VIRY.CZ

Dobrý den.
Občas mi při bootování nenašel PC HDD, při práci s prohlížečem se mi občas na několik vteřin kouše PC a pak jede dál. Pro boot HDD mi zatím pomohlo přepojení na jinou kšandu řadiče. Provedl jsem scan antivirem a malwarebyte. Disk prohlédl jestli nejsou vadné sektory. Vše se zdá být ok, jen prostě občas PC cca na 5-10 vteřin vytuhne. Prosím o kontrolu jestli se něco něděje co nemá. Děkuji .

Logfile of random's system information tool 1.10 (written by random/random)
Run by muj at 2018-03-15 17:31:19
Microsoft Windows 10 Home
System drive C: has 256 GB (54%) free of 476 GB
Total RAM: 6140 MB (59% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 17:31:36, on 15.03.2018
Platform: Unknown Windows (WinNT 6.02.1008)
MSIE: Internet Explorer v11.0 (11.00.16299.0015)
Boot mode: Normal

Running processes:
C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe
C:\Program Files (x86)\NVIDIA Corporation\NvContainer\nvcontainer.exe
C:\Program Files (x86)\Skype\Phone\Skype.exe
C:\Program Files (x86)\NVIDIA Corporation\NvNode\NVIDIA Web Helper.exe
C:\Program Files\trend micro\muj.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/p/?LinkId=255141
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/p/?LinkId=255141
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/p/?LinkId=255141
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = %11%\blank.htm
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O4 - HKLM\..\Run: [seznam-listicka-distribuce] "C:\Program Files (x86)\Seznam.cz\distribution\szninstall.exe" -s -d listicka 1 szn-software-listicka cz.seznam.software.autoupdate
O4 - HKLM\..\Run: [LogMeIn Hamachi Ui] "C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe" --auto-start
O4 - HKCU\..\Run: [OneDrive] "C:\Users\muj\AppData\Local\Microsoft\OneDrive\OneDrive.exe" /background
O4 - HKCU\..\Run: [cz.seznam.software.autoupdate] "C:\Users\muj\AppData\Roaming\Seznam.cz\szninstall.exe" -c
O4 - HKCU\..\Run: [cz.seznam.software.szndesktop] "C:\Users\muj\AppData\Roaming\Seznam.cz\bin\wszndesktop.exe" -q
O4 - HKCU\..\Run: [Steam] "C:\Program Files (x86)\Steam\steam.exe" -silent
O4 - HKCU\..\Run: [McAfeeSafeConnect] C:\Program Files (x86)\McAfee Safe Connect\McAfee Safe Connect.exe
O4 - HKCU\..\Run: [Skype] "C:\Program Files (x86)\Skype\Phone\Skype.exe" /minimized /regrun
O4 - HKUS\S-1-5-19\..\Run: [OneDriveSetup] C:\Windows\SysWOW64\OneDriveSetup.exe /thfirstsetup (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-03142018201255126\..\Run: [OneDriveSetup] C:\Windows\SysWOW64\OneDriveSetup.exe /thfirstsetup (User '?')
O4 - HKUS\S-1-5-20\..\Run: [OneDriveSetup] C:\Windows\SysWOW64\OneDriveSetup.exe /thfirstsetup (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-03142018201255595\..\Run: [OneDriveSetup] C:\Windows\SysWOW64\OneDriveSetup.exe /thfirstsetup (User '?')
O4 - HKUS\S-1-5-21-1414727818-4048635875-1041125893-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-03142018201255939\..\Run: [OneDrive] "C:\Users\muj\AppData\Local\Microsoft\OneDrive\OneDrive.exe" /background (User '?')
O4 - HKUS\S-1-5-21-1414727818-4048635875-1041125893-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-03142018201255939\..\Run: [Skype] "C:\Program Files (x86)\Skype\Phone\Skype.exe" /minimized /regrun (User '?')
O4 - S-1-5-21-1414727818-4048635875-1041125893-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-03142018201255939 Startup: SyncAudio.vbs (User '?')
O4 - Startup: SyncAudio.vbs
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\Program Files (x86)\Microsoft Office\Root\Office16\EXCEL.EXE/3000
O8 - Extra context menu item: Se&nd to OneNote - res://C:\Program Files (x86)\Microsoft Office\Root\Office16\ONBttnIE.dll/105
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\root\Office16\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Se&nd to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\root\Office16\ONBttnIE.dll
O9 - Extra button: OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files (x86)\Microsoft Office\root\Office16\ONBttnIELinkedNotes.dll
O9 - Extra 'Tools' menuitem: OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files (x86)\Microsoft Office\root\Office16\ONBttnIELinkedNotes.dll
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O18 - Protocol: mso-minsb-roaming.16 - {83C25742-A9F7-49FB-9138-434302C88D07} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL
O18 - Protocol: mso-minsb.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL
O18 - Protocol: osf-roaming.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL
O18 - Protocol: osf.16 - {5504BE45-A83B-4808-900A-3A5C36E7F77A} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL
O18 - Protocol: tbauth - {14654CA6-5711-491D-B89A-58E571679951} - C:\Windows\SysWOW64\tbauth.dll
O18 - Protocol: windows.tbauth - {14654CA6-5711-491D-B89A-58E571679951} - C:\Windows\SysWOW64\tbauth.dll
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\WINDOWS\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\WINDOWS\System32\alg.exe (file missing)
O23 - Service: BattlEye Service (BEService) - Unknown owner - C:\Program Files (x86)\Common Files\BattlEye\BEService.exe
O23 - Service: @%SystemRoot%\system32\DiagSvcs\DiagnosticsHub.StandardCollector.ServiceRes.dll,-1000 (diagnosticshub.standardcollector.service) - Unknown owner - C:\WINDOWS\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe (file missing)
O23 - Service: EasyAntiCheat - EasyAntiCheat Ltd - C:\Program Files (x86)\EasyAntiCheat\EasyAntiCheat.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\WINDOWS\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\WINDOWS\system32\fxssvc.exe (file missing)
O23 - Service: LogMeIn Hamachi Tunneling Engine (Hamachi2Svc) - LogMeIn Inc. - C:\Program Files (x86)\LogMeIn Hamachi\x64\hamachi-2.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\WINDOWS\system32\lsass.exe (file missing)
O23 - Service: LMIGuardianSvc - LogMeIn, Inc. - C:\Program Files (x86)\LogMeIn Hamachi\x64\LMIGuardianSvc.exe
O23 - Service: Malwarebytes Service (MBAMService) - Malwarebytes - C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe
O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\WINDOWS\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\WINDOWS\system32\lsass.exe (file missing)
O23 - Service: NVIDIA LocalSystem Container (NvContainerLocalSystem) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe
O23 - Service: NVIDIA NetworkService Container (NvContainerNetworkService) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe
O23 - Service: NVIDIA Display Container LS (NVDisplay.ContainerLocalSystem) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\Display.NvContainer\NVDisplay.Container.exe
O23 - Service: NVIDIA Telemetry Container (NvTelemetryContainer) - NVIDIA Corporation - C:\Program Files (x86)\NVIDIA Corporation\NvTelemetry\NvTelemetryContainer.exe
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\WINDOWS\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\WINDOWS\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\SecurityHealthAgent.dll,-1002 (SecurityHealthService) - Unknown owner - C:\WINDOWS\system32\SecurityHealthService.exe (file missing)
O23 - Service: @%SystemRoot%\system32\SensorDataService.exe,-101 (SensorDataService) - Unknown owner - C:\WINDOWS\System32\SensorDataService.exe (file missing)
O23 - Service: Skype Updater (SkypeUpdate) - Skype Technologies - C:\Program Files (x86)\Skype\Updater\Updater.exe
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\WINDOWS\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spectrum.exe,-101 (spectrum) - Unknown owner - C:\WINDOWS\system32\spectrum.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\WINDOWS\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\WINDOWS\system32\sppsvc.exe (file missing)
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files (x86)\Common Files\Steam\SteamService.exe
O23 - Service: @%SystemRoot%\system32\TieringEngineService.exe,-702 (TieringEngineService) - Unknown owner - C:\WINDOWS\system32\TieringEngineService.exe (file missing)
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\WINDOWS\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\WINDOWS\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\WINDOWS\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\WINDOWS\system32\vssvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\WINDOWS\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\WINDOWS\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)
O23 - Service: @%systemroot%\system32\xbgmsvc.exe,-100 (xbgm) - Unknown owner - C:\WINDOWS\system32\xbgmsvc.exe (file missing)

--
End of file - 10589 bytes

======Listing Processes======

C:\WINDOWS\system32\lsass.exe
c:\windows\system32\svchost.exe -k dcomlaunch -p -s PlugPlay
"fontdrvhost.exe"
C:\WINDOWS\system32\svchost.exe -k DcomLaunch -p
c:\windows\system32\svchost.exe -k rpcss -p
c:\windows\system32\svchost.exe -k dcomlaunch -p -s LSM
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -p -s NcbService
c:\windows\system32\svchost.exe -k localservicenetworkrestricted -p -s TimeBrokerSvc
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -p -s hidserv
c:\windows\system32\svchost.exe -k localservicenetworkrestricted -p -s EventLog
c:\windows\system32\svchost.exe -k localservice -p -s nsi
c:\windows\system32\svchost.exe -k netsvcs -p -s lfsvc
c:\windows\system32\svchost.exe -k localservicenetworkrestricted -p -s Dhcp
c:\windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
c:\windows\system32\svchost.exe -k networkservice -p -s NlaSvc
"C:\Program Files\NVIDIA Corporation\Display.NvContainer\NVDisplay.Container.exe" -s NVDisplay.ContainerLocalSystem -f "C:\ProgramData\NVIDIA\NVDisplay.ContainerLocalSystem.log" -l 3 -d "C:\Program Files\NVIDIA Corporation\Display.NvContainer\plugins\LocalSystem" -r -p 30000
c:\windows\system32\svchost.exe -k localservice -p -s netprofm
c:\windows\system32\svchost.exe -k netsvcs -p -s UserManager
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -p -s SysMain
c:\windows\system32\svchost.exe -k localservice -p -s EventSystem
c:\windows\system32\svchost.exe -k netsvcs -p -s Themes

c:\windows\system32\svchost.exe -k netsvcs -p -s SENS
c:\windows\system32\svchost.exe -k netsvcs -p -s Schedule
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -p -s AudioEndpointBuilder
c:\windows\system32\svchost.exe -k localservice -p -s FontCache
c:\windows\system32\svchost.exe -k networkservice -p -s Dnscache
c:\windows\system32\svchost.exe -k localservicenetworkrestricted -p -s WinHttpAutoProxySvc
C:\WINDOWS\System32\svchost.exe -k LocalServiceNetworkRestricted -p
C:\WINDOWS\system32\svchost.exe -k LocalServiceNetworkRestricted -p
C:\WINDOWS\System32\svchost.exe -k LocalServiceNetworkRestricted -p
c:\windows\system32\svchost.exe -k netsvcs -p -s ShellHWDetection
C:\WINDOWS\System32\spoolsv.exe
c:\windows\system32\svchost.exe -k localservicenonetwork -p
c:\windows\system32\svchost.exe -k networkservice -p -s LanmanWorkstation
c:\windows\system32\svchost.exe -k appmodel -p -s StateRepository

"C:\Program Files (x86)\LogMeIn Hamachi\x64\LMIGuardianSvc.exe"
"C:\Program Files (x86)\NVIDIA Corporation\NvTelemetry\NvTelemetryContainer.exe" -s NvTelemetryContainer -f "C:\ProgramData\NVIDIA\NvTelemetryContainer.log" -l 3 -d "C:\Program Files (x86)\NVIDIA Corporation\NvTelemetry\plugins" -r
C:\WINDOWS\System32\svchost.exe -k utcsvc -p
c:\windows\system32\svchost.exe -k localservicenonetwork -p -s DPS
C:\WINDOWS\system32\svchost.exe -k imgsvc
c:\windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
c:\windows\system32\svchost.exe -k netsvcs -p -s WpnService
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -p -s TrkWks
c:\windows\system32\svchost.exe -k networkservice -p -s CryptSvc
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -p -s DeviceAssociationService
"C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe" -s NvContainerLocalSystem -a -f "C:\ProgramData\NVIDIA\NvContainerLocalSystem.log" -l 3 -d "C:\Program Files\NVIDIA Corporation\NvContainer\plugins\LocalSystem" -r -p 30000 -st "C:\Program Files\NVIDIA Corporation\NvContainer\NvContainerTelemetryApi.dll"
c:\windows\system32\svchost.exe -k localservice -p -s WdiServiceHost

"C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe"
"C:\Program Files (x86)\LogMeIn Hamachi\x64\hamachi-2.exe" -s
c:\windows\system32\svchost.exe -k netsvcs -p -s iphlpsvc
dashost.exe {0e1b7e5b-6c96-40f2-9a24538e34be6350}
c:\windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -p -s PcaSvc
c:\windows\system32\svchost.exe -k netsvcs -p -s TokenBroker
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -p -s TabletInputService
c:\windows\system32\svchost.exe -k localservice -p -s CDPSvc
c:\windows\system32\svchost.exe -k localserviceandnoimpersonation -p -s SSDPSRV
c:\windows\system32\svchost.exe -k networkservice -p -s DoSvc
c:\windows\system32\svchost.exe -k localservice -p -s LicenseManager
c:\windows\system32\svchost.exe -k localservicenetworkrestricted -p -s wscsvc
C:\WINDOWS\system32\svchost.exe -k LocalService -p -s SEMgrSvc
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -p -s StorSvc
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -p -s DsSvc
c:\windows\system32\svchost.exe -k localservice -s W32Time

C:\WINDOWS\System32\WinLogon.exe -SpecialSession
"fontdrvhost.exe"
"dwm.exe"
C:\WINDOWS\system32\svchost.exe -k netsvcs -p -s gpsvc
"C:\Program Files\NVIDIA Corporation\Display.NvContainer\NVDisplay.Container.exe" -f "C:\ProgramData\NVIDIA\DisplaySessionContainer%d.log" -d "C:\Program Files\NVIDIA Corporation\Display.NvContainer\plugins\Session" -r -l 3 -p 30000 -c
C:\WINDOWS\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
"C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe"
"C:\Program Files (x86)\NVIDIA Corporation\NvContainer\nvcontainer.exe" -f "C:\ProgramData\NVIDIA\NvContainerUser%d.log" -d "C:\Program Files (x86)\NVIDIA Corporation\NvContainer\plugins\User" -r -l 3 -p 30000 -st "C:\Program Files (x86)\NVIDIA Corporation\NvContainer\NvContainerTelemetryApi.dll" -c
sihost.exe
c:\windows\system32\svchost.exe -k unistacksvcgroup -s CDPUserSvc
c:\windows\system32\svchost.exe -k unistacksvcgroup -s WpnUserService
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
C:\WINDOWS\Explorer.EXE

"C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mca
"C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca
C:\Windows\System32\RuntimeBroker.exe -Embedding
C:\Windows\System32\RuntimeBroker.exe -Embedding
"C:\Program Files\WindowsApps\Microsoft.SkypeApp_12.1807.264.0_x64__kzf8qxf38zg5c\SkypeHost.exe" -ServerName:SkypeHost.ServerServer
"ctfmon.exe"
"C:\Program Files\Windows Defender\MSASCuiL.exe"
"C:\Program Files (x86)\Skype\Phone\Skype.exe" /minimized /regrun
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /user
"C:\Program Files\Mozilla Firefox\firefox.exe"
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.9029.2253\OfficeClickToRun.exe" /update
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4172.0.1573353177\1307154535" -greomni "C:\Program Files\Mozilla Firefox\omni.ja" -appomni "C:\Program Files\Mozilla Firefox\browser\omni.ja" -appdir "C:\Program Files\Mozilla Firefox\browser" "C:\Users\muj\AppData\LocalLow\Mozilla\Temp-{4abe005c-ec4a-420d-bd27-1b0242f1aeae}" 4172 "\\.\pipe\gecko-crash-server-pipe.4172" gpu
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4172.3.799496395\1659074763" -childID 1 -isForBrowser -intPrefs 6:50|7:-1|34:1000|42:20|43:5|44:10|51:0|57:128|58:10000|63:0|65:400|66:1|67:0|68:0|69:100|74:0|75:120|76:120|159:2|160:1|164:60|165:30|166:512000|175:5000|177:6|191:8192|192:524288|193:5|206:10000|227:24|228:32768|230:0|231:0|240:5|244:1048576|246:100|247:5000|249:600|251:1|260:2000|277:4|281:0|290:60000|308:300|309:30| -boolPrefs 1:0|2:0|4:1|5:0|24:1|27:0|28:1|29:1|31:1|32:1|33:1|36:0|37:0|38:1|41:1|45:1|46:0|47:0|48:1|49:1|50:1|52:0|55:1|56:1|59:0|60:0|61:0|62:0|64:0|70:1|71:1|72:0|73:1|77:1|78:1|79:0|80:0|81:1|82:1|83:0|84:1|87:0|88:0|91:1|92:1|96:1|97:1|98:0|99:1|100:0|101:0|103:0|104:0|105:1|106:1|107:1|110:1|111:1|112:1|113:1|114:1|115:0|116:0|117:0|119:0|120:1|121:1|122:0|123:0|124:0|125:0|127:1|128:0|129:1|130:1|131:1|132:0|133:0|134:1|135:1|136:1|137:1|138:0|139:1|140:1|141:1|142:1|143:1|144:1|145:0|146:1|147:1|148:0|149:1|150:0|152:0|153:0|154:0|155:1|156:1|157:1|158:1|161:1|162:0|172:0|173:0|174:1|178:1|181:0|182:1|184:1|186:0|188:1|194:1|195:0|196:1|197:1|198:0|201:1|205:1|207:1|208:0|210:1|213:0|219:0|220:1|221:0|222:1|225:0|226:0|229:1|232:0|234:1|235:1|237:1|238:0|245:1|248:1|253:0|254:0|255:0|256:1|257:1|258:0|259:1|264:0|267:1|268:1|269:1|270:1|271:1|272:0|273:0|279:0|282:0|283:0|284:1|285:1|286:0|287:1|288:1|289:1|291:0|292:0|294:0|303:1|304:1|305:0|306:0|307:0| -stringPrefs "3:7;release|151:0;|212:3;1.0|223:332; ¼½¾ǃː̷̸։֊׃״؉؊٪۔܁܂܃܄ᅟᅠ᜵ ‎‏‐’․‧  ‪‫‬‭‮ ‹›⁁⁄⁒ ⅓⅔⅕⅖⅗⅘⅙⅚⅛⅜⅝⅞⅟∕∶⎮╱⧶⧸⫻⫽⿰⿱⿲⿳⿴⿵⿶⿷⿸⿹⿺⿻　。〔〕〳゠ㅤ㈝㈞㎮㎯㏆㏟꞉︔︕︿﹝﹞．／｡ﾠ￹￺￻�|224:4;high|278:38;{4abe005c-ec4a-420d-bd27-1b0242f1aeae}|" -schedulerPrefs 0001,2 -greomni "C:\Program Files\Mozilla Firefox\omni.ja" -appomni "C:\Program Files\Mozilla Firefox\browser\omni.ja" -appdir "C:\Program Files\Mozilla Firefox\browser" 4172 "\\.\pipe\gecko-crash-server-pipe.4172" tab
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4172.13.142964411\269702553" -childID 2 -isForBrowser -intPrefs 6:50|7:-1|34:1000|42:20|43:5|44:10|51:0|57:128|58:10000|63:0|65:400|66:1|67:0|68:0|69:100|74:0|75:120|76:120|159:2|160:1|164:60|165:30|166:512000|175:5000|177:6|191:8192|192:524288|193:5|206:10000|227:24|228:32768|230:0|231:0|240:5|244:1048576|246:100|247:5000|249:600|251:1|260:2000|277:4|281:0|290:60000|308:300|309:30| -boolPrefs 1:0|2:0|4:1|5:0|24:1|27:0|28:1|29:1|31:1|32:1|33:1|36:0|37:0|38:1|41:1|45:1|46:0|47:0|48:1|49:1|50:1|52:0|55:1|56:1|59:0|60:0|61:0|62:0|64:0|70:1|71:1|72:0|73:1|77:1|78:1|79:0|80:0|81:1|82:1|83:0|84:1|87:0|88:0|91:1|92:1|96:1|97:1|98:0|99:1|100:0|101:0|103:0|104:0|105:1|106:1|107:1|110:1|111:1|112:1|113:1|114:1|115:0|116:0|117:0|119:0|120:1|121:1|122:0|123:0|124:0|125:0|127:1|128:0|129:1|130:1|131:1|132:0|133:0|134:1|135:1|136:1|137:1|138:0|139:1|140:1|141:1|142:1|143:1|144:1|145:0|146:1|147:1|148:0|149:1|150:0|152:0|153:0|154:0|155:1|156:1|157:1|158:1|161:1|162:0|172:0|173:0|174:1|178:1|181:0|182:1|184:1|186:0|188:1|194:1|195:0|196:1|197:1|198:0|201:1|205:1|207:1|208:0|210:1|213:0|219:0|220:1|221:0|222:1|225:0|226:0|229:1|232:0|234:1|235:1|237:1|238:0|245:1|248:1|253:0|254:0|255:0|256:1|257:1|258:0|259:1|264:0|267:1|268:1|269:1|270:1|271:1|272:0|273:0|279:0|282:0|283:0|284:1|285:1|286:0|287:1|288:1|289:1|291:0|292:0|294:0|303:1|304:1|305:0|306:0|307:0| -stringPrefs "3:7;release|151:0;|212:3;1.0|223:332; ¼½¾ǃː̷̸։֊׃״؉؊٪۔܁܂܃܄ᅟᅠ᜵ ‎‏‐’․‧  ‪‫‬‭‮ ‹›⁁⁄⁒ ⅓⅔⅕⅖⅗⅘⅙⅚⅛⅜⅝⅞⅟∕∶⎮╱⧶⧸⫻⫽⿰⿱⿲⿳⿴⿵⿶⿷⿸⿹⿺⿻　。〔〕〳゠ㅤ㈝㈞㎮㎯㏆㏟꞉︔︕︿﹝﹞．／｡ﾠ￹￺￻�|224:4;high|278:38;{4abe005c-ec4a-420d-bd27-1b0242f1aeae}|" -schedulerPrefs 0001,2 -greomni "C:\Program Files\Mozilla Firefox\omni.ja" -appomni "C:\Program Files\Mozilla Firefox\browser\omni.ja" -appdir "C:\Program Files\Mozilla Firefox\browser" 4172 "\\.\pipe\gecko-crash-server-pipe.4172" tab
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4172.20.1085485001\1408375321" -childID 3 -isForBrowser -intPrefs 6:50|7:-1|34:1000|42:20|43:5|44:10|51:0|57:128|58:10000|63:0|65:400|66:1|67:0|68:0|69:100|74:0|75:120|76:120|159:2|160:1|164:60|165:30|166:512000|175:5000|177:6|191:8192|192:524288|193:5|206:10000|227:24|228:32768|230:0|231:0|240:5|244:1048576|246:100|247:5000|249:600|251:1|260:2000|277:4|281:0|290:60000|308:300|309:30| -boolPrefs 1:0|2:0|4:1|5:0|24:1|27:0|28:1|29:1|31:1|32:1|33:1|36:0|37:0|38:1|41:1|45:1|46:0|47:0|48:1|49:1|50:1|52:0|55:1|56:1|59:0|60:0|61:0|62:0|64:0|70:1|71:1|72:0|73:1|77:1|78:1|79:0|80:0|81:1|82:1|83:0|84:1|87:0|88:0|91:1|92:1|96:1|97:1|98:0|99:1|100:0|101:0|103:0|104:0|105:1|106:1|107:1|110:1|111:1|112:1|113:1|114:1|115:0|116:0|117:0|119:0|120:1|121:1|122:0|123:0|124:0|125:0|127:1|128:0|129:1|130:1|131:1|132:0|133:0|134:1|135:1|136:1|137:1|138:0|139:1|140:1|141:1|142:1|143:1|144:1|145:0|146:1|147:1|148:0|149:1|150:0|152:0|153:0|154:0|155:1|156:1|157:1|158:1|161:1|162:0|172:0|173:0|174:1|178:1|181:0|182:1|184:1|186:0|188:1|194:1|195:0|196:1|197:1|198:0|201:1|205:1|207:1|208:0|210:1|213:0|219:0|220:1|221:0|222:1|225:0|226:0|229:1|232:0|234:1|235:1|237:1|238:0|245:1|248:1|253:0|254:0|255:0|256:1|257:1|258:0|259:1|264:0|267:1|268:1|269:1|270:1|271:1|272:0|273:0|279:0|282:0|283:0|284:1|285:1|286:0|287:1|288:1|289:1|291:0|292:0|294:0|303:1|304:1|305:0|306:0|307:0| -stringPrefs "3:7;release|151:0;|212:3;1.0|223:332; ¼½¾ǃː̷̸։֊׃״؉؊٪۔܁܂܃܄ᅟᅠ᜵ ‎‏‐’․‧  ‪‫‬‭‮ ‹›⁁⁄⁒ ⅓⅔⅕⅖⅗⅘⅙⅚⅛⅜⅝⅞⅟∕∶⎮╱⧶⧸⫻⫽⿰⿱⿲⿳⿴⿵⿶⿷⿸⿹⿺⿻　。〔〕〳゠ㅤ㈝㈞㎮㎯㏆㏟꞉︔︕︿﹝﹞．／｡ﾠ￹￺￻�|224:4;high|278:38;{4abe005c-ec4a-420d-bd27-1b0242f1aeae}|" -schedulerPrefs 0001,2 -greomni "C:\Program Files\Mozilla Firefox\omni.ja" -appomni "C:\Program Files\Mozilla Firefox\browser\omni.ja" -appdir "C:\Program Files\Mozilla Firefox\browser" 4172 "\\.\pipe\gecko-crash-server-pipe.4172" tab
"C:\Program Files (x86)\NVIDIA Corporation\NvNode\NVIDIA Web Helper.exe" index.js
\??\C:\WINDOWS\system32\conhost.exe 0x4
C:\Windows\System32\RuntimeBroker.exe -Embedding
c:\windows\system32\svchost.exe -k unistacksvcgroup
c:\windows\system32\svchost.exe -k netsvcs
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4172.48.1169899614\1652450159" -childID 7 -isForBrowser -intPrefs 6:50|7:-1|34:1000|42:20|43:5|44:10|51:0|57:128|58:10000|63:0|65:400|66:1|67:0|68:0|69:100|74:0|75:120|76:120|159:2|160:1|164:60|165:30|166:512000|175:5000|177:6|191:8192|192:524288|193:5|206:10000|227:24|228:32768|230:0|231:0|240:5|244:1048576|246:100|247:5000|249:600|251:1|260:2000|277:4|281:0|290:60000|308:300|309:30| -boolPrefs 1:0|2:0|4:1|5:0|24:1|27:0|28:1|29:1|31:1|32:1|33:1|36:0|37:0|38:1|41:1|45:1|46:0|47:0|48:1|49:1|50:1|52:0|55:1|56:1|59:0|60:0|61:0|62:0|64:0|70:1|71:1|72:0|73:1|77:1|78:1|79:0|80:0|81:1|82:1|83:0|84:1|87:0|88:0|91:1|92:1|96:1|97:1|98:0|99:1|100:0|101:0|103:0|104:0|105:1|106:1|107:1|110:1|111:1|112:1|113:1|114:1|115:0|116:0|117:0|119:0|120:1|121:1|122:0|123:0|124:0|125:0|127:1|128:0|129:1|130:1|131:1|132:0|133:0|134:1|135:1|136:1|137:1|138:0|139:1|140:1|141:1|142:1|143:1|144:1|145:0|146:1|147:1|148:0|149:1|150:0|152:0|153:0|154:0|155:1|156:1|157:1|158:1|161:1|162:0|172:0|173:0|174:1|178:1|181:0|182:1|184:1|186:0|188:1|194:1|195:0|196:1|197:1|198:0|201:1|205:1|207:1|208:0|210:1|213:0|219:0|220:1|221:0|222:1|225:0|226:0|229:1|232:0|234:1|235:1|237:1|238:0|245:1|248:1|253:0|254:0|255:0|256:1|257:1|258:0|259:1|264:0|267:1|268:1|269:1|270:1|271:1|272:0|273:0|279:0|282:0|283:0|284:1|285:1|286:0|287:1|288:1|289:1|291:0|292:0|294:0|303:1|304:1|305:0|306:0|307:0| -stringPrefs "3:7;release|151:0;|212:3;1.0|223:332; ¼½¾ǃː̷̸։֊׃״؉؊٪۔܁܂܃܄ᅟᅠ᜵ ‎‏‐’․‧  ‪‫‬‭‮ ‹›⁁⁄⁒ ⅓⅔⅕⅖⅗⅘⅙⅚⅛⅜⅝⅞⅟∕∶⎮╱⧶⧸⫻⫽⿰⿱⿲⿳⿴⿵⿶⿷⿸⿹⿺⿻　。〔〕〳゠ㅤ㈝㈞㎮㎯㏆㏟꞉︔︕︿﹝﹞．／｡ﾠ￹￺￻�|224:4;high|278:38;{4abe005c-ec4a-420d-bd27-1b0242f1aeae}|" -schedulerPrefs 0001,2 -greomni "C:\Program Files\Mozilla Firefox\omni.ja" -appomni "C:\Program Files\Mozilla Firefox\browser\omni.ja" -appdir "C:\Program Files\Mozilla Firefox\browser" 4172 "\\.\pipe\gecko-crash-server-pipe.4172" tab
C:\WINDOWS\System32\svchost.exe -k netsvcs -p
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\WINDOWS\system32\svchost.exe -k appmodel -p -s tiledatamodelsvc

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4172.62.1469288539\1810363559" -childID 9 -isForBrowser -intPrefs 6:50|7:-1|34:1000|42:20|43:5|44:10|51:0|57:128|58:10000|63:0|65:400|66:1|67:0|68:0|69:100|74:0|75:120|76:120|159:2|160:1|164:60|165:30|166:512000|175:5000|177:6|191:8192|192:524288|193:5|206:10000|227:24|228:32768|230:0|231:0|240:5|244:1048576|246:100|247:5000|249:600|251:1|260:2000|277:4|281:0|290:60000|308:300|309:30| -boolPrefs 1:0|2:0|4:1|5:0|24:1|27:0|28:1|29:1|31:1|32:1|33:1|36:0|37:0|38:1|41:1|45:1|46:0|47:0|48:1|49:1|50:1|52:0|55:1|56:1|59:0|60:0|61:0|62:0|64:0|70:1|71:1|72:0|73:1|77:1|78:1|79:0|80:0|81:1|82:1|83:0|84:1|87:0|88:0|91:1|92:1|96:1|97:1|98:0|99:1|100:0|101:0|103:0|104:0|105:1|106:1|107:1|110:1|111:1|112:1|113:1|114:1|115:0|116:0|117:0|119:0|120:1|121:1|122:0|123:0|124:0|125:0|127:1|128:0|129:1|130:1|131:1|132:0|133:0|134:1|135:1|136:1|137:1|138:0|139:1|140:1|141:1|142:1|143:1|144:1|145:0|146:1|147:1|148:0|149:1|150:0|152:0|153:0|154:0|155:1|156:1|157:1|158:1|161:1|162:0|172:0|173:0|174:1|178:1|181:0|182:1|184:1|186:0|188:1|194:1|195:0|196:1|197:1|198:0|201:1|205:1|207:1|208:0|210:1|213:0|219:0|220:1|221:0|222:1|225:0|226:0|229:1|232:0|234:1|235:1|237:1|238:0|245:1|248:1|253:0|254:0|255:0|256:1|257:1|258:0|259:1|264:0|267:1|268:1|269:1|270:1|271:1|272:0|273:0|279:0|282:0|283:0|284:1|285:1|286:0|287:1|288:1|289:1|291:0|292:0|294:0|303:1|304:1|305:0|306:0|307:0| -stringPrefs "3:7;release|151:0;|212:3;1.0|223:332; ¼½¾ǃː̷̸։֊׃״؉؊٪۔܁܂܃܄ᅟᅠ᜵ ‎‏‐’․‧  ‪‫‬‭‮ ‹›⁁⁄⁒ ⅓⅔⅕⅖⅗⅘⅙⅚⅛⅜⅝⅞⅟∕∶⎮╱⧶⧸⫻⫽⿰⿱⿲⿳⿴⿵⿶⿷⿸⿹⿺⿻　。〔〕〳゠ㅤ㈝㈞㎮㎯㏆㏟꞉︔︕︿﹝﹞．／｡ﾠ￹￺￻�|224:4;high|278:38;{4abe005c-ec4a-420d-bd27-1b0242f1aeae}|" -schedulerPrefs 0001,2 -greomni "C:\Program Files\Mozilla Firefox\omni.ja" -appomni "C:\Program Files\Mozilla Firefox\browser\omni.ja" -appdir "C:\Program Files\Mozilla Firefox\browser" 4172 "\\.\pipe\gecko-crash-server-pipe.4172" tab
C:\WINDOWS\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s WdiSystemHost
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVShNotify.exe"
c:\windows\system32\svchost.exe -k netsvcs -p -s Appinfo
C:\WINDOWS\system32\AUDIODG.EXE 0x65c
"C:\Users\muj\Downloads\RSITx64.exe"
integrator.exe /I /Extension /Msi PackageGUID="9AC08E99-230B-47e8-9721-4577B7F124EA" PackageRoot="C:\Program Files (x86)\Microsoft Office\root"
\??\C:\WINDOWS\system32\conhost.exe 0x4
C:\WINDOWS\system32\svchost.exe -k netsvcs -p -s DsmSvc
C:\WINDOWS\system32\SearchIndexer.exe /Embedding
C:\WINDOWS\system32\msiexec.exe /V

=========Mozilla firefox=========

ProfilePath - C:\Users\muj\AppData\Roaming\Mozilla\Firefox\Profiles\bhqw26pn.default

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 29.0.0.113 Plugin
"Path"=C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_29_0_0_113.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@microsoft.com/SharePoint,version=14.0]
"Description"=Microsoft SharePoint Plug-in for Firefox
"Path"=C:\Program Files (x86)\Microsoft Office\root\Office16\NPSPWRAP.DLL

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@nvidia.com/3DVision]
"Description"=NVIDIA stereo images plugin for Mozilla browsers
"Path"=C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@nvidia.com/3DVisionStreaming]
"Description"=NVIDIA 3D Vision Streaming plugin for Mozilla browsers
"Path"=C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 29.0.0.113 Plugin
"Path"=C:\WINDOWS\system32\Macromed\Flash\NPSWF64_29_0_0_113.dll

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA}]
Lync Browser Helper - C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesX64\Microsoft Office\Office16\OCHelper.dll [2018-03-02 207016]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"SecurityHealth"=C:\Program Files\Windows Defender\MSASCuiL.exe [2017-09-29 630168]
"MouseDriver"=C:\WINDOWS\system32\TiltWheelMouse.exe [2013-04-09 241152]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"OneDrive"=C:\Users\muj\AppData\Local\Microsoft\OneDrive\OneDrive.exe [2018-03-06 1559200]
"cz.seznam.software.autoupdate"=C:\Users\muj\AppData\Roaming\Seznam.cz\szninstall.exe [2013-05-16 1062472]
"cz.seznam.software.szndesktop"=C:\Users\muj\AppData\Roaming\Seznam.cz\bin\wszndesktop.exe [2015-05-26 103080]
"Steam"=C:\Program Files (x86)\Steam\steam.exe [2017-12-15 3111712]
"McAfeeSafeConnect"=C:\Program Files (x86)\McAfee Safe Connect\McAfee Safe Connect.exe []
"Skype"=C:\Program Files (x86)\Skype\Phone\Skype.exe [2017-10-10 27832264]

[HKEY_LOCAL_MACHINE\Software\wow6432node\Microsoft\Windows\CurrentVersion\Run]
"seznam-listicka-distribuce"=C:\Program Files (x86)\Seznam.cz\distribution\szninstall.exe [2013-05-16 1062472]
"LogMeIn Hamachi Ui"=C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe [2017-06-29 5885352]

C:\Users\muj\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
SyncAudio.vbs

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Ahcache.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\CoreMessagingRegistrar]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\iai2c.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MBAMService]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SerCx2.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SpbCx.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\StateRepository]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\TileDataModelSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\uefi.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\UserManager]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{F2E7DD72-6468-4E36-B6F1-6488F42C1B52}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Ahcache.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\CoreMessagingRegistrar]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\MBAMService]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\NetSetupSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\SerCx2.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\SpbCx.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\StateRepository]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\TileDataModelSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\uefi.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\UserManager]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{F2E7DD72-6468-4E36-B6F1-6488F42C1B52}]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"DSCAutomationHostEnabled"=2
"EnableFullTrustStartupTasks"=2
"EnableUwpStartupTasks"=2
"SupportFullTrustStartupTasks"=1
"SupportUwpStartupTasks"=1

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"midimapper"=midimap.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.l3acm"=C:\Windows\System32\l3codeca.acm
"msacm.msadpcm"=msadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"vidc.i420"=iyuv_32.dll
"vidc.iyuv"=iyuv_32.dll
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"vidc.uyvy"=msyuv.dll
"vidc.yuy2"=msyuv.dll
"vidc.yvu9"=tsbyuv.dll
"vidc.yvyu"=msyuv.dll
"wavemapper"=msacm32.drv
"VIDC.FPS1"=frapsv64.dll
"wave1"=wdmaud.drv
"midi1"=wdmaud.drv
"mixer1"=wdmaud.drv
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*

======List of files/folders created in the last 1 month======

2018-03-15 17:31:19 ----D---- C:\rsit
2018-03-15 17:31:19 ----D---- C:\Program Files\trend micro
2018-03-14 20:12:13 ----A---- C:\WINDOWS\SYSWOW64\FlashPlayerApp.exe
2018-03-14 20:11:47 ----A---- C:\WINDOWS\system32\drivers\mbam.sys
2018-03-13 19:27:16 ----A---- C:\WINDOWS\SYSWOW64\msIso.dll
2018-03-13 19:27:16 ----A---- C:\WINDOWS\SYSWOW64\edgeIso.dll
2018-03-13 19:27:16 ----A---- C:\WINDOWS\system32\Windows.Media.Protection.PlayReady.dll
2018-03-13 19:27:16 ----A---- C:\WINDOWS\system32\SecurityHealthProxyStub.dll
2018-03-13 19:27:15 ----A---- C:\WINDOWS\SYSWOW64\Windows.Media.Protection.PlayReady.dll
2018-03-13 19:27:15 ----A---- C:\WINDOWS\SYSWOW64\vbscript.dll
2018-03-13 19:27:15 ----A---- C:\WINDOWS\SYSWOW64\AcSpecfc.dll
2018-03-13 19:27:14 ----A---- C:\WINDOWS\SYSWOW64\edgehtml.dll
2018-03-13 19:27:12 ----A---- C:\WINDOWS\SYSWOW64\mshtml.dll
2018-03-13 19:27:12 ----A---- C:\WINDOWS\SYSWOW64\jscript9diag.dll
2018-03-13 19:27:12 ----A---- C:\WINDOWS\SYSWOW64\jscript.dll
2018-03-13 19:27:12 ----A---- C:\WINDOWS\system32\drivers\USBXHCI.SYS
2018-03-13 19:27:12 ----A---- C:\WINDOWS\system32\drivers\dxgmms1.sys
2018-03-13 19:27:12 ----A---- C:\WINDOWS\system32\drivers\dumpsd.sys
2018-03-13 19:27:11 ----A---- C:\WINDOWS\SYSWOW64\jscript9.dll
2018-03-13 19:27:10 ----A---- C:\WINDOWS\SYSWOW64\iertutil.dll
2018-03-13 19:27:09 ----A---- C:\WINDOWS\SYSWOW64\win32kfull.sys
2018-03-13 19:27:09 ----A---- C:\WINDOWS\system32\rdpudd.dll
2018-03-13 19:27:09 ----A---- C:\WINDOWS\system32\drivers\volmgr.sys
2018-03-13 19:27:09 ----A---- C:\WINDOWS\system32\drivers\storahci.sys
2018-03-13 19:27:09 ----A---- C:\WINDOWS\system32\drivers\hidparse.sys
2018-03-13 19:27:09 ----A---- C:\WINDOWS\system32\drivers\acpi.sys
2018-03-13 19:27:08 ----A---- C:\WINDOWS\system32\drivers\USBHUB3.SYS
2018-03-13 19:27:08 ----A---- C:\WINDOWS\system32\drivers\storufs.sys
2018-03-13 19:27:08 ----A---- C:\WINDOWS\system32\drivers\sdbus.sys
2018-03-13 19:27:08 ----A---- C:\WINDOWS\system32\drivers\pci.sys
2018-03-13 19:27:08 ----A---- C:\WINDOWS\system32\drivers\dxgmms2.sys
2018-03-13 19:27:08 ----A---- C:\WINDOWS\system32\drivers\BasicRender.sys
2018-03-13 19:27:07 ----A---- C:\WINDOWS\SYSWOW64\ieframe.dll
2018-03-13 19:27:07 ----A---- C:\WINDOWS\system32\drivers\wcifs.sys
2018-03-13 19:27:06 ----A---- C:\WINDOWS\SYSWOW64\Chakra.dll
2018-03-13 19:27:06 ----A---- C:\WINDOWS\system32\vbscript.dll
2018-03-13 19:27:06 ----A---- C:\WINDOWS\system32\samsrv.dll
2018-03-13 19:27:06 ----A---- C:\WINDOWS\system32\jscript9.dll
2018-03-13 19:27:06 ----A---- C:\WINDOWS\system32\DbgModel.dll
2018-03-13 19:27:05 ----A---- C:\WINDOWS\SYSWOW64\Windows.Data.Pdf.dll
2018-03-13 19:27:05 ----A---- C:\WINDOWS\SYSWOW64\dbgeng.dll
2018-03-13 19:27:04 ----A---- C:\WINDOWS\SYSWOW64\wininet.dll
2018-03-13 19:27:04 ----A---- C:\WINDOWS\SYSWOW64\KernelBase.dll
2018-03-13 19:27:04 ----A---- C:\WINDOWS\SYSWOW64\d3d10warp.dll
2018-03-13 19:27:04 ----A---- C:\WINDOWS\system32\drivers\UcmUcsi.sys
2018-03-13 19:27:04 ----A---- C:\WINDOWS\system32\drivers\srv2.sys
2018-03-13 19:27:03 ----A---- C:\WINDOWS\system32\StorSvc.dll
2018-03-13 19:27:03 ----A---- C:\WINDOWS\system32\iertutil.dll
2018-03-13 19:27:03 ----A---- C:\WINDOWS\system32\edgeIso.dll
2018-03-13 19:27:02 ----A---- C:\WINDOWS\system32\win32kfull.sys
2018-03-13 19:27:02 ----A---- C:\WINDOWS\system32\win32kbase.sys
2018-03-13 19:27:02 ----A---- C:\WINDOWS\system32\ntoskrnl.exe
2018-03-13 19:27:01 ----A---- C:\WINDOWS\system32\jscript9diag.dll
2018-03-13 19:27:01 ----A---- C:\WINDOWS\system32\ieframe.dll
2018-03-13 19:27:00 ----A---- C:\WINDOWS\SYSWOW64\winmde.dll
2018-03-13 19:27:00 ----A---- C:\WINDOWS\SYSWOW64\msvproc.dll
2018-03-13 19:27:00 ----A---- C:\WINDOWS\system32\jscript.dll
2018-03-13 19:27:00 ----A---- C:\WINDOWS\system32\Chakra.dll
2018-03-13 19:27:00 ----A---- C:\WINDOWS\system32\hvloader.dll
2018-03-13 19:27:00 ----A---- C:\WINDOWS\system32\hvax64.exe
2018-03-13 19:27:00 ----A---- C:\WINDOWS\system32\drivers\vmbus.sys
2018-03-13 19:27:00 ----A---- C:\WINDOWS\system32\drivers\netvsc.sys
2018-03-13 19:27:00 ----A---- C:\WINDOWS\system32\drivers\msiscsi.sys
2018-03-13 19:26:59 ----A---- C:\WINDOWS\SYSWOW64\mfplat.dll
2018-03-13 19:26:59 ----A---- C:\WINDOWS\system32\rdpcorets.dll
2018-03-13 19:26:59 ----A---- C:\WINDOWS\system32\lsasrv.dll
2018-03-13 19:26:59 ----A---- C:\WINDOWS\system32\drivers\spaceport.sys
2018-03-13 19:26:59 ----A---- C:\WINDOWS\system32\dbgeng.dll
2018-03-13 19:26:58 ----A---- C:\WINDOWS\system32\Windows.Data.Pdf.dll
2018-03-13 19:26:57 ----A---- C:\WINDOWS\system32\drivers\dxgkrnl.sys
2018-03-13 19:26:57 ----A---- C:\WINDOWS\system32\d3d10warp.dll
2018-03-13 19:26:56 ----A---- C:\WINDOWS\system32\wininet.dll
2018-03-13 19:26:56 ----A---- C:\WINDOWS\system32\msIso.dll
2018-03-13 19:26:56 ----A---- C:\WINDOWS\system32\KernelBase.dll
2018-03-13 19:26:56 ----A---- C:\WINDOWS\system32\AcSpecfc.dll
2018-03-13 19:26:55 ----A---- C:\WINDOWS\system32\drivers\WdiWiFi.sys
2018-03-13 19:26:55 ----A---- C:\WINDOWS\system32\drivers\nwifi.sys
2018-03-13 19:26:54 ----A---- C:\WINDOWS\system32\mshtml.dll
2018-03-13 19:26:53 ----A---- C:\WINDOWS\system32\winmde.dll
2018-03-13 19:26:53 ----A---- C:\WINDOWS\system32\msvproc.dll
2018-03-13 19:26:53 ----A---- C:\WINDOWS\system32\mfplat.dll
2018-03-13 19:26:53 ----A---- C:\WINDOWS\system32\hvix64.exe
2018-03-13 19:26:53 ----A---- C:\WINDOWS\system32\drivers\vhdmp.sys
2018-03-13 19:26:52 ----A---- C:\WINDOWS\system32\edgehtml.dll
2018-03-13 19:26:51 ----A---- C:\WINDOWS\SYSWOW64\wintrust.dll
2018-03-13 19:26:50 ----A---- C:\WINDOWS\SYSWOW64\zipfldr.dll
2018-03-13 19:26:50 ----A---- C:\WINDOWS\SYSWOW64\rpcrt4.dll
2018-03-13 19:26:50 ----A---- C:\WINDOWS\system32\wintrust.dll
2018-03-13 19:26:50 ----A---- C:\WINDOWS\system32\windows.storage.dll
2018-03-13 19:26:50 ----A---- C:\WINDOWS\system32\pcalua.exe
2018-03-13 19:26:49 ----A---- C:\WINDOWS\system32\zipfldr.dll
2018-03-13 19:26:49 ----A---- C:\WINDOWS\system32\winsrv.dll
2018-03-13 19:26:49 ----A---- C:\WINDOWS\system32\rpcrt4.dll
2018-03-13 19:26:49 ----A---- C:\WINDOWS\system32\aitstatic.exe
2018-03-13 19:26:48 ----A---- C:\WINDOWS\SYSWOW64\windows.storage.dll
2018-03-13 19:26:48 ----A---- C:\WINDOWS\SYSWOW64\daxexec.dll
2018-03-13 19:26:48 ----A---- C:\WINDOWS\system32\shell32.dll
2018-03-13 19:26:47 ----A---- C:\WINDOWS\SYSWOW64\shell32.dll
2018-03-13 19:26:46 ----A---- C:\WINDOWS\system32\HologramCompositor.dll
2018-03-13 19:26:44 ----A---- C:\WINDOWS\system32\usoapi.dll
2018-03-13 19:26:44 ----A---- C:\WINDOWS\system32\updatehandlers.dll
2018-03-13 19:26:44 ----A---- C:\WINDOWS\system32\MusUpdateHandlers.dll
2018-03-13 19:26:44 ----A---- C:\WINDOWS\system32\MusNotificationUx.exe
2018-03-13 19:26:44 ----A---- C:\WINDOWS\system32\MusNotification.exe
2018-03-13 19:26:44 ----A---- C:\WINDOWS\system32\musdialoghandlers.dll
2018-03-13 19:26:43 ----A---- C:\WINDOWS\system32\usocore.dll
2018-03-13 19:26:33 ----A---- C:\WINDOWS\SYSWOW64\aepic.dll
2018-03-13 19:26:33 ----A---- C:\WINDOWS\system32\winresume.exe
2018-03-13 19:26:33 ----A---- C:\WINDOWS\system32\winload.exe
2018-03-13 19:26:33 ----A---- C:\WINDOWS\system32\win32appinventorycsp.dll
2018-03-13 19:26:33 ----A---- C:\WINDOWS\system32\pcasvc.dll
2018-03-13 19:26:33 ----A---- C:\WINDOWS\system32\invagent.dll
2018-03-13 19:26:33 ----A---- C:\WINDOWS\system32\drivers\cng.sys
2018-03-13 19:26:33 ----A---- C:\WINDOWS\system32\devinv.dll
2018-03-13 19:26:33 ----A---- C:\WINDOWS\system32\DeviceCensus.exe
2018-03-13 19:26:33 ----A---- C:\WINDOWS\system32\dcntel.dll
2018-03-13 19:26:33 ----A---- C:\WINDOWS\system32\CompatTelRunner.exe
2018-03-13 19:26:33 ----A---- C:\WINDOWS\system32\aepic.dll
2018-03-13 19:26:32 ----A---- C:\WINDOWS\system32\generaltel.dll
2018-03-13 19:26:32 ----A---- C:\WINDOWS\system32\appraiser.dll
2018-03-13 19:26:32 ----A---- C:\WINDOWS\system32\aeinv.dll
2018-03-13 19:26:32 ----A---- C:\WINDOWS\system32\acmigration.dll
2018-03-13 19:26:31 ----A---- C:\WINDOWS\system32\Spectrum.exe
2018-03-13 19:26:31 ----A---- C:\WINDOWS\system32\HolographicExtensions.dll
2018-03-13 19:26:31 ----A---- C:\WINDOWS\system32\cldapi.dll
2018-03-13 19:26:31 ----A---- C:\WINDOWS\system32\cdp.dll
2018-03-13 19:26:30 ----A---- C:\WINDOWS\system32\Windows.Payments.dll
2018-03-13 19:26:30 ----A---- C:\WINDOWS\system32\webplatstorageserver.dll
2018-03-13 19:26:30 ----A---- C:\WINDOWS\system32\SecurityHealthService.exe
2018-03-13 19:26:30 ----A---- C:\WINDOWS\system32\daxexec.dll
2018-03-13 19:26:29 ----A---- C:\WINDOWS\SYSWOW64\Windows.Payments.dll
2018-03-13 19:26:29 ----A---- C:\WINDOWS\SYSWOW64\webplatstorageserver.dll
2018-03-13 19:26:29 ----A---- C:\WINDOWS\SYSWOW64\usoapi.dll
2018-03-13 19:26:29 ----A---- C:\WINDOWS\system32\MSVidCtl.dll
2018-03-13 19:26:28 ----A---- C:\WINDOWS\system32\wlidsvc.dll
2018-03-13 19:26:27 ----A---- C:\WINDOWS\SYSWOW64\cldapi.dll
2018-03-13 19:26:27 ----A---- C:\WINDOWS\SYSWOW64\cdp.dll
2018-03-13 19:26:26 ----A---- C:\WINDOWS\system32\MusNotifyIcon.exe
2018-03-13 19:26:26 ----A---- C:\WINDOWS\system32\drivers\sdstor.sys
2018-03-13 19:26:25 ----A---- C:\WINDOWS\SYSWOW64\msi.dll
2018-03-13 19:26:25 ----A---- C:\WINDOWS\system32\msi.dll
2018-03-13 19:26:24 ----A---- C:\WINDOWS\SYSWOW64\MSVidCtl.dll
2018-03-13 19:26:24 ----A---- C:\WINDOWS\SYSWOW64\AuthFWSnapin.dll
2018-03-13 19:26:24 ----A---- C:\WINDOWS\system32\drivers\RfxVmt.sys
2018-03-13 19:26:24 ----A---- C:\WINDOWS\system32\AuthFWSnapin.dll
2018-03-13 19:26:23 ----A---- C:\WINDOWS\system32\MSVPXENC.dll
2018-03-13 19:26:23 ----A---- C:\WINDOWS\system32\MicrosoftAccountWAMExtension.dll
2018-03-13 19:26:23 ----A---- C:\WINDOWS\system32\cdpusersvc.dll
2018-03-13 19:26:22 ----A---- C:\WINDOWS\SYSWOW64\TSpkg.dll
2018-03-13 19:26:22 ----A---- C:\WINDOWS\system32\TSpkg.dll
2018-03-13 19:26:22 ----A---- C:\WINDOWS\system32\MSVideoDSP.dll
2018-03-13 19:26:21 ----A---- C:\WINDOWS\SYSWOW64\MSVPXENC.dll
2018-03-13 19:26:21 ----A---- C:\WINDOWS\system32\SecurityHealthAgent.dll
2018-03-13 19:26:21 ----A---- C:\WINDOWS\system32\msra.exe
2018-03-13 19:26:20 ----A---- C:\WINDOWS\SYSWOW64\MSVideoDSP.dll
2018-03-13 19:26:20 ----A---- C:\WINDOWS\SYSWOW64\MicrosoftAccountWAMExtension.dll
2018-03-13 19:26:20 ----A---- C:\WINDOWS\system32\Windows.Internal.Feedback.Analog.dll
2018-03-13 19:26:20 ----A---- C:\WINDOWS\system32\updatecsp.dll
2018-03-13 19:26:20 ----A---- C:\WINDOWS\system32\offlinesam.dll
2018-03-13 19:26:20 ----A---- C:\WINDOWS\system32\offlinelsa.dll
2018-03-13 19:26:20 ----A---- C:\WINDOWS\system32\EdgeManager.dll
2018-03-13 19:26:20 ----A---- C:\WINDOWS\system32\drivers\stornvme.sys
2018-03-13 19:26:19 ----A---- C:\WINDOWS\SYSWOW64\offlinesam.dll
2018-03-13 19:26:19 ----A---- C:\WINDOWS\SYSWOW64\offlinelsa.dll
2018-03-13 19:26:19 ----A---- C:\WINDOWS\SYSWOW64\EdgeManager.dll
2018-03-13 19:26:19 ----A---- C:\WINDOWS\system32\svf.dll
2018-03-13 19:26:19 ----A---- C:\WINDOWS\system32\HoloShellRuntime.dll
2018-03-13 19:26:19 ----A---- C:\WINDOWS\system32\drivers\wcnfs.sys
2018-03-13 19:26:19 ----A---- C:\WINDOWS\system32\drivers\tpm.sys
2018-03-13 19:26:19 ----A---- C:\WINDOWS\system32\drivers\msrpc.sys
2018-03-13 19:26:19 ----A---- C:\WINDOWS\system32\drivers\ksecpkg.sys
2018-03-13 19:26:19 ----A---- C:\WINDOWS\system32\drivers\isapnp.sys
2018-03-13 19:26:19 ----A---- C:\WINDOWS\system32\drivers\HdAudio.sys
2018-03-13 19:26:19 ----A---- C:\WINDOWS\system32\drivers\ataport.sys
2018-03-13 19:26:18 ----A---- C:\WINDOWS\SYSWOW64\msisip.dll
2018-03-13 19:26:18 ----A---- C:\WINDOWS\SYSWOW64\IndexedDbLegacy.dll
2018-03-13 19:26:18 ----A---- C:\WINDOWS\SYSWOW64\HoloShellRuntime.dll
2018-03-13 19:26:18 ----A---- C:\WINDOWS\SYSWOW64\credssp.dll
2018-03-13 19:26:18 ----A---- C:\WINDOWS\system32\UsoClient.exe
2018-03-13 19:26:18 ----A---- C:\WINDOWS\system32\SpectrumSyncClient.dll
2018-03-13 19:26:18 ----A---- C:\WINDOWS\system32\racpldlg.dll
2018-03-13 19:26:18 ----A---- C:\WINDOWS\system32\IndexedDbLegacy.dll
2018-03-13 19:26:18 ----A---- C:\WINDOWS\system32\HeadTrackerStorage.dll
2018-03-13 19:26:18 ----A---- C:\WINDOWS\system32\credssp.dll
2018-03-13 19:26:17 ----A---- C:\WINDOWS\system32\msisip.dll
2018-03-11 15:09:10 ----A---- C:\WINDOWS\system32\drivers\MbamChameleon.sys
2018-03-11 15:09:04 ----A---- C:\WINDOWS\system32\drivers\mwac.sys
2018-03-11 15:09:04 ----A---- C:\WINDOWS\system32\drivers\farflt.sys
2018-03-11 15:09:01 ----A---- C:\WINDOWS\system32\drivers\mbamswissarmy.sys
2018-03-09 20:08:14 ----A---- C:\WINDOWS\SYSWOW64\nvspcap.dll
2018-03-09 20:08:14 ----A---- C:\WINDOWS\system32\nvspcap64.dll
2018-03-09 20:08:14 ----A---- C:\WINDOWS\system32\NvRtmpStreamer64.dll
2018-03-09 20:07:04 ----A---- C:\WINDOWS\SYSWOW64\nvStreaming.exe
2018-03-09 20:06:50 ----A---- C:\WINDOWS\SYSWOW64\nvaudcap32v.dll
2018-03-09 20:06:50 ----A---- C:\WINDOWS\system32\nvaudcap64v.dll
2018-03-09 20:06:47 ----A---- C:\WINDOWS\NvTelemetryContainerRecovery.bat
2018-03-09 20:06:46 ----A---- C:\WINDOWS\SYSWOW64\vulkaninfo.exe
2018-03-09 20:06:45 ----A---- C:\WINDOWS\SYSWOW64\vulkan-1.dll
2018-03-09 20:06:45 ----A---- C:\WINDOWS\system32\vulkaninfo.exe
2018-03-09 20:06:45 ----A---- C:\WINDOWS\system32\vulkan-1.dll
2018-03-09 20:06:44 ----D---- C:\Program Files (x86)\VulkanRT
2018-03-09 20:05:35 ----D---- C:\WINDOWS\system32\drivers\NVIDIA Corporation
2018-03-09 20:02:39 ----A---- C:\WINDOWS\system32\drivers\nvvhci.sys
2018-03-09 20:02:23 ----A---- C:\WINDOWS\system32\nvhdap64.dll
2018-03-09 20:02:22 ----A---- C:\WINDOWS\system32\drivers\nvvad64v.sys
2018-03-09 20:02:21 ----A---- C:\WINDOWS\SYSWOW64\nvptxJitCompiler.dll
2018-03-09 20:02:21 ----A---- C:\WINDOWS\SYSWOW64\nvopencl.dll
2018-03-09 20:02:21 ----A---- C:\WINDOWS\SYSWOW64\NvIFROpenGL.dll
2018-03-09 20:02:21 ----A---- C:\WINDOWS\SYSWOW64\NvIFR.dll
2018-03-09 20:02:21 ----A---- C:\WINDOWS\SYSWOW64\NvFBC.dll
2018-03-09 20:02:21 ----A---- C:\WINDOWS\SYSWOW64\nvfatbinaryLoader.dll
2018-03-09 20:02:21 ----A---- C:\WINDOWS\SYSWOW64\nvEncodeAPI.dll
2018-03-09 20:02:21 ----A---- C:\WINDOWS\SYSWOW64\nvEncMFTH264.dll
2018-03-09 20:02:21 ----A---- C:\WINDOWS\SYSWOW64\nvDecMFTMjpeg.dll
2018-03-09 20:02:21 ----A---- C:\WINDOWS\system32\nvptxJitCompiler.dll
2018-03-09 20:02:21 ----A---- C:\WINDOWS\system32\nvopencl.dll
2018-03-09 20:02:21 ----A---- C:\WINDOWS\system32\nvmcumd.dll
2018-03-09 20:02:21 ----A---- C:\WINDOWS\system32\NvIFROpenGL.dll
2018-03-09 20:02:21 ----A---- C:\WINDOWS\system32\NvIFR64.dll
2018-03-09 20:02:21 ----A---- C:\WINDOWS\system32\NvFBC64.dll
2018-03-09 20:02:21 ----A---- C:\WINDOWS\system32\nvfatbinaryLoader.dll
2018-03-09 20:02:21 ----A---- C:\WINDOWS\system32\nvEncodeAPI64.dll
2018-03-09 20:02:21 ----A---- C:\WINDOWS\system32\nvEncMFTH264.dll
2018-03-09 20:02:21 ----A---- C:\WINDOWS\system32\nvdispgenco6439101.dll
2018-03-09 20:02:21 ----A---- C:\WINDOWS\system32\nvdispco6439101.dll
2018-03-09 20:02:21 ----A---- C:\WINDOWS\system32\nvDecMFTMjpeg.dll
2018-03-09 20:02:20 ----A---- C:\WINDOWS\SYSWOW64\nvcuda.dll
2018-03-09 20:02:20 ----A---- C:\WINDOWS\system32\nvcuvid.dll
2018-03-09 20:02:20 ----A---- C:\WINDOWS\system32\nvcuda.dll
2018-03-09 20:02:19 ----A---- C:\WINDOWS\SYSWOW64\nvcuvid.dll
2018-03-09 20:02:19 ----A---- C:\WINDOWS\SYSWOW64\nvcompiler.dll
2018-03-09 20:02:19 ----A---- C:\WINDOWS\SYSWOW64\nvapi.dll
2018-03-09 20:02:19 ----A---- C:\WINDOWS\system32\nvcompiler.dll
2018-03-09 19:53:33 ----D---- C:\NVIDIA
2018-03-09 11:10:45 ----A---- C:\WINDOWS\system32\drivers\mbae64.sys
2018-03-06 12:05:48 ----D---- C:\Users\muj\AppData\Roaming\vghost
2018-03-02 06:37:06 ----D---- C:\WINDOWS\system32\drivers\wd
2018-02-27 14:45:10 ----D---- C:\Program Files (x86)\Warcraft III - Gold Edition
2018-02-17 18:32:10 ----A---- C:\WINDOWS\SYSWOW64\XAudio2_2.dll
2018-02-17 18:32:10 ----A---- C:\WINDOWS\SYSWOW64\XAPOFX1_1.dll
2018-02-17 18:32:09 ----A---- C:\WINDOWS\SYSWOW64\d3dx10_39.dll
2018-02-17 18:32:09 ----A---- C:\WINDOWS\SYSWOW64\D3DCompiler_39.dll
2018-02-17 18:32:07 ----A---- C:\WINDOWS\SYSWOW64\D3DX9_39.dll

======List of files/folders modified in the last 1 month======

2018-03-15 17:31:38 ----SHDC---- C:\WINDOWS\Installer
2018-03-15 17:31:35 ----D---- C:\WINDOWS\Prefetch
2018-03-15 17:31:19 ----RD---- C:\Program Files
2018-03-15 17:31:19 ----D---- C:\WINDOWS\DeliveryOptimization
2018-03-15 17:31:06 ----D---- C:\WINDOWS\Temp
2018-03-15 17:30:49 ----HD---- C:\Program Files\WindowsApps
2018-03-15 17:30:29 ----AD---- C:\Program Files (x86)\Microsoft Office
2018-03-15 17:30:21 ----D---- C:\WINDOWS\AppReadiness
2018-03-15 17:29:43 ----D---- C:\ProgramData\NVIDIA
2018-03-15 17:27:49 ----D---- C:\Users\muj\AppData\Roaming\Skype
2018-03-15 17:25:04 ----D---- C:\Program Files (x86)\Steam
2018-03-15 17:24:22 ----D---- C:\WINDOWS\system32\sru
2018-03-15 15:50:34 ----D---- C:\Program Files (x86)\Mozilla Maintenance Service
2018-03-15 15:50:32 ----AD---- C:\Program Files\Mozilla Firefox
2018-03-15 15:41:29 ----D---- C:\WINDOWS\system32\drivers
2018-03-14 20:59:44 ----D---- C:\WINDOWS\rescache
2018-03-14 20:58:36 ----RD---- C:\WINDOWS\Microsoft.NET
2018-03-14 20:19:38 ----D---- C:\WINDOWS\system32\config
2018-03-14 20:18:33 ----D---- C:\WINDOWS\System32
2018-03-14 20:18:33 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2018-03-14 20:12:35 ----D---- C:\WINDOWS\WinSxS
2018-03-14 20:12:30 ----D---- C:\WINDOWS\INF
2018-03-14 20:12:13 ----D---- C:\WINDOWS\SysWOW64
2018-03-14 20:11:37 ----D---- C:\WINDOWS\system32\DriverStore
2018-03-14 20:11:06 ----D---- C:\WINDOWS\system32\catroot2
2018-03-13 20:59:23 ----D---- C:\WINDOWS\TextInput
2018-03-13 20:59:22 ----D---- C:\WINDOWS\system32\cs-CZ
2018-03-13 20:59:22 ----D---- C:\WINDOWS\system32\appraiser
2018-03-13 20:59:21 ----D---- C:\WINDOWS\ShellExperiences
2018-03-13 20:59:21 ----D---- C:\WINDOWS\apppatch
2018-03-13 20:59:20 ----D---- C:\WINDOWS\system32\Boot
2018-03-13 20:59:07 ----D---- C:\WINDOWS\system32\drivers\UMDF
2018-03-13 19:42:50 ----D---- C:\WINDOWS\CbsTemp
2018-03-13 19:41:46 ----D---- C:\WINDOWS\system32\MRT
2018-03-13 19:38:53 ----AC---- C:\WINDOWS\system32\MRT-KB890830.exe
2018-03-13 19:38:45 ----AC---- C:\WINDOWS\system32\MRT.exe
2018-03-13 19:25:33 ----SHD---- C:\System Volume Information
2018-03-13 19:10:46 ----D---- C:\WINDOWS\Logs
2018-03-13 19:03:31 ----D---- C:\WINDOWS\system32\Tasks
2018-03-13 19:03:14 ----D---- C:\WINDOWS\system32\Macromed
2018-03-13 19:03:08 ----D---- C:\WINDOWS\SYSWOW64\Macromed
2018-03-11 17:15:56 ----D---- C:\Users\muj\AppData\Roaming\Factorio
2018-03-11 17:06:33 ----D---- C:\WINDOWS\system32\SleepStudy
2018-03-11 15:12:59 ----D---- C:\WINDOWS\LiveKernelReports
2018-03-11 15:07:59 ----D---- C:\WINDOWS\Minidump
2018-03-11 15:07:57 ----D---- C:\Windows
2018-03-10 10:39:52 ----D---- C:\WINDOWS\system32\LogFiles
2018-03-09 20:26:01 ----D---- C:\Users\muj\AppData\Roaming\Seznam.cz
2018-03-09 20:18:09 ----D---- C:\WINDOWS\system32\drivers\en-US
2018-03-09 20:17:33 ----D---- C:\ProgramData\NVIDIA Corporation
2018-03-09 20:08:14 ----D---- C:\Program Files\NVIDIA Corporation
2018-03-09 20:08:14 ----D---- C:\Program Files (x86)\NVIDIA Corporation
2018-03-09 20:07:38 ----RD---- C:\Program Files (x86)
2018-03-09 20:06:46 ----D---- C:\Users\muj\AppData\Roaming\NVIDIA
2018-03-09 11:41:55 ----D---- C:\WINDOWS\system32\WDI
2018-03-09 11:10:53 ----HD---- C:\ProgramData
2018-03-09 11:10:39 ----D---- C:\ProgramData\Malwarebytes
2018-03-07 18:33:31 ----A---- C:\WINDOWS\SYSWOW64\Chakradiag.dll
2018-03-07 18:32:50 ----A---- C:\WINDOWS\system32\Chakradiag.dll
2018-03-07 18:32:45 ----RD---- C:\WINDOWS\assembly
2018-03-02 06:42:42 ----RD---- C:\Program Files\Windows Defender
2018-03-02 06:18:29 ----D---- C:\ProgramData\regid.1991-06.com.microsoft
2018-03-02 06:17:53 ----D---- C:\Program Files (x86)\Common Files
2018-02-26 20:04:46 ----AD---- C:\Program Files (x86)\McAfee Safe Connect
2018-02-26 19:25:06 ----D---- C:\Users\muj\AppData\Roaming\discord
2018-02-26 16:07:53 ----D---- C:\Users\muj\AppData\Roaming\vbhost
2018-02-26 04:42:08 ----A---- C:\WINDOWS\system32\nvapi64.dll
2018-02-25 23:11:33 ----A---- C:\WINDOWS\system32\nvhdagenco6420103.dll
2018-02-23 20:22:35 ----A---- C:\WINDOWS\system32\nvsvc64.dll
2018-02-23 20:22:35 ----A---- C:\WINDOWS\system32\nvcpl.dll
2018-02-23 20:22:25 ----A---- C:\WINDOWS\system32\nvsvcr.dll
2018-02-23 20:22:25 ----A---- C:\WINDOWS\system32\nvshext.dll
2018-02-23 20:22:25 ----A---- C:\WINDOWS\system32\nvmctray.dll
2018-02-23 20:22:25 ----A---- C:\WINDOWS\system32\nv3dappshextr.dll
2018-02-23 20:22:25 ----A---- C:\WINDOWS\system32\nv3dappshext.dll
2018-02-23 20:06:07 ----D---- C:\Users\muj\AppData\Roaming\.minecraft
2018-02-23 17:36:12 ----D---- C:\Users\muj\AppData\Roaming\TS3Client
2018-02-17 18:30:56 ----D---- C:\Riot Games

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 iorate;@%SystemRoot%\system32\drivers\iorate.sys,-101; C:\WINDOWS\system32\drivers\iorate.sys [2017-09-29 56728]
R0 storufs;@storufs.inf,%UfsServiceDesc%;Microsoft Universal Flash Storage (UFS) Driver; C:\WINDOWS\System32\drivers\storufs.sys [2018-02-22 45472]
R1 bam;@%SystemRoot%\system32\drivers\bam.sys,-100; C:\WINDOWS\system32\drivers\bam.sys [2018-01-01 59800]
R1 ESProtectionDriver;Malwarebytes Anti-Exploit; \??\C:\WINDOWS\system32\drivers\mbae64.sys [2018-01-18 76200]
R1 FileCrypt;@%systemroot%\system32\drivers\filecrypt.sys,-100; C:\WINDOWS\system32\drivers\filecrypt.sys [2017-09-29 55808]
R1 GpuEnergyDrv;@%SystemRoot%\system32\drivers\gpuenergydrv.sys,-100; C:\WINDOWS\System32\drivers\gpuenergydrv.sys [2017-09-29 8192]
R1 MpKsld2d4940c;MpKsld2d4940c; \??\C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{C86FC879-4955-4E6B-ACFD-BB82C7BBB177}\MpKsld2d4940c.sys [2018-03-14 58120]
R2 CldFlt;Windows Cloud Files Filter Driver; C:\WINDOWS\system32\drivers\cldflt.sys [2018-02-10 385536]
R2 MBAMChameleon;MBAMChameleon; C:\WINDOWS\System32\Drivers\MbamChameleon.sys [2018-03-11 193248]
R2 MMCSS;@%systemroot%\system32\drivers\mmcss.sys,-100; C:\WINDOWS\system32\drivers\mmcss.sys [2017-09-29 43520]
R2 storqosflt;@%SystemRoot%\System32\drivers\storqosflt.sys,-101; C:\WINDOWS\system32\drivers\storqosflt.sys [2017-09-29 79872]
R3 Hamachi;@oem19.inf,%Hamachi.Service.DispName%;LogMeIn Hamachi Virtual Miniport); C:\WINDOWS\System32\drivers\Hamdrv.sys [2017-06-29 45680]
R3 MBAMFarflt;MBAMFarflt; C:\WINDOWS\system32\DRIVERS\farflt.sys [2018-03-14 109800]
R3 MBAMProtection;MBAMProtection; C:\WINDOWS\system32\DRIVERS\mbam.sys [2018-03-14 45960]
R3 MBAMSwissArmy;MBAMSwissArmy; C:\WINDOWS\System32\Drivers\mbamswissarmy.sys [2018-03-14 253664]
R3 MBAMWebProtection;MBAMWebProtection; C:\WINDOWS\system32\DRIVERS\mwac.sys [2018-03-15 101600]
R3 NVHDA;@oem24.inf,%NVHDA.SvcDesc%;Service for NVIDIA High Definition Audio Driver; C:\WINDOWS\system32\drivers\nvhda64v.sys [2018-02-25 226760]
R3 nvlddmkm;nvlddmkm; C:\WINDOWS\System32\DriverStore\FileRepository\nv_dispi.inf_amd64_048172e9d7cc483d\nvlddmkm.sys [2018-02-26 17524720]
R3 nvvad_WaveExtensible;@oem10.inf,%nvvad_WaveExtensible.SvcDesc%;NVIDIA Virtual Audio Device (Wave Extensible) (WDM); C:\WINDOWS\system32\drivers\nvvad64v.sys [2017-12-15 59240]
R3 nvvhci;@oem27.inf,%ServiceDesc%;NVVHCI Enumerator Service; C:\WINDOWS\System32\drivers\nvvhci.sys [2018-01-10 57928]
R3 rt640x64;@rt640x64.inf,%rt640.Service.DispName%;Realtek RT640 NT Driver; C:\WINDOWS\System32\drivers\rt640x64.sys [2017-09-29 604160]
R3 RTL8023x64;@netrtl64.inf,%Rtlnicx64.Service.DispName%;Realtek 10/100 NIC Family NDIS x64 Driver; C:\WINDOWS\System32\drivers\Rtnic64.sys [2017-09-29 51712]
S0 bttflt;@virtdisk.inf,%service_desc%;Microsoft Hyper-V VHDPMEM BTT Filter; C:\WINDOWS\System32\drivers\bttflt.sys [2017-09-29 37784]
S0 cht4iscsi;cht4iscsi; C:\WINDOWS\System32\drivers\cht4sx64.sys [2017-09-29 357272]
S0 LSI_SAS2i;LSI_SAS2i; C:\WINDOWS\System32\drivers\lsi_sas2i.sys [2017-09-29 123800]
S0 LSI_SAS3i;LSI_SAS3i; C:\WINDOWS\System32\drivers\lsi_sas3i.sys [2017-09-29 103320]
S0 megasas2i;megasas2i; C:\WINDOWS\System32\drivers\MegaSas2i.sys [2017-09-29 63520]
S0 percsas2i;percsas2i; C:\WINDOWS\System32\drivers\percsas2i.sys [2017-09-29 58776]
S0 percsas3i;percsas3i; C:\WINDOWS\System32\drivers\percsas3i.sys [2017-09-29 61848]
S0 Ramdisk;Windows RAM Disk Driver; C:\WINDOWS\system32\DRIVERS\ramdisk.sys [2017-09-29 39832]
S0 scmbus;@scmbus.inf,%scmbus.SvcDesc%;Microsoft Storage Class Memory Bus Driver; C:\WINDOWS\System32\drivers\scmbus.sys [2017-09-29 118168]
S3 AcpiDev;@acpidev.inf,%AcpiDev.SvcDesc%;ACPI Devices driver; C:\WINDOWS\System32\drivers\AcpiDev.sys [2017-09-29 20480]
S3 applockerfltr;@%systemroot%\system32\srpapi.dll,-102; C:\WINDOWS\system32\drivers\applockerfltr.sys [2017-09-29 18432]
S3 buttonconverter;@buttonconverter.inf,%btnconv.SvcDesc%;Service for Portable Device Control devices; C:\WINDOWS\System32\drivers\buttonconverter.sys [2017-09-29 39424]
S3 CAD;@ChargeArbitration.inf,%CAD_DevDesc%;Charge Arbitration Driver; C:\WINDOWS\System32\drivers\CAD.sys [2017-09-29 60312]
S3 CapImg;@capimg.inf,%CapImgHid_Service%;HID driver for CapImg touch screen; C:\WINDOWS\System32\drivers\capimg.sys [2017-09-29 122368]
S3 genericusbfn;@genericusbfn.inf,%genericusbfn.ServiceName%;Generic USB Function Class; C:\WINDOWS\System32\drivers\genericusbfn.sys [2017-09-29 20992]
S3 hidinterrupt;@hidinterrupt.inf,%HID_Interrupt.SvcDesc%;Common Driver for HID Buttons implemented with interrupts; C:\WINDOWS\System32\drivers\hidinterrupt.sys [2017-09-29 50584]
S3 hvservice;@%SystemRoot%\system32\drivers\hvservice.sys,-16; C:\WINDOWS\system32\drivers\hvservice.sys [2017-09-29 73112]
S3 HwNClx0101;Microsoft Hardware Notifications Class Extension Driver; C:\WINDOWS\System32\Drivers\mshwnclx.sys [2017-09-29 27136]
S3 cht4vbd;@cht4vx64.inf,%cht4vbd.generic%;Chelsio Virtual Bus Driver; C:\WINDOWS\System32\drivers\cht4vx64.sys [2017-09-29 1723288]
S3 iagpio;@iagpio.inf,%iagpio.SVCDESC%;Intel Serial IO GPIO Controller Driver; C:\WINDOWS\System32\drivers\iagpio.sys [2017-09-29 36864]
S3 iai2c;@iai2c.inf,%iai2c.SVCDESC%;Intel(R) Serial IO I2C Host Controller; C:\WINDOWS\System32\drivers\iai2c.sys [2017-09-29 91648]
S3 iaLPSS2i_GPIO2;@iaLPSS2i_GPIO2_SKL.inf,%iaLPSS2i_GPIO2.SVCDESC%;Intel(R) Serial IO GPIO Driver v2; C:\WINDOWS\System32\drivers\iaLPSS2i_GPIO2.sys [2017-09-29 79360]
S3 iaLPSS2i_GPIO2_BXT_P;@iaLPSS2i_GPIO2_BXT_P.inf,%iaLPSS2i_GPIO2_BXT_P.SVCDESC%;Intel(R) Serial IO GPIO Driver v2; C:\WINDOWS\System32\drivers\iaLPSS2i_GPIO2_BXT_P.sys [2017-09-29 88576]
S3 iaLPSS2i_I2C;@iaLPSS2i_I2C_SKL.inf,%iaLPSS2i_I2C.SVCDESC%;Intel(R) Serial IO I2C Driver v2; C:\WINDOWS\System32\drivers\iaLPSS2i_I2C.sys [2017-09-29 171520]
S3 iaLPSS2i_I2C_BXT_P;@iaLPSS2i_I2C_BXT_P.inf,%iaLPSS2i_I2C_BXT_P.SVCDESC%;Intel(R) Serial IO I2C Driver v2; C:\WINDOWS\System32\drivers\iaLPSS2i_I2C_BXT_P.sys [2017-09-29 174592]
S3 ibbus;@mlx4_bus.inf,%Ibbus.ServiceDesc%;Mellanox InfiniBand Bus/AL (Filter Driver); C:\WINDOWS\System32\drivers\ibbus.sys [2017-09-29 526232]
S3 IndirectKmd;@%SystemRoot%\system32\drivers\IndirectKmd.sys,-100; C:\WINDOWS\System32\drivers\IndirectKmd.sys [2017-09-29 39424]
S3 invdimm;@invdimm.inf,%invdimm.SvcDesc%;Microsoft iNVDIMM device driver; C:\WINDOWS\System32\drivers\invdimm.sys [2017-09-29 38912]
S3 IPT;IPT; C:\WINDOWS\System32\drivers\ipt.sys [2017-09-29 26112]
S3 irda;IrDA; C:\WINDOWS\system32\drivers\irda.sys [2017-09-29 119808]
S3 mausbhost;@mausbhost.inf,%MAUSBHost.ServiceName%;MA-USB Host Controller Driver; C:\WINDOWS\System32\drivers\mausbhost.sys [2017-09-29 505240]
S3 mausbip;@mausbhost.inf,%MAUSBIP.ServiceName%;MA-USB IP Filter Driver; C:\WINDOWS\System32\drivers\mausbip.sys [2017-09-29 55840]
S3 mlx4_bus;@mlx4_bus.inf,%MLX4BUS.ServiceDesc%;Mellanox ConnectX Bus Enumerator; C:\WINDOWS\System32\drivers\mlx4_bus.sys [2017-09-29 842648]
S3 ndfltr;@mlx4_bus.inf,%ndfltr.ServiceDesc%;NetworkDirect Service; C:\WINDOWS\System32\drivers\ndfltr.sys [2017-09-29 108952]
S3 NetAdapterCx;Network Adapter Wdf Class Extension Library; C:\WINDOWS\system32\drivers\NetAdapterCx.sys [2017-09-29 132608]
S3 nvdimmn;@nvdimmn.inf,%nvdimmn.SvcDesc%;Microsoft NVDIMM-N device driver; C:\WINDOWS\System32\drivers\nvdimmn.sys [2017-09-29 88576]
S3 NvStreamKms;NVIDIA KMS; \??\C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [2018-01-10 30280]
S3 pmem;@pmem.inf,%pmem.SvcDesc%;Microsoft persistent memory disk driver; C:\WINDOWS\System32\drivers\pmem.sys [2017-09-29 100352]
S3 PNPMEM;@memory.inf,%PNPMEM.SvcDesc%;Microsoft Memory Module Driver; C:\WINDOWS\System32\drivers\pnpmem.sys [2017-09-29 16896]
S3 ReFSv1;ReFSv1; C:\WINDOWS\system32\drivers\ReFSv1.sys [2017-09-29 936856]
S3 rhproxy;@rhproxy.inf,%rhproxy.SVCDESC%;Resource Hub proxy driver; C:\WINDOWS\System32\drivers\rhproxy.sys [2017-09-29 103936]
S3 SDFRd;@SDFRd.inf,%SDFRd.ServiceDesc%;SDF Reflector; C:\WINDOWS\System32\drivers\SDFRd.sys [2017-09-29 33176]
S3 SpatialGraphFilter;Holographic Spatial Graph Filter; C:\WINDOWS\System32\drivers\SpatialGraphFilter.sys [2017-09-30 56216]
S3 tap0901;@oem15.inf,%DeviceDescription%;TAP-Windows Adapter V9; C:\WINDOWS\System32\drivers\tap0901.sys [2017-10-10 27136]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 CDPSvc;@%SystemRoot%\system32\cdpsvc.dll,-100; C:\WINDOWS\system32\svchost.exe [2017-09-29 48688]
R2 CDPUserSvc_ac85cf;Uživatelská služba platformy připojených zařízení_ac85cf; C:\WINDOWS\system32\svchost.exe [2017-09-29 48688]
R2 ClickToRunSvc;Služba Microsoft Office Klikni a spusť; C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe [2018-03-12 7962288]
R2 CoreMessagingRegistrar;@%SystemRoot%\system32\coremessaging.dll,-1; C:\WINDOWS\system32\svchost.exe [2017-09-29 48688]
R2 DiagTrack;@%SystemRoot%\system32\diagtrack.dll,-3001; C:\WINDOWS\System32\svchost.exe [2017-09-29 48688]
R2 DoSvc;@%systemroot%\system32\dosvc.dll,-100; C:\WINDOWS\System32\svchost.exe [2017-09-29 48688]
R2 DusmSvc;@%SystemRoot%\System32\dusmsvc.dll,-1; C:\WINDOWS\System32\svchost.exe [2017-09-29 48688]
R2 Hamachi2Svc;LogMeIn Hamachi Tunneling Engine; C:\Program Files (x86)\LogMeIn Hamachi\x64\hamachi-2.exe [2017-06-29 3418024]
R2 LMIGuardianSvc;LMIGuardianSvc; C:\Program Files (x86)\LogMeIn Hamachi\x64\LMIGuardianSvc.exe [2016-05-27 419248]
R2 MBAMService;Malwarebytes Service; C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe [2018-03-03 6440736]
R2 NvContainerLocalSystem;NVIDIA LocalSystem Container; C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe [2018-01-10 519240]
R2 NVDisplay.ContainerLocalSystem;NVIDIA Display Container LS; C:\Program Files\NVIDIA Corporation\Display.NvContainer\NVDisplay.Container.exe [2018-02-23 462864]
R2 NvTelemetryContainer;NVIDIA Telemetry Container; C:\Program Files (x86)\NVIDIA Corporation\NvTelemetry\NvTelemetryContainer.exe [2018-01-10 460872]
R2 OneSyncSvc_ac85cf;Hostitel synchronizace_ac85cf; C:\WINDOWS\system32\svchost.exe [2017-09-29 48688]
R2 SecurityHealthService;@%systemroot%\system32\SecurityHealthAgent.dll,-1002; C:\WINDOWS\system32\SecurityHealthService.exe [2018-03-01 519152]
R3 ClipSVC;@%SystemRoot%\system32\ClipSVC.dll,-103; C:\WINDOWS\System32\svchost.exe [2017-09-29 48688]
R3 DsSvc;@%SystemRoot%\system32\dssvc.dll,-10003; C:\WINDOWS\System32\svchost.exe [2017-09-29 48688]
R3 InstallService;@%SystemRoot%\system32\InstallService.dll,-200; C:\WINDOWS\System32\svchost.exe [2017-09-29 48688]
R3 LicenseManager;@%SystemRoot%\system32\licensemanagersvc.dll,-200; C:\WINDOWS\System32\svchost.exe [2017-09-29 48688]
R3 SEMgrSvc;@%SystemRoot%\System32\SEMgrSvc.dll,-1001; C:\WINDOWS\system32\svchost.exe [2017-09-29 48688]
R3 StateRepository;@%SystemRoot%\system32\windows.staterepository.dll,-1; C:\WINDOWS\system32\svchost.exe [2017-09-29 48688]
R3 tiledatamodelsvc;@%SystemRoot%\system32\tileobjserver.dll,-1; C:\WINDOWS\system32\svchost.exe [2017-09-29 48688]
R3 TimeBrokerSvc;@%windir%\system32\TimeBrokerServer.dll,-1001; C:\WINDOWS\system32\svchost.exe [2017-09-29 48688]
R3 TokenBroker;@%systemroot%\system32\tokenbroker.dll,-100; C:\WINDOWS\system32\svchost.exe [2017-09-29 48688]
S2 CDPUserSvc;@%SystemRoot%\system32\cdpusersvc.dll,-100; C:\WINDOWS\system32\svchost.exe [2017-09-29 48688]
S2 MapsBroker;@%SystemRoot%\System32\moshost.dll,-100; C:\WINDOWS\System32\svchost.exe [2017-09-29 48688]
S2 OneSyncSvc;@%SystemRoot%\system32\APHostRes.dll,-10002; C:\WINDOWS\system32\svchost.exe [2017-09-29 48688]
S2 SkypeUpdate;Skype Updater; C:\Program Files (x86)\Skype\Updater\Updater.exe [2017-07-18 317408]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service; C:\WINDOWS\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2018-03-13 272384]
S3 AJRouter;@%SystemRoot%\system32\AJRouter.dll,-2; C:\WINDOWS\system32\svchost.exe [2017-09-29 48688]
S3 BEService;BattlEye Service; C:\Program Files (x86)\Common Files\BattlEye\BEService.exe [2018-03-10 7013384]
S3 BthHFSrv;@%SystemRoot%\System32\BthHFSrv.dll,-103; C:\WINDOWS\System32\svchost.exe [2017-09-29 48688]
S3 camsvc;@%SystemRoot%\system32\CapabilityAccessManager.dll,-1; C:\WINDOWS\system32\svchost.exe [2017-09-29 48688]
S3 DevicesFlowUserSvc;@%SystemRoot%\system32\DevicesFlowBroker.dll,-103; C:\WINDOWS\system32\svchost.exe [2017-09-29 48688]
S3 DevicesFlowUserSvc_ac85cf;Tok zařízení_ac85cf; C:\WINDOWS\system32\svchost.exe [2017-09-29 48688]
S3 DevQueryBroker;@%SystemRoot%\system32\DevQueryBroker.dll,-100; C:\WINDOWS\system32\svchost.exe [2017-09-29 48688]
S3 diagnosticshub.standardcollector.service;@%SystemRoot%\system32\DiagSvcs\DiagnosticsHub.StandardCollector.ServiceRes.dll,-1000; C:\WINDOWS\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe [2017-09-29 85504]
S3 diagsvc;@%systemroot%\system32\DiagSvc.dll,-100; C:\WINDOWS\System32\svchost.exe [2017-09-29 48688]
S3 DmEnrollmentSvc;@%systemroot%\system32\Windows.Internal.Management.dll,-100; C:\WINDOWS\system32\svchost.exe [2017-09-29 48688]
S3 dmwappushservice;@%SystemRoot%\system32\dmwappushsvc.dll,-200; C:\WINDOWS\system32\svchost.exe [2017-09-29 48688]
S3 EasyAntiCheat;EasyAntiCheat; C:\Program Files (x86)\EasyAntiCheat\EasyAntiCheat.exe [2017-10-23 528424]
S3 embeddedmode;@%SystemRoot%\system32\embeddedmodesvc.dll,-201; C:\WINDOWS\System32\svchost.exe [2017-09-29 48688]
S3 EntAppSvc;@EnterpriseAppMgmtSvc.dll,-1; C:\WINDOWS\system32\svchost.exe [2017-09-29 48688]
S3 FontCache3.0.0.0;@%SystemRoot%\system32\PresentationHost.exe,-3309; C:\WINDOWS\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe [2017-09-28 43648]
S3 FrameServer;@%systemroot%\system32\FrameServer.dll,-100; C:\WINDOWS\System32\svchost.exe [2017-09-29 48688]
S3 GraphicsPerfSvc;@%SystemRoot%\system32\GraphicsPerfSvc.dll,-100; C:\WINDOWS\System32\svchost.exe [2017-09-29 48688]
S3 HvHost;@%SystemRoot%\system32\hvhostsvc.dll,-100; C:\WINDOWS\system32\svchost.exe [2017-09-29 48688]
S3 icssvc;@%SystemRoot%\System32\tetheringservice.dll,-4097; C:\WINDOWS\system32\svchost.exe [2017-09-29 48688]
S3 IpxlatCfgSvc;@%Systemroot%\system32\ipxlatcfg.dll,-500; C:\WINDOWS\System32\svchost.exe [2017-09-29 48688]
S3 irmon;@%SystemRoot%\System32\irmon.dll,-2000; C:\WINDOWS\system32\svchost.exe [2017-09-29 48688]
S3 MessagingService;@%SystemRoot%\system32\MessagingService.dll,-100; C:\WINDOWS\system32\svchost.exe [2017-09-29 48688]
S3 MessagingService_ac85cf;Služba zasílání zpráv_ac85cf; C:\WINDOWS\system32\svchost.exe [2017-09-29 48688]
S3 MozillaMaintenance;Mozilla Maintenance Service; C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2018-03-15 194512]
S3 NaturalAuthentication;@%systemroot%\system32\NaturalAuth.dll,-100; C:\WINDOWS\system32\svchost.exe [2017-09-29 48688]
S3 NetSetupSvc;@%SystemRoot%\system32\NetSetupSvc.dll,-3; C:\WINDOWS\System32\svchost.exe [2017-09-29 48688]
S3 NgcCtnrSvc;@%SystemRoot%\System32\NgcCtnrSvc.dll,-1; C:\WINDOWS\system32\svchost.exe [2017-09-29 48688]
S3 NgcSvc;@%SystemRoot%\System32\ngcsvc.dll,-100; C:\WINDOWS\system32\svchost.exe [2017-09-29 48688]
S3 NvContainerNetworkService;NVIDIA NetworkService Container; C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe [2018-01-10 519240]
S3 ose;Office Source Engine; C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2018-02-22 211632]
S3 PhoneSvc;@%SystemRoot%\system32\PhoneserviceRes.dll,-10000; C:\WINDOWS\system32\svchost.exe [2017-09-29 48688]
S3 PimIndexMaintenanceSvc;@%SystemRoot%\system32\UserDataAccessRes.dll,-15001; C:\WINDOWS\system32\svchost.exe [2017-09-29 48688]
S3 PimIndexMaintenanceSvc_ac85cf;Data kontaktů_ac85cf; C:\WINDOWS\system32\svchost.exe [2017-09-29 48688]
S3 PrintWorkflowUserSvc;@%SystemRoot%\system32\PrintWorkflowService.dll,-100; C:\WINDOWS\system32\svchost.exe [2017-09-29 48688]
S3 PrintWorkflowUserSvc_ac85cf;PrintWorkflow_ac85cf; C:\WINDOWS\system32\svchost.exe [2017-09-29 48688]
S3 PushToInstall;@%SystemRoot%\system32\pushtoinstall.dll,-200; C:\WINDOWS\System32\svchost.exe [2017-09-29 48688]
S3 RetailDemo;@%SystemRoot%\System32\RDXService.dll,-256; C:\WINDOWS\System32\svchost.exe [2017-09-29 48688]
S3 RmSvc;@%SystemRoot%\system32\RMapi.dll,-1001; C:\WINDOWS\System32\svchost.exe [2017-09-29 48688]
S3 SensorDataService;@%SystemRoot%\system32\SensorDataService.exe,-101; C:\WINDOWS\System32\SensorDataService.exe [2017-09-29 1288704]
S3 SensorService;@%SystemRoot%\System32\sensorservice.dll,-1000; C:\WINDOWS\system32\svchost.exe [2017-09-29 48688]
S3 SharedRealitySvc;@%SystemRoot%\system32\SharedRealitySvc.dll,-100; C:\WINDOWS\system32\svchost.exe [2017-09-29 48688]
S3 SmsRouter;@%SystemRoot%\System32\SmsRouterSvc.dll,-10001; C:\WINDOWS\system32\svchost.exe [2017-09-29 48688]
S3 spectrum;@%systemroot%\system32\spectrum.exe,-101; C:\WINDOWS\system32\spectrum.exe [2018-03-02 956416]
S3 Steam Client Service;Steam Client Service; C:\Program Files (x86)\Common Files\Steam\SteamService.exe [2017-12-15 1644832]
S3 TieringEngineService;@%SystemRoot%\system32\TieringEngineService.exe,-702; C:\WINDOWS\system32\TieringEngineService.exe [2017-09-29 302592]
S4 shpamsvc;@%SystemRoot%\System32\Windows.SharedPC.AccountManager.dll,-100; C:\WINDOWS\System32\svchost.exe [2017-09-29 48688]

-----------------EOF-----------------

Ahoj

Ak nepouzivas, odinstaluj tieto programy (navod):

McAfee Safe Connect
Seznam Software

Stiahni AdwCleaner: https://toolslib.net/downloads/finish/1/

Uloz na plochu a ukonci vsetky programy
Spusti AdwCleaner ako spravca
Odsuhlas licencne podmienky
Klikni na Scan (Skenovanie) a pockaj na dokoncenie
Klikni na Clean (Cistenie) a potvrd kliknutim na OK
AdwCleaner si vyziada restart PC, potvrd kliknutim na Restart Now (Restartovat teraz)
Po dokonceni a restartovani PC vyskoci log, jeho obsah sem skopiruj

Zdravím,
ten seznam jsem odinstaloval, to McAfee nešlo odinstalovat , byla to jem složka v program files tak jsem ji smazal.
Přikládám log dle požadavku:

# AdwCleaner 7.0.8.0 - Logfile created on Thu Mar 15 17:18:54 2018
# Updated on 2018/08/02 by Malwarebytes
# Running on Windows 10 Home (X64)
# Mode: clean
# Support: https://www.malwarebytes.com/support

***** [ Services ] *****

No malicious services deleted.

***** [ Folders ] *****

No malicious folders deleted.

***** [ Files ] *****

No malicious files deleted.

***** [ DLL ] *****

No malicious DLLs cleaned.

***** [ WMI ] *****

No malicious WMI cleaned.

***** [ Shortcuts ] *****

No malicious shortcuts cleaned.

***** [ Tasks ] *****

No malicious tasks deleted.

***** [ Registry ] *****

No malicious registry entries deleted.

***** [ Firefox (and derivatives) ] *****

No malicious Firefox entries deleted.

***** [ Chromium (and derivatives) ] *****

No malicious Chromium entries deleted.

*************************

::Tracing keys deleted
::Winsock settings cleared
::Additional Actions: 0

*************************

C:/AdwCleaner/AdwCleaner[S0].txt - [945 B] - [2018/3/15 17:18:33]

########## EOF - C:\AdwCleaner\AdwCleaner[C0].txt ##########

Děkuji!

Poprosim o obidva logy z FRST podla tohto navodu (FRST.txt a Addition.txt): https://forum.viry.cz/viewtopic.php?f=13&t=152707

V pripade, ze sa FRSTLauncher nebude dat stiahnut alebo spustit, pouzi iba samotny FRST.

Ak sa logy nezmestia do jedneho prispevku, zabal ich do archivu RAR alebo ZIP a posli ako prilohu.

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 14.03.2018
Ran by muj (15-03-2018 20:05:04)
Running from C:\Users\muj\Desktop
Windows 10 Home Version 1709 16299.309 (X64) (2017-12-09 17:49:50)
Boot Mode: Normal
==========================================================

==================== Accounts: =============================

Administrator (S-1-5-21-1414727818-4048635875-1041125893-500 - Administrator - Disabled)
DefaultAccount (S-1-5-21-1414727818-4048635875-1041125893-503 - Limited - Disabled)
Guest (S-1-5-21-1414727818-4048635875-1041125893-501 - Limited - Disabled)
muj (S-1-5-21-1414727818-4048635875-1041125893-1001 - Administrator - Enabled) => C:\Users\muj
WDAGUtilityAccount (S-1-5-21-1414727818-4048635875-1041125893-504 - Limited - Disabled)

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

Adobe Flash Player 29 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 29.0.0.113 - Adobe Systems Incorporated)
Aktualizace NVIDIA 31.0.11.0 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Update) (Version: 31.0.11.0 - NVIDIA Corporation) Hidden
AlphaConsole version 8.0 (HKLM-x32\...\{83CB5404-7E78-4B1F-B0D5-A8D0FCDA9B7D}_is1) (Version: 8.0 - AlphaConsole)
Arduino (HKLM-x32\...\Arduino) (Version: 1.8.5 - Arduino LLC)
DisplayDriverAnalyzer (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_DisplayDriverAnalyzer) (Version: 391.01 - NVIDIA Corporation) Hidden
Epic Games Launcher (HKLM-x32\...\{FE3CD7B8-14D4-46E9-A206-2C8F2C0E6F1F}) (Version: 1.1.139.0 - Epic Games, Inc.)
Fraps (HKLM-x32\...\Fraps) (Version: - )
HD Tune 2.55 (HKLM-x32\...\HD Tune_is1) (Version: - EFD Software)
Launcher Prerequisites (x64) (HKLM-x32\...\{c6c5a357-c7ca-4a5f-9789-3bb1af579253}) (Version: 1.0.0.0 - Epic Games, Inc.) Hidden
League of Legends (HKLM-x32\...\{6FEDADF5-40EC-4E18-A376-0FDBACE65338}) (Version: 4.2.1 - Riot Games) Hidden
League of Legends (HKLM-x32\...\League of Legends 4.2.1) (Version: 4.2.1 - Riot Games)
LogMeIn Hamachi (HKLM-x32\...\{BE82D2D7-6CA2-43B3-8C22-CCF6405806E7}) (Version: 2.2.0.579 - LogMeIn, Inc.) Hidden
LogMeIn Hamachi (HKLM-x32\...\LogMeIn Hamachi) (Version: 2.2.0.579 - LogMeIn, Inc.)
Malwarebytes verze 3.4.4.2398 (HKLM\...\{35065F43-4BB2-439A-BFF7-0F1014F2E0CD}_is1) (Version: 3.4.4.2398 - Malwarebytes)
Microsoft Office 365 - cs-cz (HKLM\...\O365HomePremRetail - cs-cz) (Version: 16.0.9029.2253 - Microsoft Corporation)
Microsoft OneDrive (HKU\S-1-5-21-1414727818-4048635875-1041125893-1001\...\OneDriveSetup.exe) (Version: 18.025.0204.0009 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}) (Version: 8.0.59192 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (HKLM-x32\...\{050d4fc8-5d48-4b8f-8972-47c82c46020f}) (Version: 12.0.30501.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 (HKLM-x32\...\{f65db027-aff3-4070-886a-0d87064aabb1}) (Version: 12.0.30501.0 - Microsoft Corporation)
Microsoft Visual C++ 2017 Redistributable (x64) - 14.10.25008 (HKLM-x32\...\{f1e7e313-06df-4c56-96a9-99fdfd149c51}) (Version: 14.10.25008.0 - Microsoft Corporation)
Microsoft Visual C++ 2017 Redistributable (x86) - 14.10.25008 (HKLM-x32\...\{c239cea1-d49e-4e16-8e87-8c055765f7ec}) (Version: 14.10.25008.0 - Microsoft Corporation)
Microsoft XNA Framework Redistributable 4.0 (HKLM-x32\...\{2BFC7AA0-544C-4E3A-8796-67F3BE655BE9}) (Version: 4.0.20823.0 - Microsoft Corporation)
Minecraft (HKLM-x32\...\{1C16BCA3-EBC1-49F6-8623-8FBFB9CCC872}) (Version: 1.0.3.0 - Mojang)
Mozilla Firefox 59.0 (x64 en-US) (HKLM\...\Mozilla Firefox 59.0 (x64 en-US)) (Version: 59.0 - Mozilla)
Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 55.0.3 - Mozilla)
NVIDIA GeForce Experience 3.12.0.84 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience) (Version: 3.12.0.84 - NVIDIA Corporation)
NVIDIA Ovladač 3D Vision 391.01 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision) (Version: 391.01 - NVIDIA Corporation)
NVIDIA Ovladač HD audia 1.3.36.6 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver) (Version: 1.3.36.6 - NVIDIA Corporation)
NVIDIA Ovladač řídící jednotky 3D Vision 390.41 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB) (Version: 390.41 - NVIDIA Corporation)
NVIDIA Ovladače grafiky 391.01 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 391.01 - NVIDIA Corporation)
NVIDIA Systémový software PhysX 9.17.0524 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.17.0524 - NVIDIA Corporation)
Office 16 Click-to-Run Extensibility Component (HKLM-x32\...\{90160000-008C-0000-0000-0000000FF1CE}) (Version: 16.0.9029.2253 - Microsoft Corporation) Hidden
Office 16 Click-to-Run Extensibility Component 64-bit Registration (HKLM\...\{90160000-00DD-0000-1000-0000000FF1CE}) (Version: 16.0.9029.2253 - Microsoft Corporation) Hidden
Office 16 Click-to-Run Licensing Component (HKLM\...\{90160000-008F-0000-1000-0000000FF1CE}) (Version: 16.0.9029.2253 - Microsoft Corporation) Hidden
Office 16 Click-to-Run Localization Component (HKLM-x32\...\{90160000-008C-0405-0000-0000000FF1CE}) (Version: 16.0.9029.2253 - Microsoft Corporation) Hidden
osu! (HKLM-x32\...\{a012f7d2-f39b-4198-aa0d-2d433b34bc5e}) (Version: latest - ppy Pty Ltd)
Ovládací panel NVIDIA 391.01 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.ControlPanel) (Version: 391.01 - NVIDIA Corporation) Hidden
PBE (HKLM-x32\...\PBE 1.0) (Version: 1.0 - Riot Games, Inc)
Pomocník při upgradu na Windows 10 (HKLM-x32\...\{D5C69738-B486-402E-85AC-2456D98A64E4}) (Version: 1.4.9200.22175 - Microsoft Corporation)
Roblox Player for muj (HKU\S-1-5-21-1414727818-4048635875-1041125893-1001\...\{373B1718-8CC5-4567-8EE2-9033AD08A680}) (Version: - Roblox Corporation)
Skype™ 7.40 (HKLM-x32\...\{3B7E914A-93D5-4A29-92BB-AF8C3F66C431}) (Version: 7.40.104 - Skype Technologies S.A.)
Steam (HKLM-x32\...\Steam) (Version: 2.10.91.91 - Valve Corporation)
TeamSpeak 3 Client (HKU\S-1-5-21-1414727818-4048635875-1041125893-1001\...\TeamSpeak 3 Client) (Version: 3.1.6 - TeamSpeak Systems GmbH)
UE4 Prerequisites (x64) (HKLM\...\{36EAD5CF-44EF-4FCF-8BE1-D96C4835D7A4}) (Version: 1.0.11.0 - Epic Games, Inc.) Hidden
UE4 Prerequisites (x64) (HKLM-x32\...\{2890ae6b-90e9-448d-b3e6-97e43c21e2fd}) (Version: 1.0.13.0 - Epic Games, Inc.) Hidden
Vulkan Run Time Libraries 1.0.65.1 (HKLM\...\VulkanRT1.0.65.1) (Version: 1.0.65.1 - LunarG, Inc.) Hidden
Warcraft III - Gold Edition verze 1.26 (HKLM-x32\...\{1DD8BB83-A075-4F9B-9F24-9383BC647D65}_is1) (Version: 1.26 - )
WinRAR 5.50 (64-bit) (HKLM\...\WinRAR archiver) (Version: 5.50.0 - win.rar GmbH)

==================== Custom CLSID (Whitelisted): ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

ContextMenuHandlers1: [WinRAR] -> {B41DB860-64E4-11D2-9906-E49FADC173CA} => C:\Program Files\WinRAR\rarext.dll [2017-08-11] (Alexander Roshal)
ContextMenuHandlers1-x32: [WinRAR32] -> {B41DB860-8EE4-11D2-9906-E49FADC173CA} => C:\Program Files\WinRAR\rarext32.dll [2017-08-11] (Alexander Roshal)
ContextMenuHandlers3: [MBAMShlExt] -> {57CE581A-0CB6-4266-9CA0-19364C90A0B3} => C:\Program Files\Malwarebytes\Anti-Malware\mbshlext.dll [2018-03-03] (Malwarebytes)
ContextMenuHandlers5: [NvCplDesktopContext] -> {3D1975AF-48C6-4f8e-A182-BE0E08FA86A9} => C:\WINDOWS\system32\nvshext.dll [2018-02-23] (NVIDIA Corporation)
ContextMenuHandlers6: [MBAMShlExt] -> {57CE581A-0CB6-4266-9CA0-19364C90A0B3} => C:\Program Files\Malwarebytes\Anti-Malware\mbshlext.dll [2018-03-03] (Malwarebytes)
ContextMenuHandlers6: [WinRAR] -> {B41DB860-64E4-11D2-9906-E49FADC173CA} => C:\Program Files\WinRAR\rarext.dll [2017-08-11] (Alexander Roshal)
ContextMenuHandlers6-x32: [WinRAR32] -> {B41DB860-8EE4-11D2-9906-E49FADC173CA} => C:\Program Files\WinRAR\rarext32.dll [2017-08-11] (Alexander Roshal)

==================== Scheduled Tasks (Whitelisted) =============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

Task: {044AABB2-A80A-4E76-A5F3-6D1108EA569B} - System32\Tasks\NvNodeLauncher_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files (x86)\NVIDIA Corporation\NvNode\nvnodejslauncher.exe [2018-01-10] (NVIDIA Corporation)
Task: {0DAC4593-6927-4BF2-A309-81B4FA29DD4B} - System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Cleanup => C:\ProgramData\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MpCmdRun.exe [2018-03-02] (Microsoft Corporation)
Task: {12B3D7F3-6250-43DE-AADA-D9558618A279} - System32\Tasks\NvProfileUpdaterDaily_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files\NVIDIA Corporation\Update Core\NvProfileUpdater64.exe [2018-01-10] (NVIDIA Corporation)
Task: {135DB2D7-EB10-4A8D-933E-AF64FAE2FC98} - System32\Tasks\NvTmRep_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvTmRep.exe [2018-01-10] (NVIDIA Corporation)
Task: {1B92979E-EE8F-4FE1-AC6C-8BB70E080C2D} - System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance => C:\ProgramData\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MpCmdRun.exe [2018-03-02] (Microsoft Corporation)
Task: {3640BFDC-0E39-45BF-A922-54324557FB0D} - System32\Tasks\Microsoft\Office\Office Subscription Maintenance => C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonx86\Microsoft Shared\Office16\OLicenseHeartbeat.exe [2018-03-15] (Microsoft Corporation)
Task: {38D91CBD-F8F6-40E5-B409-FEE52229D767} - System32\Tasks\Adobe Flash Player Updater => C:\WINDOWS\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2018-03-13] (Adobe Systems Incorporated)
Task: {462145F1-CE0A-4ABA-9D64-C5C25BA0A008} - System32\Tasks\NVIDIA GeForce Experience SelfUpdate_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files (x86)\NVIDIA Corporation\NVIDIA GeForce Experience\NVIDIA GeForce Experience.exe [2018-01-10] (NVIDIA Corporation)
Task: {48877E47-16D1-41A0-B674-84352C7882DD} - System32\Tasks\Adobe Flash Player NPAPI Notifier => C:\WINDOWS\SysWOW64\Macromed\Flash\FlashUtil32_29_0_0_113_Plugin.exe [2018-03-13] (Adobe Systems Incorporated)
Task: {4AD0561B-DC96-4C50-B52F-CABCD93BCF9C} - System32\Tasks\NvDriverUpdateCheckDaily_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe [2018-01-10] (NVIDIA Corporation)
Task: {55601D63-CEDA-40D6-B178-D6ABB23C6896} - System32\Tasks\Microsoft\Office\Office ClickToRun Service Monitor => C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe [2018-03-12] (Microsoft Corporation)
Task: {5E2106E1-775F-4109-836F-9B40D6CDF834} - System32\Tasks\NvProfileUpdaterOnLogon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files\NVIDIA Corporation\Update Core\NvProfileUpdater64.exe [2018-01-10] (NVIDIA Corporation)
Task: {70464495-9FD3-4C94-9FDC-8200CE7387B3} - System32\Tasks\Microsoft\Office\Office Automatic Updates => C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe [2018-03-12] (Microsoft Corporation)
Task: {7E657DED-C970-4A65-8297-74101AA938AE} - System32\Tasks\NvTmMon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvTmMon.exe [2018-01-10] (NVIDIA Corporation)
Task: {88657B7C-3FDE-4C73-859C-D3794F096FFD} - System32\Tasks\NvTmRepOnLogon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvTmRep.exe [2018-01-10] (NVIDIA Corporation)
Task: {8D8C3D46-A044-4C69-8438-B2FADDC46AC8} - System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Verification => C:\ProgramData\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MpCmdRun.exe [2018-03-02] (Microsoft Corporation)
Task: {9027E9CC-3EAB-4C57-B6FC-9BF25EEE408C} - System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan => C:\ProgramData\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MpCmdRun.exe [2018-03-02] (Microsoft Corporation)
Task: {B73666C9-35EA-4D0B-A631-D0B0731D9209} - System32\Tasks\Microsoft\Office\OfficeBackgroundTaskHandlerLogon => C:\Program Files (x86)\Microsoft Office\root\Office16\officebackgroundtaskhandler.exe [2018-03-15] (Microsoft Corporation)
Task: {BE205F27-4AB9-4156-9A98-04740564D6AC} - System32\Tasks\Microsoft\Office\OfficeBackgroundTaskHandlerRegistration => C:\Program Files (x86)\Microsoft Office\root\Office16\officebackgroundtaskhandler.exe [2018-03-15] (Microsoft Corporation)

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

==================== Shortcuts & WMI ========================

(The entries could be listed to be restored or removed.)

==================== Loaded Modules (Whitelisted) ==============

2018-03-09 20:06 - 2018-02-24 05:36 - 000543248 _____ () C:\Program Files\NVIDIA Corporation\Display.NvContainer\plugins\LocalSystem\DisplayDriverAnalyzer\_DisplayDriverCrashAnalyzer64.dll
2018-03-09 20:07 - 2018-01-10 15:22 - 001267272 _____ () C:\Program Files\NVIDIA Corporation\NvContainer\libprotobuf.dll
2017-09-29 14:41 - 2017-09-29 14:41 - 000184432 _____ () C:\WINDOWS\SYSTEM32\inputhost.dll
2017-09-10 00:13 - 2018-02-23 20:22 - 000133464 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll
2018-03-13 19:26 - 2018-02-22 01:26 - 011044864 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\CortanaApi.dll
2018-03-13 19:26 - 2018-02-22 01:21 - 001804288 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.Core.dll
2018-03-02 06:21 - 2018-03-02 06:22 - 000086528 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_12.1807.264.0_x64__kzf8qxf38zg5c\SkypeHost.exe
2018-03-02 06:21 - 2018-03-02 06:22 - 000195072 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_12.1807.264.0_x64__kzf8qxf38zg5c\SkypeBackgroundTasks.dll
2018-03-02 06:21 - 2018-03-02 06:22 - 021824000 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_12.1807.264.0_x64__kzf8qxf38zg5c\SkyWrap.dll
2018-03-02 06:21 - 2018-03-02 06:22 - 002529792 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_12.1807.264.0_x64__kzf8qxf38zg5c\skypert.dll
2018-03-02 06:21 - 2018-03-02 06:21 - 000649216 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_12.1807.264.0_x64__kzf8qxf38zg5c\RtmMvrUap.dll
2018-03-09 20:07 - 2018-01-10 15:21 - 001040456 _____ () C:\Program Files (x86)\NVIDIA Corporation\NvContainer\libprotobuf.dll

==================== Alternate Data Streams (Whitelisted) =========

(If an entry is included in the fixlist, only the ADS will be removed.)

AlternateDataStreams: C:\WINDOWS\system32\Drivers\ksqsjnkm.sys:changelist [292]
AlternateDataStreams: C:\Users\Public\AppData:CSM [480]

==================== Safe Mode (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MBAMService => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MBAMService => ""="Service"

==================== Association (Whitelisted) ===============

(If an entry is included in the fixlist, the registry item will be restored to default or removed.)

==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, it will be removed from the registry.)

==================== Hosts content: ===============================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2015-10-30 08:24 - 2018-02-26 20:39 - 000000828 _____ C:\WINDOWS\system32\Drivers\etc\hosts

==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-1414727818-4048635875-1041125893-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\muj\AppData\Roaming\Mozilla\Firefox\Pozadí plochy.bmp
DNS Servers: 192.168.1.1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer => (SmartScreenEnabled: Off)
Windows Firewall is enabled.

==================== MSCONFIG/TASK MANAGER disabled items ==

HKLM\...\StartupApproved\Run: => "MouseDriver"
HKLM\...\StartupApproved\Run32: => "seznam-listicka-distribuce"
HKLM\...\StartupApproved\Run32: => "LogMeIn Hamachi Ui"
HKU\S-1-5-21-1414727818-4048635875-1041125893-1001\...\StartupApproved\StartupFolder: => "SyncAudio.vbs"
HKU\S-1-5-21-1414727818-4048635875-1041125893-1001\...\StartupApproved\Run: => "OneDrive"
HKU\S-1-5-21-1414727818-4048635875-1041125893-1001\...\StartupApproved\Run: => "McAfeeSafeConnect"
HKU\S-1-5-21-1414727818-4048635875-1041125893-1001\...\StartupApproved\Run: => "cz.seznam.software.autoupdate"
HKU\S-1-5-21-1414727818-4048635875-1041125893-1001\...\StartupApproved\Run: => "cz.seznam.software.szndesktop"

==================== FirewallRules (Whitelisted) ===============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

FirewallRules: [{4EA5756C-1476-4032-999C-712C471C789E}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Terraria\Terraria.exe
FirewallRules: [{62243560-F3F8-40B4-A890-4539680E78F7}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Terraria\Terraria.exe
FirewallRules: [{B9D8E3DE-1892-4E6C-A078-7EB16257E83A}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Rust\Rust.exe
FirewallRules: [{FF0AE0ED-0CBB-4384-B663-84A8AF6D6FDA}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Rust\Rust.exe
FirewallRules: [UDP Query User{CA4FEE42-2564-4D53-9C2A-DB7419568554}C:\program files (x86)\arduino\java\bin\javaw.exe] => (Block) C:\program files (x86)\arduino\java\bin\javaw.exe
FirewallRules: [TCP Query User{DF961364-1341-4580-9A8B-0E6DC20BB7E0}C:\program files (x86)\arduino\java\bin\javaw.exe] => (Block) C:\program files (x86)\arduino\java\bin\javaw.exe
FirewallRules: [{17056390-9583-4ED9-A310-A38AF0D7B3A3}] => (Allow) C:\Program Files (x86)\Steam\bin\cef\cef.win7\steamwebhelper.exe
FirewallRules: [{19D584A3-D875-449F-8413-6DBBD626A446}] => (Allow) C:\Program Files (x86)\Steam\bin\cef\cef.win7\steamwebhelper.exe
FirewallRules: [{D2A02A06-7228-4C29-B2D4-86B344FE0AEA}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe
FirewallRules: [{C4F24FE4-D774-4135-AE0D-904901C83430}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe
FirewallRules: [UDP Query User{A0E0EA54-00D9-4595-9A6A-DF1024C3801A}C:\program files (x86)\minecraft\runtime\jre-x64\1.8.0_25\bin\javaw.exe] => (Allow) C:\program files (x86)\minecraft\runtime\jre-x64\1.8.0_25\bin\javaw.exe
FirewallRules: [TCP Query User{ECCA9551-7254-4214-8852-D306951FA29D}C:\program files (x86)\minecraft\runtime\jre-x64\1.8.0_25\bin\javaw.exe] => (Allow) C:\program files (x86)\minecraft\runtime\jre-x64\1.8.0_25\bin\javaw.exe
FirewallRules: [{1F0D4F06-0C62-41EB-999B-367F5C7EDCC4}] => (Allow) C:\Program Files (x86)\Skype\Phone\Skype.exe
FirewallRules: [{3F8735C0-048F-4BF5-858E-0E718B40C77C}] => (Allow) C:\Program Files\Mozilla Firefox\firefox.exe
FirewallRules: [{679DDB42-0EF3-469D-9817-70BD58E1A44A}] => (Allow) C:\Program Files\Mozilla Firefox\firefox.exe
FirewallRules: [TCP Query User{B0B42436-AC16-4F70-9D7A-675AB6F704E5}C:\program files (x86)\steam\steamapps\common\terraria\terrariaserver.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\terraria\terrariaserver.exe
FirewallRules: [UDP Query User{A9D4F3B6-066C-4D9B-A665-579A3F28DEBE}C:\program files (x86)\steam\steamapps\common\terraria\terrariaserver.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\terraria\terrariaserver.exe
FirewallRules: [{A1158957-6DB9-488C-ABA1-B4E06CFBC4D1}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\PUBG\TslGame\Binaries\Win64\TslGame_BE.exe
FirewallRules: [{6FC4A5EE-A71E-4AF6-B791-C54DC2B9DC2D}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\PUBG\TslGame\Binaries\Win64\TslGame_BE.exe
FirewallRules: [TCP Query User{FDCC4E8A-8A62-44E8-B8BB-B8B6499D2E32}C:\program files (x86)\steam\steamapps\common\pubg\tslgame\binaries\win64\tslgame.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\pubg\tslgame\binaries\win64\tslgame.exe
FirewallRules: [UDP Query User{DAF75FF9-648C-4A83-A5C8-05DCF02D9405}C:\program files (x86)\steam\steamapps\common\pubg\tslgame\binaries\win64\tslgame.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\pubg\tslgame\binaries\win64\tslgame.exe
FirewallRules: [{CB6D808B-575D-457D-9BE5-315668F2CB8E}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Factorio\bin\x64\factorio.exe
FirewallRules: [{B47E10DF-814A-4FB2-B3A8-698E6AF4A625}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Factorio\bin\x64\factorio.exe
FirewallRules: [{1281C01D-0A5D-4746-9E6B-8C56CA59167E}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Gold Rush The Game\GoldRushTheGame.exe
FirewallRules: [{9481A8F5-D6DA-4BBD-B09D-4FC4069840F0}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Gold Rush The Game\GoldRushTheGame.exe
FirewallRules: [{04AEE230-149B-48C9-81F5-3EA47780AE15}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Team Fortress 2\hl2.exe
FirewallRules: [{784BB652-4D6C-44E4-A638-747DC7B12325}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Team Fortress 2\hl2.exe
FirewallRules: [{E0001005-ADAE-47F7-B074-3E9E8375A40F}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Geometry Dash\GeometryDash.exe
FirewallRules: [{68B2A7F0-4D62-49DB-AE5D-726D44F36597}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Geometry Dash\GeometryDash.exe
FirewallRules: [{FE59EACE-7182-427F-981A-F7AD144E065E}] => (Allow) C:\Program Files (x86)\Microsoft Office\root\Office16\outlook.exe
FirewallRules: [TCP Query User{8DCB3E80-68DF-4DFD-9D38-1F44283AFB57}C:\program files (x86)\epic games\launcher\portal\binaries\win32\epicgameslauncher.exe] => (Allow) C:\program files (x86)\epic games\launcher\portal\binaries\win32\epicgameslauncher.exe
FirewallRules: [UDP Query User{95DA2732-707E-4870-A155-8E54C4492235}C:\program files (x86)\epic games\launcher\portal\binaries\win32\epicgameslauncher.exe] => (Allow) C:\program files (x86)\epic games\launcher\portal\binaries\win32\epicgameslauncher.exe
FirewallRules: [TCP Query User{EA598532-A64E-4E05-848D-9F9D7386F860}C:\program files (x86)\epic games\launcher\portal\binaries\win64\epicgameslauncher.exe] => (Allow) C:\program files (x86)\epic games\launcher\portal\binaries\win64\epicgameslauncher.exe
FirewallRules: [UDP Query User{CD3EC148-AA8F-4238-9902-FC23D90ADB20}C:\program files (x86)\epic games\launcher\portal\binaries\win64\epicgameslauncher.exe] => (Allow) C:\program files (x86)\epic games\launcher\portal\binaries\win64\epicgameslauncher.exe
FirewallRules: [TCP Query User{A9CB9622-65ED-42C3-8497-F4574151B59C}C:\program files\epic games\fortnite\fortnitegame\binaries\win64\fortniteclient-win64-shipping.exe] => (Allow) C:\program files\epic games\fortnite\fortnitegame\binaries\win64\fortniteclient-win64-shipping.exe
FirewallRules: [UDP Query User{1A01160C-15E1-4923-AC8E-4E401CDF2783}C:\program files\epic games\fortnite\fortnitegame\binaries\win64\fortniteclient-win64-shipping.exe] => (Allow) C:\program files\epic games\fortnite\fortnitegame\binaries\win64\fortniteclient-win64-shipping.exe
FirewallRules: [TCP Query User{32C7FDA6-A4DE-4410-B5E2-77F5A4952625}C:\program files\epic games\ue_4.18\engine\binaries\win64\ue4editor.exe] => (Allow) C:\program files\epic games\ue_4.18\engine\binaries\win64\ue4editor.exe
FirewallRules: [UDP Query User{08D24007-1D1E-44AF-ADC1-2519913E6789}C:\program files\epic games\ue_4.18\engine\binaries\win64\ue4editor.exe] => (Allow) C:\program files\epic games\ue_4.18\engine\binaries\win64\ue4editor.exe
FirewallRules: [{CE1C0EC2-1EF9-4AE9-85E3-303CEEA1AF59}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Don't Starve Together\bin\dontstarve_steam.exe
FirewallRules: [{2B4E254E-7F20-4F97-9903-1BC474B8D435}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Don't Starve Together\bin\dontstarve_steam.exe
FirewallRules: [TCP Query User{C2B51597-0827-4D11-87F0-BA46CD58146F}C:\program files (x86)\warcraft iii\war3.exe] => (Allow) C:\program files (x86)\warcraft iii\war3.exe
FirewallRules: [UDP Query User{23DA2762-7E9B-4EA3-B472-1ACC1FB67BA6}C:\program files (x86)\warcraft iii\war3.exe] => (Allow) C:\program files (x86)\warcraft iii\war3.exe
FirewallRules: [TCP Query User{F3F7DE68-8E2C-4DB1-B7B9-9673553D0938}C:\riot games\pbe\rads\projects\league_client\releases\0.0.1.138\deploy\leagueclient.exe] => (Allow) C:\riot games\pbe\rads\projects\league_client\releases\0.0.1.138\deploy\leagueclient.exe
FirewallRules: [UDP Query User{FBB70F3E-021C-4650-A013-DED313E54310}C:\riot games\pbe\rads\projects\league_client\releases\0.0.1.138\deploy\leagueclient.exe] => (Allow) C:\riot games\pbe\rads\projects\league_client\releases\0.0.1.138\deploy\leagueclient.exe
FirewallRules: [TCP Query User{22F672D1-90B4-45CC-BB03-5D6E86AE21B6}C:\riot games\pbe\rads\projects\league_client\releases\0.0.1.139\deploy\leagueclient.exe] => (Allow) C:\riot games\pbe\rads\projects\league_client\releases\0.0.1.139\deploy\leagueclient.exe
FirewallRules: [UDP Query User{43DFCC77-CE71-459C-8011-7E593274FABA}C:\riot games\pbe\rads\projects\league_client\releases\0.0.1.139\deploy\leagueclient.exe] => (Allow) C:\riot games\pbe\rads\projects\league_client\releases\0.0.1.139\deploy\leagueclient.exe
FirewallRules: [TCP Query User{8DD58743-7D68-445A-82AF-62252446A6C8}C:\riot games\pbe\rads\projects\league_client\releases\0.0.1.143\deploy\leagueclient.exe] => (Allow) C:\riot games\pbe\rads\projects\league_client\releases\0.0.1.143\deploy\leagueclient.exe
FirewallRules: [UDP Query User{D1E1D04F-9A13-40D1-8D21-5C4C41C75CD3}C:\riot games\pbe\rads\projects\league_client\releases\0.0.1.143\deploy\leagueclient.exe] => (Allow) C:\riot games\pbe\rads\projects\league_client\releases\0.0.1.143\deploy\leagueclient.exe
FirewallRules: [TCP Query User{B606A651-2BBC-4729-AACD-62EDD37C6632}C:\program files (x86)\warcraft iii - gold edition\war3.exe] => (Allow) C:\program files (x86)\warcraft iii - gold edition\war3.exe
FirewallRules: [UDP Query User{80A94149-109F-4026-9DB6-69AC10EB3B3F}C:\program files (x86)\warcraft iii - gold edition\war3.exe] => (Allow) C:\program files (x86)\warcraft iii - gold edition\war3.exe
FirewallRules: [{7BB7390F-3679-4318-8CC3-3A910D0E3380}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\rocketleague\Binaries\Win32\RocketLeague.exe
FirewallRules: [{46C617B1-3AA3-4FD4-A80B-CFCE38D5DDB2}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\rocketleague\Binaries\Win32\RocketLeague.exe
FirewallRules: [TCP Query User{FCD1B5CC-BAE8-4DD7-9B4C-3977EDCFB2BD}C:\riot games\league of legends\rads\projects\league_client\releases\0.0.0.129\deploy\leagueclient.exe] => (Allow) C:\riot games\league of legends\rads\projects\league_client\releases\0.0.0.129\deploy\leagueclient.exe
FirewallRules: [UDP Query User{80C38535-7515-4934-A727-48B64634D7A0}C:\riot games\league of legends\rads\projects\league_client\releases\0.0.0.129\deploy\leagueclient.exe] => (Allow) C:\riot games\league of legends\rads\projects\league_client\releases\0.0.0.129\deploy\leagueclient.exe
FirewallRules: [{0E10B93A-1911-413F-843B-70B579382505}] => (Allow) C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe
FirewallRules: [{C1190B0D-E7D2-467B-B526-6EAD10B161AC}] => (Allow) C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe
FirewallRules: [{ACA65F51-3944-40DF-8069-4F71151CE746}] => (Allow) C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe
FirewallRules: [{29FC3F4F-7DE2-4852-8089-96EA8EEE0532}] => (Allow) C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe
FirewallRules: [{C733BD74-8234-4A36-981E-23499CFD4984}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe
FirewallRules: [{FEE4CF42-3185-480E-BF86-D046635770DA}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe
FirewallRules: [{C892C5A3-9DD5-4437-864D-E3BE9CC198E0}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\H1Z1\H1Z1_BE.exe
FirewallRules: [{95A19BBA-8555-4D05-93B9-E2C2B7B54240}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\H1Z1\H1Z1_BE.exe
FirewallRules: [TCP Query User{B1691705-6D3E-4758-BE03-7AAF0E3EA148}C:\program files (x86)\steam\steamapps\common\h1z1\h1z1.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\h1z1\h1z1.exe
FirewallRules: [UDP Query User{15B2A8D4-1DA5-4ED6-A908-08F1032D0692}C:\program files (x86)\steam\steamapps\common\h1z1\h1z1.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\h1z1\h1z1.exe

==================== Restore Points =========================

09-03-2018 12:09:30 Instalační služba modulů systému Windows
13-03-2018 19:24:59 Windows Update

==================== Faulty Device Manager Devices =============

==================== Event log errors: =========================

Application errors:
==================
Error: (03/14/2018 08:18:09 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Název chybující aplikace: POWERPNT.EXE, verze: 16.0.9029.2167, časové razítko: 0x5a8e7563
Název chybujícího modulu: ntdll.dll, verze: 10.0.16299.248, časové razítko: 0x3a21d961
Kód výjimky: 0xc0000005
Posun chyby: 0x0002cfd6
ID chybujícího procesu: 0x2750
Čas spuštění chybující aplikace: 0x01d3bbc8f2dbca68
Cesta k chybující aplikaci: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
Cesta k chybujícímu modulu: C:\WINDOWS\SYSTEM32\ntdll.dll
ID zprávy: 06225c71-f6fc-42c2-8e3d-06d09dc9461a
Úplný název chybujícího balíčku:
ID aplikace související s chybujícím balíčkem:

Error: (03/14/2018 08:17:55 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Název chybující aplikace: POWERPNT.EXE, verze: 16.0.9029.2167, časové razítko: 0x5a8e7563
Název chybujícího modulu: KERNELBASE.dll, verze: 10.0.16299.309, časové razítko: 0xd3aa915c
Kód výjimky: 0xc06d007e
Posun chyby: 0x001008f2
ID chybujícího procesu: 0x2750
Čas spuštění chybující aplikace: 0x01d3bbc8f2dbca68
Cesta k chybující aplikaci: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
Cesta k chybujícímu modulu: C:\WINDOWS\System32\KERNELBASE.dll
ID zprávy: 39a3b3ed-8b55-4e59-bd8b-adc0567e3e44
Úplný název chybujícího balíčku:
ID aplikace související s chybujícím balíčkem:

Error: (03/14/2018 08:16:52 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Název chybující aplikace: POWERPNT.EXE, verze: 16.0.9029.2167, časové razítko: 0x5a8e7563
Název chybujícího modulu: shcore.dll, verze: 10.0.16299.15, časové razítko: 0x30134c68
Kód výjimky: 0xc0000005
Posun chyby: 0x00038091
ID chybujícího procesu: 0x2750
Čas spuštění chybující aplikace: 0x01d3bbc8f2dbca68
Cesta k chybující aplikaci: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
Cesta k chybujícímu modulu: C:\WINDOWS\System32\shcore.dll
ID zprávy: 033e56df-1a49-4e79-9e4e-10e0dd65d057
Úplný název chybujícího balíčku:
ID aplikace související s chybujícím balíčkem:

Error: (03/13/2018 07:41:39 PM) (Source: Perflib) (EventID: 1008) (User: )
Description: Procedura Open pro službu BITS v knihovně DLL C:\Windows\System32\bitsperf.dll se nezdařila. Výkonnostní data pro tuto službu nebudou k dispozici. Vrácený kód stavu představují první čtyři bajty (DWORD) datové části.

Otvor poznamkovy blok (Win+R -> notepad -> enter)

Skopiruj nasledujuci text a vloz ho do poznamkoveho bloku:

Kód: Vybrat vše

Start
CloseProcesses:
CreateRestorePoint:

File: C:\Users\muj\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SyncAudio.vbs
File: C:\WINDOWS\system32\Drivers\ksqsjnkm.sys
File: C:\Windows\SysWOW64\lastpass_1337.exe

HKU\S-1-5-21-1414727818-4048635875-1041125893-1001\...\Run: [McAfeeSafeConnect] => C:\Program Files (x86)\McAfee Safe Connect\McAfee Safe Connect.exe
Startup: C:\Users\muj\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SyncAudio.vbs [2018-02-11] ()
2018-03-15 19:48 - 2018-03-15 19:48 - 000000000 _____ C:\Users\muj\Downloads\FRSTLauncher(2).exe
2018-03-15 19:46 - 2018-03-15 19:46 - 000000000 _____ C:\Users\muj\Downloads\FRSTLauncher(1).exe
2018-03-15 19:12 - 2018-03-15 19:12 - 000000000 _____ C:\Users\muj\Downloads\FRSTLauncher.exe
2018-03-15 18:13 - 2017-09-10 07:21 - 000000000 ____D C:\Users\muj\AppData\Roaming\Seznam.cz
2018-03-15 18:12 - 2017-09-10 07:24 - 000000000 ____D C:\Program Files (x86)\Seznam.cz
C:\Windows\SysWOW64\lastpass_1337.exe
AlternateDataStreams: C:\WINDOWS\system32\Drivers\ksqsjnkm.sys:changelist [292]
AlternateDataStreams: C:\Users\Public\AppData:CSM [480]
HKLM\...\StartupApproved\Run32: => "seznam-listicka-distribuce"
HKU\S-1-5-21-1414727818-4048635875-1041125893-1001\...\StartupApproved\StartupFolder: => "SyncAudio.vbs"
HKU\S-1-5-21-1414727818-4048635875-1041125893-1001\...\StartupApproved\Run: => "McAfeeSafeConnect"
HKU\S-1-5-21-1414727818-4048635875-1041125893-1001\...\StartupApproved\Run: => "cz.seznam.software.autoupdate"
HKU\S-1-5-21-1414727818-4048635875-1041125893-1001\...\StartupApproved\Run: => "cz.seznam.software.szndesktop"
C:\Program Files (x86)\McAfee Safe Connect
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\McAfee Safe Connect.lnk
C:\Users\muj\AppData\Local\McAfee_Inc
C:\Users\muj\AppData\Roaming\McAfee Safe Connect

Hosts:
EmptyTemp:
End

Uloz na plochu s nazvom fixlist.txt
Spusti znovu FRST a klikni na Fix
Po dokonceni si FRST vyziada restart PC, potvrd kliknutim na OK
Po restartovani PC bude na ploche subor Fixlog.txt, jeho obsah sem skopiruj

Fix result of Farbar Recovery Scan Tool (x64) Version: 14.03.2018
Ran by muj (16-03-2018 14:21:59) Run:1
Running from C:\Users\muj\Desktop
Loaded Profiles: muj (Available Profiles: muj)
Boot Mode: Normal
==============================================

fixlist content:
*****************
Start
CloseProcesses:
CreateRestorePoint:

File: C:\Users\muj\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SyncAudio.vbs
File: C:\WINDOWS\system32\Drivers\ksqsjnkm.sys
File: C:\Windows\SysWOW64\lastpass_1337.exe

HKU\S-1-5-21-1414727818-4048635875-1041125893-1001\...\Run: [McAfeeSafeConnect] => C:\Program Files (x86)\McAfee Safe Connect\McAfee Safe Connect.exe
Startup: C:\Users\muj\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SyncAudio.vbs [2018-02-11] ()
2018-03-15 19:48 - 2018-03-15 19:48 - 000000000 _____ C:\Users\muj\Downloads\FRSTLauncher(2).exe
2018-03-15 19:46 - 2018-03-15 19:46 - 000000000 _____ C:\Users\muj\Downloads\FRSTLauncher(1).exe
2018-03-15 19:12 - 2018-03-15 19:12 - 000000000 _____ C:\Users\muj\Downloads\FRSTLauncher.exe
2018-03-15 18:13 - 2017-09-10 07:21 - 000000000 ____D C:\Users\muj\AppData\Roaming\Seznam.cz
2018-03-15 18:12 - 2017-09-10 07:24 - 000000000 ____D C:\Program Files (x86)\Seznam.cz
C:\Windows\SysWOW64\lastpass_1337.exe
AlternateDataStreams: C:\WINDOWS\system32\Drivers\ksqsjnkm.sys:changelist [292]
AlternateDataStreams: C:\Users\Public\AppData:CSM [480]
HKLM\...\StartupApproved\Run32: => "seznam-listicka-distribuce"
HKU\S-1-5-21-1414727818-4048635875-1041125893-1001\...\StartupApproved\StartupFolder: => "SyncAudio.vbs"
HKU\S-1-5-21-1414727818-4048635875-1041125893-1001\...\StartupApproved\Run: => "McAfeeSafeConnect"
HKU\S-1-5-21-1414727818-4048635875-1041125893-1001\...\StartupApproved\Run: => "cz.seznam.software.autoupdate"
HKU\S-1-5-21-1414727818-4048635875-1041125893-1001\...\StartupApproved\Run: => "cz.seznam.software.szndesktop"
C:\Program Files (x86)\McAfee Safe Connect
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\McAfee Safe Connect.lnk
C:\Users\muj\AppData\Local\McAfee_Inc
C:\Users\muj\AppData\Roaming\McAfee Safe Connect

Hosts:
EmptyTemp:
End
*****************

Processes closed successfully.
Restore point was successfully created.

========================= File: C:\Users\muj\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SyncAudio.vbs ========================

C:\Users\muj\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SyncAudio.vbs
File not signed
MD5: 2691A2192D3088A6AE4EA598C48087DD
Creation and modification date: 2018-02-11 18:59 - 2018-02-11 18:59
Size: 000000297
Attributes: ----A
Company Name:
Internal Name:
Original Name:
Product:
Description:
File Version:
Product Version:
Copyright:
VirusTotal: 0

====== End of File: ======

========================= File: C:\WINDOWS\system32\Drivers\ksqsjnkm.sys ========================

C:\WINDOWS\system32\Drivers\ksqsjnkm.sys
File is digitally signed
MD5: A5E456CD5A30B41D6B628BDB80F4FA7E
Creation and modification date: 2018-03-15 19:51 - 2018-03-15 19:51
Size: 000072816
Attributes: ----A
Company Name: Microsoft Corporation
Internal Name: BootTimeRemoval
Original Name: BTR.sys
Product: Microsoft Malware Protection
Description: Boot Time Removal Tool
File Version: 1.2.1009.0
Product Version: 1.2.1009.0
Copyright: © Microsoft Corporation. All rights reserved.
VirusTotal: https://www.virustotal.com/file/b8c6a3d ... 521015516/

====== End of File: ======

========================= File: C:\Windows\SysWOW64\lastpass_1337.exe ========================

C:\Windows\SysWOW64\lastpass_1337.exe
File is digitally signed
MD5: D41D8CD98F00B204E9800998ECF8427E (0-byte)
Creation and modification date: 2017-09-15 23:05 - 2017-09-15 23:05
Size: 000000000
Attributes: ----A
Company Name:
Internal Name:
Original Name:
Product:
Description:
File Version:
Product Version:
Copyright:
VirusTotal: 0-byte

====== End of File: ======

"HKU\S-1-5-21-1414727818-4048635875-1041125893-1001\Software\Microsoft\Windows\CurrentVersion\Run\\McAfeeSafeConnect" => removed successfully
C:\Users\muj\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SyncAudio.vbs => moved successfully
C:\Users\muj\Downloads\FRSTLauncher(2).exe => moved successfully
C:\Users\muj\Downloads\FRSTLauncher(1).exe => moved successfully
C:\Users\muj\Downloads\FRSTLauncher.exe => moved successfully
C:\Users\muj\AppData\Roaming\Seznam.cz => moved successfully
C:\Program Files (x86)\Seznam.cz => moved successfully
C:\Windows\SysWOW64\lastpass_1337.exe => moved successfully
C:\WINDOWS\system32\Drivers\ksqsjnkm.sys => ":changelist" ADS removed successfully
C:\Users\Public\AppData => ":CSM" ADS removed successfully
"HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run32\\seznam-listicka-distribuce" => removed successfully
"HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\seznam-listicka-distribuce" => not found
"C:\Users\muj\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SyncAudio.vbs" => not found
"HKU\S-1-5-21-1414727818-4048635875-1041125893-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\StartupFolder\\SyncAudio.vbs" => removed successfully
"HKU\S-1-5-21-1414727818-4048635875-1041125893-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run\\McAfeeSafeConnect" => removed successfully
"HKU\S-1-5-21-1414727818-4048635875-1041125893-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\McAfeeSafeConnect" => not found
"HKU\S-1-5-21-1414727818-4048635875-1041125893-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run\\cz.seznam.software.autoupdate" => removed successfully
"HKU\S-1-5-21-1414727818-4048635875-1041125893-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\cz.seznam.software.autoupdate" => not found
"HKU\S-1-5-21-1414727818-4048635875-1041125893-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run\\cz.seznam.software.szndesktop" => removed successfully
"HKU\S-1-5-21-1414727818-4048635875-1041125893-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\cz.seznam.software.szndesktop" => not found
"C:\Program Files (x86)\McAfee Safe Connect" => not found
"C:\ProgramData\Microsoft\Windows\Start Menu\Programs\McAfee Safe Connect.lnk" => not found
C:\Users\muj\AppData\Local\McAfee_Inc => moved successfully
C:\Users\muj\AppData\Roaming\McAfee Safe Connect => moved successfully
C:\Windows\System32\Drivers\etc\hosts => moved successfully
Hosts restored successfully.

=========== EmptyTemp: ==========

BITS transfer queue => 7364608 B
DOMStore, IE Recovery, AppCache, Feeds Cache, Thumbcache, IconCache => 61868101 B
Java, Flash, Steam htmlcache => 60393714 B
Windows/system/drivers => 4060968 B
Edge => 3263826 B
Chrome => 0 B
Firefox => 390708173 B
Opera => 0 B

Temp, IE cache, history, cookies, recent:
Default => 0 B
Users => 0 B
ProgramData => 0 B
Public => 0 B
systemprofile => 0 B
systemprofile32 => 0 B
LocalService => 22956 B
NetworkService => 437176 B
muj => 478246637 B

RecycleBin => 8964541 B
EmptyTemp: => 968.3 MB temporary data Removed.

================================

The system needed a reboot.

==== End of Fixlog 14:23:37 ====

Otvor poznamkovy blok (Win+R -> notepad -> enter)

Skopiruj nasledujuci text a vloz ho do poznamkoveho bloku:

Kód: Vybrat vše

Start
VirusTotal: C:\FRST\Quarantine\C\Users\muj\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SyncAudio.vbs.xBAD
End

Uloz na plochu s nazvom fixlist.txt
Spusti znovu FRST a klikni na Fix
Pockaj na dokoncenie
Tentokrat to bude bez restartu, otvori sa Fixlog.txt (pripadne bude na ploche), jeho obsah sem skopiruj

Ako to vyzera s PC, nastala nejaka zmena, su este nejake problemy?

Fix result of Farbar Recovery Scan Tool (x64) Version: 14.03.2018
Ran by muj (17-03-2018 12:43:41) Run:2
Running from C:\Users\muj\Desktop
Loaded Profiles: muj & (Available Profiles: muj)
Boot Mode: Normal
==============================================

fixlist content:
*****************
Start
VirusTotal: C:\FRST\Quarantine\C\Users\muj\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SyncAudio.vbs.xBAD
End
*****************

VirusTotal: C:\FRST\Quarantine\C\Users\muj\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SyncAudio.vbs.xBAD => https://www.virustotal.com/file/a0cb94f ... 521287013/

==== End of Fixlog 12:43:43 ====

Zatím to vypadá, že se to přestalo sekat. Problém byl v té nadstavbě seznamu a v tom McAfee ?
Ještě jednou děkuji.

Zmazali sme aj rozne zbytocnosti a docasne subory.

Este upraceme po pouzitych nastrojoch:

Stiahni DelFix: https://toolslib.net/downloads/finish/2-delfix/
Uloz na plochu a spusti
Nechaj oznacenu moznost "Remove disinfection tools"
Klikni na "Run"

Skontroluj velkost plochy (C:\Users\muj\Desktop). Ak je vacsia ako 300 MB, presun vsetky subory a zlozky z plochy do dokumentov a na ploche nechaj iba odkazy/zastupcov. Prilis velka velkost plochy moze sposobit spomalenie systemu.

Tak provedeno, ještě jednou děkuji.

Ještě se zeptám. V průběhu čištění se mi na ploše objevil soubor LB.bat .
Chytře jsem na něj kliknul, probliklo něco a soubor zmizel.
Netušíte co to bylo. Není to problém?

Nie je zaco, rad som pomohol

Subor LM.bat je vytvarany nasim FRSTLauncherom, mozes zmazat.

VIRY.CZ

sekání prohlížeče, pomalé PC

sekání prohlížeče, pomalé PC

Re: sekání prohlížeče, pomalé PC

Re: sekání prohlížeče, pomalé PC

Re: sekání prohlížeče, pomalé PC

Re: sekání prohlížeče, pomalé PC

Re: sekání prohlížeče, pomalé PC

Re: sekání prohlížeče, pomalé PC

Re: sekání prohlížeče, pomalé PC

Re: sekání prohlížeče, pomalé PC

Re: sekání prohlížeče, pomalé PC

Re: sekání prohlížeče, pomalé PC

Re: sekání prohlížeče, pomalé PC