VIRY.CZ

Kód: Vybrat vše

Start
CloseProcesses:
CreateRestorePoint:

PowerShell: Get-ChildItem -Path "$ENV:USERPROFILE\Desktop" -Recurse -Force | Measure-Object -Property Length -Sum
File: C:\Program Files\Common Files\Bitdefender\SetupInformation\CL-22-B4ADED13-2FD4-4CC3-9FAB-96B990F5AAA0\setuplauncher.exe
File: C:\Program Files\Intel\SUR\QUEENCREEK\esrv_svc.exe
File: C:\Program Files (x86)\HiSuite\HandSetService\HuaweiHiSuiteService64.exe
File: C:\Program Files (x86)\Synology\Assistant\UsbClientService.exe
Folder: C:\WINDOWS\SysWOW64\qfuywrai
Folder: C:\Users\Zdeněk\AppData\Roaming\juvy05izx2c
Folder: C:\Program Files\Intel\SUR
CMD: type "C:\Program Files\Intel\SUR\QUEENCREEK\task.vbs"

CHR HKLM\SOFTWARE\Policies\Google: Restriction <==== ATTENTION
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://go.microsoft.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://go.microsoft.com
HKU\S-1-5-21-2861560486-2024932042-3958806256-1001\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://go.microsoft.com
HKU\S-1-5-21-2861560486-2024932042-3958806256-1001\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKU\S-1-5-21-2861560486-2024932042-3958806256-1001\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://go.microsoft.com
HKU\S-1-5-21-2861560486-2024932042-3958806256-1001\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://www.lenovo.com
FF Extension: (No Name) - C:\Program Files (x86)\Mozilla Firefox\browser\features\{32082DD9-C536-43AA-AF48-D266049C6FDA}.xpi [2018-10-31] [not signed]
CHR HomePage: Default -> hxxp://www.centrum.cz/
CHR StartupUrls: Default -> "hxxp://www.centrum.cz/"
CHR NewTab: Default ->  Active:"chrome-extension://ofmacdiceehcibkfednmgpkhgfhpacgi/newtab.html", Active:"chrome-extension://jpfpebmajhhopeonhlcgidhclcccjcik/newtab.html"
S3 Microsoft SharePoint Workspace Audit Service; "C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE" /auditservice [X]
S2 MicroV2Service; C:\Users\Zdeněk\AppData\Local\William\William.dll [X]
S2 vsservp; "C:\Program Files\Bitdefender\Bitdefender Security\vsservp.exe" [X]
2018-10-31 23:14 - 2018-10-31 23:18 - 000000000 ____D C:\WINDOWS\SysWOW64\qfuywrai
2018-10-31 23:13 - 2018-10-31 23:18 - 000000000 ____D C:\Users\Zdeněk\AppData\Roaming\juvy05izx2c
2018-11-01 20:17 - 2018-07-10 05:13 - 000000736 _____ C:\DelFix.txt
Task: {2E3BA783-7176-4A58-9CC6-7B53A623CAD5} - System32\Tasks\USER_ESRV_SVC_QUEENCREEK => "C:\WINDOWS\System32\Wscript.exe" //B //NoLogo "C:\Program Files\Intel\SUR\QUEENCREEK\task.vbs"
AlternateDataStreams: C:\ProgramData\Temp:1CE11B51 [153]

Hosts:
EmptyTemp:
End

Kód: Vybrat vše

Start
CloseProcesses:
CreateRestorePoint:
Folder: C:\Users\Zdeněk\AppData\Roaming\juvy05izx2c
2018-10-31 23:13 - 2018-10-31 23:18 - 000000000 ____D C:\Users\Zdeněk\AppData\Roaming\juvy05izx2c
Hosts:
EmptyTemp:
End