PC-HELP.CZ

Zdravím, přikládám výpis z logu, v poslední době mi na každé stránce vyskakuje okno s reklamou(Ad by costmin). Prosím o odstranění a kontroly PC. Díky

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 7:53:32, on 22. 6. 2014
Platform: Unknown Windows (WinNT 6.02.1008)
MSIE: Internet Explorer v10.0 (10.00.9200.16921)
Boot mode: Normal

Running processes:
C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\RocketDock\RocketDock.exe
D:\Programy\origin\Origin.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
D:\Programy\Avast\avastUi.exe
D:\Programy\Avast\setup\aswOfferTool.exe
C:\Users\Public\Desktop\DropboxInstallerAvast.exe
C:\Users\Nosal\Desktop\hijackthis.exe
C:\Windows\SysWOW64\netsh.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/p/?LinkId=255141
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/p/?LinkId=255141
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/p/?LinkId=255141
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F2 - REG:system.ini: UserInit=userinit.exe
O2 - BHO: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - D:\Programy\Avast\aswWebRepIE.dll
O4 - HKLM\..\Run: [AdobeCS6ServiceManager] "C:\Program Files (x86)\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe" -launchedbylogin
O4 - HKLM\..\Run: [AvastUI.exe] "D:\Programy\Avast\AvastUI.exe" /nogui
O4 - HKCU\..\Run: [RocketDock] "C:\Program Files (x86)\RocketDock\RocketDock.exe"
O4 - HKCU\..\Run: [DAEMON Tools Lite] "D:\Programy\DAEMON Tools Lite\DTLite.exe" -autorun
O4 - HKCU\..\Run: [EADM] "D:\Programy\origin\Origin.exe" -AutoStart
O4 - HKCU\..\Run: [GoogleChromeAutoLaunch_C6C33B78DE586273BBEC87180E31F3FD] "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --no-startup-window
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O20 - AppInit_DLLs:
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: avast! Antivirus - AVAST Software - D:\Programy\Avast\AvastSvc.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: Služba Google Update (gupdate) (gupdate) - Unknown owner - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe (file missing)
O23 - Service: Služba Google Update (gupdatem) (gupdatem) - Unknown owner - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe (file missing)
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: NVIDIA Network Service (NvNetworkService) - NVIDIA Corporation - C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
O23 - Service: NVIDIA Streamer Service (NvStreamSvc) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - Unknown owner - C:\Windows\system32\nvvsvc.exe (file missing)
O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: SetupARService - Unknown owner - C:\Program Files (x86)\Realtek\Audio\SetupAfterRebootService.exe
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files (x86)\Common Files\Steam\SteamService.exe
O23 - Service: NVIDIA Stereoscopic 3D Driver Service (Stereo Service) - NVIDIA Corporation - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%ProgramFiles%\Windows Defender\MpAsDesc.dll,-310 (WinDefend) - Unknown owner - C:\Program Files (x86)\Windows Defender\MsMpEng.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--
End of file - 7002 bytes

Stáhni si ATF Cleaner
Poklepej na ATF Cleaner.exe, klikni na select all found, poté:
-Když používáš Firefox (Mozzila), klikni na Firefox nahoře a vyber: Select All, poté klikni na Empty Selected.
-Když používáš Operu, klikni nahoře na Operu a vyber: Select All, poté klikni na Empty Selected. Poté klikni na Main (hlavní stránku ) a klikni na Empty Selected.
Po vyčištění klikni na Exit k zavření programu.
ATF-Cleaner je jednoduchý nástroj na odstranění historie z webového prohlížeče. Program dokáže odstranit cache, cookies, historii a další stopy po surfování na Internetu. Mezi podporované prohlížeče patří Internet Explorer, Firefox a Opera. Aplikace navíc umí odstranit dočasné soubory Windows, vysypat koš atd.

- Pokud používáš jen Google Chrome , tak ATF nemusíš použít.


Stáhni si TFC
Otevři soubor a zavři všechny ostatní okna, Klikni na Start k zahájení procesu. Program by neměl trvat dlouho.
Poté by se měl PC restartovat, pokud ne , proveď sám.

Stáhni AdwCleaner (by Xplode)
http://www.bleepingcomputer.com/download/adwcleaner/

Ulož si ho na svojí plochu
Ukonči všechny programy , okna a prohlížeče
Spusť program poklepáním a klikni na „Prohledat-Scan“
Po skenu se objeví log ( jinak je uložen systémovem disku jako AdwCleaner[R?].txt), jeho obsah sem celý vlož.

Stáhni si Malwarebytes' Anti-Malware
- Při instalaci odeber zatržítko u „Povolit bezplatnou zkušební verzi Malwarebytes' Anti-Malware Premium“
Nainstaluj a spusť ho
- na konci instalace se ujisti že máš zvoleny/zatrhnuty obě možnosti:
Aktualizace Malwarebytes' Anti-Malware a Spustit aplikaci Malwarebytes' Anti-Malware, pokud jo tak klikni na tlačítko konec
- pokud bude nalezena aktualizace, tak se stáhne a nainstaluje
- program se po té spustí a klikni na Skenovat nyní a
- po proběhnutí programu se ti objeví hláška vpravo dole tak klikni na b] Kopírovat do schránky [/b]a a vlož sem celý log.

- po té klikni na tlačítko Exit, objeví se ti hláška tak zvol Ano
(zatím nic nemaž!).

Pokud budou problémy , spusť v nouz. režimu.

# AdwCleaner v3.212 - Report created 22/06/2014 at 14:02:19
# Updated 05/06/2014 by Xplode
# Operating System : Windows 8 (64 bits)
# Username : Nosal - SHELLBY
# Running from : C:\Users\Nosal\Desktop\adwcleaner_3.212.exe
# Option : Scan

***** [ Services ] *****


***** [ Files / Folders ] *****

File Found : C:\Windows\System32\roboot64.exe
Folder Found : C:\Program Files (x86)\CostMin
Folder Found : C:\Program Files (x86)\Mobogenie
Folder Found : C:\ProgramData\CostMin
Folder Found : C:\Users\Administrator\AppData\Local\Chromatic Browser
Folder Found : C:\Users\Administrator\AppData\Local\torch
Folder Found : C:\Users\Guest\AppData\Local\Chromatic Browser
Folder Found : C:\Users\Guest\AppData\Local\torch
Folder Found : C:\Users\HomeGroupUser$\AppData\Local\Chromatic Browser
Folder Found : C:\Users\HomeGroupUser$\AppData\Local\torch
Folder Found : C:\Users\Nosal\AppData\Local\Google\Chrome\User Data\Default\Extensions\dgpdioedihjhncjafcpgbbjdpbbkikmi
Folder Found : C:\Users\Nosal\AppData\Local\Google\Chrome\User Data\Default\Extensions\ejocekekgcaldnmjngfdbmbeebcekelc
Folder Found : C:\Users\Nosal\AppData\Local\Chromatic Browser
Folder Found : C:\Users\Nosal\AppData\Local\torch
Folder Found : C:\Users\Nosal\AppData\Roaming\OpenCandy

***** [ Shortcuts ] *****


***** [ Registry ] *****

Key Found : HKCU\Software\AppDataLow\{5F189DF5-2D05-472B-9091-84D9848AE48B}
Key Found : HKCU\Software\AppDataLow\{5F189DF5-2D05-472B-9091-84D9848AE48B}
Key Found : HKLM\Software\{3A7D3E19-1B79-4E4E-BD96-5467DA2C4EF0}
Key Found : HKLM\Software\{5F189DF5-2D05-472B-9091-84D9848AE48B}
Key Found : HKLM\Software\{77D46E27-0E41-4478-87A6-AABE6FBCF252}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\MobogenieAdd
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{2F5F003B-C71B-72E3-42B4-DE51AB079EB2}

***** [ Browsers ] *****

-\\ Internet Explorer v10.0.9200.16921


-\\ Google Chrome v35.0.1916.114

[ File : C:\Users\Nosal\AppData\Local\Google\Chrome\User Data\Default\preferences ]


*************************

AdwCleaner[R0].txt - [2116 octets] - [22/06/2014 14:02:19]

########## EOF - C:\AdwCleaner\AdwCleaner[R0].txt - [2176 octets] ##########

Malwarebytes Anti-Malware
www.malwarebytes.org

Scan Date: 22. 6. 2014
Scan Time: 14:05:58
Logfile: log.txt
Administrator: Yes

Version: 2.00.2.1012
Malware Database: v2014.06.22.02
Rootkit Database: v2014.06.20.01
License: Trial
Malware Protection: Enabled
Malicious Website Protection: Enabled
Self-protection: Disabled

OS: Windows 8
CPU: x64
File System: NTFS
User: Nosal

Scan Type: Threat Scan
Result: Completed
Objects Scanned: 289015
Time Elapsed: 5 min, 0 sec

Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled

Processes: 0
(No malicious items detected)

Modules: 0
(No malicious items detected)

Registry Keys: 1
PUP.Optional.MultiPlug, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{2F5F003B-C71B-72E3-42B4-DE51AB079EB2}, , [522857241c5f6bcbaa6c87c031d1d42c],

Registry Values: 0
(No malicious items detected)

Registry Data: 0
(No malicious items detected)

Folders: 4
PUP.Optional.OpenCandy, C:\Users\Nosal\AppData\Roaming\OpenCandy, , [a7d3700b4734360001b75f2feb17926e],
PUP.Optional.OpenCandy, C:\Users\Nosal\AppData\Roaming\OpenCandy\298C897E40EE42CDBB6C73E61EE7DC57, , [a7d3700b4734360001b75f2feb17926e],
PUP.Optional.CostMin.A, C:\ProgramData\CostMin, , [04760e6de8933105f7f5950739c939c7],
PUP.Optional.Costmin.A, C:\Program Files (x86)\CostMin, , [09714c2f2c4f8ea879dd02a2d2308f71],

Files: 21
PUP.Optional.NextLive.A, C:\Users\Nosal\AppData\Roaming\OpenCandy\298C897E40EE42CDBB6C73E61EE7DC57\Mobogenie_Setup_2.1.37_507.exe, , [17635a216714ed4904b3b2a63ac7bc44],
PUP.Optional.Somoto.A, C:\Users\Nosal\Downloads\FLVPlayerSetup-N2KfUXX21.exe, , [f288cfac47344beb2a672f5a39c8e21e],
PUP.Optional.Installrex, C:\Users\Nosal\Downloads\survivor-hot-girl-with-a-grudge-cze-5599989.exe, , [0179e19a97e4a1953d92a9cf5da4f907],
PUP.Optional.Somoto.A, C:\Users\Nosal\Downloads\ClickHeretoDownloadSetup-8BEhc2CI (1).exe, , [8bef87f40477e254c5cc6c1d0ef3748c],
PUP.Optional.Somoto.A, C:\Users\Nosal\Downloads\ClickHeretoDownloadSetup-8BEhc2CI (2).exe, , [d4a60774601bfd399af74148877a29d7],
PUP.Optional.Somoto.A, C:\Users\Nosal\Downloads\ClickHeretoDownloadSetup-8BEhc2CI (3).exe, , [c5b5c5b6304b1c1a4b46e7a23ac7bb45],
PUP.Optional.Somoto.A, C:\Users\Nosal\Downloads\ClickHeretoDownloadSetup-8BEhc2CI (4).exe, , [35457407324957df0b869fea010044bc],
PUP.Optional.Somoto.A, C:\Users\Nosal\Downloads\ClickHeretoDownloadSetup-8BEhc2CI (5).exe, , [86f4de9d0972ba7cddb4cdbcfe034fb1],
PUP.Optional.Somoto.A, C:\Users\Nosal\Downloads\ClickHeretoDownloadSetup-8BEhc2CI.exe, , [e3979cdf7b000531751c7e0b53aed32d],
PUP.Optional.Somoto.A, C:\Users\Nosal\Downloads\ClickHeretoDownloadSetup-bmrNRBCC.exe, , [245658232f4c4beb2210d734966ea060],
PUP.Optional.Somoto.A, C:\Users\Nosal\Downloads\ClickHeretoDownloadSetup-cj7OWl2T (1).exe, , [4d2d02798bf03600236e8702aa57cb35],
PUP.Optional.Somoto.A, C:\Users\Nosal\Downloads\ClickHeretoDownloadSetup-cj7OWl2T.exe, , [2a5053286d0e979f7a174148798831cf],
PUP.Optional.Softonic.A, C:\Users\Nosal\Downloads\SoftonicDownloader_for_vobsub.exe, , [bac0c0bb2b5047ef063ba1836899f709],
PUP.Optional.OptimumInstaller.A, C:\Users\Nosal\Downloads\StartDownload (1).exe, , [3842b7c4d1aa3105b7282c25768b936d],
PUP.Optional.OptimumInstaller.A, C:\Users\Nosal\Downloads\StartDownload.exe, , [562496e5d0aba98d934c1c359a6747b9],
PUP.Optional.InstallCore.A, C:\Users\Nosal\Downloads\VobSub_2.23 - CHIP Downloader.exe, , [6119df9cc4b77db94294064f9c68ca36],
PUP.Optional.Breitschopp, C:\Users\Nosal\Downloads\deluge+bittorrent+client_1.0 (1).exe, , [2d4d106b8deec17576af1753da2a4fb1],
PUP.Optional.Breitschopp, C:\Users\Nosal\Downloads\deluge+bittorrent+client_1.0.exe, , [f08a87f483f8a690bd68640616ee1fe1],
PUP.Optional.OpenCandy, C:\Users\Nosal\Downloads\DTLite4481-0347.exe, , [5f1bde9d94e711257acb9214f80c29d7],
PUP.Optional.PCPerformer.A, C:\Windows\System32\roboot64.exe, , [a6d4403bb8c3ae88d7fa1fa45ca6966a],
Malware.Trace, C:\Windows\Inf\ntvdm.inf, , [4d2dc8b3f883152181abe2ffe81bd927],

Physical Sectors: 0
(No malicious items detected)


(end)

Spusť znovu AdwCleaner (u Windows Vista či Windows7, klikni na AdwCleaner pravým a vyber „Spustit jako správce“
klikni na „Prohledat-Scan“, po prohledání klikni na „ Vymazat-Clean“

Program provede opravu, po automatickém restartu neukáže log (C:\AdwCleaner [S?].txt) , jeho obsah sem celý vlož.

Stáhni si Junkware Removal Tool by Thisisu

na svojí plochu.

Deaktivuj si svůj antivirový program. Pravým tl. myši klikni na JRT.exe a vyber „spustit jako správce“. Pro pokračování budeš vyzván ke stisknutí jakékoliv klávesy. Na nějakou klikni.
Začne skenování programu. Skenování může trvat dloho , podle množství nákaz. Po ukončení skenu se objeví log (JRT.txt) , který se uloží na ploše.
Zkopíruj sem prosím celý jeho obsah.

. spusť znovu MbAM a dej Skenovat nyní
- po proběhnutí programu se ti objeví hláška tak klikni na „Vše do karantény(smazat vybrané)“ a na „Exportovat záznam“ a vyber „textový soubor“ , soubor nějak pojmenuj a někam ho ulož. Zkopíruj se celý obsah toho logu.

Stáhni si RogueKiller by Adlice Software
32bit.:
http://www.sur-la-toile.com/RogueKiller/RogueKiller.exe
64bit.:
http://www.sur-la-toile.com/RogueKiller ... lerX64.exe
na svojí plochu.
- Zavři všechny ostatní programy a prohlížeče.
- Pro OS Vista a win7 spusť program RogueKiller.exe jako správce , u XP poklepáním.
- počkej až skončí Prescan -vyhledávání škodlivých procesů.
- Zkontroluj , zda máš zaškrtnuto:
Kontrola MBR
Kontrola Faked
Antirootkit
-Potom klikni na „Prohledat“.
- Program skenuje procesy PC. Po proskenování klikni na „Zpráva“celý obsah logu sem zkopíruj.
Pokud je program blokován , zkus ho spustit několikrát. Pokud dále program nepůjde spustit a pracovat, přejmenuj ho na winlogon.exe.

# AdwCleaner v3.213 - Report created 25/06/2014 at 10:22:49
# Updated 23/06/2014 by Xplode
# Operating System : Windows 8 (64 bits)
# Username : Nosal - SHELLBY
# Running from : C:\Users\Nosal\Downloads\adwcleaner_3.213.exe
# Option : Clean

***** [ Services ] *****


***** [ Files / Folders ] *****

Folder Deleted : C:\ProgramData\CostMin
Folder Deleted : C:\Program Files (x86)\CostMin
Folder Deleted : C:\Program Files (x86)\Mobogenie
Folder Deleted : C:\Users\Administrator\AppData\Local\Chromatic Browser
Folder Deleted : C:\Users\Administrator\AppData\Local\torch
Folder Deleted : C:\Users\Guest\AppData\Local\Chromatic Browser
Folder Deleted : C:\Users\Guest\AppData\Local\torch
Folder Deleted : C:\Users\HomeGroupUser$\AppData\Local\Chromatic Browser
Folder Deleted : C:\Users\HomeGroupUser$\AppData\Local\torch
Folder Deleted : C:\Users\Nosal\AppData\Local\Chromatic Browser
Folder Deleted : C:\Users\Nosal\AppData\Local\torch
Folder Deleted : C:\Users\Nosal\AppData\Roaming\OpenCandy
Folder Deleted : C:\Users\Nosal\AppData\Local\Google\Chrome\User Data\Default\Extensions\dgpdioedihjhncjafcpgbbjdpbbkikmi
Folder Deleted : C:\Users\Nosal\AppData\Local\Google\Chrome\User Data\Default\Extensions\ejocekekgcaldnmjngfdbmbeebcekelc
File Deleted : C:\Windows\System32\roboot64.exe

***** [ Shortcuts ] *****


***** [ Registry ] *****

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\MobogenieAdd
Key Deleted : HKCU\Software\AppDataLow\{5F189DF5-2D05-472B-9091-84D9848AE48B}
Key Deleted : HKLM\Software\{3A7D3E19-1B79-4E4E-BD96-5467DA2C4EF0}
Key Deleted : HKLM\Software\{5F189DF5-2D05-472B-9091-84D9848AE48B}
Key Deleted : HKLM\Software\{77D46E27-0E41-4478-87A6-AABE6FBCF252}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{2F5F003B-C71B-72E3-42B4-DE51AB079EB2}

***** [ Browsers ] *****

-\\ Internet Explorer v10.0.9200.16921


-\\ Google Chrome v35.0.1916.114

[ File : C:\Users\Nosal\AppData\Local\Google\Chrome\User Data\Default\preferences ]


*************************

AdwCleaner[R0].txt - [2256 octets] - [22/06/2014 14:02:19]
AdwCleaner[R1].txt - [2318 octets] - [25/06/2014 10:21:29]
AdwCleaner[S0].txt - [2204 octets] - [25/06/2014 10:22:49]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [2264 octets] ##########

walk~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.1.4 (04.06.2014:1)
OS: Windows 8 x64
Ran by Nosal on st 25. 06. 2014 at 10:25:34,73
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values



~~~ Registry Keys



~~~ Files



~~~ Folders



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on st 25. 06. 2014 at 10:32:17,96
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

MBM:

Malwarebytes Anti-Malware
www.malwarebytes.org

Scan Date: 25. 6. 2014
Scan Time: 10:24:31
Logfile: mbam.txt
Administrator: Yes

Version: 2.00.2.1012
Malware Database: v2014.06.25.03
Rootkit Database: v2014.06.23.02
License: Trial
Malware Protection: Enabled
Malicious Website Protection: Enabled
Self-protection: Disabled

OS: Windows 8
CPU: x64
File System: NTFS
User: Nosal

Scan Type: Threat Scan
Result: Completed
Objects Scanned: 290364
Time Elapsed: 4 min, 51 sec

Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled

Processes: 0
(No malicious items detected)

Modules: 0
(No malicious items detected)

Registry Keys: 0
(No malicious items detected)

Registry Values: 0
(No malicious items detected)

Registry Data: 0
(No malicious items detected)

Folders: 0
(No malicious items detected)

Files: 19
PUP.Optional.Somoto.A, C:\Users\Nosal\Downloads\FLVPlayerSetup-N2KfUXX21.exe, Quarantined, [e7c0f488a5d61f175bc75d2db74ac23e],
PUP.Optional.Installrex, C:\Users\Nosal\Downloads\survivor-hot-girl-with-a-grudge-cze-5599989.exe, Quarantined, [0e99e29a2655d462ff5999e040c1df21],
PUP.Optional.Somoto.A, C:\Users\Nosal\Downloads\ClickHeretoDownloadSetup-8BEhc2CI (1).exe, Quarantined, [5255106c2457af8724fe107a46bb5fa1],
PUP.Optional.Somoto.A, C:\Users\Nosal\Downloads\ClickHeretoDownloadSetup-8BEhc2CI (2).exe, Quarantined, [495e93e9f982e94da9791773be43e719],
PUP.Optional.Somoto.A, C:\Users\Nosal\Downloads\ClickHeretoDownloadSetup-8BEhc2CI (3).exe, Quarantined, [fdaaf8840972a5910c163b4f10f1dd23],
PUP.Optional.Somoto.A, C:\Users\Nosal\Downloads\ClickHeretoDownloadSetup-8BEhc2CI (4).exe, Quarantined, [0b9c8bf104778fa746dc62286a97669a],
PUP.Optional.Somoto.A, C:\Users\Nosal\Downloads\ClickHeretoDownloadSetup-8BEhc2CI (5).exe, Quarantined, [c4e3f587daa188ae55cd90fae61bf709],
PUP.Optional.Somoto.A, C:\Users\Nosal\Downloads\ClickHeretoDownloadSetup-8BEhc2CI.exe, Quarantined, [f8af3a42710a9c9a62c04743bd44e917],
PUP.Optional.Somoto.A, C:\Users\Nosal\Downloads\ClickHeretoDownloadSetup-bmrNRBCC.exe, Quarantined, [f5b254281269f2441bf407084cb833cd],
PUP.Optional.Somoto.A, C:\Users\Nosal\Downloads\ClickHeretoDownloadSetup-cj7OWl2T (1).exe, Quarantined, [12954b318af13ef80a184347e91832ce],
PUP.Optional.Somoto.A, C:\Users\Nosal\Downloads\ClickHeretoDownloadSetup-cj7OWl2T.exe, Quarantined, [93144e2e641725116bb7ee9cd72ab64a],
PUP.Optional.Softonic.A, C:\Users\Nosal\Downloads\SoftonicDownloader_for_vobsub.exe, Quarantined, [6f3888f4403be5511cacac78c04145bb],
PUP.Optional.OptimumInstaller.A, C:\Users\Nosal\Downloads\StartDownload (1).exe, Quarantined, [ddcacfad661579bd244276dc837e4fb1],
PUP.Optional.OptimumInstaller.A, C:\Users\Nosal\Downloads\StartDownload.exe, Quarantined, [aef96319fe7d55e1471f272b38c9a957],
PUP.Optional.InstallCore.A, C:\Users\Nosal\Downloads\VobSub_2.23 - CHIP Downloader.exe, Quarantined, [33745c20fc7fd363c6001b3e1ee69d63],
PUP.Optional.Breitschopp, C:\Users\Nosal\Downloads\deluge+bittorrent+client_1.0 (1).exe, Quarantined, [23848feda2d99d99a4711f4fc53f3cc4],
PUP.Optional.Breitschopp, C:\Users\Nosal\Downloads\deluge+bittorrent+client_1.0.exe, Quarantined, [2483df9dee8d6ec833e2b7b7e321619f],
PUP.Optional.OpenCandy, C:\Users\Nosal\Downloads\DTLite4481-0347.exe, Quarantined, [f8afcbb136452c0a0da21199fa0af10f],
Malware.Trace, C:\Windows\Inf\ntvdm.inf, Quarantined, [5651225aa0db1620636d27bde71ca858],

Physical Sectors: 0
(No malicious items detected)


(end)

Ještě log z RogueKilleru .

RogueKiller V9.1.0.0 (x64) [Jun 23 2014] by Adlice Software
mail : http://www.adlice.com/contact/
Podpora : http://forum.adlice.com
Webové stránky : http://www.adlice.com/softwares/roguekiller/
: http://www.adlice.com

Operační systém : Windows 8 (6.2.9200 ) 64 bits version
Spuštěno v : Normální režim
Uživatel : Nosal [Práva správce]
Mód : Kontrola -- Datum : 06/25/2014 11:37:03

¤¤¤ Škodlivé procesy: : 1 ¤¤¤
[Suspicious.Path] (SVC) slsvc -- C:\Windows\slsvc.exe[-] -> ZASTAVENO

¤¤¤ ¤¤¤ Záznamy Registrů: : 10 ¤¤¤
[Suspicious.Path] (X64) HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\slsvc -> NALEZENO
[Suspicious.Path] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\slsvc -> NALEZENO
[PUM.Policies] (X64) HKEY_USERS\S-1-5-21-1262675047-2338845463-3801909896-1001\Software\Microsoft\Windows\CurrentVersion\Policies\System | DisableRegistryTools : 0 -> NALEZENO
[PUM.Policies] (X64) HKEY_USERS\S-1-5-21-1262675047-2338845463-3801909896-1001\Software\Microsoft\Windows\CurrentVersion\Policies\System | DisableTaskMgr : 0 -> NALEZENO
[PUM.Policies] (X86) HKEY_USERS\S-1-5-21-1262675047-2338845463-3801909896-1001\Software\Microsoft\Windows\CurrentVersion\Policies\System | DisableRegistryTools : 0 -> NALEZENO
[PUM.Policies] (X86) HKEY_USERS\S-1-5-21-1262675047-2338845463-3801909896-1001\Software\Microsoft\Windows\CurrentVersion\Policies\System | DisableTaskMgr : 0 -> NALEZENO
[PUM.DesktopIcons] (X64) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {20D04FE0-3AEA-1069-A2D8-08002B30309D} : 1 -> NALEZENO
[PUM.DesktopIcons] (X64) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {59031a47-3f72-44a7-89c5-5595fe6b30ee} : 1 -> NALEZENO
[PUM.DesktopIcons] (X86) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {20D04FE0-3AEA-1069-A2D8-08002B30309D} : 1 -> NALEZENO
[PUM.DesktopIcons] (X86) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {59031a47-3f72-44a7-89c5-5595fe6b30ee} : 1 -> NALEZENO

¤¤¤ naplánované úlohy : 0 ¤¤¤

¤¤¤ Soubory : 0 ¤¤¤

¤¤¤ Soubor HOSTS : 0 ¤¤¤

¤¤¤ Antirootkit : 0 ¤¤¤

¤¤¤ Webové prohlížeče : 0 ¤¤¤

¤¤¤ Kontrola MBR : ¤¤¤
+++++ PhysicalDrive0: Samsung SSD 840 EVO 120GB +++++
--- User ---
[MBR] 86e645ee622376d99eeb6495268f1c76
[BSP] 558450cc1af67b233a30f383787bd1ec : Windows Vista/7/8 MBR Code
Partition table:
0 - [ACTIVE] NTFS (0x7) [VISIBLE] Offset (sectors): 2048 | Size: 350 MB
1 - [XXXXXX] NTFS (0x7) [VISIBLE] Offset (sectors): 718848 | Size: 114121 MB
User = LL1 ... OK
User = LL2 ... OK

+++++ PhysicalDrive1: ST1000DM003-1CH162 +++++
--- User ---
[MBR] fa5bf282dcb8323ab6bc1d39ac151c61
[BSP] 9c1d90eecd7ea815779bbc1a0b734e71 : Windows Vista/7/8 MBR Code
Partition table:
0 - [XXXXXX] NTFS (0x7) [VISIBLE] Offset (sectors): 2048 | Size: 953867 MB
User = LL1 ... OK
User = LL2 ... OK

Zavři všechny programy a prohlížeče. Deaktivuj antivir a firewall.
Prosím, odpoj všechny USB nebo externí disky z počítače před spuštěním tohoto programu.
Spusť RogueKiller ( Pro Windows Vista nebo Windows 7, klepni pravým a vyber "Spustit jako správce", ve Windows XP poklepej ke spuštění).
- Počkej, až Prescan dokončí práci...
- Počkej, dokud status okno zobrazuje "Prohledat "

- V záložkách (Registry , Tasks , Web Browser apod.) vše zatrhni (dej zatržítka)

- Klikni na "Smazat"
- Počkej, dokud Status box zobrazuje " Mazání dokončeno "
- Klikni na "Zpráva " a zkopíruj a vlož obsah té zprávy prosím sem. Log je možno nalézt v RKreport [číslo]. txt na ploše.
- Zavři RogueKiller


Co problémy?