PC-HELP.CZ

České diskuzní fórum o počítačích
https://pc-help.cnews.cz/

Malware našlo asi 150 hrozeb

https://pc-help.cnews.cz/viewtopic.php?f=47&t=144366

Stránka 1 z 1

Malware našlo asi 150 hrozeb

Napsal: 22 lis 2014 18:16
od kodl74
Dobrý večer, dostal se mi do rukou PC, totálně zaprasenej. Na komplu sem nalezl dva antiviráky. AVG a Avast sem odinstaloval, projel CCleaner a nainstaloval zpět Avast. Malware něco našlo, Avast nic. Prosím o pomoc pročištění breberek co se tam nachází. Dík moc a posílám logy:

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 17:50:59, on 22.11.2014
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v11.0 (11.00.9600.17420)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskhost.exe
C:\Windows\Explorer.EXE
C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
C:\Program Files\AVG\AVG PC TuneUp\TuneUpUtilitiesApp32.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Windows\system32\DllHost.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
C:\Users\Franta\Desktop\Hijackthis\hijackthis.exe
C:\Windows\system32\SearchProtocolHost.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/p/?LinkId=255141
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.bigseekpro.com/xilisoftdownloadyoutube/{686E968C-7629-412B-8F75-D45706E47012}
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: ToolbarURLSearchHook Class - {CA3EB689-8F09-4026-AA10-B9534C691CE0} - C:\Program Files\Xilisoft Download Youtube Toolbar\tbhelper.dll
O2 - BHO: (no name) - {95B7759C-8C7F-4BF1-B163-73684A933233} - (no file)
O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: SMTTB2009 - {FCBCCB87-9224-4B8D-B117-F56D924BEB18} - C:\Program Files\Xilisoft Download Youtube Toolbar\tbcore3.dll
O3 - Toolbar: Xilisoft Download Youtube Toolbar - {338B4DFE-2E2C-4338-9E41-E176D497299E} - C:\Program Files\Xilisoft Download Youtube Toolbar\tbcore3.dll
O4 - HKLM\..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe -s
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [snpstd3] C:\Windows\vsnpstd3.exe
O4 - HKLM\..\RunOnce: [AvgRemover] C:\AVG_Remover\utils\remover.exe /run_number=3 /ndis_nextstep=4 /norestart
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /minimized /regrun
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O8 - Extra context menu item: Download with Xilisoft Download YouTube Video - C:\Program Files\Xilisoft\Download YouTube Video\upod_link.HTM
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Skype Click to Call settings - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Protocol: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: AMD External Events Utility - AMD - C:\Windows\system32\atiesrxx.exe
O23 - Service: Služba Google Update (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Služba Google Update (gupdatem) (gupdatem) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. - C:\Windows\system32\IoctlSvc.exe
O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe
O23 - Service: Skype Updater (SkypeUpdate) - Skype Technologies - C:\Program Files\Skype\Updater\Updater.exe
O23 - Service: SInstalátor (ssinstall) - PS Media s.r.o. - C:\Windows\System32\ssins.exe
O23 - Service: AVG PC TuneUp Service (TuneUp.UtilitiesSvc) - AVG - C:\Program Files\AVG\AVG PC TuneUp\TuneUpUtilitiesService32.exe

--
End of file - 5492 bytes

-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------


Malwarebytes Anti-Malware
www.malwarebytes.org

Datum skenování: 22.11.2014
Čas skenování: 17:52:20
Protokol: anti malware.txt
Správce: Ano

Verze: 2.00.3.1025
Databáze malwaru: v2014.11.22.09
Databáze rootkitů: v2014.11.21.01
Licence: Bezplatná verze
Ochrana proti malwaru: Vypnuto
Ochrana proti škodlivým webovým stránkám: Vypnuto
Sebeobrany: Vypnuto

OS: Windows 7 Service Pack 1
CPU: x86
Souborový systém: NTFS
Uživatel: Franta

Typ skenu: Sken hrozeb
Výsledek: Dokončeno
Prohledaných objektů: 288199
Uplynulý čas: 8 min, 3 sek

Paměť: Zapnuto
Po spuštění: Zapnuto
Souborový systém: Zapnuto
Archivy: Zapnuto
Rootkity: Vypnuto
Heuristika: Zapnuto
PUP: Zapnuto
PUM: Zapnuto

Procesy: 0
(Žádné zákerné zjištěny položek)

Moduly: 0
(Žádné zákerné zjištěny položek)

Klíče registru: 35
PUP.Optional.BestToolbar.A, HKLM\SOFTWARE\CLASSES\CLSID\{338B4DFE-2E2C-4338-9E41-E176D497299E}, , [a8299ba32557f640ff7df5c949b9a45c],
PUP.Optional.BestToolbar.A, HKLM\SOFTWARE\CLASSES\CLSID\{57CADC46-58FF-4105-B733-5A9F3FC9783C}, , [a8299ba32557f640ff7df5c949b9a45c],
PUP.Optional.BestToolbar.A, HKLM\SOFTWARE\CLASSES\ComObject.DeskbarEnabler.1, , [a8299ba32557f640ff7df5c949b9a45c],
PUP.Optional.BestToolbar.A, HKLM\SOFTWARE\CLASSES\ComObject.DeskbarEnabler, , [a8299ba32557f640ff7df5c949b9a45c],
PUP.Optional.BestToolbar.A, HKLM\SOFTWARE\CLASSES\CLSID\{9F34B17E-FF0D-4FAB-97C4-9713FEE79052}, , [a8299ba32557f640ff7df5c949b9a45c],
PUP.Optional.BestToolbar.A, HKLM\SOFTWARE\CLASSES\TYPELIB\{EC4085F2-8DB3-45a6-AD0B-CA289F3C5D7E}, , [a8299ba32557f640ff7df5c949b9a45c],
PUP.Optional.BestToolbar.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{2A42D13C-D427-4787-821B-CF6973855778}, , [a8299ba32557f640ff7df5c949b9a45c],
PUP.Optional.BestToolbar.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{3D8478AA-7B88-48A9-8BCB-B85D594411EC}, , [a8299ba32557f640ff7df5c949b9a45c],
PUP.Optional.BestToolbar.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{4D8ED2B3-DC62-43EC-ABA3-5B74F046B1BE}, , [a8299ba32557f640ff7df5c949b9a45c],
PUP.Optional.BestToolbar.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{95B6A271-FEB4-4160-B0FF-44394C21C8DC}, , [a8299ba32557f640ff7df5c949b9a45c],
PUP.Optional.BestToolbar.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{E67D5BC7-7129-493E-9281-F47BDAFACE4F}, , [a8299ba32557f640ff7df5c949b9a45c],
PUP.Optional.BestToolbar.A, HKLM\SOFTWARE\CLASSES\Toolbar3.ContextMenuNotifier.1, , [a8299ba32557f640ff7df5c949b9a45c],
PUP.Optional.BestToolbar.A, HKLM\SOFTWARE\CLASSES\Toolbar3.ContextMenuNotifier, , [a8299ba32557f640ff7df5c949b9a45c],
PUP.Optional.BestToolbar.A, HKLM\SOFTWARE\CLASSES\CLSID\{D565B35E-B787-40FA-95E3-E3562F8FC1A0}, , [a8299ba32557f640ff7df5c949b9a45c],
PUP.Optional.BestToolbar.A, HKLM\SOFTWARE\CLASSES\Toolbar3.CustomInternetSecurityImpl.1, , [a8299ba32557f640ff7df5c949b9a45c],
PUP.Optional.BestToolbar.A, HKLM\SOFTWARE\CLASSES\Toolbar3.CustomInternetSecurityImpl, , [a8299ba32557f640ff7df5c949b9a45c],
PUP.Optional.BestToolbar.A, HKLM\SOFTWARE\CLASSES\CLSID\{FCBCCB87-9224-4B8D-B117-F56D924BEB18}, , [a8299ba32557f640ff7df5c949b9a45c],
PUP.Optional.BestToolbar.A, HKLM\SOFTWARE\CLASSES\Toolbar3.SMTTB2009.1, , [a8299ba32557f640ff7df5c949b9a45c],
PUP.Optional.BestToolbar.A, HKLM\SOFTWARE\CLASSES\Toolbar3.SMTTB2009, , [a8299ba32557f640ff7df5c949b9a45c],
PUP.Optional.BestToolbar.A, HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{FCBCCB87-9224-4B8D-B117-F56D924BEB18}, , [a8299ba32557f640ff7df5c949b9a45c],
PUP.Optional.BestToolbar.A, HKU\S-1-5-21-199143479-2753093889-1228688661-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\SETTINGS\{FCBCCB87-9224-4B8D-B117-F56D924BEB18}, , [a8299ba32557f640ff7df5c949b9a45c],
PUP.Optional.BestToolbar.A, HKU\S-1-5-21-199143479-2753093889-1228688661-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{FCBCCB87-9224-4B8D-B117-F56D924BEB18}, , [a8299ba32557f640ff7df5c949b9a45c],
PUP.Optional.BestToolbar.A, HKLM\SOFTWARE\CLASSES\CLSID\{FCBCCB87-9224-4B8D-B117-F56D924BEB18}\INPROCSERVER32, , [a8299ba32557f640ff7df5c949b9a45c],
PUP.Optional.BestToolbar.A, HKLM\SOFTWARE\CLASSES\SMTTB2009.SMTTB2009.3, , [a8299ba32557f640ff7df5c949b9a45c],
PUP.Optional.BestToolbar.A, HKLM\SOFTWARE\CLASSES\SMTTB2009.SMTTB2009, , [a8299ba32557f640ff7df5c949b9a45c],
PUP.Optional.BestToolbar.A, HKLM\SOFTWARE\CLASSES\SMTTB2009.IEToolbar, , [a8299ba32557f640ff7df5c949b9a45c],
PUP.Optional.BestToolbar.A, HKLM\SOFTWARE\CLASSES\SMTTB2009.IEToolbar.1, , [a8299ba32557f640ff7df5c949b9a45c],
PUP.Optional.BestToolbar.A, HKU\S-1-5-21-199143479-2753093889-1228688661-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\SETTINGS\{338B4DFE-2E2C-4338-9E41-E176D497299E}, , [a8299ba32557f640ff7df5c949b9a45c],
PUP.Optional.BestToolbar.A, HKU\S-1-5-21-199143479-2753093889-1228688661-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{338B4DFE-2E2C-4338-9E41-E176D497299E}, , [a8299ba32557f640ff7df5c949b9a45c],
PUP.Optional.Softomate.A, HKLM\SOFTWARE\CLASSES\CLSID\{CA3EB689-8F09-4026-AA10-B9534C691CE0}, , [ba179ba3bcc0a78f7dea813c05fd08f8],
PUP.Optional.Softomate.A, HKLM\SOFTWARE\CLASSES\TYPELIB\{4509D3CC-B642-4745-B030-645B79522C6D}, , [ba179ba3bcc0a78f7dea813c05fd08f8],
PUP.Optional.Softomate.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{4897BBA6-48D9-468C-8EFA-846275D7701B}, , [ba179ba3bcc0a78f7dea813c05fd08f8],
PUP.Optional.Softomate.A, HKLM\SOFTWARE\CLASSES\URLSearchHook.ToolbarURLSearchHook.1, , [ba179ba3bcc0a78f7dea813c05fd08f8],
PUP.Optional.Softomate.A, HKLM\SOFTWARE\CLASSES\URLSearchHook.ToolbarURLSearchHook, , [ba179ba3bcc0a78f7dea813c05fd08f8],
PUP.Optional.weDownload.A, HKU\S-1-5-21-199143479-2753093889-1228688661-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\Somoto Toolbar, , [6a67a69816669d992d2592ca05fefa06],

Hodnoty registru: 4
PUP.Optional.BestToolbar.A, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\TOOLBAR|{338B4DFE-2E2C-4338-9E41-E176D497299E}, , [a8299ba32557f640ff7df5c949b9a45c],
PUP.Optional.Softomate.A, HKU\S-1-5-21-199143479-2753093889-1228688661-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\URLSEARCHHOOKS|{CA3EB689-8F09-4026-AA10-B9534C691CE0}, , [ba179ba3bcc0a78f7dea813c05fd08f8],
PUP.Optional.Softomate.A, HKU\S-1-5-21-199143479-2753093889-1228688661-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\URLSEARCHHOOKS\{CA3EB689-8F09-4026-AA10-B9534C691CE0}, , [ce03fc427c00e056f86fc9f489796d93],
PUP.Optional.BestToolbar.A, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\TOOLBAR\{338B4DFE-2E2C-4338-9E41-E176D497299E}, , [06cbb08eceaefa3c3e3e7a44a06228d8],

Data registru: 0
(Žádné zákerné zjištěny položek)

Složky: 9
PUP.Optional.MindSpark.A, C:\Users\Franta\AppData\Roaming\Mozilla\Firefox\Profiles\95ma8vcw.default\extensions\4zffxtbr@VideoDownloadConverter_4z.com, , [4988e9559ddfee4818ab4fc2f50e16ea],
PUP.Optional.MindSpark.A, C:\Users\Franta\AppData\Roaming\Mozilla\Firefox\Profiles\95ma8vcw.default\extensions\4zffxtbr@VideoDownloadConverter_4z.com\chrome, , [4988e9559ddfee4818ab4fc2f50e16ea],
PUP.Optional.MindSpark.A, C:\Users\Franta\AppData\Roaming\Mozilla\Firefox\Profiles\95ma8vcw.default\extensions\4zffxtbr@VideoDownloadConverter_4z.com\META-INF, , [4988e9559ddfee4818ab4fc2f50e16ea],
PUP.Optional.MindSpark.A, C:\Users\Franta\AppData\Roaming\Mozilla\Firefox\Profiles\95ma8vcw.default\extensions\4zffxtbr@VideoDownloadConverter_4z.com\plugins, , [4988e9559ddfee4818ab4fc2f50e16ea],
PUP.Optional.MindSpark.A, C:\Users\Franta\AppData\Roaming\Mozilla\Firefox\Profiles\95ma8vcw.default\VideoDownloadConverter_4z, , [983948f69ce0e650c61d2ae950b3e61a],
PUP.Optional.Hyperionics.A, C:\Users\Franta\AppData\Roaming\Mozilla\Firefox\Profiles\95ma8vcw.default\extensions\{75656794-AB59-4712-BFBC-5D816D56F3BC}, , [3998b985c4b8fd391bce38e1689bd32d],
PUP.Optional.Hyperionics.A, C:\Users\Franta\AppData\Roaming\Mozilla\Firefox\Profiles\95ma8vcw.default\extensions\{75656794-AB59-4712-BFBC-5D816D56F3BC}\chrome, , [3998b985c4b8fd391bce38e1689bd32d],
PUP.Optional.Hyperionics.A, C:\Users\Franta\AppData\Roaming\Mozilla\Firefox\Profiles\95ma8vcw.default\extensions\{75656794-AB59-4712-BFBC-5D816D56F3BC}\chrome\content, , [3998b985c4b8fd391bce38e1689bd32d],
PUP.Optional.Hyperionics.A, C:\Users\Franta\AppData\Roaming\Mozilla\Firefox\Profiles\95ma8vcw.default\extensions\{75656794-AB59-4712-BFBC-5D816D56F3BC}\chrome\content\somoto, , [3998b985c4b8fd391bce38e1689bd32d],

Soubory: 104
PUP.Optional.BestToolbar.A, C:\Program Files\Xilisoft Download Youtube Toolbar\tbcore3.dll, , [a8299ba32557f640ff7df5c949b9a45c],
PUP.Optional.Softomate.A, C:\Program Files\Xilisoft Download Youtube Toolbar\tbhelper.dll, , [ba179ba3bcc0a78f7dea813c05fd08f8],
PUP.Optional.MindSpark.A, C:\Users\Franta\AppData\Roaming\Mozilla\Firefox\Profiles\95ma8vcw.default\searchplugins\ask-web-search.xml, , [438ed668413b2115fac4c597d92ae21e],
PUP.Optional.MindSpark.A, C:\Users\Franta\AppData\Roaming\Mozilla\Firefox\Profiles\95ma8vcw.default\extensions\4zffxtbr@VideoDownloadConverter_4z.com\bootstrap.js, , [4988e9559ddfee4818ab4fc2f50e16ea],
PUP.Optional.MindSpark.A, C:\Users\Franta\AppData\Roaming\Mozilla\Firefox\Profiles\95ma8vcw.default\extensions\4zffxtbr@VideoDownloadConverter_4z.com\chrome.manifest, , [4988e9559ddfee4818ab4fc2f50e16ea],
PUP.Optional.MindSpark.A, C:\Users\Franta\AppData\Roaming\Mozilla\Firefox\Profiles\95ma8vcw.default\extensions\4zffxtbr@VideoDownloadConverter_4z.com\install.rdf, , [4988e9559ddfee4818ab4fc2f50e16ea],
PUP.Optional.MindSpark.A, C:\Users\Franta\AppData\Roaming\Mozilla\Firefox\Profiles\95ma8vcw.default\extensions\4zffxtbr@VideoDownloadConverter_4z.com\install_no_bootstrap.rdf, , [4988e9559ddfee4818ab4fc2f50e16ea],
PUP.Optional.MindSpark.A, C:\Users\Franta\AppData\Roaming\Mozilla\Firefox\Profiles\95ma8vcw.default\extensions\4zffxtbr@VideoDownloadConverter_4z.com\chrome\4zffxtbr.jar, , [4988e9559ddfee4818ab4fc2f50e16ea],
PUP.Optional.MindSpark.A, C:\Users\Franta\AppData\Roaming\Mozilla\Firefox\Profiles\95ma8vcw.default\extensions\4zffxtbr@VideoDownloadConverter_4z.com\META-INF\manifest.mf, , [4988e9559ddfee4818ab4fc2f50e16ea],
PUP.Optional.MindSpark.A, C:\Users\Franta\AppData\Roaming\Mozilla\Firefox\Profiles\95ma8vcw.default\extensions\4zffxtbr@VideoDownloadConverter_4z.com\META-INF\zigbert.rsa, , [4988e9559ddfee4818ab4fc2f50e16ea],
PUP.Optional.MindSpark.A, C:\Users\Franta\AppData\Roaming\Mozilla\Firefox\Profiles\95ma8vcw.default\extensions\4zffxtbr@VideoDownloadConverter_4z.com\META-INF\zigbert.sf, , [4988e9559ddfee4818ab4fc2f50e16ea],
PUP.Optional.MindSpark.A, C:\Users\Franta\AppData\Roaming\Mozilla\Firefox\Profiles\95ma8vcw.default\extensions\4zffxtbr@VideoDownloadConverter_4z.com\plugins\NativeMessagingDispatcher.dll, , [4988e9559ddfee4818ab4fc2f50e16ea],
PUP.Optional.MindSpark.A, C:\Users\Franta\AppData\Roaming\Mozilla\Firefox\Profiles\95ma8vcw.default\VideoDownloadConverter_4z\D0C124E0-2B4C-4848-83E0-73421DF10F9C.sqlite, , [983948f69ce0e650c61d2ae950b3e61a],
PUP.Optional.Hyperionics.A, C:\Users\Franta\AppData\Roaming\Mozilla\Firefox\Profiles\95ma8vcw.default\extensions\{75656794-AB59-4712-BFBC-5D816D56F3BC}\chrome.manifest, , [3998b985c4b8fd391bce38e1689bd32d],
PUP.Optional.Hyperionics.A, C:\Users\Franta\AppData\Roaming\Mozilla\Firefox\Profiles\95ma8vcw.default\extensions\{75656794-AB59-4712-BFBC-5D816D56F3BC}\install.rdf, , [3998b985c4b8fd391bce38e1689bd32d],
PUP.Optional.Hyperionics.A, C:\Users\Franta\AppData\Roaming\Mozilla\Firefox\Profiles\95ma8vcw.default\extensions\{75656794-AB59-4712-BFBC-5D816D56F3BC}\chrome\content\somoto\28.png, , [3998b985c4b8fd391bce38e1689bd32d],
PUP.Optional.Hyperionics.A, C:\Users\Franta\AppData\Roaming\Mozilla\Firefox\Profiles\95ma8vcw.default\extensions\{75656794-AB59-4712-BFBC-5D816D56F3BC}\chrome\content\somoto\47.png, , [3998b985c4b8fd391bce38e1689bd32d],
PUP.Optional.Hyperionics.A, C:\Users\Franta\AppData\Roaming\Mozilla\Firefox\Profiles\95ma8vcw.default\extensions\{75656794-AB59-4712-BFBC-5D816D56F3BC}\chrome\content\somoto\1.png, , [3998b985c4b8fd391bce38e1689bd32d],
PUP.Optional.Hyperionics.A, C:\Users\Franta\AppData\Roaming\Mozilla\Firefox\Profiles\95ma8vcw.default\extensions\{75656794-AB59-4712-BFBC-5D816D56F3BC}\chrome\content\somoto\10.png, , [3998b985c4b8fd391bce38e1689bd32d],
PUP.Optional.Hyperionics.A, C:\Users\Franta\AppData\Roaming\Mozilla\Firefox\Profiles\95ma8vcw.default\extensions\{75656794-AB59-4712-BFBC-5D816D56F3BC}\chrome\content\somoto\11.png, , [3998b985c4b8fd391bce38e1689bd32d],
PUP.Optional.Hyperionics.A, C:\Users\Franta\AppData\Roaming\Mozilla\Firefox\Profiles\95ma8vcw.default\extensions\{75656794-AB59-4712-BFBC-5D816D56F3BC}\chrome\content\somoto\12.png, , [3998b985c4b8fd391bce38e1689bd32d],
PUP.Optional.Hyperionics.A, C:\Users\Franta\AppData\Roaming\Mozilla\Firefox\Profiles\95ma8vcw.default\extensions\{75656794-AB59-4712-BFBC-5D816D56F3BC}\chrome\content\somoto\13.png, , [3998b985c4b8fd391bce38e1689bd32d],
PUP.Optional.Hyperionics.A, C:\Users\Franta\AppData\Roaming\Mozilla\Firefox\Profiles\95ma8vcw.default\extensions\{75656794-AB59-4712-BFBC-5D816D56F3BC}\chrome\content\somoto\14.png, , [3998b985c4b8fd391bce38e1689bd32d],
PUP.Optional.Hyperionics.A, C:\Users\Franta\AppData\Roaming\Mozilla\Firefox\Profiles\95ma8vcw.default\extensions\{75656794-AB59-4712-BFBC-5D816D56F3BC}\chrome\content\somoto\15.png, , [3998b985c4b8fd391bce38e1689bd32d],
PUP.Optional.Hyperionics.A, C:\Users\Franta\AppData\Roaming\Mozilla\Firefox\Profiles\95ma8vcw.default\extensions\{75656794-AB59-4712-BFBC-5D816D56F3BC}\chrome\content\somoto\16.png, , [3998b985c4b8fd391bce38e1689bd32d],
PUP.Optional.Hyperionics.A, C:\Users\Franta\AppData\Roaming\Mozilla\Firefox\Profiles\95ma8vcw.default\extensions\{75656794-AB59-4712-BFBC-5D816D56F3BC}\chrome\content\somoto\17.png, , [3998b985c4b8fd391bce38e1689bd32d],
PUP.Optional.Hyperionics.A, C:\Users\Franta\AppData\Roaming\Mozilla\Firefox\Profiles\95ma8vcw.default\extensions\{75656794-AB59-4712-BFBC-5D816D56F3BC}\chrome\content\somoto\18.png, , [3998b985c4b8fd391bce38e1689bd32d],
PUP.Optional.Hyperionics.A, C:\Users\Franta\AppData\Roaming\Mozilla\Firefox\Profiles\95ma8vcw.default\extensions\{75656794-AB59-4712-BFBC-5D816D56F3BC}\chrome\content\somoto\19.png, , [3998b985c4b8fd391bce38e1689bd32d],
PUP.Optional.Hyperionics.A, C:\Users\Franta\AppData\Roaming\Mozilla\Firefox\Profiles\95ma8vcw.default\extensions\{75656794-AB59-4712-BFBC-5D816D56F3BC}\chrome\content\somoto\2.png, , [3998b985c4b8fd391bce38e1689bd32d],
PUP.Optional.Hyperionics.A, C:\Users\Franta\AppData\Roaming\Mozilla\Firefox\Profiles\95ma8vcw.default\extensions\{75656794-AB59-4712-BFBC-5D816D56F3BC}\chrome\content\somoto\20.png, , [3998b985c4b8fd391bce38e1689bd32d],
PUP.Optional.Hyperionics.A, C:\Users\Franta\AppData\Roaming\Mozilla\Firefox\Profiles\95ma8vcw.default\extensions\{75656794-AB59-4712-BFBC-5D816D56F3BC}\chrome\content\somoto\21.png, , [3998b985c4b8fd391bce38e1689bd32d],
PUP.Optional.Hyperionics.A, C:\Users\Franta\AppData\Roaming\Mozilla\Firefox\Profiles\95ma8vcw.default\extensions\{75656794-AB59-4712-BFBC-5D816D56F3BC}\chrome\content\somoto\22.png, , [3998b985c4b8fd391bce38e1689bd32d],
PUP.Optional.Hyperionics.A, C:\Users\Franta\AppData\Roaming\Mozilla\Firefox\Profiles\95ma8vcw.default\extensions\{75656794-AB59-4712-BFBC-5D816D56F3BC}\chrome\content\somoto\23.png, , [3998b985c4b8fd391bce38e1689bd32d],
PUP.Optional.Hyperionics.A, C:\Users\Franta\AppData\Roaming\Mozilla\Firefox\Profiles\95ma8vcw.default\extensions\{75656794-AB59-4712-BFBC-5D816D56F3BC}\chrome\content\somoto\24.png, , [3998b985c4b8fd391bce38e1689bd32d],
PUP.Optional.Hyperionics.A, C:\Users\Franta\AppData\Roaming\Mozilla\Firefox\Profiles\95ma8vcw.default\extensions\{75656794-AB59-4712-BFBC-5D816D56F3BC}\chrome\content\somoto\25.png, , [3998b985c4b8fd391bce38e1689bd32d],
PUP.Optional.Hyperionics.A, C:\Users\Franta\AppData\Roaming\Mozilla\Firefox\Profiles\95ma8vcw.default\extensions\{75656794-AB59-4712-BFBC-5D816D56F3BC}\chrome\content\somoto\26.png, , [3998b985c4b8fd391bce38e1689bd32d],
PUP.Optional.Hyperionics.A, C:\Users\Franta\AppData\Roaming\Mozilla\Firefox\Profiles\95ma8vcw.default\extensions\{75656794-AB59-4712-BFBC-5D816D56F3BC}\chrome\content\somoto\27.png, , [3998b985c4b8fd391bce38e1689bd32d],
PUP.Optional.Hyperionics.A, C:\Users\Franta\AppData\Roaming\Mozilla\Firefox\Profiles\95ma8vcw.default\extensions\{75656794-AB59-4712-BFBC-5D816D56F3BC}\chrome\content\somoto\29.png, , [3998b985c4b8fd391bce38e1689bd32d],
PUP.Optional.Hyperionics.A, C:\Users\Franta\AppData\Roaming\Mozilla\Firefox\Profiles\95ma8vcw.default\extensions\{75656794-AB59-4712-BFBC-5D816D56F3BC}\chrome\content\somoto\3.png, , [3998b985c4b8fd391bce38e1689bd32d],
PUP.Optional.Hyperionics.A, C:\Users\Franta\AppData\Roaming\Mozilla\Firefox\Profiles\95ma8vcw.default\extensions\{75656794-AB59-4712-BFBC-5D816D56F3BC}\chrome\content\somoto\30.png, , [3998b985c4b8fd391bce38e1689bd32d],
PUP.Optional.Hyperionics.A, C:\Users\Franta\AppData\Roaming\Mozilla\Firefox\Profiles\95ma8vcw.default\extensions\{75656794-AB59-4712-BFBC-5D816D56F3BC}\chrome\content\somoto\31.png, , [3998b985c4b8fd391bce38e1689bd32d],
PUP.Optional.Hyperionics.A, C:\Users\Franta\AppData\Roaming\Mozilla\Firefox\Profiles\95ma8vcw.default\extensions\{75656794-AB59-4712-BFBC-5D816D56F3BC}\chrome\content\somoto\32.png, , [3998b985c4b8fd391bce38e1689bd32d],
PUP.Optional.Hyperionics.A, C:\Users\Franta\AppData\Roaming\Mozilla\Firefox\Profiles\95ma8vcw.default\extensions\{75656794-AB59-4712-BFBC-5D816D56F3BC}\chrome\content\somoto\33.png, , [3998b985c4b8fd391bce38e1689bd32d],
PUP.Optional.Hyperionics.A, C:\Users\Franta\AppData\Roaming\Mozilla\Firefox\Profiles\95ma8vcw.default\extensions\{75656794-AB59-4712-BFBC-5D816D56F3BC}\chrome\content\somoto\34.png, , [3998b985c4b8fd391bce38e1689bd32d],
PUP.Optional.Hyperionics.A, C:\Users\Franta\AppData\Roaming\Mozilla\Firefox\Profiles\95ma8vcw.default\extensions\{75656794-AB59-4712-BFBC-5D816D56F3BC}\chrome\content\somoto\35.png, , [3998b985c4b8fd391bce38e1689bd32d],
PUP.Optional.Hyperionics.A, C:\Users\Franta\AppData\Roaming\Mozilla\Firefox\Profiles\95ma8vcw.default\extensions\{75656794-AB59-4712-BFBC-5D816D56F3BC}\chrome\content\somoto\36.png, , [3998b985c4b8fd391bce38e1689bd32d],
PUP.Optional.Hyperionics.A, C:\Users\Franta\AppData\Roaming\Mozilla\Firefox\Profiles\95ma8vcw.default\extensions\{75656794-AB59-4712-BFBC-5D816D56F3BC}\chrome\content\somoto\37.png, , [3998b985c4b8fd391bce38e1689bd32d],
PUP.Optional.Hyperionics.A, C:\Users\Franta\AppData\Roaming\Mozilla\Firefox\Profiles\95ma8vcw.default\extensions\{75656794-AB59-4712-BFBC-5D816D56F3BC}\chrome\content\somoto\38.png, , [3998b985c4b8fd391bce38e1689bd32d],
PUP.Optional.Hyperionics.A, C:\Users\Franta\AppData\Roaming\Mozilla\Firefox\Profiles\95ma8vcw.default\extensions\{75656794-AB59-4712-BFBC-5D816D56F3BC}\chrome\content\somoto\39.png, , [3998b985c4b8fd391bce38e1689bd32d],
PUP.Optional.Hyperionics.A, C:\Users\Franta\AppData\Roaming\Mozilla\Firefox\Profiles\95ma8vcw.default\extensions\{75656794-AB59-4712-BFBC-5D816D56F3BC}\chrome\content\somoto\4.png, , [3998b985c4b8fd391bce38e1689bd32d],
PUP.Optional.Hyperionics.A, C:\Users\Franta\AppData\Roaming\Mozilla\Firefox\Profiles\95ma8vcw.default\extensions\{75656794-AB59-4712-BFBC-5D816D56F3BC}\chrome\content\somoto\40.png, , [3998b985c4b8fd391bce38e1689bd32d],
PUP.Optional.Hyperionics.A, C:\Users\Franta\AppData\Roaming\Mozilla\Firefox\Profiles\95ma8vcw.default\extensions\{75656794-AB59-4712-BFBC-5D816D56F3BC}\chrome\content\somoto\41.png, , [3998b985c4b8fd391bce38e1689bd32d],
PUP.Optional.Hyperionics.A, C:\Users\Franta\AppData\Roaming\Mozilla\Firefox\Profiles\95ma8vcw.default\extensions\{75656794-AB59-4712-BFBC-5D816D56F3BC}\chrome\content\somoto\42.png, , [3998b985c4b8fd391bce38e1689bd32d],
PUP.Optional.Hyperionics.A, C:\Users\Franta\AppData\Roaming\Mozilla\Firefox\Profiles\95ma8vcw.default\extensions\{75656794-AB59-4712-BFBC-5D816D56F3BC}\chrome\content\somoto\43.png, , [3998b985c4b8fd391bce38e1689bd32d],
PUP.Optional.Hyperionics.A, C:\Users\Franta\AppData\Roaming\Mozilla\Firefox\Profiles\95ma8vcw.default\extensions\{75656794-AB59-4712-BFBC-5D816D56F3BC}\chrome\content\somoto\44.png, , [3998b985c4b8fd391bce38e1689bd32d],
PUP.Optional.Hyperionics.A, C:\Users\Franta\AppData\Roaming\Mozilla\Firefox\Profiles\95ma8vcw.default\extensions\{75656794-AB59-4712-BFBC-5D816D56F3BC}\chrome\content\somoto\45.png, , [3998b985c4b8fd391bce38e1689bd32d],
PUP.Optional.Hyperionics.A, C:\Users\Franta\AppData\Roaming\Mozilla\Firefox\Profiles\95ma8vcw.default\extensions\{75656794-AB59-4712-BFBC-5D816D56F3BC}\chrome\content\somoto\46.png, , [3998b985c4b8fd391bce38e1689bd32d],
PUP.Optional.Hyperionics.A, C:\Users\Franta\AppData\Roaming\Mozilla\Firefox\Profiles\95ma8vcw.default\extensions\{75656794-AB59-4712-BFBC-5D816D56F3BC}\chrome\content\somoto\48.png, , [3998b985c4b8fd391bce38e1689bd32d],
PUP.Optional.Hyperionics.A, C:\Users\Franta\AppData\Roaming\Mozilla\Firefox\Profiles\95ma8vcw.default\extensions\{75656794-AB59-4712-BFBC-5D816D56F3BC}\chrome\content\somoto\49.png, , [3998b985c4b8fd391bce38e1689bd32d],
PUP.Optional.Hyperionics.A, C:\Users\Franta\AppData\Roaming\Mozilla\Firefox\Profiles\95ma8vcw.default\extensions\{75656794-AB59-4712-BFBC-5D816D56F3BC}\chrome\content\somoto\5.png, , [3998b985c4b8fd391bce38e1689bd32d],
PUP.Optional.Hyperionics.A, C:\Users\Franta\AppData\Roaming\Mozilla\Firefox\Profiles\95ma8vcw.default\extensions\{75656794-AB59-4712-BFBC-5D816D56F3BC}\chrome\content\somoto\50.png, , [3998b985c4b8fd391bce38e1689bd32d],
PUP.Optional.Hyperionics.A, C:\Users\Franta\AppData\Roaming\Mozilla\Firefox\Profiles\95ma8vcw.default\extensions\{75656794-AB59-4712-BFBC-5D816D56F3BC}\chrome\content\somoto\51.png, , [3998b985c4b8fd391bce38e1689bd32d],
PUP.Optional.Hyperionics.A, C:\Users\Franta\AppData\Roaming\Mozilla\Firefox\Profiles\95ma8vcw.default\extensions\{75656794-AB59-4712-BFBC-5D816D56F3BC}\chrome\content\somoto\52.png, , [3998b985c4b8fd391bce38e1689bd32d],
PUP.Optional.Hyperionics.A, C:\Users\Franta\AppData\Roaming\Mozilla\Firefox\Profiles\95ma8vcw.default\extensions\{75656794-AB59-4712-BFBC-5D816D56F3BC}\chrome\content\somoto\53.png, , [3998b985c4b8fd391bce38e1689bd32d],
PUP.Optional.Hyperionics.A, C:\Users\Franta\AppData\Roaming\Mozilla\Firefox\Profiles\95ma8vcw.default\extensions\{75656794-AB59-4712-BFBC-5D816D56F3BC}\chrome\content\somoto\54.png, , [3998b985c4b8fd391bce38e1689bd32d],
PUP.Optional.Hyperionics.A, C:\Users\Franta\AppData\Roaming\Mozilla\Firefox\Profiles\95ma8vcw.default\extensions\{75656794-AB59-4712-BFBC-5D816D56F3BC}\chrome\content\somoto\55.png, , [3998b985c4b8fd391bce38e1689bd32d],
PUP.Optional.Hyperionics.A, C:\Users\Franta\AppData\Roaming\Mozilla\Firefox\Profiles\95ma8vcw.default\extensions\{75656794-AB59-4712-BFBC-5D816D56F3BC}\chrome\content\somoto\56.png, , [3998b985c4b8fd391bce38e1689bd32d],
PUP.Optional.Hyperionics.A, C:\Users\Franta\AppData\Roaming\Mozilla\Firefox\Profiles\95ma8vcw.default\extensions\{75656794-AB59-4712-BFBC-5D816D56F3BC}\chrome\content\somoto\57.png, , [3998b985c4b8fd391bce38e1689bd32d],
PUP.Optional.Hyperionics.A, C:\Users\Franta\AppData\Roaming\Mozilla\Firefox\Profiles\95ma8vcw.default\extensions\{75656794-AB59-4712-BFBC-5D816D56F3BC}\chrome\content\somoto\6.png, , [3998b985c4b8fd391bce38e1689bd32d],
PUP.Optional.Hyperionics.A, C:\Users\Franta\AppData\Roaming\Mozilla\Firefox\Profiles\95ma8vcw.default\extensions\{75656794-AB59-4712-BFBC-5D816D56F3BC}\chrome\content\somoto\7.png, , [3998b985c4b8fd391bce38e1689bd32d],
PUP.Optional.Hyperionics.A, C:\Users\Franta\AppData\Roaming\Mozilla\Firefox\Profiles\95ma8vcw.default\extensions\{75656794-AB59-4712-BFBC-5D816D56F3BC}\chrome\content\somoto\8.png, , [3998b985c4b8fd391bce38e1689bd32d],
PUP.Optional.Hyperionics.A, C:\Users\Franta\AppData\Roaming\Mozilla\Firefox\Profiles\95ma8vcw.default\extensions\{75656794-AB59-4712-BFBC-5D816D56F3BC}\chrome\content\somoto\9.png, , [3998b985c4b8fd391bce38e1689bd32d],
PUP.Optional.Hyperionics.A, C:\Users\Franta\AppData\Roaming\Mozilla\Firefox\Profiles\95ma8vcw.default\extensions\{75656794-AB59-4712-BFBC-5D816D56F3BC}\chrome\content\somoto\affid.dat, , [3998b985c4b8fd391bce38e1689bd32d],
PUP.Optional.Hyperionics.A, C:\Users\Franta\AppData\Roaming\Mozilla\Firefox\Profiles\95ma8vcw.default\extensions\{75656794-AB59-4712-BFBC-5D816D56F3BC}\chrome\content\somoto\basis.xml, , [3998b985c4b8fd391bce38e1689bd32d],
PUP.Optional.Hyperionics.A, C:\Users\Franta\AppData\Roaming\Mozilla\Firefox\Profiles\95ma8vcw.default\extensions\{75656794-AB59-4712-BFBC-5D816D56F3BC}\chrome\content\somoto\bubble.js, , [3998b985c4b8fd391bce38e1689bd32d],
PUP.Optional.Hyperionics.A, C:\Users\Franta\AppData\Roaming\Mozilla\Firefox\Profiles\95ma8vcw.default\extensions\{75656794-AB59-4712-BFBC-5D816D56F3BC}\chrome\content\somoto\bubble.xul, , [3998b985c4b8fd391bce38e1689bd32d],
PUP.Optional.Hyperionics.A, C:\Users\Franta\AppData\Roaming\Mozilla\Firefox\Profiles\95ma8vcw.default\extensions\{75656794-AB59-4712-BFBC-5D816D56F3BC}\chrome\content\somoto\colorpicker.htm, , [3998b985c4b8fd391bce38e1689bd32d],
PUP.Optional.Hyperionics.A, C:\Users\Franta\AppData\Roaming\Mozilla\Firefox\Profiles\95ma8vcw.default\extensions\{75656794-AB59-4712-BFBC-5D816D56F3BC}\chrome\content\somoto\contents.rdf, , [3998b985c4b8fd391bce38e1689bd32d],
PUP.Optional.Hyperionics.A, C:\Users\Franta\AppData\Roaming\Mozilla\Firefox\Profiles\95ma8vcw.default\extensions\{75656794-AB59-4712-BFBC-5D816D56F3BC}\chrome\content\somoto\dns_guard.xul, , [3998b985c4b8fd391bce38e1689bd32d],
PUP.Optional.Hyperionics.A, C:\Users\Franta\AppData\Roaming\Mozilla\Firefox\Profiles\95ma8vcw.default\extensions\{75656794-AB59-4712-BFBC-5D816D56F3BC}\chrome\content\somoto\guards.js, , [3998b985c4b8fd391bce38e1689bd32d],
PUP.Optional.Hyperionics.A, C:\Users\Franta\AppData\Roaming\Mozilla\Firefox\Profiles\95ma8vcw.default\extensions\{75656794-AB59-4712-BFBC-5D816D56F3BC}\chrome\content\somoto\homepage_guard.xul, , [3998b985c4b8fd391bce38e1689bd32d],
PUP.Optional.Hyperionics.A, C:\Users\Franta\AppData\Roaming\Mozilla\Firefox\Profiles\95ma8vcw.default\extensions\{75656794-AB59-4712-BFBC-5D816D56F3BC}\chrome\content\somoto\icons.png, , [3998b985c4b8fd391bce38e1689bd32d],
PUP.Optional.Hyperionics.A, C:\Users\Franta\AppData\Roaming\Mozilla\Firefox\Profiles\95ma8vcw.default\extensions\{75656794-AB59-4712-BFBC-5D816D56F3BC}\chrome\content\somoto\info.txt, , [3998b985c4b8fd391bce38e1689bd32d],
PUP.Optional.Hyperionics.A, C:\Users\Franta\AppData\Roaming\Mozilla\Firefox\Profiles\95ma8vcw.default\extensions\{75656794-AB59-4712-BFBC-5D816D56F3BC}\chrome\content\somoto\jscontainer.htm, , [3998b985c4b8fd391bce38e1689bd32d],
PUP.Optional.Hyperionics.A, C:\Users\Franta\AppData\Roaming\Mozilla\Firefox\Profiles\95ma8vcw.default\extensions\{75656794-AB59-4712-BFBC-5D816D56F3BC}\chrome\content\somoto\mbback.png, , [3998b985c4b8fd391bce38e1689bd32d],
PUP.Optional.Hyperionics.A, C:\Users\Franta\AppData\Roaming\Mozilla\Firefox\Profiles\95ma8vcw.default\extensions\{75656794-AB59-4712-BFBC-5D816D56F3BC}\chrome\content\somoto\mbbigopen.png, , [3998b985c4b8fd391bce38e1689bd32d],
PUP.Optional.Hyperionics.A, C:\Users\Franta\AppData\Roaming\Mozilla\Firefox\Profiles\95ma8vcw.default\extensions\{75656794-AB59-4712-BFBC-5D816D56F3BC}\chrome\content\somoto\mbclose.png, , [3998b985c4b8fd391bce38e1689bd32d],
PUP.Optional.Hyperionics.A, C:\Users\Franta\AppData\Roaming\Mozilla\Firefox\Profiles\95ma8vcw.default\extensions\{75656794-AB59-4712-BFBC-5D816D56F3BC}\chrome\content\somoto\mbfwd.png, , [3998b985c4b8fd391bce38e1689bd32d],
PUP.Optional.Hyperionics.A, C:\Users\Franta\AppData\Roaming\Mozilla\Firefox\Profiles\95ma8vcw.default\extensions\{75656794-AB59-4712-BFBC-5D816D56F3BC}\chrome\content\somoto\mbsep.png, , [3998b985c4b8fd391bce38e1689bd32d],
PUP.Optional.Hyperionics.A, C:\Users\Franta\AppData\Roaming\Mozilla\Firefox\Profiles\95ma8vcw.default\extensions\{75656794-AB59-4712-BFBC-5D816D56F3BC}\chrome\content\somoto\md5.js, , [3998b985c4b8fd391bce38e1689bd32d],
PUP.Optional.Hyperionics.A, C:\Users\Franta\AppData\Roaming\Mozilla\Firefox\Profiles\95ma8vcw.default\extensions\{75656794-AB59-4712-BFBC-5D816D56F3BC}\chrome\content\somoto\mozilla.xul, , [3998b985c4b8fd391bce38e1689bd32d],
PUP.Optional.Hyperionics.A, C:\Users\Franta\AppData\Roaming\Mozilla\Firefox\Profiles\95ma8vcw.default\extensions\{75656794-AB59-4712-BFBC-5D816D56F3BC}\chrome\content\somoto\mymenuitem.xml, , [3998b985c4b8fd391bce38e1689bd32d],
PUP.Optional.Hyperionics.A, C:\Users\Franta\AppData\Roaming\Mozilla\Firefox\Profiles\95ma8vcw.default\extensions\{75656794-AB59-4712-BFBC-5D816D56F3BC}\chrome\content\somoto\nav1c.png, , [3998b985c4b8fd391bce38e1689bd32d],
PUP.Optional.Hyperionics.A, C:\Users\Franta\AppData\Roaming\Mozilla\Firefox\Profiles\95ma8vcw.default\extensions\{75656794-AB59-4712-BFBC-5D816D56F3BC}\chrome\content\somoto\options.js, , [3998b985c4b8fd391bce38e1689bd32d],
PUP.Optional.Hyperionics.A, C:\Users\Franta\AppData\Roaming\Mozilla\Firefox\Profiles\95ma8vcw.default\extensions\{75656794-AB59-4712-BFBC-5D816D56F3BC}\chrome\content\somoto\options.xul, , [3998b985c4b8fd391bce38e1689bd32d],
PUP.Optional.Hyperionics.A, C:\Users\Franta\AppData\Roaming\Mozilla\Firefox\Profiles\95ma8vcw.default\extensions\{75656794-AB59-4712-BFBC-5D816D56F3BC}\chrome\content\somoto\separator.png, , [3998b985c4b8fd391bce38e1689bd32d],
PUP.Optional.Hyperionics.A, C:\Users\Franta\AppData\Roaming\Mozilla\Firefox\Profiles\95ma8vcw.default\extensions\{75656794-AB59-4712-BFBC-5D816D56F3BC}\chrome\content\somoto\tb.css, , [3998b985c4b8fd391bce38e1689bd32d],
PUP.Optional.Hyperionics.A, C:\Users\Franta\AppData\Roaming\Mozilla\Firefox\Profiles\95ma8vcw.default\extensions\{75656794-AB59-4712-BFBC-5D816D56F3BC}\chrome\content\somoto\tb.js, , [3998b985c4b8fd391bce38e1689bd32d],
PUP.Optional.Hyperionics.A, C:\Users\Franta\AppData\Roaming\Mozilla\Firefox\Profiles\95ma8vcw.default\extensions\{75656794-AB59-4712-BFBC-5D816D56F3BC}\chrome\content\somoto\tb.xsl, , [3998b985c4b8fd391bce38e1689bd32d],
PUP.Optional.Hyperionics.A, C:\Users\Franta\AppData\Roaming\Mozilla\Firefox\Profiles\95ma8vcw.default\extensions\{75656794-AB59-4712-BFBC-5D816D56F3BC}\chrome\content\somoto\tb.xul, , [3998b985c4b8fd391bce38e1689bd32d],
PUP.Optional.Hyperionics.A, C:\Users\Franta\AppData\Roaming\Mozilla\Firefox\Profiles\95ma8vcw.default\extensions\{75656794-AB59-4712-BFBC-5D816D56F3BC}\chrome\content\somoto\tbcore3.inf, , [3998b985c4b8fd391bce38e1689bd32d],
PUP.Optional.Hyperionics.A, C:\Users\Franta\AppData\Roaming\Mozilla\Firefox\Profiles\95ma8vcw.default\extensions\{75656794-AB59-4712-BFBC-5D816D56F3BC}\chrome\content\somoto\version.txt, , [3998b985c4b8fd391bce38e1689bd32d],
PUP.Optional.ASK.A, C:\Users\Franta\AppData\Roaming\Mozilla\Firefox\Profiles\95ma8vcw.default\prefs.js, Dobré: (), Špatné: (user_pref("extensions.toolbar.mindspark._4zMembers_.browser.startup.homepage.tb", "http://home.tb.ask.com/index.jhtml?ptb=D0C124E0-2B4C-4848-83E0-73421DF10F9C&n=780bae95&p2=^HJ^xdm073^YYA^cz&si=pconvFF");), ,[4a87c17d473516206473f5942adb6c94]
PUP.Optional.ASK.A, C:\Users\Franta\AppData\Roaming\Mozilla\Firefox\Profiles\95ma8vcw.default\prefs.js, Dobré: (), Špatné: (user_pref("keyword.URL", "http://search.tb.ask.com/search/GGmain.jhtml?st=kwd&ptb=D0C124E0-2B4C-4848-83E0-73421DF10F9C&n=780bae95&ind=2014031509&p2=^HJ^xdm073^YYA^cz&si=pconvFF&searchfor=");), ,[dff26cd259233006f6e293f6ab5ab54b]

Fyzické sektory: 0
(Žádné zákerné zjištěny položek)


(end)

Re: Malware našlo asi 150 hrozeb

Napsal: 22 lis 2014 19:00
od memphisto
V Mbam nech vše smazat a dodej log po smazání

Stáhni si ATF Cleaner
Poklepej na ATF Cleaner.exe, klikni na select all found, poté:
-Když používáš Firefox (Mozzila), klikni na Firefox nahoře a vyber: Select All, poté klikni na Empty Selected.
-Když používáš Operu, klikni nahoře na Operu a vyber: Select All, poté klikni na Empty Selected.
Po vyčištění klikni na Exit k zavření programu.
ATF-Cleaner je jednoduchý nástroj na odstranìní historie z webového prohlížeče. Program dokáže odstranit cache, cookies, historii a další stopy po surfování na Internetu. Mezi podporované prohlížeče patří Internet Explorer, Firefox a Opera. Aplikace navíc umí odstranit doèasné soubory Windows, vysypat koš atd.
- Pokud používáš jen Google Chrome , tak ATF nemusíš použít.

Stáhni si TFC
Otevři soubor a zavři všechny ostatní okna, Klikni na Start k zahájení procesu. Program by neměl trvat dlouho.
Poté by se měl PC restartovat, pokud ne , proveď sám.

Stáhni AdwCleaner
Ulož si ho na svojí plochu
Ukonči všechny programy, okna a prohlížeče
Spusť program poklepáním a klikni na „Search“
Po skenu se objeví log (jinak je uložen systémovem disku jako AdwCleaner[R?].txt), jeho obsah sem celý vlož.

Re: Malware našlo asi 150 hrozeb

Napsal: 22 lis 2014 19:50
od kodl74
Zde log:
Malwarebytes Anti-Malware
www.malwarebytes.org

Datum skenování: 22.11.2014
Čas skenování: 19:24:09
Protokol: malware 2.txt
Správce: Ano

Verze: 2.00.3.1025
Databáze malwaru: v2014.11.22.10
Databáze rootkitů: v2014.11.21.01
Licence: Bezplatná verze
Ochrana proti malwaru: Vypnuto
Ochrana proti škodlivým webovým stránkám: Vypnuto
Sebeobrany: Vypnuto

OS: Windows 7 Service Pack 1
CPU: x86
Souborový systém: NTFS
Uživatel: Franta

Typ skenu: Sken hrozeb
Výsledek: Dokončeno
Prohledaných objektů: 288674
Uplynulý čas: 8 min, 25 sek

Paměť: Zapnuto
Po spuštění: Zapnuto
Souborový systém: Zapnuto
Archivy: Zapnuto
Rootkity: Vypnuto
Heuristika: Zapnuto
PUP: Zapnuto
PUM: Zapnuto

Procesy: 0
(Žádné zákerné zjištěny položek)

Moduly: 0
(Žádné zákerné zjištěny položek)

Klíče registru: 0
(Žádné zákerné zjištěny položek)

Hodnoty registru: 0
(Žádné zákerné zjištěny položek)

Data registru: 0
(Žádné zákerné zjištěny položek)

Složky: 0
(Žádné zákerné zjištěny položek)

Soubory: 0
(Žádné zákerné zjištěny položek)

Fyzické sektory: 0
(Žádné zákerné zjištěny položek)


(end)

-------------------------------------------------------------------------------------------------------------------------------------------------------------------------

# AdwCleaner v4.101 - Report created 22/11/2014 at 19:44:59
# Updated 09/11/2014 by Xplode
# Database : 2014-11-16.1 [Live]
# Operating System : Windows 7 Ultimate Service Pack 1 (32 bits)
# Username : Franta - FRANTA
# Running from : C:\Users\Franta\Desktop\adwcleaner_4.101.exe
# Option : Scan

***** [ Services ] *****


***** [ Files / Folders ] *****

File Found : C:\Users\Franta\AppData\Roaming\Mozilla\Firefox\Profiles\95ma8vcw.default\searchplugins\Askcom.xml
File Found : C:\Users\Franta\AppData\Roaming\Mozilla\Firefox\Profiles\95ma8vcw.default\searchplugins\bingp.xml
File Found : C:\Users\Franta\AppData\Roaming\Mozilla\Firefox\Profiles\95ma8vcw.default\searchplugins\safeguard-secure-search.xml
File Found : C:\Users\Franta\AppData\Roaming\Mozilla\Firefox\Profiles\95ma8vcw.default\user.js
Folder Found : C:\Program Files\AskTBar
Folder Found : C:\ProgramData\Alawar Stargaze
Folder Found : C:\Users\Franta\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl
Folder Found : C:\Users\Franta\AppData\Local\Google\Chrome\User Data\Default\Extensions\ndibdjnfmopecpmkdieinmbadjfpblof
Folder Found : C:\Users\Franta\AppData\LocalLow\Toolbar4

***** [ Scheduled Tasks ] *****

Task Found : Driver Booster Update

***** [ Shortcuts ] *****


***** [ Registry ] *****

Key Found : HKCU\Software\BI
Key Found : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{020F4E16-7B22-40C8-9417-F8C117B9BB0E}
Key Found : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{96bd48dd-741b-41ae-ac4a-aff96ba00f7e}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{95B7759C-8C7F-4BF1-B163-73684A933233}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{95B7759C-8C7F-4BF1-B163-73684A933233}
Key Found : HKCU\Software\Zugo
Key Found : HKLM\SOFTWARE\AskTBar
Key Found : HKLM\SOFTWARE\Classes\AppID\{4CE516A7-F7AC-4628-B411-8F886DC5733E}
Key Found : HKLM\SOFTWARE\Classes\AppID\{628F3201-34D0-49C0-BB9A-82A26AEFB291}
Key Found : HKLM\SOFTWARE\Classes\AppID\TbCommonUtils.DLL
Key Found : HKLM\SOFTWARE\Classes\AppID\TbHelper.EXE
Key Found : HKLM\SOFTWARE\Classes\CLSID\{147A976F-EEE1-4377-8EA7-4716E4CDD239}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{1C950DE5-D31E-42FB-AFB9-91B0161633D8}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{3BDF4CE9-E81D-432B-A55E-9F0570CE811F}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{9AFB8248-617F-460D-9366-D71CDEDA3179}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{A9A56B8E-2DEB-4ED3-BC92-1FA450BCE1A5}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{AE338F6D-5A7C-4D1D-86E3-C618532079B5}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{C339D489-FABC-41DD-B39D-276101667C70}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{D89031C2-10DA-4C90-9A62-FCED012BC46B}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{DE9028D0-5FFA-4E69-94E3-89EE8741F468}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}
Key Found : HKLM\SOFTWARE\Classes\Interface\{01221FCC-4BFB-461C-B08C-F6D2DF309921}
Key Found : HKLM\SOFTWARE\Classes\Interface\{452AE416-9A97-44CA-93DA-D0F15C36254F}
Key Found : HKLM\SOFTWARE\Classes\Interface\{45CDA4F7-594C-49A0-AAD1-8224517FE979}
Key Found : HKLM\SOFTWARE\Classes\Interface\{81E852CC-1FD5-4004-8761-79A48B975E29}
Key Found : HKLM\SOFTWARE\Classes\Interface\{B2CA345D-ADB8-4F5D-AC64-4AB34322F659}
Key Found : HKLM\SOFTWARE\Classes\Interface\{B9F43021-60D4-42A6-A065-9BA37F38AC47}
Key Found : HKLM\SOFTWARE\Classes\Interface\{BF921DD3-732A-4A11-933B-A5EA49F2FD2C}
Key Found : HKLM\SOFTWARE\Classes\Interface\{D83B296A-2FA6-425B-8AE8-A1F33D99FBD6}
Key Found : HKLM\SOFTWARE\Classes\TbCommonUtils.CommonUtils
Key Found : HKLM\SOFTWARE\Classes\TbCommonUtils.CommonUtils.1
Key Found : HKLM\SOFTWARE\Classes\TbHelper.TbDownloadManager
Key Found : HKLM\SOFTWARE\Classes\TbHelper.TbDownloadManager.1
Key Found : HKLM\SOFTWARE\Classes\TbHelper.TbPropertyManager
Key Found : HKLM\SOFTWARE\Classes\TbHelper.TbPropertyManager.1
Key Found : HKLM\SOFTWARE\Classes\TbHelper.TbRequest
Key Found : HKLM\SOFTWARE\Classes\TbHelper.TbRequest.1
Key Found : HKLM\SOFTWARE\Classes\TbHelper.TbTask
Key Found : HKLM\SOFTWARE\Classes\TbHelper.TbTask.1
Key Found : HKLM\SOFTWARE\Classes\TbHelper.ToolbarHelper
Key Found : HKLM\SOFTWARE\Classes\TbHelper.ToolbarHelper.1
Key Found : HKLM\SOFTWARE\Classes\TypeLib\{B87F8B63-7274-43FD-87FA-09D3B7496148}
Key Found : HKLM\SOFTWARE\Classes\TypeLib\{C4BAE205-5E02-4E32-876E-F34B4E2D000C}
Key Found : HKLM\SOFTWARE\Google\Chrome\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl
Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{628F3201-34D0-49C0-BB9A-82A26AEFB291}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{95B7759C-8C7F-4BF1-B163-73684A933233}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0FF2AEFF45EEA0A48A4B33C1973B6094

***** [ Browsers ] *****

-\\ Internet Explorer v11.0.9600.17420

Setting Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Start Page] - hxxp://www.bigseekpro.com/xilisoftdownloadyoutube/{686E968C-7629-412B-8F75-D45706E47012}

-\\ Mozilla Firefox v33.1 (x86 cs)

[95ma8vcw.default] - Line Found : user_pref("browser.search.defaultengine", "Ask.com");
[95ma8vcw.default] - Line Found : user_pref("browser.search.order.1", "Ask.com");
[95ma8vcw.default] - Line Found : user_pref("extensions.mywebsearch.prevKwdEnabled", true);
[95ma8vcw.default] - Line Found : user_pref("extensions.mywebsearch.prevKwdURL", "hxxp://www.bing.com/search?FORM=UP97DF&PC=UP97&q=");
[95ma8vcw.default] - Line Found : user_pref("extensions.toolbar.mindspark._4zMembers_.BUTTON_STRUCTURE", "[{\"b\":221584481,\"c\":\"mindspark.magnify\",\"p\":\"L.0\"},{\"b\":221584482,\"c\":\"mindspark.entersearchterms\",\"p\":\"L.0.0[...]
[95ma8vcw.default] - Line Found : user_pref("extensions.toolbar.mindspark._4zMembers_.browser.search.defaultenginename.prev", "Bing");
[95ma8vcw.default] - Line Found : user_pref("extensions.toolbar.mindspark._4zMembers_.browser.search.defaultenginename.savedPrev", "true");
[95ma8vcw.default] - Line Found : user_pref("extensions.toolbar.mindspark._4zMembers_.browser.search.defaultenginename.tb", "Ask Web Search");
[95ma8vcw.default] - Line Found : user_pref("extensions.toolbar.mindspark._4zMembers_.browser.search.selectedEngine.prev", "Bing");
[95ma8vcw.default] - Line Found : user_pref("extensions.toolbar.mindspark._4zMembers_.browser.search.selectedEngine.savedPrev", "true");
[95ma8vcw.default] - Line Found : user_pref("extensions.toolbar.mindspark._4zMembers_.browser.search.selectedEngine.tb", "Ask Web Search");
[95ma8vcw.default] - Line Found : user_pref("extensions.toolbar.mindspark._4zMembers_.browser.startup.homepage.prev", "hxxp://www.seznam.cz/");
[95ma8vcw.default] - Line Found : user_pref("extensions.toolbar.mindspark._4zMembers_.browser.startup.homepage.savedPrev", "true");
[95ma8vcw.default] - Line Found : user_pref("extensions.toolbar.mindspark._4zMembers_.browser.startup.page.savedPrev", 1);
[95ma8vcw.default] - Line Found : user_pref("extensions.toolbar.mindspark._4zMembers_.browser.startup.page.tb", 1);
[95ma8vcw.default] - Line Found : user_pref("extensions.toolbar.mindspark._4zMembers_.competitorDNS", "{\"comment\":\"refresh every 1 week (7*24*60*60*1000)\",\"refreshPeriod\":604800000,\"list\":[{\"url\":\"hxxp://www.dnsrsearch.com/[...]
[95ma8vcw.default] - Line Found : user_pref("extensions.toolbar.mindspark._4zMembers_.firstKnownVersion", "6.20.3.33905");
[95ma8vcw.default] - Line Found : user_pref("extensions.toolbar.mindspark._4zMembers_.homepage", "hxxp://home.tb.ask.com/index.jhtml?ptb=D0C124E0-2B4C-4848-83E0-73421DF10F9C&n=780bae95&p2=^HJ^xdm073^YYA^cz&si=pconvFF");
[95ma8vcw.default] - Line Found : user_pref("extensions.toolbar.mindspark._4zMembers_.hp.enabled", false);
[95ma8vcw.default] - Line Found : user_pref("extensions.toolbar.mindspark._4zMembers_.hp.user.defined", true);
[95ma8vcw.default] - Line Found : user_pref("extensions.toolbar.mindspark._4zMembers_.initialized", true);
[95ma8vcw.default] - Line Found : user_pref("extensions.toolbar.mindspark._4zMembers_.installKeysSource", "LocalStorage");
[95ma8vcw.default] - Line Found : user_pref("extensions.toolbar.mindspark._4zMembers_.installType", "XPI");
[95ma8vcw.default] - Line Found : user_pref("extensions.toolbar.mindspark._4zMembers_.installation.contextKey", "");
[95ma8vcw.default] - Line Found : user_pref("extensions.toolbar.mindspark._4zMembers_.installation.installDate", "2014031509");
[95ma8vcw.default] - Line Found : user_pref("extensions.toolbar.mindspark._4zMembers_.installation.partnerId", "^HJ^xdm073^YYA^cz");
[95ma8vcw.default] - Line Found : user_pref("extensions.toolbar.mindspark._4zMembers_.installation.partnerSubId", "pconvFF");
[95ma8vcw.default] - Line Found : user_pref("extensions.toolbar.mindspark._4zMembers_.installation.pixelUrl", "hxxp://videodownloadconverter.dl.tb.ask.com/install_pixels.jhtml?partner=^HJ^xdm073^YYA^cz&coId=e1f0b98c9926494e9f7c3dcd3c6[...]
[95ma8vcw.default] - Line Found : user_pref("extensions.toolbar.mindspark._4zMembers_.installation.success", true);
[95ma8vcw.default] - Line Found : user_pref("extensions.toolbar.mindspark._4zMembers_.installation.toolbarId", "D0C124E0-2B4C-4848-83E0-73421DF10F9C");
[95ma8vcw.default] - Line Found : user_pref("extensions.toolbar.mindspark._4zMembers_.isCompliantUninstallImplementation", true);
[95ma8vcw.default] - Line Found : user_pref("extensions.toolbar.mindspark._4zMembers_.lastActivePing", "1416675948312");
[95ma8vcw.default] - Line Found : user_pref("extensions.toolbar.mindspark._4zMembers_.lastKnownVersion", "6.76.5.33347");
[95ma8vcw.default] - Line Found : user_pref("extensions.toolbar.mindspark._4zMembers_.options.defaultSearch", true);
[95ma8vcw.default] - Line Found : user_pref("extensions.toolbar.mindspark._4zMembers_.options.homePageEnabled", true);
[95ma8vcw.default] - Line Found : user_pref("extensions.toolbar.mindspark._4zMembers_.options.keywordEnabled", true);
[95ma8vcw.default] - Line Found : user_pref("extensions.toolbar.mindspark._4zMembers_.options.tabEnabled", true);
[95ma8vcw.default] - Line Found : user_pref("extensions.toolbar.mindspark._4zMembers_.partnerPixelFired", true);
[95ma8vcw.default] - Line Found : user_pref("extensions.toolbar.mindspark._4zMembers_.successUrl", "hxxp://pconverter.com/thankyou.php");
[95ma8vcw.default] - Line Found : user_pref("extensions.toolbar.mindspark._4zMembers_.toolbarCollapsed", true);
[95ma8vcw.default] - Line Found : user_pref("extensions.toolbar.mindspark._4zMembers_.weather.location", "10001");
[95ma8vcw.default] - Line Found : user_pref("extensions.toolbar.mindspark.hp.enabled", false);
[95ma8vcw.default] - Line Found : user_pref("extensions.toolbar.mindspark.hp.enabled.guid", "");
[95ma8vcw.default] - Line Found : user_pref("extensions.toolbar.mindspark.lastInstalled", "videodownloadconverter@mindspark.com");

-\\ Google Chrome v38.0.2125.111


*************************

AdwCleaner[R0].txt - [11270 octets] - [22/11/2014 19:42:14]
AdwCleaner[R1].txt - [11189 octets] - [22/11/2014 19:44:59]

########## EOF - C:\AdwCleaner\AdwCleaner[R1].txt - [11250 octets] ##########

Re: Malware našlo asi 150 hrozeb

Napsal: 22 lis 2014 20:02
od memphisto
V adw nech vše smazat a dodej log

Stáhni si RogueKiller
32bit.:
http://www.sur-la-toile.com/RogueKiller/RogueKiller.exe
64bit.:
http://www.sur-la-toile.com/RogueKiller ... lerX64.exe
na svojí plochu.
- Zavři všechny ostatní programy a prohlížeče.
- Pro OS Vista a win7 spusť program RogueKiller.exe jako správce , u XP poklepáním.
- počkej až skončí Prescan -vyhledávání škodlivých procesů.
- Zkontroluj , zda máš zaškrtnuto:
Kontrola MBR
Kontrola Faked
Antirootkit
-Potom klikni na „Prohledat“.
- Program skenuje procesy PC. Po proskenování klikni na „Zpráva“celý obsah logu sem zkopíruj.
Pokud je program blokován , zkus ho spustit několikrát. Pokud dále program nepůjde spustit a pracovat, přejmenuj ho na winlogon.exe.

Stáhni si Junkware Removal Tool

na svojí plochu.
Deaktivuj si svůj antivirový program.
Pravým tl. myši klikni na JRT.exe a vyber „spustit jako správce“. Pro pokračování budeš vyzván ke stisknutí jakékoliv klávesy. Na nějakou klikni.
Začne skenování programu. Skenování může trvat dloho , podle množství nákaz. Po ukončení skenu se objeví log (JRT.txt) , který se uloží na ploše.
Zkopíruj sem prosím celý jeho obsah.

Re: Malware našlo asi 150 hrozeb

Napsal: 22 lis 2014 20:32
od kodl74
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.3.9 (11.15.2014:2)
OS: Windows 7 Ultimate x86
Ran by Franta on so 22.11.2014 at 20:14:20,09
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values

Successfully repaired: [Registry Value] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\\Start Page



~~~ Registry Keys

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\AskInstallChecker_RASAPI32
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\AskInstallChecker_RASMANCS
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{020F4E16-7B22-40C8-9417-F8C117B9BB0E}
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{96bd48dd-741b-41ae-ac4a-aff96ba00f7e}
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{C285A418-1799-4113-8ECE-102D256F8B12}
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{95B7759C-8C7F-4BF1-B163-73684A933233}
Successfully deleted: [Registry Key - Orphan] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{95B7759C-8C7F-4BF1-B163-73684A933233}
Successfully deleted: [Registry Key - Orphan] HKEY_CLASSES_ROOT\CLSID\{95B7759C-8C7F-4BF1-B163-73684A933233}



~~~ Files

Successfully deleted: [File] C:\Windows\System32\Tasks\Driver Booster Update
Successfully deleted: [File] C:\Windows\Tasks\Driver Booster Update.job
Successfully deleted: [File] "C:\Windows\wininit.ini"



~~~ Folders

Successfully deleted: [Folder] C:\ProgramData\Alawar Stargaze
Successfully deleted: [Folder] "C:\Users\Franta\appdata\locallow\toolbar4"



~~~ FireFox

Successfully deleted: [File] C:\Users\Franta\AppData\Roaming\mozilla\firefox\profiles\95ma8vcw.default\user.js
Successfully deleted: [File] C:\Users\Franta\AppData\Roaming\mozilla\firefox\profiles\95ma8vcw.default\searchplugins\askcom.xml
Successfully deleted: [File] C:\Users\Franta\AppData\Roaming\mozilla\firefox\profiles\95ma8vcw.default\searchplugins\bingp.xml
Successfully deleted: [File] C:\Users\Franta\AppData\Roaming\mozilla\firefox\profiles\95ma8vcw.default\searchplugins\safeguard-secure-search.xml
Successfully deleted the following from C:\Users\Franta\AppData\Roaming\mozilla\firefox\profiles\95ma8vcw.default\prefs.js

user_pref("browser.search.defaultengine", "Ask.com");
user_pref("browser.search.order.1", "Ask.com");
user_pref("extensions.mywebsearch.prevKwdEnabled", true);
user_pref("extensions.mywebsearch.prevKwdURL", "hxxp://www.bing.com/search?FORM=UP97DF&PC=UP97&q=");
user_pref("extensions.toolbar.mindspark._4zMembers_.BUTTON_STRUCTURE", "[{\"b\":221584481,\"c\":\"mindspark.magnify\",\"p\":\"L.0\"},{\"b\":221584482,\"c\":\"mindspark.enterse
user_pref("extensions.toolbar.mindspark._4zMembers_.browser.search.defaultenginename.prev", "Bing");
user_pref("extensions.toolbar.mindspark._4zMembers_.browser.search.defaultenginename.savedPrev", "true");
user_pref("extensions.toolbar.mindspark._4zMembers_.browser.search.defaultenginename.tb", "Ask Web Search");
user_pref("extensions.toolbar.mindspark._4zMembers_.browser.search.selectedEngine.prev", "Bing");
user_pref("extensions.toolbar.mindspark._4zMembers_.browser.search.selectedEngine.savedPrev", "true");
user_pref("extensions.toolbar.mindspark._4zMembers_.browser.search.selectedEngine.tb", "Ask Web Search");
user_pref("extensions.toolbar.mindspark._4zMembers_.browser.startup.homepage.prev", "hxxp://www.seznam.cz/");
user_pref("extensions.toolbar.mindspark._4zMembers_.browser.startup.homepage.savedPrev", "true");
user_pref("extensions.toolbar.mindspark._4zMembers_.browser.startup.page.savedPrev", 1);
user_pref("extensions.toolbar.mindspark._4zMembers_.browser.startup.page.tb", 1);
user_pref("extensions.toolbar.mindspark._4zMembers_.competitorDNS", "{\"comment\":\"refresh every 1 week (7*24*60*60*1000)\",\"refreshPeriod\":604800000,\"list\":[{\"url\":\"h
user_pref("extensions.toolbar.mindspark._4zMembers_.firstKnownVersion", "6.20.3.33905");
user_pref("extensions.toolbar.mindspark._4zMembers_.homepage", "hxxp://home.tb.ask.com/index.jhtml?ptb=D0C124E0-2B4C-4848-83E0-73421DF10F9C&n=780bae95&p2=^HJ^xdm073^YYA^cz&si=
user_pref("extensions.toolbar.mindspark._4zMembers_.hp.enabled", false);
user_pref("extensions.toolbar.mindspark._4zMembers_.hp.user.defined", true);
user_pref("extensions.toolbar.mindspark._4zMembers_.initialized", true);
user_pref("extensions.toolbar.mindspark._4zMembers_.installKeysSource", "LocalStorage");
user_pref("extensions.toolbar.mindspark._4zMembers_.installType", "XPI");
user_pref("extensions.toolbar.mindspark._4zMembers_.installation.contextKey", "");
user_pref("extensions.toolbar.mindspark._4zMembers_.installation.installDate", "2014031509");
user_pref("extensions.toolbar.mindspark._4zMembers_.installation.partnerId", "^HJ^xdm073^YYA^cz");
user_pref("extensions.toolbar.mindspark._4zMembers_.installation.partnerSubId", "pconvFF");
user_pref("extensions.toolbar.mindspark._4zMembers_.installation.pixelUrl", "hxxp://videodownloadconverter.dl.tb.ask.com/install_pixels.jhtml?partner=^HJ^xdm073^YYA^cz&coId=e1
user_pref("extensions.toolbar.mindspark._4zMembers_.installation.success", true);
user_pref("extensions.toolbar.mindspark._4zMembers_.installation.toolbarId", "D0C124E0-2B4C-4848-83E0-73421DF10F9C");
user_pref("extensions.toolbar.mindspark._4zMembers_.isCompliantUninstallImplementation", true);
user_pref("extensions.toolbar.mindspark._4zMembers_.lastActivePing", "1416675948312");
user_pref("extensions.toolbar.mindspark._4zMembers_.lastKnownVersion", "6.76.5.33347");
user_pref("extensions.toolbar.mindspark._4zMembers_.options.defaultSearch", true);
user_pref("extensions.toolbar.mindspark._4zMembers_.options.homePageEnabled", true);
user_pref("extensions.toolbar.mindspark._4zMembers_.options.keywordEnabled", true);
user_pref("extensions.toolbar.mindspark._4zMembers_.options.tabEnabled", true);
user_pref("extensions.toolbar.mindspark._4zMembers_.partnerPixelFired", true);
user_pref("extensions.toolbar.mindspark._4zMembers_.successUrl", "hxxp://pconverter.com/thankyou.php");
user_pref("extensions.toolbar.mindspark._4zMembers_.toolbarCollapsed", true);
user_pref("extensions.toolbar.mindspark._4zMembers_.weather.location", "10001");
user_pref("extensions.toolbar.mindspark.hp.enabled", false);
user_pref("extensions.toolbar.mindspark.hp.enabled.guid", "");
user_pref("extensions.toolbar.mindspark.lastInstalled", "videodownloadconverter@mindspark.com");
Emptied folder: C:\Users\Franta\AppData\Roaming\mozilla\firefox\profiles\95ma8vcw.default\minidumps [42 files]



~~~ Chrome

Successfully deleted: [Folder] C:\Users\Franta\appdata\local\Google\Chrome\User Data\Default\Extensions\ndibdjnfmopecpmkdieinmbadjfpblof



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on so 22.11.2014 at 20:16:23,13
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

---------------------------------------------------------------------------------------------------------------------------------------------------------------------------


RogueKiller V10.0.8.0 [Nov 20 2014] by Adlice Software
mail : http://www.adlice.com/contact/
Feedback : http://forum.adlice.com
Webová stránka : http://www.adlice.com/softwares/roguekiller/
Blog : http://www.adlice.com

Operační systém : Windows 7 (6.1.7601 Service Pack 1) 32 bits version
Spuštěno : Normální režim
Uživatel : Franta [Práva správce]
Mód : Prohledat -- Datum : 11/22/2014 20:11:26

¤¤¤ Procesy : 0 ¤¤¤

¤¤¤ Registry : 24 ¤¤¤
[PUP] HKEY_CLASSES_ROOT\CLSID\{147A976F-EEE1-4377-8EA7-4716E4CDD239} -> Nalezeno
[PUP] HKEY_CLASSES_ROOT\CLSID\{1C950DE5-D31E-42FB-AFB9-91B0161633D8} -> Nalezeno
[PUP] HKEY_CLASSES_ROOT\CLSID\{3BDF4CE9-E81D-432B-A55E-9F0570CE811F} -> Nalezeno
[PUP] HKEY_CLASSES_ROOT\CLSID\{9AFB8248-617F-460d-9366-D71CDEDA3179} -> Nalezeno
[PUP] HKEY_CLASSES_ROOT\CLSID\{A9A56B8E-2DEB-4ED3-BC92-1FA450BCE1A5} -> Nalezeno
[PUP] HKEY_CLASSES_ROOT\CLSID\{AE338F6D-5A7C-4D1D-86E3-C618532079B5} -> Nalezeno
[PUP] HKEY_CLASSES_ROOT\CLSID\{C339D489-FABC-41DD-B39D-276101667C70} -> Nalezeno
[PUP] HKEY_CLASSES_ROOT\CLSID\{D89031C2-10DA-4C90-9A62-FCED012BC46B} -> Nalezeno
[PUP] HKEY_CLASSES_ROOT\CLSID\{DE9028D0-5FFA-4E69-94E3-89EE8741F468} -> Nalezeno
[PUP] HKEY_CLASSES_ROOT\CLSID\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} -> Nalezeno
[PUP] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{95B7759C-8C7F-4BF1-B163-73684A933233} -> Nalezeno
[Suspicious.Path] HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\gdrv (\??\C:\Windows\gdrv.sys) -> Nalezeno
[Suspicious.Path] HKEY_LOCAL_MACHINE\System\ControlSet001\Services\gdrv (\??\C:\Windows\gdrv.sys) -> Nalezeno
[Suspicious.Path] HKEY_LOCAL_MACHINE\System\ControlSet002\Services\gdrv (\??\C:\Windows\gdrv.sys) -> Nalezeno
[PUM.HomePage] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main | Start Page : http://www.bigseekpro.com/xilisoftdownloadyoutube/{686E968C-7629-412B-8F75-D45706E47012} -> Nalezeno
[PUM.SearchPage] HKEY_USERS\S-1-5-21-199143479-2753093889-1228688661-1000\Software\Microsoft\Internet Explorer\Main | Search Page : -> Nalezeno
[PUM.Dns] HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters | DhcpNameServer : 62.240.178.250 192.168.0.1 [CZECH REPUBLIC (CZ)] -> Nalezeno
[PUM.Dns] HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Tcpip\Parameters | DhcpNameServer : 62.240.178.250 192.168.0.1 [CZECH REPUBLIC (CZ)] -> Nalezeno
[PUM.Dns] HKEY_LOCAL_MACHINE\System\ControlSet002\Services\Tcpip\Parameters | DhcpNameServer : 62.240.178.250 192.168.0.1 [CZECH REPUBLIC (CZ)] -> Nalezeno
[PUM.Dns] HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{623150C9-6C76-45AD-8209-D979F7C0A280} | DhcpNameServer : 62.240.178.250 192.168.0.1 [CZECH REPUBLIC (CZ)] -> Nalezeno
[PUM.Dns] HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Tcpip\Parameters\Interfaces\{623150C9-6C76-45AD-8209-D979F7C0A280} | DhcpNameServer : 62.240.178.250 192.168.0.1 [CZECH REPUBLIC (CZ)] -> Nalezeno
[PUM.Dns] HKEY_LOCAL_MACHINE\System\ControlSet002\Services\Tcpip\Parameters\Interfaces\{623150C9-6C76-45AD-8209-D979F7C0A280} | DhcpNameServer : 62.240.178.250 192.168.0.1 [CZECH REPUBLIC (CZ)] -> Nalezeno
[PUM.DesktopIcons] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {20D04FE0-3AEA-1069-A2D8-08002B30309D} : 1 -> Nalezeno
[PUM.DesktopIcons] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {59031a47-3f72-44a7-89c5-5595fe6b30ee} : 1 -> Nalezeno

¤¤¤ Úlohy : 2 ¤¤¤
[Suspicious.Path] 0814tbUpdateInfo.job -- C:\ProgramData\Avg_Update_0814tb\0814tb_{DC217581-B153-4CB4-9C69-1D6B72F4AAD8}.exe ( /SETINFO /CMPID=0814tb /INFORETRY=3) -> Nalezeno
[Suspicious.Path] 1114tbUpdateInfo.job -- C:\ProgramData\Avg_Update_1114tb\1114tb_{6E0A7A39-71FC-4B07-AB26-220BEC8638A6}.exe ( /SETINFO /CMPID=1114tb /INFORETRY=3) -> Nalezeno

¤¤¤ Soubory : 0 ¤¤¤

¤¤¤ Soubor HOSTS : 0 ¤¤¤

¤¤¤ Antirootkit : 0 (Driver: Nahrán) ¤¤¤

¤¤¤ Webové prohlížeče : 1 ¤¤¤
[PUM.HomePage][FIREFX:Config] 95ma8vcw.default : user_pref("browser.startup.homepage", "http://www.seznam.cz/"); -> Nalezeno

¤¤¤ Kontrola MBR : ¤¤¤
+++++ PhysicalDrive0: SAMSUNG HD321KJ SATA Disk Device +++++
--- User ---
[MBR] 96393be436a11776d4e342978952587e
[BSP] b761887808ac06acff8cba75f1877985 : Windows Vista/7/8 MBR Code
Partition table:
0 - [ACTIVE] NTFS (0x7) [VISIBLE] Offset (sectors): 2048 | Size: 100 MB
1 - [XXXXXX] NTFS (0x7) [VISIBLE] Offset (sectors): 206848 | Size: 305143 MB
User = LL1 ... OK
User = LL2 ... OK

+++++ PhysicalDrive1: ST1000DM 003-1CH162 SATA Disk Device +++++
--- User ---
[MBR] 58adb573894a00d492aacac8cd3a4887
[BSP] c6094b11f090f7faae60f6e1866cedc9 : Windows Vista/7/8 MBR Code
Partition table:
0 - [XXXXXX] NTFS (0x7) [VISIBLE] Offset (sectors): 2048 | Size: 953867 MB
User = LL1 ... OK
User = LL2 ... OK

Re: Malware našlo asi 150 hrozeb

Napsal: 23 lis 2014 09:28
od jaro3
Zavři všechny programy a prohlížeče. Deaktivuj antivir a firewall.
Prosím, odpoj všechny USB (kromě myši s klávesnice) nebo externí disky z počítače před spuštěním tohoto programu.
Spusť znovu RogueKiller ( Pro Windows Vista nebo Windows 7, klepni pravým a vyber "Spustit jako správce", ve Windows XP poklepej ke spuštění).
- Počkej, až Prescan dokončí práci...
- Pak klikni na "Prohledat " ,po jeho skončení:


- V záložkách (Registry , Tasks , Web Browser apod.) vše zatrhni (dej zatržítka)
(musíš dát myší zatržítko do toho čtverečku vlevo od registru ap.)

- Klikni na "Smazat"
- Počkej, dokud Status box nezobrazí " Mazání dokončeno "
- Klikni na "Zpráva " a zkopíruj a vlož obsah té zprávy prosím sem. Log je možno nalézt v RKreport [číslo]. txt na ploše.
- Zavři RogueKiller

Stáhni
Zoek.exe

a uloz si ho na plochu.
Zavři všechny ostatní programy , okna i prohlížeče.
Spusť Zoek.exe ( u win vista , win7, 8 klikni na něj pravým a vyber : „Spustit jako správce“
- pozor , náběh programu může trvat déle.

Do okna programu vlož skript níže:

Kód: Vybrat vše

autoclean;
emptyclsid;
iedefaults;
FFdefaults;
CHRdefaults;
emptyalltemp;
resethosts;


klikni na Run Script
Program provede sken , opravu, sken i oprava může trvat i více minut ,je třeba posečkat do konce. Do okna neklikej!
Program nabídne restart , potvrď .

Po restartu se může nějaký čas ukázat pouze černá plocha , to je normální. Je třeba počkat až se vytvoří log. Ten si můžeš uložit třeba do dokumentů , jinak se sám ukládá do:
C:\zoek-results.log
Zkopíruj sem celý obsah toho logu.

Re: Malware našlo asi 150 hrozeb

Napsal: 23 lis 2014 11:07
od kodl74
RogueKiller V10.0.8.0 [Nov 20 2014] by Adlice Software
mail : http://www.adlice.com/contact/
Feedback : http://forum.adlice.com
Webová stránka : http://www.adlice.com/softwares/roguekiller/
Blog : http://www.adlice.com

Operační systém : Windows 7 (6.1.7601 Service Pack 1) 32 bits version
Spuštěno : Normální režim
Uživatel : Franta [Práva správce]
Mód : Smazat -- Datum : 11/23/2014 10:40:00

¤¤¤ Procesy : 0 ¤¤¤

¤¤¤ Registry : 22 ¤¤¤
[PUP] HKEY_CLASSES_ROOT\CLSID\{147A976F-EEE1-4377-8EA7-4716E4CDD239} -> Smazáno
[PUP] HKEY_CLASSES_ROOT\CLSID\{1C950DE5-D31E-42FB-AFB9-91B0161633D8} -> Smazáno
[PUP] HKEY_CLASSES_ROOT\CLSID\{3BDF4CE9-E81D-432B-A55E-9F0570CE811F} -> Smazáno
[PUP] HKEY_CLASSES_ROOT\CLSID\{9AFB8248-617F-460d-9366-D71CDEDA3179} -> Smazáno
[PUP] HKEY_CLASSES_ROOT\CLSID\{A9A56B8E-2DEB-4ED3-BC92-1FA450BCE1A5} -> Smazáno
[PUP] HKEY_CLASSES_ROOT\CLSID\{AE338F6D-5A7C-4D1D-86E3-C618532079B5} -> Smazáno
[PUP] HKEY_CLASSES_ROOT\CLSID\{C339D489-FABC-41DD-B39D-276101667C70} -> Smazáno
[PUP] HKEY_CLASSES_ROOT\CLSID\{D89031C2-10DA-4C90-9A62-FCED012BC46B} -> Smazáno
[PUP] HKEY_CLASSES_ROOT\CLSID\{DE9028D0-5FFA-4E69-94E3-89EE8741F468} -> Smazáno
[PUP] HKEY_CLASSES_ROOT\CLSID\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} -> Smazáno
[Suspicious.Path] HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\gdrv -> Smazáno
[Suspicious.Path] HKEY_LOCAL_MACHINE\System\ControlSet001\Services\gdrv -> Smazáno
[Suspicious.Path] HKEY_LOCAL_MACHINE\System\ControlSet002\Services\gdrv -> Smazáno
[PUM.SearchPage] HKEY_USERS\S-1-5-21-199143479-2753093889-1228688661-1000\Software\Microsoft\Internet Explorer\Main | Search Page : -> Nahrazeno (http://go.microsoft.com/fwlink/?LinkId=54896)
[PUM.Dns] HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters | DhcpNameServer : 62.240.178.250 192.168.0.1 [CZECH REPUBLIC (CZ)] -> Nahrazeno ()
[PUM.Dns] HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Tcpip\Parameters | DhcpNameServer : 62.240.178.250 192.168.0.1 [CZECH REPUBLIC (CZ)] -> Nahrazeno ()
[PUM.Dns] HKEY_LOCAL_MACHINE\System\ControlSet002\Services\Tcpip\Parameters | DhcpNameServer : 62.240.178.250 192.168.0.1 [CZECH REPUBLIC (CZ)] -> Nahrazeno ()
[PUM.Dns] HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{623150C9-6C76-45AD-8209-D979F7C0A280} | DhcpNameServer : 62.240.178.250 192.168.0.1 [CZECH REPUBLIC (CZ)] -> Nahrazeno ()
[PUM.Dns] HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Tcpip\Parameters\Interfaces\{623150C9-6C76-45AD-8209-D979F7C0A280} | DhcpNameServer : 62.240.178.250 192.168.0.1 [CZECH REPUBLIC (CZ)] -> Nahrazeno ()
[PUM.Dns] HKEY_LOCAL_MACHINE\System\ControlSet002\Services\Tcpip\Parameters\Interfaces\{623150C9-6C76-45AD-8209-D979F7C0A280} | DhcpNameServer : 62.240.178.250 192.168.0.1 [CZECH REPUBLIC (CZ)] -> Nahrazeno ()
[PUM.DesktopIcons] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {20D04FE0-3AEA-1069-A2D8-08002B30309D} : 1 -> Nahrazeno (0)
[PUM.DesktopIcons] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {59031a47-3f72-44a7-89c5-5595fe6b30ee} : 1 -> Nahrazeno (0)

¤¤¤ Úlohy : 2 ¤¤¤
[Suspicious.Path] 0814tbUpdateInfo.job -- C:\ProgramData\Avg_Update_0814tb\0814tb_{DC217581-B153-4CB4-9C69-1D6B72F4AAD8}.exe ( /SETINFO /CMPID=0814tb /INFORETRY=3) -> Smazáno
[Suspicious.Path] 1114tbUpdateInfo.job -- C:\ProgramData\Avg_Update_1114tb\1114tb_{6E0A7A39-71FC-4B07-AB26-220BEC8638A6}.exe ( /SETINFO /CMPID=1114tb /INFORETRY=3) -> Smazáno

¤¤¤ Soubory : 0 ¤¤¤

¤¤¤ Soubor HOSTS : 0 ¤¤¤

¤¤¤ Antirootkit : 0 (Driver: Nahrán) ¤¤¤

¤¤¤ Webové prohlížeče : 3 ¤¤¤
[FIREFX:Addon] 95ma8vcw.default : avast! Online Security [wrc@avast.com] -> Smazáno
[FIREFX:Addon] 95ma8vcw.default : Skype Click to Call [{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}] -> Smazáno
[PUM.HomePage][FIREFX:Config] 95ma8vcw.default : user_pref("browser.startup.homepage", "http://www.seznam.cz/"); -> Nahrazeno (about:home)

¤¤¤ Kontrola MBR : ¤¤¤
+++++ PhysicalDrive0: SAMSUNG HD321KJ SATA Disk Device +++++
--- User ---
[MBR] 96393be436a11776d4e342978952587e
[BSP] b761887808ac06acff8cba75f1877985 : Windows Vista/7/8 MBR Code
Partition table:
0 - [ACTIVE] NTFS (0x7) [VISIBLE] Offset (sectors): 2048 | Size: 100 MB
1 - [XXXXXX] NTFS (0x7) [VISIBLE] Offset (sectors): 206848 | Size: 305143 MB
User = LL1 ... OK
User = LL2 ... OK

+++++ PhysicalDrive1: ST1000DM 003-1CH162 SATA Disk Device +++++
--- User ---
[MBR] 58adb573894a00d492aacac8cd3a4887
[BSP] c6094b11f090f7faae60f6e1866cedc9 : Windows Vista/7/8 MBR Code
Partition table:
0 - [XXXXXX] NTFS (0x7) [VISIBLE] Offset (sectors): 2048 | Size: 953867 MB
User = LL1 ... OK
User = LL2 ... OK


============================================
RKreport_SCN_11222014_201126.log - RKreport_SCN_11232014_103515.log

------------------------------------------------------------------------------------------------------------------------------------------------------------------------

Zoek.exe v5.0.0.0 Updated 21-11-2014
Tool run by Franta on ne 23.11.2014 at 10:48:32,03.
Microsoft Windows 7 Ultimate 6.1.7601 Service Pack 1 x86
Running in: Normal Mode Internet Access Detected
Launched: C:\Users\Franta\Desktop\zoek.exe [Scan all users] [Script inserted]

==== System Restore Info ======================

23.11.2014 10:48:59 Zoek.exe System Restore Point Created Succesfully.

==== Reset Hosts File ======================

# Copyright (c) 1993-2006 Microsoft Corp.
#
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
#
# This file contains the mappings of IP addresses to host names. Each
# entry should be kept on an individual line. The IP address should
# be placed in the first column followed by the corresponding host name.
# The IP address and the host name should be separated by at least one
# space.
#
# Additionally, comments (such as these) may be inserted on individual
# lines or following the machine name denoted by a '#' symbol.
#
# For example:
#
# 102.54.94.97 rhino.acme.com # source server
# 38.25.63.10 x.acme.com # x client host

# localhost name resolution is handle within DNS itself.
127.0.0.1 localhost
::1 localhost

==== Deleting CLSID Registry Keys ======================

HKEY_USERS\S-1-5-21-199143479-2753093889-1228688661-1000\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{0E8A89AD-95D7-40EB-8D9D-083EF7066A01} deleted successfully
HKEY_USERS\S-1-5-21-199143479-2753093889-1228688661-1000\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{0E8A89AD-95D7-40EB-8D9D-083EF7066A01} deleted successfully

==== Deleting CLSID Registry Values ======================


==== Deleting Services ======================


==== FireFox Fix ======================

Deleted from C:\Users\Franta\AppData\Roaming\Mozilla\Firefox\Profiles\95ma8vcw.default\prefs.js:
user_pref("browser.startup.homepage", "www.seznam.cz");
user_pref("browser.search.suggest.enabled", false);
user_pref("browser.search.useDBForOrder", true);

Added to C:\Users\Franta\AppData\Roaming\Mozilla\Firefox\Profiles\95ma8vcw.default\prefs.js:
user_pref("browser.startup.homepage", "http://www.google.com");
user_pref("browser.search.defaulturl", "http://www.google.com/search?btnG=Google+Search&q=");
user_pref("browser.newtab.url", "http://www.google.com/");
user_pref("browser.search.defaultengine", "Google");
user_pref("browser.search.defaultenginename", "Google");
user_pref("browser.search.selectedEngine", "Google");
user_pref("browser.search.order.1", "Google");
user_pref("keyword.URL", "http://www.google.com/search?btnG=Google+Search&q=");
user_pref("browser.search.suggest.enabled", true);
user_pref("browser.search.useDBForOrder", true);

==== Deleting Files \ Folders ======================

C:\PROGRA~2\{01BD4FC9-2F86-4706-A62E-774BB7E9D308} deleted
C:\PROGRA~2\{FE8D473A-6F06-4F99-B5F4-BED72B2A038C} deleted
C:\Program Files\Mozilla Firefox\browser\searchplugins\safeguard-secure-search.xml deleted
C:\Program Files\Mozilla Firefox\defaults\preferences\pref.js deleted
C:\Program Files\AskTBar deleted
C:\PROGRA~2\Avg_Update_0814tb deleted
C:\PROGRA~2\Avg_Update_1114tb deleted
C:\Windows\system32\config\systemprofile\AppData\LocalLow\AVG SafeGuard toolbar deleted
C:\Windows\system32\tasks\0814tbUpdateInfo deleted
C:\Windows\system32\tasks\1114tbUpdateInfo deleted
C:\Windows\system32\config\systemprofile\Searches deleted
C:\Users\Franta\AppData\Roaming\Mozilla\Firefox\Profiles\95ma8vcw.default\Invalidprefs.js deleted
C:\Users\Franta\Desktop\driver-booster-softonic.exe deleted

==== Firefox Extensions Registry ======================

[HKEY_LOCAL_MACHINE\Software\Mozilla\Firefox\Extensions]
"wrc@avast.com"="C:\Program Files\AVAST Software\Avast\WebRep\FF" [22.11.2014 18:04]

==== Firefox Extensions ======================

AppDir: C:\Program Files\Mozilla Firefox
- Default - %AppDir%\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
- Skype Click to Call - %AppDir%\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}.xpi

==== Firefox Plugins ======================

Profilepath: C:\Users\Franta\AppData\Roaming\Mozilla\Firefox\Profiles\95ma8vcw.default
D2377C9458EFEB094E38B8C874AA214C - C:\Program Files\Google\Update\1.3.25.11\npGoogleUpdate3.dll - Google Update
63F8C13F269B10BC9363B007DAAACAE6 - C:\Windows\system32\Macromed\Flash\NPSWF32_15_0_0_189.dll - Shockwave Flash
005EBE4A4E6E9C9A7967F6C3F413C1DF - C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll - Adobe Acrobat
421CB2C1010522B3BF7C00725520B844 - C:\Program Files\Adobe\Reader 11.0\Reader\browser\nppdf32.dll - Adobe Acrobat
86616A2DB28CBDE470874BD61E8C9B1B - C:\Users\Franta\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll - Unity Player


==== Chromium Look ======================

HKEY_LOCAL_MACHINE\SOFTWARE\Google\Chrome\Extensions
gomekmidlodglbbmalcneegieacbdmki - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx[22.11.2014 18:04]
lifbcibllhkdhoafpjfnlhfpfgnpldfl - C:\Program Files\Skype\Toolbars\ChromeExtension\skype_chrome_extension.crx[14.07.2014 17:22]

HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\Extensions
fkkcgfbgohboipdhliafmacjnhjbhmim - No path found[]

Skype Click to Call - Franta\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl

==== Chromium Startpages ======================

C:\Users\Franta\AppData\Local\Google\Chrome\User Data\Default\Preferences
443":{"supports_spdy":true},"fls.doubleclick.net:443":{"alternate_protocol":{"port":443,"protocol_str":"quic"},"settings":{"4":100,"5":32,"6":0},"supports_spdy":true},"fonts.googleapis.com:443":{"alternate_protocol":{"port":443,"protocol_str":"quic"},"settings":{"4":100,"5":32,"6":0},"supports_spdy":true},"fonts.googleapis.com:80":{"alternate_protocol":{"port":80,"protocol_str":"quic"},"supports_spdy":false},"googleads.g.doubleclick.net:443":{"alternate_protocol":{"port":443,"protocol_str":"quic"},"settings":{"4":100,"5":32,"6":0},"supports_spdy":true},"googleads.g.doubleclick.net:80":{"alternate_protocol":{"port":80,"protocol_str":"quic"},"supports_spdy":false},"i1.ytimg.com:80":{"alternate_protocol":{"port":80,"protocol_str":"quic"},"supports_spdy":false},"lh3.googleusercontent.com:443":{"alternate_protocol":{"port":443,"protocol_str":"quic"},"supports_spdy":false},"lh4.googleusercontent.com:443":{"alternate_protocol":{"port":443,"protocol_str":"quic"},"supports_spdy":false},"lh5.googleusercontent.com:443":{"alternate_protocol":{"port":443,"protocol_str":"quic"},"supports_spdy":false},"lh6.googleusercontent.com:443":{"alternate_protocol":{"port":443,"protocol_str":"quic"},"supports_spdy":false},"oauth.googleusercontent.com:443":{"alternate_protocol":{"port":443,"protocol_str":"quic"},"settings":{"4":100,"5":32,"6":0},"supports_spdy":true},"p4-al34s25hwkaei-ype5sxla3je4wqjl-721772-i1-v6exp3-ds.metric.gstatic.com:80":{"alternate_protocol":{"port":80,"protocol_str":"quic"},"supports_spdy":false},"p4-al34s25hwkaei-ype5sxla3je4wqjl-721772-i2-v6exp3-v4.metric.gstatic.com:80":{"alternate_protocol":{"port":80,"protocol_str":"quic"},"supports_spdy":false},"p4-al34s25hwkaei-ype5sxla3je4wqjl-if-v6exp3-v4.metric.gstatic.com:80":{"alternate_protocol":{"port":80,"protocol_str":"quic"},"supports_spdy":false},"pagead2.googlesyndication.com:80":{"alternate_protocol":{"port":80,"protocol_str":"quic"},"supports_spdy":false},"partner.googleadservices.com:80":{"alternate_protocol":{"port":80,"protocol_str":"quic"},"supports_spdy":false},"pixel.facebook.com:443":{"supports_spdy":true},"pubads.g.doubleclick.net:80":{"alternate_protocol":{"port":80,"protocol_str":"quic"},"supports_spdy":false},"r1---sn-oxwu8-2gbe.c.pack.google.com:80":{"alternate_protocol":{"port":80,"protocol_str":"quic"},"supports_spdy":false},"s.ytimg.com:80":{"alternate_protocol":{"port":80,"protocol_str":"quic"},"supports_spdy":false},"scontent-a-fra.xx.fbcdn.net:443":{"supports_spdy":true},"scontent-a.xx.fbcdn.net:443":{"supports_spdy":true},"scontent-b-fra.xx.fbcdn.net:443":{"supports_spdy":true},"scontent-fra.xx.fbcdn.net:443":{"supports_spdy":true},"ssl.google-analytics.com:443":{"alternate_protocol":{"port":443,"protocol_str":"quic"},"settings":{"4":100,"5":11,"6":0},"supports_spdy":true},"ssl.gstatic.com:443":{"alternate_protocol":{"port":443,"protocol_str":"quic"},"settings":{"4":100,"5":49,"6":0},"supports_spdy":true},"ssl.gstatic.com:80":{"alternate_protocol":{"port":80,"protocol_str":"quic"},"supports_spdy":false},"stats.g.doubleclick.net:80":{"alternate_protocol":{"port":80,"protocol_str":"quic"},"supports_spdy":false},"themes.googleusercontent.com:443":{"alternate_protocol":{"port":443,"protocol_str":"quic"},"settings":{"4":100,"5":41,"6":1},"supports_spdy":true},"themes.googleusercontent.com:80":{"alternate_protocol":{"port":80,"protocol_str":"quic"},"supports_spdy":false},"translate.google.cz:80":{"alternate_protocol":{"port":80,"protocol_str":"quic"},"supports_spdy":false},"twitterjs.googlecode.com:80":{"alternate_protocol":{"port":80,"protocol_str":"quic"},"supports_spdy":false},"www.facebook.com:443":{"supports_spdy":true},"www.google-analytics.com:443":{"settings":{"4":100},"supports_spdy":true},"www.google-analytics.com:80":{"alternate_protocol":{"port":80,"protocol_str":"quic"},"supports_spdy":false},"www.google.com:443":{"alternate_protocol":{"port":443,"protocol_str":"quic"},"settings":{"4":100,"5":54,"6":0},"supports_spdy":true},"www.google.com:80":{"alternate_protocol":{"port":80,"protocol_str":"quic"},"supports_spdy":false},"www.google.cz:443":{"alternate_protocol":{"port":443,"protocol_str":"quic"},"settings":{"4":100,"5":53,"6":0},"supports_spdy":true},"www.google.cz:80":{"alternate_protocol":{"port":80,"protocol_str":"quic"},"supports_spdy":false},"www.googleadservices.com:443":{"alternate_protocol":{"port":443,"protocol_str":"quic"},"settings":{"4":100,"5":32,"6":0},"supports_spdy":true},"www.googleadservices.com:80":{"alternate_protocol":{"port":80,"protocol_str":"quic"},"supports_spdy":false},"www.gstatic.com:443":{"alternate_protocol":{"port":443,"protocol_str":"quic"},"settings":{"4":100,"5":42,"6":0},"supports_spdy":true},"www.gstatic.com:80":{"alternate_protocol":{"port":80,"protocol_str":"quic"},"supports_spdy":false},"www.youtube.com:80":{"alternate_protocol":{"port":80,"protocol_str":"quic"},"supports_spdy":false}},"version":2}},"pinned_tabs":[],"plugins":{"migrated_to_pepper_flash":true,"plugins_list":[],"removed_old_component_pepper_flash_settings":true},"printing":{"print_preview_sticky_settings":{"appState":"{\"version\":2,\"isGcpPromoDismissed\":false,\"selectedDestinationId\":\"Canon MP210 series Printer\",\"selectedDestinationOrigin\":\"local\",\"isColorEnabled\":false}"}},"profile":{"avatar_index":0,"content_settings":{"clear_on_exit_migrated":true,"pattern_pairs":{},"pref_version":1},"exit_type":"SessionEnded","exited_cleanly":true,"icon_version":2,"managed_user_id":"","name":"PrvnĂ­ uĹľivatel","password_manager_groups_for_domains":[null,null,null,null,null,null,6]},"session":{"restore_on_startup":4,"restore_on_startup_migrated":true,"startup_urls":["http://www.msn.com/?pc=UP97&ocid=UP97DHP","http://www.google.com"],"startup_urls_migration_time":"13037190524294786"},"sync_promo":{"show_on_first_run_allowed":false},"translate_blocked_languages":["cs"],"translate_whitelists":{}}


==== Set IE to Default ======================

Old Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"="http://www.msn.com/?pc=UP97&ocid=UP97DHP"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
"Start Page"="http://www.google.com"

New Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"="http://www.msn.com/?pc=UP97&ocid=UP97DHP"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
"Start Page"="http://go.microsoft.com/fwlink/?LinkId=69157"

==== All HKCU SearchScopes ======================

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes
"DefaultScope"="{0633EE93-D776-472f-A0FF-E1416B8B2E3A}"
{012E1000-F331-11DB-8314-0800200C9A66} Google Url="http://www.google.com/search?q={searchTerms}"
{05B9F773-AD75-405C-BE3C-9B53C72B8595} Zbo§ˇ.cz Url="http://www.zbozi.cz/?q={searchTerms}&r=campmoz&sourceid=QuickSearch_5"
{0633EE93-D776-472f-A0FF-E1416B8B2E3A} Bing Url="http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IESR02"
{0D3C4DF7-3D2E-461A-B6A2-85CD1DE929A5} Seznam TV Program Url="http://tv.seznam.cz/hledej?w={searchTerms}&sourceid=QuickSearch_5"
{2268150A-EA2B-4C5D-8518-CA26F71B940A} Slovnˇk CZ/EN Url="http://slovnik.seznam.cz/?q={searchTerms}&lang=cz_en&sourceid=QuickSearch_5"
{3D8995A7-D972-4793-AE11-A8B233804652} Firmy.cz Url="http://www.firmy.cz/?q={searchTerms}&sourceid=QuickSearch_5"
{55DBE0B9-996A-4384-B7C5-F4D278343CBD} Mapy.cz Url="http://www.mapy.cz/?query={searchTerms}&sourceid=QuickSearch_5"
{57079F8B-B1DD-48CA-B731-BF9191F0420C} Novinky.cz Url="http://www.novinky.cz/hledej?w={searchTerms}&sourceid=QuickSearch_5"
{64C3A481-67EB-435B-B229-9B79AA0A0326} Slovnˇk EN/CZ Url="http://slovnik.seznam.cz/?q={searchTerms}&lang=en_cz&sourceid=QuickSearch_5"
{AEF6421B-6EEB-4D9E-9430-8C490959B7F3} Encyklopedie Seznam Url="http://encyklopedie.seznam.cz/search?q={searchTerms}&sourceid=QuickSearch_5"

==== Reset Google Chrome ======================

C:\Users\Franta\AppData\Local\Google\Chrome\User Data\Default\Preferences was reset successfully
C:\Users\Franta\AppData\Local\Google\Chrome\User Data\Default\Web Data was reset successfully

==== Deleting Registry Keys ======================

HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\Extensions\fkkcgfbgohboipdhliafmacjnhjbhmim deleted successfully

==== Empty IE Cache ======================

C:\Users\Franta\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\serviceprofiles\networkservice\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\serviceprofiles\Localservice\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully

==== Empty FireFox Cache ======================

C:\Users\Franta\AppData\Local\Mozilla\Firefox\Profiles\95ma8vcw.default\cache2 emptied successfully

==== Empty Chrome Cache ======================

C:\Users\Franta\AppData\Local\Google\Chrome\User Data\Default\Cache emptied successfully

==== Empty All Flash Cache ======================

Flash Cache Emptied Successfully

==== Empty All Java Cache ======================

No Java Cache Found

==== C:\zoek_backup content ======================

C:\zoek_backup (files=59 folders=9 86713409 bytes)

==== Empty Temp Folders ======================

C:\Users\Default\AppData\Local\Temp emptied successfully
C:\Users\Default User\AppData\Local\Temp emptied successfully
C:\Users\Franta\AppData\Local\Temp will be emptied at reboot
C:\Windows\serviceprofiles\networkservice\AppData\Local\Temp will be emptied at reboot
C:\Windows\serviceprofiles\Localservice\AppData\Local\Temp emptied successfully
C:\Windows\Temp will be emptied at reboot

==== After Reboot ======================

==== Empty Temp Folders ======================

C:\Windows\Temp successfully emptied
C:\Users\Franta\AppData\Local\Temp successfully emptied

==== Empty Recycle Bin ======================

C:\$RECYCLE.BIN successfully emptied

==== Deleting Files / Folders ======================

"C:\Windows\serviceprofiles\networkservice\AppData\Local\Temp\Low" not deleted

==== EOF on ne 23.11.2014 at 11:02:00,55 ======================

Re: Malware našlo asi 150 hrozeb

Napsal: 23 lis 2014 17:27
od kodl74
Mohl bych poprosit o koncovou kontrolu logů, potřebuji ten PC dneska ještě odevzdat. Děkuji za pochopení.

Re: Malware našlo asi 150 hrozeb

Napsal: 23 lis 2014 17:50
od Pic
To musíš vyčkat, až se objeví některý z virobijců. Nemohou tady být stále. To je jejich dobrovolná činnost.

Re: Malware našlo asi 150 hrozeb

Napsal: 24 lis 2014 09:46
od jaro3
Vlož nový log z HJT + info o problémech.

Re: Malware našlo asi 150 hrozeb

Napsal: 24 lis 2014 11:48
od kodl74
Pc už nemám u sebe, ale pc se chovalo normálně, problémy sem nenalezl žádné. Dík moc za kontrolu.

Re: Malware našlo asi 150 hrozeb  Vyřešeno

Napsal: 25 lis 2014 09:48
od jaro3
Pokud nejsou problémy , je to vše a můžeš dát vyřešeno , zelenou fajfku.
Časové pásmo: UTC+02:00
Stránka 1 z 1
Powered by phpBB® Forum Software © phpBB Limited
https://www.phpbb.com/