files\Elantech\ETDService.exe [144072 2015-10-07] (ELAN Microelectronics Corp.)
R2 RtLedService; C:\Program Files\Realtek\RtLED\RtLEDService.exe [311296 2010-02-05] (Realtek Semiconductor Corp.) [File not signed]
S3 Sense; C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe [4737448 2018-04-12] (Microsoft Corporation)
S3 ssh-agent; C:\WINDOWS\System32\OpenSSH\ssh-agent.exe [495616 2018-03-10] ()
R3 WdNisSvc; C:\ProgramData\Microsoft\Windows Defender\platform\4.16.17656.18052-0\NisSrv.exe [4682552 2018-06-01] (Microsoft Corporation)
R2 WinDefend; C:\ProgramData\Microsoft\Windows Defender\platform\4.16.17656.18052-0\MsMpEng.exe [101096 2018-06-01] (Microsoft Corporation)

===================== Drivers (Whitelisted) ======================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R1 MpKslc40c1a21; C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{6DBCD8DD-AD9D-4A0A-8E5B-F83E6809FB9F}\MpKslc40c1a21.sys [58120 2018-06-04] (Microsoft Corporation)
S0 WdBoot; C:\WINDOWS\System32\drivers\wd\WdBoot.sys [46072 2018-06-01] (Microsoft Corporation)
R0 WdFilter; C:\WINDOWS\System32\drivers\wd\WdFilter.sys [313384 2018-06-01] (Microsoft Corporation)
R3 WdNisDrv; C:\WINDOWS\System32\drivers\wd\WdNisDrv.sys [61992 2018-06-01] (Microsoft Corporation)

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2018-06-04 20:05 - 2018-06-04 20:06 - 000011605 _____ C:\Users\Miroslav Hubata\Desktop\FRST.txt
2018-06-04 20:02 - 2018-06-04 20:02 - 002413056 _____ (Farbar) C:\Users\Miroslav Hubata\Desktop\FRST64.exe
2018-06-04 18:58 - 2018-06-04 18:59 - 000000000 ____D C:\AdwCleaner
2018-06-04 18:57 - 2018-06-04 18:57 - 007271632 _____ (Malwarebytes) C:\Users\Miroslav Hubata\Desktop\adwcleaner_7.1.1.exe
2018-05-25 18:28 - 2018-05-25 20:08 - 000000000 ____D C:\Users\Miroslav Hubata\AppData\Local\PlaceholderTileLogoFolder
2018-05-23 12:38 - 2018-05-23 12:38 - 000000000 ____D C:\ProgramData\Microsoft OneDrive
2018-05-23 12:37 - 2018-05-23 12:37 - 000001417 _____ C:\Users\Miroslav Hubata\Desktop\Microsoft Edge.lnk
2018-05-23 12:33 - 2018-05-23 12:33 - 000000020 ___SH C:\Users\Miroslav Hubata\ntuser.ini
2018-05-23 12:23 - 2018-06-04 19:00 - 000000006 ____H C:\WINDOWS\Tasks\SA.DAT
2018-05-23 12:23 - 2018-05-29 21:09 - 000003392 _____ C:\WINDOWS\System32\Tasks\OneDrive Standalone Update Task-S-1-5-21-1710102897-3723813563-2687980958-1000
2018-05-23 12:23 - 2018-05-23 12:23 - 000003818 _____ C:\WINDOWS\System32\Tasks\Adobe Flash Player NPAPI Notifier
2018-05-23 12:23 - 2018-05-23 12:23 - 000003482 _____ C:\WINDOWS\System32\Tasks\Adobe Acrobat Update Task
2018-05-23 12:23 - 2018-05-23 12:23 - 000003406 _____ C:\WINDOWS\System32\Tasks\Adobe Flash Player Updater
2018-05-23 12:23 - 2018-05-23 12:23 - 000002538 _____ C:\WINDOWS\System32\Tasks\CreateChoiceProcessTask
2018-05-23 12:23 - 2018-05-23 12:23 - 000002026 _____ C:\WINDOWS\System32\Tasks\{3E706687-0E8F-4E96-A81E-7721DC14005A}
2018-05-23 12:23 - 2018-05-23 12:23 - 000000000 ____D C:\WINDOWS\System32\Tasks\WPD
2018-05-23 12:22 - 2018-05-23 12:23 - 000011433 _____ C:\WINDOWS\diagwrn.xml
2018-05-23 12:22 - 2018-05-23 12:23 - 000011433 _____ C:\WINDOWS\diagerr.xml
2018-05-23 12:07 - 2018-05-23 12:07 - 000001519 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk
2018-05-23 12:05 - 2018-06-03 23:17 - 000000000 ____D C:\Users\Miroslav Hubata
2018-05-23 12:05 - 2018-05-29 21:09 - 000002463 _____ C:\Users\Miroslav Hubata\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OneDrive.lnk
2018-05-23 12:05 - 2018-05-23 12:12 - 000000000 ____D C:\Users\DefaultAppPool
2018-05-23 12:05 - 2018-05-23 12:07 - 000000000 ____D C:\Users\Miroslav Hubata\AppData\Local\Microsoft Help
2018-05-23 12:05 - 2018-05-23 12:06 - 000000000 ____D C:\Users\Miroslav Hubata\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Lenovo
2018-05-23 12:05 - 2018-05-23 12:05 - 000000000 _SHDL C:\Users\Miroslav Hubata\Šablony
2018-05-23 12:05 - 2018-05-23 12:05 - 000000000 _SHDL C:\Users\Miroslav Hubata\Soubory cookie
2018-05-23 12:05 - 2018-05-23 12:05 - 000000000 _SHDL C:\Users\Miroslav Hubata\Poslední
2018-05-23 12:05 - 2018-05-23 12:05 - 000000000 _SHDL C:\Users\Miroslav Hubata\Okolní tiskárny
2018-05-23 12:05 - 2018-05-23 12:05 - 000000000 _SHDL C:\Users\Miroslav Hubata\Okolní síť
2018-05-23 12:05 - 2018-05-23 12:05 - 000000000 _SHDL C:\Users\Miroslav Hubata\Nabídka Start
2018-05-23 12:05 - 2018-05-23 12:05 - 000000000 _SHDL C:\Users\Miroslav Hubata\Dokumenty
2018-05-23 12:05 - 2018-05-23 12:05 - 000000000 _SHDL C:\Users\Miroslav Hubata\Documents\Obrázky
2018-05-23 12:05 - 2018-05-23 12:05 - 000000000 _SHDL C:\Users\Miroslav Hubata\Documents\Hudba
2018-05-23 12:05 - 2018-05-23 12:05 - 000000000 _SHDL C:\Users\Miroslav Hubata\Documents\Filmy
2018-05-23 12:05 - 2018-05-23 12:05 - 000000000 _SHDL C:\Users\Miroslav Hubata\Data aplikací
2018-05-23 12:05 - 2018-05-23 12:05 - 000000000 _SHDL C:\Users\Miroslav Hubata\AppData\Roaming\Microsoft\Windows\Start Menu\Programy
2018-05-23 12:05 - 2018-05-23 12:05 - 000000000 _SHDL C:\Users\Miroslav Hubata\AppData\Local\Data aplikací
2018-05-23 12:05 - 2018-05-23 12:05 - 000000000 _SHDL C:\Users\DefaultAppPool\Šablony
2018-05-23 12:05 - 2018-05-23 12:05 - 000000000 _SHDL C:\Users\DefaultAppPool\Soubory cookie
2018-05-23 12:05 - 2018-05-23 12:05 - 000000000 _SHDL C:\Users\DefaultAppPool\Poslední
2018-05-23 12:05 - 2018-05-23 12:05 - 000000000 _SHDL C:\Users\DefaultAppPool\Okolní tiskárny
2018-05-23 12:05 - 2018-05-23 12:05 - 000000000 _SHDL C:\Users\DefaultAppPool\Okolní síť
2018-05-23 12:05 - 2018-05-23 12:05 - 000000000 _SHDL C:\Users\DefaultAppPool\Nabídka Start
2018-05-23 12:05 - 2018-05-23 12:05 - 000000000 _SHDL C:\Users\DefaultAppPool\Dokumenty
2018-05-23 12:05 - 2018-05-23 12:05 - 000000000 _SHDL C:\Users\DefaultAppPool\Documents\Obrázky
2018-05-23 12:05 - 2018-05-23 12:05 - 000000000 _SHDL C:\Users\DefaultAppPool\Documents\Hudba
2018-05-23 12:05 - 2018-05-23 12:05 - 000000000 _SHDL C:\Users\DefaultAppPool\Documents\Filmy
2018-05-23 12:05 - 2018-05-23 12:05 - 000000000 _SHDL C:\Users\DefaultAppPool\Data aplikací
2018-05-23 12:05 - 2018-05-23 12:05 - 000000000 _SHDL C:\Users\DefaultAppPool\AppData\Roaming\Microsoft\Windows\Start Menu\Programy
2018-05-23 12:05 - 2018-05-23 12:05 - 000000000 _SHDL C:\Users\DefaultAppPool\AppData\Local\Data aplikací
2018-05-23 12:05 - 2018-05-22 14:24 - 000000000 ____D C:\Users\DefaultAppPool\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Lenovo
2018-05-23 12:05 - 2018-04-12 01:34 - 000001105 _____ C:\Users\DefaultAppPool\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OneDrive.lnk
2018-05-23 12:05 - 2016-09-19 13:23 - 000000000 ____D C:\Users\Miroslav Hubata\AppData\Roaming\Media Center Programs
2018-05-23 12:05 - 2016-09-19 13:23 - 000000000 ____D C:\Users\DefaultAppPool\AppData\Roaming\Media Center Programs
2018-05-23 12:05 - 2016-09-19 13:23 - 000000000 ____D C:\Users\DefaultAppPool\AppData\Local\Microsoft Help
2018-05-23 12:05 - 2010-12-08 17:11 - 000002104 _____ C:\Users\Miroslav Hubata\Desktop\OneKey Recovery.lnk
2018-05-23 12:05 - 2010-12-08 17:11 - 000002104 _____ C:\Users\DefaultAppPool\Desktop\OneKey Recovery.lnk
2018-05-23 12:05 - 2010-12-08 17:10 - 000001140 _____ C:\Users\Miroslav Hubata\Desktop\Cyberlink Power2Go.lnk
2018-05-23 12:05 - 2010-12-08 17:10 - 000001140 _____ C:\Users\DefaultAppPool\Desktop\Cyberlink Power2Go.lnk
2018-05-23 12:05 - 2010-12-08 17:02 - 000002198 _____ C:\Users\Miroslav Hubata\Desktop\CyberLink YouCam.lnk
2018-05-23 12:05 - 2010-12-08 17:02 - 000002198 _____ C:\Users\DefaultAppPool\Desktop\CyberLink YouCam.lnk
2018-05-23 12:00 - 2018-06-04 19:08 - 001956564 _____ C:\WINDOWS\system32\PerfStringBackup.INI
2018-05-23 12:00 - 2018-05-23 12:00 - 000000000 ____D C:\ProgramData\USOShared
2018-05-23 12:00 - 2018-04-12 01:33 - 002752000 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\PrintConfig.dll
2018-05-23 11:55 - 2018-06-04 20:00 - 000000000 ____D C:\WINDOWS\system32\SleepStudy
2018-05-23 11:55 - 2018-05-23 12:09 - 000297040 _____ C:\WINDOWS\system32\FNTCACHE.DAT
2018-05-22 14:26 - 2018-05-22 14:26 - 000000000 ___DL C:\Users\Public\Recorded TV (2)
2018-05-22 14:25 - 2018-05-23 12:54 - 000000000 ____D C:\WINDOWS\system32\config\bbimigrate
2018-05-22 14:25 - 2018-05-22 14:25 - 000000000 ____D C:\Program Files\Common Files\SpeechEngines
2018-05-22 14:21 - 2018-05-22 14:25 - 000000000 ____D C:\WINDOWS\ServiceProfiles
2018-05-22 14:14 - 2018-05-22 14:14 - 013570560 _____ (Microsoft Corporation) C:\WINDOWS\system32\wmp.dll
2018-05-22 14:14 - 2018-05-22 14:14 - 012500992 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wmp.dll
2018-05-22 14:13 - 2018-05-22 14:13 - 025848832 _____ (Microsoft Corporation) C:\WINDOWS\system32\edgehtml.dll
2018-05-22 14:13 - 2018-05-22 14:13 - 023862272 _____ (Microsoft Corporation) C:\WINDOWS\system32\Hydrogen.dll
2018-05-22 14:13 - 2018-05-22 14:13 - 022707712 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll
2018-05-22 14:13 - 2018-05-22 14:13 - 022002688 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\edgehtml.dll
2018-05-22 14:13 - 2018-05-22 14:13 - 021389360 _____ (Microsoft Corporation) C:\WINDOWS\system32\shell32.dll
2018-05-22 14:13 - 2018-05-22 14:13 - 020383720 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\shell32.dll
2018-05-22 14:13 - 2018-05-22 14:13 - 019525120 _____ (Microsoft Corporation) C:\WINDOWS\system32\HologramCompositor.dll
2018-05-22 14:13 - 2018-05-22 14:13 - 019399168 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll
2018-05-22 14:13 - 2018-05-22 14:13 - 012712960 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll
2018-05-22 14:13 - 2018-05-22 14:13 - 011903488 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll
2018-05-22 14:13 - 2018-05-22 14:13 - 009159064 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntoskrnl.exe
2018-05-22 14:13 - 2018-05-22 14:13 - 008623104 _____ (Microsoft Corporation) C:\WINDOWS\system32\mstscax.dll
2018-05-22 14:13 - 2018-05-22 14:13 - 008188928 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Data.Pdf.dll
2018-05-22 14:13 - 2018-05-22 14:13 - 007987712 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mstscax.dll
2018-05-22 14:13 - 2018-05-22 14:13 - 007583232 _____ (Microsoft Corporation) C:\WINDOWS\system32\Chakra.dll
2018-05-22 14:13 - 2018-05-22 14:13 - 007519992 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.Protection.PlayReady.dll
2018-05-22 14:13 - 2018-05-22 14:13 - 006661632 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Data.Pdf.dll
2018-05-22 14:13 - 2018-05-22 14:13 - 006569952 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.Protection.PlayReady.dll
2018-05-22 14:13 - 2018-05-22 14:13 - 006044104 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\windows.storage.dll
2018-05-22 14:13 - 2018-05-22 14:13 - 005951488 _____ (Microsoft Corporation) C:\WINDOWS\system32\dbgeng.dll
2018-05-22 14:13 - 2018-05-22 14:13 - 005782528 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Chakra.dll
2018-05-22 14:13 - 2018-05-22 14:13 - 004929024 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dbgeng.dll
2018-05-22 14:13 - 2018-05-22 14:13 - 004867072 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll
2018-05-22 14:13 - 2018-05-22 14:13 - 004706816 _____ (Microsoft Corporation) C:\WINDOWS\system32\cdp.dll
2018-05-22 14:13 - 2018-05-22 14:13 - 004372992 _____ (Microsoft Corporation) C:\WINDOWS\system32\EdgeContent.dll
2018-05-22 14:13 - 2018-05-22 14:13 - 004070400 _____ (Microsoft Corporation) C:\WINDOWS\system32\msi.dll
2018-05-22 14:13 - 2018-05-22 14:13 - 003732800 _____ C:\WINDOWS\system32\Windows.Mirage.dll
2018-05-22 14:13 - 2018-05-22 14:13 - 003712000 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll
2018-05-22 14:13 - 2018-05-22 14:13 - 003655168 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32kfull.sys
2018-05-22 14:13 - 2018-05-22 14:13 - 003440640 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininet.dll
2018-05-22 14:13 - 2018-05-22 14:13 - 003392512 _____ (Microsoft Corporation) C:\WINDOWS\system32\tquery.dll
2018-05-22 14:13 - 2018-05-22 14:13 - 003389952 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentServer.dll
2018-05-22 14:13 - 2018-05-22 14:13 - 003320320 _____ (Microsoft Corporation) C:\WINDOWS\system32\dwmcore.dll
2018-05-22 14:13 - 2018-05-22 14:13 - 003283400 _____ (Microsoft Corporation) C:\WINDOWS\system32\CoreUIComponents.dll
2018-05-22 14:13 - 2018-05-22 14:13 - 003086336 _____ (Microsoft Corporation) C:\WINDOWS\system32\diagtrack.dll
2018-05-22 14:13 - 2018-05-22 14:13 - 003015168 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wininet.dll
2018-05-22 14:13 - 2018-05-22 14:13 - 002961408 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\cdp.dll
2018-05-22 14:13 - 2018-05-22 14:13 - 002902528 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuaueng.dll
2018-05-22 14:13 - 2018-05-22 14:13 - 002900992 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dwmcore.dll
2018-05-22 14:13 - 2018-05-22 14:13 - 002841312 _____ C:\WINDOWS\SysWOW64\Windows.Mirage.dll
2018-05-22 14:13 - 2018-05-22 14:13 - 002835864 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgkrnl.sys
2018-05-22 14:13 - 2018-05-22 14:13 - 002753040 _____ (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll
2018-05-22 14:13 - 2018-05-22 14:13 - 002700800 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\tquery.dll
2018-05-22 14:13 - 2018-05-22 14:13 - 002486976 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\CoreUIComponents.dll
2018-05-22 14:13 - 2018-05-22 14:13 - 002422168 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ntfs.sys
2018-05-22 14:13 - 2018-05-22 14:13 - 002366976 _____ (Microsoft Corporation) C:\WINDOWS\system32\WebRuntimeManager.dll
2018-05-22 14:13 - 2018-05-22 14:13 - 002242208 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iertutil.dll
2018-05-22 14:13 - 2018-05-22 14:13 - 002236928 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32kbase.sys
2018-05-22 14:13 - 2018-05-22 14:13 - 002170368 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentExtensions.onecore.dll
2018-05-22 14:13 - 2018-05-22 14:13 - 001855488 _____ (Microsoft Corporation) C:\WINDOWS\system32\msxml3.dll
2018-05-22 14:13 - 2018-05-22 14:13 - 001817088 _____ (Microsoft Corporation) C:\WINDOWS\system32\urlmon.dll
2018-05-22 14:13 - 2018-05-22 14:13 - 001664512 _____ (Microsoft Corporation) C:\WINDOWS\system32\comsvcs.dll
2018-05-22 14:13 - 2018-05-22 14:13 - 001636352 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\urlmon.dll
2018-05-22 14:13 - 2018-05-22 14:13 - 001634800 _____ (Microsoft Corporation) C:\WINDOWS\system32\gdi32full.dll
2018-05-22 14:13 - 2018-05-22 14:13 - 001586176 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieapfltr.dll
2018-05-22 14:13 - 2018-05-22 14:13 - 001550848 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentExtensions.desktop.dll
2018-05-22 14:13 - 2018-05-22 14:13 - 001534976 _____ (Microsoft Corporation) C:\WINDOWS\system32\lsasrv.dll
2018-05-22 14:13 - 2018-05-22 14:13 - 001466368 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieapfltr.dll
2018-05-22 14:13 - 2018-05-22 14:13 - 001456616 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.efi
2018-05-22 14:13 - 2018-05-22 14:13 - 001454016 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\gdi32full.dll
2018-05-22 14:13 - 2018-05-22 14:13 - 001426328 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AppxPackaging.dll
2018-05-22 14:13 - 2018-05-22 14:13 - 001421312 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpbase.dll
2018-05-22 14:13 - 2018-05-22 14:13 - 001380864 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\comsvcs.dll
2018-05-22 14:13 - 2018-05-22 14:13 - 001258280 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.exe
2018-05-22 14:13 - 2018-05-22 14:13 - 001235968 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rdpbase.dll
2018-05-22 14:13 - 2018-05-22 14:13 - 001191168 _____ (Microsoft Corporation) C:\WINDOWS\system32\rpcrt4.dll
2018-05-22 14:13 - 2018-05-22 14:13 - 001160192 _____ (Microsoft Corporation) C:\WINDOWS\system32\rpcss.dll
2018-05-22 14:13 - 2018-05-22 14:13 - 001063320 _____ (Microsoft Corporation) C:\WINDOWS\system32\SecConfig.efi
2018-05-22 14:13 - 2018-05-22 14:13 - 001034624 _____ (Microsoft Corporation) C:\WINDOWS\system32\ApplyTrustOffline.exe
2018-05-22 14:13 - 2018-05-22 14:13 - 000976384 _____ (Microsoft Corporation) C:\WINDOWS\system32\Spectrum.exe
2018-05-22 14:13 - 2018-05-22 14:13 - 000960512 _____ (Microsoft Corporation) C:\WINDOWS\system32\StorSvc.dll
2018-05-22 14:13 - 2018-05-22 14:13 - 000944640 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Mirage.Internal.dll
2018-05-22 14:13 - 2018-05-22 14:13 - 000933376 _____ (Microsoft Corporation) C:\WINDOWS\system32\rasapi32.dll
2018-05-22 14:13 - 2018-05-22 14:13 - 000917504 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuapi.dll
2018-05-22 14:13 - 2018-05-22 14:13 - 000898560 _____ (Microsoft Corporation) C:\WINDOWS\system32\WpcWebFilter.dll
2018-05-22 14:13 - 2018-05-22 14:13 - 000894464 _____ (Microsoft Corporation) C:\WINDOWS\system32\webplatstorageserver.dll
2018-05-22 14:13 - 2018-05-22 14:13 - 000860160 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rasapi32.dll
2018-05-22 14:13 - 2018-05-22 14:13 - 000826776 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVClient.exe
2018-05-22 14:13 - 2018-05-22 14:13 - 000814592 _____ (Microsoft Corporation) C:\WINDOWS\system32\EdgeManager.dll
2018-05-22 14:13 - 2018-05-22 14:13 - 000786168 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rpcrt4.dll
2018-05-22 14:13 - 2018-05-22 14:13 - 000776880 _____ (Microsoft Corporation) C:\WINDOWS\system32\wer.dll
2018-05-22 14:13 - 2018-05-22 14:13 - 000775680 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript.dll
2018-05-22 14:13 - 2018-05-22 14:13 - 000758272 _____ (Microsoft Corporation) C:\WINDOWS\system32\msfeeds.dll
2018-05-22 14:13 - 2018-05-22 14:13 - 000749976 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVReporting.dll
2018-05-22 14:13 - 2018-05-22 14:13 - 000726528 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9diag.dll
2018-05-22 14:13 - 2018-05-22 14:13 - 000709816 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\cng.sys
2018-05-22 14:13 - 2018-05-22 14:13 - 000695296 _____ (Microsoft Corporation) C:\WINDOWS\system32\hhctrl.ocx
2018-05-22 14:13 - 2018-05-22 14:13 - 000669184 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript.dll
2018-05-22 14:13 - 2018-05-22 14:13 - 000668672 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msfeeds.dll
2018-05-22 14:13 - 2018-05-22 14:13 - 000665320 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wer.dll
2018-05-22 14:13 - 2018-05-22 14:13 - 000658432 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Mirage.Internal.dll
2018-05-22 14:13 - 2018-05-22 14:13 - 000652184 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVPublishing.dll
2018-05-22 14:13 - 2018-05-22 14:13 - 000624128 _____ (Microsoft Corporation) C:\WINDOWS\system32\PsmServiceExtHost.dll
2018-05-22 14:13 - 2018-05-22 14:13 - 000619520 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WpcWebFilter.dll
2018-05-22 14:13 - 2018-05-22 14:13 - 000615424 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\EdgeManager.dll
2018-05-22 14:13 - 2018-05-22 14:13 - 000613376 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Xaml.Resources.rs4.dll
2018-05-22 14:13 - 2018-05-22 14:13 - 000606448 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\oleaut32.dll
2018-05-22 14:13 - 2018-05-22 14:13 - 000604568 _____ (Microsoft Corporation) C:\WINDOWS\system32\securekernel.exe
2018-05-22 14:13 - 2018-05-22 14:13 - 000596480 _____ (Microsoft Corporation) C:\WINDOWS\system32\updatehandlers.dll
2018-05-22 14:13 - 2018-05-22 14:13 - 000585728 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Xaml.Resources.rs3.dll
2018-05-22 14:13 - 2018-05-22 14:13 - 000584192 _____ (Microsoft Corporation) C:\WINDOWS\system32\UIRibbonRes.dll
2018-05-22 14:13 - 2018-05-22 14:13 - 000581120 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\hhctrl.ocx
2018-05-22 14:13 - 2018-05-22 14:13 - 000578560 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\webplatstorageserver.dll
2018-05-22 14:13 - 2018-05-22 14:13 - 000561664 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9diag.dll
2018-05-22 14:13 - 2018-05-22 14:13 - 000559968 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AppXDeploymentClient.dll
2018-05-22 14:13 - 2018-05-22 14:13 - 000553984 _____ (Microsoft Corporation) C:\WINDOWS\system32\PerceptionSimulationExtensions.dll
2018-05-22 14:13 - 2018-05-22 14:13 - 000543744 _____ (Microsoft Corporation) C:\WINDOWS\system32\vbscript.dll
2018-05-22 14:13 - 2018-05-22 14:13 - 000524800 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\vbscript.dll
2018-05-22 14:13 - 2018-05-22 14:13 - 000494488 _____ (Microsoft Corporation) C:\WINDOWS\system32\WerFault.exe
2018-05-22 14:13 - 2018-05-22 14:13 - 000474624 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Xaml.Resources.rs2.dll
2018-05-22 14:13 - 2018-05-22 14:13 - 000473496 _____ (Microsoft Corporation) C:\WINDOWS\system32\dcntel.dll
2018-05-22 14:13 - 2018-05-22 14:13 - 000444416 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Xaml.Resources.rs1.dll
2018-05-22 14:13 - 2018-05-22 14:13 - 000434584 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WerFault.exe
2018-05-22 14:13 - 2018-05-22 14:13 - 000399768 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVScripting.dll
2018-05-22 14:13 - 2018-05-22 14:13 - 000392192 _____ (Microsoft Corporation) C:\WINDOWS\system32\iedkcs32.dll
2018-05-22 14:13 - 2018-05-22 14:13 - 000382872 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\clfs.sys
2018-05-22 14:13 - 2018-05-22 14:13 - 000344064 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iedkcs32.dll
2018-05-22 14:13 - 2018-05-22 14:13 - 000288256 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Xaml.Resources.th.dll
2018-05-22 14:13 - 2018-05-22 14:13 - 000272288 _____ (Microsoft Corporation) C:\WINDOWS\system32\SgrmEnclave.dll
2018-05-22 14:13 - 2018-05-22 14:13 - 000269216 _____ (Microsoft Corporation) C:\WINDOWS\system32\SgrmEnclave_secure.dll
2018-05-22 14:13 - 2018-05-22 14:13 - 000256000 _____ (Microsoft Corporation) C:\WINDOWS\system32\MixedReality.Broker.dll
2018-05-22 14:13 - 2018-05-22 14:13 - 000241664 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Xaml.Resources.win81.dll
2018-05-22 14:13 - 2018-05-22 14:13 - 000171520 _____ (Microsoft Corporation) C:\WINDOWS\system32\itss.dll
2018-05-22 14:13 - 2018-05-22 14:13 - 000170904 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ksecpkg.sys
2018-05-22 14:13 - 2018-05-22 14:13 - 000159744 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Cortana.Analog.dll
2018-05-22 14:13 - 2018-05-22 14:13 - 000154112 _____ (Microsoft Corporation) C:\WINDOWS\system32\Chakradiag.dll
2018-05-22 14:13 - 2018-05-22 14:13 - 000150528 _____ (Microsoft Corporation) C:\WINDOWS\system32\SharedPCCSP.dll
2018-05-22 14:13 - 2018-05-22 14:13 - 000150016 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\itss.dll
2018-05-22 14:13 - 2018-05-22 14:13 - 000144384 _____ (Microsoft Corporation) C:\WINDOWS\system32\mssprxy.dll
2018-05-22 14:13 - 2018-05-22 14:13 - 000143360 _____ (Microsoft Corporation) C:\WINDOWS\system32\TSpkg.dll
2018-05-22 14:13 - 2018-05-22 14:13 - 000142336 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Xaml.Resources.win8rtm.dll
2018-05-22 14:13 - 2018-05-22 14:13 - 000023552 _____ (Microsoft Corporation) C:\WINDOWS\system32\credssp.dll
2018-05-22 14:13 - 2018-05-22 14:13 - 000002560 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\tzres.dll
2018-05-22 14:13 - 2018-05-22 14:13 - 000002560 _____ (Microsoft Corporation) C:\WINDOWS\system32\tzres.dll
2018-05-22 14:12 - 2018-05-22 14:12 - 007436624 _____ (Microsoft Corporation) C:\WINDOWS\system32\windows.storage.dll
2018-05-22 14:12 - 2018-05-22 14:12 - 002897408 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\win32kfull.sys
2018-05-22 14:12 - 2018-05-22 14:12 - 001953280 _____ C:\WINDOWS\system32\rdpnano.dll
2018-05-22 14:12 - 2018-05-22 14:12 - 001585664 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msxml3.dll
2018-05-22 14:12 - 2018-05-22 14:12 - 001565592 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppxPackaging.dll
2018-05-22 14:12 - 2018-05-22 14:12 - 001174424 _____ (Microsoft Corporation) C:\WINDOWS\system32\hvix64.exe
2018-05-22 14:12 - 2018-05-22 14:12 - 001012120 _____ (Microsoft Corporation) C:\WINDOWS\system32\hvax64.exe
2018-05-22 14:12 - 2018-05-22 14:12 - 000885848 _____ (Microsoft Corporation) C:\WINDOWS\system32\CoreMessaging.dll
2018-05-22 14:12 - 2018-05-22 14:12 - 000836608 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wuapi.dll
2018-05-22 14:12 - 2018-05-22 14:12 - 000788216 _____ (Microsoft Corporation) C:\WINDOWS\system32\oleaut32.dll
2018-05-22 14:12 - 2018-05-22 14:12 - 000733992 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentClient.dll
2018-05-22 14:12 - 2018-05-22 14:12 - 000705944 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\vhdmp.sys
2018-05-22 14:12 - 2018-05-22 14:12 - 000567136 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\CoreMessaging.dll
2018-05-22 14:12 - 2018-05-22 14:12 - 000134552 _____ (Microsoft Corporation) C:\WINDOWS\system32\hvloader.dll
2018-05-22 14:12 - 2018-05-22 14:12 - 000117760 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TSpkg.dll
2018-05-22 14:12 - 2018-05-22 14:12 - 000046592 _____ (Microsoft Corporation) C:\WINDOWS\system32\wcimage.dll
2018-05-22 14:12 - 2018-05-22 14:12 - 000019968 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\credssp.dll
2018-05-22 14:12 - 2018-05-22 14:12 - 000001312 _____ C:\WINDOWS\system32\tcbres.wim
2018-05-22 14:01 - 2018-05-22 14:01 - 000000000 ____D C:\WINDOWS\SysWOW64\BestPractices
2018-05-22 14:01 - 2018-05-22 14:01 - 000000000 ____D C:\WINDOWS\system32\msmq
2018-05-22 14:01 - 2018-05-22 14:01 - 000000000 ____D C:\WINDOWS\system32\BestPractices
2018-05-22 14:01 - 2018-05-22 14:01 - 000000000 ____D C:\inetpub
2018-05-22 14:00 - 2018-05-22 14:00 - 006350848 _____ (Microsoft Corporation) C:\WINDOWS\system32\NlsData0009.dll
2018-05-22 14:00 - 2018-05-22 14:00 - 005739008 _____ (Microsoft Corporation) C:\WINDOWS\system32\prm0009.dll
2018-05-22 14:00 - 2018-05-22 14:00 - 005487616 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\NlsData0009.dll
2018-05-22 14:00 - 2018-05-22 14:00 - 002629120 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\NlsLexicons0009.dll
2018-05-22 14:00 - 2018-05-22 14:00 - 002629120 _____ (Microsoft Corporation) C:\WINDOWS\system32\NlsLexicons0009.dll
2018-05-22 13:59 - 2018-05-22 13:59 - 004492288 _____ (Microsoft Corporation) C:\WINDOWS\system32\xpsrchvw.exe
2018-05-22 13:59 - 2018-05-22 13:59 - 003398144 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\xpsrchvw.exe
2018-05-22 13:59 - 2018-05-22 13:59 - 000925696 _____ (Microsoft Corporation) C:\WINDOWS\system32\XpsFilt.dll
2018-05-22 13:59 - 2018-05-22 13:59 - 000575488 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\XpsFilt.dll
2018-05-22 13:59 - 2018-05-22 13:59 - 000100352 _____ (Microsoft Corporation) C:\WINDOWS\system32\XPSSHHDR.dll
2018-05-22 13:59 - 2018-05-22 13:59 - 000082432 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\XPSSHHDR.dll
2018-05-22 13:59 - 2018-05-22 13:59 - 000076060 _____ C:\WINDOWS\SysWOW64\xpsrchvw.xml
2018-05-22 13:59 - 2018-05-22 13:59 - 000076060 _____ C:\WINDOWS\system32\xpsrchvw.xml
2018-05-22 13:59 - 2018-05-22 13:59 - 000000000 ____D C:\WINDOWS\SysWOW64\XPSViewer
2018-05-22 13:59 - 2018-05-22 13:59 - 000000000 ____D C:\Program Files\Reference Assemblies
2018-05-22 13:59 - 2018-05-22 13:59 - 000000000 ____D C:\Program Files\MSBuild
2018-05-22 13:59 - 2018-05-22 13:59 - 000000000 ____D C:\Program Files (x86)\Reference Assemblies
2018-05-22 13:59 - 2018-05-22 13:59 - 000000000 ____D C:\Program Files (x86)\MSBuild
2018-05-22 13:57 - 2018-05-22 13:57 - 001166520 _____ (Microsoft Corporation) C:\WINDOWS\system32\PresentationNative_v0300.dll
2018-05-22 13:57 - 2018-05-22 13:57 - 000778936 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\PresentationNative_v0300.dll
2018-05-22 13:57 - 2018-05-22 13:57 - 000124624 _____ (Microsoft Corporation) C:\WINDOWS\system32\PresentationCFFRasterizerNative_v0300.dll
2018-05-22 13:57 - 2018-05-22 13:57 - 000103120 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\PresentationCFFRasterizerNative_v0300.dll
2018-05-22 13:57 - 2018-05-22 13:57 - 000035456 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TsWpfWrp.exe
2018-05-22 13:57 - 2018-05-22 13:57 - 000035456 _____ (Microsoft Corporation) C:\WINDOWS\system32\TsWpfWrp.exe
2018-05-22 13:38 - 2018-05-22 13:38 - 000008192 _____ C:\WINDOWS\system32\config\userdiff
2018-05-22 12:05 - 2018-05-23 12:24 - 000000000 ___DC C:\WINDOWS\Panther
2018-05-08 14:06 - 2018-05-08 14:06 - 006084096 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerInstaller.exe

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2018-06-04 20:05 - 2017-03-19 19:34 - 000000000 ____D C:\FRST
2018-06-04 20:00 - 2018-04-12 01:38 - 000000000 ____D C:\ProgramData\regid.1991-06.com.microsoft
2018-06-04 19:08 - 2018-04-12 17:51 - 000809600 _____ C:\WINDOWS\system32\perfh005.dat
2018-06-04 19:08 - 2018-04-12 17:51 - 000186808 _____ C:\WINDOWS\system32\perfc005.dat
2018-06-04 19:08 - 2018-04-12 01:36 - 000000000 ____D C:\WINDOWS\INF
2018-06-04 19:04 - 2016-12-28 20:45 - 000000000 ____D C:\Users\Miroslav Hubata\AppData\LocalLow\Mozilla
2018-06-04 19:00 - 2018-04-11 23:04 - 000524288 _____ C:\WINDOWS\system32\config\BBI
2018-06-03 22:08 - 2012-06-10 10:58 - 000000000 ____D C:\Program Files\trend micro
2018-06-03 21:39 - 2018-04-12 01:38 - 000000000 ____D C:\WINDOWS\AppReadiness
2018-06-03 18:37 - 2017-03-26 15:38 - 000000000 ____D C:\Users\Miroslav Hubata\Desktop\Nic
2018-06-03 16:43 - 2018-04-12 01:38 - 000000000 ___HD C:\Program Files\WindowsApps
2018-06-01 20:39 - 2018-04-12 01:38 - 000000000 ____D C:\WINDOWS\system32\WinBioPlugIns
2018-06-01 20:39 - 2018-04-12 01:30 - 000000000 ____D C:\WINDOWS\CbsTemp
2018-06-01 18:42 - 2018-02-17 22:14 - 000000000 ____D C:\WINDOWS\system32\Drivers\wd
2018-05-29 21:09 - 2016-07-28 22:38 - 000000000 ___RD C:\Users\Miroslav Hubata\OneDrive
2018-05-25 19:50 - 2016-09-19 13:40 - 000000000 ____D C:\Users\Miroslav Hubata\AppData\Local\ConnectedDevicesPlatform
2018-05-25 18:29 - 2017-12-27 11:16 - 000000000 ____D C:\Users\Miroslav Hubata\AppData\Local\Packages
2018-05-24 16:06 - 2018-04-12 01:38 - 000000000 ____D C:\WINDOWS\appcompat
2018-05-23 12:54 - 2018-04-12 01:41 - 000000000 ____D C:\WINDOWS\Setup
2018-05-23 12:54 - 2018-04-12 01:38 - 000028672 _____ C:\WINDOWS\system32\config\BCD-Template
2018-05-23 12:54 - 2018-04-12 01:38 - 000000000 __SHD C:\Program Files\Windows Sidebar
2018-05-23 12:54 - 2018-04-12 01:38 - 000000000 __SHD C:\Program Files (x86)\Windows Sidebar
2018-05-23 12:54 - 2018-04-12 01:38 - 000000000 ___SD C:\WINDOWS\Downloaded Program Files
2018-05-23 12:54 - 2018-04-12 01:38 - 000000000 ____D C:\WINDOWS\SysWOW64\Macromed
2018-05-23 12:54 - 2018-04-12 01:38 - 000000000 ____D C:\WINDOWS\SysWOW64\IME
2018-05-23 12:54 - 2018-04-12 01:38 - 000000000 ____D C:\WINDOWS\system32\WinBioDatabase
2018-05-23 12:54 - 2018-04-12 01:38 - 000000000 ____D C:\WINDOWS\system32\spool
2018-05-23 12:54 - 2018-04-12 01:38 - 000000000 ____D C:\WINDOWS\system32\NDF
2018-05-23 12:54 - 2018-04-12 01:38 - 000000000 ____D C:\WINDOWS\system32\Macromed
2018-05-23 12:54 - 2018-04-12 01:38 - 000000000 ____D C:\WINDOWS\system32\IME
2018-05-23 12:54 - 2018-04-12 01:38 - 000000000 ____D C:\WINDOWS\schemas
2018-05-23 12:54 - 2018-04-12 01:38 - 000000000 ____D C:\WINDOWS\PolicyDefinitions
2018-05-23 12:54 - 2018-04-12 01:38 - 000000000 ____D C:\WINDOWS\ModemLogs
2018-05-23 12:54 - 2018-04-12 01:38 - 000000000 ____D C:\WINDOWS\LiveKernelReports
2018-05-23 12:54 - 2018-04-12 01:38 - 000000000 ____D C:\Program Files\Common Files\microsoft shared
2018-05-23 12:54 - 2018-01-21 17:56 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
2018-05-23 12:54 - 2017-09-29 15:46 - 000000000 ____D C:\WINDOWS\system32\Tasks_Migrated
2018-05-23 12:54 - 2017-09-19 08:43 - 000000000 ____D C:\Program Files\Realtek
2018-05-23 12:54 - 2017-07-16 11:43 - 000000000 ____D C:\Program Files\UNP
2018-05-23 12:54 - 2016-11-19 14:16 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MozBackup
2018-05-23 12:54 - 2015-10-30 20:35 - 000000000 ____D C:\WINDOWS\ShellNew
2018-05-23 12:54 - 2013-03-13 11:54 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
2018-05-23 12:54 - 2012-01-25 20:05 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\EPSON Creativity Suite
2018-05-23 12:54 - 2012-01-25 19:55 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\EPSON
2018-05-23 12:54 - 2011-10-12 16:51 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ABBYY FineReader 6.0 Sprint
2018-05-23 12:54 - 2011-06-09 11:06 - 000000000 ____D C:\WINDOWS\system32\SPReview
2018-05-23 12:54 - 2011-06-09 11:05 - 000000000 ____D C:\WINDOWS\system32\EventProviders
2018-05-23 12:54 - 2011-03-24 18:59 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office
2018-05-23 12:54 - 2011-03-23 12:20 - 000000000 ____D C:\WINDOWS\system32\appmgmt
2018-05-23 12:54 - 2010-12-08 17:07 - 000000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live
2018-05-23 12:54 - 2010-12-08 17:07 - 000000000 ____D C:\WINDOWS\sk
2018-05-23 12:54 - 2010-12-08 17:07 - 000000000 ____D C:\WINDOWS\en
2018-05-23 12:54 - 2010-12-08 17:07 - 000000000 ____D C:\WINDOWS\cs
2018-05-23 12:54 - 2010-12-08 16:50 - 000000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Lenovo
2018-05-23 12:54 - 2010-12-08 16:29 - 000000000 ____D C:\WINDOWS\SysWOW64\Atheros_L1e
2018-05-23 12:54 - 2010-12-08 16:22 - 000000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Intel
2018-05-23 12:34 - 2017-12-27 11:35 - 000000000 ___RD C:\Users\Miroslav Hubata\3D Objects
2018-05-23 12:34 - 2016-07-28 22:34 - 000000000 __RHD C:\Users\Public\AccountPictures
2018-05-23 12:24 - 2018-04-11 23:04 - 000032768 _____ C:\WINDOWS\system32\config\ELAM
2018-05-23 12:23 - 2018-04-12 01:38 - 000000000 ____D C:\Program Files\Windows Defender
2018-05-23 12:15 - 2018-04-12 01:38 - 000000000 ___RD C:\WINDOWS\ImmersiveControlPanel
2018-05-23 12:15 - 2018-04-12 01:38 - 000000000 ____D C:\WINDOWS\Registration
2018-05-23 12:14 - 2018-04-12 01:38 - 000000000 __RSD C:\WINDOWS\media
2018-05-23 12:14 - 2016-07-28 22:15 - 000023020 _____ C:\WINDOWS\system32\emptyregdb.dat
2018-05-23 12:07 - 2018-04-12 01:38 - 000000000 ____D C:\WINDOWS\SysWOW64\inetsrv
2018-05-23 12:00 - 2018-04-12 01:38 - 000000000 ____D C:\ProgramData\USOPrivate
2018-05-23 12:00 - 2017-09-19 08:43 - 001867966 _____ C:\WINDOWS\SysWOW64\PerfStringBackup.INI
2018-05-23 11:59 - 2018-04-12 01:38 - 000000000 ____D C:\WINDOWS\System
2018-05-23 11:59 - 2017-09-19 08:43 - 000000000 ____D C:\WINDOWS\SysWOW64\RTCOM
2018-05-23 11:59 - 2017-09-19 08:43 - 000000000 ____D C:\Program Files (x86)\USB Camera2
2018-05-23 11:59 - 2017-09-19 08:42 - 000000000 ____D C:\Program Files\Elantech
2018-05-22 14:37 - 2018-04-12 01:38 - 000000000 __RHD C:\Users\Public\Libraries
2018-05-22 14:27 - 2018-04-12 01:38 - 000000000 ____D C:\WINDOWS\system32\oobe
2018-05-22 14:25 - 2009-07-14 07:32 - 000000000 ____D C:\Program Files\Microsoft Games
2018-05-22 14:24 - 2016-09-19 13:23 - 000000000 ____D C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Lenovo
2018-05-22 14:24 - 2016-09-19 13:23 - 000000000 ____D C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Lenovo
2018-05-22 14:16 - 2018-04-12 18:12 - 000000000 ____D C:\WINDOWS\Containers
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\SysWOW64\zu-ZA
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\SysWOW64\yo-NG
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\SysWOW64\xh-ZA
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\SysWOW64\wo-SN
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\SysWOW64\vi-VN
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\SysWOW64\uz-Latn-UZ
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\SysWOW64\ur-PK
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\SysWOW64\ug-CN
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\SysWOW64\tt-RU
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\SysWOW64\tn-ZA
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\SysWOW64\tk-TM
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\SysWOW64\ti-ET
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\SysWOW64\tg-Cyrl-TJ
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\SysWOW64\te-IN
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\SysWOW64\ta-IN
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\SysWOW64\sw-KE
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\SysWOW64\sr-Cyrl-RS
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\SysWOW64\sr-Cyrl-BA
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\SysWOW64\sq-AL
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\SysWOW64\si-LK
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\SysWOW64\sd-Arab-PK
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\SysWOW64\rw-RW
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\SysWOW64\quz-PE
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\SysWOW64\quc-Latn-GT
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\SysWOW64\prs-AF
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\SysWOW64\pa-IN
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\SysWOW64\pa-Arab-PK
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\SysWOW64\or-IN
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\SysWOW64\nso-ZA
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\SysWOW64\nn-NO
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\SysWOW64\ne-NP
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\SysWOW64\mt-MT
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\SysWOW64\mr-IN
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\SysWOW64\mn-MN
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\SysWOW64\ml-IN
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\SysWOW64\mk-MK
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\SysWOW64\mi-NZ
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\SysWOW64\lo-LA
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\SysWOW64\lb-LU
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\SysWOW64\ky-KG
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\SysWOW64\ku-Arab-IQ
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\SysWOW64\kok-IN
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\SysWOW64\kn-IN
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\SysWOW64\km-KH
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\SysWOW64\kk-KZ
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\SysWOW64\ka-GE
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\SysWOW64\is-IS
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\SysWOW64\ig-NG
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\SysWOW64\id-ID
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\SysWOW64\chr-CHER-US
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\SysWOW64\hy-AM
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\SysWOW64\ha-Latn-NG
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\SysWOW64\gu-IN
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\SysWOW64\gd-GB
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\SysWOW64\ga-IE
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\SysWOW64\fil-PH
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\SysWOW64\fa-IR
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\SysWOW64\cy-GB
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\SysWOW64\ca-ES-valencia
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\SysWOW64\bs-Latn-BA
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\SysWOW64\bn-IN
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\SysWOW64\bn-BD
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\SysWOW64\be-BY
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\SysWOW64\az-Latn-AZ
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\SysWOW64\as-IN
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\SysWOW64\am-ET
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\SysWOW64\af-ZA
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\system32\zu-ZA
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\system32\yo-NG
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\system32\xh-ZA
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\system32\wo-SN
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\system32\vi-VN
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\system32\uz-Latn-UZ
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\system32\ur-PK
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\system32\ug-CN
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\system32\tt-RU
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\system32\tn-ZA
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\system32\tk-TM
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\system32\ti-ET
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\system32\tg-Cyrl-TJ
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\system32\te-IN
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\system32\sw-KE
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\system32\sr-Cyrl-RS
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\system32\sr-Cyrl-BA
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\system32\sq-AL
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\system32\sd-Arab-PK
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\system32\rw-RW
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\system32\quz-PE
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\system32\quc-Latn-GT
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\system32\prs-AF
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\system32\pa-IN
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\system32\pa-Arab-PK
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\system32\or-IN
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\system32\nso-ZA
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\system32\nn-NO
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\system32\ne-NP
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\system32\mt-MT
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\system32\mr-IN
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\system32\mn-MN
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\system32\ml-IN
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\system32\mk-MK
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\system32\mi-NZ
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\system32\lo-LA
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\system32\lb-LU
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\system32\ky-KG
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\system32\ku-Arab-IQ
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\system32\kok-IN
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\system32\kn-IN
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\system32\km-KH
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\system32\kk-KZ
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\system32\ka-GE
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\system32\is-IS
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\system32\ig-NG
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\system32\id-ID
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\system32\chr-CHER-US
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\system32\hy-AM
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\system32\ha-Latn-NG
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\system32\gu-IN
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\system32\gd-GB
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\system32\ga-IE
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\system32\fil-PH
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\system32\fa-IR
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\system32\cy-GB
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\system32\ca-ES-valencia
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\system32\bs-Latn-BA
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\system32\bn-IN
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\system32\bn-BD
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\system32\be-BY
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\system32\az-Latn-AZ
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\system32\as-IN
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\system32\af-ZA
2018-05-22 14:16 - 2018-04-12 01:38 - 000000000 ____D C:\WINDOWS\TextInput
2018-05-22 14:16 - 2018-04-12 01:38 - 000000000 ____D C:\WINDOWS\SysWOW64\setup
2018-05-22 14:16 - 2018-04-12 01:38 - 000000000 ____D C:\WINDOWS\system32\ta-in
2018-05-22 14:16 - 2018-04-12 01:38 - 000000000 ____D C:\WINDOWS\system32\si-lk
2018-05-22 14:16 - 2018-04-12 01:38 - 000000000 ____D C:\WINDOWS\system32\setup
2018-05-22 14:16 - 2018-04-12 01:38 - 000000000 ____D C:\WINDOWS\system32\appraiser
2018-05-22 14:16 - 2018-04-12 01:38 - 000000000 ____D C:\WINDOWS\system32\am-et
2018-05-22 14:16 - 2018-04-12 01:38 - 000000000 ____D C:\WINDOWS\Provisioning
2018-05-22 14:16 - 2018-04-12 01:38 - 000000000 ____D C:\WINDOWS\bcastdvr
2018-05-22 14:16 - 2018-04-12 01:38 - 000000000 ____D C:\Program Files\Windows Photo Viewer
2018-05-22 14:16 - 2018-04-12 01:38 - 000000000 ____D C:\Program Files (x86)\Windows Photo Viewer
2018-05-22 14:01 - 2018-04-12 01:38 - 000000000 ____D C:\WINDOWS\system32\inetsrv
2018-05-22 14:00 - 2018-04-12 01:38 - 000000000 ____D C:\WINDOWS\SysWOW64\lv-LV
2018-05-22 14:00 - 2018-04-12 01:38 - 000000000 ____D C:\WINDOWS\SysWOW64\lt-LT
2018-05-22 14:00 - 2018-04-12 01:38 - 000000000 ____D C:\WINDOWS\SysWOW64\et-EE
2018-05-22 14:00 - 2018-04-12 01:38 - 000000000 ____D C:\WINDOWS\SysWOW64\es-MX
2018-05-22 14:00 - 2018-04-12 01:38 - 000000000 ____D C:\WINDOWS\SysWOW64\en-GB
2018-05-22 14:00 - 2018-04-12 01:38 - 000000000 ____D C:\WINDOWS\system32\lv-LV
2018-05-22 14:00 - 2018-04-12 01:38 - 000000000 ____D C:\WINDOWS\system32\lt-LT
2018-05-22 14:00 - 2018-04-12 01:38 - 000000000 ____D C:\WINDOWS\system32\et-EE
2018-05-22 14:00 - 2018-04-12 01:38 - 000000000 ____D C:\WINDOWS\system32\es-MX
2018-05-22 14:00 - 2018-04-12 01:38 - 000000000 ____D C:\WINDOWS\system32\en-GB
2018-05-22 13:59 - 2018-04-12 01:38 - 000000000 ____D C:\WINDOWS\SysWOW64\MUI
2018-05-22 13:59 - 2018-04-12 01:38 - 000000000 ____D C:\WINDOWS\system32\MUI
2018-05-22 13:54 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\OCR
2018-05-22 13:49 - 2016-09-19 13:38 - 000000000 ____H C:\$WINRE_BACKUP_PARTITION.MARKER
2018-05-22 11:57 - 2016-12-28 20:44 - 000001232 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Firefox.lnk
2018-05-22 11:57 - 2016-12-28 20:44 - 000000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2018-05-22 11:57 - 2016-11-18 18:59 - 000000000 ____D C:\Program Files (x86)\Mozilla Firefox
2018-05-20 15:46 - 2013-02-11 21:14 - 000000000 ____D C:\Users\Miroslav Hubata\Desktop\Sylva a spol
2018-05-18 16:34 - 2015-11-15 16:03 - 000002457 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acrobat Reader DC.lnk
2018-05-10 20:52 - 2017-10-15 11:03 - 141696960 ____C (Microsoft Corporation) C:\WINDOWS\system32\MRT-KB890830.exe
2018-05-10 20:52 - 2013-08-15 23:14 - 000000000 ____D C:\WINDOWS\system32\MRT
2018-05-10 20:52 - 2011-03-23 12:34 - 141696960 ____C (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe

==================== Files in the root of some directories =======

2017-03-19 19:26 - 2017-03-19 19:30 - 000029696 _____ () C:\Users\Miroslav Hubata\AppData\Local\MSGBOX.EXE
2011-12-15 22:06 - 2011-12-15 22:06 - 000007605 _____ () C:\Users\Miroslav Hubata\AppData\Local\Resmon.ResmonCfg

==================== Bamital & volsnap ======================

(There is no automatic fix for files that do not pass verification.)

C:\WINDOWS\system32\winlogon.exe => File is digitally signed
C:\WINDOWS\system32\wininit.exe => File is digitally signed
C:\WINDOWS\explorer.exe => File is digitally signed
C:\WINDOWS\SysWOW64\explorer.exe => File is digitally signed
C:\WINDOWS\system32\svchost.exe => File is digitally signed
C:\WINDOWS\SysWOW64\svchost.exe => File is digitally signed
C:\WINDOWS\system32\services.exe => File is digitally signed
C:\WINDOWS\system32\User32.dll => File is digitally signed
C:\WINDOWS\SysWOW64\User32.dll => File is digitally signed
C:\WINDOWS\system32\userinit.exe => File is digitally signed
C:\WINDOWS\SysWOW64\userinit.exe => File is digitally signed
C:\WINDOWS\system32\rpcss.dll => File is digitally signed
C:\WINDOWS\system32\dnsapi.dll => File is digitally signed
C:\WINDOWS\SysWOW64\dnsapi.dll => File is digitally signed
C:\WINDOWS\system32\Drivers\volsnap.sys => File is digitally signed

LastRegBack: 2018-05-23 11:55

==================== End of FRST.txt ============================

[Miroslav Hubata]

a tady je ten addition:

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 03.06.2018
Ran by Miroslav Hubata (04-06-2018 20:07:03)
Running from C:\Users\Miroslav Hubata\Desktop
Windows 10 Pro Version 1803 17134.48 (X64) (2018-05-23 10:24:23)
Boot Mode: Normal
==========================================================


==================== Accounts: =============================

Administrator (S-1-5-21-1710102897-3723813563-2687980958-500 - Administrator - Disabled)
DefaultAccount (S-1-5-21-1710102897-3723813563-2687980958-503 - Limited - Disabled)
Guest (S-1-5-21-1710102897-3723813563-2687980958-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-1710102897-3723813563-2687980958-1002 - Limited - Enabled)
Miroslav Hubata (S-1-5-21-1710102897-3723813563-2687980958-1000 - Administrator - Enabled) => C:\Users\Miroslav Hubata
WDAGUtilityAccount (S-1-5-21-1710102897-3723813563-2687980958-504 - Limited - Disabled)

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

ABBYY FineReader 6.0 Sprint (HKLM-x32\...\{ACF60000-22B9-4CE9-98D6-2CCF359BAC07}) (Version: 6.00.1395.4512 - ABBYY Software House)
Acrobat.com (HKLM-x32\...\{77DCDCE3-2DED-62F3-8154-05E745472D07}) (Version: 1.1.377 - Adobe Systems Incorporated)
Active Protection System (HKLM-x32\...\{F493761C-E465-4B9E-9FC1-A312F161DE0A}) (Version: 1.70.10 - Lenovo)
Adobe Acrobat Reader DC - Czech (HKLM-x32\...\{AC76BA86-7AD7-1029-7B44-AC0F074E4100}) (Version: 18.011.20040 - Adobe Systems Incorporated)
Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 1.5.0.7220 - Adobe Systems Inc.)
Adobe Flash Player 29 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 29.0.0.171 - Adobe Systems Incorporated)
Aktualizace produktu Microsoft Office Excel 2007 Help (KB963678) (HKLM-x32\...\{90120000-0016-0405-0000-0000000FF1CE}_HOMESTUDENTR_{0A1FAC46-B899-421D-B1A2-470896DC45DB}) (Version: - Microsoft)
Aktualizace produktu Microsoft Office Powerpoint 2007 Help (KB963669) (HKLM-x32\...\{90120000-0018-0405-0000-0000000FF1CE}_HOMESTUDENTR_{5260BB53-C1F7-4A3B-9AEB-3EC9B37FF194}) (Version: - Microsoft)
Aktualizace produktu Microsoft Office Word 2007 Help (KB963665) (HKLM-x32\...\{90120000-001B-0405-0000-0000000FF1CE}_HOMESTUDENTR_{E68DD413-B834-4923-8181-0A03B7555187}) (Version: - Microsoft)
Atheros Communications Inc.(R) AR81Family Gigabit/Fast Ethernet Driver (HKLM-x32\...\{3108C217-BE83-42E4-AE9E-A56A2A92E549}) (Version: 1.0.0.26 - Atheros Communications Inc.)
Bing Rewards Client Installer (HKLM-x32\...\{61EDBE71-5D3E-4AB7-AD95-E53FEAF68C17}) (Version: 16.0.345.0 - Microsoft Corporation) Hidden
BioExcess (HKLM-x32\...\{ACF31D9F-70C2-40A1-9C7A-28BA16E64B56}) (Version: 6.0.48.175 - Egis Technology Inc.) Hidden
BioExcess (HKLM-x32\...\InstallShield_{ACF31D9F-70C2-40A1-9C7A-28BA16E64B56}) (Version: 6.0.48.175 - Egis Technology Inc.)
Broadcom 802.11 Wireless Driver (HKLM-x32\...\{8991E763-21F5-4DEA-A938-5D9D77DCB488}) (Version: 1.0.0.0 - )
Camera RAW Plug-In for EPSON Creativity Suite (HKLM-x32\...\{42EDF895-158C-484E-A7F2-42B90759F281}) (Version: 2.3.0.0 - SEIKO EPSON CORPORATION)
CyberLink YouCam (HKLM-x32\...\InstallShield_{01FB4998-33C4-4431-85ED-079E3EEFE75D}) (Version: 3.0.2626 - CyberLink Corp.)
D3DX10 (HKLM-x32\...\{E09C4DB7-630C-4F06-A631-8EA7239923AF}) (Version: 15.4.2368.0902 - Microsoft) Hidden
ELAN Touchpad 11.15.0.18_X64 (HKLM\...\Elantech) (Version: 11.15.0.18 - ELAN Microelectronic Corp.)
Energy Management (HKLM-x32\...\{0CE226F3-EB27-4ECD-BBF5-F088716779FD}) (Version: 5.4.1.9 - Lenovo)
EPSON Attach To Email (HKLM-x32\...\{20C45B32-5AB6-46A4-94EF-58950CAF05E5}) (Version: 1.01.0000 - SEIKO EPSON) Hidden
EPSON Attach To Email (HKLM-x32\...\InstallShield_{20C45B32-5AB6-46A4-94EF-58950CAF05E5}) (Version: 1.01.0000 - SEIKO EPSON)
EPSON Easy Photo Print (HKLM-x32\...\{8A8F8391-4C2C-4BE1-A984-CD4A5A546467}) (Version: 1.5.1.0 - SEIKO EPSON CORPORATION)
EPSON File Manager (HKLM-x32\...\{46CBBDF8-55B5-40DB-B459-7B848394309C}) (Version: 1.3.1.0 - )
EPSON Scan (HKLM-x32\...\EPSON Scanner) (Version: - )
EPSON Scan Assistant (HKLM-x32\...\{2A88F1BF-7041-4E42-84B1-6B4ACB83AC64}) (Version: 1.10.00 - )
EPSON Stylus SX200 Series Printer Uninstall (HKLM\...\EPSON Stylus SX200 Series) (Version: - SEIKO EPSON Corporation)
EPSON Stylus SX200_SX400_TX200_TX400 Manuál (HKLM-x32\...\EPSON Stylus SX200_SX400_TX200_TX400 Uživatelská příručka) (Version: - )
Intel(R) Control Center (HKLM-x32\...\{F8A9085D-4C7A-41a9-8A77-C8998A96C421}) (Version: 1.2.1.1007 - Intel Corporation)
Intel(R) Graphics Media Accelerator Driver (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 8.15.10.2104 - Intel Corporation)
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 6.0.0.1179 - Intel Corporation)
Junk Mail filter update (HKLM-x32\...\{1F6AB0E7-8CDD-4B93-8A23-AA9EB2FEFCE4}) (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Lenovo Bluetooth with Enhanced Data Rate Software (HKLM\...\{9E9D49A4-1DF4-4138-B7DB-5D87A893088E}) (Version: 6.2.1.1900 - Broadcom Corporation)
Lenovo EasyCamera (HKLM-x32\...\{ADE16A9D-FBDC-4ecc-B6BD-9C31E51D0333}) (Version: 1.10.0510.01 - Lenovo EasyCamera)
Lenovo OneKey Recovery (HKLM\...\{46F4D124-20E5-4D12-BE52-EC177A7A4B42}) (Version: 7.0.1628 - CyberLink Corp.) Hidden
Lenovo OneKey Recovery (HKLM-x32\...\InstallShield_{46F4D124-20E5-4D12-BE52-EC177A7A4B42}) (Version: 7.0.1628 - CyberLink Corp.)
Lenovo Security Suite (HKLM-x32\...\{0034859F-8E01-4C1D-BE77-F891C4786FBC}) (Version: 2.0.10.0 - Lenovo) Hidden
Lenovo Security Suite (HKLM-x32\...\InstallShield_{0034859F-8E01-4C1D-BE77-F891C4786FBC}) (Version: 2.0.10.0 - Lenovo)
Mesh Runtime (HKLM-x32\...\{8C6D6116-B724-4810-8F2D-D047E6B7D68E}) (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Microsoft Office 2007 Service Pack 3 (SP3) (HKLM-x32\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version: - Microsoft)
Microsoft Office File Validation Add-In (HKLM-x32\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)
Microsoft Office Home and Student 2007 (HKLM-x32\...\HOMESTUDENTR) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft OneDrive (HKU\S-1-5-21-1710102897-3723813563-2687980958-1000\...\OneDriveSetup.exe) (Version: 18.091.0506.0003 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.50907.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (HKLM-x32\...\{770657D0-A123-3C07-8E44-1C83EC895118}) (Version: 8.0.50727.4053 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2015 Redistributable (x86) - 14.0.24215 (HKLM-x32\...\{e2803110-78b3-4664-a479-3611a381656a}) (Version: 14.0.24215.1 - Microsoft Corporation)
MozBackup 1.5.1 (HKLM-x32\...\MozBackup) (Version: - Pavel Cvrcek)
Mozilla Firefox 60.0.1 (x64 cs) (HKLM\...\Mozilla Firefox 60.0.1 (x64 cs)) (Version: 60.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 60.0.1.6710 - Mozilla)
Nokia Connectivity Cable Driver (HKLM\...\{BC4AE628-81A4-4FC6-863A-7A9BA2E2531F}) (Version: 7.1.32.64 - )
Ovládací prvek ActiveX platformy Windows Live Mesh pro vzdálená připojení (HKLM-x32\...\{B6190387-0036-4BEB-8D74-A0AFC5F14706}) (Version: 15.4.5722.2 - Microsoft Corporation)
Ovládací prvok ActiveX programu Windows Live Mesh pre vzdialené pripojenia (HKLM-x32\...\{C2FD7DB5-FE30-49B6-8A2F-C5652E053C31}) (Version: 15.4.5722.2 - Microsoft Corporation)
Port Locker (HKLM\...\{1F494B8A-D6E6-4540-9A74-F773B63164A6}) (Version: 1.0.5.22 - Egis Technology Inc.) Hidden
Port Locker (HKLM-x32\...\{A6FEE06D-C7E1-48CB-A9DF-1E317CF83CA4}) (Version: 1.0.5.22 - Egis Technology Inc.) Hidden
Port Locker (HKLM-x32\...\InstallShield_{A6FEE06D-C7E1-48CB-A9DF-1E317CF83CA4}) (Version: 1.0.5.22 - Egis Technology Inc.)
Power2Go (HKLM-x32\...\{40BF1E83-20EB-11D8-97C5-0009C5020658}) (Version: 5.6.0.4809d4 - CyberLink Corp.)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6128 - Realtek Semiconductor Corp.)
Realtek USB 2.0 Card Reader (HKLM-x32\...\{96AE7E41-E34E-47D0-AC07-1091A8127911}) (Version: 6.1.7600.30117 - Realtek Semiconductor Corp.)
RtLED (HKLM\...\{5ACF5427-B4E4-4F85-A512-151E0BECF7E3}) (Version: 1.0.2 - Realtek Semiconductor Corp.)
Skype Click to Call (HKLM-x32\...\{B6CF2967-C81E-40C0-9815-C05774FEF120}) (Version: 5.9.9216 - Skype Technologies S.A.)
Skype verze 8.13 (HKLM-x32\...\Skype_is1) (Version: 8.13 - Skype Technologies S.A.)
Spelling Dictionaries Support For Adobe Reader 9 (HKLM-x32\...\{AC76BA86-7AD7-5464-3428-900000000004}) (Version: 9.0.0 - Adobe Systems Incorporated)
Update for 2007 Microsoft Office System (KB967642) (HKLM-x32\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version: - Microsoft)
Windows Driver Package - Broadcom (BTHUSB) Bluetooth (04/08/2010 6.3.5.430) (HKLM\...\DE7217D2A8B057F15EC6E52329FDAB84231521E8) (Version: 04/08/2010 6.3.5.430 - Broadcom)
Windows Driver Package - Broadcom HIDClass (07/28/2009 6.2.0.9800) (HKLM\...\3BA80AB4C7E9F8497C115C844953A3D4BEB84D21) (Version: 07/28/2009 6.2.0.9800 - Broadcom)
Windows Driver Package - Lenovo (ACPIVPC) System (10/19/2009 5.4.0.1) (HKLM\...\0A4175B489A1B4A6E07E11B063A6263480C51D71) (Version: 10/19/2009 5.4.0.1 - Lenovo)
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 15.4.3502.0922 - Microsoft Corporation)
Windows Live Mesh ActiveX Control for Remote Connections (HKLM-x32\...\{2902F983-B4C1-44BA-B85D-5C6D52E2C441}) (Version: 15.4.5722.2 - Microsoft Corporation)

==================== Custom CLSID (Whitelisted): ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

ContextMenuHandlers1-x32: [EPPShellEx] -> {509FE1AF-ADD5-49EC-BC55-7CF81FD16E78} => C:\Program Files (x86)\EPSON\Creativity Suite\Easy Photo Print\EPPShell.dll [2007-03-05] (SEIKO EPSON CORPORATION)
ContextMenuHandlers3: [EgisShellExt] -> {4AC48C52-DA87-48AB-BE92-96E4F0070CEA} => C:\Program Files (x86)\EgisTec BioExcess\x64\EgisShellExt.dll [2010-05-28] (Egis Technology Inc. )
ContextMenuHandlers5: [igfxcui] -> {3AB1675A-CCFF-11D2-8B20-00A0C93CB1F4} => C:\WINDOWS\system32\igfxpph.dll [2012-11-26] (Intel Corporation)

==================== Scheduled Tasks (Whitelisted) =============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

Task: {044EF39A-4BDF-4EA4-BE2F-2DBDCE15F9ED} - System32\Tasks\Adobe Flash Player NPAPI Notifier => C:\WINDOWS\SysWOW64\Macromed\Flash\FlashUtil32_29_0_0_171_Plugin.exe [2018-05-08] (Adobe Systems Incorporated)
Task: {110419ED-89F0-4943-A24E-1BFD41B54B06} - System32\Tasks\Microsoft\Windows\Media Center\InstallPlayReady => C:\WINDOWS\ehome\ehPrivJob.exe
Task: {12BD424B-27C9-4B1D-B885-69465BAC0061} - System32\Tasks\Microsoft\Microsoft Antimalware\Microsoft Antimalware Scheduled Scan => c:\Program Files\Microsoft Security Client\MpCmdRun.exe
Task: {164DE4EC-35C6-4E9A-822C-11D3BE4CEC10} - System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Verification => C:\ProgramData\Microsoft\Windows Defender\platform\4.16.17656.18052-0\MpCmdRun.exe [2018-06-01] (Microsoft Corporation)
Task: {2FE991F4-F83F-4566-8DAB-8A206285419B} - System32\Tasks\Microsoft\Windows\Media Center\OCURActivate => C:\WINDOWS\ehome\ehPrivJob.exe
Task: {30656AB7-C337-4FF5-A33B-7815E42CB24B} - System32\Tasks\Microsoft\Windows\Media Center\MediaCenterRecoveryTask => C:\WINDOWS\ehome\mcupdate.exe
Task: {311F2591-1B79-4837-AC40-02113F3D1939} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2018-02-09] (Adobe Systems Incorporated)
Task: {34C821AF-A171-4344-85B7-BF01D1559E0E} - System32\Tasks\Microsoft\Windows\Media Center\PvrScheduleTask => C:\WINDOWS\ehome\mcupdate.exe
Task: {350F7704-6F4B-4B99-A5B3-C34E31541221} - System32\Tasks\Microsoft\Windows\Media Center\RecordingRestart => C:\WINDOWS\ehome\ehrec.exe
Task: {42F00E24-9812-4001-8CF0-7907C9DF0BD3} - System32\Tasks\Microsoft\Windows\Media Center\PvrRecoveryTask => C:\WINDOWS\ehome\mcupdate.exe
Task: {57161E2B-A751-4447-82E2-3C13B9FA5535} - System32\Tasks\Microsoft\Windows\Setup\Notifier => C:\WINDOWS\system32\Notifier.exe
Task: {5B9E9806-D3B9-4592-9650-CAFBAACEEE9A} - System32\Tasks\Microsoft\Windows\Media Center\PeriodicScanRetry => C:\WINDOWS\ehome\MCUpdate.exe
Task: {5CE0787F-A6D8-4C7F-9F13-DC8A7457847F} - System32\Tasks\Microsoft\Windows\Media Center\ConfigureInternetTimeService => C:\WINDOWS\ehome\ehPrivJob.exe
Task: {64ABEFA1-5656-489D-9296-29C3259127A2} - System32\Tasks\Microsoft\Windows\Media Center\ObjectStoreRecoveryTask => C:\WINDOWS\ehome\mcupdate.exe
Task: {65B85F6F-35B3-4459-A179-28255D5B7B25} - System32\Tasks\Microsoft\Windows\HelloFace\FODCleanupTask => C:\WINDOWS\System32\WinBioPlugIns\FaceFodUninstaller.exe [2018-04-12] ()
Task: {6CF99414-C500-495A-9BD3-1510C246611B} - System32\Tasks\CreateChoiceProcessTask => C:\Windows\System32\browserchoice.exe
Task: {7280F249-0B41-48CF-97C0-704D66BC5E62} - System32\Tasks\Microsoft\Windows\Media Center\PBDADiscoveryW1 => C:\WINDOWS\ehome\ehPrivJob.exe
Task: {73F48DAE-ED25-431C-91AC-C95156E60AFA} - System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance => C:\ProgramData\Microsoft\Windows Defender\platform\4.16.17656.18052-0\MpCmdRun.exe [2018-06-01] (Microsoft Corporation)
Task: {8249314C-0DB8-40F0-8223-9DB9745C60E3} - System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Cleanup => C:\ProgramData\Microsoft\Windows Defender\platform\4.16.17656.18052-0\MpCmdRun.exe [2018-06-01] (Microsoft Corporation)
Task: {8EC68B2F-3972-442E-900E-67BAC2222FB9} - System32\Tasks\Microsoft\Windows\Media Center\OCURDiscovery => C:\WINDOWS\ehome\ehPrivJob.exe
Task: {9264BCF2-ED07-499B-82CD-048329DE0A59} - System32\Tasks\Microsoft\Windows\Media Center\ActivateWindowsSearch => C:\WINDOWS\ehome\ehPrivJob.exe
Task: {9C19B850-A4E0-4A42-921D-3B5B71D0CCF1} - System32\Tasks\{3E706687-0E8F-4E96-A81E-7721DC14005A} => C:\Program Files (x86)\Skype\\Phone\Skype.exe
Task: {9C4CB15E-8632-4C89-B8C6-A5C1203DD8BC} - System32\Tasks\Microsoft\Windows\Media Center\ehDRMInit => C:\WINDOWS\ehome\ehPrivJob.exe
Task: {9E30AB99-DF9B-4F70-A5AB-E9AAF1A67C43} - System32\Tasks\Microsoft\Windows\Media Center\ReindexSearchRoot => C:\WINDOWS\ehome\ehPrivJob.exe
Task: {A3481DC0-5EF2-45D9-927C-6A7C5B4FA66A} - System32\Tasks\Microsoft\Windows\Media Center\UpdateRecordPath => C:\WINDOWS\ehome\ehPrivJob.exe
Task: {A9D17D89-6D70-402F-AC3E-9DFA6D0A3BB8} - System32\Tasks\Adobe Flash Player Updater => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2018-05-08] (Adobe Systems Incorporated)
Task: {B36B0320-5676-4440-AA0D-706429CA3DFF} - System32\Tasks\Microsoft\Windows\Media Center\PBDADiscoveryW2 => C:\WINDOWS\ehome\ehPrivJob.exe
Task: {C8DFAA52-90E4-46C3-8097-2EC45533F3A6} - System32\Tasks\Microsoft\Windows\Media Center\PBDADiscovery => C:\WINDOWS\ehome\ehPrivJob.exe
Task: {CDF326F1-F615-4A9F-8A7E-B22B04207615} - System32\Tasks\Microsoft\Windows\Media Center\RegisterSearch => C:\WINDOWS\ehome\ehPrivJob.exe
Task: {D46DF2F4-F25A-4E01-9FC5-1544441627C2} - System32\Tasks\Microsoft\Windows\Media Center\DispatchRecoveryTasks => C:\WINDOWS\ehome\ehPrivJob.exe
Task: {EDD61E67-5419-47FC-A75E-04B949ABD034} - System32\Tasks\Microsoft\Windows\Media Center\SqlLiteRecoveryTask => C:\WINDOWS\ehome\mcupdate.exe
Task: {F580D60C-E0D3-49DA-BF83-BD4371A9E808} - System32\Tasks\Microsoft\Windows\Media Center\mcupdate => C:\WINDOWS\ehome\mcupdate.exe
Task: {F5EF44C3-B3E9-4D43-AE8A-980BE777A823} - \Microsoft\Windows\UNP\RunCampaignManager -> No File <==== ATTENTION
Task: {FF8BE4B2-B11F-4038-B818-371D8DDD851D} - System32\Tasks\Microsoft\Windows\Media Center\mcupdate_scheduled => C:\WINDOWS\ehome\mcupdate.exe
Task: {FFE4ECAD-223F-4E81-B421-73EC45BF8359} - System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan => C:\ProgramData\Microsoft\Windows Defender\platform\4.16.17656.18052-0\MpCmdRun.exe [2018-06-01] (Microsoft Corporation)

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)


==================== Shortcuts & WMI ========================

(The entries could be listed to be restored or removed.)


==================== Loaded Modules (Whitelisted) ==============

2018-04-12 01:34 - 2018-04-12 01:34 - 000491744 _____ () C:\WINDOWS\SYSTEM32\inputhost.dll
2018-04-12 01:34 - 2018-04-12 01:34 - 000472064 _____ () C:\Windows\ShellExperiences\TileControl.dll
2018-04-12 01:34 - 2018-04-12 01:34 - 002759168 _____ () C:\Windows\ShellComponents\TaskFlowUI.dll
2010-05-28 05:15 - 2010-05-28 05:15 - 001407344 _____ () C:\Program Files (x86)\EgisTec BioExcess\x64\LIBEAY32.dll
2018-04-12 01:35 - 2018-04-12 17:53 - 002184704 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.Core.dll
2018-06-01 18:43 - 2018-06-01 18:43 - 027118080 _____ () C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.18041.14611.0_x64__8wekyb3d8bbwe\Video.UI.exe
2018-05-23 12:52 - 2018-05-23 12:52 - 000306176 _____ () C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.18041.14611.0_x64__8wekyb3d8bbwe\SharedUI.dll
2018-05-23 12:52 - 2018-05-23 12:52 - 006748672 _____ () C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.18041.14611.0_x64__8wekyb3d8bbwe\EntCommon.dll
2017-09-26 10:32 - 2017-09-26 10:32 - 003553704 _____ () C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.18041.14611.0_x64__8wekyb3d8bbwe\Microsoft.UI.Xaml.dll
2018-05-23 12:52 - 2018-05-23 12:52 - 009358848 _____ () C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.18041.14611.0_x64__8wekyb3d8bbwe\EntPlat.dll
2018-05-23 12:53 - 2018-05-23 12:53 - 000086528 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_12.1815.209.0_x64__kzf8qxf38zg5c\SkypeHost.exe
2018-05-23 12:53 - 2018-05-23 12:53 - 000195072 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_12.1815.209.0_x64__kzf8qxf38zg5c\SkypeBackgroundTasks.dll
2018-05-23 12:53 - 2018-05-23 12:53 - 022374400 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_12.1815.209.0_x64__kzf8qxf38zg5c\SkyWrap.dll
2018-05-23 12:53 - 2018-05-23 12:53 - 002610176 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_12.1815.209.0_x64__kzf8qxf38zg5c\skypert.dll
2010-12-08 16:58 - 2010-03-15 12:59 - 000092576 _____ () C:\Program Files\Lenovo\Active Protection System\MUI\0405\TpShocks.dll
2010-12-08 17:11 - 2009-07-15 17:55 - 000054088 _____ () C:\Program Files (x86)\Lenovo\Energy Management\kbdhook.dll
2010-12-08 17:11 - 2009-07-15 17:55 - 000054088 _____ () C:\Program Files (x86)\Lenovo\Energy Management\HookLib.dll
2012-11-26 23:54 - 2012-11-26 23:54 - 000094208 _____ () C:\Windows\System32\IccLibDll_x64.dll
2018-05-20 14:06 - 2018-05-20 14:07 - 000084992 _____ () C:\Program Files\WindowsApps\Microsoft.WindowsStore_11804.1001.10.0_x64__8wekyb3d8bbwe\WinStore.Preview.dll
2018-05-08 14:09 - 2018-05-08 14:09 - 001873120 _____ () C:\Program Files\WindowsApps\Microsoft.WindowsStore_11804.1001.10.0_x64__8wekyb3d8bbwe\Microsoft.UI.Xaml.dll
2018-06-01 18:44 - 2018-06-01 18:44 - 000478720 _____ () C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2018.18041.15210.0_x64__8wekyb3d8bbwe\Microsoft.Photos.exe
2018-06-01 18:44 - 2018-06-01 18:44 - 067232256 _____ () C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2018.18041.15210.0_x64__8wekyb3d8bbwe\Microsoft.Photos.dll
2017-10-08 14:19 - 2017-10-08 14:21 - 002523136 _____ () C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2018.18041.15210.0_x64__8wekyb3d8bbwe\UnityEngineDelegates.dll
2018-06-01 18:44 - 2018-06-01 18:44 - 000010752 _____ () C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2018.18041.15210.0_x64__8wekyb3d8bbwe\RenderingPlugin.dll
2018-06-01 18:44 - 2018-06-01 18:44 - 004214784 _____ () C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2018.18041.15210.0_x64__8wekyb3d8bbwe\MediaEngineCSWrapper.dll
2018-05-04 17:58 - 2018-05-04 17:58 - 000009216 _____ () C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2018.18041.15210.0_x64__8wekyb3d8bbwe\ImagePipelineNative.dll
2018-06-01 18:44 - 2018-06-01 18:44 - 000035840 _____ () C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2018.18041.15210.0_x64__8wekyb3d8bbwe\WinMLWrapper.UWP.dll
2018-04-08 13:42 - 2018-04-08 13:44 - 002283008 _____ () C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2018.18041.15210.0_x64__8wekyb3d8bbwe\TrackingDLLUWP.dll
2018-06-01 18:44 - 2018-06-01 18:44 - 014850560 _____ () C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2018.18041.15210.0_x64__8wekyb3d8bbwe\PhotosApp.Windows.dll
2018-06-01 18:44 - 2018-06-01 18:44 - 004058624 _____ () C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2018.18041.15210.0_x64__8wekyb3d8bbwe\MediaEngine.dll
2018-06-01 18:44 - 2018-06-01 18:44 - 003265536 _____ () C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2018.18041.15210.0_x64__8wekyb3d8bbwe\AppCore.Windows.dll
2018-06-01 18:44 - 2018-06-01 18:44 - 001393664 _____ () C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2018.18041.15210.0_x64__8wekyb3d8bbwe\Microsoft.RichMedia.Ink.Controls.dll
2018-06-01 18:44 - 2018-06-01 18:44 - 004218080 _____ () C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2018.18041.15210.0_x64__8wekyb3d8bbwe\Microsoft.UI.Xaml.dll
2018-06-01 18:44 - 2018-06-01 18:44 - 000872448 _____ () C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2018.18041.15210.0_x64__8wekyb3d8bbwe\RuntimeConfiguration.dll
2018-06-01 18:44 - 2018-06-01 18:44 - 000165376 _____ () C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2018.18041.15210.0_x64__8wekyb3d8bbwe\SKU.dll

==================== Alternate Data Streams (Whitelisted) =========

(If an entry is included in the fixlist, only the ADS will be removed.)


==================== Safe Mode (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== Association (Whitelisted) ===============

(If an entry is included in the fixlist, the registry item will be restored to default or removed.)


==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, it will be removed from the registry.)


==================== Hosts content: ===============================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-14 04:34 - 2014-02-01 19:20 - 000000027 _____ C:\WINDOWS\system32\Drivers\etc\hosts

127.0.0.1 localhost

==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-1710102897-3723813563-2687980958-1000\Control Panel\Desktop\\Wallpaper -> C:\windows\Web\Wallpaper\Lenovo_1\Lenovo_11.jpg
DNS Servers: 213.46.172.36 - 213.46.172.37
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer => (SmartScreenEnabled: Warn)
Windows Firewall is enabled.

==================== MSCONFIG/TASK MANAGER disabled items ==


==================== FirewallRules (Whitelisted) ===============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

FirewallRules: [UDP Query User{9434B11D-64A2-4864-BB7C-CF3CBE4DF625}C:\program files (x86)\mozilla firefox\firefox.exe] => (Block) C:\program files (x86)\mozilla firefox\firefox.exe
FirewallRules: [TCP Query User{55578BCF-B62F-4F49-AB17-9B17A5ABB6A4}C:\program files (x86)\mozilla firefox\firefox.exe] => (Block) C:\program files (x86)\mozilla firefox\firefox.exe
FirewallRules: [{92C7263D-EF8C-416F-B255-DFE533BB5268}] => (Allow) C:\Program Files (x86)\Microsoft\Skype for Desktop\Skype.exe
FirewallRules: [{AFD684AA-4776-44EB-A62A-33A0ECAFF390}] => (Allow) C:\Program Files (x86)\Microsoft\Skype for Desktop\Skype.exe
FirewallRules: [{0E4D00BC-1403-4186-86FA-40773C526F7F}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{B96B585F-7E7C-4ACC-9347-1DC82DC9F98A}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{15031BC1-2752-4FEE-A106-36E68E1D98A8}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{5013449C-3BBF-4DCD-9A82-5D03DB1E1F0E}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{7C324B12-ABCE-4FC4-B5AF-0C4223242FB4}] => (Allow) C:\Program Files (x86)\Windows Live\Mesh\MOE.exe
FirewallRules: [{1F379284-F268-4469-9190-E55903465A56}] => (Allow) C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe
FirewallRules: [{0D6E0A40-AA9D-4F58-9D9E-B4DE8E920227}] => (Allow) LPort=1900
FirewallRules: [{89275A04-88D8-4B9E-B481-02F054D56327}] => (Allow) LPort=2869
FirewallRules: [{C7AF1EF3-2573-436E-99CF-AC759572AD36}] => (Allow) C:\Program Files (x86)\Windows Live\Contacts\wlcomm.exe

==================== Restore Points =========================

24-05-2018 16:10:16 Windows Update
04-06-2018 19:36:43 Naplánovaný kontrolní bod

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (06/03/2018 04:38:09 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Program Microsoft.Photos.exe verze 2018.18041.15210.0 přestal spolupracovat se systémem Windows a byl ukončen. Chcete-li zjistit, zda je k dispozici více informací o tomto problému, vyhledejte historii problému v ovládacím panelu Zabezpečení a údržba.

ID procesu: 2640

Čas spuštění: 01d3fb4429d4fac6

Čas ukončení: 4294967295

Cesta k aplikaci: C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2018.18041.15210.0_x64__8wekyb3d8bbwe\Microsoft.Photos.exe

ID hlášení: ef0b6368-6ac3-4306-b35e-40981a438345

Úplný název balíčku s chybou: Microsoft.Windows.Photos_2018.18041.15210.0_x64__8wekyb3d8bbwe

ID aplikace související s balíčkem s chybou: App

Error: (06/01/2018 09:44:21 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Program Microsoft.Photos.exe verze 2018.18041.15210.0 přestal spolupracovat se systémem Windows a byl ukončen. Chcete-li zjistit, zda je k dispozici více informací o tomto problému, vyhledejte historii problému v ovládacím panelu Zabezpečení a údržba.

ID procesu: 1324

Čas spuštění: 01d3f9e08ee5841b

Čas ukončení: 4294967295

Cesta k aplikaci: C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2018.18041.15210.0_x64__8wekyb3d8bbwe\Microsoft.Photos.exe

ID hlášení: b71e882c-c1d3-47a3-b53b-edbce2837924

Úplný název balíčku s chybou: Microsoft.Windows.Photos_2018.18041.15210.0_x64__8wekyb3d8bbwe

ID aplikace související s balíčkem s chybou: App

Error: (05/29/2018 09:06:57 PM) (Source: Windows Search Service) (EventID: 3083) (User: )
Description: Popisovač protokolu OneIndex nebyl načten. Popis chyby: Uvedený modul nebyl nalezen. (HRESULT : 0x8007007e).

Error: (05/27/2018 11:56:04 AM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Program Microsoft.Photos.exe verze 2018.18031.15820.0 přestal spolupracovat se systémem Windows a byl ukončen. Chcete-li zjistit, zda je k dispozici více informací o tomto problému, vyhledejte historii problému v ovládacím panelu Zabezpečení a údržba.

ID procesu: 1178

Čas spuštění: 01d3f59bf4a19c2e

Čas ukončení: 4294967295

Cesta k aplikaci: C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2018.18031.15820.0_x64__8wekyb3d8bbwe\Microsoft.Photos.exe

ID hlášení: 9385b4e1-baf3-466d-a561-0096347c79c7

Úplný název balíčku s chybou: Microsoft.Windows.Photos_2018.18031.15820.0_x64__8wekyb3d8bbwe

ID aplikace související s balíčkem s chybou: App

Error: (05/26/2018 04:28:47 PM) (Source: Windows Search Service) (EventID: 3083) (User: )
Description: Popisovač protokolu OneIndex nebyl načten. Popis chyby: Uvedený modul nebyl nalezen. (HRESULT : 0x8007007e).

Error: (05/23/2018 01:33:30 PM) (Source: Windows Search Service) (EventID: 3083) (User: )
Description: Popisovač protokolu OneIndex nebyl načten. Popis chyby: Uvedený modul nebyl nalezen. (HRESULT : 0x8007007e).

Error: (05/23/2018 12:14:55 PM) (Source: MSDTC Client 2) (EventID: 4104) (User: )
Description: Pokus získat stav uzlu clusteru se nezdařil. Vrácený kód chyby: 0x8007085A

Error: (05/23/2018 12:11:07 PM) (Source: MSDTC Client 2) (EventID: 4104) (User: )
Description: Pokus získat stav uzlu clusteru se nezdařil. Vrácený kód chyby: 0x8007085A


System errors:
=============
Error: (06/04/2018 07:43:09 PM) (Source: Microsoft-Windows-Kernel-Power) (EventID: 137) (User: )
Description: 4

Error: (06/04/2018 07:03:33 PM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: Nastavení oprávnění specifické pro aplikaci neuděluje oprávnění Místní Spuštění pro serverovou aplikaci COM s identifikátorem CLSID
Windows.SecurityCenter.WscDataProtection
a APPID
Není k dispozici
uživateli NT AUTHORITY\SYSTEM (SID: S-1-5-18) z adresy LocalHost (pomocí LRPC) běžící v kontejneru aplikací Není k dispozici – SID (Není k dispozici). Toto oprávnění zabezpečení lze změnit pomocí nástroje správy Služba komponent.

Error: (06/04/2018 07:03:33 PM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: Nastavení oprávnění specifické pro aplikaci neuděluje oprávnění Místní Spuštění pro serverovou aplikaci COM s identifikátorem CLSID
Windows.SecurityCenter.WscBrokerManager
a APPID
Není k dispozici
uživateli NT AUTHORITY\SYSTEM (SID: S-1-5-18) z adresy LocalHost (pomocí LRPC) běžící v kontejneru aplikací Není k dispozici – SID (Není k dispozici). Toto oprávnění zabezpečení lze změnit pomocí nástroje správy Služba komponent.

Error: (06/04/2018 07:02:11 PM) (Source: DCOM) (EventID: 10001) (User: IdeaPad-V560)
Description: Nelze spustit server DCOM: Microsoft.Windows.Cortana_1.10.7.17134_neutral_neutral_cw5n1h2txyewy!CortanaUI.AppXd4tad4d57t4wtdbnnmb8v2xtzym8c1n8.mca jako Není k dispozici/Není k dispozici. Došlo k chybě:
298
při provádění příkazu:
"C:\WINDOWS\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppXy7vb4pc2dr3kc93kfc509b1d0arkfb2x.mca

Error: (06/04/2018 06:59:57 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Služba RtLedService Installer byla neočekávaně ukončena. Tento stav nastal již 1krát.

Error: (06/04/2018 06:59:57 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Služba Řízení front zpráv byla nečekaně ukončena. Stalo se to 1 krát. Následující opravná akce bude spuštěna za 120000 milisekund: Restartovat službu.

Error: (06/04/2018 06:59:57 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Služba EgisTec Service byla neočekávaně ukončena. Tento stav nastal již 1krát.

Error: (06/04/2018 06:59:57 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Služba Intel(R) Management & Security Application User Notification Service byla neočekávaně ukončena. Tento stav nastal již 1krát.


Windows Defender:
===================================
Date: 2018-06-04 19:17:45.734
Description:
Prohledávání Antivirová ochrana v programu Windows Defender bylo zastaveno před dokončením.
ID prohledávání: {2B7F30B9-D75D-4815-BE9A-958DF67232A1}
Typ prohledávání: Antimalwarový program
Parametry prohledávání: Rychlé prohledávání
Uživatel: NT AUTHORITY\SYSTEM

Date: 2018-05-24 16:38:10.455
Description:
Prohledávání Antivirová ochrana v programu Windows Defender bylo zastaveno před dokončením.
ID prohledávání: {E70046A2-0990-4298-8492-C3A5B8DCE5C2}
Typ prohledávání: Antimalwarový program
Parametry prohledávání: Rychlé prohledávání
Uživatel: NT AUTHORITY\SYSTEM

CodeIntegrity:
===================================

Date: 2018-05-25 19:52:00.161
Description:
Code Integrity determined that a process (\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe) attempted to load \Device\HarddiskVolume2\Windows\assembly\GAC\Microsoft.StdFormat\7.0.3300.0__b03f5f7f11d50a3a\Microsoft.StdFormat.dll that did not meet the Microsoft signing level requirements.

Date: 2018-05-25 19:52:00.057
Description:
Code Integrity determined that a process (\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe) attempted to load \Device\HarddiskVolume2\Windows\assembly\GAC\ADODB\7.0.3300.0__b03f5f7f11d50a3a\ADODB.dll that did not meet the Microsoft signing level requirements.

Date: 2018-05-25 19:51:59.974
Description:
Code Integrity determined that a process (\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe) attempted to load \Device\HarddiskVolume2\Windows\assembly\GAC\MSDATASRC\7.0.3300.0__b03f5f7f11d50a3a\MSDATASRC.dll that did not meet the Microsoft signing level requirements.

Date: 2018-05-25 19:51:59.852
Description:
Code Integrity determined that a process (\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe) attempted to load \Device\HarddiskVolume2\Windows\assembly\GAC\Microsoft.StdFormat\7.0.3300.0__b03f5f7f11d50a3a\Microsoft.StdFormat.dll that did not meet the Microsoft signing level requirements.

Date: 2018-05-25 19:51:59.801
Description:
Code Integrity determined that a process (\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe) attempted to load \Device\HarddiskVolume2\Windows\assembly\GAC\ADODB\7.0.3300.0__b03f5f7f11d50a3a\ADODB.dll that did not meet the Microsoft signing level requirements.

Date: 2018-05-25 19:51:59.737
Description:
Code Integrity determined that a process (\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe) attempted to load \Device\HarddiskVolume2\Windows\assembly\GAC\MSDATASRC\7.0.3300.0__b03f5f7f11d50a3a\MSDATASRC.dll that did not meet the Microsoft signing level requirements.

Date: 2018-05-25 19:51:56.508
Description:
Code Integrity determined that a process (\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe) attempted to load \Device\HarddiskVolume2\Windows\assembly\GAC\stdole\7.0.3300.0__b03f5f7f11d50a3a\stdole.dll that did not meet the Microsoft signing level requirements.

Date: 2018-05-25 19:51:55.575
Description:
Code Integrity determined that a process (\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe) attempted to load \Device\HarddiskVolume2\Windows\assembly\GAC\stdole\7.0.3300.0__b03f5f7f11d50a3a\stdole.dll that did not meet the Microsoft signing level requirements.

==================== Memory info ===========================

Processor: Intel(R) Core(TM) i3 CPU M 380 @ 2.53GHz
Percentage of memory in use: 59%
Total physical RAM: 3828.51 MB
Available physical RAM: 1554.21 MB
Total Virtual: 7668.51 MB
Available Virtual: 5109.59 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:421.81 GB) (Free:121.44 GB) NTFS
Drive d: (LENOVO) (Fixed) (Total:29 GB) (Free:27.89 GB) NTFS

\\?\Volume{56480e46-02d4-11e0-9833-806e6f6e6963}\ () (Fixed) (Total:0.2 GB) (Free:0.16 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or Vista) (Size: 465.8 GB) (Disk ID: 518CC556)
Partition 1: (Active) - (Size=200 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=421.8 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=29 GB) - (Type=0F Extended)
Partition 4: (Not Active) - (Size=14.8 GB) - (Type=12)

==================== End of Addition.txt ============================

[Rudy]

Otevřte poznámkový blok a zkopírujte do něj:

Start

CloseProcesses:
Task: {F5EF44C3-B3E9-4D43-AE8A-980BE777A823} - \Microsoft\Windows\UNP\RunCampaignManager -> No File <==== ATTENTION
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - No File

EmptyTemp:
End

Uložte na plochu jako fixlist.txt. Spusťte znovu FRST a klikněte na >Fix<. Po skončení akce se objeví log, který sem zkopírujte.

[Miroslav Hubata]

Tak a teď nevím...udělal jsem ten fixlist, dal fix...začalo to pracovat, pak to vyhodilo hlášku, že se udělal log, ale nevím kde je...
Asi mám ten starej...kde to ještě najdu??? Nevím...prosím o radu ve formě "úplně pro blbce"

Tohle je asi to starý, že jo???

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 03.06.2018
Ran by Miroslav Hubata (administrator) on IDEAPAD-V560 (04-06-2018 20:05:15)
Running from C:\Users\Miroslav Hubata\Desktop
Loaded Profiles: Miroslav Hubata (Available Profiles: Miroslav Hubata & DefaultAppPool)
Platform: Windows 10 Pro Version 1803 17134.48 (X64) Language: Čeština (Česko)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/33 ... scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Egis Technology Inc. ) C:\Program Files (x86)\EgisTec BioExcess\EgisService.exe
(Egis Technology Inc. ) C:\Program Files (x86)\EgisTec Port Locker\Egishlpsvc.exe
(Egis Technology Inc. ) C:\Program Files (x86)\EgisTec BioExcess\EgisDSService.exe
(SEIKO EPSON CORPORATION) C:\ProgramData\EPSON\EPW!3 SSRP\E_S40RPB.EXE
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDService.exe
(SEIKO EPSON CORPORATION) C:\ProgramData\EPSON\EPW!3 SSRP\E_S40STB.EXE
(Microsoft Corporation) C:\Windows\System32\mqsvc.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
(Realtek Semiconductor Corp.) C:\Program Files\Realtek\RtLED\RtLEDService.exe
(Lenovo.) C:\Windows\System32\TPHDEXLG64.exe
(Microsoft Corporation) C:\ProgramData\Microsoft\Windows Defender\Platform\4.16.17656.18052-0\MsMpEng.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
(Realtek Semiconductor Corp.) C:\Program Files\Realtek\RtLED\RtLED.exe
(Microsoft Corporation) C:\ProgramData\Microsoft\Windows Defender\Platform\4.16.17656.18052-0\NisSrv.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrl.exe
(Malwarebytes) C:\Users\Miroslav Hubata\Desktop\adwcleaner_7.1.1.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrlHelper.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
() C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.18041.14611.0_x64__8wekyb3d8bbwe\Video.UI.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.9330.20915.0_x64__8wekyb3d8bbwe\HxTsr.exe
() C:\Program Files\WindowsApps\Microsoft.SkypeApp_12.1815.209.0_x64__kzf8qxf38zg5c\SkypeHost.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MSASCuiL.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Lenovo.) C:\Windows\System32\TpShocks.exe
(Lenovo(beijing) Limited) C:\Program Files (x86)\Lenovo\Energy Management\utility.exe
(Lenovo (Beijing) Limited) C:\Program Files (x86)\Lenovo\Energy Management\Energy Management.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Vimicro) C:\Program Files (x86)\USB Camera2\VM332_STI.EXE
(Egis Technology Inc. ) C:\Program Files (x86)\EgisTec BioExcess\EgisTSR.exe
(CyberLink Corp.) C:\Program Files (x86)\Lenovo\YouCam\YouCamTray.exe
(Egis Technology Inc. ) C:\Program Files (x86)\EgisTec Port Locker\EgisPLTSR.exe
(Microsoft Corporation) C:\Windows\SysWOW64\notepad.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\Microsoft.WindowsStore_11804.1001.10.0_x64__8wekyb3d8bbwe\WinStore.App.exe
() C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2018.18041.15210.0_x64__8wekyb3d8bbwe\Microsoft.Photos.exe
(Microsoft Corporation) C:\Windows\SystemApps\Microsoft.LockApp_cw5n1h2txyewy\LockApp.exe
(Microsoft Corporation) C:\Windows\System32\smartscreen.exe

==================== Registry (Whitelisted) ===========================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [SecurityHealth] => C:\Program Files\Windows Defender\MSASCuiL.exe [638872 2018-04-12] (Microsoft Corporation)
HKLM\...\Run: [ETDCtrl] => C:\Program Files\Elantech\ETDCtrl.exe [3242696 2015-10-07] (ELAN Microelectronics Corp.)
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [10821224 2010-06-02] (Realtek Semiconductor)
HKLM\...\Run: [ETDWare] => C:\Program Files\Elantech\ETDCtrl.exe [3242696 2015-10-07] (ELAN Microelectronics Corp.)
HKLM\...\Run: [TpShocks] => C:\Windows\System32\TpShocks.exe [231328 2010-03-15] (Lenovo.)
HKLM\...\Run: [UpdatePRCShortCut] => "C:\Program Files\Lenovo\OneKey App\OneKey Recovery\MUITransfer\MUIStartMenu.exe" "C:\Program Files\Lenovo\OneKey App\OneKey Recovery" UpdateWithCreateOnce "Software\Lenovo\OneKey App\OneKey Recovery"
HKLM\...\Run: [EnergyUtility] => C:\Program Files (x86)\Lenovo\Energy Management\utility.exe [4462496 2010-04-12] (Lenovo(beijing) Limited)
HKLM\...\Run: [Energy Management] => C:\Program Files (x86)\Lenovo\Energy Management\Energy Management.exe [7056800 2010-03-18] (Lenovo (Beijing) Limited)
HKLM-x32\...\Run: [332BigDog] => C:\Program Files (x86)\USB Camera2\VM332_STI.EXE [536576 2010-01-19] (Vimicro)
HKLM-x32\...\Run: [IMSS] => C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PIconStartup.exe [111640 2009-09-30] ()
HKLM-x32\...\Run: [VitaKeyTSR] => C:\Program Files (x86)\EgisTec BioExcess\EgisTSR.exe [376176 2010-05-28] (Egis Technology Inc. )
HKLM-x32\...\Run: [UCam_Menu] => C:\Program Files (x86)\Lenovo\YouCam\MUITransfer\MUIStartMenu.exe [222504 2009-05-20] (CyberLink Corp.)
HKLM-x32\...\Run: [YouCam Mirror Tray icon] => C:\Program Files (x86)\Lenovo\YouCam\YouCamTray.exe [171104 2010-03-03] (CyberLink Corp.)
HKLM-x32\...\Run: [PLTSR] => C:\Program Files (x86)\EgisTec Port Locker\EgisPLTSR.exe [364400 2010-09-11] (Egis Technology Inc. )
Winlogon\Notify\igfxcui: C:\WINDOWS\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-19\...\RunOnce: [WAB Migrate] => C:\Program Files\Windows Mail\wab.exe [518144 2018-04-12] (Microsoft Corporation)
HKU\S-1-5-20\...\RunOnce: [WAB Migrate] => C:\Program Files\Windows Mail\wab.exe [518144 2018-04-12] (Microsoft Corporation)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Tcpip\Parameters: [DhcpNameServer] 213.46.172.36 213.46.172.37
Tcpip\..\Interfaces\{3f2eb8f9-06d9-4d84-9c73-ce96c6a4585c}: [DhcpNameServer] 213.46.172.36 213.46.172.37
Tcpip\..\Interfaces\{df624ac1-2f7a-496a-8e1c-e05b5c5fe890}: [DhcpNameServer] 213.46.172.36 213.46.172.37

Internet Explorer:
==================
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
HKU\S-1-5-21-1710102897-3723813563-2687980958-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.seznam.cz/
HKU\S-1-5-21-1710102897-3723813563-2687980958-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
BHO-x32: IEPwdBankBHO Class -> {56CBB761-DA41-4E31-B270-B13B4B0A61D0} -> C:\Program Files (x86)\EgisTec BioExcess\EgisIEPwdBank.dll [2010-05-28] (Egis Technology Inc. )
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - No File

FireFox:
========
FF DefaultProfile: 26b90t9b.default
FF ProfilePath: C:\Users\Miroslav Hubata\AppData\Roaming\Mozilla\Firefox\Profiles\26b90t9b.default [2018-06-04]
FF Homepage: Mozilla\Firefox\Profiles\26b90t9b.default -> hxxps://www.seznam.cz/
FF Extension: (TLS 1.3 gradual roll-out fallback-limit) - C:\Users\Miroslav Hubata\AppData\Roaming\Mozilla\Firefox\Profiles\26b90t9b.default\features\{90b2d5a9-ce67-4557-96f6-61ebc25b75de}\tls13-version-fallback-rollout-bug1462099@mozilla.org.xpi [2018-06-01] [Legacy]
FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF64_29_0_0_171.dll [2018-05-08] ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.50907.0\npctrl.dll [2017-05-03] ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_29_0_0_171.dll [2018-05-08] ()
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.50907.0\npctrl.dll [2017-05-03] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2010-11-10] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2010-11-10] (Microsoft Corporation)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2018-05-11] (Adobe Systems Inc.)

==================== Services (Whitelisted) ====================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 EgisTec Data Security Service; C:\Program Files (x86)\EgisTec BioExcess\EgisDSService.exe [314736 2010-05-28] (Egis Technology Inc. )
R2 EgisTec Service Help; C:\Program Files (x86)\EgisTec Port Locker\Egishlpsvc.exe [327024 2010-09-11] (Egis Technology Inc. )
R2 ETDService; C:\Program Files\Elantech\ETDService.exe [144072 2015-10-07] (ELAN Microelectronics Corp.)
R2 RtLedService; C:\Program Files\Realtek\RtLED\RtLEDService.exe [311296 2010-02-05] (Realtek Semiconductor Corp.) [File not signed]
S3 Sense; C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe [4737448 2018-04-12] (Microsoft Corporation)
S3 ssh-agent; C:\WINDOWS\System32\OpenSSH\ssh-agent.exe [495616 2018-03-10] ()
R3 WdNisSvc; C:\ProgramData\Microsoft\Windows Defender\platform\4.16.17656.18052-0\NisSrv.exe [4682552 2018-06-01] (Microsoft Corporation)
R2 WinDefend; C:\ProgramData\Microsoft\Windows Defender\platform\4.16.17656.18052-0\MsMpEng.exe [101096 2018-06-01] (Microsoft Corporation)

===================== Drivers (Whitelisted) ======================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R1 MpKslc40c1a21; C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{6DBCD8DD-AD9D-4A0A-8E5B-F83E6809FB9F}\MpKslc40c1a21.sys [58120 2018-06-04] (Microsoft Corporation)
S0 WdBoot; C:\WINDOWS\System32\drivers\wd\WdBoot.sys [46072 2018-06-01] (Microsoft Corporation)
R0 WdFilter; C:\WINDOWS\System32\drivers\wd\WdFilter.sys [313384 2018-06-01] (Microsoft Corporation)
R3 WdNisDrv; C:\WINDOWS\System32\drivers\wd\WdNisDrv.sys [61992 2018-06-01] (Microsoft Corporation)

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2018-06-04 20:05 - 2018-06-04 20:06 - 000011605 _____ C:\Users\Miroslav Hubata\Desktop\FRST.txt
2018-06-04 20:02 - 2018-06-04 20:02 - 002413056 _____ (Farbar) C:\Users\Miroslav Hubata\Desktop\FRST64.exe
2018-06-04 18:58 - 2018-06-04 18:59 - 000000000 ____D C:\AdwCleaner
2018-06-04 18:57 - 2018-06-04 18:57 - 007271632 _____ (Malwarebytes) C:\Users\Miroslav Hubata\Desktop\adwcleaner_7.1.1.exe
2018-05-25 18:28 - 2018-05-25 20:08 - 000000000 ____D C:\Users\Miroslav Hubata\AppData\Local\PlaceholderTileLogoFolder
2018-05-23 12:38 - 2018-05-23 12:38 - 000000000 ____D C:\ProgramData\Microsoft OneDrive
2018-05-23 12:37 - 2018-05-23 12:37 - 000001417 _____ C:\Users\Miroslav Hubata\Desktop\Microsoft Edge.lnk
2018-05-23 12:33 - 2018-05-23 12:33 - 000000020 ___SH C:\Users\Miroslav Hubata\ntuser.ini
2018-05-23 12:23 - 2018-06-04 19:00 - 000000006 ____H C:\WINDOWS\Tasks\SA.DAT
2018-05-23 12:23 - 2018-05-29 21:09 - 000003392 _____ C:\WINDOWS\System32\Tasks\OneDrive Standalone Update Task-S-1-5-21-1710102897-3723813563-2687980958-1000
2018-05-23 12:23 - 2018-05-23 12:23 - 000003818 _____ C:\WINDOWS\System32\Tasks\Adobe Flash Player NPAPI Notifier
2018-05-23 12:23 - 2018-05-23 12:23 - 000003482 _____ C:\WINDOWS\System32\Tasks\Adobe Acrobat Update Task
2018-05-23 12:23 - 2018-05-23 12:23 - 000003406 _____ C:\WINDOWS\System32\Tasks\Adobe Flash Player Updater
2018-05-23 12:23 - 2018-05-23 12:23 - 000002538 _____ C:\WINDOWS\System32\Tasks\CreateChoiceProcessTask
2018-05-23 12:23 - 2018-05-23 12:23 - 000002026 _____ C:\WINDOWS\System32\Tasks\{3E706687-0E8F-4E96-A81E-7721DC14005A}
2018-05-23 12:23 - 2018-05-23 12:23 - 000000000 ____D C:\WINDOWS\System32\Tasks\WPD
2018-05-23 12:22 - 2018-05-23 12:23 - 000011433 _____ C:\WINDOWS\diagwrn.xml
2018-05-23 12:22 - 2018-05-23 12:23 - 000011433 _____ C:\WINDOWS\diagerr.xml
2018-05-23 12:07 - 2018-05-23 12:07 - 000001519 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk
2018-05-23 12:05 - 2018-06-03 23:17 - 000000000 ____D C:\Users\Miroslav Hubata
2018-05-23 12:05 - 2018-05-29 21:09 - 000002463 _____ C:\Users\Miroslav Hubata\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OneDrive.lnk
2018-05-23 12:05 - 2018-05-23 12:12 - 000000000 ____D C:\Users\DefaultAppPool
2018-05-23 12:05 - 2018-05-23 12:07 - 000000000 ____D C:\Users\Miroslav Hubata\AppData\Local\Microsoft Help
2018-05-23 12:05 - 2018-05-23 12:06 - 000000000 ____D C:\Users\Miroslav Hubata\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Lenovo
2018-05-23 12:05 - 2018-05-23 12:05 - 000000000 _SHDL C:\Users\Miroslav Hubata\Šablony
2018-05-23 12:05 - 2018-05-23 12:05 - 000000000 _SHDL C:\Users\Miroslav Hubata\Soubory cookie
2018-05-23 12:05 - 2018-05-23 12:05 - 000000000 _SHDL C:\Users\Miroslav Hubata\Poslední
2018-05-23 12:05 - 2018-05-23 12:05 - 000000000 _SHDL C:\Users\Miroslav Hubata\Okolní tiskárny
2018-05-23 12:05 - 2018-05-23 12:05 - 000000000 _SHDL C:\Users\Miroslav Hubata\Okolní síť
2018-05-23 12:05 - 2018-05-23 12:05 - 000000000 _SHDL C:\Users\Miroslav Hubata\Nabídka Start
2018-05-23 12:05 - 2018-05-23 12:05 - 000000000 _SHDL C:\Users\Miroslav Hubata\Dokumenty
2018-05-23 12:05 - 2018-05-23 12:05 - 000000000 _SHDL C:\Users\Miroslav Hubata\Documents\Obrázky
2018-05-23 12:05 - 2018-05-23 12:05 - 000000000 _SHDL C:\Users\Miroslav Hubata\Documents\Hudba
2018-05-23 12:05 - 2018-05-23 12:05 - 000000000 _SHDL C:\Users\Miroslav Hubata\Documents\Filmy
2018-05-23 12:05 - 2018-05-23 12:05 - 000000000 _SHDL C:\Users\Miroslav Hubata\Data aplikací
2018-05-23 12:05 - 2018-05-23 12:05 - 000000000 _SHDL C:\Users\Miroslav Hubata\AppData\Roaming\Microsoft\Windows\Start Menu\Programy
2018-05-23 12:05 - 2018-05-23 12:05 - 000000000 _SHDL C:\Users\Miroslav Hubata\AppData\Local\Data aplikací
2018-05-23 12:05 - 2018-05-23 12:05 - 000000000 _SHDL C:\Users\DefaultAppPool\Šablony
2018-05-23 12:05 - 2018-05-23 12:05 - 000000000 _SHDL C:\Users\DefaultAppPool\Soubory cookie
2018-05-23 12:05 - 2018-05-23 12:05 - 000000000 _SHDL C:\Users\DefaultAppPool\Poslední
2018-05-23 12:05 - 2018-05-23 12:05 - 000000000 _SHDL C:\Users\DefaultAppPool\Okolní tiskárny
2018-05-23 12:05 - 2018-05-23 12:05 - 000000000 _SHDL C:\Users\DefaultAppPool\Okolní síť
2018-05-23 12:05 - 2018-05-23 12:05 - 000000000 _SHDL C:\Users\DefaultAppPool\Nabídka Start
2018-05-23 12:05 - 2018-05-23 12:05 - 000000000 _SHDL C:\Users\DefaultAppPool\Dokumenty
2018-05-23 12:05 - 2018-05-23 12:05 - 000000000 _SHDL C:\Users\DefaultAppPool\Documents\Obrázky
2018-05-23 12:05 - 2018-05-23 12:05 - 000000000 _SHDL C:\Users\DefaultAppPool\Documents\Hudba
2018-05-23 12:05 - 2018-05-23 12:05 - 000000000 _SHDL C:\Users\DefaultAppPool\Documents\Filmy
2018-05-23 12:05 - 2018-05-23 12:05 - 000000000 _SHDL C:\Users\DefaultAppPool\Data aplikací
2018-05-23 12:05 - 2018-05-23 12:05 - 000000000 _SHDL C:\Users\DefaultAppPool\AppData\Roaming\Microsoft\Windows\Start Menu\Programy
2018-05-23 12:05 - 2018-05-23 12:05 - 000000000 _SHDL C:\Users\DefaultAppPool\AppData\Local\Data aplikací
2018-05-23 12:05 - 2018-05-22 14:24 - 000000000 ____D C:\Users\DefaultAppPool\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Lenovo
2018-05-23 12:05 - 2018-04-12 01:34 - 000001105 _____ C:\Users\DefaultAppPool\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OneDrive.lnk
2018-05-23 12:05 - 2016-09-19 13:23 - 000000000 ____D C:\Users\Miroslav Hubata\AppData\Roaming\Media Center Programs
2018-05-23 12:05 - 2016-09-19 13:23 - 000000000 ____D C:\Users\DefaultAppPool\AppData\Roaming\Media Center Programs
2018-05-23 12:05 - 2016-09-19 13:23 - 000000000 ____D C:\Users\DefaultAppPool\AppData\Local\Microsoft Help
2018-05-23 12:05 - 2010-12-08 17:11 - 000002104 _____ C:\Users\Miroslav Hubata\Desktop\OneKey Recovery.lnk
2018-05-23 12:05 - 2010-12-08 17:11 - 000002104 _____ C:\Users\DefaultAppPool\Desktop\OneKey Recovery.lnk
2018-05-23 12:05 - 2010-12-08 17:10 - 000001140 _____ C:\Users\Miroslav Hubata\Desktop\Cyberlink Power2Go.lnk
2018-05-23 12:05 - 2010-12-08 17:10 - 000001140 _____ C:\Users\DefaultAppPool\Desktop\Cyberlink Power2Go.lnk
2018-05-23 12:05 - 2010-12-08 17:02 - 000002198 _____ C:\Users\Miroslav Hubata\Desktop\CyberLink YouCam.lnk
2018-05-23 12:05 - 2010-12-08 17:02 - 000002198 _____ C:\Users\DefaultAppPool\Desktop\CyberLink YouCam.lnk
2018-05-23 12:00 - 2018-06-04 19:08 - 001956564 _____ C:\WINDOWS\system32\PerfStringBackup.INI
2018-05-23 12:00 - 2018-05-23 12:00 - 000000000 ____D C:\ProgramData\USOShared
2018-05-23 12:00 - 2018-04-12 01:33 - 002752000 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\PrintConfig.dll
2018-05-23 11:55 - 2018-06-04 20:00 - 000000000 ____D C:\WINDOWS\system32\SleepStudy
2018-05-23 11:55 - 2018-05-23 12:09 - 000297040 _____ C:\WINDOWS\system32\FNTCACHE.DAT
2018-05-22 14:26 - 2018-05-22 14:26 - 000000000 ___DL C:\Users\Public\Recorded TV (2)
2018-05-22 14:25 - 2018-05-23 12:54 - 000000000 ____D C:\WINDOWS\system32\config\bbimigrate
2018-05-22 14:25 - 2018-05-22 14:25 - 000000000 ____D C:\Program Files\Common Files\SpeechEngines
2018-05-22 14:21 - 2018-05-22 14:25 - 000000000 ____D C:\WINDOWS\ServiceProfiles
2018-05-22 14:14 - 2018-05-22 14:14 - 013570560 _____ (Microsoft Corporation) C:\WINDOWS\system32\wmp.dll
2018-05-22 14:14 - 2018-05-22 14:14 - 012500992 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wmp.dll
2018-05-22 14:13 - 2018-05-22 14:13 - 025848832 _____ (Microsoft Corporation) C:\WINDOWS\system32\edgehtml.dll
2018-05-22 14:13 - 2018-05-22 14:13 - 023862272 _____ (Microsoft Corporation) C:\WINDOWS\system32\Hydrogen.dll
2018-05-22 14:13 - 2018-05-22 14:13 - 022707712 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll
2018-05-22 14:13 - 2018-05-22 14:13 - 022002688 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\edgehtml.dll
2018-05-22 14:13 - 2018-05-22 14:13 - 021389360 _____ (Microsoft Corporation) C:\WINDOWS\system32\shell32.dll
2018-05-22 14:13 - 2018-05-22 14:13 - 020383720 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\shell32.dll
2018-05-22 14:13 - 2018-05-22 14:13 - 019525120 _____ (Microsoft Corporation) C:\WINDOWS\system32\HologramCompositor.dll
2018-05-22 14:13 - 2018-05-22 14:13 - 019399168 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll
2018-05-22 14:13 - 2018-05-22 14:13 - 012712960 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll
2018-05-22 14:13 - 2018-05-22 14:13 - 011903488 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll
2018-05-22 14:13 - 2018-05-22 14:13 - 009159064 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntoskrnl.exe
2018-05-22 14:13 - 2018-05-22 14:13 - 008623104 _____ (Microsoft Corporation) C:\WINDOWS\system32\mstscax.dll
2018-05-22 14:13 - 2018-05-22 14:13 - 008188928 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Data.Pdf.dll
2018-05-22 14:13 - 2018-05-22 14:13 - 007987712 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mstscax.dll
2018-05-22 14:13 - 2018-05-22 14:13 - 007583232 _____ (Microsoft Corporation) C:\WINDOWS\system32\Chakra.dll
2018-05-22 14:13 - 2018-05-22 14:13 - 007519992 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.Protection.PlayReady.dll
2018-05-22 14:13 - 2018-05-22 14:13 - 006661632 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Data.Pdf.dll
2018-05-22 14:13 - 2018-05-22 14:13 - 006569952 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.Protection.PlayReady.dll
2018-05-22 14:13 - 2018-05-22 14:13 - 006044104 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\windows.storage.dll
2018-05-22 14:13 - 2018-05-22 14:13 - 005951488 _____ (Microsoft Corporation) C:\WINDOWS\system32\dbgeng.dll
2018-05-22 14:13 - 2018-05-22 14:13 - 005782528 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Chakra.dll
2018-05-22 14:13 - 2018-05-22 14:13 - 004929024 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dbgeng.dll
2018-05-22 14:13 - 2018-05-22 14:13 - 004867072 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll
2018-05-22 14:13 - 2018-05-22 14:13 - 004706816 _____ (Microsoft Corporation) C:\WINDOWS\system32\cdp.dll
2018-05-22 14:13 - 2018-05-22 14:13 - 004372992 _____ (Microsoft Corporation) C:\WINDOWS\system32\EdgeContent.dll
2018-05-22 14:13 - 2018-05-22 14:13 - 004070400 _____ (Microsoft Corporation) C:\WINDOWS\system32\msi.dll
2018-05-22 14:13 - 2018-05-22 14:13 - 003732800 _____ C:\WINDOWS\system32\Windows.Mirage.dll
2018-05-22 14:13 - 2018-05-22 14:13 - 003712000 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll
2018-05-22 14:13 - 2018-05-22 14:13 - 003655168 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32kfull.sys
2018-05-22 14:13 - 2018-05-22 14:13 - 003440640 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininet.dll
2018-05-22 14:13 - 2018-05-22 14:13 - 003392512 _____ (Microsoft Corporation) C:\WINDOWS\system32\tquery.dll
2018-05-22 14:13 - 2018-05-22 14:13 - 003389952 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentServer.dll
2018-05-22 14:13 - 2018-05-22 14:13 - 003320320 _____ (Microsoft Corporation) C:\WINDOWS\system32\dwmcore.dll
2018-05-22 14:13 - 2018-05-22 14:13 - 003283400 _____ (Microsoft Corporation) C:\WINDOWS\system32\CoreUIComponents.dll
2018-05-22 14:13 - 2018-05-22 14:13 - 003086336 _____ (Microsoft Corporation) C:\WINDOWS\system32\diagtrack.dll
2018-05-22 14:13 - 2018-05-22 14:13 - 003015168 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wininet.dll
2018-05-22 14:13 - 2018-05-22 14:13 - 002961408 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\cdp.dll
2018-05-22 14:13 - 2018-05-22 14:13 - 002902528 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuaueng.dll
2018-05-22 14:13 - 2018-05-22 14:13 - 002900992 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dwmcore.dll
2018-05-22 14:13 - 2018-05-22 14:13 - 002841312 _____ C:\WINDOWS\SysWOW64\Windows.Mirage.dll
2018-05-22 14:13 - 2018-05-22 14:13 - 002835864 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgkrnl.sys
2018-05-22 14:13 - 2018-05-22 14:13 - 002753040 _____ (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll
2018-05-22 14:13 - 2018-05-22 14:13 - 002700800 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\tquery.dll
2018-05-22 14:13 - 2018-05-22 14:13 - 002486976 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\CoreUIComponents.dll
2018-05-22 14:13 - 2018-05-22 14:13 - 002422168 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ntfs.sys
2018-05-22 14:13 - 2018-05-22 14:13 - 002366976 _____ (Microsoft Corporation) C:\WINDOWS\system32\WebRuntimeManager.dll
2018-05-22 14:13 - 2018-05-22 14:13 - 002242208 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iertutil.dll
2018-05-22 14:13 - 2018-05-22 14:13 - 002236928 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32kbase.sys
2018-05-22 14:13 - 2018-05-22 14:13 - 002170368 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentExtensions.onecore.dll
2018-05-22 14:13 - 2018-05-22 14:13 - 001855488 _____ (Microsoft Corporation) C:\WINDOWS\system32\msxml3.dll
2018-05-22 14:13 - 2018-05-22 14:13 - 001817088 _____ (Microsoft Corporation) C:\WINDOWS\system32\urlmon.dll
2018-05-22 14:13 - 2018-05-22 14:13 - 001664512 _____ (Microsoft Corporation) C:\WINDOWS\system32\comsvcs.dll
2018-05-22 14:13 - 2018-05-22 14:13 - 001636352 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\urlmon.dll
2018-05-22 14:13 - 2018-05-22 14:13 - 001634800 _____ (Microsoft Corporation) C:\WINDOWS\system32\gdi32full.dll
2018-05-22 14:13 - 2018-05-22 14:13 - 001586176 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieapfltr.dll
2018-05-22 14:13 - 2018-05-22 14:13 - 001550848 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentExtensions.desktop.dll
2018-05-22 14:13 - 2018-05-22 14:13 - 001534976 _____ (Microsoft Corporation) C:\WINDOWS\system32\lsasrv.dll
2018-05-22 14:13 - 2018-05-22 14:13 - 001466368 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieapfltr.dll
2018-05-22 14:13 - 2018-05-22 14:13 - 001456616 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.efi
2018-05-22 14:13 - 2018-05-22 14:13 - 001454016 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\gdi32full.dll
2018-05-22 14:13 - 2018-05-22 14:13 - 001426328 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AppxPackaging.dll
2018-05-22 14:13 - 2018-05-22 14:13 - 001421312 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpbase.dll
2018-05-22 14:13 - 2018-05-22 14:13 - 001380864 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\comsvcs.dll
2018-05-22 14:13 - 2018-05-22 14:13 - 001258280 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.exe
2018-05-22 14:13 - 2018-05-22 14:13 - 001235968 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rdpbase.dll
2018-05-22 14:13 - 2018-05-22 14:13 - 001191168 _____ (Microsoft Corporation) C:\WINDOWS\system32\rpcrt4.dll
2018-05-22 14:13 - 2018-05-22 14:13 - 001160192 _____ (Microsoft Corporation) C:\WINDOWS\system32\rpcss.dll
2018-05-22 14:13 - 2018-05-22 14:13 - 001063320 _____ (Microsoft Corporation) C:\WINDOWS\system32\SecConfig.efi
2018-05-22 14:13 - 2018-05-22 14:13 - 001034624 _____ (Microsoft Corporation) C:\WINDOWS\system32\ApplyTrustOffline.exe
2018-05-22 14:13 - 2018-05-22 14:13 - 000976384 _____ (Microsoft Corporation) C:\WINDOWS\system32\Spectrum.exe
2018-05-22 14:13 - 2018-05-22 14:13 - 000960512 _____ (Microsoft Corporation) C:\WINDOWS\system32\StorSvc.dll
2018-05-22 14:13 - 2018-05-22 14:13 - 000944640 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Mirage.Internal.dll
2018-05-22 14:13 - 2018-05-22 14:13 - 000933376 _____ (Microsoft Corporation) C:\WINDOWS\system32\rasapi32.dll
2018-05-22 14:13 - 2018-05-22 14:13 - 000917504 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuapi.dll
2018-05-22 14:13 - 2018-05-22 14:13 - 000898560 _____ (Microsoft Corporation) C:\WINDOWS\system32\WpcWebFilter.dll
2018-05-22 14:13 - 2018-05-22 14:13 - 000894464 _____ (Microsoft Corporation) C:\WINDOWS\system32\webplatstorageserver.dll
2018-05-22 14:13 - 2018-05-22 14:13 - 000860160 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rasapi32.dll
2018-05-22 14:13 - 2018-05-22 14:13 - 000826776 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVClient.exe
2018-05-22 14:13 - 2018-05-22 14:13 - 000814592 _____ (Microsoft Corporation) C:\WINDOWS\system32\EdgeManager.dll
2018-05-22 14:13 - 2018-05-22 14:13 - 000786168 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rpcrt4.dll
2018-05-22 14:13 - 2018-05-22 14:13 - 000776880 _____ (Microsoft Corporation) C:\WINDOWS\system32\wer.dll
2018-05-22 14:13 - 2018-05-22 14:13 - 000775680 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript.dll
2018-05-22 14:13 - 2018-05-22 14:13 - 000758272 _____ (Microsoft Corporation) C:\WINDOWS\system32\msfeeds.dll
2018-05-22 14:13 - 2018-05-22 14:13 - 000749976 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVReporting.dll
2018-05-22 14:13 - 2018-05-22 14:13 - 000726528 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9diag.dll
2018-05-22 14:13 - 2018-05-22 14:13 - 000709816 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\cng.sys
2018-05-22 14:13 - 2018-05-22 14:13 - 000695296 _____ (Microsoft Corporation) C:\WINDOWS\system32\hhctrl.ocx
2018-05-22 14:13 - 2018-05-22 14:13 - 000669184 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript.dll
2018-05-22 14:13 - 2018-05-22 14:13 - 000668672 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msfeeds.dll
2018-05-22 14:13 - 2018-05-22 14:13 - 000665320 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wer.dll
2018-05-22 14:13 - 2018-05-22 14:13 - 000658432 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Mirage.Internal.dll
2018-05-22 14:13 - 2018-05-22 14:13 - 000652184 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVPublishing.dll
2018-05-22 14:13 - 2018-05-22 14:13 - 000624128 _____ (Microsoft Corporation) C:\WINDOWS\system32\PsmServiceExtHost.dll
2018-05-22 14:13 - 2018-05-22 14:13 - 000619520 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WpcWebFilter.dll
2018-05-22 14:13 - 2018-05-22 14:13 - 000615424 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\EdgeManager.dll
2018-05-22 14:13 - 2018-05-22 14:13 - 000613376 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Xaml.Resources.rs4.dll
2018-05-22 14:13 - 2018-05-22 14:13 - 000606448 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\oleaut32.dll
2018-05-22 14:13 - 2018-05-22 14:13 - 000604568 _____ (Microsoft Corporation) C:\WINDOWS\system32\securekernel.exe
2018-05-22 14:13 - 2018-05-22 14:13 - 000596480 _____ (Microsoft Corporation) C:\WINDOWS\system32\updatehandlers.dll
2018-05-22 14:13 - 2018-05-22 14:13 - 000585728 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Xaml.Resources.rs3.dll
2018-05-22 14:13 - 2018-05-22 14:13 - 000584192 _____ (Microsoft Corporation) C:\WINDOWS\system32\UIRibbonRes.dll
2018-05-22 14:13 - 2018-05-22 14:13 - 000581120 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\hhctrl.ocx
2018-05-22 14:13 - 2018-05-22 14:13 - 000578560 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\webplatstorageserver.dll
2018-05-22 14:13 - 2018-05-22 14:13 - 000561664 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9diag.dll
2018-05-22 14:13 - 2018-05-22 14:13 - 000559968 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AppXDeploymentClient.dll
2018-05-22 14:13 - 2018-05-22 14:13 - 000553984 _____ (Microsoft Corporation) C:\WINDOWS\system32\PerceptionSimulationExtensions.dll
2018-05-22 14:13 - 2018-05-22 14:13 - 000543744 _____ (Microsoft Corporation) C:\WINDOWS\system32\vbscript.dll
2018-05-22 14:13 - 2018-05-22 14:13 - 000524800 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\vbscript.dll
2018-05-22 14:13 - 2018-05-22 14:13 - 000494488 _____ (Microsoft Corporation) C:\WINDOWS\system32\WerFault.exe
2018-05-22 14:13 - 2018-05-22 14:13 - 000474624 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Xaml.Resources.rs2.dll
2018-05-22 14:13 - 2018-05-22 14:13 - 000473496 _____ (Microsoft Corporation) C:\WINDOWS\system32\dcntel.dll
2018-05-22 14:13 - 2018-05-22 14:13 - 000444416 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Xaml.Resources.rs1.dll
2018-05-22 14:13 - 2018-05-22 14:13 - 000434584 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WerFault.exe
2018-05-22 14:13 - 2018-05-22 14:13 - 000399768 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVScripting.dll
2018-05-22 14:13 - 2018-05-22 14:13 - 000392192 _____ (Microsoft Corporation) C:\WINDOWS\system32\iedkcs32.dll
2018-05-22 14:13 - 2018-05-22 14:13 - 000382872 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\clfs.sys
2018-05-22 14:13 - 2018-05-22 14:13 - 000344064 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iedkcs32.dll
2018-05-22 14:13 - 2018-05-22 14:13 - 000288256 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Xaml.Resources.th.dll
2018-05-22 14:13 - 2018-05-22 14:13 - 000272288 _____ (Microsoft Corporation) C:\WINDOWS\system32\SgrmEnclave.dll
2018-05-22 14:13 - 2018-05-22 14:13 - 000269216 _____ (Microsoft Corporation) C:\WINDOWS\system32\SgrmEnclave_secure.dll
2018-05-22 14:13 - 2018-05-22 14:13 - 000256000 _____ (Microsoft Corporation) C:\WINDOWS\system32\MixedReality.Broker.dll
2018-05-22 14:13 - 2018-05-22 14:13 - 000241664 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Xaml.Resources.win81.dll
2018-05-22 14:13 - 2018-05-22 14:13 - 000171520 _____ (Microsoft Corporation) C:\WINDOWS\system32\itss.dll
2018-05-22 14:13 - 2018-05-22 14:13 - 000170904 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ksecpkg.sys
2018-05-22 14:13 - 2018-05-22 14:13 - 000159744 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Cortana.Analog.dll
2018-05-22 14:13 - 2018-05-22 14:13 - 000154112 _____ (Microsoft Corporation) C:\WINDOWS\system32\Chakradiag.dll
2018-05-22 14:13 - 2018-05-22 14:13 - 000150528 _____ (Microsoft Corporation) C:\WINDOWS\system32\SharedPCCSP.dll
2018-05-22 14:13 - 2018-05-22 14:13 - 000150016 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\itss.dll
2018-05-22 14:13 - 2018-05-22 14:13 - 000144384 _____ (Microsoft Corporation) C:\WINDOWS\system32\mssprxy.dll
2018-05-22 14:13 - 2018-05-22 14:13 - 000143360 _____ (Microsoft Corporation) C:\WINDOWS\system32\TSpkg.dll
2018-05-22 14:13 - 2018-05-22 14:13 - 000142336 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Xaml.Resources.win8rtm.dll
2018-05-22 14:13 - 2018-05-22 14:13 - 000023552 _____ (Microsoft Corporation) C:\WINDOWS\system32\credssp.dll
2018-05-22 14:13 - 2018-05-22 14:13 - 000002560 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\tzres.dll
2018-05-22 14:13 - 2018-05-22 14:13 - 000002560 _____ (Microsoft Corporation) C:\WINDOWS\system32\tzres.dll
2018-05-22 14:12 - 2018-05-22 14:12 - 007436624 _____ (Microsoft Corporation) C:\WINDOWS\system32\windows.storage.dll
2018-05-22 14:12 - 2018-05-22 14:12 - 002897408 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\win32kfull.sys
2018-05-22 14:12 - 2018-05-22 14:12 - 001953280 _____ C:\WINDOWS\system32\rdpnano.dll
2018-05-22 14:12 - 2018-05-22 14:12 - 001585664 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msxml3.dll
2018-05-22 14:12 - 2018-05-22 14:12 - 001565592 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppxPackaging.dll
2018-05-22 14:12 - 2018-05-22 14:12 - 001174424 _____ (Microsoft Corporation) C:\WINDOWS\system32\hvix64.exe
2018-05-22 14:12 - 2018-05-22 14:12 - 001012120 _____ (Microsoft Corporation) C:\WINDOWS\system32\hvax64.exe
2018-05-22 14:12 - 2018-05-22 14:12 - 000885848 _____ (Microsoft Corporation) C:\WINDOWS\system32\CoreMessaging.dll
2018-05-22 14:12 - 2018-05-22 14:12 - 000836608 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wuapi.dll
2018-05-22 14:12 - 2018-05-22 14:12 - 000788216 _____ (Microsoft Corporation) C:\WINDOWS\system32\oleaut32.dll
2018-05-22 14:12 - 2018-05-22 14:12 - 000733992 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentClient.dll
2018-05-22 14:12 - 2018-05-22 14:12 - 000705944 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\vhdmp.sys
2018-05-22 14:12 - 2018-05-22 14:12 - 000567136 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\CoreMessaging.dll
2018-05-22 14:12 - 2018-05-22 14:12 - 000134552 _____ (Microsoft Corporation) C:\WINDOWS\system32\hvloader.dll
2018-05-22 14:12 - 2018-05-22 14:12 - 000117760 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TSpkg.dll
2018-05-22 14:12 - 2018-05-22 14:12 - 000046592 _____ (Microsoft Corporation) C:\WINDOWS\system32\wcimage.dll
2018-05-22 14:12 - 2018-05-22 14:12 - 000019968 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\credssp.dll
2018-05-22 14:12 - 2018-05-22 14:12 - 000001312 _____ C:\WINDOWS\system32\tcbres.wim
2018-05-22 14:01 - 2018-05-22 14:01 - 000000000 ____D C:\WINDOWS\SysWOW64\BestPractices
2018-05-22 14:01 - 2018-05-22 14:01 - 000000000 ____D C:\WINDOWS\system32\msmq
2018-05-22 14:01 - 2018-05-22 14:01 - 000000000 ____D C:\WINDOWS\system32\BestPractices
2018-05-22 14:01 - 2018-05-22 14:01 - 000000000 ____D C:\inetpub
2018-05-22 14:00 - 2018-05-22 14:00 - 006350848 _____ (Microsoft Corporation) C:\WINDOWS\system32\NlsData0009.dll
2018-05-22 14:00 - 2018-05-22 14:00 - 005739008 _____ (Microsoft Corporation) C:\WINDOWS\system32\prm0009.dll
2018-05-22 14:00 - 2018-05-22 14:00 - 005487616 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\NlsData0009.dll
2018-05-22 14:00 - 2018-05-22 14:00 - 002629120 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\NlsLexicons0009.dll
2018-05-22 14:00 - 2018-05-22 14:00 - 002629120 _____ (Microsoft Corporation) C:\WINDOWS\system32\NlsLexicons0009.dll
2018-05-22 13:59 - 2018-05-22 13:59 - 004492288 _____ (Microsoft Corporation) C:\WINDOWS\system32\xpsrchvw.exe
2018-05-22 13:59 - 2018-05-22 13:59 - 003398144 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\xpsrchvw.exe
2018-05-22 13:59 - 2018-05-22 13:59 - 000925696 _____ (Microsoft Corporation) C:\WINDOWS\system32\XpsFilt.dll
2018-05-22 13:59 - 2018-05-22 13:59 - 000575488 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\XpsFilt.dll
2018-05-22 13:59 - 2018-05-22 13:59 - 000100352 _____ (Microsoft Corporation) C:\WINDOWS\system32\XPSSHHDR.dll
2018-05-22 13:59 - 2018-05-22 13:59 - 000082432 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\XPSSHHDR.dll
2018-05-22 13:59 - 2018-05-22 13:59 - 000076060 _____ C:\WINDOWS\SysWOW64\xpsrchvw.xml
2018-05-22 13:59 - 2018-05-22 13:59 - 000076060 _____ C:\WINDOWS\system32\xpsrchvw.xml
2018-05-22 13:59 - 2018-05-22 13:59 - 000000000 ____D C:\WINDOWS\SysWOW64\XPSViewer
2018-05-22 13:59 - 2018-05-22 13:59 - 000000000 ____D C:\Program Files\Reference Assemblies
2018-05-22 13:59 - 2018-05-22 13:59 - 000000000 ____D C:\Program Files\MSBuild
2018-05-22 13:59 - 2018-05-22 13:59 - 000000000 ____D C:\Program Files (x86)\Reference Assemblies
2018-05-22 13:59 - 2018-05-22 13:59 - 000000000 ____D C:\Program Files (x86)\MSBuild
2018-05-22 13:57 - 2018-05-22 13:57 - 001166520 _____ (Microsoft Corporation) C:\WINDOWS\system32\PresentationNative_v0300.dll
2018-05-22 13:57 - 2018-05-22 13:57 - 000778936 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\PresentationNative_v0300.dll
2018-05-22 13:57 - 2018-05-22 13:57 - 000124624 _____ (Microsoft Corporation) C:\WINDOWS\system32\PresentationCFFRasterizerNative_v0300.dll
2018-05-22 13:57 - 2018-05-22 13:57 - 000103120 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\PresentationCFFRasterizerNative_v0300.dll
2018-05-22 13:57 - 2018-05-22 13:57 - 000035456 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TsWpfWrp.exe
2018-05-22 13:57 - 2018-05-22 13:57 - 000035456 _____ (Microsoft Corporation) C:\WINDOWS\system32\TsWpfWrp.exe
2018-05-22 13:38 - 2018-05-22 13:38 - 000008192 _____ C:\WINDOWS\system32\config\userdiff
2018-05-22 12:05 - 2018-05-23 12:24 - 000000000 ___DC C:\WINDOWS\Panther
2018-05-08 14:06 - 2018-05-08 14:06 - 006084096 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerInstaller.exe

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2018-06-04 20:05 - 2017-03-19 19:34 - 000000000 ____D C:\FRST
2018-06-04 20:00 - 2018-04-12 01:38 - 000000000 ____D C:\ProgramData\regid.1991-06.com.microsoft
2018-06-04 19:08 - 2018-04-12 17:51 - 000809600 _____ C:\WINDOWS\system32\perfh005.dat
2018-06-04 19:08 - 2018-04-12 17:51 - 000186808 _____ C:\WINDOWS\system32\perfc005.dat
2018-06-04 19:08 - 2018-04-12 01:36 - 000000000 ____D C:\WINDOWS\INF
2018-06-04 19:04 - 2016-12-28 20:45 - 000000000 ____D C:\Users\Miroslav Hubata\AppData\LocalLow\Mozilla
2018-06-04 19:00 - 2018-04-11 23:04 - 000524288 _____ C:\WINDOWS\system32\config\BBI
2018-06-03 22:08 - 2012-06-10 10:58 - 000000000 ____D C:\Program Files\trend micro
2018-06-03 21:39 - 2018-04-12 01:38 - 000000000 ____D C:\WINDOWS\AppReadiness
2018-06-03 18:37 - 2017-03-26 15:38 - 000000000 ____D C:\Users\Miroslav Hubata\Desktop\Nic
2018-06-03 16:43 - 2018-04-12 01:38 - 000000000 ___HD C:\Program Files\WindowsApps
2018-06-01 20:39 - 2018-04-12 01:38 - 000000000 ____D C:\WINDOWS\system32\WinBioPlugIns
2018-06-01 20:39 - 2018-04-12 01:30 - 000000000 ____D C:\WINDOWS\CbsTemp
2018-06-01 18:42 - 2018-02-17 22:14 - 000000000 ____D C:\WINDOWS\system32\Drivers\wd
2018-05-29 21:09 - 2016-07-28 22:38 - 000000000 ___RD C:\Users\Miroslav Hubata\OneDrive
2018-05-25 19:50 - 2016-09-19 13:40 - 000000000 ____D C:\Users\Miroslav Hubata\AppData\Local\ConnectedDevicesPlatform
2018-05-25 18:29 - 2017-12-27 11:16 - 000000000 ____D C:\Users\Miroslav Hubata\AppData\Local\Packages
2018-05-24 16:06 - 2018-04-12 01:38 - 000000000 ____D C:\WINDOWS\appcompat
2018-05-23 12:54 - 2018-04-12 01:41 - 000000000 ____D C:\WINDOWS\Setup
2018-05-23 12:54 - 2018-04-12 01:38 - 000028672 _____ C:\WINDOWS\system32\config\BCD-Template
2018-05-23 12:54 - 2018-04-12 01:38 - 000000000 __SHD C:\Program Files\Windows Sidebar
2018-05-23 12:54 - 2018-04-12 01:38 - 000000000 __SHD C:\Program Files (x86)\Windows Sidebar
2018-05-23 12:54 - 2018-04-12 01:38 - 000000000 ___SD C:\WINDOWS\Downloaded Program Files
2018-05-23 12:54 - 2018-04-12 01:38 - 000000000 ____D C:\WINDOWS\SysWOW64\Macromed
2018-05-23 12:54 - 2018-04-12 01:38 - 000000000 ____D C:\WINDOWS\SysWOW64\IME
2018-05-23 12:54 - 2018-04-12 01:38 - 000000000 ____D C:\WINDOWS\system32\WinBioDatabase
2018-05-23 12:54 - 2018-04-12 01:38 - 000000000 ____D C:\WINDOWS\system32\spool
2018-05-23 12:54 - 2018-04-12 01:38 - 000000000 ____D C:\WINDOWS\system32\NDF
2018-05-23 12:54 - 2018-04-12 01:38 - 000000000 ____D C:\WINDOWS\system32\Macromed
2018-05-23 12:54 - 2018-04-12 01:38 - 000000000 ____D C:\WINDOWS\system32\IME
2018-05-23 12:54 - 2018-04-12 01:38 - 000000000 ____D C:\WINDOWS\schemas
2018-05-23 12:54 - 2018-04-12 01:38 - 000000000 ____D C:\WINDOWS\PolicyDefinitions
2018-05-23 12:54 - 2018-04-12 01:38 - 000000000 ____D C:\WINDOWS\ModemLogs
2018-05-23 12:54 - 2018-04-12 01:38 - 000000000 ____D C:\WINDOWS\LiveKernelReports
2018-05-23 12:54 - 2018-04-12 01:38 - 000000000 ____D C:\Program Files\Common Files\microsoft shared
2018-05-23 12:54 - 2018-01-21 17:56 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
2018-05-23 12:54 - 2017-09-29 15:46 - 000000000 ____D C:\WINDOWS\system32\Tasks_Migrated
2018-05-23 12:54 - 2017-09-19 08:43 - 000000000 ____D C:\Program Files\Realtek
2018-05-23 12:54 - 2017-07-16 11:43 - 000000000 ____D C:\Program Files\UNP
2018-05-23 12:54 - 2016-11-19 14:16 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MozBackup
2018-05-23 12:54 - 2015-10-30 20:35 - 000000000 ____D C:\WINDOWS\ShellNew
2018-05-23 12:54 - 2013-03-13 11:54 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
2018-05-23 12:54 - 2012-01-25 20:05 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\EPSON Creativity Suite
2018-05-23 12:54 - 2012-01-25 19:55 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\EPSON
2018-05-23 12:54 - 2011-10-12 16:51 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ABBYY FineReader 6.0 Sprint
2018-05-23 12:54 - 2011-06-09 11:06 - 000000000 ____D C:\WINDOWS\system32\SPReview
2018-05-23 12:54 - 2011-06-09 11:05 - 000000000 ____D C:\WINDOWS\system32\EventProviders
2018-05-23 12:54 - 2011-03-24 18:59 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office
2018-05-23 12:54 - 2011-03-23 12:20 - 000000000 ____D C:\WINDOWS\system32\appmgmt
2018-05-23 12:54 - 2010-12-08 17:07 - 000000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live
2018-05-23 12:54 - 2010-12-08 17:07 - 000000000 ____D C:\WINDOWS\sk
2018-05-23 12:54 - 2010-12-08 17:07 - 000000000 ____D C:\WINDOWS\en
2018-05-23 12:54 - 2010-12-08 17:07 - 000000000 ____D C:\WINDOWS\cs
2018-05-23 12:54 - 2010-12-08 16:50 - 000000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Lenovo
2018-05-23 12:54 - 2010-12-08 16:29 - 000000000 ____D C:\WINDOWS\SysWOW64\Atheros_L1e
2018-05-23 12:54 - 2010-12-08 16:22 - 000000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Intel
2018-05-23 12:34 - 2017-12-27 11:35 - 000000000 ___RD C:\Users\Miroslav Hubata\3D Objects
2018-05-23 12:34 - 2016-07-28 22:34 - 000000000 __RHD C:\Users\Public\AccountPictures
2018-05-23 12:24 - 2018-04-11 23:04 - 000032768 _____ C:\WINDOWS\system32\config\ELAM
2018-05-23 12:23 - 2018-04-12 01:38 - 000000000 ____D C:\Program Files\Windows Defender
2018-05-23 12:15 - 2018-04-12 01:38 - 000000000 ___RD C:\WINDOWS\ImmersiveControlPanel
2018-05-23 12:15 - 2018-04-12 01:38 - 000000000 ____D C:\WINDOWS\Registration
2018-05-23 12:14 - 2018-04-12 01:38 - 000000000 __RSD C:\WINDOWS\media
2018-05-23 12:14 - 2016-07-28 22:15 - 000023020 _____ C:\WINDOWS\system32\emptyregdb.dat
2018-05-23 12:07 - 2018-04-12 01:38 - 000000000 ____D C:\WINDOWS\SysWOW64\inetsrv
2018-05-23 12:00 - 2018-04-12 01:38 - 000000000 ____D C:\ProgramData\USOPrivate
2018-05-23 12:00 - 2017-09-19 08:43 - 001867966 _____ C:\WINDOWS\SysWOW64\PerfStringBackup.INI
2018-05-23 11:59 - 2018-04-12 01:38 - 000000000 ____D C:\WINDOWS\System
2018-05-23 11:59 - 2017-09-19 08:43 - 000000000 ____D C:\WINDOWS\SysWOW64\RTCOM
2018-05-23 11:59 - 2017-09-19 08:43 - 000000000 ____D C:\Program Files (x86)\USB Camera2
2018-05-23 11:59 - 2017-09-19 08:42 - 000000000 ____D C:\Program Files\Elantech
2018-05-22 14:37 - 2018-04-12 01:38 - 000000000 __RHD C:\Users\Public\Libraries
2018-05-22 14:27 - 2018-04-12 01:38 - 000000000 ____D C:\WINDOWS\system32\oobe
2018-05-22 14:25 - 2009-07-14 07:32 - 000000000 ____D C:\Program Files\Microsoft Games
2018-05-22 14:24 - 2016-09-19 13:23 - 000000000 ____D C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Lenovo
2018-05-22 14:24 - 2016-09-19 13:23 - 000000000 ____D C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Lenovo
2018-05-22 14:16 - 2018-04-12 18:12 - 000000000 ____D C:\WINDOWS\Containers
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\SysWOW64\zu-ZA
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\SysWOW64\yo-NG
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\SysWOW64\xh-ZA
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\SysWOW64\wo-SN
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\SysWOW64\vi-VN
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\SysWOW64\uz-Latn-UZ
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\SysWOW64\ur-PK
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\SysWOW64\ug-CN
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\SysWOW64\tt-RU
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\SysWOW64\tn-ZA
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\SysWOW64\tk-TM
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\SysWOW64\ti-ET
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\SysWOW64\tg-Cyrl-TJ
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\SysWOW64\te-IN
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\SysWOW64\ta-IN
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\SysWOW64\sw-KE
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\SysWOW64\sr-Cyrl-RS
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\SysWOW64\sr-Cyrl-BA
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\SysWOW64\sq-AL
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\SysWOW64\si-LK
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\SysWOW64\sd-Arab-PK
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\SysWOW64\rw-RW
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\SysWOW64\quz-PE
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\SysWOW64\quc-Latn-GT
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\SysWOW64\prs-AF
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\SysWOW64\pa-IN
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\SysWOW64\pa-Arab-PK
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\SysWOW64\or-IN
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\SysWOW64\nso-ZA
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\SysWOW64\nn-NO
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\SysWOW64\ne-NP
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\SysWOW64\mt-MT
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\SysWOW64\mr-IN
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\SysWOW64\mn-MN
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\SysWOW64\ml-IN
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\SysWOW64\mk-MK
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\SysWOW64\mi-NZ
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\SysWOW64\lo-LA
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\SysWOW64\lb-LU
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\SysWOW64\ky-KG
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\SysWOW64\ku-Arab-IQ
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\SysWOW64\kok-IN
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\SysWOW64\kn-IN
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\SysWOW64\km-KH
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\SysWOW64\kk-KZ
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\SysWOW64\ka-GE
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\SysWOW64\is-IS
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\SysWOW64\ig-NG
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\SysWOW64\id-ID
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\SysWOW64\chr-CHER-US
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\SysWOW64\hy-AM
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\SysWOW64\ha-Latn-NG
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\SysWOW64\gu-IN
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\SysWOW64\gd-GB
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\SysWOW64\ga-IE
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\SysWOW64\fil-PH
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\SysWOW64\fa-IR
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\SysWOW64\cy-GB
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\SysWOW64\ca-ES-valencia
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\SysWOW64\bs-Latn-BA
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\SysWOW64\bn-IN
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\SysWOW64\bn-BD
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\SysWOW64\be-BY
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\SysWOW64\az-Latn-AZ
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\SysWOW64\as-IN
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\SysWOW64\am-ET
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\SysWOW64\af-ZA
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\system32\zu-ZA
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\system32\yo-NG
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\system32\xh-ZA
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\system32\wo-SN
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\system32\vi-VN
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\system32\uz-Latn-UZ
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\system32\ur-PK
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\system32\ug-CN
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\system32\tt-RU
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\system32\tn-ZA
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\system32\tk-TM
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\system32\ti-ET
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\system32\tg-Cyrl-TJ
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\system32\te-IN
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\system32\sw-KE
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\system32\sr-Cyrl-RS
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\system32\sr-Cyrl-BA
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\system32\sq-AL
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\system32\sd-Arab-PK
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\system32\rw-RW
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\system32\quz-PE
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\system32\quc-Latn-GT
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\system32\prs-AF
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\system32\pa-IN
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\system32\pa-Arab-PK
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\system32\or-IN
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\system32\nso-ZA
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\system32\nn-NO
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\system32\ne-NP
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\system32\mt-MT
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\system32\mr-IN
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\system32\mn-MN
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\system32\ml-IN
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\system32\mk-MK
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\system32\mi-NZ
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\system32\lo-LA
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\system32\lb-LU
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\system32\ky-KG
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\system32\ku-Arab-IQ
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\system32\kok-IN
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\system32\kn-IN
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\system32\km-KH
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\system32\kk-KZ
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\system32\ka-GE
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\system32\is-IS
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\system32\ig-NG
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\system32\id-ID
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\system32\chr-CHER-US
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\system32\hy-AM
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\system32\ha-Latn-NG
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\system32\gu-IN
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\system32\gd-GB
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\system32\ga-IE
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\system32\fil-PH
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\system32\fa-IR
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\system32\cy-GB
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\system32\ca-ES-valencia
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\system32\bs-Latn-BA
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\system32\bn-IN
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\system32\bn-BD
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\system32\be-BY
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\system32\az-Latn-AZ
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\system32\as-IN
2018-05-22 14:16 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\system32\af-ZA
2018-05-22 14:16 - 2018-04-12 01:38 - 000000000 ____D C:\WINDOWS\TextInput
2018-05-22 14:16 - 2018-04-12 01:38 - 000000000 ____D C:\WINDOWS\SysWOW64\setup
2018-05-22 14:16 - 2018-04-12 01:38 - 000000000 ____D C:\WINDOWS\system32\ta-in
2018-05-22 14:16 - 2018-04-12 01:38 - 000000000 ____D C:\WINDOWS\system32\si-lk
2018-05-22 14:16 - 2018-04-12 01:38 - 000000000 ____D C:\WINDOWS\system32\setup
2018-05-22 14:16 - 2018-04-12 01:38 - 000000000 ____D C:\WINDOWS\system32\appraiser
2018-05-22 14:16 - 2018-04-12 01:38 - 000000000 ____D C:\WINDOWS\system32\am-et
2018-05-22 14:16 - 2018-04-12 01:38 - 000000000 ____D C:\WINDOWS\Provisioning
2018-05-22 14:16 - 2018-04-12 01:38 - 000000000 ____D C:\WINDOWS\bcastdvr
2018-05-22 14:16 - 2018-04-12 01:38 - 000000000 ____D C:\Program Files\Windows Photo Viewer
2018-05-22 14:16 - 2018-04-12 01:38 - 000000000 ____D C:\Program Files (x86)\Windows Photo Viewer
2018-05-22 14:01 - 2018-04-12 01:38 - 000000000 ____D C:\WINDOWS\system32\inetsrv
2018-05-22 14:00 - 2018-04-12 01:38 - 000000000 ____D C:\WINDOWS\SysWOW64\lv-LV
2018-05-22 14:00 - 2018-04-12 01:38 - 000000000 ____D C:\WINDOWS\SysWOW64\lt-LT
2018-05-22 14:00 - 2018-04-12 01:38 - 000000000 ____D C:\WINDOWS\SysWOW64\et-EE
2018-05-22 14:00 - 2018-04-12 01:38 - 000000000 ____D C:\WINDOWS\SysWOW64\es-MX
2018-05-22 14:00 - 2018-04-12 01:38 - 000000000 ____D C:\WINDOWS\SysWOW64\en-GB
2018-05-22 14:00 - 2018-04-12 01:38 - 000000000 ____D C:\WINDOWS\system32\lv-LV
2018-05-22 14:00 - 2018-04-12 01:38 - 000000000 ____D C:\WINDOWS\system32\lt-LT
2018-05-22 14:00 - 2018-04-12 01:38 - 000000000 ____D C:\WINDOWS\system32\et-EE
2018-05-22 14:00 - 2018-04-12 01:38 - 000000000 ____D C:\WINDOWS\system32\es-MX
2018-05-22 14:00 - 2018-04-12 01:38 - 000000000 ____D C:\WINDOWS\system32\en-GB
2018-05-22 13:59 - 2018-04-12 01:38 - 000000000 ____D C:\WINDOWS\SysWOW64\MUI
2018-05-22 13:59 - 2018-04-12 01:38 - 000000000 ____D C:\WINDOWS\system32\MUI
2018-05-22 13:54 - 2018-04-12 17:52 - 000000000 ____D C:\WINDOWS\OCR
2018-05-22 13:49 - 2016-09-19 13:38 - 000000000 ____H C:\$WINRE_BACKUP_PARTITION.MARKER
2018-05-22 11:57 - 2016-12-28 20:44 - 000001232 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Firefox.lnk
2018-05-22 11:57 - 2016-12-28 20:44 - 000000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2018-05-22 11:57 - 2016-11-18 18:59 - 000000000 ____D C:\Program Files (x86)\Mozilla Firefox
2018-05-20 15:46 - 2013-02-11 21:14 - 000000000 ____D C:\Users\Miroslav Hubata\Desktop\Sylva a spol
2018-05-18 16:34 - 2015-11-15 16:03 - 000002457 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acrobat Reader DC.lnk
2018-05-10 20:52 - 2017-10-15 11:03 - 141696960 ____C (Microsoft Corporation) C:\WINDOWS\system32\MRT-KB890830.exe
2018-05-10 20:52 - 2013-08-15 23:14 - 000000000 ____D C:\WINDOWS\system32\MRT
2018-05-10 20:52 - 2011-03-23 12:34 - 141696960 ____C (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe

==================== Files in the root of some directories =======

2017-03-19 19:26 - 2017-03-19 19:30 - 000029696 _____ () C:\Users\Miroslav Hubata\AppData\Local\MSGBOX.EXE
2011-12-15 22:06 - 2011-12-15 22:06 - 000007605 _____ () C:\Users\Miroslav Hubata\AppData\Local\Resmon.ResmonCfg

==================== Bamital & volsnap ======================

(There is no automatic fix for files that do not pass verification.)

C:\WINDOWS\system32\winlogon.exe => File is digitally signed
C:\WINDOWS\system32\wininit.exe => File is digitally signed
C:\WINDOWS\explorer.exe => File is digitally signed
C:\WINDOWS\SysWOW64\explorer.exe => File is digitally signed
C:\WINDOWS\system32\svchost.exe => File is digitally signed
C:\WINDOWS\SysWOW64\svchost.exe => File is digitally signed
C:\WINDOWS\system32\services.exe => File is digitally signed
C:\WINDOWS\system32\User32.dll => File is digitally signed
C:\WINDOWS\SysWOW64\User32.dll => File is digitally signed
C:\WINDOWS\system32\userinit.exe => File is digitally signed
C:\WINDOWS\SysWOW64\userinit.exe => File is digitally signed
C:\WINDOWS\system32\rpcss.dll => File is digitally signed
C:\WINDOWS\system32\dnsapi.dll => File is digitally signed
C:\WINDOWS\SysWOW64\dnsapi.dll => File is digitally signed
C:\WINDOWS\system32\Drivers\volsnap.sys => File is digitally signed

LastRegBack: 2018-05-23 11:55

==================== End of FRST.txt ============================

[Miroslav Hubata]

Ještě doplním...on se udělal totiž restart...a pak to nic samo o sobě nevyhodilo...jen na ploše zůstaly:
fixlog, addition, frst (všechno poznámkovej blok)

[Rudy]

OK, dal jste správný log. Mělo by být smazáno, log je již OK.

[Miroslav Hubata]

Super, díky moc, můžu ty adware a frst odstranit?

[Rudy]

Můžete. ADW spusťte a v levém roletovém menu klikněte na odinstalovat. Ostatní běžným způsobem smažte. Nemáte zač!

[Miroslav Hubata]

Díky moc!!!
Ten ADW když spustím, tak máte na mysli tu levou část, kolonka nastavení a když se do toho vleze tak tlačítko odstranit?

[Miroslav Hubata]

Protože když dám v tom co jsem teď uváděl "odstranit", tak se nic nestane a Adw je furt na ploše...