Prosím o kontrolu logu z FRST
Napsal: 22 bře 2022 22:04
Zdravím,
po zapnutí PC a po připojení a odpojení manželčina telefonu (a zároveň jsem byl na facebooku) se mi zbláznilo AVG a začalo vyhazovat oznámení (celkem 96) "Zablokována hrozba....soubor [jméno - hodně číslic a písmen] byl přesunut do karantény, protože v něm byla objevena hroba VBS:Gamaredon-CM [Apt]"
Následně jsem smazal z karantény tyto soubory a udělal jsem sken PC pomocí malwarebytes i AVG a nic to nenašlo.
Prosím tedy pro klid duše o kontrolu logu z FRST.
Díky
Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 20-03-2022
Ran by tkrpe (administrator) on DESKTOP-BFAJQ2D (Micro-Star International Co., Ltd. MS-7B87) (22-03-2022 21:50:23)
Running from C:\Users\tkrpe\Desktop
Loaded Profiles: tkrpe
Platform: Microsoft Windows 10 Pro Version 21H1 19043.1586 (X64) Language: Čeština (Česko)
Default browser: FF
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(Advanced Micro Devices Inc. -> Advanced Micro Devices, Inc.) C:\Program Files\AMD\CNext\CNext\AMDRSServ.exe
(Advanced Micro Devices Inc. -> Advanced Micro Devices, Inc.) C:\Program Files\AMD\CNext\CNext\RadeonSoftware.exe
(AVG Technologies USA, LLC -> AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\Antivirus\AVGUI.exe <4>
(A-Volute SAS -> A-Volute) C:\Users\tkrpe\AppData\Local\NhNotifSys\nahimic\nahimicNotifSys.exe
(C:\Program Files (x86)\RivaTuner Statistics Server\RTSS.exe ->) (Alexey Nicolaychuk -> ) C:\Program Files (x86)\RivaTuner Statistics Server\EncoderServer.exe
(C:\Program Files (x86)\RivaTuner Statistics Server\RTSS.exe ->) (Alexey Nicolaychuk -> ) C:\Program Files (x86)\RivaTuner Statistics Server\RTSSHooksLoader64.exe
(C:\Program Files\AMD\CNext\CNext\AMDRSServ.exe ->) (Advanced Micro Devices Inc. -> Advanced Micro Devices, Inc.) C:\Program Files\AMD\CNext\CNext\amdow.exe
(C:\Program Files\AMD\CNext\CNext\AMDRSServ.exe ->) (Advanced Micro Devices Inc. -> Advanced Micro Devices, Inc.) C:\Program Files\AMD\CNext\CNext\AMDRSSrcExt.exe
(C:\Program Files\AMD\CNext\CNext\RadeonSoftware.exe ->) (Advanced Micro Devices Inc. -> Advanced Micro Devices, Inc.) C:\Program Files\AMD\CNext\CNext\cncmd.exe
(C:\Program Files\AMD\CNext\CNext\RadeonSoftware.exe ->) (The Qt Company Ltd.) [File not signed] C:\Program Files\AMD\CNext\CNext\QtWebEngineProcess.exe
(C:\Program Files\AVG\Antivirus\AVGSvc.exe ->) (AVG Technologies USA, LLC -> AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\Antivirus\aswEngSrv.exe
(C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe ->) (Malwarebytes Inc -> Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe
(DriverStore\FileRepository\u0376209.inf_amd64_b3bdffadea4def3f\B374968\atiesrxx.exe ->) (Advanced Micro Devices Inc. -> AMD) C:\Windows\System32\DriverStore\FileRepository\u0376209.inf_amd64_b3bdffadea4def3f\B374968\atieclxx.exe
(Mozilla Corporation -> Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe <11>
(Razer USA Ltd. -> Razer Inc.) [File not signed] C:\Program Files (x86)\Razer\Synapse\RzSynapse.exe
(services.exe ->) () [File not signed] C:\Program Files (x86)\Edimax\Edimax AC600 Wireless LAN Driver\WPSService20.exe
(services.exe ->) (Adobe Inc. -> Adobe Inc.) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
(services.exe ->) (Advanced Micro Devices Inc. -> Advanced Micro Devices, Inc.) C:\Windows\System32\amdfendrsr.exe
(services.exe ->) (Advanced Micro Devices Inc. -> AMD) C:\Windows\System32\DriverStore\FileRepository\u0376209.inf_amd64_b3bdffadea4def3f\B374968\atiesrxx.exe
(services.exe ->) (Autodesk, Inc. -> Autodesk Inc.) C:\Program Files (x86)\Autodesk\Autodesk Desktop App\AdAppMgrSvc.exe
(services.exe ->) (Autodesk, Inc. -> Autodesk) C:\Program Files (x86)\Common Files\Autodesk Shared\AdskLicensing\10.1.0.3194\AdskLicensingService\AdskLicensingService.exe
(services.exe ->) (AVG Technologies USA, LLC -> AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\Antivirus\afwServ.exe
(services.exe ->) (AVG Technologies USA, LLC -> AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\Antivirus\aswidsagent.exe
(services.exe ->) (AVG Technologies USA, LLC -> AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\Antivirus\AVGSvc.exe
(services.exe ->) (AVG Technologies USA, LLC -> AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\Antivirus\avgToolsSvc.exe
(services.exe ->) (AVG Technologies USA, LLC -> AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\Antivirus\wsc_proxy.exe
(services.exe ->) (A-Volute SAS -> Nahimic) C:\Windows\System32\NahimicService.exe
(services.exe ->) (Electronic Arts, Inc. -> Electronic Arts) C:\Program Files (x86)\Origin\OriginWebHelperService.exe
(services.exe ->) (Even Balance, Inc. -> ) C:\Windows\SysWOW64\PnkBstrA.exe
(services.exe ->) (Flexera Software LLC -> Flexera) C:\Program Files (x86)\Common Files\Macrovision Shared\FlexNet Publisher\FNPLicensingService.exe
(services.exe ->) (Intel Corporation -> Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
(services.exe ->) (Intel Corporation -> Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe
(services.exe ->) (Intel Corporation -> Intel® Corporation) C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe
(services.exe ->) (Malwarebytes Inc -> Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
(services.exe ->) (Microsoft Corporation -> Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe
(services.exe ->) (WIBU-SYSTEMS AG -> WIBU-SYSTEMS AG) C:\Program Files (x86)\CodeMeter\Runtime\bin\CodeMeter.exe
(services.exe ->) (WIBU-SYSTEMS AG -> WIBU-SYSTEMS AG) C:\Program Files\CodeMeter\Runtime\bin\CmWebAdmin.exe
(svchost.exe ->) (Alexey Nicolaychuk -> ) C:\Program Files (x86)\RivaTuner Statistics Server\RTSS.exe
(svchost.exe ->) (Microsoft Corporation) C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.2103.8.0_x64__8wekyb3d8bbwe\Calculator.exe
(svchost.exe ->) (Microsoft Windows -> Microsoft Corporation) C:\Windows\HelpPane.exe
(svchost.exe ->) (Microsoft Windows -> Microsoft Corporation) C:\Windows\ImmersiveControlPanel\SystemSettings.exe
(svchost.exe ->) (Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\dllhost.exe <3>
(svchost.exe ->) (Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\wlanext.exe
==================== Registry (Whitelisted) ===================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [AVGUI.exe] => C:\Program Files\AVG\Antivirus\AvLaunch.exe [190904 2022-02-20] (AVG Technologies USA, LLC -> AVG Technologies CZ, s.r.o.)
HKLM\...\Run: [AdobeAAMUpdater-1.0] => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [446392 2012-04-04] (Adobe Systems Incorporated -> Adobe Systems Incorporated)
HKLM-x32\...\Run: [Razer Synapse] => C:\Program Files (x86)\Razer\Synapse\RzSynapse.exe [599056 2021-10-28] (Razer USA Ltd. -> Razer Inc.) [File not signed]
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [248552 2010-05-14] (Sun Microsystems, Inc. -> Sun Microsystems, Inc.)
HKLM-x32\...\Run: [Autodesk Desktop App] => C:\Program Files (x86)\Autodesk\Autodesk Desktop App\AutodeskDesktopApp.exe [668376 2021-03-04] (Autodesk, Inc. -> Autodesk, Inc.)
HKLM-x32\...\Run: [Autodesk Genuine Service ] => C:\Users\tkrpe\AppData\Local\Programs\Autodesk\Genuine Service\GenuineService.exe [1077864 2020-01-02] (Autodesk, Inc. -> Autodesk)
HKLM-x32\...\Run: [SwitchBoard] => C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Test Signing Certificate -> Adobe Systems Incorporated) [File not signed]
HKLM-x32\...\Run: [AdobeCS6ServiceManager] => C:\Program Files (x86)\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe [1073312 2012-03-09] (Adobe Systems Incorporated -> Adobe Systems Incorporated)
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [VICTORY Gaming Keyboard] => C:\Program Files (x86)\Gaming Keyboard\Monitor.exe [270336 2013-03-30] () [File not signed]
HKU\S-1-5-21-4202080177-88069448-2828812736-1001\...\Run: [Web Companion] => C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe --minimize (No File)
HKU\S-1-5-21-4202080177-88069448-2828812736-1001\...\Run: [AdobeBridge] => [X]
HKU\S-1-5-21-4202080177-88069448-2828812736-1001\...\Policies\Explorer: []
HKU\S-1-5-21-4202080177-88069448-2828812736-1001\...\MountPoints2: {00d7d431-aa03-11ec-a8c1-001a7dda7111} - "D:\HiSuiteDownLoader.exe"
HKU\S-1-5-21-4202080177-88069448-2828812736-1001\...\MountPoints2: {8b696641-d682-11ea-a87f-001a7dda7111} - "D:\HiSuiteDownLoader.exe"
HKU\S-1-5-21-4202080177-88069448-2828812736-1001\...\MountPoints2: {8b6967d5-d682-11ea-a87f-001a7dda7111} - "D:\HiSuiteDownLoader.exe"
HKU\S-1-5-21-4202080177-88069448-2828812736-1001\...\MountPoints2: {ec07a370-d681-11ea-a87f-001a7dda7111} - "D:\HiSuiteDownLoader.exe"
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\CodeMeter Control Center.lnk [2020-09-12]
ShortcutTarget: CodeMeter Control Center.lnk -> C:\Program Files (x86)\CodeMeter\Runtime\bin\CodeMeterCC.exe (WIBU-SYSTEMS AG -> WIBU-SYSTEMS AG)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Network Server.lnk [2020-09-12]
ShortcutTarget: Network Server.lnk -> C:\Program Files (x86)\WIBUKEY\Server\WkSvMgr.exe (WIBU-SYSTEMS AG -> WIBU-SYSTEMS AG)
HKLM\SOFTWARE\Policies\Mozilla\Firefox: Restriction <==== ATTENTION
HKLM\SOFTWARE\Policies\Google: Restriction <==== ATTENTION
==================== Scheduled Tasks (Whitelisted) ============
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
Task: {01665AD6-6E2D-4D73-A92C-1A86C2461F3A} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [1564424 2021-11-17] (Adobe Inc. -> Adobe Inc.)
Task: {08BD7B85-4101-4094-A0B3-F0628C110BD9} - System32\Tasks\ModifyLinkUpdate => C:\Program Files\AMD\CIM\Bin64\InstallManagerApp.exe [1709048 2021-10-05] (Advanced Micro Devices Inc. -> Advanced Micro Devices, Inc.)
Task: {32BA4FF0-3B73-4FAB-A250-B713EBF56326} - System32\Tasks\StartCN => C:\Program Files\AMD\CNext\CNext\cncmd.exe [55288 2021-10-05] (Advanced Micro Devices Inc. -> Advanced Micro Devices, Inc.)
Task: {3B41C374-0FA3-47A7-8A44-CD5FB88B60B6} - System32\Tasks\AVG\Overseer => C:\Program Files\Common Files\AVG\Overseer\overseer.exe [2332984 2022-03-07] (AVG Technologies USA, LLC -> AVG Technologies)
Task: {470E4CBA-710B-472A-A34C-7A06233F3988} - System32\Tasks\AMDInstallLauncher => C:\Program Files\AMD\CIM\Bin64\InstallManagerApp.exe [1709048 2021-10-05] (Advanced Micro Devices Inc. -> Advanced Micro Devices, Inc.)
Task: {4F07AEE5-E7EE-4241-83D5-097D858758DC} - System32\Tasks\Mozilla\Firefox Background Update 308046B0AF4A39CB => C:\Program Files\Mozilla Firefox\firefox.exe --MOZ_LOG sync,prependheader,timestamp,append,maxsize:1,Dump:5 --MOZ_LOG_FILE C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\308046B0AF4A39CB\backgroundupdate.moz_log --backgroundtask backgroundupdate
Task: {583BEE35-1C5F-4E15-8010-7637BD271282} - System32\Tasks\Mozilla\Firefox Default Browser Agent 308046B0AF4A39CB => C:\Program Files\Mozilla Firefox\default-browser-agent.exe do-task "308046B0AF4A39CB"
Task: {7D76B027-E48E-43F2-85C0-64C307F6CA26} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentLogOn2016 => C:\Program Files\Microsoft Office\root\Office16\msoia.exe [8307120 2022-03-07] (Microsoft Corporation -> Microsoft Corporation)
Task: {7F36CBF7-D28A-496C-A6D9-6D7AC936FD96} - System32\Tasks\AMDLinkUpdate => C:\Program Files\AMD\CIM\Bin64\InstallManagerApp.exe [1709048 2021-10-05] (Advanced Micro Devices Inc. -> Advanced Micro Devices, Inc.)
Task: {8C8225C4-93AE-4E73-BE18-DD9EDA1FFB88} - System32\Tasks\Microsoft\Office\Office ClickToRun Service Monitor => C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe [22580696 2022-03-11] (Microsoft Corporation -> Microsoft Corporation)
Task: {92061CE5-7523-49B3-972C-C1B005F455C7} - System32\Tasks\AMDRyzenMasterSDKTask => C:\Program Files\AMD\CNext\CNext\cpumetricsserver.exe [355840 2021-10-05] (Advanced Micro Devices, Inc.) [File not signed]
Task: {96EC998D-2C84-4E1D-9565-96142B30316A} - System32\Tasks\Antivirus Emergency Update => C:\Program Files\AVG\Antivirus\AvEmUpdate.exe [5026232 2022-02-20] (AVG Technologies USA, LLC -> AVG Technologies CZ, s.r.o.)
Task: {AC18BA57-2658-4358-8E3B-D7B0ECACCB72} - System32\Tasks\Microsoft\Office\Office Feature Updates => C:\Program Files\Microsoft Office\root\Office16\sdxhelper.exe [137072 2022-03-11] (Microsoft Corporation -> Microsoft Corporation)
Task: {B001D595-4EB3-4E05-AB62-4B073AFF520E} - System32\Tasks\Microsoft\Office\Office Performance Monitor => C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\operfmon.exe [59232 2022-03-07] (Microsoft Corporation -> Microsoft Corporation)
Task: {B969FEF2-BA81-4F73-8A49-9535DEA4056C} - System32\Tasks\AVAST Software\Gaming mode Task Scheduler recovery => Command(1): schtasks.exe -> /Change /TN "\Adobe Acrobat Update Task" /ENABLE
Task: {B969FEF2-BA81-4F73-8A49-9535DEA4056C} - System32\Tasks\AVAST Software\Gaming mode Task Scheduler recovery => Command(2): schtasks.exe -> /Change /TN "\AMDInstallLauncher" /ENABLE
Task: {B969FEF2-BA81-4F73-8A49-9535DEA4056C} - System32\Tasks\AVAST Software\Gaming mode Task Scheduler recovery => Command(3): schtasks.exe -> /Change /TN "\AMDLinkUpdate" /ENABLE
Task: {B969FEF2-BA81-4F73-8A49-9535DEA4056C} - System32\Tasks\AVAST Software\Gaming mode Task Scheduler recovery => Command(4): schtasks.exe -> /Change /TN "\AMDRyzenMasterSDKTask" /ENABLE
Task: {B969FEF2-BA81-4F73-8A49-9535DEA4056C} - System32\Tasks\AVAST Software\Gaming mode Task Scheduler recovery => Command(5): schtasks.exe -> /Change /TN "\Antivirus Emergency Update" /ENABLE
Task: {B969FEF2-BA81-4F73-8A49-9535DEA4056C} - System32\Tasks\AVAST Software\Gaming mode Task Scheduler recovery => Command(6): schtasks.exe -> /Change /TN "\MicrosoftEdgeUpdateTaskMachineCore" /ENABLE
Task: {B969FEF2-BA81-4F73-8A49-9535DEA4056C} - System32\Tasks\AVAST Software\Gaming mode Task Scheduler recovery => Command(7): schtasks.exe -> /Change /TN "\MicrosoftEdgeUpdateTaskMachineUA" /ENABLE
Task: {B969FEF2-BA81-4F73-8A49-9535DEA4056C} - System32\Tasks\AVAST Software\Gaming mode Task Scheduler recovery => Command(8): schtasks.exe -> /Change /TN "\ModifyLinkUpdate" /ENABLE
Task: {B969FEF2-BA81-4F73-8A49-9535DEA4056C} - System32\Tasks\AVAST Software\Gaming mode Task Scheduler recovery => Command(9): schtasks.exe -> /Change /TN "\RTSS" /ENABLE
Task: {B969FEF2-BA81-4F73-8A49-9535DEA4056C} - System32\Tasks\AVAST Software\Gaming mode Task Scheduler recovery => Command(10): schtasks.exe -> /Change /TN "\StartCN" /ENABLE
Task: {B969FEF2-BA81-4F73-8A49-9535DEA4056C} - System32\Tasks\AVAST Software\Gaming mode Task Scheduler recovery => Command(11): schtasks.exe -> /Change /TN "\StartDVR" /ENABLE
Task: {B969FEF2-BA81-4F73-8A49-9535DEA4056C} - System32\Tasks\AVAST Software\Gaming mode Task Scheduler recovery => Command(12): schtasks.exe -> /Change /TN "\AVAST Software\Gaming mode Task Scheduler recovery" /DISABLE
Task: {CB660A54-25D9-4B98-A54F-C69FC129C2E5} - System32\Tasks\Microsoft\Office\Office Automatic Updates 2.0 => C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe [22580696 2022-03-11] (Microsoft Corporation -> Microsoft Corporation)
Task: {D4D21378-117C-4DE7-8E60-CCED8DB24DAF} - System32\Tasks\RTSS => C:\Program Files (x86)\RivaTuner Statistics Server\RTSS.exe [417160 2021-02-27] (Alexey Nicolaychuk -> )
Task: {D602437E-A652-4052-BAAB-F1F221E1CD48} - System32\Tasks\Microsoft\Office\Office Feature Updates Logon => C:\Program Files\Microsoft Office\root\Office16\sdxhelper.exe [137072 2022-03-11] (Microsoft Corporation -> Microsoft Corporation)
Task: {E13D3BBD-A3F4-4DAB-90A4-101F6ED459E8} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentFallBack2016 => C:\Program Files\Microsoft Office\root\Office16\msoia.exe [8307120 2022-03-07] (Microsoft Corporation -> Microsoft Corporation)
Task: {FAFFE63A-B0D6-42F7-AA67-8FDC45166900} - System32\Tasks\StartDVR => C:\Program Files\AMD\CNext\CNext\RSServCmd.exe [260600 2021-10-05] (Advanced Micro Devices Inc. -> Advanced Micro Devices, Inc.)
(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 10.0.0.138
Tcpip\..\Interfaces\{09d4c20e-0c2b-4750-8bdb-0a44d5f5893a}: [DhcpNameServer] 10.0.0.138
Tcpip\..\Interfaces\{904ad7cb-90a6-4b5a-925c-a1b3caae4380}: [DhcpNameServer] 10.0.0.138
Tcpip\..\Interfaces\{bd3f4503-c6be-4827-81de-e06d44f03454}: [DhcpNameServer] 192.168.0.1
Tcpip\..\Interfaces\{bf4cbe26-8f0b-48c7-b859-142f3864e664}: [DhcpNameServer] 10.0.0.138
Edge:
=======
Edge Extension: (No Name) -> AutoFormFill_5ED10D46BD7E47DEB1F3685D2C0FCE08 => C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\Assets\HostExtensions\AutoFormFill [not found]
Edge Extension: (No Name) -> BookReader_B171F20233094AC88D05A8EF7B9763E8 => C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\Assets\BookViewer [not found]
Edge Extension: (No Name) -> LearningTools_7706F933-971C-41D1-9899-8A026EB5D824 => C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\Assets\HostExtensions\LearningTools [not found]
Edge Extension: (No Name) -> PinJSAPI_EC01B57063BE468FAB6DB7EBFC3BF368 => C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\Assets\HostExtensions\PinJSAPI [not found]
Edge DefaultProfile: Default
Edge Profile: C:\Users\tkrpe\AppData\Local\Microsoft\Edge\User Data\Default [2022-03-22]
FireFox:
========
FF DefaultProfile: 66uq2n4o.default
FF ProfilePath: C:\Users\tkrpe\AppData\Roaming\Mozilla\Firefox\Profiles\66uq2n4o.default [2019-12-10]
FF ProfilePath: C:\Users\tkrpe\AppData\Roaming\Mozilla\Firefox\Profiles\gbk2fvcj.default-release-1647972981330 [2022-03-22]
FF Homepage: Mozilla\Firefox\Profiles\gbk2fvcj.default-release-1647972981330 -> hxxps://www.seznam.cz/
FF Extension: (AdBlocker Ultimate) - C:\Users\tkrpe\AppData\Roaming\Mozilla\Firefox\Profiles\gbk2fvcj.default-release-1647972981330\Extensions\adblockultimate@adblockultimate.net.xpi [2022-03-22]
FF Extension: (Aliexpress SuperStar česky, Historie cen a koruny) - C:\Users\tkrpe\AppData\Roaming\Mozilla\Firefox\Profiles\gbk2fvcj.default-release-1647972981330\Extensions\{49756ccc-44ea-4661-bc1f-2baba64cca2f}.xpi [2022-03-22]
FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office\root\Office16\NPSPWRAP.DLL [2022-03-07] (Microsoft Corporation -> Microsoft Corporation)
FF Plugin: @videolan.org/vlc,version=3.0.8 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2019-08-14] (VideoLAN -> VideoLAN)
FF Plugin: Adobe Acrobat -> C:\Program Files\Adobe\Acrobat DC\Acrobat\Air\nppdf32.dll [2022-03-02] (Adobe Inc. -> Adobe Systems Inc.)
FF Plugin-x32: @java.com/JavaPlugin -> C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll [2020-02-04] (Sun Microsystems, Inc.) [File not signed]
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\NPSPWRAP.DLL [2022-03-07] (Microsoft Corporation -> Microsoft Corporation)
Chrome:
=======
CHR HKLM-x32\...\Chrome\Extension: [mbckjcfnjmoiinpgddefodcighgikkgn]
==================== Services (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
R2 AdAppMgrSvc; C:\Program Files (x86)\Autodesk\Autodesk Desktop App\AdAppMgrSvc.exe [1050920 2021-03-04] (Autodesk, Inc. -> Autodesk Inc.)
R2 AdobeARMservice; C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [169728 2021-11-17] (Adobe Inc. -> Adobe Inc.)
R2 AdskLicensingService; C:\Program Files (x86)\Common Files\Autodesk Shared\AdskLicensing\Current\AdskLicensingService\AdskLicensingService.exe [16930616 2019-12-18] (Autodesk, Inc. -> Autodesk)
R2 AVG Antivirus; C:\Program Files\AVG\Antivirus\AVGSvc.exe [596920 2022-02-20] (AVG Technologies USA, LLC -> AVG Technologies CZ, s.r.o.)
R2 AVG Firewall; C:\Program Files\AVG\Antivirus\afwServ.exe [1943992 2022-02-20] (AVG Technologies USA, LLC -> AVG Technologies CZ, s.r.o.)
R2 AVG Tools; C:\Program Files\AVG\Antivirus\avgToolsSvc.exe [596920 2022-02-20] (AVG Technologies USA, LLC -> AVG Technologies CZ, s.r.o.)
R3 avgbIDSAgent; C:\Program Files\AVG\Antivirus\aswidsagent.exe [8519280 2022-02-20] (AVG Technologies USA, LLC -> AVG Technologies CZ, s.r.o.)
R2 AvgWscReporter; C:\Program Files\AVG\Antivirus\wsc_proxy.exe [109480 2021-06-08] (AVG Technologies USA, LLC -> AVG Technologies CZ, s.r.o.)
R2 ClickToRunSvc; C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe [11649952 2022-03-07] (Microsoft Corporation -> Microsoft Corporation)
R2 CmWebAdmin.exe; C:\Program Files\CodeMeter\Runtime\bin\CmWebAdmin.exe [9199512 2018-02-26] (WIBU-SYSTEMS AG -> WIBU-SYSTEMS AG)
R2 MBAMService; C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe [8019640 2022-03-03] (Malwarebytes Inc -> Malwarebytes)
R2 NahimicService; C:\WINDOWS\system32\NahimicService.exe [1888424 2021-10-08] (A-Volute SAS -> Nahimic)
S3 Origin Client Service; C:\Program Files (x86)\Origin\OriginClientService.exe [2562776 2022-02-15] (Electronic Arts, Inc. -> Electronic Arts)
R2 Origin Web Helper Service; C:\Program Files (x86)\Origin\OriginWebHelperService.exe [3481312 2022-02-15] (Electronic Arts, Inc. -> Electronic Arts)
R2 PnkBstrA; C:\Windows\SysWOW64\PnkBstrA.exe [75136 2020-07-10] (Even Balance, Inc. -> )
S3 Sense; C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe [6228008 2022-03-11] (Microsoft Windows Publisher -> Microsoft Corporation)
S3 SwitchBoard; C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Test Signing Certificate -> Adobe Systems Incorporated) [File not signed]
S3 WdNisSvc; C:\ProgramData\Microsoft\Windows Defender\platform\4.18.1911.3-0\NisSrv.exe [3206472 2019-12-10] (Microsoft Windows Publisher -> Microsoft Corporation)
S3 WinDefend; C:\ProgramData\Microsoft\Windows Defender\platform\4.18.1911.3-0\MsMpEng.exe [103376 2019-12-10] (Microsoft Windows Publisher -> Microsoft Corporation)
R2 WPSService20; C:\Program Files (x86)\Edimax\Edimax AC600 Wireless LAN Driver\WPSService20.exe [96768 2017-11-24] () [File not signed]
===================== Drivers (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
R3 amdfendrmgr; C:\WINDOWS\System32\drivers\amdfendrmgr.sys [41376 2021-07-30] (Advanced Micro Devices Inc. -> Advanced Micro Devices, Inc.)
R3 AMDSAFD; C:\WINDOWS\System32\DriverStore\FileRepository\amdsafd.inf_amd64_50fee1227e96ec14\amdsafd.sys [100792 2021-08-04] (Microsoft Windows Hardware Compatibility Publisher -> Advanced Micro Devices)
R3 amdwddmg; C:\WINDOWS\System32\DriverStore\FileRepository\u0376209.inf_amd64_b3bdffadea4def3f\B374968\amdkmdag.sys [80540576 2022-01-28] (Advanced Micro Devices Inc. -> Advanced Micro Devices, Inc.)
R3 AMDXE; C:\WINDOWS\System32\drivers\amdxe.sys [65168 2021-08-17] (Advanced Micro Devices Inc. -> Advanced Micro Devices, Inc.)
S3 atvi-brynhildr; C:\ProgramData\Battle.net_components\brynhildr_odin\brynhildr.sys [2355952 2022-01-14] (Activision Publishing Inc -> Activision Blizzard, Inc.)
R1 avgArPot; C:\WINDOWS\System32\drivers\avgArPot.sys [226464 2022-02-20] (AVG Technologies USA, LLC -> AVG Technologies CZ, s.r.o.)
R1 avgbidsdriver; C:\WINDOWS\System32\drivers\avgbidsdriver.sys [369768 2022-02-20] (AVG Technologies USA, LLC -> AVG Technologies CZ, s.r.o.)
R0 avgbidsh; C:\WINDOWS\System32\drivers\avgbidsh.sys [253040 2022-02-20] (AVG Technologies USA, LLC -> AVG Technologies CZ, s.r.o.)
R0 avgbuniv; C:\WINDOWS\System32\drivers\avgbuniv.sys [99424 2022-02-20] (AVG Technologies USA, LLC -> AVG Technologies CZ, s.r.o.)
R0 avgElam; C:\WINDOWS\System32\drivers\avgElam.sys [21960 2021-09-23] (Microsoft Windows Early Launch Anti-malware Publisher -> AVG Technologies CZ, s.r.o.)
R1 avgKbd; C:\WINDOWS\System32\drivers\avgKbd.sys [41488 2022-02-20] (AVG Technologies USA, LLC -> AVG Technologies CZ, s.r.o.)
R1 avgMonFlt; C:\WINDOWS\System32\drivers\avgMonFlt.sys [267000 2022-02-20] (AVG Technologies USA, LLC -> AVG Technologies CZ, s.r.o.)
R1 avgNetHub; C:\WINDOWS\System32\drivers\avgNetHub.sys [544880 2022-02-20] (AVG Technologies USA, LLC -> AVG Technologies CZ, s.r.o.)
R1 avgRdr; C:\WINDOWS\System32\drivers\avgRdr2.sys [107992 2022-02-20] (AVG Technologies USA, LLC -> AVG Technologies CZ, s.r.o.)
R0 avgRvrt; C:\WINDOWS\System32\drivers\avgRvrt.sys [83056 2022-02-20] (AVG Technologies USA, LLC -> AVG Technologies CZ, s.r.o.)
R1 avgSnx; C:\WINDOWS\System32\drivers\avgSnx.sys [854416 2022-02-20] (AVG Technologies USA, LLC -> AVG Technologies CZ, s.r.o.)
R1 avgSP; C:\WINDOWS\System32\drivers\avgSP.sys [551576 2022-03-03] (AVG Technologies USA, LLC -> AVG Technologies CZ, s.r.o.)
R2 avgStm; C:\WINDOWS\System32\drivers\avgStm.sys [215024 2022-02-20] (AVG Technologies USA, LLC -> AVG Technologies CZ, s.r.o.)
R0 avgVmm; C:\WINDOWS\System32\drivers\avgVmm.sys [318872 2022-02-20] (AVG Technologies USA, LLC -> AVG Technologies CZ, s.r.o.)
R1 ESProtectionDriver; C:\WINDOWS\system32\drivers\mbae64.sys [160176 2021-08-29] (Microsoft Windows Hardware Compatibility Publisher -> Malwarebytes)
R2 MBAMChameleon; C:\WINDOWS\System32\Drivers\MbamChameleon.sys [221096 2022-03-03] (Microsoft Windows Hardware Compatibility Publisher -> Malwarebytes)
S0 MbamElam; C:\WINDOWS\System32\DRIVERS\MbamElam.sys [19912 2020-09-13] (Microsoft Windows Early Launch Anti-malware Publisher -> Malwarebytes)
R3 MBAMFarflt; C:\WINDOWS\System32\DRIVERS\farflt.sys [194480 2022-03-22] (Microsoft Windows Hardware Compatibility Publisher -> Malwarebytes)
R3 MBAMProtection; C:\WINDOWS\system32\DRIVERS\mbam.sys [69040 2022-03-22] (Microsoft Windows Hardware Compatibility Publisher -> Malwarebytes)
R3 MBAMSwissArmy; C:\WINDOWS\System32\Drivers\mbamswissarmy.sys [248992 2021-12-17] (Malwarebytes Inc -> Malwarebytes)
R3 MBAMWebProtection; C:\WINDOWS\system32\DRIVERS\mwac.sys [156792 2022-03-22] (Malwarebytes Inc -> Malwarebytes)
R3 Nahimic_Mirroring; C:\WINDOWS\System32\drivers\Nahimic_Mirroring.sys [85616 2021-08-13] (A-Volute -> Windows (R) Win 7 DDK provider)
S3 RTCore64; C:\Program Files (x86)\MSI Afterburner\RTCore64.sys [36824 2020-07-13] (MICRO-STAR INTERNATIONAL CO., LTD. -> )
S3 RtlWlanu; C:\WINDOWS\System32\drivers\rtwlanu.sys [12041824 2020-04-30] (Realtek Semiconductor Corp. -> Realtek Semiconductor Corporation)
R3 rzendpt; C:\WINDOWS\System32\drivers\rzendpt.sys [51216 2016-05-12] (Razer USA Ltd. -> Razer Inc)
S3 WdBoot; C:\WINDOWS\system32\drivers\wd\WdBoot.sys [45664 2019-12-10] (Microsoft Windows Early Launch Anti-malware Publisher -> Microsoft Corporation)
S3 WdFilter; C:\WINDOWS\system32\drivers\wd\WdFilter.sys [355760 2019-12-10] (Microsoft Windows -> Microsoft Corporation)
S3 WdNisDrv; C:\WINDOWS\System32\drivers\wd\WdNisDrv.sys [54192 2019-12-10] (Microsoft Windows -> Microsoft Corporation)
R2 WIBUKEY; C:\WINDOWS\System32\DRIVERS\WibuKey64.sys [118200 2016-12-20] (WIBU-SYSTEMS AG -> WIBU-SYSTEMS AG)
S2 AMDRyzenMasterDriverV17; \??\C:\Program Files\AMD\CNext\CNext\AMDRyzenMasterDriver.sys [X]
==================== NetSvcs (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
==================== One month (created) (Whitelisted) =========
(If an entry is included in the fixlist, the file/folder will be moved.)
2022-03-22 21:48 - 2022-03-22 21:50 - 000027992 _____ C:\Users\tkrpe\Desktop\FRST.txt
2022-03-22 21:44 - 2022-03-22 21:50 - 000000000 ____D C:\FRST
2022-03-22 21:43 - 2022-03-22 21:42 - 002364928 _____ (Farbar) C:\Users\tkrpe\Desktop\FRST64.exe
2022-03-22 19:36 - 2022-03-22 19:37 - 000001378 _____ C:\Users\tkrpe\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\ESET Online Scanner.lnk
2022-03-22 19:36 - 2022-03-22 19:36 - 000000000 ____D C:\Users\tkrpe\AppData\Local\ESET
2022-03-22 18:56 - 2022-03-22 18:56 - 000194480 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\farflt.sys
2022-03-22 18:56 - 2022-03-22 18:56 - 000156792 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mwac.sys
2022-03-22 18:56 - 2022-03-22 18:56 - 000069040 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mbam.sys
2022-03-22 18:56 - 2022-03-22 18:56 - 000000004 ____H C:\ProgramData\cm-lock
2022-03-22 18:40 - 2022-03-22 18:40 - 000000000 ___HD C:\$AV_AVG
2022-03-11 13:19 - 2022-03-11 13:19 - 002260992 _____ C:\WINDOWS\system32\TextInputMethodFormatter.dll
2022-03-11 13:19 - 2022-03-11 13:19 - 002254336 _____ C:\WINDOWS\system32\dwmscene.dll
2022-03-11 13:19 - 2022-03-11 13:19 - 000272896 _____ C:\WINDOWS\system32\TpmTool.exe
2022-03-11 13:19 - 2022-03-11 13:19 - 000223744 _____ C:\WINDOWS\SysWOW64\TpmTool.exe
2022-03-11 13:19 - 2022-03-11 13:19 - 000195584 _____ C:\WINDOWS\system32\uwfcfgmgmt.dll
2022-03-11 13:19 - 2022-03-11 13:19 - 000011911 _____ C:\WINDOWS\system32\DrtmAuthTxt.wim
2022-03-11 13:12 - 2022-03-11 13:12 - 000000000 ___HD C:\$WinREAgent
2022-03-03 20:23 - 2022-03-03 20:23 - 000221096 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\MbamChameleon.sys
2022-02-27 22:20 - 2022-02-27 22:20 - 000000000 ____D C:\Users\tkrpe\AppData\Local\ATI
2022-02-26 12:49 - 2022-02-26 12:49 - 000000779 _____ C:\Users\Public\Desktop\Crysis 3.lnk
2022-02-20 19:51 - 2022-02-20 19:51 - 000337336 _____ (AVG Technologies CZ, s.r.o.) C:\WINDOWS\system32\avgBoot.exe
2022-02-20 19:51 - 2022-02-20 19:51 - 000215024 _____ (AVG Technologies CZ, s.r.o.) C:\WINDOWS\system32\Drivers\avgStm.sys
==================== One month (modified) ==================
(If an entry is included in the fixlist, the file/folder will be moved.)
2022-03-22 21:37 - 2019-12-07 10:14 - 000000000 ____D C:\ProgramData\regid.1991-06.com.microsoft
2022-03-22 21:21 - 2020-07-28 20:07 - 000000000 ____D C:\WINDOWS\system32\SleepStudy
2022-03-22 20:58 - 2019-12-07 10:03 - 000000000 ____D C:\WINDOWS\CbsTemp
2022-03-22 20:55 - 2019-12-07 10:13 - 000000000 ____D C:\WINDOWS\INF
2022-03-22 20:54 - 2019-12-07 10:14 - 000000000 ___HD C:\Program Files\WindowsApps
2022-03-22 20:54 - 2019-12-07 10:14 - 000000000 ____D C:\WINDOWS\AppReadiness
2022-03-22 20:37 - 2021-11-20 20:47 - 000000000 ____D C:\Days Gone
2022-03-22 19:23 - 2022-02-15 17:52 - 000000000 ____D C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38
2022-03-22 19:23 - 2021-11-03 20:17 - 000002574 _____ C:\WINDOWS\system32\Tasks\AMDInstallLauncher
2022-03-22 19:23 - 2021-11-03 20:15 - 000002732 _____ C:\WINDOWS\system32\Tasks\ModifyLinkUpdate
2022-03-22 19:23 - 2021-11-03 20:15 - 000002566 _____ C:\WINDOWS\system32\Tasks\AMDLinkUpdate
2022-03-22 19:23 - 2021-11-03 20:14 - 000002460 _____ C:\WINDOWS\system32\Tasks\AMDRyzenMasterSDKTask
2022-03-22 19:23 - 2021-07-21 20:13 - 000002262 _____ C:\WINDOWS\system32\Tasks\StartCN
2022-03-22 19:23 - 2021-07-21 20:13 - 000002182 _____ C:\WINDOWS\system32\Tasks\StartDVR
2022-03-22 19:23 - 2021-06-08 22:55 - 000002474 _____ C:\WINDOWS\system32\Tasks\RTSS
2022-03-22 19:23 - 2020-07-28 20:12 - 000003572 _____ C:\WINDOWS\system32\Tasks\MicrosoftEdgeUpdateTaskMachineUA
2022-03-22 19:23 - 2020-07-28 20:12 - 000003542 _____ C:\WINDOWS\system32\Tasks\Adobe Acrobat Update Task
2022-03-22 19:23 - 2020-07-28 20:12 - 000003348 _____ C:\WINDOWS\system32\Tasks\MicrosoftEdgeUpdateTaskMachineCore
2022-03-22 19:23 - 2020-07-28 20:12 - 000003310 _____ C:\WINDOWS\system32\Tasks\Antivirus Emergency Update
2022-03-22 19:23 - 2020-07-28 20:12 - 000000000 ____D C:\WINDOWS\system32\Tasks\AVAST Software
2022-03-22 19:22 - 2019-12-10 23:10 - 000000000 ____D C:\Users\tkrpe\AppData\LocalLow\Mozilla
2022-03-22 19:16 - 2021-10-09 22:53 - 000000000 ____D C:\WINDOWS\system32\Tasks\Mozilla
2022-03-22 19:03 - 2020-07-28 20:12 - 001693140 _____ C:\WINDOWS\system32\PerfStringBackup.INI
2022-03-22 19:03 - 2019-12-07 15:43 - 000716770 _____ C:\WINDOWS\system32\perfh005.dat
2022-03-22 19:03 - 2019-12-07 15:43 - 000144948 _____ C:\WINDOWS\system32\perfc005.dat
2022-03-22 18:57 - 2020-01-03 23:48 - 000000000 ____D C:\Users\tkrpe\AppData\Local\CrashDumps
2022-03-22 18:56 - 2021-03-25 20:48 - 000000000 ____D C:\Users\tkrpe\AppData\LocalLow\IGDump
2022-03-22 18:56 - 2020-07-28 20:12 - 000000006 ____H C:\WINDOWS\Tasks\SA.DAT
2022-03-22 18:56 - 2020-07-28 20:07 - 000008192 ___SH C:\DumpStack.log.tmp
2022-03-22 18:56 - 2019-12-11 00:49 - 000000000 ____D C:\ProgramData\AVG
2022-03-22 18:56 - 2019-12-07 10:03 - 000524288 _____ C:\WINDOWS\system32\config\BBI
2022-03-22 18:48 - 2021-03-16 01:15 - 000000000 ____D C:\Program Files\Mozilla Firefox
2022-03-22 18:48 - 2019-12-10 23:10 - 000000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2022-03-22 18:47 - 2019-12-10 23:10 - 000001005 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Firefox.lnk
2022-03-22 18:21 - 2021-01-02 19:12 - 000000000 ____D C:\Users\tkrpe\AppData\Local\AMD_Common
2022-03-22 18:15 - 2022-01-18 21:20 - 000002073 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Acrobat DC.lnk
2022-03-22 18:11 - 2020-06-05 19:24 - 000002436 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Edge.lnk
2022-03-12 18:10 - 2020-01-28 21:22 - 000000000 ____D C:\Users\tkrpe\AppData\Roaming\vlc
2022-03-11 19:35 - 2021-01-28 23:21 - 000000000 ____D C:\Program Files\Microsoft Update Health Tools
2022-03-11 19:35 - 2019-12-10 23:03 - 000000000 ____D C:\WINDOWS\system32\MRT
2022-03-11 19:33 - 2019-12-10 23:03 - 145666720 ____C (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2022-03-11 17:52 - 2019-12-11 01:03 - 000000000 ____D C:\Program Files\Microsoft Office
2022-03-11 15:04 - 2020-07-28 20:07 - 005199904 _____ C:\WINDOWS\system32\FNTCACHE.DAT
2022-03-11 15:03 - 2019-12-07 15:47 - 000000000 ___SD C:\WINDOWS\system32\AppV
2022-03-11 15:03 - 2019-12-07 15:47 - 000000000 ____D C:\Program Files\Windows Defender Advanced Threat Protection
2022-03-11 15:03 - 2019-12-07 10:14 - 000000000 ___RD C:\WINDOWS\ImmersiveControlPanel
2022-03-11 15:03 - 2019-12-07 10:14 - 000000000 ____D C:\WINDOWS\SystemResources
2022-03-11 15:03 - 2019-12-07 10:14 - 000000000 ____D C:\WINDOWS\system32\WinBioPlugIns
2022-03-11 15:03 - 2019-12-07 10:14 - 000000000 ____D C:\WINDOWS\system32\oobe
2022-03-11 15:03 - 2019-12-07 10:14 - 000000000 ____D C:\WINDOWS\system32\migwiz
2022-03-11 15:03 - 2019-12-07 10:14 - 000000000 ____D C:\WINDOWS\PolicyDefinitions
2022-03-11 15:03 - 2019-12-07 10:14 - 000000000 ____D C:\WINDOWS\bcastdvr
2022-03-11 15:03 - 2019-12-07 10:03 - 000000000 ____D C:\WINDOWS\servicing
2022-03-11 13:32 - 2019-12-10 22:32 - 000000000 ____D C:\Users\tkrpe\AppData\Local\D3DSCache
2022-03-11 13:19 - 2020-07-28 20:09 - 002877952 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\PrintConfig.dll
2022-03-03 20:23 - 2020-08-18 20:38 - 000002033 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes.lnk
2022-03-03 20:23 - 2019-12-11 00:43 - 000002021 _____ C:\Users\Public\Desktop\Malwarebytes.lnk
2022-03-03 20:22 - 2019-12-11 00:42 - 000000000 ____D C:\ProgramData\Malwarebytes
2022-03-03 20:22 - 2019-12-11 00:42 - 000000000 ____D C:\Program Files\Malwarebytes
2022-03-03 20:21 - 2019-12-11 00:50 - 000551576 _____ (AVG Technologies CZ, s.r.o.) C:\WINDOWS\system32\Drivers\avgSP.sys
2022-03-03 01:07 - 2021-01-10 15:05 - 000000000 ____D C:\Users\tkrpe\AppData\Roaming\Origin
2022-03-03 01:07 - 2021-01-10 15:05 - 000000000 ____D C:\ProgramData\Origin
2022-03-02 21:21 - 2020-02-01 21:00 - 000000000 ____D C:\Users\tkrpe\AppData\Local\Origin
2022-02-25 23:48 - 2021-10-03 21:18 - 000000000 ____D C:\Users\tkrpe\Desktop\Hotovo
2022-02-21 21:15 - 2020-03-03 22:21 - 000000000 ____D C:\Users\tkrpe\Desktop\dům
2022-02-21 21:15 - 2020-02-04 21:08 - 000000000 ____D C:\Users\tkrpe\Graphisoft
2022-02-20 19:51 - 2020-10-25 16:39 - 000267000 _____ (AVG Technologies CZ, s.r.o.) C:\WINDOWS\system32\Drivers\avgMonFlt.sys
2022-02-20 19:51 - 2020-04-21 20:47 - 000544880 _____ (AVG Technologies CZ, s.r.o.) C:\WINDOWS\system32\Drivers\avgNetHub.sys
2022-02-20 19:51 - 2019-12-11 00:50 - 000854416 _____ (AVG Technologies CZ, s.r.o.) C:\WINDOWS\system32\Drivers\avgSnx.sys
2022-02-20 19:51 - 2019-12-11 00:50 - 000369768 _____ (AVG Technologies CZ, s.r.o.) C:\WINDOWS\system32\Drivers\avgbidsdriver.sys
2022-02-20 19:51 - 2019-12-11 00:50 - 000318872 _____ (AVG Technologies CZ, s.r.o.) C:\WINDOWS\system32\Drivers\avgVmm.sys
2022-02-20 19:51 - 2019-12-11 00:50 - 000253040 _____ (AVG Technologies CZ, s.r.o.) C:\WINDOWS\system32\Drivers\avgbidsh.sys
2022-02-20 19:51 - 2019-12-11 00:50 - 000226464 _____ (AVG Technologies CZ, s.r.o.) C:\WINDOWS\system32\Drivers\avgArPot.sys
2022-02-20 19:51 - 2019-12-11 00:50 - 000107992 _____ (AVG Technologies CZ, s.r.o.) C:\WINDOWS\system32\Drivers\avgRdr2.sys
2022-02-20 19:51 - 2019-12-11 00:50 - 000099424 _____ (AVG Technologies CZ, s.r.o.) C:\WINDOWS\system32\Drivers\avgbuniv.sys
2022-02-20 19:51 - 2019-12-11 00:50 - 000083056 _____ (AVG Technologies CZ, s.r.o.) C:\WINDOWS\system32\Drivers\avgRvrt.sys
2022-02-20 19:51 - 2019-12-11 00:50 - 000041488 _____ (AVG Technologies CZ, s.r.o.) C:\WINDOWS\system32\Drivers\avgKbd.sys
2022-02-20 19:51 - 2019-12-07 10:14 - 000000000 ___HD C:\WINDOWS\ELAMBKUP
==================== Files in the root of some directories ========
2020-01-08 23:39 - 2022-02-02 21:28 - 000007652 _____ () C:\Users\tkrpe\AppData\Local\Resmon.ResmonCfg
==================== SigCheck ============================
(There is no automatic fix for files that do not pass verification.)
==================== End of FRST.txt ========================
==================== Memory info ===========================
BIOS: American Megatrends Inc. 1.00 07/13/2018
Motherboard: Micro-Star International Co., Ltd. B450M GAMING PLUS (MS-7B87)
Processor: AMD Ryzen 5 2600 Six-Core Processor
Percentage of memory in use: 39%
Total physical RAM: 16335.2 MB
Available physical RAM: 9861.15 MB
Total Virtual: 22223.2 MB
Available Virtual: 11889.5 MB
==================== Drives ================================
Drive c: () (Fixed) (Total:446.01 GB) (Free:284.94 GB) NTFS
Drive e: () (Fixed) (Total:2794.5 GB) (Free:1062.25 GB) NTFS
\\?\Volume{bfd4a860-e51b-4e65-bc0e-063119748902}\ (Obnovení) (Fixed) (Total:0.49 GB) (Free:0.05 GB) NTFS
\\?\Volume{0242298c-7d4e-4f4d-abb7-d440655088ff}\ () (Fixed) (Total:0.52 GB) (Free:0.08 GB) NTFS
\\?\Volume{47674ca8-bacb-49d3-9538-40a9d28ced80}\ () (Fixed) (Total:0.09 GB) (Free:0.07 GB) FAT32
==================== MBR & Partition Table ====================
==========================================================
Disk: 0 (Protective MBR) (Size: 2794.5 GB) (Disk ID: 00000000)
Partition: GPT.
==========================================================
Disk: 1 (Protective MBR) (Size: 447.1 GB) (Disk ID: 00000000)
Partition: GPT.
==================== End of Addition.txt =======================
po zapnutí PC a po připojení a odpojení manželčina telefonu (a zároveň jsem byl na facebooku) se mi zbláznilo AVG a začalo vyhazovat oznámení (celkem 96) "Zablokována hrozba....soubor [jméno - hodně číslic a písmen] byl přesunut do karantény, protože v něm byla objevena hroba VBS:Gamaredon-CM [Apt]"
Následně jsem smazal z karantény tyto soubory a udělal jsem sken PC pomocí malwarebytes i AVG a nic to nenašlo.
Prosím tedy pro klid duše o kontrolu logu z FRST.
Díky
Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 20-03-2022
Ran by tkrpe (administrator) on DESKTOP-BFAJQ2D (Micro-Star International Co., Ltd. MS-7B87) (22-03-2022 21:50:23)
Running from C:\Users\tkrpe\Desktop
Loaded Profiles: tkrpe
Platform: Microsoft Windows 10 Pro Version 21H1 19043.1586 (X64) Language: Čeština (Česko)
Default browser: FF
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(Advanced Micro Devices Inc. -> Advanced Micro Devices, Inc.) C:\Program Files\AMD\CNext\CNext\AMDRSServ.exe
(Advanced Micro Devices Inc. -> Advanced Micro Devices, Inc.) C:\Program Files\AMD\CNext\CNext\RadeonSoftware.exe
(AVG Technologies USA, LLC -> AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\Antivirus\AVGUI.exe <4>
(A-Volute SAS -> A-Volute) C:\Users\tkrpe\AppData\Local\NhNotifSys\nahimic\nahimicNotifSys.exe
(C:\Program Files (x86)\RivaTuner Statistics Server\RTSS.exe ->) (Alexey Nicolaychuk -> ) C:\Program Files (x86)\RivaTuner Statistics Server\EncoderServer.exe
(C:\Program Files (x86)\RivaTuner Statistics Server\RTSS.exe ->) (Alexey Nicolaychuk -> ) C:\Program Files (x86)\RivaTuner Statistics Server\RTSSHooksLoader64.exe
(C:\Program Files\AMD\CNext\CNext\AMDRSServ.exe ->) (Advanced Micro Devices Inc. -> Advanced Micro Devices, Inc.) C:\Program Files\AMD\CNext\CNext\amdow.exe
(C:\Program Files\AMD\CNext\CNext\AMDRSServ.exe ->) (Advanced Micro Devices Inc. -> Advanced Micro Devices, Inc.) C:\Program Files\AMD\CNext\CNext\AMDRSSrcExt.exe
(C:\Program Files\AMD\CNext\CNext\RadeonSoftware.exe ->) (Advanced Micro Devices Inc. -> Advanced Micro Devices, Inc.) C:\Program Files\AMD\CNext\CNext\cncmd.exe
(C:\Program Files\AMD\CNext\CNext\RadeonSoftware.exe ->) (The Qt Company Ltd.) [File not signed] C:\Program Files\AMD\CNext\CNext\QtWebEngineProcess.exe
(C:\Program Files\AVG\Antivirus\AVGSvc.exe ->) (AVG Technologies USA, LLC -> AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\Antivirus\aswEngSrv.exe
(C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe ->) (Malwarebytes Inc -> Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe
(DriverStore\FileRepository\u0376209.inf_amd64_b3bdffadea4def3f\B374968\atiesrxx.exe ->) (Advanced Micro Devices Inc. -> AMD) C:\Windows\System32\DriverStore\FileRepository\u0376209.inf_amd64_b3bdffadea4def3f\B374968\atieclxx.exe
(Mozilla Corporation -> Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe <11>
(Razer USA Ltd. -> Razer Inc.) [File not signed] C:\Program Files (x86)\Razer\Synapse\RzSynapse.exe
(services.exe ->) () [File not signed] C:\Program Files (x86)\Edimax\Edimax AC600 Wireless LAN Driver\WPSService20.exe
(services.exe ->) (Adobe Inc. -> Adobe Inc.) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
(services.exe ->) (Advanced Micro Devices Inc. -> Advanced Micro Devices, Inc.) C:\Windows\System32\amdfendrsr.exe
(services.exe ->) (Advanced Micro Devices Inc. -> AMD) C:\Windows\System32\DriverStore\FileRepository\u0376209.inf_amd64_b3bdffadea4def3f\B374968\atiesrxx.exe
(services.exe ->) (Autodesk, Inc. -> Autodesk Inc.) C:\Program Files (x86)\Autodesk\Autodesk Desktop App\AdAppMgrSvc.exe
(services.exe ->) (Autodesk, Inc. -> Autodesk) C:\Program Files (x86)\Common Files\Autodesk Shared\AdskLicensing\10.1.0.3194\AdskLicensingService\AdskLicensingService.exe
(services.exe ->) (AVG Technologies USA, LLC -> AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\Antivirus\afwServ.exe
(services.exe ->) (AVG Technologies USA, LLC -> AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\Antivirus\aswidsagent.exe
(services.exe ->) (AVG Technologies USA, LLC -> AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\Antivirus\AVGSvc.exe
(services.exe ->) (AVG Technologies USA, LLC -> AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\Antivirus\avgToolsSvc.exe
(services.exe ->) (AVG Technologies USA, LLC -> AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\Antivirus\wsc_proxy.exe
(services.exe ->) (A-Volute SAS -> Nahimic) C:\Windows\System32\NahimicService.exe
(services.exe ->) (Electronic Arts, Inc. -> Electronic Arts) C:\Program Files (x86)\Origin\OriginWebHelperService.exe
(services.exe ->) (Even Balance, Inc. -> ) C:\Windows\SysWOW64\PnkBstrA.exe
(services.exe ->) (Flexera Software LLC -> Flexera) C:\Program Files (x86)\Common Files\Macrovision Shared\FlexNet Publisher\FNPLicensingService.exe
(services.exe ->) (Intel Corporation -> Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
(services.exe ->) (Intel Corporation -> Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe
(services.exe ->) (Intel Corporation -> Intel® Corporation) C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe
(services.exe ->) (Malwarebytes Inc -> Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
(services.exe ->) (Microsoft Corporation -> Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe
(services.exe ->) (WIBU-SYSTEMS AG -> WIBU-SYSTEMS AG) C:\Program Files (x86)\CodeMeter\Runtime\bin\CodeMeter.exe
(services.exe ->) (WIBU-SYSTEMS AG -> WIBU-SYSTEMS AG) C:\Program Files\CodeMeter\Runtime\bin\CmWebAdmin.exe
(svchost.exe ->) (Alexey Nicolaychuk -> ) C:\Program Files (x86)\RivaTuner Statistics Server\RTSS.exe
(svchost.exe ->) (Microsoft Corporation) C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.2103.8.0_x64__8wekyb3d8bbwe\Calculator.exe
(svchost.exe ->) (Microsoft Windows -> Microsoft Corporation) C:\Windows\HelpPane.exe
(svchost.exe ->) (Microsoft Windows -> Microsoft Corporation) C:\Windows\ImmersiveControlPanel\SystemSettings.exe
(svchost.exe ->) (Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\dllhost.exe <3>
(svchost.exe ->) (Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\wlanext.exe
==================== Registry (Whitelisted) ===================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [AVGUI.exe] => C:\Program Files\AVG\Antivirus\AvLaunch.exe [190904 2022-02-20] (AVG Technologies USA, LLC -> AVG Technologies CZ, s.r.o.)
HKLM\...\Run: [AdobeAAMUpdater-1.0] => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [446392 2012-04-04] (Adobe Systems Incorporated -> Adobe Systems Incorporated)
HKLM-x32\...\Run: [Razer Synapse] => C:\Program Files (x86)\Razer\Synapse\RzSynapse.exe [599056 2021-10-28] (Razer USA Ltd. -> Razer Inc.) [File not signed]
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [248552 2010-05-14] (Sun Microsystems, Inc. -> Sun Microsystems, Inc.)
HKLM-x32\...\Run: [Autodesk Desktop App] => C:\Program Files (x86)\Autodesk\Autodesk Desktop App\AutodeskDesktopApp.exe [668376 2021-03-04] (Autodesk, Inc. -> Autodesk, Inc.)
HKLM-x32\...\Run: [Autodesk Genuine Service ] => C:\Users\tkrpe\AppData\Local\Programs\Autodesk\Genuine Service\GenuineService.exe [1077864 2020-01-02] (Autodesk, Inc. -> Autodesk)
HKLM-x32\...\Run: [SwitchBoard] => C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Test Signing Certificate -> Adobe Systems Incorporated) [File not signed]
HKLM-x32\...\Run: [AdobeCS6ServiceManager] => C:\Program Files (x86)\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe [1073312 2012-03-09] (Adobe Systems Incorporated -> Adobe Systems Incorporated)
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [VICTORY Gaming Keyboard] => C:\Program Files (x86)\Gaming Keyboard\Monitor.exe [270336 2013-03-30] () [File not signed]
HKU\S-1-5-21-4202080177-88069448-2828812736-1001\...\Run: [Web Companion] => C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe --minimize (No File)
HKU\S-1-5-21-4202080177-88069448-2828812736-1001\...\Run: [AdobeBridge] => [X]
HKU\S-1-5-21-4202080177-88069448-2828812736-1001\...\Policies\Explorer: []
HKU\S-1-5-21-4202080177-88069448-2828812736-1001\...\MountPoints2: {00d7d431-aa03-11ec-a8c1-001a7dda7111} - "D:\HiSuiteDownLoader.exe"
HKU\S-1-5-21-4202080177-88069448-2828812736-1001\...\MountPoints2: {8b696641-d682-11ea-a87f-001a7dda7111} - "D:\HiSuiteDownLoader.exe"
HKU\S-1-5-21-4202080177-88069448-2828812736-1001\...\MountPoints2: {8b6967d5-d682-11ea-a87f-001a7dda7111} - "D:\HiSuiteDownLoader.exe"
HKU\S-1-5-21-4202080177-88069448-2828812736-1001\...\MountPoints2: {ec07a370-d681-11ea-a87f-001a7dda7111} - "D:\HiSuiteDownLoader.exe"
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\CodeMeter Control Center.lnk [2020-09-12]
ShortcutTarget: CodeMeter Control Center.lnk -> C:\Program Files (x86)\CodeMeter\Runtime\bin\CodeMeterCC.exe (WIBU-SYSTEMS AG -> WIBU-SYSTEMS AG)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Network Server.lnk [2020-09-12]
ShortcutTarget: Network Server.lnk -> C:\Program Files (x86)\WIBUKEY\Server\WkSvMgr.exe (WIBU-SYSTEMS AG -> WIBU-SYSTEMS AG)
HKLM\SOFTWARE\Policies\Mozilla\Firefox: Restriction <==== ATTENTION
HKLM\SOFTWARE\Policies\Google: Restriction <==== ATTENTION
==================== Scheduled Tasks (Whitelisted) ============
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
Task: {01665AD6-6E2D-4D73-A92C-1A86C2461F3A} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [1564424 2021-11-17] (Adobe Inc. -> Adobe Inc.)
Task: {08BD7B85-4101-4094-A0B3-F0628C110BD9} - System32\Tasks\ModifyLinkUpdate => C:\Program Files\AMD\CIM\Bin64\InstallManagerApp.exe [1709048 2021-10-05] (Advanced Micro Devices Inc. -> Advanced Micro Devices, Inc.)
Task: {32BA4FF0-3B73-4FAB-A250-B713EBF56326} - System32\Tasks\StartCN => C:\Program Files\AMD\CNext\CNext\cncmd.exe [55288 2021-10-05] (Advanced Micro Devices Inc. -> Advanced Micro Devices, Inc.)
Task: {3B41C374-0FA3-47A7-8A44-CD5FB88B60B6} - System32\Tasks\AVG\Overseer => C:\Program Files\Common Files\AVG\Overseer\overseer.exe [2332984 2022-03-07] (AVG Technologies USA, LLC -> AVG Technologies)
Task: {470E4CBA-710B-472A-A34C-7A06233F3988} - System32\Tasks\AMDInstallLauncher => C:\Program Files\AMD\CIM\Bin64\InstallManagerApp.exe [1709048 2021-10-05] (Advanced Micro Devices Inc. -> Advanced Micro Devices, Inc.)
Task: {4F07AEE5-E7EE-4241-83D5-097D858758DC} - System32\Tasks\Mozilla\Firefox Background Update 308046B0AF4A39CB => C:\Program Files\Mozilla Firefox\firefox.exe --MOZ_LOG sync,prependheader,timestamp,append,maxsize:1,Dump:5 --MOZ_LOG_FILE C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\308046B0AF4A39CB\backgroundupdate.moz_log --backgroundtask backgroundupdate
Task: {583BEE35-1C5F-4E15-8010-7637BD271282} - System32\Tasks\Mozilla\Firefox Default Browser Agent 308046B0AF4A39CB => C:\Program Files\Mozilla Firefox\default-browser-agent.exe do-task "308046B0AF4A39CB"
Task: {7D76B027-E48E-43F2-85C0-64C307F6CA26} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentLogOn2016 => C:\Program Files\Microsoft Office\root\Office16\msoia.exe [8307120 2022-03-07] (Microsoft Corporation -> Microsoft Corporation)
Task: {7F36CBF7-D28A-496C-A6D9-6D7AC936FD96} - System32\Tasks\AMDLinkUpdate => C:\Program Files\AMD\CIM\Bin64\InstallManagerApp.exe [1709048 2021-10-05] (Advanced Micro Devices Inc. -> Advanced Micro Devices, Inc.)
Task: {8C8225C4-93AE-4E73-BE18-DD9EDA1FFB88} - System32\Tasks\Microsoft\Office\Office ClickToRun Service Monitor => C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe [22580696 2022-03-11] (Microsoft Corporation -> Microsoft Corporation)
Task: {92061CE5-7523-49B3-972C-C1B005F455C7} - System32\Tasks\AMDRyzenMasterSDKTask => C:\Program Files\AMD\CNext\CNext\cpumetricsserver.exe [355840 2021-10-05] (Advanced Micro Devices, Inc.) [File not signed]
Task: {96EC998D-2C84-4E1D-9565-96142B30316A} - System32\Tasks\Antivirus Emergency Update => C:\Program Files\AVG\Antivirus\AvEmUpdate.exe [5026232 2022-02-20] (AVG Technologies USA, LLC -> AVG Technologies CZ, s.r.o.)
Task: {AC18BA57-2658-4358-8E3B-D7B0ECACCB72} - System32\Tasks\Microsoft\Office\Office Feature Updates => C:\Program Files\Microsoft Office\root\Office16\sdxhelper.exe [137072 2022-03-11] (Microsoft Corporation -> Microsoft Corporation)
Task: {B001D595-4EB3-4E05-AB62-4B073AFF520E} - System32\Tasks\Microsoft\Office\Office Performance Monitor => C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\operfmon.exe [59232 2022-03-07] (Microsoft Corporation -> Microsoft Corporation)
Task: {B969FEF2-BA81-4F73-8A49-9535DEA4056C} - System32\Tasks\AVAST Software\Gaming mode Task Scheduler recovery => Command(1): schtasks.exe -> /Change /TN "\Adobe Acrobat Update Task" /ENABLE
Task: {B969FEF2-BA81-4F73-8A49-9535DEA4056C} - System32\Tasks\AVAST Software\Gaming mode Task Scheduler recovery => Command(2): schtasks.exe -> /Change /TN "\AMDInstallLauncher" /ENABLE
Task: {B969FEF2-BA81-4F73-8A49-9535DEA4056C} - System32\Tasks\AVAST Software\Gaming mode Task Scheduler recovery => Command(3): schtasks.exe -> /Change /TN "\AMDLinkUpdate" /ENABLE
Task: {B969FEF2-BA81-4F73-8A49-9535DEA4056C} - System32\Tasks\AVAST Software\Gaming mode Task Scheduler recovery => Command(4): schtasks.exe -> /Change /TN "\AMDRyzenMasterSDKTask" /ENABLE
Task: {B969FEF2-BA81-4F73-8A49-9535DEA4056C} - System32\Tasks\AVAST Software\Gaming mode Task Scheduler recovery => Command(5): schtasks.exe -> /Change /TN "\Antivirus Emergency Update" /ENABLE
Task: {B969FEF2-BA81-4F73-8A49-9535DEA4056C} - System32\Tasks\AVAST Software\Gaming mode Task Scheduler recovery => Command(6): schtasks.exe -> /Change /TN "\MicrosoftEdgeUpdateTaskMachineCore" /ENABLE
Task: {B969FEF2-BA81-4F73-8A49-9535DEA4056C} - System32\Tasks\AVAST Software\Gaming mode Task Scheduler recovery => Command(7): schtasks.exe -> /Change /TN "\MicrosoftEdgeUpdateTaskMachineUA" /ENABLE
Task: {B969FEF2-BA81-4F73-8A49-9535DEA4056C} - System32\Tasks\AVAST Software\Gaming mode Task Scheduler recovery => Command(8): schtasks.exe -> /Change /TN "\ModifyLinkUpdate" /ENABLE
Task: {B969FEF2-BA81-4F73-8A49-9535DEA4056C} - System32\Tasks\AVAST Software\Gaming mode Task Scheduler recovery => Command(9): schtasks.exe -> /Change /TN "\RTSS" /ENABLE
Task: {B969FEF2-BA81-4F73-8A49-9535DEA4056C} - System32\Tasks\AVAST Software\Gaming mode Task Scheduler recovery => Command(10): schtasks.exe -> /Change /TN "\StartCN" /ENABLE
Task: {B969FEF2-BA81-4F73-8A49-9535DEA4056C} - System32\Tasks\AVAST Software\Gaming mode Task Scheduler recovery => Command(11): schtasks.exe -> /Change /TN "\StartDVR" /ENABLE
Task: {B969FEF2-BA81-4F73-8A49-9535DEA4056C} - System32\Tasks\AVAST Software\Gaming mode Task Scheduler recovery => Command(12): schtasks.exe -> /Change /TN "\AVAST Software\Gaming mode Task Scheduler recovery" /DISABLE
Task: {CB660A54-25D9-4B98-A54F-C69FC129C2E5} - System32\Tasks\Microsoft\Office\Office Automatic Updates 2.0 => C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe [22580696 2022-03-11] (Microsoft Corporation -> Microsoft Corporation)
Task: {D4D21378-117C-4DE7-8E60-CCED8DB24DAF} - System32\Tasks\RTSS => C:\Program Files (x86)\RivaTuner Statistics Server\RTSS.exe [417160 2021-02-27] (Alexey Nicolaychuk -> )
Task: {D602437E-A652-4052-BAAB-F1F221E1CD48} - System32\Tasks\Microsoft\Office\Office Feature Updates Logon => C:\Program Files\Microsoft Office\root\Office16\sdxhelper.exe [137072 2022-03-11] (Microsoft Corporation -> Microsoft Corporation)
Task: {E13D3BBD-A3F4-4DAB-90A4-101F6ED459E8} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentFallBack2016 => C:\Program Files\Microsoft Office\root\Office16\msoia.exe [8307120 2022-03-07] (Microsoft Corporation -> Microsoft Corporation)
Task: {FAFFE63A-B0D6-42F7-AA67-8FDC45166900} - System32\Tasks\StartDVR => C:\Program Files\AMD\CNext\CNext\RSServCmd.exe [260600 2021-10-05] (Advanced Micro Devices Inc. -> Advanced Micro Devices, Inc.)
(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 10.0.0.138
Tcpip\..\Interfaces\{09d4c20e-0c2b-4750-8bdb-0a44d5f5893a}: [DhcpNameServer] 10.0.0.138
Tcpip\..\Interfaces\{904ad7cb-90a6-4b5a-925c-a1b3caae4380}: [DhcpNameServer] 10.0.0.138
Tcpip\..\Interfaces\{bd3f4503-c6be-4827-81de-e06d44f03454}: [DhcpNameServer] 192.168.0.1
Tcpip\..\Interfaces\{bf4cbe26-8f0b-48c7-b859-142f3864e664}: [DhcpNameServer] 10.0.0.138
Edge:
=======
Edge Extension: (No Name) -> AutoFormFill_5ED10D46BD7E47DEB1F3685D2C0FCE08 => C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\Assets\HostExtensions\AutoFormFill [not found]
Edge Extension: (No Name) -> BookReader_B171F20233094AC88D05A8EF7B9763E8 => C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\Assets\BookViewer [not found]
Edge Extension: (No Name) -> LearningTools_7706F933-971C-41D1-9899-8A026EB5D824 => C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\Assets\HostExtensions\LearningTools [not found]
Edge Extension: (No Name) -> PinJSAPI_EC01B57063BE468FAB6DB7EBFC3BF368 => C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\Assets\HostExtensions\PinJSAPI [not found]
Edge DefaultProfile: Default
Edge Profile: C:\Users\tkrpe\AppData\Local\Microsoft\Edge\User Data\Default [2022-03-22]
FireFox:
========
FF DefaultProfile: 66uq2n4o.default
FF ProfilePath: C:\Users\tkrpe\AppData\Roaming\Mozilla\Firefox\Profiles\66uq2n4o.default [2019-12-10]
FF ProfilePath: C:\Users\tkrpe\AppData\Roaming\Mozilla\Firefox\Profiles\gbk2fvcj.default-release-1647972981330 [2022-03-22]
FF Homepage: Mozilla\Firefox\Profiles\gbk2fvcj.default-release-1647972981330 -> hxxps://www.seznam.cz/
FF Extension: (AdBlocker Ultimate) - C:\Users\tkrpe\AppData\Roaming\Mozilla\Firefox\Profiles\gbk2fvcj.default-release-1647972981330\Extensions\adblockultimate@adblockultimate.net.xpi [2022-03-22]
FF Extension: (Aliexpress SuperStar česky, Historie cen a koruny) - C:\Users\tkrpe\AppData\Roaming\Mozilla\Firefox\Profiles\gbk2fvcj.default-release-1647972981330\Extensions\{49756ccc-44ea-4661-bc1f-2baba64cca2f}.xpi [2022-03-22]
FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office\root\Office16\NPSPWRAP.DLL [2022-03-07] (Microsoft Corporation -> Microsoft Corporation)
FF Plugin: @videolan.org/vlc,version=3.0.8 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2019-08-14] (VideoLAN -> VideoLAN)
FF Plugin: Adobe Acrobat -> C:\Program Files\Adobe\Acrobat DC\Acrobat\Air\nppdf32.dll [2022-03-02] (Adobe Inc. -> Adobe Systems Inc.)
FF Plugin-x32: @java.com/JavaPlugin -> C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll [2020-02-04] (Sun Microsystems, Inc.) [File not signed]
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\NPSPWRAP.DLL [2022-03-07] (Microsoft Corporation -> Microsoft Corporation)
Chrome:
=======
CHR HKLM-x32\...\Chrome\Extension: [mbckjcfnjmoiinpgddefodcighgikkgn]
==================== Services (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
R2 AdAppMgrSvc; C:\Program Files (x86)\Autodesk\Autodesk Desktop App\AdAppMgrSvc.exe [1050920 2021-03-04] (Autodesk, Inc. -> Autodesk Inc.)
R2 AdobeARMservice; C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [169728 2021-11-17] (Adobe Inc. -> Adobe Inc.)
R2 AdskLicensingService; C:\Program Files (x86)\Common Files\Autodesk Shared\AdskLicensing\Current\AdskLicensingService\AdskLicensingService.exe [16930616 2019-12-18] (Autodesk, Inc. -> Autodesk)
R2 AVG Antivirus; C:\Program Files\AVG\Antivirus\AVGSvc.exe [596920 2022-02-20] (AVG Technologies USA, LLC -> AVG Technologies CZ, s.r.o.)
R2 AVG Firewall; C:\Program Files\AVG\Antivirus\afwServ.exe [1943992 2022-02-20] (AVG Technologies USA, LLC -> AVG Technologies CZ, s.r.o.)
R2 AVG Tools; C:\Program Files\AVG\Antivirus\avgToolsSvc.exe [596920 2022-02-20] (AVG Technologies USA, LLC -> AVG Technologies CZ, s.r.o.)
R3 avgbIDSAgent; C:\Program Files\AVG\Antivirus\aswidsagent.exe [8519280 2022-02-20] (AVG Technologies USA, LLC -> AVG Technologies CZ, s.r.o.)
R2 AvgWscReporter; C:\Program Files\AVG\Antivirus\wsc_proxy.exe [109480 2021-06-08] (AVG Technologies USA, LLC -> AVG Technologies CZ, s.r.o.)
R2 ClickToRunSvc; C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe [11649952 2022-03-07] (Microsoft Corporation -> Microsoft Corporation)
R2 CmWebAdmin.exe; C:\Program Files\CodeMeter\Runtime\bin\CmWebAdmin.exe [9199512 2018-02-26] (WIBU-SYSTEMS AG -> WIBU-SYSTEMS AG)
R2 MBAMService; C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe [8019640 2022-03-03] (Malwarebytes Inc -> Malwarebytes)
R2 NahimicService; C:\WINDOWS\system32\NahimicService.exe [1888424 2021-10-08] (A-Volute SAS -> Nahimic)
S3 Origin Client Service; C:\Program Files (x86)\Origin\OriginClientService.exe [2562776 2022-02-15] (Electronic Arts, Inc. -> Electronic Arts)
R2 Origin Web Helper Service; C:\Program Files (x86)\Origin\OriginWebHelperService.exe [3481312 2022-02-15] (Electronic Arts, Inc. -> Electronic Arts)
R2 PnkBstrA; C:\Windows\SysWOW64\PnkBstrA.exe [75136 2020-07-10] (Even Balance, Inc. -> )
S3 Sense; C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe [6228008 2022-03-11] (Microsoft Windows Publisher -> Microsoft Corporation)
S3 SwitchBoard; C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Test Signing Certificate -> Adobe Systems Incorporated) [File not signed]
S3 WdNisSvc; C:\ProgramData\Microsoft\Windows Defender\platform\4.18.1911.3-0\NisSrv.exe [3206472 2019-12-10] (Microsoft Windows Publisher -> Microsoft Corporation)
S3 WinDefend; C:\ProgramData\Microsoft\Windows Defender\platform\4.18.1911.3-0\MsMpEng.exe [103376 2019-12-10] (Microsoft Windows Publisher -> Microsoft Corporation)
R2 WPSService20; C:\Program Files (x86)\Edimax\Edimax AC600 Wireless LAN Driver\WPSService20.exe [96768 2017-11-24] () [File not signed]
===================== Drivers (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
R3 amdfendrmgr; C:\WINDOWS\System32\drivers\amdfendrmgr.sys [41376 2021-07-30] (Advanced Micro Devices Inc. -> Advanced Micro Devices, Inc.)
R3 AMDSAFD; C:\WINDOWS\System32\DriverStore\FileRepository\amdsafd.inf_amd64_50fee1227e96ec14\amdsafd.sys [100792 2021-08-04] (Microsoft Windows Hardware Compatibility Publisher -> Advanced Micro Devices)
R3 amdwddmg; C:\WINDOWS\System32\DriverStore\FileRepository\u0376209.inf_amd64_b3bdffadea4def3f\B374968\amdkmdag.sys [80540576 2022-01-28] (Advanced Micro Devices Inc. -> Advanced Micro Devices, Inc.)
R3 AMDXE; C:\WINDOWS\System32\drivers\amdxe.sys [65168 2021-08-17] (Advanced Micro Devices Inc. -> Advanced Micro Devices, Inc.)
S3 atvi-brynhildr; C:\ProgramData\Battle.net_components\brynhildr_odin\brynhildr.sys [2355952 2022-01-14] (Activision Publishing Inc -> Activision Blizzard, Inc.)
R1 avgArPot; C:\WINDOWS\System32\drivers\avgArPot.sys [226464 2022-02-20] (AVG Technologies USA, LLC -> AVG Technologies CZ, s.r.o.)
R1 avgbidsdriver; C:\WINDOWS\System32\drivers\avgbidsdriver.sys [369768 2022-02-20] (AVG Technologies USA, LLC -> AVG Technologies CZ, s.r.o.)
R0 avgbidsh; C:\WINDOWS\System32\drivers\avgbidsh.sys [253040 2022-02-20] (AVG Technologies USA, LLC -> AVG Technologies CZ, s.r.o.)
R0 avgbuniv; C:\WINDOWS\System32\drivers\avgbuniv.sys [99424 2022-02-20] (AVG Technologies USA, LLC -> AVG Technologies CZ, s.r.o.)
R0 avgElam; C:\WINDOWS\System32\drivers\avgElam.sys [21960 2021-09-23] (Microsoft Windows Early Launch Anti-malware Publisher -> AVG Technologies CZ, s.r.o.)
R1 avgKbd; C:\WINDOWS\System32\drivers\avgKbd.sys [41488 2022-02-20] (AVG Technologies USA, LLC -> AVG Technologies CZ, s.r.o.)
R1 avgMonFlt; C:\WINDOWS\System32\drivers\avgMonFlt.sys [267000 2022-02-20] (AVG Technologies USA, LLC -> AVG Technologies CZ, s.r.o.)
R1 avgNetHub; C:\WINDOWS\System32\drivers\avgNetHub.sys [544880 2022-02-20] (AVG Technologies USA, LLC -> AVG Technologies CZ, s.r.o.)
R1 avgRdr; C:\WINDOWS\System32\drivers\avgRdr2.sys [107992 2022-02-20] (AVG Technologies USA, LLC -> AVG Technologies CZ, s.r.o.)
R0 avgRvrt; C:\WINDOWS\System32\drivers\avgRvrt.sys [83056 2022-02-20] (AVG Technologies USA, LLC -> AVG Technologies CZ, s.r.o.)
R1 avgSnx; C:\WINDOWS\System32\drivers\avgSnx.sys [854416 2022-02-20] (AVG Technologies USA, LLC -> AVG Technologies CZ, s.r.o.)
R1 avgSP; C:\WINDOWS\System32\drivers\avgSP.sys [551576 2022-03-03] (AVG Technologies USA, LLC -> AVG Technologies CZ, s.r.o.)
R2 avgStm; C:\WINDOWS\System32\drivers\avgStm.sys [215024 2022-02-20] (AVG Technologies USA, LLC -> AVG Technologies CZ, s.r.o.)
R0 avgVmm; C:\WINDOWS\System32\drivers\avgVmm.sys [318872 2022-02-20] (AVG Technologies USA, LLC -> AVG Technologies CZ, s.r.o.)
R1 ESProtectionDriver; C:\WINDOWS\system32\drivers\mbae64.sys [160176 2021-08-29] (Microsoft Windows Hardware Compatibility Publisher -> Malwarebytes)
R2 MBAMChameleon; C:\WINDOWS\System32\Drivers\MbamChameleon.sys [221096 2022-03-03] (Microsoft Windows Hardware Compatibility Publisher -> Malwarebytes)
S0 MbamElam; C:\WINDOWS\System32\DRIVERS\MbamElam.sys [19912 2020-09-13] (Microsoft Windows Early Launch Anti-malware Publisher -> Malwarebytes)
R3 MBAMFarflt; C:\WINDOWS\System32\DRIVERS\farflt.sys [194480 2022-03-22] (Microsoft Windows Hardware Compatibility Publisher -> Malwarebytes)
R3 MBAMProtection; C:\WINDOWS\system32\DRIVERS\mbam.sys [69040 2022-03-22] (Microsoft Windows Hardware Compatibility Publisher -> Malwarebytes)
R3 MBAMSwissArmy; C:\WINDOWS\System32\Drivers\mbamswissarmy.sys [248992 2021-12-17] (Malwarebytes Inc -> Malwarebytes)
R3 MBAMWebProtection; C:\WINDOWS\system32\DRIVERS\mwac.sys [156792 2022-03-22] (Malwarebytes Inc -> Malwarebytes)
R3 Nahimic_Mirroring; C:\WINDOWS\System32\drivers\Nahimic_Mirroring.sys [85616 2021-08-13] (A-Volute -> Windows (R) Win 7 DDK provider)
S3 RTCore64; C:\Program Files (x86)\MSI Afterburner\RTCore64.sys [36824 2020-07-13] (MICRO-STAR INTERNATIONAL CO., LTD. -> )
S3 RtlWlanu; C:\WINDOWS\System32\drivers\rtwlanu.sys [12041824 2020-04-30] (Realtek Semiconductor Corp. -> Realtek Semiconductor Corporation)
R3 rzendpt; C:\WINDOWS\System32\drivers\rzendpt.sys [51216 2016-05-12] (Razer USA Ltd. -> Razer Inc)
S3 WdBoot; C:\WINDOWS\system32\drivers\wd\WdBoot.sys [45664 2019-12-10] (Microsoft Windows Early Launch Anti-malware Publisher -> Microsoft Corporation)
S3 WdFilter; C:\WINDOWS\system32\drivers\wd\WdFilter.sys [355760 2019-12-10] (Microsoft Windows -> Microsoft Corporation)
S3 WdNisDrv; C:\WINDOWS\System32\drivers\wd\WdNisDrv.sys [54192 2019-12-10] (Microsoft Windows -> Microsoft Corporation)
R2 WIBUKEY; C:\WINDOWS\System32\DRIVERS\WibuKey64.sys [118200 2016-12-20] (WIBU-SYSTEMS AG -> WIBU-SYSTEMS AG)
S2 AMDRyzenMasterDriverV17; \??\C:\Program Files\AMD\CNext\CNext\AMDRyzenMasterDriver.sys [X]
==================== NetSvcs (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
==================== One month (created) (Whitelisted) =========
(If an entry is included in the fixlist, the file/folder will be moved.)
2022-03-22 21:48 - 2022-03-22 21:50 - 000027992 _____ C:\Users\tkrpe\Desktop\FRST.txt
2022-03-22 21:44 - 2022-03-22 21:50 - 000000000 ____D C:\FRST
2022-03-22 21:43 - 2022-03-22 21:42 - 002364928 _____ (Farbar) C:\Users\tkrpe\Desktop\FRST64.exe
2022-03-22 19:36 - 2022-03-22 19:37 - 000001378 _____ C:\Users\tkrpe\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\ESET Online Scanner.lnk
2022-03-22 19:36 - 2022-03-22 19:36 - 000000000 ____D C:\Users\tkrpe\AppData\Local\ESET
2022-03-22 18:56 - 2022-03-22 18:56 - 000194480 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\farflt.sys
2022-03-22 18:56 - 2022-03-22 18:56 - 000156792 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mwac.sys
2022-03-22 18:56 - 2022-03-22 18:56 - 000069040 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mbam.sys
2022-03-22 18:56 - 2022-03-22 18:56 - 000000004 ____H C:\ProgramData\cm-lock
2022-03-22 18:40 - 2022-03-22 18:40 - 000000000 ___HD C:\$AV_AVG
2022-03-11 13:19 - 2022-03-11 13:19 - 002260992 _____ C:\WINDOWS\system32\TextInputMethodFormatter.dll
2022-03-11 13:19 - 2022-03-11 13:19 - 002254336 _____ C:\WINDOWS\system32\dwmscene.dll
2022-03-11 13:19 - 2022-03-11 13:19 - 000272896 _____ C:\WINDOWS\system32\TpmTool.exe
2022-03-11 13:19 - 2022-03-11 13:19 - 000223744 _____ C:\WINDOWS\SysWOW64\TpmTool.exe
2022-03-11 13:19 - 2022-03-11 13:19 - 000195584 _____ C:\WINDOWS\system32\uwfcfgmgmt.dll
2022-03-11 13:19 - 2022-03-11 13:19 - 000011911 _____ C:\WINDOWS\system32\DrtmAuthTxt.wim
2022-03-11 13:12 - 2022-03-11 13:12 - 000000000 ___HD C:\$WinREAgent
2022-03-03 20:23 - 2022-03-03 20:23 - 000221096 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\MbamChameleon.sys
2022-02-27 22:20 - 2022-02-27 22:20 - 000000000 ____D C:\Users\tkrpe\AppData\Local\ATI
2022-02-26 12:49 - 2022-02-26 12:49 - 000000779 _____ C:\Users\Public\Desktop\Crysis 3.lnk
2022-02-20 19:51 - 2022-02-20 19:51 - 000337336 _____ (AVG Technologies CZ, s.r.o.) C:\WINDOWS\system32\avgBoot.exe
2022-02-20 19:51 - 2022-02-20 19:51 - 000215024 _____ (AVG Technologies CZ, s.r.o.) C:\WINDOWS\system32\Drivers\avgStm.sys
==================== One month (modified) ==================
(If an entry is included in the fixlist, the file/folder will be moved.)
2022-03-22 21:37 - 2019-12-07 10:14 - 000000000 ____D C:\ProgramData\regid.1991-06.com.microsoft
2022-03-22 21:21 - 2020-07-28 20:07 - 000000000 ____D C:\WINDOWS\system32\SleepStudy
2022-03-22 20:58 - 2019-12-07 10:03 - 000000000 ____D C:\WINDOWS\CbsTemp
2022-03-22 20:55 - 2019-12-07 10:13 - 000000000 ____D C:\WINDOWS\INF
2022-03-22 20:54 - 2019-12-07 10:14 - 000000000 ___HD C:\Program Files\WindowsApps
2022-03-22 20:54 - 2019-12-07 10:14 - 000000000 ____D C:\WINDOWS\AppReadiness
2022-03-22 20:37 - 2021-11-20 20:47 - 000000000 ____D C:\Days Gone
2022-03-22 19:23 - 2022-02-15 17:52 - 000000000 ____D C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38
2022-03-22 19:23 - 2021-11-03 20:17 - 000002574 _____ C:\WINDOWS\system32\Tasks\AMDInstallLauncher
2022-03-22 19:23 - 2021-11-03 20:15 - 000002732 _____ C:\WINDOWS\system32\Tasks\ModifyLinkUpdate
2022-03-22 19:23 - 2021-11-03 20:15 - 000002566 _____ C:\WINDOWS\system32\Tasks\AMDLinkUpdate
2022-03-22 19:23 - 2021-11-03 20:14 - 000002460 _____ C:\WINDOWS\system32\Tasks\AMDRyzenMasterSDKTask
2022-03-22 19:23 - 2021-07-21 20:13 - 000002262 _____ C:\WINDOWS\system32\Tasks\StartCN
2022-03-22 19:23 - 2021-07-21 20:13 - 000002182 _____ C:\WINDOWS\system32\Tasks\StartDVR
2022-03-22 19:23 - 2021-06-08 22:55 - 000002474 _____ C:\WINDOWS\system32\Tasks\RTSS
2022-03-22 19:23 - 2020-07-28 20:12 - 000003572 _____ C:\WINDOWS\system32\Tasks\MicrosoftEdgeUpdateTaskMachineUA
2022-03-22 19:23 - 2020-07-28 20:12 - 000003542 _____ C:\WINDOWS\system32\Tasks\Adobe Acrobat Update Task
2022-03-22 19:23 - 2020-07-28 20:12 - 000003348 _____ C:\WINDOWS\system32\Tasks\MicrosoftEdgeUpdateTaskMachineCore
2022-03-22 19:23 - 2020-07-28 20:12 - 000003310 _____ C:\WINDOWS\system32\Tasks\Antivirus Emergency Update
2022-03-22 19:23 - 2020-07-28 20:12 - 000000000 ____D C:\WINDOWS\system32\Tasks\AVAST Software
2022-03-22 19:22 - 2019-12-10 23:10 - 000000000 ____D C:\Users\tkrpe\AppData\LocalLow\Mozilla
2022-03-22 19:16 - 2021-10-09 22:53 - 000000000 ____D C:\WINDOWS\system32\Tasks\Mozilla
2022-03-22 19:03 - 2020-07-28 20:12 - 001693140 _____ C:\WINDOWS\system32\PerfStringBackup.INI
2022-03-22 19:03 - 2019-12-07 15:43 - 000716770 _____ C:\WINDOWS\system32\perfh005.dat
2022-03-22 19:03 - 2019-12-07 15:43 - 000144948 _____ C:\WINDOWS\system32\perfc005.dat
2022-03-22 18:57 - 2020-01-03 23:48 - 000000000 ____D C:\Users\tkrpe\AppData\Local\CrashDumps
2022-03-22 18:56 - 2021-03-25 20:48 - 000000000 ____D C:\Users\tkrpe\AppData\LocalLow\IGDump
2022-03-22 18:56 - 2020-07-28 20:12 - 000000006 ____H C:\WINDOWS\Tasks\SA.DAT
2022-03-22 18:56 - 2020-07-28 20:07 - 000008192 ___SH C:\DumpStack.log.tmp
2022-03-22 18:56 - 2019-12-11 00:49 - 000000000 ____D C:\ProgramData\AVG
2022-03-22 18:56 - 2019-12-07 10:03 - 000524288 _____ C:\WINDOWS\system32\config\BBI
2022-03-22 18:48 - 2021-03-16 01:15 - 000000000 ____D C:\Program Files\Mozilla Firefox
2022-03-22 18:48 - 2019-12-10 23:10 - 000000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2022-03-22 18:47 - 2019-12-10 23:10 - 000001005 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Firefox.lnk
2022-03-22 18:21 - 2021-01-02 19:12 - 000000000 ____D C:\Users\tkrpe\AppData\Local\AMD_Common
2022-03-22 18:15 - 2022-01-18 21:20 - 000002073 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Acrobat DC.lnk
2022-03-22 18:11 - 2020-06-05 19:24 - 000002436 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Edge.lnk
2022-03-12 18:10 - 2020-01-28 21:22 - 000000000 ____D C:\Users\tkrpe\AppData\Roaming\vlc
2022-03-11 19:35 - 2021-01-28 23:21 - 000000000 ____D C:\Program Files\Microsoft Update Health Tools
2022-03-11 19:35 - 2019-12-10 23:03 - 000000000 ____D C:\WINDOWS\system32\MRT
2022-03-11 19:33 - 2019-12-10 23:03 - 145666720 ____C (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2022-03-11 17:52 - 2019-12-11 01:03 - 000000000 ____D C:\Program Files\Microsoft Office
2022-03-11 15:04 - 2020-07-28 20:07 - 005199904 _____ C:\WINDOWS\system32\FNTCACHE.DAT
2022-03-11 15:03 - 2019-12-07 15:47 - 000000000 ___SD C:\WINDOWS\system32\AppV
2022-03-11 15:03 - 2019-12-07 15:47 - 000000000 ____D C:\Program Files\Windows Defender Advanced Threat Protection
2022-03-11 15:03 - 2019-12-07 10:14 - 000000000 ___RD C:\WINDOWS\ImmersiveControlPanel
2022-03-11 15:03 - 2019-12-07 10:14 - 000000000 ____D C:\WINDOWS\SystemResources
2022-03-11 15:03 - 2019-12-07 10:14 - 000000000 ____D C:\WINDOWS\system32\WinBioPlugIns
2022-03-11 15:03 - 2019-12-07 10:14 - 000000000 ____D C:\WINDOWS\system32\oobe
2022-03-11 15:03 - 2019-12-07 10:14 - 000000000 ____D C:\WINDOWS\system32\migwiz
2022-03-11 15:03 - 2019-12-07 10:14 - 000000000 ____D C:\WINDOWS\PolicyDefinitions
2022-03-11 15:03 - 2019-12-07 10:14 - 000000000 ____D C:\WINDOWS\bcastdvr
2022-03-11 15:03 - 2019-12-07 10:03 - 000000000 ____D C:\WINDOWS\servicing
2022-03-11 13:32 - 2019-12-10 22:32 - 000000000 ____D C:\Users\tkrpe\AppData\Local\D3DSCache
2022-03-11 13:19 - 2020-07-28 20:09 - 002877952 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\PrintConfig.dll
2022-03-03 20:23 - 2020-08-18 20:38 - 000002033 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes.lnk
2022-03-03 20:23 - 2019-12-11 00:43 - 000002021 _____ C:\Users\Public\Desktop\Malwarebytes.lnk
2022-03-03 20:22 - 2019-12-11 00:42 - 000000000 ____D C:\ProgramData\Malwarebytes
2022-03-03 20:22 - 2019-12-11 00:42 - 000000000 ____D C:\Program Files\Malwarebytes
2022-03-03 20:21 - 2019-12-11 00:50 - 000551576 _____ (AVG Technologies CZ, s.r.o.) C:\WINDOWS\system32\Drivers\avgSP.sys
2022-03-03 01:07 - 2021-01-10 15:05 - 000000000 ____D C:\Users\tkrpe\AppData\Roaming\Origin
2022-03-03 01:07 - 2021-01-10 15:05 - 000000000 ____D C:\ProgramData\Origin
2022-03-02 21:21 - 2020-02-01 21:00 - 000000000 ____D C:\Users\tkrpe\AppData\Local\Origin
2022-02-25 23:48 - 2021-10-03 21:18 - 000000000 ____D C:\Users\tkrpe\Desktop\Hotovo
2022-02-21 21:15 - 2020-03-03 22:21 - 000000000 ____D C:\Users\tkrpe\Desktop\dům
2022-02-21 21:15 - 2020-02-04 21:08 - 000000000 ____D C:\Users\tkrpe\Graphisoft
2022-02-20 19:51 - 2020-10-25 16:39 - 000267000 _____ (AVG Technologies CZ, s.r.o.) C:\WINDOWS\system32\Drivers\avgMonFlt.sys
2022-02-20 19:51 - 2020-04-21 20:47 - 000544880 _____ (AVG Technologies CZ, s.r.o.) C:\WINDOWS\system32\Drivers\avgNetHub.sys
2022-02-20 19:51 - 2019-12-11 00:50 - 000854416 _____ (AVG Technologies CZ, s.r.o.) C:\WINDOWS\system32\Drivers\avgSnx.sys
2022-02-20 19:51 - 2019-12-11 00:50 - 000369768 _____ (AVG Technologies CZ, s.r.o.) C:\WINDOWS\system32\Drivers\avgbidsdriver.sys
2022-02-20 19:51 - 2019-12-11 00:50 - 000318872 _____ (AVG Technologies CZ, s.r.o.) C:\WINDOWS\system32\Drivers\avgVmm.sys
2022-02-20 19:51 - 2019-12-11 00:50 - 000253040 _____ (AVG Technologies CZ, s.r.o.) C:\WINDOWS\system32\Drivers\avgbidsh.sys
2022-02-20 19:51 - 2019-12-11 00:50 - 000226464 _____ (AVG Technologies CZ, s.r.o.) C:\WINDOWS\system32\Drivers\avgArPot.sys
2022-02-20 19:51 - 2019-12-11 00:50 - 000107992 _____ (AVG Technologies CZ, s.r.o.) C:\WINDOWS\system32\Drivers\avgRdr2.sys
2022-02-20 19:51 - 2019-12-11 00:50 - 000099424 _____ (AVG Technologies CZ, s.r.o.) C:\WINDOWS\system32\Drivers\avgbuniv.sys
2022-02-20 19:51 - 2019-12-11 00:50 - 000083056 _____ (AVG Technologies CZ, s.r.o.) C:\WINDOWS\system32\Drivers\avgRvrt.sys
2022-02-20 19:51 - 2019-12-11 00:50 - 000041488 _____ (AVG Technologies CZ, s.r.o.) C:\WINDOWS\system32\Drivers\avgKbd.sys
2022-02-20 19:51 - 2019-12-07 10:14 - 000000000 ___HD C:\WINDOWS\ELAMBKUP
==================== Files in the root of some directories ========
2020-01-08 23:39 - 2022-02-02 21:28 - 000007652 _____ () C:\Users\tkrpe\AppData\Local\Resmon.ResmonCfg
==================== SigCheck ============================
(There is no automatic fix for files that do not pass verification.)
==================== End of FRST.txt ========================
==================== Memory info ===========================
BIOS: American Megatrends Inc. 1.00 07/13/2018
Motherboard: Micro-Star International Co., Ltd. B450M GAMING PLUS (MS-7B87)
Processor: AMD Ryzen 5 2600 Six-Core Processor
Percentage of memory in use: 39%
Total physical RAM: 16335.2 MB
Available physical RAM: 9861.15 MB
Total Virtual: 22223.2 MB
Available Virtual: 11889.5 MB
==================== Drives ================================
Drive c: () (Fixed) (Total:446.01 GB) (Free:284.94 GB) NTFS
Drive e: () (Fixed) (Total:2794.5 GB) (Free:1062.25 GB) NTFS
\\?\Volume{bfd4a860-e51b-4e65-bc0e-063119748902}\ (Obnovení) (Fixed) (Total:0.49 GB) (Free:0.05 GB) NTFS
\\?\Volume{0242298c-7d4e-4f4d-abb7-d440655088ff}\ () (Fixed) (Total:0.52 GB) (Free:0.08 GB) NTFS
\\?\Volume{47674ca8-bacb-49d3-9538-40a9d28ced80}\ () (Fixed) (Total:0.09 GB) (Free:0.07 GB) FAT32
==================== MBR & Partition Table ====================
==========================================================
Disk: 0 (Protective MBR) (Size: 2794.5 GB) (Disk ID: 00000000)
Partition: GPT.
==========================================================
Disk: 1 (Protective MBR) (Size: 447.1 GB) (Disk ID: 00000000)
Partition: GPT.
==================== End of Addition.txt =======================
