Prosím o kontrolu logu - PC byl teď infikován 5-7 viry
Napsal: 18 úno 2023 20:07
Dobrý večer,
stala se mi taková nepříjemnost. Navštívil jsem stránky jednoho sokolského oddílu a měli je infikované. Již jsem je informoval. Teď mi tam vyskakuje, že PC byl zavirován 5-7 viry a trojskými koni a že moje data byla zašifrována. A jeden znich je trojan Aurora.Hydra ve složce Win32 a pořád mi tam vyskakuje nějaký Norton antivirus o kterým nevím, že jej tam mám. Používám Aviru. Nechci zatím PC vypnou neb nevím, co by se stalo.
Posílám log.
Díky za pomoc.
Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 16-02-2023
Ran by Admin (administrator) on DESKTOP-1U0LM3C (18-02-2023 19:49:28)
Running from D:\Aviry
Loaded Profiles: Admin
Platform: Microsoft Windows 10 Home Version 22H2 19045.2604 (X64) Language: Čeština (Česko)
Default browser: FF
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(C:\Program Files (x86)\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe ->) (Adobe Inc. -> Adobe Inc.) C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\ADS\Adobe Desktop Service.exe
(C:\Program Files (x86)\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe ->) (Adobe Inc. -> Adobe Inc.) C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\HEX\Adobe CEF Helper.exe <2>
(C:\Program Files (x86)\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe ->) (Adobe Inc. -> Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\IPCBox\AdobeIPCBroker.exe
(C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe ->) (Hewlett Packard -> Hewlett-Packard Co.) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqste08.exe
(C:\Program Files\Avira\Endpoint Protection SDK\endpointprotection.exe ->) (Avira Operations GmbH -> Avira Operations GmbH) C:\Program Files\Avira\Endpoint Protection SDK\SentryEye.exe
(D:\Aviry\Malwarebytes\Anti-Malware\MBAMService.exe ->) (Malwarebytes Inc. -> Malwarebytes) D:\Aviry\Malwarebytes\Anti-Malware\mbamtray.exe
(explorer.exe ->) (Adobe Systems Inc.) [File not signed] D:\Programy\Adobe\Adobe Acrobat Distiller 5.0\Distillr\AcroTray.exe
(explorer.exe ->) (Avira Operations GmbH & Co. KG -> Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\VPN\Avira.WebAppHost.exe
(explorer.exe ->) (Corel Corporation -> WinZip Computing) D:\Archivace\WinZip\WzPreloader.exe
(explorer.exe ->) (Google LLC -> Google LLC) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe <9>
(explorer.exe ->) (Hewlett Packard -> Hewlett-Packard Co.) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe
(explorer.exe ->) (Microsoft Corporation -> Microsoft Corporation) C:\Program Files (x86)\Office14\ONENOTEM.EXE
(Check Point Software Technologies Ltd. -> Check Point Software Technologies Ltd.) D:\Aviry\CheckPoint\ZoneAlarm\zatray.exe
(Microsoft Windows -> Microsoft Corporation) C:\Windows\splwow64.exe
(PIRIFORM SOFTWARE LIMITED -> Piriform Software Ltd) D:\Aviry\CCleaner\CCleaner64.exe
(RealNetworks, Inc. -> ) D:\Prográmky\RealPlayer\downloader2.exe
(services.exe ->) (ABBYY Production LLC -> ABBYY Production LLC) C:\Program Files (x86)\Common Files\ABBYY\FineReader\15\Licensing\NetworkLicenseServer.exe
(services.exe ->) (Adobe Inc. -> Adobe Inc.) C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\ElevationManager\AdobeUpdateService.exe
(services.exe ->) (Adobe Inc. -> Adobe Inc.) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
(services.exe ->) (Adobe Inc. -> Adobe Systems, Incorporated) C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGMService.exe
(services.exe ->) (Adobe Inc. -> Adobe Systems, Incorporated) C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGSService.exe
(services.exe ->) (Adobe Systems Incorporated -> Adobe Systems Incorporated) D:\Fotoeditory\Adobe Photoshop Elements 11\Elements 10 Organizer\PhotoshopElementsFileAgent.exe
(services.exe ->) (ASUSTeK Computer Inc. -> ) C:\Windows\System32\AsusUpdateCheck.exe
(services.exe ->) (Avira Operations GmbH & Co. KG -> Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\VPN\Avira.VpnService.exe
(services.exe ->) (Avira Operations GmbH -> Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\Optimizer Host\Avira.OptimizerHost.exe
(services.exe ->) (Avira Operations GmbH -> Avira Operations GmbH) C:\Program Files (x86)\Avira\Security\Avira.Spotlight.Service.exe
(services.exe ->) (Avira Operations GmbH -> Avira Operations GmbH) C:\Program Files\Avira\Endpoint Protection SDK\endpointprotection.exe
(services.exe ->) (geek software GmbH -> geek software GmbH) D:\Prográmky\PDF24\pdf24.exe <2>
(services.exe ->) (Check Point Software Technologies Ltd. -> Check Point Software Technologies Ltd.) C:\Program Files (x86)\CheckPoint\ICM\ICM-Service-NET.exe
(services.exe ->) (Check Point Software Technologies Ltd. -> Check Point Software Technologies Ltd.) D:\Aviry\CheckPoint\ZoneAlarm\vsmon.exe
(services.exe ->) (Malwarebytes Inc. -> Malwarebytes) D:\Aviry\Malwarebytes\Anti-Malware\MBAMService.exe
(services.exe ->) (Microsoft Corporation -> Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
(services.exe ->) (Microsoft Windows Publisher -> Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe <2>
(services.exe ->) (NVIDIA Corporation -> NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display.NvContainer\NVDisplay.Container.exe <2>
(services.exe ->) (pdfforge GmbH -> pdfforge GmbH) C:\Program Files\PDF Architect 7\updater-ws.exe
(services.exe ->) (pdfforge GmbH -> pdfforge GmbH) C:\Program Files\PDF Architect 7\ws.exe
(services.exe ->) (RealNetworks, Inc. -> RealNetworks, Inc.) D:\Prográmky\UpdateService\RealPlayerUpdateSvc.exe
(services.exe ->) (Softland SRL -> Microsoft) C:\Program Files\Softland\novaPDF 10\Server\novapdfs.exe
(svchost.exe ->) (Adobe Inc. -> Adobe Inc.) C:\Program Files (x86)\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe
(svchost.exe ->) (Avira Operations GmbH -> Avira Operations GmbH) C:\Program Files (x86)\Avira\Security\Avira.Spotlight.Systray.Application.exe
(svchost.exe ->) (Hewlett Packard -> Hewlett-Packard Co.) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqbam08.exe
(svchost.exe ->) (Hewlett Packard -> Hewlett-Packard) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqgpc01.exe
(svchost.exe ->) (Microsoft Corporation) C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_4.2204.13303.0_x64__8wekyb3d8bbwe\Cortana.exe
(svchost.exe ->) (Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\dllhost.exe
(svchost.exe ->) (Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\MoUsoCoreWorker.exe
(svchost.exe ->) (Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\PrintIsolationHost.exe
(svchost.exe ->) (Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\rundll32.exe
(svchost.exe ->) (Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\smartscreen.exe
(svchost.exe ->) (RealNetworks, Inc. -> RealNetworks, Inc.) D:\Prográmky\RealPlayer\Update\realsched.exe
==================== Registry (Whitelisted) ===================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [Logitech Download Assistant] => C:\Windows\System32\LogiLDA.dll [3831808 2021-08-30] (Microsoft Windows Hardware Compatibility Publisher -> Logitech)
HKLM\...\Run: [AdobeGCInvoker-1.0] => C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGCInvokerUtility.exe [3503584 2023-01-19] (Adobe Inc. -> Adobe Systems, Incorporated)
HKLM\...\Run: [PDF24] => D:\Prográmky\PDF24\pdf24.exe [619192 2023-01-02] (geek software GmbH -> geek software GmbH)
HKLM\...\Run: [] => [X]
HKLM-x32\...\Run: [ZoneAlarm] => D:\Aviry\CheckPoint\ZoneAlarm\zatray.exe [325856 2020-01-23] (Check Point Software Technologies Ltd. -> Check Point Software Technologies Ltd.)
HKLM-x32\...\Run: [Avira System Speedup User Starter] => C:\Program Files (x86)\Avira\System Speedup\Avira.SystemSpeedup.Core.Common.Starter.exe [334264 2023-02-03] (Avira Operations GmbH -> Avira Operations GmbH)
HKLM-x32\...\Run: [] => [X]
HKLM\SOFTWARE\Microsoft\Windows Defender: [DisableAntiSpyware] Restriction <==== ATTENTION
HKLM\SOFTWARE\Microsoft\Windows Defender: [DisableAntiVirus] Restriction <==== ATTENTION
HKU\S-1-5-21-722231672-965411127-3486821242-1001\...\Run: [CCleaner Smart Cleaning] => D:\Aviry\CCleaner\CCleaner64.exe [38966072 2023-02-08] (PIRIFORM SOFTWARE LIMITED -> Piriform Software Ltd)
HKU\S-1-5-21-722231672-965411127-3486821242-1001\...\Run: [] => [X]
HKU\S-1-5-21-722231672-965411127-3486821242-1001\...\RunOnce: [Delete Cached Update Binary] => C:\WINDOWS\system32\cmd.exe /q /c del /q "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe" (No File)
HKU\S-1-5-21-722231672-965411127-3486821242-1001\...\RunOnce: [Delete Cached Standalone Update Binary] => C:\WINDOWS\system32\cmd.exe /q /c del /q "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\StandaloneUpdater\OneDriveSetup.exe" (No File)
HKU\S-1-5-21-722231672-965411127-3486821242-1001\...\RunOnce: [Uninstall 23.020.0125.0003] => C:\WINDOWS\system32\cmd.exe /q /c rmdir /s /q "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\23.020.0125.0003" (No File)
HKLM\...\Windows x64\Print Processors\hpzppw71: C:\Windows\System32\spool\prtprocs\x64\hpzppw71.dll [239704 2017-12-18] (Microsoft Windows Hardware Compatibility Publisher -> Hewlett-Packard Corporation)
HKLM\...\Print\Monitors\novaPDF 10 Port Monitor: C:\WINDOWS\system32\novamn10.dll [18944 2020-10-19] (Softland) [File not signed]
HKLM\...\Print\Monitors\PCL hpz3lw71: C:\WINDOWS\system32\hpz3lw71.dll [55392 2017-12-18] (Microsoft Windows Hardware Compatibility Publisher -> Hewlett-Packard Corporation)
HKLM\...\Print\Monitors\PDF Architect 7 Monitor: C:\Windows\system32\spool\DRIVERS\x64\pdf architect_pdfpmon_v.4.12.26.3.dll [932984 2019-11-26] (PDF Tools AG -> PDF Tools AG (hxxp://www.pdf-tools.com))
HKLM\...\Print\Monitors\PDF-XChange5-ABBYY: C:\Windows\system32\pxc50pma.dll [58936 2014-11-13] (Tracker Software Products (Canada) Ltd -> Tracker Software Products (Canada) Ltd.)
HKLM\...\Print\Monitors\PDF-XChange5-ABBYY-FR15: C:\WINDOWS\system32\pxc50pmaf15.dll [57328 2018-12-04] (Tracker Software Products (Canada) Ltd. -> Tracker Software Products (Canada) Ltd.)
HKLM\Software\Microsoft\Active Setup\Installed Components: [{8A69D345-D564-463c-AFF1-A69D9E530F96}] -> C:\Program Files (x86)\Google\Chrome\Application\110.0.5481.97\Installer\chrmstp.exe [2023-02-14] (Google LLC -> Google LLC)
Startup: C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Avira.lnk [2020-02-02]
ShortcutTarget: Avira.lnk -> C:\Program Files (x86)\Avira\Launcher\Avira.Systray.exe (Avira Operations GmbH -> Avira Operations GmbH & Co. KG)
Startup: C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Výřezy obrazovky a spuštění aplikace OneNote 2010.lnk [2022-05-13]
ShortcutTarget: Výřezy obrazovky a spuštění aplikace OneNote 2010.lnk -> C:\Program Files (x86)\Office14\ONENOTEM.EXE (Microsoft Corporation -> Microsoft Corporation)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Acrobat Assistant.lnk [2020-01-31]
ShortcutTarget: Acrobat Assistant.lnk -> D:\Programy\Adobe\Adobe Acrobat Distiller 5.0\Distillr\AcroTray.exe (Adobe Systems Inc.) [File not signed]
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk [2019-11-26]
ShortcutTarget: HP Digital Imaging Monitor.lnk -> C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe (Hewlett Packard -> Hewlett-Packard Co.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\WinZip Preloader.lnk [2020-08-11]
ShortcutTarget: WinZip Preloader.lnk -> D:\Archivace\WinZip\WzPreloader.exe (Corel Corporation -> WinZip Computing)
GroupPolicy-Firefox-x32: Restriction <==== ATTENTION
==================== Scheduled Tasks (Whitelisted) ============
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
Task: {0021521B-F19D-4641-921A-4D3FFAA1499C} - System32\Tasks\Avira_FallbackUpdater => C:\WINDOWS\system32\sc.exe start AviraFallbackUpdater Delayed=false
Task: {0382BFFA-D36E-47DD-A99E-F6D2C7C510A3} - System32\Tasks\Opera scheduled Autoupdate 1574800406 => C:\Program Files (x86)\Opera\launcher.exe [1977800 2023-02-08] (Opera Norway AS -> Opera Software)
Task: {043BA1DA-4398-4B02-8D31-D02F8B0973A8} - System32\Tasks\Mozilla\Firefox Default Browser Agent E7CF176E110C211B => C:\Program Files (x86)\Mozilla Firefox\default-browser-agent.exe [716192 2023-02-16] (Mozilla Corporation -> Mozilla Foundation)
Task: {05C648EC-C404-46A5-85FC-F9E9B7720D2E} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [1552376 2022-09-26] (Adobe Inc. -> Adobe Inc.)
Task: {0C3F0ED1-2C1F-42EA-AECE-130E4BEA6A04} - System32\Tasks\doPDF 10 Telemetry => C:\Program Files\Softland\novaPDF 10\Driver\GoogleAnalytics.exe [51504 2020-10-19] (Softland SRL -> )
Task: {17547B1C-0FF7-4276-9950-7093AF26FEEC} - System32\Tasks\Mozilla\Firefox Background Update E7CF176E110C211B => C:\Program Files (x86)\Mozilla Firefox\firefox.exe [674720 2023-02-16] (Mozilla Corporation -> Mozilla Corporation) -> --MOZ_LOG sync,prependheader,timestamp,append,maxsize:1,Dump:5 --MOZ_LOG_FILE C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\E7CF176E110C211B\backgroundupdate.moz_log --backgroundtask backgroundupdate
Task: {1C29A92E-D239-4352-A853-33E364E80D1E} - System32\Tasks\Avira\System Speedup\TestScheduler => C:\Program Files (x86)\Avira\System Speedup\Avira.SystemSpeedup.Core.Common.Starter.exe [334264 2023-02-03] (Avira Operations GmbH -> Avira Operations GmbH)
Task: {28D42CB5-D124-4DE5-AB47-BD599C97C52B} - System32\Tasks\Avira\System Speedup\Delayed Startup\All users\2 => C:\Program Files (x86)\Office14\BCSSync.exe [91520 2010-01-21] (Microsoft Corporation -> Microsoft Corporation)
Task: {2DA4E14C-06DD-498D-8217-4755502737E1} - System32\Tasks\RealDownloaderRealUpgradeLogonTaskS-1-5-21-722231672-965411127-3486821242-1001 => C:\Program Files (x86)\RealNetworks\RealDownloader\RealUpgrade.exe [128240 2016-02-03] (RealNetworks, Inc. -> RealNetworks, Inc.)
Task: {2DA8EF45-C109-420E-93A4-971FEC877E27} - System32\Tasks\Avira\System Speedup\Delayed Startup\Admin\2 => C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe [4243408 2023-02-16] (Microsoft Corporation -> Microsoft Corporation)
Task: {30515FA6-F9ED-44C5-8EFA-8506DAE5A0F2} - System32\Tasks\AdobeAAMUpdater-1.0-DESKTOP-1U0LM3C-Admin => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [509936 2018-04-10] (Adobe Systems Incorporated -> Adobe Systems Incorporated)
Task: {378F7421-F8D8-44FB-8CE1-48B44639438B} - System32\Tasks\Avira\System Speedup\Delayed Startup\All users\4 => C:\Program Files (x86)\Opera\assistant\browser_assistant.exe [4124416 2022-05-17] (Opera Software AS -> Opera Software)
Task: {5A590DC1-4FD3-4C73-9D95-05C48F571510} - System32\Tasks\Avira_Security_Service_SCM_Watchdog => C:\Program Files (x86)\Avira\Security\Avira.Spotlight.Service.Worker.exe [259872 2023-01-26] (Avira Operations GmbH -> Avira Operations GmbH)
Task: {66D4258B-FB2D-4822-827C-F667D673E544} - System32\Tasks\Avira_Security_Systray => C:\Program Files (x86)\Avira\Security\Avira.Spotlight.Systray.Application.exe [1695784 2023-01-26] (Avira Operations GmbH -> Avira Operations GmbH)
Task: {73D6DECF-82F9-4D6A-9866-C7FD33DD1FD9} - System32\Tasks\Avira_Security_Update => C:\WINDOWS\system32\net.exe [59904 2019-12-07] (Microsoft Windows -> Microsoft Corporation)
Task: {75EC3453-3A6D-4E59-8B4E-7561114DA633} - System32\Tasks\Avira\System Speedup\Delayed Startup\All users\5 => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [509936 2018-04-10] (Adobe Systems Incorporated -> Adobe Systems Incorporated)
Task: {8DBC5B42-9DED-4C29-9E5D-040CE4E38D32} - System32\Tasks\Avira\System Speedup\Delayed Startup\All users\3 => d:\prográmky\realplayer\Update\realsched.exe [347560 2021-12-26] (RealNetworks, Inc. -> RealNetworks, Inc.)
Task: {8FF6D8D3-1266-4D7C-B1D0-D37DFFB2BCC7} - System32\Tasks\GoogleUpdateTaskMachineUA{32984F0D-7489-4194-9DDB-4946D2A65C44} => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [153168 2019-11-26] (Google Inc -> Google Inc.)
Task: {9454FBBB-5CB0-48D2-AEBD-8254EB82CB1E} - System32\Tasks\GoogleUpdateTaskMachineCore{08E5070A-C385-4792-BF92-1F74F680059A} => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [153168 2019-11-26] (Google Inc -> Google Inc.)
Task: {ABAB166C-020B-4747-9D9C-686F045835A4} - System32\Tasks\CCleaner Update => D:\Aviry\CCleaner\CCUpdate.exe [684976 2023-02-08] (Piriform Software Ltd -> Piriform)
Task: {B5397A57-7DF5-4425-8B44-C8938C5CC7EB} - System32\Tasks\CCleanerCrashReporting => D:\Aviry\CCleaner\CCleanerBugReport.exe [4703544 2023-02-08] (PIRIFORM SOFTWARE LIMITED -> Piriform Software) -> --product 90 --send dumps|report --path "D:\Aviry\CCleaner\LOG" --programpath "D:\Aviry\CCleaner" --configpath "D:\Aviry\CCleaner\Setup" --guid "d4a0d706-3321-4b6e-9f14-d2d3bcba89e7" --version "6.09.10300" --silent
Task: {BA8F2F08-EF69-4280-8292-CC8649E65689} - System32\Tasks\Avira\System Speedup\Delayed Startup\All users\7 => D:\Prográmky\PDF24\pdf24.exe [619192 2023-01-02] (geek software GmbH -> geek software GmbH)
Task: {BB9C4A9E-8903-42A2-9BCF-77E08E69BE01} - System32\Tasks\klcp_update => D:\Prográmky\K-Lite Codec Pack\Tools\CodecTweakTool.exe [1907712 2021-04-12] () [File not signed]
Task: {C058F360-D1E7-4B0B-817D-F6E7783E7B0F} - System32\Tasks\RealDownloader Update Check => d:\prográmky\realplayer\downloader2.exe [1167784 2021-12-26] (RealNetworks, Inc. -> )
Task: {C2D10D6C-2A67-4D2F-9AFC-3225FCE0153A} - System32\Tasks\RealPlayerRealUpgradeScheduledTaskS-1-5-21-722231672-965411127-3486821242-1001 => D:\prográmky\realplayer\RealUpgrade.exe [129960 2021-12-26] (RealNetworks, Inc. -> RealNetworks, Inc.)
Task: {CC6528AE-229D-4529-9560-325BC1F601A7} - System32\Tasks\Avira\System Speedup\Delayed Startup\All users\6 => C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGCInvokerUtility.exe [3503584 2023-01-19] (Adobe Inc. -> Adobe Systems, Incorporated)
Task: {D23FE6F4-EA71-4639-ACE6-D0922061CC75} - System32\Tasks\AdobeGCInvoker-1.0 => C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGCInvokerUtility.exe [3503584 2023-01-19] (Adobe Inc. -> Adobe Systems, Incorporated)
Task: {D2C135A4-E491-469B-9EE5-8BBB500E2731} - System32\Tasks\CCleanerSkipUAC - Admin => D:\Aviry\CCleaner\CCleaner.exe [32631096 2023-02-08] (PIRIFORM SOFTWARE LIMITED -> Piriform Software Ltd)
Task: {DD4DDD5E-C15D-41A6-BFE2-8EBFC70439DC} - System32\Tasks\RealDownloaderRealUpgradeScheduledTaskS-1-5-21-722231672-965411127-3486821242-1001 => C:\Program Files (x86)\RealNetworks\RealDownloader\RealUpgrade.exe [128240 2016-02-03] (RealNetworks, Inc. -> RealNetworks, Inc.)
Task: {DF0BA4DD-EBE6-4791-9C12-E16E675E04FC} - System32\Tasks\Avira\System Speedup\Delayed Startup\All users\1 => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe [2623032 2019-07-26] (Adobe Inc. -> Adobe Inc.)
Task: {E948ECFF-5A89-46DA-AE8D-EFA7EF4E35F1} - System32\Tasks\Microsoft\Windows Live\SOXE\Extractor Definitions Update Task => {3519154C-227E-47F3-9CC9-12C3F05817F1}
Task: {EB2B61BF-C3A2-4F58-B725-387972CD7149} - System32\Tasks\doPDF 10 Update => C:\Program Files\Softland\novaPDF 10\Driver\UpdateApplication.exe [98096 2020-10-19] (Softland SRL -> )
Task: {F36A9778-2F93-41AA-88ED-CAFD9AB49CEE} - System32\Tasks\RealPlayerRealUpgradeLogonTaskS-1-5-21-722231672-965411127-3486821242-1001 => D:\prográmky\realplayer\RealUpgrade.exe [129960 2021-12-26] (RealNetworks, Inc. -> RealNetworks, Inc.)
Task: {FA6E3AFA-187C-4E34-AB13-74B7AD8D2E91} - System32\Tasks\AviraSystemSpeedupVerify => C:\Program Files (x86)\Avira\System Speedup\setup\avira_speedup_setup.exe [35437192 2023-02-09] (Avira Operations GmbH -> Avira Operations GmbH)
Task: {FDEF45B1-CBD9-4E0C-B0B8-5B88C3E1DABF} - System32\Tasks\Avira_Security_Maintenance => Command(1): C:\Program Files (x86)\Avira\Security\Avira.Spotlight.Service.Worker.exe -> FallbackTelemetry
Task: {FDEF45B1-CBD9-4E0C-B0B8-5B88C3E1DABF} - System32\Tasks\Avira_Security_Maintenance => Command(2): C:\Program Files (x86)\Avira\Security\Avira.Spotlight.Service.Worker.exe -> ServiceWatchdog
Task: {FDEF45B1-CBD9-4E0C-B0B8-5B88C3E1DABF} - System32\Tasks\Avira_Security_Maintenance => Command(3): C:\Program Files (x86)\Avira\Security\Avira.Spotlight.Service.Worker.exe -> CrashCollector
(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)
Task: C:\WINDOWS\Tasks\CCleanerCrashReporting.job => D:\Aviry\CCleaner\CCleanerBugReport.exe
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
ProxyServer: [S-1-5-21-722231672-965411127-3486821242-1001] => http=;ftp=;https=;
Tcpip\Parameters: [DhcpNameServer] 31.30.90.11 31.30.90.12
Tcpip\..\Interfaces\{2344692f-c41b-4ac7-9c50-43b9fc907f50}: [DhcpNameServer] 31.30.90.11 31.30.90.12
Edge:
=======
Edge DefaultProfile: Default
Edge Profile: C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default [2023-02-18]
Edge HKLM-x32\...\Edge\Extension: [ihcjicgdanjaechkgeegckofjjedodee]
FireFox:
========
FF DefaultProfile: 2i1040qs.default-1582311638745
FF ProfilePath: C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\u4mgi7h5.default-release [2023-02-18]
FF Homepage: Mozilla\Firefox\Profiles\u4mgi7h5.default-release -> about:home
FF NewTab: Mozilla\Firefox\Profiles\u4mgi7h5.default-release -> about:newtab
FF ProfilePath: C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2i1040qs.default-1582311638745 [2023-02-18]
FF NewTab: Mozilla\Firefox\Profiles\2i1040qs.default-1582311638745 -> about:newtab
FF Notifications: Mozilla\Firefox\Profiles\2i1040qs.default-1582311638745 -> hxxps://www.slevomat.cz
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation -> Microsoft Corporation)
FF Plugin: @videolan.org/vlc,version=3.0.10 -> D:\Prográmky\VideoLAN\VLC\npvlc.dll [2022-11-08] (VideoLAN -> VideoLAN)
FF Plugin: @videolan.org/vlc,version=3.0.11 -> D:\Prográmky\VideoLAN\VLC\npvlc.dll [2022-11-08] (VideoLAN -> VideoLAN)
FF Plugin: @videolan.org/vlc,version=3.0.12 -> D:\Prográmky\VideoLAN\VLC\npvlc.dll [2022-11-08] (VideoLAN -> VideoLAN)
FF Plugin: @videolan.org/vlc,version=3.0.14 -> D:\Prográmky\VideoLAN\VLC\npvlc.dll [2022-11-08] (VideoLAN -> VideoLAN)
FF Plugin: @videolan.org/vlc,version=3.0.16 -> D:\Prográmky\VideoLAN\VLC\npvlc.dll [2022-11-08] (VideoLAN -> VideoLAN)
FF Plugin: @videolan.org/vlc,version=3.0.18 -> D:\Prográmky\VideoLAN\VLC\npvlc.dll [2022-11-08] (VideoLAN -> VideoLAN)
FF Plugin: @videolan.org/vlc,version=3.0.8 -> D:\Prográmky\VideoLAN\VLC\npvlc.dll [2022-11-08] (VideoLAN -> VideoLAN)
FF Plugin: Adobe Acrobat -> C:\Program Files\Adobe\Acrobat DC\Acrobat\Air\nppdf32.dll [2023-02-14] (Adobe Inc. -> Adobe Systems Inc.)
FF Plugin: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Adobe\Adobe Creative Cloud\Utils\npAdobeAAMDetect64.dll [2019-07-26] (Adobe Inc. -> Adobe Systems)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation -> Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\Office14\NPSPWRAP.DLL [2010-01-09] (Microsoft Corporation -> Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3528.0331 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2014-03-31] (Microsoft Corporation -> Microsoft Corporation)
FF Plugin-x32: @real.com/nppl3260;version=20.0.7.309 -> d:\prográmky\realplayer\Netscape6\nppl3260.dll [2021-12-26] (RealNetworks, Inc. -> RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprpplugin;version=20.0.7.309 -> d:\prográmky\realplayer\Netscape6\nprpplugin.dll [2021-12-26] (RealNetworks, Inc. -> RealPlayer)
FF Plugin-x32: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Adobe\Adobe Creative Cloud\Utils\npAdobeAAMDetect32.dll [2019-07-26] (Adobe Inc. -> Adobe Systems)
Chrome:
=======
CHR DefaultProfile: Profile 6
CHR Profile: C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Guest Profile [2022-11-29]
CHR Profile: C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Profile 6 [2023-02-18]
CHR Notifications: Profile 6 -> hxxps://captchacoolnow.top
CHR Extension: (uBlock Origin) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Profile 6\Extensions\cjpalhdlnbpafiamejdnhcphjbkeiagm [2022-12-31]
CHR Extension: (Dokumenty Google offline) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Profile 6\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2023-02-14]
CHR Extension: (Malwarebytes Browser Guard) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Profile 6\Extensions\ihcjicgdanjaechkgeegckofjjedodee [2023-02-07]
CHR Extension: (Platby Internetového obchodu Chrome) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Profile 6\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2022-09-02]
CHR Profile: C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile [2023-02-18]
CHR HKLM-x32\...\Chrome\Extension: [ihcjicgdanjaechkgeegckofjjedodee]
Opera:
=======
OPR Profile: C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable [2023-02-18]
OPR DefaultSuggestURL: Opera Stable -> hxxps://www.google.com/complete/search?client=o ... utEncoding}
OPR Extension: (Rich Hints Agent) - C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Extensions\enegjkbbakeegngfapepobipndnebkdk [2022-10-31]
OPR Extension: (Opera Wallet) - C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Extensions\gojhcdgcpbpfigcaejpfhfegekdgiblk [2023-02-18]
OPR Extension: (Amazon Assistant Promotion) - C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Extensions\kbmoiomgmchbpihhdpabemajcbjpcijk [2021-08-15]
OPR Extension: (uBlock Origin) - C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Extensions\kccohkcpppjjkkjppopfnflnebibpida [2023-02-18]
==================== Services (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
R2 ABBYY.Licensing.FineReader.15.0; C:\Program Files (x86)\Common Files\ABBYY\FineReader\15\Licensing\NetworkLicenseServer.exe [1058032 2019-07-29] (ABBYY Production LLC -> ABBYY Production LLC)
S2 ABBYY.Licensing.PDFTransformer.Classic.4.0; D:\Programy\ABBYY PDF Transformer+\NetworkLicenseServer.exe [962256 2014-12-02] (ABBYY Production LLC -> ABBYY Production LLC)
R2 AdobeActiveFileMonitor10.0; D:\Fotoeditory\Adobe Photoshop Elements 11\Elements 10 Organizer\PhotoshopElementsFileAgent.exe [169624 2011-09-14] (Adobe Systems Incorporated -> Adobe Systems Incorporated)
R2 AdobeARMservice; C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [173040 2022-09-26] (Adobe Inc. -> Adobe Inc.)
R2 AdobeUpdateService; C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\ElevationManager\AdobeUpdateService.exe [816184 2019-07-26] (Adobe Inc. -> Adobe Inc.)
R2 AGMService; C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGMService.exe [3896288 2023-01-19] (Adobe Inc. -> Adobe Systems, Incorporated)
R2 AGSService; C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGSService.exe [3729888 2023-01-19] (Adobe Inc. -> Adobe Systems, Incorporated)
R2 AsusUpdateCheck; C:\WINDOWS\System32\AsusUpdateCheck.exe [768408 2023-02-18] (ASUSTeK Computer Inc. -> )
S2 AviraFallbackUpdater; C:\Program Files (x86)\Avira\Fallback Updater\Avira.Spotlight.FallbackUpdater.exe [6520504 2023-02-13] (Avira Operations GmbH -> Avira Operations GmbH & Co. KG)
R2 AviraOptimizerHost; C:\Program Files (x86)\Avira\Optimizer Host\Avira.OptimizerHost.exe [3004688 2022-07-22] (Avira Operations GmbH -> Avira Operations GmbH & Co. KG)
R2 AviraPhantomVPN; C:\Program Files (x86)\Avira\VPN\Avira.VpnService.exe [386864 2022-03-30] (Avira Operations GmbH & Co. KG -> Avira Operations GmbH & Co. KG)
R2 AviraSecurity; C:\Program Files (x86)\Avira\Security\Avira.Spotlight.Service.exe [267096 2023-01-26] (Avira Operations GmbH -> Avira Operations GmbH)
S2 AviraSecurityUpdater; C:\Program Files (x86)\Avira\Security\Avira.Spotlight.Common.Updater.exe [295920 2023-01-26] (Avira Operations GmbH -> Avira Operations GmbH)
S3 CCleanerPerformanceOptimizerService; D:\Aviry\CCleaner\CCleanerPerformanceOptimizerService.exe [1001272 2023-02-08] (PIRIFORM SOFTWARE LIMITED -> Piriform Software Ltd)
R2 EndpointProtectionService; C:\Program Files\Avira\Endpoint Protection SDK\endpointprotection.exe [8937712 2023-02-17] (Avira Operations GmbH -> Avira Operations GmbH)
S3 EndpointProtectionService2; C:\Program Files\Avira\Endpoint Protection SDK\endpointprotection.exe [8937712 2023-02-17] (Avira Operations GmbH -> Avira Operations GmbH)
R2 MBAMService; D:\Aviry\Malwarebytes\Anti-Malware\MBAMService.exe [8966256 2023-02-02] (Malwarebytes Inc. -> Malwarebytes)
S3 Microsoft SharePoint Workspace Audit Service; C:\Program Files (x86)\Office14\GROOVE.EXE [30963576 2010-01-21] (Microsoft Corporation -> Microsoft Corporation)
S2 Net Driver HPZ12; C:\Windows\System32\HPZinw12.dll [71680 2010-08-06] (Hewlett-Packard) [File not signed]
R2 NovaPdf10Server; C:\Program Files\Softland\novaPDF 10\Server\novapdfs.exe [52528 2020-10-19] (Softland SRL -> Microsoft)
R3 PDF Architect 7; C:\Program Files\PDF Architect 7\ws.exe [2579752 2019-10-07] (pdfforge GmbH -> pdfforge GmbH)
S3 PDF Architect 7 Creator; C:\Program Files\PDF Architect 7\creator\common\creator-ws.exe [692008 2019-10-07] (pdfforge GmbH -> pdfforge GmbH)
R2 PDF Architect 7 Update Service; C:\Program Files\PDF Architect 7\updater-ws.exe [1832232 2019-10-07] (pdfforge GmbH -> pdfforge GmbH)
R2 PDF24; D:\Prográmky\PDF24\pdf24.exe [619192 2023-01-02] (geek software GmbH -> geek software GmbH)
S2 Pml Driver HPZ12; C:\Windows\System32\HPZipm12.dll [89600 2010-08-06] (Hewlett-Packard) [File not signed]
R2 RealPlayerUpdateSvc; D:\prográmky\UpdateService\RealPlayerUpdateSvc.exe [38856 2021-12-04] (RealNetworks, Inc. -> RealNetworks, Inc.)
S2 RealTimes Desktop Service; d:\prográmky\realplayer\RPDS\Bin\rpdsvc.exe [991176 2021-12-26] (RealNetworks, Inc. -> RealNetworks, Inc.)
R2 vsmon; D:\Aviry\CheckPoint\ZoneAlarm\vsmon.exe [4528344 2020-01-20] (Check Point Software Technologies Ltd. -> Check Point Software Technologies Ltd.)
S3 WdNisSvc; C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.2301.6-0\NisSrv.exe [3191256 2023-02-18] (Microsoft Windows Publisher -> Microsoft Corporation)
S3 WinDefend; C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.2301.6-0\MsMpEng.exe [133576 2023-02-18] (Microsoft Windows Publisher -> Microsoft Corporation)
R2 ZA NET ICM Service; C:\Program Files (x86)\CheckPoint\ICM\ICM-Service-NET.exe [42208 2020-03-13] (Check Point Software Technologies Ltd. -> Check Point Software Technologies Ltd.)
S3 ZAPrivacyService; D:\Aviry\CheckPoint\ZoneAlarm\ZaPrivacyService.exe [114936 2020-01-20] (Check Point Software Technologies Ltd. -> Check Point Software Technologies, Ltd.)
===================== Drivers (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
R0 BdNet; C:\WINDOWS\System32\DRIVERS\BdNet.sys [185704 2022-06-13] (NortonLifeLock Inc. -> BullGuard Ltd.)
R1 BdSentry; C:\WINDOWS\System32\DRIVERS\BdSentry.sys [263000 2023-01-31] (Avira Operations GmbH -> Avira Operations GmbH)
S3 BthA2dp; C:\WINDOWS\System32\drivers\BthA2dp.sys [279040 2019-12-07] (Microsoft Corporation) [File not signed]
S3 BthHFEnum; C:\WINDOWS\System32\drivers\bthhfenum.sys [144896 2019-12-07] (Microsoft Corporation) [File not signed]
S3 dg_ssudbus; C:\WINDOWS\system32\DRIVERS\ssudbus2.sys [160376 2021-10-08] (Samsung Electronics Co., Ltd. -> Samsung Electronics Co., Ltd.)
R2 MBAMChameleon; C:\WINDOWS\System32\Drivers\MbamChameleon.sys [223176 2023-02-18] (Microsoft Windows Hardware Compatibility Publisher -> Malwarebytes)
S0 MbamElam; C:\WINDOWS\System32\DRIVERS\MbamElam.sys [21480 2022-05-04] (Microsoft Windows Early Launch Anti-malware Publisher -> Malwarebytes)
R3 MBAMSwissArmy; C:\WINDOWS\System32\Drivers\mbamswissarmy.sys [239544 2022-09-23] (Microsoft Windows Hardware Compatibility Publisher -> Malwarebytes)
R1 netprotection_network_filter; C:\WINDOWS\System32\drivers\netprotection_network_filter.sys [100128 2022-06-15] (Avira Operations GmbH & Co. KG -> Avira Operations GmbH & Co. KG)
R2 npf; C:\WINDOWS\system32\drivers\npf.sys [36600 2019-11-11] (Riverbed Technology, Inc. -> Riverbed Technology, Inc.)
S0 rtp_elam; C:\WINDOWS\System32\DRIVERS\rtp_elam.sys [28128 2023-02-15] (Microsoft Windows Early Launch Anti-malware Publisher -> Avira Operations GmbH)
R2 rtp_filesystem_filter; C:\WINDOWS\System32\DRIVERS\rtp_filesystem_filter.sys [227616 2023-02-15] (Avira Operations GmbH -> Avira Operations GmbH)
R1 rtp_process_monitor; C:\WINDOWS\system32\DRIVERS\rtp_process_monitor.sys [238144 2023-02-15] (Avira Operations GmbH -> Avira Operations GmbH)
R1 rtp_traverse; C:\WINDOWS\system32\DRIVERS\rtp_traverse.sys [64696 2023-02-15] (Avira Operations GmbH -> Avira Operations GmbH)
R1 Vsdatant; C:\WINDOWS\system32\DRIVERS\vsdatant.sys [461240 2019-07-25] (Check Point Software Technologies Ltd. -> Check Point Software Technologies Ltd.)
S3 WdBoot; C:\WINDOWS\system32\drivers\wd\WdBoot.sys [49576 2023-02-18] (Microsoft Windows Early Launch Anti-malware Publisher -> Microsoft Corporation)
S3 WdFilter; C:\WINDOWS\system32\drivers\wd\WdFilter.sys [473336 2023-02-18] (Microsoft Windows -> Microsoft Corporation)
S3 WdNisDrv; C:\WINDOWS\System32\drivers\wd\WdNisDrv.sys [99576 2023-02-18] (Microsoft Windows -> Microsoft Corporation)
U3 iswSvc; no ImagePath
S3 netprotection_network_filter2; System32\drivers\netprotection_network_filter2.sys [X]
==================== NetSvcs (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
==================== One month (created) (Whitelisted) =========
(If an entry is included in the fixlist, the file/folder will be moved.)
2023-02-18 00:57 - 2023-02-18 01:00 - 003088040 _____ C:\WINDOWS\system32\rtp.db
2023-02-17 16:03 - 2023-02-18 00:58 - 000021384 _____ C:\WINDOWS\system32\.tmp
2023-02-16 16:54 - 2023-02-16 16:54 - 000000000 ___HD C:\$WinREAgent
2023-02-16 16:35 - 2023-02-18 00:58 - 000000000 ____D C:\Program Files (x86)\Mozilla Firefox
2023-02-09 22:39 - 2023-02-09 22:39 - 000003792 _____ C:\WINDOWS\system32\Tasks\AviraSystemSpeedupVerify
2023-02-05 19:22 - 2023-02-05 19:22 - 006001320 ____T C:\Users\Admin\Downloads\Excelentní Jaroslav Foldyna - poslanec za SPD_.mp4
2023-02-02 20:39 - 2023-02-02 20:39 - 000003888 _____ C:\WINDOWS\system32\Tasks\Avira_Security_Maintenance
2023-02-02 20:39 - 2023-02-02 20:39 - 000003428 _____ C:\WINDOWS\system32\Tasks\Avira_Security_Service_SCM_Watchdog
2023-02-02 20:39 - 2023-02-02 20:39 - 000002818 _____ C:\WINDOWS\system32\Tasks\Avira_Security_Systray
2023-01-30 20:58 - 2023-01-30 21:07 - 000014146 _____ C:\Users\Admin\Documents\Mezinárodní utkání v pozemním hokeji v nové kbelské hale Sokol Kbely - HC Khalifa 20.1.2023.wlmp
2023-01-26 23:19 - 2022-03-01 03:19 - 000000773 _____ C:\Users\Admin\Downloads\HostDNSimport.bat
2023-01-26 23:16 - 2023-01-26 23:16 - 000000096 _____ C:\WINDOWS\system32\Drivers\etc\hosts.txt
2023-01-25 20:01 - 2023-01-25 20:01 - 000087532 _____ C:\Users\Admin\Downloads\Potvrzeni_platby - Ivo Antušek.pdf
2023-01-22 14:51 - 2023-01-22 14:51 - 000010136 _____ C:\Users\Admin\Documents\Cimbálová muzika Trnka na plese Sokola Praha vršovice 21.1.2023.wlmp
2023-01-22 12:17 - 2023-01-22 13:55 - 000056862 _____ C:\Users\Admin\Documents\Ples Sokola Praha vršovice v kině Vzlet 21.1.2023wlmp.wlmp
==================== One month (modified) ==================
(If an entry is included in the fixlist, the file/folder will be moved.)
2023-02-18 19:49 - 2020-02-14 18:00 - 000000000 ____D C:\FRST
2023-02-18 19:47 - 2021-12-27 21:19 - 000000000 ____D C:\Users\Admin\.cache
2023-02-18 19:38 - 2021-12-26 18:07 - 000003556 _____ C:\WINDOWS\system32\Tasks\RealPlayerRealUpgradeScheduledTaskS-1-5-21-722231672-965411127-3486821242-1001
2023-02-18 19:38 - 2021-12-26 18:07 - 000003492 _____ C:\WINDOWS\system32\Tasks\RealPlayerRealUpgradeLogonTaskS-1-5-21-722231672-965411127-3486821242-1001
2023-02-18 19:29 - 2020-04-28 21:25 - 000000000 ___HD C:\Users\Public\Documents\AdobeGCData
2023-02-18 19:26 - 2019-12-07 10:14 - 000000000 ____D C:\ProgramData\regid.1991-06.com.microsoft
2023-02-18 19:26 - 2019-11-26 21:30 - 000000000 ____D C:\Program Files (x86)\Google
2023-02-18 15:09 - 2020-02-05 19:20 - 000000000 ____D C:\Users\Admin\AppData\Roaming\vlc
2023-02-18 12:57 - 2019-11-27 01:56 - 000000000 ____D C:\Users\Admin\AppData\LocalLow\Mozilla
2023-02-18 12:22 - 2020-11-05 23:09 - 000000000 ____D C:\WINDOWS\system32\SleepStudy
2023-02-18 12:15 - 2020-06-14 18:30 - 000002436 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Edge.lnk
2023-02-18 12:15 - 2020-06-14 18:30 - 000002274 _____ C:\Users\Public\Desktop\Microsoft Edge.lnk
2023-02-18 12:15 - 2019-12-07 10:14 - 000000000 ___HD C:\Program Files\WindowsApps
2023-02-18 12:15 - 2019-12-07 10:14 - 000000000 ____D C:\WINDOWS\AppReadiness
2023-02-18 11:36 - 2020-11-05 23:18 - 001693136 _____ C:\WINDOWS\system32\PerfStringBackup.INI
2023-02-18 11:36 - 2019-12-07 15:41 - 000716764 _____ C:\WINDOWS\system32\perfh005.dat
2023-02-18 11:36 - 2019-12-07 15:41 - 000144942 _____ C:\WINDOWS\system32\perfc005.dat
2023-02-18 11:36 - 2019-12-07 10:13 - 000000000 ____D C:\WINDOWS\INF
2023-02-18 11:34 - 2019-11-26 22:04 - 000000000 ____D C:\Users\Admin\AppData\Local\D3DSCache
2023-02-18 11:33 - 2021-12-10 23:41 - 000003584 _____ C:\WINDOWS\system32\Tasks\OneDrive Reporting Task-S-1-5-21-722231672-965411127-3486821242-1001
2023-02-18 11:33 - 2020-11-05 23:16 - 000003376 _____ C:\WINDOWS\system32\Tasks\OneDrive Standalone Update Task-S-1-5-21-722231672-965411127-3486821242-1001
2023-02-18 11:33 - 2020-11-05 23:10 - 000002377 _____ C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OneDrive.lnk
2023-02-18 11:32 - 2022-07-10 00:00 - 000000000 ____D C:\Users\Public\Speedup Sessions
2023-02-18 11:32 - 2020-11-05 23:16 - 000000006 ____H C:\WINDOWS\Tasks\SA.DAT
2023-02-18 11:32 - 2020-11-05 23:09 - 000008192 ___SH C:\DumpStack.log.tmp
2023-02-18 11:32 - 2019-11-20 19:04 - 000807280 _____ C:\WINDOWS\system32\wpbbin.exe
2023-02-18 11:32 - 2019-11-20 19:04 - 000768408 _____ C:\WINDOWS\system32\AsusUpdateCheck.exe
2023-02-18 11:32 - 2019-11-20 12:12 - 000000000 ____D C:\ProgramData\NVIDIA
2023-02-18 01:00 - 2019-12-07 10:03 - 000524288 _____ C:\WINDOWS\system32\config\BBI
2023-02-18 01:00 - 2019-11-20 19:04 - 000000000 ____D C:\WINDOWS\system32\Drivers\wd
2023-02-18 00:58 - 2022-09-21 18:29 - 000000696 _____ C:\WINDOWS\Tasks\CCleanerCrashReporting.job
2023-02-18 00:58 - 2020-11-05 23:09 - 000783640 _____ C:\WINDOWS\system32\FNTCACHE.DAT
2023-02-18 00:58 - 2019-11-26 21:34 - 000000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2023-02-18 00:58 - 2019-11-26 21:33 - 000000000 ____D C:\Program Files (x86)\Opera
2023-02-18 00:57 - 2019-12-07 10:14 - 000000000 ___RD C:\WINDOWS\ImmersiveControlPanel
2023-02-18 00:57 - 2019-12-07 10:14 - 000000000 ____D C:\WINDOWS\SysWOW64\oobe
2023-02-18 00:57 - 2019-12-07 10:14 - 000000000 ____D C:\WINDOWS\SystemResources
2023-02-18 00:57 - 2019-12-07 10:14 - 000000000 ____D C:\WINDOWS\system32\setup
2023-02-18 00:57 - 2019-12-07 10:14 - 000000000 ____D C:\WINDOWS\system32\oobe
2023-02-18 00:57 - 2019-12-07 10:14 - 000000000 ____D C:\WINDOWS\system32\DDFs
2023-02-18 00:57 - 2019-12-07 10:14 - 000000000 ____D C:\WINDOWS\bcastdvr
2023-02-18 00:56 - 2019-11-27 01:03 - 000000000 ____D C:\Users\Admin\AppData\Local\CrashDumps
2023-02-18 00:42 - 2022-02-08 17:57 - 000000000 ____D C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38
2023-02-16 18:57 - 2021-10-10 20:31 - 000000000 ____D C:\WINDOWS\system32\Tasks\Mozilla
2023-02-16 18:57 - 2019-11-26 21:34 - 000001228 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Firefox.lnk
2023-02-16 17:01 - 2019-12-07 10:03 - 000000000 ____D C:\WINDOWS\CbsTemp
2023-02-16 16:59 - 2020-11-05 23:11 - 003015680 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\PrintConfig.dll
2023-02-16 16:48 - 2022-10-15 15:48 - 000002073 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Acrobat.lnk
2023-02-16 16:48 - 2022-10-15 15:48 - 000002061 _____ C:\Users\Public\Desktop\Adobe Acrobat.lnk
2023-02-16 16:48 - 2020-11-05 23:16 - 000004562 _____ C:\WINDOWS\system32\Tasks\Adobe Acrobat Update Task
2023-02-15 23:57 - 2022-09-21 18:29 - 000003408 _____ C:\WINDOWS\system32\Tasks\CCleanerCrashReporting
2023-02-15 23:57 - 2020-11-05 23:16 - 000003920 _____ C:\WINDOWS\system32\Tasks\CCleaner Update
2023-02-15 22:47 - 2019-11-26 20:09 - 000000000 ____D C:\WINDOWS\system32\MRT
2023-02-15 22:44 - 2019-11-26 20:09 - 149955784 ____C (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2023-02-15 18:30 - 2022-07-12 18:05 - 000238144 _____ (Avira Operations GmbH) C:\WINDOWS\system32\Drivers\rtp_process_monitor.sys
2023-02-15 18:30 - 2022-07-12 18:05 - 000227616 _____ (Avira Operations GmbH) C:\WINDOWS\system32\Drivers\rtp_filesystem_filter.sys
2023-02-15 18:30 - 2022-07-12 18:05 - 000064696 _____ (Avira Operations GmbH) C:\WINDOWS\system32\Drivers\rtp_traverse.sys
2023-02-15 18:30 - 2022-07-12 18:05 - 000028128 _____ (Avira Operations GmbH) C:\WINDOWS\system32\Drivers\rtp_elam.sys
2023-02-14 23:07 - 2020-02-05 19:19 - 000000789 _____ C:\Users\Public\Desktop\VLC media player.lnk
2023-02-14 00:09 - 2019-11-26 21:30 - 000002301 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2023-02-14 00:09 - 2019-11-26 21:30 - 000002260 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2023-02-13 19:55 - 2022-12-14 23:12 - 000003706 _____ C:\WINDOWS\system32\Tasks\Avira_FallbackUpdater
2023-02-11 23:03 - 2019-11-26 21:47 - 000000000 ____D C:\Users\Admin\AppData\Local\Adobe
2023-02-10 21:46 - 2021-12-19 01:46 - 000000000 ____D C:\WINDOWS\SystemTemp
2023-02-10 19:25 - 2020-11-05 23:16 - 000003970 _____ C:\WINDOWS\system32\Tasks\Opera scheduled Autoupdate 1574800406
2023-02-10 19:25 - 2019-11-26 21:33 - 000001155 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Prohlížeč Opera.lnk
2023-02-07 17:09 - 2020-11-05 23:16 - 000003640 _____ C:\WINDOWS\system32\Tasks\MicrosoftEdgeUpdateTaskMachineUA
2023-02-07 17:09 - 2020-11-05 23:16 - 000003516 _____ C:\WINDOWS\system32\Tasks\MicrosoftEdgeUpdateTaskMachineCore
2023-02-06 19:39 - 2020-11-05 23:16 - 000003522 _____ C:\WINDOWS\system32\Tasks\AdobeGCInvoker-1.0
2023-02-03 16:25 - 2019-11-20 12:16 - 000000000 ____D C:\Users\Admin\AppData\Local\Packages
2023-02-03 14:58 - 2019-12-07 15:42 - 000000000 ____D C:\WINDOWS\system32\FxsTmp
2023-02-02 20:39 - 2022-07-10 00:00 - 000003478 _____ C:\WINDOWS\system32\Tasks\Avira_Security_Update
2023-02-02 20:39 - 2022-07-09 22:05 - 000001078 _____ C:\Users\Public\Desktop\Avira.lnk
2023-02-02 20:39 - 2019-11-26 20:17 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2023-02-01 20:45 - 2022-07-10 00:02 - 000000000 ____D C:\Users\Public\Security Sessions
2023-01-31 19:38 - 2022-07-12 18:05 - 000263000 _____ (Avira Operations GmbH) C:\WINDOWS\system32\Drivers\BdSentry.sys
2023-01-26 17:38 - 2020-10-05 18:54 - 000000000 ____D C:\Program Files\Microsoft Update Health Tools
==================== Files in the root of some directories ========
2022-09-04 14:00 - 2022-09-04 14:00 - 000000000 _____ () C:\Users\Admin\AppData\Local\oobelibMkey.log
==================== SigCheck ============================
(There is no automatic fix for files that do not pass verification.)
==================== End of FRST.txt ========================
stala se mi taková nepříjemnost. Navštívil jsem stránky jednoho sokolského oddílu a měli je infikované. Již jsem je informoval. Teď mi tam vyskakuje, že PC byl zavirován 5-7 viry a trojskými koni a že moje data byla zašifrována. A jeden znich je trojan Aurora.Hydra ve složce Win32 a pořád mi tam vyskakuje nějaký Norton antivirus o kterým nevím, že jej tam mám. Používám Aviru. Nechci zatím PC vypnou neb nevím, co by se stalo.
Posílám log.
Díky za pomoc.
Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 16-02-2023
Ran by Admin (administrator) on DESKTOP-1U0LM3C (18-02-2023 19:49:28)
Running from D:\Aviry
Loaded Profiles: Admin
Platform: Microsoft Windows 10 Home Version 22H2 19045.2604 (X64) Language: Čeština (Česko)
Default browser: FF
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(C:\Program Files (x86)\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe ->) (Adobe Inc. -> Adobe Inc.) C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\ADS\Adobe Desktop Service.exe
(C:\Program Files (x86)\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe ->) (Adobe Inc. -> Adobe Inc.) C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\HEX\Adobe CEF Helper.exe <2>
(C:\Program Files (x86)\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe ->) (Adobe Inc. -> Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\IPCBox\AdobeIPCBroker.exe
(C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe ->) (Hewlett Packard -> Hewlett-Packard Co.) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqste08.exe
(C:\Program Files\Avira\Endpoint Protection SDK\endpointprotection.exe ->) (Avira Operations GmbH -> Avira Operations GmbH) C:\Program Files\Avira\Endpoint Protection SDK\SentryEye.exe
(D:\Aviry\Malwarebytes\Anti-Malware\MBAMService.exe ->) (Malwarebytes Inc. -> Malwarebytes) D:\Aviry\Malwarebytes\Anti-Malware\mbamtray.exe
(explorer.exe ->) (Adobe Systems Inc.) [File not signed] D:\Programy\Adobe\Adobe Acrobat Distiller 5.0\Distillr\AcroTray.exe
(explorer.exe ->) (Avira Operations GmbH & Co. KG -> Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\VPN\Avira.WebAppHost.exe
(explorer.exe ->) (Corel Corporation -> WinZip Computing) D:\Archivace\WinZip\WzPreloader.exe
(explorer.exe ->) (Google LLC -> Google LLC) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe <9>
(explorer.exe ->) (Hewlett Packard -> Hewlett-Packard Co.) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe
(explorer.exe ->) (Microsoft Corporation -> Microsoft Corporation) C:\Program Files (x86)\Office14\ONENOTEM.EXE
(Check Point Software Technologies Ltd. -> Check Point Software Technologies Ltd.) D:\Aviry\CheckPoint\ZoneAlarm\zatray.exe
(Microsoft Windows -> Microsoft Corporation) C:\Windows\splwow64.exe
(PIRIFORM SOFTWARE LIMITED -> Piriform Software Ltd) D:\Aviry\CCleaner\CCleaner64.exe
(RealNetworks, Inc. -> ) D:\Prográmky\RealPlayer\downloader2.exe
(services.exe ->) (ABBYY Production LLC -> ABBYY Production LLC) C:\Program Files (x86)\Common Files\ABBYY\FineReader\15\Licensing\NetworkLicenseServer.exe
(services.exe ->) (Adobe Inc. -> Adobe Inc.) C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\ElevationManager\AdobeUpdateService.exe
(services.exe ->) (Adobe Inc. -> Adobe Inc.) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
(services.exe ->) (Adobe Inc. -> Adobe Systems, Incorporated) C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGMService.exe
(services.exe ->) (Adobe Inc. -> Adobe Systems, Incorporated) C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGSService.exe
(services.exe ->) (Adobe Systems Incorporated -> Adobe Systems Incorporated) D:\Fotoeditory\Adobe Photoshop Elements 11\Elements 10 Organizer\PhotoshopElementsFileAgent.exe
(services.exe ->) (ASUSTeK Computer Inc. -> ) C:\Windows\System32\AsusUpdateCheck.exe
(services.exe ->) (Avira Operations GmbH & Co. KG -> Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\VPN\Avira.VpnService.exe
(services.exe ->) (Avira Operations GmbH -> Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\Optimizer Host\Avira.OptimizerHost.exe
(services.exe ->) (Avira Operations GmbH -> Avira Operations GmbH) C:\Program Files (x86)\Avira\Security\Avira.Spotlight.Service.exe
(services.exe ->) (Avira Operations GmbH -> Avira Operations GmbH) C:\Program Files\Avira\Endpoint Protection SDK\endpointprotection.exe
(services.exe ->) (geek software GmbH -> geek software GmbH) D:\Prográmky\PDF24\pdf24.exe <2>
(services.exe ->) (Check Point Software Technologies Ltd. -> Check Point Software Technologies Ltd.) C:\Program Files (x86)\CheckPoint\ICM\ICM-Service-NET.exe
(services.exe ->) (Check Point Software Technologies Ltd. -> Check Point Software Technologies Ltd.) D:\Aviry\CheckPoint\ZoneAlarm\vsmon.exe
(services.exe ->) (Malwarebytes Inc. -> Malwarebytes) D:\Aviry\Malwarebytes\Anti-Malware\MBAMService.exe
(services.exe ->) (Microsoft Corporation -> Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
(services.exe ->) (Microsoft Windows Publisher -> Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe <2>
(services.exe ->) (NVIDIA Corporation -> NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display.NvContainer\NVDisplay.Container.exe <2>
(services.exe ->) (pdfforge GmbH -> pdfforge GmbH) C:\Program Files\PDF Architect 7\updater-ws.exe
(services.exe ->) (pdfforge GmbH -> pdfforge GmbH) C:\Program Files\PDF Architect 7\ws.exe
(services.exe ->) (RealNetworks, Inc. -> RealNetworks, Inc.) D:\Prográmky\UpdateService\RealPlayerUpdateSvc.exe
(services.exe ->) (Softland SRL -> Microsoft) C:\Program Files\Softland\novaPDF 10\Server\novapdfs.exe
(svchost.exe ->) (Adobe Inc. -> Adobe Inc.) C:\Program Files (x86)\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe
(svchost.exe ->) (Avira Operations GmbH -> Avira Operations GmbH) C:\Program Files (x86)\Avira\Security\Avira.Spotlight.Systray.Application.exe
(svchost.exe ->) (Hewlett Packard -> Hewlett-Packard Co.) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqbam08.exe
(svchost.exe ->) (Hewlett Packard -> Hewlett-Packard) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqgpc01.exe
(svchost.exe ->) (Microsoft Corporation) C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_4.2204.13303.0_x64__8wekyb3d8bbwe\Cortana.exe
(svchost.exe ->) (Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\dllhost.exe
(svchost.exe ->) (Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\MoUsoCoreWorker.exe
(svchost.exe ->) (Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\PrintIsolationHost.exe
(svchost.exe ->) (Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\rundll32.exe
(svchost.exe ->) (Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\smartscreen.exe
(svchost.exe ->) (RealNetworks, Inc. -> RealNetworks, Inc.) D:\Prográmky\RealPlayer\Update\realsched.exe
==================== Registry (Whitelisted) ===================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [Logitech Download Assistant] => C:\Windows\System32\LogiLDA.dll [3831808 2021-08-30] (Microsoft Windows Hardware Compatibility Publisher -> Logitech)
HKLM\...\Run: [AdobeGCInvoker-1.0] => C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGCInvokerUtility.exe [3503584 2023-01-19] (Adobe Inc. -> Adobe Systems, Incorporated)
HKLM\...\Run: [PDF24] => D:\Prográmky\PDF24\pdf24.exe [619192 2023-01-02] (geek software GmbH -> geek software GmbH)
HKLM\...\Run: [] => [X]
HKLM-x32\...\Run: [ZoneAlarm] => D:\Aviry\CheckPoint\ZoneAlarm\zatray.exe [325856 2020-01-23] (Check Point Software Technologies Ltd. -> Check Point Software Technologies Ltd.)
HKLM-x32\...\Run: [Avira System Speedup User Starter] => C:\Program Files (x86)\Avira\System Speedup\Avira.SystemSpeedup.Core.Common.Starter.exe [334264 2023-02-03] (Avira Operations GmbH -> Avira Operations GmbH)
HKLM-x32\...\Run: [] => [X]
HKLM\SOFTWARE\Microsoft\Windows Defender: [DisableAntiSpyware] Restriction <==== ATTENTION
HKLM\SOFTWARE\Microsoft\Windows Defender: [DisableAntiVirus] Restriction <==== ATTENTION
HKU\S-1-5-21-722231672-965411127-3486821242-1001\...\Run: [CCleaner Smart Cleaning] => D:\Aviry\CCleaner\CCleaner64.exe [38966072 2023-02-08] (PIRIFORM SOFTWARE LIMITED -> Piriform Software Ltd)
HKU\S-1-5-21-722231672-965411127-3486821242-1001\...\Run: [] => [X]
HKU\S-1-5-21-722231672-965411127-3486821242-1001\...\RunOnce: [Delete Cached Update Binary] => C:\WINDOWS\system32\cmd.exe /q /c del /q "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe" (No File)
HKU\S-1-5-21-722231672-965411127-3486821242-1001\...\RunOnce: [Delete Cached Standalone Update Binary] => C:\WINDOWS\system32\cmd.exe /q /c del /q "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\StandaloneUpdater\OneDriveSetup.exe" (No File)
HKU\S-1-5-21-722231672-965411127-3486821242-1001\...\RunOnce: [Uninstall 23.020.0125.0003] => C:\WINDOWS\system32\cmd.exe /q /c rmdir /s /q "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\23.020.0125.0003" (No File)
HKLM\...\Windows x64\Print Processors\hpzppw71: C:\Windows\System32\spool\prtprocs\x64\hpzppw71.dll [239704 2017-12-18] (Microsoft Windows Hardware Compatibility Publisher -> Hewlett-Packard Corporation)
HKLM\...\Print\Monitors\novaPDF 10 Port Monitor: C:\WINDOWS\system32\novamn10.dll [18944 2020-10-19] (Softland) [File not signed]
HKLM\...\Print\Monitors\PCL hpz3lw71: C:\WINDOWS\system32\hpz3lw71.dll [55392 2017-12-18] (Microsoft Windows Hardware Compatibility Publisher -> Hewlett-Packard Corporation)
HKLM\...\Print\Monitors\PDF Architect 7 Monitor: C:\Windows\system32\spool\DRIVERS\x64\pdf architect_pdfpmon_v.4.12.26.3.dll [932984 2019-11-26] (PDF Tools AG -> PDF Tools AG (hxxp://www.pdf-tools.com))
HKLM\...\Print\Monitors\PDF-XChange5-ABBYY: C:\Windows\system32\pxc50pma.dll [58936 2014-11-13] (Tracker Software Products (Canada) Ltd -> Tracker Software Products (Canada) Ltd.)
HKLM\...\Print\Monitors\PDF-XChange5-ABBYY-FR15: C:\WINDOWS\system32\pxc50pmaf15.dll [57328 2018-12-04] (Tracker Software Products (Canada) Ltd. -> Tracker Software Products (Canada) Ltd.)
HKLM\Software\Microsoft\Active Setup\Installed Components: [{8A69D345-D564-463c-AFF1-A69D9E530F96}] -> C:\Program Files (x86)\Google\Chrome\Application\110.0.5481.97\Installer\chrmstp.exe [2023-02-14] (Google LLC -> Google LLC)
Startup: C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Avira.lnk [2020-02-02]
ShortcutTarget: Avira.lnk -> C:\Program Files (x86)\Avira\Launcher\Avira.Systray.exe (Avira Operations GmbH -> Avira Operations GmbH & Co. KG)
Startup: C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Výřezy obrazovky a spuštění aplikace OneNote 2010.lnk [2022-05-13]
ShortcutTarget: Výřezy obrazovky a spuštění aplikace OneNote 2010.lnk -> C:\Program Files (x86)\Office14\ONENOTEM.EXE (Microsoft Corporation -> Microsoft Corporation)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Acrobat Assistant.lnk [2020-01-31]
ShortcutTarget: Acrobat Assistant.lnk -> D:\Programy\Adobe\Adobe Acrobat Distiller 5.0\Distillr\AcroTray.exe (Adobe Systems Inc.) [File not signed]
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk [2019-11-26]
ShortcutTarget: HP Digital Imaging Monitor.lnk -> C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe (Hewlett Packard -> Hewlett-Packard Co.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\WinZip Preloader.lnk [2020-08-11]
ShortcutTarget: WinZip Preloader.lnk -> D:\Archivace\WinZip\WzPreloader.exe (Corel Corporation -> WinZip Computing)
GroupPolicy-Firefox-x32: Restriction <==== ATTENTION
==================== Scheduled Tasks (Whitelisted) ============
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
Task: {0021521B-F19D-4641-921A-4D3FFAA1499C} - System32\Tasks\Avira_FallbackUpdater => C:\WINDOWS\system32\sc.exe start AviraFallbackUpdater Delayed=false
Task: {0382BFFA-D36E-47DD-A99E-F6D2C7C510A3} - System32\Tasks\Opera scheduled Autoupdate 1574800406 => C:\Program Files (x86)\Opera\launcher.exe [1977800 2023-02-08] (Opera Norway AS -> Opera Software)
Task: {043BA1DA-4398-4B02-8D31-D02F8B0973A8} - System32\Tasks\Mozilla\Firefox Default Browser Agent E7CF176E110C211B => C:\Program Files (x86)\Mozilla Firefox\default-browser-agent.exe [716192 2023-02-16] (Mozilla Corporation -> Mozilla Foundation)
Task: {05C648EC-C404-46A5-85FC-F9E9B7720D2E} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [1552376 2022-09-26] (Adobe Inc. -> Adobe Inc.)
Task: {0C3F0ED1-2C1F-42EA-AECE-130E4BEA6A04} - System32\Tasks\doPDF 10 Telemetry => C:\Program Files\Softland\novaPDF 10\Driver\GoogleAnalytics.exe [51504 2020-10-19] (Softland SRL -> )
Task: {17547B1C-0FF7-4276-9950-7093AF26FEEC} - System32\Tasks\Mozilla\Firefox Background Update E7CF176E110C211B => C:\Program Files (x86)\Mozilla Firefox\firefox.exe [674720 2023-02-16] (Mozilla Corporation -> Mozilla Corporation) -> --MOZ_LOG sync,prependheader,timestamp,append,maxsize:1,Dump:5 --MOZ_LOG_FILE C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\E7CF176E110C211B\backgroundupdate.moz_log --backgroundtask backgroundupdate
Task: {1C29A92E-D239-4352-A853-33E364E80D1E} - System32\Tasks\Avira\System Speedup\TestScheduler => C:\Program Files (x86)\Avira\System Speedup\Avira.SystemSpeedup.Core.Common.Starter.exe [334264 2023-02-03] (Avira Operations GmbH -> Avira Operations GmbH)
Task: {28D42CB5-D124-4DE5-AB47-BD599C97C52B} - System32\Tasks\Avira\System Speedup\Delayed Startup\All users\2 => C:\Program Files (x86)\Office14\BCSSync.exe [91520 2010-01-21] (Microsoft Corporation -> Microsoft Corporation)
Task: {2DA4E14C-06DD-498D-8217-4755502737E1} - System32\Tasks\RealDownloaderRealUpgradeLogonTaskS-1-5-21-722231672-965411127-3486821242-1001 => C:\Program Files (x86)\RealNetworks\RealDownloader\RealUpgrade.exe [128240 2016-02-03] (RealNetworks, Inc. -> RealNetworks, Inc.)
Task: {2DA8EF45-C109-420E-93A4-971FEC877E27} - System32\Tasks\Avira\System Speedup\Delayed Startup\Admin\2 => C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe [4243408 2023-02-16] (Microsoft Corporation -> Microsoft Corporation)
Task: {30515FA6-F9ED-44C5-8EFA-8506DAE5A0F2} - System32\Tasks\AdobeAAMUpdater-1.0-DESKTOP-1U0LM3C-Admin => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [509936 2018-04-10] (Adobe Systems Incorporated -> Adobe Systems Incorporated)
Task: {378F7421-F8D8-44FB-8CE1-48B44639438B} - System32\Tasks\Avira\System Speedup\Delayed Startup\All users\4 => C:\Program Files (x86)\Opera\assistant\browser_assistant.exe [4124416 2022-05-17] (Opera Software AS -> Opera Software)
Task: {5A590DC1-4FD3-4C73-9D95-05C48F571510} - System32\Tasks\Avira_Security_Service_SCM_Watchdog => C:\Program Files (x86)\Avira\Security\Avira.Spotlight.Service.Worker.exe [259872 2023-01-26] (Avira Operations GmbH -> Avira Operations GmbH)
Task: {66D4258B-FB2D-4822-827C-F667D673E544} - System32\Tasks\Avira_Security_Systray => C:\Program Files (x86)\Avira\Security\Avira.Spotlight.Systray.Application.exe [1695784 2023-01-26] (Avira Operations GmbH -> Avira Operations GmbH)
Task: {73D6DECF-82F9-4D6A-9866-C7FD33DD1FD9} - System32\Tasks\Avira_Security_Update => C:\WINDOWS\system32\net.exe [59904 2019-12-07] (Microsoft Windows -> Microsoft Corporation)
Task: {75EC3453-3A6D-4E59-8B4E-7561114DA633} - System32\Tasks\Avira\System Speedup\Delayed Startup\All users\5 => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [509936 2018-04-10] (Adobe Systems Incorporated -> Adobe Systems Incorporated)
Task: {8DBC5B42-9DED-4C29-9E5D-040CE4E38D32} - System32\Tasks\Avira\System Speedup\Delayed Startup\All users\3 => d:\prográmky\realplayer\Update\realsched.exe [347560 2021-12-26] (RealNetworks, Inc. -> RealNetworks, Inc.)
Task: {8FF6D8D3-1266-4D7C-B1D0-D37DFFB2BCC7} - System32\Tasks\GoogleUpdateTaskMachineUA{32984F0D-7489-4194-9DDB-4946D2A65C44} => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [153168 2019-11-26] (Google Inc -> Google Inc.)
Task: {9454FBBB-5CB0-48D2-AEBD-8254EB82CB1E} - System32\Tasks\GoogleUpdateTaskMachineCore{08E5070A-C385-4792-BF92-1F74F680059A} => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [153168 2019-11-26] (Google Inc -> Google Inc.)
Task: {ABAB166C-020B-4747-9D9C-686F045835A4} - System32\Tasks\CCleaner Update => D:\Aviry\CCleaner\CCUpdate.exe [684976 2023-02-08] (Piriform Software Ltd -> Piriform)
Task: {B5397A57-7DF5-4425-8B44-C8938C5CC7EB} - System32\Tasks\CCleanerCrashReporting => D:\Aviry\CCleaner\CCleanerBugReport.exe [4703544 2023-02-08] (PIRIFORM SOFTWARE LIMITED -> Piriform Software) -> --product 90 --send dumps|report --path "D:\Aviry\CCleaner\LOG" --programpath "D:\Aviry\CCleaner" --configpath "D:\Aviry\CCleaner\Setup" --guid "d4a0d706-3321-4b6e-9f14-d2d3bcba89e7" --version "6.09.10300" --silent
Task: {BA8F2F08-EF69-4280-8292-CC8649E65689} - System32\Tasks\Avira\System Speedup\Delayed Startup\All users\7 => D:\Prográmky\PDF24\pdf24.exe [619192 2023-01-02] (geek software GmbH -> geek software GmbH)
Task: {BB9C4A9E-8903-42A2-9BCF-77E08E69BE01} - System32\Tasks\klcp_update => D:\Prográmky\K-Lite Codec Pack\Tools\CodecTweakTool.exe [1907712 2021-04-12] () [File not signed]
Task: {C058F360-D1E7-4B0B-817D-F6E7783E7B0F} - System32\Tasks\RealDownloader Update Check => d:\prográmky\realplayer\downloader2.exe [1167784 2021-12-26] (RealNetworks, Inc. -> )
Task: {C2D10D6C-2A67-4D2F-9AFC-3225FCE0153A} - System32\Tasks\RealPlayerRealUpgradeScheduledTaskS-1-5-21-722231672-965411127-3486821242-1001 => D:\prográmky\realplayer\RealUpgrade.exe [129960 2021-12-26] (RealNetworks, Inc. -> RealNetworks, Inc.)
Task: {CC6528AE-229D-4529-9560-325BC1F601A7} - System32\Tasks\Avira\System Speedup\Delayed Startup\All users\6 => C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGCInvokerUtility.exe [3503584 2023-01-19] (Adobe Inc. -> Adobe Systems, Incorporated)
Task: {D23FE6F4-EA71-4639-ACE6-D0922061CC75} - System32\Tasks\AdobeGCInvoker-1.0 => C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGCInvokerUtility.exe [3503584 2023-01-19] (Adobe Inc. -> Adobe Systems, Incorporated)
Task: {D2C135A4-E491-469B-9EE5-8BBB500E2731} - System32\Tasks\CCleanerSkipUAC - Admin => D:\Aviry\CCleaner\CCleaner.exe [32631096 2023-02-08] (PIRIFORM SOFTWARE LIMITED -> Piriform Software Ltd)
Task: {DD4DDD5E-C15D-41A6-BFE2-8EBFC70439DC} - System32\Tasks\RealDownloaderRealUpgradeScheduledTaskS-1-5-21-722231672-965411127-3486821242-1001 => C:\Program Files (x86)\RealNetworks\RealDownloader\RealUpgrade.exe [128240 2016-02-03] (RealNetworks, Inc. -> RealNetworks, Inc.)
Task: {DF0BA4DD-EBE6-4791-9C12-E16E675E04FC} - System32\Tasks\Avira\System Speedup\Delayed Startup\All users\1 => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe [2623032 2019-07-26] (Adobe Inc. -> Adobe Inc.)
Task: {E948ECFF-5A89-46DA-AE8D-EFA7EF4E35F1} - System32\Tasks\Microsoft\Windows Live\SOXE\Extractor Definitions Update Task => {3519154C-227E-47F3-9CC9-12C3F05817F1}
Task: {EB2B61BF-C3A2-4F58-B725-387972CD7149} - System32\Tasks\doPDF 10 Update => C:\Program Files\Softland\novaPDF 10\Driver\UpdateApplication.exe [98096 2020-10-19] (Softland SRL -> )
Task: {F36A9778-2F93-41AA-88ED-CAFD9AB49CEE} - System32\Tasks\RealPlayerRealUpgradeLogonTaskS-1-5-21-722231672-965411127-3486821242-1001 => D:\prográmky\realplayer\RealUpgrade.exe [129960 2021-12-26] (RealNetworks, Inc. -> RealNetworks, Inc.)
Task: {FA6E3AFA-187C-4E34-AB13-74B7AD8D2E91} - System32\Tasks\AviraSystemSpeedupVerify => C:\Program Files (x86)\Avira\System Speedup\setup\avira_speedup_setup.exe [35437192 2023-02-09] (Avira Operations GmbH -> Avira Operations GmbH)
Task: {FDEF45B1-CBD9-4E0C-B0B8-5B88C3E1DABF} - System32\Tasks\Avira_Security_Maintenance => Command(1): C:\Program Files (x86)\Avira\Security\Avira.Spotlight.Service.Worker.exe -> FallbackTelemetry
Task: {FDEF45B1-CBD9-4E0C-B0B8-5B88C3E1DABF} - System32\Tasks\Avira_Security_Maintenance => Command(2): C:\Program Files (x86)\Avira\Security\Avira.Spotlight.Service.Worker.exe -> ServiceWatchdog
Task: {FDEF45B1-CBD9-4E0C-B0B8-5B88C3E1DABF} - System32\Tasks\Avira_Security_Maintenance => Command(3): C:\Program Files (x86)\Avira\Security\Avira.Spotlight.Service.Worker.exe -> CrashCollector
(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)
Task: C:\WINDOWS\Tasks\CCleanerCrashReporting.job => D:\Aviry\CCleaner\CCleanerBugReport.exe
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
ProxyServer: [S-1-5-21-722231672-965411127-3486821242-1001] => http=;ftp=;https=;
Tcpip\Parameters: [DhcpNameServer] 31.30.90.11 31.30.90.12
Tcpip\..\Interfaces\{2344692f-c41b-4ac7-9c50-43b9fc907f50}: [DhcpNameServer] 31.30.90.11 31.30.90.12
Edge:
=======
Edge DefaultProfile: Default
Edge Profile: C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default [2023-02-18]
Edge HKLM-x32\...\Edge\Extension: [ihcjicgdanjaechkgeegckofjjedodee]
FireFox:
========
FF DefaultProfile: 2i1040qs.default-1582311638745
FF ProfilePath: C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\u4mgi7h5.default-release [2023-02-18]
FF Homepage: Mozilla\Firefox\Profiles\u4mgi7h5.default-release -> about:home
FF NewTab: Mozilla\Firefox\Profiles\u4mgi7h5.default-release -> about:newtab
FF ProfilePath: C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2i1040qs.default-1582311638745 [2023-02-18]
FF NewTab: Mozilla\Firefox\Profiles\2i1040qs.default-1582311638745 -> about:newtab
FF Notifications: Mozilla\Firefox\Profiles\2i1040qs.default-1582311638745 -> hxxps://www.slevomat.cz
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation -> Microsoft Corporation)
FF Plugin: @videolan.org/vlc,version=3.0.10 -> D:\Prográmky\VideoLAN\VLC\npvlc.dll [2022-11-08] (VideoLAN -> VideoLAN)
FF Plugin: @videolan.org/vlc,version=3.0.11 -> D:\Prográmky\VideoLAN\VLC\npvlc.dll [2022-11-08] (VideoLAN -> VideoLAN)
FF Plugin: @videolan.org/vlc,version=3.0.12 -> D:\Prográmky\VideoLAN\VLC\npvlc.dll [2022-11-08] (VideoLAN -> VideoLAN)
FF Plugin: @videolan.org/vlc,version=3.0.14 -> D:\Prográmky\VideoLAN\VLC\npvlc.dll [2022-11-08] (VideoLAN -> VideoLAN)
FF Plugin: @videolan.org/vlc,version=3.0.16 -> D:\Prográmky\VideoLAN\VLC\npvlc.dll [2022-11-08] (VideoLAN -> VideoLAN)
FF Plugin: @videolan.org/vlc,version=3.0.18 -> D:\Prográmky\VideoLAN\VLC\npvlc.dll [2022-11-08] (VideoLAN -> VideoLAN)
FF Plugin: @videolan.org/vlc,version=3.0.8 -> D:\Prográmky\VideoLAN\VLC\npvlc.dll [2022-11-08] (VideoLAN -> VideoLAN)
FF Plugin: Adobe Acrobat -> C:\Program Files\Adobe\Acrobat DC\Acrobat\Air\nppdf32.dll [2023-02-14] (Adobe Inc. -> Adobe Systems Inc.)
FF Plugin: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Adobe\Adobe Creative Cloud\Utils\npAdobeAAMDetect64.dll [2019-07-26] (Adobe Inc. -> Adobe Systems)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation -> Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\Office14\NPSPWRAP.DLL [2010-01-09] (Microsoft Corporation -> Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3528.0331 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2014-03-31] (Microsoft Corporation -> Microsoft Corporation)
FF Plugin-x32: @real.com/nppl3260;version=20.0.7.309 -> d:\prográmky\realplayer\Netscape6\nppl3260.dll [2021-12-26] (RealNetworks, Inc. -> RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprpplugin;version=20.0.7.309 -> d:\prográmky\realplayer\Netscape6\nprpplugin.dll [2021-12-26] (RealNetworks, Inc. -> RealPlayer)
FF Plugin-x32: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Adobe\Adobe Creative Cloud\Utils\npAdobeAAMDetect32.dll [2019-07-26] (Adobe Inc. -> Adobe Systems)
Chrome:
=======
CHR DefaultProfile: Profile 6
CHR Profile: C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Guest Profile [2022-11-29]
CHR Profile: C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Profile 6 [2023-02-18]
CHR Notifications: Profile 6 -> hxxps://captchacoolnow.top
CHR Extension: (uBlock Origin) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Profile 6\Extensions\cjpalhdlnbpafiamejdnhcphjbkeiagm [2022-12-31]
CHR Extension: (Dokumenty Google offline) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Profile 6\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2023-02-14]
CHR Extension: (Malwarebytes Browser Guard) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Profile 6\Extensions\ihcjicgdanjaechkgeegckofjjedodee [2023-02-07]
CHR Extension: (Platby Internetového obchodu Chrome) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Profile 6\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2022-09-02]
CHR Profile: C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile [2023-02-18]
CHR HKLM-x32\...\Chrome\Extension: [ihcjicgdanjaechkgeegckofjjedodee]
Opera:
=======
OPR Profile: C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable [2023-02-18]
OPR DefaultSuggestURL: Opera Stable -> hxxps://www.google.com/complete/search?client=o ... utEncoding}
OPR Extension: (Rich Hints Agent) - C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Extensions\enegjkbbakeegngfapepobipndnebkdk [2022-10-31]
OPR Extension: (Opera Wallet) - C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Extensions\gojhcdgcpbpfigcaejpfhfegekdgiblk [2023-02-18]
OPR Extension: (Amazon Assistant Promotion) - C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Extensions\kbmoiomgmchbpihhdpabemajcbjpcijk [2021-08-15]
OPR Extension: (uBlock Origin) - C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Extensions\kccohkcpppjjkkjppopfnflnebibpida [2023-02-18]
==================== Services (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
R2 ABBYY.Licensing.FineReader.15.0; C:\Program Files (x86)\Common Files\ABBYY\FineReader\15\Licensing\NetworkLicenseServer.exe [1058032 2019-07-29] (ABBYY Production LLC -> ABBYY Production LLC)
S2 ABBYY.Licensing.PDFTransformer.Classic.4.0; D:\Programy\ABBYY PDF Transformer+\NetworkLicenseServer.exe [962256 2014-12-02] (ABBYY Production LLC -> ABBYY Production LLC)
R2 AdobeActiveFileMonitor10.0; D:\Fotoeditory\Adobe Photoshop Elements 11\Elements 10 Organizer\PhotoshopElementsFileAgent.exe [169624 2011-09-14] (Adobe Systems Incorporated -> Adobe Systems Incorporated)
R2 AdobeARMservice; C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [173040 2022-09-26] (Adobe Inc. -> Adobe Inc.)
R2 AdobeUpdateService; C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\ElevationManager\AdobeUpdateService.exe [816184 2019-07-26] (Adobe Inc. -> Adobe Inc.)
R2 AGMService; C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGMService.exe [3896288 2023-01-19] (Adobe Inc. -> Adobe Systems, Incorporated)
R2 AGSService; C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGSService.exe [3729888 2023-01-19] (Adobe Inc. -> Adobe Systems, Incorporated)
R2 AsusUpdateCheck; C:\WINDOWS\System32\AsusUpdateCheck.exe [768408 2023-02-18] (ASUSTeK Computer Inc. -> )
S2 AviraFallbackUpdater; C:\Program Files (x86)\Avira\Fallback Updater\Avira.Spotlight.FallbackUpdater.exe [6520504 2023-02-13] (Avira Operations GmbH -> Avira Operations GmbH & Co. KG)
R2 AviraOptimizerHost; C:\Program Files (x86)\Avira\Optimizer Host\Avira.OptimizerHost.exe [3004688 2022-07-22] (Avira Operations GmbH -> Avira Operations GmbH & Co. KG)
R2 AviraPhantomVPN; C:\Program Files (x86)\Avira\VPN\Avira.VpnService.exe [386864 2022-03-30] (Avira Operations GmbH & Co. KG -> Avira Operations GmbH & Co. KG)
R2 AviraSecurity; C:\Program Files (x86)\Avira\Security\Avira.Spotlight.Service.exe [267096 2023-01-26] (Avira Operations GmbH -> Avira Operations GmbH)
S2 AviraSecurityUpdater; C:\Program Files (x86)\Avira\Security\Avira.Spotlight.Common.Updater.exe [295920 2023-01-26] (Avira Operations GmbH -> Avira Operations GmbH)
S3 CCleanerPerformanceOptimizerService; D:\Aviry\CCleaner\CCleanerPerformanceOptimizerService.exe [1001272 2023-02-08] (PIRIFORM SOFTWARE LIMITED -> Piriform Software Ltd)
R2 EndpointProtectionService; C:\Program Files\Avira\Endpoint Protection SDK\endpointprotection.exe [8937712 2023-02-17] (Avira Operations GmbH -> Avira Operations GmbH)
S3 EndpointProtectionService2; C:\Program Files\Avira\Endpoint Protection SDK\endpointprotection.exe [8937712 2023-02-17] (Avira Operations GmbH -> Avira Operations GmbH)
R2 MBAMService; D:\Aviry\Malwarebytes\Anti-Malware\MBAMService.exe [8966256 2023-02-02] (Malwarebytes Inc. -> Malwarebytes)
S3 Microsoft SharePoint Workspace Audit Service; C:\Program Files (x86)\Office14\GROOVE.EXE [30963576 2010-01-21] (Microsoft Corporation -> Microsoft Corporation)
S2 Net Driver HPZ12; C:\Windows\System32\HPZinw12.dll [71680 2010-08-06] (Hewlett-Packard) [File not signed]
R2 NovaPdf10Server; C:\Program Files\Softland\novaPDF 10\Server\novapdfs.exe [52528 2020-10-19] (Softland SRL -> Microsoft)
R3 PDF Architect 7; C:\Program Files\PDF Architect 7\ws.exe [2579752 2019-10-07] (pdfforge GmbH -> pdfforge GmbH)
S3 PDF Architect 7 Creator; C:\Program Files\PDF Architect 7\creator\common\creator-ws.exe [692008 2019-10-07] (pdfforge GmbH -> pdfforge GmbH)
R2 PDF Architect 7 Update Service; C:\Program Files\PDF Architect 7\updater-ws.exe [1832232 2019-10-07] (pdfforge GmbH -> pdfforge GmbH)
R2 PDF24; D:\Prográmky\PDF24\pdf24.exe [619192 2023-01-02] (geek software GmbH -> geek software GmbH)
S2 Pml Driver HPZ12; C:\Windows\System32\HPZipm12.dll [89600 2010-08-06] (Hewlett-Packard) [File not signed]
R2 RealPlayerUpdateSvc; D:\prográmky\UpdateService\RealPlayerUpdateSvc.exe [38856 2021-12-04] (RealNetworks, Inc. -> RealNetworks, Inc.)
S2 RealTimes Desktop Service; d:\prográmky\realplayer\RPDS\Bin\rpdsvc.exe [991176 2021-12-26] (RealNetworks, Inc. -> RealNetworks, Inc.)
R2 vsmon; D:\Aviry\CheckPoint\ZoneAlarm\vsmon.exe [4528344 2020-01-20] (Check Point Software Technologies Ltd. -> Check Point Software Technologies Ltd.)
S3 WdNisSvc; C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.2301.6-0\NisSrv.exe [3191256 2023-02-18] (Microsoft Windows Publisher -> Microsoft Corporation)
S3 WinDefend; C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.2301.6-0\MsMpEng.exe [133576 2023-02-18] (Microsoft Windows Publisher -> Microsoft Corporation)
R2 ZA NET ICM Service; C:\Program Files (x86)\CheckPoint\ICM\ICM-Service-NET.exe [42208 2020-03-13] (Check Point Software Technologies Ltd. -> Check Point Software Technologies Ltd.)
S3 ZAPrivacyService; D:\Aviry\CheckPoint\ZoneAlarm\ZaPrivacyService.exe [114936 2020-01-20] (Check Point Software Technologies Ltd. -> Check Point Software Technologies, Ltd.)
===================== Drivers (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
R0 BdNet; C:\WINDOWS\System32\DRIVERS\BdNet.sys [185704 2022-06-13] (NortonLifeLock Inc. -> BullGuard Ltd.)
R1 BdSentry; C:\WINDOWS\System32\DRIVERS\BdSentry.sys [263000 2023-01-31] (Avira Operations GmbH -> Avira Operations GmbH)
S3 BthA2dp; C:\WINDOWS\System32\drivers\BthA2dp.sys [279040 2019-12-07] (Microsoft Corporation) [File not signed]
S3 BthHFEnum; C:\WINDOWS\System32\drivers\bthhfenum.sys [144896 2019-12-07] (Microsoft Corporation) [File not signed]
S3 dg_ssudbus; C:\WINDOWS\system32\DRIVERS\ssudbus2.sys [160376 2021-10-08] (Samsung Electronics Co., Ltd. -> Samsung Electronics Co., Ltd.)
R2 MBAMChameleon; C:\WINDOWS\System32\Drivers\MbamChameleon.sys [223176 2023-02-18] (Microsoft Windows Hardware Compatibility Publisher -> Malwarebytes)
S0 MbamElam; C:\WINDOWS\System32\DRIVERS\MbamElam.sys [21480 2022-05-04] (Microsoft Windows Early Launch Anti-malware Publisher -> Malwarebytes)
R3 MBAMSwissArmy; C:\WINDOWS\System32\Drivers\mbamswissarmy.sys [239544 2022-09-23] (Microsoft Windows Hardware Compatibility Publisher -> Malwarebytes)
R1 netprotection_network_filter; C:\WINDOWS\System32\drivers\netprotection_network_filter.sys [100128 2022-06-15] (Avira Operations GmbH & Co. KG -> Avira Operations GmbH & Co. KG)
R2 npf; C:\WINDOWS\system32\drivers\npf.sys [36600 2019-11-11] (Riverbed Technology, Inc. -> Riverbed Technology, Inc.)
S0 rtp_elam; C:\WINDOWS\System32\DRIVERS\rtp_elam.sys [28128 2023-02-15] (Microsoft Windows Early Launch Anti-malware Publisher -> Avira Operations GmbH)
R2 rtp_filesystem_filter; C:\WINDOWS\System32\DRIVERS\rtp_filesystem_filter.sys [227616 2023-02-15] (Avira Operations GmbH -> Avira Operations GmbH)
R1 rtp_process_monitor; C:\WINDOWS\system32\DRIVERS\rtp_process_monitor.sys [238144 2023-02-15] (Avira Operations GmbH -> Avira Operations GmbH)
R1 rtp_traverse; C:\WINDOWS\system32\DRIVERS\rtp_traverse.sys [64696 2023-02-15] (Avira Operations GmbH -> Avira Operations GmbH)
R1 Vsdatant; C:\WINDOWS\system32\DRIVERS\vsdatant.sys [461240 2019-07-25] (Check Point Software Technologies Ltd. -> Check Point Software Technologies Ltd.)
S3 WdBoot; C:\WINDOWS\system32\drivers\wd\WdBoot.sys [49576 2023-02-18] (Microsoft Windows Early Launch Anti-malware Publisher -> Microsoft Corporation)
S3 WdFilter; C:\WINDOWS\system32\drivers\wd\WdFilter.sys [473336 2023-02-18] (Microsoft Windows -> Microsoft Corporation)
S3 WdNisDrv; C:\WINDOWS\System32\drivers\wd\WdNisDrv.sys [99576 2023-02-18] (Microsoft Windows -> Microsoft Corporation)
U3 iswSvc; no ImagePath
S3 netprotection_network_filter2; System32\drivers\netprotection_network_filter2.sys [X]
==================== NetSvcs (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
==================== One month (created) (Whitelisted) =========
(If an entry is included in the fixlist, the file/folder will be moved.)
2023-02-18 00:57 - 2023-02-18 01:00 - 003088040 _____ C:\WINDOWS\system32\rtp.db
2023-02-17 16:03 - 2023-02-18 00:58 - 000021384 _____ C:\WINDOWS\system32\.tmp
2023-02-16 16:54 - 2023-02-16 16:54 - 000000000 ___HD C:\$WinREAgent
2023-02-16 16:35 - 2023-02-18 00:58 - 000000000 ____D C:\Program Files (x86)\Mozilla Firefox
2023-02-09 22:39 - 2023-02-09 22:39 - 000003792 _____ C:\WINDOWS\system32\Tasks\AviraSystemSpeedupVerify
2023-02-05 19:22 - 2023-02-05 19:22 - 006001320 ____T C:\Users\Admin\Downloads\Excelentní Jaroslav Foldyna - poslanec za SPD_.mp4
2023-02-02 20:39 - 2023-02-02 20:39 - 000003888 _____ C:\WINDOWS\system32\Tasks\Avira_Security_Maintenance
2023-02-02 20:39 - 2023-02-02 20:39 - 000003428 _____ C:\WINDOWS\system32\Tasks\Avira_Security_Service_SCM_Watchdog
2023-02-02 20:39 - 2023-02-02 20:39 - 000002818 _____ C:\WINDOWS\system32\Tasks\Avira_Security_Systray
2023-01-30 20:58 - 2023-01-30 21:07 - 000014146 _____ C:\Users\Admin\Documents\Mezinárodní utkání v pozemním hokeji v nové kbelské hale Sokol Kbely - HC Khalifa 20.1.2023.wlmp
2023-01-26 23:19 - 2022-03-01 03:19 - 000000773 _____ C:\Users\Admin\Downloads\HostDNSimport.bat
2023-01-26 23:16 - 2023-01-26 23:16 - 000000096 _____ C:\WINDOWS\system32\Drivers\etc\hosts.txt
2023-01-25 20:01 - 2023-01-25 20:01 - 000087532 _____ C:\Users\Admin\Downloads\Potvrzeni_platby - Ivo Antušek.pdf
2023-01-22 14:51 - 2023-01-22 14:51 - 000010136 _____ C:\Users\Admin\Documents\Cimbálová muzika Trnka na plese Sokola Praha vršovice 21.1.2023.wlmp
2023-01-22 12:17 - 2023-01-22 13:55 - 000056862 _____ C:\Users\Admin\Documents\Ples Sokola Praha vršovice v kině Vzlet 21.1.2023wlmp.wlmp
==================== One month (modified) ==================
(If an entry is included in the fixlist, the file/folder will be moved.)
2023-02-18 19:49 - 2020-02-14 18:00 - 000000000 ____D C:\FRST
2023-02-18 19:47 - 2021-12-27 21:19 - 000000000 ____D C:\Users\Admin\.cache
2023-02-18 19:38 - 2021-12-26 18:07 - 000003556 _____ C:\WINDOWS\system32\Tasks\RealPlayerRealUpgradeScheduledTaskS-1-5-21-722231672-965411127-3486821242-1001
2023-02-18 19:38 - 2021-12-26 18:07 - 000003492 _____ C:\WINDOWS\system32\Tasks\RealPlayerRealUpgradeLogonTaskS-1-5-21-722231672-965411127-3486821242-1001
2023-02-18 19:29 - 2020-04-28 21:25 - 000000000 ___HD C:\Users\Public\Documents\AdobeGCData
2023-02-18 19:26 - 2019-12-07 10:14 - 000000000 ____D C:\ProgramData\regid.1991-06.com.microsoft
2023-02-18 19:26 - 2019-11-26 21:30 - 000000000 ____D C:\Program Files (x86)\Google
2023-02-18 15:09 - 2020-02-05 19:20 - 000000000 ____D C:\Users\Admin\AppData\Roaming\vlc
2023-02-18 12:57 - 2019-11-27 01:56 - 000000000 ____D C:\Users\Admin\AppData\LocalLow\Mozilla
2023-02-18 12:22 - 2020-11-05 23:09 - 000000000 ____D C:\WINDOWS\system32\SleepStudy
2023-02-18 12:15 - 2020-06-14 18:30 - 000002436 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Edge.lnk
2023-02-18 12:15 - 2020-06-14 18:30 - 000002274 _____ C:\Users\Public\Desktop\Microsoft Edge.lnk
2023-02-18 12:15 - 2019-12-07 10:14 - 000000000 ___HD C:\Program Files\WindowsApps
2023-02-18 12:15 - 2019-12-07 10:14 - 000000000 ____D C:\WINDOWS\AppReadiness
2023-02-18 11:36 - 2020-11-05 23:18 - 001693136 _____ C:\WINDOWS\system32\PerfStringBackup.INI
2023-02-18 11:36 - 2019-12-07 15:41 - 000716764 _____ C:\WINDOWS\system32\perfh005.dat
2023-02-18 11:36 - 2019-12-07 15:41 - 000144942 _____ C:\WINDOWS\system32\perfc005.dat
2023-02-18 11:36 - 2019-12-07 10:13 - 000000000 ____D C:\WINDOWS\INF
2023-02-18 11:34 - 2019-11-26 22:04 - 000000000 ____D C:\Users\Admin\AppData\Local\D3DSCache
2023-02-18 11:33 - 2021-12-10 23:41 - 000003584 _____ C:\WINDOWS\system32\Tasks\OneDrive Reporting Task-S-1-5-21-722231672-965411127-3486821242-1001
2023-02-18 11:33 - 2020-11-05 23:16 - 000003376 _____ C:\WINDOWS\system32\Tasks\OneDrive Standalone Update Task-S-1-5-21-722231672-965411127-3486821242-1001
2023-02-18 11:33 - 2020-11-05 23:10 - 000002377 _____ C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OneDrive.lnk
2023-02-18 11:32 - 2022-07-10 00:00 - 000000000 ____D C:\Users\Public\Speedup Sessions
2023-02-18 11:32 - 2020-11-05 23:16 - 000000006 ____H C:\WINDOWS\Tasks\SA.DAT
2023-02-18 11:32 - 2020-11-05 23:09 - 000008192 ___SH C:\DumpStack.log.tmp
2023-02-18 11:32 - 2019-11-20 19:04 - 000807280 _____ C:\WINDOWS\system32\wpbbin.exe
2023-02-18 11:32 - 2019-11-20 19:04 - 000768408 _____ C:\WINDOWS\system32\AsusUpdateCheck.exe
2023-02-18 11:32 - 2019-11-20 12:12 - 000000000 ____D C:\ProgramData\NVIDIA
2023-02-18 01:00 - 2019-12-07 10:03 - 000524288 _____ C:\WINDOWS\system32\config\BBI
2023-02-18 01:00 - 2019-11-20 19:04 - 000000000 ____D C:\WINDOWS\system32\Drivers\wd
2023-02-18 00:58 - 2022-09-21 18:29 - 000000696 _____ C:\WINDOWS\Tasks\CCleanerCrashReporting.job
2023-02-18 00:58 - 2020-11-05 23:09 - 000783640 _____ C:\WINDOWS\system32\FNTCACHE.DAT
2023-02-18 00:58 - 2019-11-26 21:34 - 000000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2023-02-18 00:58 - 2019-11-26 21:33 - 000000000 ____D C:\Program Files (x86)\Opera
2023-02-18 00:57 - 2019-12-07 10:14 - 000000000 ___RD C:\WINDOWS\ImmersiveControlPanel
2023-02-18 00:57 - 2019-12-07 10:14 - 000000000 ____D C:\WINDOWS\SysWOW64\oobe
2023-02-18 00:57 - 2019-12-07 10:14 - 000000000 ____D C:\WINDOWS\SystemResources
2023-02-18 00:57 - 2019-12-07 10:14 - 000000000 ____D C:\WINDOWS\system32\setup
2023-02-18 00:57 - 2019-12-07 10:14 - 000000000 ____D C:\WINDOWS\system32\oobe
2023-02-18 00:57 - 2019-12-07 10:14 - 000000000 ____D C:\WINDOWS\system32\DDFs
2023-02-18 00:57 - 2019-12-07 10:14 - 000000000 ____D C:\WINDOWS\bcastdvr
2023-02-18 00:56 - 2019-11-27 01:03 - 000000000 ____D C:\Users\Admin\AppData\Local\CrashDumps
2023-02-18 00:42 - 2022-02-08 17:57 - 000000000 ____D C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38
2023-02-16 18:57 - 2021-10-10 20:31 - 000000000 ____D C:\WINDOWS\system32\Tasks\Mozilla
2023-02-16 18:57 - 2019-11-26 21:34 - 000001228 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Firefox.lnk
2023-02-16 17:01 - 2019-12-07 10:03 - 000000000 ____D C:\WINDOWS\CbsTemp
2023-02-16 16:59 - 2020-11-05 23:11 - 003015680 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\PrintConfig.dll
2023-02-16 16:48 - 2022-10-15 15:48 - 000002073 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Acrobat.lnk
2023-02-16 16:48 - 2022-10-15 15:48 - 000002061 _____ C:\Users\Public\Desktop\Adobe Acrobat.lnk
2023-02-16 16:48 - 2020-11-05 23:16 - 000004562 _____ C:\WINDOWS\system32\Tasks\Adobe Acrobat Update Task
2023-02-15 23:57 - 2022-09-21 18:29 - 000003408 _____ C:\WINDOWS\system32\Tasks\CCleanerCrashReporting
2023-02-15 23:57 - 2020-11-05 23:16 - 000003920 _____ C:\WINDOWS\system32\Tasks\CCleaner Update
2023-02-15 22:47 - 2019-11-26 20:09 - 000000000 ____D C:\WINDOWS\system32\MRT
2023-02-15 22:44 - 2019-11-26 20:09 - 149955784 ____C (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2023-02-15 18:30 - 2022-07-12 18:05 - 000238144 _____ (Avira Operations GmbH) C:\WINDOWS\system32\Drivers\rtp_process_monitor.sys
2023-02-15 18:30 - 2022-07-12 18:05 - 000227616 _____ (Avira Operations GmbH) C:\WINDOWS\system32\Drivers\rtp_filesystem_filter.sys
2023-02-15 18:30 - 2022-07-12 18:05 - 000064696 _____ (Avira Operations GmbH) C:\WINDOWS\system32\Drivers\rtp_traverse.sys
2023-02-15 18:30 - 2022-07-12 18:05 - 000028128 _____ (Avira Operations GmbH) C:\WINDOWS\system32\Drivers\rtp_elam.sys
2023-02-14 23:07 - 2020-02-05 19:19 - 000000789 _____ C:\Users\Public\Desktop\VLC media player.lnk
2023-02-14 00:09 - 2019-11-26 21:30 - 000002301 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2023-02-14 00:09 - 2019-11-26 21:30 - 000002260 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2023-02-13 19:55 - 2022-12-14 23:12 - 000003706 _____ C:\WINDOWS\system32\Tasks\Avira_FallbackUpdater
2023-02-11 23:03 - 2019-11-26 21:47 - 000000000 ____D C:\Users\Admin\AppData\Local\Adobe
2023-02-10 21:46 - 2021-12-19 01:46 - 000000000 ____D C:\WINDOWS\SystemTemp
2023-02-10 19:25 - 2020-11-05 23:16 - 000003970 _____ C:\WINDOWS\system32\Tasks\Opera scheduled Autoupdate 1574800406
2023-02-10 19:25 - 2019-11-26 21:33 - 000001155 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Prohlížeč Opera.lnk
2023-02-07 17:09 - 2020-11-05 23:16 - 000003640 _____ C:\WINDOWS\system32\Tasks\MicrosoftEdgeUpdateTaskMachineUA
2023-02-07 17:09 - 2020-11-05 23:16 - 000003516 _____ C:\WINDOWS\system32\Tasks\MicrosoftEdgeUpdateTaskMachineCore
2023-02-06 19:39 - 2020-11-05 23:16 - 000003522 _____ C:\WINDOWS\system32\Tasks\AdobeGCInvoker-1.0
2023-02-03 16:25 - 2019-11-20 12:16 - 000000000 ____D C:\Users\Admin\AppData\Local\Packages
2023-02-03 14:58 - 2019-12-07 15:42 - 000000000 ____D C:\WINDOWS\system32\FxsTmp
2023-02-02 20:39 - 2022-07-10 00:00 - 000003478 _____ C:\WINDOWS\system32\Tasks\Avira_Security_Update
2023-02-02 20:39 - 2022-07-09 22:05 - 000001078 _____ C:\Users\Public\Desktop\Avira.lnk
2023-02-02 20:39 - 2019-11-26 20:17 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2023-02-01 20:45 - 2022-07-10 00:02 - 000000000 ____D C:\Users\Public\Security Sessions
2023-01-31 19:38 - 2022-07-12 18:05 - 000263000 _____ (Avira Operations GmbH) C:\WINDOWS\system32\Drivers\BdSentry.sys
2023-01-26 17:38 - 2020-10-05 18:54 - 000000000 ____D C:\Program Files\Microsoft Update Health Tools
==================== Files in the root of some directories ========
2022-09-04 14:00 - 2022-09-04 14:00 - 000000000 _____ () C:\Users\Admin\AppData\Local\oobelibMkey.log
==================== SigCheck ============================
(There is no automatic fix for files that do not pass verification.)
==================== End of FRST.txt ========================
