VIRY.CZ

Pomáháme v boji s počítačovou havěti!
https://forum.viry.cz:443/

Podezření na vir (dllhost.exe - COM Surrogate)

https://forum.viry.cz:443/viewtopic.php?t=151484

Stránka 1 z 2

Podezření na vir (dllhost.exe - COM Surrogate)

Napsal: 22 úno 2017 17:46
od Peedy
Dobrý den,

již několik dní se snažím vyřešit můj problém s neznámou běžící úlohou. Před pár dny jsem ve správci úloh našel podezřelou úlohu s popisem COM Surrogate a běží to jako dllhost.exe. Zkoušel jsem snad vše. Udělal jsem kompletní test antivirem (dokonce i více antiviry) a nic nenašly. Nainstaloval jsem si Malwarebytes a udělal jsem kontrolu, také neúspěšně. Dokonce jsem se pokoušel přeinstalovat celý operační systém, ale po pár minutách vyskočila chybová hláška. Nakonec se mi systém povedlo přeinstalovat (nic jsem nezachovával) pomocí oficiálního instalačního souboru Windows, ale i po reinstalaci se ve správci úloh tato úloha nachází.

Proto Vás prosím o kontrolu přiloženého logu.
Předem děkuji.

Logfile of random's system information tool 1.15 (written by random/random)
Run by Petr Půček at 2017-02-22 17:30:01
Microsoft Windows 10 Home
System drive C: has 1881 GB (99%) free of 1907 GB
Total RAM: 16315 MB (88% free)
X64

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 17:30:08, on 22.02.2017
Platform: Unknown Windows (WinNT 6.02.1008)
MSIE: Internet Explorer v11.0 (11.00.14393.0000)
Boot mode: Normal

Running processes:
C:\Users\Petr Půček\AppData\Local\Microsoft\OneDrive\OneDrive.exe
C:\Program Files\trend micro\Petr Půček_RSITx64.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/p/?LinkId=255141
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/p/?LinkId=255141
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/p/?LinkId=255141
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = %11%\blank.htm
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F2 - REG:system.ini: UserInit=
O4 - HKCU\..\Run: [OneDrive] "C:\Users\Petr Půček\AppData\Local\Microsoft\OneDrive\OneDrive.exe" /background
O4 - HKCU\..\RunOnce: [Uninstall 17.3.6381.0405\amd64] C:\WINDOWS\system32\cmd.exe /q /c rmdir /s /q "C:\Users\Petr Půček\AppData\Local\Microsoft\OneDrive\17.3.6381.0405\amd64"
O4 - HKCU\..\RunOnce: [Uninstall 17.3.6381.0405] C:\WINDOWS\system32\cmd.exe /q /c rmdir /s /q "C:\Users\Petr Půček\AppData\Local\Microsoft\OneDrive\17.3.6381.0405"
O4 - HKUS\S-1-5-19\..\Run: [OneDriveSetup] C:\Windows\SysWOW64\OneDriveSetup.exe /thfirstsetup (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [OneDriveSetup] C:\Windows\SysWOW64\OneDriveSetup.exe /thfirstsetup (User 'NETWORK SERVICE')
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O18 - Protocol: tbauth - {14654CA6-5711-491D-B89A-58E571679951} - C:\Windows\SysWOW64\tbauth.dll
O18 - Protocol: windows.tbauth - {14654CA6-5711-491D-B89A-58E571679951} - C:\Windows\SysWOW64\tbauth.dll
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\WINDOWS\System32\alg.exe (file missing)
O23 - Service: @%SystemRoot%\system32\DiagSvcs\DiagnosticsHub.StandardCollector.ServiceRes.dll,-1000 (diagnosticshub.standardcollector.service) - Unknown owner - C:\WINDOWS\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe (file missing)
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\WINDOWS\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\WINDOWS\system32\fxssvc.exe (file missing)
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\WINDOWS\system32\lsass.exe (file missing)
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\WINDOWS\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\WINDOWS\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\WINDOWS\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\WINDOWS\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\SensorDataService.exe,-101 (SensorDataService) - Unknown owner - C:\WINDOWS\System32\SensorDataService.exe (file missing)
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\WINDOWS\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\WINDOWS\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\WINDOWS\system32\sppsvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\TieringEngineService.exe,-702 (TieringEngineService) - Unknown owner - C:\WINDOWS\system32\TieringEngineService.exe (file missing)
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\WINDOWS\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\WINDOWS\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\WINDOWS\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\WINDOWS\system32\vssvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\WINDOWS\system32\wbengine.exe (file missing)
O23 - Service: @%ProgramFiles%\Windows Defender\MpAsDesc.dll,-320 (WdNisSvc) - Unknown owner - C:\Program Files (x86)\Windows Defender\NisSrv.exe (file missing)
O23 - Service: @%ProgramFiles%\Windows Defender\MpAsDesc.dll,-310 (WinDefend) - Unknown owner - C:\Program Files (x86)\Windows Defender\MsMpEng.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\WINDOWS\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--
End of file - 5687 bytes

====== Enumerating Processes ======

C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe -k DcomLaunch
C:\WINDOWS\system32\svchost.exe -k RPCSS
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\WINDOWS\system32\svchost.exe -k LocalServiceNoNetwork
C:\WINDOWS\system32\svchost.exe -k appmodel
C:\WINDOWS\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\WINDOWS\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\WINDOWS\system32\svchost.exe -k NetworkService
C:\WINDOWS\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\WINDOWS\system32\svchost.exe -k LocalService
C:\WINDOWS\system32\svchost.exe -k LocalServiceNetworkRestricted
C:\WINDOWS\System32\spoolsv.exe
C:\WINDOWS\System32\svchost.exe -k utcsvc
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\WINDOWS\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\WINDOWS\system32\SearchIndexer.exe /Embedding
C:\WINDOWS\System32\svchost.exe -k AppReadiness
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\dwm.exe
C:\WINDOWS\System32\sihost.exe
C:\WINDOWS\System32\taskhostw.exe
C:\WINDOWS\Explorer.EXE
C:\Windows\System32\smartscreen.exe -Embedding
"C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mca
C:\Windows\System32\RuntimeBroker.exe -Embedding
"C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca
C:\WINDOWS\system32\svchost.exe -k UnistackSvcGroup
"C:\Program Files\Windows Defender\MSASCuiL.exe"
C:\WINDOWS\system32\ApplicationFrameHost.exe -Embedding
C:\Users\Petr Půček\AppData\Local\Microsoft\OneDrive\OneDrive.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
C:\WINDOWS\system32\browser_broker.exe -Embedding
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\microsoftedgecp.exe" SCODEF:1020 CREDAT:140545 /prefetch:2
C:\Windows\System32\InstallAgent.exe -Embedding
"C:\WINDOWS\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3496302125-3621286174-2969400345-10013_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3496302125-3621286174-2969400345-10013 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
C:\WINDOWS\system32\DllHost.exe /Processid:{49F6E667-6658-4BD1-9DE9-6AF87F9FAF85}
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\microsoftedgecp.exe" SCODEF:1020 CREDAT:206123 /prefetch:2
C:\Program Files\Windows Defender\MpCmdRun.exe
C:\WINDOWS\System32\taskhostw.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\microsoftedgecp.exe" SCODEF:1020 CREDAT:337157 /prefetch:2
"C:\WINDOWS\System32\Taskmgr.exe" /3
"C:\WINDOWS\system32\SearchFilterHost.exe" 0 656 660 668 8192 664
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\microsoftedgecp.exe" SCODEF:1020 CREDAT:337174 /prefetch:2
"C:\WINDOWS\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe4_ Global\UsGthrCtrlFltPipeMssGthrPipe4 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
C:\WINDOWS\system32\AUDIODG.EXE 0x350
"C:\Users\Petr Půček\Downloads\RSITx64.exe"
C:\WINDOWS\system32\wbem\wmiprvse.exe

====== Scheduled tasks folder ======

C:\WINDOWS\system32\tasks\OneDrive Standalone Update Task v2 - %localappdata%\Microsoft\OneDrive\OneDriveStandaloneUpdater.exe
C:\WINDOWS\system32\tasks\Microsoft\XblGameSave\XblGameSaveTask - %windir%\System32\XblGameSaveTask.exe standby
C:\WINDOWS\system32\tasks\Microsoft\XblGameSave\XblGameSaveTaskLogon - %windir%\System32\XblGameSaveTask.exe logon
C:\WINDOWS\system32\tasks\Microsoft\Windows\Workplace Join\Automatic-Device-Join - %SystemRoot%\System32\dsregcmd.exe
C:\WINDOWS\system32\tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start - %systemroot%\System32\sc.exe start wuauserv
C:\WINDOWS\system32\tasks\Microsoft\Windows\WindowsUpdate\sih - %systemroot%\System32\sihclient.exe
C:\WINDOWS\system32\tasks\Microsoft\Windows\WindowsUpdate\sihboot - %systemroot%\System32\sihclient.exe /boot
C:\WINDOWS\system32\tasks\Microsoft\Windows\Windows Media Sharing\UpdateLibrary - "%ProgramFiles%\Windows Media Player\wmpnscfg.exe"
C:\WINDOWS\system32\tasks\Microsoft\Windows\Windows Filtering Platform\BfeOnServiceStartTypeChange - %windir%\system32\rundll32.exe bfe.dll,BfeOnServiceStartTypeChange
C:\WINDOWS\system32\tasks\Microsoft\Windows\Windows Error Reporting\QueueReporting - %windir%\system32\wermgr.exe -upload
C:\WINDOWS\system32\tasks\Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance - %ProgramFiles%\Windows Defender\MpCmdRun.exe -IdleTask -TaskName WdCacheMaintenance
C:\WINDOWS\system32\tasks\Microsoft\Windows\Windows Defender\Windows Defender Cleanup - %ProgramFiles%\Windows Defender\MpCmdRun.exe -IdleTask -TaskName WdCleanup
C:\WINDOWS\system32\tasks\Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan - %ProgramFiles%\Windows Defender\MpCmdRun.exe Scan -ScheduleJob
C:\WINDOWS\system32\tasks\Microsoft\Windows\Windows Defender\Windows Defender Verification - %ProgramFiles%\Windows Defender\MpCmdRun.exe -IdleTask -TaskName WdVerification
C:\WINDOWS\system32\tasks\Microsoft\Windows\WCM\WiFiTask - %SystemRoot%\System32\WiFiTask.exe
C:\WINDOWS\system32\tasks\Microsoft\Windows\UPnP\UPnPHostConfig - sc.exe config upnphost start= auto
C:\WINDOWS\system32\tasks\Microsoft\Windows\UpdateOrchestrator\Maintenance Install - %systemroot%\system32\usoclient.exe StartInstall
C:\WINDOWS\system32\tasks\Microsoft\Windows\UpdateOrchestrator\Policy Install - %systemroot%\system32\usoclient.exe StartInstall
C:\WINDOWS\system32\tasks\Microsoft\Windows\UpdateOrchestrator\Reboot - %systemroot%\system32\MusNotification.exe
C:\WINDOWS\system32\tasks\Microsoft\Windows\UpdateOrchestrator\Refresh Settings - %systemroot%\system32\usoclient.exe RefreshSettings
C:\WINDOWS\system32\tasks\Microsoft\Windows\UpdateOrchestrator\Resume On Boot - %systemroot%\system32\usoclient.exe ResumeUpdate
C:\WINDOWS\system32\tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Scan - %systemroot%\system32\usoclient.exe StartScan
C:\WINDOWS\system32\tasks\Microsoft\Windows\UpdateOrchestrator\USO_UxBroker_Display - %systemroot%\system32\MusNotification.exe Display
C:\WINDOWS\system32\tasks\Microsoft\Windows\UpdateOrchestrator\USO_UxBroker_ReadyToReboot - %systemroot%\system32\MusNotification.exe ReadyToReboot
C:\WINDOWS\system32\tasks\Microsoft\Windows\Time Zone\SynchronizeTimeZone - %windir%\system32\tzsync.exe
C:\WINDOWS\system32\tasks\Microsoft\Windows\Time Synchronization\SynchronizeTime - %windir%\system32\sc.exe start w32time task_started
C:\WINDOWS\system32\tasks\Microsoft\Windows\SystemRestore\SR - %windir%\system32\srtasks.exe ExecuteScheduledSPPCreation
C:\WINDOWS\system32\tasks\Microsoft\Windows\Sysmain\WsSwapAssessmentTask - %windir%\system32\rundll32.exe sysmain.dll,PfSvWsSwapAssessmentTask
C:\WINDOWS\system32\tasks\Microsoft\Windows\Storage Tiers Management\Storage Tiers Optimization - %windir%\system32\defrag.exe -c -h -g -# -m 8 -i 13500
C:\WINDOWS\system32\tasks\Microsoft\Windows\Speech\SpeechModelDownloadTask - %windir%\system32\speech_onecore\common\SpeechModelDownload.exe
C:\WINDOWS\system32\tasks\Microsoft\Windows\SpacePort\SpaceAgentTask - %windir%\system32\SpaceAgent.exe
C:\WINDOWS\system32\tasks\Microsoft\Windows\SpacePort\SpaceManagerTask - %windir%\system32\spaceman.exe /Work
C:\WINDOWS\system32\tasks\Microsoft\Windows\Shell\FamilySafetyMonitor - %windir%\System32\wpcmon.exe
C:\WINDOWS\system32\tasks\Microsoft\Windows\SharedPC\Account Cleanup - %windir%\System32\rundll32.exe %windir%\System32\Windows.SharedPC.AccountManager.dll,StartMaintenance
C:\WINDOWS\system32\tasks\Microsoft\Windows\RemoteAssistance\RemoteAssistanceTask - %windir%\system32\RAServer.exe /offerraupdate
C:\WINDOWS\system32\tasks\Microsoft\Windows\Plug and Play\Sysprep Generalize Drivers - %SystemRoot%\System32\drvinst.exe 6
C:\WINDOWS\system32\tasks\Microsoft\Windows\NlaSvc\WiFiTask - %SystemRoot%\System32\WiFiTask.exe nla
C:\WINDOWS\system32\tasks\Microsoft\Windows\NetTrace\GatherNetworkInfo - %windir%\system32\gatherNetworkInfo.vbs
C:\WINDOWS\system32\tasks\Microsoft\Windows\MUI\LPRemove - %windir%\system32\lpremove.exe
C:\WINDOWS\system32\tasks\Microsoft\Windows\Mobile Broadband Accounts\MNO Metadata Parser - %SystemRoot%\System32\MbaeParserTask.exe
C:\WINDOWS\system32\tasks\Microsoft\Windows\Management\Provisioning\Logon - %windir%\system32\ProvTool.exe /turn 5
C:\WINDOWS\system32\tasks\Microsoft\Windows\Location\Notifications - %windir%\System32\LocationNotificationWindows.exe
C:\WINDOWS\system32\tasks\Microsoft\Windows\Location\WindowsActionDialog - %windir%\System32\WindowsActionDialog.exe
C:\WINDOWS\system32\tasks\Microsoft\Windows\Feedback\Siuf\DmClient - %windir%\system32\dmclient.exe
C:\WINDOWS\system32\tasks\Microsoft\Windows\Feedback\Siuf\DmClientOnScenarioDownload - %windir%\system32\dmclient.exe utcwnf
C:\WINDOWS\system32\tasks\Microsoft\Windows\DUSM\dusmtask - %SystemRoot%\System32\dusmtask.exe
C:\WINDOWS\system32\tasks\Microsoft\Windows\DiskFootprint\Diagnostics - %windir%\system32\disksnapshot.exe -z
C:\WINDOWS\system32\tasks\Microsoft\Windows\DiskDiagnostic\Microsoft-Windows-DiskDiagnosticDataCollector - %windir%\system32\rundll32.exe dfdts.dll,DfdGetDefaultPolicyAndSMART
C:\WINDOWS\system32\tasks\Microsoft\Windows\DiskDiagnostic\Microsoft-Windows-DiskDiagnosticResolver - %windir%\system32\DFDWiz.exe
C:\WINDOWS\system32\tasks\Microsoft\Windows\DiskCleanup\SilentCleanup - %windir%\system32\cleanmgr.exe /autoclean /d %systemdrive%
C:\WINDOWS\system32\tasks\Microsoft\Windows\Device Information\Device - %windir%\system32\devicecensus.exe
C:\WINDOWS\system32\tasks\Microsoft\Windows\Defrag\ScheduledDefrag - %windir%\system32\defrag.exe -c -h -o -$
C:\WINDOWS\system32\tasks\Microsoft\Windows\Customer Experience Improvement Program\Consolidator - %SystemRoot%\System32\wsqmcons.exe
C:\WINDOWS\system32\tasks\Microsoft\Windows\Clip\License Validation - %SystemRoot%\system32\ClipUp.exe -p -s -o
C:\WINDOWS\system32\tasks\Microsoft\Windows\Bluetooth\UninstallDeviceTask - BthUdTask.exe $(Arg0)
C:\WINDOWS\system32\tasks\Microsoft\Windows\Autochk\Proxy - %windir%\system32\rundll32.exe /d acproxy.dll,PerformAutochkOperations
C:\WINDOWS\system32\tasks\Microsoft\Windows\AppxDeploymentClient\Pre-staged app cleanup - %windir%\system32\rundll32.exe %windir%\system32\AppxDeploymentClient.dll,AppxPreStageCleanupRunTask
C:\WINDOWS\system32\tasks\Microsoft\Windows\ApplicationData\appuriverifierdaily - %windir%\system32\AppHostRegistrationVerifier.exe
C:\WINDOWS\system32\tasks\Microsoft\Windows\ApplicationData\appuriverifierinstall - %windir%\system32\AppHostRegistrationVerifier.exe
C:\WINDOWS\system32\tasks\Microsoft\Windows\ApplicationData\CleanupTemporaryState - %windir%\system32\rundll32.exe Windows.Storage.ApplicationData.dll,CleanupTemporaryState
C:\WINDOWS\system32\tasks\Microsoft\Windows\ApplicationData\DsSvcCleanup - %windir%\system32\dstokenclean.exe
C:\WINDOWS\system32\tasks\Microsoft\Windows\Application Experience\Microsoft Compatibility Appraiser - %windir%\system32\compattelrunner.exe
C:\WINDOWS\system32\tasks\Microsoft\Windows\Application Experience\ProgramDataUpdater - %windir%\system32\compattelrunner.exe -maintenance
C:\WINDOWS\system32\tasks\Microsoft\Windows\Application Experience\StartupAppTask - %windir%\system32\rundll32.exe Startupscan.dll,SusRunTask
C:\WINDOWS\system32\tasks\Microsoft\Windows\AppID\PolicyConverter - %windir%\system32\appidpolicyconverter.exe
C:\WINDOWS\system32\tasks\Microsoft\Windows\AppID\VerifiedPublisherCertStoreCheck - %windir%\system32\appidcertstorecheck.exe

======Registry dump ======


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes]
"DefaultScope"={0633EE93-D776-472f-A0FF-E1416B8B2E3A}
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}]
"URL"=http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC


[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Internet Explorer\SearchScopes]
"DefaultScope"={0633EE93-D776-472f-A0FF-E1416B8B2E3A}
[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}]
"URL"=http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"WindowsDefender"=C:\Program Files\Windows Defender\MSASCuiL.exe [2016-11-21 631808]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"OneDrive"=C:\Users\Petr Půček\AppData\Local\Microsoft\OneDrive\OneDrive.exe [2017-02-22 1517280]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"Uninstall 17.3.6381.0405\amd64"=C:\WINDOWS\system32\cmd.exe [2016-07-16 232960]
"Uninstall 17.3.6381.0405"=C:\WINDOWS\system32\cmd.exe [2016-07-16 232960]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED}

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders" = credssp.dll

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=5
"ConsentPromptBehaviorUser"=3
"DSCAutomationHostEnabled"=2
"EnableCursorSuppression"=1
"EnableUIADesktopToggle"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"ForceActiveDesktopOn"=0
"NoActiveDesktop"=1
"NoActiveDesktopChanges"=1

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"midimapper"=midimap.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.l3acm"=C:\Windows\System32\l3codeca.acm
"msacm.msadpcm"=msadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"vidc.i420"=lvcod64.dll
"vidc.iyuv"=iyuv_32.dll
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"vidc.uyvy"=msyuv.dll
"vidc.yuy2"=msyuv.dll
"vidc.yvu9"=tsbyuv.dll
"vidc.yvyu"=msyuv.dll
"wavemapper"=msacm32.drv
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv
"wave1"=wdmaud.drv
"midi1"=wdmaud.drv
"mixer1"=wdmaud.drv
"aux1"=wdmaud.drv
"wave2"=wdmaud.drv
"midi2"=wdmaud.drv
"mixer2"=wdmaud.drv
"MSVideo8"=VfWWDM32.dll
"MSVideo"=vfwwdm32.dll

====== File associations ======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*

====== List of files/folders created in the last 1 month ======

2017-02-23 02:16:59 ----SHD---- C:\ProgramData\Šablony
2017-02-23 02:16:59 ----SHD---- C:\ProgramData\Plocha
2017-02-23 02:16:59 ----SHD---- C:\ProgramData\Nabídka Start
2017-02-23 02:16:59 ----SHD---- C:\ProgramData\Dokumenty
2017-02-23 02:16:59 ----SHD---- C:\ProgramData\Data aplikací
2017-02-23 02:16:59 ----SHD---- C:\Documents and Settings
2017-02-23 02:16:56 ----SHD---- C:\Recovery
2017-02-23 02:15:56 ----ASH---- C:\hiberfil.sys
2017-02-23 02:11:53 ----A---- C:\WINDOWS\system32\nvsvcr.dll
2017-02-23 02:11:53 ----A---- C:\WINDOWS\system32\nvsvc64.dll
2017-02-23 02:11:53 ----A---- C:\WINDOWS\system32\nvshext.dll
2017-02-23 02:11:53 ----A---- C:\WINDOWS\system32\nvmctray.dll
2017-02-23 02:11:53 ----A---- C:\WINDOWS\system32\nvcpl.dll
2017-02-23 02:11:53 ----A---- C:\WINDOWS\system32\nv3dappshextr.dll
2017-02-23 02:11:53 ----A---- C:\WINDOWS\system32\nv3dappshext.dll
2017-02-23 02:11:49 ----D---- C:\WINDOWS\SoftwareDistribution
2017-02-23 02:11:39 ----D---- C:\ProgramData\NVIDIA Corporation
2017-02-23 02:11:31 ----D---- C:\Program Files\NVIDIA Corporation
2017-02-23 02:11:31 ----D---- C:\Program Files (x86)\NVIDIA Corporation
2017-02-23 02:11:12 ----D---- C:\Program Files\Common Files\logishrd
2017-02-23 02:06:23 ----D---- C:\ProgramData\USOShared
2017-02-23 02:05:33 ----HD---- C:\Program Files\Uninstall Information
2017-02-23 02:05:32 ----AS---- C:\WINDOWS\bootstat.dat
2017-02-23 02:04:18 ----D---- C:\WINDOWS\system32\SleepStudy
2017-02-23 02:04:18 ----D---- C:\WINDOWS\ServiceProfiles
2017-02-23 02:04:15 ----SD---- C:\WINDOWS\system32\Microsoft
2017-02-23 02:04:02 ----A---- C:\WINDOWS\system32\FNTCACHE.DAT
2017-02-22 17:30:01 ----D---- C:\rsit
2017-02-22 17:30:01 ----D---- C:\Program Files\trend micro
2017-02-22 17:25:22 ----D---- C:\Users\Petr Půček\AppData\Roaming\Skype
2017-02-22 17:24:41 ----D---- C:\ProgramData\Microsoft OneDrive
2017-02-22 17:24:15 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2017-02-22 17:23:08 ----SHD---- C:\$RECYCLE.BIN
2017-02-22 17:22:38 ----D---- C:\Users\Petr Půček\AppData\Roaming\Adobe
2017-02-22 17:22:10 ----SD---- C:\Users\Petr Půček\AppData\Roaming\Microsoft
2017-02-22 17:19:15 ----A---- C:\WINDOWS\SYSWOW64\PrintConfig.dll
2017-02-22 17:00:03 ----D---- C:\WINDOWS\InfusedApps
2017-02-22 16:59:53 ----DC---- C:\WINDOWS\Panther
2017-02-22 16:59:46 ----D---- C:\Windows.old
2017-02-22 16:59:15 ----D---- C:\WINDOWS\Setup
2017-02-22 16:53:48 ----D---- C:\WINDOWS\OCR
2017-02-22 16:53:39 ----A---- C:\WINDOWS\system32\perfi005.dat
2017-02-22 16:53:39 ----A---- C:\WINDOWS\system32\perfh005.dat
2017-02-22 16:53:39 ----A---- C:\WINDOWS\system32\perfd005.dat
2017-02-22 16:53:39 ----A---- C:\WINDOWS\system32\perfc005.dat
2017-02-22 16:53:13 ----D---- C:\WINDOWS\SYSWOW64\winrm
2017-02-22 16:53:13 ----D---- C:\WINDOWS\SYSWOW64\WCN
2017-02-22 16:53:13 ----D---- C:\WINDOWS\SYSWOW64\sysprep
2017-02-22 16:53:13 ----D---- C:\WINDOWS\SYSWOW64\slmgr
2017-02-22 16:53:13 ----D---- C:\WINDOWS\SYSWOW64\Printing_Admin_Scripts
2017-02-22 16:53:13 ----D---- C:\WINDOWS\SYSWOW64\en
2017-02-22 16:53:13 ----D---- C:\WINDOWS\SYSWOW64\drivers\UMDF
2017-02-22 16:53:13 ----D---- C:\WINDOWS\SYSWOW64\drivers\en-US
2017-02-22 16:53:13 ----D---- C:\WINDOWS\SYSWOW64\drivers\cs-CZ
2017-02-22 16:53:10 ----D---- C:\WINDOWS\SYSWOW64\cs
2017-02-22 16:53:09 ----D---- C:\WINDOWS\SYSWOW64\0409
2017-02-22 16:53:09 ----D---- C:\WINDOWS\system32\winrm
2017-02-22 16:53:09 ----D---- C:\WINDOWS\system32\WCN
2017-02-22 16:53:09 ----D---- C:\WINDOWS\system32\slmgr
2017-02-22 16:53:09 ----D---- C:\WINDOWS\system32\Printing_Admin_Scripts
2017-02-22 16:53:09 ----D---- C:\WINDOWS\system32\en
2017-02-22 16:53:07 ----D---- C:\WINDOWS\system32\drivers\en-US
2017-02-22 16:53:07 ----D---- C:\WINDOWS\system32\drivers\cs-CZ
2017-02-22 16:53:06 ----D---- C:\WINDOWS\system32\cs
2017-02-22 16:53:06 ----D---- C:\WINDOWS\system32\0409
2017-02-22 16:53:06 ----D---- C:\WINDOWS\en-US
2017-02-22 16:53:06 ----D---- C:\WINDOWS\DigitalLocker
2017-02-22 16:53:06 ----D---- C:\WINDOWS\cs-CZ
2017-02-22 16:49:58 ----A---- C:\WINDOWS\system32\perfi009.dat
2017-02-22 16:49:58 ----A---- C:\WINDOWS\system32\perfh009.dat
2017-02-22 16:49:58 ----A---- C:\WINDOWS\system32\perfd009.dat
2017-02-22 16:49:58 ----A---- C:\WINDOWS\system32\perfc009.dat
2017-02-22 16:49:38 ----A---- C:\WINDOWS\SYSWOW64\FlashPlayerApp.exe
2017-02-22 16:48:13 ----A---- C:\WINDOWS\SYSWOW64\NOISE.DAT
2017-02-22 16:48:13 ----A---- C:\WINDOWS\SYSWOW64\msclmd.dll
2017-02-22 16:48:12 ----A---- C:\WINDOWS\SYSWOW64\dssec.dat
2017-02-22 16:48:02 ----A---- C:\WINDOWS\system32\NOISE.DAT
2017-02-22 16:48:02 ----A---- C:\WINDOWS\system32\msclmd.dll
2017-02-22 16:48:01 ----A---- C:\WINDOWS\system32\dssec.dat
2017-02-22 16:47:56 ----RSH---- C:\WINDOWS\fonts\StaticCache.dat
2017-02-22 16:47:56 ----A---- C:\WINDOWS\fonts\desktop.ini
2017-02-22 16:47:54 ----ASH---- C:\Program Files\desktop.ini
2017-02-22 16:47:54 ----ASH---- C:\Program Files (x86)\desktop.ini
2017-02-22 16:47:54 ----A---- C:\WINDOWS\win.ini
2017-02-22 16:47:54 ----A---- C:\WINDOWS\system.ini
2017-02-22 16:47:53 ----SHD---- C:\Program Files\Windows Sidebar
2017-02-22 16:47:53 ----SHD---- C:\Program Files (x86)\Windows Sidebar
2017-02-22 16:47:53 ----SD---- C:\WINDOWS\SYSWOW64\Nui
2017-02-22 16:47:53 ----SD---- C:\WINDOWS\SYSWOW64\F12
2017-02-22 16:47:53 ----SD---- C:\WINDOWS\SYSWOW64\DiagSvcs
2017-02-22 16:47:53 ----SD---- C:\WINDOWS\SYSWOW64\Configuration
2017-02-22 16:47:53 ----SD---- C:\WINDOWS\system32\Nui
2017-02-22 16:47:53 ----SD---- C:\WINDOWS\system32\F12
2017-02-22 16:47:53 ----SD---- C:\WINDOWS\system32\dsc
2017-02-22 16:47:53 ----SD---- C:\WINDOWS\system32\DiagSvcs
2017-02-22 16:47:53 ----SD---- C:\WINDOWS\system32\Configuration
2017-02-22 16:47:53 ----SD---- C:\WINDOWS\Downloaded Program Files
2017-02-22 16:47:53 ----SD---- C:\ProgramData\Microsoft
2017-02-22 16:47:53 ----RSD---- C:\WINDOWS\Media
2017-02-22 16:47:53 ----RSD---- C:\WINDOWS\Fonts
2017-02-22 16:47:53 ----RD---- C:\WINDOWS\PrintDialog
2017-02-22 16:47:53 ----RD---- C:\WINDOWS\Offline Web Pages
2017-02-22 16:47:53 ----RD---- C:\WINDOWS\MiracastView
2017-02-22 16:47:53 ----RD---- C:\WINDOWS\Microsoft.NET
2017-02-22 16:47:53 ----RD---- C:\WINDOWS\ImmersiveControlPanel
2017-02-22 16:47:53 ----RD---- C:\WINDOWS\assembly
2017-02-22 16:47:53 ----RD---- C:\Program Files\Windows Defender
2017-02-22 16:47:53 ----HD---- C:\WINDOWS\Installer
2017-02-22 16:47:53 ----HD---- C:\WINDOWS\ELAMBKUP
2017-02-22 16:47:53 ----HD---- C:\ProgramData
2017-02-22 16:47:53 ----HD---- C:\Program Files\WindowsApps
2017-02-22 16:47:53 ----D---- C:\WINDOWS\Web
2017-02-22 16:47:53 ----D---- C:\WINDOWS\Vss
2017-02-22 16:47:53 ----D---- C:\WINDOWS\twain_32
2017-02-22 16:47:53 ----D---- C:\WINDOWS\tracing
2017-02-22 16:47:53 ----D---- C:\WINDOWS\Temp
2017-02-22 16:47:53 ----D---- C:\WINDOWS\Tasks
2017-02-22 16:47:53 ----D---- C:\WINDOWS\TAPI
2017-02-22 16:47:53 ----D---- C:\WINDOWS\SYSWOW64\zh-TW
2017-02-22 16:47:53 ----D---- C:\WINDOWS\SYSWOW64\zh-HK
2017-02-22 16:47:53 ----D---- C:\WINDOWS\SYSWOW64\zh-CN
2017-02-22 16:47:53 ----D---- C:\WINDOWS\SYSWOW64\WinMetadata
2017-02-22 16:47:53 ----D---- C:\WINDOWS\SYSWOW64\WindowsPowerShell
2017-02-22 16:47:53 ----D---- C:\WINDOWS\SYSWOW64\wbem
2017-02-22 16:47:53 ----D---- C:\WINDOWS\SYSWOW64\uk-UA
2017-02-22 16:47:53 ----D---- C:\WINDOWS\SYSWOW64\tr-TR
2017-02-22 16:47:53 ----D---- C:\WINDOWS\SYSWOW64\th-TH
2017-02-22 16:47:53 ----D---- C:\WINDOWS\SYSWOW64\Tasks
2017-02-22 16:47:53 ----D---- C:\WINDOWS\SYSWOW64\sv-SE
2017-02-22 16:47:53 ----D---- C:\WINDOWS\SYSWOW64\sru
2017-02-22 16:47:53 ----D---- C:\WINDOWS\SYSWOW64\sr-Latn-RS
2017-02-22 16:47:53 ----D---- C:\WINDOWS\SYSWOW64\sr-Latn-CS
2017-02-22 16:47:53 ----D---- C:\WINDOWS\SYSWOW64\sppui
2017-02-22 16:47:53 ----D---- C:\WINDOWS\SYSWOW64\spp
2017-02-22 16:47:53 ----D---- C:\WINDOWS\SYSWOW64\Speech_OneCore
2017-02-22 16:47:53 ----D---- C:\WINDOWS\SYSWOW64\Speech
2017-02-22 16:47:53 ----D---- C:\WINDOWS\SYSWOW64\SMI
2017-02-22 16:47:53 ----D---- C:\WINDOWS\SYSWOW64\sl-SI
2017-02-22 16:47:53 ----D---- C:\WINDOWS\SYSWOW64\sk-SK
2017-02-22 16:47:53 ----D---- C:\WINDOWS\SYSWOW64\setup
2017-02-22 16:47:53 ----D---- C:\WINDOWS\SYSWOW64\ru-RU
2017-02-22 16:47:53 ----D---- C:\WINDOWS\SYSWOW64\ro-RO
2017-02-22 16:47:53 ----D---- C:\WINDOWS\SYSWOW64\restore
2017-02-22 16:47:53 ----D---- C:\WINDOWS\SYSWOW64\Recovery
2017-02-22 16:47:53 ----D---- C:\WINDOWS\SYSWOW64\RasToast
2017-02-22 16:47:53 ----D---- C:\WINDOWS\SYSWOW64\ras
2017-02-22 16:47:53 ----D---- C:\WINDOWS\SYSWOW64\pt-PT
2017-02-22 16:47:53 ----D---- C:\WINDOWS\SYSWOW64\pt-BR
2017-02-22 16:47:53 ----D---- C:\WINDOWS\SYSWOW64\pl-PL
2017-02-22 16:47:53 ----D---- C:\WINDOWS\SYSWOW64\oobe
2017-02-22 16:47:53 ----D---- C:\WINDOWS\SYSWOW64\nl-NL
2017-02-22 16:47:53 ----D---- C:\WINDOWS\SYSWOW64\networklist
2017-02-22 16:47:53 ----D---- C:\WINDOWS\SYSWOW64\NDF
2017-02-22 16:47:53 ----D---- C:\WINDOWS\SYSWOW64\nb-NO
2017-02-22 16:47:53 ----D---- C:\WINDOWS\SYSWOW64\MUI
2017-02-22 16:47:53 ----D---- C:\WINDOWS\SYSWOW64\MsDtc
2017-02-22 16:47:53 ----D---- C:\WINDOWS\SYSWOW64\MSDRM
2017-02-22 16:47:53 ----D---- C:\WINDOWS\SYSWOW64\migwiz
2017-02-22 16:47:53 ----D---- C:\WINDOWS\SYSWOW64\migration
2017-02-22 16:47:53 ----D---- C:\WINDOWS\SYSWOW64\MailContactsCalendarSync
2017-02-22 16:47:53 ----D---- C:\WINDOWS\SYSWOW64\Macromed
2017-02-22 16:47:53 ----D---- C:\WINDOWS\SYSWOW64\lv-LV
2017-02-22 16:47:53 ----D---- C:\WINDOWS\SYSWOW64\lt-LT
2017-02-22 16:47:53 ----D---- C:\WINDOWS\SYSWOW64\LogFiles
2017-02-22 16:47:53 ----D---- C:\WINDOWS\SYSWOW64\Licenses
2017-02-22 16:47:53 ----D---- C:\WINDOWS\SYSWOW64\ko-KR
2017-02-22 16:47:53 ----D---- C:\WINDOWS\SYSWOW64\ja-JP
2017-02-22 16:47:53 ----D---- C:\WINDOWS\SYSWOW64\it-IT
2017-02-22 16:47:53 ----D---- C:\WINDOWS\SYSWOW64\Ipmi
2017-02-22 16:47:53 ----D---- C:\WINDOWS\SYSWOW64\InstallShield
2017-02-22 16:47:53 ----D---- C:\WINDOWS\SYSWOW64\InputMethod
2017-02-22 16:47:53 ----D---- C:\WINDOWS\SYSWOW64\inetsrv
2017-02-22 16:47:53 ----D---- C:\WINDOWS\SYSWOW64\IME
2017-02-22 16:47:53 ----D---- C:\WINDOWS\SYSWOW64\icsxml
2017-02-22 16:47:53 ----D---- C:\WINDOWS\SYSWOW64\hu-HU
2017-02-22 16:47:53 ----D---- C:\WINDOWS\SYSWOW64\hr-HR
2017-02-22 16:47:53 ----D---- C:\WINDOWS\SYSWOW64\he-IL
2017-02-22 16:47:53 ----D---- C:\WINDOWS\SYSWOW64\GroupPolicyUsers
2017-02-22 16:47:53 ----D---- C:\WINDOWS\SYSWOW64\GroupPolicy
2017-02-22 16:47:53 ----D---- C:\WINDOWS\SYSWOW64\FxsTmp
2017-02-22 16:47:53 ----D---- C:\WINDOWS\SYSWOW64\fr-FR
2017-02-22 16:47:53 ----D---- C:\WINDOWS\SYSWOW64\fr-CA
2017-02-22 16:47:53 ----D---- C:\WINDOWS\SYSWOW64\fi-FI
2017-02-22 16:47:53 ----D---- C:\WINDOWS\SYSWOW64\et-EE
2017-02-22 16:47:53 ----D---- C:\WINDOWS\SYSWOW64\es-MX
2017-02-22 16:47:53 ----D---- C:\WINDOWS\SYSWOW64\es-ES
2017-02-22 16:47:53 ----D---- C:\WINDOWS\SYSWOW64\en-US
2017-02-22 16:47:53 ----D---- C:\WINDOWS\SYSWOW64\en-GB
2017-02-22 16:47:53 ----D---- C:\WINDOWS\SYSWOW64\el-GR
2017-02-22 16:47:53 ----D---- C:\WINDOWS\SYSWOW64\DriverStore
2017-02-22 16:47:53 ----D---- C:\WINDOWS\SYSWOW64\drivers
2017-02-22 16:47:53 ----D---- C:\WINDOWS\SYSWOW64\downlevel
2017-02-22 16:47:53 ----D---- C:\WINDOWS\SYSWOW64\Dism
2017-02-22 16:47:53 ----D---- C:\WINDOWS\SYSWOW64\de-DE
2017-02-22 16:47:53 ----D---- C:\WINDOWS\SYSWOW64\da-DK
2017-02-22 16:47:53 ----D---- C:\WINDOWS\SYSWOW64\cs-CZ
2017-02-22 16:47:53 ----D---- C:\WINDOWS\SYSWOW64\config
2017-02-22 16:47:53 ----D---- C:\WINDOWS\SYSWOW64\Com
2017-02-22 16:47:53 ----D---- C:\WINDOWS\SYSWOW64\catroot
2017-02-22 16:47:53 ----D---- C:\WINDOWS\SYSWOW64\Bthprops
2017-02-22 16:47:53 ----D---- C:\WINDOWS\SYSWOW64\bg-BG
2017-02-22 16:47:53 ----D---- C:\WINDOWS\SYSWOW64\ar-SA
2017-02-22 16:47:53 ----D---- C:\WINDOWS\SYSWOW64\AppLocker
2017-02-22 16:47:53 ----D---- C:\WINDOWS\SYSWOW64\AdvancedInstallers
2017-02-22 16:47:53 ----D---- C:\WINDOWS\syswow64
2017-02-22 16:47:53 ----D---- C:\WINDOWS\SystemResources
2017-02-22 16:47:53 ----D---- C:\WINDOWS\SystemApps
2017-02-22 16:47:53 ----D---- C:\WINDOWS\system32\zh-TW
2017-02-22 16:47:53 ----D---- C:\WINDOWS\system32\zh-HK
2017-02-22 16:47:53 ----D---- C:\WINDOWS\system32\zh-CN
2017-02-22 16:47:53 ----D---- C:\WINDOWS\system32\WinMetadata
2017-02-22 16:47:53 ----D---- C:\WINDOWS\system32\winevt
2017-02-22 16:47:53 ----D---- C:\WINDOWS\system32\WindowsPowerShell
2017-02-22 16:47:53 ----D---- C:\WINDOWS\system32\WinBioPlugIns
2017-02-22 16:47:53 ----D---- C:\WINDOWS\system32\WinBioDatabase
2017-02-22 16:47:53 ----D---- C:\WINDOWS\system32\WDI
2017-02-22 16:47:53 ----D---- C:\WINDOWS\system32\wbem
2017-02-22 16:47:53 ----D---- C:\WINDOWS\system32\uk-UA
2017-02-22 16:47:53 ----D---- C:\WINDOWS\system32\tr-TR
2017-02-22 16:47:53 ----D---- C:\WINDOWS\system32\th-TH
2017-02-22 16:47:53 ----D---- C:\WINDOWS\system32\Tasks
2017-02-22 16:47:53 ----D---- C:\WINDOWS\system32\SystemResetPlatform
2017-02-22 16:47:53 ----D---- C:\WINDOWS\system32\Sysprep
2017-02-22 16:47:53 ----D---- C:\WINDOWS\system32\sv-SE
2017-02-22 16:47:53 ----D---- C:\WINDOWS\system32\sru
2017-02-22 16:47:53 ----D---- C:\WINDOWS\system32\sr-Latn-RS
2017-02-22 16:47:53 ----D---- C:\WINDOWS\system32\sr-Latn-CS
2017-02-22 16:47:53 ----D---- C:\WINDOWS\system32\sppui
2017-02-22 16:47:53 ----D---- C:\WINDOWS\system32\spp
2017-02-22 16:47:53 ----D---- C:\WINDOWS\system32\spool
2017-02-22 16:47:53 ----D---- C:\WINDOWS\system32\Speech_OneCore
2017-02-22 16:47:53 ----D---- C:\WINDOWS\system32\Speech
2017-02-22 16:47:53 ----D---- C:\WINDOWS\system32\sl-SI
2017-02-22 16:47:53 ----D---- C:\WINDOWS\system32\sk-SK
2017-02-22 16:47:53 ----D---- C:\WINDOWS\system32\setup
2017-02-22 16:47:53 ----D---- C:\WINDOWS\system32\SecureBootUpdates
2017-02-22 16:47:53 ----D---- C:\WINDOWS\system32\ru-RU
2017-02-22 16:47:53 ----D---- C:\WINDOWS\system32\ro-RO
2017-02-22 16:47:53 ----D---- C:\WINDOWS\system32\restore
2017-02-22 16:47:53 ----D---- C:\WINDOWS\system32\Recovery
2017-02-22 16:47:53 ----D---- C:\WINDOWS\system32\RasToast
2017-02-22 16:47:53 ----D---- C:\WINDOWS\system32\ras
2017-02-22 16:47:53 ----D---- C:\WINDOWS\system32\pt-PT
2017-02-22 16:47:53 ----D---- C:\WINDOWS\system32\pt-BR
2017-02-22 16:47:53 ----D---- C:\WINDOWS\system32\ProximityToast
2017-02-22 16:47:53 ----D---- C:\WINDOWS\system32\PointOfService
2017-02-22 16:47:53 ----D---- C:\WINDOWS\system32\pl-PL
2017-02-22 16:47:53 ----D---- C:\WINDOWS\system32\oobe
2017-02-22 16:47:53 ----D---- C:\WINDOWS\system32\nl-NL
2017-02-22 16:47:53 ----D---- C:\WINDOWS\system32\networklist
2017-02-22 16:47:53 ----D---- C:\WINDOWS\system32\NDF
2017-02-22 16:47:53 ----D---- C:\WINDOWS\system32\nb-NO
2017-02-22 16:47:53 ----D---- C:\WINDOWS\system32\MUI
2017-02-22 16:47:53 ----D---- C:\WINDOWS\system32\MsDtc
2017-02-22 16:47:53 ----D---- C:\WINDOWS\system32\MSDRM
2017-02-22 16:47:53 ----D---- C:\WINDOWS\system32\migwiz
2017-02-22 16:47:53 ----D---- C:\WINDOWS\system32\migration
2017-02-22 16:47:53 ----D---- C:\WINDOWS\system32\MailContactsCalendarSync
2017-02-22 16:47:53 ----D---- C:\WINDOWS\system32\Macromed
2017-02-22 16:47:53 ----D---- C:\WINDOWS\system32\lv-LV
2017-02-22 16:47:53 ----D---- C:\WINDOWS\system32\lt-LT
2017-02-22 16:47:53 ----D---- C:\WINDOWS\system32\LogFiles
2017-02-22 16:47:53 ----D---- C:\WINDOWS\system32\Licenses
2017-02-22 16:47:53 ----D---- C:\WINDOWS\system32\ko-KR
2017-02-22 16:47:53 ----D---- C:\WINDOWS\system32\ja-jp
2017-02-22 16:47:53 ----D---- C:\WINDOWS\system32\it-IT
2017-02-22 16:47:53 ----D---- C:\WINDOWS\system32\Ipmi
2017-02-22 16:47:53 ----D---- C:\WINDOWS\system32\InputMethod
2017-02-22 16:47:53 ----D---- C:\WINDOWS\system32\inetsrv
2017-02-22 16:47:53 ----D---- C:\WINDOWS\system32\IME
2017-02-22 16:47:53 ----D---- C:\WINDOWS\system32\icsxml
2017-02-22 16:47:53 ----D---- C:\WINDOWS\system32\ias
2017-02-22 16:47:53 ----D---- C:\WINDOWS\system32\hu-HU
2017-02-22 16:47:53 ----D---- C:\WINDOWS\system32\hr-HR
2017-02-22 16:47:53 ----D---- C:\WINDOWS\system32\he-IL
2017-02-22 16:47:53 ----D---- C:\WINDOWS\system32\GroupPolicyUsers
2017-02-22 16:47:53 ----D---- C:\WINDOWS\system32\GroupPolicy
2017-02-22 16:47:53 ----D---- C:\WINDOWS\system32\FxsTmp
2017-02-22 16:47:53 ----D---- C:\WINDOWS\system32\fr-FR
2017-02-22 16:47:53 ----D---- C:\WINDOWS\system32\fr-CA
2017-02-22 16:47:53 ----D---- C:\WINDOWS\system32\fi-FI
2017-02-22 16:47:53 ----D---- C:\WINDOWS\system32\et-EE
2017-02-22 16:47:53 ----D---- C:\WINDOWS\system32\es-MX
2017-02-22 16:47:53 ----D---- C:\WINDOWS\system32\es-ES
2017-02-22 16:47:53 ----D---- C:\WINDOWS\system32\en-US
2017-02-22 16:47:53 ----D---- C:\WINDOWS\system32\en-GB
2017-02-22 16:47:53 ----D---- C:\WINDOWS\system32\el-GR
2017-02-22 16:47:53 ----D---- C:\WINDOWS\system32\drivers\etc
2017-02-22 16:47:53 ----D---- C:\WINDOWS\system32\downlevel
2017-02-22 16:47:53 ----D---- C:\WINDOWS\system32\Dism
2017-02-22 16:47:53 ----D---- C:\WINDOWS\system32\de-DE
2017-02-22 16:47:53 ----D---- C:\WINDOWS\system32\DDFs
2017-02-22 16:47:53 ----D---- C:\WINDOWS\system32\da-DK
2017-02-22 16:47:53 ----D---- C:\WINDOWS\system32\cs-CZ
2017-02-22 16:47:53 ----D---- C:\WINDOWS\system32\Com
2017-02-22 16:47:53 ----D---- C:\WINDOWS\system32\CodeIntegrity
2017-02-22 16:47:53 ----D---- C:\WINDOWS\system32\catroot2
2017-02-22 16:47:53 ----D---- C:\WINDOWS\system32\Bthprops
2017-02-22 16:47:53 ----D---- C:\WINDOWS\system32\Boot
2017-02-22 16:47:53 ----D---- C:\WINDOWS\system32\bg-BG
2017-02-22 16:47:53 ----D---- C:\WINDOWS\system32\ar-SA
2017-02-22 16:47:53 ----D---- C:\WINDOWS\system32\appraiser
2017-02-22 16:47:53 ----D---- C:\WINDOWS\system32\AppLocker
2017-02-22 16:47:53 ----D---- C:\WINDOWS\system32\AdvancedInstallers
2017-02-22 16:47:53 ----D---- C:\WINDOWS\System
2017-02-22 16:47:53 ----D---- C:\WINDOWS\Speech_OneCore
2017-02-22 16:47:53 ----D---- C:\WINDOWS\Speech
2017-02-22 16:47:53 ----D---- C:\WINDOWS\SKB
2017-02-22 16:47:53 ----D---- C:\WINDOWS\schemas
2017-02-22 16:47:53 ----D---- C:\WINDOWS\SchCache
2017-02-22 16:47:53 ----D---- C:\WINDOWS\ShellExperiences
2017-02-22 16:47:53 ----D---- C:\WINDOWS\security
2017-02-22 16:47:53 ----D---- C:\WINDOWS\Resources
2017-02-22 16:47:53 ----D---- C:\WINDOWS\rescache
2017-02-22 16:47:53 ----D---- C:\WINDOWS\Registration
2017-02-22 16:47:53 ----D---- C:\WINDOWS\Provisioning
2017-02-22 16:47:53 ----D---- C:\WINDOWS\prefetch
2017-02-22 16:47:53 ----D---- C:\WINDOWS\PolicyDefinitions
2017-02-22 16:47:53 ----D---- C:\WINDOWS\PLA
2017-02-22 16:47:53 ----D---- C:\WINDOWS\Performance
2017-02-22 16:47:53 ----D---- C:\WINDOWS\ModemLogs
2017-02-22 16:47:53 ----D---- C:\WINDOWS\Migration
2017-02-22 16:47:53 ----D---- C:\WINDOWS\Logs
2017-02-22 16:47:53 ----D---- C:\WINDOWS\LiveKernelReports
2017-02-22 16:47:53 ----D---- C:\WINDOWS\L2Schemas
2017-02-22 16:47:53 ----D---- C:\WINDOWS\InputMethod
2017-02-22 16:47:53 ----D---- C:\WINDOWS\IME
2017-02-22 16:47:53 ----D---- C:\WINDOWS\Help
2017-02-22 16:47:53 ----D---- C:\WINDOWS\Globalization
2017-02-22 16:47:53 ----D---- C:\WINDOWS\GameBarPresenceWriter
2017-02-22 16:47:53 ----D---- C:\WINDOWS\diagnostics
2017-02-22 16:47:53 ----D---- C:\WINDOWS\debug
2017-02-22 16:47:53 ----D---- C:\WINDOWS\Cursors
2017-02-22 16:47:53 ----D---- C:\WINDOWS\Branding
2017-02-22 16:47:53 ----D---- C:\WINDOWS\Boot
2017-02-22 16:47:53 ----D---- C:\WINDOWS\bcastdvr
2017-02-22 16:47:53 ----D---- C:\WINDOWS\AppReadiness
2017-02-22 16:47:53 ----D---- C:\WINDOWS\AppPatch
2017-02-22 16:47:53 ----D---- C:\WINDOWS\appcompat
2017-02-22 16:47:53 ----D---- C:\WINDOWS\addins
2017-02-22 16:47:53 ----D---- C:\ProgramData\USOPrivate
2017-02-22 16:47:53 ----D---- C:\ProgramData\SoftwareDistribution
2017-02-22 16:47:53 ----D---- C:\ProgramData\regid.1991-06.com.microsoft
2017-02-22 16:47:53 ----D---- C:\ProgramData\Comms
2017-02-22 16:47:53 ----D---- C:\Program Files\WindowsPowerShell
2017-02-22 16:47:53 ----D---- C:\Program Files\Windows Portable Devices
2017-02-22 16:47:53 ----D---- C:\Program Files\Windows Photo Viewer
2017-02-22 16:47:53 ----D---- C:\Program Files\Windows NT
2017-02-22 16:47:53 ----D---- C:\Program Files\Windows Multimedia Platform
2017-02-22 16:47:53 ----D---- C:\Program Files\Windows Media Player
2017-02-22 16:47:53 ----D---- C:\Program Files\Windows Mail
2017-02-22 16:47:53 ----D---- C:\Program Files\Internet Explorer
2017-02-22 16:47:53 ----D---- C:\Program Files\Common Files\System
2017-02-22 16:47:53 ----D---- C:\Program Files\Common Files\Services
2017-02-22 16:47:53 ----D---- C:\Program Files\Common Files\microsoft shared
2017-02-22 16:47:53 ----D---- C:\Program Files (x86)\WindowsPowerShell
2017-02-22 16:47:53 ----D---- C:\Program Files (x86)\Windows Portable Devices
2017-02-22 16:47:53 ----D---- C:\Program Files (x86)\Windows Photo Viewer
2017-02-22 16:47:53 ----D---- C:\Program Files (x86)\Windows NT
2017-02-22 16:47:53 ----D---- C:\Program Files (x86)\Windows Multimedia Platform
2017-02-22 16:47:53 ----D---- C:\Program Files (x86)\Windows Media Player
2017-02-22 16:47:53 ----D---- C:\Program Files (x86)\Windows Mail
2017-02-22 16:47:53 ----D---- C:\Program Files (x86)\Windows Defender
2017-02-22 16:47:53 ----D---- C:\Program Files (x86)\Microsoft.NET
2017-02-22 16:47:53 ----D---- C:\Program Files (x86)\Internet Explorer
2017-02-22 16:47:53 ----D---- C:\PerfLogs
2017-02-22 16:47:39 ----D---- C:\WINDOWS\system32\drivers\UMDF
2017-02-22 16:47:39 ----D---- C:\WINDOWS\system32\drivers
2017-02-22 16:46:40 ----D---- C:\WINDOWS\INF
2017-02-22 16:36:11 ----D---- C:\WINDOWS\CbsTemp
2017-02-22 16:33:22 ----RD---- C:\Users
2017-02-22 16:33:22 ----RD---- C:\Program Files (x86)
2017-02-22 16:33:22 ----RD---- C:\Program Files
2017-02-22 16:33:22 ----D---- C:\WINDOWS\WinSxS
2017-02-22 16:33:22 ----D---- C:\WINDOWS\system32\SMI
2017-02-22 16:33:22 ----D---- C:\WINDOWS\system32\DriverStore
2017-02-22 16:33:22 ----D---- C:\WINDOWS\system32\config
2017-02-22 16:33:22 ----D---- C:\WINDOWS\system32\CatRoot
2017-02-22 16:33:22 ----D---- C:\WINDOWS\System32
2017-02-22 16:33:22 ----D---- C:\WINDOWS\servicing
2017-02-22 16:33:22 ----D---- C:\Windows
2017-02-22 16:33:22 ----D---- C:\Program Files\Common Files
2017-02-22 16:33:22 ----D---- C:\Program Files (x86)\Common Files
2017-02-22 16:33:20 ----D---- C:\$WINDOWS.~BT
2017-02-22 16:11:09 ----HD---- C:\$SysReset

====== List of files/folders modified in the last 1 month ======

2017-02-22 16:58:03 ----A---- C:\WINDOWS\system32\bootux.dll
2017-02-22 15:20:02 ----SHD---- C:\System Volume Information

File C:\WINDOWS\system32\winlogon.exe is digitally signed
File C:\WINDOWS\system32\wininit.exe is digitally signed
File C:\WINDOWS\explorer.exe is digitally signed
File C:\WINDOWS\SysWOW64\explorer.exe is digitally signed
File C:\WINDOWS\system32\svchost.exe is digitally signed
File C:\WINDOWS\SysWOW64\svchost.exe is digitally signed
File C:\WINDOWS\system32\services.exe is digitally signed
File C:\WINDOWS\system32\User32.dll is digitally signed
File C:\WINDOWS\SysWOW64\User32.dll is digitally signed
File C:\WINDOWS\system32\userinit.exe is digitally signed
File C:\WINDOWS\SysWOW64\userinit.exe is digitally signed
File C:\WINDOWS\system32\rpcss.dll is digitally signed
File C:\WINDOWS\system32\Drivers\volsnap.sys is digitally signed

====== List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled) ======

R0 iorate;@%SystemRoot%\system32\drivers\iorate.sys,-100; C:\WINDOWS\system32\drivers\iorate.sys [2016-11-21 48992]
R0 volmgr;@volmgr.inf,%volmgr_svcdesc%;Volume Manager Driver; C:\WINDOWS\System32\drivers\volmgr.sys [2016-07-16 80224]
R0 volmgrx;@%SystemRoot%\system32\drivers\volmgrx.sys,-100; C:\WINDOWS\System32\drivers\volmgrx.sys [2016-07-16 367456]
R2 clreg;@%SystemRoot%\system32\drivers\registry.sys,-100; C:\WINDOWS\System32\drivers\registry.sys [2016-07-16 70144]
R3 LVRS64;@oem13.inf,%lvrs.SrvDesc%;Logitech RightSound Filter Driver; C:\WINDOWS\system32\DRIVERS\lvrs64.sys [2012-10-26 351520]
R3 LVUVC64;@oem11.inf,%PID_0825_DD%(UVC);Logitech HD Webcam C270(UVC); C:\WINDOWS\system32\DRIVERS\lvuvc64.sys [2012-10-26 4758176]
R3 NVHDA;@oem2.inf,%NVHDA.SvcDesc%;Service for NVIDIA High Definition Audio Driver; C:\WINDOWS\system32\drivers\nvhda64v.sys [2017-01-04 221640]
R3 nvlddmkm;nvlddmkm; C:\WINDOWS\System32\DriverStore\FileRepository\nv_dispiwu.inf_amd64_b67dc924fff8de6d\nvlddmkm.sys [2017-01-04 14199224]
R3 RTL2832U_IRHID;@oem14.inf,%RTL2832U_IRHID%;HID Infrared Remote Receiver; C:\WINDOWS\System32\drivers\RTL2832U_IRHID.sys [2009-07-13 42912]
R3 RTL2832UBDA;@oem7.inf,%RTLUSBDEV.BDA_Desc%;REALTEK 2832U BDA Driver; C:\WINDOWS\system32\drivers\RTL2832UBDA.sys [2010-07-01 224488]
R3 RTL2832UUSB;@oem7.inf,%RTLUSBDEV.USB_Desc%;REALTEK 2832U USB Driver; C:\WINDOWS\System32\Drivers\RTL2832UUSB.sys [2010-07-01 39016]
R3 RTL8023x64;@netrtl64.inf,%Rtlnicx64.Service.DispName%;Realtek 10/100 NIC Family NDIS x64 Driver; C:\WINDOWS\System32\drivers\Rtnic64.sys [2016-07-16 51712]
R3 usbaudio;@wdma_usb.inf,%USBAudio.SvcDesc%;Ovladač zvuků USB (WDM); C:\WINDOWS\system32\drivers\usbaudio.sys [2016-07-16 132096]
S0 megasas2i;megasas2i; C:\WINDOWS\System32\drivers\MegaSas2i.sys [2016-11-21 64352]
S0 scmbus;@scmbus.inf,%scmbus.SvcDesc%;Microsoft Storage Class Memory Bus Driver; C:\WINDOWS\System32\drivers\scmbus.sys [2016-07-16 88416]
S3 AcpiDev;@acpidev.inf,%AcpiDev.SvcDesc%;ACPI Devices driver; C:\WINDOWS\System32\drivers\AcpiDev.sys [2016-07-16 18432]
S3 applockerfltr;@%systemroot%\system32\srpapi.dll,-102; C:\WINDOWS\system32\drivers\applockerfltr.sys [2016-07-16 15360]
S3 CompFilter64;UVCCompositeFilter; C:\WINDOWS\System32\drivers\lvbflt64.sys [2012-10-26 26784]
S3 dtlitescsibus;@oem1.inf,%DTLITESCSIBUS.DeviceDesc%;DAEMON Tools Lite Virtual SCSI Bus; C:\WINDOWS\System32\drivers\dtlitescsibus.sys [2016-03-26 30264]
S3 hvservice;@%SystemRoot%\system32\drivers\hvservice.sys,-16; C:\WINDOWS\system32\drivers\hvservice.sys [2016-11-21 73568]
S3 cht4iscsi;cht4iscsi; C:\WINDOWS\System32\drivers\cht4sx64.sys [2016-07-16 346976]
S3 cht4vbd;@cht4vx64.inf,%cht4vbd.generic%;Chelsio Virtual Bus Driver; C:\WINDOWS\System32\drivers\cht4vx64.sys [2016-07-16 2104160]
S3 iagpio;@iagpio.inf,%iagpio.SVCDESC%;Intel Serial IO GPIO Controller Driver; C:\WINDOWS\System32\drivers\iagpio.sys [2016-07-16 33280]
S3 iaLPSS2i_GPIO2;@iaLPSS2i_GPIO2_SKL.inf,%iaLPSS2i_GPIO2.SVCDESC%;Intel(R) Serial IO GPIO Driver v2; C:\WINDOWS\System32\drivers\iaLPSS2i_GPIO2.sys [2016-07-16 64512]
S3 IndirectKmd;@%SystemRoot%\system32\drivers\IndirectKmd.sys,-100; C:\WINDOWS\System32\drivers\IndirectKmd.sys [2016-07-16 35840]
S3 irda;IrDA; C:\WINDOWS\system32\drivers\irda.sys [2016-07-16 120320]
S3 NetAdapterCx;Network Adapter Wdf Class Extension Library; C:\WINDOWS\system32\drivers\NetAdapterCx.sys [2016-07-16 90624]
S3 NvStUSB;@oem0.inf,%NvStUSB.SvcDesc%;NVIDIA Stereoscopic 3D USB driver; C:\WINDOWS\System32\drivers\nvstusb.sys [2017-01-04 478272]
S3 scmdisk0101;@scmdisk0101.inf,%scmdisk0101.SvcDesc%;Microsoft NVDIMM-N disk driver; C:\WINDOWS\System32\drivers\scmdisk0101.sys [2016-07-16 123904]
S3 UcmTcpciCx0101;UCM-TCPCI KMDF Class Extension; C:\WINDOWS\System32\Drivers\UcmTcpciCx.sys [2016-07-16 108544]
S3 vmgid;@wvmgid.inf,%VmGid.SVCDESC%;Microsoft Hyper-V Guest Infrastructure Driver; C:\WINDOWS\System32\drivers\vmgid.sys [2016-07-16 10240]

====== List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled) ======

R2 OneSyncSvc_10e2ec;Hostitel synchronizace_10e2ec; C:\WINDOWS\system32\svchost.exe -k UnistackSvcGroup;"ServiceDll" =
R3 TimeBrokerSvc;@%windir%\system32\TimeBrokerServer.dll,-1001; %SystemRoot%\system32\svchost.exe -k LocalServiceNetworkRestricted;"ServiceDll" = %SystemRoot%\System32\TimeBrokerServer.dll
S2 CDPUserSvc;@%SystemRoot%\system32\cdpusersvc.dll,-100; %SystemRoot%\system32\svchost.exe -k UnistackSvcGroup;"ServiceDll" = %SystemRoot%\System32\CDPUserSvc.dll
S2 CDPUserSvc_10e2ec;CDPUserSvc_10e2ec; C:\WINDOWS\system32\svchost.exe -k UnistackSvcGroup;"ServiceDll" =
S3 FrameServer;@%systemroot%\system32\FrameServer.dll,-100; %SystemRoot%\System32\svchost.exe -k Camera;"ServiceDll" = %SystemRoot%\system32\FrameServer.dll
S3 HvHost;@%SystemRoot%\system32\hvhostsvc.dll,-100; %SystemRoot%\system32\svchost.exe -k LocalSystemNetworkRestricted;"ServiceDll" = %SystemRoot%\System32\hvhostsvc.dll
S3 irmon;@%SystemRoot%\System32\irmon.dll,-2000; %SystemRoot%\system32\svchost.exe -k LocalSystemNetworkRestricted;"ServiceDll" = %SystemRoot%\System32\irmon.dll
S3 MessagingService_10e2ec;Služba zasílání zpráv_10e2ec; C:\WINDOWS\system32\svchost.exe -k UnistackSvcGroup;"ServiceDll" =
S3 PimIndexMaintenanceSvc_10e2ec;Data kontaktů_10e2ec; C:\WINDOWS\system32\svchost.exe -k UnistackSvcGroup;"ServiceDll" =
S3 RmSvc;@%SystemRoot%\system32\RMapi.dll,-1001; %SystemRoot%\System32\svchost.exe -k LocalServiceNetworkRestricted;"ServiceDll" = %SystemRoot%\System32\RMapi.dll
S3 UnistoreSvc_10e2ec;Úložiště uživatelských dat_10e2ec; C:\WINDOWS\System32\svchost.exe -k UnistackSvcGroup;"ServiceDll" =
S3 UserDataSvc_10e2ec;Přístup k uživatelským datům_10e2ec; C:\WINDOWS\system32\svchost.exe -k UnistackSvcGroup;"ServiceDll" =
S3 vmicvss;@%systemroot%\system32\icsvcext.dll,-501; %systemroot%\system32\svchost.exe -k LocalSystemNetworkRestricted;"ServiceDll" = %SystemRoot%\System32\icsvcext.dll
S4 shpamsvc;@%SystemRoot%\System32\Windows.SharedPC.AccountManager.dll,-100; %SystemRoot%\System32\svchost.exe -k netsvcs;"ServiceDll" = %systemroot%\system32\Windows.SharedPC.AccountManager.dll

-----------------EOF-----------------

Re: Podezření na vir (dllhost.exe - COM Surrogate)

Napsal: 22 úno 2017 18:53
od Rudy
Zdravím!
Spusťte tuto utilitu:
Stáhněte AdwCleaner https://toolslib.net/downloads/viewdown ... dwcleaner/
Uložte na plochu
Ukončete všechny programy
Klikněte nejprve na >Scan<(hledání) a pak na >Clean< (mazání).
Proběhne skenováni a pak se objeví log, který sem vložte.

Re: Podezření na vir (dllhost.exe - COM Surrogate)

Napsal: 22 úno 2017 19:02
od Peedy
# AdwCleaner v6.043 - Log vytvořen 22/02/2017 v 18:57:59
# Aktualizováno dne 27/01/2017 z Malwarebytes
# Databáze : 2017-02-22.1 [Místní]
# Operační systém : Windows 10 Home (X64)
# Uživatelské jméno : Petr Půček - DESKTOP-INSUTER
# Spuštěno z : C:\Users\Petr Půček\Desktop\adwcleaner_6.043.exe
# Mod: Čištění
# Podpora : https://www.malwarebytes.com/support



***** [ Služby ] *****



***** [ Složky ] *****



***** [ Soubory ] *****



***** [ DLL ] *****



***** [ WMI ] *****



***** [ Zástupci ] *****



***** [ Naplánované úlohy ] *****



***** [ Registry ] *****

[-] Klíč smazán: HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\solvusoft.com
[-] Klíč smazán: HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\www.solvusoft.com
[-] Klíč smazán: HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\solvusoft.com
[-] Klíč smazán: HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\www.solvusoft.com
[#] Klíč smazán po restartu: [x64] HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\solvusoft.com
[#] Klíč smazán po restartu: [x64] HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\www.solvusoft.com
[#] Klíč smazán po restartu: [x64] HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\solvusoft.com
[#] Klíč smazán po restartu: [x64] HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\www.solvusoft.com


***** [ Prohlížeče ] *****



*************************

:: "Tracing" klíče smazány
:: Winsock nastavení vyčištěno

*************************

C:\AdwCleaner\AdwCleaner[C0].txt - [2619 Bajty] - [22/02/2017 18:57:59]
C:\AdwCleaner\AdwCleaner[S0].txt - [3068 Bajty] - [22/02/2017 18:57:35]

########## EOF - C:\AdwCleaner\AdwCleaner[C0].txt - [2765 Bajty] ##########

Re: Podezření na vir (dllhost.exe - COM Surrogate)

Napsal: 22 úno 2017 20:01
od Rudy
Teď dejte log FRST: http://forum.viry.cz/viewtopic.php?f=13&t=133100 .

Re: Podezření na vir (dllhost.exe - COM Surrogate)

Napsal: 22 úno 2017 20:22
od Peedy
Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 22-02-2017
Ran by Petr PĹŻÄŤek (administrator) on DESKTOP-INSUTER (22-02-2017 20:20:08)
Running from C:\Users\Petr PĹŻÄŤek\Desktop
Loaded Profiles: Petr PĹŻÄŤek (Available Profiles: defaultuser0 & Petr PĹŻÄŤek)
Platform: Windows 10 Home Version 1607 (X64) Language: Čeština (Česká republika)
Internet Explorer Version 11 (Default browser: Edge)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/33 ... scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Microsoft Corporation) C:\Program Files\Windows Defender\MsMpEng.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\NisSrv.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MpCmdRun.exe
(Microsoft Corporation) C:\Windows\System32\smartscreen.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MSASCuiL.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\ImmersiveControlPanel\SystemSettings.exe
(Microsoft® Windows® Operating System) C:\Windows\System32\Taskmgr.exe
(forum.viry.cz) C:\Users\Petr PĹŻÄŤek\Desktop\FRSTLauncher.exe

==================== Registry (Whitelisted) ====================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [WindowsDefender] => C:\Program Files\Windows Defender\MSASCuiL.exe [631808 2016-11-21] (Microsoft Corporation)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Tcpip\Parameters: [DhcpNameServer] 192.168.3.1
Tcpip\..\Interfaces\{df4111fa-0bfb-49b1-8b52-9119ce64e80e}: [DhcpNameServer] 192.168.3.1

Internet Explorer:
==================

==================== Services (Whitelisted) ====================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [347328 2016-07-16] (Microsoft Corporation)
R2 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [103720 2016-07-16] (Microsoft Corporation)

===================== Drivers (Whitelisted) ======================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

S3 dtlitescsibus; C:\WINDOWS\System32\drivers\dtlitescsibus.sys [30264 2016-03-26] (Disc Soft Ltd)
S3 NetAdapterCx; C:\WINDOWS\System32\drivers\NetAdapterCx.sys [90624 2016-07-16] ()
R3 nvlddmkm; C:\WINDOWS\System32\DriverStore\FileRepository\nv_dispiwu.inf_amd64_b67dc924fff8de6d\nvlddmkm.sys [14199224 2017-01-04] (NVIDIA Corporation)
R3 RTL8023x64; C:\WINDOWS\System32\drivers\Rtnic64.sys [51712 2016-07-16] (Realtek Semiconductor Corporation )
S0 WdBoot; C:\WINDOWS\System32\drivers\WdBoot.sys [44056 2016-07-16] (Microsoft Corporation)
R0 WdFilter; C:\WINDOWS\System32\drivers\WdFilter.sys [290144 2016-07-16] (Microsoft Corporation)
R3 WdNisDrv; C:\WINDOWS\System32\Drivers\WdNisDrv.sys [123232 2016-07-16] (Microsoft Corporation)

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2017-02-23 02:16 - 2017-02-23 02:16 - 00000000 _SHDL C:\Users\Public\Documents\Obrázky
2017-02-23 02:16 - 2017-02-23 02:16 - 00000000 _SHDL C:\Users\Public\Documents\Hudba
2017-02-23 02:16 - 2017-02-23 02:16 - 00000000 _SHDL C:\Users\Public\Documents\Filmy
2017-02-23 02:16 - 2017-02-23 02:16 - 00000000 _SHDL C:\Users\Default\Ĺ ablony
2017-02-23 02:16 - 2017-02-23 02:16 - 00000000 _SHDL C:\Users\Default\Soubory cookie
2017-02-23 02:16 - 2017-02-23 02:16 - 00000000 _SHDL C:\Users\Default\PoslednĂ­
2017-02-23 02:16 - 2017-02-23 02:16 - 00000000 _SHDL C:\Users\Default\Okolní tiskárny
2017-02-23 02:16 - 2017-02-23 02:16 - 00000000 _SHDL C:\Users\Default\OkolnĂ­ sĂ­ĹĄ
2017-02-23 02:16 - 2017-02-23 02:16 - 00000000 _SHDL C:\Users\Default\NabĂ­dka Start
2017-02-23 02:16 - 2017-02-23 02:16 - 00000000 _SHDL C:\Users\Default\Dokumenty
2017-02-23 02:16 - 2017-02-23 02:16 - 00000000 _SHDL C:\Users\Default\Documents\Obrázky
2017-02-23 02:16 - 2017-02-23 02:16 - 00000000 _SHDL C:\Users\Default\Documents\Hudba
2017-02-23 02:16 - 2017-02-23 02:16 - 00000000 _SHDL C:\Users\Default\Documents\Filmy
2017-02-23 02:16 - 2017-02-23 02:16 - 00000000 _SHDL C:\Users\Default\Data aplikacĂ­
2017-02-23 02:16 - 2017-02-23 02:16 - 00000000 _SHDL C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programy
2017-02-23 02:16 - 2017-02-23 02:16 - 00000000 _SHDL C:\Users\Default\AppData\Local\Data aplikacĂ­
2017-02-23 02:16 - 2017-02-23 02:16 - 00000000 _SHDL C:\Users\Default User\Documents\Obrázky
2017-02-23 02:16 - 2017-02-23 02:16 - 00000000 _SHDL C:\Users\Default User\Documents\Hudba
2017-02-23 02:16 - 2017-02-23 02:16 - 00000000 _SHDL C:\Users\Default User\Documents\Filmy
2017-02-23 02:16 - 2017-02-23 02:16 - 00000000 _SHDL C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programy
2017-02-23 02:16 - 2017-02-23 02:16 - 00000000 _SHDL C:\Users\Default User\AppData\Local\Data aplikacĂ­
2017-02-23 02:16 - 2017-02-23 02:16 - 00000000 _SHDL C:\Users\Default User
2017-02-23 02:16 - 2017-02-23 02:16 - 00000000 _SHDL C:\Users\All Users
2017-02-23 02:16 - 2017-02-23 02:16 - 00000000 _SHDL C:\ProgramData\Ĺ ablony
2017-02-23 02:16 - 2017-02-23 02:16 - 00000000 _SHDL C:\ProgramData\Plocha
2017-02-23 02:16 - 2017-02-23 02:16 - 00000000 _SHDL C:\ProgramData\NabĂ­dka Start
2017-02-23 02:16 - 2017-02-23 02:16 - 00000000 _SHDL C:\ProgramData\Microsoft\Windows\Start Menu\Programy
2017-02-23 02:16 - 2017-02-23 02:16 - 00000000 _SHDL C:\ProgramData\Dokumenty
2017-02-23 02:16 - 2017-02-23 02:16 - 00000000 _SHDL C:\ProgramData\Data aplikacĂ­
2017-02-23 02:16 - 2017-02-23 02:16 - 00000000 _SHDL C:\Documents and Settings
2017-02-23 02:11 - 2017-02-23 02:11 - 00000000 ____D C:\ProgramData\NVIDIA Corporation
2017-02-23 02:11 - 2017-02-23 02:11 - 00000000 ____D C:\Program Files\NVIDIA Corporation
2017-02-23 02:11 - 2017-02-23 02:11 - 00000000 ____D C:\Program Files\Common Files\logishrd
2017-02-23 02:11 - 2017-02-23 02:11 - 00000000 ____D C:\Program Files (x86)\NVIDIA Corporation
2017-02-23 02:11 - 2016-12-29 13:44 - 06386232 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvcpl.dll
2017-02-23 02:11 - 2016-12-29 13:44 - 02477624 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvsvc64.dll
2017-02-23 02:11 - 2016-12-29 13:44 - 01762752 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvsvcr.dll
2017-02-23 02:11 - 2016-12-29 13:44 - 00546752 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nv3dappshext.dll
2017-02-23 02:11 - 2016-12-29 13:44 - 00392128 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvmctray.dll
2017-02-23 02:11 - 2016-12-29 13:44 - 00083512 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nv3dappshextr.dll
2017-02-23 02:11 - 2016-12-29 13:44 - 00069568 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvshext.dll
2017-02-23 02:11 - 2016-12-19 08:26 - 07651057 _____ C:\WINDOWS\system32\nvcoproc.bin
2017-02-23 02:06 - 2017-02-23 02:06 - 00000000 ____D C:\ProgramData\USOShared
2017-02-23 02:04 - 2017-02-23 02:04 - 00194440 _____ C:\WINDOWS\system32\FNTCACHE.DAT
2017-02-23 02:04 - 2017-02-23 02:04 - 00000000 ____D C:\WINDOWS\ServiceProfiles
2017-02-23 02:04 - 2017-02-22 19:50 - 00000000 ____D C:\WINDOWS\system32\SleepStudy
2017-02-23 02:04 - 2017-02-22 18:59 - 00000006 ____H C:\WINDOWS\Tasks\SA.DAT
2017-02-22 20:18 - 2017-02-22 20:20 - 00003754 _____ C:\Users\Petr PĹŻÄŤek\Desktop\FRST.txt
2017-02-22 20:18 - 2017-02-22 20:18 - 00000000 ____D C:\FRST
2017-02-22 20:10 - 2017-02-22 20:18 - 02422784 _____ (Farbar) C:\Users\Petr PĹŻÄŤek\Desktop\FRST64.exe
2017-02-22 20:10 - 2017-02-22 20:17 - 00112640 _____ (forum.viry.cz) C:\Users\Petr PĹŻÄŤek\Desktop\FRSTLauncher.exe
2017-02-22 19:51 - 2017-02-22 19:51 - 00000000 ____D C:\Users\Petr PĹŻÄŤek\AppData\Roaming\Macromedia
2017-02-22 18:56 - 2017-02-22 18:57 - 00000000 ____D C:\AdwCleaner
2017-02-22 18:55 - 2017-02-22 18:56 - 04015056 _____ C:\Users\Petr PĹŻÄŤek\Desktop\adwcleaner_6.043.exe
2017-02-22 17:33 - 2017-02-22 17:33 - 00000000 ____D C:\Users\Petr PĹŻÄŤek\AppData\Local\Comms
2017-02-22 17:30 - 2017-02-22 17:30 - 00000000 ____D C:\rsit
2017-02-22 17:30 - 2017-02-22 17:30 - 00000000 ____D C:\Program Files\trend micro
2017-02-22 17:29 - 2017-02-22 17:29 - 01324032 _____ C:\Users\Petr PĹŻÄŤek\Downloads\RSITx64.exe
2017-02-22 17:26 - 2017-02-22 17:26 - 00003300 _____ C:\WINDOWS\System32\Tasks\OneDrive Standalone Update Task v2
2017-02-22 17:26 - 2017-02-22 17:26 - 00000000 ____D C:\Users\Petr PĹŻÄŤek\AppData\Local\MicrosoftEdge
2017-02-22 17:25 - 2017-02-22 17:26 - 00002406 _____ C:\Users\Petr PĹŻÄŤek\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OneDrive.lnk
2017-02-22 17:25 - 2017-02-22 17:26 - 00000000 ___RD C:\Users\Petr PĹŻÄŤek\OneDrive
2017-02-22 17:25 - 2017-02-22 17:25 - 00000000 ____D C:\Users\Petr PĹŻÄŤek\AppData\Roaming\Skype
2017-02-22 17:24 - 2017-02-22 19:06 - 01716186 _____ C:\WINDOWS\system32\PerfStringBackup.INI
2017-02-22 17:24 - 2017-02-22 17:24 - 00000000 ____D C:\ProgramData\Microsoft OneDrive
2017-02-22 17:23 - 2017-02-22 17:23 - 00000000 ____D C:\Users\Petr PĹŻÄŤek\AppData\Local\Publishers
2017-02-22 17:22 - 2017-02-22 18:59 - 00000000 ____D C:\Users\Petr PĹŻÄŤek
2017-02-22 17:22 - 2017-02-22 18:30 - 00000000 ____D C:\Users\Petr PĹŻÄŤek\AppData\Local\Packages
2017-02-22 17:22 - 2017-02-22 17:22 - 00000020 ___SH C:\Users\Petr PĹŻÄŤek\ntuser.ini
2017-02-22 17:22 - 2017-02-22 17:22 - 00000000 _SHDL C:\Users\Petr PĹŻÄŤek\Ĺ ablony
2017-02-22 17:22 - 2017-02-22 17:22 - 00000000 _SHDL C:\Users\Petr PĹŻÄŤek\Soubory cookie
2017-02-22 17:22 - 2017-02-22 17:22 - 00000000 _SHDL C:\Users\Petr PĹŻÄŤek\PoslednĂ­
2017-02-22 17:22 - 2017-02-22 17:22 - 00000000 _SHDL C:\Users\Petr Půček\Okolní tiskárny
2017-02-22 17:22 - 2017-02-22 17:22 - 00000000 _SHDL C:\Users\Petr PĹŻÄŤek\OkolnĂ­ sĂ­ĹĄ
2017-02-22 17:22 - 2017-02-22 17:22 - 00000000 _SHDL C:\Users\Petr PĹŻÄŤek\NabĂ­dka Start
2017-02-22 17:22 - 2017-02-22 17:22 - 00000000 _SHDL C:\Users\Petr PĹŻÄŤek\Dokumenty
2017-02-22 17:22 - 2017-02-22 17:22 - 00000000 _SHDL C:\Users\Petr Půček\Documents\Obrázky
2017-02-22 17:22 - 2017-02-22 17:22 - 00000000 _SHDL C:\Users\Petr PĹŻÄŤek\Documents\Hudba
2017-02-22 17:22 - 2017-02-22 17:22 - 00000000 _SHDL C:\Users\Petr PĹŻÄŤek\Documents\Filmy
2017-02-22 17:22 - 2017-02-22 17:22 - 00000000 _SHDL C:\Users\Petr PĹŻÄŤek\Data aplikacĂ­
2017-02-22 17:22 - 2017-02-22 17:22 - 00000000 _SHDL C:\Users\Petr PĹŻÄŤek\AppData\Roaming\Microsoft\Windows\Start Menu\Programy
2017-02-22 17:22 - 2017-02-22 17:22 - 00000000 _SHDL C:\Users\Petr PĹŻÄŤek\AppData\Local\Data aplikacĂ­
2017-02-22 17:22 - 2017-02-22 17:22 - 00000000 __RHD C:\Users\Public\AccountPictures
2017-02-22 17:22 - 2017-02-22 17:22 - 00000000 ____D C:\Users\Petr PĹŻÄŤek\AppData\Roaming\Adobe
2017-02-22 17:22 - 2017-02-22 17:22 - 00000000 ____D C:\Users\Petr PĹŻÄŤek\AppData\Local\VirtualStore
2017-02-22 17:22 - 2017-02-22 17:22 - 00000000 ____D C:\Users\Petr PĹŻÄŤek\AppData\Local\TileDataLayer
2017-02-22 17:20 - 2017-02-22 17:20 - 00000020 ___SH C:\Users\defaultuser0\ntuser.ini
2017-02-22 17:20 - 2017-02-22 17:20 - 00000000 _SHDL C:\Users\defaultuser0\Ĺ ablony
2017-02-22 17:20 - 2017-02-22 17:20 - 00000000 _SHDL C:\Users\defaultuser0\Soubory cookie
2017-02-22 17:20 - 2017-02-22 17:20 - 00000000 _SHDL C:\Users\defaultuser0\PoslednĂ­
2017-02-22 17:20 - 2017-02-22 17:20 - 00000000 _SHDL C:\Users\defaultuser0\Okolní tiskárny
2017-02-22 17:20 - 2017-02-22 17:20 - 00000000 _SHDL C:\Users\defaultuser0\OkolnĂ­ sĂ­ĹĄ
2017-02-22 17:20 - 2017-02-22 17:20 - 00000000 _SHDL C:\Users\defaultuser0\NabĂ­dka Start
2017-02-22 17:20 - 2017-02-22 17:20 - 00000000 _SHDL C:\Users\defaultuser0\Dokumenty
2017-02-22 17:20 - 2017-02-22 17:20 - 00000000 _SHDL C:\Users\defaultuser0\Documents\Obrázky
2017-02-22 17:20 - 2017-02-22 17:20 - 00000000 _SHDL C:\Users\defaultuser0\Documents\Hudba
2017-02-22 17:20 - 2017-02-22 17:20 - 00000000 _SHDL C:\Users\defaultuser0\Documents\Filmy
2017-02-22 17:20 - 2017-02-22 17:20 - 00000000 _SHDL C:\Users\defaultuser0\Data aplikacĂ­
2017-02-22 17:20 - 2017-02-22 17:20 - 00000000 _SHDL C:\Users\defaultuser0\AppData\Roaming\Microsoft\Windows\Start Menu\Programy
2017-02-22 17:20 - 2017-02-22 17:20 - 00000000 _SHDL C:\Users\defaultuser0\AppData\Local\Data aplikacĂ­
2017-02-22 17:20 - 2017-02-22 17:20 - 00000000 ____D C:\Users\defaultuser0\AppData\Local\VirtualStore
2017-02-22 17:20 - 2017-02-22 17:20 - 00000000 ____D C:\Users\defaultuser0\AppData\Local\TileDataLayer
2017-02-22 17:20 - 2017-02-22 17:20 - 00000000 ____D C:\Users\defaultuser0\AppData\Local\Packages
2017-02-22 17:20 - 2017-02-22 17:20 - 00000000 ____D C:\Users\defaultuser0\AppData\Local\ConnectedDevicesPlatform
2017-02-22 17:20 - 2017-02-22 17:20 - 00000000 ____D C:\Users\defaultuser0
2017-02-22 17:19 - 2016-07-16 12:41 - 02716672 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\PrintConfig.dll
2017-02-22 17:00 - 2017-02-22 17:00 - 00000000 ____D C:\WINDOWS\InfusedApps
2017-02-22 16:59 - 2017-02-22 17:20 - 00000000 ___DC C:\WINDOWS\Panther
2017-02-22 16:59 - 2017-02-22 16:59 - 00008192 _____ C:\WINDOWS\system32\config\userdiff
2017-02-22 16:59 - 2017-02-22 16:59 - 00000000 ____D C:\WINDOWS\Setup
2017-02-22 16:59 - 2017-02-22 16:59 - 00000000 ____D C:\Windows.old
2017-02-22 16:53 - 2017-02-22 19:06 - 00730678 _____ C:\WINDOWS\system32\perfh005.dat
2017-02-22 16:53 - 2017-02-22 19:06 - 00148070 _____ C:\WINDOWS\system32\perfc005.dat
2017-02-22 16:53 - 2017-02-22 16:53 - 00000000 ____D C:\WINDOWS\SysWOW64\winrm
2017-02-22 16:53 - 2017-02-22 16:53 - 00000000 ____D C:\WINDOWS\SysWOW64\WCN
2017-02-22 16:53 - 2017-02-22 16:53 - 00000000 ____D C:\WINDOWS\SysWOW64\sysprep
2017-02-22 16:53 - 2017-02-22 16:53 - 00000000 ____D C:\WINDOWS\SysWOW64\slmgr
2017-02-22 16:53 - 2017-02-22 16:53 - 00000000 ____D C:\WINDOWS\SysWOW64\Printing_Admin_Scripts
2017-02-22 16:53 - 2017-02-22 16:53 - 00000000 ____D C:\WINDOWS\SysWOW64\cs
2017-02-22 16:53 - 2017-02-22 16:53 - 00000000 ____D C:\WINDOWS\SysWOW64\0409
2017-02-22 16:53 - 2017-02-22 16:53 - 00000000 ____D C:\WINDOWS\system32\winrm
2017-02-22 16:53 - 2017-02-22 16:53 - 00000000 ____D C:\WINDOWS\system32\WCN
2017-02-22 16:53 - 2017-02-22 16:53 - 00000000 ____D C:\WINDOWS\system32\slmgr
2017-02-22 16:53 - 2017-02-22 16:53 - 00000000 ____D C:\WINDOWS\system32\Printing_Admin_Scripts
2017-02-22 16:53 - 2017-02-22 16:53 - 00000000 ____D C:\WINDOWS\system32\cs
2017-02-22 16:53 - 2017-02-22 16:53 - 00000000 ____D C:\WINDOWS\system32\0409
2017-02-22 16:53 - 2017-02-22 16:53 - 00000000 ____D C:\WINDOWS\OCR
2017-02-22 16:53 - 2017-02-22 16:53 - 00000000 ____D C:\WINDOWS\DigitalLocker
2017-02-22 16:53 - 2017-02-22 16:52 - 00296654 _____ C:\WINDOWS\system32\perfi005.dat
2017-02-22 16:53 - 2017-02-22 16:52 - 00038682 _____ C:\WINDOWS\system32\perfd005.dat
2017-02-22 16:49 - 2016-11-21 05:05 - 00828408 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe
2017-02-22 16:49 - 2016-11-21 05:05 - 00176632 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl
2017-02-22 16:48 - 2017-02-22 16:59 - 00028672 _____ C:\WINDOWS\system32\config\BCD-Template
2017-02-22 16:48 - 2017-02-22 16:58 - 00015425 _____ C:\WINDOWS\system32\OEMDefaultAssociations.xml
2017-02-22 16:48 - 2017-02-22 16:45 - 00231424 _____ (Microsoft Corporation) C:\WINDOWS\system32\msclmd.dll
2017-02-22 16:48 - 2017-02-22 16:45 - 00215943 _____ C:\WINDOWS\SysWOW64\dssec.dat
2017-02-22 16:48 - 2017-02-22 16:45 - 00215943 _____ C:\WINDOWS\system32\dssec.dat
2017-02-22 16:48 - 2017-02-22 16:45 - 00209408 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msclmd.dll
2017-02-22 16:48 - 2017-02-22 16:45 - 00017463 _____ C:\WINDOWS\system32\Drivers\etc\services
2017-02-22 16:48 - 2017-02-22 16:45 - 00004096 _____ C:\WINDOWS\system32\config\VSMIDK
2017-02-22 16:48 - 2017-02-22 16:45 - 00003683 _____ C:\WINDOWS\system32\Drivers\etc\lmhosts.sam
2017-02-22 16:48 - 2017-02-22 16:45 - 00001358 _____ C:\WINDOWS\system32\Drivers\etc\protocol
2017-02-22 16:48 - 2017-02-22 16:45 - 00000858 _____ C:\WINDOWS\system32\DefaultQuestions.json
2017-02-22 16:48 - 2017-02-22 16:45 - 00000741 _____ C:\WINDOWS\SysWOW64\NOISE.DAT
2017-02-22 16:48 - 2017-02-22 16:45 - 00000741 _____ C:\WINDOWS\system32\NOISE.DAT
2017-02-22 16:48 - 2017-02-22 16:45 - 00000407 _____ C:\WINDOWS\system32\Drivers\etc\networks
2017-02-22 16:47 - 2017-02-23 02:16 - 00000000 ____D C:\Program Files\Windows NT
2017-02-22 16:47 - 2017-02-23 02:15 - 00000000 ____D C:\WINDOWS\system32\Sysprep
2017-02-22 16:47 - 2017-02-23 02:12 - 00000000 ___RD C:\WINDOWS\PrintDialog
2017-02-22 16:47 - 2017-02-23 02:12 - 00000000 ___RD C:\WINDOWS\MiracastView
2017-02-22 16:47 - 2017-02-23 02:12 - 00000000 ___RD C:\WINDOWS\ImmersiveControlPanel
2017-02-22 16:47 - 2017-02-23 02:11 - 00000000 ____D C:\WINDOWS\Help
2017-02-22 16:47 - 2017-02-23 02:06 - 00000000 ____D C:\ProgramData\USOPrivate
2017-02-22 16:47 - 2017-02-22 18:36 - 00000000 ____D C:\WINDOWS\AppReadiness
2017-02-22 16:47 - 2017-02-22 18:24 - 00000000 ___HD C:\Program Files\WindowsApps
2017-02-22 16:47 - 2017-02-22 17:23 - 00000000 ____D C:\WINDOWS\LiveKernelReports
2017-02-22 16:47 - 2017-02-22 17:22 - 00000000 ____D C:\WINDOWS\system32\WinBioDatabase
2017-02-22 16:47 - 2017-02-22 17:20 - 00000000 ____D C:\WINDOWS\rescache
2017-02-22 16:47 - 2017-02-22 17:19 - 00000000 ____D C:\WINDOWS\system32\spool
2017-02-22 16:47 - 2017-02-22 17:19 - 00000000 ____D C:\WINDOWS\system32\FxsTmp
2017-02-22 16:47 - 2017-02-22 17:18 - 00000000 ____D C:\ProgramData\regid.1991-06.com.microsoft
2017-02-22 16:47 - 2017-02-22 16:58 - 00000000 ___SD C:\WINDOWS\SysWOW64\F12
2017-02-22 16:47 - 2017-02-22 16:58 - 00000000 ___SD C:\WINDOWS\system32\F12
2017-02-22 16:47 - 2017-02-22 16:58 - 00000000 ___SD C:\WINDOWS\system32\dsc
2017-02-22 16:47 - 2017-02-22 16:58 - 00000000 ___SD C:\WINDOWS\system32\DiagSvcs
2017-02-22 16:47 - 2017-02-22 16:58 - 00000000 ___RD C:\Program Files\Windows Defender
2017-02-22 16:47 - 2017-02-22 16:58 - 00000000 ____D C:\WINDOWS\SysWOW64\setup
2017-02-22 16:47 - 2017-02-22 16:58 - 00000000 ____D C:\WINDOWS\SysWOW64\Dism
2017-02-22 16:47 - 2017-02-22 16:58 - 00000000 ____D C:\WINDOWS\system32\WinBioPlugIns
2017-02-22 16:47 - 2017-02-22 16:58 - 00000000 ____D C:\WINDOWS\system32\setup
2017-02-22 16:47 - 2017-02-22 16:58 - 00000000 ____D C:\WINDOWS\system32\oobe
2017-02-22 16:47 - 2017-02-22 16:58 - 00000000 ____D C:\WINDOWS\system32\migwiz
2017-02-22 16:47 - 2017-02-22 16:58 - 00000000 ____D C:\WINDOWS\system32\Dism
2017-02-22 16:47 - 2017-02-22 16:58 - 00000000 ____D C:\WINDOWS\system32\appraiser
2017-02-22 16:47 - 2017-02-22 16:58 - 00000000 ____D C:\WINDOWS\ShellExperiences
2017-02-22 16:47 - 2017-02-22 16:58 - 00000000 ____D C:\WINDOWS\Provisioning
2017-02-22 16:47 - 2017-02-22 16:58 - 00000000 ____D C:\WINDOWS\bcastdvr
2017-02-22 16:47 - 2017-02-22 16:58 - 00000000 ____D C:\Program Files\Windows Photo Viewer
2017-02-22 16:47 - 2017-02-22 16:58 - 00000000 ____D C:\Program Files (x86)\Windows Photo Viewer
2017-02-22 16:47 - 2017-02-22 16:58 - 00000000 ____D C:\Program Files (x86)\Windows Defender
2017-02-22 16:47 - 2017-02-22 16:53 - 00000000 ___SD C:\WINDOWS\SysWOW64\DiagSvcs
2017-02-22 16:47 - 2017-02-22 16:53 - 00000000 ____D C:\WINDOWS\SysWOW64\oobe
2017-02-22 16:47 - 2017-02-22 16:53 - 00000000 ____D C:\WINDOWS\SysWOW64\MUI
2017-02-22 16:47 - 2017-02-22 16:53 - 00000000 ____D C:\WINDOWS\SysWOW64\Com
2017-02-22 16:47 - 2017-02-22 16:53 - 00000000 ____D C:\WINDOWS\SystemApps
2017-02-22 16:47 - 2017-02-22 16:53 - 00000000 ____D C:\WINDOWS\system32\SystemResetPlatform
2017-02-22 16:47 - 2017-02-22 16:53 - 00000000 ____D C:\WINDOWS\system32\MUI
2017-02-22 16:47 - 2017-02-22 16:53 - 00000000 ____D C:\WINDOWS\system32\Com
2017-02-22 16:47 - 2017-02-22 16:53 - 00000000 ____D C:\WINDOWS\PolicyDefinitions
2017-02-22 16:47 - 2017-02-22 16:53 - 00000000 ____D C:\WINDOWS\IME
2017-02-22 16:47 - 2017-02-22 16:53 - 00000000 ____D C:\Program Files\Common Files\System
2017-02-22 16:47 - 2017-02-22 16:53 - 00000000 ____D C:\Program Files\Common Files\microsoft shared
2017-02-22 16:47 - 2017-02-22 16:48 - 00000000 ___SD C:\WINDOWS\SysWOW64\Nui
2017-02-22 16:47 - 2017-02-22 16:48 - 00000000 ___SD C:\WINDOWS\system32\Nui
2017-02-22 16:47 - 2017-02-22 16:48 - 00000000 ___RD C:\WINDOWS\Offline Web Pages
2017-02-22 16:47 - 2017-02-22 16:48 - 00000000 ____D C:\WINDOWS\SysWOW64\WinMetadata
2017-02-22 16:47 - 2017-02-22 16:48 - 00000000 ____D C:\WINDOWS\SysWOW64\migwiz
2017-02-22 16:47 - 2017-02-22 16:48 - 00000000 ____D C:\WINDOWS\SysWOW64\MailContactsCalendarSync
2017-02-22 16:47 - 2017-02-22 16:48 - 00000000 ____D C:\WINDOWS\SysWOW64\icsxml
2017-02-22 16:47 - 2017-02-22 16:48 - 00000000 ____D C:\WINDOWS\SysWOW64\downlevel
2017-02-22 16:47 - 2017-02-22 16:48 - 00000000 ____D C:\WINDOWS\SysWOW64\Bthprops
2017-02-22 16:47 - 2017-02-22 16:48 - 00000000 ____D C:\WINDOWS\SysWOW64\AdvancedInstallers
2017-02-22 16:47 - 2017-02-22 16:48 - 00000000 ____D C:\WINDOWS\system32\WinMetadata
2017-02-22 16:47 - 2017-02-22 16:48 - 00000000 ____D C:\WINDOWS\system32\SecureBootUpdates
2017-02-22 16:47 - 2017-02-22 16:48 - 00000000 ____D C:\WINDOWS\system32\MsDtc
2017-02-22 16:47 - 2017-02-22 16:48 - 00000000 ____D C:\WINDOWS\system32\MailContactsCalendarSync
2017-02-22 16:47 - 2017-02-22 16:48 - 00000000 ____D C:\WINDOWS\system32\icsxml
2017-02-22 16:47 - 2017-02-22 16:48 - 00000000 ____D C:\WINDOWS\system32\ias
2017-02-22 16:47 - 2017-02-22 16:48 - 00000000 ____D C:\WINDOWS\system32\downlevel
2017-02-22 16:47 - 2017-02-22 16:48 - 00000000 ____D C:\WINDOWS\system32\DDFs
2017-02-22 16:47 - 2017-02-22 16:48 - 00000000 ____D C:\WINDOWS\system32\Bthprops
2017-02-22 16:47 - 2017-02-22 16:48 - 00000000 ____D C:\WINDOWS\system32\AdvancedInstallers
2017-02-22 16:47 - 2017-02-22 16:48 - 00000000 ____D C:\WINDOWS\Registration
2017-02-22 16:47 - 2017-02-22 16:47 - 00000000 __SHD C:\Program Files\Windows Sidebar
2017-02-22 16:47 - 2017-02-22 16:47 - 00000000 __SHD C:\Program Files (x86)\Windows Sidebar
2017-02-22 16:47 - 2017-02-22 16:47 - 00000000 __RSD C:\WINDOWS\Media
2017-02-22 16:47 - 2017-02-22 16:47 - 00000000 __RHD C:\Users\Public\Libraries
2017-02-22 16:47 - 2017-02-22 16:47 - 00000000 ___SD C:\WINDOWS\SysWOW64\Configuration
2017-02-22 16:47 - 2017-02-22 16:47 - 00000000 ___SD C:\WINDOWS\system32\Configuration
2017-02-22 16:47 - 2017-02-22 16:47 - 00000000 ___SD C:\WINDOWS\Downloaded Program Files
2017-02-22 16:47 - 2017-02-22 16:47 - 00000000 ___HD C:\WINDOWS\ELAMBKUP
2017-02-22 16:47 - 2017-02-22 16:47 - 00000000 ____D C:\WINDOWS\Web
2017-02-22 16:47 - 2017-02-22 16:47 - 00000000 ____D C:\WINDOWS\Vss
2017-02-22 16:47 - 2017-02-22 16:47 - 00000000 ____D C:\WINDOWS\tracing
2017-02-22 16:47 - 2017-02-22 16:47 - 00000000 ____D C:\WINDOWS\TAPI
2017-02-22 16:47 - 2017-02-22 16:47 - 00000000 ____D C:\WINDOWS\SysWOW64\SMI
2017-02-22 16:47 - 2017-02-22 16:47 - 00000000 ____D C:\WINDOWS\SysWOW64\ras
2017-02-22 16:47 - 2017-02-22 16:47 - 00000000 ____D C:\WINDOWS\SysWOW64\NDF
2017-02-22 16:47 - 2017-02-22 16:47 - 00000000 ____D C:\WINDOWS\SysWOW64\MsDtc
2017-02-22 16:47 - 2017-02-22 16:47 - 00000000 ____D C:\WINDOWS\SysWOW64\Macromed
2017-02-22 16:47 - 2017-02-22 16:47 - 00000000 ____D C:\WINDOWS\SysWOW64\Ipmi
2017-02-22 16:47 - 2017-02-22 16:47 - 00000000 ____D C:\WINDOWS\SysWOW64\InputMethod
2017-02-22 16:47 - 2017-02-22 16:47 - 00000000 ____D C:\WINDOWS\SysWOW64\inetsrv
2017-02-22 16:47 - 2017-02-22 16:47 - 00000000 ____D C:\WINDOWS\SysWOW64\IME
2017-02-22 16:47 - 2017-02-22 16:47 - 00000000 ____D C:\WINDOWS\SysWOW64\GroupPolicyUsers
2017-02-22 16:47 - 2017-02-22 16:47 - 00000000 ____D C:\WINDOWS\SysWOW64\GroupPolicy
2017-02-22 16:47 - 2017-02-22 16:47 - 00000000 ____D C:\WINDOWS\SysWOW64\FxsTmp
2017-02-22 16:47 - 2017-02-22 16:47 - 00000000 ____D C:\WINDOWS\SysWOW64\AppLocker
2017-02-22 16:47 - 2017-02-22 16:47 - 00000000 ____D C:\WINDOWS\SystemResources
2017-02-22 16:47 - 2017-02-22 16:47 - 00000000 ____D C:\WINDOWS\system32\winevt
2017-02-22 16:47 - 2017-02-22 16:47 - 00000000 ____D C:\WINDOWS\system32\ras
2017-02-22 16:47 - 2017-02-22 16:47 - 00000000 ____D C:\WINDOWS\system32\ProximityToast
2017-02-22 16:47 - 2017-02-22 16:47 - 00000000 ____D C:\WINDOWS\system32\PointOfService
2017-02-22 16:47 - 2017-02-22 16:47 - 00000000 ____D C:\WINDOWS\system32\NDF
2017-02-22 16:47 - 2017-02-22 16:47 - 00000000 ____D C:\WINDOWS\system32\Macromed
2017-02-22 16:47 - 2017-02-22 16:47 - 00000000 ____D C:\WINDOWS\system32\Ipmi
2017-02-22 16:47 - 2017-02-22 16:47 - 00000000 ____D C:\WINDOWS\system32\InputMethod
2017-02-22 16:47 - 2017-02-22 16:47 - 00000000 ____D C:\WINDOWS\system32\inetsrv
2017-02-22 16:47 - 2017-02-22 16:47 - 00000000 ____D C:\WINDOWS\system32\IME
2017-02-22 16:47 - 2017-02-22 16:47 - 00000000 ____D C:\WINDOWS\system32\GroupPolicyUsers
2017-02-22 16:47 - 2017-02-22 16:47 - 00000000 ____D C:\WINDOWS\system32\GroupPolicy
2017-02-22 16:47 - 2017-02-22 16:47 - 00000000 ____D C:\WINDOWS\system32\config\Journal
2017-02-22 16:47 - 2017-02-22 16:47 - 00000000 ____D C:\WINDOWS\system32\AppLocker
2017-02-22 16:47 - 2017-02-22 16:47 - 00000000 ____D C:\WINDOWS\System
2017-02-22 16:47 - 2017-02-22 16:47 - 00000000 ____D C:\WINDOWS\SKB
2017-02-22 16:47 - 2017-02-22 16:47 - 00000000 ____D C:\WINDOWS\schemas
2017-02-22 16:47 - 2017-02-22 16:47 - 00000000 ____D C:\WINDOWS\SchCache
2017-02-22 16:47 - 2017-02-22 16:47 - 00000000 ____D C:\WINDOWS\security
2017-02-22 16:47 - 2017-02-22 16:47 - 00000000 ____D C:\WINDOWS\Resources
2017-02-22 16:47 - 2017-02-22 16:47 - 00000000 ____D C:\WINDOWS\PLA
2017-02-22 16:47 - 2017-02-22 16:47 - 00000000 ____D C:\WINDOWS\Performance
2017-02-22 16:47 - 2017-02-22 16:47 - 00000000 ____D C:\WINDOWS\ModemLogs
2017-02-22 16:47 - 2017-02-22 16:47 - 00000000 ____D C:\WINDOWS\L2Schemas
2017-02-22 16:47 - 2017-02-22 16:47 - 00000000 ____D C:\WINDOWS\InputMethod
2017-02-22 16:47 - 2017-02-22 16:47 - 00000000 ____D C:\WINDOWS\Globalization
2017-02-22 16:47 - 2017-02-22 16:47 - 00000000 ____D C:\WINDOWS\GameBarPresenceWriter
2017-02-22 16:47 - 2017-02-22 16:47 - 00000000 ____D C:\WINDOWS\Cursors
2017-02-22 16:47 - 2017-02-22 16:47 - 00000000 ____D C:\WINDOWS\Branding
2017-02-22 16:47 - 2017-02-22 16:47 - 00000000 ____D C:\WINDOWS\appcompat
2017-02-22 16:47 - 2017-02-22 16:47 - 00000000 ____D C:\WINDOWS\addins
2017-02-22 16:47 - 2017-02-22 16:47 - 00000000 ____D C:\ProgramData\Comms
2017-02-22 16:47 - 2017-02-22 16:47 - 00000000 ____D C:\Program Files\Windows Portable Devices
2017-02-22 16:47 - 2017-02-22 16:47 - 00000000 ____D C:\Program Files\Windows Multimedia Platform
2017-02-22 16:47 - 2017-02-22 16:47 - 00000000 ____D C:\Program Files\Common Files\Services
2017-02-22 16:47 - 2017-02-22 16:47 - 00000000 ____D C:\Program Files (x86)\Windows Portable Devices
2017-02-22 16:47 - 2017-02-22 16:47 - 00000000 ____D C:\Program Files (x86)\Windows NT
2017-02-22 16:47 - 2017-02-22 16:47 - 00000000 ____D C:\Program Files (x86)\Windows Multimedia Platform
2017-02-22 16:47 - 2017-02-22 16:45 - 00000219 _____ C:\WINDOWS\system.ini
2017-02-22 16:47 - 2017-02-22 16:45 - 00000092 _____ C:\WINDOWS\win.ini
2017-02-22 16:46 - 2017-02-22 17:24 - 00000000 ____D C:\WINDOWS\INF
2017-02-22 16:36 - 2017-02-22 16:59 - 00000000 ____D C:\WINDOWS\CbsTemp
2017-02-22 16:33 - 2017-02-23 02:05 - 00032768 _____ C:\WINDOWS\system32\config\ELAM
2017-02-22 16:33 - 2017-02-22 18:58 - 00262144 _____ C:\WINDOWS\system32\config\BBI
2017-02-22 16:33 - 2017-02-22 16:53 - 00000000 ____D C:\WINDOWS\servicing
2017-02-22 16:33 - 2017-02-22 16:47 - 00000000 ____D C:\WINDOWS\system32\SMI
2017-02-22 16:33 - 2017-02-22 16:33 - 00000000 ____D C:\$WINDOWS.~BT
2017-02-22 16:11 - 2017-02-22 17:00 - 00000000 ___HD C:\$SysReset

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2017-02-22 16:58 - 2016-11-21 05:05 - 03753984 _____ (Microsoft Corporation) C:\WINDOWS\system32\bootux.dll

==================== Files in the root of some directories =======


==================== Bamital & volsnap ======================

(There is no automatic fix for files that do not pass verification.)

C:\WINDOWS\system32\winlogon.exe => File is digitally signed
C:\WINDOWS\system32\wininit.exe => File is digitally signed
C:\WINDOWS\explorer.exe => File is digitally signed
C:\WINDOWS\SysWOW64\explorer.exe => File is digitally signed
C:\WINDOWS\system32\svchost.exe => File is digitally signed
C:\WINDOWS\SysWOW64\svchost.exe => File is digitally signed
C:\WINDOWS\system32\services.exe => File is digitally signed
C:\WINDOWS\system32\User32.dll => File is digitally signed
C:\WINDOWS\SysWOW64\User32.dll => File is digitally signed
C:\WINDOWS\system32\userinit.exe => File is digitally signed
C:\WINDOWS\SysWOW64\userinit.exe => File is digitally signed
C:\WINDOWS\system32\rpcss.dll => File is digitally signed
C:\WINDOWS\system32\dnsapi.dll => File is digitally signed
C:\WINDOWS\SysWOW64\dnsapi.dll => File is digitally signed
C:\WINDOWS\system32\Drivers\volsnap.sys => File is digitally signed

LastRegBack: 2017-02-23 02:03

==================== End of FRST.txt ============================



===***===***===***=== Extract of Additional scan result of Farbar Recovery Scan Tool ===***===***===***===

==================== Drive and Memory info ===================

Drive c: () (Fixed) (Total:1862.23 GB) (Free:1834.68 GB) NTFS

Available physical RAM: 14778.91 MB
Total physical RAM: 16315.49 MB
Percentage of memory in use: 9%

==================== MBR and Partition Table ==================

Disk: 0 (MBR Code: Windows 7 or 8) (Size: 1863 GB) (Disk ID: 4B991DD0)
Partition 1: (Active) - (Size=350 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=1862.2 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=450 MB) - (Type=27)

==================== Scheduled Tasks (whitelisted) ==================

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

==================== Alternate Data Streams (whitelisted) ==================


==================== Security Center ==================

AV: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}



===***===***===***=== Supplementary Scan createdy by FRSTLauncher ===***===***===***===
Posledni aktualizace FRSTLauncheru: 25_11_2013 (01)
Posledni aktualizace Modifikacniho skriptu: 30_09_2013 (01)


***** Velikost "Plochy" *****

Velikost slozky "C:\Users\Petr P…źek\Desktop" je 6 MB.


***** Startup Programs *****


***** Firewall rules *****

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
DisableNotifications REG_DWORD 0x0
EnableFirewall REG_DWORD 0x1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
DisableNotifications REG_DWORD 0x0
EnableFirewall REG_DWORD 0x1

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]


***** System Restore *****

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]


==================== End Of Log ==============================

Re: Podezření na vir (dllhost.exe - COM Surrogate)

Napsal: 22 úno 2017 21:14
od Rudy
Otevřte poznámkový blok a zkopírujte do něj:
Start
EmptyTemp:
End
Uložte na plochu jako fixlist.txt. Spusťte znovu FRST a klikněte na >Fix<. Po skončení akce se objeví log, který sem zkopírujte.

Re: Podezření na vir (dllhost.exe - COM Surrogate)

Napsal: 23 úno 2017 16:19
od Peedy
Fix result of Farbar Recovery Scan Tool (x64) Version: 23-02-2017
Ran by Petr Půček (23-02-2017 16:13:59) Run:1
Running from C:\Users\Petr Půček\Desktop
Loaded Profiles: Petr Půček (Available Profiles: defaultuser0 & Petr Půček)
Boot Mode: Normal
==============================================

fixlist content:
*****************
Start
EmptyTemp:
End
*****************


=========== EmptyTemp: ==========

BITS transfer queue => 1134528 B
DOMStore, IE Recovery, AppCache, Feeds Cache, Thumbcache, IconCache => 7396779 B
Java, Flash, Steam htmlcache => 492 B
Windows/system/drivers => 656274 B
Edge => 62083393 B
Chrome => 0 B
Firefox => 0 B
Opera => 0 B

Temp, IE cache, history, cookies, recent:
Default => 0 B
Users => 0 B
ProgramData => 0 B
Public => 0 B
systemprofile => 128 B
systemprofile32 => 0 B
LocalService => 0 B
NetworkService => 0 B
defaultuser0 => 128 B
Petr Půček => 27073869 B

RecycleBin => 83136 B
EmptyTemp: => 93.9 MB temporary data Removed.

================================


The system needed a reboot.

==== End of Fixlog 16:14:03 ====

Re: Podezření na vir (dllhost.exe - COM Surrogate)

Napsal: 23 úno 2017 17:10
od Rudy
Smazáno. Nastala nějaká změna?

Re: Podezření na vir (dllhost.exe - COM Surrogate)

Napsal: 23 úno 2017 17:12
od Peedy
Bohužel. COM Surrogate stále ve správci úloh setrvává.

Re: Podezření na vir (dllhost.exe - COM Surrogate)

Napsal: 23 úno 2017 17:20
od Rudy
Udělejte kompletní sken MBAM: http://www.malwarebytes.org/mbam.php a dejte log. Předem nic nemažte.

Re: Podezření na vir (dllhost.exe - COM Surrogate)

Napsal: 23 úno 2017 20:51
od Peedy
Malwarebytes
www.malwarebytes.com

-Podrobnosti logovacího souboru-
Datum skenování: 23.02.17
Čas skenování: 17:28
Logovací soubor: sken.txt
Správce: Ano

-Informace o softwaru-
Verze: 3.0.6.1469
Verze komponentů: 1.0.50
Aktualizovat verzi balíku komponent: 1.0.1334
Licence: Zkušební

-Systémová informace-
OS: Windows 10
CPU: x64
Systém souborů: NTFS
Uživatel: DESKTOP-INSUTER\Petr P\u00c5\u00af\u00c4\u008dek

-Shrnutí skenování-
Typ skenování: Vlastní skenování
Výsledek: Dokončeno
Skenované objekty: 447064
Uplynulý čas: 3 hod, 20 min, 30 sek

-Možnosti skenování-
Paměť: Povoleno
Start: Povoleno
Systém souborů: Povoleno
Archivy: Povoleno
Rootkity: Povoleno
Heuristika: Povoleno
Potenciálně nežádoucí program: Povoleno
Potenciálně nežádoucí modifikace: Povoleno

-Podrobnosti skenování-
Proces: 0
(Nebyly zjištěny žádné škodlivé položky)

Modul: 0
(Nebyly zjištěny žádné škodlivé položky)

Klíč registru: 0
(Nebyly zjištěny žádné škodlivé položky)

Hodnota v registru: 0
(Nebyly zjištěny žádné škodlivé položky)

Data registrů: 0
(Nebyly zjištěny žádné škodlivé položky)

Datové proudy: 0
(Nebyly zjištěny žádné škodlivé položky)

Adresář: 0
(Nebyly zjištěny žádné škodlivé položky)

Soubor: 0
(Nebyly zjištěny žádné škodlivé položky)

Fyzický sektor: 0
(Nebyly zjištěny žádné škodlivé položky)


(end)

Re: Podezření na vir (dllhost.exe - COM Surrogate)

Napsal: 23 úno 2017 20:54
od Rudy
Není tam nic. Zjistěte, v kterých adresářích se nachází soubor dllhost.exe.

Re: Podezření na vir (dllhost.exe - COM Surrogate)

Napsal: 23 úno 2017 21:02
od Peedy
Tak jsem jich našel více:

C:\Windows.old\WINDOWS\WinSxS\wow64_microsoft-windows-com-surrogate-core_31bf3856ad364e35_10.0.14393.0_none_6cb3a5d221ab784a
C:\Windows\syswow64
C:\Windows\WinSxS\wow64_microsoft-windows-com-surrogate-core_31bf3856ad364e35_10.0.14393.0_none_6cb3a5d221ab784a
C:\Windows.old\WINDOWS\System32
C:\Windows.old\WINDOWS\WinSxS\amd64_microsoft-windows-com-surrogate-core_31bf3856ad364e35_10.0.14393.0_none_625efb7fed4ab64f
C:\Windows\System32
C:\Windows\WinSxS\amd64_microsoft-windows-com-surrogate-core_31bf3856ad364e35_10.0.14393.0_none_625efb7fed4ab64f

Všechny tyto dllhost.exe mají stejný popis: COM Surrogate.

Re: Podezření na vir (dllhost.exe - COM Surrogate)

Napsal: 23 úno 2017 21:38
od Rudy
To je také v pořádku, navíc ty v adresáři C:\Windows.old jsou zcela mrtvé (je to zbytek po předchozím oper. systému). Ty ve windows jsou na správných místech, kde je soubor dllhost.exe regulérní. V jiných adresářích by to byl opravdu virus.

Re: Podezření na vir (dllhost.exe - COM Surrogate)

Napsal: 23 úno 2017 21:39
od Peedy
Dá se tedy s tím ještě něco dělat?
Všechny časy jsou v UTC+01:00
Stránka 1 z 2

Založeno na phpBB® Forum Software © phpBB Limited

Český překlad – phpBB.cz