Ahoj,
díky moc. No problémy jsem vlastně žádné nikdy neměl, celé jsem to podnikl kvůli tomu že mi dal do karantény něco Windows Defender. Je v pohodě, že ten Zemana dal do karantény tolik věcí, co vypadá jako běžné součásti programů? Díky.
Zoek.exe Version 5.0.0.2 Updated 03-May-2018
Tool run by Marek on st 04. 12. 2019 at 18:45:18.82.
Microsoft Windows 10 Pro 10.0.18363 x86
Running in: Normal Mode No Internet Access Detected
Launched: C:\Users\Marek\Downloads\zoek.exe [Scan all users] [Script inserted]
==== System Restore Info ======================
4. 12. 2019 18:46:25 Zoek.exe System Restore Point Created Successfully.
==== Reset Hosts File ======================
# Copyright (c) 1993-2006 Microsoft Corp.
#
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
#
# This file contains the mappings of IP addresses to host names. Each
# entry should be kept on an individual line. The IP address should
# be placed in the first column followed by the corresponding host name.
# The IP address and the host name should be separated by at least one
# space.
#
# Additionally, comments (such as these) may be inserted on individual
# lines or following the machine name denoted by a '#' symbol.
#
# For example:
#
# 102.54.94.97 rhino.acme.com # source server
# 38.25.63.10 x.acme.com # x client host
# localhost name resolution is handled within DNS itself.
127.0.0.1 localhost
::1 localhost
==== Empty Folders Check ======================
C:\Program Files\Altium deleted successfully
C:\Program Files\Aponia Software deleted successfully
C:\Program Files\Freemake deleted successfully
C:\Program Files\paint.net deleted successfully
C:\Program Files\Common Files\SolidWorks Shared deleted successfully
C:\PROGRA~2\Altium deleted successfully
C:\PROGRA~2\cgqaq deleted successfully
C:\PROGRA~2\Comms deleted successfully
C:\PROGRA~2\Foxit Software deleted successfully
C:\PROGRA~2\SoftwareDistribution deleted successfully
C:\PROGRA~2\{C7B6FB8A-EF9E-83F2-B7C6-ABDA5F2E7302} deleted successfully
C:\Users\Marek\AppData\Roaming\Altium deleted successfully
C:\Users\Marek\AppData\Roaming\DassaultSystemes deleted successfully
C:\Users\Marek\AppData\Roaming\JRT Studio deleted successfully
C:\Users\Marek\AppData\Roaming\Mediatronic deleted successfully
C:\Users\Marek\AppData\Roaming\MPC-HC deleted successfully
C:\Users\Marek\AppData\Roaming\v1home deleted successfully
C:\Users\Marek\AppData\Local\ActiveSync deleted successfully
C:\Users\Marek\AppData\Local\Altium deleted successfully
C:\Users\Marek\AppData\Local\AltiumSecurityService deleted successfully
C:\Users\Marek\AppData\Local\DassaultSystemes deleted successfully
C:\Users\Marek\AppData\Local\DBG deleted successfully
C:\Users\Marek\AppData\Local\ESET deleted successfully
C:\Users\Marek\AppData\Local\PeerDistRepub deleted successfully
C:\WINDOWS\serviceprofiles\networkservice\AppData\Local\DBG deleted successfully
C:\WINDOWS\serviceprofiles\networkservice\AppData\Local\Maps deleted successfully
C:\WINDOWS\serviceprofiles\networkservice\AppData\Local\PeerDistPub deleted successfully
C:\WINDOWS\serviceprofiles\networkservice\AppData\Local\PeerDistRepub deleted successfully
C:\WINDOWS\serviceprofiles\Localservice\AppData\Local\NetworkTiles deleted successfully
C:\WINDOWS\serviceprofiles\Localservice\AppData\Local\Packages deleted successfully
==== Deleting CLSID Registry Keys ======================
==== Deleting CLSID Registry Values ======================
==== Deleting Services ======================
==== FireFox Fix ======================
Deleted from C:\Users\Marek\AppData\Roaming\Mozilla\Firefox\Profiles\monwb6nn.default\prefs.js:
user_pref("browser.startup.homepage", "https://www.seznam.cz/");
Added to C:\Users\Marek\AppData\Roaming\Mozilla\Firefox\Profiles\monwb6nn.default\prefs.js:
user_pref("browser.startup.homepage", "about:home");
user_pref("browser.newtab.url", "about:newtab");
Deleted from C:\Users\Marek\AppData\Roaming\Thunderbird\Profiles\rjoxn021.default\prefs.js:
Added to C:\Users\Marek\AppData\Roaming\Thunderbird\Profiles\rjoxn021.default\prefs.js:
user_pref("browser.startup.homepage", "about:home");
user_pref("browser.newtab.url", "about:newtab");
ProfilePath: C:\Users\Marek\AppData\Roaming\Mozilla\Firefox\Profiles\monwb6nn.default
user.js not found
---- Lines searchengine removed from prefs.js ----
user_pref("browser.pageActions.persistedActions", "{\"version\":1,\"ids\":[\"bookmark\",\"bookmarkSeparator\",\"copyURL\",\"emailLink\",\"sendToDevice
---- FireFox user.js and prefs.js backups ----
prefs_201904.12._1902_.backup
ProfilePath: C:\Users\Marek\AppData\Roaming\Thunderbird\Profiles\rjoxn021.default
user.js not found
---- FireFox user.js and prefs.js backups ----
prefs_201904.12._1902_.backup
==== Deleting Files \ Folders ======================
C:\Program Files\Altium not found
C:\Users\Marek\AppData\Local\Altium not found
C:\Program Files\Aponia Software not found
C:\Program Files\Freemake not found
C:\Program Files\paint.net not found
C:\PROGRA~2\{C7B6FB8A-EF9E-83F2-B7C6-ABDA5F2E7302} not found
C:\Users\Marek\AppData\Local\paint.net deleted
C:\Program Files\OWON deleted
C:\Users\Marek\.android deleted
C:\instalace.js deleted
C:\setup.exe deleted
C:\Users\Marek\AppData\Roaming\WB.CFG deleted
C:\Users\Marek\AppData\Roaming\Kingsoft deleted
C:\WINDOWS\system32\config\systemprofile\AppData\Roaming\Safer-Networking.log deleted
C:\PROGRA~2\Package Cache deleted
C:\Users\Marek\AppData\Local\AVAST Software deleted
C:\Users\Marek\AppData\Local\cache deleted
C:\Users\Marek\AppData\Local\CrashRpt deleted
C:\WINDOWS\system32\config\systemprofile\AppData\Local\CM27480.tmp deleted
C:\WINDOWS\system32\GroupPolicy\Machine deleted
C:\WINDOWS\system32\GroupPolicy\User deleted
C:\WINDOWS\system32\GroupPolicy\gpt.ini deleted
"C:\Users\Marek\AppData\Local\cloudready_installer_uuid" deleted
"C:\Program Files\ModifiableWindowsApps" deleted
"C:\Program Files\Windows Defender Advanced Threat Protection" deleted
"C:\Program Files\Windows Defender Advanced Threat Protection" deleted
==== Firefox Start and Search pages ======================
ProfilePath: C:\Users\Marek\AppData\Roaming\Mozilla\Firefox\Profiles\monwb6nn.default
user_pref("browser.startup.homepage", "about:home");
user_pref("browser.newtab.url", "about:newtab");
ProfilePath: C:\Users\Marek\AppData\Roaming\Thunderbird\Profiles\rjoxn021.default
user_pref("browser.startup.homepage", "about:home");
user_pref("browser.newtab.url", "about:newtab");
==== Firefox Extensions ======================
ProfilePath: C:\Users\Marek\AppData\Roaming\Mozilla\Firefox\Profiles\monwb6nn.default
- OneNote Web Clipper - %ProfilePath%\extensions\Clipper@OneNote.com.xpi
- Send to Kodi - %ProfilePath%\extensions\jid0-YCM0p5WlCGjvBJcZhAusQ5h26wM@jetpack.xpi
ProfilePath: C:\Users\Marek\AppData\Roaming\Thunderbird\Profiles\rjoxn021.default
- esk slovnk pro kontrolu pravopisu - %ProfilePath%\extensions\cs@dictionaries.addons.mozilla.org
- TT DeepDark - %ProfilePath%\extensions\{9ed238c0-af95-11e0-9f1c-0800200c9a66}
==== Firefox Plugins ======================
Profilepath: C:\Users\Marek\AppData\Roaming\Mozilla\Firefox\Profiles\monwb6nn.default
54E5D2B708366C812636E12BCAC0155B - C:\WINDOWS\system32\Macromed\Flash\NPSWF32_32_0_0_293.dll - Shockwave Flash
10FFDDCB31B87E48AA264566FF93F51E - C:\Program Files\Microsoft Silverlight\5.1.50918.0\npctrl.dll - Silverlight Plug-In
3D7B9956A148376196627CD49E1A98F7 - C:\Program Files\Microsoft Silverlight\5.1.50918.0\npctrlui.dll - Microsoft® Silverlight
EAAB98D8D13A8664F7C7488447F182EF - C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dv.dll - NVIDIA 3D Vision
B0093BE1B74BA93BDC2625C5ABE115BF - C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll - NVIDIA 3D VISION
20396879736F146B6588D32EE77B8F03 - C:\Program Files\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll - Adobe Acrobat
==== Chromium Look ======================
Chromium Browser Version: 63.0.3237.0
==== Set IE to Default ======================
Old Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"="http://go.microsoft.com/fwlink/p/?LinkId=255141"
New Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"="http://go.microsoft.com/fwlink/p/?LinkId=255141"
==== All HKLM and HKCU SearchScopes ======================
HKLM\SearchScopes "DefaultScope"="{0633EE93-D776-472f-A0FF-E1416B8B2E3A}"
HKLM\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} -
http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
HKCU\SearchScopes "DefaultScope"="{0633EE93-D776-472f-A0FF-E1416B8B2E3A}"
HKCU\SearchScopes\{012E1000-F331-11DB-8314-0800200C9A66} -
http://www.google.com/search?q={searchTerms}
HKCU\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} -
http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IESR02
==== Reset Google Chrome ======================
Nothing found to reset
==== Empty IE Cache ======================
C:\Users\Marek\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 emptied successfully
C:\WINDOWS\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 emptied successfully
C:\WINDOWS\serviceprofiles\Localservice\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 emptied successfully
C:\WINDOWS\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 emptied successfully
C:\Users\Marek\AppData\Local\Microsoft\Windows\INetCache\IE emptied successfully
C:\WINDOWS\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE emptied successfully
C:\WINDOWS\serviceprofiles\Localservice\AppData\Local\Microsoft\Windows\INetCache\IE emptied successfully
==== Empty FireFox Cache ======================
C:\Users\Marek\AppData\Local\Mozilla\Firefox\Profiles\monwb6nn.default\cache2 emptied successfully
==== Empty Edge Cache ======================
Edge Cache Emptied Successfully
==== Empty Chrome Cache ======================
No Chrome User Data found
==== Empty All Flash Cache ======================
Flash Cache Emptied Successfully
==== Empty All Java Cache ======================
No Java Cache Found
==== C:\zoek_backup content ======================
C:\zoek_backup (files=920 folders=340 805369681 bytes)
==== Empty Temp Folders ======================
C:\Users\Default\AppData\Local\Temp emptied successfully
C:\Users\Default User\AppData\Local\Temp emptied successfully
C:\Users\DefaultAppPool\AppData\Local\Temp emptied successfully
C:\Users\Marek\AppData\Local\Temp will be emptied at reboot
C:\WINDOWS\serviceprofiles\networkservice\AppData\Local\Temp emptied successfully
C:\WINDOWS\serviceprofiles\Localservice\AppData\Local\Temp emptied successfully
C:\WINDOWS\Temp will be emptied at reboot
==== After Reboot ======================
==== Empty Temp Folders ======================
C:\WINDOWS\Temp successfully emptied
C:\Users\Marek\AppData\Local\Temp successfully emptied
==== Empty Recycle Bin ======================
C:\$RECYCLE.BIN successfully emptied
==== EOF on st 04. 12. 2019 at 19:08:24.54 ======================
Informace o kontroly
Název produktu : Zemana AntiMalware
Stav kontroly : Dokončena
Datum kontroly : 4. 12. 2019 19:12:48
Typ kontroly : Inteligentní kontrola
Čas trvání : 00:00:42
Zkontrolované objekty : 1679
Zjištěné objekty : 24
Vyloučené objekty : 0
Automatické odesílání : Ne
Operační systém : Windows 10 x86
Procesor : 2X Intel(R) Celeron(R) CPU G1840 @ 2.80GHz
Režim systému BIOS : Legacy
Informace o doméně : WORKGROUP,False,NetSetupWorkgroupName
CUID : 127D1DB631FB27B5157BA8
Odhalení
MD5 : 3FF5D044E56F2DC564F679E1557D25BE
Stav : Zkontrolováno
Objekt : c:\program files\common files\adobe\arm\1.0\armsvc.exe
Vydavatel : Adobe Inc.
Velikost : 88136
Odhalení : Suspicious:SRC!P
Akce : Karanténa
-----------------------------------------------------------------------
MD5 : D52B5DCE98F3A64E447226204F5353EE
Stav : Zkontrolováno
Objekt : c:\program files\3dconnexion\3dxware\3dxwincore32\en-us\3dxservice.dll
Vydavatel :
Velikost : 524800
Odhalení : Suspicious:SRC!P
Akce : Karanténa
-----------------------------------------------------------------------
MD5 : 466257B924A813BF42F91F12B6060630
Stav : Zkontrolováno
Objekt : c:\program files\windowsapps\microsoft.windowsstore_11911.1001.9.0_x86__8wekyb3d8bbwe\winstore.app.exe
Vydavatel :
Velikost : 19968
Odhalení : Suspicious:SRC!P
Akce : Karanténa
-----------------------------------------------------------------------
MD5 : 5F9CBB569D97397D6B064E5AB7360682
Stav : Zkontrolováno
Objekt : c:\program files\windowsapps\microsoft.yourphone_1.19111.85.0_x86__8wekyb3d8bbwe\appconfig.dll
Vydavatel :
Velikost : 364544
Odhalení : Suspicious:SRC!P
Akce : Karanténa
-----------------------------------------------------------------------
MD5 : 77158A7AC30B1BB2F164655C9504A292
Stav : Zkontrolováno
Objekt : c:\program files\windowsapps\microsoft.yourphone_1.19111.85.0_x86__8wekyb3d8bbwe\yourphone.datastore.dll
Vydavatel :
Velikost : 2794496
Odhalení : Suspicious:SRC!P
Akce : Karanténa
-----------------------------------------------------------------------
MD5 : 612EC152A75F5044F0E95210EDED0870
Stav : Zkontrolováno
Objekt : c:\program files\windowsapps\microsoft.windowscommunicationsapps_16005.12228.20276.0_x86__8wekyb3d8bbwe\hxoutlook_app.dll
Vydavatel :
Velikost : 1912320
Odhalení : Suspicious:SRC!P
Akce : Karanténa
-----------------------------------------------------------------------
MD5 : F46B37A806E24CC1F8E5F6DC292DE479
Stav : Zkontrolováno
Objekt : c:\program files\windowsapps\microsoft.windowscommunicationsapps_16005.12228.20276.0_x86__8wekyb3d8bbwe\hxoutlook.model.dll
Vydavatel :
Velikost : 191488
Odhalení : Suspicious:SRC!P
Akce : Karanténa
-----------------------------------------------------------------------
MD5 : 65B625B9C415DB1497CA2DED48347268
Stav : Zkontrolováno
Objekt : c:\program files\windowsapps\microsoft.windowscommunicationsapps_16005.12228.20276.0_x86__8wekyb3d8bbwe\hxcommmodel.dll
Vydavatel :
Velikost : 1998336
Odhalení : Suspicious:SRC!P
Akce : Karanténa
-----------------------------------------------------------------------
MD5 : B478D66CE58093FDBE73E3860368A141
Stav : Zkontrolováno
Objekt : c:\program files\windowsapps\microsoft.windowscommunicationsapps_16005.12228.20276.0_x86__8wekyb3d8bbwe\office.ui.xaml.hxshared.dll
Vydavatel :
Velikost : 4910592
Odhalení : Suspicious:SRC!P
Akce : Karanténa
-----------------------------------------------------------------------
MD5 : E163C5401E6F6883867AD0CB4434BFA7
Stav : Zkontrolováno
Objekt : c:\program files\windowsapps\microsoft.windowscommunicationsapps_16005.12228.20276.0_x86__8wekyb3d8bbwe\hxcomm.ipc.proxies.dll
Vydavatel :
Velikost : 13824
Odhalení : Suspicious:SRC!P
Akce : Karanténa
-----------------------------------------------------------------------
MD5 : 06DA3D6FF6B1175330669415B052264F
Stav : Zkontrolováno
Objekt : c:\program files\windowsapps\microsoft.windowsstore_11911.1001.9.0_x86__8wekyb3d8bbwe\winstore.preview.dll
Vydavatel :
Velikost : 236032
Odhalení : Suspicious:SRC!P
Akce : Karanténa
-----------------------------------------------------------------------
MD5 : EE2B770E443D5EC33FB4D15C101C4817
Stav : Zkontrolováno
Objekt : c:\program files\windowsapps\microsoft.yourphone_1.19111.85.0_x86__8wekyb3d8bbwe\yourphone.appcore.dll
Vydavatel :
Velikost : 1168896
Odhalení : Suspicious:SRC!P
Akce : Karanténa
-----------------------------------------------------------------------
MD5 : 7D490F7D3DDB09BA6FFF3EE4D961730A
Stav : Zkontrolováno
Objekt : c:\program files\windowsapps\microsoft.yourphone_1.19111.85.0_x86__8wekyb3d8bbwe\yourphone.appcore.winrt.dll
Vydavatel :
Velikost : 3353088
Odhalení : Suspicious:SRC!P
Akce : Karanténa
-----------------------------------------------------------------------
MD5 : A33EBFF5B1A6189A38D84DDF11E437FD
Stav : Zkontrolováno
Objekt : c:\program files\windowsapps\microsoft.yourphone_1.19111.85.0_x86__8wekyb3d8bbwe\phonecommunicationappservice.dll
Vydavatel :
Velikost : 4353536
Odhalení : Suspicious:SRC!P
Akce : Karanténa
-----------------------------------------------------------------------
MD5 : 5646F89B10F670FB7951741649AE09CA
Stav : Zkontrolováno
Objekt : c:\program files\windowsapps\microsoft.windowscommunicationsapps_16005.12228.20276.0_x86__8wekyb3d8bbwe\hxoutlook.exe
Vydavatel :
Velikost : 1433088
Odhalení : Suspicious:SRC!P
Akce : Karanténa
-----------------------------------------------------------------------
MD5 : 4EEC34B8DFF6E4B4A87747BF913BBAD4
Stav : Zkontrolováno
Objekt : c:\program files\windowsapps\microsoft.windowscommunicationsapps_16005.12228.20276.0_x86__8wekyb3d8bbwe\microsoft.applications.telemetry.windows.dll
Vydavatel :
Velikost : 824832
Odhalení : Suspicious:SRC!P
Akce : Karanténa
-----------------------------------------------------------------------
MD5 : A487D68EB20B5924585AD6CA028524BD
Stav : Zkontrolováno
Objekt : c:\program files\windowsapps\microsoft.windowscommunicationsapps_16005.12228.20276.0_x86__8wekyb3d8bbwe\hxoutlook.view.dll
Vydavatel :
Velikost : 2750464
Odhalení : Suspicious:SRC!P
Akce : Karanténa
-----------------------------------------------------------------------
MD5 : 3AADF585FEBF010C88A89EDBE3703471
Stav : Zkontrolováno
Objekt : c:\program files\windowsapps\microsoft.windowscommunicationsapps_16005.12228.20276.0_x86__8wekyb3d8bbwe\hxoutlook.viewmodel.dll
Vydavatel :
Velikost : 3622912
Odhalení : Suspicious:SRC!P
Akce : Karanténa
-----------------------------------------------------------------------
MD5 : 6926D44FCD9ED3AC8E2C8959E9E74CDE
Stav : Zkontrolováno
Objekt : c:\program files\windowsapps\microsoft.windowscommunicationsapps_16005.12228.20276.0_x86__8wekyb3d8bbwe\hxoutlook.resources.dll
Vydavatel :
Velikost : 131072
Odhalení : Suspicious:SRC!P
Akce : Karanténa
-----------------------------------------------------------------------
MD5 : 04776CD7A607979C9839C4F78D298EC2
Stav : Zkontrolováno
Objekt : c:\program files\windowsapps\microsoft.windowscommunicationsapps_16005.12228.20276.0_x86__8wekyb3d8bbwe\office.ui.xaml.hx.mail.dll
Vydavatel :
Velikost : 5065728
Odhalení : Suspicious:SRC!P
Akce : Karanténa
-----------------------------------------------------------------------
MD5 : 20396879736F146B6588D32EE77B8F03
Stav : Zkontrolováno
Objekt : c:\program files\adobe\acrobat reader dc\reader\air\nppdf32.dll
Vydavatel : Adobe Inc.
Velikost : 264752
Odhalení : Suspicious:SRC!R
Akce : Karanténa
-----------------------------------------------------------------------
MD5 : FD0D01239C2D0A7C46D8837FB0C127D8
Stav : Zkontrolováno
Objekt : c:\program files\windowsapps\microsoft.windowscommunicationsapps_16005.12228.20276.0_x86__8wekyb3d8bbwe\office.ui.xaml.hxcalendar.dll
Vydavatel :
Velikost : 7236096
Odhalení : Suspicious:SRC!P
Akce : Karanténa
-----------------------------------------------------------------------
MD5 : 0B4F071E3E82D664AE9D3C3A6BAE731C
Stav : Zkontrolováno
Objekt : c:\program files\windowsapps\microsoft.windowscommunicationsapps_16005.12228.20276.0_x86__8wekyb3d8bbwe\hxtsr.exe
Vydavatel :
Velikost : 79872
Odhalení : Suspicious:SRC!P
Akce : Karanténa
-----------------------------------------------------------------------
MD5 : 140CD58EE85A6219D5332CF93E2C32A3
Stav : Zkontrolováno
Objekt : c:\program files\windowsapps\microsoft.windowscommunicationsapps_16005.12228.20276.0_x86__8wekyb3d8bbwe\hxoutlookbackground.dll
Vydavatel :
Velikost : 1649152
Odhalení : Suspicious:SRC!P
Akce : Karanténa
-----------------------------------------------------------------------
Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 19:14:44, on 4. 12. 2019
Platform: Unknown Windows (WinNT 6.02.1008)
MSIE: Internet Explorer v11.0 (11.00.18362.0001)
Boot mode: Normal
Running processes:
C:\WINDOWS\system32\sihost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\taskhostw.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
C:\Windows\System32\RuntimeBroker.exe
C:\WINDOWS\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe
C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\smartscreen.exe
C:\Windows\System32\SecurityHealthSystray.exe
C:\Program Files\3Dconnexion\3DxWare\3DxNLServer\bin\3DxNLServer.exe
C:\Program Files\3Dconnexion\3DxWare\3DxWinCore32\3DxPieMenus.exe
C:\Program Files\3Dconnexion\3DxWare\3DxWinCore32\3DxVirtualLCD.exe
C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
C:\Program Files\3Dconnexion\3DxWare\3DxWinCore32\3DxProfileServer.exe
C:\Users\Marek\AppData\Local\Microsoft\OneDrive\OneDrive.exe
C:\Program Files\WindowsApps\AppleInc.iTunes_12102.3.43028.0_x86__nzyj5cx40ttqa\AMDS32\AppleMobileDeviceProcess.exe
C:\WINDOWS\system32\ApplicationFrameHost.exe
C:\WINDOWS\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe
C:\Windows\System32\RuntimeBroker.exe
C:\WINDOWS\system32\SettingSyncHost.exe
C:\WINDOWS\system32\DllHost.exe
C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
C:\Windows\System32\SystemSettingsBroker.exe
C:\Users\Marek\AppData\Local\Microsoft\OneDrive\19.192.0926.0012\FileCoAuth.exe
C:\Windows\System32\RuntimeBroker.exe
C:\WINDOWS\SystemApps\InputApp_cw5n1h2txyewy\WindowsInternal.ComposableShell.Experiences.TextInput.InputApp.exe
C:\Users\Marek\Downloads\hijackthis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page =
http://go.microsoft.com/fwlink/?LinkId=54896R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
http://go.microsoft.com/fwlink/p/?LinkId=255141R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
http://go.microsoft.com/fwlink/p/?LinkId=255141R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
http://go.microsoft.com/fwlink/?LinkId=54896R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =
http://go.microsoft.com/fwlink/?LinkId=54896R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
http://go.microsoft.com/fwlink/p/?LinkId=255141R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O4 - HKLM\..\Run: [SecurityHealth] %windir%\system32\SecurityHealthSystray.exe
O4 - HKLM\..\Run: [HotKeysCmds] "C:\WINDOWS\system32\hkcmd.exe"
O4 - HKLM\..\Run: [Persistence] "C:\WINDOWS\system32\igfxpers.exe"
O4 - HKLM\..\Run: [IAStorIcon] "C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIconLaunch.exe" "C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe" 60
O4 - HKLM\..\Run: [3DxWinCore Service] "C:\Program Files\3Dconnexion\3DxWare\3DxWinCore32\3DxService.exe" -quiet
O4 - HKLM\..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe -s
O4 - HKCU\..\Run: [OneDrive] "C:\Users\Marek\AppData\Local\Microsoft\OneDrive\OneDrive.exe" /background
O4 - HKCU\..\Run: [Chromium] "c:\users\marek\appdata\local\chromium\application\chrome.exe" --auto-launch-at-startup --profile-directory="Default" --restore-last-session
O4 - HKUS\S-1-5-18\..\RunOnce: [Application Restart #0] C:\Program Files\ASUS\GPU TweakII\GPUTweakII.exe /RestartByRestartManager:8F84847D-FF2A-424f-86F0-C4248722AC01 (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [Application Restart #1] C:\Program Files\ASUS\GPU TweakII\GPUTweakII.exe /RestartByRestartManager:806D9E02-360B-466d-8701-F7FE2307C296 (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [Application Restart #0] C:\Program Files\ASUS\GPU TweakII\GPUTweakII.exe /RestartByRestartManager:8F84847D-FF2A-424f-86F0-C4248722AC01 (User 'Default user')
O4 - Global Startup: GPUTweakII.lnk = C:\Program Files\ASUS\GPU TweakII\GPUTweakII.exe
O8 - Extra context menu item: E&xport to Microsoft Excel -
res://C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE/3000
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel -
res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Se&nd to OneNote -
res://C:\Program Files\Microsoft Office\Root\Office16\ONBttnIE.dll/105
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O17 - HKLM\System\CCS\Services\Tcpip\..\{1741d017-9d3a-438f-bda5-635bda15053e}: NameServer = 8.8.8.8,8.8.4.4
O17 - HKLM\System\CCS\Services\Tcpip\..\{6cd498ba-e671-4e2d-bba3-821562411bcc}: NameServer = 8.8.8.8,8.8.4.4
O17 - HKLM\System\CS1\Services\Tcpip\..\{1741d017-9d3a-438f-bda5-635bda15053e}: NameServer = 8.8.8.8,8.8.4.4
O18 - Protocol: mso-minsb.16 - {3459B272-CC19-4448-86C9-DDC3B4B2FAD3} - C:\Program Files\Microsoft Office\Office16\MSOSB.DLL
O18 - Protocol: osf.16 - {5504BE45-A83B-4808-900A-3A5C36E7F77A} - C:\Program Files\Microsoft Office\Office16\MSOSB.DLL
O18 - Protocol: tbauth - {14654CA6-5711-491D-B89A-58E571679951} - C:\Windows\System32\tbauth.dll
O18 - Protocol: windows.tbauth - {14654CA6-5711-491D-B89A-58E571679951} - C:\Windows\System32\tbauth.dll
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Unknown owner - C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe (file missing)
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe - C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: AppleChargerSrv - Unknown owner - C:\WINDOWS\system32\AppleChargerSrv.exe
O23 - Service: ASGT - Unknown owner - C:\Windows\System32\ASGT.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Flexera Software, Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Intel(R) Rapid Storage Technology (IAStorDataMgrSvc) - Intel Corporation - C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
O23 - Service: Intel(R) Integrated Clock Controller Service - Intel(R) ICCS (ICCS) - Intel Corporation - C:\Program Files\Intel\Intel(R) Integrated Clock Controller Service\ICCProxy.exe
O23 - Service: Intel(R) Capability Licensing Service Interface - Intel(R) Corporation - C:\Program Files\Intel\iCLS Client\HeciServer.exe
O23 - Service: Intel(R) Capability Licensing Service TCP IP Interface - Intel(R) Corporation - C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe
O23 - Service: Malwarebytes Service (MBAMService) - Malwarebytes - C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
O23 - Service: 3Dconnexion Broker Service (Mgl3DCtlrRPCService) - 3Dconnexion - C:\Program Files\3Dconnexion\3DxWare\3DxWinCore32\Mgl3DCtlrRPCService.exe
O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe
O23 - Service: NVIDIA Display Container LS (NVDisplay.ContainerLocalSystem) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\Display.NvContainer\NVDisplay.Container.exe
O23 - Service: NVIDIA Telemetry Container (NvTelemetryContainer) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\NvTelemetry\NvTelemetryContainer.exe
O23 - Service: Ralink Registry Writer (RalinkRegistryWriter) - Ralink Technology, Corp. - C:\Program Files\Tenda\Common\RaRegistry.exe
O23 - Service: @%ProgramFiles%\Windows Defender Advanced Threat Protection\MsSense.exe,-1001 (Sense) - Unknown owner - C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe (file missing)
--
End of file - 8097 bytes
