prosím o kontrolu logu Vyřešeno

[OTAS]

Karanténa smazána.

Malwarebytes
www.malwarebytes.com

-Podrobnosti logovacího souboru-
Datum skenování: 19.06.18
Čas skenování: 22:19
Logovací soubor: 197521b2-73fe-11e8-bda0-50465d8f71a5.json
Správce: Ano

-Informace o softwaru-
Verze: 3.5.1.2522
Verze komponentů: 1.0.374
Aktualizovat verzi balíku komponent: 1.0.5544
Licence: Bezplatný

-Systémová informace-
OS: Windows 7 Service Pack 1
CPU: x64
Systém souborů: NTFS
Uživatel: Otto-PC\Otto

-Shrnutí skenování-
Typ skenování: Skenování hrozeb (Threat Scan)
Spuštění skenování: Ruční
Výsledek: Dokončeno
Skenované objekty: 273203
Zjištěné hrozby: 0
(Nebyly zjištěny žádné škodlivé položky)
Hrozby umístěné do karantény: 0
(Nebyly zjištěny žádné škodlivé položky)
Uplynulý čas: 4 min, 48 sek

-Možnosti skenování-
Paměť: Povoleno
Start: Povoleno
Systém souborů: Povoleno
Archivy: Povoleno
Rootkity: Zakázáno
Heuristika: Povoleno
Potenciálně nežádoucí program: Detekovat
Potenciálně nežádoucí modifikace: Detekovat

-Podrobnosti skenování-
Proces: 0
(Nebyly zjištěny žádné škodlivé položky)

Modul: 0
(Nebyly zjištěny žádné škodlivé položky)

Klíč registru: 0
(Nebyly zjištěny žádné škodlivé položky)

Hodnota v registru: 0
(Nebyly zjištěny žádné škodlivé položky)

Data registrů: 0
(Nebyly zjištěny žádné škodlivé položky)

Datové proudy: 0
(Nebyly zjištěny žádné škodlivé položky)

Adresář: 0
(Nebyly zjištěny žádné škodlivé položky)

Soubor: 0
(Nebyly zjištěny žádné škodlivé položky)

Fyzický sektor: 0
(Nebyly zjištěny žádné škodlivé položky)

WMI: 0
(Nebyly zjištěny žádné škodlivé položky)


(end)

[Reklama]

[jaro3]

OK , tak ještě to další , budu zítra.

[OTAS]

zbytek je na 1 straně

[jaro3]

Zavři všechny programy a prohlížeče. Deaktivuj antivir a firewall.
Prosím, odpoj všechny USB (kromě myši s klávesnice) nebo externí disky z počítače před spuštěním tohoto programu.
Spusť znovu RogueKiller ( Pro Windows Vista nebo Windows 7, klepni pravým a vyber "Spustit jako správce", ve Windows XP poklepej ke spuštění).
- klikni na „Start Scan“. V novém okně nic neměň a klikni dole na „Start Scan“,
po jeho skončení - vše zatrhni (dej zatržítka vlevo od nálezů , do bílých políček)
- pak klikni na "Remove Selected"
- Počkej, dokud Status box nezobrazí " Removal finished, please review result "
- Klikni na "Open report " a pak na " Open TXT“ a zkopíruj ten log a vlož obsah té zprávy prosím sem. Log je možno nalézt v C:\ProgramData\RogueKiller\Logs - Zavři RogueKiller.

Vypni antivir i firewall.
Stáhni Zoek.exe
http://download.bleepingcomputer.com/smeenk/zoek.exe

klik nahoře vpravo na .rar-file a uloz si ho na plochu.
Zavři všechny ostatní programy , okna i prohlížeče.
Spusť Zoek.exe ( u win vista , win7, 8 klikni na něj pravým a vyber : „Spustit jako správce“
-pozor , náběh programu může trvat déle.
Do okna programu vlož skript níže:

Kód: Vybrat vše

autoclean;
emptyclsid;
iedefaults;
FFdefaults;
CHRdefaults;
emptyalltemp;
resethosts;

klikni na Run Script
Program provede sken , opravu, sken i oprava může trvat i více minut ,je třeba posečkat do konce. Do okna neklikej!
Program nabídne restart , potvrď .
Po restartu se může nějaký čas ukázat pouze černá plocha , to je normální. Je třeba počkat až se vytvoří log. Ten si můžeš uložit třeba do dokumentů , jinak se sám ukládá do:
C:\zoek-results.log Zkopíruj sem celý obsah toho logu.
Pokud budou problémy , spusť zoek v nouz. režimu.

Stáhni si Zemana AntiMalware Free z tohoto odkazu:
https://www.zemana.com/Download/AntiMal ... .Setup.exe
a ulož si ho na plochu.
Poklepej na tento soubor na ploše a postupuj podle pokynů k instalaci programu.
Přijmi licenci k používání programu EULA , pokud se nabídne.
Pokud je k dispozici aktualizace programu , klepni na tlačítko „Update now“ ( aktualizovat nyní).
Můžeš si zatrhnout i vytvoření bodu obnovy:
Klikni na ozubené kolečko , poté na „Skenování“ a zatrhni „vytvářet body obnovy“.
Vrať se zpět ( klikni na domeček).
Zavři všechny otevřené soubory, složky a prohlížeče
Neměň žádné nastavení. Klikni na „Skenovat“.
Po skenu lze vidět , zda jsou nějaké nákazy. Klikni na „Další“. Nákazy budou přemístěny do karantény.
Když je skenování dokončeno, objeví se tisková zpráva , zkopíruj sem celý obsah té zprávy.
Jinak můžeš zprávy vidět , když klikneš vpravo nahoře na „ zprávy“.


Vypni rez. ochranu u antiviru a antispywaru,příp. firewall..

Stáhni si ComboFix (by sUBs)
a ulož si ho na plochu.
Ukonči všechna aktivní okna a spusť ho.
- Po spuštění se zobrazí podmínky užití, potvrď je stiskem tlačítka Ano
- Dále postupuj dle pokynů, během aplikování ComboFixu neklikej do zobrazujícího se okna
- Po dokončení skenování by měl program vytvořit log - C:\ComboFix.txt - zkopíruj sem prosím celý jeho obsah
Pokud budou problémy , spusť ho v nouz. režimu.

Upozornění : Může se stát, že po aplikaci Combofixu a restartu počítače, Windows nenaběhnou , nebo nenajede plocha , budou problémy s připojením, pak znovu restartuj počítač, pokud to nepomůže , po restartu mačkej klávesu F8 a pak zvol poslední známou funkční konfiguraci. , či použij bod obnovy.

[OTAS]

RogueKiller V12.12.23.0 (x64) [Jun 18 2018] (Free) by Adlice Software
mail : http://www.adlice.com/contact/
Feedback : https://forum.adlice.com
Webová stránka : http://www.adlice.com/download/roguekiller/
Blog : http://www.adlice.com

Operační systém : Windows 7 (6.1.7601 Service Pack 1) 64 bits version
Spuštěno : Normální režim
Uživatel : Otto [Práva správce]
Started from : C:\Program Files\RogueKiller\RogueKiller64.exe
Mód : Smazat -- Datum : 06/21/2018 10:11:38 (Duration : 00:36:31)

¤¤¤ Procesy : 0 ¤¤¤

¤¤¤ Registry : 0 ¤¤¤

¤¤¤ Úlohy : 0 ¤¤¤

¤¤¤ Soubory : 0 ¤¤¤

¤¤¤ WMI : 0 ¤¤¤

¤¤¤ Soubor HOSTS : 0 ¤¤¤

¤¤¤ Antirootkit : 0 (Driver: Nahrán) ¤¤¤

¤¤¤ Webové prohlížeče : 2 ¤¤¤
[PUM.HomePage][Firefox:Config] b9u11n5q.default-1512667376818 : user_pref("browser.startup.homepage", "https://www.seznam.cz/"); -> Nahrazeno (about:home)
[PUM.HomePage][Chrome:Config] Default [SecurePrefs] : homepage [https://www.seznam.cz/] -> Smazáno

¤¤¤ Kontrola MBR : ¤¤¤
+++++ PhysicalDrive0: WDC WD5000AAKX-00ERMA0 ATA Device +++++
--- User ---
[MBR] 0a51fc1920679da194b2dd19884d4208
[BSP] 1fcb73c66dfbc51c854628e015723e8e : Windows Vista/7/8 MBR Code
Partition table:
0 - [ACTIVE] NTFS (0x7) [VISIBLE] Offset (sectors): 2048 | Size: 100 MB [Windows Vista/7/8 Bootstrap | Windows Vista/7/8 Bootloader]
1 - [XXXXXX] NTFS (0x7) [VISIBLE] Offset (sectors): 206848 | Size: 476838 MB [Windows Vista/7/8 Bootstrap | Windows Vista/7/8 Bootloader]
User = LL1 ... OK
User = LL2 ... OK

+++++ PhysicalDrive1: USB Mass Storage Device USB Device +++++
Error reading User MBR! ([15] Za?ízení není p?ipraveno. )
Error reading LL1 MBR! NOT VALID!
Error reading LL2 MBR! ([32] Po?adavek není podporován. )

[OTAS]

Zoek.exe v5.0.0.2 Updated 03-May-2018(Online Version)
Tool run by Otto on źt 21.06.2018 at 11:14:49,10.
Microsoft Windows 7 Ultimate 6.1.7601 Service Pack 1 x64
Running in: Safe Mode NETWORK Internet Access Detected
Launched: C:\Users\Otto\Desktop\zoek.exe [Scan all users] [Script inserted]

==== System Restore Info ======================

==== Reset Hosts File ======================

# Copyright (c) 1993-2006 Microsoft Corp.
#
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
#
# This file contains the mappings of IP addresses to host names. Each
# entry should be kept on an individual line. The IP address should
# be placed in the first column followed by the corresponding host name.
# The IP address and the host name should be separated by at least one
# space.
#
# Additionally, comments (such as these) may be inserted on individual
# lines or following the machine name denoted by a '#' symbol.
#
# For example:
#
# 102.54.94.97 rhino.acme.com # source server
# 38.25.63.10 x.acme.com # x client host

# localhost name resolution is handled within DNS itself.
127.0.0.1 localhost
::1 localhost

==== Empty Folders Check ======================

C:\PROGRA~3\dbg deleted successfully
C:\PROGRA~3\EZ CD Audio Converter deleted successfully
C:\PROGRA~3\GlarySoft deleted successfully
C:\Users\Otto\AppData\Roaming\15256 deleted successfully
C:\Users\Otto\AppData\Roaming\19769 deleted successfully
C:\Users\Otto\AppData\Roaming\DiskDefrag deleted successfully
C:\Users\Otto\AppData\Roaming\Plcore deleted successfully
C:\Users\Otto\AppData\Roaming\QuickScan deleted successfully
C:\Users\Otto\AppData\Local\CrashDumps deleted successfully

==== Deleting CLSID Registry Keys ======================


==== Deleting CLSID Registry Values ======================


==== Deleting Services ======================


==== FireFox Fix ======================

Deleted from C:\Users\Otto\AppData\Roaming\Mozilla\Firefox\Profiles\b9u11n5q.default-1512667376818\prefs.js:
user_pref("browser.startup.homepage", "about:home"about:home);
user_pref("browser.newtab.url", "about:newtab");

Added to C:\Users\Otto\AppData\Roaming\Mozilla\Firefox\Profiles\b9u11n5q.default-1512667376818\prefs.js:
user_pref("browser.startup.homepage", "about:home");
user_pref("browser.newtab.url", "about:newtab");

==== Deleting Files \ Folders ======================

C:\PROGRA~2\WinRAR 5.60 Beta 3 deleted
C:\Users\Otto\AppData\Roaming\Deezloader deleted
C:\Users\Otto\AppData\Roaming\pcouffin.log deleted
C:\PROGRA~3\Package Cache deleted
C:\Users\Otto\AppData\Local\Thinstall deleted
C:\Users\Otto\AppData\Local\Wondershare deleted
C:\Windows\sysWoW64\config\systemprofile\AppData\Local\AVAST Software deleted
C:\Users\Otto\Desktop\4K Video Downloader.lnk deleted
"C:\Users\Otto\AppData\Local\{0841835B-86DA-48C7-98F9-7A3A0165BBE6}" deleted

==== Orphaned Tasks deleted from Registry ======================

Avast Emergency Update deleted

==== Firefox Start and Search pages ======================

ProfilePath: C:\Users\Otto\AppData\Roaming\Mozilla\Firefox\Profiles\b9u11n5q.default-1512667376818
user_pref("browser.startup.homepage", "about:home");
user_pref("browser.newtab.url", "about:newtab");

==== Firefox Extensions Registry ======================

[HKEY_LOCAL_MACHINE\Software\Mozilla\Firefox\Extensions]
"bdwtwe@bitdefender.com"="C:\Program Files\Bitdefender\Bitdefender 2017\\bdwteff" [13.09.2017 18:31]
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Mozilla\Firefox\Extensions]
"bdwtwe@bitdefender.com"="C:\Program Files\Bitdefender\Bitdefender 2017\\bdwteff" [13.09.2017 18:31]

==== Firefox Extensions ======================

ProfilePath: C:\Users\Otto\AppData\Roaming\Mozilla\Firefox\Profiles\b9u11n5q.default-1512667376818
- esk slovnk pro kontrolu pravopisu - %ProfilePath%\extensions\cs@dictionaries.addons.mozilla.org
- background:page:background.htmlbrowser_action:default_title:Litikadefault_popup:popup.htmldefault_icon:icon-34.pngicons:128:icon-128.pngcontent_scripts:[matches:[http:https:]js:[browser-polyfill.jscontent.bundle.js]]manifest_version:2permissions:[tabsstoragenotificationscookiesprivacywebRequesthttp:https:]minimum_chrome_version:60content_security_policy:script-src self; object-src selfPln Penenka Litikadescription:Doplnk Vs automaticky upozorn vdy kdy je mon pi nkupu v obchod zskat penze zpt z nkupu.author:PlnPenenka.czhomepage_url:https:www.plnapenezenka.czlistickaversion:4.1.4 - %ProfilePath%\extensions\@plnapenezenkacz-firefox-extension.xpi
- Xmarks Bookmark Sync - %ProfilePath%\extensions\foxmarks@kei.com.xpi
- Google Translator for Firefox - %ProfilePath%\extensions\translator@zoli.bod.xpi
- Video DownloadHelper - %ProfilePath%\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}.xpi
- short_ __MSG_name__ - %ProfilePath%\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi

AppDir: C:\Program Files (x86)\Mozilla Firefox
- Default - %AppDir%\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}.xpi

==== Firefox Plugins ======================

Profilepath: C:\Users\Otto\AppData\Roaming\Mozilla\Firefox\Profiles\b9u11n5q.default-1512667376818
- C:\Windows\system32\Macromed\Flash\NPSWF64_29_0_0_171.dll - [?]
F3D74EAD674CAD808DC2C3326F970403 - C:\Program Files\Java\jre1.8.0_171\bin\dtplugin\npdeployJava1.dll - Java Deployment Toolkit 8.0.1710.11
19C6FF90D40C1C647B41AAEDE24E9957 - C:\Program Files\Java\jre1.8.0_171\bin\plugin2\npjp2.dll - Java(TM) Platform SE 8 U171


==== Chromium Look ======================

Google Chrome Version: 67.0.3396.87

HKEY_LOCAL_MACHINE\SOFTWARE\Google\Chrome\Extensions
efaidnbmnnnibpcajpcglclefindmkaj - No path found[]
gannpgaobkkhmpomoijebaigcapoeebl - No path found[]

uBlockâ‚€ - Otto\AppData\Local\Google\Chrome\User Data\Default\Extensions\cjpalhdlnbpafiamejdnhcphjbkeiagm
Plná Peněženka Lištička - Otto\AppData\Local\Google\Chrome\User Data\Default\Extensions\ecmgkhgjmodembdmiimbacpjgcdimiek
Bitdefender Wallet - Otto\AppData\Local\Google\Chrome\User Data\Default\Extensions\gannpgaobkkhmpomoijebaigcapoeebl
Chrome Media Router - Otto\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm

==== Set IE to Default ======================

Old Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]

New Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"="http://go.microsoft.com/fwlink/?LinkId=69157"

==== All HKLM and HKCU SearchScopes ======================

HKLM\SearchScopes "DefaultScope"="{0633EE93-D776-472f-A0FF-E1416B8B2E3A}"
HKLM\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} - http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
HKLM\Wow6432Node\SearchScopes "DefaultScope"="{0633EE93-D776-472f-A0FF-E1416B8B2E3A}"
HKLM\Wow6432Node\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} - http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
HKCU\SearchScopes "DefaultScope"="{0633EE93-D776-472f-A0FF-E1416B8B2E3A}"
HKCU\SearchScopes\{012E1000-F331-11DB-8314-0800200C9A66} - http://www.google.com/search?q={searchTerms}
HKCU\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} - http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IESR02

==== Reset Google Chrome ======================

C:\Users\Otto\AppData\Local\Google\Chrome\User Data\Default\Preferences was reset successfully
C:\Users\Otto\AppData\Local\Google\Chrome\User Data\Default\Preferences.bad was reset successfully
C:\Users\Otto\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences was reset successfully
C:\Users\Otto\AppData\Local\Google\Chrome\User Data\System Profile\Preferences was reset successfully
C:\Users\Otto\AppData\Local\Google\Chrome\User Data\System Profile\Secure Preferences was reset successfully
C:\Users\Otto\AppData\Local\Google\Chrome\User Data\Default\Web Data was reset successfully
C:\Users\Otto\AppData\Local\Google\Chrome\User Data\Default\Web Data-journal was reset successfully
C:\Users\Otto\AppData\Local\Google\Chrome\User Data\System Profile\Web Data was reset successfully

==== Empty IE Cache ======================

C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\Otto\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully

==== Empty FireFox Cache ======================

No FireFox Cache found

==== Empty Chrome Cache ======================

C:\Users\Otto\AppData\Local\Google\Chrome\User Data\Default\Cache emptied successfully

==== Empty All Flash Cache ======================

Flash Cache Emptied Successfully

==== Empty All Java Cache ======================

No Java Cache Found

==== C:\zoek_backup content ======================

C:\zoek_backup (files=46 folders=20 115656550 bytes)

==== Empty Temp Folders ======================

C:\Users\Default\AppData\Local\temp emptied successfully
C:\Users\Default User\AppData\Local\temp emptied successfully
C:\Users\Otto\AppData\Local\Temp will be emptied at reboot
C:\Users\UpdatusUser\AppData\Local\temp emptied successfully
C:\Windows\serviceprofiles\networkservice\AppData\Local\Temp emptied successfully
C:\Windows\serviceprofiles\Localservice\AppData\Local\Temp emptied successfully
C:\Windows\Temp will be emptied at reboot

==== After Reboot ======================

==== Empty Temp Folders ======================

C:\Windows\Temp successfully emptied
C:\Users\Otto\AppData\Local\Temp successfully emptied

==== Empty Recycle Bin ======================

C:\$RECYCLE.BIN successfully emptied

==== EOF on źt 21.06.2018 at 11:28:29,64 ======================

[OTAS]

Zemana AntiMalware 2.74.2.150 (instalační verze)

-------------------------------------------------------
Scan Result : Dokončeno
Scan Date : 2018.6.21
Operating System : Windows 7 64-bit
Processor : 4X Intel(R) Core(TM) i3-3220 CPU @ 3.30GHz
BIOS Mode : Legacy
CUID : 12F3D158CA2F371B05AC10
Scan Type : Skenování systému
Duration : 18m 45s
Scanned Objects : 81411
Detected Objects : 0
Excluded Objects : 0
Read Level : SCSI
Auto Upload : Zapnuto
Detect All Extensions : Vypnuto
Scan Documents : Vypnuto
Domain Info : WORKGROUP,0,2

Detected Objects
-------------------------------------------------------

Nebyly zjištěny žádné hrozby

[OTAS]

ComboFix 18-06-17.01 - Otto 21.06.2018 12:08:30.1.4 - x64
Microsoft Windows 7 Ultimate 6.1.7601.1.1250.420.1029.18.4048.2134 [GMT 2:00]
Spuštěný z: c:\users\Otto\Desktop\ComboFix.exe
AV: Bitdefender Antivirus *Disabled/Updated* {0E17DB7D-A20F-62CE-B95B-17DB0CDFE318}
FW: Bitdefender Firewall *Disabled* {362C5A58-E860-6396-9204-BEEEF20CA463}
SP: Bitdefender Antispyware *Disabled/Updated* {B5763A99-8435-6D40-83EB-2CA97758A9A5}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\Otto\AppData\Roaming\inst.exe
c:\windows\security\logs\scecomp.log
c:\windows\SysWow64\Packet.dll
c:\windows\SysWow64\pthreadVC.dll
c:\windows\SysWow64\wpcap.dll
.
.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Legacy_NPF
-------\Service_npf
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2018-05-21 do 2018-06-21 )))))))))))))))))))))))))))))))
.
.
2018-06-21 10:13 . 2018-06-21 10:13 -------- d-----w- c:\users\UpdatusUser\AppData\Local\temp
2018-06-21 10:13 . 2018-06-21 10:13 -------- d-----w- c:\users\Default\AppData\Local\temp
2018-06-21 09:45 . 2018-06-21 09:45 -------- d-----w- c:\program files (x86)\AC3Filter
2018-06-21 09:45 . 2018-06-21 09:45 -------- d-----w- c:\program files (x86)\Haali
2018-06-21 09:45 . 2014-09-29 10:23 112640 ----a-w- c:\windows\SysWow64\ff_vfw.dll
2018-06-21 09:45 . 2018-06-21 09:45 -------- d-----w- c:\program files (x86)\ffdshow
2018-06-21 09:45 . 2018-06-21 09:45 -------- d-----w- c:\program files (x86)\7-Zip
2018-06-21 09:39 . 2018-06-21 09:39 203680 ----a-w- c:\windows\system32\drivers\zam64.sys
2018-06-21 09:39 . 2018-06-21 09:39 203680 ----a-w- c:\windows\system32\drivers\zamguard64.sys
2018-06-21 09:39 . 2018-06-21 09:40 -------- d-----w- c:\program files (x86)\Zemana AntiMalware
2018-06-21 09:35 . 2018-06-21 09:35 -------- d-----w- c:\users\Otto\AppData\Roaming\QuickScan
2018-06-21 09:26 . 2018-06-21 10:17 -------- d-----w- c:\users\Otto\AppData\Local\Temp
2018-06-21 09:26 . 2014-02-13 21:59 24064 ----a-w- c:\windows\zoek-delete.exe
2018-06-21 09:13 . 2018-06-21 10:16 253664 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2018-06-21 08:59 . 2018-06-21 09:25 -------- d-----w- C:\zoek_backup
2018-06-20 17:05 . 2018-06-20 17:05 29810 ----a-w- c:\programdata\agent.update.1529514278.bdinstall.bin
2018-06-19 19:51 . 2018-06-19 20:19 -------- d-----w- c:\programdata\RogueKiller
2018-06-19 19:51 . 2018-06-19 19:51 -------- d-----w- c:\program files\RogueKiller
2018-06-19 18:44 . 2018-06-19 18:44 -------- d-----w- c:\programdata\Sophos
2018-06-19 18:44 . 2018-06-19 18:44 -------- d-----w- c:\program files (x86)\Sophos
2018-06-19 18:33 . 2018-05-24 04:55 152184 ----a-w- c:\windows\system32\drivers\mbae64.sys
2018-06-18 19:37 . 2018-06-18 19:37 -------- d-----w- c:\program files\Malwarebytes
2018-06-18 19:32 . 2018-06-18 19:33 -------- d-----w- C:\AdwCleaner
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2018-06-21 08:11 . 2017-04-25 11:40 28272 ----a-w- c:\windows\system32\drivers\TrueSight.sys
2018-06-11 17:37 . 2017-03-25 15:55 607640 ----a-w- c:\windows\system32\drivers\trufos.sys
2018-05-22 18:17 . 2017-03-25 15:56 191592 ----a-w- c:\windows\system32\drivers\ignis.sys
2018-05-22 18:16 . 2017-09-13 16:27 1177008 ----a-w- c:\windows\system32\drivers\atc.sys
2018-05-22 18:16 . 2017-03-25 15:55 189544 ----a-w- c:\windows\system32\drivers\gzflt.sys
2018-05-22 18:16 . 2017-11-24 11:00 45104 ----a-w- c:\windows\system32\drivers\bdprivmon.sys
2018-05-22 18:16 . 2017-03-25 15:56 1723552 ----a-w- c:\windows\system32\drivers\avc3.sys
2018-05-22 18:15 . 2017-03-25 15:56 96448 ----a-w- c:\windows\system32\drivers\bdvedisk.sys
2018-05-22 18:15 . 2018-04-18 18:58 23032 ----a-w- c:\windows\system32\drivers\bdelam.sys
2018-05-17 18:23 . 2017-04-07 19:55 804864 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2018-05-17 18:23 . 2017-04-07 19:55 144896 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2018-04-23 18:57 . 2018-05-09 16:53 396960 ----a-w- c:\windows\system32\iedkcs32.dll
2018-04-23 00:35 . 2018-05-09 16:53 708288 ----a-w- c:\windows\system32\winload.efi
2018-04-23 00:35 . 2018-05-09 16:53 5583552 ----a-w- c:\windows\system32\ntoskrnl.exe
2018-04-23 00:35 . 2018-05-09 16:53 95424 ----a-w- c:\windows\system32\drivers\ksecdd.sys
2018-04-23 00:35 . 2018-05-09 16:53 154816 ----a-w- c:\windows\system32\drivers\ksecpkg.sys
2018-04-23 00:35 . 2018-05-09 16:53 262336 ----a-w- c:\windows\system32\hal.dll
2018-04-23 00:12 . 2018-05-09 16:53 4047040 ----a-w- c:\windows\SysWow64\ntkrnlpa.exe
2018-04-23 00:12 . 2018-05-09 16:53 3958464 ----a-w- c:\windows\SysWow64\ntoskrnl.exe
2018-04-23 00:10 . 2018-05-09 16:53 631640 ----a-w- c:\windows\system32\winresume.efi
2018-04-23 00:07 . 2018-05-09 16:53 1665336 ----a-w- c:\windows\system32\ntdll.dll
2018-04-23 00:00 . 2018-05-09 16:53 361984 ----a-w- c:\windows\system32\wow64win.dll
2018-04-23 00:00 . 2018-05-09 16:53 243712 ----a-w- c:\windows\system32\wow64.dll
2018-04-23 00:00 . 2018-05-09 16:53 215552 ----a-w- c:\windows\system32\winsrv.dll
2018-04-23 00:00 . 2018-05-09 16:53 13312 ----a-w- c:\windows\system32\wow64cpu.dll
2018-04-23 00:00 . 2018-05-09 16:53 94208 ----a-w- c:\windows\system32\TSpkg.dll
2018-04-23 00:00 . 2018-05-09 16:53 28672 ----a-w- c:\windows\system32\sspisrv.dll
2018-04-23 00:00 . 2018-05-09 16:53 210432 ----a-w- c:\windows\system32\wdigest.dll
2018-04-23 00:00 . 2018-05-09 16:53 135680 ----a-w- c:\windows\system32\sspicli.dll
2018-04-23 00:00 . 2018-05-09 16:53 63488 ----a-w- c:\windows\system32\setbcdlocale.dll
2018-04-23 00:00 . 2018-05-09 16:53 503808 ----a-w- c:\windows\system32\srcore.dll
2018-04-23 00:00 . 2018-05-09 16:53 50176 ----a-w- c:\windows\system32\srclient.dll
2018-04-23 00:00 . 2018-05-09 16:53 876032 ----a-w- c:\windows\system32\oleaut32.dll
2018-04-23 00:00 . 2018-05-09 16:53 512512 ----a-w- c:\windows\system32\rpcss.dll
2018-04-23 00:00 . 2018-05-09 16:53 2066432 ----a-w- c:\windows\system32\ole32.dll
2018-04-23 00:00 . 2018-05-09 16:53 1212928 ----a-w- c:\windows\system32\rpcrt4.dll
2018-04-23 00:00 . 2018-05-09 16:53 345600 ----a-w- c:\windows\system32\schannel.dll
2018-04-23 00:00 . 2018-05-09 16:53 28160 ----a-w- c:\windows\system32\secur32.dll
2018-04-23 00:00 . 2018-05-09 16:53 26112 ----a-w- c:\windows\system32\oleres.dll
2018-04-23 00:00 . 2018-05-09 16:53 190464 ----a-w- c:\windows\system32\rpchttp.dll
2018-04-23 00:00 . 2018-05-09 16:53 60416 ----a-w- c:\windows\system32\msobjs.dll
2018-04-23 00:00 . 2018-05-09 16:53 316928 ----a-w- c:\windows\system32\msv1_0.dll
2018-04-23 00:00 . 2018-05-09 16:53 312320 ----a-w- c:\windows\system32\ncrypt.dll
2018-04-23 00:00 . 2018-05-09 16:53 16384 ----a-w- c:\windows\system32\ntvdm64.dll
2018-04-23 00:00 . 2018-05-09 16:53 1461248 ----a-w- c:\windows\system32\lsasrv.dll
2018-04-23 00:00 . 2018-05-09 16:53 146432 ----a-w- c:\windows\system32\msaudite.dll
2018-04-23 00:00 . 2018-05-09 16:53 731648 ----a-w- c:\windows\system32\kerberos.dll
2018-04-23 00:00 . 2018-05-09 16:53 1163264 ----a-w- c:\windows\system32\kernel32.dll
2018-04-23 00:00 . 2018-05-09 16:53 419840 ----a-w- c:\windows\system32\KernelBase.dll
2018-04-23 00:00 . 2018-05-09 16:53 8704 ----a-w- c:\windows\system32\comcat.dll
2018-04-23 00:00 . 2018-05-09 16:53 44032 ----a-w- c:\windows\system32\csrsrv.dll
2018-04-23 00:00 . 2018-05-09 16:53 43520 ----a-w- c:\windows\system32\cryptbase.dll
2018-04-23 00:00 . 2018-05-09 16:53 22016 ----a-w- c:\windows\system32\credssp.dll
2018-04-23 00:00 . 2018-05-09 16:53 463872 ----a-w- c:\windows\system32\certcli.dll
2018-04-23 00:00 . 2018-05-09 16:53 123904 ----a-w- c:\windows\system32\bcrypt.dll
2018-04-23 00:00 . 2018-05-09 16:53 880640 ----a-w- c:\windows\system32\advapi32.dll
2018-04-23 00:00 . 2018-05-09 16:53 7168 ----a-w- c:\windows\system32\apisetschema.dll
2018-04-23 00:00 . 2018-05-09 16:53 690688 ----a-w- c:\windows\system32\adtschema.dll
2018-04-23 00:00 . 2018-05-09 16:53 6144 ---ha-w- c:\windows\system32\api-ms-win-security-base-l1-1-0.dll
2018-04-23 00:00 . 2018-05-09 16:53 59904 ----a-w- c:\windows\system32\appidapi.dll
2018-04-23 00:00 . 2018-05-09 16:53 5120 ---ha-w- c:\windows\system32\api-ms-win-core-file-l1-1-0.dll
2018-04-23 00:00 . 2018-05-09 16:53 4608 ---ha-w- c:\windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2018-04-23 00:00 . 2018-05-09 16:53 4608 ---ha-w- c:\windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2018-04-23 00:00 . 2018-05-09 16:53 4096 ---ha-w- c:\windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2018-04-23 00:00 . 2018-05-09 16:53 4096 ---ha-w- c:\windows\system32\api-ms-win-core-synch-l1-1-0.dll
2018-04-23 00:00 . 2018-05-09 16:53 4096 ---ha-w- c:\windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2018-04-23 00:00 . 2018-05-09 16:53 4096 ---ha-w- c:\windows\system32\api-ms-win-core-localregistry-l1-1-0(62).dll
2018-04-23 00:00 . 2018-05-09 16:53 4096 ---ha-w- c:\windows\system32\api-ms-win-core-localization-l1-1-0.dll
2018-04-23 00:00 . 2018-05-09 16:53 3584 ---ha-w- c:\windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2018-04-23 00:00 . 2018-05-09 16:53 3584 ---ha-w- c:\windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2018-04-23 00:00 . 2018-05-09 16:53 3584 ---ha-w- c:\windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2018-04-23 00:00 . 2018-05-09 16:53 3584 ---ha-w- c:\windows\system32\api-ms-win-core-misc-l1-1-0.dll
2018-04-23 00:00 . 2018-05-09 16:53 3584 ---ha-w- c:\windows\system32\api-ms-win-core-misc-l1-1-0(63).dll
2018-04-23 00:00 . 2018-05-09 16:53 3584 ---ha-w- c:\windows\system32\api-ms-win-core-memory-l1-1-0.dll
2018-04-23 00:00 . 2018-05-09 16:53 3584 ---ha-w- c:\windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2018-04-23 00:00 . 2018-05-09 16:53 3584 ---ha-w- c:\windows\system32\api-ms-win-core-heap-l1-1-0.dll
2018-04-23 00:00 . 2018-05-09 16:53 34816 ----a-w- c:\windows\system32\appidsvc.dll
2018-04-23 00:00 . 2018-05-09 16:53 3072 ---ha-w- c:\windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2018-04-23 00:00 . 2018-05-09 16:53 3072 ---ha-w- c:\windows\system32\api-ms-win-core-util-l1-1-0.dll
2018-04-23 00:00 . 2018-05-09 16:53 3072 ---ha-w- c:\windows\system32\api-ms-win-core-string-l1-1-0.dll
2018-04-23 00:00 . 2018-05-09 16:53 3072 ---ha-w- c:\windows\system32\api-ms-win-core-profile-l1-1-0.dll
2018-04-23 00:00 . 2018-05-09 16:53 3072 ---ha-w- c:\windows\system32\api-ms-win-core-io-l1-1-0.dll
2018-04-23 00:00 . 2018-05-09 16:53 3072 ---ha-w- c:\windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2018-04-23 00:00 . 2018-05-09 16:53 3072 ---ha-w- c:\windows\system32\api-ms-win-core-handle-l1-1-0.dll
2018-04-23 00:00 . 2018-05-09 16:53 3072 ---ha-w- c:\windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2018-04-23 00:00 . 2018-05-09 16:53 3072 ---ha-w- c:\windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2018-04-23 00:00 . 2018-05-09 16:53 3072 ---ha-w- c:\windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2018-04-23 00:00 . 2018-05-09 16:53 3072 ---ha-w- c:\windows\system32\api-ms-win-core-debug-l1-1-0.dll
2018-04-23 00:00 . 2018-05-09 16:53 3072 ---ha-w- c:\windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2018-04-23 00:00 . 2018-05-09 16:53 3072 ---ha-w- c:\windows\system32\api-ms-win-core-console-l1-1-0.dll
2018-04-22 23:44 . 2018-05-09 16:53 1314064 ----a-w- c:\windows\SysWow64\ntdll.dll
2018-04-22 23:41 . 2018-05-09 16:53 666112 ----a-w- c:\windows\SysWow64\rpcrt4.dll
2018-04-22 23:41 . 2018-05-09 16:53 96768 ----a-w- c:\windows\SysWow64\sspicli.dll
2018-04-22 23:41 . 2018-05-09 16:53 82944 ----a-w- c:\windows\SysWow64\bcrypt.dll
2018-04-22 23:41 . 2018-05-09 16:53 5120 ----a-w- c:\windows\SysWow64\wow32.dll
2018-04-22 23:41 . 2018-05-09 16:53 275456 ----a-w- c:\windows\SysWow64\KernelBase.dll
2018-04-22 23:41 . 2018-05-09 16:53 70144 ----a-w- c:\windows\SysWow64\TSpkg.dll
2018-04-22 23:41 . 2018-05-09 16:53 43008 ----a-w- c:\windows\SysWow64\srclient.dll
2018-04-22 23:41 . 2018-05-09 16:53 172032 ----a-w- c:\windows\SysWow64\wdigest.dll
2018-04-22 23:40 . 2018-05-09 16:53 254464 ----a-w- c:\windows\SysWow64\schannel.dll
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Zoner Photo Studio Autoupdate"="c:\program files\ZONER\PHOTO STUDIO 19\Program32\ZPSTRAY.EXE" [2018-04-05 576456]
"CCleaner Monitoring"="c:\program files\CCleaner\CCleaner64.exe" [2018-05-24 18364648]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
"EnableLinkedConnections"= 1 (0x1)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MBAMService]
@="Service"
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\run-disabled]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe"
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R3 BrYNSvc;BrYNSvc;c:\program files (x86)\Browny02\BrYNSvc.exe;c:\program files (x86)\Browny02\BrYNSvc.exe [x]
R3 Garmin Device Interaction Service;Garmin Device Interaction Service;c:\program files (x86)\Garmin\Device Interaction Service\GarminService.exe EXPRESS;c:\program files (x86)\Garmin\Device Interaction Service\GarminService.exe EXPRESS [x]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys;c:\windows\SYSNATIVE\drivers\rdpvideominiport.sys [x]
R3 Revoflt;Revoflt;c:\windows\system32\DRIVERS\revoflt.sys;c:\windows\SYSNATIVE\DRIVERS\revoflt.sys [x]
R3 Synth3dVsc;Synth3dVsc;c:\windows\system32\drivers\synth3dvsc.sys;c:\windows\SYSNATIVE\drivers\synth3dvsc.sys [x]
R3 tnd;Acronis Try&Decide filter;c:\windows\system32\DRIVERS\tnd.sys;c:\windows\SYSNATIVE\DRIVERS\tnd.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 tsusbhub;tsusbhub;c:\windows\system32\drivers\tsusbhub.sys;c:\windows\SYSNATIVE\drivers\tsusbhub.sys [x]
R3 VGPU;VGPU;c:\windows\system32\drivers\rdvgkmd.sys;c:\windows\SYSNATIVE\drivers\rdvgkmd.sys [x]
R3 WatAdminSvc;Služba Technologie aktivace Windows;c:\windows\system32\Wat\WatAdminSvc.exe;c:\windows\SYSNATIVE\Wat\WatAdminSvc.exe [x]
R4 HuaweiHiSuiteService64.exe;HuaweiHiSuiteService64.exe;c:\program files (x86)\HiSuite\HandSetService\HuaweiHiSuiteService64.exe;c:\program files (x86)\HiSuite\HandSetService\HuaweiHiSuiteService64.exe [x]
S0 avc3;avc3;c:\windows\system32\DRIVERS\avc3.sys;c:\windows\SYSNATIVE\DRIVERS\avc3.sys [x]
S0 file_tracker;file_tracker;c:\windows\system32\DRIVERS\file_tracker.sys;c:\windows\SYSNATIVE\DRIVERS\file_tracker.sys [x]
S0 fltsrv;Acronis Storage Filter Management;c:\windows\system32\DRIVERS\fltsrv.sys;c:\windows\SYSNATIVE\DRIVERS\fltsrv.sys [x]
S0 gzflt;gzflt;c:\windows\system32\DRIVERS\gzflt.sys;c:\windows\SYSNATIVE\DRIVERS\gzflt.sys [x]
S0 Ignis;Ignis Service;c:\windows\system32\DRIVERS\ignis.sys;c:\windows\SYSNATIVE\DRIVERS\ignis.sys [x]
S0 tib;Acronis TIB Manager;c:\windows\system32\DRIVERS\tib.sys;c:\windows\SYSNATIVE\DRIVERS\tib.sys [x]
S1 atc;atc;c:\windows\system32\DRIVERS\atc.sys;c:\windows\SYSNATIVE\DRIVERS\atc.sys [x]
S1 bdfwfpf;bdfwfpf;c:\program files\Common Files\Bitdefender\Bitdefender Firewall\bdfwfpf.sys;c:\program files\Common Files\Bitdefender\Bitdefender Firewall\bdfwfpf.sys [x]
S1 BDVEDISK;BDVEDISK;c:\windows\system32\DRIVERS\bdvedisk.sys;c:\windows\SYSNATIVE\DRIVERS\bdvedisk.sys [x]
S1 ZAM;ZAM Helper Driver;c:\windows\System32\drivers\zam64.sys;c:\windows\SYSNATIVE\drivers\zam64.sys [x]
S1 ZAM_Guard;ZAM Guard Driver;c:\windows\System32\drivers\zamguard64.sys;c:\windows\SYSNATIVE\drivers\zamguard64.sys [x]
S2 afcdpsrv;Acronis Nonstop Backup Service;c:\program files (x86)\Common Files\Acronis\CDP\afcdpsrv.exe;c:\program files (x86)\Common Files\Acronis\CDP\afcdpsrv.exe [x]
S2 bdprivmon;bdprivmon;c:\windows\system32\DRIVERS\bdprivmon.sys;c:\windows\SYSNATIVE\DRIVERS\bdprivmon.sys [x]
S2 bdredline;Bitdefender RedLine Service;c:\program files\Common Files\Bitdefender\SetupInformation\Bitdefender RedLine\bdredline.exe;c:\program files\Common Files\Bitdefender\SetupInformation\Bitdefender RedLine\bdredline.exe [x]
S2 DiagTrack;Diagnostics Tracking Service;c:\windows\System32\svchost.exe;c:\windows\SYSNATIVE\svchost.exe [x]
S2 MBAMService;Malwarebytes Service;c:\program files\Malwarebytes\Anti-Malware\mbamservice.exe;c:\program files\Malwarebytes\Anti-Malware\mbamservice.exe [x]
S2 ProductAgentService;ProductAgentService;c:\program files\Bitdefender Agent\ProductAgentService.exe;c:\program files\Bitdefender Agent\ProductAgentService.exe [x]
S2 tib_mounter;Acronis TIB Mounter;c:\windows\system32\DRIVERS\tib_mounter.sys;c:\windows\SYSNATIVE\DRIVERS\tib_mounter.sys [x]
S2 UPDATESRV;Bitdefender Desktop Update Service;c:\program files\Bitdefender\Bitdefender 2017\updatesrv.exe;c:\program files\Bitdefender\Bitdefender 2017\updatesrv.exe [x]
S2 virtual_file;Acronis Virtual File Driver;c:\windows\system32\DRIVERS\virtual_file.sys;c:\windows\SYSNATIVE\DRIVERS\virtual_file.sys [x]
S2 ZAMSvc;ZAM Controller Service;c:\program files (x86)\Zemana AntiMalware\ZAM.exe;c:\program files (x86)\Zemana AntiMalware\ZAM.exe [x]
S3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\System32\Drivers\mbamswissarmy.sys;c:\windows\SYSNATIVE\Drivers\mbamswissarmy.sys [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x]
.
.
--- Ostatní služby/ovladače v paměti ---
.
*NewlyCreated* - MBAMSWISSARMY
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost]
LocalServiceAndNoImpersonation REG_MULTI_SZ SSDPSRV upnphost SCardSvr QWAVE wcncsvc
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Bdagent"="c:\program files\Bitdefender\Bitdefender 2017\bdagent.exe" [2018-05-22 452032]
"ZAM"="c:\program files (x86)\Zemana AntiMalware\ZAM.exe" [2017-08-09 15775888]
.
------- Doplňkový sken -------
.
uLocal Page = c:\windows\system32\blank.htm
mStart Page = about:blank
mLocal Page = c:\windows\SysWOW64\blank.htm
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~2\MICROS~1\Office12\EXCEL.EXE/3000
TCP: DhcpNameServer = 213.46.172.37 213.46.172.36
FF - ProfilePath - c:\users\Otto\AppData\Roaming\Mozilla\Firefox\Profiles\b9u11n5q.default-1512667376818\
FF - prefs.js: browser.startup.homepage - about:home
.
.
------- Asociace souborů -------
.
inifile="%SystemRoot%\system32\NOTEPAD.EXE" %1
txtfile="%SystemRoot%\system32\NOTEPAD.EXE" %1
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
.
ShellIconOverlayIdentifiers-{472083B0-C522-11CF-8763-00608CC02F24} - (no file)
ShellIconOverlayIdentifiers-{934BC6C0-FEC2-4df5-A100-961DE2C8A0ED} - (no file)
ShellIconOverlayIdentifiers-{00F848DC-B1D4-4892-9C25-CAADC86A215D} - (no file)
ShellIconOverlayIdentifiers-{71573297-552E-46fc-BE3D-3DFAF88D47B7} - (no file)
AddRemove-{52c2b6dd-5953-4bb1-9ef3-d145973e25e7} - c:\programdata\Package Cache\{52c2b6dd-5953-4bb1-9ef3-d145973e25e7}\GarminExpressInstaller.exe
.
.
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_29_0_0_171_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_29_0_0_171_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}]
@Denied: (A 2) (Everyone)
@="IFlashBroker6"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_29_0_0_171_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_29_0_0_171_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_29_0_0_171.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.29"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_29_0_0_171.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_29_0_0_171.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_29_0_0_171.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}]
@Denied: (A 2) (Everyone)
@="IFlashBroker6"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\System*]
"OODEFRAG21.00.00.02PROFESSIONAL"="CC3ED742129DD583819603EE2A8CBAAA3200F4A785BE43FAC7EF42558AB6BFE728F57FE6CFF7D2869EFB041C4D6FB33F58D7B39921AB8343EF2A62CADFE3B7DC860F3C19F852900C6DA04B6CA6DA9AF1E0C4FD85F287480ED650CF9EC94A1C495075EC5E1B1D58D34E8477228CE54A52C57CD5FEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CC038D530D6EB3452C038D530D6EB3452C038D530D6EB34528EDD5E5BE2F6E66769D8871787B5D714C5E210E7CC6BA120804E5AC5B9D3A1A258719EEC811331D844CD9B436AEC4B5E39440BA472C52778B9D24D31CFA89175BA71FEB63EE31F9BDB67C5AC9B312BA76AC80231D0742E5A36F2C1A89281D7993120895A69FA019A6B8BF03393B96FA4D4220602AE47E2DC4DC58AD03269F5A69121F6CD403E50906685D8C0BEE3A55125E3F78D443486DC0CCACE53570E03FA6379D38977B2167AF00511BBFB2FECED3F878FD03F53EF7AB0E20C5D1AC02937E295800CB584F31C641EFE17203FF97BB86757CABEE10619AE51909D89F7A6C080C233D516019BF9CEC65C4373DB15435DC42EFED9C048E1AD4282CA274D4EC0E233736E269B54DF72DA3736B0F0994EAAC447F51A74C6BF0A42D69BE97E0524617C9D5E6B6B785A431A706D8A0FF9ED54EFA7B97AA72664D3C2DA4E3AED479C869AE3B2DB2B7ABCEBA83FE3A1E83834BE31AB5BECA4A142CB98ACA27721A01E95EBC97D61BA5A1D4A0CAB9F9057ED7786DA026D56DD84136B7D435D72C1B5E2813229565C1BB055EEB19424E1564754F91F2D0910E8B1D15E0F6348721E3A677493AD53A075A9831FE6AA7F960583A999988449E67C9DBF044E2AAEB0A9FBED481B5995729203895661F5BDA229781A9EC131CC9B77D0606EA007E15BF656F98FB7003B0F63908E40B7CDF16DA78D0DF17C34B7645AEAFBE6CFBEB595423CD50F3A4BEDA579BAFA3E6461B3D28FBEAD330DDE33E7481B9E690AE683F369350FBE593654570C7AFE67C6B21D240E1DEAB31BD7E7460D2718A3DEEDA780EC5AF54A31149C3D74E00C03A396CCA4F8CBF77A339A090E1468FCF9C49183BA74DA9F923E0879E0B411571221B7E50CC6854CC24675C745EDCCA50495667B1349F6652DE30B2042ED415C42CB920E079493A3F8280BDBE4CF54AD8D8DD477EFD807E4E1E7E8C954E63E58FB12F9F03522D7FB4311D302DA131676144F96E42C34F47E2D754534FC0BE5CDD6C8933C2AD24619741E98F986B339A2CEDF3EB315133ED7BF1B122118E92C82A125D8A36FAEE701194F77063D537C1A22282D596CCE76DA7D491AD675B498815DC398DD7EE15801EE8A666EC8B7AF8B2BF49C4D6865423380D8F89ED643C598BF247224CA3CC626E8152980E5C7BAE339F8180EB3F7DDD293039EC573"
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
c:\program files (x86)\Google\Update\1.3.33.17\GoogleCrashHandler.exe
c:\program files\Malwarebytes\Anti-Malware\mbamtray.exe
.
**************************************************************************
.
Celkový čas: 2018-06-21 12:21:36 - počítač byl restartován
ComboFix-quarantined-files.txt 2018-06-21 10:21
.
Před spuštěním: Volných bajtů: 251 908 313 088
Po spuštění: Volných bajtů: 251 251 060 736
.
- - End Of File - - 6ACF983F42B95175557F20D0F66ADACE
A36C5E4F47E84449FF07ED3517B43A31

[OTAS]

Po ComboFixu windows opět nenaskočil tak jsem musel použít startup repair a už naběhl.

[jaro3]

Měl si zkusit několikrát restart.

Vypni rez. ochranu u antiviru a antispywaru,příp. firewall..

Otevři si Poznámkový blok (Start -> Spustit... a napiš do okna Notepad a dej Ok.
Zkopíruj do něj následující celý text označený zeleně:

Kód: Vybrat vše

ClearJavaCache::
RegLock::
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_29_0_0_171_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_29_0_0_171_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}]
@Denied: (A 2) (Everyone)
@="IFlashBroker6"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_29_0_0_171_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_29_0_0_171_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_29_0_0_171.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.29"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_29_0_0_171.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_29_0_0_171.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_29_0_0_171.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}]
@Denied: (A 2) (Everyone)
@="IFlashBroker6"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"


Zvol možnost Soubor -> Uložit jako... a nastav tyto parametry:
Název souboru: zde napiš: CFScript.txt
Uložit jako typ: tak tam vyber Všechny soubory
Ulož soubor na plochu.
Ukonči všechna aktivní okna.

Uchop myší vytvořený skript CFScript.txt, přemísti ho nad stažený program ComboFix.exe a když se oba soubory překryjí, skript upusť.
- Automaticky se spustí ComboFix
- Vlož sem log, který vyběhne v závěru čistícího procesu + nový log z HJT

Upozornění : Může se stát, že po aplikaci Combofixu a restartu počítače, Windows nenaběhnou , nebo nenajede plocha , budou problémy s připojením, pak znovu restartuj počítač, pokud to nepomůže , po restartu mačkej klávesu F8 a pak zvol poslední známou funkční konfiguraci. , či použij bod obnovy.


Stáhni si Memtest:

Políčko , ve kterém je napsáno:
All unused RAM , změň na 2048.
-dej Start , nech nejméně 2h běžet , pokud bude po 2h stále 0 errors , jsou v pořádku.
V případě vyšších kapacit RAM je třeba Memtest spustit několikrát , pro 2GB ( jednotlivá největší kapacita RAM) 2x , pro 4GB 3x , pro 8Gb 4x ap.
poklepej na Memtest , pak znovu a znovu , do políček všech Memtestů napiš 2048 , pak dej u všech Memtestů "Start".

Ještě zkontrolovat HDD na chyby ,popř. zkusit jeho defragmentaci ..

Stáhni si CrystalDiskInfo
Spusť program a klikni na Úpravy-Kopírovat. Poté sem vlož pomocí Ctrl+V obsah logu.

[OTAS]

ComboFix 18-06-17.01 - Otto 21.06.2018 20:19:44.1.4 - x64
Microsoft Windows 7 Ultimate 6.1.7601.1.1250.420.1029.18.4048.2506 [GMT 2:00]
Spuštěný z: c:\users\Otto\Desktop\ComboFix.exe
Použité ovládací přepínače :: c:\users\Otto\Desktop\CFScript.txt
AV: Bitdefender Antivirus *Disabled/Updated* {0E17DB7D-A20F-62CE-B95B-17DB0CDFE318}
FW: Bitdefender Firewall *Disabled* {362C5A58-E860-6396-9204-BEEEF20CA463}
SP: Bitdefender Antispyware *Disabled/Updated* {B5763A99-8435-6D40-83EB-2CA97758A9A5}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\Otto\AppData\Roaming\inst.exe
c:\windows\security\logs\scecomp.log
c:\windows\SysWow64\Packet.dll
c:\windows\SysWow64\pthreadVC.dll
c:\windows\SysWow64\wpcap.dll
.
.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Legacy_NPF
-------\Service_npf
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2018-05-21 do 2018-06-21 )))))))))))))))))))))))))))))))
.
.
2018-06-21 18:25 . 2018-06-21 18:25 -------- d-----w- c:\users\UpdatusUser\AppData\Local\temp
2018-06-21 18:25 . 2018-06-21 18:25 -------- d-----w- c:\users\Public\AppData\Local\temp
2018-06-21 18:25 . 2018-06-21 18:25 -------- d-----w- c:\users\Default\AppData\Local\temp
2018-06-21 09:45 . 2018-06-21 09:45 -------- d-----w- c:\program files (x86)\AC3Filter
2018-06-21 09:45 . 2018-06-21 09:45 -------- d-----w- c:\program files (x86)\Haali
2018-06-21 09:45 . 2014-09-29 10:23 112640 ----a-w- c:\windows\SysWow64\ff_vfw.dll
2018-06-21 09:45 . 2018-06-21 09:45 -------- d-----w- c:\program files (x86)\ffdshow
2018-06-21 09:45 . 2018-06-21 09:45 -------- d-----w- c:\program files (x86)\7-Zip
2018-06-21 09:39 . 2018-06-21 09:39 203680 ----a-w- c:\windows\system32\drivers\zam64.sys
2018-06-21 09:39 . 2018-06-21 09:39 203680 ----a-w- c:\windows\system32\drivers\zamguard64.sys
2018-06-21 09:39 . 2018-06-21 09:40 -------- d-----w- c:\program files (x86)\Zemana AntiMalware
2018-06-21 09:35 . 2018-06-21 09:35 -------- d-----w- c:\users\Otto\AppData\Roaming\QuickScan
2018-06-21 09:26 . 2018-06-21 18:25 -------- d-----w- c:\users\Otto\AppData\Local\Temp
2018-06-21 09:26 . 2014-02-13 21:59 24064 ----a-w- c:\windows\zoek-delete.exe
2018-06-21 08:59 . 2018-06-21 09:25 -------- d-----w- C:\zoek_backup
2018-06-20 17:05 . 2018-06-20 17:05 29810 ----a-w- c:\programdata\agent.update.1529514278.bdinstall.bin
2018-06-19 19:51 . 2018-06-19 20:19 -------- d-----w- c:\programdata\RogueKiller
2018-06-19 19:51 . 2018-06-19 19:51 -------- d-----w- c:\program files\RogueKiller
2018-06-19 18:44 . 2018-06-19 18:44 -------- d-----w- c:\programdata\Sophos
2018-06-19 18:44 . 2018-06-19 18:44 -------- d-----w- c:\program files (x86)\Sophos
2018-06-19 18:33 . 2018-05-24 04:55 152184 ----a-w- c:\windows\system32\drivers\mbae64.sys
2018-06-18 19:37 . 2018-06-18 19:37 -------- d-----w- c:\program files\Malwarebytes
2018-06-18 19:32 . 2018-06-18 19:33 -------- d-----w- C:\AdwCleaner
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2018-06-21 08:11 . 2017-04-25 11:40 28272 ----a-w- c:\windows\system32\drivers\TrueSight.sys
2018-06-11 17:37 . 2017-03-25 15:55 607640 ----a-w- c:\windows\system32\drivers\trufos.sys
2018-05-22 18:17 . 2017-03-25 15:56 191592 ----a-w- c:\windows\system32\drivers\ignis.sys
2018-05-22 18:16 . 2017-09-13 16:27 1177008 ----a-w- c:\windows\system32\drivers\atc.sys
2018-05-22 18:16 . 2017-03-25 15:55 189544 ----a-w- c:\windows\system32\drivers\gzflt.sys
2018-05-22 18:16 . 2017-11-24 11:00 45104 ----a-w- c:\windows\system32\drivers\bdprivmon.sys
2018-05-22 18:16 . 2017-03-25 15:56 1723552 ----a-w- c:\windows\system32\drivers\avc3.sys
2018-05-22 18:15 . 2017-03-25 15:56 96448 ----a-w- c:\windows\system32\drivers\bdvedisk.sys
2018-05-22 18:15 . 2018-04-18 18:58 23032 ----a-w- c:\windows\system32\drivers\bdelam.sys
2018-05-17 18:23 . 2017-04-07 19:55 804864 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2018-05-17 18:23 . 2017-04-07 19:55 144896 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2018-04-23 18:57 . 2018-05-09 16:53 396960 ----a-w- c:\windows\system32\iedkcs32.dll
2018-04-23 00:35 . 2018-05-09 16:53 708288 ----a-w- c:\windows\system32\winload.efi
2018-04-23 00:35 . 2018-05-09 16:53 5583552 ----a-w- c:\windows\system32\ntoskrnl.exe
2018-04-23 00:35 . 2018-05-09 16:53 95424 ----a-w- c:\windows\system32\drivers\ksecdd.sys
2018-04-23 00:35 . 2018-05-09 16:53 154816 ----a-w- c:\windows\system32\drivers\ksecpkg.sys
2018-04-23 00:35 . 2018-05-09 16:53 262336 ----a-w- c:\windows\system32\hal.dll
2018-04-23 00:12 . 2018-05-09 16:53 4047040 ----a-w- c:\windows\SysWow64\ntkrnlpa.exe
2018-04-23 00:12 . 2018-05-09 16:53 3958464 ----a-w- c:\windows\SysWow64\ntoskrnl.exe
2018-04-23 00:10 . 2018-05-09 16:53 631640 ----a-w- c:\windows\system32\winresume.efi
2018-04-23 00:07 . 2018-05-09 16:53 1665336 ----a-w- c:\windows\system32\ntdll.dll
2018-04-23 00:00 . 2018-05-09 16:53 361984 ----a-w- c:\windows\system32\wow64win.dll
2018-04-23 00:00 . 2018-05-09 16:53 243712 ----a-w- c:\windows\system32\wow64.dll
2018-04-23 00:00 . 2018-05-09 16:53 215552 ----a-w- c:\windows\system32\winsrv.dll
2018-04-23 00:00 . 2018-05-09 16:53 13312 ----a-w- c:\windows\system32\wow64cpu.dll
2018-04-23 00:00 . 2018-05-09 16:53 94208 ----a-w- c:\windows\system32\TSpkg.dll
2018-04-23 00:00 . 2018-05-09 16:53 28672 ----a-w- c:\windows\system32\sspisrv.dll
2018-04-23 00:00 . 2018-05-09 16:53 210432 ----a-w- c:\windows\system32\wdigest.dll
2018-04-23 00:00 . 2018-05-09 16:53 135680 ----a-w- c:\windows\system32\sspicli.dll
2018-04-23 00:00 . 2018-05-09 16:53 63488 ----a-w- c:\windows\system32\setbcdlocale.dll
2018-04-23 00:00 . 2018-05-09 16:53 503808 ----a-w- c:\windows\system32\srcore.dll
2018-04-23 00:00 . 2018-05-09 16:53 50176 ----a-w- c:\windows\system32\srclient.dll
2018-04-23 00:00 . 2018-05-09 16:53 876032 ----a-w- c:\windows\system32\oleaut32.dll
2018-04-23 00:00 . 2018-05-09 16:53 512512 ----a-w- c:\windows\system32\rpcss.dll
2018-04-23 00:00 . 2018-05-09 16:53 2066432 ----a-w- c:\windows\system32\ole32.dll
2018-04-23 00:00 . 2018-05-09 16:53 1212928 ----a-w- c:\windows\system32\rpcrt4.dll
2018-04-23 00:00 . 2018-05-09 16:53 345600 ----a-w- c:\windows\system32\schannel.dll
2018-04-23 00:00 . 2018-05-09 16:53 28160 ----a-w- c:\windows\system32\secur32.dll
2018-04-23 00:00 . 2018-05-09 16:53 26112 ----a-w- c:\windows\system32\oleres.dll
2018-04-23 00:00 . 2018-05-09 16:53 190464 ----a-w- c:\windows\system32\rpchttp.dll
2018-04-23 00:00 . 2018-05-09 16:53 60416 ----a-w- c:\windows\system32\msobjs.dll
2018-04-23 00:00 . 2018-05-09 16:53 316928 ----a-w- c:\windows\system32\msv1_0.dll
2018-04-23 00:00 . 2018-05-09 16:53 312320 ----a-w- c:\windows\system32\ncrypt.dll
2018-04-23 00:00 . 2018-05-09 16:53 16384 ----a-w- c:\windows\system32\ntvdm64.dll
2018-04-23 00:00 . 2018-05-09 16:53 1461248 ----a-w- c:\windows\system32\lsasrv.dll
2018-04-23 00:00 . 2018-05-09 16:53 146432 ----a-w- c:\windows\system32\msaudite.dll
2018-04-23 00:00 . 2018-05-09 16:53 731648 ----a-w- c:\windows\system32\kerberos.dll
2018-04-23 00:00 . 2018-05-09 16:53 1163264 ----a-w- c:\windows\system32\kernel32.dll
2018-04-23 00:00 . 2018-05-09 16:53 419840 ----a-w- c:\windows\system32\KernelBase.dll
2018-04-23 00:00 . 2018-05-09 16:53 8704 ----a-w- c:\windows\system32\comcat.dll
2018-04-23 00:00 . 2018-05-09 16:53 44032 ----a-w- c:\windows\system32\csrsrv.dll
2018-04-23 00:00 . 2018-05-09 16:53 43520 ----a-w- c:\windows\system32\cryptbase.dll
2018-04-23 00:00 . 2018-05-09 16:53 22016 ----a-w- c:\windows\system32\credssp.dll
2018-04-23 00:00 . 2018-05-09 16:53 463872 ----a-w- c:\windows\system32\certcli.dll
2018-04-23 00:00 . 2018-05-09 16:53 123904 ----a-w- c:\windows\system32\bcrypt.dll
2018-04-23 00:00 . 2018-05-09 16:53 880640 ----a-w- c:\windows\system32\advapi32.dll
2018-04-23 00:00 . 2018-05-09 16:53 7168 ----a-w- c:\windows\system32\apisetschema.dll
2018-04-23 00:00 . 2018-05-09 16:53 690688 ----a-w- c:\windows\system32\adtschema.dll
2018-04-23 00:00 . 2018-05-09 16:53 6144 ---ha-w- c:\windows\system32\api-ms-win-security-base-l1-1-0.dll
2018-04-23 00:00 . 2018-05-09 16:53 59904 ----a-w- c:\windows\system32\appidapi.dll
2018-04-23 00:00 . 2018-05-09 16:53 5120 ---ha-w- c:\windows\system32\api-ms-win-core-file-l1-1-0.dll
2018-04-23 00:00 . 2018-05-09 16:53 4608 ---ha-w- c:\windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2018-04-23 00:00 . 2018-05-09 16:53 4608 ---ha-w- c:\windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2018-04-23 00:00 . 2018-05-09 16:53 4096 ---ha-w- c:\windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2018-04-23 00:00 . 2018-05-09 16:53 4096 ---ha-w- c:\windows\system32\api-ms-win-core-synch-l1-1-0.dll
2018-04-23 00:00 . 2018-05-09 16:53 4096 ---ha-w- c:\windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2018-04-23 00:00 . 2018-05-09 16:53 4096 ---ha-w- c:\windows\system32\api-ms-win-core-localregistry-l1-1-0(62).dll
2018-04-23 00:00 . 2018-05-09 16:53 4096 ---ha-w- c:\windows\system32\api-ms-win-core-localization-l1-1-0.dll
2018-04-23 00:00 . 2018-05-09 16:53 3584 ---ha-w- c:\windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2018-04-23 00:00 . 2018-05-09 16:53 3584 ---ha-w- c:\windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2018-04-23 00:00 . 2018-05-09 16:53 3584 ---ha-w- c:\windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2018-04-23 00:00 . 2018-05-09 16:53 3584 ---ha-w- c:\windows\system32\api-ms-win-core-misc-l1-1-0.dll
2018-04-23 00:00 . 2018-05-09 16:53 3584 ---ha-w- c:\windows\system32\api-ms-win-core-misc-l1-1-0(63).dll
2018-04-23 00:00 . 2018-05-09 16:53 3584 ---ha-w- c:\windows\system32\api-ms-win-core-memory-l1-1-0.dll
2018-04-23 00:00 . 2018-05-09 16:53 3584 ---ha-w- c:\windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2018-04-23 00:00 . 2018-05-09 16:53 3584 ---ha-w- c:\windows\system32\api-ms-win-core-heap-l1-1-0.dll
2018-04-23 00:00 . 2018-05-09 16:53 34816 ----a-w- c:\windows\system32\appidsvc.dll
2018-04-23 00:00 . 2018-05-09 16:53 3072 ---ha-w- c:\windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2018-04-23 00:00 . 2018-05-09 16:53 3072 ---ha-w- c:\windows\system32\api-ms-win-core-util-l1-1-0.dll
2018-04-23 00:00 . 2018-05-09 16:53 3072 ---ha-w- c:\windows\system32\api-ms-win-core-string-l1-1-0.dll
2018-04-23 00:00 . 2018-05-09 16:53 3072 ---ha-w- c:\windows\system32\api-ms-win-core-profile-l1-1-0.dll
2018-04-23 00:00 . 2018-05-09 16:53 3072 ---ha-w- c:\windows\system32\api-ms-win-core-io-l1-1-0.dll
2018-04-23 00:00 . 2018-05-09 16:53 3072 ---ha-w- c:\windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2018-04-23 00:00 . 2018-05-09 16:53 3072 ---ha-w- c:\windows\system32\api-ms-win-core-handle-l1-1-0.dll
2018-04-23 00:00 . 2018-05-09 16:53 3072 ---ha-w- c:\windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2018-04-23 00:00 . 2018-05-09 16:53 3072 ---ha-w- c:\windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2018-04-23 00:00 . 2018-05-09 16:53 3072 ---ha-w- c:\windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2018-04-23 00:00 . 2018-05-09 16:53 3072 ---ha-w- c:\windows\system32\api-ms-win-core-debug-l1-1-0.dll
2018-04-23 00:00 . 2018-05-09 16:53 3072 ---ha-w- c:\windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2018-04-23 00:00 . 2018-05-09 16:53 3072 ---ha-w- c:\windows\system32\api-ms-win-core-console-l1-1-0.dll
2018-04-22 23:44 . 2018-05-09 16:53 1314064 ----a-w- c:\windows\SysWow64\ntdll.dll
2018-04-22 23:41 . 2018-05-09 16:53 666112 ----a-w- c:\windows\SysWow64\rpcrt4.dll
2018-04-22 23:41 . 2018-05-09 16:53 96768 ----a-w- c:\windows\SysWow64\sspicli.dll
2018-04-22 23:41 . 2018-05-09 16:53 82944 ----a-w- c:\windows\SysWow64\bcrypt.dll
2018-04-22 23:41 . 2018-05-09 16:53 5120 ----a-w- c:\windows\SysWow64\wow32.dll
2018-04-22 23:41 . 2018-05-09 16:53 275456 ----a-w- c:\windows\SysWow64\KernelBase.dll
2018-04-22 23:41 . 2018-05-09 16:53 70144 ----a-w- c:\windows\SysWow64\TSpkg.dll
2018-04-22 23:41 . 2018-05-09 16:53 43008 ----a-w- c:\windows\SysWow64\srclient.dll
2018-04-22 23:41 . 2018-05-09 16:53 172032 ----a-w- c:\windows\SysWow64\wdigest.dll
2018-04-22 23:40 . 2018-05-09 16:53 254464 ----a-w- c:\windows\SysWow64\schannel.dll
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Zoner Photo Studio Autoupdate"="c:\program files\ZONER\PHOTO STUDIO 19\Program32\ZPSTRAY.EXE" [2018-04-05 576456]
"CCleaner Monitoring"="c:\program files\CCleaner\CCleaner64.exe" [2018-05-24 18364648]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
"EnableLinkedConnections"= 1 (0x1)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MBAMService]
@="Service"
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\run-disabled]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe"
.
R0 avc3;avc3;c:\windows\system32\DRIVERS\avc3.sys;c:\windows\SYSNATIVE\DRIVERS\avc3.sys [x]
R0 gzflt;gzflt;c:\windows\system32\DRIVERS\gzflt.sys;c:\windows\SYSNATIVE\DRIVERS\gzflt.sys [x]
R0 Ignis;Ignis Service;c:\windows\system32\DRIVERS\ignis.sys;c:\windows\SYSNATIVE\DRIVERS\ignis.sys [x]
R1 atc;atc;c:\windows\system32\DRIVERS\atc.sys;c:\windows\SYSNATIVE\DRIVERS\atc.sys [x]
R1 BDVEDISK;BDVEDISK;c:\windows\system32\DRIVERS\bdvedisk.sys;c:\windows\SYSNATIVE\DRIVERS\bdvedisk.sys [x]
R1 ZAM;ZAM Helper Driver;c:\windows\System32\drivers\zam64.sys;c:\windows\SYSNATIVE\drivers\zam64.sys [x]
R1 ZAM_Guard;ZAM Guard Driver;c:\windows\System32\drivers\zamguard64.sys;c:\windows\SYSNATIVE\drivers\zamguard64.sys [x]
R2 afcdpsrv;Acronis Nonstop Backup Service;c:\program files (x86)\Common Files\Acronis\CDP\afcdpsrv.exe;c:\program files (x86)\Common Files\Acronis\CDP\afcdpsrv.exe [x]
R2 bdprivmon;bdprivmon;c:\windows\system32\DRIVERS\bdprivmon.sys;c:\windows\SYSNATIVE\DRIVERS\bdprivmon.sys [x]
R2 bdredline;Bitdefender RedLine Service;c:\program files\Common Files\Bitdefender\SetupInformation\Bitdefender RedLine\bdredline.exe;c:\program files\Common Files\Bitdefender\SetupInformation\Bitdefender RedLine\bdredline.exe [x]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 DiagTrack;Diagnostics Tracking Service;c:\windows\System32\svchost.exe;c:\windows\SYSNATIVE\svchost.exe [x]
R2 ProductAgentService;ProductAgentService;c:\program files\Bitdefender Agent\ProductAgentService.exe;c:\program files\Bitdefender Agent\ProductAgentService.exe [x]
R2 tib_mounter;Acronis TIB Mounter;c:\windows\system32\DRIVERS\tib_mounter.sys;c:\windows\SYSNATIVE\DRIVERS\tib_mounter.sys [x]
R2 UPDATESRV;Bitdefender Desktop Update Service;c:\program files\Bitdefender\Bitdefender 2017\updatesrv.exe;c:\program files\Bitdefender\Bitdefender 2017\updatesrv.exe [x]
R2 virtual_file;Acronis Virtual File Driver;c:\windows\system32\DRIVERS\virtual_file.sys;c:\windows\SYSNATIVE\DRIVERS\virtual_file.sys [x]
R2 ZAMSvc;ZAM Controller Service;c:\program files (x86)\Zemana AntiMalware\ZAM.exe;c:\program files (x86)\Zemana AntiMalware\ZAM.exe [x]
R3 BrYNSvc;BrYNSvc;c:\program files (x86)\Browny02\BrYNSvc.exe;c:\program files (x86)\Browny02\BrYNSvc.exe [x]
R3 Garmin Device Interaction Service;Garmin Device Interaction Service;c:\program files (x86)\Garmin\Device Interaction Service\GarminService.exe EXPRESS;c:\program files (x86)\Garmin\Device Interaction Service\GarminService.exe EXPRESS [x]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x]
R3 MBAMService;Malwarebytes Service;c:\program files\Malwarebytes\Anti-Malware\mbamservice.exe;c:\program files\Malwarebytes\Anti-Malware\mbamservice.exe [x]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys;c:\windows\SYSNATIVE\drivers\rdpvideominiport.sys [x]
R3 Revoflt;Revoflt;c:\windows\system32\DRIVERS\revoflt.sys;c:\windows\SYSNATIVE\DRIVERS\revoflt.sys [x]
R3 Synth3dVsc;Synth3dVsc;c:\windows\system32\drivers\synth3dvsc.sys;c:\windows\SYSNATIVE\drivers\synth3dvsc.sys [x]
R3 tnd;Acronis Try&Decide filter;c:\windows\system32\DRIVERS\tnd.sys;c:\windows\SYSNATIVE\DRIVERS\tnd.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 tsusbhub;tsusbhub;c:\windows\system32\drivers\tsusbhub.sys;c:\windows\SYSNATIVE\drivers\tsusbhub.sys [x]
R3 VGPU;VGPU;c:\windows\system32\drivers\rdvgkmd.sys;c:\windows\SYSNATIVE\drivers\rdvgkmd.sys [x]
R3 WatAdminSvc;Služba Technologie aktivace Windows;c:\windows\system32\Wat\WatAdminSvc.exe;c:\windows\SYSNATIVE\Wat\WatAdminSvc.exe [x]
R4 HuaweiHiSuiteService64.exe;HuaweiHiSuiteService64.exe;c:\program files (x86)\HiSuite\HandSetService\HuaweiHiSuiteService64.exe;c:\program files (x86)\HiSuite\HandSetService\HuaweiHiSuiteService64.exe [x]
S0 file_tracker;file_tracker;c:\windows\system32\DRIVERS\file_tracker.sys;c:\windows\SYSNATIVE\DRIVERS\file_tracker.sys [x]
S0 fltsrv;Acronis Storage Filter Management;c:\windows\system32\DRIVERS\fltsrv.sys;c:\windows\SYSNATIVE\DRIVERS\fltsrv.sys [x]
S0 tib;Acronis TIB Manager;c:\windows\system32\DRIVERS\tib.sys;c:\windows\SYSNATIVE\DRIVERS\tib.sys [x]
S1 bdfwfpf;bdfwfpf;c:\program files\Common Files\Bitdefender\Bitdefender Firewall\bdfwfpf.sys;c:\program files\Common Files\Bitdefender\Bitdefender Firewall\bdfwfpf.sys [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x]
.
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost]
LocalServiceAndNoImpersonation REG_MULTI_SZ SSDPSRV upnphost SCardSvr QWAVE wcncsvc
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Bdagent"="c:\program files\Bitdefender\Bitdefender 2017\bdagent.exe" [2018-05-22 452032]
"ZAM"="c:\program files (x86)\Zemana AntiMalware\ZAM.exe" [2017-08-09 15775888]
.
------- Doplňkový sken -------
.
uLocal Page = c:\windows\system32\blank.htm
mStart Page = about:blank
mLocal Page = c:\windows\SysWOW64\blank.htm
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~2\MICROS~1\Office12\EXCEL.EXE/3000
TCP: DhcpNameServer = 213.46.172.37 213.46.172.36
FF - ProfilePath - c:\users\Otto\AppData\Roaming\Mozilla\Firefox\Profiles\b9u11n5q.default-1512667376818\
FF - prefs.js: browser.startup.homepage - about:home
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
.
ShellIconOverlayIdentifiers-{472083B0-C522-11CF-8763-00608CC02F24} - (no file)
ShellIconOverlayIdentifiers-{934BC6C0-FEC2-4df5-A100-961DE2C8A0ED} - (no file)
ShellIconOverlayIdentifiers-{00F848DC-B1D4-4892-9C25-CAADC86A215D} - (no file)
ShellIconOverlayIdentifiers-{71573297-552E-46fc-BE3D-3DFAF88D47B7} - (no file)
AddRemove-{52c2b6dd-5953-4bb1-9ef3-d145973e25e7} - c:\programdata\Package Cache\{52c2b6dd-5953-4bb1-9ef3-d145973e25e7}\GarminExpressInstaller.exe
.
.
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_29_0_0_171_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_29_0_0_171_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}]
@Denied: (A 2) (Everyone)
@="IFlashBroker6"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\System*]
"OODEFRAG21.00.00.02PROFESSIONAL"="CC3ED742129DD583819603EE2A8CBAAA3200F4A785BE43FAC7EF42558AB6BFE728F57FE6CFF7D2869EFB041C4D6FB33F58D7B39921AB8343EF2A62CADFE3B7DC860F3C19F852900C6DA04B6CA6DA9AF1E0C4FD85F287480ED650CF9EC94A1C495075EC5E1B1D58D34E8477228CE54A52C57CD5FEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CC038D530D6EB3452C038D530D6EB3452C038D530D6EB34528EDD5E5BE2F6E66769D8871787B5D714C5E210E7CC6BA120804E5AC5B9D3A1A258719EEC811331D844CD9B436AEC4B5E39440BA472C52778B9D24D31CFA89175BA71FEB63EE31F9BDB67C5AC9B312BA76AC80231D0742E5A36F2C1A89281D7993120895A69FA019A6B8BF03393B96FA4D4220602AE47E2DC4DC58AD03269F5A69121F6CD403E50906685D8C0BEE3A55125E3F78D443486DC0CCACE53570E03FA6379D38977B2167AF00511BBFB2FECED3F878FD03F53EF7AB0E20C5D1AC02937E295800CB584F31C641EFE17203FF97BB86757CABEE10619AE51909D89F7A6C080C233D516019BF9CEC65C4373DB15435DC42EFED9C048E1AD4282CA274D4EC0E233736E269B54DF72DA3736B0F0994EAAC447F51A74C6BF0A42D69BE97E0524617C9D5E6B6B785A431A706D8A0FF9ED54EFA7B97AA72664D3C2DA4E3AED479C869AE3B2DB2B7ABCEBA83FE3A1E83834BE31AB5BECA4A142CB98ACA27721A01E95EBC97D61BA5A1D4A0CAB9F9057ED7786DA026D56DD84136B7D435D72C1B5E2813229565C1BB055EEB19424E1564754F91F2D0910E8B1D15E0F6348721E3A677493AD53A075A9831FE6AA7F960583A999988449E67C9DBF044E2AAEB0A9FBED481B5995729203895661F5BDA229781A9EC131CC9B77D0606EA007E15BF656F98FB7003B0F63908E40B7CDF16DA78D0DF17C34B7645AEAFBE6CFBEB595423CD50F3A4BEDA579BAFA3E6461B3D28FBEAD330DDE33E7481B9E690AE683F369350FBE593654570C7AFE67C6B21D240E1DEAB31BD7E7460D2718A3DEEDA780EC5AF54A31149C3D74E00C03A396CCA4F8CBF77A339A090E1468FCF9C49183BA74DA9F923E0879E0B411571221B7E50CC6854CC24675C745EDCCA50495667B1349F6652DE30B2042ED415C42CB920E079493A3F8280BDBE4CF54AD8D8DD477EFD807E4E1E7E8C954E63E58FB12F9F03522D7FB4311D302DA131676144F96E42C34F47E2D754534FC0BE5CDD6C8933C2AD24619741E98F986B339A2CEDF3EB315133ED7BF1B122118E92C82A125D8A36FAEE701194F77063D537C1A22282D596CCE76DA7D491AD675B498815DC398DD7EE15801EE8A666EC8B7AF8B2BF49C4D6865423380D8F89ED643C598BF247224CA3CC626E8152980E5C7BAE339F8180EB3F7DDD293039EC573"
.
Celkový čas: 2018-06-21 20:39:04 - počítač byl restartován
ComboFix-quarantined-files.txt 2018-06-21 18:39
ComboFix2.txt 2018-06-21 10:21
.
Před spuštěním: Volných bajtů: 252 922 744 832
Po spuštění: Volných bajtů: 252 689 514 496
.
- - End Of File - - 19C1E6FBF8D51398C6C93A664572207A
A36C5E4F47E84449FF07ED3517B43A31

[OTAS]

Zkoušel jsem 5x restartovat ale Windows nenaběhl musel jsem použít opět startup repair pak Windows opět naběhl .Zitra budu pokračovat v dalších úkonech co jste mě poslal