Prosím o jednu preventivku
Napsal: 09 srp 2019 21:03
Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 07-08-2019 02
Ran by Karlíkxy (administrator) on VELKEJPC (Gigabyte Technology Co., Ltd. GA-MA770T-UD3) (09-08-2019 21:59:08)
Running from C:\Users\Karlíkxy\Desktop\Nová složka
Loaded Profiles: Karlíkxy (Available Profiles: Karlíkxy)
Platform: Windows 10 Pro Version 1809 17763.615 (X64) Language: Čeština (Česko)
Default browser: FF
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/33 ... scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(Adobe Inc. -> Adobe Systems, Incorporated) C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGMService.exe
(Adobe Inc. -> Adobe Systems, Incorporated) C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGSService.exe
(DESlock Limited -> DESlock Limited.) C:\Program Files\ESET\ESET Secure Data\dlpsrv.exe
(ESET, spol. s r.o. -> ESET) C:\Program Files\ESET\ESET Security\eguiProxy.exe
(ESET, spol. s r.o. -> ESET) C:\Program Files\ESET\ESET Security\ekrn.exe
(Huawei Technologies Co., Ltd. -> ) [File not signed] C:\Program Files (x86)\HiSuite\HandSetService\HuaweiHiSuiteService64.exe
(Microsoft Corporation -> Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
(Microsoft Corporation -> Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe
(Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\smartscreen.exe
(Microsoft Windows Publisher -> Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe
(Microsoft Windows Publisher -> Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe
(NVIDIA Corporation -> NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NvTelemetry\NvTelemetryContainer.exe
(NVIDIA Corporation -> NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display.NvContainer\NVDisplay.Container.exe
(NVIDIA Corporation -> NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display.NvContainer\NVDisplay.Container.exe
(Realtek Semiconductor Corp. -> Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Skype Software Sarl -> Skype Technologies S.A.) C:\Program Files (x86)\Microsoft\Skype for Desktop\Skype.exe
(Skype Software Sarl -> Skype Technologies S.A.) C:\Program Files (x86)\Microsoft\Skype for Desktop\Skype.exe
(Skype Software Sarl -> Skype Technologies S.A.) C:\Program Files (x86)\Microsoft\Skype for Desktop\Skype.exe
(Skype Software Sarl -> Skype Technologies S.A.) C:\Program Files (x86)\Microsoft\Skype for Desktop\Skype.exe
(TomTom International BV -> TomTom) C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe
(Valve -> Valve Corporation) C:\Program Files (x86)\Common Files\Steam\SteamService.exe
(Valve -> Valve Corporation) C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe
(Valve -> Valve Corporation) C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe
(Valve -> Valve Corporation) C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe
(Valve -> Valve Corporation) C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe
(Valve -> Valve Corporation) C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe
(Valve -> Valve Corporation) C:\Program Files (x86)\Steam\Steam.exe
(Winstep Software Technologies) [File not signed] C:\Program Files (x86)\Winstep\Nexus.exe
(Winstep Software Technologies) [File not signed] C:\Program Files (x86)\Winstep\WsxService.exe
==================== Registry (Whitelisted) ===========================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [AdobeAAMUpdater-1.0] => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [508128 2016-07-01] (Adobe Systems Incorporated -> Adobe Systems Incorporated)
HKLM\...\Run: [egui] => C:\Program Files\ESET\ESET Security\ecmdS.exe [180448 2019-07-21] (ESET, spol. s r.o. -> ESET)
HKLM\...\Run: [AdobeGCInvoker-1.0] => C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGCInvokerUtility.exe [2849872 2019-07-04] (Adobe Inc. -> Adobe Systems, Incorporated)
HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [18391120 2019-04-11] (Realtek Semiconductor Corp. -> Realtek Semiconductor)
HKLM-x32\...\Run: [VICTORY Gaming Keyboard] => C:\Program Files (x86)\Gaming Keyboard\Monitor.exe [270336 2013-11-11] () [File not signed]
HKLM-x32\...\Run: [HP Software Update] => C:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe [96056 2013-05-30] (Hewlett-Packard Company -> Hewlett-Packard)
HKLM-x32\...\Run: [Wondershare Helper Compact.exe] => C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe [2133728 2017-09-12] (Wondershare Technology Co.,Ltd -> Wondershare)
HKU\S-1-5-21-4144462506-2486898719-981058799-1001\...\Run: [EsetPasswordManager] => C:\Program Files\ESET\ESET Password Manager\pwm.exe [113648 2019-04-29] (Lamantine Software a.s. -> ESET)
HKU\S-1-5-21-4144462506-2486898719-981058799-1001\...\Run: [Skype for Desktop] => C:\Program Files (x86)\Microsoft\Skype for Desktop\Skype.exe [53646904 2019-07-18] (Skype Software Sarl -> Skype Technologies S.A.)
HKU\S-1-5-21-4144462506-2486898719-981058799-1001\...\Run: [Nexus] => C:\Program Files (x86)\Winstep\Nexus.exe [17959552 2019-03-01] (Winstep Software Technologies) [File not signed]
HKU\S-1-5-21-4144462506-2486898719-981058799-1001\...\Run: [Zoner Photo Studio Autoupdate] => C:\Program Files\Zoner\Photo Studio 19\Program32\ZPSTRAY.EXE [604128 2018-11-01] (ZONER software, a.s. -> ZONER software)
HKU\S-1-5-21-4144462506-2486898719-981058799-1001\...\MountPoints2: {6bc1cec3-3048-11e9-8543-1c6f658aab67} - "G:\HiSuiteDownLoader.exe"
HKU\S-1-5-21-4144462506-2486898719-981058799-1001\...\MountPoints2: {df940eb5-9c28-11e9-8564-1c6f658aab67} - "F:\Setup.exe"
HKU\S-1-5-21-4144462506-2486898719-981058799-1001\...\MountPoints2: {df940f8a-9c28-11e9-8564-1c6f658aab67} - "F:\Setup.exe"
HKU\S-1-5-21-4144462506-2486898719-981058799-1001\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\WINDOWS\DREAMA~1.SCR [141312 2018-01-14] () [File not signed]
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk [2017-05-15]
ShortcutTarget: HP Digital Imaging Monitor.lnk -> C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe (Hewlett Packard -> Hewlett-Packard Co.)
GroupPolicy: Restriction ? <==== ATTENTION
==================== Scheduled Tasks (Whitelisted) =============
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
Task: {1362D4B2-119F-4D89-BB22-CFFC79D30111} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentLogOn2016 => C:\Program Files (x86)\Microsoft Office\root\Office16\msoia.exe [4519576 2019-08-02] (Microsoft Corporation -> Microsoft Corporation)
Task: {1B4B14F6-0646-4409-A65F-239C12FAA5F5} - System32\Tasks\NvTmRep_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvTmRep.exe [746056 2018-01-10] (NVIDIA Corporation -> NVIDIA Corporation)
Task: {401A4F49-C2AE-4AA9-9038-55EA9D055483} - System32\Tasks\Microsoft\Office\Office Feature Updates => C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\sdxhelper.exe [114736 2019-08-02] (Microsoft Corporation -> Microsoft Corporation)
Task: {5296E58E-6D54-4666-AA35-D66D2CC5D826} - System32\Tasks\Microsoft\Office\Office Automatic Updates 2.0 => C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe [27351864 2019-07-26] (Microsoft Corporation -> Microsoft Corporation)
Task: {5906DD94-AC24-4EDF-A907-A70E82417D89} - System32\Tasks\AdobeGCInvoker-1.0-VELKEJPC-Karlíkxy => C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGCInvokerUtility.exe [2849872 2019-07-04] (Adobe Inc. -> Adobe Systems, Incorporated)
Task: {62E336EF-2760-4806-8CF4-E8C8079F51B9} - System32\Tasks\Microsoft\Office\OfficeBackgroundTaskHandlerRegistration => C:\Program Files (x86)\Microsoft Office\root\Office16\officebackgroundtaskhandler.exe [1447064 2019-08-02] (Microsoft Corporation -> Microsoft Corporation)
Task: {64183814-E2EF-41F9-BB4A-94E6912C34B0} - \Microsoft\Windows\UNP\RunCampaignManager -> No File <==== ATTENTION
Task: {80AB00B5-53D6-4FDE-AE49-D3469867C000} - System32\Tasks\Microsoft\Office\Office ClickToRun Service Monitor => C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe [27351864 2019-07-26] (Microsoft Corporation -> Microsoft Corporation)
Task: {8E0836A4-FE9A-40BD-9744-7F0706C5447C} - System32\Tasks\Microsoft\Office\OfficeBackgroundTaskHandlerLogon => C:\Program Files (x86)\Microsoft Office\root\Office16\officebackgroundtaskhandler.exe [1447064 2019-08-02] (Microsoft Corporation -> Microsoft Corporation)
Task: {A110620B-FDDB-455B-B1E0-CC7047CFA86E} - System32\Tasks\NvTmRepOnLogon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvTmRep.exe [746056 2018-01-10] (NVIDIA Corporation -> NVIDIA Corporation)
Task: {A5834D3B-067C-4770-92F5-B87AC00C36F0} - System32\Tasks\Opera scheduled Autoupdate 1557004838 => C:\Users\Karlíkxy\AppData\Local\Programs\Opera\launcher.exe [1348120 2019-08-07] (Opera Software AS -> Opera Software)
Task: {ADB774B2-A85A-40FD-B267-4D55D0FC7C49} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentFallBack2016 => C:\Program Files (x86)\Microsoft Office\root\Office16\msoia.exe [4519576 2019-08-02] (Microsoft Corporation -> Microsoft Corporation)
Task: {B7D34523-3F35-42A6-81A0-2F5C5C9C8FBB} - System32\Tasks\Microsoft\Office\Office Feature Updates Logon => C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\sdxhelper.exe [114736 2019-08-02] (Microsoft Corporation -> Microsoft Corporation)
Task: {CA4BBF4E-79AF-42CC-BF56-3AC51F1ADEE5} - System32\Tasks\NvProfileUpdaterOnLogon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files\NVIDIA Corporation\Update Core\NvProfileUpdater64.exe [660040 2018-01-10] (NVIDIA Corporation -> NVIDIA Corporation)
Task: {D5691FF7-C0E9-4B7C-AC9C-79CBFA6C2DFF} - System32\Tasks\RogueKiller Anti-Malware => C:\Users\Karlíkxy\Desktop\RogueKiller_portable64.exe
Task: {E7E0A54E-FEAD-4B2E-9848-FD58754EDBE4} - System32\Tasks\NvTmMon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvTmMon.exe [524360 2018-01-10] (NVIDIA Corporation -> NVIDIA Corporation)
Task: {EE8BBE94-B545-4568-9BE0-39BF260A8A13} - System32\Tasks\Microsoft\Windows Live\SOXE\Extractor Definitions Update Task => {3519154C-227E-47F3-9CC9-12C3F05817F1}
Task: {F0FE289A-9FD9-4D0B-ADEE-6D92C3908F8A} - System32\Tasks\NvProfileUpdaterDaily_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files\NVIDIA Corporation\Update Core\NvProfileUpdater64.exe [660040 2018-01-10] (NVIDIA Corporation -> NVIDIA Corporation)
(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.100.1
Tcpip\..\Interfaces\{c6eac970-e2c8-4318-998b-1c9e3e635683}: [DhcpNameServer] 192.168.100.1
Internet Explorer:
==================
SearchScopes: HKU\S-1-5-21-4144462506-2486898719-981058799-1001 -> {012E1000-F331-11DB-8314-0800200C9A66} URL = hxxp://www.google.com/search?q={searchTerms}
BHO: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesX64\Microsoft Office\Office16\OCHelper.dll [2019-06-26] (Microsoft Corporation -> Microsoft Corporation)
BHO-x32: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files (x86)\Microsoft Office\root\Office16\OCHelper.dll [2019-04-05] (Microsoft Corporation -> Microsoft Corporation)
Handler-x32: mso-minsb-roaming.16 - {83C25742-A9F7-49FB-9138-434302C88D07} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2019-08-02] (Microsoft Corporation -> Microsoft Corporation)
Handler-x32: mso-minsb.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2019-08-02] (Microsoft Corporation -> Microsoft Corporation)
Handler-x32: osf-roaming.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2019-08-02] (Microsoft Corporation -> Microsoft Corporation)
Handler-x32: osf.16 - {5504BE45-A83B-4808-900A-3A5C36E7F77A} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2019-08-02] (Microsoft Corporation -> Microsoft Corporation)
FireFox:
========
FF DefaultProfile: kmapm4jw.default
FF ProfilePath: C:\Users\Karlíkxy\AppData\Roaming\TomTom\HOME\Profiles\eq9k5pmv.default [2019-05-05]
FF Homepage: TomTom\HOME\Profiles\eq9k5pmv.default -> about:home
FF NewTab: TomTom\HOME\Profiles\eq9k5pmv.default -> about:newtab
FF Extension: (RenaultTheme) - C:\Users\Karlíkxy\AppData\Roaming\TomTom\HOME\Profiles\eq9k5pmv.default\Extensions\RenaultTheme@tomtom.com [2019-03-14] [Legacy] [not signed]
FF Extension: (Map status indicator) - C:\Program Files (x86)\TomTom HOME 2\xul\extensions\MapShare-status@tomtom.com [2019-03-23] [Legacy] [not signed]
FF ProfilePath: C:\Users\Karlíkxy\AppData\Roaming\Mozilla\Firefox\Profiles\kmapm4jw.default [2019-08-09]
FF Homepage: Mozilla\Firefox\Profiles\kmapm4jw.default -> hxxps://www.seznam.cz/
FF NewTab: Mozilla\Firefox\Profiles\kmapm4jw.default -> about:newtab
FF NewTabOverride: Mozilla\Firefox\Profiles\kmapm4jw.default -> Disabled: admin@fastaddons.com_GroupSpeedDial
FF NewTabOverride: Mozilla\Firefox\Profiles\kmapm4jw.default -> Disabled: pavel.sherbakov@gmail.com
FF NewTabOverride: Mozilla\Firefox\Profiles\kmapm4jw.default -> Disabled: quickdial@matmoul.com
FF NewTabOverride: Mozilla\Firefox\Profiles\kmapm4jw.default -> Disabled: {0a79bc58-665f-4534-a7ea-6d61d68194fb}
FF Extension: (AdGuard AdBlocker) - C:\Users\Karlíkxy\AppData\Roaming\Mozilla\Firefox\Profiles\kmapm4jw.default\Extensions\adguardadblocker@adguard.com.xpi [2019-07-04]
FF Extension: (Český slovník pro kontrolu pravopisu) - C:\Users\Karlíkxy\AppData\Roaming\Mozilla\Firefox\Profiles\kmapm4jw.default\Extensions\cs@dictionaries.addons.mozilla.org.xpi [2019-01-05]
FF Extension: (Google Translator for Firefox) - C:\Users\Karlíkxy\AppData\Roaming\Mozilla\Firefox\Profiles\kmapm4jw.default\Extensions\translator@zoli.bod.xpi [2019-05-07]
FF Extension: (Blue Flower Vine by M♥Donna) - C:\Users\Karlíkxy\AppData\Roaming\Mozilla\Firefox\Profiles\kmapm4jw.default\Extensions\{04001c8a-6eff-4659-9196-0a552edd725a}.xpi [2019-05-11]
FF Extension: (tranquil blue) - C:\Users\Karlíkxy\AppData\Roaming\Mozilla\Firefox\Profiles\kmapm4jw.default\Extensions\{0d1802ae-eebf-4526-855b-1879b45e66cb}.xpi [2019-05-14]
FF Extension: (Ship in Lighthouse Reflection) - C:\Users\Karlíkxy\AppData\Roaming\Mozilla\Firefox\Profiles\kmapm4jw.default\Extensions\{2db9f8d0-ee99-4d57-a581-2722da1b573d}.xpi [2019-05-07]
FF Extension: (Dark Cubes) - C:\Users\Karlíkxy\AppData\Roaming\Mozilla\Firefox\Profiles\kmapm4jw.default\Extensions\{2dbb0302-0a64-4964-bb64-d157474dd324}.xpi [2019-05-14]
FF Extension: (Animated A Toon Town Christmas) - C:\Users\Karlíkxy\AppData\Roaming\Mozilla\Firefox\Profiles\kmapm4jw.default\Extensions\{328c92e1-1e11-4985-a74e-96aa60d8d243}.xpi [2019-05-14]
FF Extension: (Google Translate (In Page Translate)) - C:\Users\Karlíkxy\AppData\Roaming\Mozilla\Firefox\Profiles\kmapm4jw.default\Extensions\{3d09bd90-da37-41b5-a719-8da173e9870f}.xpi [2019-06-30]
FF Extension: (Deep Dark Blue Forest) - C:\Users\Karlíkxy\AppData\Roaming\Mozilla\Firefox\Profiles\kmapm4jw.default\Extensions\{5db58b6b-6fbc-4be3-b48d-e536ac711a10}.xpi [2019-05-14]
FF Extension: (Tv Firefox) - C:\Users\Karlíkxy\AppData\Roaming\Mozilla\Firefox\Profiles\kmapm4jw.default\Extensions\{6eafd633-df99-4fc0-a515-039ba8f8f253}.xpi [2019-05-14]
FF Extension: (FFX Developer) - C:\Users\Karlíkxy\AppData\Roaming\Mozilla\Firefox\Profiles\kmapm4jw.default\Extensions\{73574968-e44d-401e-8477-43882b7c9f22}.xpi [2019-05-14]
FF Extension: (Fox in the Clouds) - C:\Users\Karlíkxy\AppData\Roaming\Mozilla\Firefox\Profiles\kmapm4jw.default\Extensions\{aa842ed2-c0e8-4238-a894-c71e5bb2e97d}.xpi [2019-05-14]
FF Extension: (esafox) - C:\Users\Karlíkxy\AppData\Roaming\Mozilla\Firefox\Profiles\kmapm4jw.default\Extensions\{b526b65f-3165-4dcc-a534-3474d1de766b}.xpi [2019-05-14]
FF Extension: (FamousFox) - C:\Users\Karlíkxy\AppData\Roaming\Mozilla\Firefox\Profiles\kmapm4jw.default\Extensions\{bbf9b829-01fb-4406-8200-7622ed399df5}.xpi [2019-05-14]
FF Extension: (лиса) - C:\Users\Karlíkxy\AppData\Roaming\Mozilla\Firefox\Profiles\kmapm4jw.default\Extensions\{cdfd0c6c-8fc0-4565-ab49-fe3437600595}.xpi [2019-05-14]
FF Extension: (Grayfox) - C:\Users\Karlíkxy\AppData\Roaming\Mozilla\Firefox\Profiles\kmapm4jw.default\Extensions\{ceb971ca-37e6-4c49-ab6e-1d1a97a1eb8c}.xpi [2019-05-14]
FF Extension: (Winter Cabin Collage by M♥Donna) - C:\Users\Karlíkxy\AppData\Roaming\Mozilla\Firefox\Profiles\kmapm4jw.default\Extensions\{dba00d63-b5fe-4363-a4cf-e918ca9db46a}.xpi [2019-05-14]
FF Extension: (FirefoxClassicalBlue) - C:\Users\Karlíkxy\AppData\Roaming\Mozilla\Firefox\Profiles\kmapm4jw.default\Extensions\{dc4152a2-0127-4e36-aaf9-7a0ab4c46dc0}.xpi [2019-05-14]
FF Extension: (Dark Fox) - C:\Users\Karlíkxy\AppData\Roaming\Mozilla\Firefox\Profiles\kmapm4jw.default\Extensions\{e7fe4ffe-f256-4f85-906d-072fdd698585}.xpi [2019-05-14]
FF Extension: (Blue Flow) - C:\Users\Karlíkxy\AppData\Roaming\Mozilla\Firefox\Profiles\kmapm4jw.default\Extensions\{fb1fb250-2fd9-4f24-85ba-23dfcbf9f4e1}.xpi [2019-05-14]
FF Extension: (No Name) - C:\Users\Karlíkxy\AppData\Roaming\Mozilla\Firefox\Profiles\kmapm4jw.default\extensions\{ea614400-e918-4741-9a97-7a972ff7c30b} [not found]
FF Plugin: @docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf -> C:\Program Files\Tracker Software\PDF Viewer\npPDFXCviewNPPlugin.dll [1999-12-31] (Tracker Software Products (Canada) Ltd -> Tracker Software Products Ltd.)
FF Plugin-x32: @docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf -> C:\Program Files\Tracker Software\PDF Viewer\Win32\npPDFXCviewNPPlugin.dll [1999-12-31] (Tracker Software Products (Canada) Ltd -> Tracker Software Products Ltd.)
FF Plugin-x32: @microsoft.com/Lync,version=15.0 -> C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesX86\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll [2019-04-05] (Microsoft Corporation -> Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files (x86)\Microsoft Office\root\Office16\NPSPWRAP.DLL [2019-04-05] (Microsoft Corporation -> Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3528.0331 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2014-03-31] (Microsoft Corporation -> Microsoft Corporation)
FF Plugin HKU\S-1-5-21-4144462506-2486898719-981058799-1001: @docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf -> C:\Program Files\Tracker Software\PDF Viewer\Win32\npPDFXCviewNPPlugin.dll [1999-12-31] (Tracker Software Products (Canada) Ltd -> Tracker Software Products Ltd.)
Opera:
=======
OPR Extension: (Translator) - C:\Users\Karlíkxy\AppData\Roaming\Opera Software\Opera Stable\Extensions\cnbpedcoekjafichoehopgaaldogogch [2019-08-09]
OPR Extension: (uBlock Origin) - C:\Users\Karlíkxy\AppData\Roaming\Opera Software\Opera Stable\Extensions\kccohkcpppjjkkjppopfnflnebibpida [2019-08-09]
==================== Services (Whitelisted) ====================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
R2 AGMService; C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGMService.exe [3117648 2019-07-04] (Adobe Inc. -> Adobe Systems, Incorporated)
R2 AGSService; C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGSService.exe [2888272 2019-07-04] (Adobe Inc. -> Adobe Systems, Incorporated)
R2 ClickToRunSvc; C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe [11469920 2019-07-26] (Microsoft Corporation -> Microsoft Corporation)
R2 dlpsrv; C:\Program Files\ESET\ESET Secure Data\dlpsrv.exe [542400 2017-11-02] (DESlock Limited -> DESlock Limited.)
R2 ekrn; C:\Program Files\ESET\ESET Security\ekrn.exe [2428848 2019-07-21] (ESET, spol. s r.o. -> ESET)
R2 HuaweiHiSuiteService64.exe; C:\Program Files (x86)\HiSuite\HandSetService\HuaweiHiSuiteService64.exe [190784 2018-12-12] (Huawei Technologies Co., Ltd. -> ) [File not signed]
S3 MBAMService; C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe [6347056 2018-09-19] (Malwarebytes Corporation -> Malwarebytes)
S2 Net Driver HPZ12; C:\Windows\System32\HPZinw12.dll [71680 2010-08-06] (Hewlett-Packard) [File not signed]
S2 Pml Driver HPZ12; C:\Windows\System32\HPZipm12.dll [89600 2010-08-06] (Hewlett-Packard) [File not signed]
S3 Sense; C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe [5356848 2019-07-09] (Microsoft Windows Publisher -> Microsoft Corporation)
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [3831576 2019-06-14] (Microsoft Corporation -> Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [110944 2018-09-15] (Microsoft Corporation -> Microsoft Corporation)
R2 Winstep Xtreme Service; C:\Program Files (x86)\Winstep\WsxService.exe [775680 2018-06-06] (Winstep Software Technologies) [File not signed]
R2 NVDisplay.ContainerLocalSystem; "C:\Program Files\NVIDIA Corporation\Display.NvContainer\NVDisplay.Container.exe" -s NVDisplay.ContainerLocalSystem -f "C:\ProgramData\NVIDIA\NVDisplay.ContainerLocalSystem.log" -l 3 -d "C:\Program Files\NVIDIA Corporation\Display.NvContainer\plugins\LocalSystem" -r -p 30000
R2 NvTelemetryContainer; "C:\Program Files (x86)\NVIDIA Corporation\NvTelemetry\NvTelemetryContainer.exe" -s NvTelemetryContainer -f "C:\ProgramData\NVIDIA\NvTelemetryContainer.log" -l 3 -d "C:\Program Files (x86)\NVIDIA Corporation\NvTelemetry\plugins" -r
===================== Drivers (Whitelisted) ======================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
R0 amdide64; C:\WINDOWS\System32\drivers\amdide64.sys [13848 2019-04-11] (Microsoft Windows Hardware Compatibility Publisher -> Advanced Micro Devices Inc.)
R0 DLMFENC; C:\WINDOWS\System32\DRIVERS\DLMFENC.sys [174152 2018-02-27] (DESlock Limited -> DESlock Ltd.)
R0 DLPCRYPT; C:\WINDOWS\System32\DRIVERS\dlpcrypt.sys [121728 2017-11-02] (DESlock Limited -> DESlock Ltd.)
R0 dlpvdisk; C:\WINDOWS\System32\DRIVERS\dlpvdisk.sys [98296 2017-11-02] (DESlock Limited -> DESlock Ltd.)
S3 dot4; C:\WINDOWS\system32\DRIVERS\Dot4.sys [151968 2012-10-19] (Hewlett-Packard Company -> Windows (R) Win 7 DDK provider)
S3 Dot4Print; C:\WINDOWS\System32\drivers\Dot4Prt.sys [27040 2012-10-19] (Hewlett-Packard Company -> Windows (R) Win 7 DDK provider)
S3 dot4usb; C:\WINDOWS\system32\DRIVERS\dot4usb.sys [49056 2012-10-19] (Hewlett-Packard Company -> Microsoft Corporation)
R1 eamonm; C:\WINDOWS\System32\DRIVERS\eamonm.sys [149144 2019-07-21] (ESET, spol. s r.o. -> ESET)
R0 edevmon; C:\WINDOWS\System32\DRIVERS\edevmon.sys [102464 2019-07-21] (ESET, spol. s r.o. -> ESET)
S0 eelam; C:\WINDOWS\System32\DRIVERS\eelam.sys [15800 2019-06-05] (Microsoft Windows Early Launch Anti-malware Publisher -> ESET)
R1 ehdrv; C:\WINDOWS\system32\DRIVERS\ehdrv.sys [189232 2019-07-21] (ESET, spol. s r.o. -> ESET)
R2 ekbdflt; C:\WINDOWS\system32\DRIVERS\ekbdflt.sys [50488 2019-07-21] (ESET, spol. s r.o. -> ESET)
R1 epfw; C:\WINDOWS\system32\DRIVERS\epfw.sys [76896 2019-07-21] (ESET, spol. s r.o. -> ESET)
R1 epfwwfp; C:\WINDOWS\system32\DRIVERS\epfwwfp.sys [113336 2019-07-21] (ESET, spol. s r.o. -> ESET)
S3 ew_usbccgpfilter; C:\WINDOWS\System32\drivers\ew_usbccgpfilter.sys [18944 2018-12-12] (Microsoft Windows Hardware Compatibility Publisher -> Huawei Technologies Co., Ltd.)
S3 gdrv; C:\WINDOWS\gdrv.sys [26192 2019-04-27] (Giga-Byte Technology -> Windows (R) Server 2003 DDK provider)
R1 HWiNFO32; C:\WINDOWS\SysWOW64\drivers\HWiNFO64A.SYS [27552 2019-04-11] (Martin Malik - REALiX -> REALiX(tm))
U5 hw_usbdev; C:\Windows\System32\Drivers\hw_usbdev.sys [116864 2018-12-12] (Microsoft Windows Hardware Compatibility Publisher -> Huawei Technologies Co., Ltd.)
R3 nvlddmkm; C:\WINDOWS\System32\DriverStore\FileRepository\nv_dispi.inf_amd64_7a8e74171e1b8492\nvlddmkm.sys [20736208 2019-04-11] (NVIDIA Corporation -> NVIDIA Corporation)
R3 rt640x64; C:\WINDOWS\System32\drivers\rt640x64.sys [1138136 2019-04-11] (Realtek Semiconductor Corp. -> Realtek )
S3 RTSUER; C:\WINDOWS\system32\Drivers\RtsUer.sys [452008 2019-04-07] (Realtek Semiconductor Corp. -> Realsil Semiconductor Corporation)
R0 VDLPToken2; C:\WINDOWS\System32\DRIVERS\vdlptkn2.sys [135672 2017-11-02] (DESlock Limited -> DESlock Ltd.)
S3 WdBoot; C:\WINDOWS\system32\drivers\WdBoot.sys [46584 2018-09-15] (Microsoft Windows Early Launch Anti-malware Publisher -> Microsoft Corporation)
S3 WdFilter; C:\WINDOWS\system32\drivers\WdFilter.sys [340008 2018-09-15] (Microsoft Windows -> Microsoft Corporation)
S3 wdm_usb; C:\WINDOWS\system32\DRIVERS\usb2ser.sys [155632 2015-08-07] (Gionee Communication Equipment Co.Ltd.Shenzhen -> MBB)
S3 WdNisDrv; C:\WINDOWS\System32\Drivers\WdNisDrv.sys [61992 2018-09-15] (Microsoft Windows -> Microsoft Corporation)
R1 ZAM_Guard; C:\WINDOWS\System32\drivers\zamguard64.sys [203680 2018-05-07] (Zemana Ltd. -> Zemana Ltd.)
==================== NetSvcs (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
==================== One month (created) ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2019-08-09 21:58 - 2019-08-09 21:59 - 000000000 ____D C:\FRST
2019-08-09 21:57 - 2019-08-09 21:59 - 000000000 ____D C:\Users\Karlíkxy\Desktop\Nová složka
2019-08-09 19:51 - 2019-08-09 19:52 - 000000000 ____D C:\Users\Karlíkxy\Desktop\Bíle ikony
2019-08-09 19:50 - 2019-08-09 20:41 - 000000000 ____D C:\Users\Karlíkxy\Desktop\Black grei
2019-08-09 18:45 - 2019-08-09 18:45 - 000000000 ____D C:\Users\Karlíkxy\AppData\Local\CEF
2019-08-02 23:18 - 2019-08-02 23:22 - 000000000 ____D C:\Users\Karlíkxy\Desktop\kniha
2019-08-02 21:31 - 2019-08-02 21:31 - 000002559 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\OneNote 2016.lnk
2019-08-02 21:31 - 2019-08-02 21:31 - 000002553 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Word.lnk
2019-08-02 21:31 - 2019-08-02 21:31 - 000002530 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PowerPoint.lnk
2019-08-02 21:31 - 2019-08-02 21:31 - 000002525 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Excel.lnk
2019-08-02 21:31 - 2019-08-02 21:31 - 000002518 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype pro firmy.lnk
2019-08-02 21:31 - 2019-08-02 21:31 - 000002486 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Access.lnk
2019-08-02 21:31 - 2019-08-02 21:31 - 000002451 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Outlook.lnk
2019-08-02 21:31 - 2019-08-02 21:31 - 000002447 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Publisher.lnk
2019-08-02 21:31 - 2019-08-02 21:31 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Nástroje Microsoft Office
2019-08-02 21:30 - 2019-08-02 21:30 - 000212992 _____ C:\WINDOWS\system32\ClickToRun_Pipeline16
==================== One month (modified) ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2019-08-09 21:59 - 2018-05-07 12:29 - 000766861 _____ C:\WINDOWS\ZAM_Guard.krnl.trace
2019-08-09 21:58 - 2017-03-17 12:45 - 000000000 ____D C:\Users\Karlíkxy\AppData\LocalLow\Mozilla
2019-08-09 21:56 - 2018-10-13 20:01 - 000000000 ____D C:\Users\Karlíkxy\AppData\Roaming\uTorrent
2019-08-09 21:56 - 2017-12-10 11:59 - 000000000 ____D C:\Users\Karlíkxy\AppData\Local\CrashDumps
2019-08-09 21:32 - 2019-02-09 13:30 - 000000000 ____D C:\WINDOWS\system32\SleepStudy
2019-08-09 20:14 - 2019-06-05 12:16 - 000000000 ____D C:\Users\Karlíkxy\AppData\Roaming\Dream Aquarium
2019-08-09 19:25 - 2018-07-04 12:06 - 000000000 ____D C:\Users\Karlíkxy\Documents\American Truck Simulator
2019-08-09 19:11 - 2019-06-14 11:10 - 000000000 ____D C:\Users\Karlíkxy\Documents\Euro Truck Simulator 2
2019-08-09 19:11 - 2017-03-17 13:30 - 000000000 ____D C:\Program Files (x86)\Steam
2019-08-09 17:00 - 2018-09-15 09:33 - 000000000 ____D C:\ProgramData\regid.1991-06.com.microsoft
2019-08-09 15:43 - 2018-05-07 12:05 - 000000000 ____D C:\Users\Karlíkxy\AppData\Local\ConnectedDevicesPlatform
2019-08-09 15:33 - 2017-03-17 15:10 - 000000000 ____D C:\Games
2019-08-09 15:32 - 2018-03-27 17:15 - 000000000 ____D C:\Users\Karlíkxy\AppData\Roaming\Wargaming.net
2019-08-09 15:26 - 2018-05-19 21:17 - 000000000 ____D C:\Users\Karlíkxy\AppData\Local\D3DSCache
2019-08-09 15:17 - 2019-05-04 23:20 - 000004188 _____ C:\WINDOWS\System32\Tasks\Opera scheduled Autoupdate 1557004838
2019-08-09 15:17 - 2019-05-04 23:20 - 000001456 _____ C:\Users\Karlíkxy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Prohlížeč Opera.lnk
2019-08-09 15:17 - 2018-09-15 09:33 - 000000000 ___HD C:\Program Files\WindowsApps
2019-08-09 15:17 - 2018-09-15 09:33 - 000000000 ____D C:\WINDOWS\AppReadiness
2019-08-07 19:42 - 2017-04-16 17:20 - 000000000 ____D C:\ProgramData\NVIDIA
2019-08-07 19:17 - 2018-03-10 00:48 - 000000000 ____D C:\Users\Karlíkxy\AppData\Roaming\vlc
2019-08-02 21:30 - 2018-07-13 18:03 - 000000000 ____D C:\Program Files (x86)\Microsoft Office
2019-07-30 18:58 - 2019-06-11 20:38 - 000000000 ____D C:\Users\Karlíkxy\Desktop\NIKON Foto
2019-07-24 14:45 - 2019-01-20 10:47 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
2019-07-21 21:06 - 2019-02-09 13:48 - 001693636 _____ C:\WINDOWS\system32\PerfStringBackup.INI
2019-07-21 21:06 - 2018-09-15 19:39 - 000716776 _____ C:\WINDOWS\system32\perfh005.dat
2019-07-21 21:06 - 2018-09-15 19:39 - 000144856 _____ C:\WINDOWS\system32\perfc005.dat
2019-07-21 21:06 - 2018-09-15 09:31 - 000000000 ____D C:\WINDOWS\INF
2019-07-21 20:59 - 2019-02-09 13:52 - 000000006 ____H C:\WINDOWS\Tasks\SA.DAT
2019-07-21 20:59 - 2017-03-17 12:45 - 000000000 ____D C:\Program Files (x86)\Mozilla Firefox
2019-07-21 20:58 - 2018-09-15 08:09 - 000262144 _____ C:\WINDOWS\system32\config\BBI
2019-07-21 20:58 - 2017-10-18 17:36 - 000189232 _____ (ESET) C:\WINDOWS\system32\Drivers\ehdrv.sys
2019-07-21 20:58 - 2017-10-18 17:36 - 000149144 _____ (ESET) C:\WINDOWS\system32\Drivers\eamonm.sys
2019-07-21 20:58 - 2017-10-18 17:36 - 000113336 _____ (ESET) C:\WINDOWS\system32\Drivers\epfwwfp.sys
2019-07-21 20:58 - 2017-10-18 17:36 - 000102464 _____ (ESET) C:\WINDOWS\system32\Drivers\edevmon.sys
2019-07-21 20:58 - 2017-10-18 17:36 - 000076896 _____ (ESET) C:\WINDOWS\system32\Drivers\epfw.sys
2019-07-21 20:58 - 2017-10-18 17:36 - 000050488 _____ (ESET) C:\WINDOWS\system32\Drivers\ekbdflt.sys
2019-07-19 21:40 - 2017-03-20 21:23 - 000001228 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Firefox.lnk
2019-07-13 23:56 - 2018-02-02 21:52 - 000000000 ___RD C:\Users\Karlíkxy\Desktop\Bordel z plochy
2019-07-13 10:32 - 2019-04-06 11:50 - 000000000 ____D C:\Users\Karlíkxy\Documents\Wondershare Filmora 9
2019-07-13 10:32 - 2019-04-06 11:50 - 000000000 ____D C:\ProgramData\Wondershare Filmora
==================== Files in the root of some directories ================
2018-02-10 22:18 - 2018-02-10 22:18 - 000099384 _____ () C:\Users\Karlíkxy\AppData\Roaming\inst.exe
2018-02-10 22:18 - 2018-02-10 22:18 - 000007859 _____ () C:\Users\Karlíkxy\AppData\Roaming\pcouffin.cat
2018-02-10 22:18 - 2018-02-10 22:18 - 000001167 _____ () C:\Users\Karlíkxy\AppData\Roaming\pcouffin.inf
2018-02-10 22:18 - 2018-02-10 22:18 - 000000055 _____ () C:\Users\Karlíkxy\AppData\Roaming\pcouffin.log
2018-02-10 22:18 - 2018-02-10 22:18 - 000082816 _____ (VSO Software) C:\Users\Karlíkxy\AppData\Roaming\pcouffin.sys
2019-03-28 19:04 - 2019-03-28 19:04 - 000000208 _____ () C:\Users\Karlíkxy\AppData\Roaming\VELKEJPC.MTBF.txt
2019-03-28 19:05 - 2019-03-28 19:05 - 000003584 _____ () C:\Users\Karlíkxy\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2017-07-26 15:40 - 2017-07-26 15:40 - 000000017 _____ () C:\Users\Karlíkxy\AppData\Local\resmon.resmoncfg
==================== SigCheck ===============================
(There is no automatic fix for files that do not pass verification.)
==================== End of FRST.txt ============================
Ran by Karlíkxy (administrator) on VELKEJPC (Gigabyte Technology Co., Ltd. GA-MA770T-UD3) (09-08-2019 21:59:08)
Running from C:\Users\Karlíkxy\Desktop\Nová složka
Loaded Profiles: Karlíkxy (Available Profiles: Karlíkxy)
Platform: Windows 10 Pro Version 1809 17763.615 (X64) Language: Čeština (Česko)
Default browser: FF
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/33 ... scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(Adobe Inc. -> Adobe Systems, Incorporated) C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGMService.exe
(Adobe Inc. -> Adobe Systems, Incorporated) C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGSService.exe
(DESlock Limited -> DESlock Limited.) C:\Program Files\ESET\ESET Secure Data\dlpsrv.exe
(ESET, spol. s r.o. -> ESET) C:\Program Files\ESET\ESET Security\eguiProxy.exe
(ESET, spol. s r.o. -> ESET) C:\Program Files\ESET\ESET Security\ekrn.exe
(Huawei Technologies Co., Ltd. -> ) [File not signed] C:\Program Files (x86)\HiSuite\HandSetService\HuaweiHiSuiteService64.exe
(Microsoft Corporation -> Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
(Microsoft Corporation -> Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe
(Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\smartscreen.exe
(Microsoft Windows Publisher -> Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe
(Microsoft Windows Publisher -> Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe
(NVIDIA Corporation -> NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NvTelemetry\NvTelemetryContainer.exe
(NVIDIA Corporation -> NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display.NvContainer\NVDisplay.Container.exe
(NVIDIA Corporation -> NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display.NvContainer\NVDisplay.Container.exe
(Realtek Semiconductor Corp. -> Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Skype Software Sarl -> Skype Technologies S.A.) C:\Program Files (x86)\Microsoft\Skype for Desktop\Skype.exe
(Skype Software Sarl -> Skype Technologies S.A.) C:\Program Files (x86)\Microsoft\Skype for Desktop\Skype.exe
(Skype Software Sarl -> Skype Technologies S.A.) C:\Program Files (x86)\Microsoft\Skype for Desktop\Skype.exe
(Skype Software Sarl -> Skype Technologies S.A.) C:\Program Files (x86)\Microsoft\Skype for Desktop\Skype.exe
(TomTom International BV -> TomTom) C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe
(Valve -> Valve Corporation) C:\Program Files (x86)\Common Files\Steam\SteamService.exe
(Valve -> Valve Corporation) C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe
(Valve -> Valve Corporation) C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe
(Valve -> Valve Corporation) C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe
(Valve -> Valve Corporation) C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe
(Valve -> Valve Corporation) C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe
(Valve -> Valve Corporation) C:\Program Files (x86)\Steam\Steam.exe
(Winstep Software Technologies) [File not signed] C:\Program Files (x86)\Winstep\Nexus.exe
(Winstep Software Technologies) [File not signed] C:\Program Files (x86)\Winstep\WsxService.exe
==================== Registry (Whitelisted) ===========================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [AdobeAAMUpdater-1.0] => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [508128 2016-07-01] (Adobe Systems Incorporated -> Adobe Systems Incorporated)
HKLM\...\Run: [egui] => C:\Program Files\ESET\ESET Security\ecmdS.exe [180448 2019-07-21] (ESET, spol. s r.o. -> ESET)
HKLM\...\Run: [AdobeGCInvoker-1.0] => C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGCInvokerUtility.exe [2849872 2019-07-04] (Adobe Inc. -> Adobe Systems, Incorporated)
HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [18391120 2019-04-11] (Realtek Semiconductor Corp. -> Realtek Semiconductor)
HKLM-x32\...\Run: [VICTORY Gaming Keyboard] => C:\Program Files (x86)\Gaming Keyboard\Monitor.exe [270336 2013-11-11] () [File not signed]
HKLM-x32\...\Run: [HP Software Update] => C:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe [96056 2013-05-30] (Hewlett-Packard Company -> Hewlett-Packard)
HKLM-x32\...\Run: [Wondershare Helper Compact.exe] => C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe [2133728 2017-09-12] (Wondershare Technology Co.,Ltd -> Wondershare)
HKU\S-1-5-21-4144462506-2486898719-981058799-1001\...\Run: [EsetPasswordManager] => C:\Program Files\ESET\ESET Password Manager\pwm.exe [113648 2019-04-29] (Lamantine Software a.s. -> ESET)
HKU\S-1-5-21-4144462506-2486898719-981058799-1001\...\Run: [Skype for Desktop] => C:\Program Files (x86)\Microsoft\Skype for Desktop\Skype.exe [53646904 2019-07-18] (Skype Software Sarl -> Skype Technologies S.A.)
HKU\S-1-5-21-4144462506-2486898719-981058799-1001\...\Run: [Nexus] => C:\Program Files (x86)\Winstep\Nexus.exe [17959552 2019-03-01] (Winstep Software Technologies) [File not signed]
HKU\S-1-5-21-4144462506-2486898719-981058799-1001\...\Run: [Zoner Photo Studio Autoupdate] => C:\Program Files\Zoner\Photo Studio 19\Program32\ZPSTRAY.EXE [604128 2018-11-01] (ZONER software, a.s. -> ZONER software)
HKU\S-1-5-21-4144462506-2486898719-981058799-1001\...\MountPoints2: {6bc1cec3-3048-11e9-8543-1c6f658aab67} - "G:\HiSuiteDownLoader.exe"
HKU\S-1-5-21-4144462506-2486898719-981058799-1001\...\MountPoints2: {df940eb5-9c28-11e9-8564-1c6f658aab67} - "F:\Setup.exe"
HKU\S-1-5-21-4144462506-2486898719-981058799-1001\...\MountPoints2: {df940f8a-9c28-11e9-8564-1c6f658aab67} - "F:\Setup.exe"
HKU\S-1-5-21-4144462506-2486898719-981058799-1001\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\WINDOWS\DREAMA~1.SCR [141312 2018-01-14] () [File not signed]
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk [2017-05-15]
ShortcutTarget: HP Digital Imaging Monitor.lnk -> C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe (Hewlett Packard -> Hewlett-Packard Co.)
GroupPolicy: Restriction ? <==== ATTENTION
==================== Scheduled Tasks (Whitelisted) =============
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
Task: {1362D4B2-119F-4D89-BB22-CFFC79D30111} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentLogOn2016 => C:\Program Files (x86)\Microsoft Office\root\Office16\msoia.exe [4519576 2019-08-02] (Microsoft Corporation -> Microsoft Corporation)
Task: {1B4B14F6-0646-4409-A65F-239C12FAA5F5} - System32\Tasks\NvTmRep_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvTmRep.exe [746056 2018-01-10] (NVIDIA Corporation -> NVIDIA Corporation)
Task: {401A4F49-C2AE-4AA9-9038-55EA9D055483} - System32\Tasks\Microsoft\Office\Office Feature Updates => C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\sdxhelper.exe [114736 2019-08-02] (Microsoft Corporation -> Microsoft Corporation)
Task: {5296E58E-6D54-4666-AA35-D66D2CC5D826} - System32\Tasks\Microsoft\Office\Office Automatic Updates 2.0 => C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe [27351864 2019-07-26] (Microsoft Corporation -> Microsoft Corporation)
Task: {5906DD94-AC24-4EDF-A907-A70E82417D89} - System32\Tasks\AdobeGCInvoker-1.0-VELKEJPC-Karlíkxy => C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGCInvokerUtility.exe [2849872 2019-07-04] (Adobe Inc. -> Adobe Systems, Incorporated)
Task: {62E336EF-2760-4806-8CF4-E8C8079F51B9} - System32\Tasks\Microsoft\Office\OfficeBackgroundTaskHandlerRegistration => C:\Program Files (x86)\Microsoft Office\root\Office16\officebackgroundtaskhandler.exe [1447064 2019-08-02] (Microsoft Corporation -> Microsoft Corporation)
Task: {64183814-E2EF-41F9-BB4A-94E6912C34B0} - \Microsoft\Windows\UNP\RunCampaignManager -> No File <==== ATTENTION
Task: {80AB00B5-53D6-4FDE-AE49-D3469867C000} - System32\Tasks\Microsoft\Office\Office ClickToRun Service Monitor => C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe [27351864 2019-07-26] (Microsoft Corporation -> Microsoft Corporation)
Task: {8E0836A4-FE9A-40BD-9744-7F0706C5447C} - System32\Tasks\Microsoft\Office\OfficeBackgroundTaskHandlerLogon => C:\Program Files (x86)\Microsoft Office\root\Office16\officebackgroundtaskhandler.exe [1447064 2019-08-02] (Microsoft Corporation -> Microsoft Corporation)
Task: {A110620B-FDDB-455B-B1E0-CC7047CFA86E} - System32\Tasks\NvTmRepOnLogon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvTmRep.exe [746056 2018-01-10] (NVIDIA Corporation -> NVIDIA Corporation)
Task: {A5834D3B-067C-4770-92F5-B87AC00C36F0} - System32\Tasks\Opera scheduled Autoupdate 1557004838 => C:\Users\Karlíkxy\AppData\Local\Programs\Opera\launcher.exe [1348120 2019-08-07] (Opera Software AS -> Opera Software)
Task: {ADB774B2-A85A-40FD-B267-4D55D0FC7C49} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentFallBack2016 => C:\Program Files (x86)\Microsoft Office\root\Office16\msoia.exe [4519576 2019-08-02] (Microsoft Corporation -> Microsoft Corporation)
Task: {B7D34523-3F35-42A6-81A0-2F5C5C9C8FBB} - System32\Tasks\Microsoft\Office\Office Feature Updates Logon => C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\sdxhelper.exe [114736 2019-08-02] (Microsoft Corporation -> Microsoft Corporation)
Task: {CA4BBF4E-79AF-42CC-BF56-3AC51F1ADEE5} - System32\Tasks\NvProfileUpdaterOnLogon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files\NVIDIA Corporation\Update Core\NvProfileUpdater64.exe [660040 2018-01-10] (NVIDIA Corporation -> NVIDIA Corporation)
Task: {D5691FF7-C0E9-4B7C-AC9C-79CBFA6C2DFF} - System32\Tasks\RogueKiller Anti-Malware => C:\Users\Karlíkxy\Desktop\RogueKiller_portable64.exe
Task: {E7E0A54E-FEAD-4B2E-9848-FD58754EDBE4} - System32\Tasks\NvTmMon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvTmMon.exe [524360 2018-01-10] (NVIDIA Corporation -> NVIDIA Corporation)
Task: {EE8BBE94-B545-4568-9BE0-39BF260A8A13} - System32\Tasks\Microsoft\Windows Live\SOXE\Extractor Definitions Update Task => {3519154C-227E-47F3-9CC9-12C3F05817F1}
Task: {F0FE289A-9FD9-4D0B-ADEE-6D92C3908F8A} - System32\Tasks\NvProfileUpdaterDaily_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files\NVIDIA Corporation\Update Core\NvProfileUpdater64.exe [660040 2018-01-10] (NVIDIA Corporation -> NVIDIA Corporation)
(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.100.1
Tcpip\..\Interfaces\{c6eac970-e2c8-4318-998b-1c9e3e635683}: [DhcpNameServer] 192.168.100.1
Internet Explorer:
==================
SearchScopes: HKU\S-1-5-21-4144462506-2486898719-981058799-1001 -> {012E1000-F331-11DB-8314-0800200C9A66} URL = hxxp://www.google.com/search?q={searchTerms}
BHO: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesX64\Microsoft Office\Office16\OCHelper.dll [2019-06-26] (Microsoft Corporation -> Microsoft Corporation)
BHO-x32: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files (x86)\Microsoft Office\root\Office16\OCHelper.dll [2019-04-05] (Microsoft Corporation -> Microsoft Corporation)
Handler-x32: mso-minsb-roaming.16 - {83C25742-A9F7-49FB-9138-434302C88D07} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2019-08-02] (Microsoft Corporation -> Microsoft Corporation)
Handler-x32: mso-minsb.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2019-08-02] (Microsoft Corporation -> Microsoft Corporation)
Handler-x32: osf-roaming.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2019-08-02] (Microsoft Corporation -> Microsoft Corporation)
Handler-x32: osf.16 - {5504BE45-A83B-4808-900A-3A5C36E7F77A} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2019-08-02] (Microsoft Corporation -> Microsoft Corporation)
FireFox:
========
FF DefaultProfile: kmapm4jw.default
FF ProfilePath: C:\Users\Karlíkxy\AppData\Roaming\TomTom\HOME\Profiles\eq9k5pmv.default [2019-05-05]
FF Homepage: TomTom\HOME\Profiles\eq9k5pmv.default -> about:home
FF NewTab: TomTom\HOME\Profiles\eq9k5pmv.default -> about:newtab
FF Extension: (RenaultTheme) - C:\Users\Karlíkxy\AppData\Roaming\TomTom\HOME\Profiles\eq9k5pmv.default\Extensions\RenaultTheme@tomtom.com [2019-03-14] [Legacy] [not signed]
FF Extension: (Map status indicator) - C:\Program Files (x86)\TomTom HOME 2\xul\extensions\MapShare-status@tomtom.com [2019-03-23] [Legacy] [not signed]
FF ProfilePath: C:\Users\Karlíkxy\AppData\Roaming\Mozilla\Firefox\Profiles\kmapm4jw.default [2019-08-09]
FF Homepage: Mozilla\Firefox\Profiles\kmapm4jw.default -> hxxps://www.seznam.cz/
FF NewTab: Mozilla\Firefox\Profiles\kmapm4jw.default -> about:newtab
FF NewTabOverride: Mozilla\Firefox\Profiles\kmapm4jw.default -> Disabled: admin@fastaddons.com_GroupSpeedDial
FF NewTabOverride: Mozilla\Firefox\Profiles\kmapm4jw.default -> Disabled: pavel.sherbakov@gmail.com
FF NewTabOverride: Mozilla\Firefox\Profiles\kmapm4jw.default -> Disabled: quickdial@matmoul.com
FF NewTabOverride: Mozilla\Firefox\Profiles\kmapm4jw.default -> Disabled: {0a79bc58-665f-4534-a7ea-6d61d68194fb}
FF Extension: (AdGuard AdBlocker) - C:\Users\Karlíkxy\AppData\Roaming\Mozilla\Firefox\Profiles\kmapm4jw.default\Extensions\adguardadblocker@adguard.com.xpi [2019-07-04]
FF Extension: (Český slovník pro kontrolu pravopisu) - C:\Users\Karlíkxy\AppData\Roaming\Mozilla\Firefox\Profiles\kmapm4jw.default\Extensions\cs@dictionaries.addons.mozilla.org.xpi [2019-01-05]
FF Extension: (Google Translator for Firefox) - C:\Users\Karlíkxy\AppData\Roaming\Mozilla\Firefox\Profiles\kmapm4jw.default\Extensions\translator@zoli.bod.xpi [2019-05-07]
FF Extension: (Blue Flower Vine by M♥Donna) - C:\Users\Karlíkxy\AppData\Roaming\Mozilla\Firefox\Profiles\kmapm4jw.default\Extensions\{04001c8a-6eff-4659-9196-0a552edd725a}.xpi [2019-05-11]
FF Extension: (tranquil blue) - C:\Users\Karlíkxy\AppData\Roaming\Mozilla\Firefox\Profiles\kmapm4jw.default\Extensions\{0d1802ae-eebf-4526-855b-1879b45e66cb}.xpi [2019-05-14]
FF Extension: (Ship in Lighthouse Reflection) - C:\Users\Karlíkxy\AppData\Roaming\Mozilla\Firefox\Profiles\kmapm4jw.default\Extensions\{2db9f8d0-ee99-4d57-a581-2722da1b573d}.xpi [2019-05-07]
FF Extension: (Dark Cubes) - C:\Users\Karlíkxy\AppData\Roaming\Mozilla\Firefox\Profiles\kmapm4jw.default\Extensions\{2dbb0302-0a64-4964-bb64-d157474dd324}.xpi [2019-05-14]
FF Extension: (Animated A Toon Town Christmas) - C:\Users\Karlíkxy\AppData\Roaming\Mozilla\Firefox\Profiles\kmapm4jw.default\Extensions\{328c92e1-1e11-4985-a74e-96aa60d8d243}.xpi [2019-05-14]
FF Extension: (Google Translate (In Page Translate)) - C:\Users\Karlíkxy\AppData\Roaming\Mozilla\Firefox\Profiles\kmapm4jw.default\Extensions\{3d09bd90-da37-41b5-a719-8da173e9870f}.xpi [2019-06-30]
FF Extension: (Deep Dark Blue Forest) - C:\Users\Karlíkxy\AppData\Roaming\Mozilla\Firefox\Profiles\kmapm4jw.default\Extensions\{5db58b6b-6fbc-4be3-b48d-e536ac711a10}.xpi [2019-05-14]
FF Extension: (Tv Firefox) - C:\Users\Karlíkxy\AppData\Roaming\Mozilla\Firefox\Profiles\kmapm4jw.default\Extensions\{6eafd633-df99-4fc0-a515-039ba8f8f253}.xpi [2019-05-14]
FF Extension: (FFX Developer) - C:\Users\Karlíkxy\AppData\Roaming\Mozilla\Firefox\Profiles\kmapm4jw.default\Extensions\{73574968-e44d-401e-8477-43882b7c9f22}.xpi [2019-05-14]
FF Extension: (Fox in the Clouds) - C:\Users\Karlíkxy\AppData\Roaming\Mozilla\Firefox\Profiles\kmapm4jw.default\Extensions\{aa842ed2-c0e8-4238-a894-c71e5bb2e97d}.xpi [2019-05-14]
FF Extension: (esafox) - C:\Users\Karlíkxy\AppData\Roaming\Mozilla\Firefox\Profiles\kmapm4jw.default\Extensions\{b526b65f-3165-4dcc-a534-3474d1de766b}.xpi [2019-05-14]
FF Extension: (FamousFox) - C:\Users\Karlíkxy\AppData\Roaming\Mozilla\Firefox\Profiles\kmapm4jw.default\Extensions\{bbf9b829-01fb-4406-8200-7622ed399df5}.xpi [2019-05-14]
FF Extension: (лиса) - C:\Users\Karlíkxy\AppData\Roaming\Mozilla\Firefox\Profiles\kmapm4jw.default\Extensions\{cdfd0c6c-8fc0-4565-ab49-fe3437600595}.xpi [2019-05-14]
FF Extension: (Grayfox) - C:\Users\Karlíkxy\AppData\Roaming\Mozilla\Firefox\Profiles\kmapm4jw.default\Extensions\{ceb971ca-37e6-4c49-ab6e-1d1a97a1eb8c}.xpi [2019-05-14]
FF Extension: (Winter Cabin Collage by M♥Donna) - C:\Users\Karlíkxy\AppData\Roaming\Mozilla\Firefox\Profiles\kmapm4jw.default\Extensions\{dba00d63-b5fe-4363-a4cf-e918ca9db46a}.xpi [2019-05-14]
FF Extension: (FirefoxClassicalBlue) - C:\Users\Karlíkxy\AppData\Roaming\Mozilla\Firefox\Profiles\kmapm4jw.default\Extensions\{dc4152a2-0127-4e36-aaf9-7a0ab4c46dc0}.xpi [2019-05-14]
FF Extension: (Dark Fox) - C:\Users\Karlíkxy\AppData\Roaming\Mozilla\Firefox\Profiles\kmapm4jw.default\Extensions\{e7fe4ffe-f256-4f85-906d-072fdd698585}.xpi [2019-05-14]
FF Extension: (Blue Flow) - C:\Users\Karlíkxy\AppData\Roaming\Mozilla\Firefox\Profiles\kmapm4jw.default\Extensions\{fb1fb250-2fd9-4f24-85ba-23dfcbf9f4e1}.xpi [2019-05-14]
FF Extension: (No Name) - C:\Users\Karlíkxy\AppData\Roaming\Mozilla\Firefox\Profiles\kmapm4jw.default\extensions\{ea614400-e918-4741-9a97-7a972ff7c30b} [not found]
FF Plugin: @docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf -> C:\Program Files\Tracker Software\PDF Viewer\npPDFXCviewNPPlugin.dll [1999-12-31] (Tracker Software Products (Canada) Ltd -> Tracker Software Products Ltd.)
FF Plugin-x32: @docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf -> C:\Program Files\Tracker Software\PDF Viewer\Win32\npPDFXCviewNPPlugin.dll [1999-12-31] (Tracker Software Products (Canada) Ltd -> Tracker Software Products Ltd.)
FF Plugin-x32: @microsoft.com/Lync,version=15.0 -> C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesX86\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll [2019-04-05] (Microsoft Corporation -> Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files (x86)\Microsoft Office\root\Office16\NPSPWRAP.DLL [2019-04-05] (Microsoft Corporation -> Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3528.0331 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2014-03-31] (Microsoft Corporation -> Microsoft Corporation)
FF Plugin HKU\S-1-5-21-4144462506-2486898719-981058799-1001: @docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf -> C:\Program Files\Tracker Software\PDF Viewer\Win32\npPDFXCviewNPPlugin.dll [1999-12-31] (Tracker Software Products (Canada) Ltd -> Tracker Software Products Ltd.)
Opera:
=======
OPR Extension: (Translator) - C:\Users\Karlíkxy\AppData\Roaming\Opera Software\Opera Stable\Extensions\cnbpedcoekjafichoehopgaaldogogch [2019-08-09]
OPR Extension: (uBlock Origin) - C:\Users\Karlíkxy\AppData\Roaming\Opera Software\Opera Stable\Extensions\kccohkcpppjjkkjppopfnflnebibpida [2019-08-09]
==================== Services (Whitelisted) ====================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
R2 AGMService; C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGMService.exe [3117648 2019-07-04] (Adobe Inc. -> Adobe Systems, Incorporated)
R2 AGSService; C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGSService.exe [2888272 2019-07-04] (Adobe Inc. -> Adobe Systems, Incorporated)
R2 ClickToRunSvc; C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe [11469920 2019-07-26] (Microsoft Corporation -> Microsoft Corporation)
R2 dlpsrv; C:\Program Files\ESET\ESET Secure Data\dlpsrv.exe [542400 2017-11-02] (DESlock Limited -> DESlock Limited.)
R2 ekrn; C:\Program Files\ESET\ESET Security\ekrn.exe [2428848 2019-07-21] (ESET, spol. s r.o. -> ESET)
R2 HuaweiHiSuiteService64.exe; C:\Program Files (x86)\HiSuite\HandSetService\HuaweiHiSuiteService64.exe [190784 2018-12-12] (Huawei Technologies Co., Ltd. -> ) [File not signed]
S3 MBAMService; C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe [6347056 2018-09-19] (Malwarebytes Corporation -> Malwarebytes)
S2 Net Driver HPZ12; C:\Windows\System32\HPZinw12.dll [71680 2010-08-06] (Hewlett-Packard) [File not signed]
S2 Pml Driver HPZ12; C:\Windows\System32\HPZipm12.dll [89600 2010-08-06] (Hewlett-Packard) [File not signed]
S3 Sense; C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe [5356848 2019-07-09] (Microsoft Windows Publisher -> Microsoft Corporation)
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [3831576 2019-06-14] (Microsoft Corporation -> Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [110944 2018-09-15] (Microsoft Corporation -> Microsoft Corporation)
R2 Winstep Xtreme Service; C:\Program Files (x86)\Winstep\WsxService.exe [775680 2018-06-06] (Winstep Software Technologies) [File not signed]
R2 NVDisplay.ContainerLocalSystem; "C:\Program Files\NVIDIA Corporation\Display.NvContainer\NVDisplay.Container.exe" -s NVDisplay.ContainerLocalSystem -f "C:\ProgramData\NVIDIA\NVDisplay.ContainerLocalSystem.log" -l 3 -d "C:\Program Files\NVIDIA Corporation\Display.NvContainer\plugins\LocalSystem" -r -p 30000
R2 NvTelemetryContainer; "C:\Program Files (x86)\NVIDIA Corporation\NvTelemetry\NvTelemetryContainer.exe" -s NvTelemetryContainer -f "C:\ProgramData\NVIDIA\NvTelemetryContainer.log" -l 3 -d "C:\Program Files (x86)\NVIDIA Corporation\NvTelemetry\plugins" -r
===================== Drivers (Whitelisted) ======================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
R0 amdide64; C:\WINDOWS\System32\drivers\amdide64.sys [13848 2019-04-11] (Microsoft Windows Hardware Compatibility Publisher -> Advanced Micro Devices Inc.)
R0 DLMFENC; C:\WINDOWS\System32\DRIVERS\DLMFENC.sys [174152 2018-02-27] (DESlock Limited -> DESlock Ltd.)
R0 DLPCRYPT; C:\WINDOWS\System32\DRIVERS\dlpcrypt.sys [121728 2017-11-02] (DESlock Limited -> DESlock Ltd.)
R0 dlpvdisk; C:\WINDOWS\System32\DRIVERS\dlpvdisk.sys [98296 2017-11-02] (DESlock Limited -> DESlock Ltd.)
S3 dot4; C:\WINDOWS\system32\DRIVERS\Dot4.sys [151968 2012-10-19] (Hewlett-Packard Company -> Windows (R) Win 7 DDK provider)
S3 Dot4Print; C:\WINDOWS\System32\drivers\Dot4Prt.sys [27040 2012-10-19] (Hewlett-Packard Company -> Windows (R) Win 7 DDK provider)
S3 dot4usb; C:\WINDOWS\system32\DRIVERS\dot4usb.sys [49056 2012-10-19] (Hewlett-Packard Company -> Microsoft Corporation)
R1 eamonm; C:\WINDOWS\System32\DRIVERS\eamonm.sys [149144 2019-07-21] (ESET, spol. s r.o. -> ESET)
R0 edevmon; C:\WINDOWS\System32\DRIVERS\edevmon.sys [102464 2019-07-21] (ESET, spol. s r.o. -> ESET)
S0 eelam; C:\WINDOWS\System32\DRIVERS\eelam.sys [15800 2019-06-05] (Microsoft Windows Early Launch Anti-malware Publisher -> ESET)
R1 ehdrv; C:\WINDOWS\system32\DRIVERS\ehdrv.sys [189232 2019-07-21] (ESET, spol. s r.o. -> ESET)
R2 ekbdflt; C:\WINDOWS\system32\DRIVERS\ekbdflt.sys [50488 2019-07-21] (ESET, spol. s r.o. -> ESET)
R1 epfw; C:\WINDOWS\system32\DRIVERS\epfw.sys [76896 2019-07-21] (ESET, spol. s r.o. -> ESET)
R1 epfwwfp; C:\WINDOWS\system32\DRIVERS\epfwwfp.sys [113336 2019-07-21] (ESET, spol. s r.o. -> ESET)
S3 ew_usbccgpfilter; C:\WINDOWS\System32\drivers\ew_usbccgpfilter.sys [18944 2018-12-12] (Microsoft Windows Hardware Compatibility Publisher -> Huawei Technologies Co., Ltd.)
S3 gdrv; C:\WINDOWS\gdrv.sys [26192 2019-04-27] (Giga-Byte Technology -> Windows (R) Server 2003 DDK provider)
R1 HWiNFO32; C:\WINDOWS\SysWOW64\drivers\HWiNFO64A.SYS [27552 2019-04-11] (Martin Malik - REALiX -> REALiX(tm))
U5 hw_usbdev; C:\Windows\System32\Drivers\hw_usbdev.sys [116864 2018-12-12] (Microsoft Windows Hardware Compatibility Publisher -> Huawei Technologies Co., Ltd.)
R3 nvlddmkm; C:\WINDOWS\System32\DriverStore\FileRepository\nv_dispi.inf_amd64_7a8e74171e1b8492\nvlddmkm.sys [20736208 2019-04-11] (NVIDIA Corporation -> NVIDIA Corporation)
R3 rt640x64; C:\WINDOWS\System32\drivers\rt640x64.sys [1138136 2019-04-11] (Realtek Semiconductor Corp. -> Realtek )
S3 RTSUER; C:\WINDOWS\system32\Drivers\RtsUer.sys [452008 2019-04-07] (Realtek Semiconductor Corp. -> Realsil Semiconductor Corporation)
R0 VDLPToken2; C:\WINDOWS\System32\DRIVERS\vdlptkn2.sys [135672 2017-11-02] (DESlock Limited -> DESlock Ltd.)
S3 WdBoot; C:\WINDOWS\system32\drivers\WdBoot.sys [46584 2018-09-15] (Microsoft Windows Early Launch Anti-malware Publisher -> Microsoft Corporation)
S3 WdFilter; C:\WINDOWS\system32\drivers\WdFilter.sys [340008 2018-09-15] (Microsoft Windows -> Microsoft Corporation)
S3 wdm_usb; C:\WINDOWS\system32\DRIVERS\usb2ser.sys [155632 2015-08-07] (Gionee Communication Equipment Co.Ltd.Shenzhen -> MBB)
S3 WdNisDrv; C:\WINDOWS\System32\Drivers\WdNisDrv.sys [61992 2018-09-15] (Microsoft Windows -> Microsoft Corporation)
R1 ZAM_Guard; C:\WINDOWS\System32\drivers\zamguard64.sys [203680 2018-05-07] (Zemana Ltd. -> Zemana Ltd.)
==================== NetSvcs (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
==================== One month (created) ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2019-08-09 21:58 - 2019-08-09 21:59 - 000000000 ____D C:\FRST
2019-08-09 21:57 - 2019-08-09 21:59 - 000000000 ____D C:\Users\Karlíkxy\Desktop\Nová složka
2019-08-09 19:51 - 2019-08-09 19:52 - 000000000 ____D C:\Users\Karlíkxy\Desktop\Bíle ikony
2019-08-09 19:50 - 2019-08-09 20:41 - 000000000 ____D C:\Users\Karlíkxy\Desktop\Black grei
2019-08-09 18:45 - 2019-08-09 18:45 - 000000000 ____D C:\Users\Karlíkxy\AppData\Local\CEF
2019-08-02 23:18 - 2019-08-02 23:22 - 000000000 ____D C:\Users\Karlíkxy\Desktop\kniha
2019-08-02 21:31 - 2019-08-02 21:31 - 000002559 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\OneNote 2016.lnk
2019-08-02 21:31 - 2019-08-02 21:31 - 000002553 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Word.lnk
2019-08-02 21:31 - 2019-08-02 21:31 - 000002530 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PowerPoint.lnk
2019-08-02 21:31 - 2019-08-02 21:31 - 000002525 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Excel.lnk
2019-08-02 21:31 - 2019-08-02 21:31 - 000002518 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype pro firmy.lnk
2019-08-02 21:31 - 2019-08-02 21:31 - 000002486 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Access.lnk
2019-08-02 21:31 - 2019-08-02 21:31 - 000002451 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Outlook.lnk
2019-08-02 21:31 - 2019-08-02 21:31 - 000002447 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Publisher.lnk
2019-08-02 21:31 - 2019-08-02 21:31 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Nástroje Microsoft Office
2019-08-02 21:30 - 2019-08-02 21:30 - 000212992 _____ C:\WINDOWS\system32\ClickToRun_Pipeline16
==================== One month (modified) ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2019-08-09 21:59 - 2018-05-07 12:29 - 000766861 _____ C:\WINDOWS\ZAM_Guard.krnl.trace
2019-08-09 21:58 - 2017-03-17 12:45 - 000000000 ____D C:\Users\Karlíkxy\AppData\LocalLow\Mozilla
2019-08-09 21:56 - 2018-10-13 20:01 - 000000000 ____D C:\Users\Karlíkxy\AppData\Roaming\uTorrent
2019-08-09 21:56 - 2017-12-10 11:59 - 000000000 ____D C:\Users\Karlíkxy\AppData\Local\CrashDumps
2019-08-09 21:32 - 2019-02-09 13:30 - 000000000 ____D C:\WINDOWS\system32\SleepStudy
2019-08-09 20:14 - 2019-06-05 12:16 - 000000000 ____D C:\Users\Karlíkxy\AppData\Roaming\Dream Aquarium
2019-08-09 19:25 - 2018-07-04 12:06 - 000000000 ____D C:\Users\Karlíkxy\Documents\American Truck Simulator
2019-08-09 19:11 - 2019-06-14 11:10 - 000000000 ____D C:\Users\Karlíkxy\Documents\Euro Truck Simulator 2
2019-08-09 19:11 - 2017-03-17 13:30 - 000000000 ____D C:\Program Files (x86)\Steam
2019-08-09 17:00 - 2018-09-15 09:33 - 000000000 ____D C:\ProgramData\regid.1991-06.com.microsoft
2019-08-09 15:43 - 2018-05-07 12:05 - 000000000 ____D C:\Users\Karlíkxy\AppData\Local\ConnectedDevicesPlatform
2019-08-09 15:33 - 2017-03-17 15:10 - 000000000 ____D C:\Games
2019-08-09 15:32 - 2018-03-27 17:15 - 000000000 ____D C:\Users\Karlíkxy\AppData\Roaming\Wargaming.net
2019-08-09 15:26 - 2018-05-19 21:17 - 000000000 ____D C:\Users\Karlíkxy\AppData\Local\D3DSCache
2019-08-09 15:17 - 2019-05-04 23:20 - 000004188 _____ C:\WINDOWS\System32\Tasks\Opera scheduled Autoupdate 1557004838
2019-08-09 15:17 - 2019-05-04 23:20 - 000001456 _____ C:\Users\Karlíkxy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Prohlížeč Opera.lnk
2019-08-09 15:17 - 2018-09-15 09:33 - 000000000 ___HD C:\Program Files\WindowsApps
2019-08-09 15:17 - 2018-09-15 09:33 - 000000000 ____D C:\WINDOWS\AppReadiness
2019-08-07 19:42 - 2017-04-16 17:20 - 000000000 ____D C:\ProgramData\NVIDIA
2019-08-07 19:17 - 2018-03-10 00:48 - 000000000 ____D C:\Users\Karlíkxy\AppData\Roaming\vlc
2019-08-02 21:30 - 2018-07-13 18:03 - 000000000 ____D C:\Program Files (x86)\Microsoft Office
2019-07-30 18:58 - 2019-06-11 20:38 - 000000000 ____D C:\Users\Karlíkxy\Desktop\NIKON Foto
2019-07-24 14:45 - 2019-01-20 10:47 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
2019-07-21 21:06 - 2019-02-09 13:48 - 001693636 _____ C:\WINDOWS\system32\PerfStringBackup.INI
2019-07-21 21:06 - 2018-09-15 19:39 - 000716776 _____ C:\WINDOWS\system32\perfh005.dat
2019-07-21 21:06 - 2018-09-15 19:39 - 000144856 _____ C:\WINDOWS\system32\perfc005.dat
2019-07-21 21:06 - 2018-09-15 09:31 - 000000000 ____D C:\WINDOWS\INF
2019-07-21 20:59 - 2019-02-09 13:52 - 000000006 ____H C:\WINDOWS\Tasks\SA.DAT
2019-07-21 20:59 - 2017-03-17 12:45 - 000000000 ____D C:\Program Files (x86)\Mozilla Firefox
2019-07-21 20:58 - 2018-09-15 08:09 - 000262144 _____ C:\WINDOWS\system32\config\BBI
2019-07-21 20:58 - 2017-10-18 17:36 - 000189232 _____ (ESET) C:\WINDOWS\system32\Drivers\ehdrv.sys
2019-07-21 20:58 - 2017-10-18 17:36 - 000149144 _____ (ESET) C:\WINDOWS\system32\Drivers\eamonm.sys
2019-07-21 20:58 - 2017-10-18 17:36 - 000113336 _____ (ESET) C:\WINDOWS\system32\Drivers\epfwwfp.sys
2019-07-21 20:58 - 2017-10-18 17:36 - 000102464 _____ (ESET) C:\WINDOWS\system32\Drivers\edevmon.sys
2019-07-21 20:58 - 2017-10-18 17:36 - 000076896 _____ (ESET) C:\WINDOWS\system32\Drivers\epfw.sys
2019-07-21 20:58 - 2017-10-18 17:36 - 000050488 _____ (ESET) C:\WINDOWS\system32\Drivers\ekbdflt.sys
2019-07-19 21:40 - 2017-03-20 21:23 - 000001228 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Firefox.lnk
2019-07-13 23:56 - 2018-02-02 21:52 - 000000000 ___RD C:\Users\Karlíkxy\Desktop\Bordel z plochy
2019-07-13 10:32 - 2019-04-06 11:50 - 000000000 ____D C:\Users\Karlíkxy\Documents\Wondershare Filmora 9
2019-07-13 10:32 - 2019-04-06 11:50 - 000000000 ____D C:\ProgramData\Wondershare Filmora
==================== Files in the root of some directories ================
2018-02-10 22:18 - 2018-02-10 22:18 - 000099384 _____ () C:\Users\Karlíkxy\AppData\Roaming\inst.exe
2018-02-10 22:18 - 2018-02-10 22:18 - 000007859 _____ () C:\Users\Karlíkxy\AppData\Roaming\pcouffin.cat
2018-02-10 22:18 - 2018-02-10 22:18 - 000001167 _____ () C:\Users\Karlíkxy\AppData\Roaming\pcouffin.inf
2018-02-10 22:18 - 2018-02-10 22:18 - 000000055 _____ () C:\Users\Karlíkxy\AppData\Roaming\pcouffin.log
2018-02-10 22:18 - 2018-02-10 22:18 - 000082816 _____ (VSO Software) C:\Users\Karlíkxy\AppData\Roaming\pcouffin.sys
2019-03-28 19:04 - 2019-03-28 19:04 - 000000208 _____ () C:\Users\Karlíkxy\AppData\Roaming\VELKEJPC.MTBF.txt
2019-03-28 19:05 - 2019-03-28 19:05 - 000003584 _____ () C:\Users\Karlíkxy\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2017-07-26 15:40 - 2017-07-26 15:40 - 000000017 _____ () C:\Users\Karlíkxy\AppData\Local\resmon.resmoncfg
==================== SigCheck ===============================
(There is no automatic fix for files that do not pass verification.)
==================== End of FRST.txt ============================
Stiahni AdwCleaner: