Stránka 2 z 3

Re: Bezpečnostní incident 8.12

Napsal: 14 pro 2021 19:57
od Rudy
OK. Fixlog je to, co vygeneroval FRST po fixu. Měl by být v C:\Users\Ricky\Downloads .

Re: Bezpečnostní incident 8.12

Napsal: 14 pro 2021 20:33
od Purchan
Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 11-12-2021
Ran by Ricky (administrator) on DESKTOP-J4POG28 (14-12-2021 20:23:42)
Running from C:\Users\Ricky\Downloads
Loaded Profiles: Ricky
Platform: Microsoft Windows 10 Pro Version 21H1 19043.1387 (X64) Language: Čeština (Česko)
Default browser: Chrome
Boot Mode: Normal

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Advanced Micro Devices Inc. -> Advanced Micro Devices, Inc.) C:\Windows\System32\amdfendrsr.exe
(Advanced Micro Devices, Inc. -> AMD) C:\Windows\System32\DriverStore\FileRepository\u0367912.inf_amd64_1567db284dfba458\B366469\atieclxx.exe
(Advanced Micro Devices, Inc. -> AMD) C:\Windows\System32\DriverStore\FileRepository\u0367912.inf_amd64_1567db284dfba458\B366469\atiesrxx.exe
(AVB Disc Soft, SIA -> Disc Soft Ltd) C:\Program Files\DAEMON Tools Lite\DiscSoftBusServiceLite.exe
(AVB Disc Soft, SIA -> Disc Soft Ltd) C:\Program Files\DAEMON Tools Lite\DTAgent.exe
(AVB Disc Soft, SIA -> Disc Soft Ltd) C:\Program Files\DAEMON Tools Lite\DTShellHlp.exe
(Google LLC -> Google LLC) C:\Program Files (x86)\Google\Update\1.3.36.112\GoogleCrashHandler.exe
(Google LLC -> Google LLC) C:\Program Files (x86)\Google\Update\1.3.36.112\GoogleCrashHandler64.exe
(Google LLC -> Google LLC) C:\Program Files\Google\Chrome\Application\chrome.exe <23>
(Kaspersky Lab JSC -> AO Kaspersky Lab) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Total Security 21.3\avp.exe
(Kaspersky Lab JSC -> AO Kaspersky Lab) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Total Security 21.3\avpui.exe
(Kaspersky Lab JSC -> AO Kaspersky Lab) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Total Security 21.3\plugins_nms.exe
(Kaspersky Lab JSC -> AO Kaspersky Lab) C:\Program Files (x86)\Kaspersky Lab\Kaspersky VPN 5.3\ksde.exe
(Kaspersky Lab JSC -> AO Kaspersky Lab) C:\Program Files (x86)\Kaspersky Lab\Kaspersky VPN 5.3\ksdeui.exe
(Malwarebytes Inc -> Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\mbam.exe
(Malwarebytes Inc -> Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
(Malwarebytes Inc -> Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.14326.20544.0_x64__8wekyb3d8bbwe\HxAccounts.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.14326.20544.0_x64__8wekyb3d8bbwe\HxOutlook.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.14326.20544.0_x64__8wekyb3d8bbwe\HxTsr.exe
(Microsoft Windows -> Microsoft Corporation) C:\Windows\ImmersiveControlPanel\SystemSettings.exe
(Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\cmd.exe
(Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\smartscreen.exe
(Microsoft Windows -> Microsoft Corporation) C:\Windows\SysWOW64\wbem\WmiPrvSE.exe
(Opera Software AS -> Opera Software) C:\Users\Ricky\AppData\Local\Programs\Opera\82.0.4227.23\opera_crashreporter.exe
(Opera Software AS -> Opera Software) C:\Users\Ricky\AppData\Local\Programs\Opera\opera.exe <17>

==================== Registry (Whitelisted) ===================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM-x32\...\Run: [GrooveMonitor] => C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe [31016 2006-10-27] (Microsoft Corporation -> Microsoft Corporation)
HKU\S-1-5-21-3294239711-236292038-94065591-1001\...\Run: [DAEMON Tools Lite Automount] => C:\Program Files\DAEMON Tools Lite\DTAgent.exe [479632 2021-12-11] (AVB Disc Soft, SIA -> Disc Soft Ltd)
HKLM\Software\Microsoft\Active Setup\Installed Components: [{8A69D345-D564-463c-AFF1-A69D9E530F96}] -> C:\Program Files\Google\Chrome\Application\96.0.4664.93\Installer\chrmstp.exe [2021-12-11] (Google LLC -> Google LLC)

==================== Scheduled Tasks (Whitelisted) ============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

Task: {09AD8CF6-A7CB-4351-B0D8-CC4CA807D3AF} - System32\Tasks\Driver Booster Scheduler => C:\Program Files (x86)\IObit\Driver Booster\9.0.1\Scheduler.exe [156696 2021-09-13] (IObit CO., LTD -> IObit)
Task: {0F63F264-E1BC-49F1-B817-F74B86401D12} - System32\Tasks\Driver Booster Update => C:\Program Files (x86)\IObit\Driver Booster\9.0.1\AutoUpdate.exe [2462744 2021-09-13] (IObit CO., LTD -> IObit)
Task: {174F4847-4903-4581-9827-6B8C715D535A} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [156232 2021-12-11] (Google LLC -> Google LLC)
Task: {254A177A-A5D5-4AE4-9FD8-A100F97F55D2} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [156232 2021-12-11] (Google LLC -> Google LLC)
Task: {3A057C5F-37D1-477E-9BB8-02D88C3AD546} - System32\Tasks\Opera scheduled Autoupdate 1639179332 => C:\Users\Ricky\AppData\Local\Programs\Opera\launcher.exe [2338000 2021-12-02] (Opera Software AS -> Opera Software)
Task: {43C55387-6708-465E-8E41-19899BFD8F7A} - System32\Tasks\Mozilla\Firefox Default Browser Agent 308046B0AF4A39CB => C:\Program Files\Mozilla Firefox\default-browser-agent.exe do-task "308046B0AF4A39CB"
Task: {9D3264E8-A079-4623-ABE1-D6E7241BAF74} - System32\Tasks\Driver Booster SkipUAC (Ricky) => C:\Program Files (x86)\IObit\Driver Booster\9.0.1\DriverBooster.exe [8295960 2021-10-22] (IObit CO., LTD -> IObit)
Task: {CA9B18EE-E583-44C6-889A-AF9EEAC99091} - System32\Tasks\Kaspersky_Upgrade_Launcher_{278ADC42-419D-4547-A6CA-5B74BE0AD901} => C:\Program Files\Common Files\AV\Kaspersky Lab\upgrade_launcher.exe [743488 2021-12-11] (Kaspersky Lab JSC -> AO Kaspersky Lab)

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)


==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Tcpip\Parameters: [DhcpNameServer] 86.49.5.221 86.49.5.222
Tcpip\..\Interfaces\{0039d146-87ed-4237-bcac-43978c70e528}: [DhcpNameServer] 86.49.5.221 86.49.5.222

Edge:
=======
Edge DefaultProfile: Default
Edge Profile: C:\Users\Ricky\AppData\Local\Microsoft\Edge\User Data\Default [2021-12-12]
Edge HKU\S-1-5-21-3294239711-236292038-94065591-1001\SOFTWARE\Microsoft\Edge\Extensions\...\Edge\Extension: [ahkjpbeeocnddjkakilopmfdlnjdpcdm]

FireFox:
========
FF DefaultProfile: acxhjj4j.default
FF ProfilePath: C:\Users\Ricky\AppData\Roaming\Mozilla\Firefox\Profiles\acxhjj4j.default [2021-12-11]
FF ProfilePath: C:\Users\Ricky\AppData\Roaming\Mozilla\Firefox\Profiles\uu3pjy19.default-release [2021-12-14]
FF Extension: (SetupVPN - Lifetime Free VPN) - C:\Users\Ricky\AppData\Roaming\Mozilla\Firefox\Profiles\uu3pjy19.default-release\Extensions\@setupvpncom.xpi [2021-12-13]
FF HKLM\...\Firefox\Extensions: [light_plugin_7571494CE0B94E11BB762B659A4AD71F@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Total Security 21.3\FFExt\light_plugin_firefox\addon.xpi => not found
FF HKLM-x32\...\Firefox\Extensions: [light_plugin_7571494CE0B94E11BB762B659A4AD71F@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Total Security 21.3\FFExt\light_plugin_firefox\addon.xpi => not found
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.50918.0\npctrl.dll [2018-10-23] (Microsoft Corporation -> Microsoft Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.50918.0\npctrl.dll [2018-10-23] (Microsoft Corporation -> Microsoft Corporation)
FF Plugin-x32: @videolan.org/vlc,version=3.0.16 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2021-06-18] (VideoLAN -> VideoLAN)
FF ExtraCheck: C:\Program Files\mozilla firefox\defaults\pref\kl_prefs_62fbb8f7_c917_4cf7_957a_aad2b8fa768c.js [2021-12-11] <==== ATTENTION (Points to *.cfg file)
FF ExtraCheck: C:\Program Files\mozilla firefox\kl_config_62fbb8f7_c917_4cf7_957a_aad2b8fa768c.cfg [2021-12-11] <==== ATTENTION

Chrome:
=======
CHR DefaultProfile: Default
CHR Profile: C:\Users\Ricky\AppData\Local\Google\Chrome\User Data\Default [2021-12-14]
CHR Notifications: Default -> hxxps://www.ifortuna.cz
CHR Extension: (Prezentace) - C:\Users\Ricky\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2021-12-11]
CHR Extension: (Ochrana Kaspersky) - C:\Users\Ricky\AppData\Local\Google\Chrome\User Data\Default\Extensions\ahkjpbeeocnddjkakilopmfdlnjdpcdm [2021-12-12]
CHR Extension: (Dokumenty) - C:\Users\Ricky\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2021-12-11]
CHR Extension: (Disk Google) - C:\Users\Ricky\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2021-12-11]
CHR Extension: (YouTube) - C:\Users\Ricky\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2021-12-11]
CHR Extension: (Tabulky) - C:\Users\Ricky\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2021-12-11]
CHR Extension: (Dokumenty Google offline) - C:\Users\Ricky\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2021-12-11]
CHR Extension: (AdBlock - nejlepší blokátor reklam) - C:\Users\Ricky\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2021-12-13]
CHR Extension: (ySense Addon) - C:\Users\Ricky\AppData\Local\Google\Chrome\User Data\Default\Extensions\hjnhcgkngeeahimbfhejeaiijecekhba [2021-12-11]
CHR Extension: (Platby Internetového obchodu Chrome) - C:\Users\Ricky\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2021-12-11]
CHR Extension: (NeoBux AdAlert) - C:\Users\Ricky\AppData\Local\Google\Chrome\User Data\Default\Extensions\oaepeijninfcgjdnighjnlgdkkgpnaen [2021-12-11]
CHR Extension: (Gmail) - C:\Users\Ricky\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2021-12-11]
CHR Profile: C:\Users\Ricky\AppData\Local\Google\Chrome\User Data\Guest Profile [2021-12-14]
CHR Profile: C:\Users\Ricky\AppData\Local\Google\Chrome\User Data\Profile 1 [2021-12-14]
CHR Extension: (Prezentace) - C:\Users\Ricky\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2021-12-11]
CHR Extension: (Ochrana Kaspersky) - C:\Users\Ricky\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\ahkjpbeeocnddjkakilopmfdlnjdpcdm [2021-12-14]
CHR Extension: (Dokumenty) - C:\Users\Ricky\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\aohghmighlieiainnegkcijnfilokake [2021-12-11]
CHR Extension: (Disk Google) - C:\Users\Ricky\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\apdfllckaahabafndbhieahigkjlhalf [2021-12-11]
CHR Extension: (YouTube) - C:\Users\Ricky\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2021-12-11]
CHR Extension: (Tabulky) - C:\Users\Ricky\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2021-12-11]
CHR Extension: (Dokumenty Google offline) - C:\Users\Ricky\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2021-12-11]
CHR Extension: (Platby Internetového obchodu Chrome) - C:\Users\Ricky\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2021-12-11]
CHR Extension: (Gmail) - C:\Users\Ricky\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2021-12-11]
CHR Profile: C:\Users\Ricky\AppData\Local\Google\Chrome\User Data\System Profile [2021-12-14]
CHR HKLM\...\Chrome\Extension: [ahkjpbeeocnddjkakilopmfdlnjdpcdm] - hxxps://chrome.google.com/webstore/detail/kaspersky-protection/ahkjpbeeocnddjkakilopmfdlnjdpcdm
CHR HKLM-x32\...\Chrome\Extension: [ahkjpbeeocnddjkakilopmfdlnjdpcdm] - hxxps://chrome.google.com/webstore/detail/kaspersky-protection/ahkjpbeeocnddjkakilopmfdlnjdpcdm

Opera:
=======
OPR Profile: C:\Users\Ricky\AppData\Roaming\Opera Software\Opera Stable [2021-12-14]
OPR DefaultSuggestURL: Opera Stable -> hxxps://www.google.com/complete/search?client=o ... utEncoding}
OPR Extension: (Rich Hints Agent) - C:\Users\Ricky\AppData\Roaming\Opera Software\Opera Stable\Extensions\enegjkbbakeegngfapepobipndnebkdk [2021-12-11]
OPR Extension: (Amazon Assistant Promotion) - C:\Users\Ricky\AppData\Roaming\Opera Software\Opera Stable\Extensions\kbmoiomgmchbpihhdpabemajcbjpcijk [2021-12-11]

==================== Services (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 AVP21.3; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Total Security 21.3\avp.exe [184768 2021-12-11] (Kaspersky Lab JSC -> AO Kaspersky Lab)
R3 Disc Soft Lite Bus Service; C:\Program Files\DAEMON Tools Lite\DiscSoftBusServiceLite.exe [4958096 2021-12-11] (AVB Disc Soft, SIA -> Disc Soft Ltd)
S3 klvssbridge64_21.3; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Total Security 21.3\x64\vssbridge64.exe [479280 2021-02-19] (Kaspersky Lab JSC -> AO Kaspersky Lab)
R2 KSDE5.3; C:\Program Files (x86)\Kaspersky Lab\Kaspersky VPN 5.3\ksde.exe [447104 2021-12-11] (Kaspersky Lab JSC -> AO Kaspersky Lab)
R2 MBAMService; C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe [7901368 2021-12-14] (Malwarebytes Inc -> Malwarebytes)
S3 Sense; C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe [6136520 2021-12-11] (Microsoft Windows Publisher -> Microsoft Corporation)
S3 WdNisSvc; C:\ProgramData\Microsoft\Windows Defender\platform\4.18.2110.6-0\NisSrv.exe [2872024 2021-12-11] (Microsoft Windows Publisher -> Microsoft Corporation)
S3 WinDefend; C:\ProgramData\Microsoft\Windows Defender\platform\4.18.2110.6-0\MsMpEng.exe [128376 2021-12-11] (Microsoft Windows Publisher -> Microsoft Corporation)

===================== Drivers (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R3 AMDXE; C:\WINDOWS\System32\drivers\amdxe.sys [62056 2020-09-02] (Advanced Micro Devices, Inc. -> Advanced Micro Devices, Inc.)
R0 cm_km; C:\WINDOWS\System32\DRIVERS\cm_km.sys [250032 2021-02-19] (Kaspersky Lab JSC -> AO Kaspersky Lab)
R3 dtlitescsibus; C:\WINDOWS\System32\drivers\dtlitescsibus.sys [42256 2021-03-26] (AVB Disc Soft, SIA -> Disc Soft Ltd)
R3 dtliteusbbus; C:\WINDOWS\System32\drivers\dtliteusbbus.sys [63696 2021-12-11] (AVB Disc Soft, SIA -> Disc Soft Ltd)
R1 ESProtectionDriver; C:\WINDOWS\system32\drivers\mbae64.sys [160176 2021-12-14] (Microsoft Windows Hardware Compatibility Publisher -> Malwarebytes)
S3 ew_usbccgpfilter; C:\WINDOWS\System32\drivers\ew_usbccgpfilter.sys [18944 2018-08-23] (Microsoft Windows Hardware Compatibility Publisher -> Huawei Technologies Co., Ltd.)
R1 klbackupdisk; C:\WINDOWS\system32\DRIVERS\klbackupdisk.sys [110336 2021-02-19] (Kaspersky Lab JSC -> AO Kaspersky Lab)
R1 klbackupflt; C:\WINDOWS\System32\DRIVERS\klbackupflt.sys [211704 2021-02-19] (Kaspersky Lab JSC -> AO Kaspersky Lab)
R1 kldisk; C:\WINDOWS\system32\DRIVERS\kldisk.sys [126216 2021-02-19] (Kaspersky Lab JSC -> AO Kaspersky Lab)
S0 klelam; C:\WINDOWS\System32\DRIVERS\klelam.sys [41656 2021-02-19] (Microsoft Windows Early Launch Anti-malware Publisher -> AO Kaspersky Lab)
R1 klflt; C:\WINDOWS\system32\DRIVERS\klflt.sys [514840 2021-02-19] (Kaspersky Lab JSC -> AO Kaspersky Lab)
R1 klgse; C:\WINDOWS\System32\DRIVERS\klgse.sys [689976 2021-11-13] (Microsoft Windows Hardware Compatibility Publisher -> AO Kaspersky Lab)
R1 klhk; C:\WINDOWS\system32\DRIVERS\klhk.sys [1507648 2021-11-13] (Microsoft Windows Hardware Compatibility Publisher -> AO Kaspersky Lab)
R3 klids; C:\ProgramData\Kaspersky Lab\AVP21.3\Bases\klids.sys [273176 2021-12-11] (Microsoft Windows Hardware Compatibility Publisher -> AO Kaspersky Lab)
R1 KLIF; C:\WINDOWS\System32\DRIVERS\klif.sys [1042712 2021-02-19] (Kaspersky Lab JSC -> AO Kaspersky Lab)
R1 klim6; C:\WINDOWS\system32\DRIVERS\klim6.sys [98040 2021-02-19] (Kaspersky Lab JSC -> AO Kaspersky Lab)
R3 klkbdflt; C:\WINDOWS\system32\DRIVERS\klkbdflt.sys [112392 2021-02-19] (Kaspersky Lab JSC -> AO Kaspersky Lab)
R3 klmouflt; C:\WINDOWS\system32\DRIVERS\klmouflt.sys [112904 2021-02-19] (Kaspersky Lab JSC -> AO Kaspersky Lab)
R1 klpd; C:\WINDOWS\System32\DRIVERS\klpd.sys [85256 2021-02-19] (Kaspersky Lab JSC -> AO Kaspersky Lab)
R1 klpnpflt; C:\WINDOWS\system32\DRIVERS\klpnpflt.sys [96008 2021-12-11] (Kaspersky Lab JSC -> AO Kaspersky Lab)
R3 kltap; C:\WINDOWS\System32\drivers\kltap.sys [55592 2021-02-19] (AnchorFree Inc -> The OpenVPN Project)
R0 klupd_klif_arkmon; C:\WINDOWS\System32\Drivers\klupd_klif_arkmon.sys [276064 2021-12-11] (Microsoft Windows Hardware Compatibility Publisher -> AO Kaspersky Lab)
R3 klupd_klif_klark; C:\WINDOWS\System32\Drivers\klupd_klif_klark.sys [314040 2021-12-11] (Microsoft Windows Hardware Compatibility Publisher -> AO Kaspersky Lab)
R0 klupd_klif_klbg; C:\WINDOWS\System32\Drivers\klupd_klif_klbg.sys [113976 2021-12-11] (Microsoft Windows Hardware Compatibility Publisher -> AO Kaspersky Lab)
R3 klupd_klif_mark; C:\WINDOWS\System32\Drivers\klupd_klif_mark.sys [225648 2021-12-11] (Microsoft Windows Hardware Compatibility Publisher -> AO Kaspersky Lab)
R1 klwfp; C:\WINDOWS\system32\DRIVERS\klwfp.sys [155912 2021-02-19] (Kaspersky Lab JSC -> AO Kaspersky Lab)
R1 klwtp; C:\WINDOWS\system32\DRIVERS\klwtp.sys [327936 2021-02-19] (Kaspersky Lab JSC -> AO Kaspersky Lab)
R1 kneps; C:\WINDOWS\system32\DRIVERS\kneps.sys [300808 2021-02-19] (Kaspersky Lab JSC -> AO Kaspersky Lab)
R2 MBAMChameleon; C:\WINDOWS\System32\Drivers\MbamChameleon.sys [210352 2021-12-14] (Microsoft Windows Hardware Compatibility Publisher -> Malwarebytes)
S0 MbamElam; C:\WINDOWS\System32\DRIVERS\MbamElam.sys [19912 2021-12-14] (Microsoft Windows Early Launch Anti-malware Publisher -> Malwarebytes)
R3 MBAMFarflt; C:\WINDOWS\System32\DRIVERS\farflt.sys [193448 2021-12-14] (Microsoft Windows Hardware Compatibility Publisher -> Malwarebytes)
R3 MBAMProtection; C:\WINDOWS\system32\DRIVERS\mbam.sys [69040 2021-12-14] (Microsoft Windows Hardware Compatibility Publisher -> Malwarebytes)
R3 MBAMSwissArmy; C:\WINDOWS\System32\Drivers\mbamswissarmy.sys [248992 2021-12-14] (Malwarebytes Inc -> Malwarebytes)
R3 MBAMWebProtection; C:\WINDOWS\system32\DRIVERS\mwac.sys [149424 2021-12-14] (Microsoft Windows Hardware Compatibility Publisher -> Malwarebytes)
S3 WdBoot; C:\WINDOWS\system32\drivers\wd\WdBoot.sys [48520 2021-12-11] (Microsoft Windows Early Launch Anti-malware Publisher -> Microsoft Corporation)
S3 WdFilter; C:\WINDOWS\system32\drivers\wd\WdFilter.sys [435424 2021-12-11] (Microsoft Windows -> Microsoft Corporation)
S3 WdNisDrv; C:\WINDOWS\System32\drivers\wd\WdNisDrv.sys [86240 2021-12-11] (Microsoft Windows -> Microsoft Corporation)

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== One month (created) (Whitelisted) =========

(If an entry is included in the fixlist, the file/folder will be moved.)

2021-12-14 19:36 - 2021-12-14 19:36 - 000000801 _____ C:\Users\Ricky\Desktop\tt.txt
2021-12-14 18:26 - 2021-12-14 18:34 - 000000000 ____D C:\Users\Ricky\AppData\LocalLow\IGDump
2021-12-14 18:26 - 2021-12-14 18:26 - 000193448 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\farflt.sys
2021-12-14 18:26 - 2021-12-14 18:26 - 000149424 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mwac.sys
2021-12-14 18:26 - 2021-12-14 18:26 - 000069040 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mbam.sys
2021-12-14 16:56 - 2021-12-14 17:17 - 000021296 _____ C:\Users\Ricky\Downloads\Addition.txt
2021-12-14 16:40 - 2021-12-14 20:25 - 000019749 _____ C:\Users\Ricky\Downloads\FRST.txt
2021-12-14 16:36 - 2021-12-14 20:24 - 000000000 ____D C:\FRST
2021-12-14 16:35 - 2021-12-14 16:35 - 002311168 _____ (Farbar) C:\Users\Ricky\Downloads\FRST64.exe
2021-12-14 15:43 - 2021-12-14 15:43 - 000210352 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\MbamChameleon.sys
2021-12-14 14:37 - 2021-12-14 15:43 - 000002033 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes.lnk
2021-12-14 14:37 - 2021-12-14 15:43 - 000002021 _____ C:\Users\Public\Desktop\Malwarebytes.lnk
2021-12-14 14:37 - 2021-12-14 14:37 - 000248992 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mbamswissarmy.sys
2021-12-14 14:37 - 2021-12-14 14:37 - 000000000 ____D C:\Users\Ricky\AppData\Local\mbam
2021-12-14 14:36 - 2021-12-14 15:42 - 000000000 ____D C:\ProgramData\Malwarebytes
2021-12-14 14:36 - 2021-12-14 15:42 - 000000000 ____D C:\Program Files\Malwarebytes
2021-12-14 14:36 - 2021-12-14 14:36 - 000160176 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mbae64.sys
2021-12-14 14:36 - 2021-12-14 14:36 - 000019912 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\MbamElam.sys
2021-12-14 14:34 - 2021-12-14 14:35 - 219256648 _____ (Malwarebytes) C:\Users\Ricky\Downloads\mb4-setup-consumer-4.4.5.229-1.0.1430-1.0.44238.exe
2021-12-14 02:07 - 2021-12-14 02:07 - 000358129 _____ C:\Users\Ricky\Downloads\video-1639439659.mp4
2021-12-14 02:05 - 2021-12-14 02:05 - 003772810 _____ C:\Users\Ricky\Downloads\video-1639440682.mp4
2021-12-13 23:05 - 2021-12-14 00:34 - 1624440249 _____ C:\Users\Ricky\Downloads\Na lovu 57. díl.mp4
2021-12-13 22:32 - 2021-12-13 22:32 - 000000000 ____D C:\Users\Ricky\AppData\Roaming\ProtectDisc
2021-12-13 22:31 - 2021-12-13 22:31 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\RTL Sports
2021-12-13 22:31 - 2021-12-13 22:31 - 000000000 ____D C:\Program Files (x86)\Biathlon 2009 (Demo)
2021-12-13 20:22 - 2021-12-13 21:52 - 1635466274 _____ C:\Users\Ricky\Downloads\Na lovu 56. díl.mp4
2021-12-13 19:53 - 2021-12-13 19:53 - 000000000 ____D C:\Users\Ricky\AppData\Local\OneDrive
2021-12-13 18:48 - 2021-12-13 20:17 - 1624896966 _____ C:\Users\Ricky\Downloads\Na lovu 55. díl.mp4
2021-12-13 18:47 - 2021-12-13 19:06 - 402276352 _____ C:\Users\Ricky\Downloads\SuperStar (12.12.2021).mkv
2021-12-13 18:32 - 2021-12-13 18:32 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
2021-12-13 18:31 - 2021-12-13 18:31 - 000000000 ____D C:\Program Files\Microsoft Silverlight
2021-12-13 18:31 - 2021-12-13 18:31 - 000000000 ____D C:\Program Files (x86)\Microsoft Silverlight
2021-12-12 21:20 - 2021-12-12 21:20 - 000466456 _____ (Creative Labs) C:\WINDOWS\system32\wrap_oal.dll
2021-12-12 21:20 - 2021-12-12 21:20 - 000444952 _____ (Creative Labs) C:\WINDOWS\SysWOW64\wrap_oal.dll
2021-12-12 21:20 - 2021-12-12 21:20 - 000122904 _____ (Portions (C) Creative Labs Inc. and NVIDIA Corp.) C:\WINDOWS\system32\OpenAL32.dll
2021-12-12 21:20 - 2021-12-12 21:20 - 000109080 _____ (Portions (C) Creative Labs Inc. and NVIDIA Corp.) C:\WINDOWS\SysWOW64\OpenAL32.dll
2021-12-12 21:20 - 2021-12-12 21:20 - 000000000 ____D C:\Program Files (x86)\OpenAL
2021-12-12 19:13 - 2021-12-12 20:14 - 1312195830 _____ C:\Users\Ricky\Downloads\Lajna S03E03 Borovčík.avi
2021-12-12 18:38 - 2021-12-12 20:07 - 1619365346 _____ C:\Users\Ricky\Downloads\Na lovu 54. díl.mp4
2021-12-12 18:15 - 2021-12-12 19:12 - 1699830904 _____ C:\Users\Ricky\Downloads\SuperStar 14 díl (5.12.2021) HD kvalita (Xyff).mkv
2021-12-12 15:26 - 2021-12-12 15:26 - 000000000 ____D C:\Users\Ricky\AppData\Local\PeerDistRepub
2021-12-11 22:27 - 2021-12-11 22:27 - 000000000 ____D C:\Users\Ricky\Documents\NHL09
2021-12-11 21:42 - 2021-12-12 18:36 - 1625253689 _____ C:\Users\Ricky\Downloads\Na lovu 53. díl.mp4
2021-12-11 20:09 - 2021-12-11 21:38 - 1627523049 _____ C:\Users\Ricky\Downloads\Na lovu 52. díl.mp4
2021-12-11 18:39 - 2021-12-11 20:09 - 1628705503 _____ C:\Users\Ricky\Downloads\Na lovu 51. díl.mp4
2021-12-11 18:24 - 2021-12-11 18:24 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office
2021-12-11 18:22 - 2021-12-11 18:22 - 000000000 ____D C:\Program Files (x86)\Microsoft Works
2021-12-11 18:21 - 2021-12-11 18:21 - 000000000 ____D C:\WINDOWS\PCHEALTH
2021-12-11 18:21 - 2021-12-11 18:21 - 000000000 ____D C:\Program Files (x86)\Microsoft Visual Studio
2021-12-11 18:19 - 2021-12-11 18:19 - 000000000 ____D C:\Program Files\Microsoft Office
2021-12-11 18:19 - 2021-12-11 18:19 - 000000000 ____D C:\Program Files (x86)\Microsoft Visual Studio 8
2021-12-11 18:18 - 2021-12-11 18:21 - 000000000 ____D C:\WINDOWS\SHELLNEW
2021-12-11 18:18 - 2021-12-11 18:21 - 000000000 ____D C:\Program Files (x86)\Microsoft Office
2021-12-11 18:18 - 2021-12-11 18:18 - 000000000 ____D C:\Users\Ricky\AppData\Local\Microsoft Help
2021-12-11 18:16 - 2021-12-11 18:16 - 000000000 ____D C:\Users\Ricky\AppData\Roaming\WinRAR
2021-12-11 18:15 - 2021-12-11 18:15 - 000000000 ____D C:\Users\Ricky\AppData\Roaming\DAEMON Tools Lite
2021-12-11 18:15 - 2021-12-11 18:15 - 000000000 ____D C:\Users\Ricky\AppData\Local\Disc_Soft_Ltd
2021-12-11 18:15 - 2021-12-11 18:15 - 000000000 ____D C:\Users\Public\Documents\Daemon Tools Images
2021-12-11 18:14 - 2021-12-11 18:14 - 000063696 _____ (Disc Soft Ltd) C:\WINDOWS\system32\Drivers\dtliteusbbus.sys
2021-12-11 18:14 - 2021-12-11 18:14 - 000000834 _____ C:\Users\Public\Desktop\DAEMON Tools Lite.lnk
2021-12-11 18:14 - 2021-12-11 18:14 - 000000000 ____D C:\Users\Ricky\AppData\Roaming\Disc-Soft
2021-12-11 18:14 - 2021-12-11 18:14 - 000000000 ____D C:\Users\Public\Documents\Catch!
2021-12-11 18:14 - 2021-12-11 18:14 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\DAEMON Tools Lite
2021-12-11 18:14 - 2021-12-11 18:14 - 000000000 ____D C:\Program Files\DAEMON Tools Lite
2021-12-11 18:13 - 2021-12-11 18:13 - 000000000 ____D C:\ProgramData\Disc-Soft
2021-12-11 18:05 - 2021-12-11 18:05 - 000000000 ____D C:\Users\Ricky\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR
2021-12-11 18:05 - 2021-12-11 18:05 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinRAR
2021-12-11 18:05 - 2021-12-11 18:05 - 000000000 ____D C:\Program Files\WinRAR
2021-12-11 17:20 - 2021-12-11 17:20 - 000314040 _____ (AO Kaspersky Lab) C:\WINDOWS\system32\Drivers\klupd_klif_klark.sys
2021-12-11 17:17 - 2021-12-11 17:17 - 000276064 _____ (AO Kaspersky Lab) C:\WINDOWS\system32\Drivers\klupd_klif_arkmon.sys
2021-12-11 17:17 - 2021-12-11 17:17 - 000225648 _____ (AO Kaspersky Lab) C:\WINDOWS\system32\Drivers\klupd_klif_mark.sys
2021-12-11 17:17 - 2021-12-11 17:17 - 000113976 _____ (AO Kaspersky Lab) C:\WINDOWS\system32\Drivers\klupd_klif_klbg.sys
2021-12-11 17:17 - 2021-12-11 17:17 - 000003392 _____ C:\WINDOWS\system32\Tasks\Kaspersky_Upgrade_Launcher_{278ADC42-419D-4547-A6CA-5B74BE0AD901}
2021-12-11 17:17 - 2021-12-11 17:17 - 000001163 _____ C:\Users\Public\Desktop\Kaspersky VPN.lnk
2021-12-11 17:17 - 2021-12-11 17:17 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Kaspersky VPN
2021-12-11 17:17 - 2021-12-11 17:17 - 000000000 ____D C:\Program Files\Common Files\AV
2021-12-11 17:16 - 2021-12-11 17:17 - 000000000 ____D C:\ProgramData\Kaspersky Lab
2021-12-11 17:16 - 2021-12-11 17:17 - 000000000 ____D C:\Program Files (x86)\Kaspersky Lab
2021-12-11 17:16 - 2021-12-11 17:16 - 000002196 _____ C:\Users\Public\Desktop\Kaspersky Total Security.lnk
2021-12-11 17:16 - 2021-12-11 17:16 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Kaspersky Total Security
2021-12-11 17:16 - 2021-02-19 21:09 - 000110176 _____ (Kaspersky Lab ZAO) C:\WINDOWS\system32\klfphc.dll
2021-12-11 17:16 - 2021-02-19 21:08 - 001042712 _____ (AO Kaspersky Lab) C:\WINDOWS\system32\Drivers\klif.sys
2021-12-11 17:16 - 2021-02-19 21:08 - 000514840 _____ (AO Kaspersky Lab) C:\WINDOWS\system32\Drivers\klflt.sys
2021-12-11 15:05 - 2021-12-11 15:05 - 001156664 _____ (Realtek ) C:\WINDOWS\system32\Drivers\rt640x64.sys
2021-12-11 15:03 - 2021-12-11 15:07 - 000000000 ____D C:\Users\Ricky\AppData\Roaming\instinfo
2021-12-11 15:03 - 2021-12-11 15:03 - 000000000 ____D C:\ProgramData\ProductData
2021-12-11 15:02 - 2021-12-11 15:03 - 000002347 _____ C:\Users\Public\Desktop\Driver Booster 9.lnk
2021-12-11 15:02 - 2021-12-11 15:03 - 000000000 ____D C:\Users\Ricky\AppData\LocalLow\IObit
2021-12-11 15:02 - 2021-12-11 15:02 - 000003192 _____ C:\WINDOWS\system32\Tasks\Driver Booster Scheduler
2021-12-11 15:02 - 2021-12-11 15:02 - 000003178 _____ C:\WINDOWS\system32\Tasks\Driver Booster Update
2021-12-11 15:02 - 2021-12-11 15:02 - 000002952 _____ C:\WINDOWS\system32\Tasks\Driver Booster SkipUAC (Ricky)
2021-12-11 15:02 - 2021-12-11 15:02 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Driver Booster 9
2021-12-11 15:02 - 2021-12-11 15:02 - 000000000 ____D C:\ProgramData\{E0224FF9-7AE3-4F9E-991A-2F004F7E3952}
2021-12-11 15:02 - 2021-12-11 15:02 - 000000000 ____D C:\Program Files (x86)\IObit
2021-12-11 15:01 - 2021-12-11 15:03 - 000000000 ____D C:\Users\Ricky\AppData\Roaming\IObit
2021-12-11 15:01 - 2021-12-11 15:02 - 000000000 ____D C:\ProgramData\IObit
2021-12-11 13:25 - 2021-12-11 13:25 - 000011785 _____ C:\WINDOWS\system32\DrtmAuthTxt.wim
2021-12-11 13:24 - 2021-12-11 13:24 - 000162816 _____ C:\WINDOWS\system32\DataStoreCacheDumpTool.exe
2021-12-11 12:54 - 2021-12-11 12:54 - 000000000 ___HD C:\$WinREAgent
2021-12-11 12:16 - 2021-12-11 12:16 - 000000000 ____D C:\Program Files\Microsoft Update Health Tools
2021-12-11 02:39 - 2021-12-11 12:09 - 000000000 ____D C:\WINDOWS\system32\MRT
2021-12-11 02:39 - 2021-12-11 02:39 - 000001146 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PC Health Check.lnk
2021-12-11 02:39 - 2021-12-11 02:39 - 000000000 ____D C:\Program Files\PCHealthCheck
2021-12-11 02:22 - 2021-12-11 17:05 - 000000000 ____D C:\Users\Ricky\AppData\Roaming\Exodus
2021-12-11 02:22 - 2021-12-11 02:23 - 000000000 ____D C:\Users\Ricky\AppData\Local\SquirrelTemp
2021-12-11 02:22 - 2021-12-11 02:22 - 000002219 _____ C:\Users\Ricky\Desktop\Exodus.lnk
2021-12-11 02:22 - 2021-12-11 02:22 - 000000000 ____D C:\Users\Ricky\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Exodus Movement Inc
2021-12-11 02:22 - 2021-12-11 02:22 - 000000000 ____D C:\Users\Ricky\AppData\Local\exodus
2021-12-11 02:09 - 2021-12-14 02:14 - 000000000 ____D C:\Users\Ricky\AppData\Roaming\vlc
2021-12-11 02:02 - 2021-12-11 02:02 - 000002386 _____ C:\Users\Ricky\Desktop\Osoba 1 - Chrome.lnk
2021-12-11 01:46 - 2021-12-11 01:46 - 000001135 _____ C:\Users\Public\Desktop\VLC media player.lnk
2021-12-11 01:46 - 2021-12-11 01:46 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoLAN
2021-12-11 01:46 - 2021-12-11 01:46 - 000000000 ____D C:\Program Files (x86)\VideoLAN
2021-12-11 01:39 - 2021-12-11 01:39 - 000001288 _____ C:\Users\Ricky\AppData\Roaming\Microsoft\Windows\Start Menu\Free Auto Clicker.lnk
2021-12-11 01:39 - 2021-12-11 01:39 - 000001264 _____ C:\Users\Ricky\Desktop\Free Auto Clicker.lnk
2021-12-11 01:39 - 2021-12-11 01:39 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Free Auto Clicker
2021-12-11 01:39 - 2021-12-11 01:39 - 000000000 ____D C:\Program Files (x86)\Free Auto Clicker
2021-12-11 01:37 - 2021-12-11 01:37 - 000000984 _____ C:\Users\Ricky\Desktop\MWSnap 3.lnk
2021-12-11 01:37 - 2021-12-11 01:37 - 000000000 ____D C:\Users\Ricky\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\MWSnap
2021-12-11 01:37 - 2021-12-11 01:37 - 000000000 ____D C:\Program Files (x86)\MWSnap
2021-12-11 01:15 - 2021-12-11 01:15 - 000000000 ____D C:\Users\Ricky\Desktop\Ysense návod
2021-12-11 01:14 - 2021-12-11 01:14 - 000000000 ____H C:\WINDOWS\system32\Drivers\Msft_User_WpdFs_01_11_00.Wdf
2021-12-11 00:46 - 2021-12-11 00:47 - 000000000 ____D C:\Users\Ricky\AppData\Local\Comms
2021-12-11 00:44 - 2021-12-14 19:49 - 000000000 ____D C:\Program Files (x86)\Google
2021-12-11 00:44 - 2021-12-11 12:22 - 000002247 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2021-12-11 00:44 - 2021-12-11 12:22 - 000002206 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2021-12-11 00:44 - 2021-12-11 00:48 - 000000000 ____D C:\Users\Ricky\AppData\Local\Google
2021-12-11 00:44 - 2021-12-11 00:44 - 000003474 _____ C:\WINDOWS\system32\Tasks\GoogleUpdateTaskMachineUA
2021-12-11 00:44 - 2021-12-11 00:44 - 000003350 _____ C:\WINDOWS\system32\Tasks\GoogleUpdateTaskMachineCore
2021-12-11 00:44 - 2021-12-11 00:44 - 000000000 ____D C:\Program Files\Google
2021-12-11 00:39 - 2021-12-14 18:23 - 000000000 ____D C:\Users\Ricky\AppData\LocalLow\Mozilla
2021-12-11 00:39 - 2021-12-11 00:39 - 000001005 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Firefox.lnk
2021-12-11 00:39 - 2021-12-11 00:39 - 000000993 _____ C:\Users\Public\Desktop\Firefox.lnk
2021-12-11 00:39 - 2021-12-11 00:39 - 000000000 ____D C:\WINDOWS\system32\Tasks\Mozilla
2021-12-11 00:39 - 2021-12-11 00:39 - 000000000 ____D C:\Users\Ricky\AppData\Roaming\Mozilla
2021-12-11 00:39 - 2021-12-11 00:39 - 000000000 ____D C:\Users\Ricky\AppData\Local\Mozilla
2021-12-11 00:38 - 2021-12-14 14:30 - 000000000 ____D C:\ProgramData\Mozilla
2021-12-11 00:38 - 2021-12-11 21:08 - 000000000 ____D C:\Program Files\Mozilla Firefox
2021-12-11 00:38 - 2021-12-11 00:38 - 000000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2021-12-11 00:35 - 2021-12-11 00:35 - 000004206 _____ C:\WINDOWS\system32\Tasks\Opera scheduled Autoupdate 1639179332
2021-12-11 00:35 - 2021-12-11 00:35 - 000001423 _____ C:\Users\Ricky\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Prohlížeč Opera.lnk
2021-12-11 00:35 - 2021-12-11 00:35 - 000001405 _____ C:\Users\Ricky\Desktop\Prohlížeč Opera.lnk
2021-12-11 00:35 - 2021-12-11 00:35 - 000000436 _____ C:\Users\Ricky\Desktop\Tento počítač.lnk
2021-12-11 00:35 - 2021-12-11 00:35 - 000000000 ____D C:\Users\Ricky\AppData\Local\Opera Software
2021-12-11 00:34 - 2021-12-11 00:35 - 000000000 ___HD C:\Users\Ricky\Downloads\.opera
2021-12-11 00:34 - 2021-12-11 00:34 - 000000000 ____D C:\Users\Ricky\AppData\Roaming\Opera Software
2021-12-11 00:32 - 2021-12-13 12:25 - 000003580 _____ C:\WINDOWS\system32\Tasks\OneDrive Reporting Task-S-1-5-21-3294239711-236292038-94065591-1001
2021-12-11 00:32 - 2021-12-11 01:26 - 000000000 ____D C:\Users\Ricky\AppData\Local\PlaceholderTileLogoFolder
2021-12-11 00:31 - 2021-12-13 12:25 - 000003374 _____ C:\WINDOWS\system32\Tasks\OneDrive Standalone Update Task-S-1-5-21-3294239711-236292038-94065591-1001
2021-12-11 00:31 - 2021-12-11 00:31 - 000000000 ___RD C:\Users\Ricky\OneDrive
2021-12-11 00:31 - 2021-12-11 00:31 - 000000000 ____D C:\ProgramData\Microsoft OneDrive
2021-12-11 00:29 - 2021-12-14 14:29 - 000000000 ____D C:\Users\Ricky\AppData\Local\D3DSCache
2021-12-11 00:29 - 2021-12-11 14:17 - 000002342 _____ C:\Users\Ricky\Desktop\Microsoft Edge.lnk
2021-12-11 00:29 - 2021-12-11 01:43 - 000000000 ____D C:\Users\Ricky\AppData\Local\VirtualStore
2021-12-11 00:29 - 2021-12-11 00:51 - 000000000 ____D C:\Users\Ricky\AppData\Local\Packages
2021-12-11 00:29 - 2021-12-11 00:51 - 000000000 ____D C:\ProgramData\Packages
2021-12-11 00:29 - 2021-12-11 00:29 - 000000000 __RHD C:\Users\Public\AccountPictures
2021-12-11 00:29 - 2021-12-11 00:29 - 000000000 ___RD C:\Users\Ricky\3D Objects
2021-12-11 00:29 - 2021-12-11 00:29 - 000000000 ____D C:\Users\Ricky\AppData\Roaming\Adobe
2021-12-11 00:29 - 2021-12-11 00:29 - 000000000 ____D C:\Users\Ricky\AppData\LocalLow\AMD
2021-12-11 00:29 - 2021-12-11 00:29 - 000000000 ____D C:\Users\Ricky\AppData\Local\Publishers
2021-12-11 00:29 - 2021-12-11 00:29 - 000000000 ____D C:\Users\Ricky\AppData\Local\AMD
2021-12-11 00:28 - 2021-12-11 00:29 - 000000000 ____D C:\Users\Ricky\AppData\Local\ConnectedDevicesPlatform
2021-12-11 00:27 - 2021-12-13 12:25 - 000002373 _____ C:\Users\Ricky\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OneDrive.lnk
2021-12-11 00:27 - 2021-12-11 00:31 - 000000000 ____D C:\Users\Ricky
2021-12-11 00:27 - 2021-12-11 00:27 - 000000020 ___SH C:\Users\Ricky\ntuser.ini
2021-12-11 00:27 - 2021-12-11 00:27 - 000000000 _SHDL C:\Users\Ricky\Šablony
2021-12-11 00:27 - 2021-12-11 00:27 - 000000000 _SHDL C:\Users\Ricky\Soubory cookie
2021-12-11 00:27 - 2021-12-11 00:27 - 000000000 _SHDL C:\Users\Ricky\Poslední
2021-12-11 00:27 - 2021-12-11 00:27 - 000000000 _SHDL C:\Users\Ricky\Okolní tiskárny
2021-12-11 00:27 - 2021-12-11 00:27 - 000000000 _SHDL C:\Users\Ricky\Okolní síť
2021-12-11 00:27 - 2021-12-11 00:27 - 000000000 _SHDL C:\Users\Ricky\Nabídka Start
2021-12-11 00:27 - 2021-12-11 00:27 - 000000000 _SHDL C:\Users\Ricky\Dokumenty
2021-12-11 00:27 - 2021-12-11 00:27 - 000000000 _SHDL C:\Users\Ricky\Documents\Obrázky
2021-12-11 00:27 - 2021-12-11 00:27 - 000000000 _SHDL C:\Users\Ricky\Documents\Hudba
2021-12-11 00:27 - 2021-12-11 00:27 - 000000000 _SHDL C:\Users\Ricky\Documents\Filmy
2021-12-11 00:27 - 2021-12-11 00:27 - 000000000 _SHDL C:\Users\Ricky\Data aplikací
2021-12-11 00:27 - 2021-12-11 00:27 - 000000000 _SHDL C:\Users\Ricky\AppData\Roaming\Microsoft\Windows\Start Menu\Programy
2021-12-11 00:27 - 2021-12-11 00:27 - 000000000 _SHDL C:\Users\Ricky\AppData\Local\Data aplikací
2021-12-11 00:20 - 2021-12-14 18:34 - 001693136 _____ C:\WINDOWS\system32\PerfStringBackup.INI
2021-12-11 00:15 - 2021-12-11 00:15 - 000000000 _SHDL C:\Users\Public\Documents\Obrázky
2021-12-11 00:15 - 2021-12-11 00:15 - 000000000 _SHDL C:\Users\Public\Documents\Hudba
2021-12-11 00:15 - 2021-12-11 00:15 - 000000000 _SHDL C:\Users\Public\Documents\Filmy
2021-12-11 00:15 - 2021-12-11 00:15 - 000000000 _SHDL C:\Users\Default\Šablony
2021-12-11 00:15 - 2021-12-11 00:15 - 000000000 _SHDL C:\Users\Default\Soubory cookie
2021-12-11 00:15 - 2021-12-11 00:15 - 000000000 _SHDL C:\Users\Default\Poslední
2021-12-11 00:15 - 2021-12-11 00:15 - 000000000 _SHDL C:\Users\Default\Okolní tiskárny
2021-12-11 00:15 - 2021-12-11 00:15 - 000000000 _SHDL C:\Users\Default\Okolní síť
2021-12-11 00:15 - 2021-12-11 00:15 - 000000000 _SHDL C:\Users\Default\Nabídka Start
2021-12-11 00:15 - 2021-12-11 00:15 - 000000000 _SHDL C:\Users\Default\Documents\Obrázky
2021-12-11 00:15 - 2021-12-11 00:15 - 000000000 _SHDL C:\Users\Default\Documents\Hudba
2021-12-11 00:15 - 2021-12-11 00:15 - 000000000 _SHDL C:\Users\Default\Documents\Filmy
2021-12-11 00:15 - 2021-12-11 00:15 - 000000000 _SHDL C:\Users\Default\Data aplikací
2021-12-11 00:15 - 2021-12-11 00:15 - 000000000 _SHDL C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programy
2021-12-11 00:15 - 2021-12-11 00:15 - 000000000 _SHDL C:\Users\Default\AppData\Local\Data aplikací
2021-12-11 00:15 - 2021-12-11 00:15 - 000000000 _SHDL C:\ProgramData\Šablony
2021-12-11 00:15 - 2021-12-11 00:15 - 000000000 _SHDL C:\ProgramData\Plocha
2021-12-11 00:15 - 2021-12-11 00:15 - 000000000 _SHDL C:\ProgramData\Nabídka Start
2021-12-11 00:15 - 2021-12-11 00:15 - 000000000 _SHDL C:\ProgramData\Microsoft\Windows\Start Menu\Programy
2021-12-11 00:15 - 2021-12-11 00:15 - 000000000 _SHDL C:\ProgramData\Dokumenty
2021-12-11 00:15 - 2021-12-11 00:15 - 000000000 _SHDL C:\ProgramData\Data aplikací
2021-12-11 00:15 - 2021-12-11 00:15 - 000000000 _SHDL C:\Documents and Settings
2021-12-11 00:14 - 2021-12-11 00:14 - 000000000 _SHDL C:\Users\Default\Dokumenty
2021-12-11 00:14 - 2021-12-11 00:14 - 000000000 ____D C:\WINDOWS\CSC
2021-12-11 00:04 - 2021-12-11 12:23 - 000002436 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Edge.lnk
2021-12-11 00:03 - 2021-12-14 18:24 - 000065536 _____ C:\WINDOWS\psp_storage.bin
2021-12-11 00:03 - 2021-12-11 00:03 - 000000000 ____D C:\Program Files\AMD
2021-12-11 00:01 - 2021-12-11 12:11 - 000003584 _____ C:\WINDOWS\system32\Tasks\MicrosoftEdgeUpdateTaskMachineUA
2021-12-11 00:01 - 2021-12-11 12:11 - 000003460 _____ C:\WINDOWS\system32\Tasks\MicrosoftEdgeUpdateTaskMachineCore
2021-12-11 00:00 - 2021-12-14 18:25 - 000000006 ____H C:\WINDOWS\Tasks\SA.DAT
2021-12-11 00:00 - 2021-12-11 02:37 - 000000000 ____D C:\WINDOWS\system32\Drivers\wd
2021-12-10 23:59 - 2021-12-14 18:26 - 000446080 _____ C:\WINDOWS\system32\FNTCACHE.DAT
2021-12-10 23:59 - 2021-12-14 18:25 - 000008192 ___SH C:\DumpStack.log.tmp
2021-12-10 23:59 - 2021-12-13 21:31 - 000000000 ____D C:\WINDOWS\system32\SleepStudy
2021-12-10 23:59 - 2021-12-10 23:59 - 000000000 ____D C:\WINDOWS\ServiceProfiles
2021-12-10 23:58 - 2021-12-11 00:03 - 000000000 ____D C:\WINDOWS\system32\AMD
2021-12-10 23:30 - 2021-12-11 00:16 - 000000000 ____D C:\WINDOWS\Panther
2021-12-10 23:11 - 2021-12-10 23:11 - 000000000 ____D C:\ProgramData\ssh
2021-12-10 23:02 - 2021-12-10 23:02 - 001687040 _____ C:\WINDOWS\system32\libcrypto.dll
2021-12-10 23:01 - 2021-12-10 23:01 - 000581120 _____ (Microsoft Corporation) C:\WINDOWS\system32\PhotoScreensaver.scr
2021-12-10 23:01 - 2021-12-10 23:01 - 000499200 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\PhotoScreensaver.scr
2021-12-10 23:01 - 2021-12-10 23:01 - 000480256 _____ C:\WINDOWS\system32\AssignedAccessCsp.dll
2021-12-10 23:01 - 2021-12-10 23:01 - 000203264 _____ C:\WINDOWS\system32\uwfcfgmgmt.dll
2021-12-10 23:01 - 2021-12-10 23:01 - 000158208 _____ C:\WINDOWS\system32\uwfcsp.dll
2021-12-10 23:01 - 2021-12-10 23:01 - 000138056 _____ C:\WINDOWS\system32\HvsiManagementApi.dll
2021-12-10 23:01 - 2021-12-10 23:01 - 000101704 _____ C:\WINDOWS\SysWOW64\HvsiManagementApi.dll
2021-12-10 23:01 - 2021-12-10 23:01 - 000095744 _____ C:\WINDOWS\system32\VirtualMonitorManager.dll
2021-12-10 23:01 - 2021-12-10 23:01 - 000040960 _____ C:\WINDOWS\system32\uwfservicingapi.dll
2021-12-10 23:00 - 2021-12-10 23:00 - 000170496 _____ C:\WINDOWS\system32\DeviceUpdateCenterCsp.dll
2021-12-10 23:00 - 2021-12-10 23:00 - 000053760 _____ C:\WINDOWS\SysWOW64\BWContextHandler.dll
2021-12-10 23:00 - 2021-12-10 23:00 - 000045880 _____ C:\WINDOWS\system32\HvSocket.dll
2021-12-10 22:59 - 2021-12-10 22:59 - 003860832 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rtmpltfm.dll
2021-12-10 22:59 - 2021-12-10 22:59 - 002371072 _____ C:\WINDOWS\system32\rdpnano.dll
2021-12-10 22:59 - 2021-12-10 22:59 - 000980320 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rtmpal.dll
2021-12-10 22:59 - 2021-12-10 22:59 - 000915296 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rtmcodecs.dll
2021-12-10 22:59 - 2021-12-10 22:59 - 000732000 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ortcengine.dll
2021-12-10 22:59 - 2021-12-10 22:59 - 000672768 _____ C:\WINDOWS\system32\FsNVSDeviceSource.dll
2021-12-10 22:59 - 2021-12-10 22:59 - 000067072 _____ C:\WINDOWS\system32\BWContextHandler.dll
2021-12-10 22:59 - 2021-12-10 22:59 - 000055376 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rtmmvrortc.dll
2021-12-10 22:58 - 2021-12-10 22:58 - 002111488 _____ (Digimarc) C:\WINDOWS\SysWOW64\DMRCDecoder.dll
2021-12-10 22:58 - 2021-12-10 22:58 - 001864192 _____ (The ICU Project) C:\WINDOWS\SysWOW64\icu.dll
2021-12-10 22:58 - 2021-12-10 22:58 - 001333760 _____ C:\WINDOWS\SysWOW64\TextInputMethodFormatter.dll
2021-12-10 22:58 - 2021-12-10 22:58 - 000611960 _____ C:\WINDOWS\SysWOW64\TextShaping.dll
2021-12-10 22:58 - 2021-12-10 22:58 - 000468440 _____ C:\WINDOWS\SysWOW64\WindowManagementAPI.dll
2021-12-10 22:58 - 2021-12-10 22:58 - 000266240 _____ C:\WINDOWS\SysWOW64\Windows.Internal.UI.Shell.WindowTabManager.dll
2021-12-10 22:58 - 2021-12-10 22:58 - 000235520 _____ C:\WINDOWS\SysWOW64\HeatCore.dll
2021-12-10 22:58 - 2021-12-10 22:58 - 000047472 _____ C:\WINDOWS\SysWOW64\umpdc.dll
2021-12-10 22:58 - 2021-12-10 22:58 - 000039936 _____ (Adobe Systems) C:\WINDOWS\SysWOW64\atmlib.dll
2021-12-10 22:57 - 2021-12-10 22:57 - 004898144 _____ (Microsoft Corporation) C:\WINDOWS\system32\rtmpltfm.dll
2021-12-10 22:57 - 2021-12-10 22:57 - 001354080 _____ (Microsoft Corporation) C:\WINDOWS\system32\rtmpal.dll
2021-12-10 22:57 - 2021-12-10 22:57 - 001164288 _____ C:\WINDOWS\system32\MBR2GPT.EXE
2021-12-10 22:57 - 2021-12-10 22:57 - 001091936 _____ (Microsoft Corporation) C:\WINDOWS\system32\rtmcodecs.dll
2021-12-10 22:57 - 2021-12-10 22:57 - 001032544 _____ (Microsoft Corporation) C:\WINDOWS\system32\ortcengine.dll
2021-12-10 22:57 - 2021-12-10 22:57 - 000330752 _____ C:\WINDOWS\SysWOW64\ssdm.dll
2021-12-10 22:57 - 2021-12-10 22:57 - 000240640 _____ C:\WINDOWS\SysWOW64\CoreMas.dll
2021-12-10 22:57 - 2021-12-10 22:57 - 000223744 _____ C:\WINDOWS\SysWOW64\TpmTool.exe
2021-12-10 22:57 - 2021-12-10 22:57 - 000056672 _____ (Microsoft Corporation) C:\WINDOWS\system32\rtmmvrortc.dll
2021-12-10 22:57 - 2021-12-10 22:57 - 000010752 _____ C:\WINDOWS\SysWOW64\agentactivationruntimestarter.exe
2021-12-10 22:56 - 2021-12-10 22:56 - 002260480 _____ (The ICU Project) C:\WINDOWS\system32\icu.dll
2021-12-10 22:56 - 2021-12-10 22:56 - 002254336 _____ C:\WINDOWS\system32\dwmscene.dll
2021-12-10 22:56 - 2021-12-10 22:56 - 000657464 _____ C:\WINDOWS\system32\WindowManagementAPI.dll
2021-12-10 22:56 - 2021-12-10 22:56 - 000231248 _____ C:\WINDOWS\system32\containerdevicemanagement.dll
2021-12-10 22:56 - 2021-12-10 22:56 - 000190976 _____ C:\WINDOWS\system32\BthpanContextHandler.dll
2021-12-10 22:56 - 2021-12-10 22:56 - 000152064 _____ C:\WINDOWS\system32\EoAExperiences.exe
2021-12-10 22:56 - 2021-12-10 22:56 - 000098304 _____ C:\WINDOWS\system32\Drivers\cimfs.sys
2021-12-10 22:56 - 2021-12-10 22:56 - 000060928 _____ C:\WINDOWS\system32\runexehelper.exe
2021-12-10 22:56 - 2021-12-10 22:56 - 000048640 _____ (Adobe Systems) C:\WINDOWS\system32\atmlib.dll
2021-12-10 22:56 - 2021-12-10 22:56 - 000029696 _____ (The ICU Project) C:\WINDOWS\system32\icuuc.dll
2021-12-10 22:56 - 2021-12-10 22:56 - 000025088 _____ (The ICU Project) C:\WINDOWS\system32\icuin.dll
2021-12-10 22:56 - 2021-12-10 22:56 - 000001370 _____ C:\WINDOWS\system32\ThirdPartyNoticesBySHS.txt
2021-12-10 22:55 - 2021-12-10 22:55 - 002295296 _____ (Digimarc) C:\WINDOWS\system32\DMRCDecoder.dll
2021-12-10 22:55 - 2021-12-10 22:55 - 002260992 _____ C:\WINDOWS\system32\TextInputMethodFormatter.dll
2021-12-10 22:55 - 2021-12-10 22:55 - 000706536 _____ C:\WINDOWS\system32\TextShaping.dll
2021-12-10 22:55 - 2021-12-10 22:55 - 000363520 _____ C:\WINDOWS\system32\Windows.Internal.UI.Shell.WindowTabManager.dll
2021-12-10 22:55 - 2021-12-10 22:55 - 000306688 _____ C:\WINDOWS\system32\HeatCore.dll
2021-12-10 22:55 - 2021-12-10 22:55 - 000272384 _____ C:\WINDOWS\system32\TpmTool.exe
2021-12-10 22:54 - 2021-12-10 22:54 - 004227116 _____ C:\WINDOWS\system32\DefaultHrtfs.bin
2021-12-10 22:54 - 2021-12-10 22:54 - 000455168 _____ C:\WINDOWS\system32\ssdm.dll
2021-12-10 22:54 - 2021-12-10 22:54 - 000288768 _____ C:\WINDOWS\system32\Windows.Management.InprocObjects.dll
2021-12-10 22:54 - 2021-12-10 22:54 - 000287232 _____ C:\WINDOWS\system32\CoreMas.dll
2021-12-10 22:54 - 2021-12-10 22:54 - 000197632 _____ C:\WINDOWS\system32\IHDS.dll
2021-12-10 22:54 - 2021-12-10 22:54 - 000089088 _____ C:\WINDOWS\system32\windows.applicationmodel.conversationalagent.proxystub.dll
2021-12-10 22:54 - 2021-12-10 22:54 - 000074240 _____ C:\WINDOWS\system32\rdsxvmaudio.dll
2021-12-10 22:54 - 2021-12-10 22:54 - 000073216 _____ C:\WINDOWS\system32\windows.applicationmodel.conversationalagent.internal.proxystub.dll
2021-12-10 22:54 - 2021-12-10 22:54 - 000064552 _____ C:\WINDOWS\system32\umpdc.dll
2021-12-10 22:54 - 2021-12-10 22:54 - 000013312 _____ C:\WINDOWS\system32\agentactivationruntimestarter.exe
2021-12-10 22:34 - 2021-12-10 22:34 - 000000000 ____D C:\WINDOWS\SysWOW64\XPSViewer
2021-12-10 22:33 - 2021-12-11 18:21 - 000000000 ____D C:\Program Files (x86)\MSBuild
2021-12-10 22:33 - 2021-12-10 22:33 - 000000000 ____D C:\Program Files\Reference Assemblies
2021-12-10 22:33 - 2021-12-10 22:33 - 000000000 ____D C:\Program Files\MSBuild
2021-12-10 22:33 - 2021-12-10 22:33 - 000000000 ____D C:\Program Files (x86)\Reference Assemblies
2021-12-10 22:19 - 2021-12-10 22:19 - 000008192 _____ C:\WINDOWS\system32\config\userdiff
2021-12-10 21:53 - 2021-12-10 23:32 - 000000000 ___HD C:\$SysReset
2021-12-10 20:04 - 2021-11-11 23:54 - 000106407 _____ C:\Users\Ricky\Desktop\LC.xlsx
2021-12-10 19:36 - 2021-12-11 15:40 - 000000000 ____D C:\Users\Ricky\Desktop\Survey
2021-12-10 19:35 - 2021-12-11 15:40 - 000000000 ____D C:\Users\Ricky\Desktop\NHL 09 Roster Checker
2021-12-10 19:35 - 2021-12-11 15:40 - 000000000 ____D C:\Users\Ricky\Desktop\GPC
2021-12-10 19:31 - 2021-12-11 15:39 - 000000000 ____D C:\Users\Ricky\Desktop\Surveytime návod

==================== One month (modified) ==================

(If an entry is included in the fixlist, the file/folder will be moved.)

2021-12-14 20:18 - 2019-12-07 10:14 - 000000000 ____D C:\ProgramData\regid.1991-06.com.microsoft
2021-12-14 18:34 - 2019-12-07 15:43 - 000716726 _____ C:\WINDOWS\system32\perfh005.dat
2021-12-14 18:34 - 2019-12-07 15:43 - 000144904 _____ C:\WINDOWS\system32\perfc005.dat
2021-12-14 18:34 - 2019-12-07 10:13 - 000000000 ____D C:\WINDOWS\INF
2021-12-14 18:24 - 2019-12-07 10:03 - 000524288 _____ C:\WINDOWS\system32\config\BBI
2021-12-14 14:36 - 2019-12-07 10:14 - 000000000 ___HD C:\WINDOWS\ELAMBKUP
2021-12-13 22:30 - 2019-12-07 10:03 - 000000000 ____D C:\WINDOWS\CbsTemp
2021-12-13 22:18 - 2019-12-07 10:03 - 000000000 ____D C:\WINDOWS\servicing
2021-12-13 14:22 - 2019-12-07 10:14 - 000000000 ____D C:\WINDOWS\AppReadiness
2021-12-11 19:55 - 2021-06-08 17:58 - 000010818 _____ C:\Users\Ricky\Documents\Stats2021.xlsx
2021-12-11 18:20 - 2019-12-07 10:14 - 000000000 ____D C:\Program Files\Common Files\microsoft shared
2021-12-11 18:18 - 2019-12-07 10:14 - 000000167 _____ C:\WINDOWS\win.ini
2021-12-11 17:19 - 2021-02-19 21:09 - 000096008 _____ (AO Kaspersky Lab) C:\WINDOWS\system32\Drivers\klpnpflt.sys
2021-12-11 17:16 - 2019-12-07 10:03 - 000032768 _____ C:\WINDOWS\system32\config\ELAM
2021-12-11 15:40 - 2020-04-12 19:30 - 000000000 ____D C:\Users\Ricky\Documents\GamSt
2021-12-11 15:39 - 2020-02-16 16:06 - 000000000 ____D C:\Users\Ricky\Desktop\Bazos
2021-12-11 14:14 - 2019-12-07 10:14 - 000000000 ____D C:\WINDOWS\SystemResources
2021-12-11 14:14 - 2019-12-07 10:14 - 000000000 ____D C:\WINDOWS\system32\oobe
2021-12-11 14:13 - 2019-12-07 15:47 - 000000000 ____D C:\Program Files\Windows Defender Advanced Threat Protection
2021-12-11 14:13 - 2019-12-07 10:14 - 000000000 ___RD C:\WINDOWS\ImmersiveControlPanel
2021-12-11 14:13 - 2019-12-07 10:14 - 000000000 ____D C:\WINDOWS\system32\lv-LV
2021-12-11 14:13 - 2019-12-07 10:14 - 000000000 ____D C:\WINDOWS\system32\lt-LT
2021-12-11 14:13 - 2019-12-07 10:14 - 000000000 ____D C:\WINDOWS\system32\et-EE
2021-12-11 14:13 - 2019-12-07 10:14 - 000000000 ____D C:\WINDOWS\system32\es-MX
2021-12-11 14:13 - 2019-12-07 10:14 - 000000000 ____D C:\WINDOWS\Provisioning
2021-12-11 14:13 - 2019-12-07 10:14 - 000000000 ____D C:\WINDOWS\PolicyDefinitions
2021-12-11 14:13 - 2019-12-07 10:14 - 000000000 ____D C:\WINDOWS\bcastdvr
2021-12-11 12:14 - 2019-12-07 10:14 - 000000000 ___HD C:\Program Files\WindowsApps
2021-12-11 12:10 - 2019-12-07 10:14 - 000000000 ____D C:\WINDOWS\appcompat
2021-12-11 02:37 - 2019-12-07 10:14 - 000000000 ____D C:\Program Files\Windows Defender
2021-12-11 00:48 - 2019-12-07 10:14 - 000000000 ____D C:\WINDOWS\ServiceState
2021-12-11 00:45 - 2019-12-07 10:14 - 000000000 ___RD C:\WINDOWS\PrintDialog
2021-12-11 00:27 - 2019-12-07 10:14 - 000000000 ____D C:\WINDOWS\system32\WinBioDatabase
2021-12-11 00:17 - 2019-12-07 15:45 - 000000000 ____D C:\WINDOWS\system32\FxsTmp
2021-12-11 00:17 - 2019-12-07 10:14 - 000000000 ____D C:\WINDOWS\system32\spool
2021-12-11 00:15 - 2019-12-07 10:14 - 000000000 ____D C:\Program Files\Windows NT
2021-12-11 00:04 - 2019-12-07 10:14 - 000000000 ____D C:\ProgramData\USOPrivate
2021-12-10 23:28 - 2019-12-07 10:14 - 000028672 _____ C:\WINDOWS\system32\config\BCD-Template
2021-12-10 23:12 - 2019-12-07 10:14 - 000000000 ____D C:\WINDOWS\SysWOW64\WinMetadata
2021-12-10 23:12 - 2019-12-07 10:14 - 000000000 ____D C:\WINDOWS\SysWOW64\setup
2021-12-10 23:12 - 2019-12-07 10:14 - 000000000 ____D C:\WINDOWS\SysWOW64\PerceptionSimulation
2021-12-10 23:12 - 2019-12-07 10:14 - 000000000 ____D C:\WINDOWS\SysWOW64\oobe
2021-12-10 23:12 - 2019-12-07 10:14 - 000000000 ____D C:\WINDOWS\SysWOW64\migwiz
2021-12-10 23:12 - 2019-12-07 10:14 - 000000000 ____D C:\WINDOWS\SysWOW64\lv-LV
2021-12-10 23:12 - 2019-12-07 10:14 - 000000000 ____D C:\WINDOWS\SysWOW64\lt-LT
2021-12-10 23:11 - 2019-12-07 15:47 - 000000000 ___SD C:\WINDOWS\system32\AppV
2021-12-10 23:11 - 2019-12-07 15:47 - 000000000 ____D C:\Program Files\Windows Photo Viewer
2021-12-10 23:11 - 2019-12-07 15:47 - 000000000 ____D C:\Program Files (x86)\Windows Photo Viewer
2021-12-10 23:11 - 2019-12-07 15:44 - 000000000 ____D C:\WINDOWS\system32\OpenSSH
2021-12-10 23:11 - 2019-12-07 10:14 - 000000000 ___SD C:\WINDOWS\SysWOW64\F12
2021-12-10 23:11 - 2019-12-07 10:14 - 000000000 ___SD C:\WINDOWS\SysWOW64\DiagSvcs
2021-12-10 23:11 - 2019-12-07 10:14 - 000000000 ___SD C:\WINDOWS\system32\UNP
2021-12-10 23:11 - 2019-12-07 10:14 - 000000000 ___SD C:\WINDOWS\system32\F12
2021-12-10 23:11 - 2019-12-07 10:14 - 000000000 ___SD C:\WINDOWS\system32\DiagSvcs
2021-12-10 23:11 - 2019-12-07 10:14 - 000000000 ____D C:\WINDOWS\SysWOW64\Keywords
2021-12-10 23:11 - 2019-12-07 10:14 - 000000000 ____D C:\WINDOWS\SysWOW64\et-EE
2021-12-10 23:11 - 2019-12-07 10:14 - 000000000 ____D C:\WINDOWS\SysWOW64\Dism
2021-12-10 23:11 - 2019-12-07 10:14 - 000000000 ____D C:\WINDOWS\SysWOW64\Com
2021-12-10 23:11 - 2019-12-07 10:14 - 000000000 ____D C:\WINDOWS\SysWOW64\AdvancedInstallers
2021-12-10 23:11 - 2019-12-07 10:14 - 000000000 ____D C:\WINDOWS\system32\WinMetadata
2021-12-10 23:11 - 2019-12-07 10:14 - 000000000 ____D C:\WINDOWS\system32\WinBioPlugIns
2021-12-10 23:11 - 2019-12-07 10:14 - 000000000 ____D C:\WINDOWS\system32\SystemResetPlatform
2021-12-10 23:11 - 2019-12-07 10:14 - 000000000 ____D C:\WINDOWS\system32\Sysprep
2021-12-10 23:11 - 2019-12-07 10:14 - 000000000 ____D C:\WINDOWS\system32\ShellExperiences
2021-12-10 23:11 - 2019-12-07 10:14 - 000000000 ____D C:\WINDOWS\system32\setup
2021-12-10 23:11 - 2019-12-07 10:14 - 000000000 ____D C:\WINDOWS\system32\PerceptionSimulation
2021-12-10 23:11 - 2019-12-07 10:14 - 000000000 ____D C:\WINDOWS\system32\migwiz
2021-12-10 23:11 - 2019-12-07 10:14 - 000000000 ____D C:\WINDOWS\system32\Keywords
2021-12-10 23:11 - 2019-12-07 10:14 - 000000000 ____D C:\WINDOWS\system32\Dism
2021-12-10 23:11 - 2019-12-07 10:14 - 000000000 ____D C:\WINDOWS\system32\DDFs
2021-12-10 23:11 - 2019-12-07 10:14 - 000000000 ____D C:\WINDOWS\system32\Com
2021-12-10 23:11 - 2019-12-07 10:14 - 000000000 ____D C:\WINDOWS\system32\appraiser
2021-12-10 23:11 - 2019-12-07 10:14 - 000000000 ____D C:\WINDOWS\system32\AdvancedInstallers
2021-12-10 23:11 - 2019-12-07 10:14 - 000000000 ____D C:\WINDOWS\ShellExperiences
2021-12-10 23:11 - 2019-12-07 10:14 - 000000000 ____D C:\WINDOWS\ShellComponents
2021-12-10 23:11 - 2019-12-07 10:14 - 000000000 ____D C:\WINDOWS\IME
2021-12-10 23:11 - 2019-12-07 10:14 - 000000000 ____D C:\WINDOWS\DiagTrack
2021-12-10 23:11 - 2019-12-07 10:14 - 000000000 ____D C:\Program Files\Common Files\System
2021-12-10 23:11 - 2019-12-07 10:14 - 000000000 ____D C:\Program Files (x86)\Windows Defender
2021-12-10 23:09 - 2019-12-07 15:47 - 000023552 _____ (Microsoft Corporation) C:\WINDOWS\system32\OEMDefaultAssociations.dll
2021-12-10 23:09 - 2019-12-07 15:47 - 000020908 _____ C:\WINDOWS\system32\OEMDefaultAssociations.xml
2021-12-10 22:34 - 2019-12-07 10:14 - 000000000 ____D C:\WINDOWS\SysWOW64\MUI
2021-12-10 22:34 - 2019-12-07 10:14 - 000000000 ____D C:\WINDOWS\system32\MUI
2021-12-10 22:31 - 2019-12-07 15:43 - 000000000 ____D C:\WINDOWS\SysWOW64\winrm
2021-12-10 22:31 - 2019-12-07 15:43 - 000000000 ____D C:\WINDOWS\SysWOW64\WCN
2021-12-10 22:31 - 2019-12-07 15:43 - 000000000 ____D C:\WINDOWS\SysWOW64\slmgr
2021-12-10 22:31 - 2019-12-07 15:43 - 000000000 ____D C:\WINDOWS\SysWOW64\Printing_Admin_Scripts
2021-12-10 22:31 - 2019-12-07 15:43 - 000000000 ____D C:\WINDOWS\system32\winrm
2021-12-10 22:31 - 2019-12-07 15:43 - 000000000 ____D C:\WINDOWS\system32\WCN
2021-12-10 22:31 - 2019-12-07 15:43 - 000000000 ____D C:\WINDOWS\system32\slmgr
2021-12-10 22:31 - 2019-12-07 15:43 - 000000000 ____D C:\WINDOWS\system32\Printing_Admin_Scripts
2021-12-06 14:28 - 2021-07-03 11:32 - 000026042 _____ C:\Users\Ricky\Documents\Skiny.xlsx
2021-11-27 20:18 - 2020-04-11 18:34 - 000025600 _____ C:\Users\Ricky\Desktop\Earn2021new.xlsx

==================== SigCheck ============================

(There is no automatic fix for files that do not pass verification.)

==================== End of FRST.txt ========================

Re: Bezpečnostní incident 8.12

Napsal: 14 pro 2021 20:59
od Rudy
Potřebuji vidět obsah souboru fixlog.txt.

Re: Bezpečnostní incident 8.12

Napsal: 14 pro 2021 21:03
od Purchan
a návod jak na to? :D

Udělám norámlně ten test podle návodu kliknu na fix a objeví se no fixlist.txt found

Re: Bezpečnostní incident 8.12

Napsal: 14 pro 2021 21:56
od Rudy
Zkopírujte text odtud: https://forum.viry.cz/viewtopic.php?p=1544732#p1544732 do poznámkového bloku, uložte jej do C:\Users\Ricky\Downloads jako fixlist.txt. Pak znovu spusťte FRST a klikněte na >Fix<. Proběhne mazání položek z fixlistu, pak se PC restartuje. Po restartu vyskočí textový soubor fixlog.txt, jehož obsah zkopírujete sem.

Re: Bezpečnostní incident 8.12

Napsal: 15 pro 2021 12:44
od Purchan
To asi dokážu, jen se zeptám mám teda https://forum.viry.cz/viewtopic.php?p=1544732#p1544732 zkopírovat vše ode mě z toho prvního příspěvku tedy addition + first dohromady?

a když kliknu pak na fix tak musím mu určit cestu nebo si to najde samo?

Děkuji

//offtopic mimochodem v noci a dnes mi nešli žádné klávesnice, svítily obě ale obě jakože fungovali ale při psaní se neukazovalo žádné písmenko musel jsem restartovat proběhla nějaká aktualizace a snad již oka :cry:

Re: Bezpečnostní incident 8.12

Napsal: 15 pro 2021 14:29
od Rudy
Udělejte to přesně tak, jak píšu. Zkopírujte to, co je v rámečku, uložte jak fixlist.txt do stejného adresáře, v němž máte FRST a pak už jen klikněte na fix. Cesta se nezadává a pokud ho uložíte jinam povel se neprovede.

Re: Bezpečnostní incident 8.12

Napsal: 15 pro 2021 18:47
od Purchan
Čili jen toto zkopírovat?

Start

CloseProcesses:
FF ExtraCheck: C:\Program Files\mozilla firefox\defaults\pref\kl_prefs_62fbb8f7_c917_4cf7_957a_aad2b8fa768c.js [2021-12-11] <==== ATTENTION (Points to *.cfg file)
FF ExtraCheck: C:\Program Files\mozilla firefox\kl_config_62fbb8f7_c917_4cf7_957a_aad2b8fa768c.cfg [2021-12-11] <==== ATTENTION
C:\DumpStack.log.tmp

EmptyTemp:
End

Re: Bezpečnostní incident 8.12

Napsal: 15 pro 2021 19:01
od Rudy
Přesně tak.

Re: Bezpečnostní incident 8.12

Napsal: 15 pro 2021 23:04
od Purchan
Fix result of Farbar Recovery Scan Tool (x64) Version: 11-12-2021
Ran by Ricky (15-12-2021 22:54:11) Run:1
Running from C:\Users\Ricky\Downloads
Loaded Profiles: Ricky
Boot Mode: Normal
==============================================

fixlist content:
*****************
Start

CloseProcesses:
FF ExtraCheck: C:\Program Files\mozilla firefox\defaults\pref\kl_prefs_62fbb8f7_c917_4cf7_957a_aad2b8fa768c.js [2021-12-11] <==== ATTENTION (Points to *.cfg file)
FF ExtraCheck: C:\Program Files\mozilla firefox\kl_config_62fbb8f7_c917_4cf7_957a_aad2b8fa768c.cfg [2021-12-11] <==== ATTENTION
C:\DumpStack.log.tmp

EmptyTemp:
End
*****************

Processes closed successfully.
C:\Program Files\mozilla firefox\defaults\pref\kl_prefs_62fbb8f7_c917_4cf7_957a_aad2b8fa768c.js => moved successfully
C:\Program Files\mozilla firefox\kl_config_62fbb8f7_c917_4cf7_957a_aad2b8fa768c.cfg => moved successfully
Could not move "C:\DumpStack.log.tmp" => Scheduled to move on reboot.

=========== EmptyTemp: ==========

BITS transfer queue => 1310720 B
DOMStore, IE Recovery, AppCache, Feeds Cache, Thumbcache, IconCache => 48528906 B
Java, Flash, Steam htmlcache => 0 B
Windows/system/drivers => 10264420 B
Edge => 0 B
Chrome => 695697659 B
Firefox => 194532412 B
Opera => 239993788 B

Temp, IE cache, history, cookies, recent:
Default => 0 B
ProgramData => 0 B
Public => 0 B
systemprofile => 0 B
systemprofile32 => 0 B
LocalService => 46460 B
NetworkService => 54686 B
Ricky => 128390174 B

RecycleBin => 0 B
EmptyTemp: => 1.2 GB temporary data Removed.

================================

Result of scheduled files to move (Boot Mode: Normal) (Date&Time: 15-12-2021 23:02:44)

C:\DumpStack.log.tmp => Could not move

==== End of Fixlog 23:02:44 ====

Re: Bezpečnostní incident 8.12

Napsal: 16 pro 2021 10:33
od Rudy
Smazáno, log by již měl být OK.

Re: Bezpečnostní incident 8.12

Napsal: 16 pro 2021 17:50
od Purchan
Jak jsem říkal, havet co tam byla jsem smazal pomocí malwarebytes a kaspersky dne 9.12 + jsem smazal celý Céčko obnovením do továrního nastavení.

Mělo by to být OKA, ještě se chci zeptat mám si změnit heslo v IB preventivně?

Mám to na heslo a sms ale co jsem viděl v černých ovcích tak sms se dá prý lehce odposlechnout.

Re: Bezpečnostní incident 8.12

Napsal: 16 pro 2021 18:07
od Rudy
Tak nemůžete věřit všemu, co se tvrdí v TV. Heslo si určitě změňte.

Re: Bezpečnostní incident 8.12

Napsal: 04 led 2022 01:37
od Purchan
Mám možná problém, stalo se mi už x krát že po delším nepoužívání klávesnice přestala psát ikdyž ukazovala, že je plně funkční (svítila) o vánocích jsem koupil novou a stalo se mi to již párkrát též znovu. Jediné tlačítko které psalo bylo toto ;;;;;;;;;;;;;;;;;;;;;;;;;;;
Ostatní písmena, nešla nikde psát krom výše zmiňovaného. Windows absolutně nehlásil žádný problém s klávesnicí diagnostika vše oka.

No a dnes jsem si všimnul, něco co upoutalo mou pozornost.

Jak jsem níže v liště jazyk klávesnice tak pod čeština se mi objevil ruský jazyk to mě znepokojuje :?:

Proč se tam objevil ruský jazyk a ne anglický, nic jsem neinstaloval nikde jak právě kontroluju preferované jazyky je tam jen český jazyk.

Může to souviset, s tím hackerem z východního bloku? :x

Od nevím 14.12 2021 jsem nezaznamenal žádné nabourání nic, kromě té klávesnice která přestala psát po delší době neužívání ikdyž svítila a windows říkal že je vše oka. :(

Používám malwarebytes a každý den skenuju a jsem stále clean.
Dále Kaspersky Total Security a taky od 14.12 neobjevily nic špatného.

Nějaká rada prosím, nebo vysvětlení? :cry:

Re: Bezpečnostní incident 8.12

Napsal: 04 led 2022 10:28
od Rudy
Vysvětlení je jednoduché. Pro danou aplikaci máte zapnutý ruský jazyk. Postačí, když ho v přizpůsenbení vypnete. Myslím, že není bezpodmínečně nutné vidět za vším, čemu nerozumíte, hackera. :)