Kontrola PC , někdo mi změnil hesla. Vyřešeno

[extrem]

U toho Rogue vypnout antivir ? Teď jsem to dodělal , takže znova?

[Reklama]

[jaro3]

ne , dej to sem.

[extrem]

RogueKiller V10.10.2.0 (x64) [Aug 24 2015] by Adlice Software
mail : http://www.adlice.com/contact/
Feedback : http://forum.adlice.com
Webová stránka : http://www.adlice.com/softwares/roguekiller/
Blog : http://www.adlice.com

Operační systém : Windows 7 (6.1.7601 Service Pack 1) 64 bits version
Spuštěno : Normální režim
Uživatel : Omi [Práva správce]
Started from : C:\Users\Omi\Desktop\RogueKillerX64 (1).exe
Mód : Prohledat -- Datum : 08/29/2015 09:12:22

¤¤¤ Procesy : 0 ¤¤¤

¤¤¤ Registry : 4 ¤¤¤
[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters | DhcpNameServer : 84.16.120.1 84.16.96.2 ([CZECH REPUBLIC (CZ)][-]) -> Nalezeno
[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Tcpip\Parameters | DhcpNameServer : 84.16.120.1 84.16.96.2 ([CZECH REPUBLIC (CZ)][-]) -> Nalezeno
[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{09D762C9-851F-4096-9725-FC04E4042F32} | DhcpNameServer : 84.16.120.1 84.16.96.2 ([CZECH REPUBLIC (CZ)][-]) -> Nalezeno
[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Tcpip\Parameters\Interfaces\{09D762C9-851F-4096-9725-FC04E4042F32} | DhcpNameServer : 84.16.120.1 84.16.96.2 ([CZECH REPUBLIC (CZ)][-]) -> Nalezeno

¤¤¤ Úlohy : 0 ¤¤¤

¤¤¤ Soubory : 0 ¤¤¤

¤¤¤ Soubor HOSTS : 1 ¤¤¤
[C:\Windows\System32\drivers\etc\hosts] 127.0.0.1 localhost

¤¤¤ Antirootkit : 7 (Driver: Nahrán) ¤¤¤
[IRP:Addr(Hook.IRP)] \SystemRoot\system32\DRIVERS\iaStor.sys - IRP_MJ_CREATE[0] : Unknown @ 0x4182469600000000
[IRP:Addr(Hook.IRP)] \SystemRoot\system32\DRIVERS\iaStor.sys - IRP_MJ_CLOSE[2] : Unknown @ 0x4182469600000000
[IRP:Addr(Hook.IRP)] \SystemRoot\system32\DRIVERS\iaStor.sys - IRP_MJ_DEVICE_CONTROL[14] : Unknown @ 0x4182469600000000
[IRP:Addr(Hook.IRP)] \SystemRoot\system32\DRIVERS\iaStor.sys - IRP_MJ_INTERNAL_DEVICE_CONTROL[15] : Unknown @ 0x4182469600000000
[IRP:Addr(Hook.IRP)] \SystemRoot\system32\DRIVERS\iaStor.sys - IRP_MJ_POWER[22] : Unknown @ 0x4182469600000000
[IRP:Addr(Hook.IRP)] \SystemRoot\system32\DRIVERS\iaStor.sys - IRP_MJ_SYSTEM_CONTROL[23] : Unknown @ 0x4182469600000000
[IRP:Addr(Hook.IRP)] \SystemRoot\system32\DRIVERS\iaStor.sys - IRP_MJ_PNP[27] : Unknown @ 0x4182469600000000

¤¤¤ Webové prohlížeče : 0 ¤¤¤

¤¤¤ Kontrola MBR : ¤¤¤
+++++ PhysicalDrive0: Hitachi HTS545032B9A300 +++++
--- User ---
[MBR] 6a8a5a113ace3f366907a0adf2a50c55
[BSP] ba0d570e2f477d886f46a91d49098dfb : HP|VT.Unknown MBR Code
Partition table:
0 - [XXXXXX] ACER (0x27) [VISIBLE] Offset (sectors): 2048 | Size: 13000 MB
1 - [ACTIVE] NTFS (0x7) [VISIBLE] Offset (sectors): 26626048 | Size: 100 MB [Windows Vista/7/8 Bootstrap | Windows Vista/7/8 Bootloader]
2 - [XXXXXX] NTFS (0x7) [VISIBLE] Offset (sectors): 26830848 | Size: 292142 MB [Windows Vista/7/8 Bootstrap | Windows Vista/7/8 Bootloader]
User = LL1 ... OK
User = LL2 ... OK

[jaro3]

Zavři všechny programy a prohlížeče. Deaktivuj antivir a firewall.
Prosím, odpoj všechny USB (kromě myši s klávesnice) nebo externí disky z počítače před spuštěním tohoto programu.
Spusť znovu RogueKiller ( Pro Windows Vista nebo Windows 7, klepni pravým a vyber "Spustit jako správce", ve Windows XP poklepej ke spuštění).
- Počkej, až Prescan dokončí práci...
- Pak klikni na "Prohledat " ,po jeho skončení:

- V záložkách (Registry , Tasks , Web Browser apod.) vše zatrhni (dej zatržítka)
(musíš dát myší zatržítko do toho čtverečku vlevo od registru ap.)

- Klikni na "Smazat"
- Počkej, dokud Status box nezobrazí " Mazání dokončeno "
- Klikni na "Zpráva " a zkopíruj a vlož obsah té zprávy prosím sem. Log je možno nalézt v RKreport [číslo]. txt na ploše.
- Zavři RogueKiller



Vypni antivir i firewall.
Stáhni
Zoek.exe

a uloz si ho na plochu.
Zavři všechny ostatní programy , okna i prohlížeče.
Spusť Zoek.exe ( u win vista , win7, 8 klikni na něj pravým a vyber : „Spustit jako správce“
- pozor , náběh programu může trvat déle.

Do okna programu vlož skript níže:

Kód: Vybrat vše

autoclean;
emptyclsid;
iedefaults;
FFdefaults;
CHRdefaults;
emptyalltemp;
resethosts;

klikni na Run Script
Program provede sken , opravu, sken i oprava může trvat i více minut ,je třeba posečkat do konce. Do okna neklikej!
Program nabídne restart , potvrď .

Po restartu se může nějaký čas ukázat pouze černá plocha , to je normální. Je třeba počkat až se vytvoří log. Ten si můžeš uložit třeba do dokumentů , jinak se sám ukládá do:
C:\zoek-results.log
Zkopíruj sem celý obsah toho logu.

Vypni rez. ochranu u antiviru a antispywaru,příp. firewall..

Stáhni si ComboFix (by sUBs)
a ulož si ho na plochu.
Ukonči všechna aktivní okna a spusť ho.
- Po spuštění se zobrazí podmínky užití, potvrď je stiskem tlačítka Ano
- Dále postupuj dle pokynů, během aplikování ComboFixu neklikej do zobrazujícího se okna
- Po dokončení skenování by měl program vytvořit log - C:\ComboFix.txt - zkopíruj sem prosím celý jeho obsah
Pokud budou problémy , spusť ho v nouz. režimu.

Upozornění : Může se stát, že po aplikaci Combofixu a restartu počítače, Windows nenaběhnou , nebo nenajede plocha , budou problémy s připojením, pak znovu restartuj počítač, pokud to nepomůže , po restartu mačkej klávesu F8 a pak zvol poslední známou funkční konfiguraci. , či použij bod obnovy.

[extrem]

RogueKiller V10.10.2.0 (x64) [Aug 24 2015] by Adlice Software
mail : http://www.adlice.com/contact/
Feedback : http://forum.adlice.com
Webová stránka : http://www.adlice.com/softwares/roguekiller/
Blog : http://www.adlice.com

Operační systém : Windows 7 (6.1.7601 Service Pack 1) 64 bits version
Spuštěno : Normální režim
Uživatel : Omi [Práva správce]
Started from : C:\Users\Omi\Desktop\RogueKillerX64 (1).exe
Mód : Smazat -- Datum : 08/31/2015 10:13:38

¤¤¤ Procesy : 0 ¤¤¤

¤¤¤ Registry : 9 ¤¤¤
[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters | DhcpNameServer : 84.16.120.1 84.16.96.2 ([CZECH REPUBLIC (CZ)][-]) -> Nahrazeno ()
[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Tcpip\Parameters | DhcpNameServer : 84.16.120.1 84.16.96.2 ([CZECH REPUBLIC (CZ)][-]) -> Nahrazeno ()
[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\ControlSet002\Services\Tcpip\Parameters | DhcpNameServer : 84.16.120.1 84.16.96.2 ([CZECH REPUBLIC (CZ)][-]) -> Nahrazeno ()
[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{09D762C9-851F-4096-9725-FC04E4042F32} | DhcpNameServer : 84.16.120.1 84.16.96.2 ([CZECH REPUBLIC (CZ)][-]) -> Nahrazeno ()
[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{484C459F-8045-45C0-B14A-426E4A2EF2DA} | DhcpNameServer : 84.16.120.1 84.16.96.2 ([CZECH REPUBLIC (CZ)][-]) -> Nahrazeno ()
[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Tcpip\Parameters\Interfaces\{09D762C9-851F-4096-9725-FC04E4042F32} | DhcpNameServer : 84.16.120.1 84.16.96.2 ([CZECH REPUBLIC (CZ)][-]) -> Nahrazeno ()
[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Tcpip\Parameters\Interfaces\{484C459F-8045-45C0-B14A-426E4A2EF2DA} | DhcpNameServer : 84.16.120.1 84.16.96.2 ([CZECH REPUBLIC (CZ)][-]) -> Nahrazeno ()
[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\ControlSet002\Services\Tcpip\Parameters\Interfaces\{09D762C9-851F-4096-9725-FC04E4042F32} | DhcpNameServer : 84.16.120.1 84.16.96.2 ([CZECH REPUBLIC (CZ)][-]) -> Nahrazeno ()
[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\ControlSet002\Services\Tcpip\Parameters\Interfaces\{484C459F-8045-45C0-B14A-426E4A2EF2DA} | DhcpNameServer : 84.16.120.1 84.16.96.2 ([CZECH REPUBLIC (CZ)][-]) -> Nahrazeno ()

¤¤¤ Úlohy : 0 ¤¤¤

¤¤¤ Soubory : 0 ¤¤¤

¤¤¤ Soubor HOSTS : 2 ¤¤¤
[C:\Windows\System32\drivers\etc\hosts] 127.0.0.1 localhost Smazáno
[C:\Windows\System32\drivers\etc\hosts] ::1 localhost Smazáno

¤¤¤ Antirootkit : 7 (Driver: Nahrán) ¤¤¤
[IRP:Addr(Hook.IRP)] \SystemRoot\system32\DRIVERS\iaStor.sys - IRP_MJ_CREATE[0] : Unknown @ 0x4182451600000000
[IRP:Addr(Hook.IRP)] \SystemRoot\system32\DRIVERS\iaStor.sys - IRP_MJ_CLOSE[2] : Unknown @ 0x4182451600000000
[IRP:Addr(Hook.IRP)] \SystemRoot\system32\DRIVERS\iaStor.sys - IRP_MJ_DEVICE_CONTROL[14] : Unknown @ 0x4182451600000000
[IRP:Addr(Hook.IRP)] \SystemRoot\system32\DRIVERS\iaStor.sys - IRP_MJ_INTERNAL_DEVICE_CONTROL[15] : Unknown @ 0x4182451600000000
[IRP:Addr(Hook.IRP)] \SystemRoot\system32\DRIVERS\iaStor.sys - IRP_MJ_POWER[22] : Unknown @ 0x4182451600000000
[IRP:Addr(Hook.IRP)] \SystemRoot\system32\DRIVERS\iaStor.sys - IRP_MJ_SYSTEM_CONTROL[23] : Unknown @ 0x4182451600000000
[IRP:Addr(Hook.IRP)] \SystemRoot\system32\DRIVERS\iaStor.sys - IRP_MJ_PNP[27] : Unknown @ 0x4182451600000000

¤¤¤ Webové prohlížeče : 0 ¤¤¤

¤¤¤ Kontrola MBR : ¤¤¤
+++++ PhysicalDrive0: Hitachi HTS545032B9A300 +++++
--- User ---
[MBR] 6a8a5a113ace3f366907a0adf2a50c55
[BSP] ba0d570e2f477d886f46a91d49098dfb : HP|VT.Unknown MBR Code
Partition table:
0 - [XXXXXX] ACER (0x27) [VISIBLE] Offset (sectors): 2048 | Size: 13000 MB
1 - [ACTIVE] NTFS (0x7) [VISIBLE] Offset (sectors): 26626048 | Size: 100 MB [Windows Vista/7/8 Bootstrap | Windows Vista/7/8 Bootloader]
2 - [XXXXXX] NTFS (0x7) [VISIBLE] Offset (sectors): 26830848 | Size: 292142 MB [Windows Vista/7/8 Bootstrap | Windows Vista/7/8 Bootloader]
User = LL1 ... OK
User = LL2 ... OK

[Orcus]

RK OK, ještě Zoek + CF.

[extrem]

Zoek.exe v5.0.0.0 Updated 04-May-2015
Tool run by Omi on po 31.08.2015 at 16:13:34,32.
Microsoft Windows 7 Home Premium 6.1.7601 Service Pack 1 x64
Running in: Normal Mode Internet Access Detected
Launched: C:\Users\Omi\Downloads\zoek.exe [Scan all users] [Script inserted]

==== Older Logs ======================

C:\zoek-results2015-07-20-085844.log 12526 bytes
C:\zoek-results2015-08-29-081107.log 2184 bytes

==== Reset Hosts File ======================

# Copyright (c) 1993-2006 Microsoft Corp.
#
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
#
# This file contains the mappings of IP addresses to host names. Each
# entry should be kept on an individual line. The IP address should
# be placed in the first column followed by the corresponding host name.
# The IP address and the host name should be separated by at least one
# space.
#
# Additionally, comments (such as these) may be inserted on individual
# lines or following the machine name denoted by a '#' symbol.
#
# For example:
#
# 102.54.94.97 rhino.acme.com # source server
# 38.25.63.10 x.acme.com # x client host

# localhost name resolution is handled within DNS itself.
127.0.0.1 localhost
::1 localhost

==== Deleting CLSID Registry Keys ======================


==== Deleting CLSID Registry Values ======================


==== Deleting Services ======================


==== FireFox Fix ======================

Deleted from C:\Users\Omi\AppData\Roaming\Mozilla\Firefox\Profiles\5fx9ip06.default\prefs.js:
user_pref("browser.startup.homepage", "about:home");
user_pref("browser.newtab.url", "about:newtab");

Added to C:\Users\Omi\AppData\Roaming\Mozilla\Firefox\Profiles\5fx9ip06.default\prefs.js:
user_pref("browser.startup.homepage", "about:home");
user_pref("browser.newtab.url", "about:newtab");

==== Deleting Files \ Folders ======================


==== Firefox Start and Search pages ======================

ProfilePath: C:\Users\Omi\AppData\Roaming\Mozilla\Firefox\Profiles\5fx9ip06.default
user_pref("browser.startup.homepage", "about:home");
user_pref("browser.newtab.url", "about:newtab");

==== Firefox Extensions ======================

AppDir: C:\Program Files (x86)\Mozilla Firefox
- Default - %AppDir%\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

==== Firefox Plugins ======================


==== Chromium Look ======================

AdBlock - Omi\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom

==== Chromium Startpages ======================

C:\Users\Omi\AppData\Local\Google\Chrome\User Data\Default\Preferences
rvoice.com:443":{"supports_spdy":true},"www.alza.cz:443":{"supports_spdy":true},"www.blogger.com:443":{"alternative_service":[{"port":443,"probability":1.0,"protocol_str":"quic"}],"supports_spdy":true},"www.facebook.com:443":{"supports_spdy":true},"www.google-analytics.com:443":{"alternative_service":[{"port":443,"probability":1.0,"protocol_str":"quic"}],"supports_spdy":true},"www.google.com:443":{"alternative_service":[{"port":443,"probability":1.0,"protocol_str":"quic"}],"network_stats":{"srtt":44593},"supports_spdy":true},"www.google.cz:443":{"alternative_service":[{"port":443,"probability":1.0,"protocol_str":"quic"}],"supports_spdy":true},"www.googleadservices.com:443":{"alternative_service":[{"port":443,"probability":1.0,"protocol_str":"quic"}],"network_stats":{"srtt":42253},"supports_spdy":true},"www.googleapis.com:443":{"alternative_service":[{"port":443,"probability":1.0,"protocol_str":"quic"}],"network_stats":{"srtt":35417},"supports_spdy":true},"www.googletagmanager.com:443":{"alternative_service":[{"port":443,"probability":1.0,"protocol_str":"quic"}],"network_stats":{"srtt":20116},"supports_spdy":true},"www.googletagservices.com:443":{"alternative_service":[{"port":443,"probability":1.0,"protocol_str":"quic"}],"network_stats":{"srtt":33486},"supports_spdy":true},"www.gstatic.com:443":{"alternative_service":[{"port":443,"probability":1.0,"protocol_str":"quic"}],"supports_spdy":true},"www.redditstatic.com:443":{"supports_spdy":true},"www.teamspeak.com:443":{"supports_spdy":true},"www.twitchalerts.com:443":{"supports_spdy":true},"www.youtube-nocookie.com:443":{"alternative_service":[{"port":443,"probability":1.0,"protocol_str":"quic"}],"supports_spdy":true},"www.youtube.com:443":{"alternative_service":[{"port":443,"probability":1.0,"protocol_str":"quic"}],"supports_spdy":true},"youtu.be:443":{"alternative_service":[{"port":443,"probability":1.0,"protocol_str":"quic"}],"network_stats":{"srtt":56732},"supports_spdy":true},"yt3.ggpht.com:443":{"alternative_service":[{"port":443,"probability":1.0,"protocol_str":"quic"}],"supports_spdy":true},"ytg-coming-soon.appspot.com:443":{"alternative_service":[{"port":443,"probability":1.0,"protocol_str":"quic"}],"network_stats":{"srtt":355787},"supports_spdy":true},"zendesk.tv:443":{"supports_spdy":true}},"supports_quic":{"address":"192.168.1.176","used_quic":true},"version":3}},"ntp":{"most_visited_blacklist":{"a9e99eefa4c26a12dee0c51108d2ddeb":null,"dfac2ac2f8102bbfbd4ef18a247d74cb":null,"e203e98e4c606735cf56db84a002fd22":null}},"partition":{"per_host_zoom_levels":{"2166136261":{"www.twitch.tv":-7.6035680338478615,"www.youtube.com":1.2239010857415449}}},"password_bubble":{"nopes":5},"plugins":{"migrated_to_pepper_flash":true,"plugins_list":[],"removed_old_component_pepper_flash_settings":true},"profile":{"avatar_bubble_tutorial_shown":2,"avatar_index":26,"content_settings":{"exceptions":{"app_banner":{},"auto_select_certificate":{},"automatic_downloads":{},"cookies":{},"fullscreen":{"http://tv.isport.blesk.cz:80,http://tv.isport.blesk.cz:80":{"setting":1},"https://www.youtube.com:443,https://www.youtube.com:443":{"setting":1}},"geolocation":{},"images":{},"javascript":{},"media_stream":{},"media_stream_camera":{},"media_stream_mic":{},"metro_switch_to_desktop":{},"midi_sysex":{},"mixed_script":{},"mouselock":{},"notifications":{},"plugins":{},"popups":{},"ppapi_broker":{},"protocol_handlers":{},"push_messaging":{},"ssl_cert_decisions":{}},"pattern_pairs":{"http://tv.isport.blesk.cz:80,http://tv.isport.blesk.cz:80":{"fullscreen":1},"https://www.youtube.com:443,https://www.youtube.com:443":{"fullscreen":1}},"pref_version":1},"exit_type":"Normal","exited_cleanly":true,"icon_version":3,"managed_user_id":"","migrated_content_settings_exceptions":true,"migrated_default_content_settings":true,"migrated_default_media_stream_content_settings":true,"name":"První uživatel","per_host_zoom_levels":{}},"protection":{"macs":{}},"savefile":{"default_directory":"C:\\Users\\Omi\\Desktop"},"selectfile":{"last_directory":"C:\\Users\\Omi\\Desktop"},"session":{"restore_on_startup_migrated":true,"startup_urls_migration_time":"13083870652541756"},"translate_accepted_count":{"en":1,"sk":0},"translate_blocked_languages":["cs"],"translate_denied_count":{"en":0,"sk":1},"translate_last_denied_time":1439478499402.888,"translate_too_often_denied":true,"translate_whitelists":{}}
":false,"from_webstore":true,"granted_permissions":{"api":["notifications"],"manifest_permissions":[]},"incognito_content_settings":[],"incognito_preferences":{},"install_time":"13081856370318618","lastpingday":"13085477999440748","location":1,"manifest":{"app":{"launch":{"container":"tab","web_url":"https://mail.google.com/mail/ca"},"urls":["*://mail.google.com/mail/ca"]},"current_locale":"cs","default_locale":"en","description":"Rychlý e-mail s možností vyhledávání a menším množstvím spamu.","icons":{"128":"128.png"},"key":"MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDCuGglK43iAz3J9BEYK/Mz6ZhloIMMDqQSAaf3vJt4eHbTbSDsu4WdQ9dQDRcKlg8nwQdePBt0C3PSUBtiSNSS37Z3qEGfS7LCju3h6pI1Yr9MQtxw+jUa7kXXIS09VV73pEFUT/F7c6Qe8L5ZxgAcBvXBh1Fie63qb02I9XQ/CQIDAQAB","manifest_version":2,"name":"Gmail","options_page":"https://mail.google.com/mail/ca/#settings","permissions":["notifications"],"update_url":"http://clients2.google.com/service/update2/crx","version":"8.1"},"page_ordinal":"n","path":"pjkljhegncpnkpknbcohdijeoejaedia\\8.1_1","preferences":{},"regular_only_preferences":{},"state":1,"was_installed_by_default":true,"was_installed_by_oem":false}}},"pinned_tabs":[],"protection":{"macs":{"browser":{"show_home_button":"8C4DD3F11C00940F1770634FBF8DE0F7BC29139F2DB82FD9794326EBE85F2450"},"default_search_provider":{"keyword":"444ABDE0F74328FA9F6F0EC67CF82EBB656846B4F3F5188CBD42CFB314598D4F","name":"B871FC4147B62F1EA4922B3232C2BEC77463A822953A8DA6632E3D8C7FA47BAF","search_url":"61AF3906B928D24464DAF7AF13737A11686F993D1180CE43A62EAA5C262F442C"},"default_search_provider_data":{"template_url_data":"12C650670E7056D315C1D378471441153B4851B8481950E9E5F8D043F0DF7362"},"extensions":{"settings":{"aapocclcgogkmnckokdopfmhonfmgoek":"71F5D6A69CDAD035F1152259CD51AF8C1F29A116917B10F7EED9B8513C51D845","ahfgeienlihckogmohjhadlkjgocpleb":"F298C987FB2B7823805F131C2D1BA00EDBBC70EBE9CA6AF523FCFE7E7815688F","aohghmighlieiainnegkcijnfilokake":"3CD3EA8352E5ED9E10E09FDAEBF1592687B6A8A2260B9416A7EE39CCB30B838F","apdfllckaahabafndbhieahigkjlhalf":"7C1ED49B1960E13DBA2F405642E20DC320BF00F7DADE8A9540358D1199594226","bepbmhgboaologfdajaanbcjmnhjmhfn":"543A5F63006466C8BEBC9DB85A870F5DDB27078F5F14255511225EC124E4A803","blpcfgokakmgnkcojhhkbfbldkacnbeo":"1F261094DB9B400EBC75656EED88F4D72CC2DE6CC52E91E8C570271D8D3B858A","coobgpohoikkiipiblmjeljniedjpjpf":"3A4C4EA0E4828242D23D7A762889FBF3F010425C1370F53BCA7DBCFA717C59BC","eemcgdkfndhakfknompkggombfjjjeno":"5C034876FFF526F145BC0656787023E124B7D675436CA575EFFF263656ABFF51","ennkphjdgehloodpbhlhldgbnhmacadg":"36F4912EE0C53ED9F0F9C8EC67A1D34ED7E375A4480A324EAA8F85644849AE32","felcaaldnbdncclmgdcncolpebgiejap":"718E4A63A1B1489E5CFCF88CB54685BF65F25BD0522EA7119E87984FAE00CDD5","gfdkimpbcpahaombhbimeihdjnejgicl":"EA667D35A9F57B6FC9A937F2E3180BD3131EAE0B52EC15AFAC9925227FC134AA","gighmmpiobklfepjocnamgkkbiglidom":"48FFADA0B298C23C25126ADD8756AA7E4DF3EEB3EB1F389ACC4A6B310875650C","kmendfapggjehodndflmmgagdbamhnfd":"46058F51AD721F2034A942444172570FECA68D4405B8B714E547C32578B9A76A","mfehgcgbbipciphmccgaenjidiccnmng":"996F07A06B7530281CB66313FC5CACFEA1193663B4CBB9C635DBC0FB3382307B","mgndgikekgjfcpckkfioiadnlibdjbkf":"0042D4A7DC5968EBC042AF78B19AC582B4FAA6CAA9E73946C62AF4D9EEDB939D","mhjfbmdgcfjbbpaeojofohoefgiehjai":"13B50556472073FDFB1D8FF85C1D9214D062840E66DAF2DA08FCBCF7511A5CDF","neajdppkdcdipfabeoofebfddakdcjhd":"3C51BEC6F50BCD22FB66BB6674E490443BE4E8D5363C33B7CD9012AD1D5E5B89","nkeimhogjdpnpccoofpliimaahmaaome":"07C3C1988B6384F8B8DAD79326E68EDED18C593C7D7C3AFCEA5F93F07DFF97D8","nmmhkkegccagdldgiimedpiccmgmieda":"3848633CFBFEB6BF50DA2EBE6EF58F641AF78B59ED52B8755B135C1B30E5A81D","pafkbggdmjlpgkdkcbjmhmfcdpncadgh":"DD238DA66EBD1733ADBC28FEC55C18A3BEDB2405F7E41D7D23D47FC3EAFBC9A3","pjkljhegncpnkpknbcohdijeoejaedia":"BE982ED824463006174EF66934D1C992E5AE7FBAE2CC8483655CE9BB59AB015D"}},"google":{"services":{"last_username":"C305C9498BB860571DE7CC286ADB6060F8A779E6020C64A1171D9332653EC3D7","username":"19A988073B5F9AF65AD6D9A902949BF3F2C3F771DED460BB6BC71088BEAF0680"}},"homepage":"7D26E601B09A5ECBEF8D31E5805A0B2806C1A30E8C56F564B0D93B985992E54A","homepage_is_newtabpage":"560E57AF05E805B858A4D6E44EAEEE728EA90163ACBA8C79693B75326E3F4D22","pinned_tabs":"EACB90FC4E6CB477BB70B472EDA9D04C9F818F472A98E80D2F1F2D9D74494707","prefs":{"preference_reset_time":"E88D5D58DE4FFA031B9EBEA92991F3461F1E161C8B9AC51F0313EA8D0D58486E"},"profile":{"reset_prompt_memento":"B21153CEC8DF7F84C37714B16674410135AB07CA42C35507B0DF31AF17353582"},"safebrowsing":{"incidents_sent":"95B94DEBA72A78AC7C925EFEC363E8B94AD19F811645A34B545223EC9BA1721A"},"search_provider_overrides":"222107088DE267671CDCD0AB2D96B1935D55AD57C9C544A1883AF387A032C5C7","session":{"restore_on_startup":"B0467FB498D6E8649E590928A978CCD8217FE08C43EF345A774F3E54C2A39F97","startup_urls":"0AB15888E55776E490DE621D70A48F79021F78B1DEF6A15E8E94441098259E2C"},"software_reporter":{"prompt_reason":"A17058B6A040CF0F773D8B287C897A4ADDA4B52794909C0BA54C0016CDC530F2","prompt_seed":"58D3D1FCE7C36DC8987D193B8157AC12184478AC7140B1E282402097DBDDA2E5","prompt_version":"55DC0A3C55B34B40F05A74F490AF556C3C36A803662420E1E8F94F70452A6BBF"},"sync":{"remaining_rollback_tries":"DAAA7A17136C9E76155437648E5AA30280EAF530BF8776A36A02C3F7D11BDA8F"}},"super_mac":"99FE03DDCC43D1003E61C5910628913CB82D974B6C693AD41AA18BBD4E9A9AE1"},"session":{"restore_on_startup":1}}


==== Set IE to Default ======================

Old Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"="http://go.microsoft.com/fwlink/p/?LinkId=255141"
"Old Start Page"="http://go.microsoft.com/fwlink/p/?LinkId=255141"

New Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"="http://go.microsoft.com/fwlink/p/?LinkId=255141"
"Old Start Page"="http://go.microsoft.com/fwlink/p/?LinkId=255141"

==== All HKCU SearchScopes ======================

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes
"DefaultScope"="{67A2568C-7A0A-4EED-AECC-B5405DE63B64}"
{012E1000-F331-11DB-8314-0800200C9A66} Google Url="http://www.google.com/search?q={searchTerms}"
{0633EE93-D776-472f-A0FF-E1416B8B2E3A} Bing Url="http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC"
{67A2568C-7A0A-4EED-AECC-B5405DE63B64} Google Url="http://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACAW_csCZ627"
{6A1806CD-94D4-4689-BA73-E35EA1EA9990} Google Url="http://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7"

==== Reset Google Chrome ======================

C:\Users\Omi\AppData\Local\Google\Chrome\User Data\Default\Preferences was reset successfully
C:\Users\Omi\AppData\Local\Google\Chrome\User Data\Default\Preferences.bad was reset successfully
C:\Users\Omi\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences was reset successfully
C:\Users\Omi\AppData\Local\Google\Chrome\User Data\Default\Web Data was reset successfully
C:\Users\Omi\AppData\Local\Google\Chrome\User Data\Default\Web Data-journal was reset successfully

==== Empty IE Cache ======================

C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\Omi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5 emptied successfully
C:\Windows\serviceprofiles\Localservice\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\serviceprofiles\Localservice\AppData\Local\Temp\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\Omi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat will be deleted at reboot
C:\Windows\serviceprofiles\networkservice\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat will be deleted at reboot

==== Empty FireFox Cache ======================

No FireFox Cache found

==== Empty Chrome Cache ======================

C:\Users\Omi\AppData\Local\Google\Chrome\User Data\Default\Cache emptied successfully

==== Empty All Flash Cache ======================

Flash Cache Emptied Successfully

==== Empty All Java Cache ======================

Java Cache cleared successfully

==== C:\zoek_backup content ======================

C:\zoek_backup (files=0 folders=0 0 bytes)

==== Empty Temp Folders ======================

C:\Users\Default\AppData\Local\temp emptied successfully
C:\Users\Default User\AppData\Local\temp emptied successfully
C:\Users\Omi\AppData\Local\Temp will be emptied at reboot
C:\Users\Public\AppData\Local\temp emptied successfully
C:\Windows\serviceprofiles\networkservice\AppData\Local\Temp emptied successfully
C:\Windows\serviceprofiles\Localservice\AppData\Local\Temp emptied successfully
C:\Windows\Temp will be emptied at reboot

==== After Reboot ======================

==== Empty Temp Folders ======================

C:\Windows\Temp successfully emptied
C:\Users\Omi\AppData\Local\Temp successfully emptied

==== Empty Recycle Bin ======================

C:\$RECYCLE.BIN successfully emptied

==== Deleting Files / Folders ======================

"C:\Users\Omi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat" not found
"C:\Windows\serviceprofiles\networkservice\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat" not found

==== EOF on po 31.08.2015 at 16:38:15,92 ======================

[extrem]

Zoek chtěl restart , provedl jsem ale začal se mi hrozně sekat PC .. Kliknu na záložku a otevře se až za 20s , předtím mi to šlo v pohodě.

[jerabina]

Udělej ten ComboFix.

[extrem]

Omlouvám se za dlouhé zdržení , k PC se moc nedostávám. Musel jsem ComboFix udělat v nouz. režimu , ale nešel mi vypnout Antivir. V procesech se mi neukazoval.

ComboFix 15-08-31.01 - Omi 11.09.2015 15:22:47.6.2 - x64 NETWORK
Microsoft Windows 7 Home Premium 6.1.7601.1.1250.420.1029.18.3067.2130 [GMT 2:00]
Spuštěný z: c:\users\Omi\Desktop\ComboFix.exe
AV: ESET Smart Security 8.0 *Enabled/Updated* {19259FAE-8396-A113-46DB-15B0E7DFA289}
FW: ESET Personální firewall *Enabled* {211E1E8B-C9F9-A04B-6D84-BC85190CE5F2}
SP: ESET Smart Security 8.0 *Enabled/Updated* {A2447E4A-A5AC-AE9D-7C6B-2EC29C58E834}
SP: Windows Defender *Enabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* Vytvořen nový Bod Obnovení
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2015-08-11 do 2015-09-11 )))))))))))))))))))))))))))))))
.
.
2015-09-11 13:28 . 2015-09-11 13:28 -------- d-----w- c:\users\Public\AppData\Local\temp
2015-09-11 13:28 . 2015-09-11 13:28 -------- d-----w- c:\users\Default\AppData\Local\temp
2015-09-10 14:01 . 2015-09-10 14:01 -------- d-----w- c:\program files (x86)\Common Files\Java
2015-09-10 14:01 . 2015-09-10 14:01 -------- d-----w- c:\users\Omi\.oracle_jre_usage
2015-08-31 14:35 . 2015-09-11 13:28 -------- d-----w- c:\users\Omi\AppData\Local\Temp
2015-08-31 14:35 . 2015-08-31 14:13 24064 ----a-w- c:\windows\zoek-delete.exe
2015-08-28 14:12 . 2015-08-28 17:22 -------- d-----w- C:\AdwCleaner
2015-08-15 10:44 . 2015-08-16 16:48 -------- d-----w- c:\users\Omi\AppData\Roaming\TS3Client
2015-08-15 10:43 . 2015-08-15 10:44 -------- d-----w- c:\program files\TeamSpeak 3 Client
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2015-09-10 13:59 . 2015-02-21 10:31 97888 ----a-w- c:\windows\SysWow64\WindowsAccessBridge-32.dll
2015-08-31 07:56 . 2015-06-06 14:58 37624 ----a-w- c:\windows\system32\drivers\TrueSight.sys
2015-08-28 17:35 . 2015-06-06 13:41 136408 ----a-w- c:\windows\system32\drivers\MBAMSwissArmy.sys
2015-08-12 10:11 . 2015-02-18 18:38 778440 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2015-08-12 10:11 . 2015-02-18 18:38 142536 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2015-07-14 13:29 . 2015-07-14 13:29 72400 ----a-w- c:\windows\system32\drivers\epfwwfp.sys
2015-07-14 13:29 . 2015-07-14 13:29 53360 ----a-w- c:\windows\system32\drivers\EpfwLWF.sys
2015-07-14 13:29 . 2015-07-14 13:29 255240 ----a-w- c:\windows\system32\drivers\eamonm.sys
2015-07-14 13:29 . 2015-07-14 13:29 251632 ----a-w- c:\windows\system32\drivers\edevmon.sys
2015-07-14 13:29 . 2015-07-14 13:29 231520 ----a-w- c:\windows\system32\drivers\epfw.sys
2015-07-14 13:29 . 2015-07-14 13:29 178520 ----a-w- c:\windows\system32\drivers\ehdrv.sys
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\program files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-08-22 39408]
"CCleaner Monitoring"="c:\program files\CCleaner\CCleaner64.exe" [2015-01-20 7404312]
"Octoshape Streaming Services"="c:\users\Omi\AppData\Roaming\Octoshape\Octoshape Streaming Services\OctoshapeClient.exe" [2014-08-01 500016]
"Steam"="c:\program files (x86)\Steam\steam.exe" [2015-08-19 2899136]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"AMD AVT"="start AMD Accelerated Video Transcoding device initialization" [X]
"LManager"="c:\program files (x86)\Launch Manager\LManager.exe" [2009-08-27 1194504]
"GrooveMonitor"="c:\program files (x86)\Microsoft Office\Office12\GrooveMonitor.exe" [2009-02-26 30040]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2015-08-04 597552]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
R0 epfwwfp;epfwwfp;c:\windows\system32\DRIVERS\epfwwfp.sys;c:\windows\SYSNATIVE\DRIVERS\epfwwfp.sys [x]
R0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys;c:\windows\SYSNATIVE\Drivers\sptd.sys [x]
R1 eamonm;eamonm;c:\windows\system32\DRIVERS\eamonm.sys;c:\windows\SYSNATIVE\DRIVERS\eamonm.sys [x]
R1 ehdrv;ehdrv;c:\windows\system32\DRIVERS\ehdrv.sys;c:\windows\SYSNATIVE\DRIVERS\ehdrv.sys [x]
R2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe;c:\windows\SYSNATIVE\atiesrxx.exe [x]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 ekrn;ESET Service;c:\program files\ESET\ESET Smart Security\x86\ekrn.exe;c:\program files\ESET\ESET Smart Security\x86\ekrn.exe [x]
R2 ePowerSvc;Acer ePower Service;c:\program files\Acer\Acer ePower Management\ePowerSvc.exe;c:\program files\Acer\Acer ePower Management\ePowerSvc.exe [x]
R2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes Anti-Malware\mbamservice.exe;c:\program files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [x]
R2 NTISchedulerSvc;NTI Backup Now 5 Scheduler Service;c:\program files (x86)\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe;c:\program files (x86)\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe [x]
R3 AtiHDAudioService;AMD Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW76.sys;c:\windows\SYSNATIVE\drivers\AtihdW76.sys [x]
R3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\DRIVERS\btwl2cap.sys;c:\windows\SYSNATIVE\DRIVERS\btwl2cap.sys [x]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys;c:\windows\SYSNATIVE\drivers\mbam.sys [x]
R3 MBAMWebAccessControl;MBAMWebAccessControl;c:\windows\system32\drivers\mwac.sys;c:\windows\SYSNATIVE\drivers\mwac.sys [x]
R3 NTIBackupSvc;NTI Backup Now 5 Backup Service;c:\program files (x86)\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe;c:\program files (x86)\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe [x]
R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\System32\Drivers\RtsUStor.sys;c:\windows\SYSNATIVE\Drivers\RtsUStor.sys [x]
R3 RtsUIR;Realtek IR Driver;c:\windows\system32\DRIVERS\Rts516xIR.sys;c:\windows\SYSNATIVE\DRIVERS\Rts516xIR.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
S1 EpfwLWF;Epfw NDIS LightWeight Filter;c:\windows\system32\DRIVERS\EpfwLWF.sys;c:\windows\SYSNATIVE\DRIVERS\EpfwLWF.sys [x]
S3 k57nd60a;Broadcom NetLink (TM) Gigabit Ethernet - NDIS 6.0;c:\windows\system32\DRIVERS\k57nd60a.sys;c:\windows\SYSNATIVE\DRIVERS\k57nd60a.sys [x]
.
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2015-09-10 18:09 997704 ----a-w- c:\program files (x86)\Google\Chrome\Application\45.0.2454.85\Installer\chrmstp.exe
.
Obsah adresáře 'Naplánované úlohy'
.
2015-09-10 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-02-18 10:11]
.
2015-09-11 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2015-09-10 18:08]
.
2015-09-11 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2015-09-10 18:08]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IAAnotif"="c:\program files (x86)\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2009-06-05 186904]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2009-08-06 8060960]
"PLFSetI"="c:\windows\PLFSetI.exe" [2015-02-10 200704]
"Acer ePower Management"="c:\program files\Acer\Acer ePower Management\ePowerTray.exe" [2009-08-05 828960]
"egui"="c:\program files\ESET\ESET Smart Security\egui.exe" [2015-07-08 5595848]
.
------- Doplňkový sken -------
.
uLocal Page = c:\windows\system32\blank.htm
mLocal Page = c:\windows\SYSTEM32\blank.htm
IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~2\Office12\EXCEL.EXE/3000
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~2\MICROS~2\Office12\EXCEL.EXE/3000
IE: Odeslat obrázek do zařízení &Bluetooth... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: Odeslat stránku do zařízení &Bluetooth... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
TCP: DhcpNameServer = 84.16.120.1 84.16.96.2
FF - ProfilePath - c:\users\Omi\AppData\Roaming\Mozilla\Firefox\Profiles\5fx9ip06.default\
FF - prefs.js: browser.startup.homepage - about:home
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
.
Toolbar-Locked - (no file)
HKLM-Run-SynTPEnh - c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe
AddRemove-Cool's_Codec_pack_4.12 - c:\windows\iun6002.exe
AddRemove-PunkBusterSvc - c:\windows\system32\pbsvc.exe
.
.
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_USERS\S-1-5-21-2737042915-4269745475-1994003038-1000\Software\SecuROM\License information*]
"datasecu"=hex:b5,82,08,4e,e5,f8,be,1f,fd,15,d9,44,bf,0d,b0,8a,e6,d5,4b,77,f6,
c5,5b,28,d7,a6,0e,7b,af,19,ce,3a,ec,d4,6e,74,ce,e7,a6,b7,17,b0,a2,63,6d,7c,\
"rkeysecu"=hex:5d,be,60,1a,40,43,89,b6,64,2c,0c,b6,07,92,2c,9e
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows CE Services]
"SymbolicLinkValue"=hex(6):5c,00,72,00,65,00,67,00,69,00,73,00,74,00,72,00,79,
00,5c,00,4d,00,41,00,43,00,48,00,49,00,4e,00,45,00,5c,00,53,00,4f,00,46,00,\
.
Celkový čas: 2015-09-11 15:30:53
ComboFix-quarantined-files.txt 2015-09-11 13:30
.
Před spuštěním: Volných bajtů: 188 738 748 416
Po spuštění: Volných bajtů: 188 638 994 432
.
- - End Of File - - 75DEF4EF40D4438110449B1A21BF7CF6
5C616939100B85E558DA92B899A0FC36

[jaro3]

Vypni rez. ochranu u antiviru a antispywaru,příp. firewall..

Otevři si Poznámkový blok (Start -> Spustit... a napiš do okna Notepad a dej Ok.
Zkopíruj do něj následující celý text označený zeleně:

Kód: Vybrat vše

ClearJavaCache::
KillAll::
File::
c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

Folder::
c:\program files (x86)\Google\Update

RegLock::
[HKEY_USERS\S-1-5-21-2737042915-4269745475-1994003038-1000\Software\SecuROM\License information*]
"datasecu"=hex:b5,82,08,4e,e5,f8,be,1f,fd,15,d9,44,bf,0d,b0,8a,e6,d5,4b,77,f6,
 c5,5b,28,d7,a6,0e,7b,af,19,ce,3a,ec,d4,6e,74,ce,e7,a6,b7,17,b0,a2,63,6d,7c,\
"rkeysecu"=hex:5d,be,60,1a,40,43,89,b6,64,2c,0c,b6,07,92,2c,9e
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows CE Services]
"SymbolicLinkValue"=hex(6):5c,00,72,00,65,00,67,00,69,00,73,00,74,00,72,00,79,
 00,5c,00,4d,00,41,00,43,00,48,00,49,00,4e,00,45,00,5c,00,53,00,4f,00,46,00,\


Zvol možnost Soubor -> Uložit jako... a nastav tyto parametry:
Název souboru: zde napiš: CFScript.txt
Uložit jako typ: tak tam vyber Všechny soubory
Ulož soubor na plochu.
Ukonči všechna aktivní okna.

Uchop myší vytvořený skript CFScript.txt, přemísti ho nad stažený program ComboFix.exe a když se oba soubory překryjí, skript upusť.
- Automaticky se spustí ComboFix
- Vlož sem log, který vyběhne v závěru čistícího procesu + nový log z HJT

Upozornění : Může se stát, že po aplikaci Combofixu a restartu počítače, Windows nenaběhnou , nebo nenajede plocha , budou problémy s připojením, pak znovu restartuj počítač, pokud to nepomůže , po restartu mačkej klávesu F8 a pak zvol poslední známou funkční konfiguraci. , či použij bod obnovy.

Stáhni si aswMBR
na svojí plochu. Uzavři všechna okna , programy a prohlížeče. Poklepej na aswMBR.exe. Pokud se objeví hláška o možnosti stáhnutí databáze Avastu , klikni na NE. Poté klikni na „Scan“ . Po skenu klikni na „Save Log“ a ulož si log na plochu .Zkopíruj sem celý obsah toho logu. Pak klikni na „Exit“ k zavření programu.

[extrem]

ComboFix 15-08-31.01 - Omi 11.09.2015 18:56:11.7.2 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1250.420.1029.18.3067.2320 [GMT 2:00]
Spuštěný z: c:\users\Omi\Desktop\ComboFix.exe
Použité ovládací přepínače :: c:\users\Omi\Desktop\CFScript.txt
AV: ESET Smart Security 8.0 *Disabled/Updated* {19259FAE-8396-A113-46DB-15B0E7DFA289}
FW: ESET Personální firewall *Disabled* {211E1E8B-C9F9-A04B-6D84-BC85190CE5F2}
SP: ESET Smart Security 8.0 *Disabled/Updated* {A2447E4A-A5AC-AE9D-7C6B-2EC29C58E834}
SP: Windows Defender *Enabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
FILE ::
"c:\windows\Tasks\GoogleUpdateTaskMachineCore.job"
"c:\windows\Tasks\GoogleUpdateTaskMachineUA.job"
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\program files (x86)\Google\Update
c:\program files (x86)\Google\Update\1.3.28.13\GoogleCrashHandler.exe
c:\program files (x86)\Google\Update\1.3.28.13\GoogleCrashHandler64.exe
c:\program files (x86)\Google\Update\1.3.28.13\GoogleUpdate.exe
c:\program files (x86)\Google\Update\1.3.28.13\GoogleUpdateBroker.exe
c:\program files (x86)\Google\Update\1.3.28.13\GoogleUpdateComRegisterShell64.exe
c:\program files (x86)\Google\Update\1.3.28.13\GoogleUpdateHelper.msi
c:\program files (x86)\Google\Update\1.3.28.13\GoogleUpdateOnDemand.exe
c:\program files (x86)\Google\Update\1.3.28.13\GoogleUpdateSetup.exe
c:\program files (x86)\Google\Update\1.3.28.13\GoogleUpdateWebPlugin.exe
c:\program files (x86)\Google\Update\1.3.28.13\goopdate.dll
c:\program files (x86)\Google\Update\1.3.28.13\goopdateres_am.dll
c:\program files (x86)\Google\Update\1.3.28.13\goopdateres_ar.dll
c:\program files (x86)\Google\Update\1.3.28.13\goopdateres_bg.dll
c:\program files (x86)\Google\Update\1.3.28.13\goopdateres_bn.dll
c:\program files (x86)\Google\Update\1.3.28.13\goopdateres_ca.dll
c:\program files (x86)\Google\Update\1.3.28.13\goopdateres_cs.dll
c:\program files (x86)\Google\Update\1.3.28.13\goopdateres_da.dll
c:\program files (x86)\Google\Update\1.3.28.13\goopdateres_de.dll
c:\program files (x86)\Google\Update\1.3.28.13\goopdateres_el.dll
c:\program files (x86)\Google\Update\1.3.28.13\goopdateres_en-GB.dll
c:\program files (x86)\Google\Update\1.3.28.13\goopdateres_en.dll
c:\program files (x86)\Google\Update\1.3.28.13\goopdateres_es-419.dll
c:\program files (x86)\Google\Update\1.3.28.13\goopdateres_es.dll
c:\program files (x86)\Google\Update\1.3.28.13\goopdateres_et.dll
c:\program files (x86)\Google\Update\1.3.28.13\goopdateres_fa.dll
c:\program files (x86)\Google\Update\1.3.28.13\goopdateres_fi.dll
c:\program files (x86)\Google\Update\1.3.28.13\goopdateres_fil.dll
c:\program files (x86)\Google\Update\1.3.28.13\goopdateres_fr.dll
c:\program files (x86)\Google\Update\1.3.28.13\goopdateres_gu.dll
c:\program files (x86)\Google\Update\1.3.28.13\goopdateres_hi.dll
c:\program files (x86)\Google\Update\1.3.28.13\goopdateres_hr.dll
c:\program files (x86)\Google\Update\1.3.28.13\goopdateres_hu.dll
c:\program files (x86)\Google\Update\1.3.28.13\goopdateres_id.dll
c:\program files (x86)\Google\Update\1.3.28.13\goopdateres_is.dll
c:\program files (x86)\Google\Update\1.3.28.13\goopdateres_it.dll
c:\program files (x86)\Google\Update\1.3.28.13\goopdateres_iw.dll
c:\program files (x86)\Google\Update\1.3.28.13\goopdateres_ja.dll
c:\program files (x86)\Google\Update\1.3.28.13\goopdateres_kn.dll
c:\program files (x86)\Google\Update\1.3.28.13\goopdateres_ko.dll
c:\program files (x86)\Google\Update\1.3.28.13\goopdateres_lt.dll
c:\program files (x86)\Google\Update\1.3.28.13\goopdateres_lv.dll
c:\program files (x86)\Google\Update\1.3.28.13\goopdateres_ml.dll
c:\program files (x86)\Google\Update\1.3.28.13\goopdateres_mr.dll
c:\program files (x86)\Google\Update\1.3.28.13\goopdateres_ms.dll
c:\program files (x86)\Google\Update\1.3.28.13\goopdateres_nl.dll
c:\program files (x86)\Google\Update\1.3.28.13\goopdateres_no.dll
c:\program files (x86)\Google\Update\1.3.28.13\goopdateres_pl.dll
c:\program files (x86)\Google\Update\1.3.28.13\goopdateres_pt-BR.dll
c:\program files (x86)\Google\Update\1.3.28.13\goopdateres_pt-PT.dll
c:\program files (x86)\Google\Update\1.3.28.13\goopdateres_ro.dll
c:\program files (x86)\Google\Update\1.3.28.13\goopdateres_ru.dll
c:\program files (x86)\Google\Update\1.3.28.13\goopdateres_sk.dll
c:\program files (x86)\Google\Update\1.3.28.13\goopdateres_sl.dll
c:\program files (x86)\Google\Update\1.3.28.13\goopdateres_sr.dll
c:\program files (x86)\Google\Update\1.3.28.13\goopdateres_sv.dll
c:\program files (x86)\Google\Update\1.3.28.13\goopdateres_sw.dll
c:\program files (x86)\Google\Update\1.3.28.13\goopdateres_ta.dll
c:\program files (x86)\Google\Update\1.3.28.13\goopdateres_te.dll
c:\program files (x86)\Google\Update\1.3.28.13\goopdateres_th.dll
c:\program files (x86)\Google\Update\1.3.28.13\goopdateres_tr.dll
c:\program files (x86)\Google\Update\1.3.28.13\goopdateres_uk.dll
c:\program files (x86)\Google\Update\1.3.28.13\goopdateres_ur.dll
c:\program files (x86)\Google\Update\1.3.28.13\goopdateres_vi.dll
c:\program files (x86)\Google\Update\1.3.28.13\goopdateres_zh-CN.dll
c:\program files (x86)\Google\Update\1.3.28.13\goopdateres_zh-TW.dll
c:\program files (x86)\Google\Update\1.3.28.13\npGoogleUpdate3.dll
c:\program files (x86)\Google\Update\1.3.28.13\psmachine.dll
c:\program files (x86)\Google\Update\1.3.28.13\psmachine_64.dll
c:\program files (x86)\Google\Update\1.3.28.13\psuser.dll
c:\program files (x86)\Google\Update\1.3.28.13\psuser_64.dll
c:\program files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\45.0.2454.85\45.0.2454.85_chrome_installer.exe
c:\program files (x86)\Google\Update\GoogleUpdate.exe
c:\program files (x86)\Google\Update\Install\{ACAD8705-6E24-4995-AE55-08550A7B45AE}\45.0.2454.85_chrome_installer.exe
.
.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Service_gupdate
-------\Service_gupdatem
-------\Service_gupdate
-------\Service_gupdatem
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2015-08-11 do 2015-09-11 )))))))))))))))))))))))))))))))
.
.
2015-09-11 17:05 . 2015-09-11 17:05 -------- d-----w- c:\users\Public\AppData\Local\temp
2015-09-11 17:05 . 2015-09-11 17:05 -------- d-----w- c:\users\Default\AppData\Local\temp
2015-09-10 14:01 . 2015-09-10 14:01 -------- d-----w- c:\program files (x86)\Common Files\Java
2015-09-10 14:01 . 2015-09-10 14:01 -------- d-----w- c:\users\Omi\.oracle_jre_usage
2015-08-31 14:35 . 2015-09-11 17:05 -------- d-----w- c:\users\Omi\AppData\Local\Temp
2015-08-31 14:35 . 2015-08-31 14:13 24064 ----a-w- c:\windows\zoek-delete.exe
2015-08-28 14:12 . 2015-08-28 17:22 -------- d-----w- C:\AdwCleaner
2015-08-15 10:44 . 2015-08-16 16:48 -------- d-----w- c:\users\Omi\AppData\Roaming\TS3Client
2015-08-15 10:43 . 2015-08-15 10:44 -------- d-----w- c:\program files\TeamSpeak 3 Client
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2015-09-10 13:59 . 2015-02-21 10:31 97888 ----a-w- c:\windows\SysWow64\WindowsAccessBridge-32.dll
2015-08-31 07:56 . 2015-06-06 14:58 37624 ----a-w- c:\windows\system32\drivers\TrueSight.sys
2015-08-28 17:35 . 2015-06-06 13:41 136408 ----a-w- c:\windows\system32\drivers\MBAMSwissArmy.sys
2015-08-12 10:11 . 2015-02-18 18:38 778440 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2015-08-12 10:11 . 2015-02-18 18:38 142536 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2015-07-14 13:29 . 2015-07-14 13:29 72400 ----a-w- c:\windows\system32\drivers\epfwwfp.sys
2015-07-14 13:29 . 2015-07-14 13:29 53360 ----a-w- c:\windows\system32\drivers\EpfwLWF.sys
2015-07-14 13:29 . 2015-07-14 13:29 255240 ----a-w- c:\windows\system32\drivers\eamonm.sys
2015-07-14 13:29 . 2015-07-14 13:29 251632 ----a-w- c:\windows\system32\drivers\edevmon.sys
2015-07-14 13:29 . 2015-07-14 13:29 231520 ----a-w- c:\windows\system32\drivers\epfw.sys
2015-07-14 13:29 . 2015-07-14 13:29 178520 ----a-w- c:\windows\system32\drivers\ehdrv.sys
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\program files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-08-22 39408]
"CCleaner Monitoring"="c:\program files\CCleaner\CCleaner64.exe" [2015-01-20 7404312]
"Octoshape Streaming Services"="c:\users\Omi\AppData\Roaming\Octoshape\Octoshape Streaming Services\OctoshapeClient.exe" [2014-08-01 500016]
"Steam"="c:\program files (x86)\Steam\steam.exe" [2015-08-19 2899136]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"AMD AVT"="start AMD Accelerated Video Transcoding device initialization" [X]
"LManager"="c:\program files (x86)\Launch Manager\LManager.exe" [2009-08-27 1194504]
"GrooveMonitor"="c:\program files (x86)\Microsoft Office\Office12\GrooveMonitor.exe" [2009-02-26 30040]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2015-08-04 597552]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes Anti-Malware\mbamservice.exe;c:\program files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [x]
R3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\DRIVERS\btwl2cap.sys;c:\windows\SYSNATIVE\DRIVERS\btwl2cap.sys [x]
R3 MBAMWebAccessControl;MBAMWebAccessControl;c:\windows\system32\drivers\mwac.sys;c:\windows\SYSNATIVE\drivers\mwac.sys [x]
R3 NTIBackupSvc;NTI Backup Now 5 Backup Service;c:\program files (x86)\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe;c:\program files (x86)\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe [x]
R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\System32\Drivers\RtsUStor.sys;c:\windows\SYSNATIVE\Drivers\RtsUStor.sys [x]
R3 RtsUIR;Realtek IR Driver;c:\windows\system32\DRIVERS\Rts516xIR.sys;c:\windows\SYSNATIVE\DRIVERS\Rts516xIR.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
S0 epfwwfp;epfwwfp;c:\windows\system32\DRIVERS\epfwwfp.sys;c:\windows\SYSNATIVE\DRIVERS\epfwwfp.sys [x]
S0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys;c:\windows\SYSNATIVE\Drivers\sptd.sys [x]
S1 eamonm;eamonm;c:\windows\system32\DRIVERS\eamonm.sys;c:\windows\SYSNATIVE\DRIVERS\eamonm.sys [x]
S1 ehdrv;ehdrv;c:\windows\system32\DRIVERS\ehdrv.sys;c:\windows\SYSNATIVE\DRIVERS\ehdrv.sys [x]
S1 EpfwLWF;Epfw NDIS LightWeight Filter;c:\windows\system32\DRIVERS\EpfwLWF.sys;c:\windows\SYSNATIVE\DRIVERS\EpfwLWF.sys [x]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe;c:\windows\SYSNATIVE\atiesrxx.exe [x]
S2 ekrn;ESET Service;c:\program files\ESET\ESET Smart Security\x86\ekrn.exe;c:\program files\ESET\ESET Smart Security\x86\ekrn.exe [x]
S2 ePowerSvc;Acer ePower Service;c:\program files\Acer\Acer ePower Management\ePowerSvc.exe;c:\program files\Acer\Acer ePower Management\ePowerSvc.exe [x]
S2 NTISchedulerSvc;NTI Backup Now 5 Scheduler Service;c:\program files (x86)\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe;c:\program files (x86)\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe [x]
S3 AtiHDAudioService;AMD Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW76.sys;c:\windows\SYSNATIVE\drivers\AtihdW76.sys [x]
S3 k57nd60a;Broadcom NetLink (TM) Gigabit Ethernet - NDIS 6.0;c:\windows\system32\DRIVERS\k57nd60a.sys;c:\windows\SYSNATIVE\DRIVERS\k57nd60a.sys [x]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys;c:\windows\SYSNATIVE\drivers\mbam.sys [x]
.
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2015-09-10 18:09 997704 ----a-w- c:\program files (x86)\Google\Chrome\Application\45.0.2454.85\Installer\chrmstp.exe
.
Obsah adresáře 'Naplánované úlohy'
.
2015-09-11 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-02-18 10:11]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IAAnotif"="c:\program files (x86)\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2009-06-05 186904]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2009-08-06 8060960]
"SynTPEnh"="c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe" [BU]
"PLFSetI"="c:\windows\PLFSetI.exe" [2015-02-10 200704]
"Acer ePower Management"="c:\program files\Acer\Acer ePower Management\ePowerTray.exe" [2009-08-05 828960]
"egui"="c:\program files\ESET\ESET Smart Security\egui.exe" [2015-07-08 5595848]
.
------- Doplňkový sken -------
.
uLocal Page = c:\windows\system32\blank.htm
mLocal Page = c:\windows\SYSTEM32\blank.htm
IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~2\Office12\EXCEL.EXE/3000
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~2\MICROS~2\Office12\EXCEL.EXE/3000
IE: Odeslat obrázek do zařízení &Bluetooth... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: Odeslat stránku do zařízení &Bluetooth... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
TCP: DhcpNameServer = 84.16.120.1 84.16.96.2
FF - ProfilePath - c:\users\Omi\AppData\Roaming\Mozilla\Firefox\Profiles\5fx9ip06.default\
FF - prefs.js: browser.startup.homepage - about:home
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
.
Toolbar-Locked - (no file)
AddRemove-Cool's_Codec_pack_4.12 - c:\windows\iun6002.exe
AddRemove-PunkBusterSvc - c:\windows\system32\pbsvc.exe
.
.
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_USERS\S-1-5-21-2737042915-4269745475-1994003038-1000\Software\SecuROM\License information*]
"datasecu"=hex:b5,82,08,4e,e5,f8,be,1f,fd,15,d9,44,bf,0d,b0,8a,e6,d5,4b,77,f6,
c5,5b,28,d7,a6,0e,7b,af,19,ce,3a,ec,d4,6e,74,ce,e7,a6,b7,17,b0,a2,63,6d,7c,\
"rkeysecu"=hex:5d,be,60,1a,40,43,89,b6,64,2c,0c,b6,07,92,2c,9e
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows CE Services]
"SymbolicLinkValue"=hex(6):5c,00,72,00,65,00,67,00,69,00,73,00,74,00,72,00,79,
00,5c,00,4d,00,41,00,43,00,48,00,49,00,4e,00,45,00,5c,00,53,00,4f,00,46,00,\
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
c:\program files (x86)\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe
c:\windows\SysWOW64\PnkBstrA.exe
c:\windows\SysWOW64\PnkBstrB.exe
c:\program files (x86)\Intel\Intel Matrix Storage Manager\IAANTMon.exe
.
**************************************************************************
.
Celkový čas: 2015-09-11 19:11:51 - počítač byl restartován
ComboFix-quarantined-files.txt 2015-09-11 17:11
ComboFix2.txt 2015-09-11 13:30
.
Před spuštěním: Volných bajtů: 188 581 228 544
Po spuštění: Volných bajtů: 188 191 928 320
.
- - End Of File - - 1C5E88C0FF057F75D9ED577003803473
5C616939100B85E558DA92B899A0FC36