VIRY.CZ

Napřed na mě vyskočily (?fake?) policejní stránky, vyhrožující mega pokutou. S notebookem nešlo nic dělat, takže nakonec fyzické vypnutí a opětné spuštění. Notebook naběhl, ale stahování bylo velice pomalé. Prosím o kontrolu logů z FRST, díky.

Zdravím!
Spusťte tuto utilitu:

Ulozte na plochu AdwCleaner https://malwarebytes.com/adwcleaner/ nebo http://www.bleepingcomputer.com/download/adwcleaner/

ukoncete vsechny programy
odsouhlaste licencni podmiky (EULA) klikem na Souhlasim
kliknete pravym na ikonu AdwCleaneru a vyberte Spustit jako spravce (v pripade Win XP spustte obycejne dvojklikem)
kliknete na Skenovat nyni (Scan now), pote na Cisteni a opravy (Clean and Repair)
po restartu na Vas vyskoci log (pripadne jej najdete v C:\AdwCleaner\Logs\AdwCleaner[Cxx].txt), jehoz obsah zkopirujte do pristi odpovedi

# -------------------------------
# Malwarebytes AdwCleaner 8.4.0.0
# -------------------------------
# Build: 08-30-2022
# Database: 2022-10-10.1 (Cloud)
# Support: https://www.malwarebytes.com/support
#
# -------------------------------
# Mode: Clean
# -------------------------------
# Start: 05-06-2023
# Duration: 00:00:02
# OS: Windows 10 (Build 18362.720)
# Cleaned: 8
# Failed: 1


***** [ Services ] *****

No malicious services cleaned.

***** [ Folders ] *****

Deleted C:\ProgramData\AdvancedWindowsManager

***** [ Files ] *****

No malicious files cleaned.

***** [ DLL ] *****

No malicious DLLs cleaned.

***** [ WMI ] *****

No malicious WMI cleaned.

***** [ Shortcuts ] *****

No malicious shortcuts cleaned.

***** [ Tasks ] *****

No malicious tasks cleaned.

***** [ Registry ] *****

No malicious registry entries cleaned.

***** [ Chromium (and derivatives) ] *****

No malicious Chromium entries cleaned.

***** [ Chromium URLs ] *****

Deleted MyStart Search
Deleted iZito.com
Deleted mystartsearch
Deleted mystartsearch
Deleted mystartsearch
Deleted mystartsearch
Deleted webssearches
Not Deleted webssearches

***** [ Firefox (and derivatives) ] *****

No malicious Firefox entries cleaned.

***** [ Firefox URLs ] *****

No malicious Firefox URLs cleaned.

***** [ Hosts File Entries ] *****

No malicious hosts file entries cleaned.

***** [ Preinstalled Software ] *****

No Preinstalled Software cleaned.


*************************

[+] Delete Tracing Keys
[+] Reset Winsock

*************************

AdwCleaner[S00].txt - [3411 octets] - [18/05/2020 20:16:03]
AdwCleaner[C00].txt - [3363 octets] - [18/05/2020 20:17:06]
AdwCleaner[S01].txt - [2491 octets] - [19/05/2020 19:45:42]
AdwCleaner[C01].txt - [2445 octets] - [19/05/2020 19:46:14]
AdwCleaner[S02].txt - [1851 octets] - [24/05/2020 13:29:39]
AdwCleaner[C02].txt - [1949 octets] - [24/05/2020 13:31:03]
AdwCleaner[S03].txt - [2242 octets] - [05/11/2022 22:00:50]
AdwCleaner[C03].txt - [2248 octets] - [05/11/2022 22:03:02]
AdwCleaner[S04].txt - [2289 octets] - [06/05/2023 21:05:49]
AdwCleaner[S05].txt - [2350 octets] - [06/05/2023 21:21:25]

########## EOF - C:\AdwCleaner\Logs\AdwCleaner[C05].txt ##########

OK. Dejte nové logy FRST+Addition.

Děkuji za reakci a pomoc, Ivo.

Otevřte poznámkový blok a zkopírujte do něj:

Start

CloseProcesses:
HKLM-x32\...\Run: [] => [X]
HKLM\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore: [DisableConfig] Restriction <==== ATTENTION
HKLM\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore: [DisableSR] Restriction <==== ATTENTION
HKU\S-1-5-21-760426430-1322398698-3842268529-1001\...\MountPoints2: {239a1c1c-a9a8-11ea-b96e-1c3e84e103cc} - "D:\HiSuiteDownLoader.exe"
HKU\S-1-5-21-760426430-1322398698-3842268529-1001\...\MountPoints2: {239a1c59-a9a8-11ea-b96e-1c3e84e103cc} - "E:\HiSuiteDownLoader.exe"
HKU\S-1-5-21-760426430-1322398698-3842268529-1001\...\MountPoints2: {286bab2a-9206-11ea-b900-1c3e84e103cc} - "E:\HiSuiteDownLoader.exe"
HKU\S-1-5-21-760426430-1322398698-3842268529-1002\...\RunOnce: [ctfmon.exe] => ctfmon.exe /n (No File)
IFEO\acs.exe: [Debugger] svchost.exe
IFEO\AdAwareDesktop.exe: [Debugger] svchost.exe
IFEO\AdAwareService.exe: [Debugger] svchost.exe
IFEO\AdAwareTray.exe: [Debugger] svchost.exe
IFEO\AgentSvc.exe: [Debugger] svchost.exe
IFEO\AVK.exe: [Debugger] svchost.exe
IFEO\AVKProxy.exe: [Debugger] svchost.exe
IFEO\AVKService.exe: [Debugger] svchost.exe
IFEO\AVKTray.exe: [Debugger] svchost.exe
IFEO\AVKWCtlx64.exe: [Debugger] svchost.exe
IFEO\avpmapp.exe: [Debugger] svchost.exe
IFEO\av_task.exe: [Debugger] svchost.exe
IFEO\Bav.exe: [Debugger] svchost.exe
IFEO\bavhm.exe: [Debugger] svchost.exe
IFEO\BavSvc.exe: [Debugger] svchost.exe
IFEO\BavTray.exe: [Debugger] svchost.exe
IFEO\BavUpdater.exe: [Debugger] svchost.exe
IFEO\BavWebClient.exe: [Debugger] svchost.exe
IFEO\BDSSVC.EXE: [Debugger] svchost.exe
IFEO\BgScan.exe: [Debugger] svchost.exe
IFEO\BullGuard.exe: [Debugger] svchost.exe
IFEO\BullGuardBhvScanner.exe: [Debugger] svchost.exe
IFEO\BullGuardUpdate.exe: [Debugger] svchost.exe
IFEO\BullGuarScanner.exe: [Debugger] svchost.exe
IFEO\capinfos.exe: [Debugger] svchost.exe
IFEO\cavwp.exe: [Debugger] svchost.exe
IFEO\CertReg.exe: [Debugger] svchost.exe
IFEO\cis.exe: [Debugger] svchost.exe
IFEO\CisTray.exe: [Debugger] svchost.exe
IFEO\clamscan.exe: [Debugger] svchost.exe
IFEO\ClamTray.exe: [Debugger] svchost.exe
IFEO\ClamWin.exe: [Debugger] svchost.exe
IFEO\cmdagent.exe: [Debugger] svchost.exe
IFEO\ConfigSecurityPolicy.exe: [Debugger] svchost.exe
IFEO\CONSCTLX.EXE: [Debugger] svchost.exe
IFEO\coreFrameworkHost.exe: [Debugger] svchost.exe
IFEO\coreServiceShell.exe: [Debugger] svchost.exe
IFEO\dragon_updater.exe: [Debugger] svchost.exe
IFEO\dumpcap.exe: [Debugger] svchost.exe
IFEO\econceal.exe: [Debugger] svchost.exe
IFEO\econser.exe: [Debugger] svchost.exe
IFEO\editcap.exe: [Debugger] svchost.exe
IFEO\EMLPROXY.EXE: [Debugger] svchost.exe
IFEO\escanmon.exe: [Debugger] svchost.exe
IFEO\escanpro.exe: [Debugger] svchost.exe
IFEO\fcappdb.exe: [Debugger] svchost.exe
IFEO\FCDBlog.exe: [Debugger] svchost.exe
IFEO\FCHelper64.exe: [Debugger] svchost.exe
IFEO\FilMsg.exe: [Debugger] svchost.exe
IFEO\FilUp.exe: [Debugger] svchost.exe
IFEO\filwscc.exe: [Debugger] svchost.exe
IFEO\fmon.exe: [Debugger] svchost.exe
IFEO\FortiClient.exe: [Debugger] svchost.exe
IFEO\FortiClient_Diagnostic_Tool.exe: [Debugger] svchost.exe
IFEO\FortiESNAC.exe: [Debugger] svchost.exe
IFEO\FortiFW.exe: [Debugger] svchost.exe
IFEO\FortiProxy.exe: [Debugger] svchost.exe
IFEO\FortiSSLVPNdaemon.exe: [Debugger] svchost.exe
IFEO\FortiTray.exe: [Debugger] svchost.exe
IFEO\FPAVServer.exe: [Debugger] svchost.exe
IFEO\FProtTray.exe: [Debugger] svchost.exe
IFEO\FPWin.exe: [Debugger] svchost.exe
IFEO\freshclam.exe: [Debugger] svchost.exe
IFEO\freshclamwrap.exe: [Debugger] svchost.exe
IFEO\fsgk32.exe: [Debugger] svchost.exe
IFEO\FSHDLL64.exe: [Debugger] svchost.exe
IFEO\fshoster32.exe: [Debugger] svchost.exe
IFEO\FSM32.EXE: [Debugger] svchost.exe
IFEO\FSMA32.EXE: [Debugger] svchost.exe
IFEO\fsorsp.exe: [Debugger] svchost.exe
IFEO\fssm32.exe: [Debugger] svchost.exe
IFEO\GdBgInx64.exe: [Debugger] svchost.exe
IFEO\GDKBFltExe32.exe: [Debugger] svchost.exe
IFEO\GDSC.exe: [Debugger] svchost.exe
IFEO\GDScan.exe: [Debugger] svchost.exe
IFEO\guardxkickoff_x64.exe: [Debugger] svchost.exe
IFEO\guardxservice.exe: [Debugger] svchost.exe
IFEO\iptray.exe: [Debugger] svchost.exe
IFEO\K7AVScan.exe: [Debugger] svchost.exe
IFEO\K7CrvSvc.exe: [Debugger] svchost.exe
IFEO\K7EmlPxy.EXE: [Debugger] svchost.exe
IFEO\K7FWSrvc.exe: [Debugger] svchost.exe
IFEO\K7PSSrvc.exe: [Debugger] svchost.exe
IFEO\K7RTScan.exe: [Debugger] svchost.exe
IFEO\K7SysMon.Exe: [Debugger] svchost.exe
IFEO\K7TSecurity.exe: [Debugger] svchost.exe
IFEO\K7TSMain.exe: [Debugger] svchost.exe
IFEO\K7TSMngr.exe: [Debugger] svchost.exe
IFEO\LittleHook.exe: [Debugger] svchost.exe
IFEO\mbam.exe: [Debugger] svchost.exe
IFEO\mbamscheduler.exe: [Debugger] svchost.exe
IFEO\mbamservice.exe: [Debugger] svchost.exe
IFEO\MCS-Uninstall.exe: [Debugger] svchost.exe
IFEO\MCShieldCCC.exe: [Debugger] svchost.exe
IFEO\MCShieldDS.exe: [Debugger] svchost.exe
IFEO\MCShieldRTM.exe: [Debugger] svchost.exe
IFEO\mergecap.exe: [Debugger] svchost.exe
IFEO\MpCmdRun.exe: [Debugger] svchost.exe
IFEO\MpUXSrv.exe: [Debugger] svchost.exe
IFEO\MSASCui.exe: [Debugger] svchost.exe
IFEO\MsMpEng.exe: [Debugger] svchost.exe
IFEO\MWAGENT.EXE: [Debugger] svchost.exe
IFEO\MWASER.EXE: [Debugger] svchost.exe
IFEO\nanoav.exe: [Debugger] svchost.exe
IFEO\nanosvc.exe: [Debugger] svchost.exe
IFEO\nbrowser.exe: [Debugger] svchost.exe
IFEO\nfservice.exe: [Debugger] svchost.exe
IFEO\NisSrv.exe: [Debugger] svchost.exe
IFEO\njeeves2.exe: [Debugger] svchost.exe
IFEO\nnf.exe: [Debugger] svchost.exe
IFEO\nprosec.exe: [Debugger] svchost.exe
IFEO\NS.exe: [Debugger] svchost.exe
IFEO\nseupdatesvc.exe: [Debugger] svchost.exe
IFEO\nvcod.exe: [Debugger] svchost.exe
IFEO\nvcsvc.exe: [Debugger] svchost.exe
IFEO\nvoy.exe: [Debugger] svchost.exe
IFEO\nwscmon.exe: [Debugger] svchost.exe
IFEO\ONLINENT.EXE: [Debugger] svchost.exe
IFEO\OPSSVC.EXE: [Debugger] svchost.exe
IFEO\op_mon.exe: [Debugger] svchost.exe
IFEO\ProcessHacker.exe: [Debugger] svchost.exe
IFEO\procexp.exe: [Debugger] svchost.exe
IFEO\PSANHost.exe: [Debugger] svchost.exe
IFEO\PSUAMain.exe: [Debugger] svchost.exe
IFEO\PSUAService.exe: [Debugger] svchost.exe
IFEO\psview.exe: [Debugger] svchost.exe
IFEO\PtSessionAgent.exe: [Debugger] svchost.exe
IFEO\PtSvcHost.exe: [Debugger] svchost.exe
IFEO\PtWatchDog.exe: [Debugger] svchost.exe
IFEO\quamgr.exe: [Debugger] svchost.exe
IFEO\QUHLPSVC.EXE: [Debugger] svchost.exe
IFEO\rawshark.exe: [Debugger] svchost.exe
IFEO\SAPISSVC.EXE: [Debugger] svchost.exe
IFEO\SASCore64.exe: [Debugger] svchost.exe
IFEO\SASTask.exe: [Debugger] svchost.exe
IFEO\SBAMSvc.exe: [Debugger] svchost.exe
IFEO\SBAMTray.exe: [Debugger] svchost.exe
IFEO\SBPIMSvc.exe: [Debugger] svchost.exe
IFEO\SCANNER.EXE: [Debugger] svchost.exe
IFEO\SCANWSCS.EXE: [Debugger] svchost.exe
IFEO\schmgr.exe: [Debugger] svchost.exe
IFEO\scproxysrv.exe: [Debugger] svchost.exe
IFEO\ScSecSvc.exe: [Debugger] svchost.exe
IFEO\SDFSSvc.exe: [Debugger] svchost.exe
IFEO\SDScan.exe: [Debugger] svchost.exe
IFEO\SDTray.exe: [Debugger] svchost.exe
IFEO\SDWelcome.exe: [Debugger] svchost.exe
IFEO\SSUpdate64.exe: [Debugger] svchost.exe
IFEO\SUPERAntiSpyware.exe: [Debugger] svchost.exe
IFEO\SUPERDelete.exe: [Debugger] svchost.exe
IFEO\Taskmgr.exe: [Debugger] svchost.exe
IFEO\text2pcap.exe: [Debugger] svchost.exe
IFEO\TRAYICOS.EXE: [Debugger] svchost.exe
IFEO\TRAYSSER.EXE: [Debugger] svchost.exe
IFEO\trigger.exe: [Debugger] svchost.exe
IFEO\tshark.exe: [Debugger] svchost.exe
IFEO\twsscan.exe: [Debugger] svchost.exe
IFEO\twssrv.exe: [Debugger] svchost.exe
IFEO\uiSeAgnt.exe: [Debugger] svchost.exe
IFEO\uiUpdateTray.exe: [Debugger] svchost.exe
IFEO\uiWatchDog.exe: [Debugger] svchost.exe
IFEO\uiWinMgr.exe: [Debugger] svchost.exe
IFEO\UnThreat.exe: [Debugger] svchost.exe
IFEO\UserAccountControlSettings.exe: [Debugger] svchost.exe
IFEO\UserReg.exe: [Debugger] svchost.exe
IFEO\utsvc.exe: [Debugger] svchost.exe
IFEO\V3Main.exe: [Debugger] svchost.exe
IFEO\V3Medic.exe: [Debugger] svchost.exe
IFEO\V3Proxy.exe: [Debugger] svchost.exe
IFEO\V3SP.exe: [Debugger] svchost.exe
IFEO\V3Svc.exe: [Debugger] svchost.exe
IFEO\V3Up.exe: [Debugger] svchost.exe
IFEO\VIEWTCP.EXE: [Debugger] svchost.exe
IFEO\VIPREUI.exe: [Debugger] svchost.exe
IFEO\virusutilities.exe: [Debugger] svchost.exe
IFEO\WebCompanion.exe: [Debugger] svchost.exe
IFEO\wireshark.exe: [Debugger] svchost.exe
IFEO\Zanda.exe: [Debugger] svchost.exe
IFEO\Zlh.exe: [Debugger] svchost.exe
IFEO\zlhh.exe: [Debugger] svchost.exe
ShortcutTarget: One Calendar.lnk -> (No File)
Task: {0F3C579B-13C4-455D-95DF-4CDFDEEF030E} - System32\Tasks\AdvancedWindowsManager #9 => C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe [697208 2022-05-11] (Microleaves LTD -> Advanced Windows Manager) <==== ATTENTION
Task: {54A05535-5DEC-4F14-88EB-E5B70968659F} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [155432 2019-12-10] (Google Inc -> Google LLC)
Task: {5E844327-C783-43EB-9CB2-091B9D3A639B} - System32\Tasks\AdvancedUpdater => C:\Program Files (x86)\AW Manager\Windows Manager\Windows Updater.exe [1036152 2022-05-11] (Microleaves LTD -> AdvancedWindowsManager) <==== ATTENTION
Task: {69C561C9-D69B-46B0-ACFF-17FA175B2B81} - System32\Tasks\Mozilla\mkeeicjnx => C:\Users\Lenovo\AppData\Roaming\jjqjtpt\mchost.exe -> "C:\Users\Lenovo\AppData\Roaming\jjqjtpt\mchost.chm" <==== ATTENTION
Task: {77286421-D767-45C2-834D-5ADF02279299} - System32\Tasks\Mozilla\cjmcihk => C:\Users\Lenovo\AppData\Roaming\gttjuaqn\mchost.exe -> "C:\Users\Lenovo\AppData\Roaming\gttjuaqn\mchost.chm" <==== ATTENTION
Task: {79EA3F8C-D16D-4FCB-8296-C3CD24B3540A} - System32\Tasks\AdvancedWindowsManager #4 => C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe [697208 2022-05-11] (Microleaves LTD -> Advanced Windows Manager) <==== ATTENTION
Task: {958F8275-A385-4AFF-BE5A-D5C545B92F65} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [155432 2019-12-10] (Google Inc -> Google LLC)
Task: {968D6549-655B-4BE0-B439-3CF4AF326CBB} - System32\Tasks\AdvancedWindowsManager #5 => C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe [697208 2022-05-11] (Microleaves LTD -> Advanced Windows Manager) <==== ATTENTION
Task: {9E70FDF1-B47D-435C-8015-9C2CE0E3F32B} - System32\Tasks\AdvancedWindowsManager #2 => C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe [697208 2022-05-11] (Microleaves LTD -> Advanced Windows Manager) <==== ATTENTION
Task: {EB81E3CB-AB5A-4AFD-A222-C7C96480FA00} - System32\Tasks\Lenovo\Lenovo Customer Feedback Program 64 35 => C:\Program Files (x86)\Lenovo\Customer Feedback Program 35\Lenovo.TVT.CustomerFeedback.Agent35.exe (No File)
Task: {F1458C65-6148-4A65-A652-C8433E5ABFF9} - System32\Tasks\AdvancedWindowsManager #1 => C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe [697208 2022-05-11] (Microleaves LTD -> Advanced Windows Manager) <==== ATTENTION
Task: {F749E72A-A51D-4FDE-8719-EE3FF52B3E42} - System32\Tasks\AdvancedWindowsManager #3 => C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe [697208 2022-05-11] (Microleaves LTD -> Advanced Windows Manager) <==== ATTENTION
Task: {F96E2E47-6748-498E-8199-322ECF562CF3} - System32\Tasks\AdvancedWindowsManager #7 => C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe [697208 2022-05-11] (Microleaves LTD -> Advanced Windows Manager) <==== ATTENTION
S3 wuauserv; C:\Windows\system32\svchost.exe [53744 2019-03-19] (Microsoft Windows Publisher -> Microsoft Corporation) <==== ATTENTION (no ServiceDLL)
S3 wuauserv; C:\Windows\SysWOW64\svchost.exe [45448 2019-03-19] (Microsoft Windows Publisher -> Microsoft Corporation) <==== ATTENTION (no ServiceDLL)
C:\Users\Lenovo\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
WgaUtilAcc (S-1-5-21-760426430-1322398698-3842268529-1002 - Administrator - Enabled) => C:\Users\WgaUtilAcc <==== ATTENTION
FirewallRules: [{4ADC5C95-08CB-4137-9824-8BEA08D86DCB}] => (Allow) C:\Users\Lenovo\AppData\Local\Temp\utorrent\utorrent.exe => No File
FirewallRules: [{EC99865A-0351-4607-ACE1-6C05C0C74FD7}] => (Allow) C:\Users\Lenovo\AppData\Local\Temp\utorrent\utorrent.exe => No File
C:\Users\Lenovo\AppData\Local\Temp

Hosts:
EmptyTemp:

End

Uložte na plochu jako fixlist.txt. Spusťte znovu FRST a klikněte na >Fix<. Po skončení akce se objeví log, který sem zkopírujte.

Fix result of Farbar Recovery Scan Tool (x64) Version: 07-05-2023 01
Ran by Lenovo (08-05-2023 08:10:18) Run:3
Running from C:\Users\Lenovo\Desktop
Loaded Profiles: Lenovo & WgaUtilAcc
Boot Mode: Normal
==============================================

fixlist content:
*****************
Start

CloseProcesses:
HKLM-x32\...\Run: [] => [X]
HKLM\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore: [DisableConfig] Restriction <==== ATTENTION
HKLM\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore: [DisableSR] Restriction <==== ATTENTION
HKU\S-1-5-21-760426430-1322398698-3842268529-1001\...\MountPoints2: {239a1c1c-a9a8-11ea-b96e-1c3e84e103cc} - "D:\HiSuiteDownLoader.exe"
HKU\S-1-5-21-760426430-1322398698-3842268529-1001\...\MountPoints2: {239a1c59-a9a8-11ea-b96e-1c3e84e103cc} - "E:\HiSuiteDownLoader.exe"
HKU\S-1-5-21-760426430-1322398698-3842268529-1001\...\MountPoints2: {286bab2a-9206-11ea-b900-1c3e84e103cc} - "E:\HiSuiteDownLoader.exe"
HKU\S-1-5-21-760426430-1322398698-3842268529-1002\...\RunOnce: [ctfmon.exe] => ctfmon.exe /n (No File)
IFEO\acs.exe: [Debugger] svchost.exe
IFEO\AdAwareDesktop.exe: [Debugger] svchost.exe
IFEO\AdAwareService.exe: [Debugger] svchost.exe
IFEO\AdAwareTray.exe: [Debugger] svchost.exe
IFEO\AgentSvc.exe: [Debugger] svchost.exe
IFEO\AVK.exe: [Debugger] svchost.exe
IFEO\AVKProxy.exe: [Debugger] svchost.exe
IFEO\AVKService.exe: [Debugger] svchost.exe
IFEO\AVKTray.exe: [Debugger] svchost.exe
IFEO\AVKWCtlx64.exe: [Debugger] svchost.exe
IFEO\avpmapp.exe: [Debugger] svchost.exe
IFEO\av_task.exe: [Debugger] svchost.exe
IFEO\Bav.exe: [Debugger] svchost.exe
IFEO\bavhm.exe: [Debugger] svchost.exe
IFEO\BavSvc.exe: [Debugger] svchost.exe
IFEO\BavTray.exe: [Debugger] svchost.exe
IFEO\BavUpdater.exe: [Debugger] svchost.exe
IFEO\BavWebClient.exe: [Debugger] svchost.exe
IFEO\BDSSVC.EXE: [Debugger] svchost.exe
IFEO\BgScan.exe: [Debugger] svchost.exe
IFEO\BullGuard.exe: [Debugger] svchost.exe
IFEO\BullGuardBhvScanner.exe: [Debugger] svchost.exe
IFEO\BullGuardUpdate.exe: [Debugger] svchost.exe
IFEO\BullGuarScanner.exe: [Debugger] svchost.exe
IFEO\capinfos.exe: [Debugger] svchost.exe
IFEO\cavwp.exe: [Debugger] svchost.exe
IFEO\CertReg.exe: [Debugger] svchost.exe
IFEO\cis.exe: [Debugger] svchost.exe
IFEO\CisTray.exe: [Debugger] svchost.exe
IFEO\clamscan.exe: [Debugger] svchost.exe
IFEO\ClamTray.exe: [Debugger] svchost.exe
IFEO\ClamWin.exe: [Debugger] svchost.exe
IFEO\cmdagent.exe: [Debugger] svchost.exe
IFEO\ConfigSecurityPolicy.exe: [Debugger] svchost.exe
IFEO\CONSCTLX.EXE: [Debugger] svchost.exe
IFEO\coreFrameworkHost.exe: [Debugger] svchost.exe
IFEO\coreServiceShell.exe: [Debugger] svchost.exe
IFEO\dragon_updater.exe: [Debugger] svchost.exe
IFEO\dumpcap.exe: [Debugger] svchost.exe
IFEO\econceal.exe: [Debugger] svchost.exe
IFEO\econser.exe: [Debugger] svchost.exe
IFEO\editcap.exe: [Debugger] svchost.exe
IFEO\EMLPROXY.EXE: [Debugger] svchost.exe
IFEO\escanmon.exe: [Debugger] svchost.exe
IFEO\escanpro.exe: [Debugger] svchost.exe
IFEO\fcappdb.exe: [Debugger] svchost.exe
IFEO\FCDBlog.exe: [Debugger] svchost.exe
IFEO\FCHelper64.exe: [Debugger] svchost.exe
IFEO\FilMsg.exe: [Debugger] svchost.exe
IFEO\FilUp.exe: [Debugger] svchost.exe
IFEO\filwscc.exe: [Debugger] svchost.exe
IFEO\fmon.exe: [Debugger] svchost.exe
IFEO\FortiClient.exe: [Debugger] svchost.exe
IFEO\FortiClient_Diagnostic_Tool.exe: [Debugger] svchost.exe
IFEO\FortiESNAC.exe: [Debugger] svchost.exe
IFEO\FortiFW.exe: [Debugger] svchost.exe
IFEO\FortiProxy.exe: [Debugger] svchost.exe
IFEO\FortiSSLVPNdaemon.exe: [Debugger] svchost.exe
IFEO\FortiTray.exe: [Debugger] svchost.exe
IFEO\FPAVServer.exe: [Debugger] svchost.exe
IFEO\FProtTray.exe: [Debugger] svchost.exe
IFEO\FPWin.exe: [Debugger] svchost.exe
IFEO\freshclam.exe: [Debugger] svchost.exe
IFEO\freshclamwrap.exe: [Debugger] svchost.exe
IFEO\fsgk32.exe: [Debugger] svchost.exe
IFEO\FSHDLL64.exe: [Debugger] svchost.exe
IFEO\fshoster32.exe: [Debugger] svchost.exe
IFEO\FSM32.EXE: [Debugger] svchost.exe
IFEO\FSMA32.EXE: [Debugger] svchost.exe
IFEO\fsorsp.exe: [Debugger] svchost.exe
IFEO\fssm32.exe: [Debugger] svchost.exe
IFEO\GdBgInx64.exe: [Debugger] svchost.exe
IFEO\GDKBFltExe32.exe: [Debugger] svchost.exe
IFEO\GDSC.exe: [Debugger] svchost.exe
IFEO\GDScan.exe: [Debugger] svchost.exe
IFEO\guardxkickoff_x64.exe: [Debugger] svchost.exe
IFEO\guardxservice.exe: [Debugger] svchost.exe
IFEO\iptray.exe: [Debugger] svchost.exe
IFEO\K7AVScan.exe: [Debugger] svchost.exe
IFEO\K7CrvSvc.exe: [Debugger] svchost.exe
IFEO\K7EmlPxy.EXE: [Debugger] svchost.exe
IFEO\K7FWSrvc.exe: [Debugger] svchost.exe
IFEO\K7PSSrvc.exe: [Debugger] svchost.exe
IFEO\K7RTScan.exe: [Debugger] svchost.exe
IFEO\K7SysMon.Exe: [Debugger] svchost.exe
IFEO\K7TSecurity.exe: [Debugger] svchost.exe
IFEO\K7TSMain.exe: [Debugger] svchost.exe
IFEO\K7TSMngr.exe: [Debugger] svchost.exe
IFEO\LittleHook.exe: [Debugger] svchost.exe
IFEO\mbam.exe: [Debugger] svchost.exe
IFEO\mbamscheduler.exe: [Debugger] svchost.exe
IFEO\mbamservice.exe: [Debugger] svchost.exe
IFEO\MCS-Uninstall.exe: [Debugger] svchost.exe
IFEO\MCShieldCCC.exe: [Debugger] svchost.exe
IFEO\MCShieldDS.exe: [Debugger] svchost.exe
IFEO\MCShieldRTM.exe: [Debugger] svchost.exe
IFEO\mergecap.exe: [Debugger] svchost.exe
IFEO\MpCmdRun.exe: [Debugger] svchost.exe
IFEO\MpUXSrv.exe: [Debugger] svchost.exe
IFEO\MSASCui.exe: [Debugger] svchost.exe
IFEO\MsMpEng.exe: [Debugger] svchost.exe
IFEO\MWAGENT.EXE: [Debugger] svchost.exe
IFEO\MWASER.EXE: [Debugger] svchost.exe
IFEO\nanoav.exe: [Debugger] svchost.exe
IFEO\nanosvc.exe: [Debugger] svchost.exe
IFEO\nbrowser.exe: [Debugger] svchost.exe
IFEO\nfservice.exe: [Debugger] svchost.exe
IFEO\NisSrv.exe: [Debugger] svchost.exe
IFEO\njeeves2.exe: [Debugger] svchost.exe
IFEO\nnf.exe: [Debugger] svchost.exe
IFEO\nprosec.exe: [Debugger] svchost.exe
IFEO\NS.exe: [Debugger] svchost.exe
IFEO\nseupdatesvc.exe: [Debugger] svchost.exe
IFEO\nvcod.exe: [Debugger] svchost.exe
IFEO\nvcsvc.exe: [Debugger] svchost.exe
IFEO\nvoy.exe: [Debugger] svchost.exe
IFEO\nwscmon.exe: [Debugger] svchost.exe
IFEO\ONLINENT.EXE: [Debugger] svchost.exe
IFEO\OPSSVC.EXE: [Debugger] svchost.exe
IFEO\op_mon.exe: [Debugger] svchost.exe
IFEO\ProcessHacker.exe: [Debugger] svchost.exe
IFEO\procexp.exe: [Debugger] svchost.exe
IFEO\PSANHost.exe: [Debugger] svchost.exe
IFEO\PSUAMain.exe: [Debugger] svchost.exe
IFEO\PSUAService.exe: [Debugger] svchost.exe
IFEO\psview.exe: [Debugger] svchost.exe
IFEO\PtSessionAgent.exe: [Debugger] svchost.exe
IFEO\PtSvcHost.exe: [Debugger] svchost.exe
IFEO\PtWatchDog.exe: [Debugger] svchost.exe
IFEO\quamgr.exe: [Debugger] svchost.exe
IFEO\QUHLPSVC.EXE: [Debugger] svchost.exe
IFEO\rawshark.exe: [Debugger] svchost.exe
IFEO\SAPISSVC.EXE: [Debugger] svchost.exe
IFEO\SASCore64.exe: [Debugger] svchost.exe
IFEO\SASTask.exe: [Debugger] svchost.exe
IFEO\SBAMSvc.exe: [Debugger] svchost.exe
IFEO\SBAMTray.exe: [Debugger] svchost.exe
IFEO\SBPIMSvc.exe: [Debugger] svchost.exe
IFEO\SCANNER.EXE: [Debugger] svchost.exe
IFEO\SCANWSCS.EXE: [Debugger] svchost.exe
IFEO\schmgr.exe: [Debugger] svchost.exe
IFEO\scproxysrv.exe: [Debugger] svchost.exe
IFEO\ScSecSvc.exe: [Debugger] svchost.exe
IFEO\SDFSSvc.exe: [Debugger] svchost.exe
IFEO\SDScan.exe: [Debugger] svchost.exe
IFEO\SDTray.exe: [Debugger] svchost.exe
IFEO\SDWelcome.exe: [Debugger] svchost.exe
IFEO\SSUpdate64.exe: [Debugger] svchost.exe
IFEO\SUPERAntiSpyware.exe: [Debugger] svchost.exe
IFEO\SUPERDelete.exe: [Debugger] svchost.exe
IFEO\Taskmgr.exe: [Debugger] svchost.exe
IFEO\text2pcap.exe: [Debugger] svchost.exe
IFEO\TRAYICOS.EXE: [Debugger] svchost.exe
IFEO\TRAYSSER.EXE: [Debugger] svchost.exe
IFEO\trigger.exe: [Debugger] svchost.exe
IFEO\tshark.exe: [Debugger] svchost.exe
IFEO\twsscan.exe: [Debugger] svchost.exe
IFEO\twssrv.exe: [Debugger] svchost.exe
IFEO\uiSeAgnt.exe: [Debugger] svchost.exe
IFEO\uiUpdateTray.exe: [Debugger] svchost.exe
IFEO\uiWatchDog.exe: [Debugger] svchost.exe
IFEO\uiWinMgr.exe: [Debugger] svchost.exe
IFEO\UnThreat.exe: [Debugger] svchost.exe
IFEO\UserAccountControlSettings.exe: [Debugger] svchost.exe
IFEO\UserReg.exe: [Debugger] svchost.exe
IFEO\utsvc.exe: [Debugger] svchost.exe
IFEO\V3Main.exe: [Debugger] svchost.exe
IFEO\V3Medic.exe: [Debugger] svchost.exe
IFEO\V3Proxy.exe: [Debugger] svchost.exe
IFEO\V3SP.exe: [Debugger] svchost.exe
IFEO\V3Svc.exe: [Debugger] svchost.exe
IFEO\V3Up.exe: [Debugger] svchost.exe
IFEO\VIEWTCP.EXE: [Debugger] svchost.exe
IFEO\VIPREUI.exe: [Debugger] svchost.exe
IFEO\virusutilities.exe: [Debugger] svchost.exe
IFEO\WebCompanion.exe: [Debugger] svchost.exe
IFEO\wireshark.exe: [Debugger] svchost.exe
IFEO\Zanda.exe: [Debugger] svchost.exe
IFEO\Zlh.exe: [Debugger] svchost.exe
IFEO\zlhh.exe: [Debugger] svchost.exe
ShortcutTarget: One Calendar.lnk -> (No File)
Task: {0F3C579B-13C4-455D-95DF-4CDFDEEF030E} - System32\Tasks\AdvancedWindowsManager #9 => C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe [697208 2022-05-11] (Microleaves LTD -> Advanced Windows Manager) <==== ATTENTION
Task: {54A05535-5DEC-4F14-88EB-E5B70968659F} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [155432 2019-12-10] (Google Inc -> Google LLC)
Task: {5E844327-C783-43EB-9CB2-091B9D3A639B} - System32\Tasks\AdvancedUpdater => C:\Program Files (x86)\AW Manager\Windows Manager\Windows Updater.exe [1036152 2022-05-11] (Microleaves LTD -> AdvancedWindowsManager) <==== ATTENTION
Task: {69C561C9-D69B-46B0-ACFF-17FA175B2B81} - System32\Tasks\Mozilla\mkeeicjnx => C:\Users\Lenovo\AppData\Roaming\jjqjtpt\mchost.exe -> "C:\Users\Lenovo\AppData\Roaming\jjqjtpt\mchost.chm" <==== ATTENTION
Task: {77286421-D767-45C2-834D-5ADF02279299} - System32\Tasks\Mozilla\cjmcihk => C:\Users\Lenovo\AppData\Roaming\gttjuaqn\mchost.exe -> "C:\Users\Lenovo\AppData\Roaming\gttjuaqn\mchost.chm" <==== ATTENTION
Task: {79EA3F8C-D16D-4FCB-8296-C3CD24B3540A} - System32\Tasks\AdvancedWindowsManager #4 => C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe [697208 2022-05-11] (Microleaves LTD -> Advanced Windows Manager) <==== ATTENTION
Task: {958F8275-A385-4AFF-BE5A-D5C545B92F65} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [155432 2019-12-10] (Google Inc -> Google LLC)
Task: {968D6549-655B-4BE0-B439-3CF4AF326CBB} - System32\Tasks\AdvancedWindowsManager #5 => C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe [697208 2022-05-11] (Microleaves LTD -> Advanced Windows Manager) <==== ATTENTION
Task: {9E70FDF1-B47D-435C-8015-9C2CE0E3F32B} - System32\Tasks\AdvancedWindowsManager #2 => C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe [697208 2022-05-11] (Microleaves LTD -> Advanced Windows Manager) <==== ATTENTION
Task: {EB81E3CB-AB5A-4AFD-A222-C7C96480FA00} - System32\Tasks\Lenovo\Lenovo Customer Feedback Program 64 35 => C:\Program Files (x86)\Lenovo\Customer Feedback Program 35\Lenovo.TVT.CustomerFeedback.Agent35.exe (No File)
Task: {F1458C65-6148-4A65-A652-C8433E5ABFF9} - System32\Tasks\AdvancedWindowsManager #1 => C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe [697208 2022-05-11] (Microleaves LTD -> Advanced Windows Manager) <==== ATTENTION
Task: {F749E72A-A51D-4FDE-8719-EE3FF52B3E42} - System32\Tasks\AdvancedWindowsManager #3 => C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe [697208 2022-05-11] (Microleaves LTD -> Advanced Windows Manager) <==== ATTENTION
Task: {F96E2E47-6748-498E-8199-322ECF562CF3} - System32\Tasks\AdvancedWindowsManager #7 => C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe [697208 2022-05-11] (Microleaves LTD -> Advanced Windows Manager) <==== ATTENTION
S3 wuauserv; C:\Windows\system32\svchost.exe [53744 2019-03-19] (Microsoft Windows Publisher -> Microsoft Corporation) <==== ATTENTION (no ServiceDLL)
S3 wuauserv; C:\Windows\SysWOW64\svchost.exe [45448 2019-03-19] (Microsoft Windows Publisher -> Microsoft Corporation) <==== ATTENTION (no ServiceDLL)
C:\Users\Lenovo\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
WgaUtilAcc (S-1-5-21-760426430-1322398698-3842268529-1002 - Administrator - Enabled) => C:\Users\WgaUtilAcc <==== ATTENTION
FirewallRules: [{4ADC5C95-08CB-4137-9824-8BEA08D86DCB}] => (Allow) C:\Users\Lenovo\AppData\Local\Temp\utorrent\utorrent.exe => No File
FirewallRules: [{EC99865A-0351-4607-ACE1-6C05C0C74FD7}] => (Allow) C:\Users\Lenovo\AppData\Local\Temp\utorrent\utorrent.exe => No File
C:\Users\Lenovo\AppData\Local\Temp

Hosts:
EmptyTemp:

End
*****************

Processes closed successfully.
"HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\" => removed successfully
HKLM\Software\Policies\Microsoft\Windows NT\SystemRestore => removed successfully
HKLM\Software\Policies\Microsoft\Windows NT\SystemRestore => not found
HKU\S-1-5-21-760426430-1322398698-3842268529-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{239a1c1c-a9a8-11ea-b96e-1c3e84e103cc} => removed successfully
HKU\S-1-5-21-760426430-1322398698-3842268529-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{239a1c59-a9a8-11ea-b96e-1c3e84e103cc} => removed successfully
HKU\S-1-5-21-760426430-1322398698-3842268529-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{286bab2a-9206-11ea-b900-1c3e84e103cc} => removed successfully
"HKU\S-1-5-21-760426430-1322398698-3842268529-1002\Software\Microsoft\Windows\CurrentVersion\RunOnce\\ctfmon.exe" => removed successfully
HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\acs.exe => removed successfully
HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\AdAwareDesktop.exe => removed successfully
HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\AdAwareService.exe => removed successfully
HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\AdAwareTray.exe => removed successfully
HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\AgentSvc.exe => removed successfully
HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\AVK.exe => removed successfully
HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\AVKProxy.exe => removed successfully
HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\AVKService.exe => removed successfully
HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\AVKTray.exe => removed successfully
HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\AVKWCtlx64.exe => removed successfully
HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\avpmapp.exe => removed successfully
HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\av_task.exe => removed successfully
HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\Bav.exe => removed successfully
HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\bavhm.exe => removed successfully
HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\BavSvc.exe => removed successfully
HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\BavTray.exe => removed successfully
HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\BavUpdater.exe => removed successfully
HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\BavWebClient.exe => removed successfully
HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\BDSSVC.EXE => removed successfully
HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\BgScan.exe => removed successfully
HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\BullGuard.exe => removed successfully
HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\BullGuardBhvScanner.exe => removed successfully
HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\BullGuardUpdate.exe => removed successfully
HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\BullGuarScanner.exe => removed successfully
HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\capinfos.exe => removed successfully
HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\cavwp.exe => removed successfully
HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\CertReg.exe => removed successfully
HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\cis.exe => removed successfully
HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\CisTray.exe => removed successfully
HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\clamscan.exe => removed successfully
HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\ClamTray.exe => removed successfully
HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\ClamWin.exe => removed successfully
HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\cmdagent.exe => removed successfully
HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\ConfigSecurityPolicy.exe => removed successfully
HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\CONSCTLX.EXE => removed successfully
HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\coreFrameworkHost.exe => removed successfully
HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\coreServiceShell.exe => removed successfully
HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\dragon_updater.exe => removed successfully
HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\dumpcap.exe => removed successfully
HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\econceal.exe => removed successfully
HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\econser.exe => removed successfully
HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\editcap.exe => removed successfully
HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\EMLPROXY.EXE => removed successfully
HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\escanmon.exe => removed successfully
HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\escanpro.exe => removed successfully
HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\fcappdb.exe => removed successfully
HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\FCDBlog.exe => removed successfully
HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\FCHelper64.exe => removed successfully
HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\FilMsg.exe => removed successfully
HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\FilUp.exe => removed successfully
HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\filwscc.exe => removed successfully
HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\fmon.exe => removed successfully
HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\FortiClient.exe => removed successfully
HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\FortiClient_Diagnostic_Tool.exe => removed successfully
HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\FortiESNAC.exe => removed successfully
HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\FortiFW.exe => removed successfully
HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\FortiProxy.exe => removed successfully
HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\FortiSSLVPNdaemon.exe => removed successfully
HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\FortiTray.exe => removed successfully
HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\FPAVServer.exe => removed successfully
HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\FProtTray.exe => removed successfully
HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\FPWin.exe => removed successfully
HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\freshclam.exe => removed successfully
HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\freshclamwrap.exe => removed successfully
HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\fsgk32.exe => removed successfully
HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\FSHDLL64.exe => removed successfully
HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\fshoster32.exe => removed successfully
HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\FSM32.EXE => removed successfully
HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\FSMA32.EXE => removed successfully
HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\fsorsp.exe => removed successfully
HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\fssm32.exe => removed successfully
HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\GdBgInx64.exe => removed successfully
HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\GDKBFltExe32.exe => removed successfully
HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\GDSC.exe => removed successfully
HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\GDScan.exe => removed successfully
HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\guardxkickoff_x64.exe => removed successfully
HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\guardxservice.exe => removed successfully
HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\iptray.exe => removed successfully
HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\K7AVScan.exe => removed successfully
HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\K7CrvSvc.exe => removed successfully
HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\K7EmlPxy.EXE => removed successfully
HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\K7FWSrvc.exe => removed successfully
HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\K7PSSrvc.exe => removed successfully
HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\K7RTScan.exe => removed successfully
HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\K7SysMon.Exe => removed successfully
HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\K7TSecurity.exe => removed successfully
HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\K7TSMain.exe => removed successfully
HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\K7TSMngr.exe => removed successfully
HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\LittleHook.exe => removed successfully
HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\mbam.exe => removed successfully
HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\mbamscheduler.exe => removed successfully
HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\mbamservice.exe => removed successfully
HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\MCS-Uninstall.exe => removed successfully
HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\MCShieldCCC.exe => removed successfully
HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\MCShieldDS.exe => removed successfully
HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\MCShieldRTM.exe => removed successfully
HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\mergecap.exe => removed successfully
HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\MpCmdRun.exe => removed successfully
HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\MpUXSrv.exe => removed successfully
HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\MSASCui.exe => removed successfully
HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\MsMpEng.exe => removed successfully
HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\MWAGENT.EXE => removed successfully
HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\MWASER.EXE => removed successfully
HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\nanoav.exe => removed successfully
HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\nanosvc.exe => removed successfully
HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\nbrowser.exe => removed successfully
HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\nfservice.exe => removed successfully
HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\NisSrv.exe => removed successfully
HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\njeeves2.exe => removed successfully
HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\nnf.exe => removed successfully
HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\nprosec.exe => removed successfully
HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\NS.exe => removed successfully
HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\nseupdatesvc.exe => removed successfully
HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\nvcod.exe => removed successfully
HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\nvcsvc.exe => removed successfully
HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\nvoy.exe => removed successfully
HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\nwscmon.exe => removed successfully
HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\ONLINENT.EXE => removed successfully
HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\OPSSVC.EXE => removed successfully
HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\op_mon.exe => removed successfully
HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\ProcessHacker.exe => removed successfully
HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\procexp.exe => removed successfully
HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\PSANHost.exe => removed successfully
HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\PSUAMain.exe => removed successfully
HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\PSUAService.exe => removed successfully
HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\psview.exe => removed successfully
HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\PtSessionAgent.exe => removed successfully
HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\PtSvcHost.exe => removed successfully
HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\PtWatchDog.exe => removed successfully
HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\quamgr.exe => removed successfully
HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\QUHLPSVC.EXE => removed successfully
HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\rawshark.exe => removed successfully
HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\SAPISSVC.EXE => removed successfully
HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\SASCore64.exe => removed successfully
HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\SASTask.exe => removed successfully
HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\SBAMSvc.exe => removed successfully
HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\SBAMTray.exe => removed successfully
HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\SBPIMSvc.exe => removed successfully
HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\SCANNER.EXE => removed successfully
HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\SCANWSCS.EXE => removed successfully
HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\schmgr.exe => removed successfully
HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\scproxysrv.exe => removed successfully
HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\ScSecSvc.exe => removed successfully
HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\SDFSSvc.exe => removed successfully
HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\SDScan.exe => removed successfully
HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\SDTray.exe => removed successfully
HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\SDWelcome.exe => removed successfully
HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\SSUpdate64.exe => removed successfully
HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\SUPERAntiSpyware.exe => removed successfully
HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\SUPERDelete.exe => removed successfully
HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\Taskmgr.exe => removed successfully
HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\text2pcap.exe => removed successfully
HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\TRAYICOS.EXE => removed successfully
HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\TRAYSSER.EXE => removed successfully
HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\trigger.exe => removed successfully
HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\tshark.exe => removed successfully
HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\twsscan.exe => removed successfully
HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\twssrv.exe => removed successfully
HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\uiSeAgnt.exe => removed successfully
HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\uiUpdateTray.exe => removed successfully
HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\uiWatchDog.exe => removed successfully
HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\uiWinMgr.exe => removed successfully
HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\UnThreat.exe => removed successfully
HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\UserAccountControlSettings.exe => removed successfully
HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\UserReg.exe => removed successfully
HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\utsvc.exe => removed successfully
HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\V3Main.exe => removed successfully
HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\V3Medic.exe => removed successfully
HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\V3Proxy.exe => removed successfully
HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\V3SP.exe => removed successfully
HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\V3Svc.exe => removed successfully
HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\V3Up.exe => removed successfully
HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\VIEWTCP.EXE => removed successfully
HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\VIPREUI.exe => removed successfully
HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\virusutilities.exe => removed successfully
HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\WebCompanion.exe => removed successfully
HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\wireshark.exe => removed successfully
HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\Zanda.exe => removed successfully
HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\Zlh.exe => removed successfully
HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\zlhh.exe => removed successfully
"ShortcutTarget: One Calendar.lnk -> (No File)" => not found
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{0F3C579B-13C4-455D-95DF-4CDFDEEF030E}" => removed successfully
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{0F3C579B-13C4-455D-95DF-4CDFDEEF030E}" => removed successfully
C:\Windows\System32\Tasks\AdvancedWindowsManager #9 => moved successfully
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\AdvancedWindowsManager #9" => removed successfully
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{54A05535-5DEC-4F14-88EB-E5B70968659F}" => removed successfully
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{54A05535-5DEC-4F14-88EB-E5B70968659F}" => removed successfully
C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore => moved successfully
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\GoogleUpdateTaskMachineCore" => removed successfully
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{5E844327-C783-43EB-9CB2-091B9D3A639B}" => removed successfully
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{5E844327-C783-43EB-9CB2-091B9D3A639B}" => removed successfully
C:\Windows\System32\Tasks\AdvancedUpdater => moved successfully
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\AdvancedUpdater" => removed successfully
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{69C561C9-D69B-46B0-ACFF-17FA175B2B81}" => removed successfully
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{69C561C9-D69B-46B0-ACFF-17FA175B2B81}" => removed successfully
C:\Windows\System32\Tasks\Mozilla\mkeeicjnx => moved successfully
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Mozilla\mkeeicjnx" => removed successfully
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{77286421-D767-45C2-834D-5ADF02279299}" => removed successfully
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{77286421-D767-45C2-834D-5ADF02279299}" => removed successfully
C:\Windows\System32\Tasks\Mozilla\cjmcihk => moved successfully
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Mozilla\cjmcihk" => removed successfully
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{79EA3F8C-D16D-4FCB-8296-C3CD24B3540A}" => removed successfully
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{79EA3F8C-D16D-4FCB-8296-C3CD24B3540A}" => removed successfully
C:\Windows\System32\Tasks\AdvancedWindowsManager #4 => moved successfully
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\AdvancedWindowsManager #4" => removed successfully
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{958F8275-A385-4AFF-BE5A-D5C545B92F65}" => removed successfully
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{958F8275-A385-4AFF-BE5A-D5C545B92F65}" => removed successfully
C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA => moved successfully
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\GoogleUpdateTaskMachineUA" => removed successfully
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{968D6549-655B-4BE0-B439-3CF4AF326CBB}" => removed successfully
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{968D6549-655B-4BE0-B439-3CF4AF326CBB}" => removed successfully
C:\Windows\System32\Tasks\AdvancedWindowsManager #5 => moved successfully
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\AdvancedWindowsManager #5" => removed successfully
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{9E70FDF1-B47D-435C-8015-9C2CE0E3F32B}" => removed successfully
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{9E70FDF1-B47D-435C-8015-9C2CE0E3F32B}" => removed successfully
C:\Windows\System32\Tasks\AdvancedWindowsManager #2 => moved successfully
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\AdvancedWindowsManager #2" => removed successfully
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{EB81E3CB-AB5A-4AFD-A222-C7C96480FA00}" => removed successfully
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{EB81E3CB-AB5A-4AFD-A222-C7C96480FA00}" => removed successfully
C:\Windows\System32\Tasks\Lenovo\Lenovo Customer Feedback Program 64 35 => moved successfully
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Lenovo\Lenovo Customer Feedback Program 64 35" => removed successfully
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{F1458C65-6148-4A65-A652-C8433E5ABFF9}" => removed successfully
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{F1458C65-6148-4A65-A652-C8433E5ABFF9}" => removed successfully
C:\Windows\System32\Tasks\AdvancedWindowsManager #1 => moved successfully
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\AdvancedWindowsManager #1" => removed successfully
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{F749E72A-A51D-4FDE-8719-EE3FF52B3E42}" => removed successfully
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{F749E72A-A51D-4FDE-8719-EE3FF52B3E42}" => removed successfully
C:\Windows\System32\Tasks\AdvancedWindowsManager #3 => moved successfully
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\AdvancedWindowsManager #3" => removed successfully
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{F96E2E47-6748-498E-8199-322ECF562CF3}" => removed successfully
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{F96E2E47-6748-498E-8199-322ECF562CF3}" => removed successfully
C:\Windows\System32\Tasks\AdvancedWindowsManager #7 => moved successfully
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\AdvancedWindowsManager #7" => removed successfully
HKLM\System\CurrentControlSet\Services\wuauserv => removed successfully
wuauserv => service removed successfully
wuauserv => service not found.
C:\Users\Lenovo\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini => moved successfully
WgaUtilAcc (S-1-5-21-760426430-1322398698-3842268529-1002 - Administrator - Enabled) => C:\Users\WgaUtilAcc <==== ATTENTION => removed successfully
"HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\{4ADC5C95-08CB-4137-9824-8BEA08D86DCB}" => removed successfully
"HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\{EC99865A-0351-4607-ACE1-6C05C0C74FD7}" => removed successfully
C:\Users\Lenovo\AppData\Local\Temp => moved successfully
C:\Windows\System32\Drivers\etc\hosts => moved successfully
Hosts restored successfully.

=========== EmptyTemp: ==========

FlushDNS => completed
BITS transfer queue => 2097152 B
DOMStore, IE Recovery, AppCache, Feeds Cache, Thumbcache, IconCache => 19111176 B
Java, Discord, Steam htmlcache, WinHttpAutoProxySvc/winhttp *.cache => 0 B
Windows/system/drivers => 12565987 B
Edge => 108058 B
Chrome => 251670487 B
Firefox => 38114130 B
Opera => 7088158 B

Temp, IE cache, history, cookies, recent:
Default => 0 B
ProgramData => 0 B
Public => 0 B
systemprofile => 427721399 B
systemprofile32 => 427737155 B
LocalService => 427737155 B
NetworkService => 430229694 B
Lenovo => 434530412 B
WgaUtilAcc => 434687615 B

RecycleBin => 31573425 B
EmptyTemp: => 2.7 GB temporary data Removed.

================================


The system needed a reboot.

==== End of Fixlog 08:10:34 ====

Smazáno. Nastala nějaká změna?

Ano, noťas je rychlejší a ostatní se nijak neprojevuje. Kdyby se něco objevilo, bych se ozval.

OK, za mne vše.