Guten Abend,

leider hat mein Sohn nicht vertrauenswürdige Webseiten besucht und nun haben wir verschiedene Trojaner durch einen Scan mit Malwarebytes entdeckt. Aufgefallen ist uns zunächst, dass manche Seiten im Firefox nicht mehr zu öffnen waren oder merkwürdige Werbung angezeigt wurde.

Ich würde mich sehr über Eure Hilfe freuen! Anbei die Logs von FRST und Malwarebytes.

FRST.txt

 Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 30-07-2019 01
Ran by ** (administrator) on DESKTOP-3CK4O4E (Micro-Star International Co., Ltd. MS-7B33) (30-07-2019 22:00:40)
Running from C:\Users\*****\Desktop
Loaded Profiles: ** & ***** (Available Profiles: ** & *****)
Platform: Windows 10 Pro Version 1803 17134.885 (X64) Language: Slowakisch (Slowakei)
Default browser: FF
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Adobe Systems, Incorporated -> Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
(Disig a.s. -> Disig a.s.) C:\Program Files (x86)\Disig\Disig Web Signer 1.0.7\Updater\WebSignerTray.exe
(Google Inc -> Google LLC) C:\Program Files (x86)\Google\Update\1.3.34.11\GoogleCrashHandler.exe
(Google Inc -> Google LLC) C:\Program Files (x86)\Google\Update\1.3.34.11\GoogleCrashHandler64.exe
(IDSA Production signing key -> Intel) C:\Program Files (x86)\Intel\Driver and Support Assistant\DSAService.exe
(IDSA Production signing key -> Intel) C:\Program Files (x86)\Intel\Driver and Support Assistant\DSATray.exe
(IDSA Production signing key -> Intel) C:\Program Files (x86)\Intel\Driver and Support Assistant\DSAUpdateService.exe
(Intel(R) Embedded Subsystems and IP Blocks Group -> Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
(Intel(R) Embedded Subsystems and IP Blocks Group -> Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel(R) pGFX -> Intel Corporation) C:\Windows\System32\DriverStore\FileRepository\cui_dc_comp.inf_amd64_1c77f1231c19bc72\igfxCUIService.exe
(Intel(R) pGFX -> Intel Corporation) C:\Windows\System32\DriverStore\FileRepository\cui_dc_comp.inf_amd64_1c77f1231c19bc72\igfxEM.exe
(Intel(R) pGFX -> Intel Corporation) C:\Windows\System32\DriverStore\FileRepository\iigd_dc_base.inf_amd64_26935c8c9d5bfd3b\IntelCpHDCPSvc.exe
(Intel(R) pGFX -> Intel Corporation) C:\Windows\System32\DriverStore\FileRepository\iigd_dc_base.inf_amd64_26935c8c9d5bfd3b\IntelCpHeciSvc.exe
(Intel(R) Software Development Products -> ) C:\Program Files\Intel\SUR\QUEENCREEK\SurSvc.exe
(Malwarebytes Corporation -> Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
(Malwarebytes Corporation -> Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe
(Microsoft Corporation -> Microsoft Corporation) C:\Users\*****\AppData\Local\Microsoft\OneDrive\OneDrive.exe
(Microsoft Corporation -> Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Microsoft Windows -> Microsoft Corporation) C:\Program Files\Windows Defender\MSASCuiL.exe
(Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\CompatTelRunner.exe
(Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\CompatTelRunner.exe
(Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\smartscreen.exe
(Microsoft Windows Publisher -> Microsoft Corporation) C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.1907.4-0\MsMpEng.exe
(Mozilla Corporation -> Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Mozilla Corporation -> Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Mozilla Corporation -> Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Mozilla Corporation -> Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Mozilla Corporation -> Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Oracle America, Inc. -> Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Safer-Networking Ltd. -> Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe
(Safer-Networking Ltd. -> Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe
(Safer-Networking Ltd. -> Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe
(Safer-Networking Ltd. -> Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe
(SEIKO EPSON Corporation -> SEIKO EPSON CORPORATION) C:\Windows\System32\spool\drivers\x64\3\E_YATIHTU.EXE

==================== Registry (Whitelisted) ===========================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [SecurityHealth] => C:\Program Files\Windows Defender\MSASCuiL.exe [638872 2018-04-12] (Microsoft Windows -> Microsoft Corporation)
HKLM\...\Run: [RTHDVCPL] => "C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe" -s
HKLM\...\Run: [WindowsDefender] => C:\Program Files\Windows Defender\MSASCuiL.exe [638872 2018-04-12] (Microsoft Windows -> Microsoft Corporation)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [645456 2019-04-01] (Oracle America, Inc. -> Oracle Corporation)
HKLM-x32\...\Run: [SDTray] => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [6788032 2018-04-20] (Safer-Networking Ltd. -> Safer-Networking Ltd.)
HKLM\SOFTWARE\Policies\Microsoft\Windows Defender: Restriction <==== ATTENTION
HKU\S-1-5-21-1960842775-2088100534-3542962694-1001\...\Run: [Steam] => "C:\Program Files (x86)\Steam\steam.exe" -silent
HKU\S-1-5-21-1960842775-2088100534-3542962694-1001\...\MountPoints2: {08af5bcb-313c-11e9-94ec-309c23d44e07} - "F:\HiSuiteDownLoader.exe" 
HKU\S-1-5-21-1960842775-2088100534-3542962694-1002\...\Run: [EPLTarget\P0000000000000000] => C:\WINDOWS\system32\spool\DRIVERS\x64\3\E_YATIHTU.EXE [241280 2012-07-12] (SEIKO EPSON Corporation -> SEIKO EPSON CORPORATION)
HKU\S-1-5-21-1960842775-2088100534-3542962694-1002\...\MountPoints2: {08af5bcb-313c-11e9-94ec-309c23d44e07} - "F:\HiSuiteDownLoader.exe" 
HKU\S-1-5-21-1960842775-2088100534-3542962694-1002\...\MountPoints2: {e8fcf302-ff74-11e8-94da-806e6f6e6963} - "E:\Setup.exe" 
HKLM\...\Drivers32: [VIDC.X264] => C:\WINDOWS\system32\x264vfw64.dll [3799552 2017-07-30] (x264vfw project) [File not signed]
HKLM\...\Drivers32: [VIDC.LAGS] => C:\WINDOWS\system32\lagarith.dll [148992 2011-12-07] ( ) [File not signed]
HKLM\...\Drivers32: [VIDC.XVID] => C:\WINDOWS\system32\xvidvfw.dll [311296 2018-01-28] () [File not signed]
HKLM\...\Drivers32: [msacm.ac3acm] => C:\WINDOWS\system32\ac3acm.acm [180736 2012-07-21] (fccHandler) [File not signed]
HKLM\...\Drivers32: [VIDC.X264] => C:\Windows\SysWOW64\x264vfw.dll [3850240 2017-07-30] (x264vfw project) [File not signed]
HKLM\...\Drivers32: [VIDC.LAGS] => C:\WINDOWS\SysWOW64\lagarith.dll [216064 2011-12-07] ( ) [File not signed]
HKLM\...\Drivers32: [VIDC.XVID] => C:\WINDOWS\SysWOW64\xvidvfw.dll [284672 2018-01-28] () [File not signed]
HKLM\...\Drivers32: [VIDC.FFDS] => C:\Windows\SysWOW64\ff_vfw.dll [112128 2015-10-24] () [File not signed]
HKLM\...\Drivers32: [msacm.ac3acm] => C:\WINDOWS\SysWOW64\ac3acm.acm [122880 2012-07-21] (fccHandler) [File not signed]
HKLM\Software\Microsoft\Active Setup\Installed Components: [{8A69D345-D564-463c-AFF1-A69D9E530F96}] -> C:\Program Files (x86)\Google\Chrome\Application\75.0.3770.142\Installer\chrmstp.exe [2019-07-17] (Google LLC -> Google LLC)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Web Signer.lnk [2019-03-14]
ShortcutTarget: Web Signer.lnk -> C:\Program Files (x86)\Disig\Disig Web Signer 1.0.7\Updater\WebSignerTray.exe (Disig a.s. -> Disig a.s.)
BootExecute: autocheck autochk * sdnclean64.exe
CHR HKLM\SOFTWARE\Policies\Google: Restriction <==== ATTENTION

==================== Scheduled Tasks (Whitelisted) =============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

Task: {07629243-D0BF-4B40-9BD0-F8C67B473A82} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Scan the system => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDScan.exe [7651984 2018-04-20] (Safer-Networking Ltd. -> Safer-Networking Ltd.)
Task: {0E604FC0-C5ED-4EB1-A618-02490097313E} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [153168 2018-12-14] (Google Inc -> Google Inc.)
Task: {12F9930E-E1BE-461C-ABCA-E2E6871152CA} - System32\Tasks\Microsoft\Office\Office 15 Subscription Heartbeat => C:\Program Files\Common Files\Microsoft Shared\Office16\OLicenseHeartbeat.exe
Task: {26841A08-7BC8-413E-B648-4E9B88302A57} - System32\Tasks\EJlCPXAxczfLnX => rundll32 "C:\Program Files (x86)\XAIfWVzjYwlU2\ivfNGGvgifFGu.dll",#1
Task: {2F071C61-940D-4862-A954-D5C6A19DCD93} - System32\Tasks\IntelSURQC-Upgrade-86621605-2a0b-4128-8ffc-15514c247132-Logon => C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\IntelSoftwareAssetManagerService.exe [18168 2017-07-13] (Intel(R) Software Asset Manager -> Intel Corporation)
Task: {3DB06ABD-CC6B-46E0-98FC-E36AA4642849} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Check for updates => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe [6944304 2018-04-20] (Safer-Networking Ltd. -> Safer-Networking Ltd.)
Task: {40446FB5-8319-4883-997A-0F4FB55BC044} - System32\Tasks\ibZIUHjYTxUPTmNsU2 => rundll32 "C:\Program Files (x86)\XSeHBAjlvbTDePgmqbR\yNwwave.dll",#1
Task: {45DE53AF-C696-4FA0-95AE-89EAE95F5CCC} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentFallBack2016 => C:\Program Files\Microsoft Office\Office16\msoia.exe [416432 2015-07-31] (Microsoft Corporation -> Microsoft Corporation)
Task: {542886ED-46CC-4922-8DDD-A49E08E230E8} - System32\Tasks\Adobe Flash Player NPAPI Notifier => C:\WINDOWS\SysWOW64\Macromed\Flash\FlashUtil32_32_0_0_223_Plugin.exe [1457208 2019-07-13] (Adobe Inc. -> Adobe)
Task: {625224FD-B919-4BAE-8718-20D666776C9F} - System32\Tasks\WByhYcedlOQavqREWte2 => rundll32 "C:\Program Files (x86)\NIErSAELLsOOC\EfRGQll.dll",#1
Task: {68F13A5A-E60C-4593-BD61-7058F49F44BB} - System32\Tasks\Intel PTT EK Recertification => C:\Program Files\Intel\Intel(R) Management Engine Components\iCLS\IntelPTTEKRecertification.exe [817352 2018-06-08] (Intel(R) Trust Services -> Intel(R) Corporation)
Task: {6DF74A6B-67D3-462C-9413-F82E04D70F06} - System32\Tasks\KJMNwfnoaWMfhxH2 => rundll32 "C:\Program Files (x86)\udVlifMMU\vNGgfG.dll",#1
Task: {75D51F29-E7D7-44DF-B5E3-DB305222BD70} - System32\Tasks\lqerkybtsayax => msiexec.exe /quiet /i "C:\Users\**\AppData\Roaming\lwmjhnysqrpp\pbeohtnsooaelld.msi" WEBID=PP_MN_P3 TKNME=lqerkybtsayax
Task: {795EC12C-6485-4A36-86D6-A7F83BC10233} - System32\Tasks\klcp_update => CodecTweakTool.exe
Task: {88583ED8-4AA6-424D-A0AF-BBD7BC423EDC} - System32\Tasks\Microsoft\Windows\Setup\EOSNotify => C:\WINDOWS\system32\EOSNotify.exe
Task: {8AC426F8-1254-4832-9F4F-26F11B75A266} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentLogOn2016 => C:\Program Files\Microsoft Office\Office16\msoia.exe [416432 2015-07-31] (Microsoft Corporation -> Microsoft Corporation)
Task: {8E897747-B370-4713-B30E-A711C911CB41} - System32\Tasks\IntelSURQC-Upgrade-86621605-2a0b-4128-8ffc-15514c247132 => C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\IntelSoftwareAssetManagerService.exe [18168 2017-07-13] (Intel(R) Software Asset Manager -> Intel Corporation)
Task: {A42F7ECF-99F6-403A-BDC2-9F66B6E292EB} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [153168 2018-12-14] (Google Inc -> Google Inc.)
Task: {A6B4763B-79C7-47AC-9626-B2A5FCBB500B} - System32\Tasks\USER_ESRV_SVC_QUEENCREEK => "C:\WINDOWS\System32\Wscript.exe" //B //NoLogo "C:\Program Files\Intel\SUR\QUEENCREEK\x64\task.vbs"
Task: {B1E92710-FA20-412F-A854-A8EECE9BA802} - System32\Tasks\WZdwAMJoIRSYG2 => C:\WINDOWS\system32\wscript.exe "C:\ProgramData\LUBciApiRJzrvXVB\PFmfVpo.wsf"
Task: {BC18A36F-4A2A-42F5-877E-B3C3EF1FFCA1} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Refresh immunization => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDImmunize.exe [7192192 2018-04-20] (Safer-Networking Ltd. -> Safer-Networking Ltd.)
Task: {CCE6F463-0345-4BC9-8068-3F513EF4D603} - System32\Tasks\rescncttloqaqcg => msiexec.exe /quiet /i "C:\Users\**\AppData\Roaming\lwmjhnysqrpp\pbeohtnsooaelld.msi" WEBID=PP_MN_P3 TKNME=rescncttloqaqcg
Task: {D6841C58-556C-4171-87B7-EF1A9825CE80} - System32\Tasks\Adobe Flash Player Updater => C:\WINDOWS\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [335416 2019-07-13] (Adobe Inc. -> Adobe)
Task: {E4E894E9-95E3-4E54-A365-EAE0909FB0A1} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [1195544 2018-12-16] (Adobe Systems, Incorporated -> Adobe Systems Incorporated)
Task: {E9DE67E1-2A80-4A65-A101-4A3AB3CC97F2} - System32\Tasks\IUM-F1E24CA0-B63E-4F13-A9E3-4ADE3BFF3473 => C:\Program Files (x86)\Intel\Intel(R) Update Manager\bin\iumsvc.exe

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)


==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Tcpip\Parameters: [DhcpNameServer] 192.168.1.1 195.146.128.62
Tcpip\..\Interfaces\{293ee5fa-fe84-433a-a774-26687ea51594}: [NameServer] 45.114.8.167,,,116.203.6.218
Tcpip\..\Interfaces\{34eac78a-f8d3-4256-b5a3-9da0fc12e3a7}: [NameServer] 45.114.8.167,,,116.203.6.218
Tcpip\..\Interfaces\{da384fb4-1e59-48fc-bfe0-c27ce005f778}: [NameServer] 45.114.8.167,,,116.203.6.218
Tcpip\..\Interfaces\{da384fb4-1e59-48fc-bfe0-c27ce005f778}: [DhcpNameServer] 192.168.1.1 195.146.128.62

Internet Explorer:
==================
SearchScopes: HKU\S-1-5-21-1960842775-2088100534-3542962694-1001 -> DefaultScope {FFEBBF0A-C22C-4172-89FF-45215A135AC7} URL = 
BHO: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office\Office16\OCHelper.dll [2015-07-31] (Microsoft Corporation -> Microsoft Corporation)
BHO: YoutubeAdBlock -> {44EDBCE5-6691-4383-B723-8C21F5F1A004} -> C:\Program Files (x86)\bzDQAplLjIE\tMOJVg6.dll => No File
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_211\bin\ssv.dll [2019-05-24] (Oracle America, Inc. -> Oracle Corporation)
BHO: Microsoft OneDrive for Business Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office\Office16\GROOVEEX.DLL [2015-07-31] (Microsoft Corporation -> Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_211\bin\jp2ssv.dll [2019-05-24] (Oracle America, Inc. -> Oracle Corporation)
BHO-x32: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files (x86)\Microsoft Office\Office16\OCHelper.dll [2015-07-31] (Microsoft Corporation -> Microsoft Corporation)
BHO-x32: YoutubeAdBlock -> {44EDBCE5-6691-4383-B723-8C21F5F1A004} -> C:\Program Files (x86)\bzDQAplLjIE\kSQSQOyPW.dll => No File
BHO-x32: Microsoft OneDrive for Business Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files (x86)\Microsoft Office\Office16\GROOVEEX.DLL [2015-07-31] (Microsoft Corporation -> Microsoft Corporation)
Handler-x32: mso-minsb.16 - {3459B272-CC19-4448-86C9-DDC3B4B2FAD3} - C:\Program Files (x86)\Microsoft Office\Office16\MSOSB.DLL [2015-07-31] (Microsoft Corporation -> Microsoft Corporation)
Handler-x32: osf.16 - {5504BE45-A83B-4808-900A-3A5C36E7F77A} - C:\Program Files (x86)\Microsoft Office\Office16\MSOSB.DLL [2015-07-31] (Microsoft Corporation -> Microsoft Corporation)

FireFox:
========
FF DefaultProfile: bt6jbw3e.default
FF ProfilePath: C:\Users\**\AppData\Roaming\Mozilla\Firefox\Profiles\bt6jbw3e.default [2019-07-30]
FF user.js: detected! => C:\Users\**\AppData\Roaming\Mozilla\Firefox\Profiles\bt6jbw3e.default\user.js [2019-07-25]
FF Homepage: Mozilla\Firefox\Profiles\bt6jbw3e.default -> hxxps://www.google.sk/
FF Extension: (Adblock Plus - kostenloser Adblocker) - C:\Users\**\AppData\Roaming\Mozilla\Firefox\Profiles\bt6jbw3e.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2019-04-21]
FF Extension: (No Name) - C:\Program Files\Mozilla Firefox\browser\features\{BA546D42-BAEC-4C9C-870E-D0BE7892DBD5}.xpi [2019-07-25] [not signed]
FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF64_32_0_0_223.dll [2019-07-13] (Adobe Inc. -> )
FF Plugin: @java.com/DTPlugin,version=11.211.2 -> C:\Program Files\Java\jre1.8.0_211\bin\dtplugin\npDeployJava1.dll [2019-05-24] (Oracle America, Inc. -> Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=11.211.2 -> C:\Program Files\Java\jre1.8.0_211\bin\plugin2\npjp2.dll [2019-05-24] (Oracle America, Inc. -> Oracle Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_32_0_0_223.dll [2019-07-13] (Adobe Inc. -> )
FF Plugin-x32: @google.com/zxwebplugin -> C:\WINDOWS\system32\npzxwebplugin.dll [No File]
FF Plugin-x32: @microsoft.com/Lync,version=15.0 -> C:\Program Files (x86)\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll [2015-07-31] (Microsoft Corporation -> Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office16\NPSPWRAP.DLL [2015-07-31] (Microsoft Corporation -> Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.34.11\npGoogleUpdate3.dll [2019-05-15] (Google Inc -> Google LLC)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.34.11\npGoogleUpdate3.dll [2019-05-15] (Google Inc -> Google LLC)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2019-05-03] (Adobe Inc. -> Adobe Systems Inc.)
FF Plugin-x32: ditec.sk/DAsicFac -> C:\PROGRA~2\Ditec\DSIGNE~2.NET\NPDITE~1.DLL [2019-01-14] (DITEC, a.s. -> Ditec,a.s.)
FF Plugin-x32: ditec.sk/DitecZepDViewerFb -> C:\PROGRA~2\Ditec\DViewer\NPDITE~1.DLL [2019-01-15] (DITEC, a.s. -> Ditec, a.s.)
FF Plugin-x32: ditec.sk/DSigMessageContainer -> C:\PROGRA~2\Ditec\DSIGNE~2.NET\NPDITE~2.DLL [2016-12-15] (DITEC, a.s. -> Ditec, a.s.)
FF Plugin-x32: ditec.sk/DSigXadesExtender -> C:\PROGRA~2\Ditec\DSIGNE~2.NET\NPDITE~3.DLL [2016-12-15] (DITEC, a.s. -> Ditec, a.s.)
FF Plugin-x32: ditec.sk/DSigXadesFb -> C:\PROGRA~2\Ditec\DSIGNE~1.NET\NPDITE~1.DLL [2019-01-15] (DITEC, a.s. -> Ditec,a.s.)
FF Plugin-x32: ditec.sk/XmlDataContainerFb -> C:\PROGRA~2\Ditec\DSIGNE~1.NET\NPDITE~2.DLL [2019-01-15] (DITEC, a.s. -> Ditec,a.s.)
FF Plugin HKU\S-1-5-21-1960842775-2088100534-3542962694-1002: ditec.sk/DitecZepDViewerFb -> C:\ProgramData\Ditec\DViewer\npDitec.Zep.DViewerFb.dll [No File]
FF Plugin HKU\S-1-5-21-1960842775-2088100534-3542962694-1002: ditec.sk/DSigXadesExtenderFb -> C:\Program Files (x86)\Ditec\DSigXadesExtender\npDitec.Zep.DSigXadesExtenderFb.dll [No File]
FF Plugin HKU\S-1-5-21-1960842775-2088100534-3542962694-1002: ditec.sk/DSigXadesFb -> C:\Program Files (x86)\Ditec\DSigXades\npDitec.Zep.DSigXadesFb.dll [No File]

Chrome: 
=======
CHR HomePage: Default -> hxxps://www.google.com/
CHR Profile: C:\Users\**\AppData\Local\Google\Chrome\User Data\Default [2019-07-27]
CHR Extension: (Präsentationen) - C:\Users\**\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2018-12-14]
CHR Extension: (Docs) - C:\Users\**\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2018-12-14]
CHR Extension: (Google Drive) - C:\Users\**\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2018-12-14]
CHR Extension: (YouTube) - C:\Users\**\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2018-12-14]
CHR Extension: (Adobe Acrobat) - C:\Users\**\AppData\Local\Google\Chrome\User Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj [2019-06-21]
CHR Extension: (Tabellen) - C:\Users\**\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2018-12-14]
CHR Extension: (Google Docs Offline) - C:\Users\**\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2018-12-14]
CHR Extension: (Chrome Web Store-Zahlungen) - C:\Users\**\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2018-12-14]
CHR Extension: (Disig Web Signer 1.0.7) - C:\Users\**\AppData\Local\Google\Chrome\User Data\Default\Extensions\odbdbcaekkgabdfaabepfjgiooilmaoe [2019-03-15]
CHR Extension: (Google Mail) - C:\Users\**\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2019-04-23]
CHR HKLM-x32\...\Chrome\Extension: [efaidnbmnnnibpcajpcglclefindmkaj] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [odbdbcaekkgabdfaabepfjgiooilmaoe] - hxxps://clients2.google.com/service/update2/crx

==================== Services (Whitelisted) ====================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

S2 dLauncherLoopback; C:\Program Files (x86)\Ditec\DLauncher\dLauncherLoopback.exe [156984 2017-09-29] (DITEC, a.s. -> )
R2 DSAService; C:\Program Files (x86)\Intel\Driver and Support Assistant\DSAService.exe [26984 2019-07-25] (IDSA Production signing key -> Intel)
R3 DSAUpdateService; C:\Program Files (x86)\Intel\Driver and Support Assistant\DSAUpdateService.exe [80744 2019-07-25] (IDSA Production signing key -> Intel)
S2 ESRV_SVC_QUEENCREEK; C:\Program Files\Intel\SUR\QUEENCREEK\x64\esrv_svc.exe [937208 2018-12-19] (Intel(R) Software Development Products -> )
S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\Intel(R) Management Engine Components\iCLS\SocketHeciServer.exe [762568 2018-06-08] (Intel(R) Trust Services -> Intel(R) Corporation)
S3 Intel(R) SUR QC SAM; C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\IntelSoftwareAssetManagerService.exe [18168 2017-07-13] (Intel(R) Software Asset Manager -> Intel Corporation)
S2 Intel(R) TPM Provisioning Service; C:\Program Files\Intel\Intel(R) Management Engine Components\iCLS\TPMProvisioningService.exe [714952 2018-06-08] (Intel(R) Trust Services -> Intel(R) Corporation)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [218176 2018-08-03] (Intel(R) Embedded Subsystems and IP Blocks Group -> Intel Corporation)
R2 MBAMService; C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe [6744288 2019-06-26] (Malwarebytes Corporation -> Malwarebytes)
R2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [3892256 2018-04-20] (Safer-Networking Ltd. -> Safer-Networking Ltd.)
R2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [3943664 2018-04-20] (Safer-Networking Ltd. -> Safer-Networking Ltd.)
R2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [233712 2018-02-06] (Safer-Networking Ltd. -> Safer-Networking Ltd.)
S3 Sense; C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe [5073792 2019-07-04] (Microsoft Windows Publisher -> Microsoft Corporation)
R2 SystemUsageReportSvc_QUEENCREEK; C:\Program Files\Intel\SUR\QUEENCREEK\SurSvc.exe [195832 2018-12-19] (Intel(R) Software Development Products -> )
S3 USER_ESRV_SVC_QUEENCREEK; C:\Program Files\Intel\SUR\QUEENCREEK\x64\esrv_svc.exe [937208 2018-12-19] (Intel(R) Software Development Products -> )
S3 WdNisSvc; C:\ProgramData\Microsoft\Windows Defender\platform\4.18.1907.4-0\NisSrv.exe [2552416 2019-07-27] (Microsoft Windows Publisher -> Microsoft Corporation)
R2 WinDefend; C:\ProgramData\Microsoft\Windows Defender\platform\4.18.1907.4-0\MsMpEng.exe [108832 2019-07-27] (Microsoft Windows Publisher -> Microsoft Corporation)

===================== Drivers (Whitelisted) ======================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

S3 GemCCID; C:\WINDOWS\System32\drivers\GemCCID.sys [137712 2016-10-17] (Microsoft Windows Hardware Compatibility Publisher -> Gemalto)
R3 MBAMSwissArmy; C:\WINDOWS\System32\Drivers\mbamswissarmy.sys [275232 2019-07-30] (Malwarebytes Corporation -> Malwarebytes)
R3 rt640x64; C:\WINDOWS\System32\drivers\rt640x64.sys [1122200 2018-12-14] (Realtek Semiconductor Corp. -> Realtek )
R3 semav6msr64; C:\WINDOWS\system32\drivers\semav6msr64.sys [43008 2018-12-19] (Intel Corporation -> )
R3 tap0901; C:\WINDOWS\System32\drivers\tap0901.sys [27136 2016-04-21] (OpenVPN Technologies, Inc. -> The OpenVPN Project)
S0 WdBoot; C:\WINDOWS\System32\drivers\wd\WdBoot.sys [47496 2019-07-27] (Microsoft Windows Early Launch Anti-Malware Publisher -> Microsoft Corporation)
R0 WdFilter; C:\WINDOWS\System32\drivers\wd\WdFilter.sys [344288 2019-07-27] (Microsoft Windows -> Microsoft Corporation)
S3 WdNisDrv; C:\WINDOWS\System32\drivers\wd\WdNisDrv.sys [54496 2019-07-27] (Microsoft Windows -> Microsoft Corporation)

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== One month (created) ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2019-07-30 22:00 - 2019-07-30 22:01 - 000026246 _____ C:\Users\*****\Desktop\FRST.txt
2019-07-30 22:00 - 2019-07-30 22:00 - 000000000 ____D C:\FRST
2019-07-30 21:58 - 2019-07-30 21:58 - 000275232 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mbamswissarmy.sys
2019-07-30 21:47 - 2019-07-30 21:47 - 002096128 _____ (Farbar) C:\Users\*****\Desktop\FRST64.exe
2019-07-30 21:26 - 2019-07-30 21:26 - 000001944 _____ C:\Users\*****\Desktop\trojaner2.txt
2019-07-30 21:17 - 2019-07-30 21:17 - 000089239 _____ C:\Users\*****\Desktop\trojaner.txt
2019-07-30 21:11 - 2019-07-30 21:11 - 000001912 _____ C:\Users\Public\Desktop\Malwarebytes.lnk
2019-07-30 21:11 - 2019-07-30 21:11 - 000000000 ____D C:\Users\*****\AppData\Local\mbamtray
2019-07-30 21:11 - 2019-07-30 21:11 - 000000000 ____D C:\Users\*****\AppData\Local\mbam
2019-07-30 21:11 - 2019-07-30 21:11 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes
2019-07-30 21:11 - 2019-01-08 16:32 - 000153328 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mbae64.sys
2019-07-30 21:10 - 2019-07-30 21:10 - 000000000 ____D C:\ProgramData\Malwarebytes
2019-07-30 21:10 - 2019-07-30 21:10 - 000000000 ____D C:\Program Files\Malwarebytes
2019-07-30 21:09 - 2019-07-30 21:09 - 000000000 ____D C:\WINDOWS\pss
2019-07-30 20:49 - 2019-07-30 20:49 - 000388992 _____ C:\Users\*****\Desktop\bookmarksJ.html
2019-07-30 20:47 - 2019-07-30 20:47 - 000051801 _____ C:\Users\**\Desktop\bookmarksL.html
2019-07-30 20:26 - 2019-07-30 20:27 - 000000000 ____D C:\AdwCleaner
2019-07-30 20:24 - 2019-07-30 20:25 - 007623880 _____ (Malwarebytes) C:\Users\*****\Desktop\adwcleaner_7.4.exe
2019-07-30 20:15 - 2019-07-30 20:15 - 000000000 ____D C:\Users\*****\AppData\Local\D3DSCache
2019-07-30 20:04 - 2019-07-30 21:58 - 000000000 ____D C:\Program Files (x86)\Spybot - Search & Destroy 2
2019-07-30 20:04 - 2019-07-30 20:25 - 000000000 ____D C:\ProgramData\Spybot - Search & Destroy
2019-07-30 20:04 - 2019-07-30 20:04 - 000001507 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot-S&D Start Center.lnk
2019-07-30 20:04 - 2019-07-30 20:04 - 000001495 _____ C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk
2019-07-30 20:04 - 2019-07-30 20:04 - 000000000 ____D C:\WINDOWS\System32\Tasks\Safer-Networking
2019-07-30 20:04 - 2019-07-30 20:04 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy 2
2019-07-30 20:04 - 2018-02-06 19:04 - 000032168 _____ (Safer-Networking Ltd.) C:\WINDOWS\system32\sdnclean64.exe
2019-07-30 20:01 - 2019-07-30 20:04 - 069910960 _____ (Safer-Networking Ltd. ) C:\Users\*****\Desktop\spybotsd-2.7.64.0.exe
2019-07-27 14:10 - 2019-07-27 14:10 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Intel
2019-07-27 12:14 - 2019-07-27 12:15 - 000000000 ____D C:\Users\**\Desktop\SAP-USB
2019-07-27 12:12 - 2019-07-27 12:12 - 001680991 _____ C:\Users\**\Desktop\mssstool0221.zip
2019-07-27 12:01 - 2019-07-30 21:58 - 094896128 _____ C:\WINDOWS\system32\config\SOFTWARE
2019-07-27 11:52 - 2019-07-27 12:01 - 000000000 ____D C:\WINDOWS\Microsoft Antimalware
2019-07-25 01:04 - 2019-07-25 01:04 - 000000000 ____D C:\ProgramData\TmpLoog
2019-07-25 00:44 - 2019-07-25 00:44 - 000000000 ____D C:\Users\**\AppData\LocalLow\lltgznTbqqOCq
2019-07-25 00:41 - 2019-07-25 00:42 - 000000000 ____D C:\WINDOWS\System32\Tasks\System
2019-07-25 00:41 - 2019-07-25 00:41 - 000000000 ____D C:\ProgramData\Lamia
2019-07-25 00:40 - 2019-07-25 00:40 - 000004074 _____ C:\WINDOWS\System32\Tasks\lqerkybtsayax
2019-07-25 00:40 - 2019-07-25 00:40 - 000003356 _____ C:\WINDOWS\System32\Tasks\EJlCPXAxczfLnX
2019-07-25 00:40 - 2019-07-25 00:40 - 000003352 _____ C:\WINDOWS\System32\Tasks\rescncttloqaqcg
2019-07-25 00:40 - 2019-07-25 00:40 - 000003044 _____ C:\WINDOWS\System32\Tasks\WZdwAMJoIRSYG2
2019-07-25 00:40 - 2019-07-25 00:40 - 000003034 _____ C:\WINDOWS\System32\Tasks\ibZIUHjYTxUPTmNsU2
2019-07-25 00:40 - 2019-07-25 00:40 - 000003026 _____ C:\WINDOWS\System32\Tasks\WByhYcedlOQavqREWte2
2019-07-25 00:40 - 2019-07-25 00:40 - 000003008 _____ C:\WINDOWS\System32\Tasks\KJMNwfnoaWMfhxH2
2019-07-25 00:40 - 2019-07-25 00:40 - 000000000 ____D C:\ProgramData\LUBciApiRJzrvXVB
2019-07-25 00:39 - 2019-07-25 00:41 - 000000000 ____D C:\Users\**\AppData\Local\Mail.Ru
2019-07-25 00:39 - 2019-07-25 00:40 - 000000000 ____D C:\ProgramData\Mail.Ru
2019-07-25 00:39 - 2019-07-25 00:39 - 000825856 _____ C:\Default.xml
2019-07-25 00:39 - 2019-07-25 00:39 - 000000000 ____D C:\ProgramData\Loosger
2019-07-25 00:38 - 2019-07-25 00:38 - 004059136 _____ C:\Users\**\Downloads\setup_f5ac96a97f5f.iso
2019-07-25 00:36 - 2019-07-25 00:36 - 007856585 _____ C:\Users\**\Downloads\K-ON!! MOD COMPLETE .rar
2019-07-25 00:36 - 2019-07-25 00:36 - 001132644 _____ C:\Users\**\Downloads\Nakano Azusa.rar
2019-07-24 23:11 - 2019-07-24 23:11 - 000000000 ____D C:\Users\**\AppData\Roaming\WinRAR
2019-07-24 23:11 - 2019-07-24 23:11 - 000000000 ____D C:\Users\**\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR
2019-07-24 23:11 - 2019-07-24 23:11 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinRAR
2019-07-24 23:11 - 2019-07-24 23:11 - 000000000 ____D C:\Program Files (x86)\WinRAR
2019-07-24 23:10 - 2019-07-24 23:10 - 002918616 _____ (Alexander Roshal) C:\Users\**\Downloads\wrar571.exe
2019-07-24 23:05 - 2019-07-24 23:05 - 000147094 _____ C:\Users\**\Downloads\SilentPatchSA.zip
2019-07-24 23:04 - 2019-07-24 23:04 - 000039315 _____ C:\Users\**\Downloads\asiloader.rar
2019-07-24 23:00 - 2019-07-24 23:20 - 000000000 ____D C:\Users\**\Documents\GTA San Andreas User Files
2019-07-24 23:00 - 2008-10-15 06:22 - 005631312 _____ (Microsoft Corporation) C:\WINDOWS\system32\D3DX9_40.dll
2019-07-24 23:00 - 2008-10-15 06:22 - 004379984 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\D3DX9_40.dll
2019-07-24 23:00 - 2008-10-15 06:22 - 002605920 _____ (Microsoft Corporation) C:\WINDOWS\system32\D3DCompiler_40.dll
2019-07-24 23:00 - 2008-10-15 06:22 - 002036576 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\D3DCompiler_40.dll
2019-07-24 23:00 - 2008-10-15 06:22 - 000519000 _____ (Microsoft Corporation) C:\WINDOWS\system32\d3dx10_40.dll
2019-07-24 23:00 - 2008-10-15 06:22 - 000452440 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d3dx10_40.dll
2019-07-24 21:13 - 2019-07-24 21:13 - 000001315 _____ C:\Users\Public\Desktop\Age of Empires - The Rise of Rome color fix.lnk
2019-07-24 21:13 - 2019-07-24 21:13 - 000001306 _____ C:\Users\Public\Desktop\Age of Empires color fix.lnk
2019-07-24 21:13 - 2019-07-24 21:13 - 000001185 _____ C:\Users\Public\Desktop\Age of Empires - The Rise of Rome.lnk
2019-07-24 21:13 - 2019-07-24 21:13 - 000001178 _____ C:\Users\Public\Desktop\Age of Empires.lnk
2019-07-24 21:13 - 2019-07-24 21:13 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Age of Empires complete
2019-07-24 21:13 - 2019-07-24 21:13 - 000000000 ____D C:\Program Files (x86)\Age of Empires complete
2019-07-24 19:25 - 2019-07-24 19:25 - 000000221 _____ C:\Users\**\Desktop\Grand Theft Auto San Andreas.url
2019-07-24 19:25 - 2019-07-24 19:25 - 000000000 ____D C:\Users\**\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Steam
2019-07-24 19:23 - 2019-07-25 01:01 - 000000000 ____D C:\Program Files\Mozilla Firefox
2019-07-24 19:20 - 2019-07-24 19:20 - 000000000 ____D C:\Users\**\AppData\Local\Steam
2019-07-24 19:20 - 2019-07-24 19:20 - 000000000 ____D C:\Users\**\AppData\Local\CEF
2019-07-24 19:11 - 2019-07-24 19:11 - 001573568 _____ C:\Users\**\Downloads\SteamSetup.exe
2019-07-24 19:11 - 2019-07-24 19:11 - 000001036 _____ C:\Users\Public\Desktop\Steam.lnk
2019-07-24 19:11 - 2019-07-24 19:11 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Steam
2019-07-13 17:03 - 2019-07-13 17:03 - 000004590 _____ C:\WINDOWS\System32\Tasks\Adobe Flash Player NPAPI Notifier
2019-07-13 17:03 - 2019-07-13 17:03 - 000004424 _____ C:\WINDOWS\System32\Tasks\Adobe Flash Player Updater
2019-07-13 16:59 - 2019-07-13 16:59 - 000716789 _____ C:\WINDOWS\SysWOW64\unins000.exe
2019-07-13 16:59 - 2019-07-13 16:59 - 000001770 _____ C:\WINDOWS\SysWOW64\unins000.dat
2019-07-13 16:59 - 2019-04-10 14:55 - 000290816 _____ (www.xjghost.com) C:\WINDOWS\SysWOW64\WebClientPlayBack.ocx
2019-07-13 16:59 - 2019-04-10 14:45 - 000229484 _____ () C:\WINDOWS\SysWOW64\WebClientPlus.ocx
2019-07-13 16:59 - 2019-03-29 09:22 - 000004240 _____ C:\WINDOWS\SysWOW64\lang_spanish.ini
2019-07-13 16:59 - 2019-03-29 09:16 - 000004250 _____ C:\WINDOWS\SysWOW64\lang_italy.ini
2019-07-13 16:59 - 2019-03-29 09:12 - 000004624 _____ C:\WINDOWS\SysWOW64\lang_franch.ini
2019-07-13 16:59 - 2019-03-29 09:09 - 000004404 _____ C:\WINDOWS\SysWOW64\lang_germany.ini
2019-07-13 16:59 - 2019-03-28 10:33 - 000002698 _____ C:\WINDOWS\SysWOW64\lang_chn.ini
2019-07-13 16:59 - 2019-01-11 16:02 - 000245760 _____ () C:\WINDOWS\SysWOW64\NetLib.dll
2019-07-13 16:59 - 2019-01-11 15:55 - 000081920 _____ () C:\WINDOWS\SysWOW64\hiPBClient.dll
2019-07-13 16:59 - 2018-11-12 18:10 - 000417792 _____ () C:\WINDOWS\SysWOW64\HIPlayer.dll
2019-07-13 16:59 - 2018-11-07 11:26 - 000319488 _____ () C:\WINDOWS\SysWOW64\HIPlayer.exe
2019-07-13 16:59 - 2018-11-07 10:38 - 000057344 _____ () C:\WINDOWS\SysWOW64\HISDK.dll
2019-07-13 16:59 - 2018-11-07 09:57 - 000573952 _____ C:\WINDOWS\SysWOW64\Hi265.dll
2019-07-13 16:59 - 2014-04-10 14:28 - 000057344 _____ (微软中国) C:\WINDOWS\SysWOW64\SearchLib.dll
2019-07-13 16:59 - 2013-07-10 17:21 - 000217600 _____ C:\WINDOWS\SysWOW64\npzxwebplugin.dll
2019-07-13 16:59 - 2012-09-25 21:39 - 002555406 _____ C:\WINDOWS\SysWOW64\avcodec-54.dll
2019-07-13 16:59 - 2012-09-25 21:39 - 000157198 _____ C:\WINDOWS\SysWOW64\avutil-51.dll
2019-07-13 16:59 - 2010-08-23 20:07 - 000562220 _____ C:\WINDOWS\SysWOW64\AlarmSound.wav
2019-07-13 16:58 - 2019-07-13 16:58 - 002036967 _____ ( ) C:\Users\*****\Desktop\ClientPlus_Setup.exe
2019-07-13 16:47 - 2019-07-13 16:47 - 000001906 _____ C:\Users\*****\Desktop\HiPlayer.exe.lnk
2019-07-13 16:47 - 2019-07-13 16:47 - 000000000 ____D C:\Users\*****\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\HiPlayer
2019-07-13 16:47 - 2019-07-13 16:47 - 000000000 ____D C:\Users\*****\AppData\Roaming\HiPlayer
2019-07-09 19:25 - 2019-07-04 11:40 - 021390504 _____ (Microsoft Corporation) C:\WINDOWS\system32\shell32.dll
2019-07-09 19:25 - 2019-07-04 11:40 - 001616840 _____ (Microsoft Corporation) C:\WINDOWS\system32\sppobjs.dll
2019-07-09 19:25 - 2019-07-04 11:18 - 003614208 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32kfull.sys
2019-07-09 19:25 - 2019-07-04 10:51 - 020384128 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\shell32.dll
2019-07-09 19:25 - 2019-07-04 10:37 - 002882048 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\win32kfull.sys
2019-07-09 19:25 - 2019-07-04 07:00 - 001035040 _____ (Microsoft Corporation) C:\WINDOWS\system32\ApplyTrustOffline.exe
2019-07-09 19:25 - 2019-07-04 06:58 - 001219896 _____ (Microsoft Corporation) C:\WINDOWS\system32\hvix64.exe
2019-07-09 19:25 - 2019-07-04 06:57 - 003292152 _____ (Microsoft Corporation) C:\WINDOWS\system32\combase.dll
2019-07-09 19:25 - 2019-07-04 06:56 - 009084216 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntoskrnl.exe
2019-07-09 19:25 - 2019-07-04 06:56 - 007519896 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.Protection.PlayReady.dll
2019-07-09 19:25 - 2019-07-04 06:56 - 007436536 _____ (Microsoft Corporation) C:\WINDOWS\system32\windows.storage.dll
2019-07-09 19:25 - 2019-07-04 06:56 - 002810680 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgkrnl.sys
2019-07-09 19:25 - 2019-07-04 06:42 - 006570368 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.Protection.PlayReady.dll
2019-07-09 19:25 - 2019-07-04 06:42 - 006044008 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\windows.storage.dll
2019-07-09 19:25 - 2019-07-04 06:42 - 002479176 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\combase.dll
2019-07-09 19:25 - 2019-07-04 06:37 - 025857536 _____ (Microsoft Corporation) C:\WINDOWS\system32\edgehtml.dll
2019-07-09 19:25 - 2019-07-04 06:33 - 022017536 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\edgehtml.dll
2019-07-09 19:25 - 2019-07-04 06:29 - 022717440 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll
2019-07-09 19:25 - 2019-07-04 06:26 - 004385280 _____ (Microsoft Corporation) C:\WINDOWS\system32\EdgeContent.dll
2019-07-09 19:25 - 2019-07-04 06:25 - 019372544 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll
2019-07-09 19:25 - 2019-07-04 06:25 - 007589888 _____ (Microsoft Corporation) C:\WINDOWS\system32\Chakra.dll
2019-07-09 19:25 - 2019-07-04 06:25 - 004861440 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll
2019-07-09 19:25 - 2019-07-04 06:25 - 003401216 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentServer.dll
2019-07-09 19:25 - 2019-07-04 06:22 - 003707904 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll
2019-07-09 19:25 - 2019-07-04 06:21 - 005784064 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Chakra.dll
2019-07-09 19:25 - 2019-07-04 06:21 - 003202560 _____ (Microsoft Corporation) C:\WINDOWS\system32\DWrite.dll
2019-07-09 19:25 - 2019-06-13 14:12 - 002871848 _____ (Microsoft Corporation) C:\WINDOWS\system32\aitstatic.exe
2019-07-09 19:25 - 2019-06-13 14:05 - 000810296 _____ (Microsoft Corporation) C:\WINDOWS\system32\generaltel.dll
2019-07-09 19:25 - 2019-06-13 14:04 - 001721144 _____ (Microsoft Corporation) C:\WINDOWS\system32\appraiser.dll
2019-07-09 19:25 - 2019-06-13 13:59 - 000740664 _____ (Microsoft Corporation) C:\WINDOWS\system32\aeinv.dll
2019-07-09 19:25 - 2019-06-13 13:42 - 004038688 _____ (Microsoft Corporation) C:\WINDOWS\explorer.exe
2019-07-09 19:25 - 2019-06-13 13:18 - 006586880 _____ (Microsoft Corporation) C:\WINDOWS\system32\twinui.dll
2019-07-09 19:25 - 2019-06-13 13:18 - 004847104 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingsHandlers_nt.dll
2019-07-09 19:25 - 2019-06-13 13:17 - 012756992 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll
2019-07-09 19:25 - 2019-06-13 13:15 - 004718080 _____ (Microsoft Corporation) C:\WINDOWS\system32\twinui.pcshell.dll
2019-07-09 19:25 - 2019-06-13 13:13 - 002920448 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Logon.dll
2019-07-09 19:25 - 2019-06-13 12:11 - 001539896 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AppVEntSubsystems32.dll
2019-07-09 19:25 - 2019-06-13 12:05 - 003700160 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\explorer.exe
2019-07-09 19:25 - 2019-06-13 11:55 - 005657088 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\twinui.dll
2019-07-09 19:25 - 2019-06-13 11:54 - 011942912 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll
2019-07-09 19:25 - 2019-06-13 09:01 - 000513336 _____ (Microsoft Corporation) C:\WINDOWS\system32\aepic.dll
2019-07-09 19:25 - 2019-06-13 08:47 - 005625160 _____ (Microsoft Corporation) C:\WINDOWS\system32\StartTileData.dll
2019-07-09 19:25 - 2019-06-13 08:44 - 002769688 _____ (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll
2019-07-09 19:25 - 2019-06-13 08:14 - 003318784 _____ (Microsoft Corporation) C:\WINDOWS\system32\dwmcore.dll
2019-07-09 19:25 - 2019-06-13 08:13 - 004771840 _____ (Microsoft Corporation) C:\WINDOWS\system32\InputService.dll
2019-07-09 19:25 - 2019-06-13 07:14 - 000415544 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\aepic.dll
2019-07-09 19:25 - 2019-06-13 07:06 - 002256768 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iertutil.dll
2019-07-09 19:24 - 2019-07-04 11:45 - 001786680 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVEntVirtualization.dll
2019-07-09 19:24 - 2019-07-04 11:43 - 000094008 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpudd.dll
2019-07-09 19:24 - 2019-07-04 11:41 - 000304144 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\mssecflt.sys
2019-07-09 19:24 - 2019-07-04 11:40 - 001631808 _____ (Microsoft Corporation) C:\WINDOWS\system32\gdi32full.dll
2019-07-09 19:24 - 2019-07-04 11:40 - 000790416 _____ (Microsoft Corporation) C:\WINDOWS\system32\fontdrvhost.exe
2019-07-09 19:24 - 2019-07-04 11:22 - 000131072 _____ (Microsoft Corporation) C:\WINDOWS\splwow64.exe
2019-07-09 19:24 - 2019-07-04 11:22 - 000128000 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppxSysprep.dll
2019-07-09 19:24 - 2019-07-04 11:21 - 008627200 _____ (Microsoft Corporation) C:\WINDOWS\system32\mstscax.dll
2019-07-09 19:24 - 2019-07-04 11:20 - 001609216 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpcorets.dll
2019-07-09 19:24 - 2019-07-04 11:19 - 000420864 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpclip.exe
2019-07-09 19:24 - 2019-07-04 11:18 - 001663488 _____ (Microsoft Corporation) C:\WINDOWS\system32\GdiPlus.dll
2019-07-09 19:24 - 2019-07-04 10:56 - 001453416 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\gdi32full.dll
2019-07-09 19:24 - 2019-07-04 10:54 - 000662352 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\fontdrvhost.exe
2019-07-09 19:24 - 2019-07-04 10:41 - 007990784 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mstscax.dll
2019-07-09 19:24 - 2019-07-04 10:36 - 001471488 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\GdiPlus.dll
2019-07-09 19:24 - 2019-07-04 06:58 - 001328440 _____ (Microsoft Corporation) C:\WINDOWS\system32\wpx.dll
2019-07-09 19:24 - 2019-07-04 06:58 - 000416312 _____ (Microsoft Corporation) C:\WINDOWS\system32\wlanapi.dll
2019-07-09 19:24 - 2019-07-04 06:58 - 000192824 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\appid.sys
2019-07-09 19:24 - 2019-07-04 06:57 - 001027384 _____ (Microsoft Corporation) C:\WINDOWS\system32\hvax64.exe
2019-07-09 19:24 - 2019-07-04 06:57 - 000986128 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingSyncHost.exe
2019-07-09 19:24 - 2019-07-04 06:57 - 000776784 _____ (Microsoft Corporation) C:\WINDOWS\system32\wer.dll
2019-07-09 19:24 - 2019-07-04 06:57 - 000723728 _____ (Microsoft Corporation) C:\WINDOWS\system32\ci.dll
2019-07-09 19:24 - 2019-07-04 06:57 - 000708696 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\cng.sys
2019-07-09 19:24 - 2019-07-04 06:57 - 000568104 _____ (Microsoft Corporation) C:\WINDOWS\system32\tcblaunch.exe
2019-07-09 19:24 - 2019-07-04 06:57 - 000362264 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Storage.ApplicationData.dll
2019-07-09 19:24 - 2019-07-04 06:57 - 000209424 _____ (Microsoft Corporation) C:\WINDOWS\system32\wermgr.exe
2019-07-09 19:24 - 2019-07-04 06:57 - 000194360 _____ (Microsoft Corporation) C:\WINDOWS\system32\skci.dll
2019-07-09 19:24 - 2019-07-04 06:57 - 000137656 _____ (Microsoft Corporation) C:\WINDOWS\system32\bcrypt.dll
2019-07-09 19:24 - 2019-07-04 06:57 - 000134968 _____ (Microsoft Corporation) C:\WINDOWS\system32\hvloader.dll
2019-07-09 19:24 - 2019-07-04 06:57 - 000091776 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dumpfve.sys
2019-07-09 19:24 - 2019-07-04 06:56 - 002571640 _____ (Microsoft Corporation) C:\WINDOWS\system32\KernelBase.dll
2019-07-09 19:24 - 2019-07-04 06:56 - 001566520 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppxPackaging.dll
2019-07-09 19:24 - 2019-07-04 06:56 - 001459120 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.efi
2019-07-09 19:24 - 2019-07-04 06:56 - 001260776 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.exe
2019-07-09 19:24 - 2019-07-04 06:56 - 001141496 _____ (Microsoft Corporation) C:\WINDOWS\system32\winresume.efi
2019-07-09 19:24 - 2019-07-04 06:56 - 000983936 _____ (Microsoft Corporation) C:\WINDOWS\system32\winresume.exe
2019-07-09 19:24 - 2019-07-04 06:56 - 000767536 _____ (Microsoft Corporation) C:\WINDOWS\system32\dnsapi.dll
2019-07-09 19:24 - 2019-07-04 06:56 - 000734952 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentClient.dll
2019-07-09 19:24 - 2019-07-04 06:56 - 000713272 _____ (Microsoft Corporation) C:\WINDOWS\system32\MSVideoDSP.dll
2019-07-09 19:24 - 2019-07-04 06:56 - 000604984 _____ (Microsoft Corporation) C:\WINDOWS\system32\securekernel.exe
2019-07-09 19:24 - 2019-07-04 06:56 - 000493752 _____ (Microsoft Corporation) C:\WINDOWS\system32\bcryptprimitives.dll
2019-07-09 19:24 - 2019-07-04 06:56 - 000115512 _____ (Microsoft Corporation) C:\WINDOWS\system32\kdnet.dll
2019-07-09 19:24 - 2019-07-04 06:43 - 000832016 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SettingSyncHost.exe
2019-07-09 19:24 - 2019-07-04 06:43 - 000665440 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wer.dll
2019-07-09 19:24 - 2019-07-04 06:43 - 000328696 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wlanapi.dll
2019-07-09 19:24 - 2019-07-04 06:43 - 000287376 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Storage.ApplicationData.dll
2019-07-09 19:24 - 2019-07-04 06:43 - 000191800 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wermgr.exe
2019-07-09 19:24 - 2019-07-04 06:42 - 001980984 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\KernelBase.dll
2019-07-09 19:24 - 2019-07-04 06:42 - 001427768 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AppxPackaging.dll
2019-07-09 19:24 - 2019-07-04 06:42 - 000573808 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dnsapi.dll
2019-07-09 19:24 - 2019-07-04 06:42 - 000356312 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\bcryptprimitives.dll
2019-07-09 19:24 - 2019-07-04 06:42 - 000097272 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\bcrypt.dll
2019-07-09 19:24 - 2019-07-04 06:41 - 000559328 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AppXDeploymentClient.dll
2019-07-09 19:24 - 2019-07-04 06:26 - 000310272 _____ (Microsoft Corporation) C:\WINDOWS\system32\wc_storage.dll
2019-07-09 19:24 - 2019-07-04 06:26 - 000051200 _____ (Microsoft Corporation) C:\WINDOWS\system32\TpmTasks.dll
2019-07-09 19:24 - 2019-07-04 06:25 - 000295424 _____ (Microsoft Corporation) C:\WINDOWS\system32\TDLMigration.dll
2019-07-09 19:24 - 2019-07-04 06:25 - 000079872 _____ (Microsoft Corporation) C:\WINDOWS\system32\offreg.dll
2019-07-09 19:24 - 2019-07-04 06:24 - 000726528 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\PEAuth.sys
2019-07-09 19:24 - 2019-07-04 06:24 - 000567808 _____ (Microsoft Corporation) C:\WINDOWS\system32\daxexec.dll
2019-07-09 19:24 - 2019-07-04 06:24 - 000462336 _____ (Microsoft Corporation) C:\WINDOWS\system32\bcdedit.exe
2019-07-09 19:24 - 2019-07-04 06:24 - 000153600 _____ (Microsoft Corporation) C:\WINDOWS\system32\dssvc.dll
2019-07-09 19:24 - 2019-07-04 06:23 - 001765888 _____ (Microsoft Corporation) C:\WINDOWS\system32\audiosrv.dll
2019-07-09 19:24 - 2019-07-04 06:23 - 001217536 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpcore.dll
2019-07-09 19:24 - 2019-07-04 06:23 - 000786432 _____ (Microsoft Corporation) C:\WINDOWS\system32\iphlpsvc.dll
2019-07-09 19:24 - 2019-07-04 06:22 - 002587648 _____ (Microsoft Corporation) C:\WINDOWS\system32\wlansvc.dll
2019-07-09 19:24 - 2019-07-04 06:22 - 002176000 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentExtensions.onecore.dll
2019-07-09 19:24 - 2019-07-04 06:22 - 001561088 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentExtensions.desktop.dll
2019-07-09 19:24 - 2019-07-04 06:22 - 001549824 _____ (Microsoft Corporation) C:\WINDOWS\system32\lsasrv.dll
2019-07-09 19:24 - 2019-07-04 06:22 - 001175552 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingSyncCore.dll
2019-07-09 19:24 - 2019-07-04 06:22 - 000300544 _____ (Microsoft Corporation) C:\WINDOWS\system32\dnsrslvr.dll
2019-07-09 19:24 - 2019-07-04 06:22 - 000110592 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\profext.dll
2019-07-09 19:24 - 2019-07-04 06:22 - 000032768 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\werdiagcontroller.dll
2019-07-09 19:24 - 2019-07-04 06:21 - 005307392 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d2d1.dll
2019-07-09 19:24 - 2019-07-04 06:21 - 002166784 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32kbase.sys
2019-07-09 19:24 - 2019-07-04 06:21 - 001920000 _____ (Microsoft Corporation) C:\WINDOWS\system32\FntCache.dll
2019-07-09 19:24 - 2019-07-04 06:21 - 001220608 _____ (Microsoft Corporation) C:\WINDOWS\system32\Unistore.dll
2019-07-09 19:24 - 2019-07-04 06:21 - 000324096 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppxAllUserStore.dll
2019-07-09 19:24 - 2019-07-04 06:21 - 000124416 _____ (Microsoft Corporation) C:\WINDOWS\system32\profext.dll
2019-07-09 19:24 - 2019-07-04 06:21 - 000059392 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\offreg.dll
2019-07-09 19:24 - 2019-07-04 06:20 - 001156608 _____ (Microsoft Corporation) C:\WINDOWS\system32\rpcss.dll
2019-07-09 19:24 - 2019-07-04 06:20 - 000544256 _____ (Microsoft Corporation) C:\WINDOWS\system32\vbscript.dll
2019-07-09 19:24 - 2019-07-04 06:20 - 000392704 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\daxexec.dll
2019-07-09 19:24 - 2019-07-04 06:20 - 000330752 _____ (Microsoft Corporation) C:\WINDOWS\system32\ncryptprov.dll
2019-07-09 19:24 - 2019-07-04 06:19 - 000886272 _____ (Microsoft Corporation) C:\WINDOWS\system32\MPSSVC.dll
2019-07-09 19:24 - 2019-07-04 06:19 - 000230912 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AppxAllUserStore.dll
2019-07-09 19:24 - 2019-07-04 06:18 - 002602496 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\DWrite.dll
2019-07-09 19:24 - 2019-07-04 06:18 - 001076224 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rdpcore.dll
2019-07-09 19:24 - 2019-07-04 06:18 - 000965632 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Unistore.dll
2019-07-09 19:24 - 2019-07-04 06:18 - 000953344 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SettingSyncCore.dll
2019-07-09 19:24 - 2019-07-04 06:18 - 000275968 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ncryptprov.dll
2019-07-09 19:24 - 2019-07-04 06:17 - 000531968 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\vbscript.dll
2019-07-09 19:24 - 2019-07-04 05:01 - 000001312 _____ C:\WINDOWS\system32\tcbres.wim
2019-07-09 19:24 - 2019-06-21 10:50 - 000280584 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\msiscsi.sys
2019-07-09 19:24 - 2019-06-13 14:15 - 000324408 _____ (Microsoft Corporation) C:\WINDOWS\system32\acmigration.dll
2019-07-09 19:24 - 2019-06-13 14:00 - 000464696 _____ (Microsoft Corporation) C:\WINDOWS\system32\invagent.dll
2019-07-09 19:24 - 2019-06-13 13:58 - 000637752 _____ (Microsoft Corporation) C:\WINDOWS\system32\devinv.dll
2019-07-09 19:24 - 2019-06-13 13:58 - 000071480 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32appinventorycsp.dll
2019-07-09 19:24 - 2019-06-13 13:56 - 000164152 _____ (Microsoft Corporation) C:\WINDOWS\system32\CompatTelRunner.exe
2019-07-09 19:24 - 2019-06-13 13:43 - 001427984 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVEntSubsystemController.dll
2019-07-09 19:24 - 2019-06-13 13:43 - 001048480 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Internal.Shell.Broker.dll
2019-07-09 19:24 - 2019-06-13 13:42 - 002266936 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVEntSubsystems64.dll
2019-07-09 19:24 - 2019-06-13 13:42 - 000652088 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVPublishing.dll
2019-07-09 19:24 - 2019-06-13 13:42 - 000566536 _____ (Microsoft Corporation) C:\WINDOWS\system32\phoneactivate.exe
2019-07-09 19:24 - 2019-06-13 13:41 - 001626936 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVIntegration.dll
2019-07-09 19:24 - 2019-06-13 13:41 - 000830264 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVOrchestration.dll
2019-07-09 19:24 - 2019-06-13 13:41 - 000825144 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVEntStreamingManager.dll
2019-07-09 19:24 - 2019-06-13 13:41 - 000670008 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVCatalog.dll
2019-07-09 19:24 - 2019-06-13 13:40 - 000749880 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVReporting.dll
2019-07-09 19:24 - 2019-06-13 13:40 - 000540984 _____ (Microsoft Corporation) C:\WINDOWS\system32\pcasvc.dll
2019-07-09 19:24 - 2019-06-13 13:40 - 000495416 _____ (Microsoft Corporation) C:\WINDOWS\system32\TransportDSA.dll
2019-07-09 19:24 - 2019-06-13 13:38 - 000766264 _____ (Microsoft Corporation) C:\WINDOWS\system32\LicensingWinRT.dll
2019-07-09 19:24 - 2019-06-13 13:37 - 000101192 _____ (Microsoft Corporation) C:\WINDOWS\system32\changepk.exe
2019-07-09 19:24 - 2019-06-13 13:36 - 000251000 _____ (Microsoft Corporation) C:\WINDOWS\system32\sppwinob.dll
2019-07-09 19:24 - 2019-06-13 13:36 - 000236520 _____ (Microsoft Corporation) C:\WINDOWS\system32\EditionUpgradeManagerObj.dll
2019-07-09 19:24 - 2019-06-13 13:35 - 001376688 _____ (Microsoft Corporation) C:\WINDOWS\system32\ole32.dll
2019-07-09 19:24 - 2019-06-13 13:34 - 000146888 _____ (Microsoft Corporation) C:\WINDOWS\system32\LicensingUI.exe
2019-07-09 19:24 - 2019-06-13 13:17 - 000178176 _____ (Microsoft Corporation) C:\WINDOWS\system32\dmvdsitf.dll
2019-07-09 19:24 - 2019-06-13 13:17 - 000115200 _____ (Microsoft Corporation) C:\WINDOWS\system32\RjvMDMConfig.dll
2019-07-09 19:24 - 2019-06-13 13:17 - 000109056 _____ (Microsoft Corporation) C:\WINDOWS\system32\MDMAgent.exe
2019-07-09 19:24 - 2019-06-13 13:17 - 000093184 _____ (Microsoft Corporation) C:\WINDOWS\system32\WSReset.exe
2019-07-09 19:24 - 2019-06-13 13:16 - 000767488 _____ (Microsoft Corporation) C:\WINDOWS\system32\sppcommdlg.dll
2019-07-09 19:24 - 2019-06-13 13:15 - 000041984 _____ (Microsoft Corporation) C:\WINDOWS\system32\UpgradeResultsUI.exe
2019-07-09 19:24 - 2019-06-13 13:14 - 001127936 _____ (Microsoft Corporation) C:\WINDOWS\system32\nettrace.dll
2019-07-09 19:24 - 2019-06-13 13:14 - 000900096 _____ (Microsoft Corporation) C:\WINDOWS\system32\slui.exe
2019-07-09 19:24 - 2019-06-13 13:14 - 000346624 _____ (Microsoft Corporation) C:\WINDOWS\system32\AcGenral.dll
2019-07-09 19:24 - 2019-06-13 13:14 - 000246272 _____ (Microsoft Corporation) C:\WINDOWS\system32\DesktopSwitcherDataModel.dll
2019-07-09 19:24 - 2019-06-13 13:13 - 001339392 _____ (Microsoft Corporation) C:\WINDOWS\system32\TaskFlowDataEngine.dll
2019-07-09 19:24 - 2019-06-13 13:13 - 000951808 _____ (Microsoft Corporation) C:\WINDOWS\system32\sppcext.dll
2019-07-09 19:24 - 2019-06-13 13:13 - 000765440 _____ (Microsoft Corporation) C:\WINDOWS\system32\tdh.dll
2019-07-09 19:24 - 2019-06-13 13:13 - 000181248 _____ (Microsoft Corporation) C:\WINDOWS\system32\EditionUpgradeHelper.dll
2019-07-09 19:24 - 2019-06-13 13:12 - 000394240 _____ (Microsoft Corporation) C:\WINDOWS\system32\InputSwitch.dll
2019-07-09 19:24 - 2019-06-13 13:10 - 000239104 _____ (Microsoft Corporation) C:\WINDOWS\system32\vdsbas.dll
2019-07-09 19:24 - 2019-06-13 12:07 - 001027008 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ole32.dll
2019-07-09 19:24 - 2019-06-13 12:07 - 000660496 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\LicensingWinRT.dll
2019-07-09 19:24 - 2019-06-13 12:07 - 000221232 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\EditionUpgradeManagerObj.dll
2019-07-09 19:24 - 2019-06-13 11:54 - 000151552 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dmvdsitf.dll
2019-07-09 19:24 - 2019-06-13 11:53 - 000089600 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\olepro32.dll
2019-07-09 19:24 - 2019-06-13 11:51 - 000622080 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\tdh.dll
2019-07-09 19:24 - 2019-06-13 11:50 - 000896512 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\sppcext.dll
2019-07-09 19:24 - 2019-06-13 11:49 - 002406400 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AcGenral.dll
2019-07-09 19:24 - 2019-06-13 11:49 - 000371200 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\InputSwitch.dll
2019-07-09 19:24 - 2019-06-13 09:48 - 000677376 _____ (Microsoft Corporation) C:\WINDOWS\system32\HeadTrackerStorage.dll
2019-07-09 19:24 - 2019-06-13 09:46 - 000713216 _____ (Microsoft Corporation) C:\WINDOWS\system32\SharedRealitySvc.dll
2019-07-09 19:24 - 2019-06-13 09:01 - 000511288 _____ (Microsoft Corporation) C:\WINDOWS\system32\dcntel.dll
2019-07-09 19:24 - 2019-06-13 09:01 - 000036152 _____ (Microsoft Corporation) C:\WINDOWS\system32\DeviceCensus.exe
2019-07-09 19:24 - 2019-06-13 08:59 - 000785264 _____ (Microsoft Corporation) C:\WINDOWS\system32\pkeyhelper.dll
2019-07-09 19:24 - 2019-06-13 08:47 - 001063224 _____ (Microsoft Corporation) C:\WINDOWS\system32\SecConfig.efi
2019-07-09 19:24 - 2019-06-13 08:46 - 001076536 _____ (Microsoft Corporation) C:\WINDOWS\system32\efscore.dll
2019-07-09 19:24 - 2019-06-13 08:46 - 000510296 _____ (Microsoft Corporation) C:\WINDOWS\system32\policymanager.dll
2019-07-09 19:24 - 2019-06-13 08:46 - 000093984 _____ (Microsoft Corporation) C:\WINDOWS\system32\wldp.dll
2019-07-09 19:24 - 2019-06-13 08:45 - 002421560 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ntfs.sys
2019-07-09 19:24 - 2019-06-13 08:44 - 002546704 _____ (Microsoft Corporation) C:\WINDOWS\system32\UpdateAgent.dll
2019-07-09 19:24 - 2019-06-13 08:44 - 001098272 _____ (Microsoft Corporation) C:\WINDOWS\system32\msvproc.dll
2019-07-09 19:24 - 2019-06-13 08:44 - 001033696 _____ (Microsoft Corporation) C:\WINDOWS\system32\ClipSVC.dll
2019-07-09 19:24 - 2019-06-13 08:44 - 000607112 _____ (Microsoft Corporation) C:\WINDOWS\system32\TextInputFramework.dll
2019-07-09 19:24 - 2019-06-13 08:44 - 000545808 _____ (Microsoft Corporation) C:\WINDOWS\system32\hal.dll
2019-07-09 19:24 - 2019-06-13 08:44 - 000130624 _____ (Microsoft Corporation) C:\WINDOWS\system32\rmclient.dll
2019-07-09 19:24 - 2019-06-13 08:17 - 000106496 _____ (Microsoft Corporation) C:\WINDOWS\system32\NotificationControllerPS.dll
2019-07-09 19:24 - 2019-06-13 08:16 - 001626112 _____ (Microsoft Corporation) C:\WINDOWS\system32\enterprisecsps.dll
2019-07-09 19:24 - 2019-06-13 08:16 - 000140288 _____ (Microsoft Corporation) C:\WINDOWS\system32\mdmmigrator.dll
2019-07-09 19:24 - 2019-06-13 08:15 - 000514560 _____ (Microsoft Corporation) C:\WINDOWS\system32\nltest.exe
2019-07-09 19:24 - 2019-06-13 08:15 - 000433152 _____ (Microsoft Corporation) C:\WINDOWS\system32\MusNotification.exe
2019-07-09 19:24 - 2019-06-13 08:15 - 000204288 _____ (Microsoft Corporation) C:\WINDOWS\system32\enrollmentapi.dll
2019-07-09 19:24 - 2019-06-13 08:15 - 000137728 _____ (Microsoft Corporation) C:\WINDOWS\system32\InputLocaleManager.dll
2019-07-09 19:24 - 2019-06-13 08:15 - 000083456 _____ (Microsoft Corporation) C:\WINDOWS\system32\KdsCli.dll
2019-07-09 19:24 - 2019-06-13 08:14 - 000409088 _____ (Microsoft Corporation) C:\WINDOWS\system32\wlanmsm.dll
2019-07-09 19:24 - 2019-06-13 08:14 - 000361472 _____ (Microsoft Corporation) C:\WINDOWS\system32\DeviceEnroller.exe
2019-07-09 19:24 - 2019-06-13 08:14 - 000302080 _____ (Microsoft Corporation) C:\WINDOWS\system32\CXHProvisioningServer.dll
2019-07-09 19:24 - 2019-06-13 08:13 - 002370048 _____ (Microsoft Corporation) C:\WINDOWS\system32\WebRuntimeManager.dll
2019-07-09 19:24 - 2019-06-13 08:13 - 000761344 _____ (Microsoft Corporation) C:\WINDOWS\system32\nshwfp.dll
2019-07-09 19:24 - 2019-06-13 08:13 - 000322560 _____ (Microsoft Corporation) C:\WINDOWS\system32\MusNotificationUx.exe
2019-07-09 19:24 - 2019-06-13 08:13 - 000110592 _____ (Microsoft Corporation) C:\WINDOWS\system32\ngcpopkeysrv.dll
2019-07-09 19:24 - 2019-06-13 08:12 - 000916480 _____ (Microsoft Corporation) C:\WINDOWS\system32\MusUpdateHandlers.dll
2019-07-09 19:24 - 2019-06-13 08:12 - 000894464 _____ (Microsoft Corporation) C:\WINDOWS\system32\webplatstorageserver.dll
2019-07-09 19:24 - 2019-06-13 08:12 - 000808448 _____ (Microsoft Corporation) C:\WINDOWS\system32\EdgeManager.dll
2019-07-09 19:24 - 2019-06-13 08:12 - 000624640 _____ (Microsoft Corporation) C:\WINDOWS\system32\PsmServiceExtHost.dll
2019-07-09 19:24 - 2019-06-13 08:12 - 000532992 _____ (Microsoft Corporation) C:\WINDOWS\system32\QuietHours.dll
2019-07-09 19:24 - 2019-06-13 08:12 - 000501248 _____ (Microsoft Corporation) C:\WINDOWS\system32\rastls.dll
2019-07-09 19:24 - 2019-06-13 08:11 - 000508416 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingsHandlers_Notifications.dll
2019-07-09 19:24 - 2019-06-13 08:11 - 000271872 _____ (Microsoft Corporation) C:\WINDOWS\system32\wkssvc.dll
2019-07-09 19:24 - 2019-06-13 08:11 - 000048128 _____ (Microsoft Corporation) C:\WINDOWS\system32\TokenBrokerUI.dll
2019-07-09 19:24 - 2019-06-13 08:10 - 002912256 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuaueng.dll
2019-07-09 19:24 - 2019-06-13 08:10 - 001400832 _____ (Microsoft Corporation) C:\WINDOWS\system32\TokenBroker.dll
2019-07-09 19:24 - 2019-06-13 08:10 - 001215488 _____ (Microsoft Corporation) C:\WINDOWS\system32\NotificationController.dll
2019-07-09 19:24 - 2019-06-13 08:10 - 000871424 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.BackgroundMediaPlayback.dll
2019-07-09 19:24 - 2019-06-13 08:10 - 000869376 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.Playback.BackgroundMediaPlayer.dll
2019-07-09 19:24 - 2019-06-13 08:10 - 000849408 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.Playback.MediaPlayer.dll
2019-07-09 19:24 - 2019-06-13 08:10 - 000523776 _____ (Microsoft Corporation) C:\WINDOWS\system32\dmenrollengine.dll
2019-07-09 19:24 - 2019-06-13 08:09 - 001854976 _____ (Microsoft Corporation) C:\WINDOWS\system32\wevtsvc.dll
2019-07-09 19:24 - 2019-06-13 08:09 - 000922112 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Security.Authentication.Web.Core.dll
2019-07-09 19:24 - 2019-06-13 08:09 - 000755712 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Core.TextInput.dll
2019-07-09 19:24 - 2019-06-13 08:08 - 000506368 _____ (Microsoft Corporation) C:\WINDOWS\system32\edgeIso.dll
2019-07-09 19:24 - 2019-06-13 07:08 - 000443632 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\policymanager.dll
2019-07-09 19:24 - 2019-06-13 07:07 - 000101192 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rmclient.dll
2019-07-09 19:24 - 2019-06-13 07:07 - 000080744 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wldp.dll
2019-07-09 19:24 - 2019-06-13 07:06 - 001130776 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msvproc.dll
2019-07-09 19:24 - 2019-06-13 07:06 - 000581600 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MSVideoDSP.dll
2019-07-09 19:24 - 2019-06-13 06:49 - 000172544 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\enrollmentapi.dll
2019-07-09 19:24 - 2019-06-13 06:47 - 003554304 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\InputService.dll
2019-07-09 19:24 - 2019-06-13 06:47 - 002899456 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dwmcore.dll
2019-07-09 19:24 - 2019-06-13 06:47 - 000450048 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rastls.dll
2019-07-09 19:24 - 2019-06-13 06:46 - 000608768 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\EdgeManager.dll
2019-07-09 19:24 - 2019-06-13 06:46 - 000331776 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\edgeIso.dll
2019-07-09 19:24 - 2019-06-13 06:46 - 000038400 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TokenBrokerUI.dll
2019-07-09 19:24 - 2019-06-13 06:45 - 000602112 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\nshwfp.dll
2019-07-09 19:24 - 2019-06-13 06:45 - 000578560 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\webplatstorageserver.dll
2019-07-09 19:24 - 2019-06-13 06:44 - 001003008 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TokenBroker.dll
2019-07-09 19:24 - 2019-06-13 06:44 - 000648192 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.BackgroundMediaPlayback.dll
2019-07-09 19:24 - 2019-06-13 06:44 - 000630784 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.Playback.MediaPlayer.dll
2019-07-09 19:24 - 2019-06-13 06:44 - 000582144 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Core.TextInput.dll
2019-07-09 19:24 - 2019-06-13 06:44 - 000251904 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msIso.dll
2019-07-09 19:24 - 2019-06-13 06:43 - 000681472 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Security.Authentication.Web.Core.dll
2019-07-09 19:24 - 2019-06-13 06:43 - 000646656 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.Playback.BackgroundMediaPlayer.dll
2019-07-09 19:24 - 2019-06-13 06:43 - 000445952 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dmenrollengine.dll
2019-07-07 17:59 - 2019-07-07 18:10 - 234299675 _____ C:\Users\**\Desktop\Tajemství (The secret).mp4
2019-07-06 12:14 - 2019-07-06 12:02 - 000543307 _____ C:\Users\**\Desktop\banda_zlodejov_1.pdf
2019-06-30 12:12 - 2019-07-13 16:47 - 000000000 ____D C:\Users\*****\AppData\Roaming\InstallShield Installation Information
2019-06-30 12:12 - 2019-07-13 14:43 - 000000653 _____ C:\Users\*****\Desktop\Ip Camera Client.lnk
2019-06-30 12:12 - 2019-06-30 12:12 - 000000000 ____D C:\Users\*****\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\IP Camera
2019-06-30 12:09 - 2019-06-30 12:11 - 000000000 ____D C:\Users\*****\Desktop\SV3C

==================== One month (modified) ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2019-07-30 21:58 - 2018-12-20 22:18 - 000000000 ____D C:\Users\*****\AppData\LocalLow\Mozilla
2019-07-30 21:58 - 2018-12-20 22:11 - 000000000 __SHD C:\Users\*****\IntelGraphicsProfiles
2019-07-30 21:58 - 2018-12-14 18:56 - 000000006 ____H C:\WINDOWS\Tasks\SA.DAT
2019-07-30 21:58 - 2018-04-11 23:04 - 000786432 _____ C:\WINDOWS\system32\config\BBI
2019-07-30 21:40 - 2018-12-20 22:09 - 000730418 _____ C:\WINDOWS\system32\perfh007.dat
2019-07-30 21:40 - 2018-12-20 22:09 - 000149068 _____ C:\WINDOWS\system32\perfc007.dat
2019-07-30 21:40 - 2018-12-20 22:09 - 000116006 _____ C:\WINDOWS\system32\perfh01B.dat
2019-07-30 21:40 - 2018-12-20 22:09 - 000023440 _____ C:\WINDOWS\system32\perfc01B.dat
2019-07-30 21:40 - 2018-12-14 09:55 - 001841978 _____ C:\WINDOWS\system32\PerfStringBackup.INI
2019-07-30 21:40 - 2018-04-12 01:36 - 000000000 ____D C:\WINDOWS\INF
2019-07-30 21:23 - 2018-12-14 18:53 - 000000000 ____D C:\WINDOWS\system32\SleepStudy
2019-07-30 21:17 - 2018-12-20 22:11 - 000000000 ____D C:\Users\*****
2019-07-30 21:17 - 2018-12-14 18:54 - 000000000 ____D C:\Users\**
2019-07-30 21:09 - 2018-04-12 01:38 - 000000000 ____D C:\ProgramData\regid.1991-06.com.microsoft
2019-07-30 21:05 - 2018-12-20 21:44 - 000000000 ____D C:\Users\**\Desktop\Faktury-International-House
2019-07-30 20:48 - 2018-12-20 21:40 - 000000000 ____D C:\Users\**\AppData\LocalLow\Mozilla
2019-07-30 20:43 - 2018-12-20 22:22 - 000000000 ____D C:\Users\*****\Documents\Korespondencia
2019-07-30 20:41 - 2018-12-14 18:59 - 000000000 __SHD C:\Users\**\IntelGraphicsProfiles
2019-07-30 20:15 - 2018-04-12 01:38 - 000000000 ____D C:\WINDOWS\AppReadiness
2019-07-30 19:59 - 2018-04-12 01:38 - 000000000 ___HD C:\Program Files\WindowsApps
2019-07-27 14:11 - 2018-12-14 18:56 - 000000000 ____D C:\WINDOWS\system32\Drivers\wd
2019-07-27 14:10 - 2018-12-14 11:22 - 000000000 ____D C:\ProgramData\Package Cache
2019-07-27 14:10 - 2018-12-14 11:22 - 000000000 ____D C:\Program Files (x86)\Intel
2019-07-25 03:25 - 2018-04-12 01:38 - 000000000 ____D C:\WINDOWS\InfusedApps.tmp
2019-07-25 02:42 - 2018-04-12 01:38 - 000000000 ____D C:\WINDOWS\InfusedApps
2019-07-25 02:38 - 2018-04-12 01:38 - 000000000 ____D C:\WINDOWS\registration
2019-07-25 01:38 - 2018-12-17 09:13 - 000000000 ____D C:\Users\**\AppData\Local\D3DSCache
2019-07-25 01:01 - 2018-12-20 21:40 - 000000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2019-07-25 00:58 - 2018-04-12 01:38 - 000000000 ____D C:\WINDOWS\system32\NDF
2019-07-25 00:55 - 2019-01-05 16:50 - 000000000 ____D C:\Users\**\AppData\Local\ElevatedDiagnostics
2019-07-25 00:40 - 2015-10-30 09:24 - 000000000 ___HD C:\WINDOWS\system32\GroupPolicy
2019-07-24 23:06 - 2018-12-20 21:40 - 000001005 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Firefox.lnk
2019-07-24 22:59 - 2018-12-14 09:57 - 000000000 ____D C:\Users\**\AppData\Local\VirtualStore
2019-07-24 21:16 - 2018-04-12 01:33 - 000466432 _____ (Microsoft Corporation) C:\WINDOWS\system32\dpnet.dll
2019-07-24 21:16 - 2018-04-12 01:33 - 000390656 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dpnet.dll
2019-07-24 21:16 - 2018-04-12 01:33 - 000218112 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dplayx.dll
2019-07-24 21:16 - 2018-04-12 01:33 - 000067584 _____ (Microsoft Corporation) C:\WINDOWS\system32\dpnathlp.dll
2019-07-24 21:16 - 2018-04-12 01:33 - 000061440 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dpnathlp.dll
2019-07-24 21:16 - 2018-04-12 01:33 - 000046592 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dpwsockx.dll
2019-07-24 21:16 - 2018-04-12 01:33 - 000026624 _____ (Microsoft Corporation) C:\WINDOWS\system32\dpnsvr.exe
2019-07-24 21:16 - 2018-04-12 01:33 - 000024064 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dpmodemx.dll
2019-07-24 21:16 - 2018-04-12 01:33 - 000023040 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dpnsvr.exe
2019-07-24 21:16 - 2018-04-12 01:33 - 000020480 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dplaysvr.exe
2019-07-24 21:16 - 2018-04-12 01:33 - 000010240 _____ (Microsoft Corporation) C:\WINDOWS\system32\dpnhupnp.dll
2019-07-24 21:16 - 2018-04-12 01:33 - 000010240 _____ (Microsoft Corporation) C:\WINDOWS\system32\dpnhpast.dll
2019-07-24 21:16 - 2018-04-12 01:33 - 000008704 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dpnhupnp.dll
2019-07-24 21:16 - 2018-04-12 01:33 - 000008704 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dpnhpast.dll
2019-07-24 21:16 - 2018-04-12 01:33 - 000006144 _____ (Microsoft Corporation) C:\WINDOWS\system32\dpnlobby.dll
2019-07-24 21:16 - 2018-04-12 01:33 - 000006144 _____ (Microsoft Corporation) C:\WINDOWS\system32\dpnaddr.dll
2019-07-24 21:16 - 2018-04-12 01:33 - 000005120 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dpnlobby.dll
2019-07-24 21:16 - 2018-04-12 01:33 - 000005120 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dpnaddr.dll
2019-07-24 21:16 - 2018-04-12 01:30 - 000000000 ____D C:\WINDOWS\CbsTemp
2019-07-17 14:09 - 2018-12-14 09:57 - 000000000 ____D C:\Users\**\AppData\Local\Packages
2019-07-17 08:32 - 2018-12-14 11:11 - 000002313 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2019-07-17 08:32 - 2018-12-14 11:11 - 000002272 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2019-07-16 09:29 - 2018-12-20 21:44 - 000000000 ____D C:\Users\**\Desktop\Meditacie
2019-07-16 08:14 - 2018-12-20 21:48 - 000000000 ____D C:\Users\**\Documents\Ostatné
2019-07-13 17:03 - 2018-12-27 12:39 - 000000000 ____D C:\Users\*****\AppData\Local\Adobe
2019-07-13 17:03 - 2018-04-12 01:38 - 000000000 ____D C:\WINDOWS\SysWOW64\Macromed
2019-07-13 17:03 - 2018-04-12 01:38 - 000000000 ____D C:\WINDOWS\system32\Macromed
2019-07-13 17:02 - 2018-12-14 11:09 - 000000000 ____D C:\Users\**\AppData\Local\Adobe
2019-07-13 13:57 - 2018-12-20 22:16 - 000003380 _____ C:\WINDOWS\System32\Tasks\OneDrive Standalone Update Task-S-1-5-21-1960842775-2088100534-3542962694-1002
2019-07-13 13:57 - 2018-12-20 22:12 - 000000000 ___RD C:\Users\*****\OneDrive
2019-07-13 13:57 - 2018-12-20 22:11 - 000002383 _____ C:\Users\*****\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OneDrive.lnk
2019-07-13 13:56 - 2018-12-20 22:11 - 000000000 ___RD C:\Users\*****\3D Objects
2019-07-13 13:56 - 2018-12-14 09:57 - 000000000 __RHD C:\Users\Public\AccountPictures
2019-07-10 22:06 - 2018-12-14 10:50 - 000741432 ____N (Microsoft Corporation) C:\WINDOWS\system32\MpSigStub.exe
2019-07-09 21:11 - 2018-12-14 18:56 - 000000000 ___RD C:\Users\**\3D Objects
2019-07-09 21:10 - 2018-12-14 18:53 - 000399520 _____ C:\WINDOWS\system32\FNTCACHE.DAT
2019-07-09 21:10 - 2018-04-12 19:08 - 000000000 ____D C:\Program Files\Windows Defender Advanced Threat Protection
2019-07-09 21:10 - 2018-04-12 01:38 - 000000000 ____D C:\WINDOWS\TextInput
2019-07-09 21:10 - 2018-04-12 01:38 - 000000000 ____D C:\WINDOWS\SysWOW64\oobe
2019-07-09 21:10 - 2018-04-12 01:38 - 000000000 ____D C:\WINDOWS\SysWOW64\Dism
2019-07-09 21:10 - 2018-04-12 01:38 - 000000000 ____D C:\WINDOWS\system32\oobe
2019-07-09 21:10 - 2018-04-12 01:38 - 000000000 ____D C:\WINDOWS\system32\appraiser
2019-07-09 21:10 - 2018-04-12 01:38 - 000000000 ____D C:\WINDOWS\ShellComponents
2019-07-09 21:10 - 2018-04-12 01:38 - 000000000 ____D C:\WINDOWS\Provisioning
2019-07-09 21:10 - 2018-04-12 01:38 - 000000000 ____D C:\WINDOWS\bcastdvr
2019-07-09 21:10 - 2018-04-11 23:04 - 000000000 ____D C:\WINDOWS\system32\Dism
2019-07-09 19:24 - 2018-12-14 10:49 - 000000000 ____D C:\WINDOWS\system32\MRT
2019-07-09 19:21 - 2018-12-14 10:49 - 136618864 ____C (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2019-07-09 15:31 - 2018-12-14 18:56 - 000003380 _____ C:\WINDOWS\System32\Tasks\OneDrive Standalone Update Task-S-1-5-21-1960842775-2088100534-3542962694-1001
2019-07-09 15:31 - 2018-12-14 18:54 - 000002383 _____ C:\Users\**\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OneDrive.lnk
2019-07-09 15:31 - 2018-12-14 09:59 - 000000000 ___RD C:\Users\**\OneDrive
2019-07-02 16:55 - 2018-12-20 21:48 - 000000000 ____D C:\Users\**\Documents\materialy na vyuku
2019-06-30 12:12 - 2018-12-20 22:11 - 000000000 ____D C:\Users\*****\AppData\Local\Packages

==================== SigCheck ===============================

(There is no automatic fix for files that do not pass verification.)

==================== End of FRST.txt ============================
         

Addition.txt

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 30-07-2019 01
Ran by ** (30-07-2019 22:01:24)
Running from C:\Users\*****\Desktop
Windows 10 Pro Version 1803 17134.885 (X64) (2018-12-14 16:56:48)
Boot Mode: Normal
==========================================================


==================== Accounts: =============================

Administrator (S-1-5-21-1960842775-2088100534-3542962694-500 - Administrator - Disabled)
DefaultAccount (S-1-5-21-1960842775-2088100534-3542962694-503 - Limited - Disabled)
Guest (S-1-5-21-1960842775-2088100534-3542962694-501 - Limited - Disabled)
***** (S-1-5-21-1960842775-2088100534-3542962694-1002 - Limited - Enabled) => C:\Users\*****
** (S-1-5-21-1960842775-2088100534-3542962694-1001 - Administrator - Enabled) => C:\Users\**
WDAGUtilityAccount (S-1-5-21-1960842775-2088100534-3542962694-504 - Limited - Disabled)

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Spybot - Search and Destroy (Enabled - Up to date) {4C1D9672-63FE-5C90-371E-8FDA591C5B75}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

Adobe Acrobat Reader DC - Slovak (HKLM-x32\...\{AC76BA86-7AD7-1051-7B44-AC0F074E4100}) (Version: 19.012.20035 - Adobe Systems Incorporated)
Adobe Flash Player 32 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 32.0.0.223 - Adobe)
Age of Empires complete version 1.0c (HKLM-x32\...\{F7F0D70E-9027-4DF5-B67F-4B48CE29565A}_is1) (Version: 1.0c - vol1)
Balík softvéru eID (HKLM-x32\...\{69aff1f0-e530-4ac2-ab4f-88cb85aef940}) (Version: 1.0.0.0 - Ministerstvo vnútra Slovenskej republiky) Hidden
Balík softvéru eID (HKLM-x32\...\{d0db994b-7bbf-4a97-86ae-8e47ef7363e5}) (Version: 1.0.0.0 - Ministerstvo vnútra Slovenskej republiky) Hidden
Bit4id - miniLector (HKLM-x32\...\Bit4id - miniLector) (Version: 3.7 - Bit4id)
D.Launcher (x86) (HKLM-x32\...\{8A22CEA0-9DB7-4E30-898A-6D70F4E650CE}) (Version: 1.1.0.0 - DITEC, a.s.)
D.Signer/XAdES .NET so zásuvnými modulmi (x86) (HKLM-x32\...\{EB7D7F94-A539-4248-BCA3-2B105845284C}) (Version: 4.0.13 - DITEC, a.s.)
D.Signer/XAdES .NET Tools (x86) (HKLM-x32\...\{26E941A2-1EFF-4A3F-AD0B-6A423EFC2AAA}) (Version: 4.0.9 - DITEC, a.s.)
D.Suite/eIDAS (x86) (HKLM-x32\...\{f6fbc4ed-b1f8-4f4c-9b23-5b8e64af50b4}) (Version: 1.0.15 - DITEC, a.s.)
D.Viewer .NET (x86) (HKLM-x32\...\{967D2DE1-4E53-4700-9ED4-E4BCCD27E8F9}) (Version: 4.0.2025 - DITEC, a.s.)
Disig Web Signer 1.0.7 (HKLM-x32\...\{DD3FDF40-D8A3-454D-8A43-B53F90FB1ED7}) (Version: 1.1.8 - Disig)
DiskProtect18891 version 16.91 (HKLM-x32\...\{06B8AD54-D556-4771-A39B-A04135966F15}_is1) (Version: 16.91 - )
EAC MW klient (HKLM-x32\...\{3C1EB559-A939-4569-8EDE-006675312B46}) (Version: 3.1.3 - Ministerstvo vnútra Slovenskej republiky)
EPSON BX535WD Series Printer Uninstall (HKLM\...\EPSON BX535WD Series) (Version:  - SEIKO EPSON Corporation)
EPSON Scan (HKLM-x32\...\EPSON Scanner) (Version:  - Seiko Epson Corporation)
EpsonNet Print (HKLM-x32\...\{3E31400D-274E-4647-916C-2CACC3741799}) (Version: 2.6.0 - SEIKO EPSON CORPORATION)
GemPcCCID (HKLM\...\{39417D48-AC92-47A7-9F53-3CA2049231B0}) (Version: 2.0.7 - Gemalto)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 75.0.3770.142 - Google LLC)
Google Earth Pro (HKLM\...\{70A0F34E-564B-4F93-ADD6-3BAEC6E44075}) (Version: 7.3.2.5776 - Google)
Google Update Helper (HKLM-x32\...\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}) (Version: 1.3.34.11 - Google LLC) Hidden
HiPlayer (HKU\S-1-5-21-1960842775-2088100534-3542962694-1002\...\{1AE35ED9-955E-40D0-8811-FFD8F0E2A9F3}) (Version: 1.2 - Hi)
Intel Driver && Support Assistant (HKLM-x32\...\{CF18558A-3642-4C4D-A551-23275D1FCE16}) (Version: 19.7.30.2 - Intel) Hidden
Intel(R) Computing Improvement Program (HKLM\...\{D40D4164-EEDB-4F0F-85C6-2058A9E34CC7}) (Version: 2.4.04370 - Intel Corporation)
Intel(R) Management Engine Components (HKLM\...\{1CEAC85D-2590-4760-800F-8DE5E91F3700}) (Version: 1831.12.0.1156 - Intel Corporation)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 24.20.100.6291 - Intel Corporation)
Intel(R) Trusted Connect Service Client x86 (HKLM-x32\...\{C9552825-7BF2-4344-BA91-D3CD46F4C441}) (Version: 1.50.369.0 - Intel Corporation) Hidden
Intel(R) Trusted Connect Services Client (HKLM-x32\...\{aa81bdf2-96a6-4400-a596-c7d1916ce9f7}) (Version: 1.50.369.0 - Intel Corporation) Hidden
Intel® Chipset Device Software (HKLM-x32\...\{262e9c1d-e509-4e2a-86e8-0abb312ac2e9}) (Version: 10.1.17765.8094 - Intel(R) Corporation) Hidden
Intel® Driver & Support Assistant (HKLM-x32\...\{12d2d1d9-5223-431d-96ac-6a82d3a1391c}) (Version: 19.7.30.2 - Intel)
Intel® Driver & Support Assistant (HKLM-x32\...\{dbe96554-7594-4bba-b7c5-fc6c72dbaa39}) (Version: 19.6.26.3 - Intel)
IP Camera (HKU\S-1-5-21-1960842775-2088100534-3542962694-1002\...\{3E6DEA84-3FA0-472E-B0DB-927655097022}) (Version: 2.0.4.6 - hi)
Java 8 Update 211 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F64180211F0}) (Version: 8.0.2110.12 - Oracle Corporation)
K-Lite Mega Codec Pack 14.5.5 (HKLM-x32\...\KLiteCodecPack_is1) (Version: 14.5.5 - KLCP)
Malwarebytes Version 3.8.3.2965 (HKLM\...\{35065F43-4BB2-439A-BFF7-0F1014F2E0CD}_is1) (Version: 3.8.3.2965 - Malwarebytes)
Microsoft Office 2016 Professional Plus (HKLM-x32\...\Office16.PROPLUS) (Version: 16.0.4266.1001 - Microsoft Corporation)
Microsoft OneDrive (HKU\S-1-5-21-1960842775-2088100534-3542962694-1001\...\OneDriveSetup.exe) (Version: 19.103.0527.0003 - Microsoft Corporation)
Microsoft OneDrive (HKU\S-1-5-21-1960842775-2088100534-3542962694-1002\...\OneDriveSetup.exe) (Version: 19.103.0527.0003 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.30319 (HKLM\...\{DA5E371C-6333-3D8A-93A4-6FD5B20BCC6E}) (Version: 10.0.30319 - Microsoft Corporation)
Microsoft Visual C++ 2015 Redistributable (x64) - 14.0.23026 (HKLM-x32\...\{e46eca4f-393b-40df-9f49-076faf788d83}) (Version: 14.0.23026.0 - Microsoft Corporation)
Microsoft Visual C++ 2015 Redistributable (x86) - 14.0.23026 (HKLM-x32\...\{74d0e5db-b326-4dae-a6b2-445b9de1836e}) (Version: 14.0.23026.0 - Microsoft Corporation)
Mozilla Firefox 68.0.1 (x64 de) (HKLM\...\Mozilla Firefox 68.0.1 (x64 de)) (Version: 68.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 64.0 - Mozilla)
Nástroje kontroly pravopisu pro Microsoft Office 2016 – čeština (HKLM-x32\...\{90160000-001F-0405-0000-0000000FF1CE}) (Version: 16.0.4266.1001 - Microsoft Corporation) Hidden
Nástroje korektúry balíka Microsoft Office 2016 - slovenčina (HKLM-x32\...\{90160000-001F-041B-0000-0000000FF1CE}) (Version: 16.0.4266.1001 - Microsoft Corporation) Hidden
OLYMPUS CAMEDIA Master 4.1 (HKLM-x32\...\{30BB4D60-81DB-11D5-BB77-00400536ABAC}) (Version:  - )
QuickTime (HKLM-x32\...\QuickTime) (Version:  - )
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 10.31.828.2018 - Realtek)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.8581 - Realtek Semiconductor Corp.)
SPORE Collection (HKLM-x32\...\SPORE Collection_is1) (Version:  - )
Spybot - Search & Destroy (HKLM-x32\...\{B4092C6D-E886-4CB2-BA68-FE5A99D31DE7}_is1) (Version: 2.7.64.0 - Safer-Networking Ltd.)
SSC Service Utility v4.30 (HKLM-x32\...\SSC Service Utility_is1) (Version:  - SSC Localization Group)
Steam (HKLM-x32\...\Steam) (Version: 2.10.91.91 - Valve Corporation)
TAP-Windows 9.21.2 (HKLM\...\TAP-Windows) (Version: 9.21.2 - )
TextPad (HKLM-x32\...\{ADBBED4F-720B-460D-AA14-D85EBC4AEF97}) (Version:  - )
Update for Windows 10 for x64-based Systems (KB4023057) (HKLM\...\{F14FB68A-9188-4036-AD0D-D054BC9C9291}) (Version: 2.59.0.0 - Microsoft Corporation)
UpdateAssistant (HKLM\...\{EC4F72E8-52FE-454E-B70F-DBE5C0FA44C5}) (Version: 1.20.0.0 - Microsoft Corporation) Hidden
web control version 3.0.6.7 (HKLM-x32\...\{F88ED86C-0010-4943-BA16-72E4184E31ED}_is1) (Version: 3.0.6.7 - )
WinRAR 5.71 (32-bit) (HKLM-x32\...\WinRAR archiver) (Version: 5.71.0 - win.rar GmbH)

Packages:
=========
Candy Crush Soda Saga -> C:\Program Files\WindowsApps\king.com.CandyCrushSodaSaga_1.143.600.0_x86__kgqvnymyfvs32 [2019-07-25] (king.com)
Dolby Access -> C:\Program Files\WindowsApps\DolbyLaboratories.DolbyAccess_2.4.520.0_x64__rz1tebttyb220 [2019-07-25] (Dolby Laboratories)
Mail und Kalender -> C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe [2019-07-25] (Microsoft Corporation) [MS Ad]
Microsoft Advertising SDK for XAML -> C:\Program Files\WindowsApps\Microsoft.Advertising.Xaml_10.1811.1.0_x64__8wekyb3d8bbwe [2019-07-25] (Microsoft Corporation) [MS Ad]
Microsoft Advertising SDK for XAML -> C:\Program Files\WindowsApps\Microsoft.Advertising.Xaml_10.1811.1.0_x86__8wekyb3d8bbwe [2019-07-25] (Microsoft Corporation) [MS Ad]
Microsoft Begleiter für Telefon -> C:\Program Files\WindowsApps\Microsoft.WindowsPhone_10.1802.311.0_x64__8wekyb3d8bbwe [2019-07-25] (Microsoft Corporation)
Microsoft News – Nachrichten -> C:\Program Files\WindowsApps\Microsoft.BingNews_4.31.11905.0_x64__8wekyb3d8bbwe [2019-07-25] (Microsoft Corporation) [MS Ad]
Microsoft Solitaire Collection -> C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.6132.0_x64__8wekyb3d8bbwe [2019-07-25] (Microsoft Studios) [MS Ad]
Microsoft-Telefon -> C:\Program Files\WindowsApps\Microsoft.CommsPhone_3.43.20002.1000_x64__8wekyb3d8bbwe [2019-07-25] (Microsoft Corporation)
MSN Finanzen -> C:\Program Files\WindowsApps\Microsoft.BingFinance_4.31.11905.0_x64__8wekyb3d8bbwe [2019-07-25] (Microsoft Corporation) [MS Ad]
MSN Sport -> C:\Program Files\WindowsApps\Microsoft.BingSports_4.31.11905.0_x64__8wekyb3d8bbwe [2019-07-25] (Microsoft Corporation) [MS Ad]
MSN Wetter -> C:\Program Files\WindowsApps\Microsoft.BingWeather_4.31.11905.0_x64__8wekyb3d8bbwe [2019-07-25] (Microsoft Corporation) [MS Ad]

==================== Custom CLSID (Whitelisted): ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

CustomCLSID: HKU\S-1-5-21-1960842775-2088100534-3542962694-1001_Classes\CLSID\{233525e0-5434-46ef-b464-fd7e45e2e145}\localserver32 -> C:\Program Files (x86)\Intel\Driver and Support Assistant\DSATray.exe (IDSA Production signing key -> Intel)
CustomCLSID: HKU\S-1-5-21-1960842775-2088100534-3542962694-1002_Classes\CLSID\{233525e0-5434-46ef-b464-fd7e45e2e145}\localserver32 -> C:\Program Files (x86)\Intel\Driver and Support Assistant\DSATray.exe (IDSA Production signing key -> Intel)
ContextMenuHandlers1: [SDECon32] -> {44176360-2BBF-4EC1-93CE-384B8681A0BC} => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDECon64.dll [2018-03-23] (Safer-Networking Ltd. -> Safer-Networking Ltd.)
ContextMenuHandlers1: [SDECon64] -> {44176360-2BBF-4EC1-93CE-384B8681A0BC} => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDECon64.dll [2018-03-23] (Safer-Networking Ltd. -> Safer-Networking Ltd.)
ContextMenuHandlers1-x32: [TextPad] -> {2F25CF20-C569-11D1-B94C-00608CB45480} => C:\Program Files (x86)\TextPad 4\System\shellext.dll [2001-07-21] (Helios Software Solutions) [File not signed]
ContextMenuHandlers1: [WinRAR] -> {B41DB860-64E4-11D2-9906-E49FADC173CA} => C:\Program Files (x86)\WinRAR\rarext64.dll [2019-04-27] (win.rar GmbH -> Alexander Roshal)
ContextMenuHandlers1-x32: [WinRAR32] -> {B41DB860-8EE4-11D2-9906-E49FADC173CA} => C:\Program Files (x86)\WinRAR\rarext.dll [2019-04-27] (win.rar GmbH -> Alexander Roshal)
ContextMenuHandlers3: [MBAMShlExt] -> {57CE581A-0CB6-4266-9CA0-19364C90A0B3} => C:\Program Files\Malwarebytes\Anti-Malware\mbshlext.dll [2019-06-26] (Malwarebytes Corporation -> Malwarebytes)
ContextMenuHandlers5: [igfxcui] -> {3AB1675A-CCFF-11D2-8B20-00A0C93CB1F4} =>  -> No File
ContextMenuHandlers5: [igfxDTCM] -> {9B5F5829-A529-4B12-814A-E81BCB8D93FC} => C:\WINDOWS\System32\DriverStore\FileRepository\cui_dc_comp.inf_amd64_1c77f1231c19bc72\igfxDTCM.dll [2018-11-02] (Microsoft Windows Hardware Compatibility Publisher -> Intel Corporation)
ContextMenuHandlers6: [MBAMShlExt] -> {57CE581A-0CB6-4266-9CA0-19364C90A0B3} => C:\Program Files\Malwarebytes\Anti-Malware\mbshlext.dll [2019-06-26] (Malwarebytes Corporation -> Malwarebytes)
ContextMenuHandlers6: [SDECon32] -> {44176360-2BBF-4EC1-93CE-384B8681A0BC} => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDECon64.dll [2018-03-23] (Safer-Networking Ltd. -> Safer-Networking Ltd.)
ContextMenuHandlers6: [SDECon64] -> {44176360-2BBF-4EC1-93CE-384B8681A0BC} => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDECon64.dll [2018-03-23] (Safer-Networking Ltd. -> Safer-Networking Ltd.)
ContextMenuHandlers6: [WinRAR] -> {B41DB860-64E4-11D2-9906-E49FADC173CA} => C:\Program Files (x86)\WinRAR\rarext64.dll [2019-04-27] (win.rar GmbH -> Alexander Roshal)
ContextMenuHandlers6-x32: [WinRAR32] -> {B41DB860-8EE4-11D2-9906-E49FADC173CA} => C:\Program Files (x86)\WinRAR\rarext.dll [2019-04-27] (win.rar GmbH -> Alexander Roshal)

==================== Shortcuts & WMI ========================

(The entries could be listed to be restored or removed.)


Shortcut: C:\Users\Public\Desktop\Age of Empires - The Rise of Rome color fix.lnk -> C:\Program Files (x86)\Age of Empires complete\EMPIRESX.bat ()
Shortcut: C:\Users\Public\Desktop\Age of Empires color fix.lnk -> C:\Program Files (x86)\Age of Empires complete\Empires.bat ()

==================== Loaded Modules (Whitelisted) ==============

2018-12-20 22:32 - 2012-11-12 16:15 - 000558592 _____ (SEIKO EPSON CORPORATION) [File not signed] C:\WINDOWS\System32\enppmon.dll
2018-12-20 22:32 - 2012-10-22 18:19 - 000219648 _____ (SEIKO EPSON CORPORATION) [File not signed] C:\WINDOWS\System32\enpres.dll

==================== Alternate Data Streams (Whitelisted) =========

(If an entry is included in the fixlist, only the ADS will be removed.)


==================== Safe Mode (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MBAMService => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MBAMService => ""="Service"

==================== Association (Whitelisted) ===============

(If an entry is included in the fixlist, the registry item will be restored to default or removed.)


==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, it will be removed from the registry.)


==================== Hosts content: ===============================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2015-10-30 09:24 - 2015-10-30 09:21 - 000000824 _____ C:\WINDOWS\system32\drivers\etc\hosts


==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKLM\System\CurrentControlSet\Control\Session Manager\Environment\\Path -> C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\iCLS\;C:\Program Files\Intel\Intel(R) Management Engine Components\iCLS\;%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem;%SYSTEMROOT%\System32\WindowsPowerShell\v1.0\;C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL;C:\Program Files\Intel\Intel(R) Management Engine Components\DAL;%SYSTEMROOT%\System32\OpenSSH\;C:\Program Files (x86)\EAC MW klient\
HKU\S-1-5-21-1960842775-2088100534-3542962694-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\**\Desktop\foto.JPG
HKU\S-1-5-21-1960842775-2088100534-3542962694-1002\Control Panel\Desktop\\Wallpaper -> C:\Users\*****\Pictures\Saved Pictures\19713_en_1.jfif
DNS Servers: 45.114.8.167
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer => (SmartScreenEnabled: RequireAdmin)
Windows Firewall is enabled.

==================== MSCONFIG/TASK MANAGER disabled items ==

If an entry is included in the fixlist, it will be removed.


==================== FirewallRules (Whitelisted) ===============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

FirewallRules: [{B0E0FCA4-E614-4841-8309-C5F1BC992B51}] => (Allow) C:\Program Files (x86)\Microsoft Office\Office16\UcMapi.exe (Microsoft Corporation -> Microsoft Corporation)
FirewallRules: [{E81EFC83-D7E8-41B1-85B6-19888644E1E6}] => (Allow) C:\Program Files (x86)\Microsoft Office\Office16\UcMapi.exe (Microsoft Corporation -> Microsoft Corporation)
FirewallRules: [{E781CF56-E8E1-4EB4-B09B-782FBB63E18A}] => (Allow) C:\Program Files (x86)\Microsoft Office\Office16\lync.exe (Microsoft Corporation -> Microsoft Corporation)
FirewallRules: [{1DEEC0BE-795F-49B4-85E4-B6C781A1B559}] => (Allow) C:\Program Files (x86)\Microsoft Office\Office16\lync.exe (Microsoft Corporation -> Microsoft Corporation)
FirewallRules: [{60E1953A-3975-48CB-9A95-12682EFBE5D0}] => (Allow) C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation -> Mozilla Corporation)
FirewallRules: [{4816A673-EFC6-4880-99BC-B05F3ED27E4A}] => (Allow) C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation -> Mozilla Corporation)
FirewallRules: [{86774ECB-609F-4B3E-ACFD-1BCF4111C667}] => (Block) C:\Program Files\Intel\SUR\QUEENCREEK\x64\esrv_svc.exe (Intel(R) Software Development Products -> )
FirewallRules: [{18BE39E4-9E5E-40B2-B56E-5C1DDA55CAE0}] => (Block) C:\Program Files\Intel\SUR\QUEENCREEK\x64\esrv_svc.exe (Intel(R) Software Development Products -> )
FirewallRules: [{B3EFC748-8BD3-413E-AAC8-551A7185B62F}] => (Allow) C:\Program Files\Intel\SUR\QUEENCREEK\x64\esrv_svc.exe (Intel(R) Software Development Products -> )
FirewallRules: [{449640A9-F72F-4A5C-9FB5-5FF7FAC5DB86}] => (Allow) C:\Program Files\Intel\SUR\QUEENCREEK\x64\esrv_svc.exe (Intel(R) Software Development Products -> )
FirewallRules: [TCP Query User{BE188FCC-BD5A-4406-AF77-6E1575D282BA}D:\ip camera\ipcamclient.exe] => (Allow) D:\ip camera\ipcamclient.exe () [File not signed]
FirewallRules: [UDP Query User{87AB65A8-DC41-49DF-B57F-C796F685A96B}D:\ip camera\ipcamclient.exe] => (Allow) D:\ip camera\ipcamclient.exe () [File not signed]
FirewallRules: [TCP Query User{433C421E-E6C0-4F39-8F70-EA904602A480}D:\ip camera\ipcamclient.exe] => (Allow) D:\ip camera\ipcamclient.exe () [File not signed]
FirewallRules: [UDP Query User{2B31D666-8D5D-449D-8AA7-3DCF77632F23}D:\ip camera\ipcamclient.exe] => (Allow) D:\ip camera\ipcamclient.exe () [File not signed]
FirewallRules: [{65A9DD2E-E62F-4267-B4E4-B712B1AC688F}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google LLC -> Google LLC)
FirewallRules: [{1F633D9D-6AA0-434D-A28E-B5500A3D4D8C}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe No File
FirewallRules: [{BBBC5C50-BBD7-4106-BE83-EFC23C2771E5}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe No File
FirewallRules: [{D65400ED-A8D5-459E-976C-7BC8F2F5E71E}] => (Allow) C:\Program Files (x86)\Steam\bin\cef\cef.win7\steamwebhelper.exe No File
FirewallRules: [{FFBF8443-24B3-4587-9B82-60FB3B416CC7}] => (Allow) C:\Program Files (x86)\Steam\bin\cef\cef.win7\steamwebhelper.exe No File
FirewallRules: [{43411155-27FD-4ABD-BD18-07243101A890}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Grand Theft Auto San Andreas\gta-sa.exe No File
FirewallRules: [{7A805869-E319-453B-9A2B-CC4A789B86B2}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Grand Theft Auto San Andreas\gta-sa.exe No File
StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe] => Enabled:Spybot - Search & Destroy tray access
StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe] => Enabled:Spybot-S&D 2 Scanner Service
StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe] => Enabled:Spybot-S&D 2 Updater
StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe] => Enabled:Spybot-S&D 2 Background update service

==================== Restore Points =========================

30-07-2019 21:03:57 Scheduled Checkpoint

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (07/30/2019 09:58:27 PM) (Source: dLauncherLoopback) (EventID: 0) (User: )
Description: Event-ID 0

Error: (07/30/2019 09:31:24 PM) (Source: dLauncherLoopback) (EventID: 0) (User: )
Description: Event-ID 0

Error: (07/30/2019 09:09:27 PM) (Source: dLauncherLoopback) (EventID: 0) (User: )
Description: Event-ID 0

Error: (07/30/2019 09:08:39 PM) (Source: dLauncherLoopback) (EventID: 0) (User: )
Description: Event-ID 0

Error: (07/30/2019 09:08:05 PM) (Source: dLauncherLoopback) (EventID: 0) (User: )
Description: Event-ID 0

Error: (07/30/2019 09:07:28 PM) (Source: dLauncherLoopback) (EventID: 0) (User: )
Description: Event-ID 0

Error: (07/30/2019 09:06:48 PM) (Source: dLauncherLoopback) (EventID: 0) (User: )
Description: Event-ID 0

Error: (07/30/2019 08:45:49 PM) (Source: Perflib) (EventID: 1008) (User: )
Description: Die Open-Prozedur für den Dienst "WmiApRpl" in der DLL "C:\WINDOWS\system32\wbem\wmiaprpl.dll" war nicht erfolgreich. Die Leistungsdaten für diesen Dienst sind nicht verfügbar. Die ersten vier Bytes (DWORD) des Datenbereichs enthalten den Fehlercode.


System errors:
=============
Error: (07/30/2019 09:58:27 PM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: Durch die Berechtigungseinstellungen für "application-specific" wird dem Benutzer "NT AUTHORITY\LOCAL SERVICE" (SID: S-1-5-19) unter der Adresse "LocalHost (Using LRPC)" keine Berechtigung vom Typ "Local Activation" für die COM-Serveranwendung mit der CLSID 
{6B3B8D23-FA8D-40B9-8DBD-B950333E2C52}
 und der APPID 
{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}
 im Anwendungscontainer "Unavailable" (SID: Unavailable) gewährt. Die Sicherheitsberechtigung kann mit dem Verwaltungstool für Komponentendienste geändert werden.

Error: (07/30/2019 09:58:27 PM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: Durch die Berechtigungseinstellungen für "application-specific" wird dem Benutzer "NT AUTHORITY\LOCAL SERVICE" (SID: S-1-5-19) unter der Adresse "LocalHost (Using LRPC)" keine Berechtigung vom Typ "Local Activation" für die COM-Serveranwendung mit der CLSID 
{6B3B8D23-FA8D-40B9-8DBD-B950333E2C52}
 und der APPID 
{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}
 im Anwendungscontainer "Unavailable" (SID: Unavailable) gewährt. Die Sicherheitsberechtigung kann mit dem Verwaltungstool für Komponentendienste geändert werden.

Error: (07/30/2019 09:58:19 PM) (Source: Microsoft-Windows-Ntfs) (EventID: 98) (User: NT AUTHORITY)
Description: C:\Device\HarddiskVolume23

Error: (07/30/2019 09:57:58 PM) (Source: DCOM) (EventID: 10005) (User: DESKTOP-3CK4O4E)
Description: Fehler "1084" in DCOM, als der Dienst "ShellHWDetection" mit den Argumenten "Unavailable" gestartet wurde, um den folgenden Server zu verwenden:
{DD522ACC-F821-461A-A407-50B198B896DC}

Error: (07/30/2019 09:57:53 PM) (Source: DCOM) (EventID: 10005) (User: DESKTOP-3CK4O4E)
Description: Fehler "1084" in DCOM, als der Dienst "ShellHWDetection" mit den Argumenten "Unavailable" gestartet wurde, um den folgenden Server zu verwenden:
{DD522ACC-F821-461A-A407-50B198B896DC}

Error: (07/30/2019 09:57:48 PM) (Source: DCOM) (EventID: 10005) (User: DESKTOP-3CK4O4E)
Description: Fehler "1084" in DCOM, als der Dienst "TokenBroker" mit den Argumenten "Unavailable" gestartet wurde, um den folgenden Server zu verwenden:
Windows.Internal.Security.Authentication.Web.TokenBrokerInternal

Error: (07/30/2019 09:57:44 PM) (Source: DCOM) (EventID: 10005) (User: DESKTOP-3CK4O4E)
Description: Fehler "1084" in DCOM, als der Dienst "WSearch" mit den Argumenten "Unavailable" gestartet wurde, um den folgenden Server zu verwenden:
{E48EDA45-43C6-48E0-9323-A7B2067D9CD5}

Error: (07/30/2019 09:55:41 PM) (Source: DCOM) (EventID: 10005) (User: DESKTOP-3CK4O4E)
Description: Fehler "1084" in DCOM, als der Dienst "ShellHWDetection" mit den Argumenten "Unavailable" gestartet wurde, um den folgenden Server zu verwenden:
{DD522ACC-F821-461A-A407-50B198B896DC}


Windows Defender:
===================================
Date: 2019-07-27 14:11:19.123
Description: 
Die Windows Defender Antivirus-Überprüfung wurde vor ihrem Abschluss beendet.
Überprüfungs-ID: {F19C5FF9-CAEE-4B95-AF27-48D5428A0778}
Überprüfungstyp: Antimalware
Überprüfungsparameter: Vollständige Überprüfung
Benutzer: DESKTOP-3CK4O4E\**

Date: 2019-07-27 12:24:43.833
Description: 
Die Windows Defender Antivirus-Überprüfung wurde vor ihrem Abschluss beendet.
Überprüfungs-ID: {82B744AF-4B5B-4340-A46C-B31EB143D3E7}
Überprüfungstyp: Antimalware
Überprüfungsparameter: Schnellüberprüfung
Benutzer: NT AUTHORITY\SYSTEM

Date: 2019-07-27 11:13:24.797
Description: 
Die Windows Defender Antivirus-Überprüfung wurde vor ihrem Abschluss beendet.
Überprüfungs-ID: {1B172D1B-64F6-47C9-98B1-C708BFF51B34}
Überprüfungstyp: Antimalware
Überprüfungsparameter: Schnellüberprüfung
Benutzer: NT AUTHORITY\SYSTEM

Date: 2019-07-25 01:44:05.762
Description: 
Von Windows Defender Antivirus wurde Schadsoftware oder andere potenziell unerwünschte Software erkannt.
Weitere Informationen:
https://go.microsoft.com/fwlink/?linkid=37020&name=Behavior:Win32/Generic.KU!ml&threatid=2147739089&enterprise=0
Name: Behavior:Win32/Generic.KU!ml
ID: 2147739089
Schweregrad: Závažná
Kategorie: Podozrivé správanie
Pfad: file:_C:\Users\**\AppData\Local\Temp\wErKYuzd1HavtcSG\83314351a78e5d6e44c0cdebeb407e8c.exe
Erkennungsursprung: Lokaler Computer
Erkennungstyp: FastPath
Erkennungsquelle: Benutzer
Benutzer: DESKTOP-3CK4O4E\**
Prozessname: Unknown
Signaturversion: AV: 1.299.423.0, AS: 1.299.423.0, NIS: 0.0.0.0
Modulversion: AM: 1.1.16200.1, NIS: 0.0.0.0

Date: 2019-07-25 01:44:05.761
Description: 
Von Windows Defender Antivirus wurde Schadsoftware oder andere potenziell unerwünschte Software erkannt.
Weitere Informationen:
https://go.microsoft.com/fwlink/?linkid=37020&name=Trojan:JS/Iframe.EX&threatid=2147733337&enterprise=0
Name: Trojan:JS/Iframe.EX
ID: 2147733337
Schweregrad: Závažná
Kategorie: Trójsky kôň
Pfad: containerfile:_C:\Users\**\AppData\Local\Google\Chrome\User Data\Default\Cache\f_001582; file:_C:\Users\**\AppData\Local\Google\Chrome\User Data\Default\Cache\f_001582->(GZip)
Erkennungsursprung: Lokaler Computer
Erkennungstyp: Konkret
Erkennungsquelle: Benutzer
Benutzer: DESKTOP-3CK4O4E\**
Prozessname: Unknown
Signaturversion: AV: 1.299.423.0, AS: 1.299.423.0, NIS: 0.0.0.0
Modulversion: AM: 1.1.16200.1, NIS: 0.0.0.0

Date: 2019-07-30 21:45:38.737
Description: 
Fehler von Windows Defender Antivirus beim Aktualisieren von Signaturen.
Neue Signaturversion: 
Vorherige Signaturversion: 1.299.631.0
Updatequelle: Microsoft Center zum Schutz vor Schadsoftware
Signaturtyp: AntiVirus
Updatetyp: Voll
Benutzer: NT AUTHORITY\NETWORK SERVICE
Aktuelle Modulversion: 
Vorherige Modulversion: 1.1.16200.1
Fehlercode: 0x80072ee7
Fehlerbeschreibung: The server name or address could not be resolved 

Date: 2019-07-30 21:45:38.736
Description: 
Fehler von Windows Defender Antivirus beim Aktualisieren von Signaturen.
Neue Signaturversion: 
Vorherige Signaturversion: 1.299.631.0
Updatequelle: Microsoft Center zum Schutz vor Schadsoftware
Signaturtyp: AntiSpyware
Updatetyp: Voll
Benutzer: NT AUTHORITY\NETWORK SERVICE
Aktuelle Modulversion: 
Vorherige Modulversion: 1.1.16200.1
Fehlercode: 0x80072ee7
Fehlerbeschreibung: The server name or address could not be resolved 

Date: 2019-07-30 21:45:38.736
Description: 
Fehler von Windows Defender Antivirus beim Aktualisieren von Signaturen.
Neue Signaturversion: 
Vorherige Signaturversion: 1.299.631.0
Updatequelle: Microsoft Center zum Schutz vor Schadsoftware
Signaturtyp: AntiVirus
Updatetyp: Voll
Benutzer: NT AUTHORITY\NETWORK SERVICE
Aktuelle Modulversion: 
Vorherige Modulversion: 1.1.16200.1
Fehlercode: 0x80072ee7
Fehlerbeschreibung: The server name or address could not be resolved 

Date: 2019-07-30 21:45:38.731
Description: 
Fehler von Windows Defender Antivirus beim Aktualisieren von Signaturen.
Neue Signaturversion: 
Vorherige Signaturversion: 1.299.631.0
Updatequelle: Microsoft Center zum Schutz vor Schadsoftware
Signaturtyp: AntiVirus
Updatetyp: Voll
Benutzer: NT AUTHORITY\NETWORK SERVICE
Aktuelle Modulversion: 
Vorherige Modulversion: 1.1.16200.1
Fehlercode: 0x80072ee7
Fehlerbeschreibung: The server name or address could not be resolved 

Date: 2019-07-30 21:45:38.731
Description: 
Fehler von Windows Defender Antivirus beim Aktualisieren von Signaturen.
Neue Signaturversion: 
Vorherige Signaturversion: 1.299.631.0
Updatequelle: Microsoft Center zum Schutz vor Schadsoftware
Signaturtyp: AntiSpyware
Updatetyp: Voll
Benutzer: NT AUTHORITY\NETWORK SERVICE
Aktuelle Modulversion: 
Vorherige Modulversion: 1.1.16200.1
Fehlercode: 0x80072ee7
Fehlerbeschreibung: The server name or address could not be resolved 

==================== Memory info =========================== 

BIOS: American Megatrends Inc. 1.60 10/10/2018
Motherboard: Micro-Star International Co., Ltd. H310M PRO-VD (MS-7B33)
Processor: Intel(R) Core(TM) i3-8300 CPU @ 3.70GHz
Percentage of memory in use: 62%
Total physical RAM: 3962.59 MB
Available physical RAM: 1486.89 MB
Total Virtual: 14714.59 MB
Available Virtual: 12093.39 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:223.08 GB) (Free:103.16 GB) NTFS
Drive d: () (Fixed) (Total:1863.01 GB) (Free:1638.61 GB) NTFS

\\?\Volume{b9e8df67-0000-0000-0000-100000000000}\ (Vyhradené systémom) (Fixed) (Total:0.49 GB) (Free:0.1 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7/8/10) (Size: 223.6 GB) (Disk ID: B9E8DF67)
Partition 1: (Active) - (Size=500 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=223.1 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (Size: 1863 GB) (Disk ID: 9F919F91)
Partition 1: (Active) - (Size=1863 GB) - (Type=07 NTFS)

==================== End of Addition.txt ============================
         

2. Beitrag wegen Länge mit Malwarebytes Logs folgt.

Malwarebytes 1. Scan

Malwarebytes
www.malwarebytes.com

-Protokolldetails-
Scan-Datum: 30.07.19
Scan-Zeit: 21:12
Protokolldatei: f2605747-b2fd-11e9-ab86-000000000000.json

-Softwaredaten-
Version: 3.8.3.2965
Komponentenversion: 1.0.613
Version des Aktualisierungspakets: 1.0.11712
Lizenz: Kostenlos

-Systemdaten-
Betriebssystem: Windows 8
CPU: x64
Dateisystem: NTFS
Benutzer: DESKTOP-3CK4O4E\Jozko

-Scan-Übersicht-
Scan-Typ: Bedrohungs-Scan
Scan gestartet von: Manuell
Ergebnis: Abgeschlossen
Gescannte Objekte: 316462
Erkannte Bedrohungen: 401
In die Quarantäne verschobene Bedrohungen: 0
Abgelaufene Zeit: 3 Min., 13 Sek.

-Scan-Optionen-
Speicher: Aktiviert
Start: Aktiviert
Dateisystem: Aktiviert
Archive: Aktiviert
Rootkits: Aktiviert
Heuristik: Aktiviert
PUP: Erkennung
PUM: Erkennung

-Scan-Details-
Prozess: 0
(keine bösartigen Elemente erkannt)

Modul: 0
(keine bösartigen Elemente erkannt)

Registrierungsschlüssel: 9
Trojan.CrthRazy, HKLM\SOFTWARE\WOW6432NODE\Machiner, Keine Aktion durch Benutzer, [3135], [676882],1.0.11712
PUM.Optional.DisableChromeUpdates, HKLM\SOFTWARE\POLICIES\GOOGLE\UPDATE, Keine Aktion durch Benutzer, [7053], [252393],1.0.11712
PUM.Optional.DisableChromeUpdates, HKLM\SOFTWARE\WOW6432NODE\POLICIES\GOOGLE\UPDATE, Keine Aktion durch Benutzer, [7053], [252393],1.0.11712
PUP.Optional.MailRu, HKLM\SOFTWARE\WOW6432NODE\GOOGLE\CHROME\EXTENSIONS\iepoegkaoeljnbhagabakjodgpfniimo, Keine Aktion durch Benutzer, [255], [655213],1.0.11712
Adware.ExtenBro.BrwsrFlsh, HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\36509B8F624CE280E0C797F42F4A8F552A280313, Keine Aktion durch Benutzer, [6885], [707078],1.0.11712
Adware.ExtenBro.BrwsrFlsh, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\36509B8F624CE280E0C797F42F4A8F552A280313, Keine Aktion durch Benutzer, [6885], [707078],1.0.11712
PUP.Optional.VisualBookmarks.ChrPRST, HKLM\SOFTWARE\WOW6432NODE\GOOGLE\CHROME\EXTENSIONS\hjdkfkdkokphfploiiddakjokndinfgb, Keine Aktion durch Benutzer, [2580], [695272],1.0.11712
PUP.Optional.VisualBookmarks.ChrPRST, HKLM\SOFTWARE\POLICIES\GOOGLE\CHROME, Keine Aktion durch Benutzer, [2580], [-1],0.0.0
PUP.Optional.VisualBookmarks.ChrPRST, HKLM\SOFTWARE\WOW6432NODE\POLICIES\GOOGLE\CHROME, Keine Aktion durch Benutzer, [2580], [-1],0.0.0

Registrierungswert: 9
Rootkit.Agent, HKLM\SOFTWARE\MICROSOFT|MSVER1, Keine Aktion durch Benutzer, [441], [678869],1.0.11712
PUM.Optional.DisableChromeUpdates, HKLM\SOFTWARE\POLICIES\GOOGLE\UPDATE|DISABLEAUTOUPDATECHECKSCHECKBOXVALUE, Keine Aktion durch Benutzer, [7053], [252393],1.0.11712
PUM.Optional.DisableChromeUpdates, HKLM\SOFTWARE\WOW6432NODE\POLICIES\GOOGLE\UPDATE|DISABLEAUTOUPDATECHECKSCHECKBOXVALUE, Keine Aktion durch Benutzer, [7053], [252393],1.0.11712
PUP.Optional.MailRu, HKU\S-1-5-21-1960842775-2088100534-3542962694-1001\SOFTWARE\GOOGLE\CHROME\PREFERENCEMACS\Default\extensions.settings|IEPOEGKAOELJNBHAGABAKJODGPFNIIMO, Keine Aktion durch Benutzer, [255], [655213],1.0.11712
PUP.Optional.VisualBookmarks.ChrPRST, HKU\S-1-5-21-1960842775-2088100534-3542962694-1001\SOFTWARE\GOOGLE\CHROME\PREFERENCEMACS\Default\extensions.settings|hjdkfkdkokphfploiiddakjokndinfgb, Keine Aktion durch Benutzer, [2580], [695272],1.0.11712
PUP.Optional.ExtensionNSUU.Generic, HKLM\SOFTWARE\POLICIES\GOOGLE\CHROME\ExtensionInstallWhitelist|1, Keine Aktion durch Benutzer, [14734], [553092],1.0.11712
PUP.Optional.ExtensionNSUU.Generic, HKLM\SOFTWARE\WOW6432NODE\POLICIES\GOOGLE\CHROME\ExtensionInstallWhitelist|1, Keine Aktion durch Benutzer, [14734], [553092],1.0.11712
PUP.Optional.ExtensionNSUU.Generic, HKU\S-1-5-21-1960842775-2088100534-3542962694-1001\SOFTWARE\GOOGLE\CHROME\PREFERENCEMACS\Default\extensions.settings|hbbadcmbpgmbdlecggopiocgfbkcgona, Keine Aktion durch Benutzer, [14734], [553092],1.0.11712
Trojan.CrthRazy.Generic, HKU\S-1-5-21-1960842775-2088100534-3542962694-1001\SOFTWARE\GOOGLE\CHROME\PREFERENCEMACS\Default\extensions.settings|pkedcjkdefgpdelpbcmbmeomcjbeemfm, Keine Aktion durch Benutzer, [14647], [676732],1.0.11712

Registrierungsdaten: 6
Trojan.DNSChanger, HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{293ee5fa-fe84-433a-a774-26687ea51594}|NameServer, Keine Aktion durch Benutzer, [3069], [706134],1.0.11712
Trojan.DNSChanger, HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{293ee5fa-fe84-433a-a774-26687ea51594}|NameServer, Keine Aktion durch Benutzer, [3069], [710818],1.0.11712
Trojan.DNSChanger, HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{da384fb4-1e59-48fc-bfe0-c27ce005f778}|NameServer, Keine Aktion durch Benutzer, [3069], [706134],1.0.11712
Trojan.DNSChanger, HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{da384fb4-1e59-48fc-bfe0-c27ce005f778}|NameServer, Keine Aktion durch Benutzer, [3069], [710818],1.0.11712
Trojan.DNSChanger, HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{34eac78a-f8d3-4256-b5a3-9da0fc12e3a7}|NameServer, Keine Aktion durch Benutzer, [3069], [706134],1.0.11712
Trojan.DNSChanger, HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{34eac78a-f8d3-4256-b5a3-9da0fc12e3a7}|NameServer, Keine Aktion durch Benutzer, [3069], [710818],1.0.11712

Daten-Stream: 0
(keine bösartigen Elemente erkannt)

Ordner: 140
PUP.Optional.MailRu, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\iepoegkaoeljnbhagabakjodgpfniimo\15.1.4.3_0\_metadata, Keine Aktion durch Benutzer, [255], [655213],1.0.11712
PUP.Optional.MailRu, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\iepoegkaoeljnbhagabakjodgpfniimo\15.1.4.3_0\icons, Keine Aktion durch Benutzer, [255], [655213],1.0.11712
PUP.Optional.MailRu, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\iepoegkaoeljnbhagabakjodgpfniimo\15.1.4.3_0, Keine Aktion durch Benutzer, [255], [655213],1.0.11712
PUP.Optional.MailRu, C:\USERS\LUBKA\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\Default\Extensions\IEPOEGKAOELJNBHAGABAKJODGPFNIIMO, Keine Aktion durch Benutzer, [255], [655213],1.0.11712
PUP.Optional.MailRu, C:\USERS\LUBKA\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\Default\Local Extension Settings\IEPOEGKAOELJNBHAGABAKJODGPFNIIMO, Keine Aktion durch Benutzer, [255], [655213],1.0.11712
PUP.Optional.MailRu, C:\USERS\LUBKA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BT6JBW3E.DEFAULT\BROWSER-EXTENSION-DATA\HOMEPAGE@MAIL.RU, Keine Aktion durch Benutzer, [255], [481853],1.0.11712
PUP.Optional.MailRu, C:\USERS\LUBKA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BT6JBW3E.DEFAULT\BROWSER-EXTENSION-DATA\{A38384B3-2D1D-4F36-BC22-0F7AE402BCD7}, Keine Aktion durch Benutzer, [255], [482296],1.0.11712
PUP.Optional.VisualBookmarks.ChrPRST, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\hjdkfkdkokphfploiiddakjokndinfgb\5.3.23_0\img\browser-action, Keine Aktion durch Benutzer, [2580], [695272],1.0.11712
PUP.Optional.VisualBookmarks.ChrPRST, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\hjdkfkdkokphfploiiddakjokndinfgb\5.3.23_0\assets\resources, Keine Aktion durch Benutzer, [2580], [695272],1.0.11712
PUP.Optional.VisualBookmarks.ChrPRST, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\hjdkfkdkokphfploiiddakjokndinfgb\5.3.23_0\_locales\en, Keine Aktion durch Benutzer, [2580], [695272],1.0.11712
PUP.Optional.VisualBookmarks.ChrPRST, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\hjdkfkdkokphfploiiddakjokndinfgb\5.3.23_0\_locales\ru, Keine Aktion durch Benutzer, [2580], [695272],1.0.11712
PUP.Optional.VisualBookmarks.ChrPRST, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\hjdkfkdkokphfploiiddakjokndinfgb\5.3.23_0\assets\img, Keine Aktion durch Benutzer, [2580], [695272],1.0.11712
PUP.Optional.VisualBookmarks.ChrPRST, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\hjdkfkdkokphfploiiddakjokndinfgb\5.3.23_0\img\icons, Keine Aktion durch Benutzer, [2580], [695272],1.0.11712
PUP.Optional.VisualBookmarks.ChrPRST, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\hjdkfkdkokphfploiiddakjokndinfgb\5.3.23_0\_metadata, Keine Aktion durch Benutzer, [2580], [695272],1.0.11712
PUP.Optional.VisualBookmarks.ChrPRST, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\hjdkfkdkokphfploiiddakjokndinfgb\5.3.23_0\_locales, Keine Aktion durch Benutzer, [2580], [695272],1.0.11712
PUP.Optional.VisualBookmarks.ChrPRST, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\hjdkfkdkokphfploiiddakjokndinfgb\5.3.23_0\assets, Keine Aktion durch Benutzer, [2580], [695272],1.0.11712
PUP.Optional.VisualBookmarks.ChrPRST, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\hjdkfkdkokphfploiiddakjokndinfgb\5.3.23_0\img, Keine Aktion durch Benutzer, [2580], [695272],1.0.11712
PUP.Optional.VisualBookmarks.ChrPRST, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\hjdkfkdkokphfploiiddakjokndinfgb\5.3.23_0, Keine Aktion durch Benutzer, [2580], [695272],1.0.11712
PUP.Optional.VisualBookmarks.ChrPRST, C:\USERS\LUBKA\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\Default\Local Extension Settings\hjdkfkdkokphfploiiddakjokndinfgb, Keine Aktion durch Benutzer, [2580], [695272],1.0.11712
PUP.Optional.VisualBookmarks.ChrPRST, C:\USERS\LUBKA\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\Default\EXTENSIONS\hjdkfkdkokphfploiiddakjokndinfgb, Keine Aktion durch Benutzer, [2580], [695272],1.0.11712
PUP.Optional.ExtensionNSUU.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\hbbadcmbpgmbdlecggopiocgfbkcgona\2.8.0.39_0\_locales\es_419, Keine Aktion durch Benutzer, [14734], [553092],1.0.11712
PUP.Optional.ExtensionNSUU.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\hbbadcmbpgmbdlecggopiocgfbkcgona\2.8.0.39_0\_locales\en_GB, Keine Aktion durch Benutzer, [14734], [553092],1.0.11712
PUP.Optional.ExtensionNSUU.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\hbbadcmbpgmbdlecggopiocgfbkcgona\2.8.0.39_0\_locales\en_BS, Keine Aktion durch Benutzer, [14734], [553092],1.0.11712
PUP.Optional.ExtensionNSUU.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\hbbadcmbpgmbdlecggopiocgfbkcgona\2.8.0.39_0\_locales\pt_BR, Keine Aktion durch Benutzer, [14734], [553092],1.0.11712
PUP.Optional.ExtensionNSUU.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\hbbadcmbpgmbdlecggopiocgfbkcgona\2.8.0.39_0\_locales\en_US, Keine Aktion durch Benutzer, [14734], [553092],1.0.11712
PUP.Optional.ExtensionNSUU.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\hbbadcmbpgmbdlecggopiocgfbkcgona\2.8.0.39_0\_locales\pt_PT, Keine Aktion durch Benutzer, [14734], [553092],1.0.11712
PUP.Optional.ExtensionNSUU.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\hbbadcmbpgmbdlecggopiocgfbkcgona\2.8.0.39_0\_locales\zh_CN, Keine Aktion durch Benutzer, [14734], [553092],1.0.11712
PUP.Optional.ExtensionNSUU.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\hbbadcmbpgmbdlecggopiocgfbkcgona\2.8.0.39_0\_locales\zh_TW, Keine Aktion durch Benutzer, [14734], [553092],1.0.11712
PUP.Optional.ExtensionNSUU.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\hbbadcmbpgmbdlecggopiocgfbkcgona\2.8.0.39_0\_locales\fil, Keine Aktion durch Benutzer, [14734], [553092],1.0.11712
PUP.Optional.ExtensionNSUU.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\hbbadcmbpgmbdlecggopiocgfbkcgona\2.8.0.39_0\_locales\be, Keine Aktion durch Benutzer, [14734], [553092],1.0.11712
PUP.Optional.ExtensionNSUU.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\hbbadcmbpgmbdlecggopiocgfbkcgona\2.8.0.39_0\_locales\bg, Keine Aktion durch Benutzer, [14734], [553092],1.0.11712
PUP.Optional.ExtensionNSUU.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\hbbadcmbpgmbdlecggopiocgfbkcgona\2.8.0.39_0\_locales\bn, Keine Aktion durch Benutzer, [14734], [553092],1.0.11712
PUP.Optional.ExtensionNSUU.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\hbbadcmbpgmbdlecggopiocgfbkcgona\2.8.0.39_0\_locales\ca, Keine Aktion durch Benutzer, [14734], [553092],1.0.11712
PUP.Optional.ExtensionNSUU.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\hbbadcmbpgmbdlecggopiocgfbkcgona\2.8.0.39_0\_locales\cs, Keine Aktion durch Benutzer, [14734], [553092],1.0.11712
PUP.Optional.ExtensionNSUU.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\hbbadcmbpgmbdlecggopiocgfbkcgona\2.8.0.39_0\_locales\da, Keine Aktion durch Benutzer, [14734], [553092],1.0.11712
PUP.Optional.ExtensionNSUU.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\hbbadcmbpgmbdlecggopiocgfbkcgona\2.8.0.39_0\_locales\de, Keine Aktion durch Benutzer, [14734], [553092],1.0.11712
PUP.Optional.ExtensionNSUU.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\hbbadcmbpgmbdlecggopiocgfbkcgona\2.8.0.39_0\_locales\el, Keine Aktion durch Benutzer, [14734], [553092],1.0.11712
PUP.Optional.ExtensionNSUU.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\hbbadcmbpgmbdlecggopiocgfbkcgona\2.8.0.39_0\_locales\en, Keine Aktion durch Benutzer, [14734], [553092],1.0.11712
PUP.Optional.ExtensionNSUU.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\hbbadcmbpgmbdlecggopiocgfbkcgona\2.8.0.39_0\_locales\es, Keine Aktion durch Benutzer, [14734], [553092],1.0.11712
PUP.Optional.ExtensionNSUU.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\hbbadcmbpgmbdlecggopiocgfbkcgona\2.8.0.39_0\_locales\et, Keine Aktion durch Benutzer, [14734], [553092],1.0.11712
PUP.Optional.ExtensionNSUU.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\hbbadcmbpgmbdlecggopiocgfbkcgona\2.8.0.39_0\_locales\fa, Keine Aktion durch Benutzer, [14734], [553092],1.0.11712
PUP.Optional.ExtensionNSUU.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\hbbadcmbpgmbdlecggopiocgfbkcgona\2.8.0.39_0\_locales\fi, Keine Aktion durch Benutzer, [14734], [553092],1.0.11712
PUP.Optional.ExtensionNSUU.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\hbbadcmbpgmbdlecggopiocgfbkcgona\2.8.0.39_0\_locales\fr, Keine Aktion durch Benutzer, [14734], [553092],1.0.11712
PUP.Optional.ExtensionNSUU.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\hbbadcmbpgmbdlecggopiocgfbkcgona\2.8.0.39_0\_locales\gu, Keine Aktion durch Benutzer, [14734], [553092],1.0.11712
PUP.Optional.ExtensionNSUU.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\hbbadcmbpgmbdlecggopiocgfbkcgona\2.8.0.39_0\_locales\hi, Keine Aktion durch Benutzer, [14734], [553092],1.0.11712
PUP.Optional.ExtensionNSUU.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\hbbadcmbpgmbdlecggopiocgfbkcgona\2.8.0.39_0\_locales\hr, Keine Aktion durch Benutzer, [14734], [553092],1.0.11712
PUP.Optional.ExtensionNSUU.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\hbbadcmbpgmbdlecggopiocgfbkcgona\2.8.0.39_0\_locales\hu, Keine Aktion durch Benutzer, [14734], [553092],1.0.11712
PUP.Optional.ExtensionNSUU.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\hbbadcmbpgmbdlecggopiocgfbkcgona\2.8.0.39_0\_locales\id, Keine Aktion durch Benutzer, [14734], [553092],1.0.11712
PUP.Optional.ExtensionNSUU.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\hbbadcmbpgmbdlecggopiocgfbkcgona\2.8.0.39_0\_locales\it, Keine Aktion durch Benutzer, [14734], [553092],1.0.11712
PUP.Optional.ExtensionNSUU.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\hbbadcmbpgmbdlecggopiocgfbkcgona\2.8.0.39_0\_locales\ja, Keine Aktion durch Benutzer, [14734], [553092],1.0.11712
PUP.Optional.ExtensionNSUU.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\hbbadcmbpgmbdlecggopiocgfbkcgona\2.8.0.39_0\_locales\kn, Keine Aktion durch Benutzer, [14734], [553092],1.0.11712
PUP.Optional.ExtensionNSUU.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\hbbadcmbpgmbdlecggopiocgfbkcgona\2.8.0.39_0\_locales\ko, Keine Aktion durch Benutzer, [14734], [553092],1.0.11712
PUP.Optional.ExtensionNSUU.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\hbbadcmbpgmbdlecggopiocgfbkcgona\2.8.0.39_0\_locales\lt, Keine Aktion durch Benutzer, [14734], [553092],1.0.11712
PUP.Optional.ExtensionNSUU.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\hbbadcmbpgmbdlecggopiocgfbkcgona\2.8.0.39_0\_locales\lv, Keine Aktion durch Benutzer, [14734], [553092],1.0.11712
PUP.Optional.ExtensionNSUU.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\hbbadcmbpgmbdlecggopiocgfbkcgona\2.8.0.39_0\_locales\mk, Keine Aktion durch Benutzer, [14734], [553092],1.0.11712
PUP.Optional.ExtensionNSUU.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\hbbadcmbpgmbdlecggopiocgfbkcgona\2.8.0.39_0\_locales\ml, Keine Aktion durch Benutzer, [14734], [553092],1.0.11712
PUP.Optional.ExtensionNSUU.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\hbbadcmbpgmbdlecggopiocgfbkcgona\2.8.0.39_0\_locales\mr, Keine Aktion durch Benutzer, [14734], [553092],1.0.11712
PUP.Optional.ExtensionNSUU.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\hbbadcmbpgmbdlecggopiocgfbkcgona\2.8.0.39_0\_locales\ms, Keine Aktion durch Benutzer, [14734], [553092],1.0.11712
PUP.Optional.ExtensionNSUU.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\hbbadcmbpgmbdlecggopiocgfbkcgona\2.8.0.39_0\_locales\nl, Keine Aktion durch Benutzer, [14734], [553092],1.0.11712
PUP.Optional.ExtensionNSUU.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\hbbadcmbpgmbdlecggopiocgfbkcgona\2.8.0.39_0\_locales\no, Keine Aktion durch Benutzer, [14734], [553092],1.0.11712
PUP.Optional.ExtensionNSUU.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\hbbadcmbpgmbdlecggopiocgfbkcgona\2.8.0.39_0\_locales\pl, Keine Aktion durch Benutzer, [14734], [553092],1.0.11712
PUP.Optional.ExtensionNSUU.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\hbbadcmbpgmbdlecggopiocgfbkcgona\2.8.0.39_0\_locales\pt, Keine Aktion durch Benutzer, [14734], [553092],1.0.11712
PUP.Optional.ExtensionNSUU.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\hbbadcmbpgmbdlecggopiocgfbkcgona\2.8.0.39_0\_locales\he, Keine Aktion durch Benutzer, [14734], [553092],1.0.11712
PUP.Optional.ExtensionNSUU.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\hbbadcmbpgmbdlecggopiocgfbkcgona\2.8.0.39_0\_locales\ro, Keine Aktion durch Benutzer, [14734], [553092],1.0.11712
PUP.Optional.ExtensionNSUU.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\hbbadcmbpgmbdlecggopiocgfbkcgona\2.8.0.39_0\_locales\ru, Keine Aktion durch Benutzer, [14734], [553092],1.0.11712
PUP.Optional.ExtensionNSUU.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\hbbadcmbpgmbdlecggopiocgfbkcgona\2.8.0.39_0\_locales\sk, Keine Aktion durch Benutzer, [14734], [553092],1.0.11712
PUP.Optional.ExtensionNSUU.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\hbbadcmbpgmbdlecggopiocgfbkcgona\2.8.0.39_0\_locales\sl, Keine Aktion durch Benutzer, [14734], [553092],1.0.11712
PUP.Optional.ExtensionNSUU.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\hbbadcmbpgmbdlecggopiocgfbkcgona\2.8.0.39_0\_locales\sq, Keine Aktion durch Benutzer, [14734], [553092],1.0.11712
PUP.Optional.ExtensionNSUU.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\hbbadcmbpgmbdlecggopiocgfbkcgona\2.8.0.39_0\_locales\sr, Keine Aktion durch Benutzer, [14734], [553092],1.0.11712
PUP.Optional.ExtensionNSUU.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\hbbadcmbpgmbdlecggopiocgfbkcgona\2.8.0.39_0\_locales\sv, Keine Aktion durch Benutzer, [14734], [553092],1.0.11712
PUP.Optional.ExtensionNSUU.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\hbbadcmbpgmbdlecggopiocgfbkcgona\2.8.0.39_0\_locales\sw, Keine Aktion durch Benutzer, [14734], [553092],1.0.11712
PUP.Optional.ExtensionNSUU.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\hbbadcmbpgmbdlecggopiocgfbkcgona\2.8.0.39_0\_locales\ta, Keine Aktion durch Benutzer, [14734], [553092],1.0.11712
PUP.Optional.ExtensionNSUU.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\hbbadcmbpgmbdlecggopiocgfbkcgona\2.8.0.39_0\_locales\te, Keine Aktion durch Benutzer, [14734], [553092],1.0.11712
PUP.Optional.ExtensionNSUU.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\hbbadcmbpgmbdlecggopiocgfbkcgona\2.8.0.39_0\_locales\th, Keine Aktion durch Benutzer, [14734], [553092],1.0.11712
PUP.Optional.ExtensionNSUU.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\hbbadcmbpgmbdlecggopiocgfbkcgona\2.8.0.39_0\_locales\tr, Keine Aktion durch Benutzer, [14734], [553092],1.0.11712
PUP.Optional.ExtensionNSUU.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\hbbadcmbpgmbdlecggopiocgfbkcgona\2.8.0.39_0\_locales\uk, Keine Aktion durch Benutzer, [14734], [553092],1.0.11712
PUP.Optional.ExtensionNSUU.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\hbbadcmbpgmbdlecggopiocgfbkcgona\2.8.0.39_0\_locales\vi, Keine Aktion durch Benutzer, [14734], [553092],1.0.11712
PUP.Optional.ExtensionNSUU.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\hbbadcmbpgmbdlecggopiocgfbkcgona\2.8.0.39_0\_locales\am, Keine Aktion durch Benutzer, [14734], [553092],1.0.11712
PUP.Optional.ExtensionNSUU.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\hbbadcmbpgmbdlecggopiocgfbkcgona\2.8.0.39_0\_locales\ar, Keine Aktion durch Benutzer, [14734], [553092],1.0.11712
PUP.Optional.ExtensionNSUU.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\hbbadcmbpgmbdlecggopiocgfbkcgona\2.8.0.39_0\_locales, Keine Aktion durch Benutzer, [14734], [553092],1.0.11712
PUP.Optional.ExtensionNSUU.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\hbbadcmbpgmbdlecggopiocgfbkcgona\2.8.0.39_0\icons, Keine Aktion durch Benutzer, [14734], [553092],1.0.11712
PUP.Optional.ExtensionNSUU.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\hbbadcmbpgmbdlecggopiocgfbkcgona\2.8.0.39_0, Keine Aktion durch Benutzer, [14734], [553092],1.0.11712
PUP.Optional.ExtensionNSUU.Generic, C:\USERS\LUBKA\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\EXTENSIONS\HBBADCMBPGMBDLECGGOPIOCGFBKCGONA, Keine Aktion durch Benutzer, [14734], [553092],1.0.11712
Trojan.CrthRazy.Generic, C:\USERS\LUBKA\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\Default\Sync Extension Settings\pkedcjkdefgpdelpbcmbmeomcjbeemfm, Keine Aktion durch Benutzer, [14647], [676732],1.0.11712
Trojan.CrthRazy.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\7519.422.0.3_0\_locales\zh_TW, Keine Aktion durch Benutzer, [14647], [676732],1.0.11712
Trojan.CrthRazy.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\7519.422.0.3_0\_locales\fil, Keine Aktion durch Benutzer, [14647], [676732],1.0.11712
Trojan.CrthRazy.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\7519.422.0.3_0\_locales\ca, Keine Aktion durch Benutzer, [14647], [676732],1.0.11712
Trojan.CrthRazy.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\7519.422.0.3_0\_locales\iw, Keine Aktion durch Benutzer, [14647], [676732],1.0.11712
Trojan.CrthRazy.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\7519.422.0.3_0\_locales\am, Keine Aktion durch Benutzer, [14647], [676732],1.0.11712
Trojan.CrthRazy.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\7519.422.0.3_0\_locales\ar, Keine Aktion durch Benutzer, [14647], [676732],1.0.11712
Trojan.CrthRazy.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\7519.422.0.3_0\_locales\bg, Keine Aktion durch Benutzer, [14647], [676732],1.0.11712
Trojan.CrthRazy.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\7519.422.0.3_0\_locales\bn, Keine Aktion durch Benutzer, [14647], [676732],1.0.11712
Trojan.CrthRazy.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\7519.422.0.3_0\_locales\es, Keine Aktion durch Benutzer, [14647], [676732],1.0.11712
Trojan.CrthRazy.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\7519.422.0.3_0\_locales\cs, Keine Aktion durch Benutzer, [14647], [676732],1.0.11712
Trojan.CrthRazy.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\7519.422.0.3_0\_locales\da, Keine Aktion durch Benutzer, [14647], [676732],1.0.11712
Trojan.CrthRazy.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\7519.422.0.3_0\_locales\de, Keine Aktion durch Benutzer, [14647], [676732],1.0.11712
Trojan.CrthRazy.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\7519.422.0.3_0\_locales\el, Keine Aktion durch Benutzer, [14647], [676732],1.0.11712
Trojan.CrthRazy.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\7519.422.0.3_0\_locales\en, Keine Aktion durch Benutzer, [14647], [676732],1.0.11712
Trojan.CrthRazy.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\7519.422.0.3_0\_locales\et, Keine Aktion durch Benutzer, [14647], [676732],1.0.11712
Trojan.CrthRazy.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\7519.422.0.3_0\_locales\fa, Keine Aktion durch Benutzer, [14647], [676732],1.0.11712
Trojan.CrthRazy.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\7519.422.0.3_0\_locales\fi, Keine Aktion durch Benutzer, [14647], [676732],1.0.11712
Trojan.CrthRazy.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\7519.422.0.3_0\_locales\fr, Keine Aktion durch Benutzer, [14647], [676732],1.0.11712
Trojan.CrthRazy.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\7519.422.0.3_0\_locales\gu, Keine Aktion durch Benutzer, [14647], [676732],1.0.11712
Trojan.CrthRazy.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\7519.422.0.3_0\_locales\hi, Keine Aktion durch Benutzer, [14647], [676732],1.0.11712
Trojan.CrthRazy.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\7519.422.0.3_0\_locales\hr, Keine Aktion durch Benutzer, [14647], [676732],1.0.11712
Trojan.CrthRazy.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\7519.422.0.3_0\_locales\hu, Keine Aktion durch Benutzer, [14647], [676732],1.0.11712
Trojan.CrthRazy.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\7519.422.0.3_0\_locales\id, Keine Aktion durch Benutzer, [14647], [676732],1.0.11712
Trojan.CrthRazy.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\7519.422.0.3_0\_locales\it, Keine Aktion durch Benutzer, [14647], [676732],1.0.11712
Trojan.CrthRazy.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\7519.422.0.3_0\_locales\ja, Keine Aktion durch Benutzer, [14647], [676732],1.0.11712
Trojan.CrthRazy.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\7519.422.0.3_0\_locales\kn, Keine Aktion durch Benutzer, [14647], [676732],1.0.11712
Trojan.CrthRazy.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\7519.422.0.3_0\_locales\ko, Keine Aktion durch Benutzer, [14647], [676732],1.0.11712
Trojan.CrthRazy.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\7519.422.0.3_0\_locales\lt, Keine Aktion durch Benutzer, [14647], [676732],1.0.11712
Trojan.CrthRazy.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\7519.422.0.3_0\_locales\lv, Keine Aktion durch Benutzer, [14647], [676732],1.0.11712
Trojan.CrthRazy.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\7519.422.0.3_0\_locales\ml, Keine Aktion durch Benutzer, [14647], [676732],1.0.11712
Trojan.CrthRazy.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\7519.422.0.3_0\_locales\mr, Keine Aktion durch Benutzer, [14647], [676732],1.0.11712
Trojan.CrthRazy.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\7519.422.0.3_0\_locales\ms, Keine Aktion durch Benutzer, [14647], [676732],1.0.11712
Trojan.CrthRazy.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\7519.422.0.3_0\_locales\nb, Keine Aktion durch Benutzer, [14647], [676732],1.0.11712
Trojan.CrthRazy.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\7519.422.0.3_0\_locales\nl, Keine Aktion durch Benutzer, [14647], [676732],1.0.11712
Trojan.CrthRazy.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\7519.422.0.3_0\_locales\pl, Keine Aktion durch Benutzer, [14647], [676732],1.0.11712
Trojan.CrthRazy.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\7519.422.0.3_0\_locales\pt, Keine Aktion durch Benutzer, [14647], [676732],1.0.11712
Trojan.CrthRazy.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\7519.422.0.3_0\_locales\ro, Keine Aktion durch Benutzer, [14647], [676732],1.0.11712
Trojan.CrthRazy.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\7519.422.0.3_0\_locales\ru, Keine Aktion durch Benutzer, [14647], [676732],1.0.11712
Trojan.CrthRazy.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\7519.422.0.3_0\_locales\sk, Keine Aktion durch Benutzer, [14647], [676732],1.0.11712
Trojan.CrthRazy.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\7519.422.0.3_0\_locales\sl, Keine Aktion durch Benutzer, [14647], [676732],1.0.11712
Trojan.CrthRazy.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\7519.422.0.3_0\_locales\sr, Keine Aktion durch Benutzer, [14647], [676732],1.0.11712
Trojan.CrthRazy.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\7519.422.0.3_0\_locales\sv, Keine Aktion durch Benutzer, [14647], [676732],1.0.11712
Trojan.CrthRazy.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\7519.422.0.3_0\_locales\sw, Keine Aktion durch Benutzer, [14647], [676732],1.0.11712
Trojan.CrthRazy.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\7519.422.0.3_0\_locales\ta, Keine Aktion durch Benutzer, [14647], [676732],1.0.11712
Trojan.CrthRazy.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\7519.422.0.3_0\_locales\te, Keine Aktion durch Benutzer, [14647], [676732],1.0.11712
Trojan.CrthRazy.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\7519.422.0.3_0\_locales\th, Keine Aktion durch Benutzer, [14647], [676732],1.0.11712
Trojan.CrthRazy.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\7519.422.0.3_0\_locales\tr, Keine Aktion durch Benutzer, [14647], [676732],1.0.11712
Trojan.CrthRazy.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\7519.422.0.3_0\_locales\uk, Keine Aktion durch Benutzer, [14647], [676732],1.0.11712
Trojan.CrthRazy.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\7519.422.0.3_0\_locales\vi, Keine Aktion durch Benutzer, [14647], [676732],1.0.11712
Trojan.CrthRazy.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\7519.422.0.3_0\_locales\zh, Keine Aktion durch Benutzer, [14647], [676732],1.0.11712
Trojan.CrthRazy.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\7519.422.0.3_0\cast_setup, Keine Aktion durch Benutzer, [14647], [676732],1.0.11712
Trojan.CrthRazy.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\7519.422.0.3_0\_metadata, Keine Aktion durch Benutzer, [14647], [676732],1.0.11712
Trojan.CrthRazy.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\7519.422.0.3_0\_locales, Keine Aktion durch Benutzer, [14647], [676732],1.0.11712
Trojan.CrthRazy.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\7519.422.0.3_0, Keine Aktion durch Benutzer, [14647], [676732],1.0.11712
Trojan.CrthRazy.Generic, C:\USERS\LUBKA\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\EXTENSIONS\PKEDCJKDEFGPDELPBCMBMEOMCJBEEMFM, Keine Aktion durch Benutzer, [14647], [676732],1.0.11712
Trojan.CrthRazy.E.Generic, C:\USERS\LUBKA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BT6JBW3E.DEFAULT\EXTENSIONS\{14553439-2741-4E9D-B474-784F336F58C9}, Keine Aktion durch Benutzer, [14627], [689343],1.0.11712

Datei: 237
PUP.Optional.MailRu, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\iepoegkaoeljnbhagabakjodgpfniimo\15.1.4.3_0\icons\128.png, Keine Aktion durch Benutzer, [255], [655213],1.0.11712
PUP.Optional.MailRu, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\iepoegkaoeljnbhagabakjodgpfniimo\15.1.4.3_0\icons\16.png, Keine Aktion durch Benutzer, [255], [655213],1.0.11712
PUP.Optional.MailRu, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\iepoegkaoeljnbhagabakjodgpfniimo\15.1.4.3_0\icons\32.png, Keine Aktion durch Benutzer, [255], [655213],1.0.11712
PUP.Optional.MailRu, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\iepoegkaoeljnbhagabakjodgpfniimo\15.1.4.3_0\icons\48.png, Keine Aktion durch Benutzer, [255], [655213],1.0.11712
PUP.Optional.MailRu, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\iepoegkaoeljnbhagabakjodgpfniimo\15.1.4.3_0\_metadata\computed_hashes.json, Keine Aktion durch Benutzer, [255], [655213],1.0.11712
PUP.Optional.MailRu, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\iepoegkaoeljnbhagabakjodgpfniimo\15.1.4.3_0\_metadata\verified_contents.json, Keine Aktion durch Benutzer, [255], [655213],1.0.11712
PUP.Optional.MailRu, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\iepoegkaoeljnbhagabakjodgpfniimo\15.1.4.3_0\background.js, Keine Aktion durch Benutzer, [255], [655213],1.0.11712
PUP.Optional.MailRu, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\iepoegkaoeljnbhagabakjodgpfniimo\15.1.4.3_0\manifest.json, Keine Aktion durch Benutzer, [255], [655213],1.0.11712
PUP.Optional.MailRu, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\iepoegkaoeljnbhagabakjodgpfniimo\000003.log, Keine Aktion durch Benutzer, [255], [655213],1.0.11712
PUP.Optional.MailRu, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\iepoegkaoeljnbhagabakjodgpfniimo\CURRENT, Keine Aktion durch Benutzer, [255], [655213],1.0.11712
PUP.Optional.MailRu, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\iepoegkaoeljnbhagabakjodgpfniimo\LOCK, Keine Aktion durch Benutzer, [255], [655213],1.0.11712
PUP.Optional.MailRu, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\iepoegkaoeljnbhagabakjodgpfniimo\LOG, Keine Aktion durch Benutzer, [255], [655213],1.0.11712
PUP.Optional.MailRu, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\iepoegkaoeljnbhagabakjodgpfniimo\LOG.old, Keine Aktion durch Benutzer, [255], [655213],1.0.11712
PUP.Optional.MailRu, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\iepoegkaoeljnbhagabakjodgpfniimo\MANIFEST-000001, Keine Aktion durch Benutzer, [255], [655213],1.0.11712
PUP.Optional.MailRu, C:\USERS\LUBKA\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\Default\Preferences, Keine Aktion durch Benutzer, [255], [655213],1.0.11712
PUP.Optional.VisualBookmarks.ChrPRST, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\hjdkfkdkokphfploiiddakjokndinfgb\5.3.23_0\assets\img\loaded-empty.png, Keine Aktion durch Benutzer, [2580], [695272],1.0.11712
PUP.Optional.VisualBookmarks.ChrPRST, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\hjdkfkdkokphfploiiddakjokndinfgb\5.3.23_0\assets\resources\currency-arrow-dark-up.png, Keine Aktion durch Benutzer, [2580], [695272],1.0.11712
PUP.Optional.VisualBookmarks.ChrPRST, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\hjdkfkdkokphfploiiddakjokndinfgb\5.3.23_0\assets\resources\currency-arrow-light-down.png, Keine Aktion durch Benutzer, [2580], [695272],1.0.11712
PUP.Optional.VisualBookmarks.ChrPRST, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\hjdkfkdkokphfploiiddakjokndinfgb\5.3.23_0\assets\resources\currency-arrow-light-up.png, Keine Aktion durch Benutzer, [2580], [695272],1.0.11712
PUP.Optional.VisualBookmarks.ChrPRST, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\hjdkfkdkokphfploiiddakjokndinfgb\5.3.23_0\assets\resources\search-cancel-button.png, Keine Aktion durch Benutzer, [2580], [695272],1.0.11712
PUP.Optional.VisualBookmarks.ChrPRST, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\hjdkfkdkokphfploiiddakjokndinfgb\5.3.23_0\img\browser-action\add-128.png, Keine Aktion durch Benutzer, [2580], [695272],1.0.11712
PUP.Optional.VisualBookmarks.ChrPRST, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\hjdkfkdkokphfploiiddakjokndinfgb\5.3.23_0\img\browser-action\add-16.png, Keine Aktion durch Benutzer, [2580], [695272],1.0.11712
PUP.Optional.VisualBookmarks.ChrPRST, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\hjdkfkdkokphfploiiddakjokndinfgb\5.3.23_0\img\browser-action\add-32.png, Keine Aktion durch Benutzer, [2580], [695272],1.0.11712
PUP.Optional.VisualBookmarks.ChrPRST, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\hjdkfkdkokphfploiiddakjokndinfgb\5.3.23_0\img\browser-action\add-48.png, Keine Aktion durch Benutzer, [2580], [695272],1.0.11712
PUP.Optional.VisualBookmarks.ChrPRST, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\hjdkfkdkokphfploiiddakjokndinfgb\5.3.23_0\img\browser-action\added-128.png, Keine Aktion durch Benutzer, [2580], [695272],1.0.11712
PUP.Optional.VisualBookmarks.ChrPRST, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\hjdkfkdkokphfploiiddakjokndinfgb\5.3.23_0\img\browser-action\added-16.png, Keine Aktion durch Benutzer, [2580], [695272],1.0.11712
PUP.Optional.VisualBookmarks.ChrPRST, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\hjdkfkdkokphfploiiddakjokndinfgb\5.3.23_0\img\browser-action\added-32.png, Keine Aktion durch Benutzer, [2580], [695272],1.0.11712
PUP.Optional.VisualBookmarks.ChrPRST, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\hjdkfkdkokphfploiiddakjokndinfgb\5.3.23_0\img\browser-action\added-48.png, Keine Aktion durch Benutzer, [2580], [695272],1.0.11712
PUP.Optional.VisualBookmarks.ChrPRST, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\hjdkfkdkokphfploiiddakjokndinfgb\5.3.23_0\img\browser-action\disabled-128.png, Keine Aktion durch Benutzer, [2580], [695272],1.0.11712
PUP.Optional.VisualBookmarks.ChrPRST, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\hjdkfkdkokphfploiiddakjokndinfgb\5.3.23_0\img\browser-action\disabled-16.png, Keine Aktion durch Benutzer, [2580], [695272],1.0.11712
PUP.Optional.VisualBookmarks.ChrPRST, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\hjdkfkdkokphfploiiddakjokndinfgb\5.3.23_0\img\browser-action\disabled-32.png, Keine Aktion durch Benutzer, [2580], [695272],1.0.11712
PUP.Optional.VisualBookmarks.ChrPRST, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\hjdkfkdkokphfploiiddakjokndinfgb\5.3.23_0\img\browser-action\disabled-48.png, Keine Aktion durch Benutzer, [2580], [695272],1.0.11712
PUP.Optional.VisualBookmarks.ChrPRST, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\hjdkfkdkokphfploiiddakjokndinfgb\5.3.23_0\img\icons\icon-128.png, Keine Aktion durch Benutzer, [2580], [695272],1.0.11712
PUP.Optional.VisualBookmarks.ChrPRST, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\hjdkfkdkokphfploiiddakjokndinfgb\5.3.23_0\img\icons\icon-16.png, Keine Aktion durch Benutzer, [2580], [695272],1.0.11712
PUP.Optional.VisualBookmarks.ChrPRST, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\hjdkfkdkokphfploiiddakjokndinfgb\5.3.23_0\img\icons\icon-32.png, Keine Aktion durch Benutzer, [2580], [695272],1.0.11712
PUP.Optional.VisualBookmarks.ChrPRST, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\hjdkfkdkokphfploiiddakjokndinfgb\5.3.23_0\img\icons\icon-48.png, Keine Aktion durch Benutzer, [2580], [695272],1.0.11712
PUP.Optional.VisualBookmarks.ChrPRST, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\hjdkfkdkokphfploiiddakjokndinfgb\5.3.23_0\img\black-cross.png, Keine Aktion durch Benutzer, [2580], [695272],1.0.11712
PUP.Optional.VisualBookmarks.ChrPRST, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\hjdkfkdkokphfploiiddakjokndinfgb\5.3.23_0\img\spinner.png, Keine Aktion durch Benutzer, [2580], [695272],1.0.11712
PUP.Optional.VisualBookmarks.ChrPRST, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\hjdkfkdkokphfploiiddakjokndinfgb\5.3.23_0\img\trash.png, Keine Aktion durch Benutzer, [2580], [695272],1.0.11712
PUP.Optional.VisualBookmarks.ChrPRST, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\hjdkfkdkokphfploiiddakjokndinfgb\5.3.23_0\img\white-cross.png, Keine Aktion durch Benutzer, [2580], [695272],1.0.11712
PUP.Optional.VisualBookmarks.ChrPRST, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\hjdkfkdkokphfploiiddakjokndinfgb\5.3.23_0\_locales\en\messages.json, Keine Aktion durch Benutzer, [2580], [695272],1.0.11712
PUP.Optional.VisualBookmarks.ChrPRST, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\hjdkfkdkokphfploiiddakjokndinfgb\5.3.23_0\_locales\ru\messages.json, Keine Aktion durch Benutzer, [2580], [695272],1.0.11712
PUP.Optional.VisualBookmarks.ChrPRST, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\hjdkfkdkokphfploiiddakjokndinfgb\5.3.23_0\_metadata\computed_hashes.json, Keine Aktion durch Benutzer, [2580], [695272],1.0.11712
PUP.Optional.VisualBookmarks.ChrPRST, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\hjdkfkdkokphfploiiddakjokndinfgb\5.3.23_0\_metadata\verified_contents.json, Keine Aktion durch Benutzer, [2580], [695272],1.0.11712
PUP.Optional.VisualBookmarks.ChrPRST, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\hjdkfkdkokphfploiiddakjokndinfgb\5.3.23_0\app.bundle.css, Keine Aktion durch Benutzer, [2580], [695272],1.0.11712
PUP.Optional.VisualBookmarks.ChrPRST, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\hjdkfkdkokphfploiiddakjokndinfgb\5.3.23_0\app.bundle.js, Keine Aktion durch Benutzer, [2580], [695272],1.0.11712
PUP.Optional.VisualBookmarks.ChrPRST, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\hjdkfkdkokphfploiiddakjokndinfgb\5.3.23_0\background.bundle.css, Keine Aktion durch Benutzer, [2580], [695272],1.0.11712
PUP.Optional.VisualBookmarks.ChrPRST, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\hjdkfkdkokphfploiiddakjokndinfgb\5.3.23_0\background.bundle.js, Keine Aktion durch Benutzer, [2580], [695272],1.0.11712
PUP.Optional.VisualBookmarks.ChrPRST, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\hjdkfkdkokphfploiiddakjokndinfgb\5.3.23_0\background.html, Keine Aktion durch Benutzer, [2580], [695272],1.0.11712
PUP.Optional.VisualBookmarks.ChrPRST, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\hjdkfkdkokphfploiiddakjokndinfgb\5.3.23_0\manifest.json, Keine Aktion durch Benutzer, [2580], [695272],1.0.11712
PUP.Optional.VisualBookmarks.ChrPRST, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\hjdkfkdkokphfploiiddakjokndinfgb\5.3.23_0\prerender.js, Keine Aktion durch Benutzer, [2580], [695272],1.0.11712
PUP.Optional.VisualBookmarks.ChrPRST, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\hjdkfkdkokphfploiiddakjokndinfgb\5.3.23_0\pulse-feed-8.5.0-0.standalone.js, Keine Aktion durch Benutzer, [2580], [695272],1.0.11712
PUP.Optional.VisualBookmarks.ChrPRST, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\hjdkfkdkokphfploiiddakjokndinfgb\5.3.23_0\vendors~app.bundle.css, Keine Aktion durch Benutzer, [2580], [695272],1.0.11712
PUP.Optional.VisualBookmarks.ChrPRST, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\hjdkfkdkokphfploiiddakjokndinfgb\5.3.23_0\vendors~app.bundle.js, Keine Aktion durch Benutzer, [2580], [695272],1.0.11712
PUP.Optional.VisualBookmarks.ChrPRST, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\hjdkfkdkokphfploiiddakjokndinfgb\5.3.23_0\vendors~app.bundle~background.bundle.css, Keine Aktion durch Benutzer, [2580], [695272],1.0.11712
PUP.Optional.VisualBookmarks.ChrPRST, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\hjdkfkdkokphfploiiddakjokndinfgb\5.3.23_0\vendors~app.bundle~background.bundle.js, Keine Aktion durch Benutzer, [2580], [695272],1.0.11712
PUP.Optional.VisualBookmarks.ChrPRST, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\hjdkfkdkokphfploiiddakjokndinfgb\5.3.23_0\vendors~background.bundle.js, Keine Aktion durch Benutzer, [2580], [695272],1.0.11712
PUP.Optional.VisualBookmarks.ChrPRST, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\hjdkfkdkokphfploiiddakjokndinfgb\5.3.23_0\visual-bookmarks.html, Keine Aktion durch Benutzer, [2580], [695272],1.0.11712
PUP.Optional.VisualBookmarks.ChrPRST, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hjdkfkdkokphfploiiddakjokndinfgb\000003.log, Keine Aktion durch Benutzer, [2580], [695272],1.0.11712
PUP.Optional.VisualBookmarks.ChrPRST, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hjdkfkdkokphfploiiddakjokndinfgb\CURRENT, Keine Aktion durch Benutzer, [2580], [695272],1.0.11712
PUP.Optional.VisualBookmarks.ChrPRST, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hjdkfkdkokphfploiiddakjokndinfgb\LOCK, Keine Aktion durch Benutzer, [2580], [695272],1.0.11712
PUP.Optional.VisualBookmarks.ChrPRST, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hjdkfkdkokphfploiiddakjokndinfgb\LOG, Keine Aktion durch Benutzer, [2580], [695272],1.0.11712
PUP.Optional.VisualBookmarks.ChrPRST, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hjdkfkdkokphfploiiddakjokndinfgb\LOG.old, Keine Aktion durch Benutzer, [2580], [695272],1.0.11712
PUP.Optional.VisualBookmarks.ChrPRST, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hjdkfkdkokphfploiiddakjokndinfgb\MANIFEST-000001, Keine Aktion durch Benutzer, [2580], [695272],1.0.11712
PUP.Optional.VisualBookmarks.ChrPRST, C:\USERS\LUBKA\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\Default\Preferences, Keine Aktion durch Benutzer, [2580], [695272],1.0.11712
PUP.Optional.VisualBookmarks.ChrPRST, C:\PROGRAMDATA\NTUSER.POL, Keine Aktion durch Benutzer, [2580], [-1],0.0.0
PUP.Optional.VisualBookmarks.ChrPRST, C:\USERS\JOZKO\NTUSER.POL, Keine Aktion durch Benutzer, [2580], [-1],0.0.0
PUP.Optional.VisualBookmarks.ChrPRST, C:\USERS\LUBKA\NTUSER.POL, Keine Aktion durch Benutzer, [2580], [-1],0.0.0
PUP.Optional.VisualBookmarks.ChrPRST, C:\WINDOWS\SYSTEM32\GROUPPOLICY\USER\REGISTRY.POL, Keine Aktion durch Benutzer, [2580], [-1],0.0.0
PUP.Optional.VisualBookmarks.ChrPRST, C:\WINDOWS\SYSTEM32\GROUPPOLICY\MACHINE\REGISTRY.POL, Keine Aktion durch Benutzer, [2580], [-1],0.0.0
PUP.Optional.ExtensionNSUU.Generic, C:\WINDOWS\SYSTEM32\GROUPPOLICY\MACHINE\REGISTRY.POL, Keine Aktion durch Benutzer, [14734], [553092],1.0.11712
PUP.Optional.ExtensionNSUU.Generic, C:\USERS\LUBKA\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\Default\Secure Preferences, Keine Aktion durch Benutzer, [14734], [553092],1.0.11712
PUP.Optional.ExtensionNSUU.Generic, C:\USERS\LUBKA\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\Default\Preferences, Keine Aktion durch Benutzer, [14734], [553092],1.0.11712
PUP.Optional.ExtensionNSUU.Generic, C:\USERS\LUBKA\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\EXTENSIONS\HBBADCMBPGMBDLECGGOPIOCGFBKCGONA\2.8.0.39_0\MANIFEST.JSON, Keine Aktion durch Benutzer, [14734], [553092],1.0.11712
PUP.Optional.ExtensionNSUU.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\hbbadcmbpgmbdlecggopiocgfbkcgona\2.8.0.39_0\icons\ficon128.png, Keine Aktion durch Benutzer, [14734], [553092],1.0.11712
PUP.Optional.ExtensionNSUU.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\hbbadcmbpgmbdlecggopiocgfbkcgona\2.8.0.39_0\icons\icon128.png, Keine Aktion durch Benutzer, [14734], [553092],1.0.11712
PUP.Optional.ExtensionNSUU.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\hbbadcmbpgmbdlecggopiocgfbkcgona\2.8.0.39_0\icons\icon16.png, Keine Aktion durch Benutzer, [14734], [553092],1.0.11712
PUP.Optional.ExtensionNSUU.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\hbbadcmbpgmbdlecggopiocgfbkcgona\2.8.0.39_0\icons\icon48.png, Keine Aktion durch Benutzer, [14734], [553092],1.0.11712
PUP.Optional.ExtensionNSUU.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\hbbadcmbpgmbdlecggopiocgfbkcgona\2.8.0.39_0\_locales\he\messages.json, Keine Aktion durch Benutzer, [14734], [553092],1.0.11712
PUP.Optional.ExtensionNSUU.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\hbbadcmbpgmbdlecggopiocgfbkcgona\2.8.0.39_0\_locales\am\messages.json, Keine Aktion durch Benutzer, [14734], [553092],1.0.11712
PUP.Optional.ExtensionNSUU.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\hbbadcmbpgmbdlecggopiocgfbkcgona\2.8.0.39_0\_locales\ar\messages.json, Keine Aktion durch Benutzer, [14734], [553092],1.0.11712
PUP.Optional.ExtensionNSUU.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\hbbadcmbpgmbdlecggopiocgfbkcgona\2.8.0.39_0\_locales\be\messages.json, Keine Aktion durch Benutzer, [14734], [553092],1.0.11712
PUP.Optional.ExtensionNSUU.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\hbbadcmbpgmbdlecggopiocgfbkcgona\2.8.0.39_0\_locales\bg\messages.json, Keine Aktion durch Benutzer, [14734], [553092],1.0.11712
PUP.Optional.ExtensionNSUU.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\hbbadcmbpgmbdlecggopiocgfbkcgona\2.8.0.39_0\_locales\bn\messages.json, Keine Aktion durch Benutzer, [14734], [553092],1.0.11712
PUP.Optional.ExtensionNSUU.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\hbbadcmbpgmbdlecggopiocgfbkcgona\2.8.0.39_0\_locales\ca\messages.json, Keine Aktion durch Benutzer, [14734], [553092],1.0.11712
PUP.Optional.ExtensionNSUU.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\hbbadcmbpgmbdlecggopiocgfbkcgona\2.8.0.39_0\_locales\cs\messages.json, Keine Aktion durch Benutzer, [14734], [553092],1.0.11712
PUP.Optional.ExtensionNSUU.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\hbbadcmbpgmbdlecggopiocgfbkcgona\2.8.0.39_0\_locales\da\messages.json, Keine Aktion durch Benutzer, [14734], [553092],1.0.11712
PUP.Optional.ExtensionNSUU.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\hbbadcmbpgmbdlecggopiocgfbkcgona\2.8.0.39_0\_locales\de\messages.json, Keine Aktion durch Benutzer, [14734], [553092],1.0.11712
PUP.Optional.ExtensionNSUU.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\hbbadcmbpgmbdlecggopiocgfbkcgona\2.8.0.39_0\_locales\el\messages.json, Keine Aktion durch Benutzer, [14734], [553092],1.0.11712
PUP.Optional.ExtensionNSUU.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\hbbadcmbpgmbdlecggopiocgfbkcgona\2.8.0.39_0\_locales\en\messages.json, Keine Aktion durch Benutzer, [14734], [553092],1.0.11712
PUP.Optional.ExtensionNSUU.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\hbbadcmbpgmbdlecggopiocgfbkcgona\2.8.0.39_0\_locales\en_BS\messages.json, Keine Aktion durch Benutzer, [14734], [553092],1.0.11712
PUP.Optional.ExtensionNSUU.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\hbbadcmbpgmbdlecggopiocgfbkcgona\2.8.0.39_0\_locales\en_GB\messages.json, Keine Aktion durch Benutzer, [14734], [553092],1.0.11712
PUP.Optional.ExtensionNSUU.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\hbbadcmbpgmbdlecggopiocgfbkcgona\2.8.0.39_0\_locales\en_US\messages.json, Keine Aktion durch Benutzer, [14734], [553092],1.0.11712
PUP.Optional.ExtensionNSUU.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\hbbadcmbpgmbdlecggopiocgfbkcgona\2.8.0.39_0\_locales\es\messages.json, Keine Aktion durch Benutzer, [14734], [553092],1.0.11712
PUP.Optional.ExtensionNSUU.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\hbbadcmbpgmbdlecggopiocgfbkcgona\2.8.0.39_0\_locales\es_419\messages.json, Keine Aktion durch Benutzer, [14734], [553092],1.0.11712
PUP.Optional.ExtensionNSUU.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\hbbadcmbpgmbdlecggopiocgfbkcgona\2.8.0.39_0\_locales\et\messages.json, Keine Aktion durch Benutzer, [14734], [553092],1.0.11712
PUP.Optional.ExtensionNSUU.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\hbbadcmbpgmbdlecggopiocgfbkcgona\2.8.0.39_0\_locales\fa\messages.json, Keine Aktion durch Benutzer, [14734], [553092],1.0.11712
PUP.Optional.ExtensionNSUU.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\hbbadcmbpgmbdlecggopiocgfbkcgona\2.8.0.39_0\_locales\fi\messages.json, Keine Aktion durch Benutzer, [14734], [553092],1.0.11712
PUP.Optional.ExtensionNSUU.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\hbbadcmbpgmbdlecggopiocgfbkcgona\2.8.0.39_0\_locales\fil\messages.json, Keine Aktion durch Benutzer, [14734], [553092],1.0.11712
PUP.Optional.ExtensionNSUU.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\hbbadcmbpgmbdlecggopiocgfbkcgona\2.8.0.39_0\_locales\fr\messages.json, Keine Aktion durch Benutzer, [14734], [553092],1.0.11712
PUP.Optional.ExtensionNSUU.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\hbbadcmbpgmbdlecggopiocgfbkcgona\2.8.0.39_0\_locales\gu\messages.json, Keine Aktion durch Benutzer, [14734], [553092],1.0.11712
PUP.Optional.ExtensionNSUU.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\hbbadcmbpgmbdlecggopiocgfbkcgona\2.8.0.39_0\_locales\hi\messages.json, Keine Aktion durch Benutzer, [14734], [553092],1.0.11712
PUP.Optional.ExtensionNSUU.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\hbbadcmbpgmbdlecggopiocgfbkcgona\2.8.0.39_0\_locales\hr\messages.json, Keine Aktion durch Benutzer, [14734], [553092],1.0.11712
PUP.Optional.ExtensionNSUU.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\hbbadcmbpgmbdlecggopiocgfbkcgona\2.8.0.39_0\_locales\hu\messages.json, Keine Aktion durch Benutzer, [14734], [553092],1.0.11712
PUP.Optional.ExtensionNSUU.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\hbbadcmbpgmbdlecggopiocgfbkcgona\2.8.0.39_0\_locales\id\messages.json, Keine Aktion durch Benutzer, [14734], [553092],1.0.11712
PUP.Optional.ExtensionNSUU.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\hbbadcmbpgmbdlecggopiocgfbkcgona\2.8.0.39_0\_locales\it\messages.json, Keine Aktion durch Benutzer, [14734], [553092],1.0.11712
PUP.Optional.ExtensionNSUU.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\hbbadcmbpgmbdlecggopiocgfbkcgona\2.8.0.39_0\_locales\ja\messages.json, Keine Aktion durch Benutzer, [14734], [553092],1.0.11712
PUP.Optional.ExtensionNSUU.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\hbbadcmbpgmbdlecggopiocgfbkcgona\2.8.0.39_0\_locales\kn\messages.json, Keine Aktion durch Benutzer, [14734], [553092],1.0.11712
PUP.Optional.ExtensionNSUU.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\hbbadcmbpgmbdlecggopiocgfbkcgona\2.8.0.39_0\_locales\ko\messages.json, Keine Aktion durch Benutzer, [14734], [553092],1.0.11712
PUP.Optional.ExtensionNSUU.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\hbbadcmbpgmbdlecggopiocgfbkcgona\2.8.0.39_0\_locales\lt\messages.json, Keine Aktion durch Benutzer, [14734], [553092],1.0.11712
PUP.Optional.ExtensionNSUU.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\hbbadcmbpgmbdlecggopiocgfbkcgona\2.8.0.39_0\_locales\lv\messages.json, Keine Aktion durch Benutzer, [14734], [553092],1.0.11712
PUP.Optional.ExtensionNSUU.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\hbbadcmbpgmbdlecggopiocgfbkcgona\2.8.0.39_0\_locales\mk\messages.json, Keine Aktion durch Benutzer, [14734], [553092],1.0.11712
PUP.Optional.ExtensionNSUU.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\hbbadcmbpgmbdlecggopiocgfbkcgona\2.8.0.39_0\_locales\ml\messages.json, Keine Aktion durch Benutzer, [14734], [553092],1.0.11712
PUP.Optional.ExtensionNSUU.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\hbbadcmbpgmbdlecggopiocgfbkcgona\2.8.0.39_0\_locales\mr\messages.json, Keine Aktion durch Benutzer, [14734], [553092],1.0.11712
PUP.Optional.ExtensionNSUU.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\hbbadcmbpgmbdlecggopiocgfbkcgona\2.8.0.39_0\_locales\ms\messages.json, Keine Aktion durch Benutzer, [14734], [553092],1.0.11712
PUP.Optional.ExtensionNSUU.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\hbbadcmbpgmbdlecggopiocgfbkcgona\2.8.0.39_0\_locales\nl\messages.json, Keine Aktion durch Benutzer, [14734], [553092],1.0.11712
PUP.Optional.ExtensionNSUU.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\hbbadcmbpgmbdlecggopiocgfbkcgona\2.8.0.39_0\_locales\no\messages.json, Keine Aktion durch Benutzer, [14734], [553092],1.0.11712
PUP.Optional.ExtensionNSUU.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\hbbadcmbpgmbdlecggopiocgfbkcgona\2.8.0.39_0\_locales\pl\messages.json, Keine Aktion durch Benutzer, [14734], [553092],1.0.11712
PUP.Optional.ExtensionNSUU.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\hbbadcmbpgmbdlecggopiocgfbkcgona\2.8.0.39_0\_locales\pt\messages.json, Keine Aktion durch Benutzer, [14734], [553092],1.0.11712
PUP.Optional.ExtensionNSUU.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\hbbadcmbpgmbdlecggopiocgfbkcgona\2.8.0.39_0\_locales\pt_BR\messages.json, Keine Aktion durch Benutzer, [14734], [553092],1.0.11712
PUP.Optional.ExtensionNSUU.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\hbbadcmbpgmbdlecggopiocgfbkcgona\2.8.0.39_0\_locales\pt_PT\messages.json, Keine Aktion durch Benutzer, [14734], [553092],1.0.11712
PUP.Optional.ExtensionNSUU.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\hbbadcmbpgmbdlecggopiocgfbkcgona\2.8.0.39_0\_locales\ro\messages.json, Keine Aktion durch Benutzer, [14734], [553092],1.0.11712
PUP.Optional.ExtensionNSUU.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\hbbadcmbpgmbdlecggopiocgfbkcgona\2.8.0.39_0\_locales\ru\messages.json, Keine Aktion durch Benutzer, [14734], [553092],1.0.11712
PUP.Optional.ExtensionNSUU.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\hbbadcmbpgmbdlecggopiocgfbkcgona\2.8.0.39_0\_locales\sk\messages.json, Keine Aktion durch Benutzer, [14734], [553092],1.0.11712
PUP.Optional.ExtensionNSUU.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\hbbadcmbpgmbdlecggopiocgfbkcgona\2.8.0.39_0\_locales\sl\messages.json, Keine Aktion durch Benutzer, [14734], [553092],1.0.11712
PUP.Optional.ExtensionNSUU.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\hbbadcmbpgmbdlecggopiocgfbkcgona\2.8.0.39_0\_locales\sq\messages.json, Keine Aktion durch Benutzer, [14734], [553092],1.0.11712
PUP.Optional.ExtensionNSUU.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\hbbadcmbpgmbdlecggopiocgfbkcgona\2.8.0.39_0\_locales\sr\messages.json, Keine Aktion durch Benutzer, [14734], [553092],1.0.11712
PUP.Optional.ExtensionNSUU.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\hbbadcmbpgmbdlecggopiocgfbkcgona\2.8.0.39_0\_locales\sv\messages.json, Keine Aktion durch Benutzer, [14734], [553092],1.0.11712
PUP.Optional.ExtensionNSUU.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\hbbadcmbpgmbdlecggopiocgfbkcgona\2.8.0.39_0\_locales\sw\messages.json, Keine Aktion durch Benutzer, [14734], [553092],1.0.11712
PUP.Optional.ExtensionNSUU.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\hbbadcmbpgmbdlecggopiocgfbkcgona\2.8.0.39_0\_locales\ta\messages.json, Keine Aktion durch Benutzer, [14734], [553092],1.0.11712
PUP.Optional.ExtensionNSUU.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\hbbadcmbpgmbdlecggopiocgfbkcgona\2.8.0.39_0\_locales\te\messages.json, Keine Aktion durch Benutzer, [14734], [553092],1.0.11712
PUP.Optional.ExtensionNSUU.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\hbbadcmbpgmbdlecggopiocgfbkcgona\2.8.0.39_0\_locales\th\messages.json, Keine Aktion durch Benutzer, [14734], [553092],1.0.11712
PUP.Optional.ExtensionNSUU.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\hbbadcmbpgmbdlecggopiocgfbkcgona\2.8.0.39_0\_locales\tr\messages.json, Keine Aktion durch Benutzer, [14734], [553092],1.0.11712
PUP.Optional.ExtensionNSUU.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\hbbadcmbpgmbdlecggopiocgfbkcgona\2.8.0.39_0\_locales\uk\messages.json, Keine Aktion durch Benutzer, [14734], [553092],1.0.11712
PUP.Optional.ExtensionNSUU.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\hbbadcmbpgmbdlecggopiocgfbkcgona\2.8.0.39_0\_locales\vi\messages.json, Keine Aktion durch Benutzer, [14734], [553092],1.0.11712
PUP.Optional.ExtensionNSUU.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\hbbadcmbpgmbdlecggopiocgfbkcgona\2.8.0.39_0\_locales\zh_CN\messages.json, Keine Aktion durch Benutzer, [14734], [553092],1.0.11712
PUP.Optional.ExtensionNSUU.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\hbbadcmbpgmbdlecggopiocgfbkcgona\2.8.0.39_0\_locales\zh_TW\messages.json, Keine Aktion durch Benutzer, [14734], [553092],1.0.11712
Trojan.CrthRazy.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\pkedcjkdefgpdelpbcmbmeomcjbeemfm\000003.log, Keine Aktion durch Benutzer, [14647], [676732],1.0.11712
Trojan.CrthRazy.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\pkedcjkdefgpdelpbcmbmeomcjbeemfm\CURRENT, Keine Aktion durch Benutzer, [14647], [676732],1.0.11712
Trojan.CrthRazy.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\pkedcjkdefgpdelpbcmbmeomcjbeemfm\LOCK, Keine Aktion durch Benutzer, [14647], [676732],1.0.11712
Trojan.CrthRazy.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\pkedcjkdefgpdelpbcmbmeomcjbeemfm\LOG, Keine Aktion durch Benutzer, [14647], [676732],1.0.11712
Trojan.CrthRazy.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\pkedcjkdefgpdelpbcmbmeomcjbeemfm\LOG.old, Keine Aktion durch Benutzer, [14647], [676732],1.0.11712
Trojan.CrthRazy.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\pkedcjkdefgpdelpbcmbmeomcjbeemfm\MANIFEST-000001, Keine Aktion durch Benutzer, [14647], [676732],1.0.11712
Trojan.CrthRazy.Generic, C:\USERS\LUBKA\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\Default\Secure Preferences, Keine Aktion durch Benutzer, [14647], [676732],1.0.11712
Trojan.CrthRazy.Generic, C:\USERS\LUBKA\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\Default\Preferences, Keine Aktion durch Benutzer, [14647], [676732],1.0.11712
Trojan.CrthRazy.Generic, C:\USERS\LUBKA\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\EXTENSIONS\PKEDCJKDEFGPDELPBCMBMEOMCJBEEMFM\7519.422.0.3_0\3C0HMCMHLG.JS, Keine Aktion durch Benutzer, [14647], [676732],1.0.11712
Trojan.CrthRazy.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\7519.422.0.3_0\cast_setup\cast_app.js, Keine Aktion durch Benutzer, [14647], [676732],1.0.11712
Trojan.CrthRazy.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\7519.422.0.3_0\cast_setup\cast_app_min.css, Keine Aktion durch Benutzer, [14647], [676732],1.0.11712
Trojan.CrthRazy.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\7519.422.0.3_0\cast_setup\cast_app_redirect.js, Keine Aktion durch Benutzer, [14647], [676732],1.0.11712
Trojan.CrthRazy.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\7519.422.0.3_0\cast_setup\chromecast_logo_grey.png, Keine Aktion durch Benutzer, [14647], [676732],1.0.11712
Trojan.CrthRazy.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\7519.422.0.3_0\cast_setup\devices.html, Keine Aktion durch Benutzer, [14647], [676732],1.0.11712
Trojan.CrthRazy.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\7519.422.0.3_0\cast_setup\index.html, Keine Aktion durch Benutzer, [14647], [676732],1.0.11712
Trojan.CrthRazy.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\7519.422.0.3_0\cast_setup\offers.html, Keine Aktion durch Benutzer, [14647], [676732],1.0.11712
Trojan.CrthRazy.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\7519.422.0.3_0\cast_setup\setup.html, Keine Aktion durch Benutzer, [14647], [676732],1.0.11712
Trojan.CrthRazy.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\7519.422.0.3_0\_locales\iw\messages.json, Keine Aktion durch Benutzer, [14647], [676732],1.0.11712
Trojan.CrthRazy.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\7519.422.0.3_0\_locales\am\messages.json, Keine Aktion durch Benutzer, [14647], [676732],1.0.11712
Trojan.CrthRazy.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\7519.422.0.3_0\_locales\ar\messages.json, Keine Aktion durch Benutzer, [14647], [676732],1.0.11712
Trojan.CrthRazy.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\7519.422.0.3_0\_locales\bg\messages.json, Keine Aktion durch Benutzer, [14647], [676732],1.0.11712
Trojan.CrthRazy.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\7519.422.0.3_0\_locales\bn\messages.json, Keine Aktion durch Benutzer, [14647], [676732],1.0.11712
Trojan.CrthRazy.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\7519.422.0.3_0\_locales\ca\messages.json, Keine Aktion durch Benutzer, [14647], [676732],1.0.11712
Trojan.CrthRazy.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\7519.422.0.3_0\_locales\cs\messages.json, Keine Aktion durch Benutzer, [14647], [676732],1.0.11712
Trojan.CrthRazy.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\7519.422.0.3_0\_locales\da\messages.json, Keine Aktion durch Benutzer, [14647], [676732],1.0.11712
Trojan.CrthRazy.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\7519.422.0.3_0\_locales\de\messages.json, Keine Aktion durch Benutzer, [14647], [676732],1.0.11712
Trojan.CrthRazy.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\7519.422.0.3_0\_locales\el\messages.json, Keine Aktion durch Benutzer, [14647], [676732],1.0.11712
Trojan.CrthRazy.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\7519.422.0.3_0\_locales\en\messages.json, Keine Aktion durch Benutzer, [14647], [676732],1.0.11712
Trojan.CrthRazy.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\7519.422.0.3_0\_locales\es\messages.json, Keine Aktion durch Benutzer, [14647], [676732],1.0.11712
Trojan.CrthRazy.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\7519.422.0.3_0\_locales\et\messages.json, Keine Aktion durch Benutzer, [14647], [676732],1.0.11712
Trojan.CrthRazy.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\7519.422.0.3_0\_locales\fa\messages.json, Keine Aktion durch Benutzer, [14647], [676732],1.0.11712
Trojan.CrthRazy.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\7519.422.0.3_0\_locales\fi\messages.json, Keine Aktion durch Benutzer, [14647], [676732],1.0.11712
Trojan.CrthRazy.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\7519.422.0.3_0\_locales\fil\messages.json, Keine Aktion durch Benutzer, [14647], [676732],1.0.11712
Trojan.CrthRazy.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\7519.422.0.3_0\_locales\fr\messages.json, Keine Aktion durch Benutzer, [14647], [676732],1.0.11712
Trojan.CrthRazy.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\7519.422.0.3_0\_locales\gu\messages.json, Keine Aktion durch Benutzer, [14647], [676732],1.0.11712
Trojan.CrthRazy.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\7519.422.0.3_0\_locales\hi\messages.json, Keine Aktion durch Benutzer, [14647], [676732],1.0.11712
Trojan.CrthRazy.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\7519.422.0.3_0\_locales\hr\messages.json, Keine Aktion durch Benutzer, [14647], [676732],1.0.11712
Trojan.CrthRazy.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\7519.422.0.3_0\_locales\hu\messages.json, Keine Aktion durch Benutzer, [14647], [676732],1.0.11712
Trojan.CrthRazy.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\7519.422.0.3_0\_locales\id\messages.json, Keine Aktion durch Benutzer, [14647], [676732],1.0.11712
Trojan.CrthRazy.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\7519.422.0.3_0\_locales\it\messages.json, Keine Aktion durch Benutzer, [14647], [676732],1.0.11712
Trojan.CrthRazy.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\7519.422.0.3_0\_locales\ja\messages.json, Keine Aktion durch Benutzer, [14647], [676732],1.0.11712
Trojan.CrthRazy.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\7519.422.0.3_0\_locales\kn\messages.json, Keine Aktion durch Benutzer, [14647], [676732],1.0.11712
Trojan.CrthRazy.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\7519.422.0.3_0\_locales\ko\messages.json, Keine Aktion durch Benutzer, [14647], [676732],1.0.11712
Trojan.CrthRazy.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\7519.422.0.3_0\_locales\lt\messages.json, Keine Aktion durch Benutzer, [14647], [676732],1.0.11712
Trojan.CrthRazy.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\7519.422.0.3_0\_locales\lv\messages.json, Keine Aktion durch Benutzer, [14647], [676732],1.0.11712
Trojan.CrthRazy.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\7519.422.0.3_0\_locales\ml\messages.json, Keine Aktion durch Benutzer, [14647], [676732],1.0.11712
Trojan.CrthRazy.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\7519.422.0.3_0\_locales\mr\messages.json, Keine Aktion durch Benutzer, [14647], [676732],1.0.11712
Trojan.CrthRazy.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\7519.422.0.3_0\_locales\ms\messages.json, Keine Aktion durch Benutzer, [14647], [676732],1.0.11712
Trojan.CrthRazy.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\7519.422.0.3_0\_locales\nb\messages.json, Keine Aktion durch Benutzer, [14647], [676732],1.0.11712
Trojan.CrthRazy.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\7519.422.0.3_0\_locales\nl\messages.json, Keine Aktion durch Benutzer, [14647], [676732],1.0.11712
Trojan.CrthRazy.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\7519.422.0.3_0\_locales\pl\messages.json, Keine Aktion durch Benutzer, [14647], [676732],1.0.11712
Trojan.CrthRazy.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\7519.422.0.3_0\_locales\pt\messages.json, Keine Aktion durch Benutzer, [14647], [676732],1.0.11712
Trojan.CrthRazy.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\7519.422.0.3_0\_locales\ro\messages.json, Keine Aktion durch Benutzer, [14647], [676732],1.0.11712
Trojan.CrthRazy.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\7519.422.0.3_0\_locales\ru\messages.json, Keine Aktion durch Benutzer, [14647], [676732],1.0.11712
Trojan.CrthRazy.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\7519.422.0.3_0\_locales\sk\messages.json, Keine Aktion durch Benutzer, [14647], [676732],1.0.11712
Trojan.CrthRazy.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\7519.422.0.3_0\_locales\sl\messages.json, Keine Aktion durch Benutzer, [14647], [676732],1.0.11712
Trojan.CrthRazy.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\7519.422.0.3_0\_locales\sr\messages.json, Keine Aktion durch Benutzer, [14647], [676732],1.0.11712
Trojan.CrthRazy.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\7519.422.0.3_0\_locales\sv\messages.json, Keine Aktion durch Benutzer, [14647], [676732],1.0.11712
Trojan.CrthRazy.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\7519.422.0.3_0\_locales\sw\messages.json, Keine Aktion durch Benutzer, [14647], [676732],1.0.11712
Trojan.CrthRazy.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\7519.422.0.3_0\_locales\ta\messages.json, Keine Aktion durch Benutzer, [14647], [676732],1.0.11712
Trojan.CrthRazy.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\7519.422.0.3_0\_locales\te\messages.json, Keine Aktion durch Benutzer, [14647], [676732],1.0.11712
Trojan.CrthRazy.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\7519.422.0.3_0\_locales\th\messages.json, Keine Aktion durch Benutzer, [14647], [676732],1.0.11712
Trojan.CrthRazy.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\7519.422.0.3_0\_locales\tr\messages.json, Keine Aktion durch Benutzer, [14647], [676732],1.0.11712
Trojan.CrthRazy.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\7519.422.0.3_0\_locales\uk\messages.json, Keine Aktion durch Benutzer, [14647], [676732],1.0.11712
Trojan.CrthRazy.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\7519.422.0.3_0\_locales\vi\messages.json, Keine Aktion durch Benutzer, [14647], [676732],1.0.11712
Trojan.CrthRazy.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\7519.422.0.3_0\_locales\zh\messages.json, Keine Aktion durch Benutzer, [14647], [676732],1.0.11712
Trojan.CrthRazy.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\7519.422.0.3_0\_locales\zh_TW\messages.json, Keine Aktion durch Benutzer, [14647], [676732],1.0.11712
Trojan.CrthRazy.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\7519.422.0.3_0\_metadata\computed_hashes.json, Keine Aktion durch Benutzer, [14647], [676732],1.0.11712
Trojan.CrthRazy.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\7519.422.0.3_0\_metadata\verified_contents.json, Keine Aktion durch Benutzer, [14647], [676732],1.0.11712
Trojan.CrthRazy.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\7519.422.0.3_0\35KJE7TZ1V.js, Keine Aktion durch Benutzer, [14647], [676732],1.0.11712
Trojan.CrthRazy.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\7519.422.0.3_0\8DJBTIITED.js, Keine Aktion durch Benutzer, [14647], [676732],1.0.11712
Trojan.CrthRazy.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\7519.422.0.3_0\angular.js, Keine Aktion durch Benutzer, [14647], [676732],1.0.11712
Trojan.CrthRazy.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\7519.422.0.3_0\background_script.js, Keine Aktion durch Benutzer, [14647], [676732],1.0.11712
Trojan.CrthRazy.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\7519.422.0.3_0\cast_game_sender.js, Keine Aktion durch Benutzer, [14647], [676732],1.0.11712
Trojan.CrthRazy.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\7519.422.0.3_0\cast_sender.js, Keine Aktion durch Benutzer, [14647], [676732],1.0.11712
Trojan.CrthRazy.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\7519.422.0.3_0\common.js, Keine Aktion durch Benutzer, [14647], [676732],1.0.11712
Trojan.CrthRazy.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\7519.422.0.3_0\feedback.css, Keine Aktion durch Benutzer, [14647], [676732],1.0.11712
Trojan.CrthRazy.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\7519.422.0.3_0\feedback.html, Keine Aktion durch Benutzer, [14647], [676732],1.0.11712
Trojan.CrthRazy.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\7519.422.0.3_0\feedback_script.js, Keine Aktion durch Benutzer, [14647], [676732],1.0.11712
Trojan.CrthRazy.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\7519.422.0.3_0\H4Y4F4BWGJ.js, Keine Aktion durch Benutzer, [14647], [676732],1.0.11712
Trojan.CrthRazy.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\7519.422.0.3_0\manifest.json, Keine Aktion durch Benutzer, [14647], [676732],1.0.11712
Trojan.CrthRazy.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\7519.422.0.3_0\material_css_min.css, Keine Aktion durch Benutzer, [14647], [676732],1.0.11712
Trojan.CrthRazy.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\7519.422.0.3_0\mirroring_cast_streaming.js, Keine Aktion durch Benutzer, [14647], [676732],1.0.11712
Trojan.CrthRazy.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\7519.422.0.3_0\mirroring_common.js, Keine Aktion durch Benutzer, [14647], [676732],1.0.11712
Trojan.CrthRazy.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\7519.422.0.3_0\mirroring_hangouts.js, Keine Aktion durch Benutzer, [14647], [676732],1.0.11712
Trojan.CrthRazy.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\7519.422.0.3_0\mirroring_webrtc.js, Keine Aktion durch Benutzer, [14647], [676732],1.0.11712
Trojan.CrthRazy.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\7519.422.0.3_0\OVDM58JYD6.js, Keine Aktion durch Benutzer, [14647], [676732],1.0.11712
Trojan.CrthRazy.Generic, C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\7519.422.0.3_0\SZMG33EDCY.js, Keine Aktion durch Benutzer, [14647], [676732],1.0.11712
Trojan.CrthRazy.E.Generic, C:\USERS\LUBKA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BT6JBW3E.DEFAULT\EXTENSIONS\{14553439-2741-4E9D-B474-784F336F58C9}\FGPDKAXDCT.JS, Keine Aktion durch Benutzer, [14627], [689343],1.0.11712
Trojan.CrthRazy.E.Generic, C:\Users\Lubka\AppData\Roaming\Mozilla\Firefox\Profiles\bt6jbw3e.default\extensions\{14553439-2741-4e9d-b474-784f336f58c9}\7O9VT687H2.js, Keine Aktion durch Benutzer, [14627], [689343],1.0.11712
Trojan.CrthRazy.E.Generic, C:\Users\Lubka\AppData\Roaming\Mozilla\Firefox\Profiles\bt6jbw3e.default\extensions\{14553439-2741-4e9d-b474-784f336f58c9}\CVJYG8G13A.js, Keine Aktion durch Benutzer, [14627], [689343],1.0.11712
Trojan.CrthRazy.E.Generic, C:\Users\Lubka\AppData\Roaming\Mozilla\Firefox\Profiles\bt6jbw3e.default\extensions\{14553439-2741-4e9d-b474-784f336f58c9}\EE6FDW4AAT.js, Keine Aktion durch Benutzer, [14627], [689343],1.0.11712
Trojan.CrthRazy.E.Generic, C:\Users\Lubka\AppData\Roaming\Mozilla\Firefox\Profiles\bt6jbw3e.default\extensions\{14553439-2741-4e9d-b474-784f336f58c9}\manifest.json, Keine Aktion durch Benutzer, [14627], [689343],1.0.11712
Trojan.CrthRazy.E.Generic, C:\Users\Lubka\AppData\Roaming\Mozilla\Firefox\Profiles\bt6jbw3e.default\extensions\{14553439-2741-4e9d-b474-784f336f58c9}\QW5SJA7CIM.js, Keine Aktion durch Benutzer, [14627], [689343],1.0.11712
Trojan.CrthRazy.E.Generic, C:\Users\Lubka\AppData\Roaming\Mozilla\Firefox\Profiles\bt6jbw3e.default\extensions\{14553439-2741-4e9d-b474-784f336f58c9}\V9EVRFIM78.js, Keine Aktion durch Benutzer, [14627], [689343],1.0.11712
Trojan.ICLoader, C:\USERS\LUBKA\APPDATA\LOCAL\TEMP\7JSXDIYSIO1PQPOS\31C576D081600B887825AE5540DF6F0F.EXE, Keine Aktion durch Benutzer, [753], [710884],1.0.11712
Heuristics.Shuriken, C:\USERS\LUBKA\APPDATA\LOCAL\TEMP\~NSU.TMP\UN_A.EXE, Keine Aktion durch Benutzer, [9777], [167],1.0.11712
PUP.Optional.MailRu, C:\USERS\LUBKA\APPDATA\LOCAL\TEMP\W4AJI2GZVWKD9HFV\76A05DFE182911BE2FA29A766B420F9B.EXE, Keine Aktion durch Benutzer, [255], [609065],1.0.11712
PUP.Optional.ChipDe, C:\USERS\JOZKO\DESKTOP\INSTALACIA\LUBKA13FEB2017\DESKTOP\FOXIT READER DEUTSCH - CHIP-INSTALLER.EXE, Keine Aktion durch Benutzer, [528], [621518],1.0.11712
Adware.MailRu.BatBitRst, C:\USERS\LUBKA\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\Default\Secure Preferences, Keine Aktion durch Benutzer, [337], [481467],1.0.11712

Physischer Sektor: 0
(keine bösartigen Elemente erkannt)

WMI: 0
(keine bösartigen Elemente erkannt)


(end)
         

Malwarebytes 2. Scan

Malwarebytes
www.malwarebytes.com

-Protokolldetails-
Scan-Datum: 30.07.19
Scan-Zeit: 21:24
Protokolldatei: a4305ba1-b2ff-11e9-8031-000000000000.json

-Softwaredaten-
Version: 3.8.3.2965
Komponentenversion: 1.0.613
Version des Aktualisierungspakets: 1.0.11712
Lizenz: Kostenlos

-Systemdaten-
Betriebssystem: Windows 8
CPU: x64
Dateisystem: NTFS
Benutzer: DESKTOP-3CK4O4E\Jozko

-Scan-Übersicht-
Scan-Typ: Bedrohungs-Scan
Scan gestartet von: Manuell
Ergebnis: Abgeschlossen
Gescannte Objekte: 317063
Erkannte Bedrohungen: 3
In die Quarantäne verschobene Bedrohungen: 0
Abgelaufene Zeit: 2 Min., 5 Sek.

-Scan-Optionen-
Speicher: Aktiviert
Start: Aktiviert
Dateisystem: Aktiviert
Archive: Aktiviert
Rootkits: Aktiviert
Heuristik: Aktiviert
PUP: Erkennung
PUM: Erkennung

-Scan-Details-
Prozess: 0
(keine bösartigen Elemente erkannt)

Modul: 0
(keine bösartigen Elemente erkannt)

Registrierungsschlüssel: 0
(keine bösartigen Elemente erkannt)

Registrierungswert: 0
(keine bösartigen Elemente erkannt)

Registrierungsdaten: 3
Trojan.DNSChanger, HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{34eac78a-f8d3-4256-b5a3-9da0fc12e3a7}|NameServer, Keine Aktion durch Benutzer, [3069], [706134],1.0.11712
Trojan.DNSChanger, HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{293ee5fa-fe84-433a-a774-26687ea51594}|NameServer, Keine Aktion durch Benutzer, [3069], [706134],1.0.11712
Trojan.DNSChanger, HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{da384fb4-1e59-48fc-bfe0-c27ce005f778}|NameServer, Keine Aktion durch Benutzer, [3069], [706134],1.0.11712

Daten-Stream: 0
(keine bösartigen Elemente erkannt)

Ordner: 0
(keine bösartigen Elemente erkannt)

Datei: 0
(keine bösartigen Elemente erkannt)

Physischer Sektor: 0
(keine bösartigen Elemente erkannt)

WMI: 0
(keine bösartigen Elemente erkannt)


(end)
         

Mein Name ist Matthias und ich werde dir bei der Analyse und der eventuell notwendigen Bereinigung deines Computers helfen.

Wieso postest du nicht die Logdatei von AdwCleaner? Bitte umgehend nachreichen.
Wozu ist Spybot installiert? Kannst du deinstallieren.

Schritt 1

• Kopiere den gesamten Inhalt der folgenden Code-Box:
  

  Start::
  CloseProcesses:
  Task: {26841A08-7BC8-413E-B648-4E9B88302A57} - System32\Tasks\EJlCPXAxczfLnX => rundll32 "C:\Program Files (x86)\XAIfWVzjYwlU2\ivfNGGvgifFGu.dll",#1
  C:\Program Files (x86)\XAIfWVzjYwlU2
  Task: {40446FB5-8319-4883-997A-0F4FB55BC044} - System32\Tasks\ibZIUHjYTxUPTmNsU2 => rundll32 "C:\Program Files (x86)\XSeHBAjlvbTDePgmqbR\yNwwave.dll",#1
  C:\Program Files (x86)\XSeHBAjlvbTDePgmqbR
  Task: {625224FD-B919-4BAE-8718-20D666776C9F} - System32\Tasks\WByhYcedlOQavqREWte2 => rundll32 "C:\Program Files (x86)\NIErSAELLsOOC\EfRGQll.dll",#1
  C:\Program Files (x86)\NIErSAELLsOOC
  Task: {6DF74A6B-67D3-462C-9413-F82E04D70F06} - System32\Tasks\KJMNwfnoaWMfhxH2 => rundll32 "C:\Program Files (x86)\udVlifMMU\vNGgfG.dll",#1
  C:\Program Files (x86)\udVlifMMU
  Task: {B1E92710-FA20-412F-A854-A8EECE9BA802} - System32\Tasks\WZdwAMJoIRSYG2 => C:\WINDOWS\system32\wscript.exe "C:\ProgramData\LUBciApiRJzrvXVB\PFmfVpo.wsf"
  C:\ProgramData\LUBciApiRJzrvXVB
  Task: {CCE6F463-0345-4BC9-8068-3F513EF4D603} - System32\Tasks\rescncttloqaqcg => msiexec.exe /quiet /i "C:\Users\**\AppData\Roaming\lwmjhnysqrpp\pbeohtnsooaelld.msi" WEBID=PP_MN_P3 TKNME=rescncttloqaqcg
  Task: {75D51F29-E7D7-44DF-B5E3-DB305222BD70} - System32\Tasks\lqerkybtsayax => msiexec.exe /quiet /i "C:\Users\**\AppData\Roaming\lwmjhnysqrpp\pbeohtnsooaelld.msi" WEBID=PP_MN_P3 TKNME=lqerkybtsayax
  C:\Users\CurrentUserName\AppData\Roaming\lwmjhnysqrpp
  SearchScopes: HKU\S-1-5-21-1960842775-2088100534-3542962694-1001 -> DefaultScope {FFEBBF0A-C22C-4172-89FF-45215A135AC7} URL = 
  BHO: YoutubeAdBlock -> {44EDBCE5-6691-4383-B723-8C21F5F1A004} -> C:\Program Files (x86)\bzDQAplLjIE\tMOJVg6.dll => No File
  C:\Program Files (x86)\bzDQAplLjIE
  BHO-x32: YoutubeAdBlock -> {44EDBCE5-6691-4383-B723-8C21F5F1A004} -> C:\Program Files (x86)\bzDQAplLjIE\kSQSQOyPW.dll => No File
  FF Extension: (No Name) - C:\Program Files\Mozilla Firefox\browser\features\{BA546D42-BAEC-4C9C-870E-D0BE7892DBD5}.xpi [2019-07-25] [not signed]
  FF user.js: detected! => C:\Users\CurrentUserName\AppData\Roaming\Mozilla\Firefox\Profiles\bt6jbw3e.default\user.js [2019-07-25]
  C:\ProgramData\Lamia
  C:\WINDOWS\System32\Tasks\System
  2019-07-25 00:39 - 2019-07-25 00:41 - 000000000 ____D C:\Users\CurrentUserName\AppData\Local\Mail.Ru
  2019-07-25 00:39 - 2019-07-25 00:40 - 000000000 ____D C:\ProgramData\Mail.Ru
  2019-07-25 00:39 - 2019-07-25 00:39 - 000825856 _____ C:\Default.xml
  2019-07-25 00:39 - 2019-07-25 00:39 - 000000000 ____D C:\ProgramData\Loosger
  2019-07-25 00:38 - 2019-07-25 00:38 - 004059136 _____ C:\Users\CurrentUserName\Downloads\setup_f5ac96a97f5f.iso
  2019-07-25 00:36 - 2019-07-25 00:36 - 007856585 _____ C:\Users\CurrentUserName\Downloads\K-ON!! MOD COMPLETE .rar
  2019-07-25 00:36 - 2019-07-25 00:36 - 001132644 _____ C:\Users\CurrentUserName\Downloads\Nakano Azusa.rar
  Tcpip\..\Interfaces\{293ee5fa-fe84-433a-a774-26687ea51594}: [NameServer] 45.114.8.167,,,116.203.6.218
  Tcpip\..\Interfaces\{34eac78a-f8d3-4256-b5a3-9da0fc12e3a7}: [NameServer] 45.114.8.167,,,116.203.6.218
  Tcpip\..\Interfaces\{da384fb4-1e59-48fc-bfe0-c27ce005f778}: [NameServer] 45.114.8.167,,,116.203.6.218
  CHR HKLM\SOFTWARE\Policies\Google: Restriction <==== ATTENTION
  HKLM\SOFTWARE\Policies\Microsoft\Windows Defender: Restriction <==== ATTENTION
  CMD: dir "%ProgramFiles%"
  CMD: dir "%ProgramFiles(x86)%"
  CMD: dir "%ProgramData%"
  CMD: dir "%Appdata%"
  CMD: dir "%LocalAppdata%"
  ExportKey: HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions
  CMD: ipconfig /flushdns
  CMD: netsh winsock reset
  CMD: netsh advfirewall reset
  CMD: netsh advfirewall set allprofiles state ON
  CMD: Bitsadmin /Reset /Allusers
  Hosts:
  RemoveProxy:
  EmptyTemp:
  End::
           

• Starte nun FRST und klicke direkt den Entfernen Button.Wichtig: Du brauchst den Inhalt der Code-Box nirgends einfügen, da sich FRST den Code aus der Zwischenablage holt!
• Das Tool führt die gewünschten Schritte aus und erstellt eine fixlog.txt im selben Verzeichnis, in dem sich FRST befindet.
• Gegebenenfalls muss dein Rechner neu gestartet werden.
• Poste mir den Inhalt der fixlog.txt mit deiner nächsten Antwort.

Schritt 2
Bitte setze alle deine Browser (sofern installiert) wie folgt zurück:

IE :::
Starte den Internet Explorer.
Klicke rechts oben auf Extras, dann auf Internetoptionen.
Wähle den Tab Erweitert aus und klicke auf Zurücksetzen.
Setze einen Haken bei Persönliche Einstellungen löschen und dann auf Zurücksetzen.
Klicke auf Schließen und starte den Rechner neu.

EDGE :::
Klicke auf Start > Einstellungen > Apps.
Wähle in der Liste aller installierten Programme Microsoft Edge aus und klicke auf Erweiterte Optionen.
Scrolle etwas nach unten, klicke auf Zurücksetzen und bestätige mit Zurücksetzen.
Starte den Rechner neu.

FF :::
Firefox zurücksetzen

CHR:::
Chrome zurücksetzen

OPR::
Opera zurücksetzen







Schritt 3

• Starte FRST erneut. Vergewissere dich, dass vor Addition.txt ein Haken gesetzt ist und drücke auf Untersuchen.
• FRST erstellt wieder zwei Logdateien (FRST.txt und Addition.txt).
• Poste mir beide Logdateien mit deiner nächsten Antwort.

Bitte poste mit deiner nächsten Antwort:

• die Logdatei von AdwCleaner
• die Beantwortung der gestellten Fragen
• die Logdatei des FRST-Fix (fixlog.txt)
• die beiden neuen Logdateien von FRST (FRST.txt und Addition.txt)

Spybot ist deinstalliert.
Adwcleaner Logdateien (3 x)

# -------------------------------
# Malwarebytes AdwCleaner 7.4.0.0
# -------------------------------
# Build:    07-23-2019
# Database: 2019-07-22.1 (Local)
# Support:  https://www.malwarebytes.com/support
#
# -------------------------------
# Mode: Scan
# -------------------------------
# Start:    07-30-2019
# Duration: 00:00:09
# OS:       Windows 10 Pro
# Scanned:  35810
# Detected: 28


***** [ Services ] *****

PUP.Optional.Legacy             mrupdsrv
PUP.Optional.Mail.Ru            Updater.Mail.Ru

***** [ Folders ] *****

PUP.Optional.DownloadSponsor    C:\Users\Lubka\AppData\Local\Temp\DMR

***** [ Files ] *****

PUP.Optional.Chip               C:\Users\Lubka\Desktop\EXACT AUDIO COPY - CHIP-INSTALLER.EXE
PUP.Optional.Chip               C:\Users\Lubka\Desktop\MICROSOFT WINDOWS DEFENDER OFFLINE - CHIP-INSTALLER.EXE
PUP.Optional.Legacy             C:\Users\Lubka\Favorites\?????? ? ?????????.url
PUP.Optional.Mail.Ru            C:\Users\Lubka\Favorites\Mail.Ru.url
PUP.Optional.Presenoker         C:\Users\Lubka\AppData\Local\PetGame.exe

***** [ DLL ] *****

No malicious DLLs found.

***** [ WMI ] *****

No malicious WMI found.

***** [ Shortcuts ] *****

No malicious shortcuts found.

***** [ Tasks ] *****

PUP.Optional.Legacy             C:\Windows\System32\Tasks\MAILRUUPDATER

***** [ Registry ] *****

Adware.NeoBar                   HKLM\Software\Wow6432Node\\Microsoft\Windows\CurrentVersion\Uninstall\1655C0CA-7AE7-4012-8502-970C8675E5F8
PUP.Optional.AdService          HKCU\Software\SetupCompany
PUP.Optional.Legacy             HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{8E8F97CD-60B5-456F-A201-73065652D099}
PUP.Optional.Legacy             HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{8E8F97CD-60B5-456F-A201-73065652D099}
PUP.Optional.Legacy             HKCU\Software\Microsoft\Windows\CurrentVersion\Run|MailRuUpdater
PUP.Optional.Legacy             HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\MailRuUpdater
PUP.Optional.Legacy             HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{1D7976A2-62AB-488D-8592-7B3EFECE7121} 
PUP.Optional.Legacy             HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\MailRuUpdater
PUP.Optional.Legacy             HKLM\Software\Wow6432Node\\Classes\CLSID\{8E8F97CD-60B5-456F-A201-73065652D099}
PUP.Optional.Legacy             HKLM\Software\Wow6432Node\\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{68AE298D-7E8A-4F53-BE55-15D2B065F6C0}
PUP.Optional.Legacy             HKLM\Software\Wow6432Node\\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8E8F97CD-60B5-456F-A201-73065652D099}
PUP.Optional.Mail.Ru            HKCU\Software\Google\Chrome\NativeMessagingHosts\ru.mail.go.ext_info_host
PUP.Optional.Mail.Ru            HKCU\Software\Microsoft\Internet Explorer\Main|Start Page
PUP.Optional.Mail.Ru            HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{FFEBBF0A-C22C-4172-89FF-45215A135AC7}
PUP.Optional.Mail.Ru            HKCU\Software\Mozilla\NativeMessagingHosts\ru.mail.go.ext_info_host
PUP.Optional.Mail.Ru            HKLM\Software\Classes\IESearchPlugin.MailRuBHO
PUP.Optional.Presenoker         HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\PetGame

***** [ Chromium (and derivatives) ] *****

PUP.Optional.Mail.Ru            ?????????? ????????
PUP.Optional.Mail.Ru            ???????? ???????? ? ????? ?? Mail.Ru

***** [ Chromium URLs ] *****

No malicious Chromium URLs found.

***** [ Firefox (and derivatives) ] *****

No malicious Firefox entries found.

***** [ Firefox URLs ] *****

No malicious Firefox URLs found.

***** [ Preinstalled Software ] *****

No Preinstalled Software found.



########## EOF - C:\AdwCleaner\Logs\AdwCleaner[S00].txt ##########
         

# -------------------------------
# Malwarebytes AdwCleaner 7.4.0.0
# -------------------------------
# Build:    07-23-2019
# Database: 2019-07-22.1 (Local)
# Support:  https://www.malwarebytes.com/support
#
# -------------------------------
# Mode: Scan
# -------------------------------
# Start:    07-30-2019
# Duration: 00:00:09
# OS:       Windows 10 Pro
# Scanned:  35810
# Detected: 0


***** [ Services ] *****

No malicious services found.

***** [ Folders ] *****

No malicious folders found.

***** [ Files ] *****

No malicious files found.

***** [ DLL ] *****

No malicious DLLs found.

***** [ WMI ] *****

No malicious WMI found.

***** [ Shortcuts ] *****

No malicious shortcuts found.

***** [ Tasks ] *****

No malicious tasks found.

***** [ Registry ] *****

No malicious registry entries found.

***** [ Chromium (and derivatives) ] *****

No malicious Chromium entries found.

***** [ Chromium URLs ] *****

No malicious Chromium URLs found.

***** [ Firefox (and derivatives) ] *****

No malicious Firefox entries found.

***** [ Firefox URLs ] *****

No malicious Firefox URLs found.

***** [ Preinstalled Software ] *****

No Preinstalled Software found.


AdwCleaner[S00].txt - [3893 octets] - [30/07/2019 20:26:59]
AdwCleaner[C00].txt - [3565 octets] - [30/07/2019 20:27:18]

########## EOF - C:\AdwCleaner\Logs\AdwCleaner[S01].txt ##########
         

 # -------------------------------
# Malwarebytes AdwCleaner 7.4.0.0
# -------------------------------
# Build:    07-23-2019
# Database: 2019-07-22.1 (Local)
# Support:  https://www.malwarebytes.com/support
#
# -------------------------------
# Mode: Scan
# -------------------------------
# Start:    07-31-2019
# Duration: 00:00:09
# OS:       Windows 10 Pro
# Scanned:  35810
# Detected: 1


***** [ Services ] *****

No malicious services found.

***** [ Folders ] *****

No malicious folders found.

***** [ Files ] *****

No malicious files found.

***** [ DLL ] *****

No malicious DLLs found.

***** [ WMI ] *****

No malicious WMI found.

***** [ Shortcuts ] *****

No malicious shortcuts found.

***** [ Tasks ] *****

No malicious tasks found.

***** [ Registry ] *****

Adware.NeoBar                   HKLM\Software\Wow6432Node\\Microsoft\Windows\CurrentVersion\Uninstall\1655C0CA-7AE7-4012-8502-970C8675E5F8

***** [ Chromium (and derivatives) ] *****

No malicious Chromium entries found.

***** [ Chromium URLs ] *****

No malicious Chromium URLs found.

***** [ Firefox (and derivatives) ] *****

No malicious Firefox entries found.

***** [ Firefox URLs ] *****

No malicious Firefox URLs found.

***** [ Preinstalled Software ] *****

No Preinstalled Software found.


AdwCleaner[S00].txt - [3893 octets] - [30/07/2019 20:26:59]
AdwCleaner[C00].txt - [3565 octets] - [30/07/2019 20:27:18]
AdwCleaner[S01].txt - [1447 octets] - [30/07/2019 20:30:14]

########## EOF - C:\AdwCleaner\Logs\AdwCleaner[S02].txt ##########
         

FRST Logfile:

FRST Logfile:

FRST Logfile:

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 31-07-2019
Ran by Jozko (ATTENTION: The user is not administrator) on DESKTOP-3CK4O4E (Micro-Star International Co., Ltd. MS-7B33) (31-07-2019 20:28:01)
Running from C:\Users\Jozko\Desktop
Loaded Profiles: Jozko (Available Profiles: Lubka & Jozko)
Platform: Windows 10 Pro Version 1803 17134.885 (X64) Language: Slowakisch (Slowakei)
Default browser: FF
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Disig a.s. -> Disig a.s.) C:\Program Files (x86)\Disig\Disig Web Signer 1.0.7\Updater\WebSignerTray.exe
(IDSA Production signing key -> Intel) C:\Program Files (x86)\Intel\Driver and Support Assistant\DSATray.exe
(Intel(R) pGFX -> Intel Corporation) C:\Windows\System32\DriverStore\FileRepository\cui_dc_comp.inf_amd64_1c77f1231c19bc72\igfxEM.exe
(Malwarebytes Corporation -> Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe
(Microsoft Corporation -> Microsoft Corporation) C:\Users\Jozko\AppData\Local\Microsoft\OneDrive\OneDrive.exe
(Microsoft Windows -> Microsoft Corporation) C:\Program Files\Windows Defender\MSASCuiL.exe
(Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\smartscreen.exe
(Mozilla Corporation -> Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Mozilla Corporation -> Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Mozilla Corporation -> Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Mozilla Corporation -> Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Mozilla Corporation -> Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Oracle America, Inc. -> Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(SEIKO EPSON Corporation -> SEIKO EPSON CORPORATION) C:\Windows\System32\spool\drivers\x64\3\E_YATIHTU.EXE
Failed to access process -> armsvc.exe
Failed to access process -> CompatTelRunner.exe
Failed to access process -> conhost.exe
Failed to access process -> csrss.exe
Failed to access process -> csrss.exe
Failed to access process -> dasHost.exe
Failed to access process -> DSAService.exe
Failed to access process -> DSAUpdateService.exe
Failed to access process -> dwm.exe
Failed to access process -> fontdrvhost.exe
Failed to access process -> fontdrvhost.exe
Failed to access process -> GoogleCrashHandler.exe
Failed to access process -> GoogleCrashHandler64.exe
Failed to access process -> igfxCUIService.exe
Failed to access process -> IntelCpHDCPSvc.exe
Failed to access process -> IntelCpHeciSvc.exe
Failed to access process -> lsass.exe
Failed to access process -> MBAMService.exe
Failed to access process -> MsMpEng.exe
Failed to access process -> PresentationFontCache.exe
Failed to access process -> SearchFilterHost.exe
Failed to access process -> SearchIndexer.exe
Failed to access process -> SearchProtocolHost.exe
Failed to access process -> SecurityHealthService.exe
Failed to access process -> services.exe
Failed to access process -> smss.exe
Failed to access process -> spoolsv.exe
Failed to access process -> SurSvc.exe
Failed to access process -> svchost.exe
Failed to access process -> svchost.exe
Failed to access process -> svchost.exe
Failed to access process -> svchost.exe
Failed to access process -> svchost.exe
Failed to access process -> svchost.exe
Failed to access process -> svchost.exe
Failed to access process -> svchost.exe
Failed to access process -> svchost.exe
Failed to access process -> svchost.exe
Failed to access process -> svchost.exe
Failed to access process -> svchost.exe
Failed to access process -> svchost.exe
Failed to access process -> svchost.exe
Failed to access process -> svchost.exe
Failed to access process -> svchost.exe
Failed to access process -> svchost.exe
Failed to access process -> svchost.exe
Failed to access process -> svchost.exe
Failed to access process -> svchost.exe
Failed to access process -> svchost.exe
Failed to access process -> svchost.exe
Failed to access process -> svchost.exe
Failed to access process -> svchost.exe
Failed to access process -> svchost.exe
Failed to access process -> svchost.exe
Failed to access process -> svchost.exe
Failed to access process -> svchost.exe
Failed to access process -> svchost.exe
Failed to access process -> svchost.exe
Failed to access process -> svchost.exe
Failed to access process -> svchost.exe
Failed to access process -> svchost.exe
Failed to access process -> svchost.exe
Failed to access process -> svchost.exe
Failed to access process -> svchost.exe
Failed to access process -> svchost.exe
Failed to access process -> svchost.exe
Failed to access process -> svchost.exe
Failed to access process -> svchost.exe
Failed to access process -> svchost.exe
Failed to access process -> svchost.exe
Failed to access process -> svchost.exe
Failed to access process -> svchost.exe
Failed to access process -> svchost.exe
Failed to access process -> svchost.exe
Failed to access process -> svchost.exe
Failed to access process -> svchost.exe
Failed to access process -> svchost.exe
Failed to access process -> svchost.exe
Failed to access process -> svchost.exe
Failed to access process -> svchost.exe
Failed to access process -> svchost.exe
Failed to access process -> svchost.exe
Failed to access process -> svchost.exe
Failed to access process -> svchost.exe
Failed to access process -> svchost.exe
Failed to access process -> svchost.exe
Failed to access process -> svchost.exe
Failed to access process -> svchost.exe
Failed to access process -> svchost.exe
Failed to access process -> svchost.exe
Failed to access process -> svchost.exe
Failed to access process -> svchost.exe
Failed to access process -> svchost.exe
Failed to access process -> svchost.exe
Failed to access process -> wininit.exe
Failed to access process -> winlogon.exe
Failed to access process -> WmiPrvSE.exe
Failed to access process -> WmiPrvSE.exe

==================== Registry (Whitelisted) ===========================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [SecurityHealth] => C:\Program Files\Windows Defender\MSASCuiL.exe [638872 2018-04-12] (Microsoft Windows -> Microsoft Corporation)
HKLM\...\Run: [RTHDVCPL] => "C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe" -s
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [645456 2019-04-01] (Oracle America, Inc. -> Oracle Corporation)
HKLM\SOFTWARE\Policies\Microsoft\Windows Defender: Restriction <==== ATTENTION
HKU\S-1-5-21-1960842775-2088100534-3542962694-1002\...\Run: [EPLTarget\P0000000000000000] => C:\WINDOWS\system32\spool\DRIVERS\x64\3\E_YATIHTU.EXE [241280 2012-07-12] (SEIKO EPSON Corporation -> SEIKO EPSON CORPORATION)
HKU\S-1-5-21-1960842775-2088100534-3542962694-1002\...\MountPoints2: {08af5bcb-313c-11e9-94ec-309c23d44e07} - "F:\HiSuiteDownLoader.exe" 
HKU\S-1-5-21-1960842775-2088100534-3542962694-1002\...\MountPoints2: {e8fcf302-ff74-11e8-94da-806e6f6e6963} - "E:\Setup.exe" 
HKLM\...\Drivers32: [VIDC.X264] => C:\WINDOWS\system32\x264vfw64.dll [3799552 2017-07-30] (x264vfw project) [File not signed]
HKLM\...\Drivers32: [VIDC.LAGS] => C:\WINDOWS\system32\lagarith.dll [148992 2011-12-07] ( ) [File not signed]
HKLM\...\Drivers32: [VIDC.XVID] => C:\WINDOWS\system32\xvidvfw.dll [311296 2018-01-28] () [File not signed]
HKLM\...\Drivers32: [msacm.ac3acm] => C:\WINDOWS\system32\ac3acm.acm [180736 2012-07-21] (fccHandler) [File not signed]
HKLM\...\Drivers32: [VIDC.X264] => C:\Windows\SysWOW64\x264vfw.dll [3850240 2017-07-30] (x264vfw project) [File not signed]
HKLM\...\Drivers32: [VIDC.LAGS] => C:\Windows\SysWOW64\lagarith.dll [216064 2011-12-07] ( ) [File not signed]
HKLM\...\Drivers32: [VIDC.XVID] => C:\Windows\SysWOW64\xvidvfw.dll [284672 2018-01-28] () [File not signed]
HKLM\...\Drivers32: [VIDC.FFDS] => C:\Windows\SysWOW64\ff_vfw.dll [112128 2015-10-24] () [File not signed]
HKLM\...\Drivers32: [msacm.ac3acm] => C:\Windows\SysWOW64\ac3acm.acm [122880 2012-07-21] (fccHandler) [File not signed]
HKLM\Software\Microsoft\Active Setup\Installed Components: [{8A69D345-D564-463c-AFF1-A69D9E530F96}] -> C:\Program Files (x86)\Google\Chrome\Application\75.0.3770.142\Installer\chrmstp.exe [2019-07-17] (Google LLC -> Google LLC)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Web Signer.lnk [2019-03-14]
ShortcutTarget: Web Signer.lnk -> C:\Program Files (x86)\Disig\Disig Web Signer 1.0.7\Updater\WebSignerTray.exe (Disig a.s. -> Disig a.s.)
BootExecute: autocheck autochk * sdnclean64.exe
GroupPolicy: Restriction - Windows Defender <==== ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Restriction <==== ATTENTION

==================== Scheduled Tasks (Whitelisted) =============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

Task: C:\WINDOWS\Tasks\oncIfaVdQabfxqj.job => 

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Tcpip\Parameters: [DhcpNameServer] 192.168.1.1 195.146.128.62
Tcpip\..\Interfaces\{293ee5fa-fe84-433a-a774-26687ea51594}: [NameServer] 45.114.8.167,,,116.203.6.218
Tcpip\..\Interfaces\{34eac78a-f8d3-4256-b5a3-9da0fc12e3a7}: [NameServer] 45.114.8.167,,,116.203.6.218
Tcpip\..\Interfaces\{da384fb4-1e59-48fc-bfe0-c27ce005f778}: [NameServer] 45.114.8.167,,,116.203.6.218
Tcpip\..\Interfaces\{da384fb4-1e59-48fc-bfe0-c27ce005f778}: [DhcpNameServer] 192.168.1.1 195.146.128.62

Internet Explorer:
==================
HKU\S-1-5-21-1960842775-2088100534-3542962694-1002\Software\Microsoft\Internet Explorer\Main,Start Page = hxxps://go.microsoft.com/fwlink/p/?LinkId=619797&pc=UE03&ocid=UE03DHP
SearchScopes: HKU\S-1-5-21-1960842775-2088100534-3542962694-1002 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxps://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IESR02&pc=UE04
SearchScopes: HKU\S-1-5-21-1960842775-2088100534-3542962694-1002 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxps://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IESR02&pc=UE04
BHO: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office\Office16\OCHelper.dll [2015-07-31] (Microsoft Corporation -> Microsoft Corporation)
BHO: YoutubeAdBlock -> {44EDBCE5-6691-4383-B723-8C21F5F1A004} -> C:\Program Files (x86)\minXQDMZbIE\tMNwGvQ11.dll [2019-07-31] () [File not signed]
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_211\bin\ssv.dll [2019-05-24] (Oracle America, Inc. -> Oracle Corporation)
BHO: Microsoft OneDrive for Business Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office\Office16\GROOVEEX.DLL [2015-07-31] (Microsoft Corporation -> Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_211\bin\jp2ssv.dll [2019-05-24] (Oracle America, Inc. -> Oracle Corporation)
BHO-x32: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files (x86)\Microsoft Office\Office16\OCHelper.dll [2015-07-31] (Microsoft Corporation -> Microsoft Corporation)
BHO-x32: YoutubeAdBlock -> {44EDBCE5-6691-4383-B723-8C21F5F1A004} -> C:\Program Files (x86)\minXQDMZbIE\kbxTcSEa.dll [2019-07-31] () [File not signed]
BHO-x32: Microsoft OneDrive for Business Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files (x86)\Microsoft Office\Office16\GROOVEEX.DLL [2015-07-31] (Microsoft Corporation -> Microsoft Corporation)
Handler-x32: mso-minsb.16 - {3459B272-CC19-4448-86C9-DDC3B4B2FAD3} - C:\Program Files (x86)\Microsoft Office\Office16\MSOSB.DLL [2015-07-31] (Microsoft Corporation -> Microsoft Corporation)
Handler-x32: osf.16 - {5504BE45-A83B-4808-900A-3A5C36E7F77A} - C:\Program Files (x86)\Microsoft Office\Office16\MSOSB.DLL [2015-07-31] (Microsoft Corporation -> Microsoft Corporation)

FireFox:
========
FF DefaultProfile: 38wqa6ky.default-1564597264315
FF ProfilePath: C:\Users\Jozko\AppData\Roaming\Mozilla\Firefox\Profiles\38wqa6ky.default-1564597264315 [2019-07-31]
FF Extension: (No Name) - C:\Program Files\Mozilla Firefox\browser\features\{BA546D42-BAEC-4C9C-870E-D0BE7892DBD5}.xpi [2019-07-25] [not signed]
FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF64_32_0_0_223.dll [2019-07-13] (Adobe Inc. -> )
FF Plugin: @java.com/DTPlugin,version=11.211.2 -> C:\Program Files\Java\jre1.8.0_211\bin\dtplugin\npDeployJava1.dll [2019-05-24] (Oracle America, Inc. -> Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=11.211.2 -> C:\Program Files\Java\jre1.8.0_211\bin\plugin2\npjp2.dll [2019-05-24] (Oracle America, Inc. -> Oracle Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_32_0_0_223.dll [2019-07-13] (Adobe Inc. -> )
FF Plugin-x32: @google.com/zxwebplugin -> C:\WINDOWS\system32\npzxwebplugin.dll [No File]
FF Plugin-x32: @microsoft.com/Lync,version=15.0 -> C:\Program Files (x86)\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll [2015-07-31] (Microsoft Corporation -> Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office16\NPSPWRAP.DLL [2015-07-31] (Microsoft Corporation -> Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.34.11\npGoogleUpdate3.dll [2019-05-15] (Google Inc -> Google LLC)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.34.11\npGoogleUpdate3.dll [2019-05-15] (Google Inc -> Google LLC)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2019-05-03] (Adobe Inc. -> Adobe Systems Inc.)
FF Plugin-x32: ditec.sk/DAsicFac -> C:\PROGRA~2\Ditec\DSIGNE~2.NET\NPDITE~1.DLL [2019-01-14] (DITEC, a.s. -> Ditec,a.s.)
FF Plugin-x32: ditec.sk/DitecZepDViewerFb -> C:\PROGRA~2\Ditec\DViewer\NPDITE~1.DLL [2019-01-15] (DITEC, a.s. -> Ditec, a.s.)
FF Plugin-x32: ditec.sk/DSigMessageContainer -> C:\PROGRA~2\Ditec\DSIGNE~2.NET\NPDITE~2.DLL [2016-12-15] (DITEC, a.s. -> Ditec, a.s.)
FF Plugin-x32: ditec.sk/DSigXadesExtender -> C:\PROGRA~2\Ditec\DSIGNE~2.NET\NPDITE~3.DLL [2016-12-15] (DITEC, a.s. -> Ditec, a.s.)
FF Plugin-x32: ditec.sk/DSigXadesFb -> C:\PROGRA~2\Ditec\DSIGNE~1.NET\NPDITE~1.DLL [2019-01-15] (DITEC, a.s. -> Ditec,a.s.)
FF Plugin-x32: ditec.sk/XmlDataContainerFb -> C:\PROGRA~2\Ditec\DSIGNE~1.NET\NPDITE~2.DLL [2019-01-15] (DITEC, a.s. -> Ditec,a.s.)
FF Plugin HKU\S-1-5-21-1960842775-2088100534-3542962694-1002: ditec.sk/DitecZepDViewerFb -> C:\ProgramData\Ditec\DViewer\npDitec.Zep.DViewerFb.dll [No File]
FF Plugin HKU\S-1-5-21-1960842775-2088100534-3542962694-1002: ditec.sk/DSigXadesExtenderFb -> C:\Program Files (x86)\Ditec\DSigXadesExtender\npDitec.Zep.DSigXadesExtenderFb.dll [No File]
FF Plugin HKU\S-1-5-21-1960842775-2088100534-3542962694-1002: ditec.sk/DSigXadesFb -> C:\Program Files (x86)\Ditec\DSigXades\npDitec.Zep.DSigXadesFb.dll [No File]

Chrome: 
=======
CHR HomePage: Default -> hxxp://www.google.com/
CHR StartupUrls: Default -> "hxxp://www.google.com/"
CHR Profile: C:\Users\Jozko\AppData\Local\Google\Chrome\User Data\Default [2019-07-31]
CHR Extension: (Präsentationen) - C:\Users\Jozko\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2019-07-31]
CHR Extension: (Docs) - C:\Users\Jozko\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2019-07-31]
CHR Extension: (Google Drive) - C:\Users\Jozko\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2019-07-31]
CHR Extension: (YouTube) - C:\Users\Jozko\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2019-07-31]
CHR Extension: (Adobe Acrobat) - C:\Users\Jozko\AppData\Local\Google\Chrome\User Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj [2019-07-31]
CHR Extension: (Tabellen) - C:\Users\Jozko\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2019-07-31]
CHR Extension: (Google Docs Offline) - C:\Users\Jozko\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2019-07-31]
CHR Extension: (Chrome Web Store-Zahlungen) - C:\Users\Jozko\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2019-07-31]
CHR Extension: (Disig Web Signer 1.0.7) - C:\Users\Jozko\AppData\Local\Google\Chrome\User Data\Default\Extensions\odbdbcaekkgabdfaabepfjgiooilmaoe [2019-07-31]
CHR Extension: (Google Mail) - C:\Users\Jozko\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2019-07-31]
CHR Extension: (Chrome Media Router) - C:\Users\Jozko\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2019-07-31]
CHR HKLM-x32\...\Chrome\Extension: [efaidnbmnnnibpcajpcglclefindmkaj] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [odbdbcaekkgabdfaabepfjgiooilmaoe] - hxxps://clients2.google.com/service/update2/crx

==================== Services (Whitelisted) ====================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

S2 dLauncherLoopback; C:\Program Files (x86)\Ditec\DLauncher\dLauncherLoopback.exe [156984 2017-09-29] (DITEC, a.s. -> )
R2 DSAService; C:\Program Files (x86)\Intel\Driver and Support Assistant\DSAService.exe [26984 2019-07-25] (IDSA Production signing key -> Intel)
R3 DSAUpdateService; C:\Program Files (x86)\Intel\Driver and Support Assistant\DSAUpdateService.exe [80744 2019-07-25] (IDSA Production signing key -> Intel)
S2 ESRV_SVC_QUEENCREEK; C:\Program Files\Intel\SUR\QUEENCREEK\x64\esrv_svc.exe [937208 2018-12-19] (Intel(R) Software Development Products -> )
S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\Intel(R) Management Engine Components\iCLS\SocketHeciServer.exe [762568 2018-06-08] (Intel(R) Trust Services -> Intel(R) Corporation)
S3 Intel(R) SUR QC SAM; C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\IntelSoftwareAssetManagerService.exe [18168 2017-07-13] (Intel(R) Software Asset Manager -> Intel Corporation)
S2 Intel(R) TPM Provisioning Service; C:\Program Files\Intel\Intel(R) Management Engine Components\iCLS\TPMProvisioningService.exe [714952 2018-06-08] (Intel(R) Trust Services -> Intel(R) Corporation)
S2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [218176 2018-08-03] (Intel(R) Embedded Subsystems and IP Blocks Group -> Intel Corporation)
R3 lmhosts; C:\WINDOWS\System32\svchost.exe [85472 2019-01-09] (Microsoft Windows Publisher -> Microsoft Corporation)
R3 lmhosts; C:\WINDOWS\SysWOW64\svchost.exe [71456 2019-01-09] (Microsoft Windows Publisher -> Microsoft Corporation)
R2 MBAMService; C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe [6744288 2019-06-26] (Malwarebytes Corporation -> Malwarebytes)
R2 NlaSvc; C:\WINDOWS\System32\svchost.exe [85472 2019-01-09] (Microsoft Windows Publisher -> Microsoft Corporation)
R2 NlaSvc; C:\WINDOWS\SysWOW64\svchost.exe [71456 2019-01-09] (Microsoft Windows Publisher -> Microsoft Corporation)
R2 nsi; C:\WINDOWS\system32\svchost.exe [85472 2019-01-09] (Microsoft Windows Publisher -> Microsoft Corporation)
R2 nsi; C:\WINDOWS\SysWOW64\svchost.exe [71456 2019-01-09] (Microsoft Windows Publisher -> Microsoft Corporation)
S3 Sense; C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe [5073792 2019-07-04] (Microsoft Windows Publisher -> Microsoft Corporation)
R2 SystemUsageReportSvc_QUEENCREEK; C:\Program Files\Intel\SUR\QUEENCREEK\SurSvc.exe [195832 2018-12-19] (Intel(R) Software Development Products -> )
S3 USER_ESRV_SVC_QUEENCREEK; C:\Program Files\Intel\SUR\QUEENCREEK\x64\esrv_svc.exe [937208 2018-12-19] (Intel(R) Software Development Products -> )
S3 WdNisSvc; C:\ProgramData\Microsoft\Windows Defender\platform\4.18.1907.4-0\NisSrv.exe [2552416 2019-07-27] (Microsoft Windows Publisher -> Microsoft Corporation)
R2 WinDefend; C:\ProgramData\Microsoft\Windows Defender\platform\4.18.1907.4-0\MsMpEng.exe [108832 2019-07-27] (Microsoft Windows Publisher -> Microsoft Corporation)

===================== Drivers (Whitelisted) ======================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

S3 GemCCID; C:\WINDOWS\System32\drivers\GemCCID.sys [137712 2016-10-17] (Microsoft Windows Hardware Compatibility Publisher -> Gemalto)
R3 MBAMSwissArmy; C:\WINDOWS\System32\Drivers\mbamswissarmy.sys [275232 2019-07-31] (Malwarebytes Corporation -> Malwarebytes)
R3 rt640x64; C:\WINDOWS\System32\drivers\rt640x64.sys [1122200 2018-12-14] (Realtek Semiconductor Corp. -> Realtek )
S3 semav6msr64; C:\WINDOWS\system32\drivers\semav6msr64.sys [43008 2018-12-19] (Intel Corporation -> )
R3 tap0901; C:\WINDOWS\System32\drivers\tap0901.sys [27136 2016-04-21] (OpenVPN Technologies, Inc. -> The OpenVPN Project)
S0 WdBoot; C:\WINDOWS\System32\drivers\wd\WdBoot.sys [47496 2019-07-27] (Microsoft Windows Early Launch Anti-Malware Publisher -> Microsoft Corporation)
R0 WdFilter; C:\WINDOWS\System32\drivers\wd\WdFilter.sys [344288 2019-07-27] (Microsoft Windows -> Microsoft Corporation)
S3 WdNisDrv; C:\WINDOWS\System32\drivers\wd\WdNisDrv.sys [54496 2019-07-27] (Microsoft Windows -> Microsoft Corporation)

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== One month (created) ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2019-07-31 20:27 - 2019-07-31 20:27 - 000275232 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mbamswissarmy.sys
2019-07-31 20:12 - 2019-07-31 20:12 - 000000000 ____D C:\Users\Jozko\AppData\LocalLow\VYeRfUFKkRVtG
2019-07-31 20:01 - 2019-07-31 20:27 - 000021868 _____ C:\Users\Jozko\Desktop\Fixlog.txt
2019-07-31 20:01 - 2019-07-31 20:01 - 000000000 ____D C:\Users\Jozko\Desktop\FRST-OlderVersion
2019-07-31 20:01 - 2019-07-31 20:01 - 000000000 ____D C:\Users\Jozko\AppData\Local\PeerDistRepub
2019-07-31 19:13 - 2019-07-31 19:13 - 000000085 _____ C:\WINDOWS\wininit.ini
2019-07-31 19:11 - 2019-07-31 19:11 - 000000306 __RSH C:\Users\Jozko\ntuser.pol
2019-07-31 19:08 - 2019-07-31 19:11 - 000000330 _____ C:\WINDOWS\Tasks\oncIfaVdQabfxqj.job
2019-07-31 19:08 - 2019-07-31 19:08 - 000002708 __RSH C:\ProgramData\ntuser.pol
2019-07-31 19:08 - 2019-07-31 19:08 - 000000000 ____D C:\Program Files (x86)\minXQDMZbIE
2019-07-31 19:08 - 2019-07-31 19:08 - 000000000 ____D C:\Program Files (x86)\hhaccViKlMUn
2019-07-31 19:08 - 2019-07-31 19:08 - 000000000 ____D C:\Program Files (x86)\duxVclVEU
2019-07-30 22:25 - 2019-07-30 22:25 - 000000000 ____D C:\Users\Lubka\AppData\Local\mbamtray
2019-07-30 22:11 - 2019-07-30 22:11 - 000000000 ____D C:\Users\Jozko\AppData\Roaming\Sun
2019-07-30 22:11 - 2019-07-30 22:11 - 000000000 ____D C:\Users\Jozko\AppData\LocalLow\Sun
2019-07-30 22:01 - 2019-07-30 22:05 - 000031366 _____ C:\Users\Jozko\Desktop\Addition.txt
2019-07-30 22:00 - 2019-07-31 20:28 - 000022666 _____ C:\Users\Jozko\Desktop\FRST.txt
2019-07-30 22:00 - 2019-07-31 20:28 - 000000000 ____D C:\FRST
2019-07-30 21:47 - 2019-07-31 20:01 - 002096128 _____ (Farbar) C:\Users\Jozko\Desktop\FRST64.exe
2019-07-30 21:26 - 2019-07-30 21:26 - 000001944 _____ C:\Users\Jozko\Desktop\trojaner2.txt
2019-07-30 21:17 - 2019-07-30 21:17 - 000089239 _____ C:\Users\Jozko\Desktop\trojaner.txt
2019-07-30 21:11 - 2019-07-30 21:11 - 000001912 _____ C:\Users\Public\Desktop\Malwarebytes.lnk
2019-07-30 21:11 - 2019-07-30 21:11 - 000000000 ____D C:\Users\Jozko\AppData\Local\mbamtray
2019-07-30 21:11 - 2019-07-30 21:11 - 000000000 ____D C:\Users\Jozko\AppData\Local\mbam
2019-07-30 21:11 - 2019-07-30 21:11 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes
2019-07-30 21:11 - 2019-01-08 16:32 - 000153328 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mbae64.sys
2019-07-30 21:10 - 2019-07-30 21:10 - 000000000 ____D C:\ProgramData\Malwarebytes
2019-07-30 21:10 - 2019-07-30 21:10 - 000000000 ____D C:\Program Files\Malwarebytes
2019-07-30 21:09 - 2019-07-30 21:09 - 000000000 ____D C:\WINDOWS\pss
2019-07-30 20:49 - 2019-07-30 20:49 - 000388992 _____ C:\Users\Jozko\Desktop\bookmarksJ.html
2019-07-30 20:47 - 2019-07-30 20:47 - 000051801 _____ C:\Users\Lubka\Desktop\bookmarksL.html
2019-07-30 20:26 - 2019-07-30 20:27 - 000000000 ____D C:\AdwCleaner
2019-07-30 20:24 - 2019-07-30 20:25 - 007623880 _____ (Malwarebytes) C:\Users\Jozko\Desktop\adwcleaner_7.4.exe
2019-07-30 20:15 - 2019-07-30 20:15 - 000000000 ____D C:\Users\Jozko\AppData\Local\D3DSCache
2019-07-30 20:04 - 2019-07-31 19:14 - 000000000 ____D C:\Program Files (x86)\Spybot - Search & Destroy 2
2019-07-30 20:04 - 2019-07-31 19:13 - 000000000 ____D C:\ProgramData\Spybot - Search & Destroy
2019-07-30 20:01 - 2019-07-30 20:04 - 069910960 _____ (Safer-Networking Ltd. ) C:\Users\Jozko\Desktop\spybotsd-2.7.64.0.exe
2019-07-27 14:10 - 2019-07-27 14:10 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Intel
2019-07-27 12:14 - 2019-07-27 12:15 - 000000000 ____D C:\Users\Lubka\Desktop\SAP-USB
2019-07-27 12:12 - 2019-07-27 12:12 - 001680991 _____ C:\Users\Lubka\Desktop\mssstool0221.zip
2019-07-27 11:52 - 2019-07-27 12:01 - 000000000 ____D C:\WINDOWS\Microsoft Antimalware
2019-07-25 01:04 - 2019-07-25 01:04 - 000000000 ____D C:\ProgramData\TmpLoog
2019-07-25 00:44 - 2019-07-25 00:44 - 000000000 ____D C:\Users\Lubka\AppData\LocalLow\lltgznTbqqOCq
2019-07-25 00:41 - 2019-07-25 00:41 - 000000000 ____D C:\ProgramData\Lamia
2019-07-25 00:39 - 2019-07-25 00:41 - 000000000 ____D C:\Users\Lubka\AppData\Local\Mail.Ru
2019-07-25 00:39 - 2019-07-25 00:40 - 000000000 ____D C:\ProgramData\Mail.Ru
2019-07-25 00:39 - 2019-07-25 00:39 - 000825856 _____ C:\Default.xml
2019-07-25 00:39 - 2019-07-25 00:39 - 000000000 ____D C:\ProgramData\Loosger
2019-07-25 00:38 - 2019-07-25 00:38 - 004059136 _____ C:\Users\Lubka\Downloads\setup_f5ac96a97f5f.iso
2019-07-25 00:36 - 2019-07-25 00:36 - 007856585 _____ C:\Users\Lubka\Downloads\K-ON!! MOD COMPLETE .rar
2019-07-25 00:36 - 2019-07-25 00:36 - 001132644 _____ C:\Users\Lubka\Downloads\Nakano Azusa.rar
2019-07-24 23:11 - 2019-07-24 23:11 - 000000000 ____D C:\Users\Lubka\AppData\Roaming\WinRAR
2019-07-24 23:11 - 2019-07-24 23:11 - 000000000 ____D C:\Users\Lubka\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR
2019-07-24 23:11 - 2019-07-24 23:11 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinRAR
2019-07-24 23:11 - 2019-07-24 23:11 - 000000000 ____D C:\Program Files (x86)\WinRAR
2019-07-24 23:10 - 2019-07-24 23:10 - 002918616 _____ (Alexander Roshal) C:\Users\Lubka\Downloads\wrar571.exe
2019-07-24 23:05 - 2019-07-24 23:05 - 000147094 _____ C:\Users\Lubka\Downloads\SilentPatchSA.zip
2019-07-24 23:04 - 2019-07-24 23:04 - 000039315 _____ C:\Users\Lubka\Downloads\asiloader.rar
2019-07-24 23:00 - 2019-07-24 23:20 - 000000000 ____D C:\Users\Lubka\Documents\GTA San Andreas User Files
2019-07-24 23:00 - 2008-10-15 06:22 - 005631312 _____ (Microsoft Corporation) C:\WINDOWS\system32\D3DX9_40.dll
2019-07-24 23:00 - 2008-10-15 06:22 - 004379984 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\D3DX9_40.dll
2019-07-24 23:00 - 2008-10-15 06:22 - 002605920 _____ (Microsoft Corporation) C:\WINDOWS\system32\D3DCompiler_40.dll
2019-07-24 23:00 - 2008-10-15 06:22 - 002036576 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\D3DCompiler_40.dll
2019-07-24 23:00 - 2008-10-15 06:22 - 000519000 _____ (Microsoft Corporation) C:\WINDOWS\system32\d3dx10_40.dll
2019-07-24 23:00 - 2008-10-15 06:22 - 000452440 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d3dx10_40.dll
2019-07-24 21:13 - 2019-07-24 21:13 - 000001315 _____ C:\Users\Public\Desktop\Age of Empires - The Rise of Rome color fix.lnk
2019-07-24 21:13 - 2019-07-24 21:13 - 000001306 _____ C:\Users\Public\Desktop\Age of Empires color fix.lnk
2019-07-24 21:13 - 2019-07-24 21:13 - 000001185 _____ C:\Users\Public\Desktop\Age of Empires - The Rise of Rome.lnk
2019-07-24 21:13 - 2019-07-24 21:13 - 000001178 _____ C:\Users\Public\Desktop\Age of Empires.lnk
2019-07-24 21:13 - 2019-07-24 21:13 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Age of Empires complete
2019-07-24 21:13 - 2019-07-24 21:13 - 000000000 ____D C:\Program Files (x86)\Age of Empires complete
2019-07-24 19:25 - 2019-07-24 19:25 - 000000221 _____ C:\Users\Lubka\Desktop\Grand Theft Auto San Andreas.url
2019-07-24 19:25 - 2019-07-24 19:25 - 000000000 ____D C:\Users\Lubka\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Steam
2019-07-24 19:23 - 2019-07-25 01:01 - 000000000 ____D C:\Program Files\Mozilla Firefox
2019-07-24 19:20 - 2019-07-24 19:20 - 000000000 ____D C:\Users\Lubka\AppData\Local\Steam
2019-07-24 19:20 - 2019-07-24 19:20 - 000000000 ____D C:\Users\Lubka\AppData\Local\CEF
2019-07-24 19:11 - 2019-07-24 19:11 - 001573568 _____ C:\Users\Lubka\Downloads\SteamSetup.exe
2019-07-24 19:11 - 2019-07-24 19:11 - 000001036 _____ C:\Users\Public\Desktop\Steam.lnk
2019-07-24 19:11 - 2019-07-24 19:11 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Steam
2019-07-13 16:59 - 2019-07-13 16:59 - 000716789 _____ C:\WINDOWS\SysWOW64\unins000.exe
2019-07-13 16:59 - 2019-07-13 16:59 - 000001770 _____ C:\WINDOWS\SysWOW64\unins000.dat
2019-07-13 16:59 - 2019-04-10 14:55 - 000290816 _____ (www.xjghost.com) C:\WINDOWS\SysWOW64\WebClientPlayBack.ocx
2019-07-13 16:59 - 2019-04-10 14:45 - 000229484 _____ () C:\WINDOWS\SysWOW64\WebClientPlus.ocx
2019-07-13 16:59 - 2019-03-29 09:22 - 000004240 _____ C:\WINDOWS\SysWOW64\lang_spanish.ini
2019-07-13 16:59 - 2019-03-29 09:16 - 000004250 _____ C:\WINDOWS\SysWOW64\lang_italy.ini
2019-07-13 16:59 - 2019-03-29 09:12 - 000004624 _____ C:\WINDOWS\SysWOW64\lang_franch.ini
2019-07-13 16:59 - 2019-03-29 09:09 - 000004404 _____ C:\WINDOWS\SysWOW64\lang_germany.ini
2019-07-13 16:59 - 2019-03-28 10:33 - 000002698 _____ C:\WINDOWS\SysWOW64\lang_chn.ini
2019-07-13 16:59 - 2019-01-11 16:02 - 000245760 _____ () C:\WINDOWS\SysWOW64\NetLib.dll
2019-07-13 16:59 - 2019-01-11 15:55 - 000081920 _____ () C:\WINDOWS\SysWOW64\hiPBClient.dll
2019-07-13 16:59 - 2018-11-12 18:10 - 000417792 _____ () C:\WINDOWS\SysWOW64\HIPlayer.dll
2019-07-13 16:59 - 2018-11-07 11:26 - 000319488 _____ () C:\WINDOWS\SysWOW64\HIPlayer.exe
2019-07-13 16:59 - 2018-11-07 10:38 - 000057344 _____ () C:\WINDOWS\SysWOW64\HISDK.dll
2019-07-13 16:59 - 2018-11-07 09:57 - 000573952 _____ C:\WINDOWS\SysWOW64\Hi265.dll
2019-07-13 16:59 - 2014-04-10 14:28 - 000057344 _____ (????) C:\WINDOWS\SysWOW64\SearchLib.dll
2019-07-13 16:59 - 2013-07-10 17:21 - 000217600 _____ C:\WINDOWS\SysWOW64\npzxwebplugin.dll
2019-07-13 16:59 - 2012-09-25 21:39 - 002555406 _____ C:\WINDOWS\SysWOW64\avcodec-54.dll
2019-07-13 16:59 - 2012-09-25 21:39 - 000157198 _____ C:\WINDOWS\SysWOW64\avutil-51.dll
2019-07-13 16:59 - 2010-08-23 20:07 - 000562220 _____ C:\WINDOWS\SysWOW64\AlarmSound.wav
2019-07-13 16:58 - 2019-07-13 16:58 - 002036967 _____ ( ) C:\Users\Jozko\Desktop\ClientPlus_Setup.exe
2019-07-13 16:47 - 2019-07-13 16:47 - 000001906 _____ C:\Users\Jozko\Desktop\HiPlayer.exe.lnk
2019-07-13 16:47 - 2019-07-13 16:47 - 000000000 ____D C:\Users\Jozko\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\HiPlayer
2019-07-13 16:47 - 2019-07-13 16:47 - 000000000 ____D C:\Users\Jozko\AppData\Roaming\HiPlayer
2019-07-09 19:25 - 2019-07-04 11:40 - 021390504 _____ (Microsoft Corporation) C:\WINDOWS\system32\shell32.dll
2019-07-09 19:25 - 2019-07-04 11:40 - 001616840 _____ (Microsoft Corporation) C:\WINDOWS\system32\sppobjs.dll
2019-07-09 19:25 - 2019-07-04 11:18 - 003614208 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32kfull.sys
2019-07-09 19:25 - 2019-07-04 10:51 - 020384128 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\shell32.dll
2019-07-09 19:25 - 2019-07-04 10:37 - 002882048 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\win32kfull.sys
2019-07-09 19:25 - 2019-07-04 07:00 - 001035040 _____ (Microsoft Corporation) C:\WINDOWS\system32\ApplyTrustOffline.exe
2019-07-09 19:25 - 2019-07-04 06:58 - 001219896 _____ (Microsoft Corporation) C:\WINDOWS\system32\hvix64.exe
2019-07-09 19:25 - 2019-07-04 06:57 - 003292152 _____ (Microsoft Corporation) C:\WINDOWS\system32\combase.dll
2019-07-09 19:25 - 2019-07-04 06:56 - 009084216 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntoskrnl.exe
2019-07-09 19:25 - 2019-07-04 06:56 - 007519896 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.Protection.PlayReady.dll
2019-07-09 19:25 - 2019-07-04 06:56 - 007436536 _____ (Microsoft Corporation) C:\WINDOWS\system32\windows.storage.dll
2019-07-09 19:25 - 2019-07-04 06:56 - 002810680 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgkrnl.sys
2019-07-09 19:25 - 2019-07-04 06:42 - 006570368 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.Protection.PlayReady.dll
2019-07-09 19:25 - 2019-07-04 06:42 - 006044008 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\windows.storage.dll
2019-07-09 19:25 - 2019-07-04 06:42 - 002479176 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\combase.dll
2019-07-09 19:25 - 2019-07-04 06:37 - 025857536 _____ (Microsoft Corporation) C:\WINDOWS\system32\edgehtml.dll
2019-07-09 19:25 - 2019-07-04 06:33 - 022017536 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\edgehtml.dll
2019-07-09 19:25 - 2019-07-04 06:29 - 022717440 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll
2019-07-09 19:25 - 2019-07-04 06:26 - 004385280 _____ (Microsoft Corporation) C:\WINDOWS\system32\EdgeContent.dll
2019-07-09 19:25 - 2019-07-04 06:25 - 019372544 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll
2019-07-09 19:25 - 2019-07-04 06:25 - 007589888 _____ (Microsoft Corporation) C:\WINDOWS\system32\Chakra.dll
2019-07-09 19:25 - 2019-07-04 06:25 - 004861440 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll
2019-07-09 19:25 - 2019-07-04 06:25 - 003401216 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentServer.dll
2019-07-09 19:25 - 2019-07-04 06:22 - 003707904 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll
2019-07-09 19:25 - 2019-07-04 06:21 - 005784064 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Chakra.dll
2019-07-09 19:25 - 2019-07-04 06:21 - 003202560 _____ (Microsoft Corporation) C:\WINDOWS\system32\DWrite.dll
2019-07-09 19:25 - 2019-06-13 14:12 - 002871848 _____ (Microsoft Corporation) C:\WINDOWS\system32\aitstatic.exe
2019-07-09 19:25 - 2019-06-13 14:05 - 000810296 _____ (Microsoft Corporation) C:\WINDOWS\system32\generaltel.dll
2019-07-09 19:25 - 2019-06-13 14:04 - 001721144 _____ (Microsoft Corporation) C:\WINDOWS\system32\appraiser.dll
2019-07-09 19:25 - 2019-06-13 13:59 - 000740664 _____ (Microsoft Corporation) C:\WINDOWS\system32\aeinv.dll
2019-07-09 19:25 - 2019-06-13 13:42 - 004038688 _____ (Microsoft Corporation) C:\WINDOWS\explorer.exe
2019-07-09 19:25 - 2019-06-13 13:18 - 006586880 _____ (Microsoft Corporation) C:\WINDOWS\system32\twinui.dll
2019-07-09 19:25 - 2019-06-13 13:18 - 004847104 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingsHandlers_nt.dll
2019-07-09 19:25 - 2019-06-13 13:17 - 012756992 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll
2019-07-09 19:25 - 2019-06-13 13:15 - 004718080 _____ (Microsoft Corporation) C:\WINDOWS\system32\twinui.pcshell.dll
2019-07-09 19:25 - 2019-06-13 13:13 - 002920448 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Logon.dll
2019-07-09 19:25 - 2019-06-13 12:11 - 001539896 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AppVEntSubsystems32.dll
2019-07-09 19:25 - 2019-06-13 12:05 - 003700160 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\explorer.exe
2019-07-09 19:25 - 2019-06-13 11:55 - 005657088 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\twinui.dll
2019-07-09 19:25 - 2019-06-13 11:54 - 011942912 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll
2019-07-09 19:25 - 2019-06-13 09:01 - 000513336 _____ (Microsoft Corporation) C:\WINDOWS\system32\aepic.dll
2019-07-09 19:25 - 2019-06-13 08:47 - 005625160 _____ (Microsoft Corporation) C:\WINDOWS\system32\StartTileData.dll
2019-07-09 19:25 - 2019-06-13 08:44 - 002769688 _____ (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll
2019-07-09 19:25 - 2019-06-13 08:14 - 003318784 _____ (Microsoft Corporation) C:\WINDOWS\system32\dwmcore.dll
2019-07-09 19:25 - 2019-06-13 08:13 - 004771840 _____ (Microsoft Corporation) C:\WINDOWS\system32\InputService.dll
2019-07-09 19:25 - 2019-06-13 07:14 - 000415544 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\aepic.dll
2019-07-09 19:25 - 2019-06-13 07:06 - 002256768 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iertutil.dll
2019-07-09 19:24 - 2019-07-04 11:45 - 001786680 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVEntVirtualization.dll
2019-07-09 19:24 - 2019-07-04 11:43 - 000094008 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpudd.dll
2019-07-09 19:24 - 2019-07-04 11:41 - 000304144 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\mssecflt.sys
2019-07-09 19:24 - 2019-07-04 11:40 - 001631808 _____ (Microsoft Corporation) C:\WINDOWS\system32\gdi32full.dll
2019-07-09 19:24 - 2019-07-04 11:40 - 000790416 _____ (Microsoft Corporation) C:\WINDOWS\system32\fontdrvhost.exe
2019-07-09 19:24 - 2019-07-04 11:22 - 000131072 _____ (Microsoft Corporation) C:\WINDOWS\splwow64.exe
2019-07-09 19:24 - 2019-07-04 11:22 - 000128000 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppxSysprep.dll
2019-07-09 19:24 - 2019-07-04 11:21 - 008627200 _____ (Microsoft Corporation) C:\WINDOWS\system32\mstscax.dll
2019-07-09 19:24 - 2019-07-04 11:20 - 001609216 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpcorets.dll
2019-07-09 19:24 - 2019-07-04 11:19 - 000420864 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpclip.exe
2019-07-09 19:24 - 2019-07-04 11:18 - 001663488 _____ (Microsoft Corporation) C:\WINDOWS\system32\GdiPlus.dll
2019-07-09 19:24 - 2019-07-04 10:56 - 001453416 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\gdi32full.dll
2019-07-09 19:24 - 2019-07-04 10:54 - 000662352 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\fontdrvhost.exe
2019-07-09 19:24 - 2019-07-04 10:41 - 007990784 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mstscax.dll
2019-07-09 19:24 - 2019-07-04 10:36 - 001471488 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\GdiPlus.dll
2019-07-09 19:24 - 2019-07-04 06:58 - 001328440 _____ (Microsoft Corporation) C:\WINDOWS\system32\wpx.dll
2019-07-09 19:24 - 2019-07-04 06:58 - 000416312 _____ (Microsoft Corporation) C:\WINDOWS\system32\wlanapi.dll
2019-07-09 19:24 - 2019-07-04 06:58 - 000192824 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\appid.sys
2019-07-09 19:24 - 2019-07-04 06:57 - 001027384 _____ (Microsoft Corporation) C:\WINDOWS\system32\hvax64.exe
2019-07-09 19:24 - 2019-07-04 06:57 - 000986128 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingSyncHost.exe
2019-07-09 19:24 - 2019-07-04 06:57 - 000776784 _____ (Microsoft Corporation) C:\WINDOWS\system32\wer.dll
2019-07-09 19:24 - 2019-07-04 06:57 - 000723728 _____ (Microsoft Corporation) C:\WINDOWS\system32\ci.dll
2019-07-09 19:24 - 2019-07-04 06:57 - 000708696 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\cng.sys
2019-07-09 19:24 - 2019-07-04 06:57 - 000568104 _____ (Microsoft Corporation) C:\WINDOWS\system32\tcblaunch.exe
2019-07-09 19:24 - 2019-07-04 06:57 - 000362264 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Storage.ApplicationData.dll
2019-07-09 19:24 - 2019-07-04 06:57 - 000209424 _____ (Microsoft Corporation) C:\WINDOWS\system32\wermgr.exe
2019-07-09 19:24 - 2019-07-04 06:57 - 000194360 _____ (Microsoft Corporation) C:\WINDOWS\system32\skci.dll
2019-07-09 19:24 - 2019-07-04 06:57 - 000137656 _____ (Microsoft Corporation) C:\WINDOWS\system32\bcrypt.dll
2019-07-09 19:24 - 2019-07-04 06:57 - 000134968 _____ (Microsoft Corporation) C:\WINDOWS\system32\hvloader.dll
2019-07-09 19:24 - 2019-07-04 06:57 - 000091776 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dumpfve.sys
2019-07-09 19:24 - 2019-07-04 06:56 - 002571640 _____ (Microsoft Corporation) C:\WINDOWS\system32\KernelBase.dll
2019-07-09 19:24 - 2019-07-04 06:56 - 001566520 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppxPackaging.dll
2019-07-09 19:24 - 2019-07-04 06:56 - 001459120 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.efi
2019-07-09 19:24 - 2019-07-04 06:56 - 001260776 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.exe
2019-07-09 19:24 - 2019-07-04 06:56 - 001141496 _____ (Microsoft Corporation) C:\WINDOWS\system32\winresume.efi
2019-07-09 19:24 - 2019-07-04 06:56 - 000983936 _____ (Microsoft Corporation) C:\WINDOWS\system32\winresume.exe
2019-07-09 19:24 - 2019-07-04 06:56 - 000767536 _____ (Microsoft Corporation) C:\WINDOWS\system32\dnsapi.dll
2019-07-09 19:24 - 2019-07-04 06:56 - 000734952 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentClient.dll
2019-07-09 19:24 - 2019-07-04 06:56 - 000713272 _____ (Microsoft Corporation) C:\WINDOWS\system32\MSVideoDSP.dll
2019-07-09 19:24 - 2019-07-04 06:56 - 000604984 _____ (Microsoft Corporation) C:\WINDOWS\system32\securekernel.exe
2019-07-09 19:24 - 2019-07-04 06:56 - 000493752 _____ (Microsoft Corporation) C:\WINDOWS\system32\bcryptprimitives.dll
2019-07-09 19:24 - 2019-07-04 06:56 - 000115512 _____ (Microsoft Corporation) C:\WINDOWS\system32\kdnet.dll
2019-07-09 19:24 - 2019-07-04 06:43 - 000832016 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SettingSyncHost.exe
2019-07-09 19:24 - 2019-07-04 06:43 - 000665440 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wer.dll
2019-07-09 19:24 - 2019-07-04 06:43 - 000328696 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wlanapi.dll
2019-07-09 19:24 - 2019-07-04 06:43 - 000287376 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Storage.ApplicationData.dll
2019-07-09 19:24 - 2019-07-04 06:43 - 000191800 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wermgr.exe
2019-07-09 19:24 - 2019-07-04 06:42 - 001980984 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\KernelBase.dll
2019-07-09 19:24 - 2019-07-04 06:42 - 001427768 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AppxPackaging.dll
2019-07-09 19:24 - 2019-07-04 06:42 - 000573808 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dnsapi.dll
2019-07-09 19:24 - 2019-07-04 06:42 - 000356312 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\bcryptprimitives.dll
2019-07-09 19:24 - 2019-07-04 06:42 - 000097272 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\bcrypt.dll
2019-07-09 19:24 - 2019-07-04 06:41 - 000559328 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AppXDeploymentClient.dll
2019-07-09 19:24 - 2019-07-04 06:26 - 000310272 _____ (Microsoft Corporation) C:\WINDOWS\system32\wc_storage.dll
2019-07-09 19:24 - 2019-07-04 06:26 - 000051200 _____ (Microsoft Corporation) C:\WINDOWS\system32\TpmTasks.dll
2019-07-09 19:24 - 2019-07-04 06:25 - 000295424 _____ (Microsoft Corporation) C:\WINDOWS\system32\TDLMigration.dll
2019-07-09 19:24 - 2019-07-04 06:25 - 000079872 _____ (Microsoft Corporation) C:\WINDOWS\system32\offreg.dll
2019-07-09 19:24 - 2019-07-04 06:24 - 000726528 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\PEAuth.sys
2019-07-09 19:24 - 2019-07-04 06:24 - 000567808 _____ (Microsoft Corporation) C:\WINDOWS\system32\daxexec.dll
2019-07-09 19:24 - 2019-07-04 06:24 - 000462336 _____ (Microsoft Corporation) C:\WINDOWS\system32\bcdedit.exe
2019-07-09 19:24 - 2019-07-04 06:24 - 000153600 _____ (Microsoft Corporation) C:\WINDOWS\system32\dssvc.dll
2019-07-09 19:24 - 2019-07-04 06:23 - 001765888 _____ (Microsoft Corporation) C:\WINDOWS\system32\audiosrv.dll
2019-07-09 19:24 - 2019-07-04 06:23 - 001217536 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpcore.dll
2019-07-09 19:24 - 2019-07-04 06:23 - 000786432 _____ (Microsoft Corporation) C:\WINDOWS\system32\iphlpsvc.dll
2019-07-09 19:24 - 2019-07-04 06:22 - 002587648 _____ (Microsoft Corporation) C:\WINDOWS\system32\wlansvc.dll
2019-07-09 19:24 - 2019-07-04 06:22 - 002176000 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentExtensions.onecore.dll
2019-07-09 19:24 - 2019-07-04 06:22 - 001561088 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentExtensions.desktop.dll
2019-07-09 19:24 - 2019-07-04 06:22 - 001549824 _____ (Microsoft Corporation) C:\WINDOWS\system32\lsasrv.dll
2019-07-09 19:24 - 2019-07-04 06:22 - 001175552 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingSyncCore.dll
2019-07-09 19:24 - 2019-07-04 06:22 - 000300544 _____ (Microsoft Corporation) C:\WINDOWS\system32\dnsrslvr.dll
2019-07-09 19:24 - 2019-07-04 06:22 - 000110592 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\profext.dll
2019-07-09 19:24 - 2019-07-04 06:22 - 000032768 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\werdiagcontroller.dll
2019-07-09 19:24 - 2019-07-04 06:21 - 005307392 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d2d1.dll
2019-07-09 19:24 - 2019-07-04 06:21 - 002166784 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32kbase.sys
2019-07-09 19:24 - 2019-07-04 06:21 - 001920000 _____ (Microsoft Corporation) C:\WINDOWS\system32\FntCache.dll
2019-07-09 19:24 - 2019-07-04 06:21 - 001220608 _____ (Microsoft Corporation) C:\WINDOWS\system32\Unistore.dll
2019-07-09 19:24 - 2019-07-04 06:21 - 000324096 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppxAllUserStore.dll
2019-07-09 19:24 - 2019-07-04 06:21 - 000124416 _____ (Microsoft Corporation) C:\WINDOWS\system32\profext.dll
2019-07-09 19:24 - 2019-07-04 06:21 - 000059392 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\offreg.dll
2019-07-09 19:24 - 2019-07-04 06:20 - 001156608 _____ (Microsoft Corporation) C:\WINDOWS\system32\rpcss.dll
2019-07-09 19:24 - 2019-07-04 06:20 - 000544256 _____ (Microsoft Corporation) C:\WINDOWS\system32\vbscript.dll
2019-07-09 19:24 - 2019-07-04 06:20 - 000392704 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\daxexec.dll
2019-07-09 19:24 - 2019-07-04 06:20 - 000330752 _____ (Microsoft Corporation) C:\WINDOWS\system32\ncryptprov.dll
2019-07-09 19:24 - 2019-07-04 06:19 - 000886272 _____ (Microsoft Corporation) C:\WINDOWS\system32\MPSSVC.dll
2019-07-09 19:24 - 2019-07-04 06:19 - 000230912 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AppxAllUserStore.dll
2019-07-09 19:24 - 2019-07-04 06:18 - 002602496 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\DWrite.dll
2019-07-09 19:24 - 2019-07-04 06:18 - 001076224 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rdpcore.dll
2019-07-09 19:24 - 2019-07-04 06:18 - 000965632 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Unistore.dll
2019-07-09 19:24 - 2019-07-04 06:18 - 000953344 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SettingSyncCore.dll
2019-07-09 19:24 - 2019-07-04 06:18 - 000275968 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ncryptprov.dll
2019-07-09 19:24 - 2019-07-04 06:17 - 000531968 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\vbscript.dll
2019-07-09 19:24 - 2019-07-04 05:01 - 000001312 _____ C:\WINDOWS\system32\tcbres.wim
2019-07-09 19:24 - 2019-06-21 10:50 - 000280584 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\msiscsi.sys
2019-07-09 19:24 - 2019-06-13 14:15 - 000324408 _____ (Microsoft Corporation) C:\WINDOWS\system32\acmigration.dll
2019-07-09 19:24 - 2019-06-13 14:00 - 000464696 _____ (Microsoft Corporation) C:\WINDOWS\system32\invagent.dll
2019-07-09 19:24 - 2019-06-13 13:58 - 000637752 _____ (Microsoft Corporation) C:\WINDOWS\system32\devinv.dll
2019-07-09 19:24 - 2019-06-13 13:58 - 000071480 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32appinventorycsp.dll
2019-07-09 19:24 - 2019-06-13 13:56 - 000164152 _____ (Microsoft Corporation) C:\WINDOWS\system32\CompatTelRunner.exe
2019-07-09 19:24 - 2019-06-13 13:43 - 001427984 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVEntSubsystemController.dll
2019-07-09 19:24 - 2019-06-13 13:43 - 001048480 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Internal.Shell.Broker.dll
2019-07-09 19:24 - 2019-06-13 13:42 - 002266936 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVEntSubsystems64.dll
2019-07-09 19:24 - 2019-06-13 13:42 - 000652088 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVPublishing.dll
2019-07-09 19:24 - 2019-06-13 13:42 - 000566536 _____ (Microsoft Corporation) C:\WINDOWS\system32\phoneactivate.exe
2019-07-09 19:24 - 2019-06-13 13:41 - 001626936 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVIntegration.dll
2019-07-09 19:24 - 2019-06-13 13:41 - 000830264 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVOrchestration.dll
2019-07-09 19:24 - 2019-06-13 13:41 - 000825144 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVEntStreamingManager.dll
2019-07-09 19:24 - 2019-06-13 13:41 - 000670008 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVCatalog.dll
2019-07-09 19:24 - 2019-06-13 13:40 - 000749880 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVReporting.dll
2019-07-09 19:24 - 2019-06-13 13:40 - 000540984 _____ (Microsoft Corporation) C:\WINDOWS\system32\pcasvc.dll
2019-07-09 19:24 - 2019-06-13 13:40 - 000495416 _____ (Microsoft Corporation) C:\WINDOWS\system32\TransportDSA.dll
2019-07-09 19:24 - 2019-06-13 13:38 - 000766264 _____ (Microsoft Corporation) C:\WINDOWS\system32\LicensingWinRT.dll
2019-07-09 19:24 - 2019-06-13 13:37 - 000101192 _____ (Microsoft Corporation) C:\WINDOWS\system32\changepk.exe
2019-07-09 19:24 - 2019-06-13 13:36 - 000251000 _____ (Microsoft Corporation) C:\WINDOWS\system32\sppwinob.dll
2019-07-09 19:24 - 2019-06-13 13:36 - 000236520 _____ (Microsoft Corporation) C:\WINDOWS\system32\EditionUpgradeManagerObj.dll
2019-07-09 19:24 - 2019-06-13 13:35 - 001376688 _____ (Microsoft Corporation) C:\WINDOWS\system32\ole32.dll
2019-07-09 19:24 - 2019-06-13 13:34 - 000146888 _____ (Microsoft Corporation) C:\WINDOWS\system32\LicensingUI.exe
2019-07-09 19:24 - 2019-06-13 13:17 - 000178176 _____ (Microsoft Corporation) C:\WINDOWS\system32\dmvdsitf.dll
2019-07-09 19:24 - 2019-06-13 13:17 - 000115200 _____ (Microsoft Corporation) C:\WINDOWS\system32\RjvMDMConfig.dll
2019-07-09 19:24 - 2019-06-13 13:17 - 000109056 _____ (Microsoft Corporation) C:\WINDOWS\system32\MDMAgent.exe
2019-07-09 19:24 - 2019-06-13 13:17 - 000093184 _____ (Microsoft Corporation) C:\WINDOWS\system32\WSReset.exe
2019-07-09 19:24 - 2019-06-13 13:16 - 000767488 _____ (Microsoft Corporation) C:\WINDOWS\system32\sppcommdlg.dll
2019-07-09 19:24 - 2019-06-13 13:15 - 000041984 _____ (Microsoft Corporation) C:\WINDOWS\system32\UpgradeResultsUI.exe
2019-07-09 19:24 - 2019-06-13 13:14 - 001127936 _____ (Microsoft Corporation) C:\WINDOWS\system32\nettrace.dll
2019-07-09 19:24 - 2019-06-13 13:14 - 000900096 _____ (Microsoft Corporation) C:\WINDOWS\system32\slui.exe
2019-07-09 19:24 - 2019-06-13 13:14 - 000346624 _____ (Microsoft Corporation) C:\WINDOWS\system32\AcGenral.dll
2019-07-09 19:24 - 2019-06-13 13:14 - 000246272 _____ (Microsoft Corporation) C:\WINDOWS\system32\DesktopSwitcherDataModel.dll
2019-07-09 19:24 - 2019-06-13 13:13 - 001339392 _____ (Microsoft Corporation) C:\WINDOWS\system32\TaskFlowDataEngine.dll
2019-07-09 19:24 - 2019-06-13 13:13 - 000951808 _____ (Microsoft Corporation) C:\WINDOWS\system32\sppcext.dll
2019-07-09 19:24 - 2019-06-13 13:13 - 000765440 _____ (Microsoft Corporation) C:\WINDOWS\system32\tdh.dll
2019-07-09 19:24 - 2019-06-13 13:13 - 000181248 _____ (Microsoft Corporation) C:\WINDOWS\system32\EditionUpgradeHelper.dll
2019-07-09 19:24 - 2019-06-13 13:12 - 000394240 _____ (Microsoft Corporation) C:\WINDOWS\system32\InputSwitch.dll
2019-07-09 19:24 - 2019-06-13 13:10 - 000239104 _____ (Microsoft Corporation) C:\WINDOWS\system32\vdsbas.dll
2019-07-09 19:24 - 2019-06-13 12:07 - 001027008 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ole32.dll
2019-07-09 19:24 - 2019-06-13 12:07 - 000660496 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\LicensingWinRT.dll
2019-07-09 19:24 - 2019-06-13 12:07 - 000221232 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\EditionUpgradeManagerObj.dll
2019-07-09 19:24 - 2019-06-13 11:54 - 000151552 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dmvdsitf.dll
2019-07-09 19:24 - 2019-06-13 11:53 - 000089600 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\olepro32.dll
2019-07-09 19:24 - 2019-06-13 11:51 - 000622080 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\tdh.dll
2019-07-09 19:24 - 2019-06-13 11:50 - 000896512 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\sppcext.dll
2019-07-09 19:24 - 2019-06-13 11:49 - 002406400 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AcGenral.dll
2019-07-09 19:24 - 2019-06-13 11:49 - 000371200 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\InputSwitch.dll
2019-07-09 19:24 - 2019-06-13 09:48 - 000677376 _____ (Microsoft Corporation) C:\WINDOWS\system32\HeadTrackerStorage.dll
2019-07-09 19:24 - 2019-06-13 09:46 - 000713216 _____ (Microsoft Corporation) C:\WINDOWS\system32\SharedRealitySvc.dll
2019-07-09 19:24 - 2019-06-13 09:01 - 000511288 _____ (Microsoft Corporation) C:\WINDOWS\system32\dcntel.dll
2019-07-09 19:24 - 2019-06-13 09:01 - 000036152 _____ (Microsoft Corporation) C:\WINDOWS\system32\DeviceCensus.exe
2019-07-09 19:24 - 2019-06-13 08:59 - 000785264 _____ (Microsoft Corporation) C:\WINDOWS\system32\pkeyhelper.dll
2019-07-09 19:24 - 2019-06-13 08:47 - 001063224 _____ (Microsoft Corporation) C:\WINDOWS\system32\SecConfig.efi
2019-07-09 19:24 - 2019-06-13 08:46 - 001076536 _____ (Microsoft Corporation) C:\WINDOWS\system32\efscore.dll
2019-07-09 19:24 - 2019-06-13 08:46 - 000510296 _____ (Microsoft Corporation) C:\WINDOWS\system32\policymanager.dll
2019-07-09 19:24 - 2019-06-13 08:46 - 000093984 _____ (Microsoft Corporation) C:\WINDOWS\system32\wldp.dll
2019-07-09 19:24 - 2019-06-13 08:45 - 002421560 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ntfs.sys
2019-07-09 19:24 - 2019-06-13 08:44 - 002546704 _____ (Microsoft Corporation) C:\WINDOWS\system32\UpdateAgent.dll
2019-07-09 19:24 - 2019-06-13 08:44 - 001098272 _____ (Microsoft Corporation) C:\WINDOWS\system32\msvproc.dll
2019-07-09 19:24 - 2019-06-13 08:44 - 001033696 _____ (Microsoft Corporation) C:\WINDOWS\system32\ClipSVC.dll
2019-07-09 19:24 - 2019-06-13 08:44 - 000607112 _____ (Microsoft Corporation) C:\WINDOWS\system32\TextInputFramework.dll
2019-07-09 19:24 - 2019-06-13 08:44 - 000545808 _____ (Microsoft Corporation) C:\WINDOWS\system32\hal.dll
2019-07-09 19:24 - 2019-06-13 08:44 - 000130624 _____ (Microsoft Corporation) C:\WINDOWS\system32\rmclient.dll
2019-07-09 19:24 - 2019-06-13 08:17 - 000106496 _____ (Microsoft Corporation) C:\WINDOWS\system32\NotificationControllerPS.dll
2019-07-09 19:24 - 2019-06-13 08:16 - 001626112 _____ (Microsoft Corporation) C:\WINDOWS\system32\enterprisecsps.dll
2019-07-09 19:24 - 2019-06-13 08:16 - 000140288 _____ (Microsoft Corporation) C:\WINDOWS\system32\mdmmigrator.dll
2019-07-09 19:24 - 2019-06-13 08:15 - 000514560 _____ (Microsoft Corporation) C:\WINDOWS\system32\nltest.exe
2019-07-09 19:24 - 2019-06-13 08:15 - 000433152 _____ (Microsoft Corporation) C:\WINDOWS\system32\MusNotification.exe
2019-07-09 19:24 - 2019-06-13 08:15 - 000204288 _____ (Microsoft Corporation) C:\WINDOWS\system32\enrollmentapi.dll
2019-07-09 19:24 - 2019-06-13 08:15 - 000137728 _____ (Microsoft Corporation) C:\WINDOWS\system32\InputLocaleManager.dll
2019-07-09 19:24 - 2019-06-13 08:15 - 000083456 _____ (Microsoft Corporation) C:\WINDOWS\system32\KdsCli.dll
2019-07-09 19:24 - 2019-06-13 08:14 - 000409088 _____ (Microsoft Corporation) C:\WINDOWS\system32\wlanmsm.dll
2019-07-09 19:24 - 2019-06-13 08:14 - 000361472 _____ (Microsoft Corporation) C:\WINDOWS\system32\DeviceEnroller.exe
2019-07-09 19:24 - 2019-06-13 08:14 - 000302080 _____ (Microsoft Corporation) C:\WINDOWS\system32\CXHProvisioningServer.dll
2019-07-09 19:24 - 2019-06-13 08:13 - 002370048 _____ (Microsoft Corporation) C:\WINDOWS\system32\WebRuntimeManager.dll
2019-07-09 19:24 - 2019-06-13 08:13 - 000761344 _____ (Microsoft Corporation) C:\WINDOWS\system32\nshwfp.dll
2019-07-09 19:24 - 2019-06-13 08:13 - 000322560 _____ (Microsoft Corporation) C:\WINDOWS\system32\MusNotificationUx.exe
2019-07-09 19:24 - 2019-06-13 08:13 - 000110592 _____ (Microsoft Corporation) C:\WINDOWS\system32\ngcpopkeysrv.dll
2019-07-09 19:24 - 2019-06-13 08:12 - 000916480 _____ (Microsoft Corporation) C:\WINDOWS\system32\MusUpdateHandlers.dll
2019-07-09 19:24 - 2019-06-13 08:12 - 000894464 _____ (Microsoft Corporation) C:\WINDOWS\system32\webplatstorageserver.dll
2019-07-09 19:24 - 2019-06-13 08:12 - 000808448 _____ (Microsoft Corporation) C:\WINDOWS\system32\EdgeManager.dll
2019-07-09 19:24 - 2019-06-13 08:12 - 000624640 _____ (Microsoft Corporation) C:\WINDOWS\system32\PsmServiceExtHost.dll
2019-07-09 19:24 - 2019-06-13 08:12 - 000532992 _____ (Microsoft Corporation) C:\WINDOWS\system32\QuietHours.dll
2019-07-09 19:24 - 2019-06-13 08:12 - 000501248 _____ (Microsoft Corporation) C:\WINDOWS\system32\rastls.dll
2019-07-09 19:24 - 2019-06-13 08:11 - 000508416 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingsHandlers_Notifications.dll
2019-07-09 19:24 - 2019-06-13 08:11 - 000271872 _____ (Microsoft Corporation) C:\WINDOWS\system32\wkssvc.dll
2019-07-09 19:24 - 2019-06-13 08:11 - 000048128 _____ (Microsoft Corporation) C:\WINDOWS\system32\TokenBrokerUI.dll
2019-07-09 19:24 - 2019-06-13 08:10 - 002912256 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuaueng.dll
2019-07-09 19:24 - 2019-06-13 08:10 - 001400832 _____ (Microsoft Corporation) C:\WINDOWS\system32\TokenBroker.dll
2019-07-09 19:24 - 2019-06-13 08:10 - 001215488 _____ (Microsoft Corporation) C:\WINDOWS\system32\NotificationController.dll
2019-07-09 19:24 - 2019-06-13 08:10 - 000871424 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.BackgroundMediaPlayback.dll
2019-07-09 19:24 - 2019-06-13 08:10 - 000869376 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.Playback.BackgroundMediaPlayer.dll
2019-07-09 19:24 - 2019-06-13 08:10 - 000849408 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.Playback.MediaPlayer.dll
2019-07-09 19:24 - 2019-06-13 08:10 - 000523776 _____ (Microsoft Corporation) C:\WINDOWS\system32\dmenrollengine.dll
2019-07-09 19:24 - 2019-06-13 08:09 - 001854976 _____ (Microsoft Corporation) C:\WINDOWS\system32\wevtsvc.dll
2019-07-09 19:24 - 2019-06-13 08:09 - 000922112 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Security.Authentication.Web.Core.dll
2019-07-09 19:24 - 2019-06-13 08:09 - 000755712 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Core.TextInput.dll
2019-07-09 19:24 - 2019-06-13 08:08 - 000506368 _____ (Microsoft Corporation) C:\WINDOWS\system32\edgeIso.dll
2019-07-09 19:24 - 2019-06-13 07:08 - 000443632 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\policymanager.dll
2019-07-09 19:24 - 2019-06-13 07:07 - 000101192 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rmclient.dll
2019-07-09 19:24 - 2019-06-13 07:07 - 000080744 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wldp.dll
2019-07-09 19:24 - 2019-06-13 07:06 - 001130776 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msvproc.dll
2019-07-09 19:24 - 2019-06-13 07:06 - 000581600 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MSVideoDSP.dll
2019-07-09 19:24 - 2019-06-13 06:49 - 000172544 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\enrollmentapi.dll
2019-07-09 19:24 - 2019-06-13 06:47 - 003554304 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\InputService.dll
2019-07-09 19:24 - 2019-06-13 06:47 - 002899456 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dwmcore.dll
2019-07-09 19:24 - 2019-06-13 06:47 - 000450048 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rastls.dll
2019-07-09 19:24 - 2019-06-13 06:46 - 000608768 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\EdgeManager.dll
2019-07-09 19:24 - 2019-06-13 06:46 - 000331776 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\edgeIso.dll
2019-07-09 19:24 - 2019-06-13 06:46 - 000038400 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TokenBrokerUI.dll
2019-07-09 19:24 - 2019-06-13 06:45 - 000602112 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\nshwfp.dll
2019-07-09 19:24 - 2019-06-13 06:45 - 000578560 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\webplatstorageserver.dll
2019-07-09 19:24 - 2019-06-13 06:44 - 001003008 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TokenBroker.dll
2019-07-09 19:24 - 2019-06-13 06:44 - 000648192 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.BackgroundMediaPlayback.dll
2019-07-09 19:24 - 2019-06-13 06:44 - 000630784 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.Playback.MediaPlayer.dll
2019-07-09 19:24 - 2019-06-13 06:44 - 000582144 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Core.TextInput.dll
2019-07-09 19:24 - 2019-06-13 06:44 - 000251904 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msIso.dll
2019-07-09 19:24 - 2019-06-13 06:43 - 000681472 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Security.Authentication.Web.Core.dll
2019-07-09 19:24 - 2019-06-13 06:43 - 000646656 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.Playback.BackgroundMediaPlayer.dll
2019-07-09 19:24 - 2019-06-13 06:43 - 000445952 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dmenrollengine.dll
2019-07-07 17:59 - 2019-07-07 18:10 - 234299675 _____ C:\Users\Lubka\Desktop\Tajemství (The secret).mp4
2019-07-06 12:14 - 2019-07-06 12:02 - 000543307 _____ C:\Users\Lubka\Desktop\banda_zlodejov_1.pdf

==================== One month (modified) ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2019-07-31 20:27 - 2018-12-20 22:18 - 000000000 ____D C:\Users\Jozko\AppData\LocalLow\Mozilla
2019-07-31 20:27 - 2018-12-20 22:11 - 000000000 __SHD C:\Users\Jozko\IntelGraphicsProfiles
2019-07-31 20:26 - 2018-12-14 18:56 - 000000006 ____H C:\WINDOWS\Tasks\SA.DAT
2019-07-31 20:21 - 2018-12-20 22:22 - 000000000 ____D C:\Users\Jozko\Desktop\Alte Firefox-Daten
2019-07-31 20:19 - 2018-12-20 22:11 - 000000000 ____D C:\Users\Jozko\AppData\Local\Packages
2019-07-31 20:19 - 2018-04-12 01:38 - 000000000 ____D C:\WINDOWS\AppReadiness
2019-07-31 20:18 - 2018-12-20 22:09 - 000730418 _____ C:\WINDOWS\system32\perfh007.dat
2019-07-31 20:18 - 2018-12-20 22:09 - 000149068 _____ C:\WINDOWS\system32\perfc007.dat
2019-07-31 20:18 - 2018-12-20 22:09 - 000116006 _____ C:\WINDOWS\system32\perfh01B.dat
2019-07-31 20:18 - 2018-12-20 22:09 - 000023440 _____ C:\WINDOWS\system32\perfc01B.dat
2019-07-31 20:18 - 2018-12-14 09:55 - 001841978 _____ C:\WINDOWS\system32\PerfStringBackup.INI
2019-07-31 20:18 - 2018-04-12 01:38 - 000000000 ____D C:\ProgramData\regid.1991-06.com.microsoft
2019-07-31 20:18 - 2018-04-12 01:36 - 000000000 ____D C:\WINDOWS\INF
2019-07-31 20:01 - 2019-05-02 21:25 - 000000000 ____D C:\Users\Jozko\AppData\LocalLow\Temp
2019-07-31 19:11 - 2018-12-20 22:11 - 000000000 ____D C:\Users\Jozko
2019-07-31 19:08 - 2018-12-14 18:59 - 000000000 __SHD C:\Users\Lubka\IntelGraphicsProfiles
2019-07-30 22:27 - 2018-12-20 21:40 - 000000000 ____D C:\Users\Lubka\AppData\LocalLow\Mozilla
2019-07-30 21:23 - 2018-12-14 18:53 - 000000000 ____D C:\WINDOWS\system32\SleepStudy
2019-07-30 21:17 - 2018-12-14 18:54 - 000000000 ____D C:\Users\Lubka
2019-07-30 21:05 - 2018-12-20 21:44 - 000000000 ____D C:\Users\Lubka\Desktop\Faktury-International-House
2019-07-30 20:43 - 2018-12-20 22:22 - 000000000 ____D C:\Users\Jozko\Documents\Korespondencia
2019-07-30 19:59 - 2018-04-12 01:38 - 000000000 ___HD C:\Program Files\WindowsApps
2019-07-27 14:11 - 2018-12-14 18:56 - 000000000 ____D C:\WINDOWS\system32\Drivers\wd
2019-07-27 14:10 - 2018-12-14 11:22 - 000000000 ____D C:\ProgramData\Package Cache
2019-07-27 14:10 - 2018-12-14 11:22 - 000000000 ____D C:\Program Files (x86)\Intel
2019-07-25 03:25 - 2018-04-12 01:38 - 000000000 ____D C:\WINDOWS\InfusedApps.tmp
2019-07-25 02:42 - 2018-04-12 01:38 - 000000000 ____D C:\WINDOWS\InfusedApps
2019-07-25 02:38 - 2018-04-12 01:38 - 000000000 ____D C:\WINDOWS\registration
2019-07-25 01:38 - 2018-12-17 09:13 - 000000000 ____D C:\Users\Lubka\AppData\Local\D3DSCache
2019-07-25 01:01 - 2018-12-20 21:40 - 000000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2019-07-25 00:58 - 2018-04-12 01:38 - 000000000 ____D C:\WINDOWS\system32\NDF
2019-07-25 00:55 - 2019-01-05 16:50 - 000000000 ____D C:\Users\Lubka\AppData\Local\ElevatedDiagnostics
2019-07-25 00:40 - 2015-10-30 09:24 - 000000000 ___HD C:\WINDOWS\system32\GroupPolicy
2019-07-24 23:06 - 2018-12-20 21:40 - 000001005 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Firefox.lnk
2019-07-24 22:59 - 2018-12-14 09:57 - 000000000 ____D C:\Users\Lubka\AppData\Local\VirtualStore
2019-07-24 21:16 - 2018-04-12 01:33 - 000466432 _____ (Microsoft Corporation) C:\WINDOWS\system32\dpnet.dll
2019-07-24 21:16 - 2018-04-12 01:33 - 000390656 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dpnet.dll
2019-07-24 21:16 - 2018-04-12 01:33 - 000218112 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dplayx.dll
2019-07-24 21:16 - 2018-04-12 01:33 - 000067584 _____ (Microsoft Corporation) C:\WINDOWS\system32\dpnathlp.dll
2019-07-24 21:16 - 2018-04-12 01:33 - 000061440 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dpnathlp.dll
2019-07-24 21:16 - 2018-04-12 01:33 - 000046592 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dpwsockx.dll
2019-07-24 21:16 - 2018-04-12 01:33 - 000026624 _____ (Microsoft Corporation) C:\WINDOWS\system32\dpnsvr.exe
2019-07-24 21:16 - 2018-04-12 01:33 - 000024064 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dpmodemx.dll
2019-07-24 21:16 - 2018-04-12 01:33 - 000023040 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dpnsvr.exe
2019-07-24 21:16 - 2018-04-12 01:33 - 000020480 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dplaysvr.exe
2019-07-24 21:16 - 2018-04-12 01:33 - 000010240 _____ (Microsoft Corporation) C:\WINDOWS\system32\dpnhupnp.dll
2019-07-24 21:16 - 2018-04-12 01:33 - 000010240 _____ (Microsoft Corporation) C:\WINDOWS\system32\dpnhpast.dll
2019-07-24 21:16 - 2018-04-12 01:33 - 000008704 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dpnhupnp.dll
2019-07-24 21:16 - 2018-04-12 01:33 - 000008704 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dpnhpast.dll
2019-07-24 21:16 - 2018-04-12 01:33 - 000006144 _____ (Microsoft Corporation) C:\WINDOWS\system32\dpnlobby.dll
2019-07-24 21:16 - 2018-04-12 01:33 - 000006144 _____ (Microsoft Corporation) C:\WINDOWS\system32\dpnaddr.dll
2019-07-24 21:16 - 2018-04-12 01:33 - 000005120 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dpnlobby.dll
2019-07-24 21:16 - 2018-04-12 01:33 - 000005120 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dpnaddr.dll
2019-07-24 21:16 - 2018-04-12 01:30 - 000000000 ____D C:\WINDOWS\CbsTemp
2019-07-17 14:09 - 2018-12-14 09:57 - 000000000 ____D C:\Users\Lubka\AppData\Local\Packages
2019-07-17 08:32 - 2018-12-14 11:11 - 000002313 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2019-07-17 08:32 - 2018-12-14 11:11 - 000002272 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2019-07-16 09:29 - 2018-12-20 21:44 - 000000000 ____D C:\Users\Lubka\Desktop\Meditacie
2019-07-16 08:14 - 2018-12-20 21:48 - 000000000 ____D C:\Users\Lubka\Documents\Ostatné
2019-07-13 17:03 - 2018-12-27 12:39 - 000000000 ____D C:\Users\Jozko\AppData\Local\Adobe
2019-07-13 17:03 - 2018-04-12 01:38 - 000000000 ____D C:\WINDOWS\SysWOW64\Macromed
2019-07-13 17:03 - 2018-04-12 01:38 - 000000000 ____D C:\WINDOWS\system32\Macromed
2019-07-13 17:02 - 2018-12-14 11:09 - 000000000 ____D C:\Users\Lubka\AppData\Local\Adobe
2019-07-13 16:47 - 2019-06-30 12:12 - 000000000 ____D C:\Users\Jozko\AppData\Roaming\InstallShield Installation Information
2019-07-13 14:43 - 2019-06-30 12:12 - 000000653 _____ C:\Users\Jozko\Desktop\Ip Camera Client.lnk
2019-07-13 13:57 - 2018-12-20 22:12 - 000000000 ___RD C:\Users\Jozko\OneDrive
2019-07-13 13:57 - 2018-12-20 22:11 - 000002383 _____ C:\Users\Jozko\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OneDrive.lnk
2019-07-13 13:56 - 2018-12-20 22:11 - 000000000 ___RD C:\Users\Jozko\3D Objects
2019-07-13 13:56 - 2018-12-14 09:57 - 000000000 __RHD C:\Users\Public\AccountPictures
2019-07-10 22:06 - 2018-12-14 10:50 - 000741432 ____N (Microsoft Corporation) C:\WINDOWS\system32\MpSigStub.exe
2019-07-09 21:11 - 2018-12-14 18:56 - 000000000 ___RD C:\Users\Lubka\3D Objects
2019-07-09 21:10 - 2018-12-14 18:53 - 000399520 _____ C:\WINDOWS\system32\FNTCACHE.DAT
2019-07-09 21:10 - 2018-04-12 19:08 - 000000000 ____D C:\Program Files\Windows Defender Advanced Threat Protection
2019-07-09 21:10 - 2018-04-12 01:38 - 000000000 ____D C:\WINDOWS\TextInput
2019-07-09 21:10 - 2018-04-12 01:38 - 000000000 ____D C:\WINDOWS\SysWOW64\oobe
2019-07-09 21:10 - 2018-04-12 01:38 - 000000000 ____D C:\WINDOWS\SysWOW64\Dism
2019-07-09 21:10 - 2018-04-12 01:38 - 000000000 ____D C:\WINDOWS\system32\oobe
2019-07-09 21:10 - 2018-04-12 01:38 - 000000000 ____D C:\WINDOWS\system32\appraiser
2019-07-09 21:10 - 2018-04-12 01:38 - 000000000 ____D C:\WINDOWS\ShellComponents
2019-07-09 21:10 - 2018-04-12 01:38 - 000000000 ____D C:\WINDOWS\Provisioning
2019-07-09 21:10 - 2018-04-12 01:38 - 000000000 ____D C:\WINDOWS\bcastdvr
2019-07-09 21:10 - 2018-04-11 23:04 - 000000000 ____D C:\WINDOWS\system32\Dism
2019-07-09 19:24 - 2018-12-14 10:49 - 000000000 ____D C:\WINDOWS\system32\MRT
2019-07-09 19:21 - 2018-12-14 10:49 - 136618864 ____C (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2019-07-09 15:31 - 2018-12-14 18:54 - 000002383 _____ C:\Users\Lubka\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OneDrive.lnk
2019-07-09 15:31 - 2018-12-14 09:59 - 000000000 ___RD C:\Users\Lubka\OneDrive
2019-07-02 16:55 - 2018-12-20 21:48 - 000000000 ____D C:\Users\Lubka\Documents\materialy na vyuku

==================== FLock ================

2019-07-30 20:27 C:\Config.Msi
2018-12-14 10:38 C:\MSOCache
2018-04-12 01:38 C:\PerfLogs
2019-07-30 19:59 C:\Program Files\WindowsApps
2018-12-14 18:56 C:\WINDOWS\diagerr.xml
2018-12-14 18:56 C:\WINDOWS\diagwrn.xml
2019-07-25 02:42 C:\WINDOWS\InfusedApps
2019-07-25 03:25 C:\WINDOWS\InfusedApps.tmp
2019-04-28 19:38 C:\WINDOWS\LiveKernelReports
2018-04-12 01:38 C:\WINDOWS\ModemLogs
2019-07-31 20:27 C:\WINDOWS\Prefetch
2018-04-12 01:38 C:\WINDOWS\ServiceState
2019-07-31 20:27 C:\WINDOWS\Temp
2019-07-30 20:03 C:\WINDOWS\system32\config
2018-04-12 01:38 C:\WINDOWS\system32\Configuration
2018-04-12 01:38 C:\WINDOWS\system32\DriverState
2018-12-20 22:27 C:\WINDOWS\system32\FxsTmp
2018-04-12 01:38 C:\WINDOWS\system32\ias
2018-04-12 01:38 C:\WINDOWS\system32\MsDtc
2018-04-12 01:38 C:\WINDOWS\system32\networklist
2019-07-30 21:23 C:\WINDOWS\system32\SleepStudy
2019-07-31 20:26 C:\WINDOWS\system32\sru
2019-07-31 20:07 C:\WINDOWS\system32\Tasks
2018-12-14 18:52 C:\WINDOWS\system32\Tasks_Migrated
2018-12-20 22:11 C:\WINDOWS\system32\WDI
2018-04-12 01:38 C:\WINDOWS\SysWOW64\config
2018-04-12 01:38 C:\WINDOWS\SysWOW64\Configuration
2018-04-12 01:38 C:\WINDOWS\SysWOW64\FxsTmp
2018-04-12 01:38 C:\WINDOWS\SysWOW64\Msdtc
2018-04-12 01:38 C:\WINDOWS\SysWOW64\networklist
2018-04-12 01:38 C:\WINDOWS\SysWOW64\sru
2018-04-12 01:38 C:\WINDOWS\SysWOW64\Tasks
2018-04-12 01:38 C:\WINDOWS\system32\Drivers\DriverData
2019-07-31 19:11 C:\WINDOWS\Tasks\oncIfaVdQabfxqj.job
2019-02-09 11:51 C:\ProgramData\Packages
2018-12-14 18:56 C:\ProgramData\USOPrivate
2018-04-12 19:08 C:\ProgramData\WindowsHolographicDevices
2019-07-25 00:58 C:\Users\Lubka\AppData\Local\Diagnostics
2019-07-25 00:55 C:\Users\Lubka\AppData\Local\ElevatedDiagnostics

==================== SigCheck ===============================

(There is no automatic fix for files that do not pass verification.)



ATTENTION: ==> Could not access BCD. The user is not administrator -> Der Speicher f?r die Startkonfigurationsdaten konnte nicht ge?ffnet werden.
Zugriff verweigert

==================== End of FRST.txt ============================
         

--- --- ---

--- --- ---

--- --- ---


[CODE]Additional
FRST Logfile:

FRST Logfile:

FRST Logfile:

scan result of Farbar Recovery Scan Tool (x64) Version: 31-07-2019
Ran by Jozko (31-07-2019 20:28:42)
Running from C:\Users\Jozko\Desktop
Windows 10 Pro Version 1803 17134.885 (X64) (2018-12-14 16:56:48)
Boot Mode: Normal
==========================================================


==================== Accounts: =============================

Administrator (S-1-5-21-1960842775-2088100534-3542962694-500 - Administrator - Disabled)
DefaultAccount (S-1-5-21-1960842775-2088100534-3542962694-503 - Limited - Disabled)
Guest (S-1-5-21-1960842775-2088100534-3542962694-501 - Limited - Disabled)
Jozko (S-1-5-21-1960842775-2088100534-3542962694-1002 - Limited - Enabled) => C:\Users\Jozko
Lubka (S-1-5-21-1960842775-2088100534-3542962694-1001 - Administrator - Enabled) => C:\Users\Lubka
WDAGUtilityAccount (S-1-5-21-1960842775-2088100534-3542962694-504 - Limited - Disabled)

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

Adobe Acrobat Reader DC - Slovak (HKLM-x32\...\{AC76BA86-7AD7-1051-7B44-AC0F074E4100}) (Version: 19.012.20035 - Adobe Systems Incorporated)
Adobe Flash Player 32 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 32.0.0.223 - Adobe)
Age of Empires complete version 1.0c (HKLM-x32\...\{F7F0D70E-9027-4DF5-B67F-4B48CE29565A}_is1) (Version: 1.0c - vol1)
Balík softvéru eID (HKLM-x32\...\{69aff1f0-e530-4ac2-ab4f-88cb85aef940}) (Version: 1.0.0.0 - Ministerstvo vnútra Slovenskej republiky) Hidden
Balík softvéru eID (HKLM-x32\...\{d0db994b-7bbf-4a97-86ae-8e47ef7363e5}) (Version: 1.0.0.0 - Ministerstvo vnútra Slovenskej republiky) Hidden
Bit4id - miniLector (HKLM-x32\...\Bit4id - miniLector) (Version: 3.7 - Bit4id)
D.Launcher (x86) (HKLM-x32\...\{8A22CEA0-9DB7-4E30-898A-6D70F4E650CE}) (Version: 1.1.0.0 - DITEC, a.s.)
D.Signer/XAdES .NET so zásuvnými modulmi (x86) (HKLM-x32\...\{EB7D7F94-A539-4248-BCA3-2B105845284C}) (Version: 4.0.13 - DITEC, a.s.)
D.Signer/XAdES .NET Tools (x86) (HKLM-x32\...\{26E941A2-1EFF-4A3F-AD0B-6A423EFC2AAA}) (Version: 4.0.9 - DITEC, a.s.)
D.Suite/eIDAS (x86) (HKLM-x32\...\{f6fbc4ed-b1f8-4f4c-9b23-5b8e64af50b4}) (Version: 1.0.15 - DITEC, a.s.)
D.Viewer .NET (x86) (HKLM-x32\...\{967D2DE1-4E53-4700-9ED4-E4BCCD27E8F9}) (Version: 4.0.2025 - DITEC, a.s.)
Disig Web Signer 1.0.7 (HKLM-x32\...\{DD3FDF40-D8A3-454D-8A43-B53F90FB1ED7}) (Version: 1.1.8 - Disig)
DiskProtect18891 version 16.91 (HKLM-x32\...\{06B8AD54-D556-4771-A39B-A04135966F15}_is1) (Version: 16.91 - )
EAC MW klient (HKLM-x32\...\{3C1EB559-A939-4569-8EDE-006675312B46}) (Version: 3.1.3 - Ministerstvo vnútra Slovenskej republiky)
EPSON BX535WD Series Printer Uninstall (HKLM\...\EPSON BX535WD Series) (Version:  - SEIKO EPSON Corporation)
EPSON Scan (HKLM-x32\...\EPSON Scanner) (Version:  - Seiko Epson Corporation)
EpsonNet Print (HKLM-x32\...\{3E31400D-274E-4647-916C-2CACC3741799}) (Version: 2.6.0 - SEIKO EPSON CORPORATION)
GemPcCCID (HKLM\...\{39417D48-AC92-47A7-9F53-3CA2049231B0}) (Version: 2.0.7 - Gemalto)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 75.0.3770.142 - Google LLC)
Google Earth Pro (HKLM\...\{70A0F34E-564B-4F93-ADD6-3BAEC6E44075}) (Version: 7.3.2.5776 - Google)
Google Update Helper (HKLM-x32\...\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}) (Version: 1.3.34.11 - Google LLC) Hidden
HiPlayer (HKU\S-1-5-21-1960842775-2088100534-3542962694-1002\...\{1AE35ED9-955E-40D0-8811-FFD8F0E2A9F3}) (Version: 1.2 - Hi)
Intel Driver && Support Assistant (HKLM-x32\...\{CF18558A-3642-4C4D-A551-23275D1FCE16}) (Version: 19.7.30.2 - Intel) Hidden
Intel(R) Computing Improvement Program (HKLM\...\{D40D4164-EEDB-4F0F-85C6-2058A9E34CC7}) (Version: 2.4.04370 - Intel Corporation)
Intel(R) Management Engine Components (HKLM\...\{1CEAC85D-2590-4760-800F-8DE5E91F3700}) (Version: 1831.12.0.1156 - Intel Corporation)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 24.20.100.6291 - Intel Corporation)
Intel(R) Trusted Connect Service Client x86 (HKLM-x32\...\{C9552825-7BF2-4344-BA91-D3CD46F4C441}) (Version: 1.50.369.0 - Intel Corporation) Hidden
Intel(R) Trusted Connect Services Client (HKLM-x32\...\{aa81bdf2-96a6-4400-a596-c7d1916ce9f7}) (Version: 1.50.369.0 - Intel Corporation) Hidden
Intel® Chipset Device Software (HKLM-x32\...\{262e9c1d-e509-4e2a-86e8-0abb312ac2e9}) (Version: 10.1.17765.8094 - Intel(R) Corporation) Hidden
Intel® Driver & Support Assistant (HKLM-x32\...\{12d2d1d9-5223-431d-96ac-6a82d3a1391c}) (Version: 19.7.30.2 - Intel)
Intel® Driver & Support Assistant (HKLM-x32\...\{dbe96554-7594-4bba-b7c5-fc6c72dbaa39}) (Version: 19.6.26.3 - Intel)
IP Camera (HKU\S-1-5-21-1960842775-2088100534-3542962694-1002\...\{3E6DEA84-3FA0-472E-B0DB-927655097022}) (Version: 2.0.4.6 - hi)
Java 8 Update 211 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F64180211F0}) (Version: 8.0.2110.12 - Oracle Corporation)
K-Lite Mega Codec Pack 14.5.5 (HKLM-x32\...\KLiteCodecPack_is1) (Version: 14.5.5 - KLCP)
Malwarebytes Version 3.8.3.2965 (HKLM\...\{35065F43-4BB2-439A-BFF7-0F1014F2E0CD}_is1) (Version: 3.8.3.2965 - Malwarebytes)
Microsoft Office 2016 Professional Plus (HKLM-x32\...\Office16.PROPLUS) (Version: 16.0.4266.1001 - Microsoft Corporation)
Microsoft OneDrive (HKU\S-1-5-21-1960842775-2088100534-3542962694-1002\...\OneDriveSetup.exe) (Version: 19.103.0527.0003 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.30319 (HKLM\...\{DA5E371C-6333-3D8A-93A4-6FD5B20BCC6E}) (Version: 10.0.30319 - Microsoft Corporation)
Microsoft Visual C++ 2015 Redistributable (x64) - 14.0.23026 (HKLM-x32\...\{e46eca4f-393b-40df-9f49-076faf788d83}) (Version: 14.0.23026.0 - Microsoft Corporation)
Microsoft Visual C++ 2015 Redistributable (x86) - 14.0.23026 (HKLM-x32\...\{74d0e5db-b326-4dae-a6b2-445b9de1836e}) (Version: 14.0.23026.0 - Microsoft Corporation)
Mozilla Firefox 68.0.1 (x64 de) (HKLM\...\Mozilla Firefox 68.0.1 (x64 de)) (Version: 68.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 64.0 - Mozilla)
Nástroje kontroly pravopisu pro Microsoft Office 2016 – čeština (HKLM-x32\...\{90160000-001F-0405-0000-0000000FF1CE}) (Version: 16.0.4266.1001 - Microsoft Corporation) Hidden
Nástroje korektúry balíka Microsoft Office 2016 - slovenčina (HKLM-x32\...\{90160000-001F-041B-0000-0000000FF1CE}) (Version: 16.0.4266.1001 - Microsoft Corporation) Hidden
OLYMPUS CAMEDIA Master 4.1 (HKLM-x32\...\{30BB4D60-81DB-11D5-BB77-00400536ABAC}) (Version:  - )
QuickTime (HKLM-x32\...\QuickTime) (Version:  - )
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 10.31.828.2018 - Realtek)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.8581 - Realtek Semiconductor Corp.)
SPORE Collection (HKLM-x32\...\SPORE Collection_is1) (Version:  - )
SSC Service Utility v4.30 (HKLM-x32\...\SSC Service Utility_is1) (Version:  - SSC Localization Group)
Steam (HKLM-x32\...\Steam) (Version: 2.10.91.91 - Valve Corporation)
TAP-Windows 9.21.2 (HKLM\...\TAP-Windows) (Version: 9.21.2 - )
TextPad (HKLM-x32\...\{ADBBED4F-720B-460D-AA14-D85EBC4AEF97}) (Version:  - )
Update for Windows 10 for x64-based Systems (KB4023057) (HKLM\...\{F14FB68A-9188-4036-AD0D-D054BC9C9291}) (Version: 2.59.0.0 - Microsoft Corporation)
UpdateAssistant (HKLM\...\{EC4F72E8-52FE-454E-B70F-DBE5C0FA44C5}) (Version: 1.20.0.0 - Microsoft Corporation) Hidden
web control version 3.0.6.7 (HKLM-x32\...\{F88ED86C-0010-4943-BA16-72E4184E31ED}_is1) (Version: 3.0.6.7 - )
WinRAR 5.71 (32-bit) (HKLM-x32\...\WinRAR archiver) (Version: 5.71.0 - win.rar GmbH)

Packages:
=========
Candy Crush Saga -> C:\Program Files\WindowsApps\king.com.CandyCrushSaga_1.1550.4.0_x86__kgqvnymyfvs32 [0000-00-00] (king.com)
Community Showcase Rural Landscapes 2 -> C:\Program Files\WindowsApps\Microsoft.CommunityShowcaseRuralLandscapes2_1.0.0.0_neutral__8wekyb3d8bbwe [0000-00-00] (Microsoft Corporation)
Dolby Access -> C:\Program Files\WindowsApps\DolbyLaboratories.DolbyAccess_2.4.520.0_x64__rz1tebttyb220 [0000-00-00] (Dolby Laboratories)
Fitbit Coach -> C:\Program Files\WindowsApps\Fitbit.FitbitCoach_4.4.133.0_x64__6mqt6hf9g46tw [0000-00-00] (Fitbit)
Mail und Kalender -> C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe [0000-00-00] (Microsoft Corporation) [MS Ad]
Microsoft Advertising SDK for XAML -> C:\Program Files\WindowsApps\Microsoft.Advertising.Xaml_10.1811.1.0_x64__8wekyb3d8bbwe [0000-00-00] (Microsoft Corporation) [MS Ad]
Microsoft Advertising SDK for XAML -> C:\Program Files\WindowsApps\Microsoft.Advertising.Xaml_10.1811.1.0_x86__8wekyb3d8bbwe [0000-00-00] (Microsoft Corporation) [MS Ad]
Microsoft Begleiter für Telefon -> C:\Program Files\WindowsApps\Microsoft.WindowsPhone_10.1802.311.0_x64__8wekyb3d8bbwe [0000-00-00] (Microsoft Corporation)
Microsoft Solitaire Collection -> C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.6132.0_x64__8wekyb3d8bbwe [0000-00-00] (Microsoft Studios) [MS Ad]
Microsoft-Telefon -> C:\Program Files\WindowsApps\Microsoft.CommsPhone_3.43.20002.1000_x64__8wekyb3d8bbwe [0000-00-00] (Microsoft Corporation)
Netflix -> C:\Program Files\WindowsApps\4DF9E0F8.Netflix_6.93.478.0_x64__mcm4njqhnhss8 [0000-00-00] (Netflix, Inc.)
Phototastic Collage -> C:\Program Files\WindowsApps\ThumbmunkeysLtd.PhototasticCollage_2.2.9.0_x64__nfy108tqq3p12 [0000-00-00] (Thumbmunkeys Ltd) [MS Ad]

==================== Custom CLSID (Whitelisted): ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

CustomCLSID: HKU\S-1-5-21-1960842775-2088100534-3542962694-1002_Classes\CLSID\{233525e0-5434-46ef-b464-fd7e45e2e145}\localserver32 -> C:\Program Files (x86)\Intel\Driver and Support Assistant\DSATray.exe (IDSA Production signing key -> Intel)
ContextMenuHandlers1-x32: [TextPad] -> {2F25CF20-C569-11D1-B94C-00608CB45480} => C:\Program Files (x86)\TextPad 4\System\shellext.dll [2001-07-21] (Helios Software Solutions) [File not signed]
ContextMenuHandlers1: [WinRAR] -> {B41DB860-64E4-11D2-9906-E49FADC173CA} => C:\Program Files (x86)\WinRAR\rarext64.dll [2019-04-27] (win.rar GmbH -> Alexander Roshal)
ContextMenuHandlers1-x32: [WinRAR32] -> {B41DB860-8EE4-11D2-9906-E49FADC173CA} => C:\Program Files (x86)\WinRAR\rarext.dll [2019-04-27] (win.rar GmbH -> Alexander Roshal)
ContextMenuHandlers3: [MBAMShlExt] -> {57CE581A-0CB6-4266-9CA0-19364C90A0B3} => C:\Program Files\Malwarebytes\Anti-Malware\mbshlext.dll [2019-06-26] (Malwarebytes Corporation -> Malwarebytes)
ContextMenuHandlers5: [igfxcui] -> {3AB1675A-CCFF-11D2-8B20-00A0C93CB1F4} =>  -> No File
ContextMenuHandlers5: [igfxDTCM] -> {9B5F5829-A529-4B12-814A-E81BCB8D93FC} => C:\WINDOWS\System32\DriverStore\FileRepository\cui_dc_comp.inf_amd64_1c77f1231c19bc72\igfxDTCM.dll [2018-11-02] (Microsoft Windows Hardware Compatibility Publisher -> Intel Corporation)
ContextMenuHandlers6: [MBAMShlExt] -> {57CE581A-0CB6-4266-9CA0-19364C90A0B3} => C:\Program Files\Malwarebytes\Anti-Malware\mbshlext.dll [2019-06-26] (Malwarebytes Corporation -> Malwarebytes)
ContextMenuHandlers6: [WinRAR] -> {B41DB860-64E4-11D2-9906-E49FADC173CA} => C:\Program Files (x86)\WinRAR\rarext64.dll [2019-04-27] (win.rar GmbH -> Alexander Roshal)
ContextMenuHandlers6-x32: [WinRAR32] -> {B41DB860-8EE4-11D2-9906-E49FADC173CA} => C:\Program Files (x86)\WinRAR\rarext.dll [2019-04-27] (win.rar GmbH -> Alexander Roshal)

==================== Shortcuts & WMI ========================

(The entries could be listed to be restored or removed.)


Shortcut: C:\Users\Public\Desktop\Age of Empires - The Rise of Rome color fix.lnk -> C:\Program Files (x86)\Age of Empires complete\EMPIRESX.bat ()
Shortcut: C:\Users\Public\Desktop\Age of Empires color fix.lnk -> C:\Program Files (x86)\Age of Empires complete\Empires.bat ()

==================== Loaded Modules (Whitelisted) ==============


==================== Alternate Data Streams (Whitelisted) =========

(If an entry is included in the fixlist, only the ADS will be removed.)


==================== Safe Mode (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MBAMService => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MBAMService => ""="Service"

==================== Association (Whitelisted) ===============

(If an entry is included in the fixlist, the registry item will be restored to default or removed.)


==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, it will be removed from the registry.)


==================== Hosts content: ===============================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2015-10-30 09:24 - 2015-10-30 09:21 - 000000824 _____ C:\WINDOWS\system32\drivers\etc\hosts


==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKLM\System\CurrentControlSet\Control\Session Manager\Environment\\Path -> C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\iCLS\;C:\Program Files\Intel\Intel(R) Management Engine Components\iCLS\;%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem;%SYSTEMROOT%\System32\WindowsPowerShell\v1.0\;C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL;C:\Program Files\Intel\Intel(R) Management Engine Components\DAL;%SYSTEMROOT%\System32\OpenSSH\;C:\Program Files (x86)\EAC MW klient\
HKU\S-1-5-21-1960842775-2088100534-3542962694-1002\Control Panel\Desktop\\Wallpaper -> C:\Users\Jozko\Pictures\Saved Pictures\19713_en_1.jfif
DNS Servers: 45.114.8.167
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer => (SmartScreenEnabled: RequireAdmin)
Windows Firewall is enabled.

==================== MSCONFIG/TASK MANAGER disabled items ==

If an entry is included in the fixlist, it will be removed.


==================== FirewallRules (Whitelisted) ===============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

FirewallRules: [{B0E0FCA4-E614-4841-8309-C5F1BC992B51}] => (Allow) C:\Program Files (x86)\Microsoft Office\Office16\UcMapi.exe (Microsoft Corporation -> Microsoft Corporation)
FirewallRules: [{E81EFC83-D7E8-41B1-85B6-19888644E1E6}] => (Allow) C:\Program Files (x86)\Microsoft Office\Office16\UcMapi.exe (Microsoft Corporation -> Microsoft Corporation)
FirewallRules: [{E781CF56-E8E1-4EB4-B09B-782FBB63E18A}] => (Allow) C:\Program Files (x86)\Microsoft Office\Office16\lync.exe (Microsoft Corporation -> Microsoft Corporation)
FirewallRules: [{1DEEC0BE-795F-49B4-85E4-B6C781A1B559}] => (Allow) C:\Program Files (x86)\Microsoft Office\Office16\lync.exe (Microsoft Corporation -> Microsoft Corporation)
FirewallRules: [{60E1953A-3975-48CB-9A95-12682EFBE5D0}] => (Allow) C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation -> Mozilla Corporation)
FirewallRules: [{4816A673-EFC6-4880-99BC-B05F3ED27E4A}] => (Allow) C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation -> Mozilla Corporation)
FirewallRules: [{86774ECB-609F-4B3E-ACFD-1BCF4111C667}] => (Block) C:\Program Files\Intel\SUR\QUEENCREEK\x64\esrv_svc.exe (Intel(R) Software Development Products -> )
FirewallRules: [{18BE39E4-9E5E-40B2-B56E-5C1DDA55CAE0}] => (Block) C:\Program Files\Intel\SUR\QUEENCREEK\x64\esrv_svc.exe (Intel(R) Software Development Products -> )
FirewallRules: [{B3EFC748-8BD3-413E-AAC8-551A7185B62F}] => (Allow) C:\Program Files\Intel\SUR\QUEENCREEK\x64\esrv_svc.exe (Intel(R) Software Development Products -> )
FirewallRules: [{449640A9-F72F-4A5C-9FB5-5FF7FAC5DB86}] => (Allow) C:\Program Files\Intel\SUR\QUEENCREEK\x64\esrv_svc.exe (Intel(R) Software Development Products -> )
FirewallRules: [TCP Query User{BE188FCC-BD5A-4406-AF77-6E1575D282BA}D:\ip camera\ipcamclient.exe] => (Allow) D:\ip camera\ipcamclient.exe () [File not signed]
FirewallRules: [UDP Query User{87AB65A8-DC41-49DF-B57F-C796F685A96B}D:\ip camera\ipcamclient.exe] => (Allow) D:\ip camera\ipcamclient.exe () [File not signed]
FirewallRules: [TCP Query User{433C421E-E6C0-4F39-8F70-EA904602A480}D:\ip camera\ipcamclient.exe] => (Allow) D:\ip camera\ipcamclient.exe () [File not signed]
FirewallRules: [UDP Query User{2B31D666-8D5D-449D-8AA7-3DCF77632F23}D:\ip camera\ipcamclient.exe] => (Allow) D:\ip camera\ipcamclient.exe () [File not signed]
FirewallRules: [{65A9DD2E-E62F-4267-B4E4-B712B1AC688F}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google LLC -> Google LLC)
FirewallRules: [{1F633D9D-6AA0-434D-A28E-B5500A3D4D8C}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe No File
FirewallRules: [{BBBC5C50-BBD7-4106-BE83-EFC23C2771E5}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe No File
FirewallRules: [{D65400ED-A8D5-459E-976C-7BC8F2F5E71E}] => (Allow) C:\Program Files (x86)\Steam\bin\cef\cef.win7\steamwebhelper.exe No File
FirewallRules: [{FFBF8443-24B3-4587-9B82-60FB3B416CC7}] => (Allow) C:\Program Files (x86)\Steam\bin\cef\cef.win7\steamwebhelper.exe No File
FirewallRules: [{43411155-27FD-4ABD-BD18-07243101A890}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Grand Theft Auto San Andreas\gta-sa.exe No File
FirewallRules: [{7A805869-E319-453B-9A2B-CC4A789B86B2}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Grand Theft Auto San Andreas\gta-sa.exe No File

==================== Restore Points =========================

ATTENTION: System Restore is disabled (Total:223.08 GB) (Free:103.84 GB) (47%)
Check "winmgmt" service or repair WMI.


==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (07/31/2019 08:27:14 PM) (Source: dLauncherLoopback) (EventID: 0) (User: )
Description: Event-ID 0

Error: (07/31/2019 08:23:10 PM) (Source: dLauncherLoopback) (EventID: 0) (User: )
Description: Event-ID 0

Error: (07/31/2019 08:20:17 PM) (Source: dLauncherLoopback) (EventID: 0) (User: )
Description: Event-ID 0

Error: (07/31/2019 08:14:19 PM) (Source: dLauncherLoopback) (EventID: 0) (User: )
Description: Event-ID 0

Error: (07/31/2019 08:02:26 PM) (Source: dLauncherLoopback) (EventID: 0) (User: )
Description: Event-ID 0

Error: (07/31/2019 07:59:58 PM) (Source: dLauncherLoopback) (EventID: 0) (User: )
Description: Event-ID 0

Error: (07/31/2019 07:14:42 PM) (Source: dLauncherLoopback) (EventID: 0) (User: )
Description: Event-ID 0

Error: (07/31/2019 07:11:14 PM) (Source: dLauncherLoopback) (EventID: 0) (User: )
Description: Event-ID 0


System errors:
=============
Error: (07/31/2019 08:29:02 PM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: Durch die Berechtigungseinstellungen für "application-specific" wird dem Benutzer "NT AUTHORITY\SYSTEM" (SID: S-1-5-18) unter der Adresse "LocalHost (Using LRPC)" keine Berechtigung vom Typ "Local Launch" für die COM-Serveranwendung mit der CLSID 
Windows.SecurityCenter.WscBrokerManager
 und der APPID 
Unavailable
 im Anwendungscontainer "Unavailable" (SID: Unavailable) gewährt. Die Sicherheitsberechtigung kann mit dem Verwaltungstool für Komponentendienste geändert werden.

Error: (07/31/2019 08:29:02 PM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: Durch die Berechtigungseinstellungen für "application-specific" wird dem Benutzer "NT AUTHORITY\SYSTEM" (SID: S-1-5-18) unter der Adresse "LocalHost (Using LRPC)" keine Berechtigung vom Typ "Local Launch" für die COM-Serveranwendung mit der CLSID 
Windows.SecurityCenter.WscDataProtection
 und der APPID 
Unavailable
 im Anwendungscontainer "Unavailable" (SID: Unavailable) gewährt. Die Sicherheitsberechtigung kann mit dem Verwaltungstool für Komponentendienste geändert werden.

Error: (07/31/2019 08:29:00 PM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: Der Dienst "Energy Server Service queencreek" wurde mit folgendem Fehler beendet: 
Debugger hat Steuerung C empfangen.

Error: (07/31/2019 08:27:01 PM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: Durch die Berechtigungseinstellungen für "application-specific" wird dem Benutzer "NT AUTHORITY\LOCAL SERVICE" (SID: S-1-5-19) unter der Adresse "LocalHost (Using LRPC)" keine Berechtigung vom Typ "Local Activation" für die COM-Serveranwendung mit der CLSID 
{6B3B8D23-FA8D-40B9-8DBD-B950333E2C52}
 und der APPID 
{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}
 im Anwendungscontainer "Unavailable" (SID: Unavailable) gewährt. Die Sicherheitsberechtigung kann mit dem Verwaltungstool für Komponentendienste geändert werden.

Error: (07/31/2019 08:27:01 PM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: Durch die Berechtigungseinstellungen für "application-specific" wird dem Benutzer "NT AUTHORITY\LOCAL SERVICE" (SID: S-1-5-19) unter der Adresse "LocalHost (Using LRPC)" keine Berechtigung vom Typ "Local Activation" für die COM-Serveranwendung mit der CLSID 
{6B3B8D23-FA8D-40B9-8DBD-B950333E2C52}
 und der APPID 
{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}
 im Anwendungscontainer "Unavailable" (SID: Unavailable) gewährt. Die Sicherheitsberechtigung kann mit dem Verwaltungstool für Komponentendienste geändert werden.

Error: (07/31/2019 08:26:54 PM) (Source: Microsoft-Windows-Ntfs) (EventID: 98) (User: NT AUTHORITY)
Description: C:\Device\HarddiskVolume23

Error: (07/31/2019 08:24:58 PM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: Durch die Berechtigungseinstellungen für "application-specific" wird dem Benutzer "NT AUTHORITY\SYSTEM" (SID: S-1-5-18) unter der Adresse "LocalHost (Using LRPC)" keine Berechtigung vom Typ "Local Launch" für die COM-Serveranwendung mit der CLSID 
Windows.SecurityCenter.WscBrokerManager
 und der APPID 
Unavailable
 im Anwendungscontainer "Unavailable" (SID: Unavailable) gewährt. Die Sicherheitsberechtigung kann mit dem Verwaltungstool für Komponentendienste geändert werden.

Error: (07/31/2019 08:24:58 PM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: Durch die Berechtigungseinstellungen für "application-specific" wird dem Benutzer "NT AUTHORITY\SYSTEM" (SID: S-1-5-18) unter der Adresse "LocalHost (Using LRPC)" keine Berechtigung vom Typ "Local Launch" für die COM-Serveranwendung mit der CLSID 
Windows.SecurityCenter.WscDataProtection
 und der APPID 
Unavailable
 im Anwendungscontainer "Unavailable" (SID: Unavailable) gewährt. Die Sicherheitsberechtigung kann mit dem Verwaltungstool für Komponentendienste geändert werden.


Windows Defender:
===================================
Date: 2019-07-27 14:11:19.123
Description: 
Die Windows Defender Antivirus-Überprüfung wurde vor ihrem Abschluss beendet.
Überprüfungs-ID: {F19C5FF9-CAEE-4B95-AF27-48D5428A0778}
Überprüfungstyp: Antimalware
Überprüfungsparameter: Vollständige Überprüfung
Benutzer: DESKTOP-3CK4O4E\Lubka

Date: 2019-07-27 12:24:43.833
Description: 
Die Windows Defender Antivirus-Überprüfung wurde vor ihrem Abschluss beendet.
Überprüfungs-ID: {82B744AF-4B5B-4340-A46C-B31EB143D3E7}
Überprüfungstyp: Antimalware
Überprüfungsparameter: Schnellüberprüfung
Benutzer: NT AUTHORITY\SYSTEM

Date: 2019-07-27 11:13:24.797
Description: 
Die Windows Defender Antivirus-Überprüfung wurde vor ihrem Abschluss beendet.
Überprüfungs-ID: {1B172D1B-64F6-47C9-98B1-C708BFF51B34}
Überprüfungstyp: Antimalware
Überprüfungsparameter: Schnellüberprüfung
Benutzer: NT AUTHORITY\SYSTEM

Date: 2019-07-25 01:44:05.762
Description: 
Von Windows Defender Antivirus wurde Schadsoftware oder andere potenziell unerwünschte Software erkannt.
Weitere Informationen:
https://go.microsoft.com/fwlink/?linkid=37020&name=Behavior:Win32/Generic.KU!ml&threatid=2147739089&enterprise=0
Name: Behavior:Win32/Generic.KU!ml
ID: 2147739089
Schweregrad: Závažná
Kategorie: Podozrivé správanie
Pfad: file:_C:\Users\Lubka\AppData\Local\Temp\wErKYuzd1HavtcSG\83314351a78e5d6e44c0cdebeb407e8c.exe
Erkennungsursprung: Lokaler Computer
Erkennungstyp: FastPath
Erkennungsquelle: Benutzer
Benutzer: DESKTOP-3CK4O4E\Lubka
Prozessname: Unknown
Signaturversion: AV: 1.299.423.0, AS: 1.299.423.0, NIS: 0.0.0.0
Modulversion: AM: 1.1.16200.1, NIS: 0.0.0.0

Date: 2019-07-25 01:44:05.761
Description: 
Von Windows Defender Antivirus wurde Schadsoftware oder andere potenziell unerwünschte Software erkannt.
Weitere Informationen:
https://go.microsoft.com/fwlink/?linkid=37020&name=Trojan:JS/Iframe.EX&threatid=2147733337&enterprise=0
Name: Trojan:JS/Iframe.EX
ID: 2147733337
Schweregrad: Závažná
Kategorie: Trójsky kôň
Pfad: containerfile:_C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Cache\f_001582; file:_C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Cache\f_001582->(GZip)
Erkennungsursprung: Lokaler Computer
Erkennungstyp: Konkret
Erkennungsquelle: Benutzer
Benutzer: DESKTOP-3CK4O4E\Lubka
Prozessname: Unknown
Signaturversion: AV: 1.299.423.0, AS: 1.299.423.0, NIS: 0.0.0.0
Modulversion: AM: 1.1.16200.1, NIS: 0.0.0.0

Date: 2019-07-31 20:12:16.523
Description: 
Fehler von Windows Defender Antivirus beim Aktualisieren von Signaturen.
Neue Signaturversion: 
Vorherige Signaturversion: 1.299.631.0
Updatequelle: Microsoft Center zum Schutz vor Schadsoftware
Signaturtyp: AntiVirus
Updatetyp: Voll
Benutzer: NT AUTHORITY\NETWORK SERVICE
Aktuelle Modulversion: 
Vorherige Modulversion: 1.1.16200.1
Fehlercode: 0x80072ee7
Fehlerbeschreibung: The server name or address could not be resolved 

Date: 2019-07-31 20:12:16.523
Description: 
Fehler von Windows Defender Antivirus beim Aktualisieren von Signaturen.
Neue Signaturversion: 
Vorherige Signaturversion: 1.299.631.0
Updatequelle: Microsoft Center zum Schutz vor Schadsoftware
Signaturtyp: AntiSpyware
Updatetyp: Voll
Benutzer: NT AUTHORITY\NETWORK SERVICE
Aktuelle Modulversion: 
Vorherige Modulversion: 1.1.16200.1
Fehlercode: 0x80072ee7
Fehlerbeschreibung: The server name or address could not be resolved 

Date: 2019-07-31 20:12:16.523
Description: 
Fehler von Windows Defender Antivirus beim Aktualisieren von Signaturen.
Neue Signaturversion: 
Vorherige Signaturversion: 1.299.631.0
Updatequelle: Microsoft Center zum Schutz vor Schadsoftware
Signaturtyp: AntiVirus
Updatetyp: Voll
Benutzer: NT AUTHORITY\NETWORK SERVICE
Aktuelle Modulversion: 
Vorherige Modulversion: 1.1.16200.1
Fehlercode: 0x80072ee7
Fehlerbeschreibung: The server name or address could not be resolved 

Date: 2019-07-31 20:12:16.516
Description: 
Fehler von Windows Defender Antivirus beim Aktualisieren von Signaturen.
Neue Signaturversion: 
Vorherige Signaturversion: 1.299.631.0
Updatequelle: Microsoft Center zum Schutz vor Schadsoftware
Signaturtyp: AntiVirus
Updatetyp: Voll
Benutzer: NT AUTHORITY\NETWORK SERVICE
Aktuelle Modulversion: 
Vorherige Modulversion: 1.1.16200.1
Fehlercode: 0x80072ee7
Fehlerbeschreibung: The server name or address could not be resolved 

Date: 2019-07-31 20:12:16.515
Description: 
Fehler von Windows Defender Antivirus beim Aktualisieren von Signaturen.
Neue Signaturversion: 
Vorherige Signaturversion: 1.299.631.0
Updatequelle: Microsoft Center zum Schutz vor Schadsoftware
Signaturtyp: AntiSpyware
Updatetyp: Voll
Benutzer: NT AUTHORITY\NETWORK SERVICE
Aktuelle Modulversion: 
Vorherige Modulversion: 1.1.16200.1
Fehlercode: 0x80072ee7
Fehlerbeschreibung: The server name or address could not be resolved 

==================== Memory info =========================== 

BIOS: American Megatrends Inc. 1.60 10/10/2018
Motherboard: Micro-Star International Co., Ltd. H310M PRO-VD (MS-7B33)
Processor: Intel(R) Core(TM) i3-8300 CPU @ 3.70GHz
Percentage of memory in use: 59%
Total physical RAM: 3962.59 MB
Available physical RAM: 1589.96 MB
Total Virtual: 14714.59 MB
Available Virtual: 12457.24 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:223.08 GB) (Free:103.84 GB) NTFS
Drive d: () (Fixed) (Total:1863.01 GB) (Free:1638.61 GB) NTFS

\\?\Volume{b9e8df67-0000-0000-0000-100000000000}\ (Vyhradené systémom) (Fixed) (Total:0.49 GB) (Free:0.1 GB) NTFS

==================== MBR & Partition Table ==================

==================== End of Addition.txt ============================
         

--- --- ---

--- --- ---

Fix result of Farbar Recovery Scan Tool (x64) Version: 31-07-2019
Ran by Jozko (31-07-2019 20:01:27) Run:1
Running from C:\Users\Jozko\Desktop
Loaded Profiles: Jozko (Available Profiles: Lubka & Jozko)
Boot Mode: Normal
==============================================

fixlist content:
*****************
CloseProcesses:
Task: {26841A08-7BC8-413E-B648-4E9B88302A57} - System32\Tasks\EJlCPXAxczfLnX => rundll32 "C:\Program Files (x86)\XAIfWVzjYwlU2\ivfNGGvgifFGu.dll",#1
C:\Program Files (x86)\XAIfWVzjYwlU2
Task: {40446FB5-8319-4883-997A-0F4FB55BC044} - System32\Tasks\ibZIUHjYTxUPTmNsU2 => rundll32 "C:\Program Files (x86)\XSeHBAjlvbTDePgmqbR\yNwwave.dll",#1
C:\Program Files (x86)\XSeHBAjlvbTDePgmqbR
Task: {625224FD-B919-4BAE-8718-20D666776C9F} - System32\Tasks\WByhYcedlOQavqREWte2 => rundll32 "C:\Program Files (x86)\NIErSAELLsOOC\EfRGQll.dll",#1
C:\Program Files (x86)\NIErSAELLsOOC
Task: {6DF74A6B-67D3-462C-9413-F82E04D70F06} - System32\Tasks\KJMNwfnoaWMfhxH2 => rundll32 "C:\Program Files (x86)\udVlifMMU\vNGgfG.dll",#1
C:\Program Files (x86)\udVlifMMU
Task: {B1E92710-FA20-412F-A854-A8EECE9BA802} - System32\Tasks\WZdwAMJoIRSYG2 => C:\WINDOWS\system32\wscript.exe "C:\ProgramData\LUBciApiRJzrvXVB\PFmfVpo.wsf"
C:\ProgramData\LUBciApiRJzrvXVB
Task: {CCE6F463-0345-4BC9-8068-3F513EF4D603} - System32\Tasks\rescncttloqaqcg => msiexec.exe /quiet /i "C:\Users\**\AppData\Roaming\lwmjhnysqrpp\pbeohtnsooaelld.msi" WEBID=PP_MN_P3 TKNME=rescncttloqaqcg
Task: {75D51F29-E7D7-44DF-B5E3-DB305222BD70} - System32\Tasks\lqerkybtsayax => msiexec.exe /quiet /i "C:\Users\**\AppData\Roaming\lwmjhnysqrpp\pbeohtnsooaelld.msi" WEBID=PP_MN_P3 TKNME=lqerkybtsayax
C:\Users\Jozko\AppData\Roaming\lwmjhnysqrpp
SearchScopes: HKU\S-1-5-21-1960842775-2088100534-3542962694-1001 -> DefaultScope {FFEBBF0A-C22C-4172-89FF-45215A135AC7} URL = 
BHO: YoutubeAdBlock -> {44EDBCE5-6691-4383-B723-8C21F5F1A004} -> C:\Program Files (x86)\bzDQAplLjIE\tMOJVg6.dll => No File
C:\Program Files (x86)\bzDQAplLjIE
BHO-x32: YoutubeAdBlock -> {44EDBCE5-6691-4383-B723-8C21F5F1A004} -> C:\Program Files (x86)\bzDQAplLjIE\kSQSQOyPW.dll => No File
FF Extension: (No Name) - C:\Program Files\Mozilla Firefox\browser\features\{BA546D42-BAEC-4C9C-870E-D0BE7892DBD5}.xpi [2019-07-25] [not signed]
FF user.js: detected! => C:\Users\Jozko\AppData\Roaming\Mozilla\Firefox\Profiles\bt6jbw3e.default\user.js [2019-07-25]
C:\ProgramData\Lamia
C:\WINDOWS\System32\Tasks\System
2019-07-25 00:39 - 2019-07-25 00:41 - 000000000 ____D C:\Users\Jozko\AppData\Local\Mail.Ru
2019-07-25 00:39 - 2019-07-25 00:40 - 000000000 ____D C:\ProgramData\Mail.Ru
2019-07-25 00:39 - 2019-07-25 00:39 - 000825856 _____ C:\Default.xml
2019-07-25 00:39 - 2019-07-25 00:39 - 000000000 ____D C:\ProgramData\Loosger
2019-07-25 00:38 - 2019-07-25 00:38 - 004059136 _____ C:\Users\Jozko\Downloads\setup_f5ac96a97f5f.iso
2019-07-25 00:36 - 2019-07-25 00:36 - 007856585 _____ C:\Users\Jozko\Downloads\K-ON!! MOD COMPLETE .rar
2019-07-25 00:36 - 2019-07-25 00:36 - 001132644 _____ C:\Users\Jozko\Downloads\Nakano Azusa.rar
Tcpip\..\Interfaces\{293ee5fa-fe84-433a-a774-26687ea51594}: [NameServer] 45.114.8.167,,,116.203.6.218
Tcpip\..\Interfaces\{34eac78a-f8d3-4256-b5a3-9da0fc12e3a7}: [NameServer] 45.114.8.167,,,116.203.6.218
Tcpip\..\Interfaces\{da384fb4-1e59-48fc-bfe0-c27ce005f778}: [NameServer] 45.114.8.167,,,116.203.6.218
CHR HKLM\SOFTWARE\Policies\Google: Restriction <==== ATTENTION
HKLM\SOFTWARE\Policies\Microsoft\Windows Defender: Restriction <==== ATTENTION
CMD: dir "%ProgramFiles%"
CMD: dir "%ProgramFiles(x86)%"
CMD: dir "%ProgramData%"
CMD: dir "%Appdata%"
CMD: dir "%LocalAppdata%"
ExportKey: HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions
CMD: ipconfig /flushdns
CMD: netsh winsock reset
CMD: netsh advfirewall reset
CMD: netsh advfirewall set allprofiles state ON
CMD: Bitsadmin /Reset /Allusers
Hosts:
RemoveProxy:
EmptyTemp:

*****************

Processes closed successfully.
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{26841A08-7BC8-413E-B648-4E9B88302A57}" => not found
"C:\WINDOWS\System32\Tasks\EJlCPXAxczfLnX" => not found
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\EJlCPXAxczfLnX" => not found
"C:\Program Files (x86)\XAIfWVzjYwlU2" => not found
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{40446FB5-8319-4883-997A-0F4FB55BC044}" => not found
"C:\WINDOWS\System32\Tasks\ibZIUHjYTxUPTmNsU2" => not found
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\ibZIUHjYTxUPTmNsU2" => not found
"C:\Program Files (x86)\XSeHBAjlvbTDePgmqbR" => not found
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{625224FD-B919-4BAE-8718-20D666776C9F}" => not found
"C:\WINDOWS\System32\Tasks\WByhYcedlOQavqREWte2" => not found
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\WByhYcedlOQavqREWte2" => not found
"C:\Program Files (x86)\NIErSAELLsOOC" => not found
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{6DF74A6B-67D3-462C-9413-F82E04D70F06}" => not found
"C:\WINDOWS\System32\Tasks\KJMNwfnoaWMfhxH2" => not found
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\KJMNwfnoaWMfhxH2" => not found
"C:\Program Files (x86)\udVlifMMU" => not found
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{B1E92710-FA20-412F-A854-A8EECE9BA802}" => not found
"C:\WINDOWS\System32\Tasks\WZdwAMJoIRSYG2" => not found
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\WZdwAMJoIRSYG2" => not found
"C:\ProgramData\LUBciApiRJzrvXVB" => not found
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{CCE6F463-0345-4BC9-8068-3F513EF4D603} => could not remove. Access Denied.
"C:\WINDOWS\System32\Tasks\rescncttloqaqcg" => not found
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\rescncttloqaqcg => could not remove. Access Denied.
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{75D51F29-E7D7-44DF-B5E3-DB305222BD70} => could not remove. Access Denied.
"C:\WINDOWS\System32\Tasks\lqerkybtsayax" => not found
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\lqerkybtsayax => could not remove. Access Denied.
"C:\Users\Jozko\AppData\Roaming\lwmjhnysqrpp" => not found
"HKU\S-1-5-21-1960842775-2088100534-3542962694-1001\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope" => not found
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{44EDBCE5-6691-4383-B723-8C21F5F1A004} => could not remove. Access Denied.
HKLM\Software\Classes\CLSID\{44EDBCE5-6691-4383-B723-8C21F5F1A004} => could not remove. Access Denied.
"C:\Program Files (x86)\bzDQAplLjIE" => not found
HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{44EDBCE5-6691-4383-B723-8C21F5F1A004} => could not remove. Access Denied.
HKLM\Software\Wow6432Node\Classes\CLSID\{44EDBCE5-6691-4383-B723-8C21F5F1A004} => could not remove. Access Denied.
Could not move "C:\Program Files\Mozilla Firefox\browser\features\{BA546D42-BAEC-4C9C-870E-D0BE7892DBD5}.xpi" => Scheduled to move on reboot.
"C:\Users\Jozko\AppData\Roaming\Mozilla\Firefox\Profiles\bt6jbw3e.default\user.js" => not found

"C:\ProgramData\Lamia" folder move:

Could not move "C:\ProgramData\Lamia" => Scheduled to move on reboot.

"C:\WINDOWS\System32\Tasks\System" => not found
"C:\Users\Jozko\AppData\Local\Mail.Ru" => not found

"C:\ProgramData\Mail.Ru" folder move:

Could not move "C:\ProgramData\Mail.Ru" => Scheduled to move on reboot.

Could not move "C:\Default.xml" => Scheduled to move on reboot.

"C:\ProgramData\Loosger" folder move:

Could not move "C:\ProgramData\Loosger" => Scheduled to move on reboot.

"C:\Users\Jozko\Downloads\setup_f5ac96a97f5f.iso" => not found
"C:\Users\Jozko\Downloads\K-ON!! MOD COMPLETE .rar" => not found
"C:\Users\Jozko\Downloads\Nakano Azusa.rar" => not found
"HKLM\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{293ee5fa-fe84-433a-a774-26687ea51594}\\NameServer" => could not remove
"HKLM\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{34eac78a-f8d3-4256-b5a3-9da0fc12e3a7}\\NameServer" => could not remove
"HKLM\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{da384fb4-1e59-48fc-bfe0-c27ce005f778}\\NameServer" => could not remove
HKLM\SOFTWARE\Policies\Google => could not remove. Access Denied.
HKLM\SOFTWARE\Policies\Microsoft\Windows Defender => could not remove. Access Denied.

========= dir "%ProgramFiles%" =========

 Volume in Laufwerk C: hat keine Bezeichnung.
 Volumeseriennummer: B6BD-2C46

 Verzeichnis von C:\Program Files

30.07.2019  21:10    <DIR>          .
30.07.2019  21:10    <DIR>          ..
20.12.2018  22:33    <DIR>          Common Files
20.12.2018  22:32    <DIR>          EpsonNet
28.05.2019  18:34    <DIR>          Google
17.12.2018  09:19    <DIR>          Intel
12.06.2019  23:46    <DIR>          internet explorer
24.05.2019  20:54    <DIR>          Java
30.07.2019  21:10    <DIR>          Malwarebytes
14.12.2018  10:40    <DIR>          Microsoft Office
25.07.2019  01:01    <DIR>          Mozilla Firefox
14.03.2019  21:33    <DIR>          MSBuild
14.12.2018  18:51    <DIR>          Realtek
14.03.2019  21:33    <DIR>          Reference Assemblies
21.06.2019  22:17    <DIR>          rempl
14.03.2019  23:00    <DIR>          TAP-Windows
19.06.2019  18:44    <DIR>          UNP
11.04.2019  18:24    <DIR>          Windows Defender
09.07.2019  21:10    <DIR>          Windows Defender Advanced Threat Protection
14.12.2018  18:51    <DIR>          Windows Mail
20.12.2018  22:09    <DIR>          Windows Media Player
12.04.2018  01:38    <DIR>          Windows Multimedia Platform
12.04.2018  01:38    <DIR>          windows nt
20.12.2018  22:09    <DIR>          Windows Photo Viewer
12.04.2018  01:38    <DIR>          Windows Portable Devices
12.04.2018  01:38    <DIR>          Windows Security
12.04.2018  01:38    <DIR>          WindowsPowerShell
               0 Datei(en),              0 Bytes
              27 Verzeichnis(se), 111.003.770.880 Bytes frei

========= End of CMD: =========


========= dir "%ProgramFiles(x86)%" =========

 Volume in Laufwerk C: hat keine Bezeichnung.
 Volumeseriennummer: B6BD-2C46

 Verzeichnis von C:\Program Files (x86)

31.07.2019  19:08    <DIR>          .
31.07.2019  19:08    <DIR>          ..
14.12.2018  11:10    <DIR>          Adobe
24.07.2019  21:13    <DIR>          Age of Empires complete
13.05.2019  21:24    <DIR>          Bit4id
24.07.2019  19:11    <DIR>          Common Files
14.03.2019  21:22    <DIR>          Disig
14.03.2019  23:01    <DIR>          Ditec
31.07.2019  19:08    <DIR>          duxVclVEU
02.05.2019  06:52    <DIR>          EAC MW klient
20.12.2018  22:31    <DIR>          epson
14.12.2018  11:11    <DIR>          Google
31.07.2019  19:08    <DIR>          hhaccViKlMUn
27.07.2019  14:10    <DIR>          Intel
12.06.2019  23:46    <DIR>          Internet Explorer
14.12.2018  10:40    <DIR>          Microsoft Analysis Services
14.12.2018  10:41    <DIR>          Microsoft Office
14.12.2018  10:41    <DIR>          Microsoft SQL Server
14.12.2018  18:52    <DIR>          Microsoft.NET
31.07.2019  19:08    <DIR>          minXQDMZbIE
14.12.2018  10:41    <DIR>          Mozilla Firefox
25.07.2019  01:01    <DIR>          Mozilla Maintenance Service
14.03.2019  21:33    <DIR>          MSBuild
09.01.2019  09:41    <DIR>          MSI
20.12.2018  23:03    <DIR>          OLYMPUS
20.12.2018  23:02    <DIR>          QuickTime
14.12.2018  18:09    <DIR>          Realtek
14.12.2018  18:51    <DIR>          Reference Assemblies
14.12.2018  18:02    <DIR>          Setup Files
31.07.2019  19:14    <DIR>          Spybot - Search & Destroy 2
19.03.2019  20:41    <DIR>          SSC Service Utility
10.03.2019  19:27    <DIR>          TextPad 4
14.12.2018  19:00    <DIR>          VulkanRT
13.03.2019  19:54    <DIR>          Windows Defender
14.12.2018  18:51    <DIR>          Windows Mail
20.12.2018  22:09    <DIR>          Windows Media Player
12.04.2018  01:38    <DIR>          Windows Multimedia Platform
12.04.2018  01:38    <DIR>          windows nt
20.12.2018  22:09    <DIR>          Windows Photo Viewer
12.04.2018  01:38    <DIR>          Windows Portable Devices
12.04.2018  01:38    <DIR>          WindowsPowerShell
24.07.2019  23:11    <DIR>          WinRAR
               0 Datei(en),              0 Bytes
              42 Verzeichnis(se), 111.003.770.880 Bytes frei

========= End of CMD: =========


========= dir "%ProgramData%" =========

 Volume in Laufwerk C: hat keine Bezeichnung.
 Volumeseriennummer: B6BD-2C46

 Verzeichnis von C:\ProgramData

17.02.2019  18:50    <DIR>          .mono
14.12.2018  11:39    <DIR>          Adobe
15.05.2019  06:49    <DIR>          boost_interprocess
30.10.2015  09:24    <DIR>          Comms
14.12.2018  18:19    <DIR>          Dell
14.03.2019  23:01    <DIR>          Ditec
14.12.2018  18:09                 0 DP45977C.lfl
20.12.2018  22:37    <DIR>          EPSON
14.12.2018  18:59    <DIR>          Intel
25.07.2019  00:41    <DIR>          Lamia
25.07.2019  00:39    <DIR>          Loosger
25.07.2019  00:40    <DIR>          Mail.Ru
30.07.2019  21:10    <DIR>          Malwarebytes
14.12.2018  10:42    <DIR>          Microsoft Help
17.12.2018  09:13    <DIR>          Microsoft OneDrive
05.02.2019  19:05    <DIR>          Mozilla
20.12.2018  23:04    <DIR>          OLYMPUS
24.05.2019  20:54    <DIR>          Oracle
27.07.2019  14:10    <DIR>          Package Cache
09.02.2019  11:51    <DIR>          Packages
20.12.2018  23:02    <DIR>          QuickTime
31.07.2019  19:13    <DIR>          regid.1991-06.com.microsoft
12.04.2018  01:38    <DIR>          SoftwareDistribution
31.07.2019  19:13    <DIR>          Spybot - Search & Destroy
25.07.2019  01:04    <DIR>          TmpLoog
14.12.2018  18:56    <DIR>          USOPrivate
14.12.2018  18:57    <DIR>          USOShared
12.04.2018  19:08    <DIR>          WindowsHolographicDevices
               1 Datei(en),              0 Bytes
              27 Verzeichnis(se), 111.003.766.784 Bytes frei

========= End of CMD: =========


========= dir "%Appdata%" =========

 Volume in Laufwerk C: hat keine Bezeichnung.
 Volumeseriennummer: B6BD-2C46

 Verzeichnis von C:\Users\Jozko\AppData\Roaming

30.07.2019  22:11    <DIR>          .
30.07.2019  22:11    <DIR>          ..
27.12.2018  12:39    <DIR>          Adobe
14.03.2019  22:01    <DIR>          EAC_MW_klient
27.12.2018  12:02    <DIR>          EPSON
13.07.2019  16:47    <DIR>          HiPlayer
13.07.2019  16:47    <DIR>          InstallShield Installation Information
14.03.2019  21:50    <DIR>          Macromedia
20.12.2018  22:18    <DIR>          Mozilla
30.07.2019  22:11    <DIR>          Sun
10.03.2019  19:30    <DIR>          TextPad
               0 Datei(en),              0 Bytes
              11 Verzeichnis(se), 111.003.770.880 Bytes frei

========= End of CMD: =========


========= dir "%LocalAppdata%" =========

 Volume in Laufwerk C: hat keine Bezeichnung.
 Volumeseriennummer: B6BD-2C46

 Verzeichnis von C:\Users\Jozko\AppData\Local

31.07.2019  20:00    <DIR>          .
31.07.2019  20:00    <DIR>          ..
13.07.2019  17:03    <DIR>          Adobe
14.03.2019  21:29    <DIR>          Apps
20.12.2018  22:27    <DIR>          Comms
03.01.2019  14:53    <DIR>          ConnectedDevicesPlatform
30.07.2019  20:15    <DIR>          D3DSCache
27.12.2018  12:08    <DIR>          DBG
14.03.2019  23:01    <DIR>          Deployment
14.03.2019  21:34    <DIR>          Finanźn‚_riadite–stvo_SR_-_Sekcia_daĺov*
20.12.2018  22:11    <DIR>          Google
20.12.2018  22:12    <DIR>          Intel
30.07.2019  21:11    <DIR>          mbam
30.07.2019  21:11    <DIR>          mbamtray
14.03.2019  21:45    <DIR>          Microsoft
20.12.2018  22:11    <DIR>          MicrosoftEdge
20.12.2018  22:48    <DIR>          Mozilla
30.06.2019  12:12    <DIR>          Packages
20.02.2019  21:17    <DIR>          PlaceholderTileLogoFolder
20.12.2018  22:46    <DIR>          Publishers
31.07.2019  20:00    <DIR>          Temp
02.01.2019  20:23    <DIR>          VirtualStore
               0 Datei(en),              0 Bytes
              22 Verzeichnis(se), 111.003.766.784 Bytes frei

========= End of CMD: =========

================== ExportKey: ===================

[HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions]
[HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Extensions]
[HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths]
"C:\Users\Lubka\AppData\Roaming\lwmjhnysqrpp"="0"
"C:\ProgramData"="0"
"C:\WINDOWS\Temp\prBQoRtdiGvnAgML"="0"
"C:\Program Files (x86)\IKweScizynZHzgXUqVR"="0"
"C:\Program Files (x86)\duxVclVEU"="0"
"C:\Program Files (x86)\hhaccViKlMUn"="0"
"C:\Program Files (x86)\minXQDMZbIE"="0"
"C:\Program Files (x86)\nyOTaFQVaERJC"="0"
"C:\Program Files (x86)\oXNCRiLjSDbU2"="0"
"C:\ProgramData\tsbIJNdKRcSPLnVB"="0"
"C:\Users\Jozko\AppData\LocalLow\VYeRfUFKkRVtG"="0"
"C:\Users\Jozko\AppData\Local\Temp\tIGslkYqGZoVsFFpY"="0"
[HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes]
[HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\TemporaryPaths]

=== End of ExportKey ===

========= ipconfig /flushdns =========


Windows-IP-Konfiguration

Der DNS-Aufl”sungscache wurde geleert.

========= End of CMD: =========


========= netsh winsock reset =========

F�r den angeforderten Vorgang sind erh”hte Rechte erforderlich (Als Administrator ausf�hren).


========= End of CMD: =========


========= netsh advfirewall reset =========

F�r den angeforderten Vorgang sind erh”hte Rechte erforderlich (Als Administrator ausf�hren).


========= End of CMD: =========


========= netsh advfirewall set allprofiles state ON =========

F�r den angeforderten Vorgang sind erh”hte Rechte erforderlich (Als Administrator ausf�hren).


========= End of CMD: =========


========= Bitsadmin /Reset /Allusers =========


BITSADMIN version 3.0
BITS administration utility.
(C) Copyright Microsoft Corp.

Unable to enum jobs - 0x80070005
Zugriff verweigert



========= End of CMD: =========

Could not move "C:\Windows\System32\Drivers\etc\hosts" => Scheduled to move on reboot.

========= RemoveProxy: =========

"HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\DefaultConnectionSettings" => could not remove
"HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\SavedLegacySettings" => could not remove
"HKU\S-1-5-21-1960842775-2088100534-3542962694-1002\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\DefaultConnectionSettings" => removed successfully
"HKU\S-1-5-21-1960842775-2088100534-3542962694-1002\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\SavedLegacySettings" => removed successfully


========= End of RemoveProxy: =========


=========== EmptyTemp: ==========

BITS transfer queue => 0 B
DOMStore, IE Recovery, AppCache, Feeds Cache, Thumbcache, IconCache => 454421353 B
Java, Flash, Steam htmlcache => 1154 B
Windows/system/drivers => 0 B
Edge => 6348349 B
Chrome => 0 B
Firefox => 40119338 B
Opera => 0 B

Temp, IE cache, history, cookies, recent:
Default => 0 B
Users => 0 B
ProgramData => 0 B
Public => 0 B
systemprofile => 0 B
LocalService => 0 B
LocalService => 0 B
NetworkService => 0 B
NetworkService => 0 B
Lubka => 91979786 B
Jozko => 12732106 B

RecycleBin => 5533891 B
EmptyTemp: => 582.8 MB temporary data Removed.

================================

Result of scheduled files to move (Boot Mode: Normal) (Date&Time: 31-07-2019 20:27:39)

C:\Program Files\Mozilla Firefox\browser\features\{BA546D42-BAEC-4C9C-870E-D0BE7892DBD5}.xpi => Could not move
C:\ProgramData\Lamia => Could not move
C:\ProgramData\Mail.Ru => Could not move
C:\Default.xml => Could not move
C:\ProgramData\Loosger => Could not move
C:\Windows\System32\Drivers\etc\hosts => Could not move
Could not restore Hosts.

Result of scheduled keys to remove after reboot:

HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{CCE6F463-0345-4BC9-8068-3F513EF4D603} => could not remove. Access Denied.
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\rescncttloqaqcg => could not remove. Access Denied.
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{75D51F29-E7D7-44DF-B5E3-DB305222BD70} => could not remove. Access Denied.
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\lqerkybtsayax => could not remove. Access Denied.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{44EDBCE5-6691-4383-B723-8C21F5F1A004} => could not remove. Access Denied.
HKLM\Software\Classes\CLSID\{44EDBCE5-6691-4383-B723-8C21F5F1A004} => could not remove. Access Denied.
HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{44EDBCE5-6691-4383-B723-8C21F5F1A004} => could not remove. Access Denied.
HKLM\Software\Wow6432Node\Classes\CLSID\{44EDBCE5-6691-4383-B723-8C21F5F1A004} => could not remove. Access Denied.
HKLM\SOFTWARE\Policies\Google => could not remove. Access Denied.
HKLM\SOFTWARE\Policies\Microsoft\Windows Defender => could not remove. Access Denied.

==== End of Fixlog 20:27:39 ====
         

Ran by Jozko (ATTENTION: The user is not administrator) on DESKTOP-3CK4O4E (Micro-Star International Co., Ltd. MS-7B33) (31-07-2019 20:28:01)

Die Schritte 1, 2 und 3 nochmal, dieses Mal bitte mit Adminrechten... sonst ist das wertlos.
Auch wieder die Reihenfolge einhalten.

# -------------------------------
# Malwarebytes AdwCleaner 7.4.0.0
# -------------------------------
# Build:    07-23-2019
# Database: 2019-07-22.1 (Cloud)
# Support:  https://www.malwarebytes.com/support
#
# -------------------------------
# Mode: Scan
# -------------------------------
# Start:    07-31-2019
# Duration: 00:00:11
# OS:       Windows 10 Pro
# Scanned:  35810
# Detected: 0


***** [ Services ] *****

No malicious services found.

***** [ Folders ] *****

No malicious folders found.

***** [ Files ] *****

No malicious files found.

***** [ DLL ] *****

No malicious DLLs found.

***** [ WMI ] *****

No malicious WMI found.

***** [ Shortcuts ] *****

No malicious shortcuts found.

***** [ Tasks ] *****

No malicious tasks found.

***** [ Registry ] *****

No malicious registry entries found.

***** [ Chromium (and derivatives) ] *****

No malicious Chromium entries found.

***** [ Chromium URLs ] *****

No malicious Chromium URLs found.

***** [ Firefox (and derivatives) ] *****

No malicious Firefox entries found.

***** [ Firefox URLs ] *****

No malicious Firefox URLs found.

***** [ Preinstalled Software ] *****

No Preinstalled Software found.


AdwCleaner[S00].txt - [3893 octets] - [30/07/2019 20:26:59]
AdwCleaner[C00].txt - [3565 octets] - [30/07/2019 20:27:18]
AdwCleaner[S01].txt - [1447 octets] - [30/07/2019 20:30:14]
AdwCleaner[S02].txt - [1610 octets] - [31/07/2019 19:10:25]
AdwCleaner[C02].txt - [1778 octets] - [31/07/2019 19:10:42]

########## EOF - C:\AdwCleaner\Logs\AdwCleaner[S03].txt ##########
         

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 31-07-2019
Ran by ** (administrator) on DESKTOP-3CK4O4E (Micro-Star International Co., Ltd. MS-7B33) (31-07-2019 22:48:07)
Running from C:\Users\*****\Desktop
Loaded Profiles: ** & ***** (Available Profiles: ** & *****)
Platform: Windows 10 Pro Version 1803 17134.885 (X64) Language: Slowakisch (Slowakei)
Default browser: FF
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Adobe Systems, Incorporated -> Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
(Disig a.s. -> Disig a.s.) C:\Program Files (x86)\Disig\Disig Web Signer 1.0.7\Updater\WebSignerTray.exe
(Google Inc -> Google LLC) C:\Program Files (x86)\Google\Update\1.3.34.11\GoogleCrashHandler.exe
(Google Inc -> Google LLC) C:\Program Files (x86)\Google\Update\1.3.34.11\GoogleCrashHandler64.exe
(IDSA Production signing key -> Intel) C:\Program Files (x86)\Intel\Driver and Support Assistant\DSAService.exe
(IDSA Production signing key -> Intel) C:\Program Files (x86)\Intel\Driver and Support Assistant\DSATray.exe
(IDSA Production signing key -> Intel) C:\Program Files (x86)\Intel\Driver and Support Assistant\DSAUpdateService.exe
(Intel(R) pGFX -> Intel Corporation) C:\Windows\System32\DriverStore\FileRepository\cui_dc_comp.inf_amd64_1c77f1231c19bc72\igfxCUIService.exe
(Intel(R) pGFX -> Intel Corporation) C:\Windows\System32\DriverStore\FileRepository\cui_dc_comp.inf_amd64_1c77f1231c19bc72\igfxEM.exe
(Intel(R) pGFX -> Intel Corporation) C:\Windows\System32\DriverStore\FileRepository\iigd_dc_base.inf_amd64_26935c8c9d5bfd3b\IntelCpHDCPSvc.exe
(Intel(R) pGFX -> Intel Corporation) C:\Windows\System32\DriverStore\FileRepository\iigd_dc_base.inf_amd64_26935c8c9d5bfd3b\IntelCpHeciSvc.exe
(Intel(R) Software Development Products -> ) C:\Program Files\Intel\SUR\QUEENCREEK\SurSvc.exe
(Intel(R) Trust Services -> Intel(R) Corporation) C:\Program Files\Intel\Intel(R) Management Engine Components\iCLS\TPMProvisioningService.exe
(Malwarebytes Corporation -> Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
(Malwarebytes Corporation -> Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe
(Microsoft Corporation -> Microsoft Corporation) C:\Users\*****\AppData\Local\Microsoft\OneDrive\19.103.0527.0003\FileCoAuth.exe
(Microsoft Corporation -> Microsoft Corporation) C:\Users\*****\AppData\Local\Microsoft\OneDrive\OneDrive.exe
(Microsoft Corporation -> Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Microsoft Windows -> Microsoft Corporation) C:\Program Files\Windows Defender\MSASCuiL.exe
(Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\CompatTelRunner.exe
(Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\smartscreen.exe
(Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\userinit.exe
(Microsoft Windows Publisher -> Microsoft Corporation) C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.1907.4-0\MsMpEng.exe
(Microsoft Windows Publisher -> Microsoft Corporation) C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.1907.4-0\NisSrv.exe
(Oracle America, Inc. -> Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(SEIKO EPSON Corporation -> SEIKO EPSON CORPORATION) C:\Windows\System32\spool\drivers\x64\3\E_YATIHTU.EXE

==================== Registry (Whitelisted) ===========================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [SecurityHealth] => C:\Program Files\Windows Defender\MSASCuiL.exe [638872 2018-04-12] (Microsoft Windows -> Microsoft Corporation)
HKLM\...\Run: [RTHDVCPL] => "C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe" -s
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [645456 2019-04-01] (Oracle America, Inc. -> Oracle Corporation)
HKLM\...\RunOnce: [*EmptyTemp] => cmd /c rd /q/s C:\FRST\Temp
HKU\S-1-5-21-1960842775-2088100534-3542962694-1001\...\Run: [Steam] => "C:\Program Files (x86)\Steam\steam.exe" -silent
HKU\S-1-5-21-1960842775-2088100534-3542962694-1001\...\MountPoints2: {08af5bcb-313c-11e9-94ec-309c23d44e07} - "F:\HiSuiteDownLoader.exe" 
HKU\S-1-5-21-1960842775-2088100534-3542962694-1002\...\Run: [EPLTarget\P0000000000000000] => C:\WINDOWS\system32\spool\DRIVERS\x64\3\E_YATIHTU.EXE [241280 2012-07-12] (SEIKO EPSON Corporation -> SEIKO EPSON CORPORATION)
HKU\S-1-5-21-1960842775-2088100534-3542962694-1002\...\MountPoints2: {08af5bcb-313c-11e9-94ec-309c23d44e07} - "F:\HiSuiteDownLoader.exe" 
HKU\S-1-5-21-1960842775-2088100534-3542962694-1002\...\MountPoints2: {e8fcf302-ff74-11e8-94da-806e6f6e6963} - "E:\Setup.exe" 
HKLM\...\Drivers32: [VIDC.X264] => C:\WINDOWS\system32\x264vfw64.dll [3799552 2017-07-30] (x264vfw project) [File not signed]
HKLM\...\Drivers32: [VIDC.LAGS] => C:\WINDOWS\system32\lagarith.dll [148992 2011-12-07] ( ) [File not signed]
HKLM\...\Drivers32: [VIDC.XVID] => C:\WINDOWS\system32\xvidvfw.dll [311296 2018-01-28] () [File not signed]
HKLM\...\Drivers32: [msacm.ac3acm] => C:\WINDOWS\system32\ac3acm.acm [180736 2012-07-21] (fccHandler) [File not signed]
HKLM\...\Drivers32: [VIDC.X264] => C:\Windows\SysWOW64\x264vfw.dll [3850240 2017-07-30] (x264vfw project) [File not signed]
HKLM\...\Drivers32: [VIDC.LAGS] => C:\Windows\SysWOW64\lagarith.dll [216064 2011-12-07] ( ) [File not signed]
HKLM\...\Drivers32: [VIDC.XVID] => C:\Windows\SysWOW64\xvidvfw.dll [284672 2018-01-28] () [File not signed]
HKLM\...\Drivers32: [VIDC.FFDS] => C:\Windows\SysWOW64\ff_vfw.dll [112128 2015-10-24] () [File not signed]
HKLM\...\Drivers32: [msacm.ac3acm] => C:\Windows\SysWOW64\ac3acm.acm [122880 2012-07-21] (fccHandler) [File not signed]
HKLM\Software\Microsoft\Active Setup\Installed Components: [{8A69D345-D564-463c-AFF1-A69D9E530F96}] -> C:\Program Files (x86)\Google\Chrome\Application\75.0.3770.142\Installer\chrmstp.exe [2019-07-17] (Google LLC -> Google LLC)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Web Signer.lnk [2019-03-14]
ShortcutTarget: Web Signer.lnk -> C:\Program Files (x86)\Disig\Disig Web Signer 1.0.7\Updater\WebSignerTray.exe (Disig a.s. -> Disig a.s.)
BootExecute: autocheck autochk * sdnclean64.exe
GroupPolicy: Restriction - Windows Defender <==== ATTENTION

==================== Scheduled Tasks (Whitelisted) =============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

Task: {0329A4D0-5B41-43F6-98D2-6B150F1F7329} - System32\Tasks\oncIfaVdQabfxqj => rundll32 "C:\Program Files (x86)\duxVclVEU\UcXfsx.dll",#1
Task: {0E604FC0-C5ED-4EB1-A618-02490097313E} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [153168 2018-12-14] (Google Inc -> Google Inc.)
Task: {12F9930E-E1BE-461C-ABCA-E2E6871152CA} - System32\Tasks\Microsoft\Office\Office 15 Subscription Heartbeat => C:\Program Files\Common Files\Microsoft Shared\Office16\OLicenseHeartbeat.exe
Task: {224228E2-496F-4B35-B215-B3FF9554D334} - System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan => C:\ProgramData\Microsoft\Windows Defender\platform\4.18.1907.4-0\MpCmdRun.exe [469960 2019-07-27] (Microsoft Windows Publisher -> Microsoft Corporation)
Task: {2F071C61-940D-4862-A954-D5C6A19DCD93} - System32\Tasks\IntelSURQC-Upgrade-86621605-2a0b-4128-8ffc-15514c247132-Logon => C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\IntelSoftwareAssetManagerService.exe [18168 2017-07-13] (Intel(R) Software Asset Manager -> Intel Corporation)
Task: {45DE53AF-C696-4FA0-95AE-89EAE95F5CCC} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentFallBack2016 => C:\Program Files\Microsoft Office\Office16\msoia.exe [416432 2015-07-31] (Microsoft Corporation -> Microsoft Corporation)
Task: {542886ED-46CC-4922-8DDD-A49E08E230E8} - System32\Tasks\Adobe Flash Player NPAPI Notifier => C:\WINDOWS\SysWOW64\Macromed\Flash\FlashUtil32_32_0_0_223_Plugin.exe [1457208 2019-07-13] (Adobe Inc. -> Adobe)
Task: {68F13A5A-E60C-4593-BD61-7058F49F44BB} - System32\Tasks\Intel PTT EK Recertification => C:\Program Files\Intel\Intel(R) Management Engine Components\iCLS\IntelPTTEKRecertification.exe [817352 2018-06-08] (Intel(R) Trust Services -> Intel(R) Corporation)
Task: {795EC12C-6485-4A36-86D6-A7F83BC10233} - System32\Tasks\klcp_update => CodecTweakTool.exe
Task: {88583ED8-4AA6-424D-A0AF-BBD7BC423EDC} - System32\Tasks\Microsoft\Windows\Setup\EOSNotify => C:\WINDOWS\system32\EOSNotify.exe
Task: {8AC426F8-1254-4832-9F4F-26F11B75A266} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentLogOn2016 => C:\Program Files\Microsoft Office\Office16\msoia.exe [416432 2015-07-31] (Microsoft Corporation -> Microsoft Corporation)
Task: {8E897747-B370-4713-B30E-A711C911CB41} - System32\Tasks\IntelSURQC-Upgrade-86621605-2a0b-4128-8ffc-15514c247132 => C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\IntelSoftwareAssetManagerService.exe [18168 2017-07-13] (Intel(R) Software Asset Manager -> Intel Corporation)
Task: {92337728-02AC-49E0-8A2B-36D4200DED2D} - System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Cleanup => C:\ProgramData\Microsoft\Windows Defender\platform\4.18.1907.4-0\MpCmdRun.exe [469960 2019-07-27] (Microsoft Windows Publisher -> Microsoft Corporation)
Task: {A3BB6E79-8DFB-4B1D-AA6D-5033276E6CB4} - System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance => C:\ProgramData\Microsoft\Windows Defender\platform\4.18.1907.4-0\MpCmdRun.exe [469960 2019-07-27] (Microsoft Windows Publisher -> Microsoft Corporation)
Task: {A42F7ECF-99F6-403A-BDC2-9F66B6E292EB} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [153168 2018-12-14] (Google Inc -> Google Inc.)
Task: {A6B4763B-79C7-47AC-9626-B2A5FCBB500B} - System32\Tasks\USER_ESRV_SVC_QUEENCREEK => "C:\WINDOWS\System32\Wscript.exe" //B //NoLogo "C:\Program Files\Intel\SUR\QUEENCREEK\x64\task.vbs"
Task: {AC59177D-7B0B-4D2B-9F6F-8431F22EA625} - System32\Tasks\AdwCleaner_onReboot => C:/Users/*****/Desktop/adwcleaner_7.4.exe [7623880 2019-07-30] (Malwarebytes Inc -> Malwarebytes)
Task: {D6841C58-556C-4171-87B7-EF1A9825CE80} - System32\Tasks\Adobe Flash Player Updater => C:\WINDOWS\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [335416 2019-07-13] (Adobe Inc. -> Adobe)
Task: {E4E894E9-95E3-4E54-A365-EAE0909FB0A1} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [1195544 2018-12-16] (Adobe Systems, Incorporated -> Adobe Systems Incorporated)
Task: {EBE5BDCE-1F19-4D36-BFDF-01F8DBD1A58F} - System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Verification => C:\ProgramData\Microsoft\Windows Defender\platform\4.18.1907.4-0\MpCmdRun.exe [469960 2019-07-27] (Microsoft Windows Publisher -> Microsoft Corporation)
Task: {FAC763BD-75EC-454E-8B60-3797854559A6} - System32\Tasks\IUM-F1E24CA0-B63E-4F13-A9E3-4ADE3BFF3473 => C:\Program Files (x86)\Intel\Intel(R) Update Manager\bin\iumsvc.exe

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

Task: C:\WINDOWS\Tasks\oncIfaVdQabfxqj.job => C:\Program Files (x86)\duxVclVEU\UcXfsx.dll

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Tcpip\Parameters: [DhcpNameServer] 192.168.1.1 195.146.128.62
Tcpip\..\Interfaces\{da384fb4-1e59-48fc-bfe0-c27ce005f778}: [DhcpNameServer] 192.168.1.1 195.146.128.62

Internet Explorer:
==================
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxps://go.microsoft.com/fwlink/p/?LinkId=255141
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxps://go.microsoft.com/fwlink/p/?LinkId=255141
HKU\S-1-5-21-1960842775-2088100534-3542962694-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxps://go.microsoft.com/fwlink/p/?LinkId=619797&pc=UE03&ocid=UE03DHP
HKU\S-1-5-21-1960842775-2088100534-3542962694-1002\Software\Microsoft\Internet Explorer\Main,Start Page = hxxps://go.microsoft.com/fwlink/p/?LinkId=619797&pc=UE03&ocid=UE03DHP
SearchScopes: HKU\S-1-5-21-1960842775-2088100534-3542962694-1001 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxps://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IESR02&pc=UE04
SearchScopes: HKU\S-1-5-21-1960842775-2088100534-3542962694-1001 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxps://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IESR02&pc=UE04
SearchScopes: HKU\S-1-5-21-1960842775-2088100534-3542962694-1002 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxps://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IESR02&pc=UE04
SearchScopes: HKU\S-1-5-21-1960842775-2088100534-3542962694-1002 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxps://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IESR02&pc=UE04
BHO: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office\Office16\OCHelper.dll [2015-07-31] (Microsoft Corporation -> Microsoft Corporation)
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_211\bin\ssv.dll [2019-05-24] (Oracle America, Inc. -> Oracle Corporation)
BHO: Microsoft OneDrive for Business Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office\Office16\GROOVEEX.DLL [2015-07-31] (Microsoft Corporation -> Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_211\bin\jp2ssv.dll [2019-05-24] (Oracle America, Inc. -> Oracle Corporation)
BHO-x32: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files (x86)\Microsoft Office\Office16\OCHelper.dll [2015-07-31] (Microsoft Corporation -> Microsoft Corporation)
BHO-x32: Microsoft OneDrive for Business Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files (x86)\Microsoft Office\Office16\GROOVEEX.DLL [2015-07-31] (Microsoft Corporation -> Microsoft Corporation)
Handler-x32: mso-minsb.16 - {3459B272-CC19-4448-86C9-DDC3B4B2FAD3} - C:\Program Files (x86)\Microsoft Office\Office16\MSOSB.DLL [2015-07-31] (Microsoft Corporation -> Microsoft Corporation)
Handler-x32: osf.16 - {5504BE45-A83B-4808-900A-3A5C36E7F77A} - C:\Program Files (x86)\Microsoft Office\Office16\MSOSB.DLL [2015-07-31] (Microsoft Corporation -> Microsoft Corporation)

FireFox:
========
FF DefaultProfile: bt6jbw3e.default
FF ProfilePath: C:\Users\**\AppData\Roaming\Mozilla\Firefox\Profiles\bt6jbw3e.default [2019-07-31]
FF Homepage: Mozilla\Firefox\Profiles\bt6jbw3e.default -> hxxps://www.google.sk/
FF Extension: (Adblock Plus - kostenloser Adblocker) - C:\Users\**\AppData\Roaming\Mozilla\Firefox\Profiles\bt6jbw3e.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2019-04-21]
FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF64_32_0_0_223.dll [2019-07-13] (Adobe Inc. -> )
FF Plugin: @java.com/DTPlugin,version=11.211.2 -> C:\Program Files\Java\jre1.8.0_211\bin\dtplugin\npDeployJava1.dll [2019-05-24] (Oracle America, Inc. -> Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=11.211.2 -> C:\Program Files\Java\jre1.8.0_211\bin\plugin2\npjp2.dll [2019-05-24] (Oracle America, Inc. -> Oracle Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_32_0_0_223.dll [2019-07-13] (Adobe Inc. -> )
FF Plugin-x32: @google.com/zxwebplugin -> C:\WINDOWS\system32\npzxwebplugin.dll [No File]
FF Plugin-x32: @microsoft.com/Lync,version=15.0 -> C:\Program Files (x86)\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll [2015-07-31] (Microsoft Corporation -> Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office16\NPSPWRAP.DLL [2015-07-31] (Microsoft Corporation -> Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.34.11\npGoogleUpdate3.dll [2019-05-15] (Google Inc -> Google LLC)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.34.11\npGoogleUpdate3.dll [2019-05-15] (Google Inc -> Google LLC)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2019-05-03] (Adobe Inc. -> Adobe Systems Inc.)
FF Plugin-x32: ditec.sk/DAsicFac -> C:\PROGRA~2\Ditec\DSIGNE~2.NET\NPDITE~1.DLL [2019-01-14] (DITEC, a.s. -> Ditec,a.s.)
FF Plugin-x32: ditec.sk/DitecZepDViewerFb -> C:\PROGRA~2\Ditec\DViewer\NPDITE~1.DLL [2019-01-15] (DITEC, a.s. -> Ditec, a.s.)
FF Plugin-x32: ditec.sk/DSigMessageContainer -> C:\PROGRA~2\Ditec\DSIGNE~2.NET\NPDITE~2.DLL [2016-12-15] (DITEC, a.s. -> Ditec, a.s.)
FF Plugin-x32: ditec.sk/DSigXadesExtender -> C:\PROGRA~2\Ditec\DSIGNE~2.NET\NPDITE~3.DLL [2016-12-15] (DITEC, a.s. -> Ditec, a.s.)
FF Plugin-x32: ditec.sk/DSigXadesFb -> C:\PROGRA~2\Ditec\DSIGNE~1.NET\NPDITE~1.DLL [2019-01-15] (DITEC, a.s. -> Ditec,a.s.)
FF Plugin-x32: ditec.sk/XmlDataContainerFb -> C:\PROGRA~2\Ditec\DSIGNE~1.NET\NPDITE~2.DLL [2019-01-15] (DITEC, a.s. -> Ditec,a.s.)
FF Plugin HKU\S-1-5-21-1960842775-2088100534-3542962694-1002: ditec.sk/DitecZepDViewerFb -> C:\ProgramData\Ditec\DViewer\npDitec.Zep.DViewerFb.dll [No File]
FF Plugin HKU\S-1-5-21-1960842775-2088100534-3542962694-1002: ditec.sk/DSigXadesExtenderFb -> C:\Program Files (x86)\Ditec\DSigXadesExtender\npDitec.Zep.DSigXadesExtenderFb.dll [No File]
FF Plugin HKU\S-1-5-21-1960842775-2088100534-3542962694-1002: ditec.sk/DSigXadesFb -> C:\Program Files (x86)\Ditec\DSigXades\npDitec.Zep.DSigXadesFb.dll [No File]

Chrome: 
=======
CHR HomePage: Default -> hxxps://www.google.com/
CHR Profile: C:\Users\**\AppData\Local\Google\Chrome\User Data\Default [2019-07-31]
CHR Extension: (Präsentationen) - C:\Users\**\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2018-12-14]
CHR Extension: (Docs) - C:\Users\**\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2018-12-14]
CHR Extension: (Google Drive) - C:\Users\**\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2018-12-14]
CHR Extension: (YouTube) - C:\Users\**\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2018-12-14]
CHR Extension: (Adobe Acrobat) - C:\Users\**\AppData\Local\Google\Chrome\User Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj [2019-06-21]
CHR Extension: (Tabellen) - C:\Users\**\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2018-12-14]
CHR Extension: (Google Docs Offline) - C:\Users\**\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2018-12-14]
CHR Extension: (Chrome Web Store-Zahlungen) - C:\Users\**\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2018-12-14]
CHR Extension: (Disig Web Signer 1.0.7) - C:\Users\**\AppData\Local\Google\Chrome\User Data\Default\Extensions\odbdbcaekkgabdfaabepfjgiooilmaoe [2019-03-15]
CHR Extension: (Google Mail) - C:\Users\**\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2019-04-23]
CHR Extension: (Chrome Media Router) - C:\Users\**\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2019-07-31]
CHR HKLM-x32\...\Chrome\Extension: [efaidnbmnnnibpcajpcglclefindmkaj] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [odbdbcaekkgabdfaabepfjgiooilmaoe] - hxxps://clients2.google.com/service/update2/crx

==================== Services (Whitelisted) ====================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

S2 dLauncherLoopback; C:\Program Files (x86)\Ditec\DLauncher\dLauncherLoopback.exe [156984 2017-09-29] (DITEC, a.s. -> )
R2 DSAService; C:\Program Files (x86)\Intel\Driver and Support Assistant\DSAService.exe [26984 2019-07-25] (IDSA Production signing key -> Intel)
R3 DSAUpdateService; C:\Program Files (x86)\Intel\Driver and Support Assistant\DSAUpdateService.exe [80744 2019-07-25] (IDSA Production signing key -> Intel)
S2 ESRV_SVC_QUEENCREEK; C:\Program Files\Intel\SUR\QUEENCREEK\x64\esrv_svc.exe [937208 2018-12-19] (Intel(R) Software Development Products -> )
S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\Intel(R) Management Engine Components\iCLS\SocketHeciServer.exe [762568 2018-06-08] (Intel(R) Trust Services -> Intel(R) Corporation)
S3 Intel(R) SUR QC SAM; C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\IntelSoftwareAssetManagerService.exe [18168 2017-07-13] (Intel(R) Software Asset Manager -> Intel Corporation)
R2 Intel(R) TPM Provisioning Service; C:\Program Files\Intel\Intel(R) Management Engine Components\iCLS\TPMProvisioningService.exe [714952 2018-06-08] (Intel(R) Trust Services -> Intel(R) Corporation)
S2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [218176 2018-08-03] (Intel(R) Embedded Subsystems and IP Blocks Group -> Intel Corporation)
R2 MBAMService; C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe [6744288 2019-06-26] (Malwarebytes Corporation -> Malwarebytes)
S3 Sense; C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe [5073792 2019-07-04] (Microsoft Windows Publisher -> Microsoft Corporation)
R2 SystemUsageReportSvc_QUEENCREEK; C:\Program Files\Intel\SUR\QUEENCREEK\SurSvc.exe [195832 2018-12-19] (Intel(R) Software Development Products -> )
S3 USER_ESRV_SVC_QUEENCREEK; C:\Program Files\Intel\SUR\QUEENCREEK\x64\esrv_svc.exe [937208 2018-12-19] (Intel(R) Software Development Products -> )
R3 WdNisSvc; C:\ProgramData\Microsoft\Windows Defender\platform\4.18.1907.4-0\NisSrv.exe [2552416 2019-07-27] (Microsoft Windows Publisher -> Microsoft Corporation)
R2 WinDefend; C:\ProgramData\Microsoft\Windows Defender\platform\4.18.1907.4-0\MsMpEng.exe [108832 2019-07-27] (Microsoft Windows Publisher -> Microsoft Corporation)

===================== Drivers (Whitelisted) ======================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

S3 GemCCID; C:\WINDOWS\System32\drivers\GemCCID.sys [137712 2016-10-17] (Microsoft Windows Hardware Compatibility Publisher -> Gemalto)
R3 MBAMSwissArmy; C:\WINDOWS\System32\Drivers\mbamswissarmy.sys [275232 2019-07-31] (Malwarebytes Corporation -> Malwarebytes)
R3 rt640x64; C:\WINDOWS\System32\drivers\rt640x64.sys [1122200 2018-12-14] (Realtek Semiconductor Corp. -> Realtek )
S3 semav6msr64; C:\WINDOWS\system32\drivers\semav6msr64.sys [43008 2018-12-19] (Intel Corporation -> )
R3 tap0901; C:\WINDOWS\System32\drivers\tap0901.sys [27136 2016-04-21] (OpenVPN Technologies, Inc. -> The OpenVPN Project)
S0 WdBoot; C:\WINDOWS\System32\drivers\wd\WdBoot.sys [47496 2019-07-27] (Microsoft Windows Early Launch Anti-Malware Publisher -> Microsoft Corporation)
R0 WdFilter; C:\WINDOWS\System32\drivers\wd\WdFilter.sys [344288 2019-07-27] (Microsoft Windows -> Microsoft Corporation)
R3 WdNisDrv; C:\WINDOWS\System32\drivers\wd\WdNisDrv.sys [54496 2019-07-27] (Microsoft Windows -> Microsoft Corporation)

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== One month (created) ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2019-07-31 22:47 - 2019-07-31 22:47 - 000275232 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mbamswissarmy.sys
2019-07-31 22:45 - 2019-07-31 22:48 - 000024656 _____ C:\Users\*****\Desktop\FRST.txt
2019-07-31 22:38 - 2019-07-31 22:48 - 000020597 _____ C:\Users\*****\Desktop\Fixlog.txt
2019-07-31 22:37 - 2019-07-31 22:37 - 000000000 ____D C:\Users\*****\Desktop\Trojaner
2019-07-31 20:57 - 2019-07-31 20:57 - 000003893 _____ C:\Users\**\Desktop\AdwCleaner[S00].txt
2019-07-31 20:57 - 2019-07-31 20:57 - 000001610 _____ C:\Users\**\Desktop\AdwCleaner[S02].txt
2019-07-31 20:57 - 2019-07-31 20:57 - 000001447 _____ C:\Users\**\Desktop\AdwCleaner[S01].txt
2019-07-31 20:34 - 2019-07-31 20:34 - 007316688 _____ (Malwarebytes) C:\Users\*****\Downloads\adwcleaner-7-2-7.exe
2019-07-31 20:12 - 2019-07-31 20:12 - 000000000 ____D C:\Users\*****\AppData\LocalLow\VYeRfUFKkRVtG
2019-07-31 20:01 - 2019-07-31 20:01 - 000000000 ____D C:\Users\*****\Desktop\FRST-OlderVersion
2019-07-31 20:01 - 2019-07-31 20:01 - 000000000 ____D C:\Users\*****\AppData\Local\PeerDistRepub
2019-07-31 19:13 - 2019-07-31 19:13 - 000000085 _____ C:\WINDOWS\wininit.ini
2019-07-31 19:11 - 2019-07-31 19:11 - 000000306 __RSH C:\Users\*****\ntuser.pol
2019-07-31 19:10 - 2019-07-31 19:10 - 000003166 _____ C:\WINDOWS\System32\Tasks\AdwCleaner_onReboot
2019-07-31 19:08 - 2019-07-31 19:11 - 000000330 _____ C:\WINDOWS\Tasks\oncIfaVdQabfxqj.job
2019-07-31 19:08 - 2019-07-31 19:08 - 000002708 __RSH C:\ProgramData\ntuser.pol
2019-07-31 19:08 - 2019-07-31 19:08 - 000002650 _____ C:\WINDOWS\System32\Tasks\oncIfaVdQabfxqj
2019-07-31 19:08 - 2019-07-31 19:08 - 000000000 ____D C:\Program Files (x86)\minXQDMZbIE
2019-07-31 19:08 - 2019-07-31 19:08 - 000000000 ____D C:\Program Files (x86)\hhaccViKlMUn
2019-07-31 19:08 - 2019-07-31 19:08 - 000000000 ____D C:\Program Files (x86)\duxVclVEU
2019-07-30 22:25 - 2019-07-30 22:25 - 000000000 ____D C:\Users\**\AppData\Local\mbamtray
2019-07-30 22:11 - 2019-07-30 22:11 - 000000000 ____D C:\Users\*****\AppData\Roaming\Sun
2019-07-30 22:11 - 2019-07-30 22:11 - 000000000 ____D C:\Users\*****\AppData\LocalLow\Sun
2019-07-30 22:00 - 2019-07-31 22:48 - 000000000 ____D C:\FRST
2019-07-30 21:47 - 2019-07-31 20:01 - 002096128 _____ (Farbar) C:\Users\*****\Desktop\FRST64.exe
2019-07-30 21:11 - 2019-07-30 21:11 - 000001912 _____ C:\Users\Public\Desktop\Malwarebytes.lnk
2019-07-30 21:11 - 2019-07-30 21:11 - 000000000 ____D C:\Users\*****\AppData\Local\mbamtray
2019-07-30 21:11 - 2019-07-30 21:11 - 000000000 ____D C:\Users\*****\AppData\Local\mbam
2019-07-30 21:11 - 2019-07-30 21:11 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes
2019-07-30 21:11 - 2019-01-08 16:32 - 000153328 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mbae64.sys
2019-07-30 21:10 - 2019-07-30 21:10 - 000000000 ____D C:\ProgramData\Malwarebytes
2019-07-30 21:10 - 2019-07-30 21:10 - 000000000 ____D C:\Program Files\Malwarebytes
2019-07-30 21:09 - 2019-07-30 21:09 - 000000000 ____D C:\WINDOWS\pss
2019-07-30 20:49 - 2019-07-30 20:49 - 000388992 _____ C:\Users\*****\Desktop\bookmarksJ.html
2019-07-30 20:47 - 2019-07-30 20:47 - 000051801 _____ C:\Users\**\Desktop\bookmarksL.html
2019-07-30 20:26 - 2019-07-30 20:27 - 000000000 ____D C:\AdwCleaner
2019-07-30 20:24 - 2019-07-30 20:25 - 007623880 _____ (Malwarebytes) C:\Users\*****\Desktop\adwcleaner_7.4.exe
2019-07-30 20:15 - 2019-07-30 20:15 - 000000000 ____D C:\Users\*****\AppData\Local\D3DSCache
2019-07-30 20:04 - 2019-07-31 19:14 - 000000000 ____D C:\Program Files (x86)\Spybot - Search & Destroy 2
2019-07-30 20:04 - 2019-07-31 19:13 - 000000000 ____D C:\ProgramData\Spybot - Search & Destroy
2019-07-30 20:04 - 2019-07-30 20:04 - 000000000 ____D C:\WINDOWS\System32\Tasks\Safer-Networking
2019-07-27 14:10 - 2019-07-27 14:10 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Intel
2019-07-27 12:14 - 2019-07-27 12:15 - 000000000 ____D C:\Users\**\Desktop\SAP-USB
2019-07-27 12:12 - 2019-07-27 12:12 - 001680991 _____ C:\Users\**\Desktop\mssstool0221.zip
2019-07-27 12:01 - 2019-07-31 22:47 - 094896128 _____ C:\WINDOWS\system32\config\SOFTWARE
2019-07-27 11:52 - 2019-07-27 12:01 - 000000000 ____D C:\WINDOWS\Microsoft Antimalware
2019-07-25 01:04 - 2019-07-25 01:04 - 000000000 ____D C:\ProgramData\TmpLoog
2019-07-25 00:44 - 2019-07-25 00:44 - 000000000 ____D C:\Users\**\AppData\LocalLow\lltgznTbqqOCq
2019-07-24 23:11 - 2019-07-24 23:11 - 000000000 ____D C:\Users\**\AppData\Roaming\WinRAR
2019-07-24 23:11 - 2019-07-24 23:11 - 000000000 ____D C:\Users\**\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR
2019-07-24 23:11 - 2019-07-24 23:11 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinRAR
2019-07-24 23:11 - 2019-07-24 23:11 - 000000000 ____D C:\Program Files (x86)\WinRAR
2019-07-24 23:10 - 2019-07-24 23:10 - 002918616 _____ (Alexander Roshal) C:\Users\**\Downloads\wrar571.exe
2019-07-24 23:05 - 2019-07-24 23:05 - 000147094 _____ C:\Users\**\Downloads\SilentPatchSA.zip
2019-07-24 23:04 - 2019-07-24 23:04 - 000039315 _____ C:\Users\**\Downloads\asiloader.rar
2019-07-24 23:00 - 2019-07-24 23:20 - 000000000 ____D C:\Users\**\Documents\GTA San Andreas User Files
2019-07-24 23:00 - 2008-10-15 06:22 - 005631312 _____ (Microsoft Corporation) C:\WINDOWS\system32\D3DX9_40.dll
2019-07-24 23:00 - 2008-10-15 06:22 - 004379984 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\D3DX9_40.dll
2019-07-24 23:00 - 2008-10-15 06:22 - 002605920 _____ (Microsoft Corporation) C:\WINDOWS\system32\D3DCompiler_40.dll
2019-07-24 23:00 - 2008-10-15 06:22 - 002036576 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\D3DCompiler_40.dll
2019-07-24 23:00 - 2008-10-15 06:22 - 000519000 _____ (Microsoft Corporation) C:\WINDOWS\system32\d3dx10_40.dll
2019-07-24 23:00 - 2008-10-15 06:22 - 000452440 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d3dx10_40.dll
2019-07-24 21:13 - 2019-07-24 21:13 - 000001315 _____ C:\Users\Public\Desktop\Age of Empires - The Rise of Rome color fix.lnk
2019-07-24 21:13 - 2019-07-24 21:13 - 000001306 _____ C:\Users\Public\Desktop\Age of Empires color fix.lnk
2019-07-24 21:13 - 2019-07-24 21:13 - 000001185 _____ C:\Users\Public\Desktop\Age of Empires - The Rise of Rome.lnk
2019-07-24 21:13 - 2019-07-24 21:13 - 000001178 _____ C:\Users\Public\Desktop\Age of Empires.lnk
2019-07-24 21:13 - 2019-07-24 21:13 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Age of Empires complete
2019-07-24 21:13 - 2019-07-24 21:13 - 000000000 ____D C:\Program Files (x86)\Age of Empires complete
2019-07-24 19:25 - 2019-07-24 19:25 - 000000221 _____ C:\Users\**\Desktop\Grand Theft Auto San Andreas.url
2019-07-24 19:25 - 2019-07-24 19:25 - 000000000 ____D C:\Users\**\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Steam
2019-07-24 19:23 - 2019-07-25 01:01 - 000000000 ____D C:\Program Files\Mozilla Firefox
2019-07-24 19:20 - 2019-07-24 19:20 - 000000000 ____D C:\Users\**\AppData\Local\Steam
2019-07-24 19:20 - 2019-07-24 19:20 - 000000000 ____D C:\Users\**\AppData\Local\CEF
2019-07-24 19:11 - 2019-07-24 19:11 - 001573568 _____ C:\Users\**\Downloads\SteamSetup.exe
2019-07-24 19:11 - 2019-07-24 19:11 - 000001036 _____ C:\Users\Public\Desktop\Steam.lnk
2019-07-24 19:11 - 2019-07-24 19:11 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Steam
2019-07-13 17:03 - 2019-07-13 17:03 - 000004590 _____ C:\WINDOWS\System32\Tasks\Adobe Flash Player NPAPI Notifier
2019-07-13 17:03 - 2019-07-13 17:03 - 000004424 _____ C:\WINDOWS\System32\Tasks\Adobe Flash Player Updater
2019-07-13 16:59 - 2019-07-13 16:59 - 000716789 _____ C:\WINDOWS\SysWOW64\unins000.exe
2019-07-13 16:59 - 2019-07-13 16:59 - 000001770 _____ C:\WINDOWS\SysWOW64\unins000.dat
2019-07-13 16:59 - 2019-04-10 14:55 - 000290816 _____ (www.xjghost.com) C:\WINDOWS\SysWOW64\WebClientPlayBack.ocx
2019-07-13 16:59 - 2019-04-10 14:45 - 000229484 _____ () C:\WINDOWS\SysWOW64\WebClientPlus.ocx
2019-07-13 16:59 - 2019-03-29 09:22 - 000004240 _____ C:\WINDOWS\SysWOW64\lang_spanish.ini
2019-07-13 16:59 - 2019-03-29 09:16 - 000004250 _____ C:\WINDOWS\SysWOW64\lang_italy.ini
2019-07-13 16:59 - 2019-03-29 09:12 - 000004624 _____ C:\WINDOWS\SysWOW64\lang_franch.ini
2019-07-13 16:59 - 2019-03-29 09:09 - 000004404 _____ C:\WINDOWS\SysWOW64\lang_germany.ini
2019-07-13 16:59 - 2019-03-28 10:33 - 000002698 _____ C:\WINDOWS\SysWOW64\lang_chn.ini
2019-07-13 16:59 - 2019-01-11 16:02 - 000245760 _____ () C:\WINDOWS\SysWOW64\NetLib.dll
2019-07-13 16:59 - 2019-01-11 15:55 - 000081920 _____ () C:\WINDOWS\SysWOW64\hiPBClient.dll
2019-07-13 16:59 - 2018-11-12 18:10 - 000417792 _____ () C:\WINDOWS\SysWOW64\HIPlayer.dll
2019-07-13 16:59 - 2018-11-07 11:26 - 000319488 _____ () C:\WINDOWS\SysWOW64\HIPlayer.exe
2019-07-13 16:59 - 2018-11-07 10:38 - 000057344 _____ () C:\WINDOWS\SysWOW64\HISDK.dll
2019-07-13 16:59 - 2018-11-07 09:57 - 000573952 _____ C:\WINDOWS\SysWOW64\Hi265.dll
2019-07-13 16:59 - 2014-04-10 14:28 - 000057344 _____ (微软中国) C:\WINDOWS\SysWOW64\SearchLib.dll
2019-07-13 16:59 - 2013-07-10 17:21 - 000217600 _____ C:\WINDOWS\SysWOW64\npzxwebplugin.dll
2019-07-13 16:59 - 2012-09-25 21:39 - 002555406 _____ C:\WINDOWS\SysWOW64\avcodec-54.dll
2019-07-13 16:59 - 2012-09-25 21:39 - 000157198 _____ C:\WINDOWS\SysWOW64\avutil-51.dll
2019-07-13 16:59 - 2010-08-23 20:07 - 000562220 _____ C:\WINDOWS\SysWOW64\AlarmSound.wav
2019-07-13 16:58 - 2019-07-13 16:58 - 002036967 _____ ( ) C:\Users\*****\Desktop\ClientPlus_Setup.exe
2019-07-13 16:47 - 2019-07-13 16:47 - 000001906 _____ C:\Users\*****\Desktop\HiPlayer.exe.lnk
2019-07-13 16:47 - 2019-07-13 16:47 - 000000000 ____D C:\Users\*****\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\HiPlayer
2019-07-13 16:47 - 2019-07-13 16:47 - 000000000 ____D C:\Users\*****\AppData\Roaming\HiPlayer
2019-07-09 19:25 - 2019-07-04 11:40 - 021390504 _____ (Microsoft Corporation) C:\WINDOWS\system32\shell32.dll
2019-07-09 19:25 - 2019-07-04 11:40 - 001616840 _____ (Microsoft Corporation) C:\WINDOWS\system32\sppobjs.dll
2019-07-09 19:25 - 2019-07-04 11:18 - 003614208 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32kfull.sys
2019-07-09 19:25 - 2019-07-04 10:51 - 020384128 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\shell32.dll
2019-07-09 19:25 - 2019-07-04 10:37 - 002882048 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\win32kfull.sys
2019-07-09 19:25 - 2019-07-04 07:00 - 001035040 _____ (Microsoft Corporation) C:\WINDOWS\system32\ApplyTrustOffline.exe
2019-07-09 19:25 - 2019-07-04 06:58 - 001219896 _____ (Microsoft Corporation) C:\WINDOWS\system32\hvix64.exe
2019-07-09 19:25 - 2019-07-04 06:57 - 003292152 _____ (Microsoft Corporation) C:\WINDOWS\system32\combase.dll
2019-07-09 19:25 - 2019-07-04 06:56 - 009084216 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntoskrnl.exe
2019-07-09 19:25 - 2019-07-04 06:56 - 007519896 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.Protection.PlayReady.dll
2019-07-09 19:25 - 2019-07-04 06:56 - 007436536 _____ (Microsoft Corporation) C:\WINDOWS\system32\windows.storage.dll
2019-07-09 19:25 - 2019-07-04 06:56 - 002810680 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgkrnl.sys
2019-07-09 19:25 - 2019-07-04 06:42 - 006570368 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.Protection.PlayReady.dll
2019-07-09 19:25 - 2019-07-04 06:42 - 006044008 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\windows.storage.dll
2019-07-09 19:25 - 2019-07-04 06:42 - 002479176 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\combase.dll
2019-07-09 19:25 - 2019-07-04 06:37 - 025857536 _____ (Microsoft Corporation) C:\WINDOWS\system32\edgehtml.dll
2019-07-09 19:25 - 2019-07-04 06:33 - 022017536 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\edgehtml.dll
2019-07-09 19:25 - 2019-07-04 06:29 - 022717440 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll
2019-07-09 19:25 - 2019-07-04 06:26 - 004385280 _____ (Microsoft Corporation) C:\WINDOWS\system32\EdgeContent.dll
2019-07-09 19:25 - 2019-07-04 06:25 - 019372544 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll
2019-07-09 19:25 - 2019-07-04 06:25 - 007589888 _____ (Microsoft Corporation) C:\WINDOWS\system32\Chakra.dll
2019-07-09 19:25 - 2019-07-04 06:25 - 004861440 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll
2019-07-09 19:25 - 2019-07-04 06:25 - 003401216 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentServer.dll
2019-07-09 19:25 - 2019-07-04 06:22 - 003707904 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll
2019-07-09 19:25 - 2019-07-04 06:21 - 005784064 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Chakra.dll
2019-07-09 19:25 - 2019-07-04 06:21 - 003202560 _____ (Microsoft Corporation) C:\WINDOWS\system32\DWrite.dll
2019-07-09 19:25 - 2019-06-13 14:12 - 002871848 _____ (Microsoft Corporation) C:\WINDOWS\system32\aitstatic.exe
2019-07-09 19:25 - 2019-06-13 14:05 - 000810296 _____ (Microsoft Corporation) C:\WINDOWS\system32\generaltel.dll
2019-07-09 19:25 - 2019-06-13 14:04 - 001721144 _____ (Microsoft Corporation) C:\WINDOWS\system32\appraiser.dll
2019-07-09 19:25 - 2019-06-13 13:59 - 000740664 _____ (Microsoft Corporation) C:\WINDOWS\system32\aeinv.dll
2019-07-09 19:25 - 2019-06-13 13:42 - 004038688 _____ (Microsoft Corporation) C:\WINDOWS\explorer.exe
2019-07-09 19:25 - 2019-06-13 13:18 - 006586880 _____ (Microsoft Corporation) C:\WINDOWS\system32\twinui.dll
2019-07-09 19:25 - 2019-06-13 13:18 - 004847104 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingsHandlers_nt.dll
2019-07-09 19:25 - 2019-06-13 13:17 - 012756992 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll
2019-07-09 19:25 - 2019-06-13 13:15 - 004718080 _____ (Microsoft Corporation) C:\WINDOWS\system32\twinui.pcshell.dll
2019-07-09 19:25 - 2019-06-13 13:13 - 002920448 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Logon.dll
2019-07-09 19:25 - 2019-06-13 12:11 - 001539896 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AppVEntSubsystems32.dll
2019-07-09 19:25 - 2019-06-13 12:05 - 003700160 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\explorer.exe
2019-07-09 19:25 - 2019-06-13 11:55 - 005657088 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\twinui.dll
2019-07-09 19:25 - 2019-06-13 11:54 - 011942912 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll
2019-07-09 19:25 - 2019-06-13 09:01 - 000513336 _____ (Microsoft Corporation) C:\WINDOWS\system32\aepic.dll
2019-07-09 19:25 - 2019-06-13 08:47 - 005625160 _____ (Microsoft Corporation) C:\WINDOWS\system32\StartTileData.dll
2019-07-09 19:25 - 2019-06-13 08:44 - 002769688 _____ (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll
2019-07-09 19:25 - 2019-06-13 08:14 - 003318784 _____ (Microsoft Corporation) C:\WINDOWS\system32\dwmcore.dll
2019-07-09 19:25 - 2019-06-13 08:13 - 004771840 _____ (Microsoft Corporation) C:\WINDOWS\system32\InputService.dll
2019-07-09 19:25 - 2019-06-13 07:14 - 000415544 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\aepic.dll
2019-07-09 19:25 - 2019-06-13 07:06 - 002256768 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iertutil.dll
2019-07-09 19:24 - 2019-07-04 11:45 - 001786680 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVEntVirtualization.dll
2019-07-09 19:24 - 2019-07-04 11:43 - 000094008 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpudd.dll
2019-07-09 19:24 - 2019-07-04 11:41 - 000304144 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\mssecflt.sys
2019-07-09 19:24 - 2019-07-04 11:40 - 001631808 _____ (Microsoft Corporation) C:\WINDOWS\system32\gdi32full.dll
2019-07-09 19:24 - 2019-07-04 11:40 - 000790416 _____ (Microsoft Corporation) C:\WINDOWS\system32\fontdrvhost.exe
2019-07-09 19:24 - 2019-07-04 11:22 - 000131072 _____ (Microsoft Corporation) C:\WINDOWS\splwow64.exe
2019-07-09 19:24 - 2019-07-04 11:22 - 000128000 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppxSysprep.dll
2019-07-09 19:24 - 2019-07-04 11:21 - 008627200 _____ (Microsoft Corporation) C:\WINDOWS\system32\mstscax.dll
2019-07-09 19:24 - 2019-07-04 11:20 - 001609216 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpcorets.dll
2019-07-09 19:24 - 2019-07-04 11:19 - 000420864 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpclip.exe
2019-07-09 19:24 - 2019-07-04 11:18 - 001663488 _____ (Microsoft Corporation) C:\WINDOWS\system32\GdiPlus.dll
2019-07-09 19:24 - 2019-07-04 10:56 - 001453416 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\gdi32full.dll
2019-07-09 19:24 - 2019-07-04 10:54 - 000662352 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\fontdrvhost.exe
2019-07-09 19:24 - 2019-07-04 10:41 - 007990784 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mstscax.dll
2019-07-09 19:24 - 2019-07-04 10:36 - 001471488 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\GdiPlus.dll
2019-07-09 19:24 - 2019-07-04 06:58 - 001328440 _____ (Microsoft Corporation) C:\WINDOWS\system32\wpx.dll
2019-07-09 19:24 - 2019-07-04 06:58 - 000416312 _____ (Microsoft Corporation) C:\WINDOWS\system32\wlanapi.dll
2019-07-09 19:24 - 2019-07-04 06:58 - 000192824 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\appid.sys
2019-07-09 19:24 - 2019-07-04 06:57 - 001027384 _____ (Microsoft Corporation) C:\WINDOWS\system32\hvax64.exe
2019-07-09 19:24 - 2019-07-04 06:57 - 000986128 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingSyncHost.exe
2019-07-09 19:24 - 2019-07-04 06:57 - 000776784 _____ (Microsoft Corporation) C:\WINDOWS\system32\wer.dll
2019-07-09 19:24 - 2019-07-04 06:57 - 000723728 _____ (Microsoft Corporation) C:\WINDOWS\system32\ci.dll
2019-07-09 19:24 - 2019-07-04 06:57 - 000708696 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\cng.sys
2019-07-09 19:24 - 2019-07-04 06:57 - 000568104 _____ (Microsoft Corporation) C:\WINDOWS\system32\tcblaunch.exe
2019-07-09 19:24 - 2019-07-04 06:57 - 000362264 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Storage.ApplicationData.dll
2019-07-09 19:24 - 2019-07-04 06:57 - 000209424 _____ (Microsoft Corporation) C:\WINDOWS\system32\wermgr.exe
2019-07-09 19:24 - 2019-07-04 06:57 - 000194360 _____ (Microsoft Corporation) C:\WINDOWS\system32\skci.dll
2019-07-09 19:24 - 2019-07-04 06:57 - 000137656 _____ (Microsoft Corporation) C:\WINDOWS\system32\bcrypt.dll
2019-07-09 19:24 - 2019-07-04 06:57 - 000134968 _____ (Microsoft Corporation) C:\WINDOWS\system32\hvloader.dll
2019-07-09 19:24 - 2019-07-04 06:57 - 000091776 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dumpfve.sys
2019-07-09 19:24 - 2019-07-04 06:56 - 002571640 _____ (Microsoft Corporation) C:\WINDOWS\system32\KernelBase.dll
2019-07-09 19:24 - 2019-07-04 06:56 - 001566520 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppxPackaging.dll
2019-07-09 19:24 - 2019-07-04 06:56 - 001459120 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.efi
2019-07-09 19:24 - 2019-07-04 06:56 - 001260776 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.exe
2019-07-09 19:24 - 2019-07-04 06:56 - 001141496 _____ (Microsoft Corporation) C:\WINDOWS\system32\winresume.efi
2019-07-09 19:24 - 2019-07-04 06:56 - 000983936 _____ (Microsoft Corporation) C:\WINDOWS\system32\winresume.exe
2019-07-09 19:24 - 2019-07-04 06:56 - 000767536 _____ (Microsoft Corporation) C:\WINDOWS\system32\dnsapi.dll
2019-07-09 19:24 - 2019-07-04 06:56 - 000734952 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentClient.dll
2019-07-09 19:24 - 2019-07-04 06:56 - 000713272 _____ (Microsoft Corporation) C:\WINDOWS\system32\MSVideoDSP.dll
2019-07-09 19:24 - 2019-07-04 06:56 - 000604984 _____ (Microsoft Corporation) C:\WINDOWS\system32\securekernel.exe
2019-07-09 19:24 - 2019-07-04 06:56 - 000493752 _____ (Microsoft Corporation) C:\WINDOWS\system32\bcryptprimitives.dll
2019-07-09 19:24 - 2019-07-04 06:56 - 000115512 _____ (Microsoft Corporation) C:\WINDOWS\system32\kdnet.dll
2019-07-09 19:24 - 2019-07-04 06:43 - 000832016 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SettingSyncHost.exe
2019-07-09 19:24 - 2019-07-04 06:43 - 000665440 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wer.dll
2019-07-09 19:24 - 2019-07-04 06:43 - 000328696 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wlanapi.dll
2019-07-09 19:24 - 2019-07-04 06:43 - 000287376 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Storage.ApplicationData.dll
2019-07-09 19:24 - 2019-07-04 06:43 - 000191800 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wermgr.exe
2019-07-09 19:24 - 2019-07-04 06:42 - 001980984 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\KernelBase.dll
2019-07-09 19:24 - 2019-07-04 06:42 - 001427768 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AppxPackaging.dll
2019-07-09 19:24 - 2019-07-04 06:42 - 000573808 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dnsapi.dll
2019-07-09 19:24 - 2019-07-04 06:42 - 000356312 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\bcryptprimitives.dll
2019-07-09 19:24 - 2019-07-04 06:42 - 000097272 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\bcrypt.dll
2019-07-09 19:24 - 2019-07-04 06:41 - 000559328 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AppXDeploymentClient.dll
2019-07-09 19:24 - 2019-07-04 06:26 - 000310272 _____ (Microsoft Corporation) C:\WINDOWS\system32\wc_storage.dll
2019-07-09 19:24 - 2019-07-04 06:26 - 000051200 _____ (Microsoft Corporation) C:\WINDOWS\system32\TpmTasks.dll
2019-07-09 19:24 - 2019-07-04 06:25 - 000295424 _____ (Microsoft Corporation) C:\WINDOWS\system32\TDLMigration.dll
2019-07-09 19:24 - 2019-07-04 06:25 - 000079872 _____ (Microsoft Corporation) C:\WINDOWS\system32\offreg.dll
2019-07-09 19:24 - 2019-07-04 06:24 - 000726528 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\PEAuth.sys
2019-07-09 19:24 - 2019-07-04 06:24 - 000567808 _____ (Microsoft Corporation) C:\WINDOWS\system32\daxexec.dll
2019-07-09 19:24 - 2019-07-04 06:24 - 000462336 _____ (Microsoft Corporation) C:\WINDOWS\system32\bcdedit.exe
2019-07-09 19:24 - 2019-07-04 06:24 - 000153600 _____ (Microsoft Corporation) C:\WINDOWS\system32\dssvc.dll
2019-07-09 19:24 - 2019-07-04 06:23 - 001765888 _____ (Microsoft Corporation) C:\WINDOWS\system32\audiosrv.dll
2019-07-09 19:24 - 2019-07-04 06:23 - 001217536 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpcore.dll
2019-07-09 19:24 - 2019-07-04 06:23 - 000786432 _____ (Microsoft Corporation) C:\WINDOWS\system32\iphlpsvc.dll
2019-07-09 19:24 - 2019-07-04 06:22 - 002587648 _____ (Microsoft Corporation) C:\WINDOWS\system32\wlansvc.dll
2019-07-09 19:24 - 2019-07-04 06:22 - 002176000 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentExtensions.onecore.dll
2019-07-09 19:24 - 2019-07-04 06:22 - 001561088 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentExtensions.desktop.dll
2019-07-09 19:24 - 2019-07-04 06:22 - 001549824 _____ (Microsoft Corporation) C:\WINDOWS\system32\lsasrv.dll
2019-07-09 19:24 - 2019-07-04 06:22 - 001175552 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingSyncCore.dll
2019-07-09 19:24 - 2019-07-04 06:22 - 000300544 _____ (Microsoft Corporation) C:\WINDOWS\system32\dnsrslvr.dll
2019-07-09 19:24 - 2019-07-04 06:22 - 000110592 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\profext.dll
2019-07-09 19:24 - 2019-07-04 06:22 - 000032768 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\werdiagcontroller.dll
2019-07-09 19:24 - 2019-07-04 06:21 - 005307392 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d2d1.dll
2019-07-09 19:24 - 2019-07-04 06:21 - 002166784 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32kbase.sys
2019-07-09 19:24 - 2019-07-04 06:21 - 001920000 _____ (Microsoft Corporation) C:\WINDOWS\system32\FntCache.dll
2019-07-09 19:24 - 2019-07-04 06:21 - 001220608 _____ (Microsoft Corporation) C:\WINDOWS\system32\Unistore.dll
2019-07-09 19:24 - 2019-07-04 06:21 - 000324096 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppxAllUserStore.dll
2019-07-09 19:24 - 2019-07-04 06:21 - 000124416 _____ (Microsoft Corporation) C:\WINDOWS\system32\profext.dll
2019-07-09 19:24 - 2019-07-04 06:21 - 000059392 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\offreg.dll
2019-07-09 19:24 - 2019-07-04 06:20 - 001156608 _____ (Microsoft Corporation) C:\WINDOWS\system32\rpcss.dll
2019-07-09 19:24 - 2019-07-04 06:20 - 000544256 _____ (Microsoft Corporation) C:\WINDOWS\system32\vbscript.dll
2019-07-09 19:24 - 2019-07-04 06:20 - 000392704 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\daxexec.dll
2019-07-09 19:24 - 2019-07-04 06:20 - 000330752 _____ (Microsoft Corporation) C:\WINDOWS\system32\ncryptprov.dll
2019-07-09 19:24 - 2019-07-04 06:19 - 000886272 _____ (Microsoft Corporation) C:\WINDOWS\system32\MPSSVC.dll
2019-07-09 19:24 - 2019-07-04 06:19 - 000230912 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AppxAllUserStore.dll
2019-07-09 19:24 - 2019-07-04 06:18 - 002602496 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\DWrite.dll
2019-07-09 19:24 - 2019-07-04 06:18 - 001076224 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rdpcore.dll
2019-07-09 19:24 - 2019-07-04 06:18 - 000965632 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Unistore.dll
2019-07-09 19:24 - 2019-07-04 06:18 - 000953344 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SettingSyncCore.dll
2019-07-09 19:24 - 2019-07-04 06:18 - 000275968 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ncryptprov.dll
2019-07-09 19:24 - 2019-07-04 06:17 - 000531968 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\vbscript.dll
2019-07-09 19:24 - 2019-07-04 05:01 - 000001312 _____ C:\WINDOWS\system32\tcbres.wim
2019-07-09 19:24 - 2019-06-21 10:50 - 000280584 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\msiscsi.sys
2019-07-09 19:24 - 2019-06-13 14:15 - 000324408 _____ (Microsoft Corporation) C:\WINDOWS\system32\acmigration.dll
2019-07-09 19:24 - 2019-06-13 14:00 - 000464696 _____ (Microsoft Corporation) C:\WINDOWS\system32\invagent.dll
2019-07-09 19:24 - 2019-06-13 13:58 - 000637752 _____ (Microsoft Corporation) C:\WINDOWS\system32\devinv.dll
2019-07-09 19:24 - 2019-06-13 13:58 - 000071480 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32appinventorycsp.dll
2019-07-09 19:24 - 2019-06-13 13:56 - 000164152 _____ (Microsoft Corporation) C:\WINDOWS\system32\CompatTelRunner.exe
2019-07-09 19:24 - 2019-06-13 13:43 - 001427984 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVEntSubsystemController.dll
2019-07-09 19:24 - 2019-06-13 13:43 - 001048480 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Internal.Shell.Broker.dll
2019-07-09 19:24 - 2019-06-13 13:42 - 002266936 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVEntSubsystems64.dll
2019-07-09 19:24 - 2019-06-13 13:42 - 000652088 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVPublishing.dll
2019-07-09 19:24 - 2019-06-13 13:42 - 000566536 _____ (Microsoft Corporation) C:\WINDOWS\system32\phoneactivate.exe
2019-07-09 19:24 - 2019-06-13 13:41 - 001626936 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVIntegration.dll
2019-07-09 19:24 - 2019-06-13 13:41 - 000830264 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVOrchestration.dll
2019-07-09 19:24 - 2019-06-13 13:41 - 000825144 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVEntStreamingManager.dll
2019-07-09 19:24 - 2019-06-13 13:41 - 000670008 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVCatalog.dll
2019-07-09 19:24 - 2019-06-13 13:40 - 000749880 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVReporting.dll
2019-07-09 19:24 - 2019-06-13 13:40 - 000540984 _____ (Microsoft Corporation) C:\WINDOWS\system32\pcasvc.dll
2019-07-09 19:24 - 2019-06-13 13:40 - 000495416 _____ (Microsoft Corporation) C:\WINDOWS\system32\TransportDSA.dll
2019-07-09 19:24 - 2019-06-13 13:38 - 000766264 _____ (Microsoft Corporation) C:\WINDOWS\system32\LicensingWinRT.dll
2019-07-09 19:24 - 2019-06-13 13:37 - 000101192 _____ (Microsoft Corporation) C:\WINDOWS\system32\changepk.exe
2019-07-09 19:24 - 2019-06-13 13:36 - 000251000 _____ (Microsoft Corporation) C:\WINDOWS\system32\sppwinob.dll
2019-07-09 19:24 - 2019-06-13 13:36 - 000236520 _____ (Microsoft Corporation) C:\WINDOWS\system32\EditionUpgradeManagerObj.dll
2019-07-09 19:24 - 2019-06-13 13:35 - 001376688 _____ (Microsoft Corporation) C:\WINDOWS\system32\ole32.dll
2019-07-09 19:24 - 2019-06-13 13:34 - 000146888 _____ (Microsoft Corporation) C:\WINDOWS\system32\LicensingUI.exe
2019-07-09 19:24 - 2019-06-13 13:17 - 000178176 _____ (Microsoft Corporation) C:\WINDOWS\system32\dmvdsitf.dll
2019-07-09 19:24 - 2019-06-13 13:17 - 000115200 _____ (Microsoft Corporation) C:\WINDOWS\system32\RjvMDMConfig.dll
2019-07-09 19:24 - 2019-06-13 13:17 - 000109056 _____ (Microsoft Corporation) C:\WINDOWS\system32\MDMAgent.exe
2019-07-09 19:24 - 2019-06-13 13:17 - 000093184 _____ (Microsoft Corporation) C:\WINDOWS\system32\WSReset.exe
2019-07-09 19:24 - 2019-06-13 13:16 - 000767488 _____ (Microsoft Corporation) C:\WINDOWS\system32\sppcommdlg.dll
2019-07-09 19:24 - 2019-06-13 13:15 - 000041984 _____ (Microsoft Corporation) C:\WINDOWS\system32\UpgradeResultsUI.exe
2019-07-09 19:24 - 2019-06-13 13:14 - 001127936 _____ (Microsoft Corporation) C:\WINDOWS\system32\nettrace.dll
2019-07-09 19:24 - 2019-06-13 13:14 - 000900096 _____ (Microsoft Corporation) C:\WINDOWS\system32\slui.exe
2019-07-09 19:24 - 2019-06-13 13:14 - 000346624 _____ (Microsoft Corporation) C:\WINDOWS\system32\AcGenral.dll
2019-07-09 19:24 - 2019-06-13 13:14 - 000246272 _____ (Microsoft Corporation) C:\WINDOWS\system32\DesktopSwitcherDataModel.dll
2019-07-09 19:24 - 2019-06-13 13:13 - 001339392 _____ (Microsoft Corporation) C:\WINDOWS\system32\TaskFlowDataEngine.dll
2019-07-09 19:24 - 2019-06-13 13:13 - 000951808 _____ (Microsoft Corporation) C:\WINDOWS\system32\sppcext.dll
2019-07-09 19:24 - 2019-06-13 13:13 - 000765440 _____ (Microsoft Corporation) C:\WINDOWS\system32\tdh.dll
2019-07-09 19:24 - 2019-06-13 13:13 - 000181248 _____ (Microsoft Corporation) C:\WINDOWS\system32\EditionUpgradeHelper.dll
2019-07-09 19:24 - 2019-06-13 13:12 - 000394240 _____ (Microsoft Corporation) C:\WINDOWS\system32\InputSwitch.dll
2019-07-09 19:24 - 2019-06-13 13:10 - 000239104 _____ (Microsoft Corporation) C:\WINDOWS\system32\vdsbas.dll
2019-07-09 19:24 - 2019-06-13 12:07 - 001027008 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ole32.dll
2019-07-09 19:24 - 2019-06-13 12:07 - 000660496 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\LicensingWinRT.dll
2019-07-09 19:24 - 2019-06-13 12:07 - 000221232 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\EditionUpgradeManagerObj.dll
2019-07-09 19:24 - 2019-06-13 11:54 - 000151552 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dmvdsitf.dll
2019-07-09 19:24 - 2019-06-13 11:53 - 000089600 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\olepro32.dll
2019-07-09 19:24 - 2019-06-13 11:51 - 000622080 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\tdh.dll
2019-07-09 19:24 - 2019-06-13 11:50 - 000896512 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\sppcext.dll
2019-07-09 19:24 - 2019-06-13 11:49 - 002406400 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AcGenral.dll
2019-07-09 19:24 - 2019-06-13 11:49 - 000371200 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\InputSwitch.dll
2019-07-09 19:24 - 2019-06-13 09:48 - 000677376 _____ (Microsoft Corporation) C:\WINDOWS\system32\HeadTrackerStorage.dll
2019-07-09 19:24 - 2019-06-13 09:46 - 000713216 _____ (Microsoft Corporation) C:\WINDOWS\system32\SharedRealitySvc.dll
2019-07-09 19:24 - 2019-06-13 09:01 - 000511288 _____ (Microsoft Corporation) C:\WINDOWS\system32\dcntel.dll
2019-07-09 19:24 - 2019-06-13 09:01 - 000036152 _____ (Microsoft Corporation) C:\WINDOWS\system32\DeviceCensus.exe
2019-07-09 19:24 - 2019-06-13 08:59 - 000785264 _____ (Microsoft Corporation) C:\WINDOWS\system32\pkeyhelper.dll
2019-07-09 19:24 - 2019-06-13 08:47 - 001063224 _____ (Microsoft Corporation) C:\WINDOWS\system32\SecConfig.efi
2019-07-09 19:24 - 2019-06-13 08:46 - 001076536 _____ (Microsoft Corporation) C:\WINDOWS\system32\efscore.dll
2019-07-09 19:24 - 2019-06-13 08:46 - 000510296 _____ (Microsoft Corporation) C:\WINDOWS\system32\policymanager.dll
2019-07-09 19:24 - 2019-06-13 08:46 - 000093984 _____ (Microsoft Corporation) C:\WINDOWS\system32\wldp.dll
2019-07-09 19:24 - 2019-06-13 08:45 - 002421560 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ntfs.sys
2019-07-09 19:24 - 2019-06-13 08:44 - 002546704 _____ (Microsoft Corporation) C:\WINDOWS\system32\UpdateAgent.dll
2019-07-09 19:24 - 2019-06-13 08:44 - 001098272 _____ (Microsoft Corporation) C:\WINDOWS\system32\msvproc.dll
2019-07-09 19:24 - 2019-06-13 08:44 - 001033696 _____ (Microsoft Corporation) C:\WINDOWS\system32\ClipSVC.dll
2019-07-09 19:24 - 2019-06-13 08:44 - 000607112 _____ (Microsoft Corporation) C:\WINDOWS\system32\TextInputFramework.dll
2019-07-09 19:24 - 2019-06-13 08:44 - 000545808 _____ (Microsoft Corporation) C:\WINDOWS\system32\hal.dll
2019-07-09 19:24 - 2019-06-13 08:44 - 000130624 _____ (Microsoft Corporation) C:\WINDOWS\system32\rmclient.dll
2019-07-09 19:24 - 2019-06-13 08:17 - 000106496 _____ (Microsoft Corporation) C:\WINDOWS\system32\NotificationControllerPS.dll
2019-07-09 19:24 - 2019-06-13 08:16 - 001626112 _____ (Microsoft Corporation) C:\WINDOWS\system32\enterprisecsps.dll
2019-07-09 19:24 - 2019-06-13 08:16 - 000140288 _____ (Microsoft Corporation) C:\WINDOWS\system32\mdmmigrator.dll
2019-07-09 19:24 - 2019-06-13 08:15 - 000514560 _____ (Microsoft Corporation) C:\WINDOWS\system32\nltest.exe
2019-07-09 19:24 - 2019-06-13 08:15 - 000433152 _____ (Microsoft Corporation) C:\WINDOWS\system32\MusNotification.exe
2019-07-09 19:24 - 2019-06-13 08:15 - 000204288 _____ (Microsoft Corporation) C:\WINDOWS\system32\enrollmentapi.dll
2019-07-09 19:24 - 2019-06-13 08:15 - 000137728 _____ (Microsoft Corporation) C:\WINDOWS\system32\InputLocaleManager.dll
2019-07-09 19:24 - 2019-06-13 08:15 - 000083456 _____ (Microsoft Corporation) C:\WINDOWS\system32\KdsCli.dll
2019-07-09 19:24 - 2019-06-13 08:14 - 000409088 _____ (Microsoft Corporation) C:\WINDOWS\system32\wlanmsm.dll
2019-07-09 19:24 - 2019-06-13 08:14 - 000361472 _____ (Microsoft Corporation) C:\WINDOWS\system32\DeviceEnroller.exe
2019-07-09 19:24 - 2019-06-13 08:14 - 000302080 _____ (Microsoft Corporation) C:\WINDOWS\system32\CXHProvisioningServer.dll
2019-07-09 19:24 - 2019-06-13 08:13 - 002370048 _____ (Microsoft Corporation) C:\WINDOWS\system32\WebRuntimeManager.dll
2019-07-09 19:24 - 2019-06-13 08:13 - 000761344 _____ (Microsoft Corporation) C:\WINDOWS\system32\nshwfp.dll
2019-07-09 19:24 - 2019-06-13 08:13 - 000322560 _____ (Microsoft Corporation) C:\WINDOWS\system32\MusNotificationUx.exe
2019-07-09 19:24 - 2019-06-13 08:13 - 000110592 _____ (Microsoft Corporation) C:\WINDOWS\system32\ngcpopkeysrv.dll
2019-07-09 19:24 - 2019-06-13 08:12 - 000916480 _____ (Microsoft Corporation) C:\WINDOWS\system32\MusUpdateHandlers.dll
2019-07-09 19:24 - 2019-06-13 08:12 - 000894464 _____ (Microsoft Corporation) C:\WINDOWS\system32\webplatstorageserver.dll
2019-07-09 19:24 - 2019-06-13 08:12 - 000808448 _____ (Microsoft Corporation) C:\WINDOWS\system32\EdgeManager.dll
2019-07-09 19:24 - 2019-06-13 08:12 - 000624640 _____ (Microsoft Corporation) C:\WINDOWS\system32\PsmServiceExtHost.dll
2019-07-09 19:24 - 2019-06-13 08:12 - 000532992 _____ (Microsoft Corporation) C:\WINDOWS\system32\QuietHours.dll
2019-07-09 19:24 - 2019-06-13 08:12 - 000501248 _____ (Microsoft Corporation) C:\WINDOWS\system32\rastls.dll
2019-07-09 19:24 - 2019-06-13 08:11 - 000508416 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingsHandlers_Notifications.dll
2019-07-09 19:24 - 2019-06-13 08:11 - 000271872 _____ (Microsoft Corporation) C:\WINDOWS\system32\wkssvc.dll
2019-07-09 19:24 - 2019-06-13 08:11 - 000048128 _____ (Microsoft Corporation) C:\WINDOWS\system32\TokenBrokerUI.dll
2019-07-09 19:24 - 2019-06-13 08:10 - 002912256 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuaueng.dll
2019-07-09 19:24 - 2019-06-13 08:10 - 001400832 _____ (Microsoft Corporation) C:\WINDOWS\system32\TokenBroker.dll
2019-07-09 19:24 - 2019-06-13 08:10 - 001215488 _____ (Microsoft Corporation) C:\WINDOWS\system32\NotificationController.dll
2019-07-09 19:24 - 2019-06-13 08:10 - 000871424 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.BackgroundMediaPlayback.dll
2019-07-09 19:24 - 2019-06-13 08:10 - 000869376 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.Playback.BackgroundMediaPlayer.dll
2019-07-09 19:24 - 2019-06-13 08:10 - 000849408 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.Playback.MediaPlayer.dll
2019-07-09 19:24 - 2019-06-13 08:10 - 000523776 _____ (Microsoft Corporation) C:\WINDOWS\system32\dmenrollengine.dll
2019-07-09 19:24 - 2019-06-13 08:09 - 001854976 _____ (Microsoft Corporation) C:\WINDOWS\system32\wevtsvc.dll
2019-07-09 19:24 - 2019-06-13 08:09 - 000922112 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Security.Authentication.Web.Core.dll
2019-07-09 19:24 - 2019-06-13 08:09 - 000755712 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Core.TextInput.dll
2019-07-09 19:24 - 2019-06-13 08:08 - 000506368 _____ (Microsoft Corporation) C:\WINDOWS\system32\edgeIso.dll
2019-07-09 19:24 - 2019-06-13 07:08 - 000443632 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\policymanager.dll
2019-07-09 19:24 - 2019-06-13 07:07 - 000101192 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rmclient.dll
2019-07-09 19:24 - 2019-06-13 07:07 - 000080744 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wldp.dll
2019-07-09 19:24 - 2019-06-13 07:06 - 001130776 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msvproc.dll
2019-07-09 19:24 - 2019-06-13 07:06 - 000581600 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MSVideoDSP.dll
2019-07-09 19:24 - 2019-06-13 06:49 - 000172544 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\enrollmentapi.dll
2019-07-09 19:24 - 2019-06-13 06:47 - 003554304 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\InputService.dll
2019-07-09 19:24 - 2019-06-13 06:47 - 002899456 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dwmcore.dll
2019-07-09 19:24 - 2019-06-13 06:47 - 000450048 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rastls.dll
2019-07-09 19:24 - 2019-06-13 06:46 - 000608768 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\EdgeManager.dll
2019-07-09 19:24 - 2019-06-13 06:46 - 000331776 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\edgeIso.dll
2019-07-09 19:24 - 2019-06-13 06:46 - 000038400 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TokenBrokerUI.dll
2019-07-09 19:24 - 2019-06-13 06:45 - 000602112 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\nshwfp.dll
2019-07-09 19:24 - 2019-06-13 06:45 - 000578560 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\webplatstorageserver.dll
2019-07-09 19:24 - 2019-06-13 06:44 - 001003008 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TokenBroker.dll
2019-07-09 19:24 - 2019-06-13 06:44 - 000648192 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.BackgroundMediaPlayback.dll
2019-07-09 19:24 - 2019-06-13 06:44 - 000630784 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.Playback.MediaPlayer.dll
2019-07-09 19:24 - 2019-06-13 06:44 - 000582144 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Core.TextInput.dll
2019-07-09 19:24 - 2019-06-13 06:44 - 000251904 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msIso.dll
2019-07-09 19:24 - 2019-06-13 06:43 - 000681472 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Security.Authentication.Web.Core.dll
2019-07-09 19:24 - 2019-06-13 06:43 - 000646656 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.Playback.BackgroundMediaPlayer.dll
2019-07-09 19:24 - 2019-06-13 06:43 - 000445952 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dmenrollengine.dll
2019-07-07 17:59 - 2019-07-07 18:10 - 234299675 _____ C:\Users\**\Desktop\Tajemství (The secret).mp4
2019-07-06 12:14 - 2019-07-06 12:02 - 000543307 _____ C:\Users\**\Desktop\banda_zlodejov_1.pdf

==================== One month (modified) ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2019-07-31 22:47 - 2018-12-20 22:11 - 000000000 __SHD C:\Users\*****\IntelGraphicsProfiles
2019-07-31 22:47 - 2018-12-14 18:56 - 000000006 ____H C:\WINDOWS\Tasks\SA.DAT
2019-07-31 22:47 - 2018-04-12 01:38 - 000000000 ____D C:\WINDOWS\AppReadiness
2019-07-31 22:47 - 2018-04-11 23:04 - 000786432 _____ C:\WINDOWS\system32\config\BBI
2019-07-31 22:45 - 2018-12-20 22:18 - 000000000 ____D C:\Users\*****\AppData\LocalLow\Mozilla
2019-07-31 22:44 - 2018-12-20 22:09 - 000730418 _____ C:\WINDOWS\system32\perfh007.dat
2019-07-31 22:44 - 2018-12-20 22:09 - 000149068 _____ C:\WINDOWS\system32\perfc007.dat
2019-07-31 22:44 - 2018-12-20 22:09 - 000116006 _____ C:\WINDOWS\system32\perfh01B.dat
2019-07-31 22:44 - 2018-12-20 22:09 - 000023440 _____ C:\WINDOWS\system32\perfc01B.dat
2019-07-31 22:44 - 2018-12-14 09:55 - 001841978 _____ C:\WINDOWS\system32\PerfStringBackup.INI
2019-07-31 22:44 - 2018-04-12 01:36 - 000000000 ____D C:\WINDOWS\INF
2019-07-31 22:43 - 2018-12-20 22:22 - 000000000 ____D C:\Users\*****\Desktop\Alte Firefox-Daten
2019-07-31 22:42 - 2018-12-20 22:11 - 000000000 ____D C:\Users\*****\AppData\Local\Packages
2019-07-31 22:41 - 2018-04-12 01:38 - 000000000 ____D C:\ProgramData\regid.1991-06.com.microsoft
2019-07-31 20:07 - 2018-12-14 18:56 - 000003834 _____ C:\WINDOWS\System32\Tasks\IUM-F1E24CA0-B63E-4F13-A9E3-4ADE3BFF3473
2019-07-31 20:01 - 2019-05-02 21:25 - 000000000 ____D C:\Users\*****\AppData\LocalLow\Temp
2019-07-31 19:11 - 2018-12-20 22:11 - 000000000 ____D C:\Users\*****
2019-07-31 19:08 - 2018-12-14 18:59 - 000000000 __SHD C:\Users\**\IntelGraphicsProfiles
2019-07-30 22:27 - 2018-12-20 21:40 - 000000000 ____D C:\Users\**\AppData\LocalLow\Mozilla
2019-07-30 21:23 - 2018-12-14 18:53 - 000000000 ____D C:\WINDOWS\system32\SleepStudy
2019-07-30 21:17 - 2018-12-14 18:54 - 000000000 ____D C:\Users\**
2019-07-30 21:05 - 2018-12-20 21:44 - 000000000 ____D C:\Users\**\Desktop\Faktury-International-House
2019-07-30 20:43 - 2018-12-20 22:22 - 000000000 ____D C:\Users\*****\Documents\Korespondencia
2019-07-30 19:59 - 2018-04-12 01:38 - 000000000 ___HD C:\Program Files\WindowsApps
2019-07-27 14:11 - 2018-12-14 18:56 - 000000000 ____D C:\WINDOWS\system32\Drivers\wd
2019-07-27 14:10 - 2018-12-14 11:22 - 000000000 ____D C:\ProgramData\Package Cache
2019-07-27 14:10 - 2018-12-14 11:22 - 000000000 ____D C:\Program Files (x86)\Intel
2019-07-25 03:25 - 2018-04-12 01:38 - 000000000 ____D C:\WINDOWS\InfusedApps.tmp
2019-07-25 02:42 - 2018-04-12 01:38 - 000000000 ____D C:\WINDOWS\InfusedApps
2019-07-25 02:38 - 2018-04-12 01:38 - 000000000 ____D C:\WINDOWS\registration
2019-07-25 01:38 - 2018-12-17 09:13 - 000000000 ____D C:\Users\**\AppData\Local\D3DSCache
2019-07-25 01:01 - 2018-12-20 21:40 - 000000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2019-07-25 00:58 - 2018-04-12 01:38 - 000000000 ____D C:\WINDOWS\system32\NDF
2019-07-25 00:55 - 2019-01-05 16:50 - 000000000 ____D C:\Users\**\AppData\Local\ElevatedDiagnostics
2019-07-25 00:40 - 2015-10-30 09:24 - 000000000 ___HD C:\WINDOWS\system32\GroupPolicy
2019-07-24 23:06 - 2018-12-20 21:40 - 000001005 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Firefox.lnk
2019-07-24 22:59 - 2018-12-14 09:57 - 000000000 ____D C:\Users\**\AppData\Local\VirtualStore
2019-07-24 21:16 - 2018-04-12 01:33 - 000466432 _____ (Microsoft Corporation) C:\WINDOWS\system32\dpnet.dll
2019-07-24 21:16 - 2018-04-12 01:33 - 000390656 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dpnet.dll
2019-07-24 21:16 - 2018-04-12 01:33 - 000218112 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dplayx.dll
2019-07-24 21:16 - 2018-04-12 01:33 - 000067584 _____ (Microsoft Corporation) C:\WINDOWS\system32\dpnathlp.dll
2019-07-24 21:16 - 2018-04-12 01:33 - 000061440 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dpnathlp.dll
2019-07-24 21:16 - 2018-04-12 01:33 - 000046592 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dpwsockx.dll
2019-07-24 21:16 - 2018-04-12 01:33 - 000026624 _____ (Microsoft Corporation) C:\WINDOWS\system32\dpnsvr.exe
2019-07-24 21:16 - 2018-04-12 01:33 - 000024064 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dpmodemx.dll
2019-07-24 21:16 - 2018-04-12 01:33 - 000023040 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dpnsvr.exe
2019-07-24 21:16 - 2018-04-12 01:33 - 000020480 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dplaysvr.exe
2019-07-24 21:16 - 2018-04-12 01:33 - 000010240 _____ (Microsoft Corporation) C:\WINDOWS\system32\dpnhupnp.dll
2019-07-24 21:16 - 2018-04-12 01:33 - 000010240 _____ (Microsoft Corporation) C:\WINDOWS\system32\dpnhpast.dll
2019-07-24 21:16 - 2018-04-12 01:33 - 000008704 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dpnhupnp.dll
2019-07-24 21:16 - 2018-04-12 01:33 - 000008704 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dpnhpast.dll
2019-07-24 21:16 - 2018-04-12 01:33 - 000006144 _____ (Microsoft Corporation) C:\WINDOWS\system32\dpnlobby.dll
2019-07-24 21:16 - 2018-04-12 01:33 - 000006144 _____ (Microsoft Corporation) C:\WINDOWS\system32\dpnaddr.dll
2019-07-24 21:16 - 2018-04-12 01:33 - 000005120 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dpnlobby.dll
2019-07-24 21:16 - 2018-04-12 01:33 - 000005120 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dpnaddr.dll
2019-07-24 21:16 - 2018-04-12 01:30 - 000000000 ____D C:\WINDOWS\CbsTemp
2019-07-17 14:09 - 2018-12-14 09:57 - 000000000 ____D C:\Users\**\AppData\Local\Packages
2019-07-17 08:32 - 2018-12-14 11:11 - 000002313 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2019-07-17 08:32 - 2018-12-14 11:11 - 000002272 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2019-07-16 09:29 - 2018-12-20 21:44 - 000000000 ____D C:\Users\**\Desktop\Meditacie
2019-07-16 08:14 - 2018-12-20 21:48 - 000000000 ____D C:\Users\**\Documents\Ostatné
2019-07-13 17:03 - 2018-12-27 12:39 - 000000000 ____D C:\Users\*****\AppData\Local\Adobe
2019-07-13 17:03 - 2018-04-12 01:38 - 000000000 ____D C:\WINDOWS\SysWOW64\Macromed
2019-07-13 17:03 - 2018-04-12 01:38 - 000000000 ____D C:\WINDOWS\system32\Macromed
2019-07-13 17:02 - 2018-12-14 11:09 - 000000000 ____D C:\Users\**\AppData\Local\Adobe
2019-07-13 16:47 - 2019-06-30 12:12 - 000000000 ____D C:\Users\*****\AppData\Roaming\InstallShield Installation Information
2019-07-13 14:43 - 2019-06-30 12:12 - 000000653 _____ C:\Users\*****\Desktop\Ip Camera Client.lnk
2019-07-13 13:57 - 2018-12-20 22:16 - 000003380 _____ C:\WINDOWS\System32\Tasks\OneDrive Standalone Update Task-S-1-5-21-1960842775-2088100534-3542962694-1002
2019-07-13 13:57 - 2018-12-20 22:12 - 000000000 ___RD C:\Users\*****\OneDrive
2019-07-13 13:57 - 2018-12-20 22:11 - 000002383 _____ C:\Users\*****\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OneDrive.lnk
2019-07-13 13:56 - 2018-12-20 22:11 - 000000000 ___RD C:\Users\*****\3D Objects
2019-07-13 13:56 - 2018-12-14 09:57 - 000000000 __RHD C:\Users\Public\AccountPictures
2019-07-10 22:06 - 2018-12-14 10:50 - 000741432 ____N (Microsoft Corporation) C:\WINDOWS\system32\MpSigStub.exe
2019-07-09 21:11 - 2018-12-14 18:56 - 000000000 ___RD C:\Users\**\3D Objects
2019-07-09 21:10 - 2018-12-14 18:53 - 000399520 _____ C:\WINDOWS\system32\FNTCACHE.DAT
2019-07-09 21:10 - 2018-04-12 19:08 - 000000000 ____D C:\Program Files\Windows Defender Advanced Threat Protection
2019-07-09 21:10 - 2018-04-12 01:38 - 000000000 ____D C:\WINDOWS\TextInput
2019-07-09 21:10 - 2018-04-12 01:38 - 000000000 ____D C:\WINDOWS\SysWOW64\oobe
2019-07-09 21:10 - 2018-04-12 01:38 - 000000000 ____D C:\WINDOWS\SysWOW64\Dism
2019-07-09 21:10 - 2018-04-12 01:38 - 000000000 ____D C:\WINDOWS\system32\oobe
2019-07-09 21:10 - 2018-04-12 01:38 - 000000000 ____D C:\WINDOWS\system32\appraiser
2019-07-09 21:10 - 2018-04-12 01:38 - 000000000 ____D C:\WINDOWS\ShellComponents
2019-07-09 21:10 - 2018-04-12 01:38 - 000000000 ____D C:\WINDOWS\Provisioning
2019-07-09 21:10 - 2018-04-12 01:38 - 000000000 ____D C:\WINDOWS\bcastdvr
2019-07-09 21:10 - 2018-04-11 23:04 - 000000000 ____D C:\WINDOWS\system32\Dism
2019-07-09 19:24 - 2018-12-14 10:49 - 000000000 ____D C:\WINDOWS\system32\MRT
2019-07-09 19:21 - 2018-12-14 10:49 - 136618864 ____C (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2019-07-09 15:31 - 2018-12-14 18:56 - 000003380 _____ C:\WINDOWS\System32\Tasks\OneDrive Standalone Update Task-S-1-5-21-1960842775-2088100534-3542962694-1001
2019-07-09 15:31 - 2018-12-14 18:54 - 000002383 _____ C:\Users\**\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OneDrive.lnk
2019-07-09 15:31 - 2018-12-14 09:59 - 000000000 ___RD C:\Users\**\OneDrive
2019-07-02 16:55 - 2018-12-20 21:48 - 000000000 ____D C:\Users\**\Documents\materialy na vyuku

==================== SigCheck ===============================

(There is no automatic fix for files that do not pass verification.)

==================== End of FRST.txt ============================
         

 Additional scan result of Farbar Recovery Scan Tool (x64) Version: 31-07-2019
Ran by ** (31-07-2019 22:49:06)
Running from C:\Users\*****\Desktop
Windows 10 Pro Version 1803 17134.885 (X64) (2018-12-14 16:56:48)
Boot Mode: Normal
==========================================================


==================== Accounts: =============================

Administrator (S-1-5-21-1960842775-2088100534-3542962694-500 - Administrator - Disabled)
DefaultAccount (S-1-5-21-1960842775-2088100534-3542962694-503 - Limited - Disabled)
Guest (S-1-5-21-1960842775-2088100534-3542962694-501 - Limited - Disabled)
***** (S-1-5-21-1960842775-2088100534-3542962694-1002 - Limited - Enabled) => C:\Users\*****
** (S-1-5-21-1960842775-2088100534-3542962694-1001 - Administrator - Enabled) => C:\Users\**
WDAGUtilityAccount (S-1-5-21-1960842775-2088100534-3542962694-504 - Limited - Disabled)

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

Adobe Acrobat Reader DC - Slovak (HKLM-x32\...\{AC76BA86-7AD7-1051-7B44-AC0F074E4100}) (Version: 19.012.20035 - Adobe Systems Incorporated)
Adobe Flash Player 32 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 32.0.0.223 - Adobe)
Age of Empires complete version 1.0c (HKLM-x32\...\{F7F0D70E-9027-4DF5-B67F-4B48CE29565A}_is1) (Version: 1.0c - vol1)
Balík softvéru eID (HKLM-x32\...\{69aff1f0-e530-4ac2-ab4f-88cb85aef940}) (Version: 1.0.0.0 - Ministerstvo vnútra Slovenskej republiky) Hidden
Balík softvéru eID (HKLM-x32\...\{d0db994b-7bbf-4a97-86ae-8e47ef7363e5}) (Version: 1.0.0.0 - Ministerstvo vnútra Slovenskej republiky) Hidden
Bit4id - miniLector (HKLM-x32\...\Bit4id - miniLector) (Version: 3.7 - Bit4id)
D.Launcher (x86) (HKLM-x32\...\{8A22CEA0-9DB7-4E30-898A-6D70F4E650CE}) (Version: 1.1.0.0 - DITEC, a.s.)
D.Signer/XAdES .NET so zásuvnými modulmi (x86) (HKLM-x32\...\{EB7D7F94-A539-4248-BCA3-2B105845284C}) (Version: 4.0.13 - DITEC, a.s.)
D.Signer/XAdES .NET Tools (x86) (HKLM-x32\...\{26E941A2-1EFF-4A3F-AD0B-6A423EFC2AAA}) (Version: 4.0.9 - DITEC, a.s.)
D.Suite/eIDAS (x86) (HKLM-x32\...\{f6fbc4ed-b1f8-4f4c-9b23-5b8e64af50b4}) (Version: 1.0.15 - DITEC, a.s.)
D.Viewer .NET (x86) (HKLM-x32\...\{967D2DE1-4E53-4700-9ED4-E4BCCD27E8F9}) (Version: 4.0.2025 - DITEC, a.s.)
Disig Web Signer 1.0.7 (HKLM-x32\...\{DD3FDF40-D8A3-454D-8A43-B53F90FB1ED7}) (Version: 1.1.8 - Disig)
DiskProtect18891 version 16.91 (HKLM-x32\...\{06B8AD54-D556-4771-A39B-A04135966F15}_is1) (Version: 16.91 - )
EAC MW klient (HKLM-x32\...\{3C1EB559-A939-4569-8EDE-006675312B46}) (Version: 3.1.3 - Ministerstvo vnútra Slovenskej republiky)
EPSON BX535WD Series Printer Uninstall (HKLM\...\EPSON BX535WD Series) (Version:  - SEIKO EPSON Corporation)
EPSON Scan (HKLM-x32\...\EPSON Scanner) (Version:  - Seiko Epson Corporation)
EpsonNet Print (HKLM-x32\...\{3E31400D-274E-4647-916C-2CACC3741799}) (Version: 2.6.0 - SEIKO EPSON CORPORATION)
GemPcCCID (HKLM\...\{39417D48-AC92-47A7-9F53-3CA2049231B0}) (Version: 2.0.7 - Gemalto)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 75.0.3770.142 - Google LLC)
Google Earth Pro (HKLM\...\{70A0F34E-564B-4F93-ADD6-3BAEC6E44075}) (Version: 7.3.2.5776 - Google)
Google Update Helper (HKLM-x32\...\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}) (Version: 1.3.34.11 - Google LLC) Hidden
HiPlayer (HKU\S-1-5-21-1960842775-2088100534-3542962694-1002\...\{1AE35ED9-955E-40D0-8811-FFD8F0E2A9F3}) (Version: 1.2 - Hi)
Intel Driver && Support Assistant (HKLM-x32\...\{CF18558A-3642-4C4D-A551-23275D1FCE16}) (Version: 19.7.30.2 - Intel) Hidden
Intel(R) Computing Improvement Program (HKLM\...\{D40D4164-EEDB-4F0F-85C6-2058A9E34CC7}) (Version: 2.4.04370 - Intel Corporation)
Intel(R) Management Engine Components (HKLM\...\{1CEAC85D-2590-4760-800F-8DE5E91F3700}) (Version: 1831.12.0.1156 - Intel Corporation)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 24.20.100.6291 - Intel Corporation)
Intel(R) Trusted Connect Service Client x86 (HKLM-x32\...\{C9552825-7BF2-4344-BA91-D3CD46F4C441}) (Version: 1.50.369.0 - Intel Corporation) Hidden
Intel(R) Trusted Connect Services Client (HKLM-x32\...\{aa81bdf2-96a6-4400-a596-c7d1916ce9f7}) (Version: 1.50.369.0 - Intel Corporation) Hidden
Intel® Chipset Device Software (HKLM-x32\...\{262e9c1d-e509-4e2a-86e8-0abb312ac2e9}) (Version: 10.1.17765.8094 - Intel(R) Corporation) Hidden
Intel® Driver & Support Assistant (HKLM-x32\...\{12d2d1d9-5223-431d-96ac-6a82d3a1391c}) (Version: 19.7.30.2 - Intel)
Intel® Driver & Support Assistant (HKLM-x32\...\{dbe96554-7594-4bba-b7c5-fc6c72dbaa39}) (Version: 19.6.26.3 - Intel)
IP Camera (HKU\S-1-5-21-1960842775-2088100534-3542962694-1002\...\{3E6DEA84-3FA0-472E-B0DB-927655097022}) (Version: 2.0.4.6 - hi)
Java 8 Update 211 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F64180211F0}) (Version: 8.0.2110.12 - Oracle Corporation)
K-Lite Mega Codec Pack 14.5.5 (HKLM-x32\...\KLiteCodecPack_is1) (Version: 14.5.5 - KLCP)
Malwarebytes Version 3.8.3.2965 (HKLM\...\{35065F43-4BB2-439A-BFF7-0F1014F2E0CD}_is1) (Version: 3.8.3.2965 - Malwarebytes)
Microsoft Office 2016 Professional Plus (HKLM-x32\...\Office16.PROPLUS) (Version: 16.0.4266.1001 - Microsoft Corporation)
Microsoft OneDrive (HKU\S-1-5-21-1960842775-2088100534-3542962694-1001\...\OneDriveSetup.exe) (Version: 19.103.0527.0003 - Microsoft Corporation)
Microsoft OneDrive (HKU\S-1-5-21-1960842775-2088100534-3542962694-1002\...\OneDriveSetup.exe) (Version: 19.103.0527.0003 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.30319 (HKLM\...\{DA5E371C-6333-3D8A-93A4-6FD5B20BCC6E}) (Version: 10.0.30319 - Microsoft Corporation)
Microsoft Visual C++ 2015 Redistributable (x64) - 14.0.23026 (HKLM-x32\...\{e46eca4f-393b-40df-9f49-076faf788d83}) (Version: 14.0.23026.0 - Microsoft Corporation)
Microsoft Visual C++ 2015 Redistributable (x86) - 14.0.23026 (HKLM-x32\...\{74d0e5db-b326-4dae-a6b2-445b9de1836e}) (Version: 14.0.23026.0 - Microsoft Corporation)
Mozilla Firefox 68.0.1 (x64 de) (HKLM\...\Mozilla Firefox 68.0.1 (x64 de)) (Version: 68.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 64.0 - Mozilla)
Nástroje kontroly pravopisu pro Microsoft Office 2016 – čeština (HKLM-x32\...\{90160000-001F-0405-0000-0000000FF1CE}) (Version: 16.0.4266.1001 - Microsoft Corporation) Hidden
Nástroje korektúry balíka Microsoft Office 2016 - slovenčina (HKLM-x32\...\{90160000-001F-041B-0000-0000000FF1CE}) (Version: 16.0.4266.1001 - Microsoft Corporation) Hidden
OLYMPUS CAMEDIA Master 4.1 (HKLM-x32\...\{30BB4D60-81DB-11D5-BB77-00400536ABAC}) (Version:  - )
QuickTime (HKLM-x32\...\QuickTime) (Version:  - )
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 10.31.828.2018 - Realtek)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.8581 - Realtek Semiconductor Corp.)
SPORE Collection (HKLM-x32\...\SPORE Collection_is1) (Version:  - )
SSC Service Utility v4.30 (HKLM-x32\...\SSC Service Utility_is1) (Version:  - SSC Localization Group)
Steam (HKLM-x32\...\Steam) (Version: 2.10.91.91 - Valve Corporation)
TAP-Windows 9.21.2 (HKLM\...\TAP-Windows) (Version: 9.21.2 - )
TextPad (HKLM-x32\...\{ADBBED4F-720B-460D-AA14-D85EBC4AEF97}) (Version:  - )
Update for Windows 10 for x64-based Systems (KB4023057) (HKLM\...\{F14FB68A-9188-4036-AD0D-D054BC9C9291}) (Version: 2.59.0.0 - Microsoft Corporation)
UpdateAssistant (HKLM\...\{EC4F72E8-52FE-454E-B70F-DBE5C0FA44C5}) (Version: 1.20.0.0 - Microsoft Corporation) Hidden
web control version 3.0.6.7 (HKLM-x32\...\{F88ED86C-0010-4943-BA16-72E4184E31ED}_is1) (Version: 3.0.6.7 - )
WinRAR 5.71 (32-bit) (HKLM-x32\...\WinRAR archiver) (Version: 5.71.0 - win.rar GmbH)

Packages:
=========
Candy Crush Soda Saga -> C:\Program Files\WindowsApps\king.com.CandyCrushSodaSaga_1.143.600.0_x86__kgqvnymyfvs32 [2019-07-25] (king.com)
Dolby Access -> C:\Program Files\WindowsApps\DolbyLaboratories.DolbyAccess_2.4.520.0_x64__rz1tebttyb220 [2019-07-25] (Dolby Laboratories)
Mail und Kalender -> C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe [2019-07-25] (Microsoft Corporation) [MS Ad]
Microsoft Advertising SDK for XAML -> C:\Program Files\WindowsApps\Microsoft.Advertising.Xaml_10.1811.1.0_x64__8wekyb3d8bbwe [2019-07-25] (Microsoft Corporation) [MS Ad]
Microsoft Advertising SDK for XAML -> C:\Program Files\WindowsApps\Microsoft.Advertising.Xaml_10.1811.1.0_x86__8wekyb3d8bbwe [2019-07-25] (Microsoft Corporation) [MS Ad]
Microsoft Begleiter für Telefon -> C:\Program Files\WindowsApps\Microsoft.WindowsPhone_10.1802.311.0_x64__8wekyb3d8bbwe [2019-07-25] (Microsoft Corporation)
Microsoft News – Nachrichten -> C:\Program Files\WindowsApps\Microsoft.BingNews_4.31.11905.0_x64__8wekyb3d8bbwe [2019-07-25] (Microsoft Corporation) [MS Ad]
Microsoft Solitaire Collection -> C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.6132.0_x64__8wekyb3d8bbwe [2019-07-25] (Microsoft Studios) [MS Ad]
Microsoft-Telefon -> C:\Program Files\WindowsApps\Microsoft.CommsPhone_3.43.20002.1000_x64__8wekyb3d8bbwe [2019-07-25] (Microsoft Corporation)
MSN Finanzen -> C:\Program Files\WindowsApps\Microsoft.BingFinance_4.31.11905.0_x64__8wekyb3d8bbwe [2019-07-25] (Microsoft Corporation) [MS Ad]
MSN Sport -> C:\Program Files\WindowsApps\Microsoft.BingSports_4.31.11905.0_x64__8wekyb3d8bbwe [2019-07-25] (Microsoft Corporation) [MS Ad]
MSN Wetter -> C:\Program Files\WindowsApps\Microsoft.BingWeather_4.31.11905.0_x64__8wekyb3d8bbwe [2019-07-25] (Microsoft Corporation) [MS Ad]

==================== Custom CLSID (Whitelisted): ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

CustomCLSID: HKU\S-1-5-21-1960842775-2088100534-3542962694-1001_Classes\CLSID\{233525e0-5434-46ef-b464-fd7e45e2e145}\localserver32 -> C:\Program Files (x86)\Intel\Driver and Support Assistant\DSATray.exe (IDSA Production signing key -> Intel)
CustomCLSID: HKU\S-1-5-21-1960842775-2088100534-3542962694-1002_Classes\CLSID\{233525e0-5434-46ef-b464-fd7e45e2e145}\localserver32 -> C:\Program Files (x86)\Intel\Driver and Support Assistant\DSATray.exe (IDSA Production signing key -> Intel)
ContextMenuHandlers1-x32: [TextPad] -> {2F25CF20-C569-11D1-B94C-00608CB45480} => C:\Program Files (x86)\TextPad 4\System\shellext.dll [2001-07-21] (Helios Software Solutions) [File not signed]
ContextMenuHandlers1: [WinRAR] -> {B41DB860-64E4-11D2-9906-E49FADC173CA} => C:\Program Files (x86)\WinRAR\rarext64.dll [2019-04-27] (win.rar GmbH -> Alexander Roshal)
ContextMenuHandlers1-x32: [WinRAR32] -> {B41DB860-8EE4-11D2-9906-E49FADC173CA} => C:\Program Files (x86)\WinRAR\rarext.dll [2019-04-27] (win.rar GmbH -> Alexander Roshal)
ContextMenuHandlers3: [MBAMShlExt] -> {57CE581A-0CB6-4266-9CA0-19364C90A0B3} => C:\Program Files\Malwarebytes\Anti-Malware\mbshlext.dll [2019-06-26] (Malwarebytes Corporation -> Malwarebytes)
ContextMenuHandlers5: [igfxcui] -> {3AB1675A-CCFF-11D2-8B20-00A0C93CB1F4} =>  -> No File
ContextMenuHandlers5: [igfxDTCM] -> {9B5F5829-A529-4B12-814A-E81BCB8D93FC} => C:\WINDOWS\System32\DriverStore\FileRepository\cui_dc_comp.inf_amd64_1c77f1231c19bc72\igfxDTCM.dll [2018-11-02] (Microsoft Windows Hardware Compatibility Publisher -> Intel Corporation)
ContextMenuHandlers6: [MBAMShlExt] -> {57CE581A-0CB6-4266-9CA0-19364C90A0B3} => C:\Program Files\Malwarebytes\Anti-Malware\mbshlext.dll [2019-06-26] (Malwarebytes Corporation -> Malwarebytes)
ContextMenuHandlers6: [WinRAR] -> {B41DB860-64E4-11D2-9906-E49FADC173CA} => C:\Program Files (x86)\WinRAR\rarext64.dll [2019-04-27] (win.rar GmbH -> Alexander Roshal)
ContextMenuHandlers6-x32: [WinRAR32] -> {B41DB860-8EE4-11D2-9906-E49FADC173CA} => C:\Program Files (x86)\WinRAR\rarext.dll [2019-04-27] (win.rar GmbH -> Alexander Roshal)

==================== Shortcuts & WMI ========================

(The entries could be listed to be restored or removed.)


Shortcut: C:\Users\Public\Desktop\Age of Empires - The Rise of Rome color fix.lnk -> C:\Program Files (x86)\Age of Empires complete\EMPIRESX.bat ()
Shortcut: C:\Users\Public\Desktop\Age of Empires color fix.lnk -> C:\Program Files (x86)\Age of Empires complete\Empires.bat ()

==================== Loaded Modules (Whitelisted) ==============

2018-12-20 22:32 - 2012-11-12 16:15 - 000558592 _____ (SEIKO EPSON CORPORATION) [File not signed] C:\WINDOWS\System32\enppmon.dll
2018-12-20 22:32 - 2012-10-22 18:19 - 000219648 _____ (SEIKO EPSON CORPORATION) [File not signed] C:\WINDOWS\System32\enpres.dll

==================== Alternate Data Streams (Whitelisted) =========

(If an entry is included in the fixlist, only the ADS will be removed.)


==================== Safe Mode (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MBAMService => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MBAMService => ""="Service"

==================== Association (Whitelisted) ===============

(If an entry is included in the fixlist, the registry item will be restored to default or removed.)


==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, it will be removed from the registry.)


==================== Hosts content: ===============================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2015-10-30 09:24 - 2019-07-31 22:38 - 000000027 _____ C:\WINDOWS\system32\drivers\etc\hosts

127.0.0.1       localhost

==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKLM\System\CurrentControlSet\Control\Session Manager\Environment\\Path -> C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\iCLS\;C:\Program Files\Intel\Intel(R) Management Engine Components\iCLS\;%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem;%SYSTEMROOT%\System32\WindowsPowerShell\v1.0\;C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL;C:\Program Files\Intel\Intel(R) Management Engine Components\DAL;%SYSTEMROOT%\System32\OpenSSH\;C:\Program Files (x86)\EAC MW klient\
HKU\S-1-5-21-1960842775-2088100534-3542962694-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\**\Desktop\foto.JPG
HKU\S-1-5-21-1960842775-2088100534-3542962694-1002\Control Panel\Desktop\\Wallpaper -> C:\Users\*****\Pictures\Saved Pictures\19713_en_1.jfif
DNS Servers: 192.168.1.1 - 195.146.128.62
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer => (SmartScreenEnabled: RequireAdmin)
Windows Firewall is enabled.

==================== MSCONFIG/TASK MANAGER disabled items ==

If an entry is included in the fixlist, it will be removed.


==================== FirewallRules (Whitelisted) ===============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== Restore Points =========================

30-07-2019 21:03:57 Scheduled Checkpoint

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (07/31/2019 10:48:02 PM) (Source: dLauncherLoopback) (EventID: 0) (User: )
Description: Event-ID 0

Error: (07/31/2019 10:39:40 PM) (Source: dLauncherLoopback) (EventID: 0) (User: )
Description: Event-ID 0

Error: (07/31/2019 10:37:08 PM) (Source: dLauncherLoopback) (EventID: 0) (User: )
Description: Event-ID 0

Error: (07/31/2019 08:27:14 PM) (Source: dLauncherLoopback) (EventID: 0) (User: )
Description: Event-ID 0

Error: (07/31/2019 08:23:10 PM) (Source: dLauncherLoopback) (EventID: 0) (User: )
Description: Event-ID 0

Error: (07/31/2019 08:20:17 PM) (Source: dLauncherLoopback) (EventID: 0) (User: )
Description: Event-ID 0

Error: (07/31/2019 08:14:19 PM) (Source: dLauncherLoopback) (EventID: 0) (User: )
Description: Event-ID 0

Error: (07/31/2019 08:02:26 PM) (Source: dLauncherLoopback) (EventID: 0) (User: )
Description: Event-ID 0


System errors:
=============
Error: (07/31/2019 10:47:48 PM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: Durch die Berechtigungseinstellungen für "application-specific" wird dem Benutzer "NT AUTHORITY\LOCAL SERVICE" (SID: S-1-5-19) unter der Adresse "LocalHost (Using LRPC)" keine Berechtigung vom Typ "Local Activation" für die COM-Serveranwendung mit der CLSID 
{6B3B8D23-FA8D-40B9-8DBD-B950333E2C52}
 und der APPID 
{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}
 im Anwendungscontainer "Unavailable" (SID: Unavailable) gewährt. Die Sicherheitsberechtigung kann mit dem Verwaltungstool für Komponentendienste geändert werden.

Error: (07/31/2019 10:47:48 PM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: Durch die Berechtigungseinstellungen für "application-specific" wird dem Benutzer "NT AUTHORITY\LOCAL SERVICE" (SID: S-1-5-19) unter der Adresse "LocalHost (Using LRPC)" keine Berechtigung vom Typ "Local Activation" für die COM-Serveranwendung mit der CLSID 
{6B3B8D23-FA8D-40B9-8DBD-B950333E2C52}
 und der APPID 
{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}
 im Anwendungscontainer "Unavailable" (SID: Unavailable) gewährt. Die Sicherheitsberechtigung kann mit dem Verwaltungstool für Komponentendienste geändert werden.

Error: (07/31/2019 10:47:41 PM) (Source: Microsoft-Windows-Ntfs) (EventID: 98) (User: NT AUTHORITY)
Description: C:\Device\HarddiskVolume23

Error: (07/31/2019 10:44:24 PM) (Source: DCOM) (EventID: 10016) (User: DESKTOP-3CK4O4E)
Description: Durch die Berechtigungseinstellungen für "application-specific" wird dem Benutzer "DESKTOP-3CK4O4E\**" (SID: S-1-5-21-1960842775-2088100534-3542962694-1001) unter der Adresse "LocalHost (Using LRPC)" keine Berechtigung vom Typ "Local Activation" für die COM-Serveranwendung mit der CLSID 
{D63B10C5-BB46-4990-A94F-E40B9D520160}
 und der APPID 
{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}
 im Anwendungscontainer "Unavailable" (SID: Unavailable) gewährt. Die Sicherheitsberechtigung kann mit dem Verwaltungstool für Komponentendienste geändert werden.

Error: (07/31/2019 10:41:51 PM) (Source: DCOM) (EventID: 10016) (User: DESKTOP-3CK4O4E)
Description: Durch die Berechtigungseinstellungen für "application-specific" wird dem Benutzer "DESKTOP-3CK4O4E\**" (SID: S-1-5-21-1960842775-2088100534-3542962694-1001) unter der Adresse "LocalHost (Using LRPC)" keine Berechtigung vom Typ "Local Activation" für die COM-Serveranwendung mit der CLSID 
{D63B10C5-BB46-4990-A94F-E40B9D520160}
 und der APPID 
{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}
 im Anwendungscontainer "Unavailable" (SID: S-1-15-2-1430448594-2639229838-973813799-439329657-1197984847-4069167804-1277922394) gewährt. Die Sicherheitsberechtigung kann mit dem Verwaltungstool für Komponentendienste geändert werden.

Error: (07/31/2019 10:41:32 PM) (Source: DCOM) (EventID: 10016) (User: DESKTOP-3CK4O4E)
Description: Durch die Berechtigungseinstellungen für "application-specific" wird dem Benutzer "DESKTOP-3CK4O4E\**" (SID: S-1-5-21-1960842775-2088100534-3542962694-1001) unter der Adresse "LocalHost (Using LRPC)" keine Berechtigung vom Typ "Local Activation" für die COM-Serveranwendung mit der CLSID 
{D63B10C5-BB46-4990-A94F-E40B9D520160}
 und der APPID 
{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}
 im Anwendungscontainer "Unavailable" (SID: S-1-15-2-1430448594-2639229838-973813799-439329657-1197984847-4069167804-1277922394) gewährt. Die Sicherheitsberechtigung kann mit dem Verwaltungstool für Komponentendienste geändert werden.

Error: (07/31/2019 10:41:26 PM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: Durch die Berechtigungseinstellungen für "application-specific" wird dem Benutzer "NT AUTHORITY\SYSTEM" (SID: S-1-5-18) unter der Adresse "LocalHost (Using LRPC)" keine Berechtigung vom Typ "Local Launch" für die COM-Serveranwendung mit der CLSID 
Windows.SecurityCenter.WscDataProtection
 und der APPID 
Unavailable
 im Anwendungscontainer "Unavailable" (SID: Unavailable) gewährt. Die Sicherheitsberechtigung kann mit dem Verwaltungstool für Komponentendienste geändert werden.

Error: (07/31/2019 10:41:26 PM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: Durch die Berechtigungseinstellungen für "application-specific" wird dem Benutzer "NT AUTHORITY\SYSTEM" (SID: S-1-5-18) unter der Adresse "LocalHost (Using LRPC)" keine Berechtigung vom Typ "Local Launch" für die COM-Serveranwendung mit der CLSID 
Windows.SecurityCenter.WscBrokerManager
 und der APPID 
Unavailable
 im Anwendungscontainer "Unavailable" (SID: Unavailable) gewährt. Die Sicherheitsberechtigung kann mit dem Verwaltungstool für Komponentendienste geändert werden.


Windows Defender:
===================================
Date: 2019-07-27 14:11:19.123
Description: 
Die Windows Defender Antivirus-Überprüfung wurde vor ihrem Abschluss beendet.
Überprüfungs-ID: {F19C5FF9-CAEE-4B95-AF27-48D5428A0778}
Überprüfungstyp: Antimalware
Überprüfungsparameter: Vollständige Überprüfung
Benutzer: DESKTOP-3CK4O4E\**

Date: 2019-07-27 12:24:43.833
Description: 
Die Windows Defender Antivirus-Überprüfung wurde vor ihrem Abschluss beendet.
Überprüfungs-ID: {82B744AF-4B5B-4340-A46C-B31EB143D3E7}
Überprüfungstyp: Antimalware
Überprüfungsparameter: Schnellüberprüfung
Benutzer: NT AUTHORITY\SYSTEM

Date: 2019-07-27 11:13:24.797
Description: 
Die Windows Defender Antivirus-Überprüfung wurde vor ihrem Abschluss beendet.
Überprüfungs-ID: {1B172D1B-64F6-47C9-98B1-C708BFF51B34}
Überprüfungstyp: Antimalware
Überprüfungsparameter: Schnellüberprüfung
Benutzer: NT AUTHORITY\SYSTEM

Date: 2019-07-25 01:44:05.762
Description: 
Von Windows Defender Antivirus wurde Schadsoftware oder andere potenziell unerwünschte Software erkannt.
Weitere Informationen:
https://go.microsoft.com/fwlink/?linkid=37020&name=Behavior:Win32/Generic.KU!ml&threatid=2147739089&enterprise=0
Name: Behavior:Win32/Generic.KU!ml
ID: 2147739089
Schweregrad: Závažná
Kategorie: Podozrivé správanie
Pfad: file:_C:\Users\**\AppData\Local\Temp\wErKYuzd1HavtcSG\83314351a78e5d6e44c0cdebeb407e8c.exe
Erkennungsursprung: Lokaler Computer
Erkennungstyp: FastPath
Erkennungsquelle: Benutzer
Benutzer: DESKTOP-3CK4O4E\**
Prozessname: Unknown
Signaturversion: AV: 1.299.423.0, AS: 1.299.423.0, NIS: 0.0.0.0
Modulversion: AM: 1.1.16200.1, NIS: 0.0.0.0

Date: 2019-07-25 01:44:05.761
Description: 
Von Windows Defender Antivirus wurde Schadsoftware oder andere potenziell unerwünschte Software erkannt.
Weitere Informationen:
https://go.microsoft.com/fwlink/?linkid=37020&name=Trojan:JS/Iframe.EX&threatid=2147733337&enterprise=0
Name: Trojan:JS/Iframe.EX
ID: 2147733337
Schweregrad: Závažná
Kategorie: Trójsky kôň
Pfad: containerfile:_C:\Users\**\AppData\Local\Google\Chrome\User Data\Default\Cache\f_001582; file:_C:\Users\**\AppData\Local\Google\Chrome\User Data\Default\Cache\f_001582->(GZip)
Erkennungsursprung: Lokaler Computer
Erkennungstyp: Konkret
Erkennungsquelle: Benutzer
Benutzer: DESKTOP-3CK4O4E\**
Prozessname: Unknown
Signaturversion: AV: 1.299.423.0, AS: 1.299.423.0, NIS: 0.0.0.0
Modulversion: AM: 1.1.16200.1, NIS: 0.0.0.0

Date: 2019-07-31 20:37:02.389
Description: 
Fehler von Windows Defender Antivirus beim Aktualisieren von Signaturen.
Neue Signaturversion: 
Vorherige Signaturversion: 1.299.631.0
Updatequelle: Microsoft Center zum Schutz vor Schadsoftware
Signaturtyp: AntiVirus
Updatetyp: Voll
Benutzer: NT AUTHORITY\NETWORK SERVICE
Aktuelle Modulversion: 
Vorherige Modulversion: 1.1.16200.1
Fehlercode: 0x80072ee7
Fehlerbeschreibung: The server name or address could not be resolved 

Date: 2019-07-31 20:37:02.389
Description: 
Fehler von Windows Defender Antivirus beim Aktualisieren von Signaturen.
Neue Signaturversion: 
Vorherige Signaturversion: 1.299.631.0
Updatequelle: Microsoft Center zum Schutz vor Schadsoftware
Signaturtyp: AntiSpyware
Updatetyp: Voll
Benutzer: NT AUTHORITY\NETWORK SERVICE
Aktuelle Modulversion: 
Vorherige Modulversion: 1.1.16200.1
Fehlercode: 0x80072ee7
Fehlerbeschreibung: The server name or address could not be resolved 

Date: 2019-07-31 20:37:02.389
Description: 
Fehler von Windows Defender Antivirus beim Aktualisieren von Signaturen.
Neue Signaturversion: 
Vorherige Signaturversion: 1.299.631.0
Updatequelle: Microsoft Center zum Schutz vor Schadsoftware
Signaturtyp: AntiVirus
Updatetyp: Voll
Benutzer: NT AUTHORITY\NETWORK SERVICE
Aktuelle Modulversion: 
Vorherige Modulversion: 1.1.16200.1
Fehlercode: 0x80072ee7
Fehlerbeschreibung: The server name or address could not be resolved 

Date: 2019-07-31 20:37:02.375
Description: 
Fehler von Windows Defender Antivirus beim Aktualisieren von Signaturen.
Neue Signaturversion: 
Vorherige Signaturversion: 1.299.631.0
Updatequelle: Microsoft Center zum Schutz vor Schadsoftware
Signaturtyp: AntiVirus
Updatetyp: Voll
Benutzer: NT AUTHORITY\NETWORK SERVICE
Aktuelle Modulversion: 
Vorherige Modulversion: 1.1.16200.1
Fehlercode: 0x80072ee7
Fehlerbeschreibung: The server name or address could not be resolved 

Date: 2019-07-31 20:37:02.375
Description: 
Fehler von Windows Defender Antivirus beim Aktualisieren von Signaturen.
Neue Signaturversion: 
Vorherige Signaturversion: 1.299.631.0
Updatequelle: Microsoft Center zum Schutz vor Schadsoftware
Signaturtyp: AntiSpyware
Updatetyp: Voll
Benutzer: NT AUTHORITY\NETWORK SERVICE
Aktuelle Modulversion: 
Vorherige Modulversion: 1.1.16200.1
Fehlercode: 0x80072ee7
Fehlerbeschreibung: The server name or address could not be resolved 

==================== Memory info =========================== 

BIOS: American Megatrends Inc. 1.60 10/10/2018
Motherboard: Micro-Star International Co., Ltd. H310M PRO-VD (MS-7B33)
Processor: Intel(R) Core(TM) i3-8300 CPU @ 3.70GHz
Percentage of memory in use: 51%
Total physical RAM: 3962.59 MB
Available physical RAM: 1912.23 MB
Total Virtual: 14714.59 MB
Available Virtual: 12851.26 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:223.08 GB) (Free:105.98 GB) NTFS
Drive d: () (Fixed) (Total:1863.01 GB) (Free:1638.61 GB) NTFS

\\?\Volume{b9e8df67-0000-0000-0000-100000000000}\ (Vyhradené systémom) (Fixed) (Total:0.49 GB) (Free:0.1 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7/8/10) (Size: 223.6 GB) (Disk ID: B9E8DF67)
Partition 1: (Active) - (Size=500 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=223.1 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (Size: 1863 GB) (Disk ID: 9F919F91)
Partition 1: (Active) - (Size=1863 GB) - (Type=07 NTFS)

==================== End of Addition.txt ============================
         

Fix result of Farbar Recovery Scan Tool (x64) Version: 31-07-2019
Ran by ** (31-07-2019 22:38:42) Run:2
Running from C:\Users\*****\Desktop
Loaded Profiles: ** & ***** (Available Profiles: ** & *****)
Boot Mode: Normal
==============================================

fixlist content:
*****************
CloseProcesses:
Task: {26841A08-7BC8-413E-B648-4E9B88302A57} - System32\Tasks\EJlCPXAxczfLnX => rundll32 "C:\Program Files (x86)\XAIfWVzjYwlU2\ivfNGGvgifFGu.dll",#1
C:\Program Files (x86)\XAIfWVzjYwlU2
Task: {40446FB5-8319-4883-997A-0F4FB55BC044} - System32\Tasks\ibZIUHjYTxUPTmNsU2 => rundll32 "C:\Program Files (x86)\XSeHBAjlvbTDePgmqbR\yNwwave.dll",#1
C:\Program Files (x86)\XSeHBAjlvbTDePgmqbR
Task: {625224FD-B919-4BAE-8718-20D666776C9F} - System32\Tasks\WByhYcedlOQavqREWte2 => rundll32 "C:\Program Files (x86)\NIErSAELLsOOC\EfRGQll.dll",#1
C:\Program Files (x86)\NIErSAELLsOOC
Task: {6DF74A6B-67D3-462C-9413-F82E04D70F06} - System32\Tasks\KJMNwfnoaWMfhxH2 => rundll32 "C:\Program Files (x86)\udVlifMMU\vNGgfG.dll",#1
C:\Program Files (x86)\udVlifMMU
Task: {B1E92710-FA20-412F-A854-A8EECE9BA802} - System32\Tasks\WZdwAMJoIRSYG2 => C:\WINDOWS\system32\wscript.exe "C:\ProgramData\LUBciApiRJzrvXVB\PFmfVpo.wsf"
C:\ProgramData\LUBciApiRJzrvXVB
Task: {CCE6F463-0345-4BC9-8068-3F513EF4D603} - System32\Tasks\rescncttloqaqcg => msiexec.exe /quiet /i "C:\Users\**\AppData\Roaming\lwmjhnysqrpp\pbeohtnsooaelld.msi" WEBID=PP_MN_P3 TKNME=rescncttloqaqcg
Task: {75D51F29-E7D7-44DF-B5E3-DB305222BD70} - System32\Tasks\lqerkybtsayax => msiexec.exe /quiet /i "C:\Users\**\AppData\Roaming\lwmjhnysqrpp\pbeohtnsooaelld.msi" WEBID=PP_MN_P3 TKNME=lqerkybtsayax
C:\Users\**\AppData\Roaming\lwmjhnysqrpp
SearchScopes: HKU\S-1-5-21-1960842775-2088100534-3542962694-1001 -> DefaultScope {FFEBBF0A-C22C-4172-89FF-45215A135AC7} URL = 
BHO: YoutubeAdBlock -> {44EDBCE5-6691-4383-B723-8C21F5F1A004} -> C:\Program Files (x86)\bzDQAplLjIE\tMOJVg6.dll => No File
C:\Program Files (x86)\bzDQAplLjIE
BHO-x32: YoutubeAdBlock -> {44EDBCE5-6691-4383-B723-8C21F5F1A004} -> C:\Program Files (x86)\bzDQAplLjIE\kSQSQOyPW.dll => No File
FF Extension: (No Name) - C:\Program Files\Mozilla Firefox\browser\features\{BA546D42-BAEC-4C9C-870E-D0BE7892DBD5}.xpi [2019-07-25] [not signed]
FF user.js: detected! => C:\Users\**\AppData\Roaming\Mozilla\Firefox\Profiles\bt6jbw3e.default\user.js [2019-07-25]
C:\ProgramData\Lamia
C:\WINDOWS\System32\Tasks\System
2019-07-25 00:39 - 2019-07-25 00:41 - 000000000 ____D C:\Users\**\AppData\Local\Mail.Ru
2019-07-25 00:39 - 2019-07-25 00:40 - 000000000 ____D C:\ProgramData\Mail.Ru
2019-07-25 00:39 - 2019-07-25 00:39 - 000825856 _____ C:\Default.xml
2019-07-25 00:39 - 2019-07-25 00:39 - 000000000 ____D C:\ProgramData\Loosger
2019-07-25 00:38 - 2019-07-25 00:38 - 004059136 _____ C:\Users\**\Downloads\setup_f5ac96a97f5f.iso
2019-07-25 00:36 - 2019-07-25 00:36 - 007856585 _____ C:\Users\**\Downloads\K-ON!! MOD COMPLETE .rar
2019-07-25 00:36 - 2019-07-25 00:36 - 001132644 _____ C:\Users\**\Downloads\Nakano Azusa.rar
Tcpip\..\Interfaces\{293ee5fa-fe84-433a-a774-26687ea51594}: [NameServer] 45.114.8.167,,,116.203.6.218
Tcpip\..\Interfaces\{34eac78a-f8d3-4256-b5a3-9da0fc12e3a7}: [NameServer] 45.114.8.167,,,116.203.6.218
Tcpip\..\Interfaces\{da384fb4-1e59-48fc-bfe0-c27ce005f778}: [NameServer] 45.114.8.167,,,116.203.6.218
CHR HKLM\SOFTWARE\Policies\Google: Restriction <==== ATTENTION
HKLM\SOFTWARE\Policies\Microsoft\Windows Defender: Restriction <==== ATTENTION
CMD: dir "%ProgramFiles%"
CMD: dir "%ProgramFiles(x86)%"
CMD: dir "%ProgramData%"
CMD: dir "%Appdata%"
CMD: dir "%LocalAppdata%"
ExportKey: HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions
CMD: ipconfig /flushdns
CMD: netsh winsock reset
CMD: netsh advfirewall reset
CMD: netsh advfirewall set allprofiles state ON
CMD: Bitsadmin /Reset /Allusers
Hosts:
RemoveProxy:
EmptyTemp:

*****************

Processes closed successfully.
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{26841A08-7BC8-413E-B648-4E9B88302A57}" => not found
"C:\WINDOWS\System32\Tasks\EJlCPXAxczfLnX" => not found
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\EJlCPXAxczfLnX" => not found
"C:\Program Files (x86)\XAIfWVzjYwlU2" => not found
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{40446FB5-8319-4883-997A-0F4FB55BC044}" => not found
"C:\WINDOWS\System32\Tasks\ibZIUHjYTxUPTmNsU2" => not found
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\ibZIUHjYTxUPTmNsU2" => not found
"C:\Program Files (x86)\XSeHBAjlvbTDePgmqbR" => not found
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{625224FD-B919-4BAE-8718-20D666776C9F}" => not found
"C:\WINDOWS\System32\Tasks\WByhYcedlOQavqREWte2" => not found
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\WByhYcedlOQavqREWte2" => not found
"C:\Program Files (x86)\NIErSAELLsOOC" => not found
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{6DF74A6B-67D3-462C-9413-F82E04D70F06}" => not found
"C:\WINDOWS\System32\Tasks\KJMNwfnoaWMfhxH2" => not found
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\KJMNwfnoaWMfhxH2" => not found
"C:\Program Files (x86)\udVlifMMU" => not found
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{B1E92710-FA20-412F-A854-A8EECE9BA802}" => not found
"C:\WINDOWS\System32\Tasks\WZdwAMJoIRSYG2" => not found
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\WZdwAMJoIRSYG2" => not found
"C:\ProgramData\LUBciApiRJzrvXVB" => not found
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{CCE6F463-0345-4BC9-8068-3F513EF4D603}" => removed successfully
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{CCE6F463-0345-4BC9-8068-3F513EF4D603}" => removed successfully
C:\WINDOWS\System32\Tasks\rescncttloqaqcg => moved successfully
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\rescncttloqaqcg" => removed successfully
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{75D51F29-E7D7-44DF-B5E3-DB305222BD70}" => removed successfully
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{75D51F29-E7D7-44DF-B5E3-DB305222BD70}" => removed successfully
C:\WINDOWS\System32\Tasks\lqerkybtsayax => moved successfully
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\lqerkybtsayax" => removed successfully
"C:\Users\**\AppData\Roaming\lwmjhnysqrpp" => not found
"HKU\S-1-5-21-1960842775-2088100534-3542962694-1001\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope" => removed successfully
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{44EDBCE5-6691-4383-B723-8C21F5F1A004} => removed successfully
HKLM\Software\Classes\CLSID\{44EDBCE5-6691-4383-B723-8C21F5F1A004} => removed successfully
"C:\Program Files (x86)\bzDQAplLjIE" => not found
HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{44EDBCE5-6691-4383-B723-8C21F5F1A004} => removed successfully
HKLM\Software\Wow6432Node\Classes\CLSID\{44EDBCE5-6691-4383-B723-8C21F5F1A004} => removed successfully
C:\Program Files\Mozilla Firefox\browser\features\{BA546D42-BAEC-4C9C-870E-D0BE7892DBD5}.xpi => moved successfully
C:\Users\**\AppData\Roaming\Mozilla\Firefox\Profiles\bt6jbw3e.default\user.js => moved successfully
C:\ProgramData\Lamia => moved successfully
C:\WINDOWS\System32\Tasks\System => moved successfully
C:\Users\**\AppData\Local\Mail.Ru => moved successfully
C:\ProgramData\Mail.Ru => moved successfully
C:\Default.xml => moved successfully
C:\ProgramData\Loosger => moved successfully
C:\Users\**\Downloads\setup_f5ac96a97f5f.iso => moved successfully
C:\Users\**\Downloads\K-ON!! MOD COMPLETE .rar => moved successfully
C:\Users\**\Downloads\Nakano Azusa.rar => moved successfully
"HKLM\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{293ee5fa-fe84-433a-a774-26687ea51594}\\NameServer" => removed successfully
"HKLM\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{34eac78a-f8d3-4256-b5a3-9da0fc12e3a7}\\NameServer" => removed successfully
"HKLM\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{da384fb4-1e59-48fc-bfe0-c27ce005f778}\\NameServer" => removed successfully
HKLM\SOFTWARE\Policies\Google => removed successfully
HKLM\SOFTWARE\Policies\Microsoft\Windows Defender => removed successfully

========= dir "%ProgramFiles%" =========

 Volume in Laufwerk C: hat keine Bezeichnung.
 Volumeseriennummer: B6BD-2C46

 Verzeichnis von C:\Program Files

30.07.2019  21:10    <DIR>          .
30.07.2019  21:10    <DIR>          ..
20.12.2018  22:33    <DIR>          Common Files
20.12.2018  22:32    <DIR>          EpsonNet
28.05.2019  18:34    <DIR>          Google
17.12.2018  09:19    <DIR>          Intel
12.06.2019  23:46    <DIR>          internet explorer
24.05.2019  20:54    <DIR>          Java
30.07.2019  21:10    <DIR>          Malwarebytes
14.12.2018  10:40    <DIR>          Microsoft Office
25.07.2019  01:01    <DIR>          Mozilla Firefox
14.03.2019  21:33    <DIR>          MSBuild
14.12.2018  18:51    <DIR>          Realtek
14.03.2019  21:33    <DIR>          Reference Assemblies
21.06.2019  22:17    <DIR>          rempl
14.03.2019  23:00    <DIR>          TAP-Windows
19.06.2019  18:44    <DIR>          UNP
11.04.2019  18:24    <DIR>          Windows Defender
09.07.2019  21:10    <DIR>          Windows Defender Advanced Threat Protection
14.12.2018  18:51    <DIR>          Windows Mail
20.12.2018  22:09    <DIR>          Windows Media Player
12.04.2018  01:38    <DIR>          Windows Multimedia Platform
12.04.2018  01:38    <DIR>          windows nt
20.12.2018  22:09    <DIR>          Windows Photo Viewer
12.04.2018  01:38    <DIR>          Windows Portable Devices
12.04.2018  01:38    <DIR>          Windows Security
12.04.2018  01:38    <DIR>          WindowsPowerShell
               0 Datei(en),              0 Bytes
              27 Verzeichnis(se), 111.479.885.824 Bytes frei

========= End of CMD: =========


========= dir "%ProgramFiles(x86)%" =========

 Volume in Laufwerk C: hat keine Bezeichnung.
 Volumeseriennummer: B6BD-2C46

 Verzeichnis von C:\Program Files (x86)

31.07.2019  19:08    <DIR>          .
31.07.2019  19:08    <DIR>          ..
14.12.2018  11:10    <DIR>          Adobe
24.07.2019  21:13    <DIR>          Age of Empires complete
13.05.2019  21:24    <DIR>          Bit4id
24.07.2019  19:11    <DIR>          Common Files
14.03.2019  21:22    <DIR>          Disig
14.03.2019  23:01    <DIR>          Ditec
31.07.2019  19:08    <DIR>          duxVclVEU
02.05.2019  06:52    <DIR>          EAC MW klient
20.12.2018  22:31    <DIR>          epson
14.12.2018  11:11    <DIR>          Google
31.07.2019  19:08    <DIR>          hhaccViKlMUn
27.07.2019  14:10    <DIR>          Intel
12.06.2019  23:46    <DIR>          Internet Explorer
14.12.2018  10:40    <DIR>          Microsoft Analysis Services
14.12.2018  10:41    <DIR>          Microsoft Office
14.12.2018  10:41    <DIR>          Microsoft SQL Server
14.12.2018  18:52    <DIR>          Microsoft.NET
31.07.2019  19:08    <DIR>          minXQDMZbIE
14.12.2018  10:41    <DIR>          Mozilla Firefox
25.07.2019  01:01    <DIR>          Mozilla Maintenance Service
14.03.2019  21:33    <DIR>          MSBuild
09.01.2019  09:41    <DIR>          MSI
20.12.2018  23:03    <DIR>          OLYMPUS
20.12.2018  23:02    <DIR>          QuickTime
14.12.2018  18:09    <DIR>          Realtek
14.12.2018  18:51    <DIR>          Reference Assemblies
14.12.2018  18:02    <DIR>          Setup Files
31.07.2019  19:14    <DIR>          Spybot - Search & Destroy 2
19.03.2019  20:41    <DIR>          SSC Service Utility
10.03.2019  19:27    <DIR>          TextPad 4
14.12.2018  19:00    <DIR>          VulkanRT
13.03.2019  19:54    <DIR>          Windows Defender
14.12.2018  18:51    <DIR>          Windows Mail
20.12.2018  22:09    <DIR>          Windows Media Player
12.04.2018  01:38    <DIR>          Windows Multimedia Platform
12.04.2018  01:38    <DIR>          windows nt
20.12.2018  22:09    <DIR>          Windows Photo Viewer
12.04.2018  01:38    <DIR>          Windows Portable Devices
12.04.2018  01:38    <DIR>          WindowsPowerShell
24.07.2019  23:11    <DIR>          WinRAR
               0 Datei(en),              0 Bytes
              42 Verzeichnis(se), 111.479.885.824 Bytes frei

========= End of CMD: =========


========= dir "%ProgramData%" =========

 Volume in Laufwerk C: hat keine Bezeichnung.
 Volumeseriennummer: B6BD-2C46

 Verzeichnis von C:\ProgramData

17.02.2019  18:50    <DIR>          .mono
14.12.2018  11:39    <DIR>          Adobe
15.05.2019  06:49    <DIR>          boost_interprocess
30.10.2015  09:24    <DIR>          Comms
14.12.2018  18:19    <DIR>          Dell
14.03.2019  23:01    <DIR>          Ditec
14.12.2018  18:09                 0 DP45977C.lfl
20.12.2018  22:37    <DIR>          EPSON
14.12.2018  18:59    <DIR>          Intel
30.07.2019  21:10    <DIR>          Malwarebytes
14.12.2018  10:42    <DIR>          Microsoft Help
17.12.2018  09:13    <DIR>          Microsoft OneDrive
05.02.2019  19:05    <DIR>          Mozilla
20.12.2018  23:04    <DIR>          OLYMPUS
24.05.2019  20:54    <DIR>          Oracle
27.07.2019  14:10    <DIR>          Package Cache
09.02.2019  11:51    <DIR>          Packages
20.12.2018  23:02    <DIR>          QuickTime
31.07.2019  20:37    <DIR>          regid.1991-06.com.microsoft
12.04.2018  01:38    <DIR>          SoftwareDistribution
31.07.2019  19:13    <DIR>          Spybot - Search & Destroy
25.07.2019  01:04    <DIR>          TmpLoog
14.12.2018  18:56    <DIR>          USOPrivate
14.12.2018  18:57    <DIR>          USOShared
12.04.2018  19:08    <DIR>          WindowsHolographicDevices
               1 Datei(en),              0 Bytes
              24 Verzeichnis(se), 111.479.881.728 Bytes frei

========= End of CMD: =========


========= dir "%Appdata%" =========

 Volume in Laufwerk C: hat keine Bezeichnung.
 Volumeseriennummer: B6BD-2C46

 Verzeichnis von C:\Users\**\AppData\Roaming

25.07.2019  02:15    <DIR>          .
25.07.2019  02:15    <DIR>          ..
17.02.2019  18:50    <DIR>          .mono
24.05.2019  20:56    <DIR>          .technic
14.12.2018  11:11    <DIR>          Adobe
14.03.2019  21:22    <DIR>          EAC_MW_klient
03.02.2019  19:29    <DIR>          EPSON
14.12.2018  11:08    <DIR>          Macromedia
20.12.2018  21:40    <DIR>          Mozilla
24.04.2019  21:51    <DIR>          Spore
24.05.2019  20:54    <DIR>          Sun
10.03.2019  19:27    <DIR>          TextPad
24.07.2019  23:11    <DIR>          WinRAR
               0 Datei(en),              0 Bytes
              13 Verzeichnis(se), 111.479.881.728 Bytes frei

========= End of CMD: =========


========= dir "%LocalAppdata%" =========

 Volume in Laufwerk C: hat keine Bezeichnung.
 Volumeseriennummer: B6BD-2C46

 Verzeichnis von C:\Users\**\AppData\Local

31.07.2019  22:38    <DIR>          .
31.07.2019  22:38    <DIR>          ..
14.12.2018  09:59    <DIR>          ActiveSync
13.07.2019  17:02    <DIR>          Adobe
24.07.2019  19:20    <DIR>          CEF
17.02.2019  18:46    <DIR>          Colossal Order
14.12.2018  10:14    <DIR>          Comms
20.12.2018  22:11    <DIR>          ConnectedDevicesPlatform
25.07.2019  01:38    <DIR>          D3DSCache
14.12.2018  20:56    <DIR>          DBG
25.07.2019  00:58    <DIR>          Diagnostics
25.07.2019  00:55    <DIR>          ElevatedDiagnostics
14.12.2018  11:21    <DIR>          Google
14.12.2018  19:00    <DIR>          Intel
30.07.2019  22:25    <DIR>          mbamtray
25.07.2019  00:58    <DIR>          Microsoft
14.12.2018  10:40    <DIR>          Microsoft Help
14.12.2018  11:02    <DIR>          MicrosoftEdge
20.12.2018  21:56    <DIR>          Mozilla
17.07.2019  14:09    <DIR>          Packages
20.12.2018  23:10    <DIR>          PeerDistRepub
07.01.2019  11:57    <DIR>          PlaceholderTileLogoFolder
14.12.2018  11:13    <DIR>          Programs
14.12.2018  19:19    <DIR>          Publishers
25.07.2019  01:45    <DIR>          speech
24.07.2019  19:20    <DIR>          Steam
31.07.2019  20:01    <DIR>          Temp
14.12.2018  09:57    <DIR>          TileDataLayer
24.07.2019  22:59    <DIR>          VirtualStore
               0 Datei(en),              0 Bytes
              29 Verzeichnis(se), 111.479.881.728 Bytes frei

========= End of CMD: =========

================== ExportKey: ===================

[HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions]
[HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Extensions]
[HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths]
"C:\Users\**\AppData\Roaming\lwmjhnysqrpp"="0"
"C:\ProgramData"="0"
"C:\WINDOWS\Temp\prBQoRtdiGvnAgML"="0"
"C:\Program Files (x86)\IKweScizynZHzgXUqVR"="0"
"C:\Program Files (x86)\duxVclVEU"="0"
"C:\Program Files (x86)\hhaccViKlMUn"="0"
"C:\Program Files (x86)\minXQDMZbIE"="0"
"C:\Program Files (x86)\nyOTaFQVaERJC"="0"
"C:\Program Files (x86)\oXNCRiLjSDbU2"="0"
"C:\ProgramData\tsbIJNdKRcSPLnVB"="0"
"C:\Users\*****\AppData\LocalLow\VYeRfUFKkRVtG"="0"
"C:\Users\*****\AppData\Local\Temp\tIGslkYqGZoVsFFpY"="0"
[HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes]
[HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\TemporaryPaths]

=== End of ExportKey ===

========= ipconfig /flushdns =========


Windows-IP-Konfiguration

Der DNS-Aufl”sungscache wurde geleert.

========= End of CMD: =========


========= netsh winsock reset =========


Der Winsock-Katalog wurde zur�ckgesetzt.
Sie m�ssen den Computer neu starten, um den Vorgang abzuschlieáen.


========= End of CMD: =========


========= netsh advfirewall reset =========

OK.


========= End of CMD: =========


========= netsh advfirewall set allprofiles state ON =========

OK.


========= End of CMD: =========


========= Bitsadmin /Reset /Allusers =========


BITSADMIN version 3.0
BITS administration utility.
(C) Copyright Microsoft Corp.

Unable to cancel {DF6CDD7A-5559-4AE8-B43B-BD5FF31257FE}.
0 out of 1 jobs canceled.

========= End of CMD: =========

C:\Windows\System32\Drivers\etc\hosts => moved successfully
Hosts restored successfully.

========= RemoveProxy: =========

"HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\DefaultConnectionSettings" => removed successfully
"HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\SavedLegacySettings" => removed successfully
"HKU\S-1-5-21-1960842775-2088100534-3542962694-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\DefaultConnectionSettings" => removed successfully
"HKU\S-1-5-21-1960842775-2088100534-3542962694-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\SavedLegacySettings" => removed successfully
"HKU\S-1-5-21-1960842775-2088100534-3542962694-1002\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\DefaultConnectionSettings" => removed successfully
"HKU\S-1-5-21-1960842775-2088100534-3542962694-1002\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\SavedLegacySettings" => removed successfully


========= End of RemoveProxy: =========


=========== EmptyTemp: ==========

BITS transfer queue => 10510336 B
DOMStore, IE Recovery, AppCache, Feeds Cache, Thumbcache, IconCache => 1820018558 B
Java, Flash, Steam htmlcache => 13583168 B
Windows/system/drivers => 7501725 B
Edge => 2489213 B
Chrome => 23642199 B
Firefox => 54521500 B
Opera => 0 B

Temp, IE cache, history, cookies, recent:
Default => 0 B
Users => 0 B
ProgramData => 0 B
Public => 0 B
systemprofile => 0 B
systemprofile32 => 0 B
LocalService => 16754 B
LocalService => 0 B
NetworkService => 5137304 B
NetworkService => 0 B
** => 16907 B
***** => 5555147 B

RecycleBin => 18806369 B
EmptyTemp: => 1.8 GB temporary data Removed.

================================


The system needed a reboot.

==== End of Fixlog 22:38:53 ====
         

Die Malware ist noch da, schwerer zu entfernen als gedacht.

Wir müssen nochmal ran, alles wieder als Admin.






Schritt 1

• Kopiere den gesamten Inhalt der folgenden Code-Box:
  

  Start::
  CloseProcesses:
  Task: {0329A4D0-5B41-43F6-98D2-6B150F1F7329} - System32\Tasks\oncIfaVdQabfxqj => rundll32 "C:\Program Files (x86)\duxVclVEU\UcXfsx.dll",#1
  Task: C:\WINDOWS\Tasks\oncIfaVdQabfxqj.job => C:\Program Files (x86)\duxVclVEU\UcXfsx.dll
  C:\Program Files (x86)\duxVclVEU
  C:\Program Files (x86)\hhaccViKlMUn
  C:\Program Files (x86)\minXQDMZbIE
  DeleteValue: HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths|C:\Users\CurrentUserName\AppData\Roaming\lwmjhnysqrpp
  DeleteValue: HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths|C:\Users\Jozko\AppData\Roaming\lwmjhnysqrpp
  DeleteValue: HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths|C:\Users\Lubka\AppData\Roaming\lwmjhnysqrpp
  DeleteValue: HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths|C:\ProgramData
  DeleteValue: HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths|C:\WINDOWS\Temp\prBQoRtdiGvnAgML
  DeleteValue: HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths|C:\Program Files (x86)\IKweScizynZHzgXUqVR
  DeleteValue: HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths|C:\Program Files (x86)\duxVclVEU
  DeleteValue: HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths|C:\Program Files (x86)\hhaccViKlMUn
  DeleteValue: HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths|C:\Program Files (x86)\minXQDMZbIE
  DeleteValue: HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths|C:\Program Files (x86)\nyOTaFQVaERJC
  DeleteValue: HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths|C:\Program Files (x86)\oXNCRiLjSDbU2
  DeleteValue: HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths|C:\ProgramData\tsbIJNdKRcSPLnVB
  DeleteValue: HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths|C:\Users\CurrentUserName\AppData\LocalLow\VYeRfUFKkRVtG
  DeleteValue: HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths|C:\Users\CurrentUserName\AppData\Local\tIGslkYqGZoVsFFpY
  DeleteValue: HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths|C:\Users\Jozko\AppData\LocalLow\VYeRfUFKkRVtG
  DeleteValue: HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths|C:\Users\Jozko\AppData\Local\Temp\tIGslkYqGZoVsFFpY
  DeleteValue: HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths|C:\Users\Lubka\AppData\LocalLow\VYeRfUFKkRVtG
  DeleteValue: HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths|C:\Users\Lubka\AppData\Local\Temp\tIGslkYqGZoVsFFpY
  GroupPolicy: Restriction - Windows Defender <==== ATTENTION
  C:\ProgramData\ntuser.pol
  C:\Users\CurrentUserName\ntuser.pol
  C:\Users\Jozko\ntuser.pol
  C:\Users\Lubka\ntuser.pol
  C:\Users\CurrentUserName\AppData\LocalLow\VYeRfUFKkRVtG
  C:\Users\Jozko\AppData\LocalLow\VYeRfUFKkRVtG
  C:\Users\Lubka\AppData\LocalLow\VYeRfUFKkRVtG
  CMD: dir "%ProgramFiles%"
  CMD: dir "%ProgramFiles(x86)%"
  CMD: dir "%ProgramData%"
  CMD: dir "%Appdata%"
  CMD: dir "%LocalAppdata%"
  CMD: dir "C:\Users\Jozko\AppData\Local"
  CMD: dir "C:\Users\Lubka\AppData\Local"
  ExportKey: HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions
  EmptyTemp:
  End::
           

• Starte nun FRST und klicke direkt den Entfernen Button.Wichtig: Du brauchst den Inhalt der Code-Box nirgends einfügen, da sich FRST den Code aus der Zwischenablage holt!
• Das Tool führt die gewünschten Schritte aus und erstellt eine fixlog.txt im selben Verzeichnis, in dem sich FRST befindet.
• Gegebenenfalls muss dein Rechner neu gestartet werden.
• Poste mir den Inhalt der fixlog.txt mit deiner nächsten Antwort.

Schritt 2

• Starte FRST erneut. Vergewissere dich, dass vor Addition.txt ein Haken gesetzt ist und drücke auf Untersuchen.
• FRST erstellt wieder zwei Logdateien (FRST.txt und Addition.txt).
• Poste mir beide Logdateien mit deiner nächsten Antwort.

Bitte poste mit deiner nächsten Antwort:

• die Logdatei des FRST-Fix (fixlog.txt)
• die beiden neuen Logdateien von FRST (FRST.txt und Addition.txt)

Den rsten Schritt habe ich (unabsichtlich) 2 mal gemacht. Leider es gibt nur letzte fix.log

Fix result of Farbar Recovery Scan Tool (x64) Version: 31-07-2019
Ran by Lubka (01-08-2019 13:40:05) Run:4
Running from C:\Users\Jozko\Desktop
Loaded Profiles: Lubka & Jozko (Available Profiles: Lubka & Jozko)
Boot Mode: Normal
==============================================

fixlist content:
*****************
CloseProcesses:
Task: {0329A4D0-5B41-43F6-98D2-6B150F1F7329} - System32\Tasks\oncIfaVdQabfxqj => rundll32 "C:\Program Files (x86)\duxVclVEU\UcXfsx.dll",#1
Task: C:\WINDOWS\Tasks\oncIfaVdQabfxqj.job => C:\Program Files (x86)\duxVclVEU\UcXfsx.dll
C:\Program Files (x86)\duxVclVEU
C:\Program Files (x86)\hhaccViKlMUn
C:\Program Files (x86)\minXQDMZbIE
DeleteValue: HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths|C:\Users\Lubka\AppData\Roaming\lwmjhnysqrpp
DeleteValue: HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths|C:\Users\Jozko\AppData\Roaming\lwmjhnysqrpp
DeleteValue: HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths|C:\Users\Lubka\AppData\Roaming\lwmjhnysqrpp
DeleteValue: HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths|C:\ProgramData
DeleteValue: HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths|C:\WINDOWS\Temp\prBQoRtdiGvnAgML
DeleteValue: HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths|C:\Program Files (x86)\IKweScizynZHzgXUqVR
DeleteValue: HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths|C:\Program Files (x86)\duxVclVEU
DeleteValue: HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths|C:\Program Files (x86)\hhaccViKlMUn
DeleteValue: HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths|C:\Program Files (x86)\minXQDMZbIE
DeleteValue: HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths|C:\Program Files (x86)\nyOTaFQVaERJC
DeleteValue: HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths|C:\Program Files (x86)\oXNCRiLjSDbU2
DeleteValue: HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths|C:\ProgramData\tsbIJNdKRcSPLnVB
DeleteValue: HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths|C:\Users\Lubka\AppData\LocalLow\VYeRfUFKkRVtG
DeleteValue: HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths|C:\Users\Lubka\AppData\Local\tIGslkYqGZoVsFFpY
DeleteValue: HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths|C:\Users\Jozko\AppData\LocalLow\VYeRfUFKkRVtG
DeleteValue: HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths|C:\Users\Jozko\AppData\Local\Temp\tIGslkYqGZoVsFFpY
DeleteValue: HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths|C:\Users\Lubka\AppData\LocalLow\VYeRfUFKkRVtG
DeleteValue: HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths|C:\Users\Lubka\AppData\Local\Temp\tIGslkYqGZoVsFFpY
GroupPolicy: Restriction - Windows Defender <==== ATTENTION
C:\ProgramData\ntuser.pol
C:\Users\Lubka\ntuser.pol
C:\Users\Jozko\ntuser.pol
C:\Users\Lubka\ntuser.pol
C:\Users\Lubka\AppData\LocalLow\VYeRfUFKkRVtG
C:\Users\Jozko\AppData\LocalLow\VYeRfUFKkRVtG
C:\Users\Lubka\AppData\LocalLow\VYeRfUFKkRVtG
CMD: dir "%ProgramFiles%"
CMD: dir "%ProgramFiles(x86)%"
CMD: dir "%ProgramData%"
CMD: dir "%Appdata%"
CMD: dir "%LocalAppdata%"
CMD: dir "C:\Users\Jozko\AppData\Local"
CMD: dir "C:\Users\Lubka\AppData\Local"
ExportKey: HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions
EmptyTemp:

*****************

Processes closed successfully.
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{0329A4D0-5B41-43F6-98D2-6B150F1F7329}" => not found
"C:\WINDOWS\System32\Tasks\oncIfaVdQabfxqj" => not found
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\oncIfaVdQabfxqj" => not found
"C:\WINDOWS\Tasks\oncIfaVdQabfxqj.job" => not found
"C:\Program Files (x86)\duxVclVEU" => not found
"C:\Program Files (x86)\hhaccViKlMUn" => not found
"C:\Program Files (x86)\minXQDMZbIE" => not found
"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\\C:\Users\Lubka\AppData\Roaming\lwmjhnysqrpp" => not found
"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\\C:\Users\Jozko\AppData\Roaming\lwmjhnysqrpp" => not found
"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\\C:\Users\Lubka\AppData\Roaming\lwmjhnysqrpp" => not found
"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\\C:\ProgramData" => not found
"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\\C:\WINDOWS\Temp\prBQoRtdiGvnAgML" => not found
"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\\C:\Program Files (x86)\IKweScizynZHzgXUqVR" => not found
"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\\C:\Program Files (x86)\duxVclVEU" => not found
"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\\C:\Program Files (x86)\hhaccViKlMUn" => not found
"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\\C:\Program Files (x86)\minXQDMZbIE" => not found
"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\\C:\Program Files (x86)\nyOTaFQVaERJC" => not found
"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\\C:\Program Files (x86)\oXNCRiLjSDbU2" => not found
"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\\C:\ProgramData\tsbIJNdKRcSPLnVB" => not found
"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\\C:\Users\Lubka\AppData\LocalLow\VYeRfUFKkRVtG" => not found
"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\\C:\Users\Lubka\AppData\Local\tIGslkYqGZoVsFFpY" => not found
"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\\C:\Users\Jozko\AppData\LocalLow\VYeRfUFKkRVtG" => not found
"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\\C:\Users\Jozko\AppData\Local\Temp\tIGslkYqGZoVsFFpY" => not found
"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\\C:\Users\Lubka\AppData\LocalLow\VYeRfUFKkRVtG" => not found
"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\\C:\Users\Lubka\AppData\Local\Temp\tIGslkYqGZoVsFFpY" => not found
"C:\WINDOWS\system32\GroupPolicy\Machine" => not found
C:\ProgramData\ntuser.pol => moved successfully
"C:\Users\Lubka\ntuser.pol" => not found
C:\Users\Jozko\ntuser.pol => moved successfully
"C:\Users\Lubka\ntuser.pol" => not found
"C:\Users\Lubka\AppData\LocalLow\VYeRfUFKkRVtG" => not found
"C:\Users\Jozko\AppData\LocalLow\VYeRfUFKkRVtG" => not found
"C:\Users\Lubka\AppData\LocalLow\VYeRfUFKkRVtG" => not found

========= dir "%ProgramFiles%" =========

 Volume in Laufwerk C: hat keine Bezeichnung.
 Volumeseriennummer: B6BD-2C46

 Verzeichnis von C:\Program Files

30.07.2019  21:10    <DIR>          .
30.07.2019  21:10    <DIR>          ..
20.12.2018  22:33    <DIR>          Common Files
20.12.2018  22:32    <DIR>          EpsonNet
28.05.2019  18:34    <DIR>          Google
17.12.2018  09:19    <DIR>          Intel
12.06.2019  23:46    <DIR>          internet explorer
24.05.2019  20:54    <DIR>          Java
30.07.2019  21:10    <DIR>          Malwarebytes
14.12.2018  10:40    <DIR>          Microsoft Office
25.07.2019  01:01    <DIR>          Mozilla Firefox
14.03.2019  21:33    <DIR>          MSBuild
14.12.2018  18:51    <DIR>          Realtek
14.03.2019  21:33    <DIR>          Reference Assemblies
21.06.2019  22:17    <DIR>          rempl
14.03.2019  23:00    <DIR>          TAP-Windows
19.06.2019  18:44    <DIR>          UNP
11.04.2019  18:24    <DIR>          Windows Defender
09.07.2019  21:10    <DIR>          Windows Defender Advanced Threat Protection
14.12.2018  18:51    <DIR>          Windows Mail
20.12.2018  22:09    <DIR>          Windows Media Player
12.04.2018  01:38    <DIR>          Windows Multimedia Platform
12.04.2018  01:38    <DIR>          windows nt
20.12.2018  22:09    <DIR>          Windows Photo Viewer
12.04.2018  01:38    <DIR>          Windows Portable Devices
12.04.2018  01:38    <DIR>          Windows Security
12.04.2018  01:38    <DIR>          WindowsPowerShell
               0 Datei(en),              0 Bytes
              27 Verzeichnis(se), 113.800.474.624 Bytes frei

========= End of CMD: =========


========= dir "%ProgramFiles(x86)%" =========

 Volume in Laufwerk C: hat keine Bezeichnung.
 Volumeseriennummer: B6BD-2C46

 Verzeichnis von C:\Program Files (x86)

01.08.2019  13:37    <DIR>          .
01.08.2019  13:37    <DIR>          ..
14.12.2018  11:10    <DIR>          Adobe
24.07.2019  21:13    <DIR>          Age of Empires complete
13.05.2019  21:24    <DIR>          Bit4id
24.07.2019  19:11    <DIR>          Common Files
14.03.2019  21:22    <DIR>          Disig
14.03.2019  23:01    <DIR>          Ditec
02.05.2019  06:52    <DIR>          EAC MW klient
20.12.2018  22:31    <DIR>          epson
14.12.2018  11:11    <DIR>          Google
27.07.2019  14:10    <DIR>          Intel
12.06.2019  23:46    <DIR>          Internet Explorer
14.12.2018  10:40    <DIR>          Microsoft Analysis Services
14.12.2018  10:41    <DIR>          Microsoft Office
14.12.2018  10:41    <DIR>          Microsoft SQL Server
14.12.2018  18:52    <DIR>          Microsoft.NET
14.12.2018  10:41    <DIR>          Mozilla Firefox
25.07.2019  01:01    <DIR>          Mozilla Maintenance Service
14.03.2019  21:33    <DIR>          MSBuild
09.01.2019  09:41    <DIR>          MSI
20.12.2018  23:03    <DIR>          OLYMPUS
20.12.2018  23:02    <DIR>          QuickTime
14.12.2018  18:09    <DIR>          Realtek
14.12.2018  18:51    <DIR>          Reference Assemblies
14.12.2018  18:02    <DIR>          Setup Files
31.07.2019  19:14    <DIR>          Spybot - Search & Destroy 2
19.03.2019  20:41    <DIR>          SSC Service Utility
10.03.2019  19:27    <DIR>          TextPad 4
14.12.2018  19:00    <DIR>          VulkanRT
13.03.2019  19:54    <DIR>          Windows Defender
14.12.2018  18:51    <DIR>          Windows Mail
20.12.2018  22:09    <DIR>          Windows Media Player
12.04.2018  01:38    <DIR>          Windows Multimedia Platform
12.04.2018  01:38    <DIR>          windows nt
20.12.2018  22:09    <DIR>          Windows Photo Viewer
12.04.2018  01:38    <DIR>          Windows Portable Devices
12.04.2018  01:38    <DIR>          WindowsPowerShell
24.07.2019  23:11    <DIR>          WinRAR
               0 Datei(en),              0 Bytes
              39 Verzeichnis(se), 113.800.474.624 Bytes frei

========= End of CMD: =========


========= dir "%ProgramData%" =========

 Volume in Laufwerk C: hat keine Bezeichnung.
 Volumeseriennummer: B6BD-2C46

 Verzeichnis von C:\ProgramData

17.02.2019  18:50    <DIR>          .mono
14.12.2018  11:39    <DIR>          Adobe
15.05.2019  06:49    <DIR>          boost_interprocess
30.10.2015  09:24    <DIR>          Comms
14.12.2018  18:19    <DIR>          Dell
14.03.2019  23:01    <DIR>          Ditec
14.12.2018  18:09                 0 DP45977C.lfl
20.12.2018  22:37    <DIR>          EPSON
14.12.2018  18:59    <DIR>          Intel
30.07.2019  21:10    <DIR>          Malwarebytes
14.12.2018  10:42    <DIR>          Microsoft Help
17.12.2018  09:13    <DIR>          Microsoft OneDrive
05.02.2019  19:05    <DIR>          Mozilla
20.12.2018  23:04    <DIR>          OLYMPUS
24.05.2019  20:54    <DIR>          Oracle
27.07.2019  14:10    <DIR>          Package Cache
09.02.2019  11:51    <DIR>          Packages
20.12.2018  23:02    <DIR>          QuickTime
31.07.2019  22:57    <DIR>          regid.1991-06.com.microsoft
12.04.2018  01:38    <DIR>          SoftwareDistribution
31.07.2019  19:13    <DIR>          Spybot - Search & Destroy
25.07.2019  01:04    <DIR>          TmpLoog
14.12.2018  18:56    <DIR>          USOPrivate
14.12.2018  18:57    <DIR>          USOShared
12.04.2018  19:08    <DIR>          WindowsHolographicDevices
               1 Datei(en),              0 Bytes
              24 Verzeichnis(se), 113.800.470.528 Bytes frei

========= End of CMD: =========


========= dir "%Appdata%" =========

 Volume in Laufwerk C: hat keine Bezeichnung.
 Volumeseriennummer: B6BD-2C46

 Verzeichnis von C:\Users\Lubka\AppData\Roaming

25.07.2019  02:15    <DIR>          .
25.07.2019  02:15    <DIR>          ..
17.02.2019  18:50    <DIR>          .mono
24.05.2019  20:56    <DIR>          .technic
14.12.2018  11:11    <DIR>          Adobe
14.03.2019  21:22    <DIR>          EAC_MW_klient
03.02.2019  19:29    <DIR>          EPSON
14.12.2018  11:08    <DIR>          Macromedia
20.12.2018  21:40    <DIR>          Mozilla
24.04.2019  21:51    <DIR>          Spore
24.05.2019  20:54    <DIR>          Sun
10.03.2019  19:27    <DIR>          TextPad
24.07.2019  23:11    <DIR>          WinRAR
               0 Datei(en),              0 Bytes
              13 Verzeichnis(se), 113.800.470.528 Bytes frei

========= End of CMD: =========


========= dir "%LocalAppdata%" =========

 Volume in Laufwerk C: hat keine Bezeichnung.
 Volumeseriennummer: B6BD-2C46

 Verzeichnis von C:\Users\Lubka\AppData\Local

31.07.2019  22:38    <DIR>          .
31.07.2019  22:38    <DIR>          ..
14.12.2018  09:59    <DIR>          ActiveSync
13.07.2019  17:02    <DIR>          Adobe
24.07.2019  19:20    <DIR>          CEF
17.02.2019  18:46    <DIR>          Colossal Order
14.12.2018  10:14    <DIR>          Comms
20.12.2018  22:11    <DIR>          ConnectedDevicesPlatform
25.07.2019  01:38    <DIR>          D3DSCache
14.12.2018  20:56    <DIR>          DBG
25.07.2019  00:58    <DIR>          Diagnostics
25.07.2019  00:55    <DIR>          ElevatedDiagnostics
14.12.2018  11:21    <DIR>          Google
14.12.2018  19:00    <DIR>          Intel
30.07.2019  22:25    <DIR>          mbamtray
25.07.2019  00:58    <DIR>          Microsoft
14.12.2018  10:40    <DIR>          Microsoft Help
14.12.2018  11:02    <DIR>          MicrosoftEdge
20.12.2018  21:56    <DIR>          Mozilla
17.07.2019  14:09    <DIR>          Packages
20.12.2018  23:10    <DIR>          PeerDistRepub
07.01.2019  11:57    <DIR>          PlaceholderTileLogoFolder
14.12.2018  11:13    <DIR>          Programs
14.12.2018  19:19    <DIR>          Publishers
25.07.2019  01:45    <DIR>          speech
24.07.2019  19:20    <DIR>          Steam
01.08.2019  13:37    <DIR>          Temp
14.12.2018  09:57    <DIR>          TileDataLayer
24.07.2019  22:59    <DIR>          VirtualStore
               0 Datei(en),              0 Bytes
              29 Verzeichnis(se), 113.800.466.432 Bytes frei

========= End of CMD: =========


========= dir "C:\Users\Jozko\AppData\Local" =========

 Volume in Laufwerk C: hat keine Bezeichnung.
 Volumeseriennummer: B6BD-2C46

 Verzeichnis von C:\Users\Jozko\AppData\Local

31.07.2019  20:01    <DIR>          .
31.07.2019  20:01    <DIR>          ..
13.07.2019  17:03    <DIR>          Adobe
14.03.2019  21:29    <DIR>          Apps
20.12.2018  22:27    <DIR>          Comms
03.01.2019  14:53    <DIR>          ConnectedDevicesPlatform
30.07.2019  20:15    <DIR>          D3DSCache
27.12.2018  12:08    <DIR>          DBG
14.03.2019  23:01    <DIR>          Deployment
14.03.2019  21:34    <DIR>          Finanźn‚_riadite–stvo_SR_-_Sekcia_daĺov*
20.12.2018  22:11    <DIR>          Google
20.12.2018  22:12    <DIR>          Intel
30.07.2019  21:11    <DIR>          mbam
30.07.2019  21:11    <DIR>          mbamtray
14.03.2019  21:45    <DIR>          Microsoft
20.12.2018  22:11    <DIR>          MicrosoftEdge
20.12.2018  22:48    <DIR>          Mozilla
31.07.2019  22:42    <DIR>          Packages
31.07.2019  20:01    <DIR>          PeerDistRepub
20.02.2019  21:17    <DIR>          PlaceholderTileLogoFolder
20.12.2018  22:46    <DIR>          Publishers
01.08.2019  13:39    <DIR>          Temp
02.01.2019  20:23    <DIR>          VirtualStore
               0 Datei(en),              0 Bytes
              23 Verzeichnis(se), 113.800.466.432 Bytes frei

========= End of CMD: =========


========= dir "C:\Users\Lubka\AppData\Local" =========

 Volume in Laufwerk C: hat keine Bezeichnung.
 Volumeseriennummer: B6BD-2C46

 Verzeichnis von C:\Users\Lubka\AppData\Local

31.07.2019  22:38    <DIR>          .
31.07.2019  22:38    <DIR>          ..
14.12.2018  09:59    <DIR>          ActiveSync
13.07.2019  17:02    <DIR>          Adobe
24.07.2019  19:20    <DIR>          CEF
17.02.2019  18:46    <DIR>          Colossal Order
14.12.2018  10:14    <DIR>          Comms
20.12.2018  22:11    <DIR>          ConnectedDevicesPlatform
25.07.2019  01:38    <DIR>          D3DSCache
14.12.2018  20:56    <DIR>          DBG
25.07.2019  00:58    <DIR>          Diagnostics
25.07.2019  00:55    <DIR>          ElevatedDiagnostics
14.12.2018  11:21    <DIR>          Google
14.12.2018  19:00    <DIR>          Intel
30.07.2019  22:25    <DIR>          mbamtray
25.07.2019  00:58    <DIR>          Microsoft
14.12.2018  10:40    <DIR>          Microsoft Help
14.12.2018  11:02    <DIR>          MicrosoftEdge
20.12.2018  21:56    <DIR>          Mozilla
17.07.2019  14:09    <DIR>          Packages
20.12.2018  23:10    <DIR>          PeerDistRepub
07.01.2019  11:57    <DIR>          PlaceholderTileLogoFolder
14.12.2018  11:13    <DIR>          Programs
14.12.2018  19:19    <DIR>          Publishers
25.07.2019  01:45    <DIR>          speech
24.07.2019  19:20    <DIR>          Steam
01.08.2019  13:37    <DIR>          Temp
14.12.2018  09:57    <DIR>          TileDataLayer
24.07.2019  22:59    <DIR>          VirtualStore
               0 Datei(en),              0 Bytes
              29 Verzeichnis(se), 113.800.466.432 Bytes frei

========= End of CMD: =========

================== ExportKey: ===================

[HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions]
[HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Extensions]
[HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths]
"C:\Users\Lubka\AppData\Roaming\lwmjhnysqrpp"="0"
"C:\ProgramData"="0"
"C:\WINDOWS\Temp\prBQoRtdiGvnAgML"="0"
"C:\Program Files (x86)\IKweScizynZHzgXUqVR"="0"
"C:\Program Files (x86)\duxVclVEU"="0"
"C:\Program Files (x86)\hhaccViKlMUn"="0"
"C:\Program Files (x86)\minXQDMZbIE"="0"
"C:\Program Files (x86)\nyOTaFQVaERJC"="0"
"C:\Program Files (x86)\oXNCRiLjSDbU2"="0"
"C:\ProgramData\tsbIJNdKRcSPLnVB"="0"
"C:\Users\Jozko\AppData\LocalLow\VYeRfUFKkRVtG"="0"
"C:\Users\Jozko\AppData\Local\Temp\tIGslkYqGZoVsFFpY"="0"
[HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes]
[HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\TemporaryPaths]

=== End of ExportKey ===

=========== EmptyTemp: ==========

BITS transfer queue => 10510336 B
DOMStore, IE Recovery, AppCache, Feeds Cache, Thumbcache, IconCache => 0 B
Java, Flash, Steam htmlcache => 0 B
Windows/system/drivers => 0 B
Edge => 0 B
Chrome => 0 B
Firefox => 0 B
Opera => 0 B

Temp, IE cache, history, cookies, recent:
Default => 0 B
Users => 0 B
ProgramData => 0 B
Public => 0 B
systemprofile => 0 B
systemprofile32 => 0 B
LocalService => 0 B
LocalService => 0 B
NetworkService => 0 B
NetworkService => 0 B
Lubka => 7179 B
Jozko => 5906599 B

RecycleBin => 0 B
EmptyTemp: => 15.7 MB temporary data Removed.

================================


The system needed a reboot.

==== End of Fixlog 13:40:08 ====
         

[CODE]Additional
FRST Logfile:

scan result of Farbar Recovery Scan Tool (x64) Version: 31-07-2019
Ran by Lubka (01-08-2019 13:42:28)
Running from C:\Users\Jozko\Desktop
Windows 10 Pro Version 1803 17134.885 (X64) (2018-12-14 16:56:48)
Boot Mode: Normal
==========================================================


==================== Accounts: =============================

Administrator (S-1-5-21-1960842775-2088100534-3542962694-500 - Administrator - Disabled)
DefaultAccount (S-1-5-21-1960842775-2088100534-3542962694-503 - Limited - Disabled)
Guest (S-1-5-21-1960842775-2088100534-3542962694-501 - Limited - Disabled)
Jozko (S-1-5-21-1960842775-2088100534-3542962694-1002 - Limited - Enabled) => C:\Users\Jozko
Lubka (S-1-5-21-1960842775-2088100534-3542962694-1001 - Administrator - Enabled) => C:\Users\Lubka
WDAGUtilityAccount (S-1-5-21-1960842775-2088100534-3542962694-504 - Limited - Disabled)

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

Adobe Acrobat Reader DC - Slovak (HKLM-x32\...\{AC76BA86-7AD7-1051-7B44-AC0F074E4100}) (Version: 19.012.20035 - Adobe Systems Incorporated)
Adobe Flash Player 32 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 32.0.0.223 - Adobe)
Age of Empires complete version 1.0c (HKLM-x32\...\{F7F0D70E-9027-4DF5-B67F-4B48CE29565A}_is1) (Version: 1.0c - vol1)
Balík softvéru eID (HKLM-x32\...\{69aff1f0-e530-4ac2-ab4f-88cb85aef940}) (Version: 1.0.0.0 - Ministerstvo vnútra Slovenskej republiky) Hidden
Balík softvéru eID (HKLM-x32\...\{d0db994b-7bbf-4a97-86ae-8e47ef7363e5}) (Version: 1.0.0.0 - Ministerstvo vnútra Slovenskej republiky) Hidden
Bit4id - miniLector (HKLM-x32\...\Bit4id - miniLector) (Version: 3.7 - Bit4id)
D.Launcher (x86) (HKLM-x32\...\{8A22CEA0-9DB7-4E30-898A-6D70F4E650CE}) (Version: 1.1.0.0 - DITEC, a.s.)
D.Signer/XAdES .NET so zásuvnými modulmi (x86) (HKLM-x32\...\{EB7D7F94-A539-4248-BCA3-2B105845284C}) (Version: 4.0.13 - DITEC, a.s.)
D.Signer/XAdES .NET Tools (x86) (HKLM-x32\...\{26E941A2-1EFF-4A3F-AD0B-6A423EFC2AAA}) (Version: 4.0.9 - DITEC, a.s.)
D.Suite/eIDAS (x86) (HKLM-x32\...\{f6fbc4ed-b1f8-4f4c-9b23-5b8e64af50b4}) (Version: 1.0.15 - DITEC, a.s.)
D.Viewer .NET (x86) (HKLM-x32\...\{967D2DE1-4E53-4700-9ED4-E4BCCD27E8F9}) (Version: 4.0.2025 - DITEC, a.s.)
Disig Web Signer 1.0.7 (HKLM-x32\...\{DD3FDF40-D8A3-454D-8A43-B53F90FB1ED7}) (Version: 1.1.8 - Disig)
DiskProtect18891 version 16.91 (HKLM-x32\...\{06B8AD54-D556-4771-A39B-A04135966F15}_is1) (Version: 16.91 - )
EAC MW klient (HKLM-x32\...\{3C1EB559-A939-4569-8EDE-006675312B46}) (Version: 3.1.3 - Ministerstvo vnútra Slovenskej republiky)
EPSON BX535WD Series Printer Uninstall (HKLM\...\EPSON BX535WD Series) (Version:  - SEIKO EPSON Corporation)
EPSON Scan (HKLM-x32\...\EPSON Scanner) (Version:  - Seiko Epson Corporation)
EpsonNet Print (HKLM-x32\...\{3E31400D-274E-4647-916C-2CACC3741799}) (Version: 2.6.0 - SEIKO EPSON CORPORATION)
GemPcCCID (HKLM\...\{39417D48-AC92-47A7-9F53-3CA2049231B0}) (Version: 2.0.7 - Gemalto)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 75.0.3770.142 - Google LLC)
Google Earth Pro (HKLM\...\{70A0F34E-564B-4F93-ADD6-3BAEC6E44075}) (Version: 7.3.2.5776 - Google)
Google Update Helper (HKLM-x32\...\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}) (Version: 1.3.34.11 - Google LLC) Hidden
HiPlayer (HKU\S-1-5-21-1960842775-2088100534-3542962694-1002\...\{1AE35ED9-955E-40D0-8811-FFD8F0E2A9F3}) (Version: 1.2 - Hi)
Intel Driver && Support Assistant (HKLM-x32\...\{CF18558A-3642-4C4D-A551-23275D1FCE16}) (Version: 19.7.30.2 - Intel) Hidden
Intel(R) Computing Improvement Program (HKLM\...\{D40D4164-EEDB-4F0F-85C6-2058A9E34CC7}) (Version: 2.4.04370 - Intel Corporation)
Intel(R) Management Engine Components (HKLM\...\{1CEAC85D-2590-4760-800F-8DE5E91F3700}) (Version: 1831.12.0.1156 - Intel Corporation)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 24.20.100.6291 - Intel Corporation)
Intel(R) Trusted Connect Service Client x86 (HKLM-x32\...\{C9552825-7BF2-4344-BA91-D3CD46F4C441}) (Version: 1.50.369.0 - Intel Corporation) Hidden
Intel(R) Trusted Connect Services Client (HKLM-x32\...\{aa81bdf2-96a6-4400-a596-c7d1916ce9f7}) (Version: 1.50.369.0 - Intel Corporation) Hidden
Intel® Chipset Device Software (HKLM-x32\...\{262e9c1d-e509-4e2a-86e8-0abb312ac2e9}) (Version: 10.1.17765.8094 - Intel(R) Corporation) Hidden
Intel® Driver & Support Assistant (HKLM-x32\...\{12d2d1d9-5223-431d-96ac-6a82d3a1391c}) (Version: 19.7.30.2 - Intel)
Intel® Driver & Support Assistant (HKLM-x32\...\{dbe96554-7594-4bba-b7c5-fc6c72dbaa39}) (Version: 19.6.26.3 - Intel)
IP Camera (HKU\S-1-5-21-1960842775-2088100534-3542962694-1002\...\{3E6DEA84-3FA0-472E-B0DB-927655097022}) (Version: 2.0.4.6 - hi)
Java 8 Update 211 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F64180211F0}) (Version: 8.0.2110.12 - Oracle Corporation)
K-Lite Mega Codec Pack 14.5.5 (HKLM-x32\...\KLiteCodecPack_is1) (Version: 14.5.5 - KLCP)
Malwarebytes Version 3.8.3.2965 (HKLM\...\{35065F43-4BB2-439A-BFF7-0F1014F2E0CD}_is1) (Version: 3.8.3.2965 - Malwarebytes)
Microsoft Office 2016 Professional Plus (HKLM-x32\...\Office16.PROPLUS) (Version: 16.0.4266.1001 - Microsoft Corporation)
Microsoft OneDrive (HKU\S-1-5-21-1960842775-2088100534-3542962694-1001\...\OneDriveSetup.exe) (Version: 19.103.0527.0003 - Microsoft Corporation)
Microsoft OneDrive (HKU\S-1-5-21-1960842775-2088100534-3542962694-1002\...\OneDriveSetup.exe) (Version: 19.103.0527.0003 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.30319 (HKLM\...\{DA5E371C-6333-3D8A-93A4-6FD5B20BCC6E}) (Version: 10.0.30319 - Microsoft Corporation)
Microsoft Visual C++ 2015 Redistributable (x64) - 14.0.23026 (HKLM-x32\...\{e46eca4f-393b-40df-9f49-076faf788d83}) (Version: 14.0.23026.0 - Microsoft Corporation)
Microsoft Visual C++ 2015 Redistributable (x86) - 14.0.23026 (HKLM-x32\...\{74d0e5db-b326-4dae-a6b2-445b9de1836e}) (Version: 14.0.23026.0 - Microsoft Corporation)
Mozilla Firefox 68.0.1 (x64 de) (HKLM\...\Mozilla Firefox 68.0.1 (x64 de)) (Version: 68.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 64.0 - Mozilla)
Nástroje kontroly pravopisu pro Microsoft Office 2016 – čeština (HKLM-x32\...\{90160000-001F-0405-0000-0000000FF1CE}) (Version: 16.0.4266.1001 - Microsoft Corporation) Hidden
Nástroje korektúry balíka Microsoft Office 2016 - slovenčina (HKLM-x32\...\{90160000-001F-041B-0000-0000000FF1CE}) (Version: 16.0.4266.1001 - Microsoft Corporation) Hidden
OLYMPUS CAMEDIA Master 4.1 (HKLM-x32\...\{30BB4D60-81DB-11D5-BB77-00400536ABAC}) (Version:  - )
QuickTime (HKLM-x32\...\QuickTime) (Version:  - )
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 10.31.828.2018 - Realtek)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.8581 - Realtek Semiconductor Corp.)
SPORE Collection (HKLM-x32\...\SPORE Collection_is1) (Version:  - )
SSC Service Utility v4.30 (HKLM-x32\...\SSC Service Utility_is1) (Version:  - SSC Localization Group)
Steam (HKLM-x32\...\Steam) (Version: 2.10.91.91 - Valve Corporation)
TAP-Windows 9.21.2 (HKLM\...\TAP-Windows) (Version: 9.21.2 - )
TextPad (HKLM-x32\...\{ADBBED4F-720B-460D-AA14-D85EBC4AEF97}) (Version:  - )
Update for Windows 10 for x64-based Systems (KB4023057) (HKLM\...\{F14FB68A-9188-4036-AD0D-D054BC9C9291}) (Version: 2.59.0.0 - Microsoft Corporation)
UpdateAssistant (HKLM\...\{EC4F72E8-52FE-454E-B70F-DBE5C0FA44C5}) (Version: 1.20.0.0 - Microsoft Corporation) Hidden
web control version 3.0.6.7 (HKLM-x32\...\{F88ED86C-0010-4943-BA16-72E4184E31ED}_is1) (Version: 3.0.6.7 - )
WinRAR 5.71 (32-bit) (HKLM-x32\...\WinRAR archiver) (Version: 5.71.0 - win.rar GmbH)

Packages:
=========
Candy Crush Soda Saga -> C:\Program Files\WindowsApps\king.com.CandyCrushSodaSaga_1.143.600.0_x86__kgqvnymyfvs32 [2019-07-25] (king.com)
Dolby Access -> C:\Program Files\WindowsApps\DolbyLaboratories.DolbyAccess_2.4.520.0_x64__rz1tebttyb220 [2019-07-25] (Dolby Laboratories)
Mail und Kalender -> C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe [2019-07-25] (Microsoft Corporation) [MS Ad]
Microsoft Advertising SDK for XAML -> C:\Program Files\WindowsApps\Microsoft.Advertising.Xaml_10.1811.1.0_x64__8wekyb3d8bbwe [2019-07-25] (Microsoft Corporation) [MS Ad]
Microsoft Advertising SDK for XAML -> C:\Program Files\WindowsApps\Microsoft.Advertising.Xaml_10.1811.1.0_x86__8wekyb3d8bbwe [2019-07-25] (Microsoft Corporation) [MS Ad]
Microsoft Begleiter für Telefon -> C:\Program Files\WindowsApps\Microsoft.WindowsPhone_10.1802.311.0_x64__8wekyb3d8bbwe [2019-07-25] (Microsoft Corporation)
Microsoft News – Nachrichten -> C:\Program Files\WindowsApps\Microsoft.BingNews_4.31.11905.0_x64__8wekyb3d8bbwe [2019-07-25] (Microsoft Corporation) [MS Ad]
Microsoft Solitaire Collection -> C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.6132.0_x64__8wekyb3d8bbwe [2019-07-25] (Microsoft Studios) [MS Ad]
Microsoft-Telefon -> C:\Program Files\WindowsApps\Microsoft.CommsPhone_3.43.20002.1000_x64__8wekyb3d8bbwe [2019-07-25] (Microsoft Corporation)
MSN Finanzen -> C:\Program Files\WindowsApps\Microsoft.BingFinance_4.31.11905.0_x64__8wekyb3d8bbwe [2019-07-25] (Microsoft Corporation) [MS Ad]
MSN Sport -> C:\Program Files\WindowsApps\Microsoft.BingSports_4.31.11905.0_x64__8wekyb3d8bbwe [2019-07-25] (Microsoft Corporation) [MS Ad]
MSN Wetter -> C:\Program Files\WindowsApps\Microsoft.BingWeather_4.31.11905.0_x64__8wekyb3d8bbwe [2019-07-25] (Microsoft Corporation) [MS Ad]

==================== Custom CLSID (Whitelisted): ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

CustomCLSID: HKU\S-1-5-21-1960842775-2088100534-3542962694-1001_Classes\CLSID\{233525e0-5434-46ef-b464-fd7e45e2e145}\localserver32 -> C:\Program Files (x86)\Intel\Driver and Support Assistant\DSATray.exe (IDSA Production signing key -> Intel)
CustomCLSID: HKU\S-1-5-21-1960842775-2088100534-3542962694-1002_Classes\CLSID\{233525e0-5434-46ef-b464-fd7e45e2e145}\localserver32 -> C:\Program Files (x86)\Intel\Driver and Support Assistant\DSATray.exe (IDSA Production signing key -> Intel)
ContextMenuHandlers1-x32: [TextPad] -> {2F25CF20-C569-11D1-B94C-00608CB45480} => C:\Program Files (x86)\TextPad 4\System\shellext.dll [2001-07-21] (Helios Software Solutions) [File not signed]
ContextMenuHandlers1: [WinRAR] -> {B41DB860-64E4-11D2-9906-E49FADC173CA} => C:\Program Files (x86)\WinRAR\rarext64.dll [2019-04-27] (win.rar GmbH -> Alexander Roshal)
ContextMenuHandlers1-x32: [WinRAR32] -> {B41DB860-8EE4-11D2-9906-E49FADC173CA} => C:\Program Files (x86)\WinRAR\rarext.dll [2019-04-27] (win.rar GmbH -> Alexander Roshal)
ContextMenuHandlers3: [MBAMShlExt] -> {57CE581A-0CB6-4266-9CA0-19364C90A0B3} => C:\Program Files\Malwarebytes\Anti-Malware\mbshlext.dll [2019-06-26] (Malwarebytes Corporation -> Malwarebytes)
ContextMenuHandlers5: [igfxcui] -> {3AB1675A-CCFF-11D2-8B20-00A0C93CB1F4} =>  -> No File
ContextMenuHandlers5: [igfxDTCM] -> {9B5F5829-A529-4B12-814A-E81BCB8D93FC} => C:\WINDOWS\System32\DriverStore\FileRepository\cui_dc_comp.inf_amd64_1c77f1231c19bc72\igfxDTCM.dll [2018-11-02] (Microsoft Windows Hardware Compatibility Publisher -> Intel Corporation)
ContextMenuHandlers6: [MBAMShlExt] -> {57CE581A-0CB6-4266-9CA0-19364C90A0B3} => C:\Program Files\Malwarebytes\Anti-Malware\mbshlext.dll [2019-06-26] (Malwarebytes Corporation -> Malwarebytes)
ContextMenuHandlers6: [WinRAR] -> {B41DB860-64E4-11D2-9906-E49FADC173CA} => C:\Program Files (x86)\WinRAR\rarext64.dll [2019-04-27] (win.rar GmbH -> Alexander Roshal)
ContextMenuHandlers6-x32: [WinRAR32] -> {B41DB860-8EE4-11D2-9906-E49FADC173CA} => C:\Program Files (x86)\WinRAR\rarext.dll [2019-04-27] (win.rar GmbH -> Alexander Roshal)

==================== Shortcuts & WMI ========================

(The entries could be listed to be restored or removed.)


Shortcut: C:\Users\Public\Desktop\Age of Empires - The Rise of Rome color fix.lnk -> C:\Program Files (x86)\Age of Empires complete\EMPIRESX.bat ()
Shortcut: C:\Users\Public\Desktop\Age of Empires color fix.lnk -> C:\Program Files (x86)\Age of Empires complete\Empires.bat ()

==================== Loaded Modules (Whitelisted) ==============

2018-12-20 22:32 - 2012-11-12 16:15 - 000558592 _____ (SEIKO EPSON CORPORATION) [File not signed] C:\WINDOWS\System32\enppmon.dll
2018-12-20 22:32 - 2012-10-22 18:19 - 000219648 _____ (SEIKO EPSON CORPORATION) [File not signed] C:\WINDOWS\System32\enpres.dll

==================== Alternate Data Streams (Whitelisted) =========

(If an entry is included in the fixlist, only the ADS will be removed.)


==================== Safe Mode (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MBAMService => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MBAMService => ""="Service"

==================== Association (Whitelisted) ===============

(If an entry is included in the fixlist, the registry item will be restored to default or removed.)


==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, it will be removed from the registry.)


==================== Hosts content: ===============================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2015-10-30 09:24 - 2019-07-31 22:38 - 000000027 _____ C:\WINDOWS\system32\drivers\etc\hosts

127.0.0.1       localhost

==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKLM\System\CurrentControlSet\Control\Session Manager\Environment\\Path -> C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\iCLS\;C:\Program Files\Intel\Intel(R) Management Engine Components\iCLS\;%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem;%SYSTEMROOT%\System32\WindowsPowerShell\v1.0\;C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL;C:\Program Files\Intel\Intel(R) Management Engine Components\DAL;%SYSTEMROOT%\System32\OpenSSH\;C:\Program Files (x86)\EAC MW klient\
HKU\S-1-5-21-1960842775-2088100534-3542962694-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\Lubka\Desktop\foto.JPG
HKU\S-1-5-21-1960842775-2088100534-3542962694-1002\Control Panel\Desktop\\Wallpaper -> C:\Users\Jozko\Pictures\Saved Pictures\19713_en_1.jfif
DNS Servers: 192.168.1.1 - 195.146.128.62
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer => (SmartScreenEnabled: RequireAdmin)
Windows Firewall is enabled.

==================== MSCONFIG/TASK MANAGER disabled items ==

If an entry is included in the fixlist, it will be removed.


==================== FirewallRules (Whitelisted) ===============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== Restore Points =========================

30-07-2019 21:03:57 Scheduled Checkpoint

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (08/01/2019 01:41:00 PM) (Source: dLauncherLoopback) (EventID: 0) (User: )
Description: Event-ID 0

Error: (08/01/2019 01:38:40 PM) (Source: dLauncherLoopback) (EventID: 0) (User: )
Description: Event-ID 0

Error: (08/01/2019 01:36:11 PM) (Source: dLauncherLoopback) (EventID: 0) (User: )
Description: Event-ID 0

Error: (07/31/2019 10:48:02 PM) (Source: dLauncherLoopback) (EventID: 0) (User: )
Description: Event-ID 0

Error: (07/31/2019 10:39:40 PM) (Source: dLauncherLoopback) (EventID: 0) (User: )
Description: Event-ID 0

Error: (07/31/2019 10:37:08 PM) (Source: dLauncherLoopback) (EventID: 0) (User: )
Description: Event-ID 0

Error: (07/31/2019 08:27:14 PM) (Source: dLauncherLoopback) (EventID: 0) (User: )
Description: Event-ID 0

Error: (07/31/2019 08:23:10 PM) (Source: dLauncherLoopback) (EventID: 0) (User: )
Description: Event-ID 0


System errors:
=============
Error: (08/01/2019 01:42:43 PM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: Durch die Berechtigungseinstellungen für "application-specific" wird dem Benutzer "NT AUTHORITY\SYSTEM" (SID: S-1-5-18) unter der Adresse "LocalHost (Using LRPC)" keine Berechtigung vom Typ "Local Launch" für die COM-Serveranwendung mit der CLSID 
Windows.SecurityCenter.WscDataProtection
 und der APPID 
Unavailable
 im Anwendungscontainer "Unavailable" (SID: Unavailable) gewährt. Die Sicherheitsberechtigung kann mit dem Verwaltungstool für Komponentendienste geändert werden.

Error: (08/01/2019 01:42:43 PM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: Durch die Berechtigungseinstellungen für "application-specific" wird dem Benutzer "NT AUTHORITY\SYSTEM" (SID: S-1-5-18) unter der Adresse "LocalHost (Using LRPC)" keine Berechtigung vom Typ "Local Launch" für die COM-Serveranwendung mit der CLSID 
Windows.SecurityCenter.WscBrokerManager
 und der APPID 
Unavailable
 im Anwendungscontainer "Unavailable" (SID: Unavailable) gewährt. Die Sicherheitsberechtigung kann mit dem Verwaltungstool für Komponentendienste geändert werden.

Error: (08/01/2019 01:42:41 PM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: Der Dienst "Energy Server Service queencreek" wurde mit folgendem Fehler beendet: 
Debugger hat Steuerung C empfangen.

Error: (08/01/2019 01:40:42 PM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: Durch die Berechtigungseinstellungen für "application-specific" wird dem Benutzer "NT AUTHORITY\LOCAL SERVICE" (SID: S-1-5-19) unter der Adresse "LocalHost (Using LRPC)" keine Berechtigung vom Typ "Local Activation" für die COM-Serveranwendung mit der CLSID 
{6B3B8D23-FA8D-40B9-8DBD-B950333E2C52}
 und der APPID 
{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}
 im Anwendungscontainer "Unavailable" (SID: Unavailable) gewährt. Die Sicherheitsberechtigung kann mit dem Verwaltungstool für Komponentendienste geändert werden.

Error: (08/01/2019 01:40:42 PM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: Durch die Berechtigungseinstellungen für "application-specific" wird dem Benutzer "NT AUTHORITY\LOCAL SERVICE" (SID: S-1-5-19) unter der Adresse "LocalHost (Using LRPC)" keine Berechtigung vom Typ "Local Activation" für die COM-Serveranwendung mit der CLSID 
{6B3B8D23-FA8D-40B9-8DBD-B950333E2C52}
 und der APPID 
{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}
 im Anwendungscontainer "Unavailable" (SID: Unavailable) gewährt. Die Sicherheitsberechtigung kann mit dem Verwaltungstool für Komponentendienste geändert werden.

Error: (08/01/2019 01:40:34 PM) (Source: Microsoft-Windows-Ntfs) (EventID: 98) (User: NT AUTHORITY)
Description: C:\Device\HarddiskVolume23

Error: (08/01/2019 01:40:05 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "Windows Search" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 30000 Millisekunden durchgeführt: Reštartovať službu.

Error: (08/01/2019 01:40:05 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "Intel(R) Driver & Support Assistant Updater" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.


Windows Defender:
===================================
Date: 2019-07-27 14:11:19.123
Description: 
Die Windows Defender Antivirus-Überprüfung wurde vor ihrem Abschluss beendet.
Überprüfungs-ID: {F19C5FF9-CAEE-4B95-AF27-48D5428A0778}
Überprüfungstyp: Antimalware
Überprüfungsparameter: Vollständige Überprüfung
Benutzer: DESKTOP-3CK4O4E\Lubka

Date: 2019-07-27 12:24:43.833
Description: 
Die Windows Defender Antivirus-Überprüfung wurde vor ihrem Abschluss beendet.
Überprüfungs-ID: {82B744AF-4B5B-4340-A46C-B31EB143D3E7}
Überprüfungstyp: Antimalware
Überprüfungsparameter: Schnellüberprüfung
Benutzer: NT AUTHORITY\SYSTEM

Date: 2019-07-27 11:13:24.797
Description: 
Die Windows Defender Antivirus-Überprüfung wurde vor ihrem Abschluss beendet.
Überprüfungs-ID: {1B172D1B-64F6-47C9-98B1-C708BFF51B34}
Überprüfungstyp: Antimalware
Überprüfungsparameter: Schnellüberprüfung
Benutzer: NT AUTHORITY\SYSTEM

Date: 2019-07-25 01:44:05.762
Description: 
Von Windows Defender Antivirus wurde Schadsoftware oder andere potenziell unerwünschte Software erkannt.
Weitere Informationen:
https://go.microsoft.com/fwlink/?linkid=37020&name=Behavior:Win32/Generic.KU!ml&threatid=2147739089&enterprise=0
Name: Behavior:Win32/Generic.KU!ml
ID: 2147739089
Schweregrad: Závažná
Kategorie: Podozrivé správanie
Pfad: file:_C:\Users\Lubka\AppData\Local\Temp\wErKYuzd1HavtcSG\83314351a78e5d6e44c0cdebeb407e8c.exe
Erkennungsursprung: Lokaler Computer
Erkennungstyp: FastPath
Erkennungsquelle: Benutzer
Benutzer: DESKTOP-3CK4O4E\Lubka
Prozessname: Unknown
Signaturversion: AV: 1.299.423.0, AS: 1.299.423.0, NIS: 0.0.0.0
Modulversion: AM: 1.1.16200.1, NIS: 0.0.0.0

Date: 2019-07-25 01:44:05.761
Description: 
Von Windows Defender Antivirus wurde Schadsoftware oder andere potenziell unerwünschte Software erkannt.
Weitere Informationen:
https://go.microsoft.com/fwlink/?linkid=37020&name=Trojan:JS/Iframe.EX&threatid=2147733337&enterprise=0
Name: Trojan:JS/Iframe.EX
ID: 2147733337
Schweregrad: Závažná
Kategorie: Trójsky kôň
Pfad: containerfile:_C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Cache\f_001582; file:_C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Cache\f_001582->(GZip)
Erkennungsursprung: Lokaler Computer
Erkennungstyp: Konkret
Erkennungsquelle: Benutzer
Benutzer: DESKTOP-3CK4O4E\Lubka
Prozessname: Unknown
Signaturversion: AV: 1.299.423.0, AS: 1.299.423.0, NIS: 0.0.0.0
Modulversion: AM: 1.1.16200.1, NIS: 0.0.0.0

Date: 2019-07-31 20:37:02.389
Description: 
Fehler von Windows Defender Antivirus beim Aktualisieren von Signaturen.
Neue Signaturversion: 
Vorherige Signaturversion: 1.299.631.0
Updatequelle: Microsoft Center zum Schutz vor Schadsoftware
Signaturtyp: AntiVirus
Updatetyp: Voll
Benutzer: NT AUTHORITY\NETWORK SERVICE
Aktuelle Modulversion: 
Vorherige Modulversion: 1.1.16200.1
Fehlercode: 0x80072ee7
Fehlerbeschreibung: The server name or address could not be resolved 

Date: 2019-07-31 20:37:02.389
Description: 
Fehler von Windows Defender Antivirus beim Aktualisieren von Signaturen.
Neue Signaturversion: 
Vorherige Signaturversion: 1.299.631.0
Updatequelle: Microsoft Center zum Schutz vor Schadsoftware
Signaturtyp: AntiSpyware
Updatetyp: Voll
Benutzer: NT AUTHORITY\NETWORK SERVICE
Aktuelle Modulversion: 
Vorherige Modulversion: 1.1.16200.1
Fehlercode: 0x80072ee7
Fehlerbeschreibung: The server name or address could not be resolved 

Date: 2019-07-31 20:37:02.389
Description: 
Fehler von Windows Defender Antivirus beim Aktualisieren von Signaturen.
Neue Signaturversion: 
Vorherige Signaturversion: 1.299.631.0
Updatequelle: Microsoft Center zum Schutz vor Schadsoftware
Signaturtyp: AntiVirus
Updatetyp: Voll
Benutzer: NT AUTHORITY\NETWORK SERVICE
Aktuelle Modulversion: 
Vorherige Modulversion: 1.1.16200.1
Fehlercode: 0x80072ee7
Fehlerbeschreibung: The server name or address could not be resolved 

Date: 2019-07-31 20:37:02.375
Description: 
Fehler von Windows Defender Antivirus beim Aktualisieren von Signaturen.
Neue Signaturversion: 
Vorherige Signaturversion: 1.299.631.0
Updatequelle: Microsoft Center zum Schutz vor Schadsoftware
Signaturtyp: AntiVirus
Updatetyp: Voll
Benutzer: NT AUTHORITY\NETWORK SERVICE
Aktuelle Modulversion: 
Vorherige Modulversion: 1.1.16200.1
Fehlercode: 0x80072ee7
Fehlerbeschreibung: The server name or address could not be resolved 

Date: 2019-07-31 20:37:02.375
Description: 
Fehler von Windows Defender Antivirus beim Aktualisieren von Signaturen.
Neue Signaturversion: 
Vorherige Signaturversion: 1.299.631.0
Updatequelle: Microsoft Center zum Schutz vor Schadsoftware
Signaturtyp: AntiSpyware
Updatetyp: Voll
Benutzer: NT AUTHORITY\NETWORK SERVICE
Aktuelle Modulversion: 
Vorherige Modulversion: 1.1.16200.1
Fehlercode: 0x80072ee7
Fehlerbeschreibung: The server name or address could not be resolved 

==================== Memory info =========================== 

BIOS: American Megatrends Inc. 1.60 10/10/2018
Motherboard: Micro-Star International Co., Ltd. H310M PRO-VD (MS-7B33)
Processor: Intel(R) Core(TM) i3-8300 CPU @ 3.70GHz
Percentage of memory in use: 61%
Total physical RAM: 3962.59 MB
Available physical RAM: 1536.49 MB
Total Virtual: 14714.59 MB
Available Virtual: 12336.25 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:223.08 GB) (Free:105.95 GB) NTFS
Drive d: () (Fixed) (Total:1863.01 GB) (Free:1638.61 GB) NTFS

\\?\Volume{b9e8df67-0000-0000-0000-100000000000}\ (Vyhradené systémom) (Fixed) (Total:0.49 GB) (Free:0.1 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7/8/10) (Size: 223.6 GB) (Disk ID: B9E8DF67)
Partition 1: (Active) - (Size=500 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=223.1 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (Size: 1863 GB) (Disk ID: 9F919F91)
Partition 1: (Active) - (Size=1863 GB) - (Type=07 NTFS)

==================== End of Addition.txt ============================
         

--- --- ---


FRST Logfile:

FRST Logfile:

FRST Logfile:

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 31-07-2019
Ran by ** (administrator) on DESKTOP-3CK4O4E (Micro-Star International Co., Ltd. MS-7B33) (01-08-2019 13:41:29)
Running from C:\Users\*****\Desktop
Loaded Profiles: ** & ***** (Available Profiles: ** & *****)
Platform: Windows 10 Pro Version 1803 17134.885 (X64) Language: Slowakisch (Slowakei)
Default browser: FF
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Adobe Systems, Incorporated -> Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
(Disig a.s. -> Disig a.s.) C:\Program Files (x86)\Disig\Disig Web Signer 1.0.7\Updater\WebSignerTray.exe
(Google Inc -> Google LLC) C:\Program Files (x86)\Google\Update\1.3.34.11\GoogleCrashHandler.exe
(Google Inc -> Google LLC) C:\Program Files (x86)\Google\Update\1.3.34.11\GoogleCrashHandler64.exe
(IDSA Production signing key -> Intel) C:\Program Files (x86)\Intel\Driver and Support Assistant\DSAService.exe
(IDSA Production signing key -> Intel) C:\Program Files (x86)\Intel\Driver and Support Assistant\DSATray.exe
(IDSA Production signing key -> Intel) C:\Program Files (x86)\Intel\Driver and Support Assistant\DSAUpdateService.exe
(Intel(R) pGFX -> Intel Corporation) C:\Windows\System32\DriverStore\FileRepository\cui_dc_comp.inf_amd64_1c77f1231c19bc72\igfxCUIService.exe
(Intel(R) pGFX -> Intel Corporation) C:\Windows\System32\DriverStore\FileRepository\cui_dc_comp.inf_amd64_1c77f1231c19bc72\igfxEM.exe
(Intel(R) pGFX -> Intel Corporation) C:\Windows\System32\DriverStore\FileRepository\iigd_dc_base.inf_amd64_26935c8c9d5bfd3b\IntelCpHDCPSvc.exe
(Intel(R) pGFX -> Intel Corporation) C:\Windows\System32\DriverStore\FileRepository\iigd_dc_base.inf_amd64_26935c8c9d5bfd3b\IntelCpHeciSvc.exe
(Intel(R) Software Development Products -> ) C:\Program Files\Intel\SUR\QUEENCREEK\SurSvc.exe
(Intel(R) Trust Services -> Intel(R) Corporation) C:\Program Files\Intel\Intel(R) Management Engine Components\iCLS\TPMProvisioningService.exe
(Malwarebytes Corporation -> Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
(Malwarebytes Corporation -> Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe
(Microsoft Corporation -> Microsoft Corporation) C:\Users\*****\AppData\Local\Microsoft\OneDrive\OneDrive.exe
(Microsoft Corporation -> Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Microsoft Windows -> Microsoft Corporation) C:\Program Files\Windows Defender\MSASCuiL.exe
(Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\CompatTelRunner.exe
(Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\smartscreen.exe
(Microsoft Windows Publisher -> Microsoft Corporation) C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.1907.4-0\MsMpEng.exe
(Microsoft Windows Publisher -> Microsoft Corporation) C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.1907.4-0\NisSrv.exe
(Mozilla Corporation -> Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Mozilla Corporation -> Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Mozilla Corporation -> Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Mozilla Corporation -> Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Mozilla Corporation -> Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Mozilla Corporation -> Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Oracle America, Inc. -> Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(SEIKO EPSON Corporation -> SEIKO EPSON CORPORATION) C:\Windows\System32\spool\drivers\x64\3\E_YATIHTU.EXE

==================== Registry (Whitelisted) ===========================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [SecurityHealth] => C:\Program Files\Windows Defender\MSASCuiL.exe [638872 2018-04-12] (Microsoft Windows -> Microsoft Corporation)
HKLM\...\Run: [RTHDVCPL] => "C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe" -s
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [645456 2019-04-01] (Oracle America, Inc. -> Oracle Corporation)
HKLM\...\RunOnce: [*EmptyTemp] => cmd /c rd /q/s C:\FRST\Temp
HKU\S-1-5-21-1960842775-2088100534-3542962694-1001\...\Run: [Steam] => "C:\Program Files (x86)\Steam\steam.exe" -silent
HKU\S-1-5-21-1960842775-2088100534-3542962694-1001\...\MountPoints2: {08af5bcb-313c-11e9-94ec-309c23d44e07} - "F:\HiSuiteDownLoader.exe" 
HKU\S-1-5-21-1960842775-2088100534-3542962694-1002\...\Run: [EPLTarget\P0000000000000000] => C:\WINDOWS\system32\spool\DRIVERS\x64\3\E_YATIHTU.EXE [241280 2012-07-12] (SEIKO EPSON Corporation -> SEIKO EPSON CORPORATION)
HKU\S-1-5-21-1960842775-2088100534-3542962694-1002\...\MountPoints2: {08af5bcb-313c-11e9-94ec-309c23d44e07} - "F:\HiSuiteDownLoader.exe" 
HKU\S-1-5-21-1960842775-2088100534-3542962694-1002\...\MountPoints2: {e8fcf302-ff74-11e8-94da-806e6f6e6963} - "E:\Setup.exe" 
HKLM\...\Drivers32: [VIDC.X264] => C:\WINDOWS\system32\x264vfw64.dll [3799552 2017-07-30] (x264vfw project) [File not signed]
HKLM\...\Drivers32: [VIDC.LAGS] => C:\WINDOWS\system32\lagarith.dll [148992 2011-12-07] ( ) [File not signed]
HKLM\...\Drivers32: [VIDC.XVID] => C:\WINDOWS\system32\xvidvfw.dll [311296 2018-01-28] () [File not signed]
HKLM\...\Drivers32: [msacm.ac3acm] => C:\WINDOWS\system32\ac3acm.acm [180736 2012-07-21] (fccHandler) [File not signed]
HKLM\...\Drivers32: [VIDC.X264] => C:\Windows\SysWOW64\x264vfw.dll [3850240 2017-07-30] (x264vfw project) [File not signed]
HKLM\...\Drivers32: [VIDC.LAGS] => C:\Windows\SysWOW64\lagarith.dll [216064 2011-12-07] ( ) [File not signed]
HKLM\...\Drivers32: [VIDC.XVID] => C:\Windows\SysWOW64\xvidvfw.dll [284672 2018-01-28] () [File not signed]
HKLM\...\Drivers32: [VIDC.FFDS] => C:\Windows\SysWOW64\ff_vfw.dll [112128 2015-10-24] () [File not signed]
HKLM\...\Drivers32: [msacm.ac3acm] => C:\Windows\SysWOW64\ac3acm.acm [122880 2012-07-21] (fccHandler) [File not signed]
HKLM\Software\Microsoft\Active Setup\Installed Components: [{8A69D345-D564-463c-AFF1-A69D9E530F96}] -> C:\Program Files (x86)\Google\Chrome\Application\75.0.3770.142\Installer\chrmstp.exe [2019-07-17] (Google LLC -> Google LLC)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Web Signer.lnk [2019-03-14]
ShortcutTarget: Web Signer.lnk -> C:\Program Files (x86)\Disig\Disig Web Signer 1.0.7\Updater\WebSignerTray.exe (Disig a.s. -> Disig a.s.)
BootExecute: autocheck autochk * sdnclean64.exe

==================== Scheduled Tasks (Whitelisted) =============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

Task: {0E604FC0-C5ED-4EB1-A618-02490097313E} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [153168 2018-12-14] (Google Inc -> Google Inc.)
Task: {12F9930E-E1BE-461C-ABCA-E2E6871152CA} - System32\Tasks\Microsoft\Office\Office 15 Subscription Heartbeat => C:\Program Files\Common Files\Microsoft Shared\Office16\OLicenseHeartbeat.exe
Task: {224228E2-496F-4B35-B215-B3FF9554D334} - System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan => C:\ProgramData\Microsoft\Windows Defender\platform\4.18.1907.4-0\MpCmdRun.exe [469960 2019-07-27] (Microsoft Windows Publisher -> Microsoft Corporation)
Task: {2F071C61-940D-4862-A954-D5C6A19DCD93} - System32\Tasks\IntelSURQC-Upgrade-86621605-2a0b-4128-8ffc-15514c247132-Logon => C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\IntelSoftwareAssetManagerService.exe [18168 2017-07-13] (Intel(R) Software Asset Manager -> Intel Corporation)
Task: {45DE53AF-C696-4FA0-95AE-89EAE95F5CCC} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentFallBack2016 => C:\Program Files\Microsoft Office\Office16\msoia.exe [416432 2015-07-31] (Microsoft Corporation -> Microsoft Corporation)
Task: {542886ED-46CC-4922-8DDD-A49E08E230E8} - System32\Tasks\Adobe Flash Player NPAPI Notifier => C:\WINDOWS\SysWOW64\Macromed\Flash\FlashUtil32_32_0_0_223_Plugin.exe [1457208 2019-07-13] (Adobe Inc. -> Adobe)
Task: {68F13A5A-E60C-4593-BD61-7058F49F44BB} - System32\Tasks\Intel PTT EK Recertification => C:\Program Files\Intel\Intel(R) Management Engine Components\iCLS\IntelPTTEKRecertification.exe [817352 2018-06-08] (Intel(R) Trust Services -> Intel(R) Corporation)
Task: {795EC12C-6485-4A36-86D6-A7F83BC10233} - System32\Tasks\klcp_update => CodecTweakTool.exe
Task: {88583ED8-4AA6-424D-A0AF-BBD7BC423EDC} - System32\Tasks\Microsoft\Windows\Setup\EOSNotify => C:\WINDOWS\system32\EOSNotify.exe
Task: {8AC426F8-1254-4832-9F4F-26F11B75A266} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentLogOn2016 => C:\Program Files\Microsoft Office\Office16\msoia.exe [416432 2015-07-31] (Microsoft Corporation -> Microsoft Corporation)
Task: {8E897747-B370-4713-B30E-A711C911CB41} - System32\Tasks\IntelSURQC-Upgrade-86621605-2a0b-4128-8ffc-15514c247132 => C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\IntelSoftwareAssetManagerService.exe [18168 2017-07-13] (Intel(R) Software Asset Manager -> Intel Corporation)
Task: {92337728-02AC-49E0-8A2B-36D4200DED2D} - System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Cleanup => C:\ProgramData\Microsoft\Windows Defender\platform\4.18.1907.4-0\MpCmdRun.exe [469960 2019-07-27] (Microsoft Windows Publisher -> Microsoft Corporation)
Task: {A3BB6E79-8DFB-4B1D-AA6D-5033276E6CB4} - System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance => C:\ProgramData\Microsoft\Windows Defender\platform\4.18.1907.4-0\MpCmdRun.exe [469960 2019-07-27] (Microsoft Windows Publisher -> Microsoft Corporation)
Task: {A42F7ECF-99F6-403A-BDC2-9F66B6E292EB} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [153168 2018-12-14] (Google Inc -> Google Inc.)
Task: {A6B4763B-79C7-47AC-9626-B2A5FCBB500B} - System32\Tasks\USER_ESRV_SVC_QUEENCREEK => "C:\WINDOWS\System32\Wscript.exe" //B //NoLogo "C:\Program Files\Intel\SUR\QUEENCREEK\x64\task.vbs"
Task: {AC59177D-7B0B-4D2B-9F6F-8431F22EA625} - System32\Tasks\AdwCleaner_onReboot => C:/Users/*****/Desktop/adwcleaner_7.4.exe [7623880 2019-07-30] (Malwarebytes Inc -> Malwarebytes)
Task: {D6841C58-556C-4171-87B7-EF1A9825CE80} - System32\Tasks\Adobe Flash Player Updater => C:\WINDOWS\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [335416 2019-07-13] (Adobe Inc. -> Adobe)
Task: {E4E894E9-95E3-4E54-A365-EAE0909FB0A1} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [1195544 2018-12-16] (Adobe Systems, Incorporated -> Adobe Systems Incorporated)
Task: {EBE5BDCE-1F19-4D36-BFDF-01F8DBD1A58F} - System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Verification => C:\ProgramData\Microsoft\Windows Defender\platform\4.18.1907.4-0\MpCmdRun.exe [469960 2019-07-27] (Microsoft Windows Publisher -> Microsoft Corporation)
Task: {FAC763BD-75EC-454E-8B60-3797854559A6} - System32\Tasks\IUM-F1E24CA0-B63E-4F13-A9E3-4ADE3BFF3473 => C:\Program Files (x86)\Intel\Intel(R) Update Manager\bin\iumsvc.exe

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)


==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Tcpip\Parameters: [DhcpNameServer] 192.168.1.1 195.146.128.62
Tcpip\..\Interfaces\{da384fb4-1e59-48fc-bfe0-c27ce005f778}: [DhcpNameServer] 192.168.1.1 195.146.128.62

Internet Explorer:
==================
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxps://go.microsoft.com/fwlink/p/?LinkId=255141
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxps://go.microsoft.com/fwlink/p/?LinkId=255141
HKU\S-1-5-21-1960842775-2088100534-3542962694-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxps://go.microsoft.com/fwlink/p/?LinkId=619797&pc=UE03&ocid=UE03DHP
HKU\S-1-5-21-1960842775-2088100534-3542962694-1002\Software\Microsoft\Internet Explorer\Main,Start Page = hxxps://go.microsoft.com/fwlink/p/?LinkId=619797&pc=UE03&ocid=UE03DHP
SearchScopes: HKU\S-1-5-21-1960842775-2088100534-3542962694-1001 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxps://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IESR02&pc=UE04
SearchScopes: HKU\S-1-5-21-1960842775-2088100534-3542962694-1001 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxps://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IESR02&pc=UE04
SearchScopes: HKU\S-1-5-21-1960842775-2088100534-3542962694-1002 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxps://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IESR02&pc=UE04
SearchScopes: HKU\S-1-5-21-1960842775-2088100534-3542962694-1002 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxps://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IESR02&pc=UE04
BHO: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office\Office16\OCHelper.dll [2015-07-31] (Microsoft Corporation -> Microsoft Corporation)
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_211\bin\ssv.dll [2019-05-24] (Oracle America, Inc. -> Oracle Corporation)
BHO: Microsoft OneDrive for Business Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office\Office16\GROOVEEX.DLL [2015-07-31] (Microsoft Corporation -> Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_211\bin\jp2ssv.dll [2019-05-24] (Oracle America, Inc. -> Oracle Corporation)
BHO-x32: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files (x86)\Microsoft Office\Office16\OCHelper.dll [2015-07-31] (Microsoft Corporation -> Microsoft Corporation)
BHO-x32: Microsoft OneDrive for Business Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files (x86)\Microsoft Office\Office16\GROOVEEX.DLL [2015-07-31] (Microsoft Corporation -> Microsoft Corporation)
Handler-x32: mso-minsb.16 - {3459B272-CC19-4448-86C9-DDC3B4B2FAD3} - C:\Program Files (x86)\Microsoft Office\Office16\MSOSB.DLL [2015-07-31] (Microsoft Corporation -> Microsoft Corporation)
Handler-x32: osf.16 - {5504BE45-A83B-4808-900A-3A5C36E7F77A} - C:\Program Files (x86)\Microsoft Office\Office16\MSOSB.DLL [2015-07-31] (Microsoft Corporation -> Microsoft Corporation)

FireFox:
========
FF DefaultProfile: bt6jbw3e.default
FF ProfilePath: C:\Users\**\AppData\Roaming\Mozilla\Firefox\Profiles\bt6jbw3e.default [2019-07-31]
FF Homepage: Mozilla\Firefox\Profiles\bt6jbw3e.default -> hxxps://www.google.sk/
FF Extension: (Adblock Plus - kostenloser Adblocker) - C:\Users\**\AppData\Roaming\Mozilla\Firefox\Profiles\bt6jbw3e.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2019-04-21]
FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF64_32_0_0_223.dll [2019-07-13] (Adobe Inc. -> )
FF Plugin: @java.com/DTPlugin,version=11.211.2 -> C:\Program Files\Java\jre1.8.0_211\bin\dtplugin\npDeployJava1.dll [2019-05-24] (Oracle America, Inc. -> Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=11.211.2 -> C:\Program Files\Java\jre1.8.0_211\bin\plugin2\npjp2.dll [2019-05-24] (Oracle America, Inc. -> Oracle Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_32_0_0_223.dll [2019-07-13] (Adobe Inc. -> )
FF Plugin-x32: @google.com/zxwebplugin -> C:\WINDOWS\system32\npzxwebplugin.dll [No File]
FF Plugin-x32: @microsoft.com/Lync,version=15.0 -> C:\Program Files (x86)\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll [2015-07-31] (Microsoft Corporation -> Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office16\NPSPWRAP.DLL [2015-07-31] (Microsoft Corporation -> Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.34.11\npGoogleUpdate3.dll [2019-05-15] (Google Inc -> Google LLC)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.34.11\npGoogleUpdate3.dll [2019-05-15] (Google Inc -> Google LLC)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2019-05-03] (Adobe Inc. -> Adobe Systems Inc.)
FF Plugin-x32: ditec.sk/DAsicFac -> C:\PROGRA~2\Ditec\DSIGNE~2.NET\NPDITE~1.DLL [2019-01-14] (DITEC, a.s. -> Ditec,a.s.)
FF Plugin-x32: ditec.sk/DitecZepDViewerFb -> C:\PROGRA~2\Ditec\DViewer\NPDITE~1.DLL [2019-01-15] (DITEC, a.s. -> Ditec, a.s.)
FF Plugin-x32: ditec.sk/DSigMessageContainer -> C:\PROGRA~2\Ditec\DSIGNE~2.NET\NPDITE~2.DLL [2016-12-15] (DITEC, a.s. -> Ditec, a.s.)
FF Plugin-x32: ditec.sk/DSigXadesExtender -> C:\PROGRA~2\Ditec\DSIGNE~2.NET\NPDITE~3.DLL [2016-12-15] (DITEC, a.s. -> Ditec, a.s.)
FF Plugin-x32: ditec.sk/DSigXadesFb -> C:\PROGRA~2\Ditec\DSIGNE~1.NET\NPDITE~1.DLL [2019-01-15] (DITEC, a.s. -> Ditec,a.s.)
FF Plugin-x32: ditec.sk/XmlDataContainerFb -> C:\PROGRA~2\Ditec\DSIGNE~1.NET\NPDITE~2.DLL [2019-01-15] (DITEC, a.s. -> Ditec,a.s.)
FF Plugin HKU\S-1-5-21-1960842775-2088100534-3542962694-1002: ditec.sk/DitecZepDViewerFb -> C:\ProgramData\Ditec\DViewer\npDitec.Zep.DViewerFb.dll [No File]
FF Plugin HKU\S-1-5-21-1960842775-2088100534-3542962694-1002: ditec.sk/DSigXadesExtenderFb -> C:\Program Files (x86)\Ditec\DSigXadesExtender\npDitec.Zep.DSigXadesExtenderFb.dll [No File]
FF Plugin HKU\S-1-5-21-1960842775-2088100534-3542962694-1002: ditec.sk/DSigXadesFb -> C:\Program Files (x86)\Ditec\DSigXades\npDitec.Zep.DSigXadesFb.dll [No File]

Chrome: 
=======
CHR HomePage: Default -> hxxps://www.google.com/
CHR Profile: C:\Users\**\AppData\Local\Google\Chrome\User Data\Default [2019-08-01]
CHR Extension: (Präsentationen) - C:\Users\**\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2018-12-14]
CHR Extension: (Docs) - C:\Users\**\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2018-12-14]
CHR Extension: (Google Drive) - C:\Users\**\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2018-12-14]
CHR Extension: (YouTube) - C:\Users\**\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2018-12-14]
CHR Extension: (Adobe Acrobat) - C:\Users\**\AppData\Local\Google\Chrome\User Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj [2019-06-21]
CHR Extension: (Tabellen) - C:\Users\**\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2018-12-14]
CHR Extension: (Google Docs Offline) - C:\Users\**\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2018-12-14]
CHR Extension: (Chrome Web Store-Zahlungen) - C:\Users\**\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2018-12-14]
CHR Extension: (Disig Web Signer 1.0.7) - C:\Users\**\AppData\Local\Google\Chrome\User Data\Default\Extensions\odbdbcaekkgabdfaabepfjgiooilmaoe [2019-03-15]
CHR Extension: (Google Mail) - C:\Users\**\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2019-04-23]
CHR Extension: (Chrome Media Router) - C:\Users\**\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2019-07-31]
CHR HKLM-x32\...\Chrome\Extension: [efaidnbmnnnibpcajpcglclefindmkaj] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [odbdbcaekkgabdfaabepfjgiooilmaoe] - hxxps://clients2.google.com/service/update2/crx

==================== Services (Whitelisted) ====================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

S2 dLauncherLoopback; C:\Program Files (x86)\Ditec\DLauncher\dLauncherLoopback.exe [156984 2017-09-29] (DITEC, a.s. -> )
R2 DSAService; C:\Program Files (x86)\Intel\Driver and Support Assistant\DSAService.exe [26984 2019-07-25] (IDSA Production signing key -> Intel)
R3 DSAUpdateService; C:\Program Files (x86)\Intel\Driver and Support Assistant\DSAUpdateService.exe [80744 2019-07-25] (IDSA Production signing key -> Intel)
S2 ESRV_SVC_QUEENCREEK; C:\Program Files\Intel\SUR\QUEENCREEK\x64\esrv_svc.exe [937208 2018-12-19] (Intel(R) Software Development Products -> )
S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\Intel(R) Management Engine Components\iCLS\SocketHeciServer.exe [762568 2018-06-08] (Intel(R) Trust Services -> Intel(R) Corporation)
S3 Intel(R) SUR QC SAM; C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\IntelSoftwareAssetManagerService.exe [18168 2017-07-13] (Intel(R) Software Asset Manager -> Intel Corporation)
S2 Intel(R) TPM Provisioning Service; C:\Program Files\Intel\Intel(R) Management Engine Components\iCLS\TPMProvisioningService.exe [714952 2018-06-08] (Intel(R) Trust Services -> Intel(R) Corporation)
S2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [218176 2018-08-03] (Intel(R) Embedded Subsystems and IP Blocks Group -> Intel Corporation)
R2 MBAMService; C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe [6744288 2019-06-26] (Malwarebytes Corporation -> Malwarebytes)
S3 Sense; C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe [5073792 2019-07-04] (Microsoft Windows Publisher -> Microsoft Corporation)
R2 SystemUsageReportSvc_QUEENCREEK; C:\Program Files\Intel\SUR\QUEENCREEK\SurSvc.exe [195832 2018-12-19] (Intel(R) Software Development Products -> )
S3 USER_ESRV_SVC_QUEENCREEK; C:\Program Files\Intel\SUR\QUEENCREEK\x64\esrv_svc.exe [937208 2018-12-19] (Intel(R) Software Development Products -> )
R3 WdNisSvc; C:\ProgramData\Microsoft\Windows Defender\platform\4.18.1907.4-0\NisSrv.exe [2552416 2019-07-27] (Microsoft Windows Publisher -> Microsoft Corporation)
R2 WinDefend; C:\ProgramData\Microsoft\Windows Defender\platform\4.18.1907.4-0\MsMpEng.exe [108832 2019-07-27] (Microsoft Windows Publisher -> Microsoft Corporation)

===================== Drivers (Whitelisted) ======================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

S3 GemCCID; C:\WINDOWS\System32\drivers\GemCCID.sys [137712 2016-10-17] (Microsoft Windows Hardware Compatibility Publisher -> Gemalto)
R3 MBAMSwissArmy; C:\WINDOWS\System32\Drivers\mbamswissarmy.sys [275232 2019-08-01] (Malwarebytes Corporation -> Malwarebytes)
R3 rt640x64; C:\WINDOWS\System32\drivers\rt640x64.sys [1122200 2018-12-14] (Realtek Semiconductor Corp. -> Realtek )
S3 semav6msr64; C:\WINDOWS\system32\drivers\semav6msr64.sys [43008 2018-12-19] (Intel Corporation -> )
R3 tap0901; C:\WINDOWS\System32\drivers\tap0901.sys [27136 2016-04-21] (OpenVPN Technologies, Inc. -> The OpenVPN Project)
S0 WdBoot; C:\WINDOWS\System32\drivers\wd\WdBoot.sys [47496 2019-07-27] (Microsoft Windows Early Launch Anti-Malware Publisher -> Microsoft Corporation)
R0 WdFilter; C:\WINDOWS\System32\drivers\wd\WdFilter.sys [344288 2019-07-27] (Microsoft Windows -> Microsoft Corporation)
R3 WdNisDrv; C:\WINDOWS\System32\drivers\wd\WdNisDrv.sys [54496 2019-07-27] (Microsoft Windows -> Microsoft Corporation)

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== One month (created) ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2019-08-01 13:41 - 2019-08-01 13:42 - 000024545 _____ C:\Users\*****\Desktop\FRST.txt
2019-08-01 13:40 - 2019-08-01 13:40 - 000275232 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mbamswissarmy.sys
2019-08-01 13:37 - 2019-08-01 13:40 - 000019294 _____ C:\Users\*****\Desktop\Fixlog.txt
2019-07-31 22:52 - 2019-07-31 22:52 - 000001630 _____ C:\Users\**\Desktop\AdwCleaner[S03].txt
2019-07-31 22:37 - 2019-07-31 22:59 - 000000000 ____D C:\Users\*****\Desktop\Trojaner
2019-07-31 20:57 - 2019-07-31 20:57 - 000003893 _____ C:\Users\**\Desktop\AdwCleaner[S00].txt
2019-07-31 20:57 - 2019-07-31 20:57 - 000001610 _____ C:\Users\**\Desktop\AdwCleaner[S02].txt
2019-07-31 20:57 - 2019-07-31 20:57 - 000001447 _____ C:\Users\**\Desktop\AdwCleaner[S01].txt
2019-07-31 20:34 - 2019-07-31 20:34 - 007316688 _____ (Malwarebytes) C:\Users\*****\Downloads\adwcleaner-7-2-7.exe
2019-07-31 20:01 - 2019-07-31 20:01 - 000000000 ____D C:\Users\*****\Desktop\FRST-OlderVersion
2019-07-31 20:01 - 2019-07-31 20:01 - 000000000 ____D C:\Users\*****\AppData\Local\PeerDistRepub
2019-07-31 19:13 - 2019-07-31 19:13 - 000000085 _____ C:\WINDOWS\wininit.ini
2019-07-31 19:10 - 2019-07-31 19:10 - 000003166 _____ C:\WINDOWS\System32\Tasks\AdwCleaner_onReboot
2019-07-30 22:25 - 2019-07-30 22:25 - 000000000 ____D C:\Users\**\AppData\Local\mbamtray
2019-07-30 22:11 - 2019-07-30 22:11 - 000000000 ____D C:\Users\*****\AppData\Roaming\Sun
2019-07-30 22:11 - 2019-07-30 22:11 - 000000000 ____D C:\Users\*****\AppData\LocalLow\Sun
2019-07-30 22:00 - 2019-08-01 13:41 - 000000000 ____D C:\FRST
2019-07-30 21:47 - 2019-07-31 20:01 - 002096128 _____ (Farbar) C:\Users\*****\Desktop\FRST64.exe
2019-07-30 21:11 - 2019-07-30 21:11 - 000001912 _____ C:\Users\Public\Desktop\Malwarebytes.lnk
2019-07-30 21:11 - 2019-07-30 21:11 - 000000000 ____D C:\Users\*****\AppData\Local\mbamtray
2019-07-30 21:11 - 2019-07-30 21:11 - 000000000 ____D C:\Users\*****\AppData\Local\mbam
2019-07-30 21:11 - 2019-07-30 21:11 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes
2019-07-30 21:11 - 2019-01-08 16:32 - 000153328 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mbae64.sys
2019-07-30 21:10 - 2019-07-30 21:10 - 000000000 ____D C:\ProgramData\Malwarebytes
2019-07-30 21:10 - 2019-07-30 21:10 - 000000000 ____D C:\Program Files\Malwarebytes
2019-07-30 21:09 - 2019-07-30 21:09 - 000000000 ____D C:\WINDOWS\pss
2019-07-30 20:49 - 2019-07-30 20:49 - 000388992 _____ C:\Users\*****\Desktop\bookmarksJ.html
2019-07-30 20:47 - 2019-07-30 20:47 - 000051801 _____ C:\Users\**\Desktop\bookmarksL.html
2019-07-30 20:26 - 2019-07-30 20:27 - 000000000 ____D C:\AdwCleaner
2019-07-30 20:24 - 2019-07-30 20:25 - 007623880 _____ (Malwarebytes) C:\Users\*****\Desktop\adwcleaner_7.4.exe
2019-07-30 20:15 - 2019-07-30 20:15 - 000000000 ____D C:\Users\*****\AppData\Local\D3DSCache
2019-07-30 20:04 - 2019-07-31 19:14 - 000000000 ____D C:\Program Files (x86)\Spybot - Search & Destroy 2
2019-07-30 20:04 - 2019-07-31 19:13 - 000000000 ____D C:\ProgramData\Spybot - Search & Destroy
2019-07-30 20:04 - 2019-07-30 20:04 - 000000000 ____D C:\WINDOWS\System32\Tasks\Safer-Networking
2019-07-27 14:10 - 2019-07-27 14:10 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Intel
2019-07-27 12:14 - 2019-07-27 12:15 - 000000000 ____D C:\Users\**\Desktop\SAP-USB
2019-07-27 12:12 - 2019-07-27 12:12 - 001680991 _____ C:\Users\**\Desktop\mssstool0221.zip
2019-07-27 12:01 - 2019-08-01 13:40 - 095682560 _____ C:\WINDOWS\system32\config\SOFTWARE
2019-07-27 11:52 - 2019-07-27 12:01 - 000000000 ____D C:\WINDOWS\Microsoft Antimalware
2019-07-25 01:04 - 2019-07-25 01:04 - 000000000 ____D C:\ProgramData\TmpLoog
2019-07-25 00:44 - 2019-07-25 00:44 - 000000000 ____D C:\Users\**\AppData\LocalLow\lltgznTbqqOCq
2019-07-24 23:11 - 2019-07-24 23:11 - 000000000 ____D C:\Users\**\AppData\Roaming\WinRAR
2019-07-24 23:11 - 2019-07-24 23:11 - 000000000 ____D C:\Users\**\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR
2019-07-24 23:11 - 2019-07-24 23:11 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinRAR
2019-07-24 23:11 - 2019-07-24 23:11 - 000000000 ____D C:\Program Files (x86)\WinRAR
2019-07-24 23:10 - 2019-07-24 23:10 - 002918616 _____ (Alexander Roshal) C:\Users\**\Downloads\wrar571.exe
2019-07-24 23:05 - 2019-07-24 23:05 - 000147094 _____ C:\Users\**\Downloads\SilentPatchSA.zip
2019-07-24 23:04 - 2019-07-24 23:04 - 000039315 _____ C:\Users\**\Downloads\asiloader.rar
2019-07-24 23:00 - 2019-07-24 23:20 - 000000000 ____D C:\Users\**\Documents\GTA San Andreas User Files
2019-07-24 23:00 - 2008-10-15 06:22 - 005631312 _____ (Microsoft Corporation) C:\WINDOWS\system32\D3DX9_40.dll
2019-07-24 23:00 - 2008-10-15 06:22 - 004379984 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\D3DX9_40.dll
2019-07-24 23:00 - 2008-10-15 06:22 - 002605920 _____ (Microsoft Corporation) C:\WINDOWS\system32\D3DCompiler_40.dll
2019-07-24 23:00 - 2008-10-15 06:22 - 002036576 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\D3DCompiler_40.dll
2019-07-24 23:00 - 2008-10-15 06:22 - 000519000 _____ (Microsoft Corporation) C:\WINDOWS\system32\d3dx10_40.dll
2019-07-24 23:00 - 2008-10-15 06:22 - 000452440 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d3dx10_40.dll
2019-07-24 21:13 - 2019-07-24 21:13 - 000001315 _____ C:\Users\Public\Desktop\Age of Empires - The Rise of Rome color fix.lnk
2019-07-24 21:13 - 2019-07-24 21:13 - 000001306 _____ C:\Users\Public\Desktop\Age of Empires color fix.lnk
2019-07-24 21:13 - 2019-07-24 21:13 - 000001185 _____ C:\Users\Public\Desktop\Age of Empires - The Rise of Rome.lnk
2019-07-24 21:13 - 2019-07-24 21:13 - 000001178 _____ C:\Users\Public\Desktop\Age of Empires.lnk
2019-07-24 21:13 - 2019-07-24 21:13 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Age of Empires complete
2019-07-24 21:13 - 2019-07-24 21:13 - 000000000 ____D C:\Program Files (x86)\Age of Empires complete
2019-07-24 19:25 - 2019-07-24 19:25 - 000000221 _____ C:\Users\**\Desktop\Grand Theft Auto San Andreas.url
2019-07-24 19:25 - 2019-07-24 19:25 - 000000000 ____D C:\Users\**\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Steam
2019-07-24 19:23 - 2019-07-25 01:01 - 000000000 ____D C:\Program Files\Mozilla Firefox
2019-07-24 19:20 - 2019-07-24 19:20 - 000000000 ____D C:\Users\**\AppData\Local\Steam
2019-07-24 19:20 - 2019-07-24 19:20 - 000000000 ____D C:\Users\**\AppData\Local\CEF
2019-07-24 19:11 - 2019-07-24 19:11 - 001573568 _____ C:\Users\**\Downloads\SteamSetup.exe
2019-07-24 19:11 - 2019-07-24 19:11 - 000001036 _____ C:\Users\Public\Desktop\Steam.lnk
2019-07-24 19:11 - 2019-07-24 19:11 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Steam
2019-07-13 17:03 - 2019-07-13 17:03 - 000004590 _____ C:\WINDOWS\System32\Tasks\Adobe Flash Player NPAPI Notifier
2019-07-13 17:03 - 2019-07-13 17:03 - 000004424 _____ C:\WINDOWS\System32\Tasks\Adobe Flash Player Updater
2019-07-13 16:59 - 2019-07-13 16:59 - 000716789 _____ C:\WINDOWS\SysWOW64\unins000.exe
2019-07-13 16:59 - 2019-07-13 16:59 - 000001770 _____ C:\WINDOWS\SysWOW64\unins000.dat
2019-07-13 16:59 - 2019-04-10 14:55 - 000290816 _____ (www.xjghost.com) C:\WINDOWS\SysWOW64\WebClientPlayBack.ocx
2019-07-13 16:59 - 2019-04-10 14:45 - 000229484 _____ () C:\WINDOWS\SysWOW64\WebClientPlus.ocx
2019-07-13 16:59 - 2019-03-29 09:22 - 000004240 _____ C:\WINDOWS\SysWOW64\lang_spanish.ini
2019-07-13 16:59 - 2019-03-29 09:16 - 000004250 _____ C:\WINDOWS\SysWOW64\lang_italy.ini
2019-07-13 16:59 - 2019-03-29 09:12 - 000004624 _____ C:\WINDOWS\SysWOW64\lang_franch.ini
2019-07-13 16:59 - 2019-03-29 09:09 - 000004404 _____ C:\WINDOWS\SysWOW64\lang_germany.ini
2019-07-13 16:59 - 2019-03-28 10:33 - 000002698 _____ C:\WINDOWS\SysWOW64\lang_chn.ini
2019-07-13 16:59 - 2019-01-11 16:02 - 000245760 _____ () C:\WINDOWS\SysWOW64\NetLib.dll
2019-07-13 16:59 - 2019-01-11 15:55 - 000081920 _____ () C:\WINDOWS\SysWOW64\hiPBClient.dll
2019-07-13 16:59 - 2018-11-12 18:10 - 000417792 _____ () C:\WINDOWS\SysWOW64\HIPlayer.dll
2019-07-13 16:59 - 2018-11-07 11:26 - 000319488 _____ () C:\WINDOWS\SysWOW64\HIPlayer.exe
2019-07-13 16:59 - 2018-11-07 10:38 - 000057344 _____ () C:\WINDOWS\SysWOW64\HISDK.dll
2019-07-13 16:59 - 2018-11-07 09:57 - 000573952 _____ C:\WINDOWS\SysWOW64\Hi265.dll
2019-07-13 16:59 - 2014-04-10 14:28 - 000057344 _____ (微软中国) C:\WINDOWS\SysWOW64\SearchLib.dll
2019-07-13 16:59 - 2013-07-10 17:21 - 000217600 _____ C:\WINDOWS\SysWOW64\npzxwebplugin.dll
2019-07-13 16:59 - 2012-09-25 21:39 - 002555406 _____ C:\WINDOWS\SysWOW64\avcodec-54.dll
2019-07-13 16:59 - 2012-09-25 21:39 - 000157198 _____ C:\WINDOWS\SysWOW64\avutil-51.dll
2019-07-13 16:59 - 2010-08-23 20:07 - 000562220 _____ C:\WINDOWS\SysWOW64\AlarmSound.wav
2019-07-13 16:58 - 2019-07-13 16:58 - 002036967 _____ ( ) C:\Users\*****\Desktop\ClientPlus_Setup.exe
2019-07-13 16:47 - 2019-07-13 16:47 - 000001906 _____ C:\Users\*****\Desktop\HiPlayer.exe.lnk
2019-07-13 16:47 - 2019-07-13 16:47 - 000000000 ____D C:\Users\*****\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\HiPlayer
2019-07-13 16:47 - 2019-07-13 16:47 - 000000000 ____D C:\Users\*****\AppData\Roaming\HiPlayer
2019-07-09 19:25 - 2019-07-04 11:40 - 021390504 _____ (Microsoft Corporation) C:\WINDOWS\system32\shell32.dll
2019-07-09 19:25 - 2019-07-04 11:40 - 001616840 _____ (Microsoft Corporation) C:\WINDOWS\system32\sppobjs.dll
2019-07-09 19:25 - 2019-07-04 11:18 - 003614208 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32kfull.sys
2019-07-09 19:25 - 2019-07-04 10:51 - 020384128 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\shell32.dll
2019-07-09 19:25 - 2019-07-04 10:37 - 002882048 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\win32kfull.sys
2019-07-09 19:25 - 2019-07-04 07:00 - 001035040 _____ (Microsoft Corporation) C:\WINDOWS\system32\ApplyTrustOffline.exe
2019-07-09 19:25 - 2019-07-04 06:58 - 001219896 _____ (Microsoft Corporation) C:\WINDOWS\system32\hvix64.exe
2019-07-09 19:25 - 2019-07-04 06:57 - 003292152 _____ (Microsoft Corporation) C:\WINDOWS\system32\combase.dll
2019-07-09 19:25 - 2019-07-04 06:56 - 009084216 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntoskrnl.exe
2019-07-09 19:25 - 2019-07-04 06:56 - 007519896 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.Protection.PlayReady.dll
2019-07-09 19:25 - 2019-07-04 06:56 - 007436536 _____ (Microsoft Corporation) C:\WINDOWS\system32\windows.storage.dll
2019-07-09 19:25 - 2019-07-04 06:56 - 002810680 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgkrnl.sys
2019-07-09 19:25 - 2019-07-04 06:42 - 006570368 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.Protection.PlayReady.dll
2019-07-09 19:25 - 2019-07-04 06:42 - 006044008 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\windows.storage.dll
2019-07-09 19:25 - 2019-07-04 06:42 - 002479176 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\combase.dll
2019-07-09 19:25 - 2019-07-04 06:37 - 025857536 _____ (Microsoft Corporation) C:\WINDOWS\system32\edgehtml.dll
2019-07-09 19:25 - 2019-07-04 06:33 - 022017536 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\edgehtml.dll
2019-07-09 19:25 - 2019-07-04 06:29 - 022717440 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll
2019-07-09 19:25 - 2019-07-04 06:26 - 004385280 _____ (Microsoft Corporation) C:\WINDOWS\system32\EdgeContent.dll
2019-07-09 19:25 - 2019-07-04 06:25 - 019372544 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll
2019-07-09 19:25 - 2019-07-04 06:25 - 007589888 _____ (Microsoft Corporation) C:\WINDOWS\system32\Chakra.dll
2019-07-09 19:25 - 2019-07-04 06:25 - 004861440 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll
2019-07-09 19:25 - 2019-07-04 06:25 - 003401216 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentServer.dll
2019-07-09 19:25 - 2019-07-04 06:22 - 003707904 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll
2019-07-09 19:25 - 2019-07-04 06:21 - 005784064 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Chakra.dll
2019-07-09 19:25 - 2019-07-04 06:21 - 003202560 _____ (Microsoft Corporation) C:\WINDOWS\system32\DWrite.dll
2019-07-09 19:25 - 2019-06-13 14:12 - 002871848 _____ (Microsoft Corporation) C:\WINDOWS\system32\aitstatic.exe
2019-07-09 19:25 - 2019-06-13 14:05 - 000810296 _____ (Microsoft Corporation) C:\WINDOWS\system32\generaltel.dll
2019-07-09 19:25 - 2019-06-13 14:04 - 001721144 _____ (Microsoft Corporation) C:\WINDOWS\system32\appraiser.dll
2019-07-09 19:25 - 2019-06-13 13:59 - 000740664 _____ (Microsoft Corporation) C:\WINDOWS\system32\aeinv.dll
2019-07-09 19:25 - 2019-06-13 13:42 - 004038688 _____ (Microsoft Corporation) C:\WINDOWS\explorer.exe
2019-07-09 19:25 - 2019-06-13 13:18 - 006586880 _____ (Microsoft Corporation) C:\WINDOWS\system32\twinui.dll
2019-07-09 19:25 - 2019-06-13 13:18 - 004847104 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingsHandlers_nt.dll
2019-07-09 19:25 - 2019-06-13 13:17 - 012756992 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll
2019-07-09 19:25 - 2019-06-13 13:15 - 004718080 _____ (Microsoft Corporation) C:\WINDOWS\system32\twinui.pcshell.dll
2019-07-09 19:25 - 2019-06-13 13:13 - 002920448 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Logon.dll
2019-07-09 19:25 - 2019-06-13 12:11 - 001539896 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AppVEntSubsystems32.dll
2019-07-09 19:25 - 2019-06-13 12:05 - 003700160 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\explorer.exe
2019-07-09 19:25 - 2019-06-13 11:55 - 005657088 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\twinui.dll
2019-07-09 19:25 - 2019-06-13 11:54 - 011942912 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll
2019-07-09 19:25 - 2019-06-13 09:01 - 000513336 _____ (Microsoft Corporation) C:\WINDOWS\system32\aepic.dll
2019-07-09 19:25 - 2019-06-13 08:47 - 005625160 _____ (Microsoft Corporation) C:\WINDOWS\system32\StartTileData.dll
2019-07-09 19:25 - 2019-06-13 08:44 - 002769688 _____ (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll
2019-07-09 19:25 - 2019-06-13 08:14 - 003318784 _____ (Microsoft Corporation) C:\WINDOWS\system32\dwmcore.dll
2019-07-09 19:25 - 2019-06-13 08:13 - 004771840 _____ (Microsoft Corporation) C:\WINDOWS\system32\InputService.dll
2019-07-09 19:25 - 2019-06-13 07:14 - 000415544 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\aepic.dll
2019-07-09 19:25 - 2019-06-13 07:06 - 002256768 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iertutil.dll
2019-07-09 19:24 - 2019-07-04 11:45 - 001786680 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVEntVirtualization.dll
2019-07-09 19:24 - 2019-07-04 11:43 - 000094008 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpudd.dll
2019-07-09 19:24 - 2019-07-04 11:41 - 000304144 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\mssecflt.sys
2019-07-09 19:24 - 2019-07-04 11:40 - 001631808 _____ (Microsoft Corporation) C:\WINDOWS\system32\gdi32full.dll
2019-07-09 19:24 - 2019-07-04 11:40 - 000790416 _____ (Microsoft Corporation) C:\WINDOWS\system32\fontdrvhost.exe
2019-07-09 19:24 - 2019-07-04 11:22 - 000131072 _____ (Microsoft Corporation) C:\WINDOWS\splwow64.exe
2019-07-09 19:24 - 2019-07-04 11:22 - 000128000 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppxSysprep.dll
2019-07-09 19:24 - 2019-07-04 11:21 - 008627200 _____ (Microsoft Corporation) C:\WINDOWS\system32\mstscax.dll
2019-07-09 19:24 - 2019-07-04 11:20 - 001609216 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpcorets.dll
2019-07-09 19:24 - 2019-07-04 11:19 - 000420864 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpclip.exe
2019-07-09 19:24 - 2019-07-04 11:18 - 001663488 _____ (Microsoft Corporation) C:\WINDOWS\system32\GdiPlus.dll
2019-07-09 19:24 - 2019-07-04 10:56 - 001453416 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\gdi32full.dll
2019-07-09 19:24 - 2019-07-04 10:54 - 000662352 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\fontdrvhost.exe
2019-07-09 19:24 - 2019-07-04 10:41 - 007990784 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mstscax.dll
2019-07-09 19:24 - 2019-07-04 10:36 - 001471488 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\GdiPlus.dll
2019-07-09 19:24 - 2019-07-04 06:58 - 001328440 _____ (Microsoft Corporation) C:\WINDOWS\system32\wpx.dll
2019-07-09 19:24 - 2019-07-04 06:58 - 000416312 _____ (Microsoft Corporation) C:\WINDOWS\system32\wlanapi.dll
2019-07-09 19:24 - 2019-07-04 06:58 - 000192824 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\appid.sys
2019-07-09 19:24 - 2019-07-04 06:57 - 001027384 _____ (Microsoft Corporation) C:\WINDOWS\system32\hvax64.exe
2019-07-09 19:24 - 2019-07-04 06:57 - 000986128 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingSyncHost.exe
2019-07-09 19:24 - 2019-07-04 06:57 - 000776784 _____ (Microsoft Corporation) C:\WINDOWS\system32\wer.dll
2019-07-09 19:24 - 2019-07-04 06:57 - 000723728 _____ (Microsoft Corporation) C:\WINDOWS\system32\ci.dll
2019-07-09 19:24 - 2019-07-04 06:57 - 000708696 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\cng.sys
2019-07-09 19:24 - 2019-07-04 06:57 - 000568104 _____ (Microsoft Corporation) C:\WINDOWS\system32\tcblaunch.exe
2019-07-09 19:24 - 2019-07-04 06:57 - 000362264 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Storage.ApplicationData.dll
2019-07-09 19:24 - 2019-07-04 06:57 - 000209424 _____ (Microsoft Corporation) C:\WINDOWS\system32\wermgr.exe
2019-07-09 19:24 - 2019-07-04 06:57 - 000194360 _____ (Microsoft Corporation) C:\WINDOWS\system32\skci.dll
2019-07-09 19:24 - 2019-07-04 06:57 - 000137656 _____ (Microsoft Corporation) C:\WINDOWS\system32\bcrypt.dll
2019-07-09 19:24 - 2019-07-04 06:57 - 000134968 _____ (Microsoft Corporation) C:\WINDOWS\system32\hvloader.dll
2019-07-09 19:24 - 2019-07-04 06:57 - 000091776 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dumpfve.sys
2019-07-09 19:24 - 2019-07-04 06:56 - 002571640 _____ (Microsoft Corporation) C:\WINDOWS\system32\KernelBase.dll
2019-07-09 19:24 - 2019-07-04 06:56 - 001566520 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppxPackaging.dll
2019-07-09 19:24 - 2019-07-04 06:56 - 001459120 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.efi
2019-07-09 19:24 - 2019-07-04 06:56 - 001260776 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.exe
2019-07-09 19:24 - 2019-07-04 06:56 - 001141496 _____ (Microsoft Corporation) C:\WINDOWS\system32\winresume.efi
2019-07-09 19:24 - 2019-07-04 06:56 - 000983936 _____ (Microsoft Corporation) C:\WINDOWS\system32\winresume.exe
2019-07-09 19:24 - 2019-07-04 06:56 - 000767536 _____ (Microsoft Corporation) C:\WINDOWS\system32\dnsapi.dll
2019-07-09 19:24 - 2019-07-04 06:56 - 000734952 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentClient.dll
2019-07-09 19:24 - 2019-07-04 06:56 - 000713272 _____ (Microsoft Corporation) C:\WINDOWS\system32\MSVideoDSP.dll
2019-07-09 19:24 - 2019-07-04 06:56 - 000604984 _____ (Microsoft Corporation) C:\WINDOWS\system32\securekernel.exe
2019-07-09 19:24 - 2019-07-04 06:56 - 000493752 _____ (Microsoft Corporation) C:\WINDOWS\system32\bcryptprimitives.dll
2019-07-09 19:24 - 2019-07-04 06:56 - 000115512 _____ (Microsoft Corporation) C:\WINDOWS\system32\kdnet.dll
2019-07-09 19:24 - 2019-07-04 06:43 - 000832016 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SettingSyncHost.exe
2019-07-09 19:24 - 2019-07-04 06:43 - 000665440 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wer.dll
2019-07-09 19:24 - 2019-07-04 06:43 - 000328696 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wlanapi.dll
2019-07-09 19:24 - 2019-07-04 06:43 - 000287376 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Storage.ApplicationData.dll
2019-07-09 19:24 - 2019-07-04 06:43 - 000191800 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wermgr.exe
2019-07-09 19:24 - 2019-07-04 06:42 - 001980984 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\KernelBase.dll
2019-07-09 19:24 - 2019-07-04 06:42 - 001427768 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AppxPackaging.dll
2019-07-09 19:24 - 2019-07-04 06:42 - 000573808 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dnsapi.dll
2019-07-09 19:24 - 2019-07-04 06:42 - 000356312 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\bcryptprimitives.dll
2019-07-09 19:24 - 2019-07-04 06:42 - 000097272 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\bcrypt.dll
2019-07-09 19:24 - 2019-07-04 06:41 - 000559328 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AppXDeploymentClient.dll
2019-07-09 19:24 - 2019-07-04 06:26 - 000310272 _____ (Microsoft Corporation) C:\WINDOWS\system32\wc_storage.dll
2019-07-09 19:24 - 2019-07-04 06:26 - 000051200 _____ (Microsoft Corporation) C:\WINDOWS\system32\TpmTasks.dll
2019-07-09 19:24 - 2019-07-04 06:25 - 000295424 _____ (Microsoft Corporation) C:\WINDOWS\system32\TDLMigration.dll
2019-07-09 19:24 - 2019-07-04 06:25 - 000079872 _____ (Microsoft Corporation) C:\WINDOWS\system32\offreg.dll
2019-07-09 19:24 - 2019-07-04 06:24 - 000726528 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\PEAuth.sys
2019-07-09 19:24 - 2019-07-04 06:24 - 000567808 _____ (Microsoft Corporation) C:\WINDOWS\system32\daxexec.dll
2019-07-09 19:24 - 2019-07-04 06:24 - 000462336 _____ (Microsoft Corporation) C:\WINDOWS\system32\bcdedit.exe
2019-07-09 19:24 - 2019-07-04 06:24 - 000153600 _____ (Microsoft Corporation) C:\WINDOWS\system32\dssvc.dll
2019-07-09 19:24 - 2019-07-04 06:23 - 001765888 _____ (Microsoft Corporation) C:\WINDOWS\system32\audiosrv.dll
2019-07-09 19:24 - 2019-07-04 06:23 - 001217536 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpcore.dll
2019-07-09 19:24 - 2019-07-04 06:23 - 000786432 _____ (Microsoft Corporation) C:\WINDOWS\system32\iphlpsvc.dll
2019-07-09 19:24 - 2019-07-04 06:22 - 002587648 _____ (Microsoft Corporation) C:\WINDOWS\system32\wlansvc.dll
2019-07-09 19:24 - 2019-07-04 06:22 - 002176000 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentExtensions.onecore.dll
2019-07-09 19:24 - 2019-07-04 06:22 - 001561088 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentExtensions.desktop.dll
2019-07-09 19:24 - 2019-07-04 06:22 - 001549824 _____ (Microsoft Corporation) C:\WINDOWS\system32\lsasrv.dll
2019-07-09 19:24 - 2019-07-04 06:22 - 001175552 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingSyncCore.dll
2019-07-09 19:24 - 2019-07-04 06:22 - 000300544 _____ (Microsoft Corporation) C:\WINDOWS\system32\dnsrslvr.dll
2019-07-09 19:24 - 2019-07-04 06:22 - 000110592 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\profext.dll
2019-07-09 19:24 - 2019-07-04 06:22 - 000032768 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\werdiagcontroller.dll
2019-07-09 19:24 - 2019-07-04 06:21 - 005307392 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d2d1.dll
2019-07-09 19:24 - 2019-07-04 06:21 - 002166784 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32kbase.sys
2019-07-09 19:24 - 2019-07-04 06:21 - 001920000 _____ (Microsoft Corporation) C:\WINDOWS\system32\FntCache.dll
2019-07-09 19:24 - 2019-07-04 06:21 - 001220608 _____ (Microsoft Corporation) C:\WINDOWS\system32\Unistore.dll
2019-07-09 19:24 - 2019-07-04 06:21 - 000324096 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppxAllUserStore.dll
2019-07-09 19:24 - 2019-07-04 06:21 - 000124416 _____ (Microsoft Corporation) C:\WINDOWS\system32\profext.dll
2019-07-09 19:24 - 2019-07-04 06:21 - 000059392 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\offreg.dll
2019-07-09 19:24 - 2019-07-04 06:20 - 001156608 _____ (Microsoft Corporation) C:\WINDOWS\system32\rpcss.dll
2019-07-09 19:24 - 2019-07-04 06:20 - 000544256 _____ (Microsoft Corporation) C:\WINDOWS\system32\vbscript.dll
2019-07-09 19:24 - 2019-07-04 06:20 - 000392704 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\daxexec.dll
2019-07-09 19:24 - 2019-07-04 06:20 - 000330752 _____ (Microsoft Corporation) C:\WINDOWS\system32\ncryptprov.dll
2019-07-09 19:24 - 2019-07-04 06:19 - 000886272 _____ (Microsoft Corporation) C:\WINDOWS\system32\MPSSVC.dll
2019-07-09 19:24 - 2019-07-04 06:19 - 000230912 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AppxAllUserStore.dll
2019-07-09 19:24 - 2019-07-04 06:18 - 002602496 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\DWrite.dll
2019-07-09 19:24 - 2019-07-04 06:18 - 001076224 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rdpcore.dll
2019-07-09 19:24 - 2019-07-04 06:18 - 000965632 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Unistore.dll
2019-07-09 19:24 - 2019-07-04 06:18 - 000953344 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SettingSyncCore.dll
2019-07-09 19:24 - 2019-07-04 06:18 - 000275968 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ncryptprov.dll
2019-07-09 19:24 - 2019-07-04 06:17 - 000531968 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\vbscript.dll
2019-07-09 19:24 - 2019-07-04 05:01 - 000001312 _____ C:\WINDOWS\system32\tcbres.wim
2019-07-09 19:24 - 2019-06-21 10:50 - 000280584 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\msiscsi.sys
2019-07-09 19:24 - 2019-06-13 14:15 - 000324408 _____ (Microsoft Corporation) C:\WINDOWS\system32\acmigration.dll
2019-07-09 19:24 - 2019-06-13 14:00 - 000464696 _____ (Microsoft Corporation) C:\WINDOWS\system32\invagent.dll
2019-07-09 19:24 - 2019-06-13 13:58 - 000637752 _____ (Microsoft Corporation) C:\WINDOWS\system32\devinv.dll
2019-07-09 19:24 - 2019-06-13 13:58 - 000071480 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32appinventorycsp.dll
2019-07-09 19:24 - 2019-06-13 13:56 - 000164152 _____ (Microsoft Corporation) C:\WINDOWS\system32\CompatTelRunner.exe
2019-07-09 19:24 - 2019-06-13 13:43 - 001427984 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVEntSubsystemController.dll
2019-07-09 19:24 - 2019-06-13 13:43 - 001048480 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Internal.Shell.Broker.dll
2019-07-09 19:24 - 2019-06-13 13:42 - 002266936 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVEntSubsystems64.dll
2019-07-09 19:24 - 2019-06-13 13:42 - 000652088 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVPublishing.dll
2019-07-09 19:24 - 2019-06-13 13:42 - 000566536 _____ (Microsoft Corporation) C:\WINDOWS\system32\phoneactivate.exe
2019-07-09 19:24 - 2019-06-13 13:41 - 001626936 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVIntegration.dll
2019-07-09 19:24 - 2019-06-13 13:41 - 000830264 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVOrchestration.dll
2019-07-09 19:24 - 2019-06-13 13:41 - 000825144 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVEntStreamingManager.dll
2019-07-09 19:24 - 2019-06-13 13:41 - 000670008 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVCatalog.dll
2019-07-09 19:24 - 2019-06-13 13:40 - 000749880 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVReporting.dll
2019-07-09 19:24 - 2019-06-13 13:40 - 000540984 _____ (Microsoft Corporation) C:\WINDOWS\system32\pcasvc.dll
2019-07-09 19:24 - 2019-06-13 13:40 - 000495416 _____ (Microsoft Corporation) C:\WINDOWS\system32\TransportDSA.dll
2019-07-09 19:24 - 2019-06-13 13:38 - 000766264 _____ (Microsoft Corporation) C:\WINDOWS\system32\LicensingWinRT.dll
2019-07-09 19:24 - 2019-06-13 13:37 - 000101192 _____ (Microsoft Corporation) C:\WINDOWS\system32\changepk.exe
2019-07-09 19:24 - 2019-06-13 13:36 - 000251000 _____ (Microsoft Corporation) C:\WINDOWS\system32\sppwinob.dll
2019-07-09 19:24 - 2019-06-13 13:36 - 000236520 _____ (Microsoft Corporation) C:\WINDOWS\system32\EditionUpgradeManagerObj.dll
2019-07-09 19:24 - 2019-06-13 13:35 - 001376688 _____ (Microsoft Corporation) C:\WINDOWS\system32\ole32.dll
2019-07-09 19:24 - 2019-06-13 13:34 - 000146888 _____ (Microsoft Corporation) C:\WINDOWS\system32\LicensingUI.exe
2019-07-09 19:24 - 2019-06-13 13:17 - 000178176 _____ (Microsoft Corporation) C:\WINDOWS\system32\dmvdsitf.dll
2019-07-09 19:24 - 2019-06-13 13:17 - 000115200 _____ (Microsoft Corporation) C:\WINDOWS\system32\RjvMDMConfig.dll
2019-07-09 19:24 - 2019-06-13 13:17 - 000109056 _____ (Microsoft Corporation) C:\WINDOWS\system32\MDMAgent.exe
2019-07-09 19:24 - 2019-06-13 13:17 - 000093184 _____ (Microsoft Corporation) C:\WINDOWS\system32\WSReset.exe
2019-07-09 19:24 - 2019-06-13 13:16 - 000767488 _____ (Microsoft Corporation) C:\WINDOWS\system32\sppcommdlg.dll
2019-07-09 19:24 - 2019-06-13 13:15 - 000041984 _____ (Microsoft Corporation) C:\WINDOWS\system32\UpgradeResultsUI.exe
2019-07-09 19:24 - 2019-06-13 13:14 - 001127936 _____ (Microsoft Corporation) C:\WINDOWS\system32\nettrace.dll
2019-07-09 19:24 - 2019-06-13 13:14 - 000900096 _____ (Microsoft Corporation) C:\WINDOWS\system32\slui.exe
2019-07-09 19:24 - 2019-06-13 13:14 - 000346624 _____ (Microsoft Corporation) C:\WINDOWS\system32\AcGenral.dll
2019-07-09 19:24 - 2019-06-13 13:14 - 000246272 _____ (Microsoft Corporation) C:\WINDOWS\system32\DesktopSwitcherDataModel.dll
2019-07-09 19:24 - 2019-06-13 13:13 - 001339392 _____ (Microsoft Corporation) C:\WINDOWS\system32\TaskFlowDataEngine.dll
2019-07-09 19:24 - 2019-06-13 13:13 - 000951808 _____ (Microsoft Corporation) C:\WINDOWS\system32\sppcext.dll
2019-07-09 19:24 - 2019-06-13 13:13 - 000765440 _____ (Microsoft Corporation) C:\WINDOWS\system32\tdh.dll
2019-07-09 19:24 - 2019-06-13 13:13 - 000181248 _____ (Microsoft Corporation) C:\WINDOWS\system32\EditionUpgradeHelper.dll
2019-07-09 19:24 - 2019-06-13 13:12 - 000394240 _____ (Microsoft Corporation) C:\WINDOWS\system32\InputSwitch.dll
2019-07-09 19:24 - 2019-06-13 13:10 - 000239104 _____ (Microsoft Corporation) C:\WINDOWS\system32\vdsbas.dll
2019-07-09 19:24 - 2019-06-13 12:07 - 001027008 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ole32.dll
2019-07-09 19:24 - 2019-06-13 12:07 - 000660496 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\LicensingWinRT.dll
2019-07-09 19:24 - 2019-06-13 12:07 - 000221232 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\EditionUpgradeManagerObj.dll
2019-07-09 19:24 - 2019-06-13 11:54 - 000151552 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dmvdsitf.dll
2019-07-09 19:24 - 2019-06-13 11:53 - 000089600 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\olepro32.dll
2019-07-09 19:24 - 2019-06-13 11:51 - 000622080 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\tdh.dll
2019-07-09 19:24 - 2019-06-13 11:50 - 000896512 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\sppcext.dll
2019-07-09 19:24 - 2019-06-13 11:49 - 002406400 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AcGenral.dll
2019-07-09 19:24 - 2019-06-13 11:49 - 000371200 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\InputSwitch.dll
2019-07-09 19:24 - 2019-06-13 09:48 - 000677376 _____ (Microsoft Corporation) C:\WINDOWS\system32\HeadTrackerStorage.dll
2019-07-09 19:24 - 2019-06-13 09:46 - 000713216 _____ (Microsoft Corporation) C:\WINDOWS\system32\SharedRealitySvc.dll
2019-07-09 19:24 - 2019-06-13 09:01 - 000511288 _____ (Microsoft Corporation) C:\WINDOWS\system32\dcntel.dll
2019-07-09 19:24 - 2019-06-13 09:01 - 000036152 _____ (Microsoft Corporation) C:\WINDOWS\system32\DeviceCensus.exe
2019-07-09 19:24 - 2019-06-13 08:59 - 000785264 _____ (Microsoft Corporation) C:\WINDOWS\system32\pkeyhelper.dll
2019-07-09 19:24 - 2019-06-13 08:47 - 001063224 _____ (Microsoft Corporation) C:\WINDOWS\system32\SecConfig.efi
2019-07-09 19:24 - 2019-06-13 08:46 - 001076536 _____ (Microsoft Corporation) C:\WINDOWS\system32\efscore.dll
2019-07-09 19:24 - 2019-06-13 08:46 - 000510296 _____ (Microsoft Corporation) C:\WINDOWS\system32\policymanager.dll
2019-07-09 19:24 - 2019-06-13 08:46 - 000093984 _____ (Microsoft Corporation) C:\WINDOWS\system32\wldp.dll
2019-07-09 19:24 - 2019-06-13 08:45 - 002421560 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ntfs.sys
2019-07-09 19:24 - 2019-06-13 08:44 - 002546704 _____ (Microsoft Corporation) C:\WINDOWS\system32\UpdateAgent.dll
2019-07-09 19:24 - 2019-06-13 08:44 - 001098272 _____ (Microsoft Corporation) C:\WINDOWS\system32\msvproc.dll
2019-07-09 19:24 - 2019-06-13 08:44 - 001033696 _____ (Microsoft Corporation) C:\WINDOWS\system32\ClipSVC.dll
2019-07-09 19:24 - 2019-06-13 08:44 - 000607112 _____ (Microsoft Corporation) C:\WINDOWS\system32\TextInputFramework.dll
2019-07-09 19:24 - 2019-06-13 08:44 - 000545808 _____ (Microsoft Corporation) C:\WINDOWS\system32\hal.dll
2019-07-09 19:24 - 2019-06-13 08:44 - 000130624 _____ (Microsoft Corporation) C:\WINDOWS\system32\rmclient.dll
2019-07-09 19:24 - 2019-06-13 08:17 - 000106496 _____ (Microsoft Corporation) C:\WINDOWS\system32\NotificationControllerPS.dll
2019-07-09 19:24 - 2019-06-13 08:16 - 001626112 _____ (Microsoft Corporation) C:\WINDOWS\system32\enterprisecsps.dll
2019-07-09 19:24 - 2019-06-13 08:16 - 000140288 _____ (Microsoft Corporation) C:\WINDOWS\system32\mdmmigrator.dll
2019-07-09 19:24 - 2019-06-13 08:15 - 000514560 _____ (Microsoft Corporation) C:\WINDOWS\system32\nltest.exe
2019-07-09 19:24 - 2019-06-13 08:15 - 000433152 _____ (Microsoft Corporation) C:\WINDOWS\system32\MusNotification.exe
2019-07-09 19:24 - 2019-06-13 08:15 - 000204288 _____ (Microsoft Corporation) C:\WINDOWS\system32\enrollmentapi.dll
2019-07-09 19:24 - 2019-06-13 08:15 - 000137728 _____ (Microsoft Corporation) C:\WINDOWS\system32\InputLocaleManager.dll
2019-07-09 19:24 - 2019-06-13 08:15 - 000083456 _____ (Microsoft Corporation) C:\WINDOWS\system32\KdsCli.dll
2019-07-09 19:24 - 2019-06-13 08:14 - 000409088 _____ (Microsoft Corporation) C:\WINDOWS\system32\wlanmsm.dll
2019-07-09 19:24 - 2019-06-13 08:14 - 000361472 _____ (Microsoft Corporation) C:\WINDOWS\system32\DeviceEnroller.exe
2019-07-09 19:24 - 2019-06-13 08:14 - 000302080 _____ (Microsoft Corporation) C:\WINDOWS\system32\CXHProvisioningServer.dll
2019-07-09 19:24 - 2019-06-13 08:13 - 002370048 _____ (Microsoft Corporation) C:\WINDOWS\system32\WebRuntimeManager.dll
2019-07-09 19:24 - 2019-06-13 08:13 - 000761344 _____ (Microsoft Corporation) C:\WINDOWS\system32\nshwfp.dll
2019-07-09 19:24 - 2019-06-13 08:13 - 000322560 _____ (Microsoft Corporation) C:\WINDOWS\system32\MusNotificationUx.exe
2019-07-09 19:24 - 2019-06-13 08:13 - 000110592 _____ (Microsoft Corporation) C:\WINDOWS\system32\ngcpopkeysrv.dll
2019-07-09 19:24 - 2019-06-13 08:12 - 000916480 _____ (Microsoft Corporation) C:\WINDOWS\system32\MusUpdateHandlers.dll
2019-07-09 19:24 - 2019-06-13 08:12 - 000894464 _____ (Microsoft Corporation) C:\WINDOWS\system32\webplatstorageserver.dll
2019-07-09 19:24 - 2019-06-13 08:12 - 000808448 _____ (Microsoft Corporation) C:\WINDOWS\system32\EdgeManager.dll
2019-07-09 19:24 - 2019-06-13 08:12 - 000624640 _____ (Microsoft Corporation) C:\WINDOWS\system32\PsmServiceExtHost.dll
2019-07-09 19:24 - 2019-06-13 08:12 - 000532992 _____ (Microsoft Corporation) C:\WINDOWS\system32\QuietHours.dll
2019-07-09 19:24 - 2019-06-13 08:12 - 000501248 _____ (Microsoft Corporation) C:\WINDOWS\system32\rastls.dll
2019-07-09 19:24 - 2019-06-13 08:11 - 000508416 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingsHandlers_Notifications.dll
2019-07-09 19:24 - 2019-06-13 08:11 - 000271872 _____ (Microsoft Corporation) C:\WINDOWS\system32\wkssvc.dll
2019-07-09 19:24 - 2019-06-13 08:11 - 000048128 _____ (Microsoft Corporation) C:\WINDOWS\system32\TokenBrokerUI.dll
2019-07-09 19:24 - 2019-06-13 08:10 - 002912256 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuaueng.dll
2019-07-09 19:24 - 2019-06-13 08:10 - 001400832 _____ (Microsoft Corporation) C:\WINDOWS\system32\TokenBroker.dll
2019-07-09 19:24 - 2019-06-13 08:10 - 001215488 _____ (Microsoft Corporation) C:\WINDOWS\system32\NotificationController.dll
2019-07-09 19:24 - 2019-06-13 08:10 - 000871424 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.BackgroundMediaPlayback.dll
2019-07-09 19:24 - 2019-06-13 08:10 - 000869376 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.Playback.BackgroundMediaPlayer.dll
2019-07-09 19:24 - 2019-06-13 08:10 - 000849408 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.Playback.MediaPlayer.dll
2019-07-09 19:24 - 2019-06-13 08:10 - 000523776 _____ (Microsoft Corporation) C:\WINDOWS\system32\dmenrollengine.dll
2019-07-09 19:24 - 2019-06-13 08:09 - 001854976 _____ (Microsoft Corporation) C:\WINDOWS\system32\wevtsvc.dll
2019-07-09 19:24 - 2019-06-13 08:09 - 000922112 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Security.Authentication.Web.Core.dll
2019-07-09 19:24 - 2019-06-13 08:09 - 000755712 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Core.TextInput.dll
2019-07-09 19:24 - 2019-06-13 08:08 - 000506368 _____ (Microsoft Corporation) C:\WINDOWS\system32\edgeIso.dll
2019-07-09 19:24 - 2019-06-13 07:08 - 000443632 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\policymanager.dll
2019-07-09 19:24 - 2019-06-13 07:07 - 000101192 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rmclient.dll
2019-07-09 19:24 - 2019-06-13 07:07 - 000080744 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wldp.dll
2019-07-09 19:24 - 2019-06-13 07:06 - 001130776 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msvproc.dll
2019-07-09 19:24 - 2019-06-13 07:06 - 000581600 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MSVideoDSP.dll
2019-07-09 19:24 - 2019-06-13 06:49 - 000172544 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\enrollmentapi.dll
2019-07-09 19:24 - 2019-06-13 06:47 - 003554304 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\InputService.dll
2019-07-09 19:24 - 2019-06-13 06:47 - 002899456 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dwmcore.dll
2019-07-09 19:24 - 2019-06-13 06:47 - 000450048 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rastls.dll
2019-07-09 19:24 - 2019-06-13 06:46 - 000608768 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\EdgeManager.dll
2019-07-09 19:24 - 2019-06-13 06:46 - 000331776 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\edgeIso.dll
2019-07-09 19:24 - 2019-06-13 06:46 - 000038400 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TokenBrokerUI.dll
2019-07-09 19:24 - 2019-06-13 06:45 - 000602112 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\nshwfp.dll
2019-07-09 19:24 - 2019-06-13 06:45 - 000578560 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\webplatstorageserver.dll
2019-07-09 19:24 - 2019-06-13 06:44 - 001003008 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TokenBroker.dll
2019-07-09 19:24 - 2019-06-13 06:44 - 000648192 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.BackgroundMediaPlayback.dll
2019-07-09 19:24 - 2019-06-13 06:44 - 000630784 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.Playback.MediaPlayer.dll
2019-07-09 19:24 - 2019-06-13 06:44 - 000582144 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Core.TextInput.dll
2019-07-09 19:24 - 2019-06-13 06:44 - 000251904 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msIso.dll
2019-07-09 19:24 - 2019-06-13 06:43 - 000681472 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Security.Authentication.Web.Core.dll
2019-07-09 19:24 - 2019-06-13 06:43 - 000646656 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.Playback.BackgroundMediaPlayer.dll
2019-07-09 19:24 - 2019-06-13 06:43 - 000445952 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dmenrollengine.dll
2019-07-07 17:59 - 2019-07-07 18:10 - 234299675 _____ C:\Users\**\Desktop\Tajemství (The secret).mp4
2019-07-06 12:14 - 2019-07-06 12:02 - 000543307 _____ C:\Users\**\Desktop\banda_zlodejov_1.pdf

==================== One month (modified) ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2019-08-01 13:40 - 2018-12-20 22:18 - 000000000 ____D C:\Users\*****\AppData\LocalLow\Mozilla
2019-08-01 13:40 - 2018-12-20 22:11 - 000000000 __SHD C:\Users\*****\IntelGraphicsProfiles
2019-08-01 13:40 - 2018-12-20 22:11 - 000000000 ____D C:\Users\*****
2019-08-01 13:40 - 2018-12-14 18:56 - 000000006 ____H C:\WINDOWS\Tasks\SA.DAT
2019-08-01 13:40 - 2018-04-12 01:36 - 000000000 ____D C:\WINDOWS\INF
2019-08-01 13:40 - 2018-04-11 23:04 - 000786432 _____ C:\WINDOWS\system32\config\BBI
2019-08-01 13:37 - 2015-10-30 09:24 - 000000000 ___HD C:\WINDOWS\system32\GroupPolicy
2019-07-31 22:57 - 2018-04-12 01:38 - 000000000 ____D C:\ProgramData\regid.1991-06.com.microsoft
2019-07-31 22:52 - 2018-12-20 22:09 - 000730418 _____ C:\WINDOWS\system32\perfh007.dat
2019-07-31 22:52 - 2018-12-20 22:09 - 000149068 _____ C:\WINDOWS\system32\perfc007.dat
2019-07-31 22:52 - 2018-12-20 22:09 - 000116006 _____ C:\WINDOWS\system32\perfh01B.dat
2019-07-31 22:52 - 2018-12-20 22:09 - 000023440 _____ C:\WINDOWS\system32\perfc01B.dat
2019-07-31 22:52 - 2018-12-14 09:55 - 001841978 _____ C:\WINDOWS\system32\PerfStringBackup.INI
2019-07-31 22:47 - 2018-04-12 01:38 - 000000000 ____D C:\WINDOWS\AppReadiness
2019-07-31 22:43 - 2018-12-20 22:22 - 000000000 ____D C:\Users\*****\Desktop\Alte Firefox-Daten
2019-07-31 22:42 - 2018-12-20 22:11 - 000000000 ____D C:\Users\*****\AppData\Local\Packages
2019-07-31 20:07 - 2018-12-14 18:56 - 000003834 _____ C:\WINDOWS\System32\Tasks\IUM-F1E24CA0-B63E-4F13-A9E3-4ADE3BFF3473
2019-07-31 20:01 - 2019-05-02 21:25 - 000000000 ____D C:\Users\*****\AppData\LocalLow\Temp
2019-07-31 19:08 - 2018-12-14 18:59 - 000000000 __SHD C:\Users\**\IntelGraphicsProfiles
2019-07-30 22:27 - 2018-12-20 21:40 - 000000000 ____D C:\Users\**\AppData\LocalLow\Mozilla
2019-07-30 21:23 - 2018-12-14 18:53 - 000000000 ____D C:\WINDOWS\system32\SleepStudy
2019-07-30 21:17 - 2018-12-14 18:54 - 000000000 ____D C:\Users\**
2019-07-30 21:05 - 2018-12-20 21:44 - 000000000 ____D C:\Users\**\Desktop\Faktury-International-House
2019-07-30 20:43 - 2018-12-20 22:22 - 000000000 ____D C:\Users\*****\Documents\Korespondencia
2019-07-30 19:59 - 2018-04-12 01:38 - 000000000 ___HD C:\Program Files\WindowsApps
2019-07-27 14:11 - 2018-12-14 18:56 - 000000000 ____D C:\WINDOWS\system32\Drivers\wd
2019-07-27 14:10 - 2018-12-14 11:22 - 000000000 ____D C:\ProgramData\Package Cache
2019-07-27 14:10 - 2018-12-14 11:22 - 000000000 ____D C:\Program Files (x86)\Intel
2019-07-25 03:25 - 2018-04-12 01:38 - 000000000 ____D C:\WINDOWS\InfusedApps.tmp
2019-07-25 02:42 - 2018-04-12 01:38 - 000000000 ____D C:\WINDOWS\InfusedApps
2019-07-25 02:38 - 2018-04-12 01:38 - 000000000 ____D C:\WINDOWS\registration
2019-07-25 01:38 - 2018-12-17 09:13 - 000000000 ____D C:\Users\**\AppData\Local\D3DSCache
2019-07-25 01:01 - 2018-12-20 21:40 - 000000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2019-07-25 00:58 - 2018-04-12 01:38 - 000000000 ____D C:\WINDOWS\system32\NDF
2019-07-25 00:55 - 2019-01-05 16:50 - 000000000 ____D C:\Users\**\AppData\Local\ElevatedDiagnostics
2019-07-24 23:06 - 2018-12-20 21:40 - 000001005 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Firefox.lnk
2019-07-24 22:59 - 2018-12-14 09:57 - 000000000 ____D C:\Users\**\AppData\Local\VirtualStore
2019-07-24 21:16 - 2018-04-12 01:33 - 000466432 _____ (Microsoft Corporation) C:\WINDOWS\system32\dpnet.dll
2019-07-24 21:16 - 2018-04-12 01:33 - 000390656 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dpnet.dll
2019-07-24 21:16 - 2018-04-12 01:33 - 000218112 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dplayx.dll
2019-07-24 21:16 - 2018-04-12 01:33 - 000067584 _____ (Microsoft Corporation) C:\WINDOWS\system32\dpnathlp.dll
2019-07-24 21:16 - 2018-04-12 01:33 - 000061440 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dpnathlp.dll
2019-07-24 21:16 - 2018-04-12 01:33 - 000046592 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dpwsockx.dll
2019-07-24 21:16 - 2018-04-12 01:33 - 000026624 _____ (Microsoft Corporation) C:\WINDOWS\system32\dpnsvr.exe
2019-07-24 21:16 - 2018-04-12 01:33 - 000024064 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dpmodemx.dll
2019-07-24 21:16 - 2018-04-12 01:33 - 000023040 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dpnsvr.exe
2019-07-24 21:16 - 2018-04-12 01:33 - 000020480 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dplaysvr.exe
2019-07-24 21:16 - 2018-04-12 01:33 - 000010240 _____ (Microsoft Corporation) C:\WINDOWS\system32\dpnhupnp.dll
2019-07-24 21:16 - 2018-04-12 01:33 - 000010240 _____ (Microsoft Corporation) C:\WINDOWS\system32\dpnhpast.dll
2019-07-24 21:16 - 2018-04-12 01:33 - 000008704 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dpnhupnp.dll
2019-07-24 21:16 - 2018-04-12 01:33 - 000008704 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dpnhpast.dll
2019-07-24 21:16 - 2018-04-12 01:33 - 000006144 _____ (Microsoft Corporation) C:\WINDOWS\system32\dpnlobby.dll
2019-07-24 21:16 - 2018-04-12 01:33 - 000006144 _____ (Microsoft Corporation) C:\WINDOWS\system32\dpnaddr.dll
2019-07-24 21:16 - 2018-04-12 01:33 - 000005120 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dpnlobby.dll
2019-07-24 21:16 - 2018-04-12 01:33 - 000005120 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dpnaddr.dll
2019-07-24 21:16 - 2018-04-12 01:30 - 000000000 ____D C:\WINDOWS\CbsTemp
2019-07-17 14:09 - 2018-12-14 09:57 - 000000000 ____D C:\Users\**\AppData\Local\Packages
2019-07-17 08:32 - 2018-12-14 11:11 - 000002313 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2019-07-17 08:32 - 2018-12-14 11:11 - 000002272 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2019-07-16 09:29 - 2018-12-20 21:44 - 000000000 ____D C:\Users\**\Desktop\Meditacie
2019-07-16 08:14 - 2018-12-20 21:48 - 000000000 ____D C:\Users\**\Documents\Ostatné
2019-07-13 17:03 - 2018-12-27 12:39 - 000000000 ____D C:\Users\*****\AppData\Local\Adobe
2019-07-13 17:03 - 2018-04-12 01:38 - 000000000 ____D C:\WINDOWS\SysWOW64\Macromed
2019-07-13 17:03 - 2018-04-12 01:38 - 000000000 ____D C:\WINDOWS\system32\Macromed
2019-07-13 17:02 - 2018-12-14 11:09 - 000000000 ____D C:\Users\**\AppData\Local\Adobe
2019-07-13 16:47 - 2019-06-30 12:12 - 000000000 ____D C:\Users\*****\AppData\Roaming\InstallShield Installation Information
2019-07-13 14:43 - 2019-06-30 12:12 - 000000653 _____ C:\Users\*****\Desktop\Ip Camera Client.lnk
2019-07-13 13:57 - 2018-12-20 22:16 - 000003380 _____ C:\WINDOWS\System32\Tasks\OneDrive Standalone Update Task-S-1-5-21-1960842775-2088100534-3542962694-1002
2019-07-13 13:57 - 2018-12-20 22:12 - 000000000 ___RD C:\Users\*****\OneDrive
2019-07-13 13:57 - 2018-12-20 22:11 - 000002383 _____ C:\Users\*****\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OneDrive.lnk
2019-07-13 13:56 - 2018-12-20 22:11 - 000000000 ___RD C:\Users\*****\3D Objects
2019-07-13 13:56 - 2018-12-14 09:57 - 000000000 __RHD C:\Users\Public\AccountPictures
2019-07-10 22:06 - 2018-12-14 10:50 - 000741432 ____N (Microsoft Corporation) C:\WINDOWS\system32\MpSigStub.exe
2019-07-09 21:11 - 2018-12-14 18:56 - 000000000 ___RD C:\Users\**\3D Objects
2019-07-09 21:10 - 2018-12-14 18:53 - 000399520 _____ C:\WINDOWS\system32\FNTCACHE.DAT
2019-07-09 21:10 - 2018-04-12 19:08 - 000000000 ____D C:\Program Files\Windows Defender Advanced Threat Protection
2019-07-09 21:10 - 2018-04-12 01:38 - 000000000 ____D C:\WINDOWS\TextInput
2019-07-09 21:10 - 2018-04-12 01:38 - 000000000 ____D C:\WINDOWS\SysWOW64\oobe
2019-07-09 21:10 - 2018-04-12 01:38 - 000000000 ____D C:\WINDOWS\SysWOW64\Dism
2019-07-09 21:10 - 2018-04-12 01:38 - 000000000 ____D C:\WINDOWS\system32\oobe
2019-07-09 21:10 - 2018-04-12 01:38 - 000000000 ____D C:\WINDOWS\system32\appraiser
2019-07-09 21:10 - 2018-04-12 01:38 - 000000000 ____D C:\WINDOWS\ShellComponents
2019-07-09 21:10 - 2018-04-12 01:38 - 000000000 ____D C:\WINDOWS\Provisioning
2019-07-09 21:10 - 2018-04-12 01:38 - 000000000 ____D C:\WINDOWS\bcastdvr
2019-07-09 21:10 - 2018-04-11 23:04 - 000000000 ____D C:\WINDOWS\system32\Dism
2019-07-09 19:24 - 2018-12-14 10:49 - 000000000 ____D C:\WINDOWS\system32\MRT
2019-07-09 19:21 - 2018-12-14 10:49 - 136618864 ____C (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2019-07-09 15:31 - 2018-12-14 18:56 - 000003380 _____ C:\WINDOWS\System32\Tasks\OneDrive Standalone Update Task-S-1-5-21-1960842775-2088100534-3542962694-1001
2019-07-09 15:31 - 2018-12-14 18:54 - 000002383 _____ C:\Users\**\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OneDrive.lnk
2019-07-09 15:31 - 2018-12-14 09:59 - 000000000 ___RD C:\Users\**\OneDrive
2019-07-02 16:55 - 2018-12-20 21:48 - 000000000 ____D C:\Users\**\Documents\materialy na vyuku

==================== SigCheck ===============================

(There is no automatic fix for files that do not pass verification.)

==================== End of FRST.txt ============================
         

--- --- ---

--- --- ---

--- --- ---

Schritt 1

• Kopiere den gesamten Inhalt der folgenden Code-Box:
  

  Start::
  CloseProcesses:
  C:\Users\Lubka\AppData\Roaming\lwmjhnysqrpp
  C:\Users\Jozko\AppData\Roaming\lwmjhnysqrpp
  EmptyTemp:
  End::
           

• Starte nun FRST und klicke direkt den Entfernen Button.Wichtig: Du brauchst den Inhalt der Code-Box nirgends einfügen, da sich FRST den Code aus der Zwischenablage holt!
• Das Tool führt die gewünschten Schritte aus und erstellt eine fixlog.txt im selben Verzeichnis, in dem sich FRST befindet.
• Gegebenenfalls muss dein Rechner neu gestartet werden.
• Poste mir den Inhalt der fixlog.txt mit deiner nächsten Antwort.

Schritt 2
Führe ESET Online Scanner gemäß der bebilderten Anleitung aus und poste abschließend die Logdatei.







Schritt 3

• Starte die FRST.exe erneut. Vergewissere dich, dass vor Addition.txt ein Haken gesetzt ist und drücke auf Untersuchen.
• FRST erstellt wieder zwei Logdateien (FRST.txt und Addition.txt).
• Poste mir beide Logdateien mit deiner nächsten Antwort.

Schritt 4

Wie läuft der Rechner aktuell? Gibt es noch irgendwelche Probleme bzw. Auffälligkeiten?

Bitte poste mit deiner nächsten Antwort

• die Logdatei des FRST-Fix (fixlog.txt)
• die Logdatei von ESET
• die beiden neuen Logdateien von FRST (FRST.txt und Addition.txt)
• die Beantwortung der gestellten Frage

Eset hat nur sehr kurze Resultat geliefert (unten)
auch wenn 31 Schädlinge gefunden

 16:44:01 # product=EOS
# version=8
# ESETOnlineScanner_DEU.exe=3.1.6.0
# country="Germany"
# lang=1031
16:44:56 # product=EOS
# version=8
# stats_enabled=0
         

Fix result of Farbar Recovery Scan Tool (x64) Version: 31-07-2019
Ran by Lubka (01-08-2019 16:41:06) Run:5
Running from C:\Users\Jozko\Desktop
Loaded Profiles: Lubka & Jozko (Available Profiles: Lubka & Jozko)
Boot Mode: Normal
==============================================

fixlist content:
*****************
CloseProcesses:
C:\Users\Lubka\AppData\Roaming\lwmjhnysqrpp
C:\Users\Jozko\AppData\Roaming\lwmjhnysqrpp
EmptyTemp:

*****************

Processes closed successfully.
"C:\Users\Lubka\AppData\Roaming\lwmjhnysqrpp" => not found
"C:\Users\Jozko\AppData\Roaming\lwmjhnysqrpp" => not found

=========== EmptyTemp: ==========

BITS transfer queue => 10510336 B
DOMStore, IE Recovery, AppCache, Feeds Cache, Thumbcache, IconCache => 0 B
Java, Flash, Steam htmlcache => 0 B
Windows/system/drivers => 11440 B
Edge => 0 B
Chrome => 0 B
Firefox => 0 B
Opera => 0 B

Temp, IE cache, history, cookies, recent:
Default => 0 B
Users => 0 B
ProgramData => 0 B
Public => 0 B
systemprofile => 0 B
systemprofile32 => 0 B
LocalService => 0 B
LocalService => 0 B
NetworkService => 1864 B
NetworkService => 0 B
Lubka => 7179 B
Jozko => 780175 B

RecycleBin => 0 B
EmptyTemp: => 10.8 MB temporary data Removed.

================================


The system needed a reboot.

==== End of Fixlog 16:41:09 ====
         

[CODE]Additional
FRST Logfile:

scan result of Farbar Recovery Scan Tool (x64) Version: 31-07-2019
Ran by Jozko (01-08-2019 18:10:21)
Running from C:\Users\Jozko\Desktop
Windows 10 Pro Version 1803 17134.885 (X64) (2018-12-14 16:56:48)
Boot Mode: Normal
==========================================================


==================== Accounts: =============================

Administrator (S-1-5-21-1960842775-2088100534-3542962694-500 - Administrator - Disabled)
DefaultAccount (S-1-5-21-1960842775-2088100534-3542962694-503 - Limited - Disabled)
Guest (S-1-5-21-1960842775-2088100534-3542962694-501 - Limited - Disabled)
Jozko (S-1-5-21-1960842775-2088100534-3542962694-1002 - Limited - Enabled) => C:\Users\Jozko
Lubka (S-1-5-21-1960842775-2088100534-3542962694-1001 - Administrator - Enabled) => C:\Users\Lubka
WDAGUtilityAccount (S-1-5-21-1960842775-2088100534-3542962694-504 - Limited - Disabled)

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

Adobe Acrobat Reader DC - Slovak (HKLM-x32\...\{AC76BA86-7AD7-1051-7B44-AC0F074E4100}) (Version: 19.012.20035 - Adobe Systems Incorporated)
Adobe Flash Player 32 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 32.0.0.223 - Adobe)
Age of Empires complete version 1.0c (HKLM-x32\...\{F7F0D70E-9027-4DF5-B67F-4B48CE29565A}_is1) (Version: 1.0c - vol1)
Balík softvéru eID (HKLM-x32\...\{69aff1f0-e530-4ac2-ab4f-88cb85aef940}) (Version: 1.0.0.0 - Ministerstvo vnútra Slovenskej republiky) Hidden
Balík softvéru eID (HKLM-x32\...\{d0db994b-7bbf-4a97-86ae-8e47ef7363e5}) (Version: 1.0.0.0 - Ministerstvo vnútra Slovenskej republiky) Hidden
Bit4id - miniLector (HKLM-x32\...\Bit4id - miniLector) (Version: 3.7 - Bit4id)
D.Launcher (x86) (HKLM-x32\...\{8A22CEA0-9DB7-4E30-898A-6D70F4E650CE}) (Version: 1.1.0.0 - DITEC, a.s.)
D.Signer/XAdES .NET so zásuvnými modulmi (x86) (HKLM-x32\...\{EB7D7F94-A539-4248-BCA3-2B105845284C}) (Version: 4.0.13 - DITEC, a.s.)
D.Signer/XAdES .NET Tools (x86) (HKLM-x32\...\{26E941A2-1EFF-4A3F-AD0B-6A423EFC2AAA}) (Version: 4.0.9 - DITEC, a.s.)
D.Suite/eIDAS (x86) (HKLM-x32\...\{f6fbc4ed-b1f8-4f4c-9b23-5b8e64af50b4}) (Version: 1.0.15 - DITEC, a.s.)
D.Viewer .NET (x86) (HKLM-x32\...\{967D2DE1-4E53-4700-9ED4-E4BCCD27E8F9}) (Version: 4.0.2025 - DITEC, a.s.)
Disig Web Signer 1.0.7 (HKLM-x32\...\{DD3FDF40-D8A3-454D-8A43-B53F90FB1ED7}) (Version: 1.1.8 - Disig)
DiskProtect18891 version 16.91 (HKLM-x32\...\{06B8AD54-D556-4771-A39B-A04135966F15}_is1) (Version: 16.91 - )
EAC MW klient (HKLM-x32\...\{3C1EB559-A939-4569-8EDE-006675312B46}) (Version: 3.1.3 - Ministerstvo vnútra Slovenskej republiky)
EPSON BX535WD Series Printer Uninstall (HKLM\...\EPSON BX535WD Series) (Version:  - SEIKO EPSON Corporation)
EPSON Scan (HKLM-x32\...\EPSON Scanner) (Version:  - Seiko Epson Corporation)
EpsonNet Print (HKLM-x32\...\{3E31400D-274E-4647-916C-2CACC3741799}) (Version: 2.6.0 - SEIKO EPSON CORPORATION)
GemPcCCID (HKLM\...\{39417D48-AC92-47A7-9F53-3CA2049231B0}) (Version: 2.0.7 - Gemalto)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 75.0.3770.142 - Google LLC)
Google Earth Pro (HKLM\...\{70A0F34E-564B-4F93-ADD6-3BAEC6E44075}) (Version: 7.3.2.5776 - Google)
Google Update Helper (HKLM-x32\...\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}) (Version: 1.3.34.11 - Google LLC) Hidden
HiPlayer (HKU\S-1-5-21-1960842775-2088100534-3542962694-1002\...\{1AE35ED9-955E-40D0-8811-FFD8F0E2A9F3}) (Version: 1.2 - Hi)
Intel Driver && Support Assistant (HKLM-x32\...\{CF18558A-3642-4C4D-A551-23275D1FCE16}) (Version: 19.7.30.2 - Intel) Hidden
Intel(R) Computing Improvement Program (HKLM\...\{D40D4164-EEDB-4F0F-85C6-2058A9E34CC7}) (Version: 2.4.04370 - Intel Corporation)
Intel(R) Management Engine Components (HKLM\...\{1CEAC85D-2590-4760-800F-8DE5E91F3700}) (Version: 1831.12.0.1156 - Intel Corporation)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 24.20.100.6291 - Intel Corporation)
Intel(R) Trusted Connect Service Client x86 (HKLM-x32\...\{C9552825-7BF2-4344-BA91-D3CD46F4C441}) (Version: 1.50.369.0 - Intel Corporation) Hidden
Intel(R) Trusted Connect Services Client (HKLM-x32\...\{aa81bdf2-96a6-4400-a596-c7d1916ce9f7}) (Version: 1.50.369.0 - Intel Corporation) Hidden
Intel® Chipset Device Software (HKLM-x32\...\{262e9c1d-e509-4e2a-86e8-0abb312ac2e9}) (Version: 10.1.17765.8094 - Intel(R) Corporation) Hidden
Intel® Driver & Support Assistant (HKLM-x32\...\{12d2d1d9-5223-431d-96ac-6a82d3a1391c}) (Version: 19.7.30.2 - Intel)
Intel® Driver & Support Assistant (HKLM-x32\...\{dbe96554-7594-4bba-b7c5-fc6c72dbaa39}) (Version: 19.6.26.3 - Intel)
IP Camera (HKU\S-1-5-21-1960842775-2088100534-3542962694-1002\...\{3E6DEA84-3FA0-472E-B0DB-927655097022}) (Version: 2.0.4.6 - hi)
Java 8 Update 211 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F64180211F0}) (Version: 8.0.2110.12 - Oracle Corporation)
K-Lite Mega Codec Pack 14.5.5 (HKLM-x32\...\KLiteCodecPack_is1) (Version: 14.5.5 - KLCP)
Malwarebytes Version 3.8.3.2965 (HKLM\...\{35065F43-4BB2-439A-BFF7-0F1014F2E0CD}_is1) (Version: 3.8.3.2965 - Malwarebytes)
Microsoft Office 2016 Professional Plus (HKLM-x32\...\Office16.PROPLUS) (Version: 16.0.4266.1001 - Microsoft Corporation)
Microsoft OneDrive (HKU\S-1-5-21-1960842775-2088100534-3542962694-1002\...\OneDriveSetup.exe) (Version: 19.103.0527.0003 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.30319 (HKLM\...\{DA5E371C-6333-3D8A-93A4-6FD5B20BCC6E}) (Version: 10.0.30319 - Microsoft Corporation)
Microsoft Visual C++ 2015 Redistributable (x64) - 14.0.23026 (HKLM-x32\...\{e46eca4f-393b-40df-9f49-076faf788d83}) (Version: 14.0.23026.0 - Microsoft Corporation)
Microsoft Visual C++ 2015 Redistributable (x86) - 14.0.23026 (HKLM-x32\...\{74d0e5db-b326-4dae-a6b2-445b9de1836e}) (Version: 14.0.23026.0 - Microsoft Corporation)
Mozilla Firefox 68.0.1 (x64 de) (HKLM\...\Mozilla Firefox 68.0.1 (x64 de)) (Version: 68.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 64.0 - Mozilla)
Nástroje kontroly pravopisu pro Microsoft Office 2016 – čeština (HKLM-x32\...\{90160000-001F-0405-0000-0000000FF1CE}) (Version: 16.0.4266.1001 - Microsoft Corporation) Hidden
Nástroje korektúry balíka Microsoft Office 2016 - slovenčina (HKLM-x32\...\{90160000-001F-041B-0000-0000000FF1CE}) (Version: 16.0.4266.1001 - Microsoft Corporation) Hidden
OLYMPUS CAMEDIA Master 4.1 (HKLM-x32\...\{30BB4D60-81DB-11D5-BB77-00400536ABAC}) (Version:  - )
QuickTime (HKLM-x32\...\QuickTime) (Version:  - )
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 10.31.828.2018 - Realtek)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.8581 - Realtek Semiconductor Corp.)
SPORE Collection (HKLM-x32\...\SPORE Collection_is1) (Version:  - )
SSC Service Utility v4.30 (HKLM-x32\...\SSC Service Utility_is1) (Version:  - SSC Localization Group)
Steam (HKLM-x32\...\Steam) (Version: 2.10.91.91 - Valve Corporation)
TAP-Windows 9.21.2 (HKLM\...\TAP-Windows) (Version: 9.21.2 - )
TextPad (HKLM-x32\...\{ADBBED4F-720B-460D-AA14-D85EBC4AEF97}) (Version:  - )
Update for Windows 10 for x64-based Systems (KB4023057) (HKLM\...\{F14FB68A-9188-4036-AD0D-D054BC9C9291}) (Version: 2.59.0.0 - Microsoft Corporation)
UpdateAssistant (HKLM\...\{EC4F72E8-52FE-454E-B70F-DBE5C0FA44C5}) (Version: 1.20.0.0 - Microsoft Corporation) Hidden
web control version 3.0.6.7 (HKLM-x32\...\{F88ED86C-0010-4943-BA16-72E4184E31ED}_is1) (Version: 3.0.6.7 - )
WinRAR 5.71 (32-bit) (HKLM-x32\...\WinRAR archiver) (Version: 5.71.0 - win.rar GmbH)

Packages:
=========
Candy Crush Saga -> C:\Program Files\WindowsApps\king.com.CandyCrushSaga_1.1550.4.0_x86__kgqvnymyfvs32 [0000-00-00] (king.com)
Community Showcase Rural Landscapes 2 -> C:\Program Files\WindowsApps\Microsoft.CommunityShowcaseRuralLandscapes2_1.0.0.0_neutral__8wekyb3d8bbwe [0000-00-00] (Microsoft Corporation)
Dolby Access -> C:\Program Files\WindowsApps\DolbyLaboratories.DolbyAccess_2.4.520.0_x64__rz1tebttyb220 [0000-00-00] (Dolby Laboratories)
Fitbit Coach -> C:\Program Files\WindowsApps\Fitbit.FitbitCoach_4.4.133.0_x64__6mqt6hf9g46tw [0000-00-00] (Fitbit)
Mail und Kalender -> C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe [0000-00-00] (Microsoft Corporation) [MS Ad]
Microsoft Advertising SDK for XAML -> C:\Program Files\WindowsApps\Microsoft.Advertising.Xaml_10.1811.1.0_x64__8wekyb3d8bbwe [0000-00-00] (Microsoft Corporation) [MS Ad]
Microsoft Advertising SDK for XAML -> C:\Program Files\WindowsApps\Microsoft.Advertising.Xaml_10.1811.1.0_x86__8wekyb3d8bbwe [0000-00-00] (Microsoft Corporation) [MS Ad]
Microsoft Begleiter für Telefon -> C:\Program Files\WindowsApps\Microsoft.WindowsPhone_10.1802.311.0_x64__8wekyb3d8bbwe [0000-00-00] (Microsoft Corporation)
Microsoft News – Nachrichten -> C:\Program Files\WindowsApps\Microsoft.BingNews_4.31.11905.0_x64__8wekyb3d8bbwe [0000-00-00] (Microsoft Corporation) [MS Ad]
Microsoft Solitaire Collection -> C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.6132.0_x64__8wekyb3d8bbwe [0000-00-00] (Microsoft Studios) [MS Ad]
Microsoft-Telefon -> C:\Program Files\WindowsApps\Microsoft.CommsPhone_3.43.20002.1000_x64__8wekyb3d8bbwe [0000-00-00] (Microsoft Corporation)
MSN Finanzen -> C:\Program Files\WindowsApps\Microsoft.BingFinance_4.31.11905.0_x64__8wekyb3d8bbwe [0000-00-00] (Microsoft Corporation) [MS Ad]
MSN Sport -> C:\Program Files\WindowsApps\Microsoft.BingSports_4.31.11905.0_x64__8wekyb3d8bbwe [0000-00-00] (Microsoft Corporation) [MS Ad]
MSN Wetter -> C:\Program Files\WindowsApps\Microsoft.BingWeather_4.31.11905.0_x64__8wekyb3d8bbwe [0000-00-00] (Microsoft Corporation) [MS Ad]
Netflix -> C:\Program Files\WindowsApps\4DF9E0F8.Netflix_6.93.478.0_x64__mcm4njqhnhss8 [0000-00-00] (Netflix, Inc.)
Phototastic Collage -> C:\Program Files\WindowsApps\ThumbmunkeysLtd.PhototasticCollage_2.2.9.0_x64__nfy108tqq3p12 [0000-00-00] (Thumbmunkeys Ltd) [MS Ad]

==================== Custom CLSID (Whitelisted): ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

ContextMenuHandlers1: [7-Zip] -> {23170F69-40C1-278A-1000-000100020000} =>  -> No File
ContextMenuHandlers1: [ANotepad++64] -> {B298D29A-A6ED-11DE-BA8C-A68E55D89593} =>  -> No File
ContextMenuHandlers1: [BriefcaseMenu] -> {85BBD920-42A0-1069-A2E4-08002B30309D} =>  -> No File
ContextMenuHandlers1-x32: [TextPad] -> {2F25CF20-C569-11D1-B94C-00608CB45480} => C:\Program Files (x86)\TextPad 4\System\shellext.dll [2001-07-21] (Helios Software Solutions) [File not signed]
ContextMenuHandlers1: [WinRAR] -> {B41DB860-64E4-11D2-9906-E49FADC173CA} => C:\Program Files (x86)\WinRAR\rarext64.dll [2019-04-27] (win.rar GmbH -> Alexander Roshal)
ContextMenuHandlers1-x32: [WinRAR32] -> {B41DB860-8EE4-11D2-9906-E49FADC173CA} => C:\Program Files (x86)\WinRAR\rarext.dll [2019-04-27] (win.rar GmbH -> Alexander Roshal)
ContextMenuHandlers3: [MBAMShlExt] -> {57CE581A-0CB6-4266-9CA0-19364C90A0B3} => C:\Program Files\Malwarebytes\Anti-Malware\mbshlext.dll [2019-06-26] (Malwarebytes Corporation -> Malwarebytes)
ContextMenuHandlers3: [{4A7C4306-57E0-4C0C-83A9-78C1528F618C}] -> {4A7C4306-57E0-4C0C-83A9-78C1528F618C} =>  -> No File
ContextMenuHandlers4: [7-Zip] -> {23170F69-40C1-278A-1000-000100020000} =>  -> No File
ContextMenuHandlers5: [igfxcui] -> {3AB1675A-CCFF-11D2-8B20-00A0C93CB1F4} =>  -> No File
ContextMenuHandlers5: [igfxDTCM] -> {9B5F5829-A529-4B12-814A-E81BCB8D93FC} => C:\WINDOWS\System32\DriverStore\FileRepository\cui_dc_comp.inf_amd64_1c77f1231c19bc72\igfxDTCM.dll [2018-11-02] (Microsoft Windows Hardware Compatibility Publisher -> Intel Corporation)
ContextMenuHandlers6: [BriefcaseMenu] -> {85BBD920-42A0-1069-A2E4-08002B30309D} =>  -> No File
ContextMenuHandlers6: [MBAMShlExt] -> {57CE581A-0CB6-4266-9CA0-19364C90A0B3} => C:\Program Files\Malwarebytes\Anti-Malware\mbshlext.dll [2019-06-26] (Malwarebytes Corporation -> Malwarebytes)
ContextMenuHandlers6: [WinRAR] -> {B41DB860-64E4-11D2-9906-E49FADC173CA} => C:\Program Files (x86)\WinRAR\rarext64.dll [2019-04-27] (win.rar GmbH -> Alexander Roshal)
ContextMenuHandlers6-x32: [WinRAR32] -> {B41DB860-8EE4-11D2-9906-E49FADC173CA} => C:\Program Files (x86)\WinRAR\rarext.dll [2019-04-27] (win.rar GmbH -> Alexander Roshal)

==================== Shortcuts & WMI ========================

(The entries could be listed to be restored or removed.)


Shortcut: C:\Users\Public\Desktop\Age of Empires - The Rise of Rome color fix.lnk -> C:\Program Files (x86)\Age of Empires complete\EMPIRESX.bat ()
Shortcut: C:\Users\Public\Desktop\Age of Empires color fix.lnk -> C:\Program Files (x86)\Age of Empires complete\Empires.bat ()

==================== Loaded Modules (Whitelisted) ==============


==================== Alternate Data Streams (Whitelisted) =========

(If an entry is included in the fixlist, only the ADS will be removed.)


==================== Safe Mode (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MBAMService => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MBAMService => ""="Service"

==================== Association (Whitelisted) ===============

(If an entry is included in the fixlist, the registry item will be restored to default or removed.)


==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, it will be removed from the registry.)


==================== Hosts content: ===============================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2015-10-30 09:24 - 2019-07-31 22:38 - 000000027 _____ C:\WINDOWS\system32\drivers\etc\hosts

127.0.0.1       localhost

==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKLM\System\CurrentControlSet\Control\Session Manager\Environment\\Path -> C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\iCLS\;C:\Program Files\Intel\Intel(R) Management Engine Components\iCLS\;%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem;%SYSTEMROOT%\System32\WindowsPowerShell\v1.0\;C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL;C:\Program Files\Intel\Intel(R) Management Engine Components\DAL;%SYSTEMROOT%\System32\OpenSSH\;C:\Program Files (x86)\EAC MW klient\
HKU\S-1-5-21-1960842775-2088100534-3542962694-1002\Control Panel\Desktop\\Wallpaper -> C:\Users\Jozko\Pictures\Saved Pictures\19713_en_1.jfif
DNS Servers: 192.168.1.1 - 195.146.128.62
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer => (SmartScreenEnabled: RequireAdmin)
Windows Firewall is enabled.

==================== MSCONFIG/TASK MANAGER disabled items ==

If an entry is included in the fixlist, it will be removed.


==================== FirewallRules (Whitelisted) ===============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== Restore Points =========================

ATTENTION: System Restore is disabled (Total:223.08 GB) (Free:105.05 GB) (47%)
Check "winmgmt" service or repair WMI.


==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (08/01/2019 04:41:52 PM) (Source: dLauncherLoopback) (EventID: 0) (User: )
Description: Event-ID 0

Error: (08/01/2019 04:39:46 PM) (Source: dLauncherLoopback) (EventID: 0) (User: )
Description: Event-ID 0

Error: (08/01/2019 01:41:00 PM) (Source: dLauncherLoopback) (EventID: 0) (User: )
Description: Event-ID 0

Error: (08/01/2019 01:38:40 PM) (Source: dLauncherLoopback) (EventID: 0) (User: )
Description: Event-ID 0

Error: (08/01/2019 01:36:11 PM) (Source: dLauncherLoopback) (EventID: 0) (User: )
Description: Event-ID 0

Error: (07/31/2019 10:48:02 PM) (Source: dLauncherLoopback) (EventID: 0) (User: )
Description: Event-ID 0

Error: (07/31/2019 10:39:40 PM) (Source: dLauncherLoopback) (EventID: 0) (User: )
Description: Event-ID 0

Error: (07/31/2019 10:37:08 PM) (Source: dLauncherLoopback) (EventID: 0) (User: )
Description: Event-ID 0


System errors:
=============
Error: (08/01/2019 06:08:49 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "eapihdrv" wurde aufgrund folgenden Fehlers nicht gestartet: 
Der Treiber konnte nicht geladen werden.

Error: (08/01/2019 06:08:49 PM) (Source: Application Popup) (EventID: 1060) (User: )
Description: \??\C:\Users\Lubka\AppData\Local\Temp\ehdrv.sys

Error: (08/01/2019 06:08:49 PM) (Source: Application Popup) (EventID: 1060) (User: )
Description: \??\C:\Users\Lubka\AppData\Local\Temp\ehdrv.sys

Error: (08/01/2019 06:08:49 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "eapihdrv" wurde aufgrund folgenden Fehlers nicht gestartet: 
Der Treiber konnte nicht geladen werden.

Error: (08/01/2019 06:08:49 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "eapihdrv" wurde aufgrund folgenden Fehlers nicht gestartet: 
Der Treiber konnte nicht geladen werden.

Error: (08/01/2019 06:08:49 PM) (Source: Application Popup) (EventID: 1060) (User: )
Description: \??\C:\Users\Lubka\AppData\Local\Temp\ehdrv.sys

Error: (08/01/2019 06:08:49 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "eapihdrv" wurde aufgrund folgenden Fehlers nicht gestartet: 
Der Treiber konnte nicht geladen werden.

Error: (08/01/2019 06:08:49 PM) (Source: Application Popup) (EventID: 1060) (User: )
Description: \??\C:\Users\Lubka\AppData\Local\Temp\ehdrv.sys


Windows Defender:
===================================
Date: 2019-08-01 17:25:39.688
Description: 
Die Windows Defender Antivirus-Überprüfung wurde vor ihrem Abschluss beendet.
Überprüfungs-ID: {DFF5225B-29C4-43EA-80B3-092CCF6C502F}
Überprüfungstyp: Antimalware
Überprüfungsparameter: Schnellüberprüfung
Benutzer: NT AUTHORITY\SYSTEM

Date: 2019-08-01 17:15:43.350
Description: 
Die Windows Defender Antivirus-Überprüfung wurde vor ihrem Abschluss beendet.
Überprüfungs-ID: {1A731123-6AD7-434B-A31C-E228B84BFA17}
Überprüfungstyp: Antimalware
Überprüfungsparameter: Schnellüberprüfung
Benutzer: NT AUTHORITY\SYSTEM

Date: 2019-08-01 17:00:13.718
Description: 
Die Windows Defender Antivirus-Überprüfung wurde vor ihrem Abschluss beendet.
Überprüfungs-ID: {83BC08A2-D642-4535-8DF8-A3473BDCE83C}
Überprüfungstyp: Antimalware
Überprüfungsparameter: Schnellüberprüfung
Benutzer: NT AUTHORITY\SYSTEM

Date: 2019-07-27 14:11:19.123
Description: 
Die Windows Defender Antivirus-Überprüfung wurde vor ihrem Abschluss beendet.
Überprüfungs-ID: {F19C5FF9-CAEE-4B95-AF27-48D5428A0778}
Überprüfungstyp: Antimalware
Überprüfungsparameter: Vollständige Überprüfung
Benutzer: DESKTOP-3CK4O4E\Lubka

Date: 2019-07-27 12:24:43.833
Description: 
Die Windows Defender Antivirus-Überprüfung wurde vor ihrem Abschluss beendet.
Überprüfungs-ID: {82B744AF-4B5B-4340-A46C-B31EB143D3E7}
Überprüfungstyp: Antimalware
Überprüfungsparameter: Schnellüberprüfung
Benutzer: NT AUTHORITY\SYSTEM

Date: 2019-07-31 20:37:02.389
Description: 
Fehler von Windows Defender Antivirus beim Aktualisieren von Signaturen.
Neue Signaturversion: 
Vorherige Signaturversion: 1.299.631.0
Updatequelle: Microsoft Center zum Schutz vor Schadsoftware
Signaturtyp: AntiVirus
Updatetyp: Voll
Benutzer: NT AUTHORITY\NETWORK SERVICE
Aktuelle Modulversion: 
Vorherige Modulversion: 1.1.16200.1
Fehlercode: 0x80072ee7
Fehlerbeschreibung: The server name or address could not be resolved 

Date: 2019-07-31 20:37:02.389
Description: 
Fehler von Windows Defender Antivirus beim Aktualisieren von Signaturen.
Neue Signaturversion: 
Vorherige Signaturversion: 1.299.631.0
Updatequelle: Microsoft Center zum Schutz vor Schadsoftware
Signaturtyp: AntiSpyware
Updatetyp: Voll
Benutzer: NT AUTHORITY\NETWORK SERVICE
Aktuelle Modulversion: 
Vorherige Modulversion: 1.1.16200.1
Fehlercode: 0x80072ee7
Fehlerbeschreibung: The server name or address could not be resolved 

Date: 2019-07-31 20:37:02.389
Description: 
Fehler von Windows Defender Antivirus beim Aktualisieren von Signaturen.
Neue Signaturversion: 
Vorherige Signaturversion: 1.299.631.0
Updatequelle: Microsoft Center zum Schutz vor Schadsoftware
Signaturtyp: AntiVirus
Updatetyp: Voll
Benutzer: NT AUTHORITY\NETWORK SERVICE
Aktuelle Modulversion: 
Vorherige Modulversion: 1.1.16200.1
Fehlercode: 0x80072ee7
Fehlerbeschreibung: The server name or address could not be resolved 

Date: 2019-07-31 20:37:02.375
Description: 
Fehler von Windows Defender Antivirus beim Aktualisieren von Signaturen.
Neue Signaturversion: 
Vorherige Signaturversion: 1.299.631.0
Updatequelle: Microsoft Center zum Schutz vor Schadsoftware
Signaturtyp: AntiVirus
Updatetyp: Voll
Benutzer: NT AUTHORITY\NETWORK SERVICE
Aktuelle Modulversion: 
Vorherige Modulversion: 1.1.16200.1
Fehlercode: 0x80072ee7
Fehlerbeschreibung: The server name or address could not be resolved 

Date: 2019-07-31 20:37:02.375
Description: 
Fehler von Windows Defender Antivirus beim Aktualisieren von Signaturen.
Neue Signaturversion: 
Vorherige Signaturversion: 1.299.631.0
Updatequelle: Microsoft Center zum Schutz vor Schadsoftware
Signaturtyp: AntiSpyware
Updatetyp: Voll
Benutzer: NT AUTHORITY\NETWORK SERVICE
Aktuelle Modulversion: 
Vorherige Modulversion: 1.1.16200.1
Fehlercode: 0x80072ee7
Fehlerbeschreibung: The server name or address could not be resolved 

==================== Memory info =========================== 

BIOS: American Megatrends Inc. 1.60 10/10/2018
Motherboard: Micro-Star International Co., Ltd. H310M PRO-VD (MS-7B33)
Processor: Intel(R) Core(TM) i3-8300 CPU @ 3.70GHz
Percentage of memory in use: 76%
Total physical RAM: 3962.59 MB
Available physical RAM: 948.18 MB
Total Virtual: 14714.59 MB
Available Virtual: 11387.95 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:223.08 GB) (Free:105.05 GB) NTFS
Drive d: () (Fixed) (Total:1863.01 GB) (Free:1638.77 GB) NTFS

\\?\Volume{b9e8df67-0000-0000-0000-100000000000}\ (Vyhradené systémom) (Fixed) (Total:0.49 GB) (Free:0.1 GB) NTFS

==================== MBR & Partition Table ==================

==================== End of Addition.txt ============================
         

--- --- ---


FRST Logfile:

FRST Logfile:

FRST Logfile:

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 31-07-2019
Ran by Jozko (ATTENTION: The user is not administrator) on DESKTOP-3CK4O4E (Micro-Star International Co., Ltd. MS-7B33) (01-08-2019 18:09:17)
Running from C:\Users\Jozko\Desktop
Loaded Profiles: Lubka & Jozko (Available Profiles: Lubka & Jozko)
Platform: Windows 10 Pro Version 1803 17134.885 (X64) Language: Slowakisch (Slowakei)
Default browser: FF
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

() [File not signed] C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19031.11411.0_x64__8wekyb3d8bbwe\Video.UI.exe
(Disig a.s. -> Disig a.s.) C:\Program Files (x86)\Disig\Disig Web Signer 1.0.7\Updater\WebSignerTray.exe
(ESET, spol. s r.o. -> ESET spol. s r.o.) C:\Users\Jozko\Desktop\ESETOnlineScanner_DEU.exe
(IDSA Production signing key -> Intel) C:\Program Files (x86)\Intel\Driver and Support Assistant\DSATray.exe
(Intel(R) pGFX -> Intel Corporation) C:\Windows\System32\DriverStore\FileRepository\cui_dc_comp.inf_amd64_1c77f1231c19bc72\igfxEM.exe
(Malwarebytes Corporation -> Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe
(Microsoft Corporation -> Microsoft Corporation) C:\Users\Jozko\AppData\Local\Microsoft\OneDrive\OneDrive.exe
(Microsoft Corporation) [File not signed] C:\Program Files\WindowsApps\Microsoft.WindowsStore_11905.1001.4.0_x64__8wekyb3d8bbwe\WinStore.App.exe
(Microsoft Windows -> Microsoft Corporation) C:\Program Files\Windows Defender\MSASCuiL.exe
(Microsoft Windows -> Microsoft Corporation) C:\Windows\ImmersiveControlPanel\SystemSettings.exe
(Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\smartscreen.exe
(Mozilla Corporation -> Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Mozilla Corporation -> Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Mozilla Corporation -> Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Mozilla Corporation -> Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Mozilla Corporation -> Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Oracle America, Inc. -> Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe
(Oracle America, Inc. -> Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(SEIKO EPSON Corporation -> SEIKO EPSON CORPORATION) C:\Windows\System32\spool\drivers\x64\3\E_YATIHTU.EXE
Failed to access process -> armsvc.exe
Failed to access process -> csrss.exe
Failed to access process -> csrss.exe
Failed to access process -> dasHost.exe
Failed to access process -> dllhost.exe
Failed to access process -> DSAService.exe
Failed to access process -> DSAUpdateService.exe
Failed to access process -> dwm.exe
Failed to access process -> fontdrvhost.exe
Failed to access process -> fontdrvhost.exe
Failed to access process -> GoogleCrashHandler.exe
Failed to access process -> GoogleCrashHandler64.exe
Failed to access process -> igfxCUIService.exe
Failed to access process -> IntelCpHDCPSvc.exe
Failed to access process -> IntelCpHeciSvc.exe
Failed to access process -> jhi_service.exe
Failed to access process -> LMS.exe
Failed to access process -> lsass.exe
Failed to access process -> MBAMService.exe
Failed to access process -> MsMpEng.exe
Failed to access process -> NisSrv.exe
Failed to access process -> PresentationFontCache.exe
Failed to access process -> SearchFilterHost.exe
Failed to access process -> SearchIndexer.exe
Failed to access process -> SearchProtocolHost.exe
Failed to access process -> SecurityHealthService.exe
Failed to access process -> sedsvc.exe
Failed to access process -> services.exe
Failed to access process -> SgrmBroker.exe
Failed to access process -> smss.exe
Failed to access process -> spoolsv.exe
Failed to access process -> SurSvc.exe
Failed to access process -> svchost.exe
Failed to access process -> svchost.exe
Failed to access process -> svchost.exe
Failed to access process -> svchost.exe
Failed to access process -> svchost.exe
Failed to access process -> svchost.exe
Failed to access process -> svchost.exe
Failed to access process -> svchost.exe
Failed to access process -> svchost.exe
Failed to access process -> svchost.exe
Failed to access process -> svchost.exe
Failed to access process -> svchost.exe
Failed to access process -> svchost.exe
Failed to access process -> svchost.exe
Failed to access process -> svchost.exe
Failed to access process -> svchost.exe
Failed to access process -> svchost.exe
Failed to access process -> svchost.exe
Failed to access process -> svchost.exe
Failed to access process -> svchost.exe
Failed to access process -> svchost.exe
Failed to access process -> svchost.exe
Failed to access process -> svchost.exe
Failed to access process -> svchost.exe
Failed to access process -> svchost.exe
Failed to access process -> svchost.exe
Failed to access process -> svchost.exe
Failed to access process -> svchost.exe
Failed to access process -> svchost.exe
Failed to access process -> svchost.exe
Failed to access process -> svchost.exe
Failed to access process -> svchost.exe
Failed to access process -> svchost.exe
Failed to access process -> svchost.exe
Failed to access process -> svchost.exe
Failed to access process -> svchost.exe
Failed to access process -> svchost.exe
Failed to access process -> svchost.exe
Failed to access process -> svchost.exe
Failed to access process -> svchost.exe
Failed to access process -> svchost.exe
Failed to access process -> svchost.exe
Failed to access process -> svchost.exe
Failed to access process -> svchost.exe
Failed to access process -> svchost.exe
Failed to access process -> svchost.exe
Failed to access process -> svchost.exe
Failed to access process -> svchost.exe
Failed to access process -> svchost.exe
Failed to access process -> svchost.exe
Failed to access process -> svchost.exe
Failed to access process -> svchost.exe
Failed to access process -> svchost.exe
Failed to access process -> svchost.exe
Failed to access process -> svchost.exe
Failed to access process -> svchost.exe
Failed to access process -> svchost.exe
Failed to access process -> svchost.exe
Failed to access process -> svchost.exe
Failed to access process -> svchost.exe
Failed to access process -> svchost.exe
Failed to access process -> wininit.exe
Failed to access process -> winlogon.exe
Failed to access process -> WmiPrvSE.exe
Failed to access process -> WmiPrvSE.exe

==================== Registry (Whitelisted) ===========================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [SecurityHealth] => C:\Program Files\Windows Defender\MSASCuiL.exe [638872 2018-04-12] (Microsoft Windows -> Microsoft Corporation)
HKLM\...\Run: [RTHDVCPL] => "C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe" -s
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [645456 2019-04-01] (Oracle America, Inc. -> Oracle Corporation)
HKLM\...\RunOnce: [*EmptyTemp] => cmd /c rd /q/s C:\FRST\Temp
HKU\S-1-5-21-1960842775-2088100534-3542962694-1002\...\Run: [EPLTarget\P0000000000000000] => C:\WINDOWS\system32\spool\DRIVERS\x64\3\E_YATIHTU.EXE [241280 2012-07-12] (SEIKO EPSON Corporation -> SEIKO EPSON CORPORATION)
HKU\S-1-5-21-1960842775-2088100534-3542962694-1002\...\MountPoints2: {08af5bcb-313c-11e9-94ec-309c23d44e07} - "F:\HiSuiteDownLoader.exe" 
HKU\S-1-5-21-1960842775-2088100534-3542962694-1002\...\MountPoints2: {e8fcf302-ff74-11e8-94da-806e6f6e6963} - "E:\Setup.exe" 
HKLM\...\Drivers32: [VIDC.X264] => C:\WINDOWS\system32\x264vfw64.dll [3799552 2017-07-30] (x264vfw project) [File not signed]
HKLM\...\Drivers32: [VIDC.LAGS] => C:\WINDOWS\system32\lagarith.dll [148992 2011-12-07] ( ) [File not signed]
HKLM\...\Drivers32: [VIDC.XVID] => C:\WINDOWS\system32\xvidvfw.dll [311296 2018-01-28] () [File not signed]
HKLM\...\Drivers32: [msacm.ac3acm] => C:\WINDOWS\system32\ac3acm.acm [180736 2012-07-21] (fccHandler) [File not signed]
HKLM\...\Drivers32: [VIDC.X264] => C:\Windows\SysWOW64\x264vfw.dll [3850240 2017-07-30] (x264vfw project) [File not signed]
HKLM\...\Drivers32: [VIDC.LAGS] => C:\Windows\SysWOW64\lagarith.dll [216064 2011-12-07] ( ) [File not signed]
HKLM\...\Drivers32: [VIDC.XVID] => C:\Windows\SysWOW64\xvidvfw.dll [284672 2018-01-28] () [File not signed]
HKLM\...\Drivers32: [VIDC.FFDS] => C:\Windows\SysWOW64\ff_vfw.dll [112128 2015-10-24] () [File not signed]
HKLM\...\Drivers32: [msacm.ac3acm] => C:\Windows\SysWOW64\ac3acm.acm [122880 2012-07-21] (fccHandler) [File not signed]
HKLM\Software\Microsoft\Active Setup\Installed Components: [{8A69D345-D564-463c-AFF1-A69D9E530F96}] -> C:\Program Files (x86)\Google\Chrome\Application\75.0.3770.142\Installer\chrmstp.exe [2019-07-17] (Google LLC -> Google LLC)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Web Signer.lnk [2019-03-14]
ShortcutTarget: Web Signer.lnk -> C:\Program Files (x86)\Disig\Disig Web Signer 1.0.7\Updater\WebSignerTray.exe (Disig a.s. -> Disig a.s.)
BootExecute: autocheck autochk * sdnclean64.exe

==================== Scheduled Tasks (Whitelisted) =============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)


==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Tcpip\Parameters: [DhcpNameServer] 192.168.1.1 195.146.128.62
Tcpip\..\Interfaces\{da384fb4-1e59-48fc-bfe0-c27ce005f778}: [DhcpNameServer] 192.168.1.1 195.146.128.62

Internet Explorer:
==================
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxps://go.microsoft.com/fwlink/p/?LinkId=255141
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxps://go.microsoft.com/fwlink/p/?LinkId=255141
HKU\S-1-5-21-1960842775-2088100534-3542962694-1002\Software\Microsoft\Internet Explorer\Main,Start Page = hxxps://go.microsoft.com/fwlink/p/?LinkId=619797&pc=UE03&ocid=UE03DHP
URLSearchHook: [S-1-5-21-1960842775-2088100534-3542962694-1001] ATTENTION => Default URLSearchHook is missing
SearchScopes: HKU\S-1-5-21-1960842775-2088100534-3542962694-1002 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxps://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IESR02&pc=UE04
SearchScopes: HKU\S-1-5-21-1960842775-2088100534-3542962694-1002 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxps://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IESR02&pc=UE04
BHO: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office\Office16\OCHelper.dll [2015-07-31] (Microsoft Corporation -> Microsoft Corporation)
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_211\bin\ssv.dll [2019-05-24] (Oracle America, Inc. -> Oracle Corporation)
BHO: Microsoft OneDrive for Business Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office\Office16\GROOVEEX.DLL [2015-07-31] (Microsoft Corporation -> Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_211\bin\jp2ssv.dll [2019-05-24] (Oracle America, Inc. -> Oracle Corporation)
BHO-x32: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files (x86)\Microsoft Office\Office16\OCHelper.dll [2015-07-31] (Microsoft Corporation -> Microsoft Corporation)
BHO-x32: Microsoft OneDrive for Business Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files (x86)\Microsoft Office\Office16\GROOVEEX.DLL [2015-07-31] (Microsoft Corporation -> Microsoft Corporation)
Handler-x32: mso-minsb.16 - {3459B272-CC19-4448-86C9-DDC3B4B2FAD3} - C:\Program Files (x86)\Microsoft Office\Office16\MSOSB.DLL [2015-07-31] (Microsoft Corporation -> Microsoft Corporation)
Handler-x32: osf.16 - {5504BE45-A83B-4808-900A-3A5C36E7F77A} - C:\Program Files (x86)\Microsoft Office\Office16\MSOSB.DLL [2015-07-31] (Microsoft Corporation -> Microsoft Corporation)

FireFox:
========
FF DefaultProfile: ffufpq0y.default-1564605814320
FF ProfilePath: C:\Users\Jozko\AppData\Roaming\Mozilla\Firefox\Profiles\ffufpq0y.default-1564605814320 [2019-08-01]
FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF64_32_0_0_223.dll [2019-07-13] (Adobe Inc. -> )
FF Plugin: @java.com/DTPlugin,version=11.211.2 -> C:\Program Files\Java\jre1.8.0_211\bin\dtplugin\npDeployJava1.dll [2019-05-24] (Oracle America, Inc. -> Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=11.211.2 -> C:\Program Files\Java\jre1.8.0_211\bin\plugin2\npjp2.dll [2019-05-24] (Oracle America, Inc. -> Oracle Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_32_0_0_223.dll [2019-07-13] (Adobe Inc. -> )
FF Plugin-x32: @google.com/zxwebplugin -> C:\WINDOWS\system32\npzxwebplugin.dll [No File]
FF Plugin-x32: @microsoft.com/Lync,version=15.0 -> C:\Program Files (x86)\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll [2015-07-31] (Microsoft Corporation -> Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office16\NPSPWRAP.DLL [2015-07-31] (Microsoft Corporation -> Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.34.11\npGoogleUpdate3.dll [2019-05-15] (Google Inc -> Google LLC)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.34.11\npGoogleUpdate3.dll [2019-05-15] (Google Inc -> Google LLC)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2019-05-03] (Adobe Inc. -> Adobe Systems Inc.)
FF Plugin-x32: ditec.sk/DAsicFac -> C:\PROGRA~2\Ditec\DSIGNE~2.NET\NPDITE~1.DLL [2019-01-14] (DITEC, a.s. -> Ditec,a.s.)
FF Plugin-x32: ditec.sk/DitecZepDViewerFb -> C:\PROGRA~2\Ditec\DViewer\NPDITE~1.DLL [2019-01-15] (DITEC, a.s. -> Ditec, a.s.)
FF Plugin-x32: ditec.sk/DSigMessageContainer -> C:\PROGRA~2\Ditec\DSIGNE~2.NET\NPDITE~2.DLL [2016-12-15] (DITEC, a.s. -> Ditec, a.s.)
FF Plugin-x32: ditec.sk/DSigXadesExtender -> C:\PROGRA~2\Ditec\DSIGNE~2.NET\NPDITE~3.DLL [2016-12-15] (DITEC, a.s. -> Ditec, a.s.)
FF Plugin-x32: ditec.sk/DSigXadesFb -> C:\PROGRA~2\Ditec\DSIGNE~1.NET\NPDITE~1.DLL [2019-01-15] (DITEC, a.s. -> Ditec,a.s.)
FF Plugin-x32: ditec.sk/XmlDataContainerFb -> C:\PROGRA~2\Ditec\DSIGNE~1.NET\NPDITE~2.DLL [2019-01-15] (DITEC, a.s. -> Ditec,a.s.)
FF Plugin HKU\S-1-5-21-1960842775-2088100534-3542962694-1002: ditec.sk/DitecZepDViewerFb -> C:\ProgramData\Ditec\DViewer\npDitec.Zep.DViewerFb.dll [No File]
FF Plugin HKU\S-1-5-21-1960842775-2088100534-3542962694-1002: ditec.sk/DSigXadesExtenderFb -> C:\Program Files (x86)\Ditec\DSigXadesExtender\npDitec.Zep.DSigXadesExtenderFb.dll [No File]
FF Plugin HKU\S-1-5-21-1960842775-2088100534-3542962694-1002: ditec.sk/DSigXadesFb -> C:\Program Files (x86)\Ditec\DSigXades\npDitec.Zep.DSigXadesFb.dll [No File]

Chrome: 
=======
CHR HomePage: Default -> hxxp://www.google.com/
CHR StartupUrls: Default -> "hxxp://www.google.com/"
CHR Profile: C:\Users\Jozko\AppData\Local\Google\Chrome\User Data\Default [2019-07-31]
CHR Extension: (Präsentationen) - C:\Users\Jozko\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2019-07-31]
CHR Extension: (Docs) - C:\Users\Jozko\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2019-07-31]
CHR Extension: (Google Drive) - C:\Users\Jozko\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2019-07-31]
CHR Extension: (YouTube) - C:\Users\Jozko\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2019-07-31]
CHR Extension: (Adobe Acrobat) - C:\Users\Jozko\AppData\Local\Google\Chrome\User Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj [2019-07-31]
CHR Extension: (Tabellen) - C:\Users\Jozko\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2019-07-31]
CHR Extension: (Google Docs Offline) - C:\Users\Jozko\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2019-07-31]
CHR Extension: (Chrome Web Store-Zahlungen) - C:\Users\Jozko\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2019-07-31]
CHR Extension: (Disig Web Signer 1.0.7) - C:\Users\Jozko\AppData\Local\Google\Chrome\User Data\Default\Extensions\odbdbcaekkgabdfaabepfjgiooilmaoe [2019-07-31]
CHR Extension: (Google Mail) - C:\Users\Jozko\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2019-07-31]
CHR Extension: (Chrome Media Router) - C:\Users\Jozko\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2019-07-31]
CHR HKLM-x32\...\Chrome\Extension: [efaidnbmnnnibpcajpcglclefindmkaj] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [odbdbcaekkgabdfaabepfjgiooilmaoe] - hxxps://clients2.google.com/service/update2/crx

==================== Services (Whitelisted) ====================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

S2 dLauncherLoopback; C:\Program Files (x86)\Ditec\DLauncher\dLauncherLoopback.exe [156984 2017-09-29] (DITEC, a.s. -> )
R2 DSAService; C:\Program Files (x86)\Intel\Driver and Support Assistant\DSAService.exe [26984 2019-07-25] (IDSA Production signing key -> Intel)
R3 DSAUpdateService; C:\Program Files (x86)\Intel\Driver and Support Assistant\DSAUpdateService.exe [80744 2019-07-25] (IDSA Production signing key -> Intel)
S2 ESRV_SVC_QUEENCREEK; C:\Program Files\Intel\SUR\QUEENCREEK\x64\esrv_svc.exe [937208 2018-12-19] (Intel(R) Software Development Products -> )
S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\Intel(R) Management Engine Components\iCLS\SocketHeciServer.exe [762568 2018-06-08] (Intel(R) Trust Services -> Intel(R) Corporation)
S3 Intel(R) SUR QC SAM; C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\IntelSoftwareAssetManagerService.exe [18168 2017-07-13] (Intel(R) Software Asset Manager -> Intel Corporation)
S2 Intel(R) TPM Provisioning Service; C:\Program Files\Intel\Intel(R) Management Engine Components\iCLS\TPMProvisioningService.exe [714952 2018-06-08] (Intel(R) Trust Services -> Intel(R) Corporation)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [218176 2018-08-03] (Intel(R) Embedded Subsystems and IP Blocks Group -> Intel Corporation)
R3 lmhosts; C:\WINDOWS\System32\svchost.exe [85472 2019-01-09] (Microsoft Windows Publisher -> Microsoft Corporation)
R3 lmhosts; C:\WINDOWS\SysWOW64\svchost.exe [71456 2019-01-09] (Microsoft Windows Publisher -> Microsoft Corporation)
R2 MBAMService; C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe [6744288 2019-06-26] (Malwarebytes Corporation -> Malwarebytes)
R2 NlaSvc; C:\WINDOWS\System32\svchost.exe [85472 2019-01-09] (Microsoft Windows Publisher -> Microsoft Corporation)
R2 NlaSvc; C:\WINDOWS\SysWOW64\svchost.exe [71456 2019-01-09] (Microsoft Windows Publisher -> Microsoft Corporation)
R2 nsi; C:\WINDOWS\system32\svchost.exe [85472 2019-01-09] (Microsoft Windows Publisher -> Microsoft Corporation)
R2 nsi; C:\WINDOWS\SysWOW64\svchost.exe [71456 2019-01-09] (Microsoft Windows Publisher -> Microsoft Corporation)
S3 Sense; C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe [5073792 2019-07-04] (Microsoft Windows Publisher -> Microsoft Corporation)
R2 SystemUsageReportSvc_QUEENCREEK; C:\Program Files\Intel\SUR\QUEENCREEK\SurSvc.exe [195832 2018-12-19] (Intel(R) Software Development Products -> )
S3 USER_ESRV_SVC_QUEENCREEK; C:\Program Files\Intel\SUR\QUEENCREEK\x64\esrv_svc.exe [937208 2018-12-19] (Intel(R) Software Development Products -> )
R3 WdNisSvc; C:\ProgramData\Microsoft\Windows Defender\platform\4.18.1907.4-0\NisSrv.exe [2552416 2019-07-27] (Microsoft Windows Publisher -> Microsoft Corporation)
R2 WinDefend; C:\ProgramData\Microsoft\Windows Defender\platform\4.18.1907.4-0\MsMpEng.exe [108832 2019-07-27] (Microsoft Windows Publisher -> Microsoft Corporation)

===================== Drivers (Whitelisted) ======================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

S3 GemCCID; C:\WINDOWS\System32\drivers\GemCCID.sys [137712 2016-10-17] (Microsoft Windows Hardware Compatibility Publisher -> Gemalto)
R3 MBAMSwissArmy; C:\WINDOWS\System32\Drivers\mbamswissarmy.sys [275232 2019-08-01] (Malwarebytes Corporation -> Malwarebytes)
R3 rt640x64; C:\WINDOWS\System32\drivers\rt640x64.sys [1122200 2018-12-14] (Realtek Semiconductor Corp. -> Realtek )
S3 semav6msr64; C:\WINDOWS\system32\drivers\semav6msr64.sys [43008 2018-12-19] (Intel Corporation -> )
R3 tap0901; C:\WINDOWS\System32\drivers\tap0901.sys [27136 2016-04-21] (OpenVPN Technologies, Inc. -> The OpenVPN Project)
S0 WdBoot; C:\WINDOWS\System32\drivers\wd\WdBoot.sys [47496 2019-07-27] (Microsoft Windows Early Launch Anti-Malware Publisher -> Microsoft Corporation)
R0 WdFilter; C:\WINDOWS\System32\drivers\wd\WdFilter.sys [344288 2019-07-27] (Microsoft Windows -> Microsoft Corporation)
R3 WdNisDrv; C:\WINDOWS\System32\drivers\wd\WdNisDrv.sys [54496 2019-07-27] (Microsoft Windows -> Microsoft Corporation)

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== One month (created) ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2019-08-01 18:09 - 2019-08-01 18:09 - 000022662 _____ C:\Users\Jozko\Desktop\FRST.txt
2019-08-01 16:45 - 2019-08-01 18:07 - 000001187 _____ C:\Users\Lubka\Desktop\ESET Online Scanner.lnk
2019-08-01 16:45 - 2019-08-01 16:45 - 000001286 _____ C:\Users\Lubka\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\ESET Online Scanner.lnk
2019-08-01 16:45 - 2019-08-01 16:45 - 000000000 ____D C:\Users\Lubka\AppData\Local\ESET
2019-08-01 16:44 - 2019-08-01 16:44 - 000000812 _____ C:\Users\Jozko\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\ESET Online Scanner.lnk
2019-08-01 16:44 - 2019-08-01 16:44 - 000000000 ____D C:\Users\Jozko\AppData\Local\ESET
2019-08-01 16:43 - 2019-08-01 16:43 - 007986712 _____ (ESET spol. s r.o.) C:\Users\Jozko\Desktop\ESETOnlineScanner_DEU.exe
2019-08-01 16:41 - 2019-08-01 16:41 - 000001348 _____ C:\Users\Jozko\Desktop\Fixlog.txt
2019-08-01 16:39 - 2019-08-01 16:41 - 000275232 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mbamswissarmy.sys
2019-07-31 22:52 - 2019-07-31 22:52 - 000001630 _____ C:\Users\Lubka\Desktop\AdwCleaner[S03].txt
2019-07-31 22:37 - 2019-08-01 13:55 - 000000000 ____D C:\Users\Jozko\Desktop\Trojaner
2019-07-31 20:57 - 2019-07-31 20:57 - 000003893 _____ C:\Users\Lubka\Desktop\AdwCleaner[S00].txt
2019-07-31 20:57 - 2019-07-31 20:57 - 000001610 _____ C:\Users\Lubka\Desktop\AdwCleaner[S02].txt
2019-07-31 20:57 - 2019-07-31 20:57 - 000001447 _____ C:\Users\Lubka\Desktop\AdwCleaner[S01].txt
2019-07-31 20:34 - 2019-07-31 20:34 - 007316688 _____ (Malwarebytes) C:\Users\Jozko\Downloads\adwcleaner-7-2-7.exe
2019-07-31 20:01 - 2019-07-31 20:01 - 000000000 ____D C:\Users\Jozko\Desktop\FRST-OlderVersion
2019-07-31 20:01 - 2019-07-31 20:01 - 000000000 ____D C:\Users\Jozko\AppData\Local\PeerDistRepub
2019-07-31 19:13 - 2019-07-31 19:13 - 000000085 _____ C:\WINDOWS\wininit.ini
2019-07-30 22:25 - 2019-07-30 22:25 - 000000000 ____D C:\Users\Lubka\AppData\Local\mbamtray
2019-07-30 22:11 - 2019-07-30 22:11 - 000000000 ____D C:\Users\Jozko\AppData\Roaming\Sun
2019-07-30 22:11 - 2019-07-30 22:11 - 000000000 ____D C:\Users\Jozko\AppData\LocalLow\Sun
2019-07-30 22:00 - 2019-08-01 18:09 - 000000000 ____D C:\FRST
2019-07-30 21:47 - 2019-07-31 20:01 - 002096128 _____ (Farbar) C:\Users\Jozko\Desktop\FRST64.exe
2019-07-30 21:11 - 2019-07-30 21:11 - 000001912 _____ C:\Users\Public\Desktop\Malwarebytes.lnk
2019-07-30 21:11 - 2019-07-30 21:11 - 000000000 ____D C:\Users\Jozko\AppData\Local\mbamtray
2019-07-30 21:11 - 2019-07-30 21:11 - 000000000 ____D C:\Users\Jozko\AppData\Local\mbam
2019-07-30 21:11 - 2019-07-30 21:11 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes
2019-07-30 21:11 - 2019-01-08 16:32 - 000153328 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mbae64.sys
2019-07-30 21:10 - 2019-07-30 21:10 - 000000000 ____D C:\ProgramData\Malwarebytes
2019-07-30 21:10 - 2019-07-30 21:10 - 000000000 ____D C:\Program Files\Malwarebytes
2019-07-30 21:09 - 2019-07-30 21:09 - 000000000 ____D C:\WINDOWS\pss
2019-07-30 20:49 - 2019-07-30 20:49 - 000388992 _____ C:\Users\Jozko\Desktop\bookmarksJ.html
2019-07-30 20:47 - 2019-07-30 20:47 - 000051801 _____ C:\Users\Lubka\Desktop\bookmarksL.html
2019-07-30 20:26 - 2019-07-30 20:27 - 000000000 ____D C:\AdwCleaner
2019-07-30 20:24 - 2019-07-30 20:25 - 007623880 _____ (Malwarebytes) C:\Users\Jozko\Desktop\adwcleaner_7.4.exe
2019-07-30 20:15 - 2019-07-30 20:15 - 000000000 ____D C:\Users\Jozko\AppData\Local\D3DSCache
2019-07-30 20:04 - 2019-07-31 19:14 - 000000000 ____D C:\Program Files (x86)\Spybot - Search & Destroy 2
2019-07-30 20:04 - 2019-07-31 19:13 - 000000000 ____D C:\ProgramData\Spybot - Search & Destroy
2019-07-27 14:10 - 2019-07-27 14:10 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Intel
2019-07-27 12:14 - 2019-07-27 12:15 - 000000000 ____D C:\Users\Lubka\Desktop\SAP-USB
2019-07-27 12:12 - 2019-07-27 12:12 - 001680991 _____ C:\Users\Lubka\Desktop\mssstool0221.zip
2019-07-27 11:52 - 2019-07-27 12:01 - 000000000 ____D C:\WINDOWS\Microsoft Antimalware
2019-07-25 01:04 - 2019-08-01 17:01 - 000000000 ____D C:\ProgramData\TmpLoog
2019-07-25 00:44 - 2019-07-25 00:44 - 000000000 ____D C:\Users\Lubka\AppData\LocalLow\lltgznTbqqOCq
2019-07-24 23:11 - 2019-07-24 23:11 - 000000000 ____D C:\Users\Lubka\AppData\Roaming\WinRAR
2019-07-24 23:11 - 2019-07-24 23:11 - 000000000 ____D C:\Users\Lubka\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR
2019-07-24 23:11 - 2019-07-24 23:11 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinRAR
2019-07-24 23:11 - 2019-07-24 23:11 - 000000000 ____D C:\Program Files (x86)\WinRAR
2019-07-24 23:10 - 2019-07-24 23:10 - 002918616 _____ (Alexander Roshal) C:\Users\Lubka\Downloads\wrar571.exe
2019-07-24 23:05 - 2019-07-24 23:05 - 000147094 _____ C:\Users\Lubka\Downloads\SilentPatchSA.zip
2019-07-24 23:04 - 2019-07-24 23:04 - 000039315 _____ C:\Users\Lubka\Downloads\asiloader.rar
2019-07-24 23:00 - 2019-07-24 23:20 - 000000000 ____D C:\Users\Lubka\Documents\GTA San Andreas User Files
2019-07-24 23:00 - 2008-10-15 06:22 - 005631312 _____ (Microsoft Corporation) C:\WINDOWS\system32\D3DX9_40.dll
2019-07-24 23:00 - 2008-10-15 06:22 - 004379984 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\D3DX9_40.dll
2019-07-24 23:00 - 2008-10-15 06:22 - 002605920 _____ (Microsoft Corporation) C:\WINDOWS\system32\D3DCompiler_40.dll
2019-07-24 23:00 - 2008-10-15 06:22 - 002036576 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\D3DCompiler_40.dll
2019-07-24 23:00 - 2008-10-15 06:22 - 000519000 _____ (Microsoft Corporation) C:\WINDOWS\system32\d3dx10_40.dll
2019-07-24 23:00 - 2008-10-15 06:22 - 000452440 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d3dx10_40.dll
2019-07-24 21:13 - 2019-07-24 21:13 - 000001315 _____ C:\Users\Public\Desktop\Age of Empires - The Rise of Rome color fix.lnk
2019-07-24 21:13 - 2019-07-24 21:13 - 000001306 _____ C:\Users\Public\Desktop\Age of Empires color fix.lnk
2019-07-24 21:13 - 2019-07-24 21:13 - 000001185 _____ C:\Users\Public\Desktop\Age of Empires - The Rise of Rome.lnk
2019-07-24 21:13 - 2019-07-24 21:13 - 000001178 _____ C:\Users\Public\Desktop\Age of Empires.lnk
2019-07-24 21:13 - 2019-07-24 21:13 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Age of Empires complete
2019-07-24 21:13 - 2019-07-24 21:13 - 000000000 ____D C:\Program Files (x86)\Age of Empires complete
2019-07-24 19:25 - 2019-07-24 19:25 - 000000221 _____ C:\Users\Lubka\Desktop\Grand Theft Auto San Andreas.url
2019-07-24 19:25 - 2019-07-24 19:25 - 000000000 ____D C:\Users\Lubka\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Steam
2019-07-24 19:23 - 2019-07-25 01:01 - 000000000 ____D C:\Program Files\Mozilla Firefox
2019-07-24 19:20 - 2019-07-24 19:20 - 000000000 ____D C:\Users\Lubka\AppData\Local\Steam
2019-07-24 19:20 - 2019-07-24 19:20 - 000000000 ____D C:\Users\Lubka\AppData\Local\CEF
2019-07-24 19:11 - 2019-07-24 19:11 - 001573568 _____ C:\Users\Lubka\Downloads\SteamSetup.exe
2019-07-24 19:11 - 2019-07-24 19:11 - 000001036 _____ C:\Users\Public\Desktop\Steam.lnk
2019-07-24 19:11 - 2019-07-24 19:11 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Steam
2019-07-13 16:59 - 2019-07-13 16:59 - 000716789 _____ C:\WINDOWS\SysWOW64\unins000.exe
2019-07-13 16:59 - 2019-07-13 16:59 - 000001770 _____ C:\WINDOWS\SysWOW64\unins000.dat
2019-07-13 16:59 - 2019-04-10 14:55 - 000290816 _____ (www.xjghost.com) C:\WINDOWS\SysWOW64\WebClientPlayBack.ocx
2019-07-13 16:59 - 2019-04-10 14:45 - 000229484 _____ () C:\WINDOWS\SysWOW64\WebClientPlus.ocx
2019-07-13 16:59 - 2019-03-29 09:22 - 000004240 _____ C:\WINDOWS\SysWOW64\lang_spanish.ini
2019-07-13 16:59 - 2019-03-29 09:16 - 000004250 _____ C:\WINDOWS\SysWOW64\lang_italy.ini
2019-07-13 16:59 - 2019-03-29 09:12 - 000004624 _____ C:\WINDOWS\SysWOW64\lang_franch.ini
2019-07-13 16:59 - 2019-03-29 09:09 - 000004404 _____ C:\WINDOWS\SysWOW64\lang_germany.ini
2019-07-13 16:59 - 2019-03-28 10:33 - 000002698 _____ C:\WINDOWS\SysWOW64\lang_chn.ini
2019-07-13 16:59 - 2019-01-11 16:02 - 000245760 _____ () C:\WINDOWS\SysWOW64\NetLib.dll
2019-07-13 16:59 - 2019-01-11 15:55 - 000081920 _____ () C:\WINDOWS\SysWOW64\hiPBClient.dll
2019-07-13 16:59 - 2018-11-12 18:10 - 000417792 _____ () C:\WINDOWS\SysWOW64\HIPlayer.dll
2019-07-13 16:59 - 2018-11-07 11:26 - 000319488 _____ () C:\WINDOWS\SysWOW64\HIPlayer.exe
2019-07-13 16:59 - 2018-11-07 10:38 - 000057344 _____ () C:\WINDOWS\SysWOW64\HISDK.dll
2019-07-13 16:59 - 2018-11-07 09:57 - 000573952 _____ C:\WINDOWS\SysWOW64\Hi265.dll
2019-07-13 16:59 - 2014-04-10 14:28 - 000057344 _____ (微软中国) C:\WINDOWS\SysWOW64\SearchLib.dll
2019-07-13 16:59 - 2013-07-10 17:21 - 000217600 _____ C:\WINDOWS\SysWOW64\npzxwebplugin.dll
2019-07-13 16:59 - 2012-09-25 21:39 - 002555406 _____ C:\WINDOWS\SysWOW64\avcodec-54.dll
2019-07-13 16:59 - 2012-09-25 21:39 - 000157198 _____ C:\WINDOWS\SysWOW64\avutil-51.dll
2019-07-13 16:59 - 2010-08-23 20:07 - 000562220 _____ C:\WINDOWS\SysWOW64\AlarmSound.wav
2019-07-13 16:58 - 2019-07-13 16:58 - 002036967 _____ ( ) C:\Users\Jozko\Desktop\ClientPlus_Setup.exe
2019-07-13 16:47 - 2019-07-13 16:47 - 000001906 _____ C:\Users\Jozko\Desktop\HiPlayer.exe.lnk
2019-07-13 16:47 - 2019-07-13 16:47 - 000000000 ____D C:\Users\Jozko\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\HiPlayer
2019-07-13 16:47 - 2019-07-13 16:47 - 000000000 ____D C:\Users\Jozko\AppData\Roaming\HiPlayer
2019-07-09 19:25 - 2019-07-04 11:40 - 021390504 _____ (Microsoft Corporation) C:\WINDOWS\system32\shell32.dll
2019-07-09 19:25 - 2019-07-04 11:40 - 001616840 _____ (Microsoft Corporation) C:\WINDOWS\system32\sppobjs.dll
2019-07-09 19:25 - 2019-07-04 11:18 - 003614208 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32kfull.sys
2019-07-09 19:25 - 2019-07-04 10:51 - 020384128 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\shell32.dll
2019-07-09 19:25 - 2019-07-04 10:37 - 002882048 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\win32kfull.sys
2019-07-09 19:25 - 2019-07-04 07:00 - 001035040 _____ (Microsoft Corporation) C:\WINDOWS\system32\ApplyTrustOffline.exe
2019-07-09 19:25 - 2019-07-04 06:58 - 001219896 _____ (Microsoft Corporation) C:\WINDOWS\system32\hvix64.exe
2019-07-09 19:25 - 2019-07-04 06:57 - 003292152 _____ (Microsoft Corporation) C:\WINDOWS\system32\combase.dll
2019-07-09 19:25 - 2019-07-04 06:56 - 009084216 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntoskrnl.exe
2019-07-09 19:25 - 2019-07-04 06:56 - 007519896 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.Protection.PlayReady.dll
2019-07-09 19:25 - 2019-07-04 06:56 - 007436536 _____ (Microsoft Corporation) C:\WINDOWS\system32\windows.storage.dll
2019-07-09 19:25 - 2019-07-04 06:56 - 002810680 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgkrnl.sys
2019-07-09 19:25 - 2019-07-04 06:42 - 006570368 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.Protection.PlayReady.dll
2019-07-09 19:25 - 2019-07-04 06:42 - 006044008 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\windows.storage.dll
2019-07-09 19:25 - 2019-07-04 06:42 - 002479176 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\combase.dll
2019-07-09 19:25 - 2019-07-04 06:37 - 025857536 _____ (Microsoft Corporation) C:\WINDOWS\system32\edgehtml.dll
2019-07-09 19:25 - 2019-07-04 06:33 - 022017536 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\edgehtml.dll
2019-07-09 19:25 - 2019-07-04 06:29 - 022717440 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll
2019-07-09 19:25 - 2019-07-04 06:26 - 004385280 _____ (Microsoft Corporation) C:\WINDOWS\system32\EdgeContent.dll
2019-07-09 19:25 - 2019-07-04 06:25 - 019372544 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll
2019-07-09 19:25 - 2019-07-04 06:25 - 007589888 _____ (Microsoft Corporation) C:\WINDOWS\system32\Chakra.dll
2019-07-09 19:25 - 2019-07-04 06:25 - 004861440 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll
2019-07-09 19:25 - 2019-07-04 06:25 - 003401216 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentServer.dll
2019-07-09 19:25 - 2019-07-04 06:22 - 003707904 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll
2019-07-09 19:25 - 2019-07-04 06:21 - 005784064 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Chakra.dll
2019-07-09 19:25 - 2019-07-04 06:21 - 003202560 _____ (Microsoft Corporation) C:\WINDOWS\system32\DWrite.dll
2019-07-09 19:25 - 2019-06-13 14:12 - 002871848 _____ (Microsoft Corporation) C:\WINDOWS\system32\aitstatic.exe
2019-07-09 19:25 - 2019-06-13 14:05 - 000810296 _____ (Microsoft Corporation) C:\WINDOWS\system32\generaltel.dll
2019-07-09 19:25 - 2019-06-13 14:04 - 001721144 _____ (Microsoft Corporation) C:\WINDOWS\system32\appraiser.dll
2019-07-09 19:25 - 2019-06-13 13:59 - 000740664 _____ (Microsoft Corporation) C:\WINDOWS\system32\aeinv.dll
2019-07-09 19:25 - 2019-06-13 13:42 - 004038688 _____ (Microsoft Corporation) C:\WINDOWS\explorer.exe
2019-07-09 19:25 - 2019-06-13 13:18 - 006586880 _____ (Microsoft Corporation) C:\WINDOWS\system32\twinui.dll
2019-07-09 19:25 - 2019-06-13 13:18 - 004847104 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingsHandlers_nt.dll
2019-07-09 19:25 - 2019-06-13 13:17 - 012756992 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll
2019-07-09 19:25 - 2019-06-13 13:15 - 004718080 _____ (Microsoft Corporation) C:\WINDOWS\system32\twinui.pcshell.dll
2019-07-09 19:25 - 2019-06-13 13:13 - 002920448 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Logon.dll
2019-07-09 19:25 - 2019-06-13 12:11 - 001539896 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AppVEntSubsystems32.dll
2019-07-09 19:25 - 2019-06-13 12:05 - 003700160 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\explorer.exe
2019-07-09 19:25 - 2019-06-13 11:55 - 005657088 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\twinui.dll
2019-07-09 19:25 - 2019-06-13 11:54 - 011942912 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll
2019-07-09 19:25 - 2019-06-13 09:01 - 000513336 _____ (Microsoft Corporation) C:\WINDOWS\system32\aepic.dll
2019-07-09 19:25 - 2019-06-13 08:47 - 005625160 _____ (Microsoft Corporation) C:\WINDOWS\system32\StartTileData.dll
2019-07-09 19:25 - 2019-06-13 08:44 - 002769688 _____ (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll
2019-07-09 19:25 - 2019-06-13 08:14 - 003318784 _____ (Microsoft Corporation) C:\WINDOWS\system32\dwmcore.dll
2019-07-09 19:25 - 2019-06-13 08:13 - 004771840 _____ (Microsoft Corporation) C:\WINDOWS\system32\InputService.dll
2019-07-09 19:25 - 2019-06-13 07:14 - 000415544 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\aepic.dll
2019-07-09 19:25 - 2019-06-13 07:06 - 002256768 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iertutil.dll
2019-07-09 19:24 - 2019-07-04 11:45 - 001786680 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVEntVirtualization.dll
2019-07-09 19:24 - 2019-07-04 11:43 - 000094008 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpudd.dll
2019-07-09 19:24 - 2019-07-04 11:41 - 000304144 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\mssecflt.sys
2019-07-09 19:24 - 2019-07-04 11:40 - 001631808 _____ (Microsoft Corporation) C:\WINDOWS\system32\gdi32full.dll
2019-07-09 19:24 - 2019-07-04 11:40 - 000790416 _____ (Microsoft Corporation) C:\WINDOWS\system32\fontdrvhost.exe
2019-07-09 19:24 - 2019-07-04 11:22 - 000131072 _____ (Microsoft Corporation) C:\WINDOWS\splwow64.exe
2019-07-09 19:24 - 2019-07-04 11:22 - 000128000 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppxSysprep.dll
2019-07-09 19:24 - 2019-07-04 11:21 - 008627200 _____ (Microsoft Corporation) C:\WINDOWS\system32\mstscax.dll
2019-07-09 19:24 - 2019-07-04 11:20 - 001609216 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpcorets.dll
2019-07-09 19:24 - 2019-07-04 11:19 - 000420864 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpclip.exe
2019-07-09 19:24 - 2019-07-04 11:18 - 001663488 _____ (Microsoft Corporation) C:\WINDOWS\system32\GdiPlus.dll
2019-07-09 19:24 - 2019-07-04 10:56 - 001453416 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\gdi32full.dll
2019-07-09 19:24 - 2019-07-04 10:54 - 000662352 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\fontdrvhost.exe
2019-07-09 19:24 - 2019-07-04 10:41 - 007990784 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mstscax.dll
2019-07-09 19:24 - 2019-07-04 10:36 - 001471488 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\GdiPlus.dll
2019-07-09 19:24 - 2019-07-04 06:58 - 001328440 _____ (Microsoft Corporation) C:\WINDOWS\system32\wpx.dll
2019-07-09 19:24 - 2019-07-04 06:58 - 000416312 _____ (Microsoft Corporation) C:\WINDOWS\system32\wlanapi.dll
2019-07-09 19:24 - 2019-07-04 06:58 - 000192824 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\appid.sys
2019-07-09 19:24 - 2019-07-04 06:57 - 001027384 _____ (Microsoft Corporation) C:\WINDOWS\system32\hvax64.exe
2019-07-09 19:24 - 2019-07-04 06:57 - 000986128 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingSyncHost.exe
2019-07-09 19:24 - 2019-07-04 06:57 - 000776784 _____ (Microsoft Corporation) C:\WINDOWS\system32\wer.dll
2019-07-09 19:24 - 2019-07-04 06:57 - 000723728 _____ (Microsoft Corporation) C:\WINDOWS\system32\ci.dll
2019-07-09 19:24 - 2019-07-04 06:57 - 000708696 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\cng.sys
2019-07-09 19:24 - 2019-07-04 06:57 - 000568104 _____ (Microsoft Corporation) C:\WINDOWS\system32\tcblaunch.exe
2019-07-09 19:24 - 2019-07-04 06:57 - 000362264 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Storage.ApplicationData.dll
2019-07-09 19:24 - 2019-07-04 06:57 - 000209424 _____ (Microsoft Corporation) C:\WINDOWS\system32\wermgr.exe
2019-07-09 19:24 - 2019-07-04 06:57 - 000194360 _____ (Microsoft Corporation) C:\WINDOWS\system32\skci.dll
2019-07-09 19:24 - 2019-07-04 06:57 - 000137656 _____ (Microsoft Corporation) C:\WINDOWS\system32\bcrypt.dll
2019-07-09 19:24 - 2019-07-04 06:57 - 000134968 _____ (Microsoft Corporation) C:\WINDOWS\system32\hvloader.dll
2019-07-09 19:24 - 2019-07-04 06:57 - 000091776 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dumpfve.sys
2019-07-09 19:24 - 2019-07-04 06:56 - 002571640 _____ (Microsoft Corporation) C:\WINDOWS\system32\KernelBase.dll
2019-07-09 19:24 - 2019-07-04 06:56 - 001566520 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppxPackaging.dll
2019-07-09 19:24 - 2019-07-04 06:56 - 001459120 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.efi
2019-07-09 19:24 - 2019-07-04 06:56 - 001260776 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.exe
2019-07-09 19:24 - 2019-07-04 06:56 - 001141496 _____ (Microsoft Corporation) C:\WINDOWS\system32\winresume.efi
2019-07-09 19:24 - 2019-07-04 06:56 - 000983936 _____ (Microsoft Corporation) C:\WINDOWS\system32\winresume.exe
2019-07-09 19:24 - 2019-07-04 06:56 - 000767536 _____ (Microsoft Corporation) C:\WINDOWS\system32\dnsapi.dll
2019-07-09 19:24 - 2019-07-04 06:56 - 000734952 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentClient.dll
2019-07-09 19:24 - 2019-07-04 06:56 - 000713272 _____ (Microsoft Corporation) C:\WINDOWS\system32\MSVideoDSP.dll
2019-07-09 19:24 - 2019-07-04 06:56 - 000604984 _____ (Microsoft Corporation) C:\WINDOWS\system32\securekernel.exe
2019-07-09 19:24 - 2019-07-04 06:56 - 000493752 _____ (Microsoft Corporation) C:\WINDOWS\system32\bcryptprimitives.dll
2019-07-09 19:24 - 2019-07-04 06:56 - 000115512 _____ (Microsoft Corporation) C:\WINDOWS\system32\kdnet.dll
2019-07-09 19:24 - 2019-07-04 06:43 - 000832016 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SettingSyncHost.exe
2019-07-09 19:24 - 2019-07-04 06:43 - 000665440 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wer.dll
2019-07-09 19:24 - 2019-07-04 06:43 - 000328696 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wlanapi.dll
2019-07-09 19:24 - 2019-07-04 06:43 - 000287376 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Storage.ApplicationData.dll
2019-07-09 19:24 - 2019-07-04 06:43 - 000191800 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wermgr.exe
2019-07-09 19:24 - 2019-07-04 06:42 - 001980984 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\KernelBase.dll
2019-07-09 19:24 - 2019-07-04 06:42 - 001427768 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AppxPackaging.dll
2019-07-09 19:24 - 2019-07-04 06:42 - 000573808 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dnsapi.dll
2019-07-09 19:24 - 2019-07-04 06:42 - 000356312 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\bcryptprimitives.dll
2019-07-09 19:24 - 2019-07-04 06:42 - 000097272 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\bcrypt.dll
2019-07-09 19:24 - 2019-07-04 06:41 - 000559328 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AppXDeploymentClient.dll
2019-07-09 19:24 - 2019-07-04 06:26 - 000310272 _____ (Microsoft Corporation) C:\WINDOWS\system32\wc_storage.dll
2019-07-09 19:24 - 2019-07-04 06:26 - 000051200 _____ (Microsoft Corporation) C:\WINDOWS\system32\TpmTasks.dll
2019-07-09 19:24 - 2019-07-04 06:25 - 000295424 _____ (Microsoft Corporation) C:\WINDOWS\system32\TDLMigration.dll
2019-07-09 19:24 - 2019-07-04 06:25 - 000079872 _____ (Microsoft Corporation) C:\WINDOWS\system32\offreg.dll
2019-07-09 19:24 - 2019-07-04 06:24 - 000726528 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\PEAuth.sys
2019-07-09 19:24 - 2019-07-04 06:24 - 000567808 _____ (Microsoft Corporation) C:\WINDOWS\system32\daxexec.dll
2019-07-09 19:24 - 2019-07-04 06:24 - 000462336 _____ (Microsoft Corporation) C:\WINDOWS\system32\bcdedit.exe
2019-07-09 19:24 - 2019-07-04 06:24 - 000153600 _____ (Microsoft Corporation) C:\WINDOWS\system32\dssvc.dll
2019-07-09 19:24 - 2019-07-04 06:23 - 001765888 _____ (Microsoft Corporation) C:\WINDOWS\system32\audiosrv.dll
2019-07-09 19:24 - 2019-07-04 06:23 - 001217536 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpcore.dll
2019-07-09 19:24 - 2019-07-04 06:23 - 000786432 _____ (Microsoft Corporation) C:\WINDOWS\system32\iphlpsvc.dll
2019-07-09 19:24 - 2019-07-04 06:22 - 002587648 _____ (Microsoft Corporation) C:\WINDOWS\system32\wlansvc.dll
2019-07-09 19:24 - 2019-07-04 06:22 - 002176000 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentExtensions.onecore.dll
2019-07-09 19:24 - 2019-07-04 06:22 - 001561088 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentExtensions.desktop.dll
2019-07-09 19:24 - 2019-07-04 06:22 - 001549824 _____ (Microsoft Corporation) C:\WINDOWS\system32\lsasrv.dll
2019-07-09 19:24 - 2019-07-04 06:22 - 001175552 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingSyncCore.dll
2019-07-09 19:24 - 2019-07-04 06:22 - 000300544 _____ (Microsoft Corporation) C:\WINDOWS\system32\dnsrslvr.dll
2019-07-09 19:24 - 2019-07-04 06:22 - 000110592 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\profext.dll
2019-07-09 19:24 - 2019-07-04 06:22 - 000032768 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\werdiagcontroller.dll
2019-07-09 19:24 - 2019-07-04 06:21 - 005307392 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d2d1.dll
2019-07-09 19:24 - 2019-07-04 06:21 - 002166784 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32kbase.sys
2019-07-09 19:24 - 2019-07-04 06:21 - 001920000 _____ (Microsoft Corporation) C:\WINDOWS\system32\FntCache.dll
2019-07-09 19:24 - 2019-07-04 06:21 - 001220608 _____ (Microsoft Corporation) C:\WINDOWS\system32\Unistore.dll
2019-07-09 19:24 - 2019-07-04 06:21 - 000324096 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppxAllUserStore.dll
2019-07-09 19:24 - 2019-07-04 06:21 - 000124416 _____ (Microsoft Corporation) C:\WINDOWS\system32\profext.dll
2019-07-09 19:24 - 2019-07-04 06:21 - 000059392 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\offreg.dll
2019-07-09 19:24 - 2019-07-04 06:20 - 001156608 _____ (Microsoft Corporation) C:\WINDOWS\system32\rpcss.dll
2019-07-09 19:24 - 2019-07-04 06:20 - 000544256 _____ (Microsoft Corporation) C:\WINDOWS\system32\vbscript.dll
2019-07-09 19:24 - 2019-07-04 06:20 - 000392704 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\daxexec.dll
2019-07-09 19:24 - 2019-07-04 06:20 - 000330752 _____ (Microsoft Corporation) C:\WINDOWS\system32\ncryptprov.dll
2019-07-09 19:24 - 2019-07-04 06:19 - 000886272 _____ (Microsoft Corporation) C:\WINDOWS\system32\MPSSVC.dll
2019-07-09 19:24 - 2019-07-04 06:19 - 000230912 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AppxAllUserStore.dll
2019-07-09 19:24 - 2019-07-04 06:18 - 002602496 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\DWrite.dll
2019-07-09 19:24 - 2019-07-04 06:18 - 001076224 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rdpcore.dll
2019-07-09 19:24 - 2019-07-04 06:18 - 000965632 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Unistore.dll
2019-07-09 19:24 - 2019-07-04 06:18 - 000953344 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SettingSyncCore.dll
2019-07-09 19:24 - 2019-07-04 06:18 - 000275968 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ncryptprov.dll
2019-07-09 19:24 - 2019-07-04 06:17 - 000531968 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\vbscript.dll
2019-07-09 19:24 - 2019-07-04 05:01 - 000001312 _____ C:\WINDOWS\system32\tcbres.wim
2019-07-09 19:24 - 2019-06-21 10:50 - 000280584 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\msiscsi.sys
2019-07-09 19:24 - 2019-06-13 14:15 - 000324408 _____ (Microsoft Corporation) C:\WINDOWS\system32\acmigration.dll
2019-07-09 19:24 - 2019-06-13 14:00 - 000464696 _____ (Microsoft Corporation) C:\WINDOWS\system32\invagent.dll
2019-07-09 19:24 - 2019-06-13 13:58 - 000637752 _____ (Microsoft Corporation) C:\WINDOWS\system32\devinv.dll
2019-07-09 19:24 - 2019-06-13 13:58 - 000071480 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32appinventorycsp.dll
2019-07-09 19:24 - 2019-06-13 13:56 - 000164152 _____ (Microsoft Corporation) C:\WINDOWS\system32\CompatTelRunner.exe
2019-07-09 19:24 - 2019-06-13 13:43 - 001427984 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVEntSubsystemController.dll
2019-07-09 19:24 - 2019-06-13 13:43 - 001048480 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Internal.Shell.Broker.dll
2019-07-09 19:24 - 2019-06-13 13:42 - 002266936 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVEntSubsystems64.dll
2019-07-09 19:24 - 2019-06-13 13:42 - 000652088 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVPublishing.dll
2019-07-09 19:24 - 2019-06-13 13:42 - 000566536 _____ (Microsoft Corporation) C:\WINDOWS\system32\phoneactivate.exe
2019-07-09 19:24 - 2019-06-13 13:41 - 001626936 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVIntegration.dll
2019-07-09 19:24 - 2019-06-13 13:41 - 000830264 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVOrchestration.dll
2019-07-09 19:24 - 2019-06-13 13:41 - 000825144 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVEntStreamingManager.dll
2019-07-09 19:24 - 2019-06-13 13:41 - 000670008 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVCatalog.dll
2019-07-09 19:24 - 2019-06-13 13:40 - 000749880 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVReporting.dll
2019-07-09 19:24 - 2019-06-13 13:40 - 000540984 _____ (Microsoft Corporation) C:\WINDOWS\system32\pcasvc.dll
2019-07-09 19:24 - 2019-06-13 13:40 - 000495416 _____ (Microsoft Corporation) C:\WINDOWS\system32\TransportDSA.dll
2019-07-09 19:24 - 2019-06-13 13:38 - 000766264 _____ (Microsoft Corporation) C:\WINDOWS\system32\LicensingWinRT.dll
2019-07-09 19:24 - 2019-06-13 13:37 - 000101192 _____ (Microsoft Corporation) C:\WINDOWS\system32\changepk.exe
2019-07-09 19:24 - 2019-06-13 13:36 - 000251000 _____ (Microsoft Corporation) C:\WINDOWS\system32\sppwinob.dll
2019-07-09 19:24 - 2019-06-13 13:36 - 000236520 _____ (Microsoft Corporation) C:\WINDOWS\system32\EditionUpgradeManagerObj.dll
2019-07-09 19:24 - 2019-06-13 13:35 - 001376688 _____ (Microsoft Corporation) C:\WINDOWS\system32\ole32.dll
2019-07-09 19:24 - 2019-06-13 13:34 - 000146888 _____ (Microsoft Corporation) C:\WINDOWS\system32\LicensingUI.exe
2019-07-09 19:24 - 2019-06-13 13:17 - 000178176 _____ (Microsoft Corporation) C:\WINDOWS\system32\dmvdsitf.dll
2019-07-09 19:24 - 2019-06-13 13:17 - 000115200 _____ (Microsoft Corporation) C:\WINDOWS\system32\RjvMDMConfig.dll
2019-07-09 19:24 - 2019-06-13 13:17 - 000109056 _____ (Microsoft Corporation) C:\WINDOWS\system32\MDMAgent.exe
2019-07-09 19:24 - 2019-06-13 13:17 - 000093184 _____ (Microsoft Corporation) C:\WINDOWS\system32\WSReset.exe
2019-07-09 19:24 - 2019-06-13 13:16 - 000767488 _____ (Microsoft Corporation) C:\WINDOWS\system32\sppcommdlg.dll
2019-07-09 19:24 - 2019-06-13 13:15 - 000041984 _____ (Microsoft Corporation) C:\WINDOWS\system32\UpgradeResultsUI.exe
2019-07-09 19:24 - 2019-06-13 13:14 - 001127936 _____ (Microsoft Corporation) C:\WINDOWS\system32\nettrace.dll
2019-07-09 19:24 - 2019-06-13 13:14 - 000900096 _____ (Microsoft Corporation) C:\WINDOWS\system32\slui.exe
2019-07-09 19:24 - 2019-06-13 13:14 - 000346624 _____ (Microsoft Corporation) C:\WINDOWS\system32\AcGenral.dll
2019-07-09 19:24 - 2019-06-13 13:14 - 000246272 _____ (Microsoft Corporation) C:\WINDOWS\system32\DesktopSwitcherDataModel.dll
2019-07-09 19:24 - 2019-06-13 13:13 - 001339392 _____ (Microsoft Corporation) C:\WINDOWS\system32\TaskFlowDataEngine.dll
2019-07-09 19:24 - 2019-06-13 13:13 - 000951808 _____ (Microsoft Corporation) C:\WINDOWS\system32\sppcext.dll
2019-07-09 19:24 - 2019-06-13 13:13 - 000765440 _____ (Microsoft Corporation) C:\WINDOWS\system32\tdh.dll
2019-07-09 19:24 - 2019-06-13 13:13 - 000181248 _____ (Microsoft Corporation) C:\WINDOWS\system32\EditionUpgradeHelper.dll
2019-07-09 19:24 - 2019-06-13 13:12 - 000394240 _____ (Microsoft Corporation) C:\WINDOWS\system32\InputSwitch.dll
2019-07-09 19:24 - 2019-06-13 13:10 - 000239104 _____ (Microsoft Corporation) C:\WINDOWS\system32\vdsbas.dll
2019-07-09 19:24 - 2019-06-13 12:07 - 001027008 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ole32.dll
2019-07-09 19:24 - 2019-06-13 12:07 - 000660496 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\LicensingWinRT.dll
2019-07-09 19:24 - 2019-06-13 12:07 - 000221232 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\EditionUpgradeManagerObj.dll
2019-07-09 19:24 - 2019-06-13 11:54 - 000151552 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dmvdsitf.dll
2019-07-09 19:24 - 2019-06-13 11:53 - 000089600 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\olepro32.dll
2019-07-09 19:24 - 2019-06-13 11:51 - 000622080 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\tdh.dll
2019-07-09 19:24 - 2019-06-13 11:50 - 000896512 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\sppcext.dll
2019-07-09 19:24 - 2019-06-13 11:49 - 002406400 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AcGenral.dll
2019-07-09 19:24 - 2019-06-13 11:49 - 000371200 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\InputSwitch.dll
2019-07-09 19:24 - 2019-06-13 09:48 - 000677376 _____ (Microsoft Corporation) C:\WINDOWS\system32\HeadTrackerStorage.dll
2019-07-09 19:24 - 2019-06-13 09:46 - 000713216 _____ (Microsoft Corporation) C:\WINDOWS\system32\SharedRealitySvc.dll
2019-07-09 19:24 - 2019-06-13 09:01 - 000511288 _____ (Microsoft Corporation) C:\WINDOWS\system32\dcntel.dll
2019-07-09 19:24 - 2019-06-13 09:01 - 000036152 _____ (Microsoft Corporation) C:\WINDOWS\system32\DeviceCensus.exe
2019-07-09 19:24 - 2019-06-13 08:59 - 000785264 _____ (Microsoft Corporation) C:\WINDOWS\system32\pkeyhelper.dll
2019-07-09 19:24 - 2019-06-13 08:47 - 001063224 _____ (Microsoft Corporation) C:\WINDOWS\system32\SecConfig.efi
2019-07-09 19:24 - 2019-06-13 08:46 - 001076536 _____ (Microsoft Corporation) C:\WINDOWS\system32\efscore.dll
2019-07-09 19:24 - 2019-06-13 08:46 - 000510296 _____ (Microsoft Corporation) C:\WINDOWS\system32\policymanager.dll
2019-07-09 19:24 - 2019-06-13 08:46 - 000093984 _____ (Microsoft Corporation) C:\WINDOWS\system32\wldp.dll
2019-07-09 19:24 - 2019-06-13 08:45 - 002421560 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ntfs.sys
2019-07-09 19:24 - 2019-06-13 08:44 - 002546704 _____ (Microsoft Corporation) C:\WINDOWS\system32\UpdateAgent.dll
2019-07-09 19:24 - 2019-06-13 08:44 - 001098272 _____ (Microsoft Corporation) C:\WINDOWS\system32\msvproc.dll
2019-07-09 19:24 - 2019-06-13 08:44 - 001033696 _____ (Microsoft Corporation) C:\WINDOWS\system32\ClipSVC.dll
2019-07-09 19:24 - 2019-06-13 08:44 - 000607112 _____ (Microsoft Corporation) C:\WINDOWS\system32\TextInputFramework.dll
2019-07-09 19:24 - 2019-06-13 08:44 - 000545808 _____ (Microsoft Corporation) C:\WINDOWS\system32\hal.dll
2019-07-09 19:24 - 2019-06-13 08:44 - 000130624 _____ (Microsoft Corporation) C:\WINDOWS\system32\rmclient.dll
2019-07-09 19:24 - 2019-06-13 08:17 - 000106496 _____ (Microsoft Corporation) C:\WINDOWS\system32\NotificationControllerPS.dll
2019-07-09 19:24 - 2019-06-13 08:16 - 001626112 _____ (Microsoft Corporation) C:\WINDOWS\system32\enterprisecsps.dll
2019-07-09 19:24 - 2019-06-13 08:16 - 000140288 _____ (Microsoft Corporation) C:\WINDOWS\system32\mdmmigrator.dll
2019-07-09 19:24 - 2019-06-13 08:15 - 000514560 _____ (Microsoft Corporation) C:\WINDOWS\system32\nltest.exe
2019-07-09 19:24 - 2019-06-13 08:15 - 000433152 _____ (Microsoft Corporation) C:\WINDOWS\system32\MusNotification.exe
2019-07-09 19:24 - 2019-06-13 08:15 - 000204288 _____ (Microsoft Corporation) C:\WINDOWS\system32\enrollmentapi.dll
2019-07-09 19:24 - 2019-06-13 08:15 - 000137728 _____ (Microsoft Corporation) C:\WINDOWS\system32\InputLocaleManager.dll
2019-07-09 19:24 - 2019-06-13 08:15 - 000083456 _____ (Microsoft Corporation) C:\WINDOWS\system32\KdsCli.dll
2019-07-09 19:24 - 2019-06-13 08:14 - 000409088 _____ (Microsoft Corporation) C:\WINDOWS\system32\wlanmsm.dll
2019-07-09 19:24 - 2019-06-13 08:14 - 000361472 _____ (Microsoft Corporation) C:\WINDOWS\system32\DeviceEnroller.exe
2019-07-09 19:24 - 2019-06-13 08:14 - 000302080 _____ (Microsoft Corporation) C:\WINDOWS\system32\CXHProvisioningServer.dll
2019-07-09 19:24 - 2019-06-13 08:13 - 002370048 _____ (Microsoft Corporation) C:\WINDOWS\system32\WebRuntimeManager.dll
2019-07-09 19:24 - 2019-06-13 08:13 - 000761344 _____ (Microsoft Corporation) C:\WINDOWS\system32\nshwfp.dll
2019-07-09 19:24 - 2019-06-13 08:13 - 000322560 _____ (Microsoft Corporation) C:\WINDOWS\system32\MusNotificationUx.exe
2019-07-09 19:24 - 2019-06-13 08:13 - 000110592 _____ (Microsoft Corporation) C:\WINDOWS\system32\ngcpopkeysrv.dll
2019-07-09 19:24 - 2019-06-13 08:12 - 000916480 _____ (Microsoft Corporation) C:\WINDOWS\system32\MusUpdateHandlers.dll
2019-07-09 19:24 - 2019-06-13 08:12 - 000894464 _____ (Microsoft Corporation) C:\WINDOWS\system32\webplatstorageserver.dll
2019-07-09 19:24 - 2019-06-13 08:12 - 000808448 _____ (Microsoft Corporation) C:\WINDOWS\system32\EdgeManager.dll
2019-07-09 19:24 - 2019-06-13 08:12 - 000624640 _____ (Microsoft Corporation) C:\WINDOWS\system32\PsmServiceExtHost.dll
2019-07-09 19:24 - 2019-06-13 08:12 - 000532992 _____ (Microsoft Corporation) C:\WINDOWS\system32\QuietHours.dll
2019-07-09 19:24 - 2019-06-13 08:12 - 000501248 _____ (Microsoft Corporation) C:\WINDOWS\system32\rastls.dll
2019-07-09 19:24 - 2019-06-13 08:11 - 000508416 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingsHandlers_Notifications.dll
2019-07-09 19:24 - 2019-06-13 08:11 - 000271872 _____ (Microsoft Corporation) C:\WINDOWS\system32\wkssvc.dll
2019-07-09 19:24 - 2019-06-13 08:11 - 000048128 _____ (Microsoft Corporation) C:\WINDOWS\system32\TokenBrokerUI.dll
2019-07-09 19:24 - 2019-06-13 08:10 - 002912256 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuaueng.dll
2019-07-09 19:24 - 2019-06-13 08:10 - 001400832 _____ (Microsoft Corporation) C:\WINDOWS\system32\TokenBroker.dll
2019-07-09 19:24 - 2019-06-13 08:10 - 001215488 _____ (Microsoft Corporation) C:\WINDOWS\system32\NotificationController.dll
2019-07-09 19:24 - 2019-06-13 08:10 - 000871424 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.BackgroundMediaPlayback.dll
2019-07-09 19:24 - 2019-06-13 08:10 - 000869376 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.Playback.BackgroundMediaPlayer.dll
2019-07-09 19:24 - 2019-06-13 08:10 - 000849408 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.Playback.MediaPlayer.dll
2019-07-09 19:24 - 2019-06-13 08:10 - 000523776 _____ (Microsoft Corporation) C:\WINDOWS\system32\dmenrollengine.dll
2019-07-09 19:24 - 2019-06-13 08:09 - 001854976 _____ (Microsoft Corporation) C:\WINDOWS\system32\wevtsvc.dll
2019-07-09 19:24 - 2019-06-13 08:09 - 000922112 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Security.Authentication.Web.Core.dll
2019-07-09 19:24 - 2019-06-13 08:09 - 000755712 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Core.TextInput.dll
2019-07-09 19:24 - 2019-06-13 08:08 - 000506368 _____ (Microsoft Corporation) C:\WINDOWS\system32\edgeIso.dll
2019-07-09 19:24 - 2019-06-13 07:08 - 000443632 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\policymanager.dll
2019-07-09 19:24 - 2019-06-13 07:07 - 000101192 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rmclient.dll
2019-07-09 19:24 - 2019-06-13 07:07 - 000080744 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wldp.dll
2019-07-09 19:24 - 2019-06-13 07:06 - 001130776 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msvproc.dll
2019-07-09 19:24 - 2019-06-13 07:06 - 000581600 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MSVideoDSP.dll
2019-07-09 19:24 - 2019-06-13 06:49 - 000172544 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\enrollmentapi.dll
2019-07-09 19:24 - 2019-06-13 06:47 - 003554304 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\InputService.dll
2019-07-09 19:24 - 2019-06-13 06:47 - 002899456 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dwmcore.dll
2019-07-09 19:24 - 2019-06-13 06:47 - 000450048 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rastls.dll
2019-07-09 19:24 - 2019-06-13 06:46 - 000608768 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\EdgeManager.dll
2019-07-09 19:24 - 2019-06-13 06:46 - 000331776 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\edgeIso.dll
2019-07-09 19:24 - 2019-06-13 06:46 - 000038400 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TokenBrokerUI.dll
2019-07-09 19:24 - 2019-06-13 06:45 - 000602112 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\nshwfp.dll
2019-07-09 19:24 - 2019-06-13 06:45 - 000578560 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\webplatstorageserver.dll
2019-07-09 19:24 - 2019-06-13 06:44 - 001003008 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TokenBroker.dll
2019-07-09 19:24 - 2019-06-13 06:44 - 000648192 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.BackgroundMediaPlayback.dll
2019-07-09 19:24 - 2019-06-13 06:44 - 000630784 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.Playback.MediaPlayer.dll
2019-07-09 19:24 - 2019-06-13 06:44 - 000582144 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Core.TextInput.dll
2019-07-09 19:24 - 2019-06-13 06:44 - 000251904 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msIso.dll
2019-07-09 19:24 - 2019-06-13 06:43 - 000681472 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Security.Authentication.Web.Core.dll
2019-07-09 19:24 - 2019-06-13 06:43 - 000646656 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.Playback.BackgroundMediaPlayer.dll
2019-07-09 19:24 - 2019-06-13 06:43 - 000445952 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dmenrollengine.dll
2019-07-07 17:59 - 2019-07-07 18:10 - 234299675 _____ C:\Users\Lubka\Desktop\Tajemství (The secret).mp4
2019-07-06 12:14 - 2019-07-06 12:02 - 000543307 _____ C:\Users\Lubka\Desktop\banda_zlodejov_1.pdf

==================== One month (modified) ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2019-08-01 18:08 - 2018-12-20 22:18 - 000000000 ____D C:\Users\Jozko\AppData\LocalLow\Mozilla
2019-08-01 17:22 - 2018-12-14 18:53 - 000000000 ____D C:\WINDOWS\system32\SleepStudy
2019-08-01 17:16 - 2018-04-12 01:38 - 000000000 ____D C:\ProgramData\regid.1991-06.com.microsoft
2019-08-01 17:03 - 2018-04-12 01:38 - 000000000 ____D C:\WINDOWS\AppReadiness
2019-08-01 17:02 - 2018-04-12 01:38 - 000000000 ___HD C:\Program Files\WindowsApps
2019-08-01 16:46 - 2018-12-20 22:09 - 000730418 _____ C:\WINDOWS\system32\perfh007.dat
2019-08-01 16:46 - 2018-12-20 22:09 - 000149068 _____ C:\WINDOWS\system32\perfc007.dat
2019-08-01 16:46 - 2018-12-20 22:09 - 000116006 _____ C:\WINDOWS\system32\perfh01B.dat
2019-08-01 16:46 - 2018-12-20 22:09 - 000023440 _____ C:\WINDOWS\system32\perfc01B.dat
2019-08-01 16:46 - 2018-12-14 09:55 - 001841978 _____ C:\WINDOWS\system32\PerfStringBackup.INI
2019-08-01 16:46 - 2018-04-12 01:36 - 000000000 ____D C:\WINDOWS\INF
2019-08-01 16:41 - 2018-12-20 22:11 - 000000000 __SHD C:\Users\Jozko\IntelGraphicsProfiles
2019-08-01 16:41 - 2018-12-14 18:56 - 000000006 ____H C:\WINDOWS\Tasks\SA.DAT
2019-08-01 13:52 - 2018-12-20 22:11 - 000000000 ____D C:\Users\Jozko\AppData\Local\Packages
2019-08-01 13:40 - 2018-12-20 22:11 - 000000000 ____D C:\Users\Jozko
2019-08-01 13:37 - 2015-10-30 09:24 - 000000000 ___HD C:\WINDOWS\system32\GroupPolicy
2019-07-31 22:43 - 2018-12-20 22:22 - 000000000 ____D C:\Users\Jozko\Desktop\Alte Firefox-Daten
2019-07-31 20:01 - 2019-05-02 21:25 - 000000000 ____D C:\Users\Jozko\AppData\LocalLow\Temp
2019-07-31 19:08 - 2018-12-14 18:59 - 000000000 __SHD C:\Users\Lubka\IntelGraphicsProfiles
2019-07-30 22:27 - 2018-12-20 21:40 - 000000000 ____D C:\Users\Lubka\AppData\LocalLow\Mozilla
2019-07-30 21:17 - 2018-12-14 18:54 - 000000000 ____D C:\Users\Lubka
2019-07-30 21:05 - 2018-12-20 21:44 - 000000000 ____D C:\Users\Lubka\Desktop\Faktury-International-House
2019-07-30 20:43 - 2018-12-20 22:22 - 000000000 ____D C:\Users\Jozko\Documents\Korespondencia
2019-07-27 14:11 - 2018-12-14 18:56 - 000000000 ____D C:\WINDOWS\system32\Drivers\wd
2019-07-27 14:10 - 2018-12-14 11:22 - 000000000 ____D C:\ProgramData\Package Cache
2019-07-27 14:10 - 2018-12-14 11:22 - 000000000 ____D C:\Program Files (x86)\Intel
2019-07-25 03:25 - 2018-04-12 01:38 - 000000000 ____D C:\WINDOWS\InfusedApps.tmp
2019-07-25 02:42 - 2018-04-12 01:38 - 000000000 ____D C:\WINDOWS\InfusedApps
2019-07-25 02:38 - 2018-04-12 01:38 - 000000000 ____D C:\WINDOWS\registration
2019-07-25 01:38 - 2018-12-17 09:13 - 000000000 ____D C:\Users\Lubka\AppData\Local\D3DSCache
2019-07-25 01:01 - 2018-12-20 21:40 - 000000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2019-07-25 00:58 - 2018-04-12 01:38 - 000000000 ____D C:\WINDOWS\system32\NDF
2019-07-25 00:55 - 2019-01-05 16:50 - 000000000 ____D C:\Users\Lubka\AppData\Local\ElevatedDiagnostics
2019-07-24 23:06 - 2018-12-20 21:40 - 000001005 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Firefox.lnk
2019-07-24 22:59 - 2018-12-14 09:57 - 000000000 ____D C:\Users\Lubka\AppData\Local\VirtualStore
2019-07-24 21:16 - 2018-04-12 01:33 - 000466432 _____ (Microsoft Corporation) C:\WINDOWS\system32\dpnet.dll
2019-07-24 21:16 - 2018-04-12 01:33 - 000390656 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dpnet.dll
2019-07-24 21:16 - 2018-04-12 01:33 - 000218112 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dplayx.dll
2019-07-24 21:16 - 2018-04-12 01:33 - 000067584 _____ (Microsoft Corporation) C:\WINDOWS\system32\dpnathlp.dll
2019-07-24 21:16 - 2018-04-12 01:33 - 000061440 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dpnathlp.dll
2019-07-24 21:16 - 2018-04-12 01:33 - 000046592 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dpwsockx.dll
2019-07-24 21:16 - 2018-04-12 01:33 - 000026624 _____ (Microsoft Corporation) C:\WINDOWS\system32\dpnsvr.exe
2019-07-24 21:16 - 2018-04-12 01:33 - 000024064 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dpmodemx.dll
2019-07-24 21:16 - 2018-04-12 01:33 - 000023040 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dpnsvr.exe
2019-07-24 21:16 - 2018-04-12 01:33 - 000020480 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dplaysvr.exe
2019-07-24 21:16 - 2018-04-12 01:33 - 000010240 _____ (Microsoft Corporation) C:\WINDOWS\system32\dpnhupnp.dll
2019-07-24 21:16 - 2018-04-12 01:33 - 000010240 _____ (Microsoft Corporation) C:\WINDOWS\system32\dpnhpast.dll
2019-07-24 21:16 - 2018-04-12 01:33 - 000008704 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dpnhupnp.dll
2019-07-24 21:16 - 2018-04-12 01:33 - 000008704 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dpnhpast.dll
2019-07-24 21:16 - 2018-04-12 01:33 - 000006144 _____ (Microsoft Corporation) C:\WINDOWS\system32\dpnlobby.dll
2019-07-24 21:16 - 2018-04-12 01:33 - 000006144 _____ (Microsoft Corporation) C:\WINDOWS\system32\dpnaddr.dll
2019-07-24 21:16 - 2018-04-12 01:33 - 000005120 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dpnlobby.dll
2019-07-24 21:16 - 2018-04-12 01:33 - 000005120 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dpnaddr.dll
2019-07-24 21:16 - 2018-04-12 01:30 - 000000000 ____D C:\WINDOWS\CbsTemp
2019-07-17 14:09 - 2018-12-14 09:57 - 000000000 ____D C:\Users\Lubka\AppData\Local\Packages
2019-07-17 08:32 - 2018-12-14 11:11 - 000002313 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2019-07-17 08:32 - 2018-12-14 11:11 - 000002272 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2019-07-16 09:29 - 2018-12-20 21:44 - 000000000 ____D C:\Users\Lubka\Desktop\Meditacie
2019-07-16 08:14 - 2018-12-20 21:48 - 000000000 ____D C:\Users\Lubka\Documents\Ostatné
2019-07-13 17:03 - 2018-12-27 12:39 - 000000000 ____D C:\Users\Jozko\AppData\Local\Adobe
2019-07-13 17:03 - 2018-04-12 01:38 - 000000000 ____D C:\WINDOWS\SysWOW64\Macromed
2019-07-13 17:03 - 2018-04-12 01:38 - 000000000 ____D C:\WINDOWS\system32\Macromed
2019-07-13 17:02 - 2018-12-14 11:09 - 000000000 ____D C:\Users\Lubka\AppData\Local\Adobe
2019-07-13 16:47 - 2019-06-30 12:12 - 000000000 ____D C:\Users\Jozko\AppData\Roaming\InstallShield Installation Information
2019-07-13 14:43 - 2019-06-30 12:12 - 000000653 _____ C:\Users\Jozko\Desktop\Ip Camera Client.lnk
2019-07-13 13:57 - 2018-12-20 22:12 - 000000000 ___RD C:\Users\Jozko\OneDrive
2019-07-13 13:57 - 2018-12-20 22:11 - 000002383 _____ C:\Users\Jozko\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OneDrive.lnk
2019-07-13 13:56 - 2018-12-20 22:11 - 000000000 ___RD C:\Users\Jozko\3D Objects
2019-07-13 13:56 - 2018-12-14 09:57 - 000000000 __RHD C:\Users\Public\AccountPictures
2019-07-10 22:06 - 2018-12-14 10:50 - 000741432 ____N (Microsoft Corporation) C:\WINDOWS\system32\MpSigStub.exe
2019-07-09 21:11 - 2018-12-14 18:56 - 000000000 ___RD C:\Users\Lubka\3D Objects
2019-07-09 21:10 - 2018-12-14 18:53 - 000399520 _____ C:\WINDOWS\system32\FNTCACHE.DAT
2019-07-09 21:10 - 2018-04-12 19:08 - 000000000 ____D C:\Program Files\Windows Defender Advanced Threat Protection
2019-07-09 21:10 - 2018-04-12 01:38 - 000000000 ____D C:\WINDOWS\TextInput
2019-07-09 21:10 - 2018-04-12 01:38 - 000000000 ____D C:\WINDOWS\SysWOW64\oobe
2019-07-09 21:10 - 2018-04-12 01:38 - 000000000 ____D C:\WINDOWS\SysWOW64\Dism
2019-07-09 21:10 - 2018-04-12 01:38 - 000000000 ____D C:\WINDOWS\system32\oobe
2019-07-09 21:10 - 2018-04-12 01:38 - 000000000 ____D C:\WINDOWS\system32\appraiser
2019-07-09 21:10 - 2018-04-12 01:38 - 000000000 ____D C:\WINDOWS\ShellComponents
2019-07-09 21:10 - 2018-04-12 01:38 - 000000000 ____D C:\WINDOWS\Provisioning
2019-07-09 21:10 - 2018-04-12 01:38 - 000000000 ____D C:\WINDOWS\bcastdvr
2019-07-09 21:10 - 2018-04-11 23:04 - 000000000 ____D C:\WINDOWS\system32\Dism
2019-07-09 19:24 - 2018-12-14 10:49 - 000000000 ____D C:\WINDOWS\system32\MRT
2019-07-09 19:21 - 2018-12-14 10:49 - 136618864 ____C (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2019-07-09 15:31 - 2018-12-14 18:54 - 000002383 _____ C:\Users\Lubka\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OneDrive.lnk
2019-07-09 15:31 - 2018-12-14 09:59 - 000000000 ___RD C:\Users\Lubka\OneDrive
2019-07-02 16:55 - 2018-12-20 21:48 - 000000000 ____D C:\Users\Lubka\Documents\materialy na vyuku

==================== FLock ================

2019-07-30 20:27 C:\Config.Msi
2018-12-14 10:38 C:\MSOCache
2018-04-12 01:38 C:\PerfLogs
2019-08-01 17:02 C:\Program Files\WindowsApps
2018-12-14 18:56 C:\WINDOWS\diagerr.xml
2018-12-14 18:56 C:\WINDOWS\diagwrn.xml
2019-07-25 02:42 C:\WINDOWS\InfusedApps
2019-07-25 03:25 C:\WINDOWS\InfusedApps.tmp
2019-04-28 19:38 C:\WINDOWS\LiveKernelReports
2018-04-12 01:38 C:\WINDOWS\ModemLogs
2019-08-01 18:08 C:\WINDOWS\Prefetch
2018-04-12 01:38 C:\WINDOWS\ServiceState
2019-08-01 17:57 C:\WINDOWS\Temp
2019-07-30 20:03 C:\WINDOWS\system32\config
2018-04-12 01:38 C:\WINDOWS\system32\Configuration
2018-04-12 01:38 C:\WINDOWS\system32\DriverState
2018-12-20 22:27 C:\WINDOWS\system32\FxsTmp
2018-04-12 01:38 C:\WINDOWS\system32\ias
2018-04-12 01:38 C:\WINDOWS\system32\MsDtc
2018-04-12 01:38 C:\WINDOWS\system32\networklist
2019-08-01 17:22 C:\WINDOWS\system32\SleepStudy
2019-08-01 17:42 C:\WINDOWS\system32\sru
2019-08-01 18:05 C:\WINDOWS\system32\Tasks
2018-12-14 18:52 C:\WINDOWS\system32\Tasks_Migrated
2019-07-31 22:49 C:\WINDOWS\system32\WDI
2018-04-12 01:38 C:\WINDOWS\SysWOW64\config
2018-04-12 01:38 C:\WINDOWS\SysWOW64\Configuration
2018-04-12 01:38 C:\WINDOWS\SysWOW64\FxsTmp
2018-04-12 01:38 C:\WINDOWS\SysWOW64\Msdtc
2018-04-12 01:38 C:\WINDOWS\SysWOW64\networklist
2018-04-12 01:38 C:\WINDOWS\SysWOW64\sru
2018-04-12 01:38 C:\WINDOWS\SysWOW64\Tasks
2018-04-12 01:38 C:\WINDOWS\system32\Drivers\DriverData
2019-02-09 11:51 C:\ProgramData\Packages
2018-12-14 18:56 C:\ProgramData\USOPrivate
2018-04-12 19:08 C:\ProgramData\WindowsHolographicDevices
2019-07-25 00:58 C:\Users\Lubka\AppData\Local\Diagnostics
2019-07-25 00:55 C:\Users\Lubka\AppData\Local\ElevatedDiagnostics

==================== SigCheck ===============================

(There is no automatic fix for files that do not pass verification.)



ATTENTION: ==> Could not access BCD. The user is not administrator -> Der Speicher f�r die Startkonfigurationsdaten konnte nicht ge�ffnet werden.
Zugriff verweigert

==================== End of FRST.txt ============================
         

--- --- ---

--- --- ---

--- --- ---

Eset hat nur sehr kurze Resultat geliefert (unten)
auch wenn 31 Schädlinge gefunden

Dann hast du da was falsch gemacht... habs erst gestern selbst getestet.

Schau nochmal nach, ob du die ganze Logdatei noch findest.

Ran by Jozko (ATTENTION: The user is not administrator) on DESKTOP-3CK4O4E (Micro-Star International Co., Ltd. MS-7B33) (01-08-2019 18:09:17)

Nicht schon wieder...

Auch das könnte der Grund sein, warum die Logdatei von ESET unvollständig ist.


Denkst du, du bekommst es richtig hin ?

Ich hoffe, ich habe ESET log File gefunden.
Ich habe noch mal gescant und FIRST.txt und Adition.txt beigefügt.
Ich entschuldige mich, dass ich gestern nicht als Administrator gescannt habe.
Heute hoffe ich, dass es passt.

 16:45:14 # product=EOS
# version=8
# ESETOnlineScanner_DEU.exe=3.1.6.0
# country="Germany"
# lang=1031
16:48:55 Updating
16:48:55 Update Init
16:48:56 Update Download
16:52:39 esets_scanner_reload returned 0
16:52:39 g_uiModuleBuild: 42277
16:52:39 Update Finalize
16:52:39 Call m_esets_charon_send
16:52:39 Call m_esets_charon_destroy
16:52:39 Updated modules version: 42277
16:52:48 Call m_esets_charon_setup_create
16:52:48 Call m_esets_charon_create
16:52:49 m_esets_charon_create OK
16:52:49 Call m_esets_charon_start_send_thread
16:52:49 Call m_esets_charon_setup_set
16:52:49 m_esets_charon_setup_set OK
16:52:49 Scanner engine: 42277
18:05:58 # product=EOS
# version=8
# flags=0
# av=0
# fw=7
# admin=1
# ESETOnlineScanner_DEU.exe=3.1.6.0
# EOSSerial=ef8dee2af0ed76469689fa8520ab964f
# engine=42277
# end=finished
# bannerClicked=0
# remove_checked=true
# archives_checked=false
# unwanted_checked=true
# unsafe_checked=true
# antistealth_checked=true
# sfx_checked=true
# utc_time=2019-08-01 16:05:57
# local_time=2019-08-01 18:05:57 (+0100, Mitteleuropäische Sommerzeit )
# country="Germany"
# lang=1031
# osver=10.0.17134 NT 
# compatibility_mode_1=''
# compatibility_mode=5893 16776573 100 94 15271 41185919 0 0
# scanned=443641
# found=32
# cleaned=32
# scan_time=4374
# scan_type=2
# flow=2019-08-01 16:45:14|scr|intro|2019-08-01 16:45:15|scr|eula|2019-08-01 16:45:15|promo|eis|2019-08-01 16:45:17|scr|welcome|2019-08-01 16:46:06|scr|consents|2019-08-01 16:46:37|scr|scan_type|2019-08-01 16:46:39|scr|pua|2019-08-01 16:48:55|scr|updating|2019-08-01 16:52:39|scr|scanning|2019-08-01 18:05:34|scr|all_cleaned|2019-08-01 18:05:37|scr|periodic_offer|2019-08-01 18:05:41|scr|upsell|2019-08-01 18:05:55|scr|thanks
# periodic=0,0
# stats_enabled=1
sh=7FC4AFC34FDC6323BFDFD873820AF5BE130193E3 ft=1 fh=0000000000178808 vn="Variante von Win32/DownloadSponsor.C potenziell unerwünschte Anwendung (Gesäubert durch Löschen)" ac=C fn="C:\AdwCleaner\Quarantine\v1\20190730.202717\20\EXACT AUDIO COPY - CHIP-INSTALLER.EXE#21739ACB6E86C5B4"
sh=354DE28503B9BA60056709930B967152B9EC4933 ft=1 fh=0000000000149410 vn="Variante von Win32/DownloadSponsor.C potenziell unerwünschte Anwendung (Gesäubert durch Löschen)" ac=C fn="C:\AdwCleaner\Quarantine\v1\20190730.202717\21\MICROSOFT WINDOWS DEFENDER OFFLINE - CHIP-INSTALLER.EXE#EDC68C48F185D208"
sh=004E514129645D3CCB7DBC6972DFBEB9A1665857 ft=1 fh=0000000000045a00 vn="Variante von Win32/Adware.Neoreklami.EY Anwendung (Gesäubert durch Löschen)" ac=C fn="C:\FRST\Quarantine\C\Program Files (x86)\duxVclVEU\UcXfsx.dll"
sh=B85CEB7D47688A0C1CEB85F2DCC25DC260A4D34A ft=1 fh=000000000049c5f1 vn="Variante von Win32/Adware.Neoreklami.GQ Anwendung (Gesäubert durch Löschen)" ac=C fn="C:\FRST\Quarantine\C\Program Files (x86)\hhaccViKlMUn\knQHRWGacC.dll"
sh=54D35F17AA661ABA6FCA40BF0744ACCAED2C7D0E ft=1 fh=00000000000dba00 vn="Variante von Win32/Adware.Neoreklami.GX Anwendung (Gesäubert durch Löschen)" ac=C fn="C:\FRST\Quarantine\C\Program Files (x86)\minXQDMZbIE\DBTfImjmKZ.exe"
sh=92E9B9DFF92E7F7149434A5A3090854FB53E22E2 ft=1 fh=00000000000aca00 vn="Variante von Win32/Adware.Neoreklami.ET Anwendung (Gesäubert durch Löschen)" ac=C fn="C:\FRST\Quarantine\C\Program Files (x86)\minXQDMZbIE\kbxTcSEa.dll"
sh=1377EA581A4246377E8381A11991EB074FB72DF6 ft=1 fh=00000000000d1400 vn="Variante von Win64/Adware.Neoreklami.N Anwendung (Gesäubert durch Löschen)" ac=C fn="C:\FRST\Quarantine\C\Program Files (x86)\minXQDMZbIE\tMNwGvQ11.dll"
sh=6C77F756E32B2F7567A6F8349B8F29A5D82902C7 ft=1 fh=000000000007b600 vn="Variante von Win32/DNSChanger.NDV Trojaner (Gesäubert durch Löschen)" ac=C fn="C:\FRST\Quarantine\C\ProgramData\Loosger\temp.dll"
sh=885533A78BCA845C43D5904E10A303615798F461 ft=1 fh=0000000000060a00 vn="Variante von Win32/DNSChanger.NDV Trojaner (Gesäubert durch Löschen)" ac=C fn="C:\ProgramData\TmpLoog\tmplog.dll"
sh=0E928293568B678D2A79DD84905842B97C0E665A ft=1 fh=000000000008a604 vn="Variante von Win32/HackTool.Crack.DK potenziell unsichere Anwendung (Gesäubert durch Löschen)" ac=C fn="D:\Games\The Sims 4\Game\Bin\RldOrigin.dll"
sh=9B025B6F6A62F195E570498B057A4B312CAFEC27 ft=1 fh=0000000001c69a10 vn="Variante von Win32/IObit.E potenziell unerwünschte Anwendung,Variante von Win32/IObit.L potenziell unerwünschte Anwendung,Variante von Win32/IObit.M potenziell unerwünschte Anwendung,Variante von Win32/IObit.J potenziell unerwünschte Anwendung,Variante von Win32/IObit.D potenziell unerwünschte Anwendung (Gesäubert durch Löschen)" ac=C fn="D:\RECYCLER\S-1-5-21-220523388-1214440339-1801674531-1003\Dc2.exe"
sh=B12116CAB6DADD8934FCC84F7A2CF9A2A4D24577 ft=1 fh=000000000016d608 vn="Variante von Win32/DownloadSponsor.C potenziell unerwünschte Anwendung (Gesäubert durch Löschen)" ac=C fn="D:\So-stareho-pocitaca\Aktualne13122018\Users\Jozko\Desktop\Instalacia\Lubka13Feb2017\Desktop\Foxit Reader Deutsch - CHIP-Installer.exe"
sh=7FC4AFC34FDC6323BFDFD873820AF5BE130193E3 ft=1 fh=0000000000178808 vn="Variante von Win32/DownloadSponsor.C potenziell unerwünschte Anwendung (Gesäubert durch Löschen)" ac=C fn="D:\So-stareho-pocitaca\Aktualne13122018\Users\Lubka\Desktop\Exact Audio Copy - CHIP-Installer.exe"
sh=AB6F353B8016453C01932866F8666B4A4FC87180 ft=1 fh=0000000001b2ac30 vn="Variante von Win32/IObit.G potenziell unerwünschte Anwendung,Variante von Win32/IObit.L potenziell unerwünschte Anwendung,Variante von Win32/IObit.M potenziell unerwünschte Anwendung,Variante von Win32/IObit.J potenziell unerwünschte Anwendung,Variante von Win32/IObit.D potenziell unerwünschte Anwendung (Gesäubert durch Löschen)" ac=C fn="D:\So-stareho-pocitaca\Dokumente und Einstellungen\All Users\Anwendungsdaten\IObit\ASCDownloader\av11\ASCSetup.exe"
sh=8B855AF3A81A88CDD56D2A2AFBD5D1885D3C305C ft=1 fh=00000000025d3c00 vn="Variante von Win32/IObit.G potenziell unerwünschte Anwendung,Win32/IObit.J potenziell unerwünschte Anwendung,Variante von Win32/IObit.L potenziell unerwünschte Anwendung,Variante von Win32/IObit.M potenziell unerwünschte Anwendung,Variante von Win32/IObit.J potenziell unerwünschte Anwendung,Win32/IObit.D potenziell unerwünschte Anwendung,Variante von Win32/IObit.D potenziell unerwünschte Anwendung (Gesäubert durch Löschen)" ac=C fn="D:\So-stareho-pocitaca\Dokumente und Einstellungen\All Users\Anwendungsdaten\IObit\ASCDownloader\db4\Advanced SystemCare 10.exe"
sh=63E0DF5B2D89FFD2745C9BF9B6F59C58E2C2E16E ft=1 fh=0000000002869300 vn="Variante von Win32/IObit.S potenziell unerwünschte Anwendung,Variante von Win32/IObit.L potenziell unerwünschte Anwendung,Variante von Win32/IObit.E potenziell unerwünschte Anwendung,Variante von Win32/IObit.M potenziell unerwünschte Anwendung,Win32/IObit.D potenziell unerwünschte Anwendung,Variante von Win32/IObit.D potenziell unerwünschte Anwendung (Gesäubert durch Löschen)" ac=C fn="D:\So-stareho-pocitaca\Dokumente und Einstellungen\All Users\Anwendungsdaten\IObit\Driver Booster\Downloader\db5\IObit Malware Fighter.exe"
sh=B12116CAB6DADD8934FCC84F7A2CF9A2A4D24577 ft=1 fh=000000000016d608 vn="Variante von Win32/DownloadSponsor.C potenziell unerwünschte Anwendung (Gesäubert durch Löschen)" ac=C fn="D:\So-stareho-pocitaca\Dokumente und Einstellungen\tatino\Desktop\Instalacia\Lubka13Feb2017\Desktop\Foxit Reader Deutsch - CHIP-Installer.exe"
sh=979247E507387D81F48D8129E5C2C7F627691204 ft=1 fh=000000000031ab40 vn="Win32/Toolbar.Conduit potenziell unerwünschte Anwendung (gelöscht)" ac=C fn="D:\So-stareho-pocitaca\Dokumente und Einstellungen\tatino\Desktop\clean.exe"
sh=1318A60FEC4C78D76C74C5AAB1C24B08A0BBD879 ft=1 fh=00000000001dd520 vn="Variante von Win32/IObit.M potenziell unerwünschte Anwendung (Gesäubert durch Löschen)" ac=C fn="D:\So-stareho-pocitaca\Programme\IObit\Advanced SystemCare\Database\AutoUpdate.dat"
sh=C06C77F763AD3A5FC54658849174B54D016C787D ft=1 fh=0000000000247910 vn="Variante von Win32/IObit.L potenziell unerwünschte Anwendung (Gesäubert durch Löschen)" ac=C fn="D:\So-stareho-pocitaca\Programme\IObit\Advanced SystemCare\ActionCenterDownloader.exe"
sh=1318A60FEC4C78D76C74C5AAB1C24B08A0BBD879 ft=1 fh=00000000001dd520 vn="Variante von Win32/IObit.M potenziell unerwünschte Anwendung (Gesäubert durch Löschen)" ac=C fn="D:\So-stareho-pocitaca\Programme\IObit\Advanced SystemCare\AutoUpdate.exe"
sh=BB1AAEE47A461761E7ACFBC8CB27D6EE902EC7A6 ft=1 fh=000000000020b910 vn="Variante von Win32/IObit.M potenziell unerwünschte Anwendung (Gesäubert durch Löschen)" ac=C fn="D:\So-stareho-pocitaca\Programme\IObit\Advanced SystemCare\Register.exe"
sh=0A551B6B41094DEF5B82DE4687D52D304BA11EB2 ft=1 fh=0000000000283110 vn="Variante von Win32/IObit.J potenziell unerwünschte Anwendung (Gesäubert durch Löschen)" ac=C fn="D:\So-stareho-pocitaca\Programme\IObit\Advanced SystemCare\UninstallPromote.exe"
sh=C6C74FDF3D779F7B84D63E3D6CB54FDA5480C4C4 ft=1 fh=0000000000293120 vn="Variante von Win32/IObit.N potenziell unerwünschte Anwendung (Gesäubert durch Löschen)" ac=C fn="D:\So-stareho-pocitaca\Programme\IObit\Driver Booster\5.1.0\AutoUpdate.exe"
sh=7293B3F6CA44E139F0435BEB12B28CE7C4B901AB ft=1 fh=000000000059ab20 vn="Variante von Win32/IObit.Z potenziell unerwünschte Anwendung (Gesäubert durch Löschen)" ac=C fn="D:\So-stareho-pocitaca\Programme\IObit\Driver Booster\5.1.0\DriverBooster.exe"
sh=FCE5C86EA81CE55DBDBA237F009EB94D5AB49370 ft=1 fh=0000000000246f20 vn="Variante von Win32/IObit.L potenziell unerwünschte Anwendung (Gesäubert durch Löschen)" ac=C fn="D:\So-stareho-pocitaca\Programme\IObit\Driver Booster\5.1.0\IObitDownloader.exe"
sh=CD147088A32855C4575546CD18D3C542C616454B ft=1 fh=00000000001fa320 vn="Variante von Win32/IObit.L potenziell unerwünschte Anwendung (Gesäubert durch Löschen)" ac=C fn="D:\So-stareho-pocitaca\Programme\IObit\Driver Booster\5.1.0\Vulnerabilityfix.exe"
sh=5369D2EC60A6AD2BC3D1380010F02C4F5C54FB17 ft=1 fh=0000000000019b20 vn="Variante von MSIL/WebCompanion.D potenziell unerwünschte Anwendung (Gesäubert durch Löschen)" ac=C fn="D:\So-stareho-pocitaca\Programme\Lavasoft\Web Companion\Application\Lavasoft.Utils.dll"
sh=9144B028BB4317783A97ACFCD216E38C62FA9459 ft=1 fh=0000000000006520 vn="Variante von MSIL/WebCompanion.D potenziell unerwünschte Anwendung (Gesäubert durch Löschen)" ac=C fn="D:\So-stareho-pocitaca\Programme\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exe"
sh=5966A286F8556D8059C6146A252BFE5BD79018F0 ft=1 fh=0000000000709b20 vn="Variante von MSIL/WebCompanion.D potenziell unerwünschte Anwendung (Gesäubert durch Löschen)" ac=C fn="D:\So-stareho-pocitaca\Programme\Lavasoft\Web Companion\Application\WebCompanion.exe"
sh=59D85E357559DF8059547F04915EDDE2D9C616B7 ft=1 fh=000000000004fd20 vn="Variante von MSIL/WebCompanion.C potenziell unerwünschte Anwendung (Gesäubert durch Löschen)" ac=C fn="D:\So-stareho-pocitaca\Programme\Lavasoft\Web Companion\Application\WebCompanionInstaller.exe"
sh=23EE616CD11B185FB587B5A0C01CC4E5BAB902D7 ft=1 fh=0000000000056b90 vn="Variante von MSIL/WebCompanion.C potenziell unerwünschte Anwendung (Gesäubert durch Löschen)" ac=C fn="D:\So-stareho-pocitaca\WINDOWS\Temp\wctmp_460523251\WcInstaller.exe"
18:05:59 Call m_esets_charon_send
18:05:59 Call m_esets_charon_destroy
18:07:56 # product=EOS
# version=8
# ESETOnlineScanner_DEU.exe=3.1.6.0
# country="Germany"
# lang=1031
18:08:16 Updating
18:08:16 Update Init
18:08:25 Update Download
18:08:47 esets_scanner_reload returned 0
18:08:47 g_uiModuleBuild: 42279
18:08:47 Update Finalize
18:08:48 Call m_esets_charon_send
18:08:48 Call m_esets_charon_destroy
18:08:48 Updated modules version: 42279
18:08:57 Call m_esets_charon_setup_create
18:08:57 Call m_esets_charon_create
18:08:57 m_esets_charon_create OK
18:08:57 Call m_esets_charon_start_send_thread
18:08:57 Call m_esets_charon_setup_set
18:08:57 m_esets_charon_setup_set OK
18:08:57 Scanner engine: 42279
07:38:39 # product=EOS
# version=8
# flags=0
# av=0
# fw=7
# admin=1
# ESETOnlineScanner_DEU.exe=3.1.6.0
# EOSSerial=ef8dee2af0ed76469689fa8520ab964f
# engine=42279
# end=stopped
# bannerClicked=0
# remove_checked=true
# archives_checked=false
# unwanted_checked=true
# unsafe_checked=true
# antistealth_checked=true
# sfx_checked=true
# utc_time=2019-08-02 05:38:39
# local_time=2019-08-02 07:38:39 (+0100, Mitteleuropäische Sommerzeit )
# country="Germany"
# lang=1031
# osver=10.0.17134 NT 
# compatibility_mode_1=''
# compatibility_mode=5893 16776573 100 94 53210 41234681 0 0
# scanned=348668
# found=0
# cleaned=0
# scan_time=0
# scan_type=2
# flow=2019-08-01 18:07:56|scr|home|2019-08-01 18:07:57|promo|eis|2019-08-01 18:08:03|scr|scan_type|2019-08-01 18:08:04|scr|pua|2019-08-01 18:08:06|scr|updating|2019-08-01 18:08:48|scr|scanning|2019-08-01 18:09:42|click|help|2019-08-01 18:12:43|click|minimize|2019-08-01 18:16:03|click|minimize|2019-08-02 07:23:44|click|minimize|2019-08-02 07:38:31|scr|product_update|2019-08-02 07:38:34|scr|restart_resolved
# periodic=0,0
# stats_enabled=1
07:38:39 Call m_esets_charon_send
07:38:39 Call m_esets_charon_destroy
07:38:40 Call m_esets_charon_send
07:38:40 Call m_esets_charon_destroy
07:43:17 # product=EOS
# version=8
# ESETOnlineScanner_DEU.exe=3.1.6.0
# country="Germany"
# lang=1031
07:44:06 Updating
07:44:06 Update Init
07:44:15 Update Download
07:44:36 esets_scanner_reload returned 0
07:44:36 g_uiModuleBuild: 42285
07:44:36 Update Finalize
07:44:36 Call m_esets_charon_send
07:44:36 Call m_esets_charon_destroy
07:44:36 Updated modules version: 42285
07:44:45 Call m_esets_charon_setup_create
07:44:45 Call m_esets_charon_create
07:44:45 m_esets_charon_create OK
07:44:45 Call m_esets_charon_start_send_thread
07:44:45 Call m_esets_charon_setup_set
07:44:45 m_esets_charon_setup_set OK
07:44:45 Scanner engine: 42285
09:06:58 # product=EOS
# version=8
# flags=0
# av=0
# fw=7
# admin=1
# ESETOnlineScanner_DEU.exe=3.1.6.0
# EOSSerial=ef8dee2af0ed76469689fa8520ab964f
# engine=42285
# end=finished
# bannerClicked=0
# remove_checked=true
# archives_checked=false
# unwanted_checked=true
# unsafe_checked=true
# antistealth_checked=true
# sfx_checked=true
# utc_time=2019-08-02 07:06:58
# local_time=2019-08-02 09:06:58 (+0100, Mitteleuropäische Sommerzeit )
# country="Germany"
# lang=1031
# osver=10.0.17134 NT 
# compatibility_mode_1=''
# compatibility_mode=5893 16776573 100 94 51598 41239980 0 0
# scanned=445671
# found=0
# cleaned=0
# scan_time=4175
# scan_type=2
# flow=2019-08-02 07:43:17|scr|home|2019-08-02 07:43:19|promo|eis|2019-08-02 07:43:21|scr|scan_type|2019-08-02 07:43:25|scr|pua|2019-08-02 07:43:56|scr|updating|2019-08-02 07:44:36|scr|scanning|2019-08-02 08:54:12|scr|restart_resolved|2019-08-02 09:05:50|scr|periodic_offer|2019-08-02 09:06:13|scr|upsell|2019-08-02 09:06:16|scr|thanks_short|2019-08-02 09:06:19|click|minimize|2019-08-02 09:06:37|click|minimize|2019-08-02 09:06:52|click|minimize
# periodic=0,0
# stats_enabled=1
# rating=0
# feedback=
09:06:59 Call m_esets_charon_send
09:06:59 Call m_esets_charon_destroy
09:07:00 Call m_esets_charon_send
09:07:00 Call m_esets_charon_destroy
         

[CODE]Additional
FRST Logfile:

scan result of Farbar Recovery Scan Tool (x64) Version: 31-07-2019
Ran by Lubka (02-08-2019 17:00:17)
Running from C:\Users\Jozko\Desktop
Windows 10 Pro Version 1803 17134.885 (X64) (2018-12-14 16:56:48)
Boot Mode: Normal
==========================================================


==================== Accounts: =============================

Administrator (S-1-5-21-1960842775-2088100534-3542962694-500 - Administrator - Disabled)
DefaultAccount (S-1-5-21-1960842775-2088100534-3542962694-503 - Limited - Disabled)
Guest (S-1-5-21-1960842775-2088100534-3542962694-501 - Limited - Disabled)
Jozko (S-1-5-21-1960842775-2088100534-3542962694-1002 - Limited - Enabled) => C:\Users\Jozko
Lubka (S-1-5-21-1960842775-2088100534-3542962694-1001 - Administrator - Enabled) => C:\Users\Lubka
WDAGUtilityAccount (S-1-5-21-1960842775-2088100534-3542962694-504 - Limited - Disabled)

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

Adobe Acrobat Reader DC - Slovak (HKLM-x32\...\{AC76BA86-7AD7-1051-7B44-AC0F074E4100}) (Version: 19.012.20035 - Adobe Systems Incorporated)
Adobe Flash Player 32 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 32.0.0.223 - Adobe)
Age of Empires complete version 1.0c (HKLM-x32\...\{F7F0D70E-9027-4DF5-B67F-4B48CE29565A}_is1) (Version: 1.0c - vol1)
Balík softvéru eID (HKLM-x32\...\{69aff1f0-e530-4ac2-ab4f-88cb85aef940}) (Version: 1.0.0.0 - Ministerstvo vnútra Slovenskej republiky) Hidden
Balík softvéru eID (HKLM-x32\...\{d0db994b-7bbf-4a97-86ae-8e47ef7363e5}) (Version: 1.0.0.0 - Ministerstvo vnútra Slovenskej republiky) Hidden
Bit4id - miniLector (HKLM-x32\...\Bit4id - miniLector) (Version: 3.7 - Bit4id)
D.Launcher (x86) (HKLM-x32\...\{8A22CEA0-9DB7-4E30-898A-6D70F4E650CE}) (Version: 1.1.0.0 - DITEC, a.s.)
D.Signer/XAdES .NET so zásuvnými modulmi (x86) (HKLM-x32\...\{EB7D7F94-A539-4248-BCA3-2B105845284C}) (Version: 4.0.13 - DITEC, a.s.)
D.Signer/XAdES .NET Tools (x86) (HKLM-x32\...\{26E941A2-1EFF-4A3F-AD0B-6A423EFC2AAA}) (Version: 4.0.9 - DITEC, a.s.)
D.Suite/eIDAS (x86) (HKLM-x32\...\{f6fbc4ed-b1f8-4f4c-9b23-5b8e64af50b4}) (Version: 1.0.15 - DITEC, a.s.)
D.Viewer .NET (x86) (HKLM-x32\...\{967D2DE1-4E53-4700-9ED4-E4BCCD27E8F9}) (Version: 4.0.2025 - DITEC, a.s.)
Disig Web Signer 1.0.7 (HKLM-x32\...\{DD3FDF40-D8A3-454D-8A43-B53F90FB1ED7}) (Version: 1.1.8 - Disig)
DiskProtect18891 version 16.91 (HKLM-x32\...\{06B8AD54-D556-4771-A39B-A04135966F15}_is1) (Version: 16.91 - )
EAC MW klient (HKLM-x32\...\{3C1EB559-A939-4569-8EDE-006675312B46}) (Version: 3.1.3 - Ministerstvo vnútra Slovenskej republiky)
EPSON BX535WD Series Printer Uninstall (HKLM\...\EPSON BX535WD Series) (Version:  - SEIKO EPSON Corporation)
EPSON Scan (HKLM-x32\...\EPSON Scanner) (Version:  - Seiko Epson Corporation)
EpsonNet Print (HKLM-x32\...\{3E31400D-274E-4647-916C-2CACC3741799}) (Version: 2.6.0 - SEIKO EPSON CORPORATION)
GemPcCCID (HKLM\...\{39417D48-AC92-47A7-9F53-3CA2049231B0}) (Version: 2.0.7 - Gemalto)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 75.0.3770.142 - Google LLC)
Google Earth Pro (HKLM\...\{70A0F34E-564B-4F93-ADD6-3BAEC6E44075}) (Version: 7.3.2.5776 - Google)
Google Update Helper (HKLM-x32\...\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}) (Version: 1.3.34.11 - Google LLC) Hidden
HiPlayer (HKU\S-1-5-21-1960842775-2088100534-3542962694-1002\...\{1AE35ED9-955E-40D0-8811-FFD8F0E2A9F3}) (Version: 1.2 - Hi)
Intel Driver && Support Assistant (HKLM-x32\...\{CF18558A-3642-4C4D-A551-23275D1FCE16}) (Version: 19.7.30.2 - Intel) Hidden
Intel(R) Computing Improvement Program (HKLM\...\{D40D4164-EEDB-4F0F-85C6-2058A9E34CC7}) (Version: 2.4.04370 - Intel Corporation)
Intel(R) Management Engine Components (HKLM\...\{1CEAC85D-2590-4760-800F-8DE5E91F3700}) (Version: 1831.12.0.1156 - Intel Corporation)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 24.20.100.6291 - Intel Corporation)
Intel(R) Trusted Connect Service Client x86 (HKLM-x32\...\{C9552825-7BF2-4344-BA91-D3CD46F4C441}) (Version: 1.50.369.0 - Intel Corporation) Hidden
Intel(R) Trusted Connect Services Client (HKLM-x32\...\{aa81bdf2-96a6-4400-a596-c7d1916ce9f7}) (Version: 1.50.369.0 - Intel Corporation) Hidden
Intel® Chipset Device Software (HKLM-x32\...\{262e9c1d-e509-4e2a-86e8-0abb312ac2e9}) (Version: 10.1.17765.8094 - Intel(R) Corporation) Hidden
Intel® Driver & Support Assistant (HKLM-x32\...\{12d2d1d9-5223-431d-96ac-6a82d3a1391c}) (Version: 19.7.30.2 - Intel)
Intel® Driver & Support Assistant (HKLM-x32\...\{dbe96554-7594-4bba-b7c5-fc6c72dbaa39}) (Version: 19.6.26.3 - Intel)
IP Camera (HKU\S-1-5-21-1960842775-2088100534-3542962694-1002\...\{3E6DEA84-3FA0-472E-B0DB-927655097022}) (Version: 2.0.4.6 - hi)
Java 8 Update 211 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F64180211F0}) (Version: 8.0.2110.12 - Oracle Corporation)
K-Lite Mega Codec Pack 14.5.5 (HKLM-x32\...\KLiteCodecPack_is1) (Version: 14.5.5 - KLCP)
Malwarebytes Version 3.8.3.2965 (HKLM\...\{35065F43-4BB2-439A-BFF7-0F1014F2E0CD}_is1) (Version: 3.8.3.2965 - Malwarebytes)
Microsoft Office 2016 Professional Plus (HKLM-x32\...\Office16.PROPLUS) (Version: 16.0.4266.1001 - Microsoft Corporation)
Microsoft OneDrive (HKU\S-1-5-21-1960842775-2088100534-3542962694-1001\...\OneDriveSetup.exe) (Version: 19.103.0527.0003 - Microsoft Corporation)
Microsoft OneDrive (HKU\S-1-5-21-1960842775-2088100534-3542962694-1002\...\OneDriveSetup.exe) (Version: 19.103.0527.0003 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.30319 (HKLM\...\{DA5E371C-6333-3D8A-93A4-6FD5B20BCC6E}) (Version: 10.0.30319 - Microsoft Corporation)
Microsoft Visual C++ 2015 Redistributable (x64) - 14.0.23026 (HKLM-x32\...\{e46eca4f-393b-40df-9f49-076faf788d83}) (Version: 14.0.23026.0 - Microsoft Corporation)
Microsoft Visual C++ 2015 Redistributable (x86) - 14.0.23026 (HKLM-x32\...\{74d0e5db-b326-4dae-a6b2-445b9de1836e}) (Version: 14.0.23026.0 - Microsoft Corporation)
Mozilla Firefox 68.0.1 (x64 de) (HKLM\...\Mozilla Firefox 68.0.1 (x64 de)) (Version: 68.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 64.0 - Mozilla)
Nástroje kontroly pravopisu pro Microsoft Office 2016 – čeština (HKLM-x32\...\{90160000-001F-0405-0000-0000000FF1CE}) (Version: 16.0.4266.1001 - Microsoft Corporation) Hidden
Nástroje korektúry balíka Microsoft Office 2016 - slovenčina (HKLM-x32\...\{90160000-001F-041B-0000-0000000FF1CE}) (Version: 16.0.4266.1001 - Microsoft Corporation) Hidden
OLYMPUS CAMEDIA Master 4.1 (HKLM-x32\...\{30BB4D60-81DB-11D5-BB77-00400536ABAC}) (Version:  - )
QuickTime (HKLM-x32\...\QuickTime) (Version:  - )
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 10.31.828.2018 - Realtek)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.8581 - Realtek Semiconductor Corp.)
SPORE Collection (HKLM-x32\...\SPORE Collection_is1) (Version:  - )
SSC Service Utility v4.30 (HKLM-x32\...\SSC Service Utility_is1) (Version:  - SSC Localization Group)
Steam (HKLM-x32\...\Steam) (Version: 2.10.91.91 - Valve Corporation)
TAP-Windows 9.21.2 (HKLM\...\TAP-Windows) (Version: 9.21.2 - )
TextPad (HKLM-x32\...\{ADBBED4F-720B-460D-AA14-D85EBC4AEF97}) (Version:  - )
Update for Windows 10 for x64-based Systems (KB4023057) (HKLM\...\{16AD6161-2E47-4BF1-AA77-0946EFE93E08}) (Version: 2.61.0.0 - Microsoft Corporation)
UpdateAssistant (HKLM\...\{EC4F72E8-52FE-454E-B70F-DBE5C0FA44C5}) (Version: 1.20.0.0 - Microsoft Corporation) Hidden
web control version 3.0.6.7 (HKLM-x32\...\{F88ED86C-0010-4943-BA16-72E4184E31ED}_is1) (Version: 3.0.6.7 - )
WinRAR 5.71 (32-bit) (HKLM-x32\...\WinRAR archiver) (Version: 5.71.0 - win.rar GmbH)

Packages:
=========
Candy Crush Soda Saga -> C:\Program Files\WindowsApps\king.com.CandyCrushSodaSaga_1.143.600.0_x86__kgqvnymyfvs32 [2019-07-25] (king.com)
Dolby Access -> C:\Program Files\WindowsApps\DolbyLaboratories.DolbyAccess_2.4.520.0_x64__rz1tebttyb220 [2019-07-25] (Dolby Laboratories)
Mail und Kalender -> C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe [2019-07-25] (Microsoft Corporation) [MS Ad]
Microsoft Advertising SDK for XAML -> C:\Program Files\WindowsApps\Microsoft.Advertising.Xaml_10.1811.1.0_x64__8wekyb3d8bbwe [2019-07-25] (Microsoft Corporation) [MS Ad]
Microsoft Advertising SDK for XAML -> C:\Program Files\WindowsApps\Microsoft.Advertising.Xaml_10.1811.1.0_x86__8wekyb3d8bbwe [2019-07-25] (Microsoft Corporation) [MS Ad]
Microsoft Begleiter für Telefon -> C:\Program Files\WindowsApps\Microsoft.WindowsPhone_10.1802.311.0_x64__8wekyb3d8bbwe [2019-07-25] (Microsoft Corporation)
Microsoft News – Nachrichten -> C:\Program Files\WindowsApps\Microsoft.BingNews_4.31.11905.0_x64__8wekyb3d8bbwe [2019-07-25] (Microsoft Corporation) [MS Ad]
Microsoft Solitaire Collection -> C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.6132.0_x64__8wekyb3d8bbwe [2019-07-25] (Microsoft Studios) [MS Ad]
Microsoft-Telefon -> C:\Program Files\WindowsApps\Microsoft.CommsPhone_3.43.20002.1000_x64__8wekyb3d8bbwe [2019-07-25] (Microsoft Corporation)
MSN Finanzen -> C:\Program Files\WindowsApps\Microsoft.BingFinance_4.31.11905.0_x64__8wekyb3d8bbwe [2019-07-25] (Microsoft Corporation) [MS Ad]
MSN Sport -> C:\Program Files\WindowsApps\Microsoft.BingSports_4.31.11905.0_x64__8wekyb3d8bbwe [2019-07-25] (Microsoft Corporation) [MS Ad]
MSN Wetter -> C:\Program Files\WindowsApps\Microsoft.BingWeather_4.31.11905.0_x64__8wekyb3d8bbwe [2019-07-25] (Microsoft Corporation) [MS Ad]

==================== Custom CLSID (Whitelisted): ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

CustomCLSID: HKU\S-1-5-21-1960842775-2088100534-3542962694-1001_Classes\CLSID\{233525e0-5434-46ef-b464-fd7e45e2e145}\localserver32 -> C:\Program Files (x86)\Intel\Driver and Support Assistant\DSATray.exe (IDSA Production signing key -> Intel)
CustomCLSID: HKU\S-1-5-21-1960842775-2088100534-3542962694-1002_Classes\CLSID\{233525e0-5434-46ef-b464-fd7e45e2e145}\localserver32 -> C:\Program Files (x86)\Intel\Driver and Support Assistant\DSATray.exe (IDSA Production signing key -> Intel)
ContextMenuHandlers1: [7-Zip] -> {23170F69-40C1-278A-1000-000100020000} =>  -> No File
ContextMenuHandlers1: [ANotepad++64] -> {B298D29A-A6ED-11DE-BA8C-A68E55D89593} =>  -> No File
ContextMenuHandlers1: [BriefcaseMenu] -> {85BBD920-42A0-1069-A2E4-08002B30309D} =>  -> No File
ContextMenuHandlers1-x32: [TextPad] -> {2F25CF20-C569-11D1-B94C-00608CB45480} => C:\Program Files (x86)\TextPad 4\System\shellext.dll [2001-07-21] (Helios Software Solutions) [File not signed]
ContextMenuHandlers1: [WinRAR] -> {B41DB860-64E4-11D2-9906-E49FADC173CA} => C:\Program Files (x86)\WinRAR\rarext64.dll [2019-04-27] (win.rar GmbH -> Alexander Roshal)
ContextMenuHandlers1-x32: [WinRAR32] -> {B41DB860-8EE4-11D2-9906-E49FADC173CA} => C:\Program Files (x86)\WinRAR\rarext.dll [2019-04-27] (win.rar GmbH -> Alexander Roshal)
ContextMenuHandlers3: [MBAMShlExt] -> {57CE581A-0CB6-4266-9CA0-19364C90A0B3} => C:\Program Files\Malwarebytes\Anti-Malware\mbshlext.dll [2019-06-26] (Malwarebytes Corporation -> Malwarebytes)
ContextMenuHandlers3: [{4A7C4306-57E0-4C0C-83A9-78C1528F618C}] -> {4A7C4306-57E0-4C0C-83A9-78C1528F618C} =>  -> No File
ContextMenuHandlers4: [7-Zip] -> {23170F69-40C1-278A-1000-000100020000} =>  -> No File
ContextMenuHandlers5: [igfxcui] -> {3AB1675A-CCFF-11D2-8B20-00A0C93CB1F4} =>  -> No File
ContextMenuHandlers5: [igfxDTCM] -> {9B5F5829-A529-4B12-814A-E81BCB8D93FC} => C:\WINDOWS\System32\DriverStore\FileRepository\cui_dc_comp.inf_amd64_1c77f1231c19bc72\igfxDTCM.dll [2018-11-02] (Microsoft Windows Hardware Compatibility Publisher -> Intel Corporation)
ContextMenuHandlers6: [BriefcaseMenu] -> {85BBD920-42A0-1069-A2E4-08002B30309D} =>  -> No File
ContextMenuHandlers6: [MBAMShlExt] -> {57CE581A-0CB6-4266-9CA0-19364C90A0B3} => C:\Program Files\Malwarebytes\Anti-Malware\mbshlext.dll [2019-06-26] (Malwarebytes Corporation -> Malwarebytes)
ContextMenuHandlers6: [WinRAR] -> {B41DB860-64E4-11D2-9906-E49FADC173CA} => C:\Program Files (x86)\WinRAR\rarext64.dll [2019-04-27] (win.rar GmbH -> Alexander Roshal)
ContextMenuHandlers6-x32: [WinRAR32] -> {B41DB860-8EE4-11D2-9906-E49FADC173CA} => C:\Program Files (x86)\WinRAR\rarext.dll [2019-04-27] (win.rar GmbH -> Alexander Roshal)

==================== Shortcuts & WMI ========================

(The entries could be listed to be restored or removed.)


Shortcut: C:\Users\Public\Desktop\Age of Empires - The Rise of Rome color fix.lnk -> C:\Program Files (x86)\Age of Empires complete\EMPIRESX.bat ()
Shortcut: C:\Users\Public\Desktop\Age of Empires color fix.lnk -> C:\Program Files (x86)\Age of Empires complete\Empires.bat ()

==================== Loaded Modules (Whitelisted) ==============

2018-12-20 22:32 - 2012-11-12 16:15 - 000558592 _____ (SEIKO EPSON CORPORATION) [File not signed] C:\WINDOWS\System32\enppmon.dll
2018-12-20 22:32 - 2012-10-22 18:19 - 000219648 _____ (SEIKO EPSON CORPORATION) [File not signed] C:\WINDOWS\System32\enpres.dll

==================== Alternate Data Streams (Whitelisted) =========

(If an entry is included in the fixlist, only the ADS will be removed.)


==================== Safe Mode (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MBAMService => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MBAMService => ""="Service"

==================== Association (Whitelisted) ===============

(If an entry is included in the fixlist, the registry item will be restored to default or removed.)


==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, it will be removed from the registry.)


==================== Hosts content: ===============================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2015-10-30 09:24 - 2019-07-31 22:38 - 000000027 _____ C:\WINDOWS\system32\drivers\etc\hosts

127.0.0.1       localhost

==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKLM\System\CurrentControlSet\Control\Session Manager\Environment\\Path -> C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\iCLS\;C:\Program Files\Intel\Intel(R) Management Engine Components\iCLS\;%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem;%SYSTEMROOT%\System32\WindowsPowerShell\v1.0\;C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL;C:\Program Files\Intel\Intel(R) Management Engine Components\DAL;%SYSTEMROOT%\System32\OpenSSH\;C:\Program Files (x86)\EAC MW klient\
HKU\S-1-5-21-1960842775-2088100534-3542962694-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\Lubka\Desktop\foto.JPG
HKU\S-1-5-21-1960842775-2088100534-3542962694-1002\Control Panel\Desktop\\Wallpaper -> C:\Users\Jozko\Pictures\Saved Pictures\19713_en_1.jfif
DNS Servers: 192.168.1.1 - 195.146.128.62
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer => (SmartScreenEnabled: RequireAdmin)
Windows Firewall is enabled.

==================== MSCONFIG/TASK MANAGER disabled items ==

If an entry is included in the fixlist, it will be removed.


==================== FirewallRules (Whitelisted) ===============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== Restore Points =========================

30-07-2019 21:03:57 Scheduled Checkpoint

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (08/02/2019 04:49:50 PM) (Source: dLauncherLoopback) (EventID: 0) (User: )
Description: Event-ID 0

Error: (08/01/2019 04:41:52 PM) (Source: dLauncherLoopback) (EventID: 0) (User: )
Description: Event-ID 0

Error: (08/01/2019 04:39:46 PM) (Source: dLauncherLoopback) (EventID: 0) (User: )
Description: Event-ID 0

Error: (08/01/2019 01:41:00 PM) (Source: dLauncherLoopback) (EventID: 0) (User: )
Description: Event-ID 0

Error: (08/01/2019 01:38:40 PM) (Source: dLauncherLoopback) (EventID: 0) (User: )
Description: Event-ID 0

Error: (08/01/2019 01:36:11 PM) (Source: dLauncherLoopback) (EventID: 0) (User: )
Description: Event-ID 0

Error: (07/31/2019 10:48:02 PM) (Source: dLauncherLoopback) (EventID: 0) (User: )
Description: Event-ID 0

Error: (07/31/2019 10:39:40 PM) (Source: dLauncherLoopback) (EventID: 0) (User: )
Description: Event-ID 0


System errors:
=============
Error: (08/02/2019 04:51:35 PM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: Durch die Berechtigungseinstellungen für "application-specific" wird dem Benutzer "NT AUTHORITY\SYSTEM" (SID: S-1-5-18) unter der Adresse "LocalHost (Using LRPC)" keine Berechtigung vom Typ "Local Launch" für die COM-Serveranwendung mit der CLSID 
Windows.SecurityCenter.WscDataProtection
 und der APPID 
Unavailable
 im Anwendungscontainer "Unavailable" (SID: Unavailable) gewährt. Die Sicherheitsberechtigung kann mit dem Verwaltungstool für Komponentendienste geändert werden.

Error: (08/02/2019 04:51:35 PM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: Durch die Berechtigungseinstellungen für "application-specific" wird dem Benutzer "NT AUTHORITY\SYSTEM" (SID: S-1-5-18) unter der Adresse "LocalHost (Using LRPC)" keine Berechtigung vom Typ "Local Launch" für die COM-Serveranwendung mit der CLSID 
Windows.SecurityCenter.WscBrokerManager
 und der APPID 
Unavailable
 im Anwendungscontainer "Unavailable" (SID: Unavailable) gewährt. Die Sicherheitsberechtigung kann mit dem Verwaltungstool für Komponentendienste geändert werden.

Error: (08/02/2019 04:51:31 PM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: Der Dienst "Energy Server Service queencreek" wurde mit folgendem Fehler beendet: 
Debugger hat Steuerung C empfangen.

Error: (08/02/2019 04:49:50 PM) (Source: DCOM) (EventID: 10016) (User: DESKTOP-3CK4O4E)
Description: Durch die Berechtigungseinstellungen für "application-specific" wird dem Benutzer "DESKTOP-3CK4O4E\Jozko" (SID: S-1-5-21-1960842775-2088100534-3542962694-1002) unter der Adresse "LocalHost (Using LRPC)" keine Berechtigung vom Typ "Local Activation" für die COM-Serveranwendung mit der CLSID 
{8BC3F05E-D86B-11D0-A075-00C04FB68820}
 und der APPID 
{8BC3F05E-D86B-11D0-A075-00C04FB68820}
 im Anwendungscontainer "Microsoft.Windows.ContentDeliveryManager_10.0.17134.1_neutral_neutral_cw5n1h2txyewy" (SID: S-1-15-2-350187224-1905355452-1037786396-3028148496-2624191407-3283318427-1255436723) gewährt. Die Sicherheitsberechtigung kann mit dem Verwaltungstool für Komponentendienste geändert werden.

Error: (08/02/2019 04:49:49 PM) (Source: DCOM) (EventID: 10016) (User: DESKTOP-3CK4O4E)
Description: Durch die Berechtigungseinstellungen für "application-specific" wird dem Benutzer "DESKTOP-3CK4O4E\Jozko" (SID: S-1-5-21-1960842775-2088100534-3542962694-1002) unter der Adresse "LocalHost (Using LRPC)" keine Berechtigung vom Typ "Local Activation" für die COM-Serveranwendung mit der CLSID 
{8BC3F05E-D86B-11D0-A075-00C04FB68820}
 und der APPID 
{8BC3F05E-D86B-11D0-A075-00C04FB68820}
 im Anwendungscontainer "Microsoft.Windows.ContentDeliveryManager_10.0.17134.1_neutral_neutral_cw5n1h2txyewy" (SID: S-1-15-2-350187224-1905355452-1037786396-3028148496-2624191407-3283318427-1255436723) gewährt. Die Sicherheitsberechtigung kann mit dem Verwaltungstool für Komponentendienste geändert werden.

Error: (08/02/2019 04:49:34 PM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: Durch die Berechtigungseinstellungen für "application-specific" wird dem Benutzer "NT AUTHORITY\LOCAL SERVICE" (SID: S-1-5-19) unter der Adresse "LocalHost (Using LRPC)" keine Berechtigung vom Typ "Local Activation" für die COM-Serveranwendung mit der CLSID 
{6B3B8D23-FA8D-40B9-8DBD-B950333E2C52}
 und der APPID 
{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}
 im Anwendungscontainer "Unavailable" (SID: Unavailable) gewährt. Die Sicherheitsberechtigung kann mit dem Verwaltungstool für Komponentendienste geändert werden.

Error: (08/02/2019 04:49:34 PM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: Durch die Berechtigungseinstellungen für "application-specific" wird dem Benutzer "NT AUTHORITY\LOCAL SERVICE" (SID: S-1-5-19) unter der Adresse "LocalHost (Using LRPC)" keine Berechtigung vom Typ "Local Activation" für die COM-Serveranwendung mit der CLSID 
{6B3B8D23-FA8D-40B9-8DBD-B950333E2C52}
 und der APPID 
{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}
 im Anwendungscontainer "Unavailable" (SID: Unavailable) gewährt. Die Sicherheitsberechtigung kann mit dem Verwaltungstool für Komponentendienste geändert werden.

Error: (08/02/2019 04:49:25 PM) (Source: Microsoft-Windows-Ntfs) (EventID: 98) (User: NT AUTHORITY)
Description: C:\Device\HarddiskVolume23


Windows Defender:
===================================
Date: 2019-08-02 09:05:29.447
Description: 
Die Windows Defender Antivirus-Überprüfung wurde vor ihrem Abschluss beendet.
Überprüfungs-ID: {563498E3-E0BF-4C8A-81AF-AB8A07ABE366}
Überprüfungstyp: Antimalware
Überprüfungsparameter: Schnellüberprüfung
Benutzer: NT AUTHORITY\SYSTEM

Date: 2019-08-02 07:50:56.329
Description: 
Die Windows Defender Antivirus-Überprüfung wurde vor ihrem Abschluss beendet.
Überprüfungs-ID: {143FDCDF-C87F-41F2-86FD-5F7F65FAF1D4}
Überprüfungstyp: Antimalware
Überprüfungsparameter: Schnellüberprüfung
Benutzer: NT AUTHORITY\SYSTEM

Date: 2019-08-01 17:25:39.688
Description: 
Die Windows Defender Antivirus-Überprüfung wurde vor ihrem Abschluss beendet.
Überprüfungs-ID: {DFF5225B-29C4-43EA-80B3-092CCF6C502F}
Überprüfungstyp: Antimalware
Überprüfungsparameter: Schnellüberprüfung
Benutzer: NT AUTHORITY\SYSTEM

Date: 2019-08-01 17:15:43.350
Description: 
Die Windows Defender Antivirus-Überprüfung wurde vor ihrem Abschluss beendet.
Überprüfungs-ID: {1A731123-6AD7-434B-A31C-E228B84BFA17}
Überprüfungstyp: Antimalware
Überprüfungsparameter: Schnellüberprüfung
Benutzer: NT AUTHORITY\SYSTEM

Date: 2019-08-01 17:00:13.718
Description: 
Die Windows Defender Antivirus-Überprüfung wurde vor ihrem Abschluss beendet.
Überprüfungs-ID: {83BC08A2-D642-4535-8DF8-A3473BDCE83C}
Überprüfungstyp: Antimalware
Überprüfungsparameter: Schnellüberprüfung
Benutzer: NT AUTHORITY\SYSTEM

Date: 2019-07-31 20:37:02.389
Description: 
Fehler von Windows Defender Antivirus beim Aktualisieren von Signaturen.
Neue Signaturversion: 
Vorherige Signaturversion: 1.299.631.0
Updatequelle: Microsoft Center zum Schutz vor Schadsoftware
Signaturtyp: AntiVirus
Updatetyp: Voll
Benutzer: NT AUTHORITY\NETWORK SERVICE
Aktuelle Modulversion: 
Vorherige Modulversion: 1.1.16200.1
Fehlercode: 0x80072ee7
Fehlerbeschreibung: The server name or address could not be resolved 

Date: 2019-07-31 20:37:02.389
Description: 
Fehler von Windows Defender Antivirus beim Aktualisieren von Signaturen.
Neue Signaturversion: 
Vorherige Signaturversion: 1.299.631.0
Updatequelle: Microsoft Center zum Schutz vor Schadsoftware
Signaturtyp: AntiSpyware
Updatetyp: Voll
Benutzer: NT AUTHORITY\NETWORK SERVICE
Aktuelle Modulversion: 
Vorherige Modulversion: 1.1.16200.1
Fehlercode: 0x80072ee7
Fehlerbeschreibung: The server name or address could not be resolved 

Date: 2019-07-31 20:37:02.389
Description: 
Fehler von Windows Defender Antivirus beim Aktualisieren von Signaturen.
Neue Signaturversion: 
Vorherige Signaturversion: 1.299.631.0
Updatequelle: Microsoft Center zum Schutz vor Schadsoftware
Signaturtyp: AntiVirus
Updatetyp: Voll
Benutzer: NT AUTHORITY\NETWORK SERVICE
Aktuelle Modulversion: 
Vorherige Modulversion: 1.1.16200.1
Fehlercode: 0x80072ee7
Fehlerbeschreibung: The server name or address could not be resolved 

Date: 2019-07-31 20:37:02.375
Description: 
Fehler von Windows Defender Antivirus beim Aktualisieren von Signaturen.
Neue Signaturversion: 
Vorherige Signaturversion: 1.299.631.0
Updatequelle: Microsoft Center zum Schutz vor Schadsoftware
Signaturtyp: AntiVirus
Updatetyp: Voll
Benutzer: NT AUTHORITY\NETWORK SERVICE
Aktuelle Modulversion: 
Vorherige Modulversion: 1.1.16200.1
Fehlercode: 0x80072ee7
Fehlerbeschreibung: The server name or address could not be resolved 

Date: 2019-07-31 20:37:02.375
Description: 
Fehler von Windows Defender Antivirus beim Aktualisieren von Signaturen.
Neue Signaturversion: 
Vorherige Signaturversion: 1.299.631.0
Updatequelle: Microsoft Center zum Schutz vor Schadsoftware
Signaturtyp: AntiSpyware
Updatetyp: Voll
Benutzer: NT AUTHORITY\NETWORK SERVICE
Aktuelle Modulversion: 
Vorherige Modulversion: 1.1.16200.1
Fehlercode: 0x80072ee7
Fehlerbeschreibung: The server name or address could not be resolved 

==================== Memory info =========================== 

BIOS: American Megatrends Inc. 1.60 10/10/2018
Motherboard: Micro-Star International Co., Ltd. H310M PRO-VD (MS-7B33)
Processor: Intel(R) Core(TM) i3-8300 CPU @ 3.70GHz
Percentage of memory in use: 70%
Total physical RAM: 3962.59 MB
Available physical RAM: 1159.32 MB
Total Virtual: 14714.59 MB
Available Virtual: 11704.24 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:223.08 GB) (Free:104.59 GB) NTFS
Drive d: () (Fixed) (Total:1863.01 GB) (Free:1638.77 GB) NTFS

\\?\Volume{b9e8df67-0000-0000-0000-100000000000}\ (Vyhradené systémom) (Fixed) (Total:0.49 GB) (Free:0.1 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7/8/10) (Size: 223.6 GB) (Disk ID: B9E8DF67)
Partition 1: (Active) - (Size=500 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=223.1 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (Size: 1863 GB) (Disk ID: 9F919F91)
Partition 1: (Active) - (Size=1863 GB) - (Type=07 NTFS)

==================== End of Addition.txt ============================
         

--- --- ---


FRST Logfile:

FRST Logfile:

FRST Logfile:

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 31-07-2019
Ran by Lubka (administrator) on DESKTOP-3CK4O4E (Micro-Star International Co., Ltd. MS-7B33) (02-08-2019 16:59:39)
Running from C:\Users\Jozko\Desktop
Loaded Profiles: Lubka & Jozko (Available Profiles: Lubka & Jozko)
Platform: Windows 10 Pro Version 1803 17134.885 (X64) Language: Slowakisch (Slowakei)
Default browser: FF
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Adobe Systems, Incorporated -> Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
(Disig a.s. -> Disig a.s.) C:\Program Files (x86)\Disig\Disig Web Signer 1.0.7\Updater\WebSignerTray.exe
(Google Inc -> Google LLC) C:\Program Files (x86)\Google\Update\1.3.34.11\GoogleCrashHandler.exe
(Google Inc -> Google LLC) C:\Program Files (x86)\Google\Update\1.3.34.11\GoogleCrashHandler64.exe
(IDSA Production signing key -> Intel) C:\Program Files (x86)\Intel\Driver and Support Assistant\DSAService.exe
(IDSA Production signing key -> Intel) C:\Program Files (x86)\Intel\Driver and Support Assistant\DSATray.exe
(IDSA Production signing key -> Intel) C:\Program Files (x86)\Intel\Driver and Support Assistant\DSAUpdateService.exe
(Intel(R) Embedded Subsystems and IP Blocks Group -> Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
(Intel(R) Embedded Subsystems and IP Blocks Group -> Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel(R) pGFX -> Intel Corporation) C:\Windows\System32\DriverStore\FileRepository\cui_dc_comp.inf_amd64_1c77f1231c19bc72\igfxCUIService.exe
(Intel(R) pGFX -> Intel Corporation) C:\Windows\System32\DriverStore\FileRepository\cui_dc_comp.inf_amd64_1c77f1231c19bc72\igfxEM.exe
(Intel(R) pGFX -> Intel Corporation) C:\Windows\System32\DriverStore\FileRepository\iigd_dc_base.inf_amd64_26935c8c9d5bfd3b\IntelCpHDCPSvc.exe
(Intel(R) pGFX -> Intel Corporation) C:\Windows\System32\DriverStore\FileRepository\iigd_dc_base.inf_amd64_26935c8c9d5bfd3b\IntelCpHeciSvc.exe
(Intel(R) Software Development Products -> ) C:\Program Files\Intel\SUR\QUEENCREEK\SurSvc.exe
(Malwarebytes Corporation -> Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
(Malwarebytes Corporation -> Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe
(Microsoft Corporation -> Microsoft Corporation) C:\Users\Jozko\AppData\Local\Microsoft\OneDrive\OneDrive.exe
(Microsoft Corporation -> Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Microsoft Windows -> Microsoft Corporation) C:\Program Files\Windows Defender\MSASCuiL.exe
(Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\CompatTelRunner.exe
(Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\msiexec.exe
(Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\smartscreen.exe
(Microsoft Windows Publisher -> Microsoft Corporation) C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.1907.4-0\MsMpEng.exe
(Microsoft Windows Publisher -> Microsoft Corporation) C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.1907.4-0\NisSrv.exe
(Mozilla Corporation -> Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Mozilla Corporation -> Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Mozilla Corporation -> Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Mozilla Corporation -> Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Mozilla Corporation -> Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Oracle America, Inc. -> Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe
(Oracle America, Inc. -> Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(SEIKO EPSON Corporation -> SEIKO EPSON CORPORATION) C:\Windows\System32\spool\drivers\x64\3\E_YATIHTU.EXE

==================== Registry (Whitelisted) ===========================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [SecurityHealth] => C:\Program Files\Windows Defender\MSASCuiL.exe [638872 2018-04-12] (Microsoft Windows -> Microsoft Corporation)
HKLM\...\Run: [RTHDVCPL] => "C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe" -s
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [645456 2019-04-01] (Oracle America, Inc. -> Oracle Corporation)
HKLM\...\RunOnce: [*EmptyTemp] => cmd /c rd /q/s C:\FRST\Temp
HKU\S-1-5-21-1960842775-2088100534-3542962694-1001\...\Run: [Steam] => "C:\Program Files (x86)\Steam\steam.exe" -silent
HKU\S-1-5-21-1960842775-2088100534-3542962694-1001\...\MountPoints2: {08af5bcb-313c-11e9-94ec-309c23d44e07} - "F:\HiSuiteDownLoader.exe" 
HKU\S-1-5-21-1960842775-2088100534-3542962694-1002\...\Run: [EPLTarget\P0000000000000000] => C:\WINDOWS\system32\spool\DRIVERS\x64\3\E_YATIHTU.EXE [241280 2012-07-12] (SEIKO EPSON Corporation -> SEIKO EPSON CORPORATION)
HKU\S-1-5-21-1960842775-2088100534-3542962694-1002\...\MountPoints2: {08af5bcb-313c-11e9-94ec-309c23d44e07} - "F:\HiSuiteDownLoader.exe" 
HKU\S-1-5-21-1960842775-2088100534-3542962694-1002\...\MountPoints2: {e8fcf302-ff74-11e8-94da-806e6f6e6963} - "E:\Setup.exe" 
HKLM\...\Drivers32: [VIDC.X264] => C:\WINDOWS\system32\x264vfw64.dll [3799552 2017-07-30] (x264vfw project) [File not signed]
HKLM\...\Drivers32: [VIDC.LAGS] => C:\WINDOWS\system32\lagarith.dll [148992 2011-12-07] ( ) [File not signed]
HKLM\...\Drivers32: [VIDC.XVID] => C:\WINDOWS\system32\xvidvfw.dll [311296 2018-01-28] () [File not signed]
HKLM\...\Drivers32: [msacm.ac3acm] => C:\WINDOWS\system32\ac3acm.acm [180736 2012-07-21] (fccHandler) [File not signed]
HKLM\...\Drivers32: [VIDC.X264] => C:\Windows\SysWOW64\x264vfw.dll [3850240 2017-07-30] (x264vfw project) [File not signed]
HKLM\...\Drivers32: [VIDC.LAGS] => C:\Windows\SysWOW64\lagarith.dll [216064 2011-12-07] ( ) [File not signed]
HKLM\...\Drivers32: [VIDC.XVID] => C:\Windows\SysWOW64\xvidvfw.dll [284672 2018-01-28] () [File not signed]
HKLM\...\Drivers32: [VIDC.FFDS] => C:\Windows\SysWOW64\ff_vfw.dll [112128 2015-10-24] () [File not signed]
HKLM\...\Drivers32: [msacm.ac3acm] => C:\Windows\SysWOW64\ac3acm.acm [122880 2012-07-21] (fccHandler) [File not signed]
HKLM\Software\Microsoft\Active Setup\Installed Components: [{8A69D345-D564-463c-AFF1-A69D9E530F96}] -> C:\Program Files (x86)\Google\Chrome\Application\75.0.3770.142\Installer\chrmstp.exe [2019-07-17] (Google LLC -> Google LLC)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Web Signer.lnk [2019-03-14]
ShortcutTarget: Web Signer.lnk -> C:\Program Files (x86)\Disig\Disig Web Signer 1.0.7\Updater\WebSignerTray.exe (Disig a.s. -> Disig a.s.)
BootExecute: autocheck autochk * sdnclean64.exe

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Tcpip\Parameters: [DhcpNameServer] 192.168.1.1 195.146.128.62
Tcpip\..\Interfaces\{da384fb4-1e59-48fc-bfe0-c27ce005f778}: [DhcpNameServer] 192.168.1.1 195.146.128.62

Internet Explorer:
==================
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxps://go.microsoft.com/fwlink/p/?LinkId=255141
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxps://go.microsoft.com/fwlink/p/?LinkId=255141
HKU\S-1-5-21-1960842775-2088100534-3542962694-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxps://go.microsoft.com/fwlink/p/?LinkId=619797&pc=UE03&ocid=UE03DHP
HKU\S-1-5-21-1960842775-2088100534-3542962694-1002\Software\Microsoft\Internet Explorer\Main,Start Page = hxxps://go.microsoft.com/fwlink/p/?LinkId=619797&pc=UE03&ocid=UE03DHP
SearchScopes: HKU\S-1-5-21-1960842775-2088100534-3542962694-1001 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxps://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IESR02&pc=UE04
SearchScopes: HKU\S-1-5-21-1960842775-2088100534-3542962694-1001 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxps://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IESR02&pc=UE04
SearchScopes: HKU\S-1-5-21-1960842775-2088100534-3542962694-1002 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxps://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IESR02&pc=UE04
SearchScopes: HKU\S-1-5-21-1960842775-2088100534-3542962694-1002 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxps://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IESR02&pc=UE04
BHO: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office\Office16\OCHelper.dll [2015-07-31] (Microsoft Corporation -> Microsoft Corporation)
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_211\bin\ssv.dll [2019-05-24] (Oracle America, Inc. -> Oracle Corporation)
BHO: Microsoft OneDrive for Business Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office\Office16\GROOVEEX.DLL [2015-07-31] (Microsoft Corporation -> Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_211\bin\jp2ssv.dll [2019-05-24] (Oracle America, Inc. -> Oracle Corporation)
BHO-x32: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files (x86)\Microsoft Office\Office16\OCHelper.dll [2015-07-31] (Microsoft Corporation -> Microsoft Corporation)
BHO-x32: Microsoft OneDrive for Business Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files (x86)\Microsoft Office\Office16\GROOVEEX.DLL [2015-07-31] (Microsoft Corporation -> Microsoft Corporation)
Handler-x32: mso-minsb.16 - {3459B272-CC19-4448-86C9-DDC3B4B2FAD3} - C:\Program Files (x86)\Microsoft Office\Office16\MSOSB.DLL [2015-07-31] (Microsoft Corporation -> Microsoft Corporation)
Handler-x32: osf.16 - {5504BE45-A83B-4808-900A-3A5C36E7F77A} - C:\Program Files (x86)\Microsoft Office\Office16\MSOSB.DLL [2015-07-31] (Microsoft Corporation -> Microsoft Corporation)

FireFox:
========
FF DefaultProfile: bt6jbw3e.default
FF ProfilePath: C:\Users\Lubka\AppData\Roaming\Mozilla\Firefox\Profiles\bt6jbw3e.default [2019-07-31]
FF Homepage: Mozilla\Firefox\Profiles\bt6jbw3e.default -> hxxps://www.google.sk/
FF Extension: (Adblock Plus - kostenloser Adblocker) - C:\Users\Lubka\AppData\Roaming\Mozilla\Firefox\Profiles\bt6jbw3e.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2019-04-21]
FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF64_32_0_0_223.dll [2019-07-13] (Adobe Inc. -> )
FF Plugin: @java.com/DTPlugin,version=11.211.2 -> C:\Program Files\Java\jre1.8.0_211\bin\dtplugin\npDeployJava1.dll [2019-05-24] (Oracle America, Inc. -> Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=11.211.2 -> C:\Program Files\Java\jre1.8.0_211\bin\plugin2\npjp2.dll [2019-05-24] (Oracle America, Inc. -> Oracle Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_32_0_0_223.dll [2019-07-13] (Adobe Inc. -> )
FF Plugin-x32: @google.com/zxwebplugin -> C:\WINDOWS\system32\npzxwebplugin.dll [No File]
FF Plugin-x32: @microsoft.com/Lync,version=15.0 -> C:\Program Files (x86)\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll [2015-07-31] (Microsoft Corporation -> Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office16\NPSPWRAP.DLL [2015-07-31] (Microsoft Corporation -> Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.34.11\npGoogleUpdate3.dll [2019-05-15] (Google Inc -> Google LLC)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.34.11\npGoogleUpdate3.dll [2019-05-15] (Google Inc -> Google LLC)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2019-05-03] (Adobe Inc. -> Adobe Systems Inc.)
FF Plugin-x32: ditec.sk/DAsicFac -> C:\PROGRA~2\Ditec\DSIGNE~2.NET\NPDITE~1.DLL [2019-01-14] (DITEC, a.s. -> Ditec,a.s.)
FF Plugin-x32: ditec.sk/DitecZepDViewerFb -> C:\PROGRA~2\Ditec\DViewer\NPDITE~1.DLL [2019-01-15] (DITEC, a.s. -> Ditec, a.s.)
FF Plugin-x32: ditec.sk/DSigMessageContainer -> C:\PROGRA~2\Ditec\DSIGNE~2.NET\NPDITE~2.DLL [2016-12-15] (DITEC, a.s. -> Ditec, a.s.)
FF Plugin-x32: ditec.sk/DSigXadesExtender -> C:\PROGRA~2\Ditec\DSIGNE~2.NET\NPDITE~3.DLL [2016-12-15] (DITEC, a.s. -> Ditec, a.s.)
FF Plugin-x32: ditec.sk/DSigXadesFb -> C:\PROGRA~2\Ditec\DSIGNE~1.NET\NPDITE~1.DLL [2019-01-15] (DITEC, a.s. -> Ditec,a.s.)
FF Plugin-x32: ditec.sk/XmlDataContainerFb -> C:\PROGRA~2\Ditec\DSIGNE~1.NET\NPDITE~2.DLL [2019-01-15] (DITEC, a.s. -> Ditec,a.s.)
FF Plugin HKU\S-1-5-21-1960842775-2088100534-3542962694-1002: ditec.sk/DitecZepDViewerFb -> C:\ProgramData\Ditec\DViewer\npDitec.Zep.DViewerFb.dll [No File]
FF Plugin HKU\S-1-5-21-1960842775-2088100534-3542962694-1002: ditec.sk/DSigXadesExtenderFb -> C:\Program Files (x86)\Ditec\DSigXadesExtender\npDitec.Zep.DSigXadesExtenderFb.dll [No File]
FF Plugin HKU\S-1-5-21-1960842775-2088100534-3542962694-1002: ditec.sk/DSigXadesFb -> C:\Program Files (x86)\Ditec\DSigXades\npDitec.Zep.DSigXadesFb.dll [No File]

Chrome: 
=======
CHR HomePage: Default -> hxxps://www.google.com/
CHR Profile: C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default [2019-08-01]
CHR Extension: (Präsentationen) - C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2018-12-14]
CHR Extension: (Docs) - C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2018-12-14]
CHR Extension: (Google Drive) - C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2018-12-14]
CHR Extension: (YouTube) - C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2018-12-14]
CHR Extension: (Adobe Acrobat) - C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj [2019-06-21]
CHR Extension: (Tabellen) - C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2018-12-14]
CHR Extension: (Google Docs Offline) - C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2018-12-14]
CHR Extension: (Chrome Web Store-Zahlungen) - C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2018-12-14]
CHR Extension: (Disig Web Signer 1.0.7) - C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\odbdbcaekkgabdfaabepfjgiooilmaoe [2019-03-15]
CHR Extension: (Google Mail) - C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2019-04-23]
CHR Extension: (Chrome Media Router) - C:\Users\Lubka\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2019-07-31]
CHR HKLM-x32\...\Chrome\Extension: [efaidnbmnnnibpcajpcglclefindmkaj] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [odbdbcaekkgabdfaabepfjgiooilmaoe] - hxxps://clients2.google.com/service/update2/crx

==================== Services (Whitelisted) ====================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

S2 dLauncherLoopback; C:\Program Files (x86)\Ditec\DLauncher\dLauncherLoopback.exe [156984 2017-09-29] (DITEC, a.s. -> )
R2 DSAService; C:\Program Files (x86)\Intel\Driver and Support Assistant\DSAService.exe [26984 2019-07-25] (IDSA Production signing key -> Intel)
R3 DSAUpdateService; C:\Program Files (x86)\Intel\Driver and Support Assistant\DSAUpdateService.exe [80744 2019-07-25] (IDSA Production signing key -> Intel)
S2 ESRV_SVC_QUEENCREEK; C:\Program Files\Intel\SUR\QUEENCREEK\x64\esrv_svc.exe [937208 2018-12-19] (Intel(R) Software Development Products -> )
S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\Intel(R) Management Engine Components\iCLS\SocketHeciServer.exe [762568 2018-06-08] (Intel(R) Trust Services -> Intel(R) Corporation)
S3 Intel(R) SUR QC SAM; C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\IntelSoftwareAssetManagerService.exe [18168 2017-07-13] (Intel(R) Software Asset Manager -> Intel Corporation)
S2 Intel(R) TPM Provisioning Service; C:\Program Files\Intel\Intel(R) Management Engine Components\iCLS\TPMProvisioningService.exe [714952 2018-06-08] (Intel(R) Trust Services -> Intel(R) Corporation)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [218176 2018-08-03] (Intel(R) Embedded Subsystems and IP Blocks Group -> Intel Corporation)
R2 MBAMService; C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe [6744288 2019-06-26] (Malwarebytes Corporation -> Malwarebytes)
S3 Sense; C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe [5073792 2019-07-04] (Microsoft Windows Publisher -> Microsoft Corporation)
R2 SystemUsageReportSvc_QUEENCREEK; C:\Program Files\Intel\SUR\QUEENCREEK\SurSvc.exe [195832 2018-12-19] (Intel(R) Software Development Products -> )
S3 USER_ESRV_SVC_QUEENCREEK; C:\Program Files\Intel\SUR\QUEENCREEK\x64\esrv_svc.exe [937208 2018-12-19] (Intel(R) Software Development Products -> )
R3 WdNisSvc; C:\ProgramData\Microsoft\Windows Defender\platform\4.18.1907.4-0\NisSrv.exe [2552416 2019-07-27] (Microsoft Windows Publisher -> Microsoft Corporation)
R2 WinDefend; C:\ProgramData\Microsoft\Windows Defender\platform\4.18.1907.4-0\MsMpEng.exe [108832 2019-07-27] (Microsoft Windows Publisher -> Microsoft Corporation)

===================== Drivers (Whitelisted) ======================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

S3 GemCCID; C:\WINDOWS\System32\drivers\GemCCID.sys [137712 2016-10-17] (Microsoft Windows Hardware Compatibility Publisher -> Gemalto)
R3 MBAMSwissArmy; C:\WINDOWS\System32\Drivers\mbamswissarmy.sys [275232 2019-08-02] (Malwarebytes Corporation -> Malwarebytes)
R3 rt640x64; C:\WINDOWS\System32\drivers\rt640x64.sys [1122200 2018-12-14] (Realtek Semiconductor Corp. -> Realtek )
S3 semav6msr64; C:\WINDOWS\system32\drivers\semav6msr64.sys [43008 2018-12-19] (Intel Corporation -> )
R3 tap0901; C:\WINDOWS\System32\drivers\tap0901.sys [27136 2016-04-21] (OpenVPN Technologies, Inc. -> The OpenVPN Project)
S0 WdBoot; C:\WINDOWS\System32\drivers\wd\WdBoot.sys [47496 2019-07-27] (Microsoft Windows Early Launch Anti-Malware Publisher -> Microsoft Corporation)
R0 WdFilter; C:\WINDOWS\System32\drivers\wd\WdFilter.sys [344288 2019-07-27] (Microsoft Windows -> Microsoft Corporation)
R3 WdNisDrv; C:\WINDOWS\System32\drivers\wd\WdNisDrv.sys [54496 2019-07-27] (Microsoft Windows -> Microsoft Corporation)

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== One month (created) ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2019-08-02 16:49 - 2019-08-02 16:49 - 000275232 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mbamswissarmy.sys
2019-08-01 18:09 - 2019-08-02 16:59 - 000020087 _____ C:\Users\Jozko\Desktop\FRST.txt
2019-08-01 16:45 - 2019-08-02 07:43 - 000001187 _____ C:\Users\Lubka\Desktop\ESET Online Scanner.lnk
2019-08-01 16:45 - 2019-08-01 16:45 - 000001286 _____ C:\Users\Lubka\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\ESET Online Scanner.lnk
2019-08-01 16:45 - 2019-08-01 16:45 - 000000000 ____D C:\Users\Lubka\AppData\Local\ESET
2019-08-01 16:44 - 2019-08-01 16:44 - 000000812 _____ C:\Users\Jozko\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\ESET Online Scanner.lnk
2019-08-01 16:44 - 2019-08-01 16:44 - 000000000 ____D C:\Users\Jozko\AppData\Local\ESET
2019-08-01 16:43 - 2019-08-01 16:43 - 007986712 _____ (ESET spol. s r.o.) C:\Users\Jozko\Desktop\ESETOnlineScanner_DEU.exe
2019-08-01 16:41 - 2019-08-01 16:41 - 000001348 _____ C:\Users\Jozko\Desktop\Fixlog.txt
2019-07-31 22:52 - 2019-07-31 22:52 - 000001630 _____ C:\Users\Lubka\Desktop\AdwCleaner[S03].txt
2019-07-31 22:37 - 2019-08-02 17:00 - 000000000 ____D C:\Users\Jozko\Desktop\Trojaner
2019-07-31 20:57 - 2019-07-31 20:57 - 000003893 _____ C:\Users\Lubka\Desktop\AdwCleaner[S00].txt
2019-07-31 20:57 - 2019-07-31 20:57 - 000001610 _____ C:\Users\Lubka\Desktop\AdwCleaner[S02].txt
2019-07-31 20:57 - 2019-07-31 20:57 - 000001447 _____ C:\Users\Lubka\Desktop\AdwCleaner[S01].txt
2019-07-31 20:34 - 2019-07-31 20:34 - 007316688 _____ (Malwarebytes) C:\Users\Jozko\Downloads\adwcleaner-7-2-7.exe
2019-07-31 20:01 - 2019-07-31 20:01 - 000000000 ____D C:\Users\Jozko\Desktop\FRST-OlderVersion
2019-07-31 20:01 - 2019-07-31 20:01 - 000000000 ____D C:\Users\Jozko\AppData\Local\PeerDistRepub
2019-07-31 19:13 - 2019-07-31 19:13 - 000000085 _____ C:\WINDOWS\wininit.ini
2019-07-31 19:10 - 2019-07-31 19:10 - 000003166 _____ C:\WINDOWS\System32\Tasks\AdwCleaner_onReboot
2019-07-30 22:25 - 2019-07-30 22:25 - 000000000 ____D C:\Users\Lubka\AppData\Local\mbamtray
2019-07-30 22:11 - 2019-07-30 22:11 - 000000000 ____D C:\Users\Jozko\AppData\Roaming\Sun
2019-07-30 22:11 - 2019-07-30 22:11 - 000000000 ____D C:\Users\Jozko\AppData\LocalLow\Sun
2019-07-30 22:00 - 2019-08-02 16:59 - 000000000 ____D C:\FRST
2019-07-30 21:47 - 2019-07-31 20:01 - 002096128 _____ (Farbar) C:\Users\Jozko\Desktop\FRST64.exe
2019-07-30 21:11 - 2019-07-30 21:11 - 000001912 _____ C:\Users\Public\Desktop\Malwarebytes.lnk
2019-07-30 21:11 - 2019-07-30 21:11 - 000000000 ____D C:\Users\Jozko\AppData\Local\mbamtray
2019-07-30 21:11 - 2019-07-30 21:11 - 000000000 ____D C:\Users\Jozko\AppData\Local\mbam
2019-07-30 21:11 - 2019-07-30 21:11 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes
2019-07-30 21:11 - 2019-01-08 16:32 - 000153328 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mbae64.sys
2019-07-30 21:10 - 2019-07-30 21:10 - 000000000 ____D C:\ProgramData\Malwarebytes
2019-07-30 21:10 - 2019-07-30 21:10 - 000000000 ____D C:\Program Files\Malwarebytes
2019-07-30 21:09 - 2019-07-30 21:09 - 000000000 ____D C:\WINDOWS\pss
2019-07-30 20:49 - 2019-07-30 20:49 - 000388992 _____ C:\Users\Jozko\Desktop\bookmarksJ.html
2019-07-30 20:47 - 2019-07-30 20:47 - 000051801 _____ C:\Users\Lubka\Desktop\bookmarksL.html
2019-07-30 20:26 - 2019-07-30 20:27 - 000000000 ____D C:\AdwCleaner
2019-07-30 20:24 - 2019-07-30 20:25 - 007623880 _____ (Malwarebytes) C:\Users\Jozko\Desktop\adwcleaner_7.4.exe
2019-07-30 20:15 - 2019-07-30 20:15 - 000000000 ____D C:\Users\Jozko\AppData\Local\D3DSCache
2019-07-30 20:04 - 2019-07-31 19:14 - 000000000 ____D C:\Program Files (x86)\Spybot - Search & Destroy 2
2019-07-30 20:04 - 2019-07-31 19:13 - 000000000 ____D C:\ProgramData\Spybot - Search & Destroy
2019-07-30 20:04 - 2019-07-30 20:04 - 000000000 ____D C:\WINDOWS\System32\Tasks\Safer-Networking
2019-07-27 14:10 - 2019-07-27 14:10 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Intel
2019-07-27 12:14 - 2019-07-27 12:15 - 000000000 ____D C:\Users\Lubka\Desktop\SAP-USB
2019-07-27 12:12 - 2019-07-27 12:12 - 001680991 _____ C:\Users\Lubka\Desktop\mssstool0221.zip
2019-07-27 12:01 - 2019-08-02 09:08 - 095682560 _____ C:\WINDOWS\system32\config\SOFTWARE
2019-07-27 11:52 - 2019-07-27 12:01 - 000000000 ____D C:\WINDOWS\Microsoft Antimalware
2019-07-25 01:04 - 2019-08-01 17:01 - 000000000 ____D C:\ProgramData\TmpLoog
2019-07-25 00:44 - 2019-07-25 00:44 - 000000000 ____D C:\Users\Lubka\AppData\LocalLow\lltgznTbqqOCq
2019-07-24 23:11 - 2019-07-24 23:11 - 000000000 ____D C:\Users\Lubka\AppData\Roaming\WinRAR
2019-07-24 23:11 - 2019-07-24 23:11 - 000000000 ____D C:\Users\Lubka\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR
2019-07-24 23:11 - 2019-07-24 23:11 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinRAR
2019-07-24 23:11 - 2019-07-24 23:11 - 000000000 ____D C:\Program Files (x86)\WinRAR
2019-07-24 23:10 - 2019-07-24 23:10 - 002918616 _____ (Alexander Roshal) C:\Users\Lubka\Downloads\wrar571.exe
2019-07-24 23:05 - 2019-07-24 23:05 - 000147094 _____ C:\Users\Lubka\Downloads\SilentPatchSA.zip
2019-07-24 23:04 - 2019-07-24 23:04 - 000039315 _____ C:\Users\Lubka\Downloads\asiloader.rar
2019-07-24 23:00 - 2019-07-24 23:20 - 000000000 ____D C:\Users\Lubka\Documents\GTA San Andreas User Files
2019-07-24 23:00 - 2008-10-15 06:22 - 005631312 _____ (Microsoft Corporation) C:\WINDOWS\system32\D3DX9_40.dll
2019-07-24 23:00 - 2008-10-15 06:22 - 004379984 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\D3DX9_40.dll
2019-07-24 23:00 - 2008-10-15 06:22 - 002605920 _____ (Microsoft Corporation) C:\WINDOWS\system32\D3DCompiler_40.dll
2019-07-24 23:00 - 2008-10-15 06:22 - 002036576 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\D3DCompiler_40.dll
2019-07-24 23:00 - 2008-10-15 06:22 - 000519000 _____ (Microsoft Corporation) C:\WINDOWS\system32\d3dx10_40.dll
2019-07-24 23:00 - 2008-10-15 06:22 - 000452440 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d3dx10_40.dll
2019-07-24 21:13 - 2019-07-24 21:13 - 000001315 _____ C:\Users\Public\Desktop\Age of Empires - The Rise of Rome color fix.lnk
2019-07-24 21:13 - 2019-07-24 21:13 - 000001306 _____ C:\Users\Public\Desktop\Age of Empires color fix.lnk
2019-07-24 21:13 - 2019-07-24 21:13 - 000001185 _____ C:\Users\Public\Desktop\Age of Empires - The Rise of Rome.lnk
2019-07-24 21:13 - 2019-07-24 21:13 - 000001178 _____ C:\Users\Public\Desktop\Age of Empires.lnk
2019-07-24 21:13 - 2019-07-24 21:13 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Age of Empires complete
2019-07-24 21:13 - 2019-07-24 21:13 - 000000000 ____D C:\Program Files (x86)\Age of Empires complete
2019-07-24 19:25 - 2019-07-24 19:25 - 000000221 _____ C:\Users\Lubka\Desktop\Grand Theft Auto San Andreas.url
2019-07-24 19:25 - 2019-07-24 19:25 - 000000000 ____D C:\Users\Lubka\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Steam
2019-07-24 19:23 - 2019-07-25 01:01 - 000000000 ____D C:\Program Files\Mozilla Firefox
2019-07-24 19:20 - 2019-07-24 19:20 - 000000000 ____D C:\Users\Lubka\AppData\Local\Steam
2019-07-24 19:20 - 2019-07-24 19:20 - 000000000 ____D C:\Users\Lubka\AppData\Local\CEF
2019-07-24 19:11 - 2019-07-24 19:11 - 001573568 _____ C:\Users\Lubka\Downloads\SteamSetup.exe
2019-07-24 19:11 - 2019-07-24 19:11 - 000001036 _____ C:\Users\Public\Desktop\Steam.lnk
2019-07-24 19:11 - 2019-07-24 19:11 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Steam
2019-07-13 17:03 - 2019-07-13 17:03 - 000004590 _____ C:\WINDOWS\System32\Tasks\Adobe Flash Player NPAPI Notifier
2019-07-13 17:03 - 2019-07-13 17:03 - 000004424 _____ C:\WINDOWS\System32\Tasks\Adobe Flash Player Updater
2019-07-13 16:59 - 2019-07-13 16:59 - 000716789 _____ C:\WINDOWS\SysWOW64\unins000.exe
2019-07-13 16:59 - 2019-07-13 16:59 - 000001770 _____ C:\WINDOWS\SysWOW64\unins000.dat
2019-07-13 16:59 - 2019-04-10 14:55 - 000290816 _____ (www.xjghost.com) C:\WINDOWS\SysWOW64\WebClientPlayBack.ocx
2019-07-13 16:59 - 2019-04-10 14:45 - 000229484 _____ () C:\WINDOWS\SysWOW64\WebClientPlus.ocx
2019-07-13 16:59 - 2019-03-29 09:22 - 000004240 _____ C:\WINDOWS\SysWOW64\lang_spanish.ini
2019-07-13 16:59 - 2019-03-29 09:16 - 000004250 _____ C:\WINDOWS\SysWOW64\lang_italy.ini
2019-07-13 16:59 - 2019-03-29 09:12 - 000004624 _____ C:\WINDOWS\SysWOW64\lang_franch.ini
2019-07-13 16:59 - 2019-03-29 09:09 - 000004404 _____ C:\WINDOWS\SysWOW64\lang_germany.ini
2019-07-13 16:59 - 2019-03-28 10:33 - 000002698 _____ C:\WINDOWS\SysWOW64\lang_chn.ini
2019-07-13 16:59 - 2019-01-11 16:02 - 000245760 _____ () C:\WINDOWS\SysWOW64\NetLib.dll
2019-07-13 16:59 - 2019-01-11 15:55 - 000081920 _____ () C:\WINDOWS\SysWOW64\hiPBClient.dll
2019-07-13 16:59 - 2018-11-12 18:10 - 000417792 _____ () C:\WINDOWS\SysWOW64\HIPlayer.dll
2019-07-13 16:59 - 2018-11-07 11:26 - 000319488 _____ () C:\WINDOWS\SysWOW64\HIPlayer.exe
2019-07-13 16:59 - 2018-11-07 10:38 - 000057344 _____ () C:\WINDOWS\SysWOW64\HISDK.dll
2019-07-13 16:59 - 2018-11-07 09:57 - 000573952 _____ C:\WINDOWS\SysWOW64\Hi265.dll
2019-07-13 16:59 - 2014-04-10 14:28 - 000057344 _____ (微软中国) C:\WINDOWS\SysWOW64\SearchLib.dll
2019-07-13 16:59 - 2013-07-10 17:21 - 000217600 _____ C:\WINDOWS\SysWOW64\npzxwebplugin.dll
2019-07-13 16:59 - 2012-09-25 21:39 - 002555406 _____ C:\WINDOWS\SysWOW64\avcodec-54.dll
2019-07-13 16:59 - 2012-09-25 21:39 - 000157198 _____ C:\WINDOWS\SysWOW64\avutil-51.dll
2019-07-13 16:59 - 2010-08-23 20:07 - 000562220 _____ C:\WINDOWS\SysWOW64\AlarmSound.wav
2019-07-13 16:58 - 2019-07-13 16:58 - 002036967 _____ ( ) C:\Users\Jozko\Desktop\ClientPlus_Setup.exe
2019-07-13 16:47 - 2019-07-13 16:47 - 000001906 _____ C:\Users\Jozko\Desktop\HiPlayer.exe.lnk
2019-07-13 16:47 - 2019-07-13 16:47 - 000000000 ____D C:\Users\Jozko\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\HiPlayer
2019-07-13 16:47 - 2019-07-13 16:47 - 000000000 ____D C:\Users\Jozko\AppData\Roaming\HiPlayer
2019-07-09 19:25 - 2019-07-04 11:40 - 021390504 _____ (Microsoft Corporation) C:\WINDOWS\system32\shell32.dll
2019-07-09 19:25 - 2019-07-04 11:40 - 001616840 _____ (Microsoft Corporation) C:\WINDOWS\system32\sppobjs.dll
2019-07-09 19:25 - 2019-07-04 11:18 - 003614208 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32kfull.sys
2019-07-09 19:25 - 2019-07-04 10:51 - 020384128 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\shell32.dll
2019-07-09 19:25 - 2019-07-04 10:37 - 002882048 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\win32kfull.sys
2019-07-09 19:25 - 2019-07-04 07:00 - 001035040 _____ (Microsoft Corporation) C:\WINDOWS\system32\ApplyTrustOffline.exe
2019-07-09 19:25 - 2019-07-04 06:58 - 001219896 _____ (Microsoft Corporation) C:\WINDOWS\system32\hvix64.exe
2019-07-09 19:25 - 2019-07-04 06:57 - 003292152 _____ (Microsoft Corporation) C:\WINDOWS\system32\combase.dll
2019-07-09 19:25 - 2019-07-04 06:56 - 009084216 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntoskrnl.exe
2019-07-09 19:25 - 2019-07-04 06:56 - 007519896 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.Protection.PlayReady.dll
2019-07-09 19:25 - 2019-07-04 06:56 - 007436536 _____ (Microsoft Corporation) C:\WINDOWS\system32\windows.storage.dll
2019-07-09 19:25 - 2019-07-04 06:56 - 002810680 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgkrnl.sys
2019-07-09 19:25 - 2019-07-04 06:42 - 006570368 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.Protection.PlayReady.dll
2019-07-09 19:25 - 2019-07-04 06:42 - 006044008 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\windows.storage.dll
2019-07-09 19:25 - 2019-07-04 06:42 - 002479176 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\combase.dll
2019-07-09 19:25 - 2019-07-04 06:37 - 025857536 _____ (Microsoft Corporation) C:\WINDOWS\system32\edgehtml.dll
2019-07-09 19:25 - 2019-07-04 06:33 - 022017536 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\edgehtml.dll
2019-07-09 19:25 - 2019-07-04 06:29 - 022717440 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll
2019-07-09 19:25 - 2019-07-04 06:26 - 004385280 _____ (Microsoft Corporation) C:\WINDOWS\system32\EdgeContent.dll
2019-07-09 19:25 - 2019-07-04 06:25 - 019372544 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll
2019-07-09 19:25 - 2019-07-04 06:25 - 007589888 _____ (Microsoft Corporation) C:\WINDOWS\system32\Chakra.dll
2019-07-09 19:25 - 2019-07-04 06:25 - 004861440 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll
2019-07-09 19:25 - 2019-07-04 06:25 - 003401216 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentServer.dll
2019-07-09 19:25 - 2019-07-04 06:22 - 003707904 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll
2019-07-09 19:25 - 2019-07-04 06:21 - 005784064 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Chakra.dll
2019-07-09 19:25 - 2019-07-04 06:21 - 003202560 _____ (Microsoft Corporation) C:\WINDOWS\system32\DWrite.dll
2019-07-09 19:25 - 2019-06-13 14:12 - 002871848 _____ (Microsoft Corporation) C:\WINDOWS\system32\aitstatic.exe
2019-07-09 19:25 - 2019-06-13 14:05 - 000810296 _____ (Microsoft Corporation) C:\WINDOWS\system32\generaltel.dll
2019-07-09 19:25 - 2019-06-13 14:04 - 001721144 _____ (Microsoft Corporation) C:\WINDOWS\system32\appraiser.dll
2019-07-09 19:25 - 2019-06-13 13:59 - 000740664 _____ (Microsoft Corporation) C:\WINDOWS\system32\aeinv.dll
2019-07-09 19:25 - 2019-06-13 13:42 - 004038688 _____ (Microsoft Corporation) C:\WINDOWS\explorer.exe
2019-07-09 19:25 - 2019-06-13 13:18 - 006586880 _____ (Microsoft Corporation) C:\WINDOWS\system32\twinui.dll
2019-07-09 19:25 - 2019-06-13 13:18 - 004847104 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingsHandlers_nt.dll
2019-07-09 19:25 - 2019-06-13 13:17 - 012756992 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll
2019-07-09 19:25 - 2019-06-13 13:15 - 004718080 _____ (Microsoft Corporation) C:\WINDOWS\system32\twinui.pcshell.dll
2019-07-09 19:25 - 2019-06-13 13:13 - 002920448 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Logon.dll
2019-07-09 19:25 - 2019-06-13 12:11 - 001539896 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AppVEntSubsystems32.dll
2019-07-09 19:25 - 2019-06-13 12:05 - 003700160 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\explorer.exe
2019-07-09 19:25 - 2019-06-13 11:55 - 005657088 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\twinui.dll
2019-07-09 19:25 - 2019-06-13 11:54 - 011942912 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll
2019-07-09 19:25 - 2019-06-13 09:01 - 000513336 _____ (Microsoft Corporation) C:\WINDOWS\system32\aepic.dll
2019-07-09 19:25 - 2019-06-13 08:47 - 005625160 _____ (Microsoft Corporation) C:\WINDOWS\system32\StartTileData.dll
2019-07-09 19:25 - 2019-06-13 08:44 - 002769688 _____ (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll
2019-07-09 19:25 - 2019-06-13 08:14 - 003318784 _____ (Microsoft Corporation) C:\WINDOWS\system32\dwmcore.dll
2019-07-09 19:25 - 2019-06-13 08:13 - 004771840 _____ (Microsoft Corporation) C:\WINDOWS\system32\InputService.dll
2019-07-09 19:25 - 2019-06-13 07:14 - 000415544 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\aepic.dll
2019-07-09 19:25 - 2019-06-13 07:06 - 002256768 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iertutil.dll
2019-07-09 19:24 - 2019-07-04 11:45 - 001786680 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVEntVirtualization.dll
2019-07-09 19:24 - 2019-07-04 11:43 - 000094008 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpudd.dll
2019-07-09 19:24 - 2019-07-04 11:41 - 000304144 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\mssecflt.sys
2019-07-09 19:24 - 2019-07-04 11:40 - 001631808 _____ (Microsoft Corporation) C:\WINDOWS\system32\gdi32full.dll
2019-07-09 19:24 - 2019-07-04 11:40 - 000790416 _____ (Microsoft Corporation) C:\WINDOWS\system32\fontdrvhost.exe
2019-07-09 19:24 - 2019-07-04 11:22 - 000131072 _____ (Microsoft Corporation) C:\WINDOWS\splwow64.exe
2019-07-09 19:24 - 2019-07-04 11:22 - 000128000 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppxSysprep.dll
2019-07-09 19:24 - 2019-07-04 11:21 - 008627200 _____ (Microsoft Corporation) C:\WINDOWS\system32\mstscax.dll
2019-07-09 19:24 - 2019-07-04 11:20 - 001609216 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpcorets.dll
2019-07-09 19:24 - 2019-07-04 11:19 - 000420864 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpclip.exe
2019-07-09 19:24 - 2019-07-04 11:18 - 001663488 _____ (Microsoft Corporation) C:\WINDOWS\system32\GdiPlus.dll
2019-07-09 19:24 - 2019-07-04 10:56 - 001453416 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\gdi32full.dll
2019-07-09 19:24 - 2019-07-04 10:54 - 000662352 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\fontdrvhost.exe
2019-07-09 19:24 - 2019-07-04 10:41 - 007990784 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mstscax.dll
2019-07-09 19:24 - 2019-07-04 10:36 - 001471488 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\GdiPlus.dll
2019-07-09 19:24 - 2019-07-04 06:58 - 001328440 _____ (Microsoft Corporation) C:\WINDOWS\system32\wpx.dll
2019-07-09 19:24 - 2019-07-04 06:58 - 000416312 _____ (Microsoft Corporation) C:\WINDOWS\system32\wlanapi.dll
2019-07-09 19:24 - 2019-07-04 06:58 - 000192824 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\appid.sys
2019-07-09 19:24 - 2019-07-04 06:57 - 001027384 _____ (Microsoft Corporation) C:\WINDOWS\system32\hvax64.exe
2019-07-09 19:24 - 2019-07-04 06:57 - 000986128 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingSyncHost.exe
2019-07-09 19:24 - 2019-07-04 06:57 - 000776784 _____ (Microsoft Corporation) C:\WINDOWS\system32\wer.dll
2019-07-09 19:24 - 2019-07-04 06:57 - 000723728 _____ (Microsoft Corporation) C:\WINDOWS\system32\ci.dll
2019-07-09 19:24 - 2019-07-04 06:57 - 000708696 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\cng.sys
2019-07-09 19:24 - 2019-07-04 06:57 - 000568104 _____ (Microsoft Corporation) C:\WINDOWS\system32\tcblaunch.exe
2019-07-09 19:24 - 2019-07-04 06:57 - 000362264 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Storage.ApplicationData.dll
2019-07-09 19:24 - 2019-07-04 06:57 - 000209424 _____ (Microsoft Corporation) C:\WINDOWS\system32\wermgr.exe
2019-07-09 19:24 - 2019-07-04 06:57 - 000194360 _____ (Microsoft Corporation) C:\WINDOWS\system32\skci.dll
2019-07-09 19:24 - 2019-07-04 06:57 - 000137656 _____ (Microsoft Corporation) C:\WINDOWS\system32\bcrypt.dll
2019-07-09 19:24 - 2019-07-04 06:57 - 000134968 _____ (Microsoft Corporation) C:\WINDOWS\system32\hvloader.dll
2019-07-09 19:24 - 2019-07-04 06:57 - 000091776 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dumpfve.sys
2019-07-09 19:24 - 2019-07-04 06:56 - 002571640 _____ (Microsoft Corporation) C:\WINDOWS\system32\KernelBase.dll
2019-07-09 19:24 - 2019-07-04 06:56 - 001566520 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppxPackaging.dll
2019-07-09 19:24 - 2019-07-04 06:56 - 001459120 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.efi
2019-07-09 19:24 - 2019-07-04 06:56 - 001260776 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.exe
2019-07-09 19:24 - 2019-07-04 06:56 - 001141496 _____ (Microsoft Corporation) C:\WINDOWS\system32\winresume.efi
2019-07-09 19:24 - 2019-07-04 06:56 - 000983936 _____ (Microsoft Corporation) C:\WINDOWS\system32\winresume.exe
2019-07-09 19:24 - 2019-07-04 06:56 - 000767536 _____ (Microsoft Corporation) C:\WINDOWS\system32\dnsapi.dll
2019-07-09 19:24 - 2019-07-04 06:56 - 000734952 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentClient.dll
2019-07-09 19:24 - 2019-07-04 06:56 - 000713272 _____ (Microsoft Corporation) C:\WINDOWS\system32\MSVideoDSP.dll
2019-07-09 19:24 - 2019-07-04 06:56 - 000604984 _____ (Microsoft Corporation) C:\WINDOWS\system32\securekernel.exe
2019-07-09 19:24 - 2019-07-04 06:56 - 000493752 _____ (Microsoft Corporation) C:\WINDOWS\system32\bcryptprimitives.dll
2019-07-09 19:24 - 2019-07-04 06:56 - 000115512 _____ (Microsoft Corporation) C:\WINDOWS\system32\kdnet.dll
2019-07-09 19:24 - 2019-07-04 06:43 - 000832016 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SettingSyncHost.exe
2019-07-09 19:24 - 2019-07-04 06:43 - 000665440 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wer.dll
2019-07-09 19:24 - 2019-07-04 06:43 - 000328696 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wlanapi.dll
2019-07-09 19:24 - 2019-07-04 06:43 - 000287376 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Storage.ApplicationData.dll
2019-07-09 19:24 - 2019-07-04 06:43 - 000191800 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wermgr.exe
2019-07-09 19:24 - 2019-07-04 06:42 - 001980984 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\KernelBase.dll
2019-07-09 19:24 - 2019-07-04 06:42 - 001427768 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AppxPackaging.dll
2019-07-09 19:24 - 2019-07-04 06:42 - 000573808 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dnsapi.dll
2019-07-09 19:24 - 2019-07-04 06:42 - 000356312 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\bcryptprimitives.dll
2019-07-09 19:24 - 2019-07-04 06:42 - 000097272 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\bcrypt.dll
2019-07-09 19:24 - 2019-07-04 06:41 - 000559328 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AppXDeploymentClient.dll
2019-07-09 19:24 - 2019-07-04 06:26 - 000310272 _____ (Microsoft Corporation) C:\WINDOWS\system32\wc_storage.dll
2019-07-09 19:24 - 2019-07-04 06:26 - 000051200 _____ (Microsoft Corporation) C:\WINDOWS\system32\TpmTasks.dll
2019-07-09 19:24 - 2019-07-04 06:25 - 000295424 _____ (Microsoft Corporation) C:\WINDOWS\system32\TDLMigration.dll
2019-07-09 19:24 - 2019-07-04 06:25 - 000079872 _____ (Microsoft Corporation) C:\WINDOWS\system32\offreg.dll
2019-07-09 19:24 - 2019-07-04 06:24 - 000726528 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\PEAuth.sys
2019-07-09 19:24 - 2019-07-04 06:24 - 000567808 _____ (Microsoft Corporation) C:\WINDOWS\system32\daxexec.dll
2019-07-09 19:24 - 2019-07-04 06:24 - 000462336 _____ (Microsoft Corporation) C:\WINDOWS\system32\bcdedit.exe
2019-07-09 19:24 - 2019-07-04 06:24 - 000153600 _____ (Microsoft Corporation) C:\WINDOWS\system32\dssvc.dll
2019-07-09 19:24 - 2019-07-04 06:23 - 001765888 _____ (Microsoft Corporation) C:\WINDOWS\system32\audiosrv.dll
2019-07-09 19:24 - 2019-07-04 06:23 - 001217536 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpcore.dll
2019-07-09 19:24 - 2019-07-04 06:23 - 000786432 _____ (Microsoft Corporation) C:\WINDOWS\system32\iphlpsvc.dll
2019-07-09 19:24 - 2019-07-04 06:22 - 002587648 _____ (Microsoft Corporation) C:\WINDOWS\system32\wlansvc.dll
2019-07-09 19:24 - 2019-07-04 06:22 - 002176000 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentExtensions.onecore.dll
2019-07-09 19:24 - 2019-07-04 06:22 - 001561088 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentExtensions.desktop.dll
2019-07-09 19:24 - 2019-07-04 06:22 - 001549824 _____ (Microsoft Corporation) C:\WINDOWS\system32\lsasrv.dll
2019-07-09 19:24 - 2019-07-04 06:22 - 001175552 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingSyncCore.dll
2019-07-09 19:24 - 2019-07-04 06:22 - 000300544 _____ (Microsoft Corporation) C:\WINDOWS\system32\dnsrslvr.dll
2019-07-09 19:24 - 2019-07-04 06:22 - 000110592 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\profext.dll
2019-07-09 19:24 - 2019-07-04 06:22 - 000032768 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\werdiagcontroller.dll
2019-07-09 19:24 - 2019-07-04 06:21 - 005307392 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d2d1.dll
2019-07-09 19:24 - 2019-07-04 06:21 - 002166784 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32kbase.sys
2019-07-09 19:24 - 2019-07-04 06:21 - 001920000 _____ (Microsoft Corporation) C:\WINDOWS\system32\FntCache.dll
2019-07-09 19:24 - 2019-07-04 06:21 - 001220608 _____ (Microsoft Corporation) C:\WINDOWS\system32\Unistore.dll
2019-07-09 19:24 - 2019-07-04 06:21 - 000324096 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppxAllUserStore.dll
2019-07-09 19:24 - 2019-07-04 06:21 - 000124416 _____ (Microsoft Corporation) C:\WINDOWS\system32\profext.dll
2019-07-09 19:24 - 2019-07-04 06:21 - 000059392 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\offreg.dll
2019-07-09 19:24 - 2019-07-04 06:20 - 001156608 _____ (Microsoft Corporation) C:\WINDOWS\system32\rpcss.dll
2019-07-09 19:24 - 2019-07-04 06:20 - 000544256 _____ (Microsoft Corporation) C:\WINDOWS\system32\vbscript.dll
2019-07-09 19:24 - 2019-07-04 06:20 - 000392704 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\daxexec.dll
2019-07-09 19:24 - 2019-07-04 06:20 - 000330752 _____ (Microsoft Corporation) C:\WINDOWS\system32\ncryptprov.dll
2019-07-09 19:24 - 2019-07-04 06:19 - 000886272 _____ (Microsoft Corporation) C:\WINDOWS\system32\MPSSVC.dll
2019-07-09 19:24 - 2019-07-04 06:19 - 000230912 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AppxAllUserStore.dll
2019-07-09 19:24 - 2019-07-04 06:18 - 002602496 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\DWrite.dll
2019-07-09 19:24 - 2019-07-04 06:18 - 001076224 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rdpcore.dll
2019-07-09 19:24 - 2019-07-04 06:18 - 000965632 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Unistore.dll
2019-07-09 19:24 - 2019-07-04 06:18 - 000953344 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SettingSyncCore.dll
2019-07-09 19:24 - 2019-07-04 06:18 - 000275968 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ncryptprov.dll
2019-07-09 19:24 - 2019-07-04 06:17 - 000531968 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\vbscript.dll
2019-07-09 19:24 - 2019-07-04 05:01 - 000001312 _____ C:\WINDOWS\system32\tcbres.wim
2019-07-09 19:24 - 2019-06-21 10:50 - 000280584 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\msiscsi.sys
2019-07-09 19:24 - 2019-06-13 14:15 - 000324408 _____ (Microsoft Corporation) C:\WINDOWS\system32\acmigration.dll
2019-07-09 19:24 - 2019-06-13 14:00 - 000464696 _____ (Microsoft Corporation) C:\WINDOWS\system32\invagent.dll
2019-07-09 19:24 - 2019-06-13 13:58 - 000637752 _____ (Microsoft Corporation) C:\WINDOWS\system32\devinv.dll
2019-07-09 19:24 - 2019-06-13 13:58 - 000071480 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32appinventorycsp.dll
2019-07-09 19:24 - 2019-06-13 13:56 - 000164152 _____ (Microsoft Corporation) C:\WINDOWS\system32\CompatTelRunner.exe
2019-07-09 19:24 - 2019-06-13 13:43 - 001427984 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVEntSubsystemController.dll
2019-07-09 19:24 - 2019-06-13 13:43 - 001048480 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Internal.Shell.Broker.dll
2019-07-09 19:24 - 2019-06-13 13:42 - 002266936 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVEntSubsystems64.dll
2019-07-09 19:24 - 2019-06-13 13:42 - 000652088 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVPublishing.dll
2019-07-09 19:24 - 2019-06-13 13:42 - 000566536 _____ (Microsoft Corporation) C:\WINDOWS\system32\phoneactivate.exe
2019-07-09 19:24 - 2019-06-13 13:41 - 001626936 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVIntegration.dll
2019-07-09 19:24 - 2019-06-13 13:41 - 000830264 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVOrchestration.dll
2019-07-09 19:24 - 2019-06-13 13:41 - 000825144 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVEntStreamingManager.dll
2019-07-09 19:24 - 2019-06-13 13:41 - 000670008 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVCatalog.dll
2019-07-09 19:24 - 2019-06-13 13:40 - 000749880 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVReporting.dll
2019-07-09 19:24 - 2019-06-13 13:40 - 000540984 _____ (Microsoft Corporation) C:\WINDOWS\system32\pcasvc.dll
2019-07-09 19:24 - 2019-06-13 13:40 - 000495416 _____ (Microsoft Corporation) C:\WINDOWS\system32\TransportDSA.dll
2019-07-09 19:24 - 2019-06-13 13:38 - 000766264 _____ (Microsoft Corporation) C:\WINDOWS\system32\LicensingWinRT.dll
2019-07-09 19:24 - 2019-06-13 13:37 - 000101192 _____ (Microsoft Corporation) C:\WINDOWS\system32\changepk.exe
2019-07-09 19:24 - 2019-06-13 13:36 - 000251000 _____ (Microsoft Corporation) C:\WINDOWS\system32\sppwinob.dll
2019-07-09 19:24 - 2019-06-13 13:36 - 000236520 _____ (Microsoft Corporation) C:\WINDOWS\system32\EditionUpgradeManagerObj.dll
2019-07-09 19:24 - 2019-06-13 13:35 - 001376688 _____ (Microsoft Corporation) C:\WINDOWS\system32\ole32.dll
2019-07-09 19:24 - 2019-06-13 13:34 - 000146888 _____ (Microsoft Corporation) C:\WINDOWS\system32\LicensingUI.exe
2019-07-09 19:24 - 2019-06-13 13:17 - 000178176 _____ (Microsoft Corporation) C:\WINDOWS\system32\dmvdsitf.dll
2019-07-09 19:24 - 2019-06-13 13:17 - 000115200 _____ (Microsoft Corporation) C:\WINDOWS\system32\RjvMDMConfig.dll
2019-07-09 19:24 - 2019-06-13 13:17 - 000109056 _____ (Microsoft Corporation) C:\WINDOWS\system32\MDMAgent.exe
2019-07-09 19:24 - 2019-06-13 13:17 - 000093184 _____ (Microsoft Corporation) C:\WINDOWS\system32\WSReset.exe
2019-07-09 19:24 - 2019-06-13 13:16 - 000767488 _____ (Microsoft Corporation) C:\WINDOWS\system32\sppcommdlg.dll
2019-07-09 19:24 - 2019-06-13 13:15 - 000041984 _____ (Microsoft Corporation) C:\WINDOWS\system32\UpgradeResultsUI.exe
2019-07-09 19:24 - 2019-06-13 13:14 - 001127936 _____ (Microsoft Corporation) C:\WINDOWS\system32\nettrace.dll
2019-07-09 19:24 - 2019-06-13 13:14 - 000900096 _____ (Microsoft Corporation) C:\WINDOWS\system32\slui.exe
2019-07-09 19:24 - 2019-06-13 13:14 - 000346624 _____ (Microsoft Corporation) C:\WINDOWS\system32\AcGenral.dll
2019-07-09 19:24 - 2019-06-13 13:14 - 000246272 _____ (Microsoft Corporation) C:\WINDOWS\system32\DesktopSwitcherDataModel.dll
2019-07-09 19:24 - 2019-06-13 13:13 - 001339392 _____ (Microsoft Corporation) C:\WINDOWS\system32\TaskFlowDataEngine.dll
2019-07-09 19:24 - 2019-06-13 13:13 - 000951808 _____ (Microsoft Corporation) C:\WINDOWS\system32\sppcext.dll
2019-07-09 19:24 - 2019-06-13 13:13 - 000765440 _____ (Microsoft Corporation) C:\WINDOWS\system32\tdh.dll
2019-07-09 19:24 - 2019-06-13 13:13 - 000181248 _____ (Microsoft Corporation) C:\WINDOWS\system32\EditionUpgradeHelper.dll
2019-07-09 19:24 - 2019-06-13 13:12 - 000394240 _____ (Microsoft Corporation) C:\WINDOWS\system32\InputSwitch.dll
2019-07-09 19:24 - 2019-06-13 13:10 - 000239104 _____ (Microsoft Corporation) C:\WINDOWS\system32\vdsbas.dll
2019-07-09 19:24 - 2019-06-13 12:07 - 001027008 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ole32.dll
2019-07-09 19:24 - 2019-06-13 12:07 - 000660496 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\LicensingWinRT.dll
2019-07-09 19:24 - 2019-06-13 12:07 - 000221232 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\EditionUpgradeManagerObj.dll
2019-07-09 19:24 - 2019-06-13 11:54 - 000151552 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dmvdsitf.dll
2019-07-09 19:24 - 2019-06-13 11:53 - 000089600 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\olepro32.dll
2019-07-09 19:24 - 2019-06-13 11:51 - 000622080 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\tdh.dll
2019-07-09 19:24 - 2019-06-13 11:50 - 000896512 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\sppcext.dll
2019-07-09 19:24 - 2019-06-13 11:49 - 002406400 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AcGenral.dll
2019-07-09 19:24 - 2019-06-13 11:49 - 000371200 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\InputSwitch.dll
2019-07-09 19:24 - 2019-06-13 09:48 - 000677376 _____ (Microsoft Corporation) C:\WINDOWS\system32\HeadTrackerStorage.dll
2019-07-09 19:24 - 2019-06-13 09:46 - 000713216 _____ (Microsoft Corporation) C:\WINDOWS\system32\SharedRealitySvc.dll
2019-07-09 19:24 - 2019-06-13 09:01 - 000511288 _____ (Microsoft Corporation) C:\WINDOWS\system32\dcntel.dll
2019-07-09 19:24 - 2019-06-13 09:01 - 000036152 _____ (Microsoft Corporation) C:\WINDOWS\system32\DeviceCensus.exe
2019-07-09 19:24 - 2019-06-13 08:59 - 000785264 _____ (Microsoft Corporation) C:\WINDOWS\system32\pkeyhelper.dll
2019-07-09 19:24 - 2019-06-13 08:47 - 001063224 _____ (Microsoft Corporation) C:\WINDOWS\system32\SecConfig.efi
2019-07-09 19:24 - 2019-06-13 08:46 - 001076536 _____ (Microsoft Corporation) C:\WINDOWS\system32\efscore.dll
2019-07-09 19:24 - 2019-06-13 08:46 - 000510296 _____ (Microsoft Corporation) C:\WINDOWS\system32\policymanager.dll
2019-07-09 19:24 - 2019-06-13 08:46 - 000093984 _____ (Microsoft Corporation) C:\WINDOWS\system32\wldp.dll
2019-07-09 19:24 - 2019-06-13 08:45 - 002421560 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ntfs.sys
2019-07-09 19:24 - 2019-06-13 08:44 - 002546704 _____ (Microsoft Corporation) C:\WINDOWS\system32\UpdateAgent.dll
2019-07-09 19:24 - 2019-06-13 08:44 - 001098272 _____ (Microsoft Corporation) C:\WINDOWS\system32\msvproc.dll
2019-07-09 19:24 - 2019-06-13 08:44 - 001033696 _____ (Microsoft Corporation) C:\WINDOWS\system32\ClipSVC.dll
2019-07-09 19:24 - 2019-06-13 08:44 - 000607112 _____ (Microsoft Corporation) C:\WINDOWS\system32\TextInputFramework.dll
2019-07-09 19:24 - 2019-06-13 08:44 - 000545808 _____ (Microsoft Corporation) C:\WINDOWS\system32\hal.dll
2019-07-09 19:24 - 2019-06-13 08:44 - 000130624 _____ (Microsoft Corporation) C:\WINDOWS\system32\rmclient.dll
2019-07-09 19:24 - 2019-06-13 08:17 - 000106496 _____ (Microsoft Corporation) C:\WINDOWS\system32\NotificationControllerPS.dll
2019-07-09 19:24 - 2019-06-13 08:16 - 001626112 _____ (Microsoft Corporation) C:\WINDOWS\system32\enterprisecsps.dll
2019-07-09 19:24 - 2019-06-13 08:16 - 000140288 _____ (Microsoft Corporation) C:\WINDOWS\system32\mdmmigrator.dll
2019-07-09 19:24 - 2019-06-13 08:15 - 000514560 _____ (Microsoft Corporation) C:\WINDOWS\system32\nltest.exe
2019-07-09 19:24 - 2019-06-13 08:15 - 000433152 _____ (Microsoft Corporation) C:\WINDOWS\system32\MusNotification.exe
2019-07-09 19:24 - 2019-06-13 08:15 - 000204288 _____ (Microsoft Corporation) C:\WINDOWS\system32\enrollmentapi.dll
2019-07-09 19:24 - 2019-06-13 08:15 - 000137728 _____ (Microsoft Corporation) C:\WINDOWS\system32\InputLocaleManager.dll
2019-07-09 19:24 - 2019-06-13 08:15 - 000083456 _____ (Microsoft Corporation) C:\WINDOWS\system32\KdsCli.dll
2019-07-09 19:24 - 2019-06-13 08:14 - 000409088 _____ (Microsoft Corporation) C:\WINDOWS\system32\wlanmsm.dll
2019-07-09 19:24 - 2019-06-13 08:14 - 000361472 _____ (Microsoft Corporation) C:\WINDOWS\system32\DeviceEnroller.exe
2019-07-09 19:24 - 2019-06-13 08:14 - 000302080 _____ (Microsoft Corporation) C:\WINDOWS\system32\CXHProvisioningServer.dll
2019-07-09 19:24 - 2019-06-13 08:13 - 002370048 _____ (Microsoft Corporation) C:\WINDOWS\system32\WebRuntimeManager.dll
2019-07-09 19:24 - 2019-06-13 08:13 - 000761344 _____ (Microsoft Corporation) C:\WINDOWS\system32\nshwfp.dll
2019-07-09 19:24 - 2019-06-13 08:13 - 000322560 _____ (Microsoft Corporation) C:\WINDOWS\system32\MusNotificationUx.exe
2019-07-09 19:24 - 2019-06-13 08:13 - 000110592 _____ (Microsoft Corporation) C:\WINDOWS\system32\ngcpopkeysrv.dll
2019-07-09 19:24 - 2019-06-13 08:12 - 000916480 _____ (Microsoft Corporation) C:\WINDOWS\system32\MusUpdateHandlers.dll
2019-07-09 19:24 - 2019-06-13 08:12 - 000894464 _____ (Microsoft Corporation) C:\WINDOWS\system32\webplatstorageserver.dll
2019-07-09 19:24 - 2019-06-13 08:12 - 000808448 _____ (Microsoft Corporation) C:\WINDOWS\system32\EdgeManager.dll
2019-07-09 19:24 - 2019-06-13 08:12 - 000624640 _____ (Microsoft Corporation) C:\WINDOWS\system32\PsmServiceExtHost.dll
2019-07-09 19:24 - 2019-06-13 08:12 - 000532992 _____ (Microsoft Corporation) C:\WINDOWS\system32\QuietHours.dll
2019-07-09 19:24 - 2019-06-13 08:12 - 000501248 _____ (Microsoft Corporation) C:\WINDOWS\system32\rastls.dll
2019-07-09 19:24 - 2019-06-13 08:11 - 000508416 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingsHandlers_Notifications.dll
2019-07-09 19:24 - 2019-06-13 08:11 - 000271872 _____ (Microsoft Corporation) C:\WINDOWS\system32\wkssvc.dll
2019-07-09 19:24 - 2019-06-13 08:11 - 000048128 _____ (Microsoft Corporation) C:\WINDOWS\system32\TokenBrokerUI.dll
2019-07-09 19:24 - 2019-06-13 08:10 - 002912256 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuaueng.dll
2019-07-09 19:24 - 2019-06-13 08:10 - 001400832 _____ (Microsoft Corporation) C:\WINDOWS\system32\TokenBroker.dll
2019-07-09 19:24 - 2019-06-13 08:10 - 001215488 _____ (Microsoft Corporation) C:\WINDOWS\system32\NotificationController.dll
2019-07-09 19:24 - 2019-06-13 08:10 - 000871424 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.BackgroundMediaPlayback.dll
2019-07-09 19:24 - 2019-06-13 08:10 - 000869376 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.Playback.BackgroundMediaPlayer.dll
2019-07-09 19:24 - 2019-06-13 08:10 - 000849408 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.Playback.MediaPlayer.dll
2019-07-09 19:24 - 2019-06-13 08:10 - 000523776 _____ (Microsoft Corporation) C:\WINDOWS\system32\dmenrollengine.dll
2019-07-09 19:24 - 2019-06-13 08:09 - 001854976 _____ (Microsoft Corporation) C:\WINDOWS\system32\wevtsvc.dll
2019-07-09 19:24 - 2019-06-13 08:09 - 000922112 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Security.Authentication.Web.Core.dll
2019-07-09 19:24 - 2019-06-13 08:09 - 000755712 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Core.TextInput.dll
2019-07-09 19:24 - 2019-06-13 08:08 - 000506368 _____ (Microsoft Corporation) C:\WINDOWS\system32\edgeIso.dll
2019-07-09 19:24 - 2019-06-13 07:08 - 000443632 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\policymanager.dll
2019-07-09 19:24 - 2019-06-13 07:07 - 000101192 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rmclient.dll
2019-07-09 19:24 - 2019-06-13 07:07 - 000080744 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wldp.dll
2019-07-09 19:24 - 2019-06-13 07:06 - 001130776 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msvproc.dll
2019-07-09 19:24 - 2019-06-13 07:06 - 000581600 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MSVideoDSP.dll
2019-07-09 19:24 - 2019-06-13 06:49 - 000172544 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\enrollmentapi.dll
2019-07-09 19:24 - 2019-06-13 06:47 - 003554304 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\InputService.dll
2019-07-09 19:24 - 2019-06-13 06:47 - 002899456 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dwmcore.dll
2019-07-09 19:24 - 2019-06-13 06:47 - 000450048 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rastls.dll
2019-07-09 19:24 - 2019-06-13 06:46 - 000608768 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\EdgeManager.dll
2019-07-09 19:24 - 2019-06-13 06:46 - 000331776 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\edgeIso.dll
2019-07-09 19:24 - 2019-06-13 06:46 - 000038400 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TokenBrokerUI.dll
2019-07-09 19:24 - 2019-06-13 06:45 - 000602112 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\nshwfp.dll
2019-07-09 19:24 - 2019-06-13 06:45 - 000578560 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\webplatstorageserver.dll
2019-07-09 19:24 - 2019-06-13 06:44 - 001003008 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TokenBroker.dll
2019-07-09 19:24 - 2019-06-13 06:44 - 000648192 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.BackgroundMediaPlayback.dll
2019-07-09 19:24 - 2019-06-13 06:44 - 000630784 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.Playback.MediaPlayer.dll
2019-07-09 19:24 - 2019-06-13 06:44 - 000582144 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Core.TextInput.dll
2019-07-09 19:24 - 2019-06-13 06:44 - 000251904 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msIso.dll
2019-07-09 19:24 - 2019-06-13 06:43 - 000681472 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Security.Authentication.Web.Core.dll
2019-07-09 19:24 - 2019-06-13 06:43 - 000646656 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.Playback.BackgroundMediaPlayer.dll
2019-07-09 19:24 - 2019-06-13 06:43 - 000445952 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dmenrollengine.dll
2019-07-07 17:59 - 2019-07-07 18:10 - 234299675 _____ C:\Users\Lubka\Desktop\Tajemství (The secret).mp4
2019-07-06 12:14 - 2019-07-06 12:02 - 000543307 _____ C:\Users\Lubka\Desktop\banda_zlodejov_1.pdf

==================== One month (modified) ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2019-08-02 16:59 - 2018-04-12 01:38 - 000000000 ____D C:\WINDOWS\AppReadiness
2019-08-02 16:58 - 2018-12-14 10:49 - 000000000 ____D C:\Program Files\rempl
2019-08-02 16:58 - 2018-04-12 01:38 - 000000000 ___HD C:\Program Files\WindowsApps
2019-08-02 16:57 - 2018-12-20 22:18 - 000000000 ____D C:\Users\Jozko\AppData\LocalLow\Mozilla
2019-08-02 16:56 - 2018-04-12 01:38 - 000000000 ____D C:\ProgramData\regid.1991-06.com.microsoft
2019-08-02 16:54 - 2018-12-20 22:09 - 000730418 _____ C:\WINDOWS\system32\perfh007.dat
2019-08-02 16:54 - 2018-12-20 22:09 - 000149068 _____ C:\WINDOWS\system32\perfc007.dat
2019-08-02 16:54 - 2018-12-20 22:09 - 000116006 _____ C:\WINDOWS\system32\perfh01B.dat
2019-08-02 16:54 - 2018-12-20 22:09 - 000023440 _____ C:\WINDOWS\system32\perfc01B.dat
2019-08-02 16:54 - 2018-12-14 09:55 - 001841978 _____ C:\WINDOWS\system32\PerfStringBackup.INI
2019-08-02 16:54 - 2018-04-12 01:36 - 000000000 ____D C:\WINDOWS\INF
2019-08-02 16:49 - 2018-12-20 22:11 - 000000000 __SHD C:\Users\Jozko\IntelGraphicsProfiles
2019-08-02 16:49 - 2018-12-14 18:56 - 000000006 ____H C:\WINDOWS\Tasks\SA.DAT
2019-08-02 09:08 - 2018-04-11 23:04 - 000786432 _____ C:\WINDOWS\system32\config\BBI
2019-08-02 09:05 - 2018-12-14 18:53 - 000000000 ____D C:\WINDOWS\system32\SleepStudy
2019-08-01 13:52 - 2018-12-20 22:11 - 000000000 ____D C:\Users\Jozko\AppData\Local\Packages
2019-08-01 13:40 - 2018-12-20 22:11 - 000000000 ____D C:\Users\Jozko
2019-08-01 13:37 - 2015-10-30 09:24 - 000000000 ___HD C:\WINDOWS\system32\GroupPolicy
2019-07-31 22:43 - 2018-12-20 22:22 - 000000000 ____D C:\Users\Jozko\Desktop\Alte Firefox-Daten
2019-07-31 20:07 - 2018-12-14 18:56 - 000003834 _____ C:\WINDOWS\System32\Tasks\IUM-F1E24CA0-B63E-4F13-A9E3-4ADE3BFF3473
2019-07-31 20:01 - 2019-05-02 21:25 - 000000000 ____D C:\Users\Jozko\AppData\LocalLow\Temp
2019-07-31 19:08 - 2018-12-14 18:59 - 000000000 __SHD C:\Users\Lubka\IntelGraphicsProfiles
2019-07-30 22:27 - 2018-12-20 21:40 - 000000000 ____D C:\Users\Lubka\AppData\LocalLow\Mozilla
2019-07-30 21:17 - 2018-12-14 18:54 - 000000000 ____D C:\Users\Lubka
2019-07-30 21:05 - 2018-12-20 21:44 - 000000000 ____D C:\Users\Lubka\Desktop\Faktury-International-House
2019-07-30 20:43 - 2018-12-20 22:22 - 000000000 ____D C:\Users\Jozko\Documents\Korespondencia
2019-07-27 14:11 - 2018-12-14 18:56 - 000000000 ____D C:\WINDOWS\system32\Drivers\wd
2019-07-27 14:10 - 2018-12-14 11:22 - 000000000 ____D C:\ProgramData\Package Cache
2019-07-27 14:10 - 2018-12-14 11:22 - 000000000 ____D C:\Program Files (x86)\Intel
2019-07-25 03:25 - 2018-04-12 01:38 - 000000000 ____D C:\WINDOWS\InfusedApps.tmp
2019-07-25 02:42 - 2018-04-12 01:38 - 000000000 ____D C:\WINDOWS\InfusedApps
2019-07-25 02:38 - 2018-04-12 01:38 - 000000000 ____D C:\WINDOWS\registration
2019-07-25 01:38 - 2018-12-17 09:13 - 000000000 ____D C:\Users\Lubka\AppData\Local\D3DSCache
2019-07-25 01:01 - 2018-12-20 21:40 - 000000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2019-07-25 00:58 - 2018-04-12 01:38 - 000000000 ____D C:\WINDOWS\system32\NDF
2019-07-25 00:55 - 2019-01-05 16:50 - 000000000 ____D C:\Users\Lubka\AppData\Local\ElevatedDiagnostics
2019-07-24 23:06 - 2018-12-20 21:40 - 000001005 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Firefox.lnk
2019-07-24 22:59 - 2018-12-14 09:57 - 000000000 ____D C:\Users\Lubka\AppData\Local\VirtualStore
2019-07-24 21:16 - 2018-04-12 01:33 - 000466432 _____ (Microsoft Corporation) C:\WINDOWS\system32\dpnet.dll
2019-07-24 21:16 - 2018-04-12 01:33 - 000390656 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dpnet.dll
2019-07-24 21:16 - 2018-04-12 01:33 - 000218112 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dplayx.dll
2019-07-24 21:16 - 2018-04-12 01:33 - 000067584 _____ (Microsoft Corporation) C:\WINDOWS\system32\dpnathlp.dll
2019-07-24 21:16 - 2018-04-12 01:33 - 000061440 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dpnathlp.dll
2019-07-24 21:16 - 2018-04-12 01:33 - 000046592 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dpwsockx.dll
2019-07-24 21:16 - 2018-04-12 01:33 - 000026624 _____ (Microsoft Corporation) C:\WINDOWS\system32\dpnsvr.exe
2019-07-24 21:16 - 2018-04-12 01:33 - 000024064 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dpmodemx.dll
2019-07-24 21:16 - 2018-04-12 01:33 - 000023040 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dpnsvr.exe
2019-07-24 21:16 - 2018-04-12 01:33 - 000020480 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dplaysvr.exe
2019-07-24 21:16 - 2018-04-12 01:33 - 000010240 _____ (Microsoft Corporation) C:\WINDOWS\system32\dpnhupnp.dll
2019-07-24 21:16 - 2018-04-12 01:33 - 000010240 _____ (Microsoft Corporation) C:\WINDOWS\system32\dpnhpast.dll
2019-07-24 21:16 - 2018-04-12 01:33 - 000008704 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dpnhupnp.dll
2019-07-24 21:16 - 2018-04-12 01:33 - 000008704 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dpnhpast.dll
2019-07-24 21:16 - 2018-04-12 01:33 - 000006144 _____ (Microsoft Corporation) C:\WINDOWS\system32\dpnlobby.dll
2019-07-24 21:16 - 2018-04-12 01:33 - 000006144 _____ (Microsoft Corporation) C:\WINDOWS\system32\dpnaddr.dll
2019-07-24 21:16 - 2018-04-12 01:33 - 000005120 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dpnlobby.dll
2019-07-24 21:16 - 2018-04-12 01:33 - 000005120 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dpnaddr.dll
2019-07-24 21:16 - 2018-04-12 01:30 - 000000000 ____D C:\WINDOWS\CbsTemp
2019-07-17 14:09 - 2018-12-14 09:57 - 000000000 ____D C:\Users\Lubka\AppData\Local\Packages
2019-07-17 08:32 - 2018-12-14 11:11 - 000002313 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2019-07-17 08:32 - 2018-12-14 11:11 - 000002272 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2019-07-16 09:29 - 2018-12-20 21:44 - 000000000 ____D C:\Users\Lubka\Desktop\Meditacie
2019-07-16 08:14 - 2018-12-20 21:48 - 000000000 ____D C:\Users\Lubka\Documents\Ostatné
2019-07-13 17:03 - 2018-12-27 12:39 - 000000000 ____D C:\Users\Jozko\AppData\Local\Adobe
2019-07-13 17:03 - 2018-04-12 01:38 - 000000000 ____D C:\WINDOWS\SysWOW64\Macromed
2019-07-13 17:03 - 2018-04-12 01:38 - 000000000 ____D C:\WINDOWS\system32\Macromed
2019-07-13 17:02 - 2018-12-14 11:09 - 000000000 ____D C:\Users\Lubka\AppData\Local\Adobe
2019-07-13 16:47 - 2019-06-30 12:12 - 000000000 ____D C:\Users\Jozko\AppData\Roaming\InstallShield Installation Information
2019-07-13 14:43 - 2019-06-30 12:12 - 000000653 _____ C:\Users\Jozko\Desktop\Ip Camera Client.lnk
2019-07-13 13:57 - 2018-12-20 22:16 - 000003380 _____ C:\WINDOWS\System32\Tasks\OneDrive Standalone Update Task-S-1-5-21-1960842775-2088100534-3542962694-1002
2019-07-13 13:57 - 2018-12-20 22:12 - 000000000 ___RD C:\Users\Jozko\OneDrive
2019-07-13 13:57 - 2018-12-20 22:11 - 000002383 _____ C:\Users\Jozko\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OneDrive.lnk
2019-07-13 13:56 - 2018-12-20 22:11 - 000000000 ___RD C:\Users\Jozko\3D Objects
2019-07-13 13:56 - 2018-12-14 09:57 - 000000000 __RHD C:\Users\Public\AccountPictures
2019-07-10 22:06 - 2018-12-14 10:50 - 000741432 ____N (Microsoft Corporation) C:\WINDOWS\system32\MpSigStub.exe
2019-07-09 21:11 - 2018-12-14 18:56 - 000000000 ___RD C:\Users\Lubka\3D Objects
2019-07-09 21:10 - 2018-12-14 18:53 - 000399520 _____ C:\WINDOWS\system32\FNTCACHE.DAT
2019-07-09 21:10 - 2018-04-12 19:08 - 000000000 ____D C:\Program Files\Windows Defender Advanced Threat Protection
2019-07-09 21:10 - 2018-04-12 01:38 - 000000000 ____D C:\WINDOWS\TextInput
2019-07-09 21:10 - 2018-04-12 01:38 - 000000000 ____D C:\WINDOWS\SysWOW64\oobe
2019-07-09 21:10 - 2018-04-12 01:38 - 000000000 ____D C:\WINDOWS\SysWOW64\Dism
2019-07-09 21:10 - 2018-04-12 01:38 - 000000000 ____D C:\WINDOWS\system32\oobe
2019-07-09 21:10 - 2018-04-12 01:38 - 000000000 ____D C:\WINDOWS\system32\appraiser
2019-07-09 21:10 - 2018-04-12 01:38 - 000000000 ____D C:\WINDOWS\ShellComponents
2019-07-09 21:10 - 2018-04-12 01:38 - 000000000 ____D C:\WINDOWS\Provisioning
2019-07-09 21:10 - 2018-04-12 01:38 - 000000000 ____D C:\WINDOWS\bcastdvr
2019-07-09 21:10 - 2018-04-11 23:04 - 000000000 ____D C:\WINDOWS\system32\Dism
2019-07-09 19:24 - 2018-12-14 10:49 - 000000000 ____D C:\WINDOWS\system32\MRT
2019-07-09 19:21 - 2018-12-14 10:49 - 136618864 ____C (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2019-07-09 15:31 - 2018-12-14 18:56 - 000003380 _____ C:\WINDOWS\System32\Tasks\OneDrive Standalone Update Task-S-1-5-21-1960842775-2088100534-3542962694-1001
2019-07-09 15:31 - 2018-12-14 18:54 - 000002383 _____ C:\Users\Lubka\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OneDrive.lnk
2019-07-09 15:31 - 2018-12-14 09:59 - 000000000 ___RD C:\Users\Lubka\OneDrive

==================== SigCheck ===============================

(There is no automatic fix for files that do not pass verification.)

==================== End of FRST.txt ============================
         

--- --- ---

--- --- ---

--- --- ---

Servus,



gut gemacht.
Das sind die richtigen Logdateien.

Variante von Win32/HackTool.Crack.DK potenziell unsichere Anwendung (Gesäubert durch Löschen)" ac=C fn="D:\Games\The Sims 4\Game\Bin\RldOrigin.dll

Lesestoff:
Illegale Software: Cracks, Keygens und Co

Bitte lesen => Cracks, Keygens und andere illegale Software

Es geht weiter wenn du alles Illegale entfernt hast.


Bei wiederholten Crack/Keygen Verstößen behalte ich es mir vor, den Support einzustellen, d.h. Hilfe nur noch bei der Datensicherung und Neuinstallation des Betriebssystems.