PC-HELP.CZ

České diskuzní fórum o počítačích
https://pc-help.cnews.cz/

prosím o kontrolu logu

https://pc-help.cnews.cz/viewtopic.php?f=70&t=138980

Stránka 1 z 3

prosím o kontrolu logu

Napsal: 25 srp 2014 08:54
od KamilaS
po odstranění doplňku (zřejmě nežádoucího) AdPlus (ne reklamy), mi vyskakuje plno reklam a všude, mám FF, děkuju



Logfile of Trend Micro HijackThis v2.0.5
Scan saved at 8:52:22, on 25.8.2014
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v11.0 (11.00.9600.17239)

FIREFOX: 31.0 (x86 cs)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskhost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Microsoft Security Client\msseces.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Sony\Sony PC Companion\PCCompanion.exe
C:\Program Files\Sony\Sony PC Companion\PCCompanionInfo.exe
C:\Program Files\EnhanceEmpire\bin\EnhanceEmpire.BrowserAdapter.exe
C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
C:\Users\PaKSzabovy\Downloads\STAŽENINY\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/p/?LinkId=255141
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/p/?LinkId=255141
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [IAStorIcon] "C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIconLaunch.exe" "C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe" 60
O4 - HKLM\..\Run: [MSC] "c:\Program Files\Microsoft Security Client\msseces.exe" -hide -runkey
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [Sony PC Companion] "C:\Program Files\Sony\Sony PC Companion\PCCompanion.exe" /Background
O10 - Unknown file in Winsock LSP: c:\program files\common files\microsoft shared\windows live\wlidnsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\common files\microsoft shared\windows live\wlidnsp.dll
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O18 - Protocol: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: COMODO Dragon Update Service (DragonUpdater) - Comodo Security Solutions, Inc. - C:\Program Files\Comodo\Dragon\dragon_updater.exe
O23 - Service: Intel(R) Rapid Storage Technology (IAStorDataMgrSvc) - Intel Corporation - C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
O23 - Service: Skype Updater (SkypeUpdate) - Skype Technologies - C:\Program Files\Skype\Updater\Updater.exe
O23 - Service: Sony PC Companion - Avanquest Software - C:\Program Files\Sony\Sony PC Companion\PCCService.exe
O23 - Service: NVIDIA Stereoscopic 3D Driver Service (Stereo Service) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
O23 - Service: Update EnhanceEmpire - Unknown owner - C:\Program Files\EnhanceEmpire\updateEnhanceEmpire.exe
O23 - Service: Util EnhanceEmpire - Unknown owner - C:\Program Files\EnhanceEmpire\bin\utilEnhanceEmpire.exe

--
End of file - 4234 bytes

Re: prosím o kontrolu logu

Napsal: 25 srp 2014 10:07
od jaro3
Stáhni si ATF Cleaner
Poklepej na ATF Cleaner.exe, klikni na select all found, poté:
-Když používáš Firefox (Mozzila), klikni na Firefox nahoře a vyber: Select All, poté klikni na Empty Selected.
-Když používáš Operu, klikni nahoře na Operu a vyber: Select All, poté klikni na Empty Selected. Poté klikni na Main (hlavní stránku ) a klikni na Empty Selected.
Po vyčištění klikni na Exit k zavření programu.
ATF-Cleaner je jednoduchý nástroj na odstranění historie z webového prohlížeče. Program dokáže odstranit cache, cookies, historii a další stopy po surfování na Internetu. Mezi podporované prohlížeče patří Internet Explorer, Firefox a Opera. Aplikace navíc umí odstranit dočasné soubory Windows, vysypat koš atd.

- Pokud používáš jen Google Chrome , tak ATF nemusíš použít.


Stáhni si TFC
Otevři soubor a zavři všechny ostatní okna, Klikni na Start k zahájení procesu. Program by neměl trvat dlouho.
Poté by se měl PC restartovat, pokud ne , proveď sám.

Stáhni AdwCleaner (by Xplode)
http://www.bleepingcomputer.com/download/adwcleaner/

Ulož si ho na svojí plochu
Ukonči všechny programy , okna a prohlížeče
Spusť program poklepáním a klikni na „Prohledat-Scan“
Po skenu se objeví log ( jinak je uložen systémovem disku jako AdwCleaner[R?].txt), jeho obsah sem celý vlož.

Stáhni si Malwarebytes' Anti-Malware
- Při instalaci odeber zatržítko u „Povolit bezplatnou zkušební verzi Malwarebytes' Anti-Malware Premium“
Nainstaluj a spusť ho
- na konci instalace se ujisti že máš zvoleny/zatrhnuty obě možnosti:
Aktualizace Malwarebytes' Anti-Malware a Spustit aplikaci Malwarebytes' Anti-Malware, pokud jo tak klikni na tlačítko konec
- pokud bude nalezena aktualizace, tak se stáhne a nainstaluje
- program se po té spustí a klikni na Skenovat nyní a
- po proběhnutí programu se ti objeví hláška vpravo dole tak klikni na b] Kopírovat do schránky [/b]a a vlož sem celý log.

- po té klikni na tlačítko Exit, objeví se ti hláška tak zvol Ano
(zatím nic nemaž!).

Pokud budou problémy , spusť v nouz. režimu.

Re: prosím o kontrolu logu

Napsal: 25 srp 2014 14:22
od KamilaS
# AdwCleaner v3.007 - Report created 12/10/2013 at 12:24:00
# Updated 09/10/2013 by Xplode
# Operating System : Windows 7 Home Premium Service Pack 1 (32 bits)
# Username : P. a K. Szabovy - PAKSZABOVY-PC
# Running from : C:\Users\P. a K. Szabovy\Desktop\adwcleaner.exe
# Option : Scan

***** [ Services ] *****


***** [ Files / Folders ] *****

File Found : C:\END
File Found : C:\Users\P. a K. Szabovy\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\QuickStores.url
File Found : C:\Users\P. a K. Szabovy\AppData\Roaming\Microsoft\Windows\Start Menu\QuickStores.url
File Found : C:\Users\P. a K. Szabovy\AppData\Roaming\Mozilla\Firefox\Profiles\f38ynnaa.default-1372323181890\user.js
File Found : C:\Windows\System32\Tasks\Express FilesUpdate
File Found : C:\Windows\System32\Tasks\Scheduled Update for Ask Toolbar
Folder Found C:\Program Files\Minibar
Folder Found C:\ProgramData\StarApp
Folder Found C:\Users\P. a K. Szabovy\AppData\Local\Minibar
Folder Found C:\Users\P. a K. Szabovy\AppData\Roaming\BitLord
Folder Found C:\Users\P. a K. Szabovy\Documents\BitLord
Folder Found C:\Windows\assembly\GAC_MSIL\QuickStoresToolbar

***** [ Shortcuts ] *****


***** [ Registry ] *****

Key Found : HKCU\Software\APN PIP
Key Found : HKCU\Software\BI
Key Found : HKCU\Software\Conduit
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{898EA8C8-E7FF-479B-8935-AEC46303B9E5}
Key Found : HKCU\Software\Softonic
Key Found : HKCU\Software\Webplayer
Key Found : HKLM\SOFTWARE\Classes\CLSID\{1AA60054-57D9-4F99-9A55-D0FBFBE7ECD3}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{2CE4D4CF-B278-4126-AD1E-B622DA2E8339}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{539F76FD-084E-4858-86D5-62F02F54AE86}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{60EACC1A-33FA-443D-9846-17B28E2C9BDB}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{898EA8C8-E7FF-479B-8935-AEC46303B9E5}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{AA74D58F-ACD0-450D-A85E-6C04B171C044}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{AAA38851-3CFF-475F-B5E0-720D3645E4A5}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Key Found : HKLM\Software\Classes\Installer\Features\B6EF34C0188ECFA43B48A4BE9C00748E
Key Found : HKLM\Software\Classes\Installer\Products\B6EF34C0188ECFA43B48A4BE9C00748E
Key Found : HKLM\SOFTWARE\Classes\Interface\{06E50566-0AB7-431C-841D-62794727DAF9}
Key Found : HKLM\SOFTWARE\Classes\Interface\{26E7211D-0650-43CF-8498-4C81E83AEAAA}
Key Found : HKLM\SOFTWARE\Classes\Interface\{2CE4D4CF-B278-4126-AD1E-B622DA2E8339}
Key Found : HKLM\SOFTWARE\Classes\TypeLib\{F13D3582-1359-4F8F-9A48-EF3AE9F5701C}
Key Found : HKLM\Software\Desksvc
Key Found : HKLM\SOFTWARE\Google\Chrome\Extensions\nbmafkdmkkckhggblphicnnhlgljnoje
Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{898EA8C8-E7FF-479B-8935-AEC46303B9E5}
Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{AAA38851-3CFF-475F-B5E0-720D3645E4A5}
Key Found : HKLM\SOFTWARE\Microsoft\Tracing\AskPIP_FF__RASAPI32
Key Found : HKLM\SOFTWARE\Microsoft\Tracing\AskPIP_FF__RASMANCS
Key Found : HKLM\SOFTWARE\Microsoft\Tracing\AskSLib_RASAPI32
Key Found : HKLM\SOFTWARE\Microsoft\Tracing\AskSLib_RASMANCS
Key Found : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_for_jetbee-free_RASAPI32
Key Found : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_for_jetbee-free_RASMANCS
Key Found : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_for_windows-live-messenger_RASAPI32
Key Found : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_for_windows-live-messenger_RASMANCS
Key Found : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_para_kmplayer_RASAPI32
Key Found : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_para_kmplayer_RASMANCS
Key Found : HKLM\SOFTWARE\Microsoft\Tracing\TaskScheduler_RASAPI32
Key Found : HKLM\SOFTWARE\Microsoft\Tracing\TaskScheduler_RASMANCS
Key Found : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\Express FilesUpdate
Key Found : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\Scheduled Update for Ask Toolbar
Key Found : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\Express FilesUpdate
Key Found : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\Scheduled Update for Ask Toolbar
Key Found : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Express FilesUpdate
Key Found : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Scheduled Update for Ask Toolbar
Key Found : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Scheduled Update for Ask Toolbar
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AA74D58F-ACD0-450D-A85E-6C04B171C044}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Key Found : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0FF2AEFF45EEA0A48A4B33C1973B6094
Key Found : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\305B09CE8C53A214DB58887F62F25536
Key Found : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\B6EF34C0188ECFA43B48A4BE9C00748E
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\bi_uninstaller
Key Found : HKLM\Software\Minibar
Key Found : HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Application\DeskSvc
Value Found : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks [{539F76FD-084E-4858-86D5-62F02F54AE86}]
Value Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Run [AppsHat]
Value Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{10EDB994-47F8-43F7-AE96-F2EA63E9F90F}]

***** [ Browsers ] *****

-\\ Internet Explorer v10.0.9200.16720


-\\ Mozilla Firefox v22.0 (cs)

[ File : C:\Users\P. a K. Szabovy\AppData\Roaming\Mozilla\Firefox\Profiles\f38ynnaa.default-1372323181890\prefs.js ]


-\\ Google Chrome v27.0.1453.110

[ File : C:\Users\P. a K. Szabovy\AppData\Local\Google\Chrome\User Data\Default\preferences ]


*************************

AdwCleaner[R0].txt - [6386 octets] - [12/10/2013 12:24:00]

########## EOF - C:\AdwCleaner\AdwCleaner[R0].txt - [6446 octets] ##########
# AdwCleaner v3.308 - Report created 25/08/2014 at 14:13:05
# Updated 20/08/2014 by Xplode
# Operating System : Windows 7 Home Premium Service Pack 1 (32 bits)
# Username : PaKSzabovy - PAKSZABOVY-PC
# Running from : C:\Users\PaKSzabovy\Desktop\adwcleaner_3.308.exe
# Option : Scan

***** [ Services ] *****

Service Found : Update EnhanceEmpire
Service Found : Util EnhanceEmpire
Service Found : {7951da45-7bdd-437b-929a-ec3e88ff6c84}w

***** [ Files / Folders ] *****

File Found : C:\Users\PaKSzabovy\AppData\Roaming\Mozilla\Firefox\Profiles\eqxpmc90.default\user.js
File Found : C:\Windows\system32\drivers\{7951da45-7bdd-437b-929a-ec3e88ff6c84}w.sys
Folder Found : C:\Program Files\EnhanceEmpire
Folder Found : C:\Program Files\SiteLookup
Folder Found : C:\ProgramData\Alawar
Folder Found : C:\Users\PaKSzabovy\AppData\Roaming\Alawar
Folder Found : C:\Users\PaKSzabovy\AppData\Roaming\SimilarAddon

***** [ Scheduled Tasks ] *****


***** [ Shortcuts ] *****


***** [ Registry ] *****

Key Found : HKCU\Software\EnhanceEmpire
Key Found : HKCU\Software\EnhanceEmpire
Key Found : HKCU\Software\Softonic
Key Found : HKLM\SOFTWARE\Classes\CLSID\{1AA60054-57D9-4F99-9A55-D0FBFBE7ECD3}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{4AA46D49-459F-4358-B4D1-169048547C23}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{5A4E3A41-FA55-4BDA-AED7-CEBE6E7BCB52}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{5A4E3A41-FA55-4BDA-AED7-CEBE6E7BCB52}
Key Found : HKLM\SOFTWARE\Classes\Interface\{4E6354DE-9115-4AEE-BD21-C46C3E8A49DB}
Key Found : HKLM\SOFTWARE\Classes\Interface\{FC073BDA-C115-4A1D-9DF9-9B5C461482E5}
Key Found : HKLM\SOFTWARE\Classes\TypeLib\{A2D733A7-73B0-4C6B-B0C7-06A432950B66}
Key Found : HKLM\SOFTWARE\Classes\TypeLib\{A2D733A7-73B0-4C6B-B0C7-06A432950B66}
Key Found : HKLM\SOFTWARE\EnhanceEmpire
Key Found : HKLM\SOFTWARE\EnhanceEmpire
Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{74F475FA-6C75-43BD-AAB9-ECDA6184F600}
Key Found : HKLM\SOFTWARE\Microsoft\Tracing\EnhanceEmpire_RASAPI32
Key Found : HKLM\SOFTWARE\Microsoft\Tracing\EnhanceEmpire_RASMANCS
Key Found : HKLM\SOFTWARE\Microsoft\Tracing\updateEnhanceEmpire_RASAPI32
Key Found : HKLM\SOFTWARE\Microsoft\Tracing\updateEnhanceEmpire_RASMANCS
Key Found : HKLM\SOFTWARE\Microsoft\Tracing\utilEnhanceEmpire_RASAPI32
Key Found : HKLM\SOFTWARE\Microsoft\Tracing\utilEnhanceEmpire_RASMANCS
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\08121C32A9C319F4CB0C11FF059552A4
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\EnhanceEmpire
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\EnhanceEmpire
Key Found : HKLM\SYSTEM\CurrentControlSet\Services\EventLog\Application\Update EnhanceEmpire
Key Found : HKLM\SYSTEM\CurrentControlSet\Services\EventLog\Application\Util EnhanceEmpire

***** [ Browsers ] *****

-\\ Internet Explorer v11.0.9600.17239


-\\ Mozilla Firefox v31.0 (x86 cs)

[ File : C:\Users\PaKSzabovy\AppData\Roaming\Mozilla\Firefox\Profiles\eqxpmc90.default\prefs.js ]


*************************

AdwCleaner[R0].txt - [9677 octets] - [11/08/2014 09:50:07]
AdwCleaner[R1].txt - [6586 octets] - [11/08/2014 09:50:07]
AdwCleaner[R2].txt - [7621 octets] - [11/08/2014 09:50:07]
AdwCleaner[R3].txt - [7681 octets] - [11/08/2014 09:50:07]
AdwCleaner[S0].txt - [6745 octets] - [11/08/2014 09:50:07]
AdwCleaner[S1].txt - [7157 octets] - [11/08/2014 09:50:07]

########## EOF - C:\AdwCleaner\AdwCleaner[R0].txt - [10037 octets] ##########

vyčistila jsem to omylem, design je nový

Napsal: 25 srp 2014 14:47
od KamilaS
Malwarebytes Anti-Malware
www.malwarebytes.org

Datum skenování: 25.8.2014
Čas skenování: 14:38:55
Protokol: malware log.txt
Správce: Ano

Verze: 2.00.2.1012
Databáze malwaru: v2014.08.25.02
Databáze rootkitů: v2014.08.21.01
Licence: Zkušební verze
Ochrana proti malwaru: Zapnuto
Ochrana proti škodlivým webovým stránkám: Zapnuto
Self-protection: Vypnuto

OS: Windows 7 Service Pack 1
CPU: x86
Souborový systém: NTFS
Uživatel: PaKSzabovy

Typ skenu: Sken hrozeb
Výsledek: Dokončeno
Prohledaných objektů: 265576
Uplynulý čas: 3 min, 58 sek

Paměť: Zapnuto
Po spuštění: Zapnuto
Souborový systém: Zapnuto
Archivy: Zapnuto
Rootkity: Vypnuto
Heuristics: Zapnuto
PUP: Zapnuto
PUM: Zapnuto

Procesy: 1
PUP.Optional.EnhanceEmpire.A, C:\Program Files\EnhanceEmpire\updateEnhanceEmpire.exe, 2376, Smazat při restartu, [af175e6c9cdf0630642cb3e43fc2e51b]

Moduly: 0
(No malicious items detected)

Klíče registru: 12
PUP.Optional.EnhanceEmpire.A, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\Update EnhanceEmpire, Do karantény, [af175e6c9cdf0630642cb3e43fc2e51b],
PUP.Optional.BrowseFox.A, HKLM\SOFTWARE\CLASSES\CLSID\{4AA46D49-459F-4358-B4D1-169048547C23}, Do karantény, [3195d3f791ea5adcdeac3675f40eff01],
PUP.Optional.EnhanceEmpire.A, HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\EnhanceEmpire, Do karantény, [eadc04c687f40d29b54b688d8d750cf4],
PUP.Optional.EnhanceEmpire.A, HKLM\SOFTWARE\CLASSES\CLSID\{5A4E3A41-FA55-4BDA-AED7-CEBE6E7BCB52}, Do karantény, [eadc04c687f40d29b54b688d8d750cf4],
PUP.Optional.EnhanceEmpire.A, HKLM\SOFTWARE\CLASSES\TYPELIB\{A2D733A7-73B0-4C6B-B0C7-06A432950B66}, Do karantény, [eadc04c687f40d29b54b688d8d750cf4],
PUP.Optional.EnhanceEmpire.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{4E6354DE-9115-4AEE-BD21-C46C3E8A49DB}, Do karantény, [eadc04c687f40d29b54b688d8d750cf4],
PUP.Optional.EnhanceEmpire.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{FC073BDA-C115-4A1D-9DF9-9B5C461482E5}, Do karantény, [eadc04c687f40d29b54b688d8d750cf4],
PUP.Optional.Sanbreel.A, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\{7951da45-7bdd-437b-929a-ec3e88ff6c84}w, Do karantény, [527446849cdfe84ed662aca17e86649c],
PUP.Optional.EnhanceEmpire.A, HKLM\SOFTWARE\EnhanceEmpire, Do karantény, [a2242aa02a51c76f9a6734c10df5718f],
PUP.Optional.EnhanceEmpire.A, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\Util EnhanceEmpire, Do karantény, [d0f623a70774b97d11f3e411639f817f],
PUP.Optional.EnhanceEmpire.A, HKU\S-1-5-21-2921485920-836263657-3417334645-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\EnhanceEmpire, Do karantény, [90368d3dee8ddc5ae41ea35245bdfd03],
PUP.Optional.Softonic.A, HKU\S-1-5-21-2921485920-836263657-3417334645-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\SOFTONIC\Universal Downloader, Do karantény, [6e587d4d3249b482fa3b0204ca39d729],

Hodnoty registru: 0
(No malicious items detected)

Data registru: 0
(No malicious items detected)

Složky: 5
PUP.Optional.EnhanceEmpire.A, C:\Program Files\EnhanceEmpire, Smazat při restartu, [eadc04c687f40d29b54b688d8d750cf4],
PUP.Optional.EnhanceEmpire.A, C:\Program Files\EnhanceEmpire\bin, Do karantény, [eadc04c687f40d29b54b688d8d750cf4],
PUP.Optional.EnhanceEmpire.A, C:\Program Files\EnhanceEmpire\bin\plugins, Do karantény, [eadc04c687f40d29b54b688d8d750cf4],
PUP.Optional.EnhanceEmpire.A, C:\Program Files\EnhanceEmpire\bin\TEMP, Do karantény, [eadc04c687f40d29b54b688d8d750cf4],
PUP.Optional.SimilarAddon.A, C:\Users\PaKSzabovy\AppData\Roaming\SimilarAddon, Do karantény, [1fa7f9d1d7a438fe1f88638024de946c],

Soubory: 21
PUP.Optional.EnhanceEmpire.A, C:\Program Files\EnhanceEmpire\updateEnhanceEmpire.exe, Smazat při restartu, [af175e6c9cdf0630642cb3e43fc2e51b],
PUP.Optional.EnhanceEmpire.A, C:\Program Files\EnhanceEmpire\EnhanceEmpire.ico, Do karantény, [eadc04c687f40d29b54b688d8d750cf4],
PUP.Optional.EnhanceEmpire.A, C:\Program Files\EnhanceEmpire\0, Do karantény, [eadc04c687f40d29b54b688d8d750cf4],
PUP.Optional.EnhanceEmpire.A, C:\Program Files\EnhanceEmpire\7za.exe, Do karantény, [eadc04c687f40d29b54b688d8d750cf4],
PUP.Optional.EnhanceEmpire.A, C:\Program Files\EnhanceEmpire\EnhanceEmpireUninstall.exe, Do karantény, [eadc04c687f40d29b54b688d8d750cf4],
PUP.Optional.EnhanceEmpire.A, C:\Program Files\EnhanceEmpire\updateEnhanceEmpire.InstallState, Do karantény, [eadc04c687f40d29b54b688d8d750cf4],
PUP.Optional.EnhanceEmpire.A, C:\Program Files\EnhanceEmpire\bin\7951da457bdd437b929a.dll, Do karantény, [eadc04c687f40d29b54b688d8d750cf4],
PUP.Optional.EnhanceEmpire.A, C:\Program Files\EnhanceEmpire\bin\7za.exe, Do karantény, [eadc04c687f40d29b54b688d8d750cf4],
PUP.Optional.EnhanceEmpire.A, C:\Program Files\EnhanceEmpire\bin\BrowserAdapter.7z, Do karantény, [eadc04c687f40d29b54b688d8d750cf4],
PUP.Optional.EnhanceEmpire.A, C:\Program Files\EnhanceEmpire\bin\EnhanceEmpire.BrowserAdapter.exe, Do karantény, [eadc04c687f40d29b54b688d8d750cf4],
PUP.Optional.EnhanceEmpire.A, C:\Program Files\EnhanceEmpire\bin\EnhanceEmpire.PurBrowse.exe, Do karantény, [eadc04c687f40d29b54b688d8d750cf4],
PUP.Optional.EnhanceEmpire.A, C:\Program Files\EnhanceEmpire\bin\EnhanceEmpire.PurBrowse.zip, Do karantény, [eadc04c687f40d29b54b688d8d750cf4],
PUP.Optional.EnhanceEmpire.A, C:\Program Files\EnhanceEmpire\bin\sqlite3.dll, Do karantény, [eadc04c687f40d29b54b688d8d750cf4],
PUP.Optional.EnhanceEmpire.A, C:\Program Files\EnhanceEmpire\bin\utilEnhanceEmpire.InstallState, Do karantény, [eadc04c687f40d29b54b688d8d750cf4],
PUP.Optional.EnhanceEmpire.A, C:\Program Files\EnhanceEmpire\bin\{7951da45-7bdd-437b-929a-ec3e88ff6c84}.dll, Do karantény, [eadc04c687f40d29b54b688d8d750cf4],
PUP.Optional.EnhanceEmpire.A, C:\Program Files\EnhanceEmpire\bin\plugins\EnhanceEmpire.Bromon.dll, Do karantény, [eadc04c687f40d29b54b688d8d750cf4],
PUP.Optional.EnhanceEmpire.A, C:\Program Files\EnhanceEmpire\bin\plugins\EnhanceEmpire.BroStats.dll, Do karantény, [eadc04c687f40d29b54b688d8d750cf4],
PUP.Optional.EnhanceEmpire.A, C:\Program Files\EnhanceEmpire\bin\plugins\EnhanceEmpire.BrowserAdapter.dll, Do karantény, [eadc04c687f40d29b54b688d8d750cf4],
PUP.Optional.EnhanceEmpire.A, C:\Program Files\EnhanceEmpire\bin\plugins\EnhanceEmpire.CompatibilityChecker.dll, Do karantény, [eadc04c687f40d29b54b688d8d750cf4],
PUP.Optional.EnhanceEmpire.A, C:\Program Files\EnhanceEmpire\bin\plugins\EnhanceEmpire.PurBrowse.dll, Do karantény, [eadc04c687f40d29b54b688d8d750cf4],
PUP.Optional.Sanbreel.A, C:\Windows\System32\drivers\{7951da45-7bdd-437b-929a-ec3e88ff6c84}w.sys, Do karantény, [527446849cdfe84ed662aca17e86649c],

Fyzické sektory: 0
(No malicious items detected)


(end)

Re: prosím o kontrolu logu

Napsal: 25 srp 2014 17:31
od jaro3
Spusť znovu AdwCleaner (u Windows Vista či Windows7, klikni na AdwCleaner pravým a vyber „Spustit jako správce“
klikni na „Prohledat-Scan“, po prohledání klikni na „ Vymazat-Clean“

Program provede opravu, po automatickém restartu neukáže log (C:\AdwCleaner [S?].txt) , jeho obsah sem celý vlož.

Stáhni si Junkware Removal Tool by Thisisu

na svojí plochu.

Deaktivuj si svůj antivirový program. Pravým tl. myši klikni na JRT.exe a vyber „spustit jako správce“. Pro pokračování budeš vyzván ke stisknutí jakékoliv klávesy. Na nějakou klikni.
Začne skenování programu. Skenování může trvat dloho , podle množství nákaz. Po ukončení skenu se objeví log (JRT.txt) , který se uloží na ploše.
Zkopíruj sem prosím celý jeho obsah.

Stáhni si RogueKiller by Adlice Software
32bit.:
http://www.sur-la-toile.com/RogueKiller/RogueKiller.exe
64bit.:
http://www.sur-la-toile.com/RogueKiller ... lerX64.exe
na svojí plochu.
- Zavři všechny ostatní programy a prohlížeče.
- Pro OS Vista a win7 spusť program RogueKiller.exe jako správce , u XP poklepáním.
- počkej až skončí Prescan -vyhledávání škodlivých procesů.
- Zkontroluj , zda máš zaškrtnuto:
Kontrola MBR
Kontrola Faked
Antirootkit
-Potom klikni na „Prohledat“.
- Program skenuje procesy PC. Po proskenování klikni na „Zpráva“celý obsah logu sem zkopíruj.
Pokud je program blokován , zkus ho spustit několikrát. Pokud dále program nepůjde spustit a pracovat, přejmenuj ho na winlogon.exe.

Re: prosím o kontrolu logu

Napsal: 25 srp 2014 17:44
od KamilaS
# AdwCleaner v3.007 - Report created 12/10/2013 at 13:00:03
# Updated 09/10/2013 by Xplode
# Operating System : Windows 7 Home Premium Service Pack 1 (32 bits)
# Username : P. a K. Szabovy - PAKSZABOVY-PC
# Running from : C:\Users\P. a K. Szabovy\Desktop\adwcleaner.exe
# Option : Clean

***** [ Services ] *****


***** [ Files / Folders ] *****

Folder Deleted : C:\ProgramData\StarApp
Folder Deleted : C:\Program Files\Minibar
Folder Deleted : C:\Windows\assembly\GAC_MSIL\QuickStoresToolbar
Folder Deleted : C:\Users\P. a K. Szabovy\AppData\Local\Minibar
Folder Deleted : C:\Users\P. a K. Szabovy\AppData\Roaming\BitLord
Folder Deleted : C:\Users\P. a K. Szabovy\Documents\BitLord
File Deleted : C:\END
File Deleted : C:\Users\P. a K. Szabovy\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\QuickStores.url
File Deleted : C:\Users\P. a K. Szabovy\AppData\Roaming\Microsoft\Windows\Start Menu\QuickStores.url
File Deleted : C:\Users\P. a K. Szabovy\AppData\Roaming\Mozilla\Firefox\Profiles\f38ynnaa.default-1372323181890\user.js
File Deleted : C:\Windows\System32\Tasks\Express FilesUpdate
File Deleted : C:\Windows\System32\Tasks\Scheduled Update for Ask Toolbar

***** [ Shortcuts ] *****


***** [ Registry ] *****

Key Deleted : HKLM\SOFTWARE\Google\Chrome\Extensions\nbmafkdmkkckhggblphicnnhlgljnoje
[#] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Express FilesUpdate
[#] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{E61098D5-C2D0-450C-9706-FD943BC25E7E}
[#] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{E61098D5-C2D0-450C-9706-FD943BC25E7E}
[#] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Scheduled Update for Ask Toolbar
[#] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{148C43E1-CF13-4F74-B39F-8DEFCBE9235D}
[#] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{148C43E1-CF13-4F74-B39F-8DEFCBE9235D}
Value Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Run [AppsHat]
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\AskPIP_FF__RASAPI32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\AskPIP_FF__RASMANCS
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\AskSLib_RASAPI32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\AskSLib_RASMANCS
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\TaskScheduler_RASAPI32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\TaskScheduler_RASMANCS
Key Deleted : HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Application\DeskSvc
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_for_jetbee-free_RASAPI32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_for_jetbee-free_RASMANCS
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_for_windows-live-messenger_RASAPI32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_for_windows-live-messenger_RASMANCS
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_para_kmplayer_RASAPI32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_para_kmplayer_RASMANCS
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{1AA60054-57D9-4F99-9A55-D0FBFBE7ECD3}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{2CE4D4CF-B278-4126-AD1E-B622DA2E8339}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{539F76FD-084E-4858-86D5-62F02F54AE86}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{60EACC1A-33FA-443D-9846-17B28E2C9BDB}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{898EA8C8-E7FF-479B-8935-AEC46303B9E5}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{AA74D58F-ACD0-450D-A85E-6C04B171C044}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{AAA38851-3CFF-475F-B5E0-720D3645E4A5}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{06E50566-0AB7-431C-841D-62794727DAF9}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{26E7211D-0650-43CF-8498-4C81E83AEAAA}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{2CE4D4CF-B278-4126-AD1E-B622DA2E8339}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{F13D3582-1359-4F8F-9A48-EF3AE9F5701C}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AA74D58F-ACD0-450D-A85E-6C04B171C044}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{898EA8C8-E7FF-479B-8935-AEC46303B9E5}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{898EA8C8-E7FF-479B-8935-AEC46303B9E5}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{AAA38851-3CFF-475F-B5E0-720D3645E4A5}
Value Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{10EDB994-47F8-43F7-AE96-F2EA63E9F90F}]
Value Deleted : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks [{539F76FD-084E-4858-86D5-62F02F54AE86}]
Key Deleted : HKCU\Software\APN PIP
Key Deleted : HKCU\Software\BI
Key Deleted : HKCU\Software\Conduit
Key Deleted : HKCU\Software\Softonic
Key Deleted : HKCU\Software\Webplayer
Key Deleted : HKLM\Software\Desksvc
Key Deleted : HKLM\Software\Minibar
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\bi_uninstaller
Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0FF2AEFF45EEA0A48A4B33C1973B6094
Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\305B09CE8C53A214DB58887F62F25536
Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\B6EF34C0188ECFA43B48A4BE9C00748E
Key Deleted : HKLM\Software\Classes\Installer\Features\B6EF34C0188ECFA43B48A4BE9C00748E
Key Deleted : HKLM\Software\Classes\Installer\Products\B6EF34C0188ECFA43B48A4BE9C00748E

***** [ Browsers ] *****

-\\ Internet Explorer v10.0.9200.16720


-\\ Mozilla Firefox v22.0 (cs)

[ File : C:\Users\P. a K. Szabovy\AppData\Roaming\Mozilla\Firefox\Profiles\f38ynnaa.default-1372323181890\prefs.js ]


-\\ Google Chrome v27.0.1453.110

[ File : C:\Users\P. a K. Szabovy\AppData\Local\Google\Chrome\User Data\Default\preferences ]


*************************

AdwCleaner[R0].txt - [6526 octets] - [12/10/2013 12:24:00]
AdwCleaner[R1].txt - [6586 octets] - [12/10/2013 12:59:26]
AdwCleaner[S0].txt - [6605 octets] - [12/10/2013 13:00:03]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [6665 octets] ##########
# AdwCleaner v3.308 - Report created 25/08/2014 at 17:41:37
# Updated 20/08/2014 by Xplode
# Operating System : Windows 7 Home Premium Service Pack 1 (32 bits)
# Username : PaKSzabovy - PAKSZABOVY-PC
# Running from : C:\Users\PaKSzabovy\Desktop\adwcleaner_3.308.exe
# Option : Clean

***** [ Services ] *****


***** [ Files / Folders ] *****

Folder Deleted : C:\ProgramData\Alawar
Folder Deleted : C:\Program Files\SiteLookup
Folder Deleted : C:\Users\PaKSzabovy\AppData\Roaming\Alawar
File Deleted : C:\Users\PaKSzabovy\AppData\Roaming\Mozilla\Firefox\Profiles\eqxpmc90.default\user.js

***** [ Scheduled Tasks ] *****


***** [ Shortcuts ] *****


***** [ Registry ] *****

Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{74F475FA-6C75-43BD-AAB9-ECDA6184F600}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{1AA60054-57D9-4F99-9A55-D0FBFBE7ECD3}
Key Deleted : HKCU\Software\Softonic
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\08121C32A9C319F4CB0C11FF059552A4

***** [ Browsers ] *****

-\\ Internet Explorer v11.0.9600.17239


-\\ Mozilla Firefox v31.0 (x86 cs)

[ File : C:\Users\PaKSzabovy\AppData\Roaming\Mozilla\Firefox\Profiles\eqxpmc90.default\prefs.js ]


*************************

AdwCleaner[R0].txt - [10118 octets] - [11/08/2014 09:50:07]
AdwCleaner[R1].txt - [8331 octets] - [11/08/2014 09:50:07]
AdwCleaner[R2].txt - [7621 octets] - [11/08/2014 09:50:07]
AdwCleaner[R3].txt - [7681 octets] - [11/08/2014 09:50:07]
AdwCleaner[S0].txt - [8307 octets] - [11/08/2014 09:50:07]
AdwCleaner[S1].txt - [7157 octets] - [11/08/2014 09:50:07]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [8427 octets] ##########

Re: prosím o kontrolu logu

Napsal: 25 srp 2014 19:20
od KamilaS
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.1.3 (03.23.2014:1)
OS: Windows 7 Home Premium x86
Ran by PaKSzabovy on po 25.08.2014 at 19:17:15,79
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values



~~~ Registry Keys



~~~ Files



~~~ Folders



~~~ FireFox

Successfully deleted the following from C:\Users\PaKSzabovy\AppData\Roaming\mozilla\firefox\profiles\eqxpmc90.default\prefs.js

user_pref("extensions.leechblock.blockRE1", "^(hxxps?|file):\\/+((www\\.)?<!DOCTYPE|(www\\.)?html>|(www\\.)?<html|(www\\.)?lang=\"cs\"|(www\\.)?id=\"facebook\"|(www\\.)?class=
user_pref("extensions.leechblock.sites1", "<!DOCTYPE html> <html lang=\"cs\" id=\"facebook\" class=\"no_js\"> <head><meta charset=\"utf-8\" /><script>function envFlush(a){func
Emptied folder: C:\Users\PaKSzabovy\AppData\Roaming\mozilla\firefox\profiles\eqxpmc90.default\minidumps [5 files]



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on po 25.08.2014 at 19:19:01,66
Computer was rebooted
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Re: prosím o kontrolu logu

Napsal: 25 srp 2014 19:25
od KamilaS
RogueKiller V9.2.8.0 [Jul 11 2014] by Adlice Software
mail : http://www.adlice.com/contact/
Podpora : http://forum.adlice.com
Webové stránky : http://www.adlice.com/softwares/roguekiller/
: http://www.adlice.com

Operační systém : Windows 7 (6.1.7601 Service Pack 1) 32 bits version
Spuštěno v : Normální režim
Uživatel : PaKSzabovy [Práva správce]
Mód : Kontrola -- Datum : 08/25/2014 19:24:30

¤¤¤ Škodlivé procesy: : 0 ¤¤¤

¤¤¤ ¤¤¤ Záznamy Registrů: : 10 ¤¤¤
[PUM.Dns] HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters | DhcpNameServer : 176.107.120.35 176.107.120.42 -> NALEZENO
[PUM.Dns] HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Tcpip\Parameters | DhcpNameServer : 176.107.120.35 176.107.120.42 -> NALEZENO
[PUM.Dns] HKEY_LOCAL_MACHINE\System\ControlSet002\Services\Tcpip\Parameters | DhcpNameServer : 176.107.120.35 176.107.120.42 -> NALEZENO
[PUM.Dns] HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{71B436CF-B40A-428C-BB16-A34FFD4216F0} | DhcpNameServer : 176.107.120.35 176.107.120.42 -> NALEZENO
[PUM.Dns] HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Tcpip\Parameters\Interfaces\{71B436CF-B40A-428C-BB16-A34FFD4216F0} | DhcpNameServer : 176.107.120.35 176.107.120.42 -> NALEZENO
[PUM.Dns] HKEY_LOCAL_MACHINE\System\ControlSet002\Services\Tcpip\Parameters\Interfaces\{71B436CF-B40A-428C-BB16-A34FFD4216F0} | DhcpNameServer : 176.107.120.35 176.107.120.42 -> NALEZENO
[PUM.Policies] HKEY_USERS\S-1-5-21-2921485920-836263657-3417334645-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System | DisableRegistryTools : 0 -> NALEZENO
[PUM.Policies] HKEY_USERS\S-1-5-21-2921485920-836263657-3417334645-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System | DisableTaskMgr : 0 -> NALEZENO
[PUM.DesktopIcons] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {20D04FE0-3AEA-1069-A2D8-08002B30309D} : 1 -> NALEZENO
[PUM.DesktopIcons] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {59031a47-3f72-44a7-89c5-5595fe6b30ee} : 1 -> NALEZENO

¤¤¤ naplánované úlohy : 1 ¤¤¤
[Suspicious.Path] \Microsoft\Microsoft Antimalware\Microsoft Antimalware Scheduled Scan -- c:\Program Files\Microsoft Security Client\MpCmdRun.exe (Scan -ScheduleJob -RestrictPrivileges) -> NALEZENO

¤¤¤ Soubory : 0 ¤¤¤

¤¤¤ Soubor HOSTS : 0 ¤¤¤

¤¤¤ Antirootkit : 0 (Driver: NAHRÁNO) ¤¤¤

¤¤¤ Webové prohlížeče : 2 ¤¤¤
[PUM.Proxy][FIREFX:Config] eqxpmc90.default : user_pref("network.proxy.type", 4); -> NALEZENO
[PUM.HomePage][FIREFX:Config] eqxpmc90.default : user_pref("browser.startup.homepage", "http://wol.jw.org/cs/wol/dt/r29/lp-b/2014/8/13"); -> NALEZENO

¤¤¤ Kontrola MBR : ¤¤¤
+++++ PhysicalDrive0: WDC WD10EALX-009BA0 SCSI Disk Device +++++
--- User ---
[MBR] 147f7eb657cb54d1a4cb019dcbdc3d4a
[BSP] da6ca8bfc332d8b697f854e6bb8b6f7c : Windows Vista/7/8 MBR Code
Partition table:
0 - [ACTIVE] NTFS (0x7) [VISIBLE] Offset (sectors): 2048 | Size: 100 MB
1 - [XXXXXX] NTFS (0x7) [VISIBLE] Offset (sectors): 206848 | Size: 953767 MB
User = LL1 ... OK
Error reading LL2 MBR! ([18] Program vydal p?íkaz, délka p?íkazu je v?ak nesprávná. )

+++++ PhysicalDrive1: Generic- SD/MMC USB Device +++++
Error reading User MBR! ([15] Za?ízení není p?ipraveno. )
Error reading LL1 MBR! NOT VALID!
Error reading LL2 MBR! ([32] Po?adavek není podporován. )

+++++ PhysicalDrive2: Generic- Compact Flash USB Device +++++
Error reading User MBR! ([15] Za?ízení není p?ipraveno. )
Error reading LL1 MBR! NOT VALID!
Error reading LL2 MBR! ([32] Po?adavek není podporován. )

+++++ PhysicalDrive3: Generic- SM/xD-Picture USB Device +++++
Error reading User MBR! ([15] Za?ízení není p?ipraveno. )
Error reading LL1 MBR! NOT VALID!
Error reading LL2 MBR! ([32] Po?adavek není podporován. )

+++++ PhysicalDrive4: Generic- MS/MS-Pro USB Device +++++
Error reading User MBR! ([15] Za?ízení není p?ipraveno. )
Error reading LL1 MBR! NOT VALID!
Error reading LL2 MBR! ([32] Po?adavek není podporován. )

Re: prosím o kontrolu logu

Napsal: 25 srp 2014 20:12
od jaro3
Zavři všechny programy a prohlížeče. Deaktivuj antivir a firewall.
Prosím, odpoj všechny USB nebo externí disky z počítače před spuštěním tohoto programu.
Spusť znovu RogueKiller ( Pro Windows Vista nebo Windows 7, klepni pravým a vyber "Spustit jako správce", ve Windows XP poklepej ke spuštění).
- Počkej, až Prescan dokončí práci...
- Pak klikni na "Prohledat " ,po jeho skončení:


- V záložkách (Registry , Tasks , Web Browser apod.) vše zatrhni (dej zatržítka)

- Klikni na "Smazat"
- Počkej, dokud Status box nezobrazí " Mazání dokončeno "
- Klikni na "Zpráva " a zkopíruj a vlož obsah té zprávy prosím sem. Log je možno nalézt v RKreport [číslo]. txt na ploše.
- Zavři RogueKiller

Vlož nový log z HJT + info o problémech.

Re: prosím o kontrolu logu

Napsal: 26 srp 2014 10:07
od KamilaS
RogueKiller V9.2.8.0 [Jul 11 2014] by Adlice Software
mail : http://www.adlice.com/contact/
Podpora : http://forum.adlice.com
Webové stránky : http://www.adlice.com/softwares/roguekiller/
: http://www.adlice.com

Operační systém : Windows 7 (6.1.7601 Service Pack 1) 32 bits version
Spuštěno v : Normální režim
Uživatel : PaKSzabovy [Práva správce]
Mód : Odebrat -- Datum : 08/26/2014 10:07:08

¤¤¤ Škodlivé procesy: : 0 ¤¤¤

¤¤¤ ¤¤¤ Záznamy Registrů: : 10 ¤¤¤
[PUM.Dns] HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters | DhcpNameServer : 176.107.120.35 176.107.120.42 -> NEVYBRÁNO
[PUM.Dns] HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Tcpip\Parameters | DhcpNameServer : 176.107.120.35 176.107.120.42 -> NEVYBRÁNO
[PUM.Dns] HKEY_LOCAL_MACHINE\System\ControlSet002\Services\Tcpip\Parameters | DhcpNameServer : 176.107.120.35 176.107.120.42 -> NEVYBRÁNO
[PUM.Dns] HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{71B436CF-B40A-428C-BB16-A34FFD4216F0} | DhcpNameServer : 176.107.120.35 176.107.120.42 -> NEVYBRÁNO
[PUM.Dns] HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Tcpip\Parameters\Interfaces\{71B436CF-B40A-428C-BB16-A34FFD4216F0} | DhcpNameServer : 176.107.120.35 176.107.120.42 -> NEVYBRÁNO
[PUM.Dns] HKEY_LOCAL_MACHINE\System\ControlSet002\Services\Tcpip\Parameters\Interfaces\{71B436CF-B40A-428C-BB16-A34FFD4216F0} | DhcpNameServer : 176.107.120.35 176.107.120.42 -> NEVYBRÁNO
[PUM.Policies] HKEY_USERS\S-1-5-21-2921485920-836263657-3417334645-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System | DisableRegistryTools : 0 -> NEVYBRÁNO
[PUM.Policies] HKEY_USERS\S-1-5-21-2921485920-836263657-3417334645-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System | DisableTaskMgr : 0 -> NEVYBRÁNO
[PUM.DesktopIcons] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {20D04FE0-3AEA-1069-A2D8-08002B30309D} : 1 -> NEVYBRÁNO
[PUM.DesktopIcons] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {59031a47-3f72-44a7-89c5-5595fe6b30ee} : 1 -> NEVYBRÁNO

¤¤¤ naplánované úlohy : 1 ¤¤¤
[Suspicious.Path] \Microsoft\Microsoft Antimalware\Microsoft Antimalware Scheduled Scan -- c:\Program Files\Microsoft Security Client\MpCmdRun.exe (Scan -ScheduleJob -RestrictPrivileges) -> VYMAZÁNO

¤¤¤ Soubory : 0 ¤¤¤

¤¤¤ Soubor HOSTS : 0 ¤¤¤

¤¤¤ Antirootkit : 0 (Driver: NAHRÁNO) ¤¤¤

¤¤¤ Webové prohlížeče : 2 ¤¤¤
[PUM.Proxy][FIREFX:Config] eqxpmc90.default : user_pref("network.proxy.type", 4); -> NEVYBRÁNO
[PUM.HomePage][FIREFX:Config] eqxpmc90.default : user_pref("browser.startup.homepage", "http://wol.jw.org/cs/wol/dt/r29/lp-b/2014/8/13"); -> NEVYBRÁNO

¤¤¤ Kontrola MBR : ¤¤¤
+++++ PhysicalDrive0: WDC WD10EALX-009BA0 SCSI Disk Device +++++
--- User ---
[MBR] 147f7eb657cb54d1a4cb019dcbdc3d4a
[BSP] da6ca8bfc332d8b697f854e6bb8b6f7c : Windows Vista/7/8 MBR Code
Partition table:
0 - [ACTIVE] NTFS (0x7) [VISIBLE] Offset (sectors): 2048 | Size: 100 MB
1 - [XXXXXX] NTFS (0x7) [VISIBLE] Offset (sectors): 206848 | Size: 953767 MB
User = LL1 ... OK
Error reading LL2 MBR! ([18] Program vydal p?íkaz, délka p?íkazu je v?ak nesprávná. )

+++++ PhysicalDrive1: Generic- SD/MMC USB Device +++++
Error reading User MBR! ([15] Za?ízení není p?ipraveno. )
Error reading LL1 MBR! NOT VALID!
Error reading LL2 MBR! ([32] Po?adavek není podporován. )

+++++ PhysicalDrive2: Generic- Compact Flash USB Device +++++
Error reading User MBR! ([15] Za?ízení není p?ipraveno. )
Error reading LL1 MBR! NOT VALID!
Error reading LL2 MBR! ([32] Po?adavek není podporován. )

+++++ PhysicalDrive3: Generic- SM/xD-Picture USB Device +++++
Error reading User MBR! ([15] Za?ízení není p?ipraveno. )
Error reading LL1 MBR! NOT VALID!
Error reading LL2 MBR! ([32] Po?adavek není podporován. )

+++++ PhysicalDrive4: Generic- MS/MS-Pro USB Device +++++
Error reading User MBR! ([15] Za?ízení není p?ipraveno. )
Error reading LL1 MBR! NOT VALID!
Error reading LL2 MBR! ([32] Po?adavek není podporován. )


============================================
RKreport_SCN_08252014_192430.log - RKreport_SCN_08262014_100626.log

Re: prosím o kontrolu logu

Napsal: 26 srp 2014 10:08
od KamilaS
Logfile of Trend Micro HijackThis v2.0.5
Scan saved at 10:08:18, on 26.8.2014
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v11.0 (11.00.9600.17239)

FIREFOX: 31.0 (x86 cs)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskhost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Sony\Sony PC Companion\PCCompanion.exe
C:\Program Files\Sony\Sony PC Companion\PCCompanionInfo.exe
C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
C:\Windows\system32\taskeng.exe
C:\Users\PaKSzabovy\Downloads\STAŽENINY\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/p/?LinkId=255141
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/p/?LinkId=255141
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [IAStorIcon] "C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIconLaunch.exe" "C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe" 60
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [Sony PC Companion] "C:\Program Files\Sony\Sony PC Companion\PCCompanion.exe" /Background
O10 - Unknown file in Winsock LSP: c:\program files\common files\microsoft shared\windows live\wlidnsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\common files\microsoft shared\windows live\wlidnsp.dll
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O18 - Protocol: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: COMODO Dragon Update Service (DragonUpdater) - Comodo Security Solutions, Inc. - C:\Program Files\Comodo\Dragon\dragon_updater.exe
O23 - Service: Intel(R) Rapid Storage Technology (IAStorDataMgrSvc) - Intel Corporation - C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
O23 - Service: MBAMScheduler - Malwarebytes Corporation - C:\Program Files\Malwarebytes Anti-Malware\mbamscheduler.exe
O23 - Service: MBAMService - Malwarebytes Corporation - C:\Program Files\Malwarebytes Anti-Malware\mbamservice.exe
O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
O23 - Service: Skype Updater (SkypeUpdate) - Skype Technologies - C:\Program Files\Skype\Updater\Updater.exe
O23 - Service: Sony PC Companion - Avanquest Software - C:\Program Files\Sony\Sony PC Companion\PCCService.exe
O23 - Service: NVIDIA Stereoscopic 3D Driver Service (Stereo Service) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe

--
End of file - 4063 bytes

Re: prosím o kontrolu logu

Napsal: 26 srp 2014 10:10
od KamilaS
je to strašně divný ale tam, kde nikdy reklamy nebyly teď jsou, na http://wol.jw.org/cs/wol/dt/r29/lp-b/2014/8/13
Časové pásmo: UTC+02:00
Stránka 1 z 3
Powered by phpBB® Forum Software © phpBB Limited
https://www.phpbb.com/