Quote from: carnage88 on September 21, 2019, 08:14:18 PM

They answered that this isn't their address...

At last, you replied.
First: "Remote Utility - Host" is a legit application, it was just installed by the hacker/malware/virus to view and control to your PC using the client.
The main malware/virus must be something else, installed though other means like browsing/download.

Your case was exactly the same as this one: forums.malwarebytes.com.
But the case was closed without an answer.

Quote from: carnage88 on September 21, 2019, 08:14:18 PM

I use electrum which was password protected and I used these coins every day but last week or so I wasnt using them. I rus some exchanges and needed whole amount, that's way i didn't put on ladger.

There are two possible scenarios:
1. Hacked SEED: Because even with remote access, the hacker can't still decrypt your wallet.
Where did you keep your electrum SEED? in your email, cloud disk or local disk?
2. Keylogger and manual operation: When you're AFK and the PC's idle, the hacker installed keylogger using remote access, disconnect then wait for you to use your wallet;
Waited for another AFK cue, then he controlled your PC to manually send the transaction since he already have your passphrase.

Seriously, "needing the whole amount" isn't an excuse to not-to-use you ledger.
It's not a hassle to plug the device to sign a transaction, it's safe as long as you review the addresses of the transaction that you're signing.