PC-HELP.CZ

České diskuzní fórum o počítačích
https://pc-help.cnews.cz/

Prosím o kontrolu logu

https://pc-help.cnews.cz/viewtopic.php?f=70&t=136077

Stránka 1 z 2

Prosím o kontrolu logu

Napsal: 12 črc 2014 10:11
od tony13
Malwarebytes mi při běžném skenu hlásil mimo jiné i Somoto, tak bych to potřeboval vyčistit. Předem děkuji.

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 10:08:27, on 12.7.2014
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Internet Explorer v9.00 (9.00.8112.16448)
CHROME: 30.0.1599.101
FIREFOX: 29.0.1 (cs)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Windows\Explorer.EXE
C:\Program Files\Apoint2K\Apoint.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\System32\igfxpers.exe
C:\Program Files\AVAST Software\Avast\avastui.exe
C:\Program Files\Comodo\COMODO Internet Security\cistray.exe
C:\Windows\ehome\ehtray.exe
C:\Windows\system32\igfxsrvc.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Apoint2K\ApMsgFwd.exe
C:\Program Files\Apoint2K\Apntex.exe
C:\Program Files\Malwarebytes Anti-Malware\mbam.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\Comodo\COMODO Internet Security\cis.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Users\Comfor\Downloads\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe
O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [AvastUI.exe] "C:\Program Files\AVAST Software\Avast\AvastUI.exe" /nogui
O4 - HKLM\..\Run: [COMODO Internet Security] C:\Program Files\COMODO\COMODO Internet Security\cistray.exe
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Utility\DAEMON Tools Lite\DTLite.exe" -autorun
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\Windows\system32\GPhotos.scr/200
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Odeslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Od&eslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\Windows\system32\browseui.dll
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\AVAST Software\Avast\AvastSvc.exe
O23 - Service: COMODO Internet Security Helper Service (cmdAgent) - COMODO - C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe
O23 - Service: COMODO Virtual Service Manager (cmdvirth) - COMODO - C:\Program Files\COMODO\COMODO Internet Security\cmdvirth.exe
O23 - Service: COMODO Dragon Update Service (DragonUpdater) - Unknown owner - C:\Program Files\Comodo\Dragon\dragon_updater.exe
O23 - Service: FLEXnet Licensing Service - Flexera Software, Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: globalUpdate Update Service (globalUpdate) (globalUpdate) - globalUpdate - C:\Program Files\globalUpdate\Update\GoogleUpdate.exe
O23 - Service: globalUpdate Update Service (globalUpdatem) (globalUpdatem) - globalUpdate - C:\Program Files\globalUpdate\Update\GoogleUpdate.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: IviRegMgr - InterVideo - C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe
O23 - Service: MBAMScheduler - Malwarebytes Corporation - C:\Program Files\Malwarebytes Anti-Malware\mbamscheduler.exe
O23 - Service: MBAMService - Malwarebytes Corporation - C:\Program Files\Malwarebytes Anti-Malware\mbamservice.exe
O23 - Service: NBService - Unknown owner - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe (file missing)
O23 - Service: PMSveH - Lenovo - C:\Program Files\Lenovo\PMDriver\PMSveH.exe
O23 - Service: Skype Updater (SkypeUpdate) - Skype Technologies - C:\Program Files\Skype\Updater\Updater.exe
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe

--
End of file - 5548 bytes

Re: Prosím o kontrolu logu

Napsal: 12 črc 2014 10:25
od jaro3
Stáhni si ATF Cleaner
Poklepej na ATF Cleaner.exe, klikni na select all found, poté:
-Když používáš Firefox (Mozzila), klikni na Firefox nahoře a vyber: Select All, poté klikni na Empty Selected.
-Když používáš Operu, klikni nahoře na Operu a vyber: Select All, poté klikni na Empty Selected. Poté klikni na Main (hlavní stránku ) a klikni na Empty Selected.
Po vyčištění klikni na Exit k zavření programu.
ATF-Cleaner je jednoduchý nástroj na odstranění historie z webového prohlížeče. Program dokáže odstranit cache, cookies, historii a další stopy po surfování na Internetu. Mezi podporované prohlížeče patří Internet Explorer, Firefox a Opera. Aplikace navíc umí odstranit dočasné soubory Windows, vysypat koš atd.

- Pokud používáš jen Google Chrome , tak ATF nemusíš použít.


Stáhni si TFC
Otevři soubor a zavři všechny ostatní okna, Klikni na Start k zahájení procesu. Program by neměl trvat dlouho.
Poté by se měl PC restartovat, pokud ne , proveď sám.

Stáhni AdwCleaner (by Xplode)
http://www.bleepingcomputer.com/download/adwcleaner/

Ulož si ho na svojí plochu
Ukonči všechny programy , okna a prohlížeče
Spusť program poklepáním a klikni na „Prohledat-Scan“
Po skenu se objeví log ( jinak je uložen systémovem disku jako AdwCleaner[R?].txt), jeho obsah sem celý vlož.

Stáhni si Malwarebytes' Anti-Malware
- Při instalaci odeber zatržítko u „Povolit bezplatnou zkušební verzi Malwarebytes' Anti-Malware Premium“
Nainstaluj a spusť ho
- na konci instalace se ujisti že máš zvoleny/zatrhnuty obě možnosti:
Aktualizace Malwarebytes' Anti-Malware a Spustit aplikaci Malwarebytes' Anti-Malware, pokud jo tak klikni na tlačítko konec
- pokud bude nalezena aktualizace, tak se stáhne a nainstaluje
- program se po té spustí a klikni na Skenovat nyní a
- po proběhnutí programu se ti objeví hláška vpravo dole tak klikni na b] Kopírovat do schránky [/b]a a vlož sem celý log.

- po té klikni na tlačítko Exit, objeví se ti hláška tak zvol Ano
(zatím nic nemaž!).

Pokud budou problémy , spusť v nouz. režimu.

Re: Prosím o kontrolu logu

Napsal: 12 črc 2014 10:55
od tony13
# AdwCleaner v3.215 - Report created 12/07/2014 at 10:37:23
# Updated 09/07/2014 by Xplode
# Operating System : Windows Vista (TM) Home Premium Service Pack 2 (32 bits)
# Username : Comfor - COMFOR-PC
# Running from : C:\Users\Comfor\Desktop\adwcleaner.exe
# Option : Scan

***** [ Services ] *****

Service Found : globalUpdate
Service Found : globalUpdatem

***** [ Files / Folders ] *****

File Found : C:\Users\Guest\AppData\Roaming\Mozilla\Firefox\Profiles\n1o2zrhp.default\.autoreg
File Found : C:\Windows\System32\Tasks\globalUpdateUpdateTaskMachineCore
File Found : C:\Windows\System32\Tasks\globalUpdateUpdateTaskMachineUA
File Found : C:\Windows\Tasks\globalUpdateUpdateTaskMachineCore.job
File Found : C:\Windows\Tasks\globalUpdateUpdateTaskMachineUA.job
Folder Found : C:\Program Files\globalUpdate
Folder Found : C:\Program Files\GreenTree Applications
Folder Found : C:\Users\Comfor\AppData\Local\globalUpdate
Folder Found : C:\Users\Comfor\AppData\Roaming\NCH Software
Folder Found : C:\Users\Guest\AppData\LocalLow\SearchquTB

***** [ Shortcuts ] *****


***** [ Registry ] *****

Key Found : HKCU\Software\installedbrowserextensions
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\1ClickDownload
Key Found : HKLM\SOFTWARE\Classes\AppID\{C007DADD-132A-624C-088E-59EE6CF0711F}
Key Found : HKLM\Software\installedbrowserextensions
Key Found : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{EB6FCC31-CF00-4A26-B88A-3EEAA9940B02}
Key Found : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{92D0A040-9A1B-431A-A020-4834D499701E}
Key Found : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{92D0A040-9A1B-431A-A020-4834D499701E}
Key Found : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{AEE85005-7261-488E-8123-C22216455864}
Key Found : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{EB6FCC31-CF00-4A26-B88A-3EEAA9940B02}
Key Found : HKLM\SOFTWARE\MozillaPlugins\@staging.google.com/globalUpdate Update;version=10
Key Found : HKLM\SOFTWARE\MozillaPlugins\@staging.google.com/globalUpdate Update;version=4
Value Found : HKCU\Software\Microsoft\Internet Explorer\Main [ICQ Search]

***** [ Browsers ] *****

-\\ Internet Explorer v9.0.8112.16448


-\\ Mozilla Firefox v29.0.1 (cs)

[ File : C:\Users\Comfor\AppData\Roaming\Mozilla\Firefox\Profiles\5ye992uu.default\prefs.js ]


[ File : C:\Users\Guest\AppData\Roaming\Mozilla\Firefox\Profiles\n1o2zrhp.default\prefs.js ]

Line Found : user_pref("browser.search.selectedEngine", "Web Search");

-\\ Google Chrome v

[ File : C:\Users\Comfor\AppData\Local\Google\Chrome\User Data\Default\preferences ]

Found [Extension] : dhdepfaagokllfmhfbcfmocaeigmoebo
Found [Extension] : fbmimoidopbghbcmdmpkjaffffmcbmbg
Found [Extension] : hphibigbodkkohoglgfkddblldpfohjl
Found [Extension] : kdcnnmifdmlmjffdgeieikcokcogpbej
Found [Extension] : kincjchfokkeneeofpeefomkikfkiedl
Found [Extension] : kkkeikdkpjenmoiicggnnodbkebafgpc
Found [Extension] : pgmfkblbflahhponhjmkcnpjinenhlnc

*************************

AdwCleaner[R0].txt - [48011 octets] - [05/11/2013 12:56:03]
AdwCleaner[R1].txt - [48072 octets] - [06/11/2013 09:31:24]
AdwCleaner[R2].txt - [3329 octets] - [12/07/2014 10:37:23]
AdwCleaner[S0].txt - [17216 octets] - [06/11/2013 09:33:21]

########## EOF - C:\AdwCleaner\AdwCleaner[R2].txt - [3450 octets] ##########

Re: Prosím o kontrolu logu

Napsal: 12 črc 2014 10:56
od tony13
Malwarebytes Anti-Malware
www.malwarebytes.org

Datum skenování: 12.7.2014
Čas skenování: 10:42:05
Protokol: malware.txt
Správce: Ano

Verze: 2.00.2.1012
Databáze malwaru: v2014.07.12.01
Databáze rootkitů: v2014.07.09.01
Licence: Premium
Ochrana proti malwaru: Vypnuto
Ochrana proti škodlivým webovým stránkám: Zapnuto
Self-protection: Vypnuto

OS: Windows Vista Service Pack 2
CPU: x86
Souborový systém: NTFS
Uživatel: Comfor

Typ skenu: Sken hrozeb
Výsledek: Dokončeno
Prohledaných objektů: 318419
Uplynulý čas: 11 min, 17 sek

Paměť: Zapnuto
Po spuštění: Zapnuto
Souborový systém: Zapnuto
Archivy: Zapnuto
Rootkity: Vypnuto
Heuristics: Zapnuto
PUP: Varovat
PUM: Zapnuto

Procesy: 1
PUP.Optional.GlobalUpdate.T, C:\Program Files\globalUpdate\Update\GoogleUpdate.exe, 1688, , [ebb6831bd4a78da962561b9c33cff50b]

Moduly: 1
PUP.Optional.GlobalUpdate.T, C:\Program Files\globalUpdate\Update\1.3.25.0\goopdate.dll, , [ebb6831bd4a78da962561b9c33cff50b],

Klíče registru: 14
PUP.Optional.GlobalUpdate.T, HKLM\SOFTWARE\GLOBALUPDATE\UPDATE, , [a8f99e00d9a21e18d86a9f19f012e917],
PUP.Optional.GlobalUpdate.T, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\globalUpdate, , [ebb6831bd4a78da962561b9c33cff50b],
PUP.Optional.GlobalUpdate.T, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\globalUpdatem, , [ebb6831bd4a78da962561b9c33cff50b],
PUP.Optional.GlobalUpdate.T, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\GOOGLEUPDATE.EXE, , [ebb6831bd4a78da962561b9c33cff50b],
PUP.Optional.GlobalUpdate.T, HKLM\SOFTWARE\CLASSES\CLSID\{5645E0E7-FC12-43BF-A6E4-F9751942B298}, , [ebb6831bd4a78da962561b9c33cff50b],
PUP.Optional.GlobalUpdate.T, HKLM\SOFTWARE\CLASSES\globalUpdate.OneClickCtrl.10, , [ebb6831bd4a78da962561b9c33cff50b],
PUP.Optional.GlobalUpdate.T, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\ELEVATIONPOLICY\{5645E0E7-FC12-43BF-A6E4-F9751942B298}, , [ebb6831bd4a78da962561b9c33cff50b],
PUP.Optional.GlobalUpdate.T, HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\PREAPPROVED\{5645E0E7-FC12-43BF-A6E4-F9751942B298}, , [ebb6831bd4a78da962561b9c33cff50b],
PUP.Optional.GlobalUpdate.T, HKLM\SOFTWARE\CLASSES\CLSID\{C7BF8F4B-7BC7-4F42-B944-3D28A3A86D8A}, , [ebb6831bd4a78da962561b9c33cff50b],
PUP.Optional.GlobalUpdate.T, HKLM\SOFTWARE\CLASSES\globalUpdate.Update3WebControl.4, , [ebb6831bd4a78da962561b9c33cff50b],
PUP.Optional.GlobalUpdate.T, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\ELEVATIONPOLICY\{C7BF8F4B-7BC7-4F42-B944-3D28A3A86D8A}, , [ebb6831bd4a78da962561b9c33cff50b],
PUP.Optional.GlobalUpdate.T, HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\PREAPPROVED\{C7BF8F4B-7BC7-4F42-B944-3D28A3A86D8A}, , [ebb6831bd4a78da962561b9c33cff50b],
PUP.Optional.GlobalUpdate.T, HKLM\SOFTWARE\CLASSES\CLSID\{CFC47BB5-5FB5-4AD0-8427-6AA04334A3FC}, , [ebb6831bd4a78da962561b9c33cff50b],
PUP.Optional.GlobalUpdate.T, HKLM\SOFTWARE\CLASSES\CLSID\{E0ADB535-D7B5-4D8B-B15D-578BDD20D76A}, , [ebb6831bd4a78da962561b9c33cff50b],

Hodnoty registru: 1
PUP.Optional.GlobalUpdate.T, HKLM\SOFTWARE\GLOBALUPDATE\UPDATE|path, C:\Program Files\globalUpdate\Update\GoogleUpdate.exe, , [a8f99e00d9a21e18d86a9f19f012e917]

Data registru: 0
(No malicious items detected)

Složky: 6
PUP.Optional.GlobalUpdate.T, C:\Program Files\globalUpdate\Update, , [ebb6831bd4a78da962561b9c33cff50b],
PUP.Optional.GlobalUpdate.T, C:\Program Files\globalUpdate\Update\1.3.25.0, , [ebb6831bd4a78da962561b9c33cff50b],
PUP.Optional.GlobalUpdate.T, C:\Program Files\globalUpdate\Update\Download, , [ebb6831bd4a78da962561b9c33cff50b],
PUP.Optional.GlobalUpdate.T, C:\Program Files\globalUpdate\Update\Install, , [ebb6831bd4a78da962561b9c33cff50b],
PUP.Optional.GlobalUpdate.T, C:\Program Files\globalUpdate\Update\Offline, , [ebb6831bd4a78da962561b9c33cff50b],
PUP.Optional.GlobalUpdate.T, C:\Program Files\globalUpdate\Update\Offline\{98A800CB-6FB5-4B78-B2E8-7C2E0D73B8FD}, , [ebb6831bd4a78da962561b9c33cff50b],

Soubory: 15
PUP.Optional.GlobalUpdate.A, C:\Windows\Tasks\globalUpdateUpdateTaskMachineCore.job, , [b6ebabf3bcbf4de955bd28efcd37c13f],
PUP.Optional.GlobalUpdate.A, C:\Windows\System32\Tasks\globalUpdateUpdateTaskMachineCore, , [9f02930bd9a20531977c8691ab59b64a],
PUP.Optional.GlobalUpdate.A, C:\Windows\Tasks\globalUpdateUpdateTaskMachineUA.job, , [455c5c426e0d979f1004a572b54fd927],
PUP.Optional.GlobalUpdate.A, C:\Windows\System32\Tasks\globalUpdateUpdateTaskMachineUA, , [dfc2aef0e99270c6a66f8d8ad430bb45],
PUP.Optional.GlobalUpdate.T, C:\Program Files\globalUpdate\Update\GoogleUpdate.exe, , [ebb6831bd4a78da962561b9c33cff50b],
PUP.Optional.GlobalUpdate.T, C:\Program Files\globalUpdate\Update\1.3.25.0\GoogleCrashHandler.exe, , [ebb6831bd4a78da962561b9c33cff50b],
PUP.Optional.GlobalUpdate.T, C:\Program Files\globalUpdate\Update\1.3.25.0\GoogleUpdate.exe, , [ebb6831bd4a78da962561b9c33cff50b],
PUP.Optional.GlobalUpdate.T, C:\Program Files\globalUpdate\Update\1.3.25.0\GoogleUpdateBroker.exe, , [ebb6831bd4a78da962561b9c33cff50b],
PUP.Optional.GlobalUpdate.T, C:\Program Files\globalUpdate\Update\1.3.25.0\GoogleUpdateHelper.msi, , [ebb6831bd4a78da962561b9c33cff50b],
PUP.Optional.GlobalUpdate.T, C:\Program Files\globalUpdate\Update\1.3.25.0\GoogleUpdateOnDemand.exe, , [ebb6831bd4a78da962561b9c33cff50b],
PUP.Optional.GlobalUpdate.T, C:\Program Files\globalUpdate\Update\1.3.25.0\goopdate.dll, , [ebb6831bd4a78da962561b9c33cff50b],
PUP.Optional.GlobalUpdate.T, C:\Program Files\globalUpdate\Update\1.3.25.0\goopdateres_en.dll, , [ebb6831bd4a78da962561b9c33cff50b],
PUP.Optional.GlobalUpdate.T, C:\Program Files\globalUpdate\Update\1.3.25.0\npGoogleUpdate4.dll, , [ebb6831bd4a78da962561b9c33cff50b],
PUP.Optional.GlobalUpdate.T, C:\Program Files\globalUpdate\Update\1.3.25.0\psmachine.dll, , [ebb6831bd4a78da962561b9c33cff50b],
PUP.Optional.GlobalUpdate.T, C:\Program Files\globalUpdate\Update\1.3.25.0\psuser.dll, , [ebb6831bd4a78da962561b9c33cff50b],

Fyzické sektory: 0
(No malicious items detected)


(end)

Re: Prosím o kontrolu logu

Napsal: 13 črc 2014 08:13
od Orcus
- Znovu spusť MbAM a dej Skenovat nyní
- Po proběhnutí programu se ti objeví hláška, tak klikni na „Vše do karantény“ -> „Exportovat záznam“ a vyber „textový soubor“ , soubor nějak pojmenuj a ulož na Plochu.
- Zkopíruj sem celý obsah toho logu.

====================================================

Spusť znovu AdwCleaner (u Windows Vista či Windows7, klikni na AdwCleaner pravým a vyber „Spustit jako správce“
Klikni na „ Smazat“
Program provede opravu, po automatickém restartu neukáže log (C:\AdwCleaner [S?].txt) , jeho obsah sem celý vlož.

====================================================

Stáhni si Junkware Removal Tool

na svojí plochu.
Deaktivuj si svůj antivirový program.
Pravým tl. myši klikni na JRT.exe a vyber „spustit jako správce“. Pro pokračování budeš vyzván ke stisknutí jakékoliv klávesy. Na nějakou klikni.
Začne skenování programu. Skenování může trvat dloho , podle množství nákaz. Po ukončení skenu se objeví log (JRT.txt) , který se uloží na ploše.
Zkopíruj sem prosím celý jeho obsah.

====================================================

Stáhni si RogueKiller
32bit.:
http://www.sur-la-toile.com/RogueKiller/RogueKiller.exe
64bit.:
http://www.sur-la-toile.com/RogueKiller ... lerX64.exe
na svojí plochu.
- Zavři všechny ostatní programy a prohlížeče.
- Pro OS Vista a win7 spusť program RogueKiller.exe jako správce , u XP poklepáním.
- počkej až skončí Prescan -vyhledávání škodlivých procesů.
- Zkontroluj , zda máš zaškrtnuto:
Kontrola MBR
Kontrola Faked
Antirootkit
-Potom klikni na „Prohledat“.
- Program skenuje procesy PC. Po proskenování klikni na „Zpráva“celý obsah logu sem zkopíruj.
Pokud je program blokován , zkus ho spustit několikrát. Pokud dále program nepůjde spustit a pracovat, přejmenuj ho na winlogon.exe.

Re: Prosím o kontrolu logu

Napsal: 13 črc 2014 11:38
od tony13
Log z Malwarebytes se mi do textového souboru nepodařilo uložit, protože se počítač restartoval a našel jsem ho jen takto, tak snad stačí:

<?xml version="1.0" encoding="UTF-16"?>
-<mbam-log> -<header> <date>2014/07/13 11:05:42 +0200</date> <logfile>mbam-log-2014-07-13 (11-05-41).xml</logfile> <isadmin>yes</isadmin> </header> -<engine> <version>2.00.2.1012</version> <malware-database>v2014.07.13.01</malware-database> <rootkit-database>v2014.07.09.01</rootkit-database> <license>premium</license> <file-protection>disabled</file-protection> <web-protection>enabled</web-protection> <self-protection>disabled</self-protection> </engine> -<system> <osversion>Windows Vista Service Pack 2</osversion> <arch>x86</arch> <username>Comfor</username> <filesys>NTFS</filesys> </system> -<summary> <type>threat</type> <result>completed</result> <objects>318746</objects> <time>753</time> <processes>1</processes> <modules>1</modules> <keys>14</keys> <values>1</values> <datas>0</datas> <folders>6</folders> <files>15</files> <sectors>0</sectors> </summary> -<options> <memory>enabled</memory> <startup>enabled</startup> <filesystem>enabled</filesystem> <archives>enabled</archives> <rootkits>disabled</rootkits> <deeprootkit>disabled</deeprootkit> <heuristics>enabled</heuristics> <pup>warn</pup> <pum>enabled</pum> </options> -<items> -<process><path>C:\Program Files\globalUpdate\Update\GoogleUpdate.exe</path><vendor>PUP.Optional.GlobalUpdate.T</vendor><action>delete-on-reboot</action><pid>4056</pid><hash>9174b2edafcc9f9719eecaeee0226c94</hash></process> -<module><path>C:\Program Files\globalUpdate\Update\1.3.25.0\goopdate.dll</path><vendor>PUP.Optional.GlobalUpdate.T</vendor><action>delete-on-reboot</action><hash>9174b2edafcc9f9719eecaeee0226c94</hash></module> -<key><path>HKLM\SOFTWARE\GLOBALUPDATE\UPDATE</path><vendor>PUP.Optional.GlobalUpdate.T</vendor><action>success</action><hash>3ec77d22f784ab8b98424474788a35cb</hash></key> -<key><path>HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\globalUpdate</path><vendor>PUP.Optional.GlobalUpdate.T</vendor><action>success</action><hash>9174b2edafcc9f9719eecaeee0226c94</hash></key> -<key><path>HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\globalUpdatem</path><vendor>PUP.Optional.GlobalUpdate.T</vendor><action>success</action><hash>9174b2edafcc9f9719eecaeee0226c94</hash></key> -<key><path>HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\GOOGLEUPDATE.EXE</path><vendor>PUP.Optional.GlobalUpdate.T</vendor><action>success</action><hash>9174b2edafcc9f9719eecaeee0226c94</hash></key> -<key><path>HKLM\SOFTWARE\CLASSES\CLSID\{5645E0E7-FC12-43BF-A6E4-F9751942B298}</path><vendor>PUP.Optional.GlobalUpdate.T</vendor><action>success</action><hash>9174b2edafcc9f9719eecaeee0226c94</hash></key> -<key><path>HKLM\SOFTWARE\CLASSES\globalUpdate.OneClickCtrl.10</path><vendor>PUP.Optional.GlobalUpdate.T</vendor><action>success</action><hash>9174b2edafcc9f9719eecaeee0226c94</hash></key> -<key><path>HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\ELEVATIONPOLICY\{5645E0E7-FC12-43BF-A6E4-F9751942B298}</path><vendor>PUP.Optional.GlobalUpdate.T</vendor><action>success</action><hash>9174b2edafcc9f9719eecaeee0226c94</hash></key> -<key><path>HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\PREAPPROVED\{5645E0E7-FC12-43BF-A6E4-F9751942B298}</path><vendor>PUP.Optional.GlobalUpdate.T</vendor><action>success</action><hash>9174b2edafcc9f9719eecaeee0226c94</hash></key> -<key><path>HKLM\SOFTWARE\CLASSES\CLSID\{C7BF8F4B-7BC7-4F42-B944-3D28A3A86D8A}</path><vendor>PUP.Optional.GlobalUpdate.T</vendor><action>success</action><hash>9174b2edafcc9f9719eecaeee0226c94</hash></key> -<key><path>HKLM\SOFTWARE\CLASSES\globalUpdate.Update3WebControl.4</path><vendor>PUP.Optional.GlobalUpdate.T</vendor><action>success</action><hash>9174b2edafcc9f9719eecaeee0226c94</hash></key> -<key><path>HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\ELEVATIONPOLICY\{C7BF8F4B-7BC7-4F42-B944-3D28A3A86D8A}</path><vendor>PUP.Optional.GlobalUpdate.T</vendor><action>success</action><hash>9174b2edafcc9f9719eecaeee0226c94</hash></key> -<key><path>HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\PREAPPROVED\{C7BF8F4B-7BC7-4F42-B944-3D28A3A86D8A}</path><vendor>PUP.Optional.GlobalUpdate.T</vendor><action>success</action><hash>9174b2edafcc9f9719eecaeee0226c94</hash></key> -<key><path>HKLM\SOFTWARE\CLASSES\CLSID\{CFC47BB5-5FB5-4AD0-8427-6AA04334A3FC}</path><vendor>PUP.Optional.GlobalUpdate.T</vendor><action>success</action><hash>9174b2edafcc9f9719eecaeee0226c94</hash></key> -<key><path>HKLM\SOFTWARE\CLASSES\CLSID\{E0ADB535-D7B5-4D8B-B15D-578BDD20D76A}</path><vendor>PUP.Optional.GlobalUpdate.T</vendor><action>success</action><hash>9174b2edafcc9f9719eecaeee0226c94</hash></key> -<value><path>HKLM\SOFTWARE\GLOBALUPDATE\UPDATE</path><valuename>path</valuename><vendor>PUP.Optional.GlobalUpdate.T</vendor><action>success</action><valuedata>C:\Program Files\globalUpdate\Update\GoogleUpdate.exe</valuedata><hash>3ec77d22f784ab8b98424474788a35cb</hash></value> -<folder><path>C:\Program Files\globalUpdate\Update</path><vendor>PUP.Optional.GlobalUpdate.T</vendor><action>delete-on-reboot</action><hash>9174b2edafcc9f9719eecaeee0226c94</hash></folder> -<folder><path>C:\Program Files\globalUpdate\Update\1.3.25.0</path><vendor>PUP.Optional.GlobalUpdate.T</vendor><action>delete-on-reboot</action><hash>9174b2edafcc9f9719eecaeee0226c94</hash></folder> -<folder><path>C:\Program Files\globalUpdate\Update\Download</path><vendor>PUP.Optional.GlobalUpdate.T</vendor><action>success</action><hash>9174b2edafcc9f9719eecaeee0226c94</hash></folder> -<folder><path>C:\Program Files\globalUpdate\Update\Install</path><vendor>PUP.Optional.GlobalUpdate.T</vendor><action>success</action><hash>9174b2edafcc9f9719eecaeee0226c94</hash></folder> -<folder><path>C:\Program Files\globalUpdate\Update\Offline</path><vendor>PUP.Optional.GlobalUpdate.T</vendor><action>success</action><hash>9174b2edafcc9f9719eecaeee0226c94</hash></folder> -<folder><path>C:\Program Files\globalUpdate\Update\Offline\{98A800CB-6FB5-4B78-B2E8-7C2E0D73B8FD}</path><vendor>PUP.Optional.GlobalUpdate.T</vendor><action>success</action><hash>9174b2edafcc9f9719eecaeee0226c94</hash></folder> -<file><path>C:\Windows\Tasks\globalUpdateUpdateTaskMachineCore.job</path><vendor>PUP.Optional.GlobalUpdate.A</vendor><action>success</action><hash>fc09732cf68581b5851667b048bcaf51</hash></file> -<file><path>C:\Windows\System32\Tasks\globalUpdateUpdateTaskMachineCore</path><vendor>PUP.Optional.GlobalUpdate.A</vendor><action>success</action><hash>9e675e41bfbc3cfa0a929d7a857fc33d</hash></file> -<file><path>C:\Windows\Tasks\globalUpdateUpdateTaskMachineUA.job</path><vendor>PUP.Optional.GlobalUpdate.A</vendor><action>success</action><hash>996c514e4536b185cecf74a345bfda26</hash></file> -<file><path>C:\Windows\System32\Tasks\globalUpdateUpdateTaskMachineUA</path><vendor>PUP.Optional.GlobalUpdate.A</vendor><action>success</action><hash>50b58b146e0d171f049a8295897bb14f</hash></file> -<file><path>C:\Program Files\globalUpdate\Update\GoogleUpdate.exe</path><vendor>PUP.Optional.GlobalUpdate.T</vendor><action>delete-on-reboot</action><hash>9174b2edafcc9f9719eecaeee0226c94</hash></file> -<file><path>C:\Program Files\globalUpdate\Update\1.3.25.0\GoogleCrashHandler.exe</path><vendor>PUP.Optional.GlobalUpdate.T</vendor><action>success</action><hash>9174b2edafcc9f9719eecaeee0226c94</hash></file> -<file><path>C:\Program Files\globalUpdate\Update\1.3.25.0\GoogleUpdate.exe</path><vendor>PUP.Optional.GlobalUpdate.T</vendor><action>success</action><hash>9174b2edafcc9f9719eecaeee0226c94</hash></file> -<file><path>C:\Program Files\globalUpdate\Update\1.3.25.0\GoogleUpdateBroker.exe</path><vendor>PUP.Optional.GlobalUpdate.T</vendor><action>success</action><hash>9174b2edafcc9f9719eecaeee0226c94</hash></file> -<file><path>C:\Program Files\globalUpdate\Update\1.3.25.0\GoogleUpdateHelper.msi</path><vendor>PUP.Optional.GlobalUpdate.T</vendor><action>success</action><hash>9174b2edafcc9f9719eecaeee0226c94</hash></file> -<file><path>C:\Program Files\globalUpdate\Update\1.3.25.0\GoogleUpdateOnDemand.exe</path><vendor>PUP.Optional.GlobalUpdate.T</vendor><action>success</action><hash>9174b2edafcc9f9719eecaeee0226c94</hash></file> -<file><path>C:\Program Files\globalUpdate\Update\1.3.25.0\goopdate.dll</path><vendor>PUP.Optional.GlobalUpdate.T</vendor><action>delete-on-reboot</action><hash>9174b2edafcc9f9719eecaeee0226c94</hash></file> -<file><path>C:\Program Files\globalUpdate\Update\1.3.25.0\goopdateres_en.dll</path><vendor>PUP.Optional.GlobalUpdate.T</vendor><action>success</action><hash>9174b2edafcc9f9719eecaeee0226c94</hash></file> -<file><path>C:\Program Files\globalUpdate\Update\1.3.25.0\npGoogleUpdate4.dll</path><vendor>PUP.Optional.GlobalUpdate.T</vendor><action>success</action><hash>9174b2edafcc9f9719eecaeee0226c94</hash></file> -<file><path>C:\Program Files\globalUpdate\Update\1.3.25.0\psmachine.dll</path><vendor>PUP.Optional.GlobalUpdate.T</vendor><action>success</action><hash>9174b2edafcc9f9719eecaeee0226c94</hash></file> -<file><path>C:\Program Files\globalUpdate\Update\1.3.25.0\psuser.dll</path><vendor>PUP.Optional.GlobalUpdate.T</vendor><action>success</action><hash>9174b2edafcc9f9719eecaeee0226c94</hash></file> </items> </mbam-log>

Re: Prosím o kontrolu logu

Napsal: 13 črc 2014 11:40
od tony13
# AdwCleaner v3.215 - Report created 13/07/2014 at 11:31:28
# Updated 09/07/2014 by Xplode
# Operating System : Windows Vista (TM) Home Premium Service Pack 2 (32 bits)
# Username : Comfor - COMFOR-PC
# Running from : C:\Users\Comfor\Desktop\adwcleaner.exe
# Option : Clean

***** [ Services ] *****


***** [ Files / Folders ] *****

Folder Deleted : C:\Program Files\globalUpdate
Folder Deleted : C:\Program Files\GreenTree Applications
Folder Deleted : C:\Users\Comfor\AppData\Local\globalUpdate
Folder Deleted : C:\Users\Comfor\AppData\Roaming\NCH Software
Folder Deleted : C:\Users\Guest\AppData\LocalLow\SearchquTB
File Deleted : C:\Users\Guest\AppData\Roaming\Mozilla\Firefox\Profiles\n1o2zrhp.default\.autoreg

***** [ Shortcuts ] *****


***** [ Registry ] *****

[#] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{EB6FCC31-CF00-4A26-B88A-3EEAA9940B02}
[#] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{EB6FCC31-CF00-4A26-B88A-3EEAA9940B02}
[#] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{92D0A040-9A1B-431A-A020-4834D499701E}
[#] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{92D0A040-9A1B-431A-A020-4834D499701E}
[#] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{AEE85005-7261-488E-8123-C22216455864}
Value Deleted : HKCU\Software\Microsoft\Internet Explorer\Main [ICQ Search]
Key Deleted : HKLM\SOFTWARE\MozillaPlugins\@staging.google.com/globalUpdate Update;version=10
Key Deleted : HKLM\SOFTWARE\MozillaPlugins\@staging.google.com/globalUpdate Update;version=4
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{C007DADD-132A-624C-088E-59EE6CF0711F}
Key Deleted : HKCU\Software\installedbrowserextensions
Key Deleted : HKLM\Software\installedbrowserextensions
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\1ClickDownload

***** [ Browsers ] *****

-\\ Internet Explorer v9.0.8112.16448


-\\ Mozilla Firefox v29.0.1 (cs)

[ File : C:\Users\Comfor\AppData\Roaming\Mozilla\Firefox\Profiles\5ye992uu.default\prefs.js ]


[ File : C:\Users\Guest\AppData\Roaming\Mozilla\Firefox\Profiles\n1o2zrhp.default\prefs.js ]

Line Deleted : user_pref("browser.search.selectedEngine", "Web Search");

-\\ Google Chrome v

[ File : C:\Users\Comfor\AppData\Local\Google\Chrome\User Data\Default\preferences ]

Deleted [Extension] : dhdepfaagokllfmhfbcfmocaeigmoebo
Deleted [Extension] : fbmimoidopbghbcmdmpkjaffffmcbmbg
Deleted [Extension] : hphibigbodkkohoglgfkddblldpfohjl
Deleted [Extension] : kdcnnmifdmlmjffdgeieikcokcogpbej
Deleted [Extension] : kincjchfokkeneeofpeefomkikfkiedl
Deleted [Extension] : kkkeikdkpjenmoiicggnnodbkebafgpc
Deleted [Extension] : pgmfkblbflahhponhjmkcnpjinenhlnc

*************************

AdwCleaner[R0].txt - [48011 octets] - [05/11/2013 12:56:03]
AdwCleaner[R1].txt - [48072 octets] - [06/11/2013 09:31:24]
AdwCleaner[R2].txt - [3530 octets] - [12/07/2014 10:37:23]
AdwCleaner[R3].txt - [3247 octets] - [13/07/2014 11:29:05]
AdwCleaner[S0].txt - [17216 octets] - [06/11/2013 09:33:21]
AdwCleaner[S1].txt - [3240 octets] - [13/07/2014 11:31:28]

########## EOF - C:\AdwCleaner\AdwCleaner[S1].txt - [3300 octets] ##########

Re: Prosím o kontrolu logu

Napsal: 13 črc 2014 12:04
od tony13
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.1.3 (03.23.2014:1)
OS: Windows Vista (TM) Home Premium x86
Ran by Comfor on ne 13.07.2014 at 11:47:49,36
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values




~~~ Registry Keys



~~~ Files



~~~ Folders

Successfully deleted: [Folder] "C:\Users\Comfor\AppData\Roaming\getrighttogo"



~~~ FireFox

Emptied folder: C:\Users\Comfor\AppData\Roaming\mozilla\firefox\profiles\5ye992uu.default\minidumps [177 files]



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on ne 13.07.2014 at 12:02:45,00
Computer was rebooted
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Re: Prosím o kontrolu logu

Napsal: 13 črc 2014 12:17
od tony13
RogueKiller V9.2.2.0 [Jul 11 2014] by Adlice Software
mail : http://www.adlice.com/contact/
Podpora : http://forum.adlice.com
Webové stránky : http://www.adlice.com/softwares/roguekiller/
: http://www.adlice.com

Operační systém : Windows Vista (6.0.6002 Service Pack 2) 32 bits version
Spuštěno v : Normální režim
Uživatel : Comfor [Práva správce]
Mód : Kontrola -- Datum : 07/13/2014 12:15:44

¤¤¤ Škodlivé procesy: : 0 ¤¤¤

¤¤¤ ¤¤¤ Záznamy Registrů: : 15 ¤¤¤
[PUM.Dns] HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters | DhcpNameServer : 10.0.0.1 -> NALEZENO
[PUM.Dns] HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Tcpip\Parameters | DhcpNameServer : 10.0.0.1 -> NALEZENO
[PUM.Dns] HKEY_LOCAL_MACHINE\System\ControlSet003\Services\Tcpip\Parameters | DhcpNameServer : 10.0.0.1 -> NALEZENO
[PUM.Dns] HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{5FFEE5D1-D46A-4E06-BB58-DBB25392C431} | DhcpNameServer : 10.0.0.1 -> NALEZENO
[PUM.Dns] HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{DD91456F-7CA2-4148-89C6-D2ED66C74254} | DhcpNameServer : 192.168.88.1 193.85.1.100 193.85.2.100 -> NALEZENO
[PUM.Dns] HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Tcpip\Parameters\Interfaces\{5FFEE5D1-D46A-4E06-BB58-DBB25392C431} | DhcpNameServer : 10.0.0.1 -> NALEZENO
[PUM.Dns] HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Tcpip\Parameters\Interfaces\{DD91456F-7CA2-4148-89C6-D2ED66C74254} | DhcpNameServer : 192.168.88.1 193.85.1.100 193.85.2.100 -> NALEZENO
[PUM.Dns] HKEY_LOCAL_MACHINE\System\ControlSet003\Services\Tcpip\Parameters\Interfaces\{5FFEE5D1-D46A-4E06-BB58-DBB25392C431} | DhcpNameServer : 10.0.0.1 -> NALEZENO
[PUM.Dns] HKEY_LOCAL_MACHINE\System\ControlSet003\Services\Tcpip\Parameters\Interfaces\{DD91456F-7CA2-4148-89C6-D2ED66C74254} | DhcpNameServer : 192.168.88.1 193.85.1.100 193.85.2.100 -> NALEZENO
[PUM.Policies] HKEY_USERS\S-1-5-21-209910396-3507630868-571481715-1003\Software\Microsoft\Windows\CurrentVersion\Policies\System | DisableRegistryTools : 0 -> NALEZENO
[PUM.Policies] HKEY_USERS\S-1-5-21-209910396-3507630868-571481715-1003\Software\Microsoft\Windows\CurrentVersion\Policies\System | DisableTaskMgr : 0 -> NALEZENO
[PUM.Policies] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System | DisableRegistryTools : 0 -> NALEZENO
[PUM.Policies] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System | EnableLUA : 0 -> NALEZENO
[PUM.DesktopIcons] HKEY_USERS\S-1-5-21-209910396-3507630868-571481715-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\ClassicStartMenu | {59031A47-3F72-44A7-89C5-5595FE6B30EE} : 1 -> NALEZENO
[PUM.DesktopIcons] HKEY_USERS\S-1-5-21-209910396-3507630868-571481715-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {59031A47-3F72-44A7-89C5-5595FE6B30EE} : 1 -> NALEZENO

¤¤¤ naplánované úlohy : 0 ¤¤¤

¤¤¤ Soubory : 0 ¤¤¤

¤¤¤ Soubor HOSTS : 1 ¤¤¤
[C:\Windows\System32\drivers\etc\hosts] 127.0.0.1 localhost

¤¤¤ Antirootkit : 7 (Driver: NAHRÁNO) ¤¤¤
[IRP:Addr(Hook.IRP)] \SystemRoot\System32\drivers\mountmgr.sys - IRP_MJ_CREATE[0] : Unknown @ 0x853331f8
[IRP:Addr(Hook.IRP)] \SystemRoot\System32\drivers\mountmgr.sys - IRP_MJ_CLOSE[2] : Unknown @ 0x853331f8
[IRP:Addr(Hook.IRP)] \SystemRoot\System32\drivers\mountmgr.sys - IRP_MJ_DEVICE_CONTROL[14] : Unknown @ 0x853331f8
[IRP:Addr(Hook.IRP)] \SystemRoot\System32\drivers\mountmgr.sys - IRP_MJ_INTERNAL_DEVICE_CONTROL[15] : Unknown @ 0x853331f8
[IRP:Addr(Hook.IRP)] \SystemRoot\System32\drivers\mountmgr.sys - IRP_MJ_POWER[22] : Unknown @ 0x853331f8
[IRP:Addr(Hook.IRP)] \SystemRoot\System32\drivers\mountmgr.sys - IRP_MJ_SYSTEM_CONTROL[23] : Unknown @ 0x853331f8
[IRP:Addr(Hook.IRP)] \SystemRoot\System32\drivers\mountmgr.sys - IRP_MJ_PNP[27] : Unknown @ 0x853331f8

¤¤¤ Webové prohlížeče : 2 ¤¤¤
[PUM.Proxy][FIREFX:Config] 5ye992uu.default : user_pref("network.proxy.http", "proxy.mendelu.cz"); -> NALEZENO
[PUM.Proxy][FIREFX:Config] 5ye992uu.default : user_pref("network.proxy.http_port", 5555); -> NALEZENO

¤¤¤ Kontrola MBR : ¤¤¤
+++++ PhysicalDrive0: WDC WD2500BEVT-88ZCT0 ATA Device +++++
--- User ---
[MBR] 9197f2cba4fdf160c3d41a3a90e8f46e
[BSP] 73ee09f6a8c6eaee0636e5b22a4bcb19 : HP MBR Code
Partition table:
0 - [ACTIVE] NTFS (0x7) [VISIBLE] Offset (sectors): 2048 | Size: 1500 MB
1 - [XXXXXX] NTFS (0x7) [VISIBLE] Offset (sectors): 3074048 | Size: 209726 MB
2 - [XXXXXX] EXTEN (0x5) [VISIBLE] Offset (sectors): 432598320 | Size: 27243 MB
User = LL1 ... OK
User = LL2 ... OK

Re: Prosím o kontrolu logu

Napsal: 13 črc 2014 18:39
od jaro3
. spusť znovu MbAM a dej Skenovat nyní
- po proběhnutí programu se ti objeví hláška tak klikni na „Vše do karantény(smazat vybrané)“ a na „Exportovat záznam“ a vyber „textový soubor“ , soubor nějak pojmenuj a někam ho ulož. Zkopíruj se celý obsah toho logu.

Zavři všechny programy a prohlížeče. Deaktivuj antivir a firewall.
Prosím, odpoj všechny USB nebo externí disky z počítače před spuštěním tohoto programu.
Spusť znovu RogueKiller ( Pro Windows Vista nebo Windows 7, klepni pravým a vyber "Spustit jako správce", ve Windows XP poklepej ke spuštění).
- Počkej, až Prescan dokončí práci...
- Pak klikni na "Prohledat " ,po jeho skončení:


- V záložkách (Registry , Tasks , Web Browser apod.) vše zatrhni (dej zatržítka)

- Klikni na "Smazat"
- Počkej, dokud Status box nezobrazí " Mazání dokončeno "
- Klikni na "Zpráva " a zkopíruj a vlož obsah té zprávy prosím sem. Log je možno nalézt v RKreport [číslo]. txt na ploše.
- Zavři RogueKiller

Stáhni si TDSSKiller
Na svojí plochu.Ujisti se , že máš zavřeny všechny ostatní aplikace a prohlížeče. Rozbal soubor a spusť TDSSKiller.exe. Restartuj PC . Log z TDSSKilleru najdeš zde:
C:\TDSSKiller. 2.8.16.0_(datum)_log.txt , vlož sem prosím celý obsah logu.
-pokud bude mít log více než 60.000 znaků , rozděl ho a vlož do více příspěvků

Re: Prosím o kontrolu logu

Napsal: 13 črc 2014 19:47
od tony13
RogueKiller V9.2.2.0 [Jul 11 2014] by Adlice Software
mail : http://www.adlice.com/contact/
Podpora : http://forum.adlice.com
Webové stránky : http://www.adlice.com/softwares/roguekiller/
: http://www.adlice.com

Operační systém : Windows Vista (6.0.6002 Service Pack 2) 32 bits version
Spuštěno v : Normální režim
Uživatel : Comfor [Práva správce]
Mód : Odebrat -- Datum : 07/13/2014 19:41:22

¤¤¤ Škodlivé procesy: : 0 ¤¤¤

¤¤¤ ¤¤¤ Záznamy Registrů: : 15 ¤¤¤
[PUM.Dns] HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters | DhcpNameServer : 10.0.0.1 -> NAHRAZENO ()
[PUM.Dns] HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Tcpip\Parameters | DhcpNameServer : 10.0.0.1 -> NAHRAZENO ()
[PUM.Dns] HKEY_LOCAL_MACHINE\System\ControlSet003\Services\Tcpip\Parameters | DhcpNameServer : 10.0.0.1 -> NAHRAZENO ()
[PUM.Dns] HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{5FFEE5D1-D46A-4E06-BB58-DBB25392C431} | DhcpNameServer : 10.0.0.1 -> NAHRAZENO ()
[PUM.Dns] HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{DD91456F-7CA2-4148-89C6-D2ED66C74254} | DhcpNameServer : 192.168.88.1 193.85.1.100 193.85.2.100 -> NAHRAZENO ()
[PUM.Dns] HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Tcpip\Parameters\Interfaces\{5FFEE5D1-D46A-4E06-BB58-DBB25392C431} | DhcpNameServer : 10.0.0.1 -> NAHRAZENO ()
[PUM.Dns] HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Tcpip\Parameters\Interfaces\{DD91456F-7CA2-4148-89C6-D2ED66C74254} | DhcpNameServer : 192.168.88.1 193.85.1.100 193.85.2.100 -> NAHRAZENO ()
[PUM.Dns] HKEY_LOCAL_MACHINE\System\ControlSet003\Services\Tcpip\Parameters\Interfaces\{5FFEE5D1-D46A-4E06-BB58-DBB25392C431} | DhcpNameServer : 10.0.0.1 -> NAHRAZENO ()
[PUM.Dns] HKEY_LOCAL_MACHINE\System\ControlSet003\Services\Tcpip\Parameters\Interfaces\{DD91456F-7CA2-4148-89C6-D2ED66C74254} | DhcpNameServer : 192.168.88.1 193.85.1.100 193.85.2.100 -> NAHRAZENO ()
[PUM.Policies] HKEY_USERS\S-1-5-21-209910396-3507630868-571481715-1003\Software\Microsoft\Windows\CurrentVersion\Policies\System | DisableRegistryTools : 0 -> VYMAZÁNO
[PUM.Policies] HKEY_USERS\S-1-5-21-209910396-3507630868-571481715-1003\Software\Microsoft\Windows\CurrentVersion\Policies\System | DisableTaskMgr : 0 -> VYMAZÁNO
[PUM.Policies] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System | DisableRegistryTools : 0 -> VYMAZÁNO
[PUM.Policies] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System | EnableLUA : 0 -> NAHRAZENO (1)
[PUM.DesktopIcons] HKEY_USERS\S-1-5-21-209910396-3507630868-571481715-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\ClassicStartMenu | {59031A47-3F72-44A7-89C5-5595FE6B30EE} : 1 -> NAHRAZENO (0)
[PUM.DesktopIcons] HKEY_USERS\S-1-5-21-209910396-3507630868-571481715-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {59031A47-3F72-44A7-89C5-5595FE6B30EE} : 1 -> NAHRAZENO (0)

¤¤¤ naplánované úlohy : 0 ¤¤¤

¤¤¤ Soubory : 0 ¤¤¤

¤¤¤ Soubor HOSTS : 1 ¤¤¤
[C:\Windows\System32\drivers\etc\hosts] 127.0.0.1 localhost -> VYMAZÁNO

¤¤¤ Antirootkit : 8 (Driver: NAHRÁNO) ¤¤¤
[IRP:Addr(Hook.IRP)] \SystemRoot\System32\drivers\mountmgr.sys - IRP_MJ_CREATE[0] : Unknown @ 0x853341f8
[IRP:Addr(Hook.IRP)] \SystemRoot\System32\drivers\mountmgr.sys - IRP_MJ_CLOSE[2] : Unknown @ 0x853341f8
[IRP:Addr(Hook.IRP)] \SystemRoot\System32\drivers\mountmgr.sys - IRP_MJ_DEVICE_CONTROL[14] : Unknown @ 0x853341f8
[IRP:Addr(Hook.IRP)] \SystemRoot\System32\drivers\mountmgr.sys - IRP_MJ_INTERNAL_DEVICE_CONTROL[15] : Unknown @ 0x853341f8
[IRP:Addr(Hook.IRP)] \SystemRoot\System32\drivers\mountmgr.sys - IRP_MJ_POWER[22] : Unknown @ 0x853341f8
[IRP:Addr(Hook.IRP)] \SystemRoot\System32\drivers\mountmgr.sys - IRP_MJ_SYSTEM_CONTROL[23] : Unknown @ 0x853341f8
[IRP:Addr(Hook.IRP)] \SystemRoot\System32\drivers\mountmgr.sys - IRP_MJ_PNP[27] : Unknown @ 0x853341f8
[Filter(Kernel.Filter)] \Driver\atapi @ Unknown : \Driver\cdrom @ \Device\CdRom0 (\SystemRoot\system32\drivers\NETIO.SYS)

¤¤¤ Webové prohlížeče : 11 ¤¤¤
[FIREFX:Addon] 5ye992uu.default : Microsoft .NET Framework Assistant [{20a82645-c095-46ed-80e3-08825760534b}] -> VYMAZÁNO
[FIREFX:Addon] 5ye992uu.default : avast! Online Security [wrc@avast.com] -> VYMAZÁNO
[PUM.Proxy][FIREFX:Config] 5ye992uu.default : user_pref("network.proxy.http", "proxy.mendelu.cz"); -> VYMAZÁNO
[PUM.Proxy][FIREFX:Config] 5ye992uu.default : user_pref("network.proxy.http_port", 5555); -> VYMAZÁNO
[CHROME:Addon] Default : Google Drive [apdfllckaahabafndbhieahigkjlhalf] -> VYMAZÁNO
[CHROME:Addon] Default : YouTube [blpcfgokakmgnkcojhhkbfbldkacnbeo] -> ERROR [2]
[CHROME:Addon] Default : Google Search [coobgpohoikkiipiblmjeljniedjpjpf] -> ERROR [2]
[CHROME:Addon] Default : AdBlock [gighmmpiobklfepjocnamgkkbiglidom] -> ERROR [2]
[CHROME:Addon] Default : Default [hkacjpbfdknhflllbcmjibkdeoafencn] -> ERROR [2]
[CHROME:Addon] Default : Google Wallet [nmmhkkegccagdldgiimedpiccmgmieda] -> ERROR [2]
[CHROME:Addon] Default : Gmail [pjkljhegncpnkpknbcohdijeoejaedia] -> ERROR [2]

¤¤¤ Kontrola MBR : ¤¤¤
+++++ PhysicalDrive0: WDC WD2500BEVT-88ZCT0 ATA Device +++++
--- User ---
[MBR] 9197f2cba4fdf160c3d41a3a90e8f46e
[BSP] 73ee09f6a8c6eaee0636e5b22a4bcb19 : HP MBR Code
Partition table:
0 - [ACTIVE] NTFS (0x7) [VISIBLE] Offset (sectors): 2048 | Size: 1500 MB
1 - [XXXXXX] NTFS (0x7) [VISIBLE] Offset (sectors): 3074048 | Size: 209726 MB
2 - [XXXXXX] EXTEN (0x5) [VISIBLE] Offset (sectors): 432598320 | Size: 27243 MB
User = LL1 ... OK
User = LL2 ... OK


============================================
RKreport_SCN_07132014_121544.log - RKreport_SCN_07132014_193759.log

Re: Prosím o kontrolu logu

Napsal: 13 črc 2014 19:48
od tony13
Malwarebytes mi tentokrát nic nenašel...
Časové pásmo: UTC+02:00
Stránka 1 z 2
Powered by phpBB® Forum Software © phpBB Limited
https://www.phpbb.com/