Kontrola logu - zásuvný model Shockwave Flash vypadává

[Janase]

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 9:58:50, on 27.9.2014
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v9.00 (9.00.8112.16575)

FIREFOX: 32.0.3 (x86 cs)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskhost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Microsoft Security Client\msseces.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe
C:\Program Files\HP\HP Software Update\hpwuschd2.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe
C:\Program Files\RelevantKnowledge\rlvknlg.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\PROGRA~1\RELEVA~1\rlvknlg32.exe
C:\Users\Jana\Desktop\install_flashplayer15x32_mssd_awc_aih.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_15_0_0_152.exe
C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_15_0_0_152.exe
C:\Windows\system32\wuauclt.exe
C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_15_0_0_152.exe
C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_15_0_0_152.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_15_0_0_152.exe
C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_15_0_0_152.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Users\Jana\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: MSS+ Identifier - {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} - C:\Program Files\McAfee Security Scan\3.8.150\McAfeeMSS_IE.dll
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: Bing Bar BHO - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files\MSN Toolbar\Platform\6.3.2291.0\npwinext.dll
O3 - Toolbar: @C:\Program Files\MSN Toolbar\Platform\6.3.2291.0\npwinext.dll,-100 - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files\MSN Toolbar\Platform\6.3.2291.0\npwinext.dll
O4 - HKLM\..\Run: [MSC] "c:\Program Files\Microsoft Security Client\msseces.exe" -hide -runkey
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [ApnTBMon] "C:\Program Files\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [Microsoft Default Manager] "C:\Program Files\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" -resume
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\RunOnce: [SPReview] "C:\Windows\System32\SPReview\SPReview.exe" /sp:1 /errorfwlink:"http://go.microsoft.com/fwlink/?LinkID=122915" /build:7601 (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [SPReview] "C:\Windows\System32\SPReview\SPReview.exe" /sp:1 /errorfwlink:"http://go.microsoft.com/fwlink/?LinkID=122915" /build:7601 (User 'Default user')
O4 - Global Startup: McAfee Security Scan Plus.lnk = C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O9 - Extra button: Odeslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Od&eslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: Ask Update Service (APNMCP) - APN LLC. - C:\Program Files\AskPartnerNetwork\Toolbar\apnmcp.exe
O23 - Service: COMODO Dragon Update Service (DragonUpdater) - Unknown owner - C:\Program Files\Comodo\Dragon\dragon_updater.exe
O23 - Service: McAfee Security Scan Component Host Service (McComponentHostService) - McAfee, Inc. - C:\Program Files\McAfee Security Scan\3.8.150\McCHSvc.exe
O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe
O23 - Service: RelevantKnowledge - TMRG, Inc. - C:\Program Files\RelevantKnowledge\rlservice.exe

--
End of file - 6752 bytes

[Reklama]

[memphisto]

Stáhni si ATF Cleaner
Poklepej na ATF Cleaner.exe, klikni na select all found, poté:
-Když používáš Firefox (Mozzila), klikni na Firefox nahoře a vyber: Select All, poté klikni na Empty Selected.
-Když používáš Operu, klikni nahoře na Operu a vyber: Select All, poté klikni na Empty Selected.
Po vyčištění klikni na Exit k zavření programu.
ATF-Cleaner je jednoduchý nástroj na odstranìní historie z webového prohlížeče. Program dokáže odstranit cache, cookies, historii a další stopy po surfování na Internetu. Mezi podporované prohlížeče patří Internet Explorer, Firefox a Opera. Aplikace navíc umí odstranit doèasné soubory Windows, vysypat koš atd.
- Pokud používáš jen Google Chrome , tak ATF nemusíš použít.

Stáhni si TFC
Otevři soubor a zavři všechny ostatní okna, Klikni na Start k zahájení procesu. Program by neměl trvat dlouho.
Poté by se měl PC restartovat, pokud ne , proveď sám.

Stáhni AdwCleaner
Ulož si ho na svojí plochu
Ukonči všechny programy, okna a prohlížeče
Spusť program poklepáním a klikni na „Search“
Po skenu se objeví log (jinak je uložen systémovem disku jako AdwCleaner[R?].txt), jeho obsah sem celý vlož.


Stáhni si Malwarebytes' Anti-Malware
Nainstaluj a spusť ho
- na konci instalace se ujisti že máš zvoleny/zatrhnuty obě možnosti:
Update Malwarebytes' Anti-Malware (Aktualizace Malwarebytes' Anti-Malware) a Launch Malwarebytes' Anti-Malware (Spustit aplikaci Malwarebytes' Anti-Malware), pokud jo tak klikni na tlačítko Finish
- pokud bude nalezena aktualizace, tak se stáhne a nainstaluje
- program se po té spustí a nech vybranou možnost Perform Quick Scan (Provést rychlý sken) a klikni na tlačítko Scan (Skenovat)
- po probìhnutí programu se ti objeví hláška tak klikni na OK a pak na tlačítko Show Results
- pak zvol možnost Save Logfile a ulož si log na plochu
- po té klikni na tlačítko Exit, objeví se ti hláška tak zvol Ano
(zatím nic nemaž!).
Vlož sem pak obsah toho logu.

[Janase]

AdwCleaner

# AdwCleaner v4.000 - Report created 19/10/2014 at 10:27:29
# Updated 12/10/2014 by Xplode
# Database : 2014-10-17.9
# Operating System : Windows 7 Home Premium Service Pack 1 (32 bits)
# Username : Jana - JANA-PC
# Running from : C:\Users\Jana\Desktop\adwcleaner_4.000.exe
# Option : Scan

***** [ Services ] *****

Service Found : APNMCP
Service Found : RelevantKnowledge

***** [ Files / Folders ] *****

File Found : C:\Users\Jana\AppData\Roaming\Mozilla\Firefox\Profiles\m805vyor.default\searchplugins\ask-search.xml
File Found : C:\Windows\system32\rlls.dll
Folder Found : C:\Program Files\AskPartnerNetwork
Folder Found : C:\Program Files\RelevantKnowledge
Folder Found : C:\ProgramData\apn
Folder Found : C:\ProgramData\AskPartnerNetwork
Folder Found : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\RelevantKnowledge
Folder Found : C:\Users\Jana\AppData\Local\Temp\apn
Folder Found : C:\Users\Jana\AppData\Roaming\OpenCandy

***** [ Scheduled Tasks ] *****


***** [ Shortcuts ] *****


***** [ Registry ] *****

Key Found : HKCU\Software\AskPartnerNetwork
Key Found : HKLM\SOFTWARE\AskPartnerNetwork
Key Found : HKLM\SOFTWARE\Classes\AppID\NCTAudioCDGrabber2.DLL
Key Found : HKLM\SOFTWARE\Classes\CLSID\{35B8892D-C3FB-4D88-990D-31DB2EBD72BD}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{5EB0259D-AB79-4AE6-A6E6-24FFE21C3DA4}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{CADAF6BE-BF50-4669-8BFD-C27BD4E6181B}
Key Found : HKLM\SOFTWARE\Classes\Interface\{2BEF239C-752E-4001-8048-F256E0D8CD93}
Key Found : HKLM\SOFTWARE\Classes\Interface\{3F607E46-0D3C-4442-B1DE-DE7FA4768F5C}
Key Found : HKLM\SOFTWARE\Classes\Interface\{49C00A51-6E59-41FE-B3FA-2D2157FAD67B}
Key Found : HKLM\SOFTWARE\Classes\Interface\{6DFF5DBA-AE3A-46DB-B301-ECFFC6DB2982}
Key Found : HKLM\SOFTWARE\Classes\Interface\{DE34CD67-F1C8-4001-9A23-B8A68F63F377}
Key Found : HKLM\SOFTWARE\Classes\Interface\{FE0273D1-99DF-4AC0-87D5-1371C6271785}
Key Found : HKLM\SOFTWARE\Classes\TypeLib\{93E3D79C-0786-48FF-9329-93BC9F6DC2B3}
Key Found : HKLM\SOFTWARE\Google\Chrome\Extensions\bopakagnckmlgajfccecajhnimjiiedh
Key Found : HKLM\SOFTWARE\Microsoft\Tracing\ApnSetup_RASAPI32
Key Found : HKLM\SOFTWARE\Microsoft\Tracing\ApnSetup_RASMANCS
Key Found : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASAPI32
Key Found : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASMANCS
Key Found : HKLM\SOFTWARE\Microsoft\Tracing\askpartnercobrandingtool_rasapi32
Key Found : HKLM\SOFTWARE\Microsoft\Tracing\askpartnercobrandingtool_rasmancs
Key Found : HKLM\SOFTWARE\Microsoft\Tracing\AskSLib_RASAPI32
Key Found : HKLM\SOFTWARE\Microsoft\Tracing\AskSLib_RASMANCS
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{D08D9F98-1C78-4704-87E6-368B0023D831}
Value Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [ApnTbMon]

***** [ Browsers ] *****

-\\ Internet Explorer v9.0.8112.16584


-\\ Mozilla Firefox v32.0.3 (x86 cs)


*************************

AdwCleaner[R0].txt - [2988 octets] - [19/10/2014 10:27:29]

########## EOF - C:\AdwCleaner\AdwCleaner[R0].txt - [3048 octets] ##########

[Janase]

Malwarebytes Anti-Malware
www.malwarebytes.org

Scan Date: 19.10.2014
Scan Time: 10:42:36
Logfile: Malwarebytes Anti-Malware.txt
Administrator: Yes

Version: 2.00.2.1012
Malware Database: v2014.10.19.02
Rootkit Database: v2014.10.17.01
License: Trial
Malware Protection: Enabled
Malicious Website Protection: Enabled
Self-protection: Disabled

OS: Windows 7 Service Pack 1
CPU: x86
File System: NTFS
User: Jana

Scan Type: Threat Scan
Result: Completed
Objects Scanned: 280964
Time Elapsed: 14 min, 0 sec

Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled

Processes: 3
PUP.Optional.RelevantKnowledge, C:\Program Files\RelevantKnowledge\rlservice.exe, 1652, , [c4caab6bafcdbc7a76f38caca85da35d]
PUP.Optional.RelevantKnowledge, C:\Program Files\RelevantKnowledge\rlvknlg.exe, 3700, , [f09e2de97408b383d198063210f540c0]
PUP.Optional.RelevantKnowledge, C:\Program Files\RelevantKnowledge\rlvknlg32.exe, 2340, , [fc9248ce2557d95d24451b1d0ef7837d]

Modules: 40
PUP.Optional.RelevantKnowledge, C:\Windows\System32\rlls.dll, , [d9b5fc1a84f8e65086e3c375c2438e72],
PUP.Optional.RelevantKnowledge, C:\Windows\System32\rlls.dll, , [d9b5fc1a84f8e65086e3c375c2438e72],
PUP.Optional.RelevantKnowledge, C:\Windows\System32\rlls.dll, , [d9b5fc1a84f8e65086e3c375c2438e72],
PUP.Optional.RelevantKnowledge, C:\Windows\System32\rlls.dll, , [d9b5fc1a84f8e65086e3c375c2438e72],
PUP.Optional.RelevantKnowledge, C:\Windows\System32\rlls.dll, , [d9b5fc1a84f8e65086e3c375c2438e72],
PUP.Optional.RelevantKnowledge, C:\Windows\System32\rlls.dll, , [d9b5fc1a84f8e65086e3c375c2438e72],
PUP.Optional.RelevantKnowledge, C:\Windows\System32\rlls.dll, , [d9b5fc1a84f8e65086e3c375c2438e72],
PUP.Optional.RelevantKnowledge, C:\Windows\System32\rlls.dll, , [d9b5fc1a84f8e65086e3c375c2438e72],
PUP.Optional.RelevantKnowledge, C:\Windows\System32\rlls.dll, , [d9b5fc1a84f8e65086e3c375c2438e72],
PUP.Optional.RelevantKnowledge, C:\Windows\System32\rlls.dll, , [d9b5fc1a84f8e65086e3c375c2438e72],
PUP.Optional.RelevantKnowledge, C:\Windows\System32\rlls.dll, , [d9b5fc1a84f8e65086e3c375c2438e72],
PUP.Optional.RelevantKnowledge, C:\Windows\System32\rlls.dll, , [d9b5fc1a84f8e65086e3c375c2438e72],
PUP.Optional.RelevantKnowledge, C:\Windows\System32\rlls.dll, , [d9b5fc1a84f8e65086e3c375c2438e72],
PUP.Optional.RelevantKnowledge, C:\Windows\System32\rlls.dll, , [d9b5fc1a84f8e65086e3c375c2438e72],
PUP.Optional.RelevantKnowledge, C:\Windows\System32\rlls.dll, , [d9b5fc1a84f8e65086e3c375c2438e72],
PUP.Optional.RelevantKnowledge, C:\Windows\System32\rlls.dll, , [d9b5fc1a84f8e65086e3c375c2438e72],
PUP.Optional.RelevantKnowledge, C:\Windows\System32\rlls.dll, , [d9b5fc1a84f8e65086e3c375c2438e72],
PUP.Optional.RelevantKnowledge, C:\Windows\System32\rlls.dll, , [d9b5fc1a84f8e65086e3c375c2438e72],
PUP.Optional.RelevantKnowledge, C:\Windows\System32\rlls.dll, , [d9b5fc1a84f8e65086e3c375c2438e72],
PUP.Optional.RelevantKnowledge, C:\Windows\System32\rlls.dll, , [d9b5fc1a84f8e65086e3c375c2438e72],
Trojan.Agent, C:\Windows\System32\rlls.dll, , [434b9b7bc1bb1f17fb4d5b4954af8a76],
Trojan.Agent, C:\Windows\System32\rlls.dll, , [434b9b7bc1bb1f17fb4d5b4954af8a76],
Trojan.Agent, C:\Windows\System32\rlls.dll, , [434b9b7bc1bb1f17fb4d5b4954af8a76],
Trojan.Agent, C:\Windows\System32\rlls.dll, , [434b9b7bc1bb1f17fb4d5b4954af8a76],
Trojan.Agent, C:\Windows\System32\rlls.dll, , [434b9b7bc1bb1f17fb4d5b4954af8a76],
Trojan.Agent, C:\Windows\System32\rlls.dll, , [434b9b7bc1bb1f17fb4d5b4954af8a76],
Trojan.Agent, C:\Windows\System32\rlls.dll, , [434b9b7bc1bb1f17fb4d5b4954af8a76],
Trojan.Agent, C:\Windows\System32\rlls.dll, , [434b9b7bc1bb1f17fb4d5b4954af8a76],
Trojan.Agent, C:\Windows\System32\rlls.dll, , [434b9b7bc1bb1f17fb4d5b4954af8a76],
Trojan.Agent, C:\Windows\System32\rlls.dll, , [434b9b7bc1bb1f17fb4d5b4954af8a76],
Trojan.Agent, C:\Windows\System32\rlls.dll, , [434b9b7bc1bb1f17fb4d5b4954af8a76],
Trojan.Agent, C:\Windows\System32\rlls.dll, , [434b9b7bc1bb1f17fb4d5b4954af8a76],
Trojan.Agent, C:\Windows\System32\rlls.dll, , [434b9b7bc1bb1f17fb4d5b4954af8a76],
Trojan.Agent, C:\Windows\System32\rlls.dll, , [434b9b7bc1bb1f17fb4d5b4954af8a76],
Trojan.Agent, C:\Windows\System32\rlls.dll, , [434b9b7bc1bb1f17fb4d5b4954af8a76],
Trojan.Agent, C:\Windows\System32\rlls.dll, , [434b9b7bc1bb1f17fb4d5b4954af8a76],
Trojan.Agent, C:\Windows\System32\rlls.dll, , [434b9b7bc1bb1f17fb4d5b4954af8a76],
Trojan.Agent, C:\Windows\System32\rlls.dll, , [434b9b7bc1bb1f17fb4d5b4954af8a76],
Trojan.Agent, C:\Windows\System32\rlls.dll, , [434b9b7bc1bb1f17fb4d5b4954af8a76],
Trojan.Agent, C:\Windows\System32\rlls.dll, , [434b9b7bc1bb1f17fb4d5b4954af8a76],

Registry Keys: 2
PUP.Optional.RelevantKnowledge, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\RelevantKnowledge, , [c4caab6bafcdbc7a76f38caca85da35d],
PUP.Optional.RelevantKnowledge, HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{d08d9f98-1c78-4704-87e6-368b0023d831}, , [f09e2de97408b383d198063210f540c0],

Registry Values: 0
(No malicious items detected)

Registry Data: 0
(No malicious items detected)

Folders: 5
PUP.Optional.MarketScore, C:\Program Files\RelevantKnowledge, , [aee048ce9be14ee81f9236ac986a22de],
PUP.Optional.MarketScore, C:\ProgramData\Microsoft\Windows\Start Menu\Programs\RelevantKnowledge, , [216df521136976c0e9eacc19d9294ab6],
PUP.Optional.OpenCandy, C:\Users\Jana\AppData\Roaming\OpenCandy, , [6e2010063448e551567bb636a55d08f8],
PUP.Optional.OpenCandy, C:\Users\Jana\AppData\Roaming\OpenCandy\93C5C093E0554BA3A2BB581B724636B0, , [6e2010063448e551567bb636a55d08f8],
PUP.Optional.OpenCandy, C:\Users\Jana\AppData\Roaming\OpenCandy\OpenCandy_93C5C093E0554BA3A2BB581B724636B0, , [6e2010063448e551567bb636a55d08f8],

Files: 18
PUP.Optional.RelevantKnowledge, C:\Windows\System32\rlls.dll, , [d9b5fc1a84f8e65086e3c375c2438e72],
PUP.Optional.RelevantKnowledge, C:\Program Files\RelevantKnowledge\rlservice.exe, , [c4caab6bafcdbc7a76f38caca85da35d],
PUP.Optional.RelevantKnowledge, C:\Program Files\RelevantKnowledge\rlvknlg.exe, , [f09e2de97408b383d198063210f540c0],
PUP.Optional.RelevantKnowledge, C:\Program Files\RelevantKnowledge\rlvknlg32.exe, , [fc9248ce2557d95d24451b1d0ef7837d],
PUP.Optional.RelevantKnowledge, C:\Program Files\RelevantKnowledge\rlls.dll, , [4c42d34389f3bb7bf277c57333d244bc],
PUP.Optional.RelevantKnowledge, C:\Program Files\RelevantKnowledge\rlls64.dll, , [fb9376a06517d660d891999f47be4eb2],
PUP.Optional.RelevantKnowledge, C:\Program Files\RelevantKnowledge\rlvknlg64.exe, , [d0be73a337457eb8bcad73c5f213f907],
Trojan.Agent, C:\Windows\System32\rlls.dll, , [434b9b7bc1bb1f17fb4d5b4954af8a76],
PUP.Optional.MarketScore, C:\Program Files\RelevantKnowledge\ncncf.dat, , [aee048ce9be14ee81f9236ac986a22de],
PUP.Optional.MarketScore, C:\Program Files\RelevantKnowledge\nscf.dat, , [aee048ce9be14ee81f9236ac986a22de],
PUP.Optional.MarketScore, C:\Program Files\RelevantKnowledge\readme.txt, , [aee048ce9be14ee81f9236ac986a22de],
PUP.Optional.MarketScore, C:\Program Files\RelevantKnowledge\rloci.bin, , [aee048ce9be14ee81f9236ac986a22de],
PUP.Optional.MarketScore, C:\ProgramData\Microsoft\Windows\Start Menu\Programs\RelevantKnowledge\About RelevantKnowledge.lnk, , [216df521136976c0e9eacc19d9294ab6],
PUP.Optional.MarketScore, C:\ProgramData\Microsoft\Windows\Start Menu\Programs\RelevantKnowledge\Member of GRID - Goodware Repository Information Database.lnk, , [216df521136976c0e9eacc19d9294ab6],
PUP.Optional.MarketScore, C:\ProgramData\Microsoft\Windows\Start Menu\Programs\RelevantKnowledge\Privacy Policy and User License Agreement.lnk, , [216df521136976c0e9eacc19d9294ab6],
PUP.Optional.MarketScore, C:\ProgramData\Microsoft\Windows\Start Menu\Programs\RelevantKnowledge\Support.lnk, , [216df521136976c0e9eacc19d9294ab6],
PUP.Optional.MarketScore, C:\ProgramData\Microsoft\Windows\Start Menu\Programs\RelevantKnowledge\Uninstall Instructions.lnk, , [216df521136976c0e9eacc19d9294ab6],
PUP.Optional.OpenCandy, C:\Users\Jana\AppData\Roaming\OpenCandy\93C5C093E0554BA3A2BB581B724636B0\avg_tuht_stf_cs_2014_206_CZ.exe, , [6e2010063448e551567bb636a55d08f8],

Physical Sectors: 0
(No malicious items detected)


(end)

[Orcus]

Znovu spusť MbAM a dej Skenovat nyní
Po proběhnutí programu se ti objeví hláška, tak klikni na „Vše do karantény“ -> „Exportovat záznam“ a vyber „textový soubor“ , soubor nějak pojmenuj a ulož na Plochu.
Zkopíruj sem celý obsah toho logu.

====================================================

Spusť znovu AdwCleaner (u Windows Vista či Windows7, klikni na AdwCleaner pravým a vyber „Spustit jako správce“
Klikni na „ Smazat“
Program provede opravu, po automatickém restartu neukáže log (C:\AdwCleaner [S?].txt) , jeho obsah sem celý vlož.

====================================================

Stáhni si Junkware Removal Tool

na svojí plochu.
Deaktivuj si svůj antivirový program.
Pravým tl. myši klikni na JRT.exe a vyber „spustit jako správce“. Pro pokračování budeš vyzván ke stisknutí jakékoliv klávesy. Na nějakou klikni.
Začne skenování programu. Skenování může trvat dloho , podle množství nákaz. Po ukončení skenu se objeví log (JRT.txt) , který se uloží na ploše.
Zkopíruj sem prosím celý jeho obsah.

====================================================

Stáhni si RogueKiller
32bit.:
http://www.sur-la-toile.com/RogueKiller/RogueKiller.exe
64bit.:
http://www.sur-la-toile.com/RogueKiller ... lerX64.exe
na svojí plochu.
- Zavři všechny ostatní programy a prohlížeče.
- Pro OS Vista a win7 spusť program RogueKiller.exe jako správce , u XP poklepáním.
- počkej až skončí Prescan -vyhledávání škodlivých procesů.
- Zkontroluj , zda máš zaškrtnuto:
Kontrola MBR
Kontrola Faked
Antirootkit
-Potom klikni na „Prohledat“.
- Program skenuje procesy PC. Po proskenování klikni na „Zpráva“celý obsah logu sem zkopíruj.
Pokud je program blokován , zkus ho spustit několikrát. Pokud dále program nepůjde spustit a pracovat, přejmenuj ho na winlogon.exe.