VIRY.CZ

Dobry den ,skontrolujte log z Rsitu dakujem


Logfile of random's system information tool 1.16 (written by random/random)
Run by Roman at 2018-08-16 11:55:58
Microsoft Windows 10 Home
System drive C: has 314 GB (66%) free of 476 GB
Total RAM: 7368 MB (68% free)
X64

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 11:56:01, on 16.8.2018
Platform: Unknown Windows (WinNT 6.02.1008)
MSIE: Internet Explorer v11.0 (11.00.17134.0001)
Boot mode: Normal

Running processes:
C:\Program Files (x86)\ASUS\AI Suite II\EasyUpdate\EzUpdt.exe
C:\Program Files (x86)\ASUS\AI Suite II\AsRoutineController.exe
C:\Program Files (x86)\ASUS\AI Suite II\Remote GO!\AssistTools\WiFi GO! Server.exe
C:\Program Files (x86)\ASUS\AI Suite II\DIGI+ VRM\PowerControlHelp.exe
C:\Program Files\AVAST Software\Avast\AvastUI.exe
C:\Program Files (x86)\ASUS\AI Suite II\TurboV EVO\TurboVHelp.exe
C:\Program Files (x86)\ASUS\AI Suite II\EPU\EPUHelp.exe
C:\Program Files (x86)\ASUS\AI Suite II\Remote GO!\ASUSDMS.exe
C:\Program Files (x86)\ASUS\AI Suite II\AI Suite II.exe
C:\Program Files (x86)\ASUS\AI Suite II\Sensor\AlertHelper\AlertHelper.exe
C:\Program Files (x86)\ASUS\AI Suite II\Remote GO!\AsDLNAServerReal.exe
C:\Program Files\trend micro\Roman_RSITx64.exe
C:\Users\Roman\AppData\Local\Microsoft\OneDrive\18.065.0329.0002\FileCoAuth.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = www.google.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.sk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/p/?LinkId=255141
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/p/?LinkId=255141
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F2 - REG:system.ini: UserInit=
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre1.8.0_181\bin\ssv.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre1.8.0_181\bin\jp2ssv.dll
O4 - HKCU\..\Run: [AppEx Accelerator UI] C:\Program Files\AMD Quick Stream\AMDQuickStream.exe -h
O4 - HKCU\..\Run: [CCleaner Monitoring] "C:\Program Files\CCleaner\CCleaner64.exe" /MONITOR
O4 - HKUS\S-1-5-19\..\Run: [OneDriveSetup] C:\Windows\SysWOW64\OneDriveSetup.exe /thfirstsetup (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [WAB Migrate] %ProgramFiles%\Windows Mail\wab.exe /Upgrade (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [OneDriveSetup] C:\Windows\SysWOW64\OneDriveSetup.exe /thfirstsetup (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [WAB Migrate] %ProgramFiles%\Windows Mail\wab.exe /Upgrade (User 'NETWORK SERVICE')
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O17 - HKLM\System\CCS\Services\Tcpip\..\{132dfb21-73ef-4cbc-a6cd-d65add0efd4b}: NameServer = 156.154.70.25,156.154.71.25
O17 - HKLM\System\CCS\Services\Tcpip\..\{74547168-27fa-4820-997b-69288ee87606}: NameServer = 156.154.70.25,156.154.71.25
O17 - HKLM\System\CCS\Services\Tcpip\..\{d2e62f6c-faa7-4c2f-904f-fed63d1394d8}: NameServer = 156.154.70.25,156.154.71.25
O18 - Protocol: tbauth - {14654CA6-5711-491D-B89A-58E571679951} - C:\Windows\SysWOW64\tbauth.dll
O18 - Protocol: windows.tbauth - {14654CA6-5711-491D-B89A-58E571679951} - C:\Windows\SysWOW64\tbauth.dll
O18 - Protocol: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\WINDOWS\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\WINDOWS\System32\alg.exe (file missing)
O23 - Service: AMD External Events Utility - Unknown owner - C:\WINDOWS\system32\atiesrxx.exe (file missing)
O23 - Service: AMD FUEL Service - Advanced Micro Devices, Inc. - C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe
O23 - Service: Apple Mobile Device Service - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: ASUS Com Service (asComSvc) - Unknown owner - C:\Program Files (x86)\ASUS\AXSP\1.00.19\atkexComSvc.exe
O23 - Service: ASUS HM Com Service (asHmComSvc) - ASUSTeK Computer Inc. - C:\Program Files (x86)\ASUS\AAHM\1.00.20\aaHMSvc.exe
O23 - Service: ASUS System Control Service (AsSysCtrlService) - ASUSTeK Computer Inc. - C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.13\AsSysCtrlService.exe
O23 - Service: AsusFanControlService - ASUSTeK Computer Inc. - C:\Program Files (x86)\ASUS\AsusFanControlService\1.02.05\AsusFanControlService.exe
O23 - Service: aswbIDSAgent - AVAST Software - C:\Program Files\AVAST Software\Avast\x64\aswidsagenta.exe
O23 - Service: Avast Antivirus (avast! Antivirus) - AVAST Software - C:\Program Files\AVAST Software\Avast\AvastSvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: COMODO Internet Security Helper Service (CmdAgent) - COMODO - C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe
O23 - Service: COMODO Virtual Service Manager (cmdvirth) - COMODO - C:\Program Files\COMODO\COMODO Internet Security\cmdvirth.exe
O23 - Service: @%SystemRoot%\system32\DiagSvcs\DiagnosticsHub.StandardCollector.ServiceRes.dll,-1000 (diagnosticshub.standardcollector.service) - Unknown owner - C:\WINDOWS\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe (file missing)
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\WINDOWS\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\WINDOWS\system32\fxssvc.exe (file missing)
O23 - Service: Canon Inkjet Printer/Scanner/Fax Extended Survey Program (IJPLMSVC) - Unknown owner - C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\WINDOWS\system32\lsass.exe (file missing)
O23 - Service: Malwarebytes Service (MBAMService) - Malwarebytes - C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\WINDOWS\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\WINDOWS\system32\lsass.exe (file missing)
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\WINDOWS\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\WINDOWS\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\SecurityHealthAgent.dll,-1002 (SecurityHealthService) - Unknown owner - C:\WINDOWS\system32\SecurityHealthService.exe (file missing)
O23 - Service: @%SystemRoot%\system32\SensorDataService.exe,-101 (SensorDataService) - Unknown owner - C:\WINDOWS\System32\SensorDataService.exe (file missing)
O23 - Service: @%SystemRoot%\System32\SgrmBroker.exe,-100 (SgrmBroker) - Unknown owner - C:\WINDOWS\system32\SgrmBroker.exe (file missing)
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\WINDOWS\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spectrum.exe,-101 (spectrum) - Unknown owner - C:\WINDOWS\system32\spectrum.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\WINDOWS\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\WINDOWS\system32\sppsvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\TieringEngineService.exe,-702 (TieringEngineService) - Unknown owner - C:\WINDOWS\system32\TieringEngineService.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\WINDOWS\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\WINDOWS\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\WINDOWS\system32\vssvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\WINDOWS\system32\wbengine.exe (file missing)
O23 - Service: @%ProgramFiles%\Windows Defender\MpAsDesc.dll,-320 (WdNisSvc) - Unknown owner - C:\Program Files (x86)\Windows Defender\NisSrv.exe (file missing)
O23 - Service: @%ProgramFiles%\Windows Defender\MpAsDesc.dll,-310 (WinDefend) - Unknown owner - C:\Program Files (x86)\Windows Defender\MsMpEng.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\WINDOWS\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)
O23 - Service: @%systemroot%\system32\xbgmsvc.exe,-100 (xbgm) - Unknown owner - C:\WINDOWS\system32\xbgmsvc.exe (file missing)

--
End of file - 9893 bytes

====== Enumerating Processes ======

C:\WINDOWS\system32\winlogon.exe
c:\windows\system32\svchost.exe -k dcomlaunch -p -s PlugPlay
C:\WINDOWS\system32\fontdrvhost.exe
C:\WINDOWS\system32\fontdrvhost.exe
C:\WINDOWS\system32\svchost.exe -k DcomLaunch -p
c:\windows\system32\svchost.exe -k rpcss -p
c:\windows\system32\svchost.exe -k dcomlaunch -p -s LSM
C:\WINDOWS\system32\dwm.exe
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -p -s NcbService
c:\windows\system32\svchost.exe -k netsvcs -p -s Schedule
c:\windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
C:\WINDOWS\system32\svchost.exe -k LocalServiceNoNetwork -p
c:\windows\system32\svchost.exe -k localservicenetworkrestricted -p -s TimeBrokerSvc
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -p -s hidserv
c:\windows\system32\svchost.exe -k localservicenetworkrestricted -p -s EventLog
c:\windows\system32\svchost.exe -k netsvcs -p -s UserManager
c:\windows\system32\svchost.exe -k localservice -p -s nsi
C:\WINDOWS\system32\atiesrxx.exe
c:\windows\system32\svchost.exe -k localservicenetworkrestricted -p -s Dhcp
C:\WINDOWS\system32\atieclxx.exe
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -p -s SysMain
c:\windows\system32\svchost.exe -k localservice -p -s EventSystem
c:\windows\system32\svchost.exe -k netsvcs -p -s Themes
C:\WINDOWS\system32\svchost.exe -k LocalService -p
c:\windows\system32\svchost.exe -k networkservice -p -s NlaSvc
c:\windows\system32\svchost.exe -k netsvcs -p -s SENS
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -p -s AudioEndpointBuilder
c:\windows\system32\svchost.exe -k localservice -p -s FontCache
c:\windows\system32\svchost.exe -k localservice -p -s netprofm
c:\windows\system32\svchost.exe -k netsvcs -p -s lfsvc
C:\WINDOWS\System32\svchost.exe -k LocalServiceNetworkRestricted -p
c:\windows\system32\svchost.exe -k appmodel -p -s StateRepository
C:\WINDOWS\System32\svchost.exe -k LocalServiceNetworkRestricted -p
c:\windows\system32\svchost.exe -k networkservice -p -s Dnscache
C:\WINDOWS\system32\svchost.exe -k LocalServiceNetworkRestricted -p
c:\windows\system32\svchost.exe -k localservicenetworkrestricted -p -s WinHttpAutoProxySvc
C:\WINDOWS\system32\svchost.exe -k LocalSystemNetworkRestricted -p
c:\windows\system32\svchost.exe -k netsvcs -p -s ShellHWDetection
C:\WINDOWS\System32\spoolsv.exe
c:\windows\system32\svchost.exe -k networkservice -p -s LanmanWorkstation
"C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe"
"C:\Program Files (x86)\ASUS\AAHM\1.00.20\aaHMSvc.exe"
C:\WINDOWS\System32\svchost.exe -k utcsvc -p
"C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe"
"C:\Program Files (x86)\ASUS\AXSP\1.00.19\atkexComSvc.exe"
"C:\Program Files (x86)\ASUS\AsusFanControlService\1.02.05\AsusFanControlService.exe"
c:\windows\system32\svchost.exe -k networkservice -p -s CryptSvc
"C:\Program Files\Bonjour\mDNSResponder.exe"
"C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe" /launchService
c:\windows\system32\svchost.exe -k localservicenonetwork -p -s DPS
"C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE"
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -p -s DeviceAssociationService
c:\windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
c:\windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
"C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.13\AsSysCtrlService.exe"
"C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe"
c:\windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
C:\WINDOWS\SysWOW64\PnkBstrA.exe
c:\windows\system32\svchost.exe -k networkservice -p -s TapiSrv
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -p -s TrkWks
C:\WINDOWS\system32\svchost.exe -k imgsvc
c:\windows\system32\svchost.exe -k localservice -s W32Time
c:\windows\system32\svchost.exe -k netsvcs -p -s WpnService
c:\windows\system32\svchost.exe -k netsvcs -p -s iphlpsvc
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -p -s WdiSystemHost
C:\WINDOWS\system32\dashost.exe
c:\windows\system32\svchost.exe -k localservice -p -s SstpSvc
c:\windows\system32\svchost.exe -k localservice -p -s WdiServiceHost
c:\windows\system32\svchost.exe -k netsvcs
c:\windows\system32\svchost.exe -k localserviceandnoimpersonation -p -s SSDPSRV
c:\windows\system32\svchost.exe -k localservicenetworkrestricted -p -s lmhosts
c:\windows\system32\sihost.exe
"C:\Program Files\COMODO\COMODO Internet Security\cavwp.exe" /ModeAvMonitor -Embedding
c:\windows\system32\svchost.exe -k unistacksvcgroup -s CDPUserSvc
c:\windows\system32\svchost.exe -k netsvcs -p -s Browser
c:\windows\system32\svchost.exe -k networkservicenetworkrestricted -p -s PolicyAgent
c:\windows\system32\svchost.exe -k unistacksvcgroup -s WpnUserService
c:\windows\system32\taskhostw.exe
"C:\Program Files (x86)\ASUS\AI Suite II\EasyUpdate\EzUpdt.exe" -onlytray
"C:\Program Files (x86)\ASUS\AI Suite II\AsRoutineController.exe" -open
"C:\Program Files (x86)\ASUS\AI Suite II\Remote GO!\AssistTools\WiFi GO! Server.exe"
"C:\Program Files\COMODO\COMODO Internet Security\cistray.exe"
"C:\Program Files (x86)\ASUS\AI Suite II\DIGI+ VRM\PowerControlHelp.exe"
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -p -s TabletInputService
C:\WINDOWS\system32\ctfmon.exe
c:\windows\system32\svchost.exe -k netsvcs -p -s TokenBroker
C:\WINDOWS\Explorer.EXE
c:\windows\system32\svchost.exe -k localservice -p -s CDPSvc
"C:\WINDOWS\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mca
"C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca
C:\Windows\System32\RuntimeBroker.exe -Embedding
C:\Windows\System32\RuntimeBroker.exe -Embedding
c:\windows\system32\svchost.exe -k localservice -p -s LicenseManager
"C:\Program Files\WindowsApps\Microsoft.SkypeApp_12.1815.210.0_x64__kzf8qxf38zg5c\SkypeHost.exe" -ServerName:SkypeHost.ServerServer
"C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_17.10314.31700.0_x64__8wekyb3d8bbwe\Office16\OfficeHubTaskHost.exe" -ServerName:Microsoft.MicrosoftOfficeHub.AppX6an27ssxm1kq22j0wm54a996rsgjh8an.mca
C:\WINDOWS\system32\SearchIndexer.exe /Embedding
"C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.18071.11811.0_x64__8wekyb3d8bbwe\Video.UI.exe" -ServerName:Microsoft.ZuneVideo.AppX758ya5sqdjd98rx6z7g95nw6jy7bqx9y.mca
"C:\Program Files\AMD Quick Stream\AMDQuickStream.exe" -h
C:\Windows\System32\RuntimeBroker.exe -Embedding
C:\Windows\System32\RuntimeBroker.exe -Embedding
C:\Program Files\AVAST Software\Avast\AvastUI.exe
c:\windows\system32\svchost.exe -k localservicenetworkrestricted -p -s wscsvc
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -p -s Netman
"C:\Program Files\COMODO\COMODO Internet Security\cis.exe" --alertsUI
"C:\Program Files\Opera\54.0.2952.71\opera.exe" -noautoupdate --ran-launcher -- https://www.comodo.com/cis-install-complete/
"C:\Program Files\Opera\54.0.2952.71\opera_crashreporter.exe" -noautoupdate --ran-launcher --crash-reporter-parent-id=5744 -- https://www.comodo.com/cis-install-complete/
C:\Program Files\CCleaner\CCleaner64.exe
"C:\Program Files\Opera\54.0.2952.71\opera.exe" --type=gpu-process --field-trial-handle=1612,2690053627617031004,14946416022533680154,131072 --disable-features=SharedArrayBuffer --with-feature:installer-experiment-test=off --with-feature:installer-use-minimal-package=off --crash-reporter-pid=636 --gpu-preferences=KAAAAAAAAACAAwCAAQAAAAAAAAAAAGAAEAAAAAAAAAAAAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAKAAAAEAAAAAAAAAAAAAAACwAAABAAAAAAAAAAAQAAAAoAAAAQAAAAAAAAAAEAAAALAAAA --with-feature:installer-experiment-test=off --with-feature:installer-use-minimal-package=off --crash-reporter-pid=636 --service-request-channel-token=B106A9B637F448143A1666C16E322E6C --mojo-platform-channel-handle=1636 --ignored=" --type=renderer " /prefetch:2
"C:\Program Files\Opera\54.0.2952.71\opera.exe" --type=renderer --field-trial-handle=1612,2690053627617031004,14946416022533680154,131072 --disable-features=SharedArrayBuffer --service-pipe-token=C25C0EC3B0E319965C62170A56AF8873 --lang=sk --extension-process --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --with-feature:installer-experiment-test=off --with-feature:installer-use-minimal-package=off --crash-reporter-pid=636 --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=C25C0EC3B0E319965C62170A56AF8873 --renderer-client-id=3 --mojo-platform-channel-handle=2724 /prefetch:1
"C:\Program Files\Opera\54.0.2952.71\opera.exe" --type=renderer --field-trial-handle=1612,2690053627617031004,14946416022533680154,131072 --disable-features=SharedArrayBuffer --service-pipe-token=8DA87D649094CD31D260FE33D5BAA659 --lang=sk --extension-process --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --with-feature:installer-experiment-test=off --with-feature:installer-use-minimal-package=off --crash-reporter-pid=636 --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=8DA87D649094CD31D260FE33D5BAA659 --renderer-client-id=4 --mojo-platform-channel-handle=2972 /prefetch:1
"C:\Program Files\Opera\54.0.2952.71\opera.exe" --type=renderer --field-trial-handle=1612,2690053627617031004,14946416022533680154,131072 --disable-features=SharedArrayBuffer --service-pipe-token=814AC508DCD366EA81C1F9F4E4CB88A7 --lang=sk --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --with-feature:installer-experiment-test=off --with-feature:installer-use-minimal-package=off --crash-reporter-pid=636 --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=814AC508DCD366EA81C1F9F4E4CB88A7 --renderer-client-id=9 --mojo-platform-channel-handle=4152 /prefetch:1
"C:\Program Files\Opera\54.0.2952.71\opera.exe" --type=renderer --field-trial-handle=1612,2690053627617031004,14946416022533680154,131072 --disable-features=SharedArrayBuffer --service-pipe-token=C636E06EC52C32CC389A9C3D04AB22ED --lang=sk --extension-process --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --with-feature:installer-experiment-test=off --with-feature:installer-use-minimal-package=off --crash-reporter-pid=636 --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=C636E06EC52C32CC389A9C3D04AB22ED --renderer-client-id=10 --mojo-platform-channel-handle=5056 /prefetch:1
c:\windows\system32\svchost.exe -k unistacksvcgroup
C:\WINDOWS\system32\wbem\unsecapp.exe -Embedding
C:\Windows\System32\RuntimeBroker.exe -Embedding
c:\windows\system32\svchost.exe -k netsvcs -p
C:\WINDOWS\system32\wbem\wmiprvse.exe
"C:\Program Files\Opera\54.0.2952.71\opera.exe" --type=renderer --field-trial-handle=1612,2690053627617031004,14946416022533680154,131072 --disable-features=SharedArrayBuffer --service-pipe-token=C47EDA072A031435C2D5850C37798EC7 --lang=sk --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --with-feature:installer-experiment-test=off --with-feature:installer-use-minimal-package=off --crash-reporter-pid=636 --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=C47EDA072A031435C2D5850C37798EC7 --renderer-client-id=21 --mojo-platform-channel-handle=8024 /prefetch:1
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -p -s PcaSvc
C:\WINDOWS\system32\AUDIODG.EXE 0x574
"C:\Program Files (x86)\ASUS\AI Suite II\USB 3.0 Boost\U3BoostSvr64.exe"
"C:\Program Files (x86)\ASUS\AI Suite II\TurboV EVO\TurboVHelp.exe" -Init
"C:\Program Files (x86)\ASUS\AI Suite II\EPU\EPUHelp.exe" -Init
"C:\Program Files (x86)\ASUS\AI Suite II\Remote GO!\ASUSDMS.exe"
\??\C:\WINDOWS\system32\conhost.exe 0x4
C:\Windows\System32\RuntimeBroker.exe -Embedding
"C:\Program Files (x86)\ASUS\AI Suite II\AI Suite II.exe" -hide
"C:\Program Files (x86)\ASUS\AI Suite II\Sensor\AlertHelper\AlertHelper.exe" -hide
"C:\Program Files (x86)\ASUS\AI Suite II\Remote GO!\AsDLNAServerReal.exe"
C:\Windows\System32\smartscreen.exe -Embedding
C:\WINDOWS\system32\DllHost.exe /Processid:{973D20D7-562D-44B9-B70B-5A0F49CCDF3F}
C:\Windows\System32\SystemSettingsBroker.exe -Embedding
c:\windows\system32\svchost.exe -k localservicenetworkrestricted -s RmSvc
C:\WINDOWS\system32\svchost.exe -k appmodel -p -s camsvc
c:\windows\system32\svchost.exe -k netsvcs -p -s BITS
"C:\WINDOWS\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
"C:\WINDOWS\system32\SearchFilterHost.exe" 0 776 780 788 8192 784
c:\windows\system32\svchost.exe -k netsvcs -p -s Appinfo
C:\WINDOWS\system32\DllHost.exe /Processid:{E10F6C3A-F1AE-4ADC-AA9D-2FE65525666E}
"C:\Users\Roman\Desktop\RSITx64.exe"
C:\WINDOWS\system32\wbem\wmiprvse.exe
c:\windows\system32\taskhostw.exe
C:\WINDOWS\system32\svchost.exe -k netsvcs -p -s gpsvc
C:\WINDOWS\system32\DllHost.exe /Processid:{4FE95D37-3459-4ECC-AC3E-F7ABBE4E8AED}
C:\Users\Roman\AppData\Local\Microsoft\OneDrive\18.065.0329.0002\FileCoAuth.exe -Embedding

====== Scheduled tasks folder ======

C:\WINDOWS\tasks\CreateExplorerShellUnelevatedTask.job - C:\WINDOWS\explorer.exe /NOUACCHECK
C:\WINDOWS\system32\tasks\Adobe Acrobat Update Task - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
C:\WINDOWS\system32\tasks\Avast Emergency Update - C:\Program Files\AVAST Software\Avast\AvEmUpdate.exe
C:\WINDOWS\system32\tasks\CCleaner Update - C:\Program Files\CCleaner\CCUpdate.exe
C:\WINDOWS\system32\tasks\CCleanerSkipUAC - "C:\Program Files\CCleaner\CCleaner.exe" $(Arg0)
C:\WINDOWS\system32\tasks\Opera scheduled Autoupdate 1504285159 - C:\Program Files\Opera\launcher.exe --scheduledautoupdate $(Arg0)
C:\WINDOWS\system32\tasks\User_Feed_Synchronization-{3BADFC2A-9228-4714-8C89-80EA8D6B7DB4} - C:\WINDOWS\system32\msfeedssync.exe sync
C:\WINDOWS\system32\tasks\S-1-5-21-1537523766-1934355744-2765702040-1001\DataSenseLiveTileTask - %SystemRoot%\System32\DataUsageLiveTileTask.exe
C:\WINDOWS\system32\tasks\Microsoft\XblGameSave\XblGameSaveTask - %windir%\System32\XblGameSaveTask.exe standby
C:\WINDOWS\system32\tasks\Microsoft\XblGameSave\XblGameSaveTaskLogon - %windir%\System32\XblGameSaveTask.exe logon
C:\WINDOWS\system32\tasks\Microsoft\Windows\SysResetLogSuccess - %windir%\system32\rundll32.exe ResetEng.dll,RjvLogSuccessEntryPoint
C:\WINDOWS\system32\tasks\Microsoft\Windows\WwanSvc\NotificationTask - %SystemRoot%\System32\WiFiTask.exe wwan
C:\WINDOWS\system32\tasks\Microsoft\Windows\Workplace Join\Automatic-Device-Join - %SystemRoot%\System32\dsregcmd.exe
C:\WINDOWS\system32\tasks\Microsoft\Windows\Workplace Join\Automatic-Workplace-Join - %SystemRoot%\System32\AutoWorkplace.exe join
C:\WINDOWS\system32\tasks\Microsoft\Windows\Workplace Join\Recovery-Check - %SystemRoot%\System32\dsregcmd.exe /checkrecovery
C:\WINDOWS\system32\tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start - C:\WINDOWS\system32\sc.exe start wuauserv
C:\WINDOWS\system32\tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start With Network - C:\WINDOWS\system32\sc.exe start wuauserv
C:\WINDOWS\system32\tasks\Microsoft\Windows\WindowsUpdate\sih - %systemroot%\System32\sihclient.exe
C:\WINDOWS\system32\tasks\Microsoft\Windows\Windows Media Sharing\UpdateLibrary - "%ProgramFiles%\Windows Media Player\wmpnscfg.exe"
C:\WINDOWS\system32\tasks\Microsoft\Windows\Windows Filtering Platform\BfeOnServiceStartTypeChange - %windir%\system32\rundll32.exe bfe.dll,BfeOnServiceStartTypeChange
C:\WINDOWS\system32\tasks\Microsoft\Windows\Windows Error Reporting\QueueReporting - %windir%\system32\wermgr.exe -upload
C:\WINDOWS\system32\tasks\Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance - %ProgramFiles%\Windows Defender\MpCmdRun.exe -IdleTask -TaskName WdCacheMaintenance
C:\WINDOWS\system32\tasks\Microsoft\Windows\Windows Defender\Windows Defender Cleanup - %ProgramFiles%\Windows Defender\MpCmdRun.exe -IdleTask -TaskName WdCleanup
C:\WINDOWS\system32\tasks\Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan - %ProgramFiles%\Windows Defender\MpCmdRun.exe Scan -ScheduleJob
C:\WINDOWS\system32\tasks\Microsoft\Windows\Windows Defender\Windows Defender Verification - %ProgramFiles%\Windows Defender\MpCmdRun.exe -IdleTask -TaskName WdVerification
C:\WINDOWS\system32\tasks\Microsoft\Windows\WCM\WiFiTask - %SystemRoot%\System32\WiFiTask.exe
C:\WINDOWS\system32\tasks\Microsoft\Windows\UPnP\UPnPHostConfig - sc.exe config upnphost start= auto
C:\WINDOWS\system32\tasks\Microsoft\Windows\UpdateOrchestrator\Maintenance Install - %systemroot%\system32\usoclient.exe StartInstall
C:\WINDOWS\system32\tasks\Microsoft\Windows\UpdateOrchestrator\MusUx_UpdateInterval - %systemroot%\system32\MusNotification.exe Display
C:\WINDOWS\system32\tasks\Microsoft\Windows\UpdateOrchestrator\Reboot - %systemroot%\system32\MusNotification.exe RebootDialog
C:\WINDOWS\system32\tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Retry Scan - %systemroot%\system32\usoclient.exe StartScan
C:\WINDOWS\system32\tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Scan - %systemroot%\system32\usoclient.exe StartScan
C:\WINDOWS\system32\tasks\Microsoft\Windows\UpdateOrchestrator\USO_Broker_Display - %systemroot%\system32\MusNotification.exe Display
C:\WINDOWS\system32\tasks\Microsoft\Windows\UNP\RunUpdateNotificationMgr - %windir%\System32\UNP\UpdateNotificationMgr.exe
C:\WINDOWS\system32\tasks\Microsoft\Windows\Time Zone\SynchronizeTimeZone - %windir%\system32\tzsync.exe
C:\WINDOWS\system32\tasks\Microsoft\Windows\Time Synchronization\SynchronizeTime - %windir%\system32\sc.exe start w32time task_started
C:\WINDOWS\system32\tasks\Microsoft\Windows\SystemRestore\SR - %windir%\system32\srtasks.exe ExecuteScheduledSPPCreation
C:\WINDOWS\system32\tasks\Microsoft\Windows\Sysmain\WsSwapAssessmentTask - %windir%\system32\rundll32.exe sysmain.dll,PfSvWsSwapAssessmentTask
C:\WINDOWS\system32\tasks\Microsoft\Windows\Subscription\EnableLicenseAcquisition - %SystemRoot%\system32\ClipRenew.exe -e
C:\WINDOWS\system32\tasks\Microsoft\Windows\Subscription\LicenseAcquisition - %SystemRoot%\system32\ClipRenew.exe
C:\WINDOWS\system32\tasks\Microsoft\Windows\Storage Tiers Management\Storage Tiers Optimization - %windir%\system32\defrag.exe -c -h -g -# -m 8 -i 13500
C:\WINDOWS\system32\tasks\Microsoft\Windows\Speech\HeadsetButtonPress - %windir%\system32\speech_onecore\common\SpeechRuntime.exe StartedFromTask
C:\WINDOWS\system32\tasks\Microsoft\Windows\Speech\SpeechModelDownloadTask - %windir%\system32\speech_onecore\common\SpeechModelDownload.exe
C:\WINDOWS\system32\tasks\Microsoft\Windows\SpacePort\SpaceAgentTask - %windir%\system32\SpaceAgent.exe
C:\WINDOWS\system32\tasks\Microsoft\Windows\SpacePort\SpaceManagerTask - %windir%\system32\spaceman.exe /Work
C:\WINDOWS\system32\tasks\Microsoft\Windows\SMB\UninstallSMB1ClientTask - %windir%\system32\WindowsPowerShell\v1.0\powershell.exe -ExecutionPolicy Unrestricted -NonInteractive -NoProfile -WindowStyle Hidden "& %windir%\system32\WindowsPowerShell\v1.0\Modules\SmbShare\DisableUnusedSmb1.ps1 -Scenario Client"
C:\WINDOWS\system32\tasks\Microsoft\Windows\SMB\UninstallSMB1ServerTask - %windir%\system32\WindowsPowerShell\v1.0\powershell.exe -ExecutionPolicy Unrestricted -NonInteractive -NoProfile -WindowStyle Hidden "& %windir%\system32\WindowsPowerShell\v1.0\Modules\SmbShare\DisableUnusedSmb1.ps1 -Scenario Server"
C:\WINDOWS\system32\tasks\Microsoft\Windows\Shell\FamilySafetyMonitor - %windir%\System32\wpcmon.exe
C:\WINDOWS\system32\tasks\Microsoft\Windows\SharedPC\Account Cleanup - %windir%\System32\rundll32.exe %windir%\System32\Windows.SharedPC.AccountManager.dll,StartMaintenance
C:\WINDOWS\system32\tasks\Microsoft\Windows\RemovalTools\MRT_ERROR_HB - C:\WINDOWS\system32\MRT.exe /EHB /HeartbeatFailure "SubmitHeartbeatReportData" /HeartbeatError "0x80072ee2"
C:\WINDOWS\system32\tasks\Microsoft\Windows\RemoteAssistance\RemoteAssistanceTask - %windir%\system32\RAServer.exe /offerraupdate
C:\WINDOWS\system32\tasks\Microsoft\Windows\PushToInstall\LoginCheck - %windir%\system32\sc.exe start pushtoinstall login
C:\WINDOWS\system32\tasks\Microsoft\Windows\PushToInstall\Registration - %windir%\system32\sc.exe start pushtoinstall registration
C:\WINDOWS\system32\tasks\Microsoft\Windows\Printing\EduPrintProv - %windir%\system32\eduprintprov.exe
C:\WINDOWS\system32\tasks\Microsoft\Windows\Plug and Play\Sysprep Generalize Drivers - %SystemRoot%\System32\drvinst.exe 6
C:\WINDOWS\system32\tasks\Microsoft\Windows\NlaSvc\WiFiTask - %SystemRoot%\System32\WiFiTask.exe nla
C:\WINDOWS\system32\tasks\Microsoft\Windows\NetTrace\GatherNetworkInfo - %windir%\system32\gatherNetworkInfo.vbs
C:\WINDOWS\system32\tasks\Microsoft\Windows\MUI\LPRemove - %windir%\system32\lpremove.exe
C:\WINDOWS\system32\tasks\Microsoft\Windows\Mobile Broadband Accounts\MNO Metadata Parser - %SystemRoot%\System32\MbaeParserTask.exe
C:\WINDOWS\system32\tasks\Microsoft\Windows\Management\Provisioning\Cellular - %windir%\system32\ProvTool.exe /turn 7 /source CellStateChangeTask
C:\WINDOWS\system32\tasks\Microsoft\Windows\Management\Provisioning\Logon - %windir%\system32\ProvTool.exe /turn 5 /source LogonIdleTask
C:\WINDOWS\system32\tasks\Microsoft\Windows\Location\Notifications - %windir%\System32\LocationNotificationWindows.exe
C:\WINDOWS\system32\tasks\Microsoft\Windows\Location\WindowsActionDialog - %windir%\System32\WindowsActionDialog.exe
C:\WINDOWS\system32\tasks\Microsoft\Windows\HelloFace\FODCleanupTask - %WinDir%\System32\WinBioPlugIns\FaceFodUninstaller.exe
C:\WINDOWS\system32\tasks\Microsoft\Windows\Feedback\Siuf\DmClient - %windir%\system32\dmclient.exe
C:\WINDOWS\system32\tasks\Microsoft\Windows\Feedback\Siuf\DmClientOnScenarioDownload - %windir%\system32\dmclient.exe utcwnf
C:\WINDOWS\system32\tasks\Microsoft\Windows\EnterpriseMgmt\MDMMaintenenceTask - %windir%\system32\MDMAgent.exe
C:\WINDOWS\system32\tasks\Microsoft\Windows\DUSM\dusmtask - %SystemRoot%\System32\dusmtask.exe
C:\WINDOWS\system32\tasks\Microsoft\Windows\DiskFootprint\Diagnostics - %windir%\system32\disksnapshot.exe -z
C:\WINDOWS\system32\tasks\Microsoft\Windows\DiskDiagnostic\Microsoft-Windows-DiskDiagnosticDataCollector - %windir%\system32\rundll32.exe dfdts.dll,DfdGetDefaultPolicyAndSMART
C:\WINDOWS\system32\tasks\Microsoft\Windows\DiskDiagnostic\Microsoft-Windows-DiskDiagnosticResolver - %windir%\system32\DFDWiz.exe
C:\WINDOWS\system32\tasks\Microsoft\Windows\DiskCleanup\SilentCleanup - %windir%\system32\cleanmgr.exe /autoclean /d %systemdrive%
C:\WINDOWS\system32\tasks\Microsoft\Windows\DirectX\DXGIAdapterCache - %windir%\system32\dxgiadaptercache.exe
C:\WINDOWS\system32\tasks\Microsoft\Windows\Device Information\Device - %windir%\system32\devicecensus.exe
C:\WINDOWS\system32\tasks\Microsoft\Windows\Defrag\ScheduledDefrag - %windir%\system32\defrag.exe -c -h -o -$
C:\WINDOWS\system32\tasks\Microsoft\Windows\Customer Experience Improvement Program\Consolidator - %SystemRoot%\System32\wsqmcons.exe
C:\WINDOWS\system32\tasks\Microsoft\Windows\Clip\License Validation - %SystemRoot%\system32\ClipUp.exe -p -s -o
C:\WINDOWS\system32\tasks\Microsoft\Windows\Chkdsk\SyspartRepair - %windir%\system32\bcdboot.exe %windir% /sysrepair
C:\WINDOWS\system32\tasks\Microsoft\Windows\Bluetooth\UninstallDeviceTask - BthUdTask.exe $(Arg0)
C:\WINDOWS\system32\tasks\Microsoft\Windows\Autochk\Proxy - %windir%\system32\rundll32.exe /d acproxy.dll,PerformAutochkOperations
C:\WINDOWS\system32\tasks\Microsoft\Windows\AppxDeploymentClient\Pre-staged app cleanup - %windir%\system32\rundll32.exe %windir%\system32\AppxDeploymentClient.dll,AppxPreStageCleanupRunTask
C:\WINDOWS\system32\tasks\Microsoft\Windows\ApplicationData\appuriverifierdaily - %windir%\system32\AppHostRegistrationVerifier.exe
C:\WINDOWS\system32\tasks\Microsoft\Windows\ApplicationData\appuriverifierinstall - %windir%\system32\AppHostRegistrationVerifier.exe
C:\WINDOWS\system32\tasks\Microsoft\Windows\ApplicationData\CleanupTemporaryState - %windir%\system32\rundll32.exe Windows.Storage.ApplicationData.dll,CleanupTemporaryState
C:\WINDOWS\system32\tasks\Microsoft\Windows\ApplicationData\DsSvcCleanup - %windir%\system32\dstokenclean.exe
C:\WINDOWS\system32\tasks\Microsoft\Windows\Application Experience\Microsoft Compatibility Appraiser - %windir%\system32\compattelrunner.exe
C:\WINDOWS\system32\tasks\Microsoft\Windows\Application Experience\ProgramDataUpdater - %windir%\system32\compattelrunner.exe -maintenance
C:\WINDOWS\system32\tasks\Microsoft\Windows\Application Experience\StartupAppTask - %windir%\system32\rundll32.exe Startupscan.dll,SusRunTask
C:\WINDOWS\system32\tasks\Microsoft\Windows\AppID\PolicyConverter - %windir%\system32\appidpolicyconverter.exe
C:\WINDOWS\system32\tasks\Microsoft\Windows\AppID\VerifiedPublisherCertStoreCheck - %windir%\system32\appidcertstorecheck.exe
C:\WINDOWS\system32\tasks\COMODO\COMODO Autostart {D5EFF3B3-E126-4AF6-BCE9-852A72129E10} - "C:\Program Files\COMODO\COMODO Internet Security\cistray.exe"
C:\WINDOWS\system32\tasks\COMODO\COMODO CMC {06A09C0F-DD9C-4191-A670-71115CD78627} - "C:\Program Files\COMODO\COMODO Internet Security\cfpconfg.exe" --launchSchedule {06A09C0F-DD9C-4191-A670-71115CD78627}
C:\WINDOWS\system32\tasks\COMODO\COMODO Maintenance {947247B5-026A-4437-9371-770782BE839D} - "C:\Program Files\COMODO\COMODO Internet Security\cfpconfg.exe" --launchSchedule {947247B5-026A-4437-9371-770782BE839D}
C:\WINDOWS\system32\tasks\COMODO\COMODO Signature Update {B9D5C6F9-17D2-4917-8BD0-614BAA1C6A59} - "C:\Program Files\COMODO\COMODO Internet Security\cfpconfg.exe" --launchSchedule {B9D5C6F9-17D2-4917-8BD0-614BAA1C6A59}
C:\WINDOWS\system32\tasks\COMODO\COMODO Telemetry {18AD3DFA-30C0-4B5F-84F7-F1870B1A4921} - "C:\Program Files\COMODO\COMODO Internet Security\cis.exe" --telemetry
C:\WINDOWS\system32\tasks\COMODO\COMODO Update {A6D52E4F-569B-4756-B3D8-DF217313DA85} - "C:\Program Files\COMODO\COMODO Internet Security\cfpconfg.exe" --launchSchedule {A6D52E4F-569B-4756-B3D8-DF217313DA85}
C:\WINDOWS\system32\tasks\Avast Software\Overseer - C:\PROGRA~1\COMMON~1\AVASTS~1\Overseer\overseer.exe
C:\WINDOWS\system32\tasks\ASUS\ASUS AI Suite II Execute - C:\Program Files (x86)\ASUS\AI Suite II\AsRoutineController.exe -open
C:\WINDOWS\system32\tasks\ASUS\ASUS DigiPowerControl Help - C:\Program Files (x86)\ASUS\AI Suite II\DIGI+ VRM\PowerControlHelp.exe
C:\WINDOWS\system32\tasks\ASUS\ASUS Network iControl Help Execute - C:\Program Files (x86)\ASUS\AI Suite II\Network iControl\NetSvcHelp\NetSvcHelpEntry.exe -delay
C:\WINDOWS\system32\tasks\ASUS\ASUS WiFi GO! Server Execute - C:\Program Files (x86)\ASUS\AI Suite II\Remote GO!\AssistTools\WiFi GO! Server.exe
C:\WINDOWS\system32\tasks\ASUS\Easy Update - C:\Program Files (x86)\ASUS\AI Suite II\EasyUpdate\EzUpdt.exe -onlytray
C:\WINDOWS\system32\tasks\ASUS\USB 3.0 Boost Service - C:\Program Files (x86)\ASUS\AI Suite II\USB 3.0 Boost\U3BoostSvr.exe
C:\WINDOWS\system32\tasks\Apple\AppleSoftwareUpdate - C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe -task

======Registry dump ======


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes]
"DefaultScope"={0633EE93-D776-472f-A0FF-E1416B8B2E3A}
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}]
"URL"=http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC


[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Internet Explorer\SearchScopes]
"DefaultScope"={0633EE93-D776-472f-A0FF-E1416B8B2E3A}
[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}]
"URL"=http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
Java(tm) Plug-In SSV Helper - C:\Program Files (x86)\Java\jre1.8.0_181\bin\ssv.dll [2018-08-01 480120]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files (x86)\Java\jre1.8.0_181\bin\jp2ssv.dll [2018-08-01 194424]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"AvastUI.exe"=C:\Program Files\AVAST Software\Avast\AvLaunch.exe [2018-06-20 242904]
"COMODO Autostart {D5EFF3B3-E126-4AF6-BCE9-852A72129E10}"=C:\Program Files\COMODO\COMODO Internet Security\cistray.exe [2018-06-18 1585344]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"AppEx Accelerator UI"=C:\Program Files\AMD Quick Stream\AMDQuickStream.exe [2015-04-06 488640]
"CCleaner Monitoring"=C:\Program Files\CCleaner\CCleaner64.exe [2018-07-20 18534016]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED}

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders" = credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\AudioEndpointBuilder]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\AudioSrv]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\HdAudAddService.Sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\HdAudBus.Sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SerCx2.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\usbaudio.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E96C-E325-11CE-BFC1-08002BE10318}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AudioEndpointBuilder]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AudioSrv]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\HdAudAddService.Sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\HdAudBus.Sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\NetSetupSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\SerCx2.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\usbaudio.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{4D36E96C-E325-11CE-BFC1-08002BE10318}]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=5
"ConsentPromptBehaviorUser"=3
"DSCAutomationHostEnabled"=2
"EnableCursorSuppression"=1
"EnableFullTrustStartupTasks"=2
"EnableUIADesktopToggle"=0
"EnableUwpStartupTasks"=2
"SupportFullTrustStartupTasks"=1
"SupportUwpStartupTasks"=1
"undockwithoutlogon"=1
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"SoftwareSASGeneration"=1

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"ForceActiveDesktopOn"=0
"NoActiveDesktop"=1
"NoActiveDesktopChanges"=1

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"midimapper"=midimap.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.l3acm"=C:\Windows\System32\l3codeca.acm
"msacm.msadpcm"=msadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"vidc.i420"=iyuv_32.dll
"vidc.iyuv"=iyuv_32.dll
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"vidc.uyvy"=msyuv.dll
"vidc.yuy2"=msyuv.dll
"vidc.yvu9"=tsbyuv.dll
"vidc.yvyu"=msyuv.dll
"wavemapper"=msacm32.drv
"VIDC.FPS1"=frapsv64.dll
"MSVideo8"=VfWWDM32.dll
"wave1"=wdmaud.drv
"midi1"=wdmaud.drv
"mixer1"=wdmaud.drv
"aux1"=wdmaud.drv
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv

====== File associations ======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*

====== List of files/folders created in the last 1 month ======

2018-08-16 11:55:59 ----D---- C:\Program Files\trend micro
2018-08-16 11:55:58 ----D---- C:\rsit
2018-08-16 11:38:31 ----A---- C:\WINDOWS\system32\drivers\cmdboot.sys
2018-08-16 11:38:27 ----D---- C:\Program Files\COMODO
2018-08-16 11:37:12 ----D---- C:\ProgramData\Shared Space
2018-08-16 11:37:12 ----D---- C:\ProgramData\Comodo Downloader
2018-08-16 10:58:01 ----D---- C:\Program Files (x86)\TP-Link
2018-08-16 10:57:20 ----A---- C:\WINDOWS\system32\rtwlanu.sys
2018-08-16 10:57:20 ----A---- C:\WINDOWS\system32\drivers\rtwlanu.sys
2018-08-16 09:14:43 ----A---- C:\WINDOWS\system32\Windows.Media.Protection.PlayReady.dll
2018-08-16 09:14:42 ----A---- C:\WINDOWS\SYSWOW64\Windows.Media.Protection.PlayReady.dll
2018-08-16 09:14:41 ----A---- C:\WINDOWS\system32\edgehtml.dll
2018-08-16 09:14:38 ----A---- C:\WINDOWS\system32\mshtml.dll
2018-08-16 09:14:34 ----A---- C:\WINDOWS\system32\shell32.dll
2018-08-16 09:14:32 ----A---- C:\WINDOWS\SYSWOW64\wininet.dll
2018-08-16 09:14:32 ----A---- C:\WINDOWS\SYSWOW64\edgehtml.dll
2018-08-16 09:14:32 ----A---- C:\WINDOWS\system32\wininet.dll
2018-08-16 09:14:31 ----A---- C:\WINDOWS\system32\windows.storage.dll
2018-08-16 09:14:31 ----A---- C:\WINDOWS\system32\ntoskrnl.exe
2018-08-16 09:14:29 ----A---- C:\WINDOWS\system32\Windows.Data.Pdf.dll
2018-08-16 09:14:29 ----A---- C:\WINDOWS\system32\Chakra.dll
2018-08-16 09:14:28 ----A---- C:\WINDOWS\SYSWOW64\mshtml.dll
2018-08-16 09:14:26 ----A---- C:\WINDOWS\SYSWOW64\windows.storage.dll
2018-08-16 09:14:26 ----A---- C:\WINDOWS\system32\AppXDeploymentServer.dll
2018-08-16 09:14:24 ----A---- C:\WINDOWS\system32\EdgeContent.dll
2018-08-16 09:14:23 ----A---- C:\WINDOWS\SYSWOW64\Chakra.dll
2018-08-16 09:14:23 ----A---- C:\WINDOWS\system32\jscript9.dll
2018-08-16 09:14:22 ----A---- C:\WINDOWS\SYSWOW64\shell32.dll
2018-08-16 09:14:22 ----A---- C:\WINDOWS\system32\tquery.dll
2018-08-16 09:14:21 ----A---- C:\WINDOWS\system32\win32kfull.sys
2018-08-16 09:14:20 ----A---- C:\WINDOWS\system32\mssrch.dll
2018-08-16 09:14:20 ----A---- C:\WINDOWS\system32\hvix64.exe
2018-08-16 09:14:19 ----A---- C:\WINDOWS\SYSWOW64\Windows.Data.Pdf.dll
2018-08-16 09:14:19 ----A---- C:\WINDOWS\system32\iertutil.dll
2018-08-16 09:14:18 ----A---- C:\WINDOWS\SYSWOW64\tquery.dll
2018-08-16 09:14:18 ----A---- C:\WINDOWS\SYSWOW64\iertutil.dll
2018-08-16 09:14:17 ----A---- C:\WINDOWS\SYSWOW64\jscript9.dll
2018-08-16 09:14:17 ----A---- C:\WINDOWS\system32\wevtsvc.dll
2018-08-16 09:14:17 ----A---- C:\WINDOWS\system32\hvax64.exe
2018-08-16 09:14:16 ----A---- C:\WINDOWS\SYSWOW64\win32kfull.sys
2018-08-16 09:14:16 ----A---- C:\WINDOWS\SYSWOW64\mssrch.dll
2018-08-16 09:14:16 ----A---- C:\WINDOWS\system32\TokenBroker.dll
2018-08-16 09:14:16 ----A---- C:\WINDOWS\system32\drivers\dxgkrnl.sys
2018-08-16 09:14:16 ----A---- C:\WINDOWS\system32\ApplyTrustOffline.exe
2018-08-16 09:14:15 ----A---- C:\WINDOWS\SYSWOW64\ntdll.dll
2018-08-16 09:14:15 ----A---- C:\WINDOWS\system32\Windows.Security.Authentication.Web.Core.dll
2018-08-16 09:14:15 ----A---- C:\WINDOWS\system32\EdgeManager.dll
2018-08-16 09:14:15 ----A---- C:\WINDOWS\system32\bcastdvruserservice.dll
2018-08-16 09:14:14 ----A---- C:\WINDOWS\system32\webplatstorageserver.dll
2018-08-16 09:14:14 ----A---- C:\WINDOWS\system32\ntdll.dll
2018-08-16 09:14:14 ----A---- C:\WINDOWS\system32\edgeangle.dll
2018-08-16 09:14:14 ----A---- C:\WINDOWS\system32\AppXDeploymentExtensions.onecore.dll
2018-08-16 09:14:13 ----A---- C:\WINDOWS\SYSWOW64\vbscript.dll
2018-08-16 09:14:13 ----A---- C:\WINDOWS\SYSWOW64\jscript.dll
2018-08-16 09:14:13 ----A---- C:\WINDOWS\SYSWOW64\GdiPlus.dll
2018-08-16 09:14:13 ----A---- C:\WINDOWS\SYSWOW64\EdgeManager.dll
2018-08-16 09:14:13 ----A---- C:\WINDOWS\system32\win32kbase.sys
2018-08-16 09:14:13 ----A---- C:\WINDOWS\system32\SearchIndexer.exe
2018-08-16 09:14:13 ----A---- C:\WINDOWS\system32\nettrace.dll
2018-08-16 09:14:13 ----A---- C:\WINDOWS\system32\jscript.dll
2018-08-16 09:14:12 ----A---- C:\WINDOWS\SYSWOW64\msi.dll
2018-08-16 09:14:11 ----A---- C:\WINDOWS\SYSWOW64\TokenBroker.dll
2018-08-16 09:14:11 ----A---- C:\WINDOWS\system32\wbiosrvc.dll
2018-08-16 09:14:11 ----A---- C:\WINDOWS\system32\msi.dll
2018-08-16 09:14:10 ----A---- C:\WINDOWS\SYSWOW64\StructuredQuery.dll
2018-08-16 09:14:10 ----A---- C:\WINDOWS\system32\winload.exe
2018-08-16 09:14:10 ----A---- C:\WINDOWS\system32\edgeIso.dll
2018-08-16 09:14:09 ----A---- C:\WINDOWS\SYSWOW64\msvproc.dll
2018-08-16 09:14:09 ----A---- C:\WINDOWS\system32\winresume.exe
2018-08-16 09:14:09 ----A---- C:\WINDOWS\system32\vbscript.dll
2018-08-16 09:14:09 ----A---- C:\WINDOWS\system32\tdh.dll
2018-08-16 09:14:09 ----A---- C:\WINDOWS\system32\StructuredQuery.dll
2018-08-16 09:14:09 ----A---- C:\WINDOWS\system32\GdiPlus.dll
2018-08-16 09:14:09 ----A---- C:\WINDOWS\system32\AppXDeploymentExtensions.desktop.dll
2018-08-16 09:14:08 ----A---- C:\WINDOWS\SYSWOW64\Windows.Security.Authentication.Web.Core.dll
2018-08-16 09:14:08 ----A---- C:\WINDOWS\SYSWOW64\tdh.dll
2018-08-16 09:14:08 ----A---- C:\WINDOWS\system32\WpcWebFilter.dll
2018-08-16 09:14:08 ----A---- C:\WINDOWS\system32\securekernel.exe
2018-08-16 09:14:08 ----A---- C:\WINDOWS\system32\msvproc.dll
2018-08-16 09:14:07 ----A---- C:\WINDOWS\SYSWOW64\SearchIndexer.exe
2018-08-16 09:14:07 ----A---- C:\WINDOWS\SYSWOW64\MSVideoDSP.dll
2018-08-16 09:14:07 ----A---- C:\WINDOWS\SYSWOW64\jscript9diag.dll
2018-08-16 09:14:07 ----A---- C:\WINDOWS\SYSWOW64\fontdrvhost.exe
2018-08-16 09:14:07 ----A---- C:\WINDOWS\system32\tcblaunch.exe
2018-08-16 09:14:07 ----A---- C:\WINDOWS\system32\MSVideoDSP.dll
2018-08-16 09:14:07 ----A---- C:\WINDOWS\system32\lsasrv.dll
2018-08-16 09:14:07 ----A---- C:\WINDOWS\system32\drivers\ndis.sys
2018-08-16 09:14:06 ----A---- C:\WINDOWS\system32\SgrmEnclave_secure.dll
2018-08-16 09:14:06 ----A---- C:\WINDOWS\system32\SgrmEnclave.dll
2018-08-16 09:14:06 ----A---- C:\WINDOWS\system32\drivers\USBHUB3.SYS
2018-08-16 09:14:05 ----A---- C:\WINDOWS\system32\wldp.dll
2018-08-16 09:14:05 ----A---- C:\WINDOWS\system32\hvloader.dll
2018-08-16 09:14:05 ----A---- C:\WINDOWS\system32\fontdrvhost.exe
2018-08-16 09:14:05 ----A---- C:\WINDOWS\system32\drivers\hvservice.sys
2018-08-16 09:14:05 ----A---- C:\WINDOWS\system32\drivers\cng.sys
2018-08-16 09:14:04 ----A---- C:\WINDOWS\SYSWOW64\CoreMessaging.dll
2018-08-16 09:14:04 ----A---- C:\WINDOWS\system32\vertdll.dll
2018-08-16 09:14:04 ----A---- C:\WINDOWS\system32\nltest.exe
2018-08-16 09:14:04 ----A---- C:\WINDOWS\system32\drivers\scmbus.sys
2018-08-16 09:14:04 ----A---- C:\WINDOWS\system32\drivers\ksecpkg.sys
2018-08-16 09:14:03 ----A---- C:\WINDOWS\SYSWOW64\WpcWebFilter.dll
2018-08-16 09:14:03 ----A---- C:\WINDOWS\SYSWOW64\wldp.dll
2018-08-16 09:14:03 ----A---- C:\WINDOWS\SYSWOW64\nshwfp.dll
2018-08-16 09:14:03 ----A---- C:\WINDOWS\SYSWOW64\edgeIso.dll
2018-08-16 09:14:03 ----A---- C:\WINDOWS\system32\sppc.dll
2018-08-16 09:14:03 ----A---- C:\WINDOWS\system32\nshwfp.dll
2018-08-16 09:14:03 ----A---- C:\WINDOWS\system32\MSPhotography.dll
2018-08-16 09:14:03 ----A---- C:\WINDOWS\system32\kdnet.dll
2018-08-16 09:14:03 ----A---- C:\WINDOWS\system32\hvhostsvc.dll
2018-08-16 09:14:03 ----A---- C:\WINDOWS\system32\drivers\Ucx01000.sys
2018-08-16 09:14:03 ----A---- C:\WINDOWS\system32\CoreMessaging.dll
2018-08-16 09:14:02 ----A---- C:\WINDOWS\SYSWOW64\mssvp.dll
2018-08-16 09:14:02 ----A---- C:\WINDOWS\system32\TSWorkspace.dll
2018-08-16 09:14:02 ----A---- C:\WINDOWS\system32\SearchProtocolHost.exe
2018-08-16 09:14:02 ----A---- C:\WINDOWS\system32\mssvp.dll
2018-08-16 09:14:02 ----A---- C:\WINDOWS\system32\iedkcs32.dll
2018-08-16 09:14:02 ----A---- C:\WINDOWS\system32\drivers\winhv.sys
2018-08-16 09:14:02 ----A---- C:\WINDOWS\system32\drivers\vpci.sys
2018-08-16 09:14:02 ----A---- C:\WINDOWS\system32\drivers\vmbus.sys
2018-08-16 09:14:01 ----A---- C:\WINDOWS\SYSWOW64\Windows.Media.MixedRealityCapture.dll
2018-08-16 09:14:01 ----A---- C:\WINDOWS\SYSWOW64\SearchProtocolHost.exe
2018-08-16 09:14:01 ----A---- C:\WINDOWS\SYSWOW64\msiexec.exe
2018-08-16 09:14:01 ----A---- C:\WINDOWS\SYSWOW64\iedkcs32.dll
2018-08-16 09:14:01 ----A---- C:\WINDOWS\SYSWOW64\hlink.dll
2018-08-16 09:14:01 ----A---- C:\WINDOWS\system32\Windows.Media.MixedRealityCapture.dll
2018-08-16 09:14:01 ----A---- C:\WINDOWS\system32\WaaSAssessment.dll
2018-08-16 09:14:01 ----A---- C:\WINDOWS\system32\Search.ProtocolHandler.MAPI2.dll
2018-08-16 09:14:01 ----A---- C:\WINDOWS\system32\msiexec.exe
2018-08-16 09:14:01 ----A---- C:\WINDOWS\system32\fontsub.dll
2018-08-16 09:14:01 ----A---- C:\WINDOWS\system32\drivers\winhvr.sys
2018-08-16 09:13:59 ----A---- C:\WINDOWS\SYSWOW64\t2embed.dll
2018-08-16 09:13:59 ----A---- C:\WINDOWS\SYSWOW64\msIso.dll
2018-08-16 09:13:59 ----A---- C:\WINDOWS\SYSWOW64\fontsub.dll
2018-08-16 09:13:59 ----A---- C:\WINDOWS\system32\t2embed.dll
2018-08-16 09:13:59 ----A---- C:\WINDOWS\system32\jscript9diag.dll
2018-08-16 09:13:59 ----A---- C:\WINDOWS\system32\hlink.dll
2018-08-16 09:13:59 ----A---- C:\WINDOWS\system32\drivers\netbt.sys
2018-08-16 09:13:57 ----A---- C:\WINDOWS\SYSWOW64\webplatstorageserver.dll
2018-08-16 09:13:57 ----A---- C:\WINDOWS\system32\mssph.dll
2018-08-16 09:13:57 ----A---- C:\WINDOWS\system32\AppXApplicabilityBlob.dll
2018-08-16 09:13:56 ----A---- C:\WINDOWS\SYSWOW64\winshfhc.dll
2018-08-16 09:13:56 ----A---- C:\WINDOWS\SYSWOW64\Search.ProtocolHandler.MAPI2.dll
2018-08-16 09:13:56 ----A---- C:\WINDOWS\SYSWOW64\MSPhotography.dll
2018-08-16 09:13:56 ----A---- C:\WINDOWS\SYSWOW64\Chakradiag.dll
2018-08-16 09:13:56 ----A---- C:\WINDOWS\system32\winshfhc.dll
2018-08-16 09:13:56 ----A---- C:\WINDOWS\system32\mssprxy.dll
2018-08-16 09:13:56 ----A---- C:\WINDOWS\system32\Chakradiag.dll
2018-08-16 09:13:56 ----A---- C:\WINDOWS\system32\drivers\vmgid.sys
2018-08-16 09:13:56 ----A---- C:\WINDOWS\system32\atmlib.dll
2018-07-29 21:07:36 ----A---- C:\WINDOWS\system32\Hydrogen.dll
2018-07-29 21:07:25 ----A---- C:\WINDOWS\system32\HologramCompositor.dll
2018-07-29 21:07:19 ----A---- C:\WINDOWS\system32\mos.dll
2018-07-29 21:07:18 ----A---- C:\WINDOWS\system32\msmpeg2vdec.dll
2018-07-29 21:07:18 ----A---- C:\WINDOWS\system32\ieframe.dll
2018-07-29 21:07:17 ----A---- C:\WINDOWS\SYSWOW64\msmpeg2vdec.dll
2018-07-29 21:07:17 ----A---- C:\WINDOWS\system32\twinui.pcshell.dll
2018-07-29 21:07:17 ----A---- C:\WINDOWS\system32\twinui.dll
2018-07-29 21:07:16 ----A---- C:\WINDOWS\system32\Windows.UI.Xaml.Controls.dll
2018-07-29 21:07:16 ----A---- C:\WINDOWS\system32\Windows.Media.dll
2018-07-29 21:07:16 ----A---- C:\WINDOWS\system32\mfnetcore.dll
2018-07-29 21:07:15 ----A---- C:\WINDOWS\SYSWOW64\mfnetcore.dll
2018-07-29 21:07:15 ----A---- C:\WINDOWS\SYSWOW64\ieframe.dll
2018-07-29 21:07:15 ----A---- C:\WINDOWS\system32\NetworkMobileSettings.dll
2018-07-29 21:07:14 ----A---- C:\WINDOWS\SYSWOW64\Windows.Media.dll
2018-07-29 21:07:12 ----A---- C:\WINDOWS\SYSWOW64\twinui.dll
2018-07-29 21:07:12 ----A---- C:\WINDOWS\SYSWOW64\mos.dll
2018-07-29 21:07:12 ----A---- C:\WINDOWS\system32\Windows.CloudStore.dll
2018-07-29 21:07:12 ----A---- C:\WINDOWS\system32\MFMediaEngine.dll
2018-07-29 21:07:11 ----A---- C:\WINDOWS\system32\InputService.dll
2018-07-29 21:07:10 ----A---- C:\WINDOWS\system32\dosvc.dll
2018-07-29 21:07:10 ----A---- C:\WINDOWS\system32\BingMaps.dll
2018-07-29 21:07:09 ----A---- C:\WINDOWS\system32\WebRuntimeManager.dll
2018-07-29 21:07:09 ----A---- C:\WINDOWS\system32\mstscax.dll
2018-07-29 21:07:09 ----A---- C:\WINDOWS\system32\dwmcore.dll
2018-07-29 21:07:09 ----A---- C:\WINDOWS\system32\drivers\ntfs.sys
2018-07-29 21:07:08 ----A---- C:\WINDOWS\system32\wuaueng.dll
2018-07-29 21:07:08 ----A---- C:\WINDOWS\system32\urlmon.dll
2018-07-29 21:07:06 ----A---- C:\WINDOWS\system32\msctf.dll
2018-07-29 21:07:05 ----A---- C:\WINDOWS\SYSWOW64\dwmcore.dll
2018-07-29 21:07:05 ----A---- C:\WINDOWS\system32\enterprisecsps.dll
2018-07-29 21:07:05 ----A---- C:\WINDOWS\system32\cdprt.dll
2018-07-29 21:06:51 ----A---- C:\WINDOWS\SYSWOW64\urlmon.dll
2018-07-29 21:06:50 ----A---- C:\WINDOWS\SYSWOW64\MFMediaEngine.dll
2018-07-29 21:06:50 ----A---- C:\WINDOWS\system32\BingOnlineServices.dll
2018-07-29 21:06:48 ----A---- C:\WINDOWS\system32\WFDSConMgrSvc.dll
2018-07-29 21:06:48 ----A---- C:\WINDOWS\system32\ucrtbase.dll
2018-07-29 21:06:48 ----A---- C:\WINDOWS\system32\TextInputFramework.dll
2018-07-29 21:06:48 ----A---- C:\WINDOWS\system32\LicenseManager.dll
2018-07-29 21:06:47 ----A---- C:\WINDOWS\SYSWOW64\ucrtbase.dll
2018-07-29 21:06:47 ----A---- C:\WINDOWS\SYSWOW64\msctf.dll
2018-07-29 21:06:46 ----A---- C:\WINDOWS\system32\wsp_fs.dll
2018-07-29 21:06:46 ----A---- C:\WINDOWS\system32\wcmsvc.dll
2018-07-29 21:06:46 ----A---- C:\WINDOWS\system32\mfplat.dll
2018-07-29 21:06:45 ----A---- C:\WINDOWS\SYSWOW64\TextInputFramework.dll
2018-07-29 21:06:45 ----A---- C:\WINDOWS\SYSWOW64\mfmp4srcsnk.dll
2018-07-29 21:06:45 ----A---- C:\WINDOWS\system32\mfmp4srcsnk.dll
2018-07-29 21:06:45 ----A---- C:\WINDOWS\system32\MapRouter.dll
2018-07-29 21:06:45 ----A---- C:\WINDOWS\system32\MapGeocoder.dll
2018-07-29 21:06:44 ----A---- C:\WINDOWS\system32\wsp_health.dll
2018-07-29 21:06:44 ----A---- C:\WINDOWS\system32\Windows.Networking.Vpn.dll
2018-07-29 21:06:44 ----A---- C:\WINDOWS\system32\lpasvc.dll
2018-07-29 21:06:44 ----A---- C:\WINDOWS\system32\localspl.dll
2018-07-29 21:06:43 ----A---- C:\WINDOWS\SYSWOW64\mfplat.dll
2018-07-29 21:06:43 ----A---- C:\WINDOWS\SYSWOW64\InputService.dll
2018-07-29 21:06:43 ----A---- C:\WINDOWS\system32\NMAA.dll
2018-07-29 21:06:42 ----A---- C:\WINDOWS\SYSWOW64\mstscax.dll
2018-07-29 21:06:42 ----A---- C:\WINDOWS\SYSWOW64\BingMaps.dll
2018-07-29 21:06:42 ----A---- C:\WINDOWS\system32\SecurityHealthService.exe
2018-07-29 21:06:42 ----A---- C:\WINDOWS\system32\policymanager.dll
2018-07-29 21:06:42 ----A---- C:\WINDOWS\system32\MapControlCore.dll
2018-07-29 21:06:42 ----A---- C:\WINDOWS\system32\daxexec.dll
2018-07-29 21:06:41 ----A---- C:\WINDOWS\system32\WWAHost.exe
2018-07-29 21:06:41 ----A---- C:\WINDOWS\system32\MapsStore.dll
2018-07-29 21:06:40 ----A---- C:\WINDOWS\SYSWOW64\MapRouter.dll
2018-07-29 21:06:40 ----A---- C:\WINDOWS\SYSWOW64\LicenseManager.dll
2018-07-29 21:06:40 ----A---- C:\WINDOWS\SYSWOW64\BingOnlineServices.dll
2018-07-29 21:06:40 ----A---- C:\WINDOWS\system32\netprofmsvc.dll
2018-07-29 21:06:40 ----A---- C:\WINDOWS\system32\cloudAP.dll
2018-07-29 21:06:40 ----A---- C:\WINDOWS\system32\ActiveSyncProvider.dll
2018-07-29 21:06:39 ----A---- C:\WINDOWS\system32\ucrtbase_enclave.dll
2018-07-29 21:06:39 ----A---- C:\WINDOWS\system32\PCPKsp.dll
2018-07-29 21:06:39 ----A---- C:\WINDOWS\system32\MusUpdateHandlers.dll
2018-07-29 21:06:38 ----A---- C:\WINDOWS\SYSWOW64\WWAHost.exe
2018-07-29 21:06:38 ----A---- C:\WINDOWS\system32\provops.dll
2018-07-29 21:06:38 ----A---- C:\WINDOWS\system32\provengine.dll
2018-07-29 21:06:38 ----A---- C:\WINDOWS\system32\clusapi.dll
2018-07-29 21:06:38 ----A---- C:\WINDOWS\system32\ci.dll
2018-07-29 21:06:37 ----A---- C:\WINDOWS\SYSWOW64\wsp_health.dll
2018-07-29 21:06:37 ----A---- C:\WINDOWS\SYSWOW64\rdpserverbase.dll
2018-07-29 21:06:37 ----A---- C:\WINDOWS\SYSWOW64\policymanager.dll
2018-07-29 21:06:37 ----A---- C:\WINDOWS\system32\rdpserverbase.dll
2018-07-29 21:06:36 ----A---- C:\WINDOWS\SYSWOW64\wsp_fs.dll
2018-07-29 21:06:36 ----A---- C:\WINDOWS\SYSWOW64\Windows.Networking.Vpn.dll
2018-07-29 21:06:36 ----A---- C:\WINDOWS\SYSWOW64\ActiveSyncProvider.dll
2018-07-29 21:06:36 ----A---- C:\WINDOWS\system32\rdpcorets.dll
2018-07-29 21:06:35 ----A---- C:\WINDOWS\SYSWOW64\rsaenh.dll
2018-07-29 21:06:35 ----A---- C:\WINDOWS\SYSWOW64\MapGeocoder.dll
2018-07-29 21:06:35 ----A---- C:\WINDOWS\SYSWOW64\daxexec.dll
2018-07-29 21:06:35 ----A---- C:\WINDOWS\system32\rsaenh.dll
2018-07-29 21:06:35 ----A---- C:\WINDOWS\system32\resutils.dll
2018-07-29 21:06:35 ----A---- C:\WINDOWS\system32\profsvc.dll
2018-07-29 21:06:35 ----A---- C:\WINDOWS\system32\MapConfiguration.dll
2018-07-29 21:06:34 ----A---- C:\WINDOWS\SYSWOW64\NMAA.dll
2018-07-29 21:06:34 ----A---- C:\WINDOWS\system32\Windows.UI.XamlHost.dll
2018-07-29 21:06:34 ----A---- C:\WINDOWS\system32\WiFiDisplay.dll
2018-07-29 21:06:34 ----A---- C:\WINDOWS\system32\sysmain.dll
2018-07-29 21:06:34 ----A---- C:\WINDOWS\system32\PushToInstall.dll
2018-07-29 21:06:34 ----A---- C:\WINDOWS\system32\MSVPXENC.dll
2018-07-29 21:06:34 ----A---- C:\WINDOWS\system32\drivers\tpm.sys
2018-07-29 21:06:34 ----A---- C:\WINDOWS\system32\defragsvc.dll
2018-07-29 21:06:34 ----A---- C:\WINDOWS\system32\datamarketsvc.dll
2018-07-29 21:06:33 ----A---- C:\WINDOWS\SYSWOW64\rdpencom.dll
2018-07-29 21:06:33 ----A---- C:\WINDOWS\system32\services.exe
2018-07-29 21:06:33 ----A---- C:\WINDOWS\system32\drivers\fastfat.sys
2018-07-29 21:06:32 ----A---- C:\WINDOWS\SYSWOW64\MSVPXENC.dll
2018-07-29 21:06:32 ----A---- C:\WINDOWS\system32\rdpencom.dll
2018-07-29 21:06:31 ----A---- C:\WINDOWS\SYSWOW64\Windows.UI.XamlHost.dll
2018-07-29 21:06:31 ----A---- C:\WINDOWS\SYSWOW64\dmenrollengine.dll
2018-07-29 21:06:31 ----A---- C:\WINDOWS\SYSWOW64\cdprt.dll
2018-07-29 21:06:31 ----A---- C:\WINDOWS\system32\ProvSysprep.dll
2018-07-29 21:06:31 ----A---- C:\WINDOWS\system32\drivers\pci.sys
2018-07-29 21:06:31 ----A---- C:\WINDOWS\system32\dmenrollengine.dll
2018-07-29 21:06:30 ----A---- C:\WINDOWS\SYSWOW64\PCPKsp.dll
2018-07-29 21:06:30 ----A---- C:\WINDOWS\system32\wuuhext.dll
2018-07-29 21:06:30 ----A---- C:\WINDOWS\system32\Windows.UI.Core.TextInput.dll
2018-07-29 21:06:30 ----A---- C:\WINDOWS\system32\rdpudd.dll
2018-07-29 21:06:30 ----A---- C:\WINDOWS\system32\RasMediaManager.dll
2018-07-29 21:06:30 ----A---- C:\WINDOWS\system32\drivers\exfat.sys
2018-07-29 21:06:29 ----A---- C:\WINDOWS\SYSWOW64\Windows.UI.Xaml.Controls.dll
2018-07-29 21:06:29 ----A---- C:\WINDOWS\SYSWOW64\WiFiDisplay.dll
2018-07-29 21:06:29 ----A---- C:\WINDOWS\SYSWOW64\dhcpcore.dll
2018-07-29 21:06:29 ----A---- C:\WINDOWS\SYSWOW64\clusapi.dll
2018-07-29 21:06:29 ----A---- C:\WINDOWS\system32\rasmans.dll
2018-07-29 21:06:29 ----A---- C:\WINDOWS\system32\raschap.dll
2018-07-29 21:06:29 ----A---- C:\WINDOWS\system32\provisioningcsp.dll
2018-07-29 21:06:29 ----A---- C:\WINDOWS\system32\EASPolicyManagerBrokerHost.exe
2018-07-29 21:06:29 ----A---- C:\WINDOWS\system32\drivers\appid.sys
2018-07-29 21:06:28 ----A---- C:\WINDOWS\SYSWOW64\resutils.dll
2018-07-29 21:06:28 ----A---- C:\WINDOWS\SYSWOW64\raschap.dll
2018-07-29 21:06:28 ----A---- C:\WINDOWS\system32\mdmregistration.dll
2018-07-29 21:06:28 ----A---- C:\WINDOWS\system32\mcbuilder.exe
2018-07-29 21:06:28 ----A---- C:\WINDOWS\system32\drivers\cldflt.sys
2018-07-29 21:06:28 ----A---- C:\WINDOWS\system32\dhcpcore.dll
2018-07-29 21:06:27 ----A---- C:\WINDOWS\SYSWOW64\UserDataTimeUtil.dll
2018-07-29 21:06:27 ----A---- C:\WINDOWS\SYSWOW64\MapConfiguration.dll
2018-07-29 21:06:27 ----A---- C:\WINDOWS\system32\UserDataTimeUtil.dll
2018-07-29 21:06:27 ----A---- C:\WINDOWS\system32\EasPolicyManagerBrokerPS.dll
2018-07-29 21:06:26 ----A---- C:\WINDOWS\SYSWOW64\mcbuilder.exe
2018-07-29 21:06:26 ----A---- C:\WINDOWS\SYSWOW64\MapControlCore.dll
2018-07-29 21:06:26 ----A---- C:\WINDOWS\system32\OneCoreCommonProxyStub.dll
2018-07-29 21:06:26 ----A---- C:\WINDOWS\system32\drivers\winnat.sys
2018-07-29 21:06:25 ----A---- C:\WINDOWS\SYSWOW64\Windows.UI.Core.TextInput.dll
2018-07-29 21:06:25 ----A---- C:\WINDOWS\SYSWOW64\tzres.dll
2018-07-29 21:06:25 ----A---- C:\WINDOWS\SYSWOW64\OneCoreCommonProxyStub.dll
2018-07-29 21:06:25 ----A---- C:\WINDOWS\SYSWOW64\mdmregistration.dll
2018-07-29 21:06:25 ----A---- C:\WINDOWS\SYSWOW64\enrollmentapi.dll
2018-07-29 21:06:25 ----A---- C:\WINDOWS\system32\WFDSConMgr.dll
2018-07-29 21:06:25 ----A---- C:\WINDOWS\system32\tzres.dll
2018-07-29 21:06:25 ----A---- C:\WINDOWS\system32\rascustom.dll
2018-07-29 21:06:25 ----A---- C:\WINDOWS\system32\iemigplugin.dll
2018-07-29 21:06:25 ----A---- C:\WINDOWS\system32\enrollmentapi.dll
2018-07-22 19:26:28 ----A---- C:\WINDOWS\system32\drivers\tcpip.sys

====== List of files/folders modified in the last 1 month ======

2018-08-16 11:56:01 ----D---- C:\WINDOWS\Prefetch
2018-08-16 11:56:00 ----D---- C:\WINDOWS\system32\drivers\etc
2018-08-16 11:55:59 ----RD---- C:\Program Files
2018-08-16 11:55:35 ----D---- C:\WINDOWS\Temp
2018-08-16 11:52:11 ----D---- C:\WINDOWS\System32
2018-08-16 11:52:11 ----D---- C:\WINDOWS\INF
2018-08-16 11:52:11 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2018-08-16 11:46:31 ----D---- C:\ProgramData\regid.1991-06.com.microsoft
2018-08-16 11:44:50 ----D---- C:\WINDOWS\system32\sru
2018-08-16 11:44:48 ----D---- C:\WINDOWS\system32\catroot2
2018-08-16 11:38:50 ----SHDC---- C:\WINDOWS\Installer
2018-08-16 11:38:46 ----D---- C:\WINDOWS\system32\Tasks
2018-08-16 11:38:40 ----D---- C:\WINDOWS\system32\DriverStore
2018-08-16 11:38:36 ----D---- C:\WINDOWS\system32\drivers
2018-08-16 11:38:31 ----HD---- C:\WINDOWS\ELAMBKUP
2018-08-16 11:38:28 ----D---- C:\WINDOWS\SysWOW64
2018-08-16 11:37:15 ----D---- C:\ProgramData\Comodo
2018-08-16 11:37:12 ----HD---- C:\ProgramData
2018-08-16 11:33:53 ----D---- C:\WINDOWS\system32\config
2018-08-16 11:29:08 ----AD---- C:\Program Files\Opera
2018-08-16 11:00:33 ----D---- C:\WINDOWS\system32\NDF
2018-08-16 10:58:01 ----RD---- C:\Program Files (x86)
2018-08-16 10:57:19 ----HD---- C:\Program Files (x86)\InstallShield Installation Information
2018-08-16 10:45:50 ----SHD---- C:\System Volume Information
2018-08-16 10:28:40 ----D---- C:\WINDOWS\system32\SleepStudy
2018-08-16 10:20:31 ----D---- C:\WINDOWS\LiveKernelReports
2018-08-16 10:06:43 ----RD---- C:\WINDOWS\assembly
2018-08-16 10:02:56 ----RD---- C:\WINDOWS\Microsoft.NET
2018-08-16 09:59:07 ----D---- C:\WINDOWS\WinSxS
2018-08-16 09:56:28 ----D---- C:\WINDOWS\system32\WDI
2018-08-16 09:55:46 ----SD---- C:\WINDOWS\SYSWOW64\F12
2018-08-16 09:55:46 ----D---- C:\WINDOWS\TextInput
2018-08-16 09:55:46 ----D---- C:\WINDOWS\SYSWOW64\zu-ZA
2018-08-16 09:55:46 ----D---- C:\WINDOWS\SYSWOW64\yo-NG
2018-08-16 09:55:46 ----D---- C:\WINDOWS\SYSWOW64\xh-ZA
2018-08-16 09:55:46 ----D---- C:\WINDOWS\SYSWOW64\wo-SN
2018-08-16 09:55:46 ----D---- C:\WINDOWS\SYSWOW64\uz-Latn-UZ
2018-08-16 09:55:46 ----D---- C:\WINDOWS\SYSWOW64\tn-ZA
2018-08-16 09:55:46 ----D---- C:\WINDOWS\SYSWOW64\ti-ET
2018-08-16 09:55:46 ----D---- C:\WINDOWS\SYSWOW64\tg-Cyrl-TJ
2018-08-16 09:55:46 ----D---- C:\WINDOWS\SYSWOW64\sr-Cyrl-RS
2018-08-16 09:55:46 ----D---- C:\WINDOWS\SYSWOW64\sr-Cyrl-BA
2018-08-16 09:55:46 ----D---- C:\WINDOWS\SYSWOW64\sd-Arab-PK
2018-08-16 09:55:46 ----D---- C:\WINDOWS\SYSWOW64\rw-RW
2018-08-16 09:55:46 ----D---- C:\WINDOWS\SYSWOW64\quc-Latn-GT
2018-08-16 09:55:46 ----D---- C:\WINDOWS\SYSWOW64\pa-Arab-PK
2018-08-16 09:55:46 ----D---- C:\WINDOWS\SYSWOW64\nso-ZA
2018-08-16 09:55:46 ----D---- C:\WINDOWS\SYSWOW64\ku-Arab-IQ
2018-08-16 09:55:46 ----D---- C:\WINDOWS\SYSWOW64\ig-NG
2018-08-16 09:55:46 ----D---- C:\WINDOWS\SYSWOW64\chr-CHER-US
2018-08-16 09:55:46 ----D---- C:\WINDOWS\SYSWOW64\ha-Latn-NG
2018-08-16 09:55:46 ----D---- C:\WINDOWS\SYSWOW64\en-US
2018-08-16 09:55:46 ----D---- C:\WINDOWS\SYSWOW64\ca-ES-valencia
2018-08-16 09:55:46 ----D---- C:\WINDOWS\SYSWOW64\bs-Latn-BA
2018-08-16 09:55:46 ----D---- C:\WINDOWS\SYSWOW64\az-Latn-AZ
2018-08-16 09:55:45 ----D---- C:\WINDOWS\system32\zu-ZA
2018-08-16 09:55:44 ----SD---- C:\WINDOWS\system32\F12
2018-08-16 09:55:44 ----SD---- C:\WINDOWS\system32\DiagSvcs
2018-08-16 09:55:44 ----D---- C:\WINDOWS\system32\yo-NG
2018-08-16 09:55:44 ----D---- C:\WINDOWS\system32\xh-ZA
2018-08-16 09:55:44 ----D---- C:\WINDOWS\system32\wo-SN
2018-08-16 09:55:44 ----D---- C:\WINDOWS\system32\uz-Latn-UZ
2018-08-16 09:55:44 ----D---- C:\WINDOWS\system32\tn-ZA
2018-08-16 09:55:44 ----D---- C:\WINDOWS\system32\ti-ET
2018-08-16 09:55:44 ----D---- C:\WINDOWS\system32\tg-Cyrl-TJ
2018-08-16 09:55:44 ----D---- C:\WINDOWS\system32\sr-Cyrl-RS
2018-08-16 09:55:44 ----D---- C:\WINDOWS\system32\sr-Cyrl-BA
2018-08-16 09:55:44 ----D---- C:\WINDOWS\system32\sd-Arab-PK
2018-08-16 09:55:44 ----D---- C:\WINDOWS\system32\rw-RW
2018-08-16 09:55:44 ----D---- C:\WINDOWS\system32\quc-Latn-GT
2018-08-16 09:55:44 ----D---- C:\WINDOWS\system32\pa-Arab-PK
2018-08-16 09:55:44 ----D---- C:\WINDOWS\system32\nso-ZA
2018-08-16 09:55:44 ----D---- C:\WINDOWS\system32\migration
2018-08-16 09:55:44 ----D---- C:\WINDOWS\system32\ku-Arab-IQ
2018-08-16 09:55:44 ----D---- C:\WINDOWS\system32\ig-NG
2018-08-16 09:55:44 ----D---- C:\WINDOWS\system32\chr-CHER-US
2018-08-16 09:55:44 ----D---- C:\WINDOWS\system32\ha-Latn-NG
2018-08-16 09:55:44 ----D---- C:\WINDOWS\system32\en-US
2018-08-16 09:55:44 ----D---- C:\WINDOWS\system32\drivers\en-US
2018-08-16 09:55:44 ----D---- C:\WINDOWS\system32\ca-ES-valencia
2018-08-16 09:55:44 ----D---- C:\WINDOWS\system32\bs-Latn-BA
2018-08-16 09:55:44 ----D---- C:\WINDOWS\system32\Boot
2018-08-16 09:55:44 ----D---- C:\WINDOWS\system32\az-Latn-AZ
2018-08-16 09:55:41 ----D---- C:\WINDOWS\ShellExperiences
2018-08-16 09:55:40 ----RD---- C:\Program Files\Windows Defender
2018-08-16 09:55:40 ----D---- C:\WINDOWS\bcastdvr
2018-08-16 09:55:40 ----D---- C:\Program Files (x86)\Windows Defender
2018-08-16 09:49:21 ----D---- C:\Windows
2018-08-16 09:30:01 ----D---- C:\WINDOWS\system32\MRT
2018-08-16 09:21:39 ----D---- C:\WINDOWS\debug
2018-08-16 09:21:33 ----AC---- C:\WINDOWS\system32\MRT.exe
2018-08-16 09:21:25 ----D---- C:\WINDOWS\CbsTemp
2018-08-16 09:06:11 ----D---- C:\WINDOWS\Logs
2018-08-15 12:56:40 ----D---- C:\WINDOWS\AppReadiness
2018-08-15 11:54:37 ----HD---- C:\Program Files\WindowsApps
2018-08-15 11:51:34 ----D---- C:\Program Files (x86)\Internet Explorer
2018-08-15 10:32:41 ----D---- C:\ProgramData\CanonIJPLM
2018-08-14 09:49:52 ----D---- C:\WINDOWS\system32\LogFiles
2018-08-09 20:07:26 ----AD---- C:\Program Files (x86)\KMPlayer
2018-08-06 17:19:36 ----A---- C:\WINDOWS\SYSWOW64\FlashPlayerApp.exe
2018-08-06 14:02:13 ----D---- C:\WINDOWS\SoftwareDistribution
2018-08-05 20:50:16 ----D---- C:\Program Files (x86)\Java
2018-08-04 11:56:53 ----D---- C:\Program Files (x86)\SpeedFan
2018-08-01 19:01:27 ----D---- C:\Program Files (x86)\Common Files
2018-08-01 19:00:11 ----A---- C:\WINDOWS\SYSWOW64\WindowsAccessBridge-32.dll
2018-07-31 21:37:29 ----D---- C:\ProgramData\Packages
2018-07-29 21:32:50 ----D---- C:\WINDOWS\SYSWOW64\sk-SK
2018-07-29 21:32:50 ----D---- C:\WINDOWS\SYSWOW64\migration
2018-07-29 21:32:49 ----SD---- C:\WINDOWS\system32\UNP
2018-07-29 21:32:49 ----D---- C:\WINDOWS\system32\sk-SK
2018-07-29 21:32:49 ----D---- C:\WINDOWS\system32\ShellExperiences
2018-07-29 21:32:47 ----RD---- C:\WINDOWS\PrintDialog
2018-07-22 16:43:25 ----D---- C:\WINDOWS\system32\FxsTmp

File C:\WINDOWS\system32\winlogon.exe is digitally signed
File C:\WINDOWS\system32\wininit.exe is digitally signed
File C:\WINDOWS\explorer.exe is digitally signed
File C:\WINDOWS\SysWOW64\explorer.exe is digitally signed
File C:\WINDOWS\system32\svchost.exe is digitally signed
File C:\WINDOWS\SysWOW64\svchost.exe is digitally signed
File C:\WINDOWS\system32\services.exe is digitally signed
File C:\WINDOWS\system32\User32.dll is digitally signed
File C:\WINDOWS\SysWOW64\User32.dll is digitally signed
File C:\WINDOWS\system32\userinit.exe is digitally signed
File C:\WINDOWS\SysWOW64\userinit.exe is digitally signed
File C:\WINDOWS\system32\rpcss.dll is digitally signed
File C:\WINDOWS\system32\Drivers\volsnap.sys is digitally signed

====== List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled) ======

R0 amd_sata;amd_sata; C:\WINDOWS\System32\drivers\amd_sata.sys [2014-03-21 81608]
R0 amd_xata;amd_xata; C:\WINDOWS\System32\drivers\amd_xata.sys [2014-03-21 23752]
R0 aswbidsh;aswbidsh; C:\WINDOWS\system32\drivers\aswbidsha.sys [2018-06-20 201328]
R0 aswblog;aswblog; C:\WINDOWS\system32\drivers\aswbloga.sys [2018-06-20 346664]
R0 aswbuniv;aswbuniv; C:\WINDOWS\system32\drivers\aswbuniva.sys [2018-06-20 59592]
R0 aswRvrt;aswRvrt; C:\WINDOWS\system32\drivers\aswRvrt.sys [2018-06-20 85968]
R0 aswVmm;aswVmm; C:\WINDOWS\system32\drivers\aswVmm.sys [2018-06-20 381584]
R0 iorate;@%SystemRoot%\system32\drivers\iorate.sys,-101; C:\WINDOWS\system32\drivers\iorate.sys [2018-04-12 58272]
R0 SgrmAgent;@%SystemRoot%\System32\Drivers\SgrmAgent.sys,-1001; C:\WINDOWS\system32\drivers\SgrmAgent.sys [2018-04-12 63896]
R1 afunix;afunix; C:\WINDOWS\system32\drivers\afunix.sys [2018-04-12 39424]
R1 AsIO;AsIO; C:\WINDOWS\SysWow64\drivers\AsIO.sys [2014-12-28 15232]
R1 AsUpIO;AsUpIO; C:\WINDOWS\SysWow64\drivers\AsUpIO.sys [2010-08-03 14464]
R1 aswArPot;aswArPot; C:\WINDOWS\system32\drivers\aswArPot.sys [2018-06-20 197160]
R1 aswbidsdriver;aswbidsdriver; C:\WINDOWS\system32\drivers\aswbidsdrivera.sys [2018-06-20 229392]
R1 aswHdsKe;aswHdsKe; C:\WINDOWS\system32\drivers\aswHdsKe.sys [2018-06-20 239680]
R1 aswRdr;aswRdr; C:\WINDOWS\system32\drivers\aswRdr2.sys [2018-06-20 111872]
R1 aswSnx;aswSnx; C:\WINDOWS\system32\drivers\aswSnx.sys [2018-06-20 1027728]
R1 aswSP;aswSP; C:\WINDOWS\system32\drivers\aswSP.sys [2018-07-23 467064]
R1 bam;@%SystemRoot%\system32\drivers\bam.sys,-100; C:\WINDOWS\system32\drivers\bam.sys [2018-04-12 60320]
R1 cmderd;COMODO Internet Security Eradication Driver; C:\WINDOWS\System32\DRIVERS\cmderd.sys [2018-05-23 44056]
R1 cmdGuard;COMODO Internet Security Sandbox Driver; C:\WINDOWS\system32\DRIVERS\cmdguard.sys [2018-05-23 832032]
R1 cmdhlp;COMODO Internet Security Helper Driver; C:\WINDOWS\system32\DRIVERS\cmdhlp.sys [2018-05-23 50768]
R1 inspect;@oem14.inf,%inspect_Desc%;COMODO Internet Security Firewall Driver; C:\WINDOWS\system32\DRIVERS\inspect.sys [2018-05-23 134400]
R1 ndisrd;@oem35.inf,%ndisrd_Desc%;WinpkFilter LightWeight Filter; C:\WINDOWS\system32\DRIVERS\ndisrd.sys [2014-12-28 32840]
R2 AODDriver4.3;AODDriver4.3; \??\C:\Program Files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys [2014-02-11 59616]
R2 APXACC;@oem12.inf,%APPEX_ACC_SERVICE_NAME%;AppEx Networks Accelerator LWF; C:\WINDOWS\system32\DRIVERS\appexDrv.sys [2015-04-03 229056]
R2 aswMonFlt;aswMonFlt; C:\WINDOWS\system32\drivers\aswMonFlt.sys [2018-06-20 159640]
R2 aswStm;aswStm; C:\WINDOWS\system32\drivers\aswStm.sys [2018-06-20 211160]
R2 CldFlt;Windows Cloud Files Filter Driver; C:\WINDOWS\system32\drivers\cldflt.sys [2018-07-14 414720]
R2 RtNdPt60;@oem15.inf,%NDISPROT_Desc%;Realtek NDIS Protocol Driver; C:\WINDOWS\system32\DRIVERS\RtNdPt60.sys [2011-06-15 32544]
R3 amdkmdag;amdkmdag; C:\WINDOWS\system32\DRIVERS\atikmdag.sys [2016-09-04 21648880]
R3 amdkmdap;amdkmdap; C:\WINDOWS\system32\DRIVERS\atikmpag.sys [2016-09-04 674288]
R3 AtiHDAudioService;@oem9.inf,%ATIHdAudioDriver.SvcDesc%;AMD Function Driver for HD Audio Service; C:\WINDOWS\system32\drivers\AtihdWT6.sys [2017-11-07 111112]
R3 GEARAspiWDM;GEAR ASPI Filter Driver; C:\WINDOWS\system32\DRIVERS\GEARAspiWDM.sys [2012-08-21 33240]
R3 rt640x64;@oem23.inf,%rt640.Service.DispName%;Realtek RT640 NT Driver; C:\WINDOWS\System32\drivers\rt640x64.sys [2016-02-16 888064]
S0 amdkmafd;@oem8.inf,%AMDKMAFD_svcdesc%;AMD Audio Bus Lower Filter; C:\WINDOWS\System32\drivers\amdkmafd.sys [2016-09-04 31992]
S0 bttflt;@virtdisk.inf,%service_desc%;Microsoft Hyper-V VHDPMEM BTT Filter; C:\WINDOWS\System32\drivers\bttflt.sys [2018-04-12 38304]
S0 cmdboot;COMODO Early Launch Driver; C:\WINDOWS\System32\DRIVERS\cmdboot.sys [2018-05-23 17944]
S0 cht4iscsi;cht4iscsi; C:\WINDOWS\System32\drivers\cht4sx64.sys [2018-04-12 321432]
S0 iaStorAVC;@iastorav.inf,%iaStorAVC.DeviceDesc%;Intel Chipset SATA RAID Controller; C:\WINDOWS\System32\drivers\iaStorAVC.sys [2018-04-12 885144]
S0 ItSas35i;ItSas35i; C:\WINDOWS\System32\drivers\ItSas35i.sys [2018-04-12 145816]
S0 megasas2i;megasas2i; C:\WINDOWS\System32\drivers\MegaSas2i.sys [2018-04-12 75160]
S0 megasas35i;megasas35i; C:\WINDOWS\System32\drivers\megasas35i.sys [2018-04-12 82328]
S0 Ramdisk;Windows RAM Disk Driver; C:\WINDOWS\system32\DRIVERS\ramdisk.sys [2018-04-12 39840]
S0 scmbus;@scmbus.inf,%scmbus.SvcDesc%;Microsoft Storage Class Memory Bus Driver; C:\WINDOWS\System32\drivers\scmbus.sys [2018-08-03 128920]
S2 AODDriver4.2.0;AODDriver4.2.0; \??\C:\Program Files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys [2014-02-11 59616]
S3 AcpiDev;@acpidev.inf,%AcpiDev.SvcDesc%;ACPI Devices driver; C:\WINDOWS\System32\drivers\AcpiDev.sys [2018-04-12 20480]
S3 AiCharger;AiCharger; C:\WINDOWS\SysWow64\drivers\AiCharger.sys [2014-12-30 14848]
S3 applockerfltr;@%systemroot%\system32\srpapi.dll,-102; C:\WINDOWS\system32\drivers\applockerfltr.sys [2018-04-12 18432]
S3 aswElam;aswElam; C:\WINDOWS\system32\drivers\aswElam.sys [2018-06-20 15360]
S3 aswHwid;aswHwid; C:\WINDOWS\system32\drivers\aswHwid.sys [2018-06-20 46976]
S3 bindflt;@%systemroot%\system32\drivers\bindflt.sys,-100; C:\WINDOWS\system32\drivers\bindflt.sys [2018-04-12 92056]
S3 CAD;@ChargeArbitration.inf,%CAD_DevDesc%;Charge Arbitration Driver; C:\WINDOWS\System32\drivers\CAD.sys [2018-04-12 60320]
S3 dg_ssudbus;@oem22.inf,%ssud.Service.DeviceDesc%;SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.); C:\WINDOWS\system32\DRIVERS\ssudbus.sys [2017-05-18 131984]
S3 hvservice;@%SystemRoot%\system32\drivers\hvservice.sys,-16; C:\WINDOWS\system32\drivers\hvservice.sys [2018-08-03 77608]
S3 HwNClx0101;Microsoft Hardware Notifications Class Extension Driver; C:\WINDOWS\System32\Drivers\mshwnclx.sys [2018-04-12 27136]
S3 HyperVideo;HyperVideo; C:\WINDOWS\System32\drivers\HyperVideo.sys [2018-04-12 28672]
S3 cht4vbd;@cht4vx64.inf,%cht4vbd.generic%;Chelsio Virtual Bus Driver; C:\WINDOWS\System32\drivers\cht4vx64.sys [2018-04-12 1836952]
S3 iagpio;@iagpio.inf,%iagpio.SVCDESC%;Intel Serial IO GPIO Controller Driver; C:\WINDOWS\System32\drivers\iagpio.sys [2018-04-12 36864]
S3 iaLPSS2i_GPIO2;@iaLPSS2i_GPIO2_SKL.inf,%iaLPSS2i_GPIO2.SVCDESC%;Intel(R) Serial IO GPIO Driver v2; C:\WINDOWS\System32\drivers\iaLPSS2i_GPIO2.sys [2018-04-12 79360]
S3 iaLPSS2i_GPIO2_BXT_P;@iaLPSS2i_GPIO2_BXT_P.inf,%iaLPSS2i_GPIO2_BXT_P.SVCDESC%;Intel(R) Serial IO GPIO Driver v2; C:\WINDOWS\System32\drivers\iaLPSS2i_GPIO2_BXT_P.sys [2018-04-12 88576]
S3 iaLPSS2i_I2C_BXT_P;@iaLPSS2i_I2C_BXT_P.inf,%iaLPSS2i_I2C_BXT_P.SVCDESC%;Intel(R) Serial IO I2C Driver v2; C:\WINDOWS\System32\drivers\iaLPSS2i_I2C_BXT_P.sys [2018-04-12 174592]
S3 IndirectKmd;@%SystemRoot%\system32\drivers\IndirectKmd.sys,-100; C:\WINDOWS\System32\drivers\IndirectKmd.sys [2018-04-12 38912]
S3 IPT;IPT; C:\WINDOWS\System32\drivers\ipt.sys [2018-04-12 32256]
S3 irda;IrDA; C:\WINDOWS\system32\drivers\irda.sys [2018-04-12 119808]
S3 mausbhost;@mausbhost.inf,%MAUSBHost.ServiceName%;MA-USB Host Controller Driver; C:\WINDOWS\System32\drivers\mausbhost.sys [2018-04-12 505240]
S3 mausbip;@mausbhost.inf,%MAUSBIP.ServiceName%;MA-USB IP Filter Driver; C:\WINDOWS\System32\drivers\mausbip.sys [2018-04-12 56736]
S3 NetAdapterCx;Network Adapter Wdf Class Extension Library; C:\WINDOWS\system32\drivers\NetAdapterCx.sys [2018-04-12 175104]
S3 netvsc;netvsc; C:\WINDOWS\System32\drivers\netvsc.sys [2018-04-12 197632]
S3 nvdimm;@nvdimm.inf,%nvdimm.SvcDesc%;Microsoft NVDIMM device driver; C:\WINDOWS\System32\drivers\nvdimm.sys [2018-04-12 104448]
S3 pmem;@pmem.inf,%pmem.SvcDesc%;Microsoft persistent memory disk driver; C:\WINDOWS\System32\drivers\pmem.sys [2018-04-12 105984]
S3 PNPMEM;@memory.inf,%PNPMEM.SvcDesc%;Microsoft Memory Module Driver; C:\WINDOWS\System32\drivers\pnpmem.sys [2018-04-12 16896]
S3 ReFS;ReFS; C:\WINDOWS\system32\drivers\ReFS.sys [2018-06-15 1921944]
S3 rhproxy;@rhproxy.inf,%rhproxy.SVCDESC%;Resource Hub proxy driver; C:\WINDOWS\System32\drivers\rhproxy.sys [2018-04-12 104448]
S3 SDFRd;@SDFRd.inf,%SDFRd.ServiceDesc%;SDF Reflector; C:\WINDOWS\System32\drivers\SDFRd.sys [2018-04-12 33176]
S3 SpatialGraphFilter;Holographic Spatial Graph Filter; C:\WINDOWS\System32\drivers\SpatialGraphFilter.sys [2018-04-12 57752]
S4 hvcrash;hvcrash; C:\WINDOWS\System32\drivers\hvcrash.sys [2018-04-12 33184]

====== List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled) ======

R2 AMD External Events Utility;AMD External Events Utility; C:\WINDOWS\system32\atiesrxx.exe [2016-09-04 255472]
R2 AMD FUEL Service;AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [2015-11-04 351944]
R2 Apple Mobile Device Service;Apple Mobile Device Service; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [2018-07-05 83768]
R2 asComSvc;ASUS Com Service; C:\Program Files (x86)\ASUS\AXSP\1.00.19\atkexComSvc.exe [2012-06-01 920736]
R2 asHmComSvc;ASUS HM Com Service; C:\Program Files (x86)\ASUS\AAHM\1.00.20\aaHMSvc.exe [2012-06-01 951936]
R2 AsSysCtrlService;ASUS System Control Service; C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.13\AsSysCtrlService.exe [2012-02-17 149120]
R2 AsusFanControlService;AsusFanControlService; C:\Program Files (x86)\ASUS\AsusFanControlService\1.02.05\AsusFanControlService.exe [2014-12-28 2005504]
R2 avast! Antivirus;Avast Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [2018-06-20 322464]
R2 Bonjour Service;Bonjour Service; C:\Program Files\Bonjour\mDNSResponder.exe [2015-09-19 462096]
R2 CDPUserSvc_47ff0;Connected Devices Platform User Service_47ff0; C:\WINDOWS\system32\svchost.exe -k UnistackSvcGroup;"ServiceDll" =
R2 CmdAgent;COMODO Internet Security Helper Service; C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe [2018-06-18 10815296]
R2 DusmSvc;@%SystemRoot%\System32\dusmsvc.dll,-1; %SystemRoot%\System32\svchost.exe -k LocalServiceNetworkRestricted -p;"ServiceDll" = %SystemRoot%\System32\dusmsvc.dll
R2 IJPLMSVC;Canon Inkjet Printer/Scanner/Fax Extended Survey Program; C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE [2010-04-05 116104]
R2 OneSyncSvc_47ff0;Sync Host_47ff0; C:\WINDOWS\system32\svchost.exe -k UnistackSvcGroup;"ServiceDll" =
R2 PnkBstrA;PnkBstrA; C:\WINDOWS\syswow64\PnkBstrA.exe [2016-05-15 76152]
R2 SecurityHealthService;@%systemroot%\system32\SecurityHealthAgent.dll,-1002; C:\WINDOWS\system32\SecurityHealthService.exe [2018-07-14 760888]
R2 SgrmBroker;@%SystemRoot%\System32\SgrmBroker.exe,-100; C:\WINDOWS\system32\SgrmBroker.exe [2018-04-12 163336]
R3 aswbIDSAgent;aswbIDSAgent; C:\Program Files\AVAST Software\Avast\x64\aswidsagenta.exe [2018-06-20 7780400]
R3 camsvc;@%SystemRoot%\system32\CapabilityAccessManager.dll,-1; %SystemRoot%\system32\svchost.exe -k appmodel -p;"ServiceDll" = %SystemRoot%\system32\CapabilityAccessManager.dll
R3 PimIndexMaintenanceSvc_47ff0;Kontaktné údaje_47ff0; C:\WINDOWS\system32\svchost.exe -k UnistackSvcGroup;"ServiceDll" =
R3 RmSvc;@%SystemRoot%\system32\RMapi.dll,-1001; %SystemRoot%\System32\svchost.exe -k LocalServiceNetworkRestricted;"ServiceDll" = %SystemRoot%\System32\RMapi.dll
R3 SEMgrSvc;@%SystemRoot%\System32\SEMgrSvc.dll,-1001; %SystemRoot%\system32\svchost.exe -k LocalService -p;"ServiceDll" = %SystemRoot%\system32\SEMgrSvc.dll
S2 CDPUserSvc;@%SystemRoot%\system32\cdpusersvc.dll,-100; %SystemRoot%\system32\svchost.exe -k UnistackSvcGroup;"ServiceDll" = %SystemRoot%\System32\CDPUserSvc.dll
S3 BcastDVRUserService;@%SystemRoot%\system32\BcastDVRUserService.dll,-100; %SystemRoot%\system32\svchost.exe -k BcastDVRUserService;"ServiceDll" = %SystemRoot%\System32\BcastDVRUserService.dll
S3 BcastDVRUserService_47ff0;GameDVR and Broadcast User Service_47ff0; C:\WINDOWS\system32\svchost.exe -k BcastDVRUserService;"ServiceDll" =
S3 BluetoothUserService;@%SystemRoot%\system32\Microsoft.Bluetooth.UserService.dll,-101; %SystemRoot%\system32\svchost.exe -k BthAppGroup;"ServiceDll" = %SystemRoot%\System32\Microsoft.Bluetooth.UserService.dll
S3 BluetoothUserService_47ff0;Služba podpory používateľov rozhrania Bluetooth_47ff0; C:\WINDOWS\system32\svchost.exe -k BthAppGroup;"ServiceDll" =
S3 BTAGService;@%SystemRoot%\system32\BTAGService.dll,-101; %SystemRoot%\system32\svchost.exe -k LocalServiceNetworkRestricted;"ServiceDll" = %SystemRoot%\System32\BTAGService.dll
S3 BthAvctpSvc;@%SystemRoot%\system32\BthAvctpSvc.dll,-101; %SystemRoot%\system32\svchost.exe -k LocalService -p;"ServiceDll" = %SystemRoot%\System32\BthAvctpSvc.dll
S3 cmdvirth;COMODO Virtual Service Manager; C:\Program Files\COMODO\COMODO Internet Security\cmdvirth.exe [2018-06-18 2876096]
S3 DevicePickerUserSvc;@%SystemRoot%\system32\Windows.Devices.Picker.dll,-1006; %SystemRoot%\system32\svchost.exe -k DevicesFlow;"ServiceDll" = %SystemRoot%\System32\Windows.Devices.Picker.dll
S3 DevicePickerUserSvc_47ff0;DevicePicker_47ff0; C:\WINDOWS\system32\svchost.exe -k DevicesFlow;"ServiceDll" =
S3 DevicesFlowUserSvc;@%SystemRoot%\system32\DevicesFlowBroker.dll,-103; %SystemRoot%\system32\svchost.exe -k DevicesFlow;"ServiceDll" = %SystemRoot%\System32\DevicesFlowBroker.dll
S3 DevicesFlowUserSvc_47ff0;DevicesFlow_47ff0; C:\WINDOWS\system32\svchost.exe -k DevicesFlow;"ServiceDll" =
S3 diagsvc;@%systemroot%\system32\DiagSvc.dll,-100; %SystemRoot%\System32\svchost.exe -k diagnostics;"ServiceDll" = %systemroot%\system32\DiagSvc.dll
S3 FontCache3.0.0.0;@%SystemRoot%\system32\PresentationHost.exe,-3309; C:\WINDOWS\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe [2018-05-11 43648]
S3 FrameServer;@%systemroot%\system32\FrameServer.dll,-100; %SystemRoot%\System32\svchost.exe -k Camera;"ServiceDll" = %SystemRoot%\system32\FrameServer.dll
S3 GraphicsPerfSvc;@%SystemRoot%\system32\GraphicsPerfSvc.dll,-100; %SystemRoot%\System32\svchost.exe -k GraphicsPerfSvcGroup;"ServiceDll" = %SystemRoot%\System32\GraphicsPerfSvc.dll
S3 HvHost;@%SystemRoot%\system32\hvhostsvc.dll,-100; %SystemRoot%\system32\svchost.exe -k LocalSystemNetworkRestricted -p;"ServiceDll" = %SystemRoot%\System32\hvhostsvc.dll
S3 InstallService;@%SystemRoot%\system32\InstallService.dll,-200; %SystemRoot%\System32\svchost.exe -k netsvcs -p;"ServiceDll" = %SystemRoot%\system32\InstallService.dll
S3 iPod Service;iPod Service; C:\Program Files\iPod\bin\iPodService.exe [2018-07-06 674104]
S3 IpxlatCfgSvc;@%Systemroot%\system32\ipxlatcfg.dll,-500; %SystemRoot%\System32\svchost.exe -k LocalSystemNetworkRestricted -p;"ServiceDll" = %SystemRoot%\System32\IpxlatCfg.dll
S3 irmon;@%SystemRoot%\System32\irmon.dll,-2000; %SystemRoot%\system32\svchost.exe -k LocalSystemNetworkRestricted -p;"ServiceDll" = %SystemRoot%\System32\irmon.dll
S3 LxpSvc;@%SystemRoot%\system32\LanguageOverlayServer.dll,-100; %SystemRoot%\system32\svchost.exe -k netsvcs;"ServiceDll" = %SystemRoot%\System32\LanguageOverlayServer.dll
S3 MBAMService;Malwarebytes Service; C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe [2017-11-01 6234056]
S3 MessagingService_47ff0;MessagingService_47ff0; C:\WINDOWS\system32\svchost.exe -k UnistackSvcGroup;"ServiceDll" =
S3 NaturalAuthentication;@%systemroot%\system32\NaturalAuth.dll,-100; %SystemRoot%\system32\svchost.exe -k netsvcs -p;"ServiceDll" = %SystemRoot%\System32\NaturalAuth.dll
S3 PrintWorkflowUserSvc;@%SystemRoot%\system32\PrintWorkflowService.dll,-100; %SystemRoot%\system32\svchost.exe -k PrintWorkflow;"ServiceDll" = %SystemRoot%\System32\PrintWorkflowService.dll
S3 PrintWorkflowUserSvc_47ff0;PrintWorkflow_47ff0; C:\WINDOWS\system32\svchost.exe -k PrintWorkflow;"ServiceDll" =
S3 PushToInstall;@%SystemRoot%\system32\pushtoinstall.dll,-200; %SystemRoot%\System32\svchost.exe -k netsvcs -p;"ServiceDll" = %SystemRoot%\system32\PushToInstall.dll
S3 SharedRealitySvc;@%SystemRoot%\system32\SharedRealitySvc.dll,-100; %SystemRoot%\system32\svchost.exe -k LocalService -p;"ServiceDll" = %SystemRoot%\System32\SharedRealitySvc.dll
S3 spectrum;@%systemroot%\system32\spectrum.exe,-101; C:\WINDOWS\system32\spectrum.exe [2018-06-08 976384]
S4 shpamsvc;@%SystemRoot%\System32\Windows.SharedPC.AccountManager.dll,-100; %SystemRoot%\System32\svchost.exe -k netsvcs -p;"ServiceDll" = %systemroot%\system32\Windows.SharedPC.AccountManager.dll

-----------------EOF-----------------

Ahoj

Stiahni AdwCleaner: https://toolslib.net/downloads/finish/1/

• Uloz na plochu a ukonci vsetky programy
• Spusti AdwCleaner ako spravca
• Odsuhlas licencne podmienky
• Klikni na Skenovat nyni (Scan now) a pockaj na dokoncenie
• Nechaj zaskrtnute vsetky nalezy
• Klikni na Cisteni a opravy (Clean and Repair) a potvrd restart PC teraz
• Po restartovani PC sa otvori AdwCleaner, klikni na Zobrazit soubor protokolu
• Otvori sa log, jeho obsah sem skopiruj

-------------------------------
# Malwarebytes AdwCleaner 7.2.2.0
# -------------------------------
# Build: 07-17-2018
# Database: 2018-08-17.1
# Support: https://www.malwarebytes.com/support
#
# -------------------------------
# Mode: Scan
# -------------------------------
# Start: 08-17-2018
# Duration: 00:00:21
# OS: Windows 10 Home
# Scanned: 41822
# Detected: 0


***** [ Services ] *****

No malicious services found.

***** [ Folders ] *****

No malicious folders found.

***** [ Files ] *****

No malicious files found.

***** [ DLL ] *****

No malicious DLLs found.

***** [ WMI ] *****

No malicious WMI found.

***** [ Shortcuts ] *****

No malicious shortcuts found.

***** [ Tasks ] *****

No malicious tasks found.

***** [ Registry ] *****

No malicious registry entries found.

***** [ Chromium (and derivatives) ] *****

No malicious Chromium entries found.

***** [ Chromium URLs ] *****

No malicious Chromium URLs found.

***** [ Firefox (and derivatives) ] *****

No malicious Firefox entries found.

***** [ Firefox URLs ] *****

No malicious Firefox URLs found.



########## EOF - C:\AdwCleaner\Logs\AdwCleaner[S00].txt ##########

Poprosim o obidva logy z FRST podla tohto navodu (FRST.txt a Addition.txt): https://forum.viry.cz/viewtopic.php?f=13&t=152707

V pripade, ze sa FRSTLauncher nebude dat stiahnut alebo spustit, pouzi iba samotny FRST.

Ak sa logy nezmestia do jedneho prispevku, zabal ich do archivu RAR alebo ZIP a posli ako prilohu.

Prilohu posielam 2 logy FRST .

Otvor poznamkovy blok (Win+R -> notepad -> enter)

• Skopiruj nasledujuci text a vloz ho do poznamkoveho bloku:

  Kód: Vybrat vše

  Start
  CloseProcesses:
  CreateRestorePoint:
  
  PowerShell: Get-ChildItem -Path "C:\Users\Roman\Desktop" -Recurse -Force | Measure-Object -Property Length -Sum
  
  HKU\S-1-5-21-1537523766-1934355744-2765702040-1001\...\MountPoints2: {f8b6d70c-7767-11e7-823e-50465db58091} - "F:\HiSuiteDownLoader.exe" 
  GroupPolicy: Restriction - Chrome <==== ATTENTION
  CHR HKLM\SOFTWARE\Policies\Google: Restriction <==== ATTENTION
  2018-08-18 10:51 - 2018-08-18 10:51 - 000015327 _____ C:\Users\Roman\Desktop\LM.bat
  2018-08-18 10:50 - 2018-08-18 10:50 - 000112640 _____ (forum.viry.cz) C:\Users\Roman\Desktop\FRSTLauncher.exe
  2018-08-16 11:55 - 2018-08-16 11:56 - 000000000 ____D C:\Users\Roman\Desktop\trend micro
  2018-08-16 11:55 - 2018-08-16 11:56 - 000000000 ____D C:\Users\Roman\Desktop\rsit
  2018-08-16 11:54 - 2018-08-16 11:54 - 001329152 _____ C:\Users\Roman\Desktop\RSITx64.exe
  2015-09-21 13:37 - 2015-09-21 13:37 - 000000000 _____ () C:\ProgramData\cisE2B0.exe
  
  Task: {0829A6DC-A497-4CC9-8C2C-32F537927A34} - \Microsoft\Windows\UNP\RunCampaignManager -> No File <==== ATTENTION
  Task: {17BF7E14-31ED-4213-8C4C-6DD851A9ACBE} - \Microsoft\Windows\Setup\GWXTriggers\Logon-5d -> No File <==== ATTENTION
  Task: {3AB6E3F7-ED5E-4C85-B3FA-D989B62313B4} - \WPD\SqmUpload_S-1-5-21-1537523766-1934355744-2765702040-1001 -> No File <==== ATTENTION
  Task: {3D072AF8-CD55-49A6-A61E-698CAB3A8A2E} - \Microsoft\Windows\Setup\gwx\refreshgwxconfig -> No File <==== ATTENTION
  Task: {42AD8F82-331D-42B4-8ABC-D3792CF5790B} - \Microsoft\Windows\Setup\gwx\refreshgwxcontent -> No File <==== ATTENTION
  Task: {4F93C631-BB13-48F2-A3F2-141A6B841FF6} - \Microsoft\Windows\Setup\GWXTriggers\Time-5d -> No File <==== ATTENTION
  Task: {5535BBF5-3320-473A-B289-0CECA05DA69E} - \Microsoft\Windows\Setup\gwx\launchtrayprocess -> No File <==== ATTENTION
  Task: {69C84728-1591-4D29-BA45-17C9AB4802E9} - \Microsoft\Windows\Setup\GWXTriggers\Telemetry-4xd -> No File <==== ATTENTION
  Task: {A74A2216-AB54-4B87-B195-4FB579F08E7E} - \Microsoft\Windows\Setup\GWXTriggers\refreshgwxconfig-B -> No File <==== ATTENTION
  Task: {A965DBF1-0570-4BFB-9282-ACE1DF739175} - \Microsoft\Windows\Setup\gwx\refreshgwxconfigandcontent -> No File <==== ATTENTION
  Task: {B5B09AEF-7BF8-4DF6-9C5B-D8795512649A} - \Microsoft\Windows\Setup\GWXTriggers\OutOfSleep-5d -> No File <==== ATTENTION
  Task: {CB743DC4-E31B-492C-94C7-4C973C220F2C} - \Microsoft\Windows\Setup\GWXTriggers\OutOfIdle-5d -> No File <==== ATTENTION
  Task: {CD18E0DB-6851-400B-8C4C-44571F84ADC4} - \Microsoft\Windows\Setup\GWXTriggers\MachineUnlock-5d -> No File <==== ATTENTION
  
  AlternateDataStreams: C:\WINDOWS\avastSS.scr:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\RtlExUpd.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\AcpiServiceVnA64.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\AERTAC64.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\AERTAR64.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\amdave64.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\amdgfxinfo64.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\amdhcp64.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\amdhdl64.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\amdlvr64.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\amdmantle64.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\amdmiracast.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\amdmmcl6.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\amdocl12cl64.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\amdocl_as64.exe:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\amdocl_ld64.exe:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\amdpcom64.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\amdxc64.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\api-ms-win-crt-conio-l1-1-0.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\api-ms-win-crt-math-l1-1-0.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\api-ms-win-crt-multibyte-l1-1-0.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\api-ms-win-crt-string-l1-1-0.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\api-ms-win-crt-time-l1-1-0.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\atiadlxx.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\atiapfxx.exe:$CmdTcID [130]
  AlternateDataStreams: C:\WINDOWS\system32\aticalcl64.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\aticaldd64.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\aticalrt64.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\aticfx64.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\atidemgy.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\atidxx64.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\atieah64.exe:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\atieclxx.exe:$CMDTCID [0]
  AlternateDataStreams: C:\WINDOWS\system32\atig6pxx.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\atig6txx.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\atiglpxx.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\atimpc64.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\atimuixx.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\atio6axx.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\ATIODCLI.exe:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\ATIODE.exe:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\atisamu64.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\atitmm64.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\atiu9p64.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\atiumd64.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\atiumd6a.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\atiuxp64.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\audioLibVc.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\cdpreference.exe:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\clinfo.exe:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\Cmeau108.exe:$CmdTcID [130]
  AlternateDataStreams: C:\WINDOWS\system32\CNC280C.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\CNC280I.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\CNC280L.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\CNC280O.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\CNHMCA6.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\CNMXLMAA.DLL:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\coinst_15.20.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\CONEQMSAPOGUILibrary.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\CX64APO.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\D3DCompiler_33.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\D3DCompiler_34.dll:$CmdTcID [130]
  AlternateDataStreams: C:\WINDOWS\system32\D3DCompiler_35.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\D3DCompiler_36.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\D3DCompiler_37.dll:$CmdTcID [130]
  AlternateDataStreams: C:\WINDOWS\system32\D3DCompiler_38.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\D3DCompiler_39.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\D3DCompiler_40.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\D3DCompiler_41.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\D3DCompiler_42.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\d3dcsx_42.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\d3dcsx_43.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\d3dx10.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\d3dx10_33.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\d3dx10_34.dll:$CmdTcID [130]
  AlternateDataStreams: C:\WINDOWS\system32\d3dx10_35.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\d3dx10_36.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\d3dx10_37.dll:$CmdTcID [130]
  AlternateDataStreams: C:\WINDOWS\system32\d3dx10_38.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\d3dx10_39.dll:$CmdTcID [130]
  AlternateDataStreams: C:\WINDOWS\system32\d3dx10_40.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\d3dx10_41.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\d3dx10_43.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\d3dx11_42.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\d3dx9_24.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\d3dx9_25.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\d3dx9_26.dll:$CmdTcID [130]
  AlternateDataStreams: C:\WINDOWS\system32\d3dx9_27.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\d3dx9_29.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\d3dx9_30.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\d3dx9_31.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\d3dx9_33.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\d3dx9_34.dll:$CmdTcID [130]
  AlternateDataStreams: C:\WINDOWS\system32\d3dx9_35.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\d3dx9_36.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\D3DX9_37.dll:$CmdTcID [130]
  AlternateDataStreams: C:\WINDOWS\system32\D3DX9_38.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\D3DX9_39.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\D3DX9_40.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\D3DX9_41.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\D3DX9_42.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\D3DX9_43.dll:$CmdTcID [130]
  AlternateDataStreams: C:\WINDOWS\system32\DdcWnsListener.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\DDPA64.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\DDPA64F3.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\DDPD64A.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\DDPD64AF3.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\DDPO64A.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\DDPO64AF3.dll:$CmdTcID [130]
  AlternateDataStreams: C:\WINDOWS\system32\DDPP64A.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\DDPP64AF3.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\DelayAPO.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\detoured.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\dns-sd.exe:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\DTSBassEnhancementDLL64.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\DTSBoostDLL64.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\DTSGainCompensatorDLL64.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\DTSGFXAPO64.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\DTSGFXAPONS64.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\DTSLFXAPO64.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\DTSLimiterDLL64.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\DTSNeoPCDLL64.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\DTSS2HeadphoneDLL64.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\DTSS2SpeakerDLL64.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\DTSSymmetryDLL64.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\DTSU2PGFX64.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\DTSU2PLFX64.dll:$CmdTcID [130]
  AlternateDataStreams: C:\WINDOWS\system32\DTSU2PREC64.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\DTSVoiceClarityDLL64.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\FMAPO64.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\ftcserco.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\ftd2xx.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\ftserui2.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\GEARAspi64.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\hsa-thunk64.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\ICEsoundAPO64.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\indexeddbserver.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\KAAPORT64.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\mantle64.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\mantleaxl64.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\MaxxAudioAPO20.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\MaxxAudioAPO30.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\MaxxAudioAPO4064.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\MaxxAudioAPO5064.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\MaxxAudioAPO6064.dll:$CmdTcID [130]
  AlternateDataStreams: C:\WINDOWS\system32\MaxxAudioAPO7064.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\MaxxAudioAPOShell64.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\MaxxAudioEQ64.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\MaxxAudioRealtek64.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\MaxxSpeechAPO64.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\MaxxVoiceAPO2064.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\MaxxVoiceAPO3064.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\MaxxVoiceAPO4064.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\MaxxVolumeSDAPO.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\MISS_APO.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\NAHIMICAPOlfx.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\NahimicAPONSControl.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\NAHIMICAPOSettingsIPC.dll:$CmdTcID [130]
  AlternateDataStreams: C:\WINDOWS\system32\NAHIMICV2apo.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\OpenCL.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\R4EEA64A.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\R4EED64A.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\R4EEG64A.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\R4EEL64A.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\R4EEP64A.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\RCoInstII64.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\RltkAPO64.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\RP3DAA64.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\RP3DHT64.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\RTCOM64.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\RtDataProc64.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\RTEED64A.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\RTEEG64A.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\RTEEL64A.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\RTEEP64A.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\RtkApi64.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\RtkCfg64.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\RtkCoLDR64.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\RtlCPAPI64.dll:$CmdTcID [130]
  AlternateDataStreams: C:\WINDOWS\system32\RtNicProp64.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\RtPgEx64.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\RTSnMg64.cpl:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\SEAPO64.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\SECOMN64.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\SEHDRA64.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\SFAPO64.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\SFCOM64.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\SFNHK64.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\SFSS_APO.dll:$CmdTcID [130]
  AlternateDataStreams: C:\WINDOWS\system32\sl3apo64.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\slcnt64.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\slprp64.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\sltech64.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\SRAPO64.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\SRCOM.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\SRCOM64.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\SRRPTR64.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\SRSHP64.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\SRSTSH64.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\SRSTSX64.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\SRSWOW64.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\SStudio.dll:$CmdTcID [130]
  AlternateDataStreams: C:\WINDOWS\system32\tadefxapo.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\tadefxapo264.dll:$CmdTcID [130]
  AlternateDataStreams: C:\WINDOWS\system32\tepeqapo64.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\tosade.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\tosasfapo64.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\toseaeapo64.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\tossaeapo64.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\tossaemaxapo64.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\usbaaplrc.dll:$CmdTcID [130]
  AlternateDataStreams: C:\WINDOWS\system32\UtcResources.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\WavesGUILib64.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\wu.upgrade.ps.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\x3daudio1_0.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\x3daudio1_1.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\X3DAudio1_2.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\X3DAudio1_3.dll:$CmdTcID [130]
  AlternateDataStreams: C:\WINDOWS\system32\X3DAudio1_4.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\X3DAudio1_5.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\X3DAudio1_6.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\X3DAudio1_7.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\xactengine2_0.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\xactengine2_1.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\xactengine2_10.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\xactengine2_2.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\xactengine2_3.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\xactengine2_4.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\xactengine2_5.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\xactengine2_6.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\xactengine2_7.dll:$CmdTcID [130]
  AlternateDataStreams: C:\WINDOWS\system32\xactengine2_8.dll:$CmdTcID [130]
  AlternateDataStreams: C:\WINDOWS\system32\xactengine2_9.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\xactengine3_0.dll:$CmdTcID [130]
  AlternateDataStreams: C:\WINDOWS\system32\xactengine3_1.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\xactengine3_2.dll:$CmdTcID [130]
  AlternateDataStreams: C:\WINDOWS\system32\xactengine3_3.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\xactengine3_4.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\xactengine3_5.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\xactengine3_6.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\xactengine3_7.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\XAPOFX1_0.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\XAPOFX1_1.dll:$CmdTcID [130]
  AlternateDataStreams: C:\WINDOWS\system32\XAPOFX1_2.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\XAPOFX1_3.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\XAPOFX1_4.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\XAudio2_0.dll:$CmdTcID [130]
  AlternateDataStreams: C:\WINDOWS\system32\XAudio2_1.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\XAudio2_2.dll:$CmdTcID [130]
  AlternateDataStreams: C:\WINDOWS\system32\XAudio2_3.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\XAudio2_4.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\XAudio2_5.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\XAudio2_6.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\xinput1_1.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\xinput1_2.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\xinput1_3.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\YamahaAE.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\YamahaAE2.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\SysWOW64\amdave32.dll:$CmdTcID [130]
  AlternateDataStreams: C:\WINDOWS\SysWOW64\amdgfxinfo32.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\SysWOW64\amdhcp32.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\SysWOW64\amdhdl32.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\SysWOW64\amdlvr32.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\SysWOW64\amdmantle32.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\SysWOW64\amdmmcl.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\SysWOW64\amdocl.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\SysWOW64\amdocl12cl.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\SysWOW64\amdocl_as32.exe:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\SysWOW64\amdocl_ld32.exe:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\SysWOW64\amdpcom32.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\SysWOW64\amdxc32.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\SysWOW64\api-ms-win-crt-heap-l1-1-0.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\SysWOW64\api-ms-win-crt-locale-l1-1-0.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\SysWOW64\api-ms-win-crt-math-l1-1-0.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\SysWOW64\api-ms-win-crt-multibyte-l1-1-0.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\SysWOW64\api-ms-win-crt-string-l1-1-0.dll:$CmdTcID [130]
  AlternateDataStreams: C:\WINDOWS\SysWOW64\atiadlxx.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\SysWOW64\atiadlxy.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\SysWOW64\aticalcl.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\SysWOW64\aticaldd.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\SysWOW64\aticalrt.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\SysWOW64\aticfx32.dll:$CmdTcID [130]
  AlternateDataStreams: C:\WINDOWS\SysWOW64\atidxx32.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\SysWOW64\atieah32.exe:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\SysWOW64\atigktxx.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\SysWOW64\atiglpxx.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\SysWOW64\atimpc32.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\SysWOW64\atioglxx.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\SysWOW64\atisamu32.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\SysWOW64\atiu9pag.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\SysWOW64\atiumdag.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\SysWOW64\atiumdva.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\SysWOW64\atiuxpag.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\SysWOW64\CNC280L.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\SysWOW64\CNC280U.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\SysWOW64\CNHMCA.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\SysWOW64\Comdlg32.ocx:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\SysWOW64\D3DCompiler_33.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\SysWOW64\D3DCompiler_34.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\SysWOW64\D3DCompiler_35.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\SysWOW64\D3DCompiler_36.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\SysWOW64\D3DCompiler_37.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\SysWOW64\D3DCompiler_38.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\SysWOW64\D3DCompiler_39.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\SysWOW64\D3DCompiler_40.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\SysWOW64\D3DCompiler_42.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\SysWOW64\d3dcsx_42.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\SysWOW64\d3dcsx_43.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\SysWOW64\d3dx10.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\SysWOW64\d3dx10_33.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\SysWOW64\d3dx10_34.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\SysWOW64\d3dx10_35.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\SysWOW64\d3dx10_36.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\SysWOW64\d3dx10_37.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\SysWOW64\d3dx10_38.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\SysWOW64\d3dx10_39.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\SysWOW64\d3dx10_40.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\SysWOW64\d3dx10_43.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\SysWOW64\d3dx11_42.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\SysWOW64\d3dx9_24.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\SysWOW64\d3dx9_25.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\SysWOW64\d3dx9_26.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\SysWOW64\d3dx9_27.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\SysWOW64\d3dx9_28.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\SysWOW64\d3dx9_29.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\SysWOW64\d3dx9_30.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\SysWOW64\d3dx9_31.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\SysWOW64\d3dx9_33.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\SysWOW64\d3dx9_34.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\SysWOW64\d3dx9_35.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\SysWOW64\d3dx9_36.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\SysWOW64\D3DX9_37.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\SysWOW64\D3DX9_38.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\SysWOW64\D3DX9_39.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\SysWOW64\D3DX9_40.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\SysWOW64\D3DX9_41.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\SysWOW64\D3DX9_42.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\SysWOW64\D3DX9_43.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\SysWOW64\detoured.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\SysWOW64\DLLDEV32i.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\SysWOW64\dns-sd.exe:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\SysWOW64\ftd2xx.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\SysWOW64\GEARAspi.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\SysWOW64\hsa-thunk.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\SysWOW64\indexeddbserver.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\SysWOW64\mantle32.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\SysWOW64\mantleaxl32.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\SysWOW64\Mscomctl.ocx:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\SysWOW64\newlistview2.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\SysWOW64\OpenCL.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\SysWOW64\PnkBstrB.ex0:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\SysWOW64\PnkBstrB.exe:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\SysWOW64\PnkBstrB.xtr:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\SysWOW64\RltkAPO.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\SysWOW64\SECOMN32.DLL:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\SysWOW64\SFCOM.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\SysWOW64\SRCOM.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\SysWOW64\vgf.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\SysWOW64\x3daudio1_0.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\SysWOW64\x3daudio1_1.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\SysWOW64\X3DAudio1_2.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\SysWOW64\X3DAudio1_3.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\SysWOW64\X3DAudio1_4.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\SysWOW64\X3DAudio1_5.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\SysWOW64\X3DAudio1_6.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\SysWOW64\X3DAudio1_7.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\SysWOW64\xactengine2_0.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\SysWOW64\xactengine2_1.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\SysWOW64\xactengine2_10.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\SysWOW64\xactengine2_2.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\SysWOW64\xactengine2_3.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\SysWOW64\xactengine2_4.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\SysWOW64\xactengine2_5.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\SysWOW64\xactengine2_6.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\SysWOW64\xactengine2_7.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\SysWOW64\xactengine2_8.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\SysWOW64\xactengine2_9.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\SysWOW64\xactengine3_0.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\SysWOW64\xactengine3_1.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\SysWOW64\xactengine3_2.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\SysWOW64\xactengine3_3.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\SysWOW64\xactengine3_4.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\SysWOW64\xactengine3_5.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\SysWOW64\xactengine3_6.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\SysWOW64\xactengine3_7.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\SysWOW64\XAPOFX1_0.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\SysWOW64\XAPOFX1_1.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\SysWOW64\XAPOFX1_2.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\SysWOW64\XAPOFX1_3.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\SysWOW64\XAPOFX1_4.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\SysWOW64\XAudio2_0.dll:$CmdTcID [130]
  AlternateDataStreams: C:\WINDOWS\SysWOW64\XAudio2_1.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\SysWOW64\XAudio2_2.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\SysWOW64\XAudio2_3.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\SysWOW64\XAudio2_4.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\SysWOW64\XAudio2_5.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\SysWOW64\XAudio2_6.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\SysWOW64\xinput1_1.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\SysWOW64\xinput1_2.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\SysWOW64\xinput1_3.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\Drivers\amdacpksd.sys:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\Drivers\amdkmafd.sys:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\Drivers\ati2erec.dll:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\Drivers\atikmdag.sys:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\Drivers\atikmpag.sys:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\Drivers\ndisrd.sys:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\Drivers\rt640x64.sys:$CmdTcID [130]
  AlternateDataStreams: C:\WINDOWS\system32\Drivers\RTKVHD64.sys:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\Drivers\RtNdPt630.sys:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\system32\Drivers\usbaapl64.sys:$CmdTcID [130]
  AlternateDataStreams: C:\WINDOWS\system32\Drivers\VDiskBus64.sys:$CmdTcID [64]
  AlternateDataStreams: C:\WINDOWS\SysWOW64\Drivers\AsInsHelp32.sys:$CmdZnID [26]
  AlternateDataStreams: C:\WINDOWS\SysWOW64\Drivers\AsInsHelp64.sys:$CmdZnID [26]
  AlternateDataStreams: C:\WINDOWS\SysWOW64\Drivers\AsIO.sys:$CmdZnID [26]
  AlternateDataStreams: C:\WINDOWS\SysWOW64\Drivers\ASUSFILTER.sys:$CmdZnID [26]
  AlternateDataStreams: C:\WINDOWS\SysWOW64\Drivers\UpdateHelper.dll:$CmdTcID [64]
  AlternateDataStreams: C:\ProgramData\Reprise:wupeogjxldtlfudivq`qsp`26hfm [0]
  AlternateDataStreams: C:\ProgramData\TEMP:66BB1E73 [147]
  AlternateDataStreams: C:\Users\Roman\Desktop\File-share.top Manager.exe:$CMDTCID [0]
  
  Hosts:
  EmptyTemp:
  End

• Uloz na plochu s nazvom fixlist.txt
• Spusti znovu FRST a klikni na Fix
• Po dokonceni si FRST vyziada restart PC, potvrd kliknutim na OK
• Po restartovani PC bude na ploche subor Fixlog.txt, jeho obsah sem skopiruj

Fix result of Farbar Recovery Scan Tool (x64) Version: 02.08.2018
Ran by Roman (18-08-2018 19:08:12) Run:1
Running from C:\Users\Roman\Desktop
Loaded Profiles: Roman (Available Profiles: Roman)
Boot Mode: Normal
==============================================

fixlist content:
*****************
Start
CloseProcesses:
CreateRestorePoint:

PowerShell: Get-ChildItem -Recurse | Measure-Object -Property Length -Sum

HKU\S-1-5-21-1537523766-1934355744-2765702040-1001\...\MountPoints2: {f8b6d70c-7767-11e7-823e-50465db58091} - "F:\HiSuiteDownLoader.exe"
GroupPolicy: Restriction - Chrome <==== ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Restriction <==== ATTENTION
2018-08-18 10:51 - 2018-08-18 10:51 - 000015327 _____ C:\Users\Roman\Desktop\LM.bat
2018-08-18 10:50 - 2018-08-18 10:50 - 000112640 _____ (forum.viry.cz) C:\Users\Roman\Desktop\FRSTLauncher.exe
2018-08-16 11:55 - 2018-08-16 11:56 - 000000000 ____D C:\Users\Roman\Desktop\trend micro
2018-08-16 11:55 - 2018-08-16 11:56 - 000000000 ____D C:\Users\Roman\Desktop\rsit
2018-08-16 11:54 - 2018-08-16 11:54 - 001329152 _____ C:\Users\Roman\Desktop\RSITx64.exe
2015-09-21 13:37 - 2015-09-21 13:37 - 000000000 _____ () C:\ProgramData\cisE2B0.exe

Task: {0829A6DC-A497-4CC9-8C2C-32F537927A34} - \Microsoft\Windows\UNP\RunCampaignManager -> No File <==== ATTENTION
Task: {17BF7E14-31ED-4213-8C4C-6DD851A9ACBE} - \Microsoft\Windows\Setup\GWXTriggers\Logon-5d -> No File <==== ATTENTION
Task: {3AB6E3F7-ED5E-4C85-B3FA-D989B62313B4} - \WPD\SqmUpload_S-1-5-21-1537523766-1934355744-2765702040-1001 -> No File <==== ATTENTION
Task: {3D072AF8-CD55-49A6-A61E-698CAB3A8A2E} - \Microsoft\Windows\Setup\gwx\refreshgwxconfig -> No File <==== ATTENTION
Task: {42AD8F82-331D-42B4-8ABC-D3792CF5790B} - \Microsoft\Windows\Setup\gwx\refreshgwxcontent -> No File <==== ATTENTION
Task: {4F93C631-BB13-48F2-A3F2-141A6B841FF6} - \Microsoft\Windows\Setup\GWXTriggers\Time-5d -> No File <==== ATTENTION
Task: {5535BBF5-3320-473A-B289-0CECA05DA69E} - \Microsoft\Windows\Setup\gwx\launchtrayprocess -> No File <==== ATTENTION
Task: {69C84728-1591-4D29-BA45-17C9AB4802E9} - \Microsoft\Windows\Setup\GWXTriggers\Telemetry-4xd -> No File <==== ATTENTION
Task: {A74A2216-AB54-4B87-B195-4FB579F08E7E} - \Microsoft\Windows\Setup\GWXTriggers\refreshgwxconfig-B -> No File <==== ATTENTION
Task: {A965DBF1-0570-4BFB-9282-ACE1DF739175} - \Microsoft\Windows\Setup\gwx\refreshgwxconfigandcontent -> No File <==== ATTENTION
Task: {B5B09AEF-7BF8-4DF6-9C5B-D8795512649A} - \Microsoft\Windows\Setup\GWXTriggers\OutOfSleep-5d -> No File <==== ATTENTION
Task: {CB743DC4-E31B-492C-94C7-4C973C220F2C} - \Microsoft\Windows\Setup\GWXTriggers\OutOfIdle-5d -> No File <==== ATTENTION
Task: {CD18E0DB-6851-400B-8C4C-44571F84ADC4} - \Microsoft\Windows\Setup\GWXTriggers\MachineUnlock-5d -> No File <==== ATTENTION

AlternateDataStreams: C:\WINDOWS\avastSS.scr:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\RtlExUpd.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\AcpiServiceVnA64.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\AERTAC64.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\AERTAR64.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\amdave64.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\amdgfxinfo64.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\amdhcp64.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\amdhdl64.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\amdlvr64.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\amdmantle64.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\amdmiracast.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\amdmmcl6.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\amdocl12cl64.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\amdocl_as64.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\amdocl_ld64.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\amdpcom64.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\amdxc64.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\api-ms-win-crt-conio-l1-1-0.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\api-ms-win-crt-math-l1-1-0.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\api-ms-win-crt-multibyte-l1-1-0.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\api-ms-win-crt-string-l1-1-0.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\api-ms-win-crt-time-l1-1-0.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\atiadlxx.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\atiapfxx.exe:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\system32\aticalcl64.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\aticaldd64.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\aticalrt64.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\aticfx64.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\atidemgy.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\atidxx64.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\atieah64.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\atieclxx.exe:$CMDTCID [0]
AlternateDataStreams: C:\WINDOWS\system32\atig6pxx.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\atig6txx.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\atiglpxx.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\atimpc64.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\atimuixx.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\atio6axx.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\ATIODCLI.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\ATIODE.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\atisamu64.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\atitmm64.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\atiu9p64.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\atiumd64.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\atiumd6a.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\atiuxp64.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\audioLibVc.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\cdpreference.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\clinfo.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Cmeau108.exe:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\system32\CNC280C.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\CNC280I.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\CNC280L.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\CNC280O.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\CNHMCA6.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\CNMXLMAA.DLL:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\coinst_15.20.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\CONEQMSAPOGUILibrary.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\CX64APO.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\D3DCompiler_33.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\D3DCompiler_34.dll:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\system32\D3DCompiler_35.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\D3DCompiler_36.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\D3DCompiler_37.dll:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\system32\D3DCompiler_38.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\D3DCompiler_39.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\D3DCompiler_40.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\D3DCompiler_41.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\D3DCompiler_42.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\d3dcsx_42.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\d3dcsx_43.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\d3dx10.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\d3dx10_33.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\d3dx10_34.dll:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\system32\d3dx10_35.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\d3dx10_36.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\d3dx10_37.dll:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\system32\d3dx10_38.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\d3dx10_39.dll:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\system32\d3dx10_40.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\d3dx10_41.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\d3dx10_43.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\d3dx11_42.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\d3dx9_24.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\d3dx9_25.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\d3dx9_26.dll:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\system32\d3dx9_27.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\d3dx9_29.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\d3dx9_30.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\d3dx9_31.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\d3dx9_33.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\d3dx9_34.dll:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\system32\d3dx9_35.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\d3dx9_36.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\D3DX9_37.dll:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\system32\D3DX9_38.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\D3DX9_39.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\D3DX9_40.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\D3DX9_41.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\D3DX9_42.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\D3DX9_43.dll:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\system32\DdcWnsListener.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\DDPA64.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\DDPA64F3.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\DDPD64A.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\DDPD64AF3.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\DDPO64A.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\DDPO64AF3.dll:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\system32\DDPP64A.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\DDPP64AF3.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\DelayAPO.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\detoured.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\dns-sd.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\DTSBassEnhancementDLL64.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\DTSBoostDLL64.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\DTSGainCompensatorDLL64.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\DTSGFXAPO64.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\DTSGFXAPONS64.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\DTSLFXAPO64.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\DTSLimiterDLL64.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\DTSNeoPCDLL64.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\DTSS2HeadphoneDLL64.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\DTSS2SpeakerDLL64.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\DTSSymmetryDLL64.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\DTSU2PGFX64.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\DTSU2PLFX64.dll:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\system32\DTSU2PREC64.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\DTSVoiceClarityDLL64.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\FMAPO64.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\ftcserco.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\ftd2xx.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\ftserui2.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\GEARAspi64.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\hsa-thunk64.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\ICEsoundAPO64.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\indexeddbserver.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\KAAPORT64.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\mantle64.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\mantleaxl64.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\MaxxAudioAPO20.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\MaxxAudioAPO30.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\MaxxAudioAPO4064.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\MaxxAudioAPO5064.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\MaxxAudioAPO6064.dll:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\system32\MaxxAudioAPO7064.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\MaxxAudioAPOShell64.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\MaxxAudioEQ64.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\MaxxAudioRealtek64.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\MaxxSpeechAPO64.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\MaxxVoiceAPO2064.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\MaxxVoiceAPO3064.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\MaxxVoiceAPO4064.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\MaxxVolumeSDAPO.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\MISS_APO.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\NAHIMICAPOlfx.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\NahimicAPONSControl.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\NAHIMICAPOSettingsIPC.dll:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\system32\NAHIMICV2apo.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\OpenCL.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\R4EEA64A.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\R4EED64A.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\R4EEG64A.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\R4EEL64A.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\R4EEP64A.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\RCoInstII64.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\RltkAPO64.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\RP3DAA64.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\RP3DHT64.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\RTCOM64.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\RtDataProc64.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\RTEED64A.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\RTEEG64A.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\RTEEL64A.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\RTEEP64A.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\RtkApi64.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\RtkCfg64.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\RtkCoLDR64.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\RtlCPAPI64.dll:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\system32\RtNicProp64.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\RtPgEx64.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\RTSnMg64.cpl:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\SEAPO64.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\SECOMN64.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\SEHDRA64.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\SFAPO64.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\SFCOM64.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\SFNHK64.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\SFSS_APO.dll:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\system32\sl3apo64.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\slcnt64.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\slprp64.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\sltech64.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\SRAPO64.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\SRCOM.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\SRCOM64.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\SRRPTR64.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\SRSHP64.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\SRSTSH64.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\SRSTSX64.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\SRSWOW64.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\SStudio.dll:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\system32\tadefxapo.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\tadefxapo264.dll:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\system32\tepeqapo64.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\tosade.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\tosasfapo64.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\toseaeapo64.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\tossaeapo64.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\tossaemaxapo64.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\usbaaplrc.dll:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\system32\UtcResources.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\WavesGUILib64.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\wu.upgrade.ps.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\x3daudio1_0.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\x3daudio1_1.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\X3DAudio1_2.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\X3DAudio1_3.dll:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\system32\X3DAudio1_4.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\X3DAudio1_5.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\X3DAudio1_6.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\X3DAudio1_7.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\xactengine2_0.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\xactengine2_1.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\xactengine2_10.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\xactengine2_2.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\xactengine2_3.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\xactengine2_4.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\xactengine2_5.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\xactengine2_6.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\xactengine2_7.dll:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\system32\xactengine2_8.dll:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\system32\xactengine2_9.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\xactengine3_0.dll:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\system32\xactengine3_1.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\xactengine3_2.dll:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\system32\xactengine3_3.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\xactengine3_4.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\xactengine3_5.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\xactengine3_6.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\xactengine3_7.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\XAPOFX1_0.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\XAPOFX1_1.dll:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\system32\XAPOFX1_2.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\XAPOFX1_3.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\XAPOFX1_4.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\XAudio2_0.dll:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\system32\XAudio2_1.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\XAudio2_2.dll:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\system32\XAudio2_3.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\XAudio2_4.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\XAudio2_5.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\XAudio2_6.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\xinput1_1.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\xinput1_2.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\xinput1_3.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\YamahaAE.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\YamahaAE2.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\amdave32.dll:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\SysWOW64\amdgfxinfo32.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\amdhcp32.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\amdhdl32.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\amdlvr32.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\amdmantle32.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\amdmmcl.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\amdocl.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\amdocl12cl.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\amdocl_as32.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\amdocl_ld32.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\amdpcom32.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\amdxc32.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\api-ms-win-crt-heap-l1-1-0.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\api-ms-win-crt-locale-l1-1-0.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\api-ms-win-crt-math-l1-1-0.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\api-ms-win-crt-multibyte-l1-1-0.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\api-ms-win-crt-string-l1-1-0.dll:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\SysWOW64\atiadlxx.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\atiadlxy.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\aticalcl.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\aticaldd.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\aticalrt.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\aticfx32.dll:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\SysWOW64\atidxx32.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\atieah32.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\atigktxx.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\atiglpxx.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\atimpc32.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\atioglxx.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\atisamu32.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\atiu9pag.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\atiumdag.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\atiumdva.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\atiuxpag.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\CNC280L.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\CNC280U.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\CNHMCA.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\Comdlg32.ocx:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\D3DCompiler_33.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\D3DCompiler_34.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\D3DCompiler_35.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\D3DCompiler_36.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\D3DCompiler_37.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\D3DCompiler_38.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\D3DCompiler_39.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\D3DCompiler_40.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\D3DCompiler_42.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\d3dcsx_42.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\d3dcsx_43.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\d3dx10.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\d3dx10_33.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\d3dx10_34.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\d3dx10_35.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\d3dx10_36.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\d3dx10_37.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\d3dx10_38.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\d3dx10_39.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\d3dx10_40.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\d3dx10_43.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\d3dx11_42.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\d3dx9_24.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\d3dx9_25.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\d3dx9_26.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\d3dx9_27.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\d3dx9_28.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\d3dx9_29.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\d3dx9_30.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\d3dx9_31.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\d3dx9_33.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\d3dx9_34.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\d3dx9_35.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\d3dx9_36.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\D3DX9_37.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\D3DX9_38.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\D3DX9_39.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\D3DX9_40.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\D3DX9_41.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\D3DX9_42.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\D3DX9_43.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\detoured.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\DLLDEV32i.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\dns-sd.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\ftd2xx.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\GEARAspi.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\hsa-thunk.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\indexeddbserver.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\mantle32.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\mantleaxl32.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\Mscomctl.ocx:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\newlistview2.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\OpenCL.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\PnkBstrB.ex0:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\PnkBstrB.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\PnkBstrB.xtr:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\RltkAPO.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\SECOMN32.DLL:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\SFCOM.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\SRCOM.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\vgf.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\x3daudio1_0.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\x3daudio1_1.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\X3DAudio1_2.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\X3DAudio1_3.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\X3DAudio1_4.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\X3DAudio1_5.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\X3DAudio1_6.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\X3DAudio1_7.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\xactengine2_0.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\xactengine2_1.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\xactengine2_10.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\xactengine2_2.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\xactengine2_3.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\xactengine2_4.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\xactengine2_5.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\xactengine2_6.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\xactengine2_7.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\xactengine2_8.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\xactengine2_9.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\xactengine3_0.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\xactengine3_1.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\xactengine3_2.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\xactengine3_3.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\xactengine3_4.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\xactengine3_5.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\xactengine3_6.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\xactengine3_7.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\XAPOFX1_0.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\XAPOFX1_1.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\XAPOFX1_2.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\XAPOFX1_3.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\XAPOFX1_4.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\XAudio2_0.dll:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\SysWOW64\XAudio2_1.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\XAudio2_2.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\XAudio2_3.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\XAudio2_4.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\XAudio2_5.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\XAudio2_6.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\xinput1_1.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\xinput1_2.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\xinput1_3.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\amdacpksd.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\amdkmafd.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\ati2erec.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\atikmdag.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\atikmpag.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\ndisrd.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\rt640x64.sys:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\RTKVHD64.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\RtNdPt630.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\usbaapl64.sys:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\VDiskBus64.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\Drivers\AsInsHelp32.sys:$CmdZnID [26]
AlternateDataStreams: C:\WINDOWS\SysWOW64\Drivers\AsInsHelp64.sys:$CmdZnID [26]
AlternateDataStreams: C:\WINDOWS\SysWOW64\Drivers\AsIO.sys:$CmdZnID [26]
AlternateDataStreams: C:\WINDOWS\SysWOW64\Drivers\ASUSFILTER.sys:$CmdZnID [26]
AlternateDataStreams: C:\WINDOWS\SysWOW64\Drivers\UpdateHelper.dll:$CmdTcID [64]
AlternateDataStreams: C:\ProgramData\Reprise:wupeogjxldtlfudivq`qsp`26hfm [0]
AlternateDataStreams: C:\ProgramData\TEMP:66BB1E73 [147]
AlternateDataStreams: C:\Users\Roman\Desktop\File-share.top Manager.exe:$CMDTCID [0]

Hosts:
EmptyTemp:
End
*****************

Processes closed successfully.
Restore point was successfully created.

========= Get-ChildItem -Recurse | Measure-Object -Property Length -Sum =========



Count : 4651
Average :
Sum : 88377366160
Maximum :
Minimum :
Property : Length




========= End of Powershell: =========

"HKU\S-1-5-21-1537523766-1934355744-2765702040-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{f8b6d70c-7767-11e7-823e-50465db58091}" => removed successfully
HKLM\Software\Classes\CLSID\{f8b6d70c-7767-11e7-823e-50465db58091} => not found
C:\WINDOWS\system32\GroupPolicy\Machine => moved successfully
C:\WINDOWS\system32\GroupPolicy\GPT.ini => moved successfully
C:\WINDOWS\SysWOW64\GroupPolicy\GPT.ini => moved successfully
"HKLM\SOFTWARE\Policies\Google" => removed successfully
"C:\Users\Roman\Desktop\LM.bat" => not found
"C:\Users\Roman\Desktop\FRSTLauncher.exe" => not found
C:\Users\Roman\Desktop\trend micro => moved successfully
C:\Users\Roman\Desktop\rsit => moved successfully
C:\Users\Roman\Desktop\RSITx64.exe => moved successfully
C:\ProgramData\cisE2B0.exe => moved successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{0829A6DC-A497-4CC9-8C2C-32F537927A34}" => removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{0829A6DC-A497-4CC9-8C2C-32F537927A34}" => removed successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\UNP\RunCampaignManager => not found
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{17BF7E14-31ED-4213-8C4C-6DD851A9ACBE}" => removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{17BF7E14-31ED-4213-8C4C-6DD851A9ACBE}" => removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\GWXTriggers\Logon-5d" => removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{3AB6E3F7-ED5E-4C85-B3FA-D989B62313B4}" => removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{3AB6E3F7-ED5E-4C85-B3FA-D989B62313B4}" => removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\WPD\SqmUpload_S-1-5-21-1537523766-1934355744-2765702040-1001" => removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{3D072AF8-CD55-49A6-A61E-698CAB3A8A2E}" => removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{3D072AF8-CD55-49A6-A61E-698CAB3A8A2E}" => removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\gwx\refreshgwxconfig" => removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{42AD8F82-331D-42B4-8ABC-D3792CF5790B}" => removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{42AD8F82-331D-42B4-8ABC-D3792CF5790B}" => removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\gwx\refreshgwxcontent" => removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{4F93C631-BB13-48F2-A3F2-141A6B841FF6}" => removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{4F93C631-BB13-48F2-A3F2-141A6B841FF6}" => removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\GWXTriggers\Time-5d" => removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{5535BBF5-3320-473A-B289-0CECA05DA69E}" => removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{5535BBF5-3320-473A-B289-0CECA05DA69E}" => removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\gwx\launchtrayprocess" => removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{69C84728-1591-4D29-BA45-17C9AB4802E9}" => removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{69C84728-1591-4D29-BA45-17C9AB4802E9}" => removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\GWXTriggers\Telemetry-4xd" => removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{A74A2216-AB54-4B87-B195-4FB579F08E7E}" => removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{A74A2216-AB54-4B87-B195-4FB579F08E7E}" => removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\GWXTriggers\refreshgwxconfig-B" => removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{A965DBF1-0570-4BFB-9282-ACE1DF739175}" => removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{A965DBF1-0570-4BFB-9282-ACE1DF739175}" => removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\gwx\refreshgwxconfigandcontent" => removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{B5B09AEF-7BF8-4DF6-9C5B-D8795512649A}" => removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{B5B09AEF-7BF8-4DF6-9C5B-D8795512649A}" => removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\GWXTriggers\OutOfSleep-5d" => removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{CB743DC4-E31B-492C-94C7-4C973C220F2C}" => removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{CB743DC4-E31B-492C-94C7-4C973C220F2C}" => removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\GWXTriggers\OutOfIdle-5d" => removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{CD18E0DB-6851-400B-8C4C-44571F84ADC4}" => removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{CD18E0DB-6851-400B-8C4C-44571F84ADC4}" => removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\GWXTriggers\MachineUnlock-5d" => removed successfully
C:\WINDOWS\avastSS.scr => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\RtlExUpd.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\AcpiServiceVnA64.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\AERTAC64.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\AERTAR64.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\amdave64.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\amdgfxinfo64.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\amdhcp64.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\amdhdl64.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\amdlvr64.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\amdmantle64.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\amdmiracast.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\amdmmcl6.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\amdocl12cl64.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\amdocl_as64.exe => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\amdocl_ld64.exe => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\amdpcom64.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\amdxc64.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\api-ms-win-crt-conio-l1-1-0.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\api-ms-win-crt-math-l1-1-0.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\api-ms-win-crt-multibyte-l1-1-0.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\api-ms-win-crt-string-l1-1-0.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\api-ms-win-crt-time-l1-1-0.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\atiadlxx.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\atiapfxx.exe => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\aticalcl64.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\aticaldd64.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\aticalrt64.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\aticfx64.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\atidemgy.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\atidxx64.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\atieah64.exe => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\atieclxx.exe => ":$CMDTCID" ADS could not remove.
C:\WINDOWS\system32\atig6pxx.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\atig6txx.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\atiglpxx.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\atimpc64.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\atimuixx.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\atio6axx.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\ATIODCLI.exe => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\ATIODE.exe => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\atisamu64.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\atitmm64.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\atiu9p64.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\atiumd64.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\atiumd6a.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\atiuxp64.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\audioLibVc.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\cdpreference.exe => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\clinfo.exe => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\Cmeau108.exe => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\CNC280C.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\CNC280I.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\CNC280L.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\CNC280O.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\CNHMCA6.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\CNMXLMAA.DLL => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\coinst_15.20.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\CONEQMSAPOGUILibrary.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\CX64APO.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\D3DCompiler_33.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\D3DCompiler_34.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\D3DCompiler_35.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\D3DCompiler_36.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\D3DCompiler_37.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\D3DCompiler_38.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\D3DCompiler_39.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\D3DCompiler_40.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\D3DCompiler_41.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\D3DCompiler_42.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\d3dcsx_42.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\d3dcsx_43.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\d3dx10.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\d3dx10_33.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\d3dx10_34.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\d3dx10_35.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\d3dx10_36.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\d3dx10_37.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\d3dx10_38.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\d3dx10_39.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\d3dx10_40.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\d3dx10_41.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\d3dx10_43.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\d3dx11_42.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\d3dx9_24.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\d3dx9_25.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\d3dx9_26.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\d3dx9_27.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\d3dx9_29.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\d3dx9_30.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\d3dx9_31.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\d3dx9_33.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\d3dx9_34.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\d3dx9_35.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\d3dx9_36.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\D3DX9_37.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\D3DX9_38.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\D3DX9_39.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\D3DX9_40.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\D3DX9_41.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\D3DX9_42.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\D3DX9_43.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\DdcWnsListener.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\DDPA64.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\DDPA64F3.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\DDPD64A.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\DDPD64AF3.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\DDPO64A.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\DDPO64AF3.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\DDPP64A.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\DDPP64AF3.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\DelayAPO.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\detoured.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\dns-sd.exe => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\DTSBassEnhancementDLL64.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\DTSBoostDLL64.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\DTSGainCompensatorDLL64.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\DTSGFXAPO64.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\DTSGFXAPONS64.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\DTSLFXAPO64.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\DTSLimiterDLL64.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\DTSNeoPCDLL64.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\DTSS2HeadphoneDLL64.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\DTSS2SpeakerDLL64.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\DTSSymmetryDLL64.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\DTSU2PGFX64.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\DTSU2PLFX64.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\DTSU2PREC64.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\DTSVoiceClarityDLL64.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\FMAPO64.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\ftcserco.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\ftd2xx.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\ftserui2.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\GEARAspi64.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\hsa-thunk64.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\ICEsoundAPO64.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\indexeddbserver.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\KAAPORT64.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\mantle64.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\mantleaxl64.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\MaxxAudioAPO20.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\MaxxAudioAPO30.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\MaxxAudioAPO4064.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\MaxxAudioAPO5064.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\MaxxAudioAPO6064.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\MaxxAudioAPO7064.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\MaxxAudioAPOShell64.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\MaxxAudioEQ64.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\MaxxAudioRealtek64.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\MaxxSpeechAPO64.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\MaxxVoiceAPO2064.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\MaxxVoiceAPO3064.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\MaxxVoiceAPO4064.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\MaxxVolumeSDAPO.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\MISS_APO.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\NAHIMICAPOlfx.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\NahimicAPONSControl.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\NAHIMICAPOSettingsIPC.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\NAHIMICV2apo.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\OpenCL.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\R4EEA64A.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\R4EED64A.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\R4EEG64A.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\R4EEL64A.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\R4EEP64A.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\RCoInstII64.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\RltkAPO64.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\RP3DAA64.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\RP3DHT64.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\RTCOM64.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\RtDataProc64.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\RTEED64A.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\RTEEG64A.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\RTEEL64A.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\RTEEP64A.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\RtkApi64.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\RtkCfg64.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\RtkCoLDR64.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\RtlCPAPI64.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\RtNicProp64.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\RtPgEx64.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\RTSnMg64.cpl => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\SEAPO64.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\SECOMN64.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\SEHDRA64.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\SFAPO64.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\SFCOM64.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\SFNHK64.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\SFSS_APO.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\sl3apo64.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\slcnt64.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\slprp64.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\sltech64.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\SRAPO64.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\SRCOM.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\SRCOM64.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\SRRPTR64.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\SRSHP64.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\SRSTSH64.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\SRSTSX64.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\SRSWOW64.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\SStudio.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\tadefxapo.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\tadefxapo264.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\tepeqapo64.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\tosade.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\tosasfapo64.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\toseaeapo64.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\tossaeapo64.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\tossaemaxapo64.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\usbaaplrc.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\UtcResources.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\WavesGUILib64.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\wu.upgrade.ps.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\x3daudio1_0.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\x3daudio1_1.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\X3DAudio1_2.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\X3DAudio1_3.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\X3DAudio1_4.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\X3DAudio1_5.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\X3DAudio1_6.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\X3DAudio1_7.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\xactengine2_0.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\xactengine2_1.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\xactengine2_10.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\xactengine2_2.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\xactengine2_3.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\xactengine2_4.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\xactengine2_5.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\xactengine2_6.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\xactengine2_7.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\xactengine2_8.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\xactengine2_9.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\xactengine3_0.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\xactengine3_1.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\xactengine3_2.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\xactengine3_3.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\xactengine3_4.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\xactengine3_5.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\xactengine3_6.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\xactengine3_7.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\XAPOFX1_0.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\XAPOFX1_1.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\XAPOFX1_2.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\XAPOFX1_3.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\XAPOFX1_4.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\XAudio2_0.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\XAudio2_1.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\XAudio2_2.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\XAudio2_3.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\XAudio2_4.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\XAudio2_5.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\XAudio2_6.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\xinput1_1.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\xinput1_2.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\xinput1_3.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\YamahaAE.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\YamahaAE2.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\amdave32.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\amdgfxinfo32.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\amdhcp32.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\amdhdl32.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\amdlvr32.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\amdmantle32.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\amdmmcl.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\amdocl.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\amdocl12cl.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\amdocl_as32.exe => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\amdocl_ld32.exe => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\amdpcom32.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\amdxc32.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\api-ms-win-crt-heap-l1-1-0.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\api-ms-win-crt-locale-l1-1-0.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\api-ms-win-crt-math-l1-1-0.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\api-ms-win-crt-multibyte-l1-1-0.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\api-ms-win-crt-string-l1-1-0.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\atiadlxx.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\atiadlxy.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\aticalcl.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\aticaldd.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\aticalrt.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\aticfx32.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\atidxx32.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\atieah32.exe => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\atigktxx.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\atiglpxx.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\atimpc32.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\atioglxx.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\atisamu32.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\atiu9pag.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\atiumdag.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\atiumdva.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\atiuxpag.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\CNC280L.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\CNC280U.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\CNHMCA.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\Comdlg32.ocx => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\D3DCompiler_33.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\D3DCompiler_34.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\D3DCompiler_35.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\D3DCompiler_36.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\D3DCompiler_37.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\D3DCompiler_38.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\D3DCompiler_39.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\D3DCompiler_40.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\D3DCompiler_42.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\d3dcsx_42.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\d3dcsx_43.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\d3dx10.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\d3dx10_33.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\d3dx10_34.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\d3dx10_35.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\d3dx10_36.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\d3dx10_37.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\d3dx10_38.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\d3dx10_39.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\d3dx10_40.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\d3dx10_43.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\d3dx11_42.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\d3dx9_24.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\d3dx9_25.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\d3dx9_26.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\d3dx9_27.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\d3dx9_28.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\d3dx9_29.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\d3dx9_30.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\d3dx9_31.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\d3dx9_33.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\d3dx9_34.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\d3dx9_35.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\d3dx9_36.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\D3DX9_37.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\D3DX9_38.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\D3DX9_39.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\D3DX9_40.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\D3DX9_41.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\D3DX9_42.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\D3DX9_43.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\detoured.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\DLLDEV32i.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\dns-sd.exe => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\ftd2xx.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\GEARAspi.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\hsa-thunk.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\indexeddbserver.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\mantle32.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\mantleaxl32.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\Mscomctl.ocx => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\newlistview2.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\OpenCL.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\PnkBstrB.ex0 => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\PnkBstrB.exe => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\PnkBstrB.xtr => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\RltkAPO.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\SECOMN32.DLL => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\SFCOM.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\SRCOM.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\vgf.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\x3daudio1_0.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\x3daudio1_1.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\X3DAudio1_2.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\X3DAudio1_3.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\X3DAudio1_4.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\X3DAudio1_5.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\X3DAudio1_6.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\X3DAudio1_7.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\xactengine2_0.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\xactengine2_1.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\xactengine2_10.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\xactengine2_2.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\xactengine2_3.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\xactengine2_4.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\xactengine2_5.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\xactengine2_6.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\xactengine2_7.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\xactengine2_8.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\xactengine2_9.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\xactengine3_0.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\xactengine3_1.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\xactengine3_2.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\xactengine3_3.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\xactengine3_4.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\xactengine3_5.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\xactengine3_6.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\xactengine3_7.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\XAPOFX1_0.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\XAPOFX1_1.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\XAPOFX1_2.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\XAPOFX1_3.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\XAPOFX1_4.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\XAudio2_0.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\XAudio2_1.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\XAudio2_2.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\XAudio2_3.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\XAudio2_4.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\XAudio2_5.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\XAudio2_6.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\xinput1_1.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\xinput1_2.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\xinput1_3.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\Drivers\amdacpksd.sys => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\Drivers\amdkmafd.sys => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\Drivers\ati2erec.dll => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\Drivers\atikmdag.sys => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\Drivers\atikmpag.sys => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\Drivers\ndisrd.sys => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\Drivers\rt640x64.sys => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\Drivers\RTKVHD64.sys => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\Drivers\RtNdPt630.sys => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\Drivers\usbaapl64.sys => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\system32\Drivers\VDiskBus64.sys => ":$CmdTcID" ADS could not remove.
C:\WINDOWS\SysWOW64\Drivers\AsInsHelp32.sys => ":$CmdZnID" ADS removed successfully
C:\WINDOWS\SysWOW64\Drivers\AsInsHelp64.sys => ":$CmdZnID" ADS removed successfully
C:\WINDOWS\SysWOW64\Drivers\AsIO.sys => ":$CmdZnID" ADS removed successfully
C:\WINDOWS\SysWOW64\Drivers\ASUSFILTER.sys => ":$CmdZnID" ADS removed successfully
C:\WINDOWS\SysWOW64\Drivers\UpdateHelper.dll => ":$CmdTcID" ADS could not remove.
C:\ProgramData\Reprise => ":wupeogjxldtlfudivq`qsp`26hfm" ADS removed successfully
C:\ProgramData\TEMP => ":66BB1E73" ADS removed successfully
C:\Users\Roman\Desktop\File-share.top Manager.exe => ":$CMDTCID" ADS could not remove.
C:\Windows\System32\Drivers\etc\hosts => moved successfully
Hosts restored successfully.

=========== EmptyTemp: ==========

BITS transfer queue => 7888896 B
DOMStore, IE Recovery, AppCache, Feeds Cache, Thumbcache, IconCache => 211298623 B
Java, Flash, Steam htmlcache => 1129 B
Windows/system/drivers => 33865 B
Edge => 8192 B
Chrome => 0 B
Firefox => 0 B
Opera => 432374339 B

Temp, IE cache, history, cookies, recent:
Default => 7680 B
Users => 0 B
ProgramData => 0 B
Public => 0 B
systemprofile => 0 B
systemprofile32 => 0 B
LocalService => 8584 B
LocalService => 0 B
NetworkService => 7680 B
NetworkService => 0 B
Roman => 34606875 B

RecycleBin => 0 B
EmptyTemp: => 654.4 MB temporary data Removed.

================================


The system needed a reboot.

==== End of Fixlog 19:10:18 ====

Poznas IP adresy 156.154.70.25 a 156.154.71.25? Su nastavene ako DNS servery.

Presun vsetky subory a zlozky z plochy do dokumentov a na ploche nechaj iba odkazy/zastupcov. Prilis velka velkost plochy moze sposobit spomalenie systemu.

Nepoznam IP adresy ,slozky som presunul do dokumentov ako si pisal.

Tak tie DNS servery by mali byt v poriadku, je to Comodo Secure DNS.

Inak vyzera to OK. Su este s PC nejake problemy?

Jeden problem je vytazenie disku 100 % niekedy ked pc bezi tak spomaluje po case PC sa potom trosku znormalizuje vytazenie disku klesne.Spravcov uloh som pozeral to vytazenie sposobuje to hostitel sluzby pravdepodobne.

V Spravcovi uloh, pri polozke Hostitel sluzby by mal byt aj presny nazov sluzby a dany riadok by sa mal dat "rozbalit". Ked sa to opat vyskytne tak urob najlepsie screenshot, o co sa konkretne jedna.

Skontrolujeme disk:

Stiahni CrystalDiskInfo: https://crystalmark.info/redirect.php?p ... alDiskInfo

• Rozbal cely archiv na plochu a spusti cez DiskInfo64.exe
• Hore klikni na Upravy (Edit) -> Kopirovat (Copy)
• Skopiruje sa log, jeho obsah vloz (Ctrl+V) do dalsej odpovedi

https://imgur.com/a/JV413iY
---------------------------------------------------------------------------
CrystalDiskInfo 7.7.0 (C) 2008-2018 hiyohiyo
Crystal Dew World : https://crystalmark.info/
----------------------------------------------------------------------------

OS : Windows 10 [10.0 Build 17134] (x64)
Date : 2018/08/22 17:30:20

-- Controller Map ----------------------------------------------------------
+ AMD SATA Controller [ATA]
- WDC WD5000AAKX-003CA0
- HL-DT-ST DVDRAM GH24NS95
- HL-DT-ST BD-RE BH16NS40
- Microsoft Storage Spaces Controller [SCSI]

-- Disk List ---------------------------------------------------------------
(1) WDC WD5000AAKX-003CA0 : 500,1 GB [0/0/0, pd1] - wd

----------------------------------------------------------------------------
(1) WDC WD5000AAKX-003CA0
----------------------------------------------------------------------------
Model : WDC WD5000AAKX-003CA0
Firmware : 15.01H15
Serial Number : WD-WCAYUJU98628
Disk Size : 500,1 GB (8,4/137,4/500,1/500,1)
Buffer Size : 16384 KB
Queue Depth : 32
# of Sectors : 976773168
Rotation Rate : Neznámy
Interface : Serial ATA
Major Version : ATA8-ACS
Minor Version : ----
Transfer Mode : SATA/600 | SATA/600
Power On Hours : 10647 hod.
Power On Count : 3673 krát
Temperature : 44 C (111 F)
Health Status : Pozor
Features : S.M.A.R.T., 48bit LBA, NCQ
APM Level : ----
AAM Level : ----
Drive Letter : C:

-- S.M.A.R.T. --------------------------------------------------------------
ID Cur Wor Thr RawValues(6) Attribute Name
01 200 200 _51 000000009128 Miera chybných čítaní
03 137 135 _21 00000000101D Čas rozbehu
04 _97 _97 __0 000000000ECD Počet spustení/zastavení
05 200 200 140 000000000000 Počet realokovaných sektorov
07 100 253 __0 000000000000 Miera chýb pri vyhľadávaní
09 _86 _86 __0 000000002997 Hodiny napájania
0A 100 100 __0 000000000000 Počet opakovaných roztočení
0B 100 100 __0 000000000000 Pokusy o rekalibrovanie
0C _97 _97 __0 000000000E59 Počet cyklov napájania
C0 200 200 __0 000000000076 Počet stiahnutí pri vypnutí napájania
C1 199 199 __0 000000000E56 Počet cyklov načítania/odstránenia
C2 _99 _92 __0 00000000002C Teplota
C4 200 200 __0 000000000000 Počet udalostí realokovania
C5 200 200 __0 000000000001 Počet aktuálne podozrivých sektorov
C6 200 200 __0 000000000000 Počet neopraviteľných sektorov
C7 200 200 __0 000000000000 Počet chýb v kontrolnom súčte UltraDMA
C8 200 200 __0 000000000000 Miera chýb pri zápise

-- IDENTIFY_DEVICE ---------------------------------------------------------
0 1 2 3 4 5 6 7 8 9
000: 427A 3FFF C837 0010 0000 0000 003F 0000 0000 0000
010: 2020 2020 2057 442D 5743 4159 554A 5539 3836 3238
020: 0000 8000 0032 3135 2E30 3148 3135 5744 4320 5744
030: 3530 3030 4141 4B58 2D30 3033 4341 3020 2020 2020
040: 2020 2020 2020 2020 2020 2020 2020 8010 0000 2F00
050: 4001 0000 0000 0007 3FFF 0010 003F FC10 00FB 0110
060: FFFF 0FFF 0000 0007 0003 0078 0078 0078 0078 0000
070: 0000 0000 0000 0000 0000 001F 170E 0006 0044 0044
080: 01FE 0000 746B 7D61 4123 7469 BC41 4123 407F 002B
090: 002B 0000 FFFE 0000 0000 0000 0000 0000 0000 0000
100: 6030 3A38 0000 0000 0000 0000 0000 0000 5001 4EE2
110: 5C57 8E00 0000 0000 0000 0000 0000 0000 0000 4018
120: 4018 0000 0000 0000 0000 0000 0000 0000 0029 0000
130: 0000 0000 0000 16FE 0125 0000 0000 0000 0000 0000
140: 0000 0000 0004 0000 0000 0000 0000 0000 0000 0000
150: 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000
160: 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000
170: 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000
180: 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000
190: 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000
200: 0000 0000 0000 0000 0000 0000 3037 0000 0000 0000
210: 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000
220: 0000 0000 103E 0000 0000 0000 0000 0000 0000 0000
230: 0000 0000 0000 0000 0001 1000 0000 0000 0000 0000
240: 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000
250: 0000 0000 0000 0000 0000 41A5

-- SMART_READ_DATA ---------------------------------------------------------
+0 +1 +2 +3 +4 +5 +6 +7 +8 +9 +A +B +C +D +E +F
000: 10 00 01 2F 00 C8 C8 28 91 00 00 00 00 00 03 27
010: 00 89 87 1D 10 00 00 00 00 00 04 32 00 61 61 CD
020: 0E 00 00 00 00 00 05 33 00 C8 C8 00 00 00 00 00
030: 00 00 07 2E 00 64 FD 00 00 00 00 00 00 00 09 32
040: 00 56 56 97 29 00 00 00 00 00 0A 32 00 64 64 00
050: 00 00 00 00 00 00 0B 32 00 64 64 00 00 00 00 00
060: 00 00 0C 32 00 61 61 59 0E 00 00 00 00 00 C0 32
070: 00 C8 C8 76 00 00 00 00 00 00 C1 32 00 C7 C7 56
080: 0E 00 00 00 00 00 C2 22 00 63 5C 2C 00 00 00 00
090: 00 00 C4 32 00 C8 C8 00 00 00 00 00 00 00 C5 32
0A0: 00 C8 C8 01 00 00 00 00 00 00 C6 30 00 C8 C8 00
0B0: 00 00 00 00 00 00 C7 32 00 C8 C8 00 00 00 00 00
0C0: 00 00 C8 08 00 C8 C8 00 00 00 00 00 00 00 00 00
0D0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0E0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0F0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
110: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
120: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
130: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
140: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
150: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
160: 00 00 00 00 00 00 00 00 00 00 82 00 0C 21 01 7B
170: 03 00 01 00 02 56 05 00 00 00 00 00 00 00 00 00
180: 00 00 01 02 00 00 00 00 00 00 00 00 00 00 00 00
190: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
1A0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
1B0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
1C0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
1D0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
1E0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
1F0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10

-- SMART_READ_THRESHOLD ----------------------------------------------------
+0 +1 +2 +3 +4 +5 +6 +7 +8 +9 +A +B +C +D +E +F
000: 10 00 01 33 C8 C8 00 00 00 00 00 00 00 00 03 15
010: 00 00 00 00 00 00 00 00 00 00 04 00 00 00 00 00
020: 00 00 00 00 00 00 05 8C 00 00 00 00 00 00 00 00
030: 00 00 07 00 64 64 00 00 00 00 00 00 00 00 09 00
040: 00 00 00 00 00 00 00 00 00 00 0A 00 00 00 00 00
050: 00 00 00 00 00 00 0B 00 00 00 00 00 00 00 00 00
060: 00 00 0C 00 00 00 00 00 00 00 00 00 00 00 C0 00
070: 00 00 00 00 00 00 00 00 00 00 C1 00 00 00 00 00
080: 00 00 00 00 00 00 C2 00 00 00 00 00 00 00 00 00
090: 00 00 C4 00 00 00 00 00 00 00 00 00 00 00 C5 00
0A0: 00 00 00 00 00 00 00 00 00 00 C6 00 00 00 00 00
0B0: 00 00 00 00 00 00 C7 00 00 00 00 00 00 00 00 00
0C0: 00 00 C8 00 C8 C8 00 00 00 00 00 00 00 00 00 00
0D0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0E0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0F0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
110: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
120: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
130: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
140: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
150: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
160: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
170: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
180: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
190: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
1A0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
1B0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
1C0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
1D0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
1E0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
1F0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 D5

Sice HDD ma dost chyb citania, ale bez chybnych sektorov, az na 1 podozrivy sektor.

Podla logov ale PC vyzera cisty co sa tyka malware. Pre istotu mozes este urobot sken:

Urob v MBAM uplny sken

• Stiahni a nainstaluj Malwarebytes (MBAM): https://www.malwarebytes.com/mwb-download/thankyou/
• Ignoruj skusobnu trial verziu
• Otvor MBAM a vlavo klikni na "Skenovat"
• Klikni na "Vlastne skenovanie" a potom na "Nakonfigurovat skenovanie" (Nastavit sken)
• Vpravo oznac vsetky disky v PC a vlavo oznac moznost "Vyhladavat rootkity"
• Klikni na Skenovat teraz a pockaj na dokoncenie
• Po dokonceni klikni na Exportovat zhrnutie -> Textovy subor, zadaj nejaky nazov suboru a uloz na plochu
• Obsah tohto suboru sem skopiruj
• Obrazkovy navod (bohuzial pre starsiu verziu): https://forum.viry.cz/viewtopic.php?f=29&t=144868

Malwarebytes
www.malwarebytes.com

-Podrobnosti denníka-
Dátum skenovania: 22. 8. 2018
Čas skenovania: 21:09
Súbor denníka: ec540a4a-a63e-11e8-a2b2-50465db58091.json

-Údaje o softvéri-
Verzia: 3.5.1.2522
Verzia súčastí: 1.0.421
Aktualizovať verziu balíka: 1.0.6459
Licencia: Skúšobná verzia

-Systémové informácie-
OS: Windows 10 (Build 17134.228)
Procesor: x64
Systém súborov: NTFS
Používateľ: ROMAN\Roman

-Zhrnutie skenovania-
Typ skenovania: Vlastné skenovanie
Skenovanie bolo spustené: Manuálne
Výsledok: Dokončené
Preskenované objekty: 463145
Zistené hrozby: 0
(Nezistili sa nijaké škodlivé položky)
Hrozby umiestnené do karantény: 0
(Nezistili sa nijaké škodlivé položky)
Uplynulý čas: 20 h, 35 min, 21 s

-Možnosti skenovania-
Pamäť: Povolené
Spúšťanie: Povolené
Systém súborov: Povolené
Archívy: Povolené
Rootkity: Povolené
Heuristika: Povolené
PUP: Zistiť
PUM: Zistiť

-Podrobnosti skenovania-
Proces: 0
(Nezistili sa nijaké škodlivé položky)

Modul: 0
(Nezistili sa nijaké škodlivé položky)

Kľúč databázy Registry: 0
(Nezistili sa nijaké škodlivé položky)

Hodnota databázy Registry: 0
(Nezistili sa nijaké škodlivé položky)

Údaje databázy Registry: 0
(Nezistili sa nijaké škodlivé položky)

Prúd údajov: 0
(Nezistili sa nijaké škodlivé položky)

Priečinok: 0
(Nezistili sa nijaké škodlivé položky)

Súbor: 0
(Nezistili sa nijaké škodlivé položky)

Fyzický sektor: 0
(Nezistili sa nijaké škodlivé položky)

WMI: 0
(Nezistili sa nijaké škodlivé položky)


(end)