{
"header": {
"program": {
"project": "RogueKiller",
"version": "12.11.9.0",
"x64": false,
"date": "Aug 3 2017",
"contact": "http://www.adlice.com/contact/",
"feedback": "https://forum.adlice.com",
"website": "http://www.adlice.com/download/roguekiller/",
"blog": "http://www.adlice.com"
},
"environment": {
"operating_system": "Windows XP (5.1.2600 Service Pack 3) 32 bits version",
"boot": 0,
"winpe": false,
"user": "Adam2",
"user_admin": true,
"program_location": "C:\\Documents and Settings\\Adam2\\Plocha\\RogueKiller_old32.exe",
"x64": false,
"licensing": "free"
},
"report": {
"type": 1,
"aborted": false,
"date": "11/19/2017 12:16:20",
"duration": 3611,
"debug": false,
"count": 0,
"show_legit_hooks": false,
"expert_mode": false,
"switches": []
}
},
"information": {
"processes": [
{
"name": "[System Process]",
"name_parent": "",
"pid": 0,
"path": "",
"command_line": "",
"pid_parent": 0,
"path_parent": "",
"is_64": false
},
{
"name": "System",
"name_parent": "",
"pid": 4,
"path": "",
"command_line": "",
"pid_parent": 0,
"path_parent": "",
"is_64": false
},
{
"name": "smss.exe",
"name_parent": "",
"pid": 1340,
"path": "C:\\WINDOWS2\\system32\\smss.exe",
"command_line": "\\SystemRoot\\System32\\smss.exe",
"pid_parent": 4,
"path_parent": "",
"is_64": false
},
{
"name": "csrss.exe",
"name_parent": "smss.exe",
"pid": 1388,
"path": "C:\\WINDOWS2\\system32\\csrss.exe",
"command_line": "",
"pid_parent": 1340,
"path_parent": "C:\\WINDOWS2\\system32\\smss.exe",
"is_64": false
},
{
"name": "winlogon.exe",
"name_parent": "smss.exe",
"pid": 1412,
"path": "C:\\WINDOWS2\\system32\\winlogon.exe",
"command_line": "winlogon.exe",
"pid_parent": 1340,
"path_parent": "C:\\WINDOWS2\\system32\\smss.exe",
"is_64": false
},
{
"name": "services.exe",
"name_parent": "winlogon.exe",
"pid": 1460,
"path": "C:\\WINDOWS2\\system32\\services.exe",
"command_line": "C:\\WINDOWS2\\system32\\services.exe",
"pid_parent": 1412,
"path_parent": "C:\\WINDOWS2\\system32\\winlogon.exe",
"is_64": false
},
{
"name": "lsass.exe",
"name_parent": "winlogon.exe",
"pid": 1472,
"path": "C:\\WINDOWS2\\system32\\lsass.exe",
"command_line": "C:\\WINDOWS2\\system32\\lsass.exe",
"pid_parent": 1412,
"path_parent": "C:\\WINDOWS2\\system32\\winlogon.exe",
"is_64": false
},
{
"name": "svchost.exe",
"name_parent": "services.exe",
"pid": 1664,
"path": "C:\\WINDOWS2\\system32\\svchost.exe",
"command_line": "C:\\WINDOWS2\\system32\\svchost.exe -k DcomLaunch",
"pid_parent": 1460,
"path_parent": "C:\\WINDOWS2\\system32\\services.exe",
"is_64": false
},
{
"name": "svchost.exe",
"name_parent": "services.exe",
"pid": 1736,
"path": "C:\\WINDOWS2\\system32\\svchost.exe",
"command_line": "",
"pid_parent": 1460,
"path_parent": "C:\\WINDOWS2\\system32\\services.exe",
"is_64": false
},
{
"name": "svchost.exe",
"name_parent": "services.exe",
"pid": 1892,
"path": "C:\\WINDOWS2\\system32\\svchost.exe",
"command_line": "C:\\WINDOWS2\\System32\\svchost.exe -k netsvcs",
"pid_parent": 1460,
"path_parent": "C:\\WINDOWS2\\system32\\services.exe",
"is_64": false
},
{
"name": "svchost.exe",
"name_parent": "services.exe",
"pid": 164,
"path": "C:\\WINDOWS2\\system32\\svchost.exe",
"command_line": "",
"pid_parent": 1460,
"path_parent": "C:\\WINDOWS2\\system32\\services.exe",
"is_64": false
},
{
"name": "svchost.exe",
"name_parent": "services.exe",
"pid": 348,
"path": "C:\\WINDOWS2\\system32\\svchost.exe",
"command_line": "",
"pid_parent": 1460,
"path_parent": "C:\\WINDOWS2\\system32\\services.exe",
"is_64": false
},
{
"name": "spoolsv.exe",
"name_parent": "services.exe",
"pid": 488,
"path": "C:\\WINDOWS2\\system32\\spoolsv.exe",
"command_line": "C:\\WINDOWS2\\system32\\spoolsv.exe",
"pid_parent": 1460,
"path_parent": "C:\\WINDOWS2\\system32\\services.exe",
"is_64": false
},
{
"name": "svchost.exe",
"name_parent": "services.exe",
"pid": 328,
"path": "C:\\WINDOWS2\\system32\\svchost.exe",
"command_line": "",
"pid_parent": 1460,
"path_parent": "C:\\WINDOWS2\\system32\\services.exe",
"is_64": false
},
{
"name": "LMIGuardianSvc.exe",
"name_parent": "services.exe",
"pid": 1124,
"path": "C:\\Program Files\\LogMeIn Hamachi\\LMIGuardianSvc.exe",
"command_line": "\"C:\\Program Files\\LogMeIn Hamachi\\LMIGuardianSvc.exe\"",
"pid_parent": 1460,
"path_parent": "C:\\WINDOWS2\\system32\\services.exe",
"is_64": false
},
{
"name": "mbamscheduler.exe",
"name_parent": "services.exe",
"pid": 196,
"path": "C:\\Program Files\\Malwarebytes' Anti-Malware\\mbamscheduler.exe",
"command_line": "\"C:\\Program Files\\Malwarebytes' Anti-Malware\\mbamscheduler.exe\"",
"pid_parent": 1460,
"path_parent": "C:\\WINDOWS2\\system32\\services.exe",
"is_64": false
},
{
"name": "svchost.exe",
"name_parent": "services.exe",
"pid": 3112,
"path": "C:\\WINDOWS2\\system32\\svchost.exe",
"command_line": "C:\\WINDOWS2\\system32\\svchost.exe -k imgsvc",
"pid_parent": 1460,
"path_parent": "C:\\WINDOWS2\\system32\\services.exe",
"is_64": false
},
{
"name": "ZAM.exe",
"name_parent": "services.exe",
"pid": 3224,
"path": "C:\\Program Files\\Zemana AntiMalware\\ZAM.exe",
"command_line": "\"C:\\Program Files\\Zemana AntiMalware\\ZAM.exe\" /service",
"pid_parent": 1460,
"path_parent": "C:\\WINDOWS2\\system32\\services.exe",
"is_64": false
},
{
"name": "alg.exe",
"name_parent": "services.exe",
"pid": 2396,
"path": "C:\\WINDOWS2\\system32\\alg.exe",
"command_line": "",
"pid_parent": 1460,
"path_parent": "C:\\WINDOWS2\\system32\\services.exe",
"is_64": false
},
{
"name": "svchost.exe",
"name_parent": "services.exe",
"pid": 1332,
"path": "C:\\WINDOWS2\\system32\\svchost.exe",
"command_line": "C:\\WINDOWS2\\System32\\svchost.exe -k HTTPFilter",
"pid_parent": 1460,
"path_parent": "C:\\WINDOWS2\\system32\\services.exe",
"is_64": false
},
{
"name": "wscntfy.exe",
"name_parent": "svchost.exe",
"pid": 1612,
"path": "C:\\WINDOWS2\\system32\\wscntfy.exe",
"command_line": "C:\\WINDOWS2\\system32\\wscntfy.exe",
"pid_parent": 1892,
"path_parent": "C:\\WINDOWS2\\system32\\svchost.exe",
"is_64": false
},
{
"name": "explorer.exe",
"name_parent": "",
"pid": 1052,
"path": "C:\\WINDOWS2\\explorer.exe",
"command_line": "C:\\WINDOWS2\\Explorer.EXE",
"pid_parent": 3736,
"path_parent": "",
"is_64": false
},
{
"name": "NvBackend.exe",
"name_parent": "Explorer.EXE",
"pid": 2124,
"path": "C:\\Program Files\\NVIDIA Corporation\\Update Core\\NvBackend.exe",
"command_line": "\"C:\\Program Files\\NVIDIA Corporation\\Update Core\\NvBackend.exe\" ",
"pid_parent": 1052,
"path_parent": "C:\\WINDOWS2\\explorer.exe",
"is_64": false
},
{
"name": "HDeck.exe",
"name_parent": "Explorer.EXE",
"pid": 2488,
"path": "C:\\Program Files\\VIA\\VIAudioi\\HDADeck\\HDeck.exe",
"command_line": "\"C:\\Program Files\\VIA\\VIAudioi\\HDADeck\\HDeck.exe\" 1",
"pid_parent": 1052,
"path_parent": "C:\\WINDOWS2\\explorer.exe",
"is_64": false
},
{
"name": "wuauclt.exe",
"name_parent": "svchost.exe",
"pid": 2524,
"path": "C:\\WINDOWS2\\system32\\wuauclt.exe",
"command_line": "\"C:\\WINDOWS2\\system32\\wuauclt.exe\"",
"pid_parent": 1892,
"path_parent": "C:\\WINDOWS2\\system32\\svchost.exe",
"is_64": false
},
{
"name": "jusched.exe",
"name_parent": "Explorer.EXE",
"pid": 536,
"path": "C:\\Program Files\\Common Files\\Java\\Java Update\\jusched.exe",
"command_line": "\"C:\\Program Files\\Common Files\\Java\\Java Update\\jusched.exe\" ",
"pid_parent": 1052,
"path_parent": "C:\\WINDOWS2\\explorer.exe",
"is_64": false
},
{
"name": "ctfmon.exe",
"name_parent": "Explorer.EXE",
"pid": 2732,
"path": "C:\\WINDOWS2\\system32\\ctfmon.exe",
"command_line": "\"C:\\WINDOWS2\\system32\\ctfmon.exe\" ",
"pid_parent": 1052,
"path_parent": "C:\\WINDOWS2\\explorer.exe",
"is_64": false
},
{
"name": "NvNetworkService.exe",
"name_parent": "services.exe",
"pid": 1392,
"path": "C:\\Program Files\\NVIDIA Corporation\\NetService\\NvNetworkService.exe",
"command_line": "\"C:\\Program Files\\NVIDIA Corporation\\NetService\\NvNetworkService.exe\"",
"pid_parent": 1460,
"path_parent": "C:\\WINDOWS2\\system32\\services.exe",
"is_64": false
},
{
"name": "svchost.exe",
"name_parent": "services.exe",
"pid": 2016,
"path": "C:\\WINDOWS2\\system32\\svchost.exe",
"command_line": "C:\\WINDOWS2\\system32\\svchost.exe -k netsvcs",
"pid_parent": 1460,
"path_parent": "C:\\WINDOWS2\\system32\\services.exe",
"is_64": false
},
{
"name": "RogueKiller_old32.exe",
"name_parent": "Explorer.EXE",
"pid": 1980,
"path": "C:\\Documents and Settings\\Adam2\\Plocha\\RogueKiller_old32.exe",
"command_line": "\"C:\\Documents and Settings\\Adam2\\Plocha\\RogueKiller_old32.exe\" ",
"pid_parent": 1052,
"path_parent": "C:\\WINDOWS2\\explorer.exe",
"is_64": false
}
]
},
"results": {
"processes": [],
"modules": [],
"services": [],
"registry": [],
"tasks": [],
"filesystem": [],
"wmi": [],
"hosts": {
"is_too_big": false,
"lines": []
},
"antirootkit": {
"is_driver_loaded": true,
"driver_error": 0,
"results": []
},
"web_browsers": [],
"disk": {
"results": [],
"mbr": "+++++ PhysicalDrive0: WDC WD20EARS-00S8B1 +++++\n--- User ---\n[MBR] a5ced8a48748cd199ba61954ef8dd124\n[BSP] 970b64111ddb8e108d85fbe7f7707fa1 : Windows XP MBR Code\nPartition table:\n0 - [ACTIVE] NTFS (0x7) [VISIBLE] Offset (sectors): 14 | Size: 1907727 MB [Windows XP Bootstrap | Windows XP Bootloader]\nUser = LL1 ... OK\nUser = LL2 ... OK\n\n+++++ PhysicalDrive1: SAMSUNG HD502HI +++++\n--- User ---\n[MBR] 98233269bb5a58b110f235d5cf8cd70e\n[BSP] 7d509d352da6a11935c6d5a6e6d43cad : Windows XP MBR Code\nPartition table:\n0 - [XXXXXX] NTFS (0x7) [VISIBLE] Offset (sectors): 63 | Size: 476929 MB[Invalid]\nUser = LL1 ... OK\nUser = LL2 ... OK\n\n"
}
}
}

To není ten log , je třeba zvolit možnost v textové podobě.

Mě se to pokaždé, když to nenajde žádnou infekci zobrazí v prohlížeči v této podobě(např. RKreport_DEL_09072010_152402.json) Jako texťák to neotevřu. Bude to problém?

No pokud tam nejsou žádné nálezy tak ne,

Vypni antivir i firewall.
Stáhni Zoek.exe
http://download.bleepingcomputer.com/smeenk/zoek.exe
http://leteckaposta.cz/415997425
klik nahoře vpravo na .rar-file a uloz si ho na plochu.
Zavři všechny ostatní programy , okna i prohlížeče.
Spusť Zoek.exe ( u win vista , win7, 8 klikni na něj pravým a vyber : „Spustit jako správce“
-pozor , náběh programu může trvat déle.
Do okna programu vlož skript níže:

klikni na Run Script
Program provede sken , opravu, sken i oprava může trvat i více minut ,je třeba posečkat do konce. Do okna neklikej!
Program nabídne restart , potvrď .
Po restartu se může nějaký čas ukázat pouze černá plocha , to je normální. Je třeba počkat až se vytvoří log. Ten si můžeš uložit třeba do dokumentů , jinak se sám ukládá do:
C:\zoek-results.log Zkopíruj sem celý obsah toho logu.
Pokud budou problémy , spusť zoek v nouz. režimu.

Stáhni si Zemana AntiMalware Free z tohoto odkazu:
https://www.zemana.com/Download/AntiMal ... .Setup.exe
a ulož si ho na plochu.
Poklepej na tento soubor na ploše a postupuj podle pokynů k instalaci programu.
Přijmi licenci k používání programu EULA , pokud se nabídne.
Pokud je k dispozici aktualizace programu , klepni na tlačítko „Update now“ ( aktualizovat nyní).
Můžeš si zatrhnout i vytvoření bodu obnovy:
Klikni na ozubené kolečko , poté na „Skenování“ a zatrhni „vytvářet body obnovy“.
Vrať se zpět ( klikni na domeček).
Zavři všechny otevřené soubory, složky a prohlížeče
Neměň žádné nastavení. Klikni na „Skenovat“.
Po skenu lze vidět , zda jsou nějaké nákazy. Klikni na „Další“. Nákazy budou přemístěny do karantény.
Když je skenování dokončeno, objeví se tisková zpráva , zkopíruj sem celý obsah té zprávy.
Jinak můžeš zprávy vidět , když klikneš vpravo nahoře na „ zprávy“.


Vlož nový log z HJT + informuj o problémech

Zoek.exe v5.0.0.1 Updated 24-October-2017
Tool run by Adam2 on st 22.11.2017 at 1:36:54,85.
Systém Microsoft Windows XP Professional 5.1.2600 Service Pack 3 x86
Running in: Normal Mode No Internet Access Detected
Launched: C:\Documents and Settings\Adam2\Plocha\zoek.exe [Scan all users] [Script inserted]

==== Older Logs ======================

C:\zoek-results2016-03-14-225613.log 7713 bytes
C:\zoek-results2016-11-03-193430.log 15800 bytes
C:\zoek-results2017-06-06-173407.log 5821 bytes

==== Reset Hosts File ======================

# Copyright (c) 1993-2006 Microsoft Corp.
#
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
#
# This file contains the mappings of IP addresses to host names. Each
# entry should be kept on an individual line. The IP address should
# be placed in the first column followed by the corresponding host name.
# The IP address and the host name should be separated by at least one
# space.
#
# Additionally, comments (such as these) may be inserted on individual
# lines or following the machine name denoted by a '#' symbol.
#
# For example:
#
# 102.54.94.97 rhino.acme.com # source server
# 38.25.63.10 x.acme.com # x client host

127.0.0.1 localhost

==== Deleting CLSID Registry Keys ======================

HKEY_USERS\S-1-5-21-329068152-1645522239-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2E38825B-8815-42CF-9126-C58BC28D4591} deleted successfully
HKEY_USERS\S-1-5-21-329068152-1645522239-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{2E38825B-8815-42CF-9126-C58BC28D4591} deleted successfully

==== Deleting CLSID Registry Values ======================

HKEY_USERS\S-1-5-21-329068152-1645522239-839522115-1003\Software\Microsoft\Internet Explorer\Approved Extensions\{2E38825B-8815-42CF-9126-C58BC28D4591} deleted successfully

==== Set IE to Default ======================

Old Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\AboutURLs]
"Tabs"="res://ieframe.dll/tabswelcome.htm"
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes]
"DefaultScope"="{0633EE93-D776-472f-A0FF-E1416B8B2E3A}"

New Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"="http://go.microsoft.com/fwlink/?LinkId=69157"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\AboutURLs]
"Tabs"="about:newtab"
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes]
"DefaultScope"="{0633EE93-D776-472f-A0FF-E1416B8B2E3A}"

==== All HKLM and HKCU SearchScopes ======================

HKLM\SearchScopes "DefaultScope"=""
HKCU\SearchScopes "DefaultScope"="{0633EE93-D776-472f-A0FF-E1416B8B2E3A}"
HKCU\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} - http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC

==== Reset Google Chrome ======================

Nothing found to reset

==== Empty IE Cache ======================

C:\Documents and Settings\Administrator.BBDRA2-3D0A5E7C\Local Settings\Temporary Internet Files\Content.IE5 emptied successfully
C:\Documents and Settings\Adam2\Local Settings\Temporary Internet Files\Content.IE5\index.dat will be deleted at reboot
C:\Documents and Settings\LocalService.NT AUTHORITY\Local Settings\Temporary Internet Files\Content.IE5\index.dat will be deleted at reboot
C:\Documents and Settings\NetworkService.NT AUTHORITY\Local Settings\Temporary Internet Files\Content.IE5\index.dat will be deleted at reboot

==== Empty FireFox Cache ======================

No FireFox Profiles found

==== Empty Chrome Cache ======================

No Chrome User Data found

==== Empty All Flash Cache ======================

No Flash Cache Found

==== Empty All Java Cache ======================

No Java Cache Found

==== C:\zoek_backup content ======================

C:\zoek_backup (files=11562 folders=926 3380582029 bytes)

==== Empty Temp Folders ======================

C:\WINDOWS2\Temp will be emptied at reboot

==== After Reboot ======================

==== Empty Temp Folders ======================

C:\WINDOWS2\Temp successfully emptied
C:\DOCUME~1\Adam2\LOCALS~1\Temp successfully emptied

==== Empty Recycle Bin ======================

C:\RECYCLER successfully emptied

==== Deleting Files / Folders ======================

"C:\Documents and Settings\Adam2\Local Settings\Temporary Internet Files\Content.IE5\index.dat" not deleted
"C:\Documents and Settings\LocalService.NT AUTHORITY\Local Settings\Temporary Internet Files\Content.IE5\index.dat" not found
"C:\Documents and Settings\NetworkService.NT AUTHORITY\Local Settings\Temporary Internet Files\Content.IE5\index.dat" not found

==== EOF on st 22.11.2017 at 1:47:08,96 ======================

Nevím, jestli má script vliv i na můj primární prohlížeč (comodo chromodo), který používám. Delší dobu na něm nejde poslochat hudba na soundcloudu a přehrávat videa na fb. Stav je stejný nadále.

Zemana AntiMalware 2.74.2.150 (instalační verze)

-------------------------------------------------------
Scan Result : Dokončeno
Scan Date : 2017.11.22
Operating System : Windows XP 32-bit
Processor : 4X AMD Phenom(tm) II X4 965 Processor
BIOS Mode : Legacy
CUID : 1411D8038D943CE9720D4E
Scan Type : Skenování systému
Duration : 74m 46s
Scanned Objects : 393719
Detected Objects : 1
Excluded Objects : 0
Read Level : SCSI
Auto Upload : Zapnuto
Detect All Extensions : Vypnuto
Scan Documents : Vypnuto
Domain Info : SKUPINA,0,2

Detected Objects
-------------------------------------------------------

Tabs Hijack (System)
Status : Skenováno
Object : HKLM\SOFTWARE\Microsoft\Internet Explorer\AboutURLs\Tabs
MD5 : -
Publisher : -
Size : -
Version : -
Detection : Potenciálně nechtěné modifikace
Cleaning Action : Opravit
Related Objects :
Záznam registru - HKLM\SOFTWARE\Microsoft\Internet Explorer\AboutURLs\Tabs = about:newtab


Cleaning Result
-------------------------------------------------------
Cleaned : 1
Reported as safe : 0
Failed : 0

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 6:51:13, on 22.11.2017
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)


Boot mode: Normal

Running processes:
C:\WINDOWS2\System32\smss.exe
C:\WINDOWS2\system32\winlogon.exe
C:\WINDOWS2\system32\services.exe
C:\WINDOWS2\system32\lsass.exe
C:\WINDOWS2\system32\svchost.exe
C:\WINDOWS2\System32\svchost.exe
C:\WINDOWS2\system32\spoolsv.exe
C:\Program Files\NVIDIA Corporation\Update Core\NvBackend.exe
C:\Program Files\VIA\VIAudioi\HDADeck\HDeck.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\WINDOWS2\system32\ctfmon.exe
C:\Program Files\Comodo\Chromodo\chromodo_updater.exe
C:\Program Files\Foxit Software\Foxit Reader\FoxitConnectedPDFService.exe
C:\Program Files\Java\jre7\bin\jqs.exe
C:\WINDOWS2\system32\KaraokeSer.exe
C:\Program Files\LogMeIn Hamachi\LMIGuardianSvc.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe
C:\Program Files\NetLimiter 3\nlsvc.exe
C:\Program Files\NVIDIA Corporation\NetService\NvNetworkService.exe
C:\WINDOWS2\system32\svchost.exe
C:\Program Files\LogMeIn Hamachi\hamachi-2.exe
C:\WINDOWS2\system32\wscntfy.exe
C:\Program Files\Zemana AntiMalware\ZAM.exe
C:\WINDOWS2\System32\svchost.exe
C:\WINDOWS2\system32\wuauclt.exe
C:\WINDOWS2\explorer.exe
C:\Documents and Settings\Adam2\Plocha\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.slimwareutilities.com/slimdr ... wnload.php
O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2011\ievkbd.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll
O2 - BHO: link filter bho - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2011\klwtbbho.dll
O4 - HKLM\..\Run: [NvBackend] "C:\Program Files\NVIDIA Corporation\Update Core\NvBackend.exe"
O4 - HKLM\..\Run: [HDAudDeck] C:\Program Files\VIA\VIAudioi\HDADeck\HDeck.exe 1
O4 - HKLM\..\Run: [LogMeIn Hamachi Ui] "C:\Program Files\LogMeIn Hamachi\hamachi-2-ui.exe" --auto-start
O4 - HKLM\..\Run: [ZAM] "C:\Program Files\Zemana AntiMalware\ZAM.exe" /minimized
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Common Files\Java\Java Update\jusched.exe
O4 - HKLM\..\Run: [IseUI] C:\Program Files\COMODO\Internet Security Essentials\vkise.exe
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2011\avp.exe"
O4 - HKCU\..\Run: [CCleaner Monitoring] "C:\Program Files\CCleaner\CCleaner.exe" /MONITOR
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS2\system32\ctfmon.exe
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /minimized /regrun
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS2\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS2\system32\CTFMON.EXE (User 'Default user')
O9 - Extra button: &Virtual Keyboard - {4248FE82-7FCB-46AC-B270-339F08212110} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2011\klwtbbho.dll
O9 - Extra button: URLs c&heck - {CCF151D8-D089-449F-A5A4-D9909053F20F} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2011\klwtbbho.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS2\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS2\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O20 - AppInit_DLLs: C:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd3.dll
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS2\system32\browseui.dll
O22 - SharedTaskScheduler: Proces mezipaměti kategorií součástí - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS2\system32\browseui.dll
O23 - Service: Kaspersky Anti-Virus Service (AVP) - Kaspersky Lab ZAO - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2011\avp.exe
O23 - Service: COMODO Chromodo Update Service (ChromodoUpdater) - Comodo - C:\Program Files\Comodo\Chromodo\chromodo_updater.exe
O23 - Service: Disc Soft Lite Bus Service - Disc Soft Ltd - C:\Program Files\DAEMON Tools Lite\DiscSoftBusService.exe
O23 - Service: Foxit Reader Service (FoxitReaderService) - Foxit Software Inc. - C:\Program Files\Foxit Software\Foxit Reader\FoxitConnectedPDFService.exe
O23 - Service: LogMeIn Hamachi Tunneling Engine (Hamachi2Svc) - LogMeIn Inc. - C:\Program Files\LogMeIn Hamachi\hamachi-2.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Oracle Corporation - C:\Program Files\Java\jre7\bin\jqs.exe
O23 - Service: VIA Karaoke digital mixer Service (KaraokeService) - VIA Technologies, Inc. - C:\WINDOWS2\system32\KaraokeSer.exe
O23 - Service: LMIGuardianSvc - LogMeIn, Inc. - C:\Program Files\LogMeIn Hamachi\LMIGuardianSvc.exe
O23 - Service: MBAMScheduler - Malwarebytes Corporation - C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe
O23 - Service: MBAMService - Malwarebytes Corporation - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
O23 - Service: NetLimiter 3 Service (nlsvc) - Locktime Software - C:\Program Files\NetLimiter 3\nlsvc.exe
O23 - Service: NVIDIA Network Service (NvNetworkService) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\NetService\NvNetworkService.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS2\system32\nvsvc32.exe
O23 - Service: Skype Updater (SkypeUpdate) - Skype Technologies - C:\Program Files\Skype\Updater\Updater.exe
O23 - Service: ZAM Controller Service (ZAMSvc) - Copyright 2017. - C:\Program Files\Zemana AntiMalware\ZAM.exe

--
End of file - 6742 bytes

Zavři ostatní aplikace a prohlížeče, odpoj se od netu a fixni v HJT:
Návod



Kaspersky Internet Security 2011
COMODO\Internet Security Essentials

jeden antivir odinstaluj!

Na jiném prohlížeči problémy nejsou?

Vypni rez. ochranu u antiviru a antispywaru,příp. firewall..

Stáhni si ComboFix (by sUBs)
a ulož si ho na plochu.
Ukonči všechna aktivní okna a spusť ho.
- Po spuštění se zobrazí podmínky užití, potvrď je stiskem tlačítka Ano
- Dále postupuj dle pokynů, během aplikování ComboFixu neklikej do zobrazujícího se okna
- Po dokončení skenování by měl program vytvořit log - C:\ComboFix.txt - zkopíruj sem prosím celý jeho obsah
Pokud budou problémy , spusť ho v nouz. režimu.

Upozornění : Může se stát, že po aplikaci Combofixu a restartu počítače, Windows nenaběhnou , nebo nenajede plocha , budou problémy s připojením, pak znovu restartuj počítač, pokud to nepomůže , po restartu mačkej klávesu F8 a pak zvol poslední známou funkční konfiguraci. , či použij bod obnovy.

COMODO\Internet Security Essentials jsem kdysi instaloval, ale nepodařilo se mi ho nainstalovat, buď je to proto, že mám Xpčka a nebo mi to něco bloklo. Nainstalovaný není, ale asi v PC zůstaly jeho součásti. Nvm jak se toho můžu zbavit?

Stáhněte si a nainstalujte Revo Uninstaller FreePlease download and install Revo Uninstaller Free
http://www.revouninstaller.com/start_fr ... nload.html
Poklepáním na Revo Uninstaller jej spustit.

Ze seznamu programů klikněte dvakrát na programu odstranit
Až budete vyzváni, zda chcete odinstalovat klepněte na tlačítko Ano.
Ujistěte se, že je vybrána možnost Mírný potom klepněte na tlačítko Další.
Program bude probíhat, Pokud budete vyzváni znovu klepněte na tlačítko Ano
Při vestavěný Uninstaller je dokončena klepněte na tlačítko Další.
Jakmile program hledal zbytky klepněte na tlačítko Další.
Zkontrolujte / zaškrtněte položky Bolded jen na seznamu a potom klepněte na tlačítko Odstranit
Po vyzvání klepněte na Ano a pak na další.
další na všechny složky, které se nachází a vyberte možnost odstranění
Po zobrazení výzvy vyberte ano, pak na další
Poté, co udělal na tlačítko Dokončit.


udělej ten Combofix.

COMODO\Internet Security Essentials není v seznamu.

Btw přemýšlím o novým antiviru rozhoduju se mezi 360 total security a trend micro. Co si o nich myslíš?