PC-HELP.CZ

České diskuzní fórum o počítačích
https://pc-help.cnews.cz/

Vzdálné nabourání PC ?

https://pc-help.cnews.cz/viewtopic.php?f=70&t=159068

Stránka 1 z 1

Vzdálné nabourání PC ?

Napsal: 07 srp 2015 15:42
od Barzul
Ahoj,

mám podezření na nabourání do PC, používám ESET Smart Security a scan nehlásí žádného trojana. Prosím o radu.

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 15:39:11, on 7.8.2015
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v11.0 (11.00.9600.17910)
Boot mode: Normal

Running processes:
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
C:\PROGRA~2\Raptr\raptr.exe
C:\PROGRA~2\Raptr\raptr_im.exe
C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe
C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\AAM Updates Notifier.exe
C:\Program Files (x86)\Mozilla Firefox\firefox.exe
E:\filmy\hijackthis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.mystartsearch.com/?type=hppp ... X4APWJ9ASX
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.mystartsearch.com/web/?type= ... PWJ9ASX&q={searchTerms}
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.mystartsearch.com/web/?type= ... PWJ9ASX&q={searchTerms}
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.mystartsearch.com/?type=hppp ... X4APWJ9ASX
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/p/?LinkId=255141
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.mystartsearch.com/web/?type= ... PWJ9ASX&q={searchTerms}
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.mystartsearch.com/web/?type= ... PWJ9ASX&q={searchTerms}
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/p/?LinkId=255141
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F2 - REG:system.ini: UserInit=userinit.exe
O2 - BHO: PDF Architect 3 Helper - {06E08260-0695-4EC1-A74B-1310D8899D93} - C:\Program Files (x86)\PDF Architect 3\creator-ie-helper.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre1.8.0_45\bin\ssv.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre1.8.0_45\bin\jp2ssv.dll
O3 - Toolbar: PDF Architect 3 Toolbar - {2DFF3579-5AA7-45B9-9328-1D38EA230861} - C:\Program Files (x86)\PDF Architect 3\creator-ie-plugin.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [SwitchBoard] C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
O4 - HKLM\..\Run: [AdobeCS6ServiceManager] "C:\Program Files (x86)\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe" -launchedbylogin
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files (x86)\AMD\ATI.ACE\Core-Static\amd64\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [Raptr] C:\PROGRA~2\Raptr\raptrstub.exe --startup
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\DTLite.exe" -autorun
O4 - HKCU\..\Run: [WarThunderLauncher] E:\Hry\WarThunder\launcher.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: AMD External Events Utility - Unknown owner - C:\Windows\system32\atiesrxx.exe (file missing)
O23 - Service: Disc Soft Lite Bus Service - Disc Soft Ltd - C:\Program Files\DAEMON Tools Lite\DiscSoftBusService.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: ESET Service (ekrn) - ESET - C:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: Služba Google Update (gupdate) (gupdate) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Služba Google Update (gupdatem) (gupdatem) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: @%SystemRoot%\system32\ieetwcollectorres.dll,-1000 (IEEtwCollectorService) - Unknown owner - C:\Windows\system32\IEEtwCollector.exe (file missing)
O23 - Service: IHProtect Service - Unknown owner - C:\Program Files (x86)\XTab\ProtectService.exe (file missing)
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: PDF Architect 3 - pdfforge GmbH - C:\Program Files (x86)\PDF Architect 3\ws.exe
O23 - Service: PDF Architect 3 CrashHandler - pdfforge GmbH - C:\Program Files (x86)\PDF Architect 3\crash-handler-ws.exe
O23 - Service: PDF Architect 3 Creator - pdfforge GmbH - C:\Program Files (x86)\PDF Architect 3\creator-ws.exe
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Skype Updater (SkypeUpdate) - Skype Technologies - C:\Program Files (x86)\Skype\Updater\Updater.exe
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: SwitchBoard - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
O23 - Service: TeamViewer 10 (TeamViewer) - TeamViewer GmbH - C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: WindowsMangerProtect Service (WindowsMangerProtect) - Unknown owner - C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--
End of file - 9167 bytes

Re: Vzdálné nabourání PC ?

Napsal: 07 srp 2015 17:05
od jaro3
nedávej logy do code.

Stáhni si ATF Cleaner
Poklepej na ATF Cleaner.exe, klikni na select all found, poté:
-Když používáš Firefox (Mozzila), klikni na Firefox nahoře a vyber: Select All, poté klikni na Empty Selected.
-Když používáš Operu, klikni nahoře na Operu a vyber: Select All, poté klikni na Empty Selected. Poté klikni na Main (hlavní stránku ) a klikni na Empty Selected.
Po vyčištění klikni na Exit k zavření programu.
ATF-Cleaner je jednoduchý nástroj na odstranění historie z webového prohlížeče. Program dokáže odstranit cache, cookies, historii a další stopy po surfování na Internetu. Mezi podporované prohlížeče patří Internet Explorer, Firefox a Opera. Aplikace navíc umí odstranit dočasné soubory Windows, vysypat koš atd.

- Pokud používáš jen Google Chrome , tak ATF nemusíš použít.


Stáhni si TFC
Otevři soubor a zavři všechny ostatní okna, Klikni na Start k zahájení procesu. Program by neměl trvat dlouho.
Poté by se měl PC restartovat, pokud ne , proveď sám.

Stáhni AdwCleaner (by Xplode)
http://www.bleepingcomputer.com/download/adwcleaner/

Ulož si ho na svojí plochu
Ukonči všechny programy , okna a prohlížeče
Spusť program poklepáním a klikni na „Prohledat-Scan“
Po skenu se objeví log ( jinak je uložen systémovem disku jako AdwCleaner[R?].txt), jeho obsah sem celý vlož.

Stáhni si Malwarebytes' Anti-Malware
- Při instalaci odeber zatržítko u „Povolit bezplatnou zkušební verzi Malwarebytes' Anti-Malware Premium“
Nainstaluj a spusť ho
- na konci instalace se ujisti že máš zvoleny/zatrhnuty obě možnosti:
Aktualizace Malwarebytes' Anti-Malware a Spustit aplikaci Malwarebytes' Anti-Malware, pokud jo tak klikni na tlačítko konec
- pokud bude nalezena aktualizace, tak se stáhne a nainstaluje
- program se po té spustí a klikni na Skenovat nyní a
- po proběhnutí programu se ti objeví hláška vpravo dole tak klikni na b] Kopírovat do schránky [/b]a a vlož sem celý log.

- po té klikni na tlačítko Exit, objeví se ti hláška tak zvol Ano
(zatím nic nemaž!).

Pokud budou problémy , spusť v nouz. režimu.

Re: Vzdálné nabourání PC ?

Napsal: 07 srp 2015 17:57
od Barzul
Díky za pomoc :thumbup:

LOG REPORT z AdwCleaner

# AdwCleaner v4.208 - Log vytvořen 07/08/2015 v 17:43:20
# Aktualizováno 09/07/2015 by Xplode
# Databáze : 2015-07-09.2 [Server]
# Operační system : Windows 7 Professional Service Pack 1 (x64)
# Uživatelské jméno : Bazy - PC_BAZY
# Spuštěno z : C:\Users\Bazy\Desktop\adwcleaner_4.208.exe
# Nastavení : Sken

***** [ Služby ] *****

Služba Nalezeno : IHProtect Service
Služba Nalezeno : WindowsMangerProtect

***** [ Soubory / Složky ] *****

Složka Nalezeno : C:\Program Files (x86)\globalUpdate
Složka Nalezeno : C:\Program Files (x86)\Smart Driver Updater
Složka Nalezeno : C:\Program Files (x86)\XTab
Složka Nalezeno : C:\ProgramData\IHProtectUpDate
Složka Nalezeno : C:\ProgramData\WindowsMangerProtect
Složka Nalezeno : C:\Users\Bazy\AppData\Local\globalUpdate
Složka Nalezeno : C:\Users\Bazy\AppData\Roaming\OpenCandy
Složka Nalezeno : C:\Users\Bazy\AppData\Roaming\Opera Software\Opera Stable\Extensions\bbglkiiiofelplniblholffbhhjmdhhi
Složka Nalezeno : C:\Users\Bazy\AppData\Roaming\RHEng
Soubor Nalezeno : C:\Users\Bazy\AppData\Roaming\Mozilla\Firefox\Profiles\6kl0v44j.default\searchplugins\mystartsearch.xml
Soubor Nalezeno : C:\Users\Bazy\AppData\Roaming\Mozilla\Firefox\Profiles\6kl0v44j.default\user.js

***** [ Naplánované úlohy ] *****


***** [ Zástupci ] *****


***** [ Registry ] *****

Hodnota Nalezeno : HKLM\SOFTWARE\Mozilla\Firefox\Extensions [searchffv2@gmail.com]
Hodnota Nalezeno : HKLM\SOFTWARE\Mozilla\Firefox\Extensions [sweetsearch@gmail.com]
Klíč Nalezeno : HKCU\Software\APN PIP
Klíč Nalezeno : HKCU\Software\AppDataLow\Software\Crossrider
Klíč Nalezeno : HKCU\Software\GlobalUpdate
Klíč Nalezeno : HKCU\Software\HomeTab
Klíč Nalezeno : HKCU\Software\Kromtech
Klíč Nalezeno : HKCU\Software\Linkey
Klíč Nalezeno : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}
Klíč Nalezeno : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{2023ECEC-E06A-4372-A1C7-0B49F9E0FFF0}
Klíč Nalezeno : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}
Klíč Nalezeno : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{E733165D-CBCF-4FDA-883E-ADEF965B476C}
Klíč Nalezeno : HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\IMBoosterARP
Klíč Nalezeno : HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\IminentToolbar
Klíč Nalezeno : HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\Linkey
Klíč Nalezeno : HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\SearchProtect
Klíč Nalezeno : HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\Vosteran.com
Klíč Nalezeno : HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\WajIntEnhance
Klíč Nalezeno : HKCU\Software\Mozilla\Extends
Klíč Nalezeno : HKCU\Software\SearchProtectWS
Klíč Nalezeno : HKCU\Software\simplytech
Klíč Nalezeno : HKCU\Software\TNT2
Klíč Nalezeno : HKCU\Software\WajIntEnhance
Klíč Nalezeno : [x64] HKCU\Software\APN PIP
Klíč Nalezeno : [x64] HKCU\Software\GlobalUpdate
Klíč Nalezeno : [x64] HKCU\Software\HomeTab
Klíč Nalezeno : [x64] HKCU\Software\Kromtech
Klíč Nalezeno : [x64] HKCU\Software\Linkey
Klíč Nalezeno : [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}
Klíč Nalezeno : [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{2023ECEC-E06A-4372-A1C7-0B49F9E0FFF0}
Klíč Nalezeno : [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{2023ECEC-E06A-4372-A1C7-0B49F9E0FFF0}
Klíč Nalezeno : [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}
Klíč Nalezeno : [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{E733165D-CBCF-4FDA-883E-ADEF965B476C}
Klíč Nalezeno : [x64] HKCU\Software\SearchProtectWS
Klíč Nalezeno : [x64] HKCU\Software\simplytech
Klíč Nalezeno : [x64] HKCU\Software\TNT2
Klíč Nalezeno : [x64] HKCU\Software\WajIntEnhance
Klíč Nalezeno : HKLM\SOFTWARE\AIM Toolbar
Klíč Nalezeno : HKLM\SOFTWARE\AskPartnerNetwork
Klíč Nalezeno : HKLM\SOFTWARE\Classes\CLSID\{51D26BB4-4D2C-4AE4-9873-5FF41B6DED1F}
Klíč Nalezeno : HKLM\SOFTWARE\Classes\CLSID\{F83D1872-D9FF-47F8-B5A0-49CC51E24EE8}
Klíč Nalezeno : HKLM\SOFTWARE\Classes\Interface\{917CAAE9-DD47-4025-936E-1414F07DF5B8}
Klíč Nalezeno : HKLM\SOFTWARE\Classes\pc-mechanic
Klíč Nalezeno : HKLM\SOFTWARE\Conduit
Klíč Nalezeno : HKLM\SOFTWARE\FFPluginHp
Klíč Nalezeno : HKLM\SOFTWARE\GlobalUpdate
Klíč Nalezeno : HKLM\SOFTWARE\IHProtect
Klíč Nalezeno : HKLM\SOFTWARE\Iminent
Klíč Nalezeno : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}
Klíč Nalezeno : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\globalupdate.exe
Klíč Nalezeno : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IMBoosterARP
Klíč Nalezeno : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IminentToolbar
Klíč Nalezeno : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Linkey
Klíč Nalezeno : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SearchProtect
Klíč Nalezeno : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Vosteran.com
Klíč Nalezeno : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WajIntEnhance
Klíč Nalezeno : HKLM\SOFTWARE\mystartsearchSoftware
Klíč Nalezeno : HKLM\SOFTWARE\SearchProtect
Klíč Nalezeno : HKLM\SOFTWARE\SpeedBit
Klíč Nalezeno : HKLM\SOFTWARE\SupDp
Klíč Nalezeno : HKLM\SOFTWARE\SupTab
Klíč Nalezeno : HKLM\SOFTWARE\supWindowsMangerProtect
Klíč Nalezeno : HKLM\SOFTWARE\Uniblue
Klíč Nalezeno : HKLM\SOFTWARE\WajIntEnhance
Klíč Nalezeno : HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Application\WindowsMangerProtect
Klíč Nalezeno : [x64] HKLM\SOFTWARE\Classes\Interface\{917CAAE9-DD47-4025-936E-1414F07DF5B8}
Klíč Nalezeno : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}

***** [ Prohlížeče ] *****

-\\ Internet Explorer v11.0.9600.17909

Nastavení Nalezeno : HKCU\Software\Microsoft\Internet Explorer\Main [Search Page] - hxxp://www.mystartsearch.com/web/?type= ... PWJ9ASX&q={searchTerms}
Nastavení Nalezeno : HKCU\Software\Microsoft\Internet Explorer\Main [Start Page] - hxxp://www.mystartsearch.com/?type=hppp ... X4APWJ9ASX
Nastavení Nalezeno : HKCU\Software\Microsoft\Internet Explorer\Main [Default_Page_URL] - hxxp://www.mystartsearch.com/?type=hppp ... X4APWJ9ASX
Nastavení Nalezeno : HKCU\Software\Microsoft\Internet Explorer\Main [Default_Search_URL] - hxxp://www.mystartsearch.com/web/?type= ... PWJ9ASX&q={searchTerms}
Nastavení Nalezeno : HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Default_Search_URL] - hxxp://www.mystartsearch.com/web/?type= ... PWJ9ASX&q={searchTerms}
Nastavení Nalezeno : HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Search Page] - hxxp://www.mystartsearch.com/web/?type= ... PWJ9ASX&q={searchTerms}
Nastavení Nalezeno : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Default_Search_URL] - hxxp://www.mystartsearch.com/web/?type= ... PWJ9ASX&q={searchTerms}
Nastavení Nalezeno : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Search Page] - hxxp://www.mystartsearch.com/web/?type= ... PWJ9ASX&q={searchTerms}

-\\ Mozilla Firefox v38.0.1 (x86 cs)

[6kl0v44j.default] - Řádek Nalezeno : user_pref("browser.newtab.url", "chrome://quick_start/content/index.html");
[6kl0v44j.default] - Řádek Nalezeno : user_pref("browser.search.defaultenginename", "mystartsearch");
[6kl0v44j.default] - Řádek Nalezeno : user_pref("browser.search.searchengine.alias", "mystartsearch");
[6kl0v44j.default] - Řádek Nalezeno : user_pref("browser.search.searchengine.iconURL", "hxxp://www.mystartsearch.com/web/favicon.ico");
[6kl0v44j.default] - Řádek Nalezeno : user_pref("browser.search.searchengine.name", "mystartsearch");
[6kl0v44j.default] - Řádek Nalezeno : user_pref("browser.search.searchengine.url", "hxxp://www.mystartsearch.com/web/?type=dspp&ts=1433093038&z=7f8d798aef2c07144e7d8ecgaz1cec0edtdcdebc5m&from=cvs&uid=TOSHIBAXDT01ACA050_X4APWJ9ASXXX4APWJ9A[...]
[6kl0v44j.default] - Řádek Nalezeno : user_pref("browser.search.selectedEngine", "mystartsearch");
[6kl0v44j.default] - Řádek Nalezeno : user_pref("browser.startup.homepage", "hxxp://www.mystartsearch.com/?type=hppp&ts=1433093038&z=7f8d798aef2c07144e7d8ecgaz1cec0edtdcdebc5m&from=cvs&uid=TOSHIBAXDT01ACA050_X4APWJ9ASXXX4APWJ9ASX");
[6kl0v44j.default] - Řádek Nalezeno : user_pref("extensions.crossrider.bic", "14dad60b79b0d70506d82cdaf64ce0a8");
[6kl0v44j.default] - Řádek Nalezeno : user_pref("extensions.quick_start.enable_search1", false);
[6kl0v44j.default] - Řádek Nalezeno : user_pref("extensions.quick_start.sd.closeWindowWithLastTab_prev_state", false);

-\\ Google Chrome v44.0.2403.130


-\\ Opera v31.0.1889.99


*************************

AdwCleaner[R0].txt - [10033 bytů] - [07/08/2015 17:40:03]
AdwCleaner[R1].txt - [9910 bytů] - [07/08/2015 17:42:20]
AdwCleaner[R2].txt - [9760 bytů] - [07/08/2015 17:43:20]

########## EOF - C:\AdwCleaner\AdwCleaner[R2].txt - [9818 bytů] ##########


SCAN REPORT Malwarebytes' Anti-Malware


Malwarebytes Anti-Malware
www.malwarebytes.org

Datum skenování: 7.8.2015
Čas skenování: 17:48
Protokol:
Správce: Ano

Verze: 2.1.8.1057
Databáze malwaru: v2015.08.07.04
Databáze rootkitů: v2015.08.06.01
Licence: Zkušební verze
Ochrana proti malwaru: Zapnuto
Ochrana proti škodlivým webovým stránkám: Zapnuto
Ochrana programu: Vypnuto

OS: Windows 7 Service Pack 1
CPU: x64
Souborový systém: NTFS
Uživatel: Bazy

Typ skenu: Sken hrozeb
Výsledek: Dokončeno
Prohledaných objektů: 343012
Uplynulý čas: 8 min, 52 sek

Paměť: Zapnuto
Po spuštění: Zapnuto
Souborový systém: Zapnuto
Archivy: Zapnuto
Rootkity: Vypnuto
Heuristika: Zapnuto
PUP: Zapnuto
PUM: Zapnuto

Procesy: 0
(Nenalezeny žádné škodlivé položky)

Moduly: 0
(Nenalezeny žádné škodlivé položky)

Klíče registru: 47
PUP.Optional.LuckyTab.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{51D26BB4-4D2C-4AE4-9873-5FF41B6DED1F}, , [619f31d591fa3204e726028c7f83df21],
PUP.Optional.LuckyTab.A, HKLM\SOFTWARE\CLASSES\TYPELIB\{7D3C47ED-E0BE-4940-9DDA-A7A097AEBD88}, , [619f31d591fa3204e726028c7f83df21],
PUP.Optional.LuckyTab.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{917CAAE9-DD47-4025-936E-1414F07DF5B8}, , [619f31d591fa3204e726028c7f83df21],
PUP.Optional.LuckyTab.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\INTERFACE\{917CAAE9-DD47-4025-936E-1414F07DF5B8}, , [619f31d591fa3204e726028c7f83df21],
PUP.Optional.LuckyTab.A, HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{917CAAE9-DD47-4025-936E-1414F07DF5B8}, , [619f31d591fa3204e726028c7f83df21],
PUP.Optional.LuckyTab.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\TYPELIB\{7D3C47ED-E0BE-4940-9DDA-A7A097AEBD88}, , [619f31d591fa3204e726028c7f83df21],
PUP.Optional.LuckyTab.A, HKLM\SOFTWARE\CLASSES\WOW6432NODE\TYPELIB\{7D3C47ED-E0BE-4940-9DDA-A7A097AEBD88}, , [619f31d591fa3204e726028c7f83df21],
PUP.Optional.LuckyTab.A, HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{51D26BB4-4D2C-4AE4-9873-5FF41B6DED1F}, , [619f31d591fa3204e726028c7f83df21],
PUP.Optional.MyStartSearch.ShrtCln, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{33BB0A4E-99AF-4226-BDF6-49120163DE86}, , [be42689e206bee48bf370b910bf9669a],
PUP.Optional.APNToolBar.Gen, HKLM\SOFTWARE\WOW6432NODE\AskPartnerNetwork, , [54acfc0a85060a2cbf2cad6af013857b],
PUP.Optional.FFPluginHp.A, HKLM\SOFTWARE\WOW6432NODE\FFPluginHp, , [39c7f1151d6eaa8c9c6158c07b886997],
PUP.Optional.IHProtect.A, HKLM\SOFTWARE\WOW6432NODE\IHProtect, , [6d93da2c9ceff2449fdfe148c53e2ad6],
PUP.Optional.Iminent.A, HKLM\SOFTWARE\WOW6432NODE\Iminent, , [bf4193733952261055901e41b152c23e],
PUP.Optional.MyStartSearch.ShrtCln, HKLM\SOFTWARE\WOW6432NODE\mystartsearchSoftware, , [1ae6030359326dc9b6c22d03c73cca36],
PUP.Optional.WPM.A, HKLM\SOFTWARE\WOW6432NODE\supWindowsMangerProtect, , [0ef26e9897f46ec8a080b8d541c3936d],
PUP.Optional.Wajam.A, HKLM\SOFTWARE\WOW6432NODE\WajIntEnhance, , [35cb64a294f77fb7c6741f07986bd42c],
PUP.Optional.CrossRider.C, HKLM\SOFTWARE\WOW6432NODE\APPDATALOW\SOFTWARE\Crossrider, , [d22ecb3be2a9e74faaf49683ab58ed13],
PUP.Optional.MyStartSearch.ShrtCln, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{33BB0A4E-99AF-4226-BDF6-49120163DE86}, , [fb053fc78407ce683bbb79232ed6e61a],
PUP.Optional.Iminent.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\IMBoosterARP, , [4ab6ff070f7c89ad62008b98e32044bc],
PUP.Optional.Iminent.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\IminentToolbar, , [bf41bc4aa7e460d6e081ee355ca70af6],
PUP.Optional.Vosteran, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\Vosteran.com, , [10f0020495f689ad667d27092dd6ef11],
PUP.Optional.Wajam.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\WajIntEnhance, , [af5138ce7615023462fef52e55ae18e8],
PUP.Optional.SupTab.A, HKLM\SOFTWARE\WOW6432NODE\SUPTAB, , [8977dd2993f8ec4a4a0455e72dd6da26],
PUP.Optional.IHProtect.A, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\IHProtect Service, , [778941c545465cda6a1358d119ea3cc4],
PUP.Optional.WindowsMangerProtect.A, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\WindowsMangerProtect, , [4cb45caa90fba5914274a389f3106997],
PUP.Optional.WindowsMangerProtect.A, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\EVENTLOG\APPLICATION\WindowsMangerProtect, , [2cd4bc4aeaa1fe38ee3921128d76a65a],
PUP.Optional.InternetSpeedChecker.PrxySvrRST, HKU\S-1-5-18\SOFTWARE\Internet Speed Checker-nv, , [39c7b35329629d99e305e43d0df62dd3],
PUP.Optional.InternetSpeedChecker.PrxySvrRST, HKU\S-1-5-18\SOFTWARE\Internet Speed Checker-nv-ie, , [47b97294eaa1df57b43468b90003c739],
PUP.Optional.Crossrider.C, HKU\S-1-5-18\SOFTWARE\APPDATALOW\SOFTWARE\_CrossriderRegNamePlaceHolder_, , [639d47bf5f2c55e18ef3524cca3a9f61],
PUP.Optional.HomeTab.A, HKU\S-1-5-21-3337690945-2375857415-1498957166-1001\SOFTWARE\HomeTab, , [fe02d6300d7e191dbe7cb19a4cb7f808],
PUP.Optional.InternetSpeedChecker.PrxySvrRST, HKU\S-1-5-21-3337690945-2375857415-1498957166-1001\SOFTWARE\Internet Speed Checker-nv-ie, , [639d798ded9e26102eba42dfc53ea15f],
PUP.Optional.SearchProtect.A, HKU\S-1-5-21-3337690945-2375857415-1498957166-1001\SOFTWARE\SearchProtectWS, , [d32d34d22863c6701252a3809073fc04],
PUP.Optional.TNT.A, HKU\S-1-5-21-3337690945-2375857415-1498957166-1001\SOFTWARE\TNT2, , [05fbef17fb90c47212fb012457acbc44],
PUP.Optional.Wajam.A, HKU\S-1-5-21-3337690945-2375857415-1498957166-1001\SOFTWARE\WajIntEnhance, , [90701fe7dcaf90a63efd8e9847bc936d],
PUP.Optional.CrossRider.A, HKU\S-1-5-21-3337690945-2375857415-1498957166-1001\SOFTWARE\APPDATALOW\SOFTWARE\Crossrider, , [fc048086315a44f23bc40a7b3ec606fa],
PUP.Optional.GlobalUpdate.C, HKU\S-1-5-21-3337690945-2375857415-1498957166-1001\SOFTWARE\GLOBALUPDATE\UPDATE\PROXY, , [a858aa5c7f0c36002d90110aeb18d927],
PUP.Optional.MyStartSearch.ShrtCln, HKU\S-1-5-21-3337690945-2375857415-1498957166-1001\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{0633EE93-D776-472F-A0FF-E1416B8B2E3A}, , [38c853b3612ad16504e29d7849ba0af6],
PUP.Optional.MyStartSearch.ShrtCln, HKU\S-1-5-21-3337690945-2375857415-1498957166-1001\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{2023ECEC-E06A-4372-A1C7-0B49F9E0FFF0}, , [58a8b551eba066d04d991df8a95a8977],
PUP.Optional.MyStartSearch.ShrtCln, HKU\S-1-5-21-3337690945-2375857415-1498957166-1001\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{33BB0A4E-99AF-4226-BDF6-49120163DE86}, , [f50b3dc9d9b2e254dd18465630d48e72],
PUP.Optional.MyStartSearch.ShrtCln, HKU\S-1-5-21-3337690945-2375857415-1498957166-1001\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{E733165D-CBCF-4FDA-883E-ADEF965B476C}, , [c83835d16427280e499d59bcb94ab050],
PUP.Optional.Iminent.A, HKU\S-1-5-21-3337690945-2375857415-1498957166-1001\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\IMBoosterARP, , [8f71c93d2863a5919f7043ddb0530bf5],
PUP.Optional.Iminent.A, HKU\S-1-5-21-3337690945-2375857415-1498957166-1001\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\IminentToolbar, , [d32d41c53b50999d1bf5c15f54af0ef2],
PUP.Optional.Linkey.A, HKU\S-1-5-21-3337690945-2375857415-1498957166-1001\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\Linkey, , [d12fef1742491422fa175cc457ac15eb],
PUP.Optional.SearchProtect.A, HKU\S-1-5-21-3337690945-2375857415-1498957166-1001\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\SearchProtect, , [8779897d1a71b581b0637727cc386f91],
PUP.Optional.Vosteran.A, HKU\S-1-5-21-3337690945-2375857415-1498957166-1001\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\Vosteran.com, , [dc2444c2ed9eb77f3ad8150b020144bc],
PUP.Optional.Wajam.A, HKU\S-1-5-21-3337690945-2375857415-1498957166-1001\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\WajIntEnhance, , [6c94ce385f2cc175967da97741c220e0],
PUP.Optional.SweetSearch.A, HKU\S-1-5-21-3337690945-2375857415-1498957166-1001\SOFTWARE\MOZILLA\EXTENDS, , [a25e25e12a61191d16fba377e41f33cd],

Hodnoty registru: 16
PUP.Optional.MyStartSearch.ShrtCln, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{33BB0A4E-99AF-4226-BDF6-49120163DE86}|DisplayName, mystartsearch, , [be42689e206bee48bf370b910bf9669a]
PUP.Optional.MyStartSearch.ShrtCln, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{33BB0A4E-99AF-4226-BDF6-49120163DE86}|URL, http://www.mystartsearch.com/web/?type= ... PWJ9ASX&q={searchTerms}, , [6997f70f414ae74f12d50312d033b050]
PUP.Optional.MyStartSearch.ShrtCln, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{33BB0A4E-99AF-4226-BDF6-49120163DE86}|DisplayName, mystartsearch, , [fb053fc78407ce683bbb79232ed6e61a]
PUP.Optional.MyStartSearch.ShrtCln, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{33BB0A4E-99AF-4226-BDF6-49120163DE86}|URL, http://www.mystartsearch.com/web/?type= ... PWJ9ASX&q={searchTerms}, , [09f731d5a9e276c0b631e035d2318a76]
PUP.Optional.FastStart.A, HKLM\SOFTWARE\WOW6432NODE\MOZILLA\FIREFOX\EXTENSIONS|searchffv2@gmail.com, C:\Users\Bazy\AppData\Roaming\Mozilla\Firefox\Profiles\6kl0v44j.default\extensions\searchffv2@gmail.com, , [60a0a75fec9f0c2a97c5fba634d05fa1]
PUP.Optional.SweetSearch.A, HKLM\SOFTWARE\WOW6432NODE\MOZILLA\FIREFOX\EXTENSIONS|sweetsearch@gmail.com, C:\Users\Bazy\AppData\Roaming\Mozilla\Firefox\Profiles\6kl0v44j.default\extensions\sweetsearch@gmail.com, , [da2652b4a7e41422519a9b7e14ef867a]
PUP.Optional.SupTab.A, HKLM\SOFTWARE\WOW6432NODE\SUPTAB|ptid, cvs, , [8977dd2993f8ec4a4a0455e72dd6da26]
PUP.Optional.GlobalUpdate.C, HKU\S-1-5-21-3337690945-2375857415-1498957166-1001\SOFTWARE\GLOBALUPDATE\UPDATE\PROXY|source, Firefox, , [a858aa5c7f0c36002d90110aeb18d927]
PUP.Optional.MyStartSearch.ShrtCln, HKU\S-1-5-21-3337690945-2375857415-1498957166-1001\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}|URL, http://www.mystartsearch.com/web/?utm_s ... default&q={searchTerms}, , [38c853b3612ad16504e29d7849ba0af6]
PUP.Optional.MyStartSearch.ShrtCln, HKU\S-1-5-21-3337690945-2375857415-1498957166-1001\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{2023ECEC-E06A-4372-A1C7-0B49F9E0FFF0}|URL, http://www.mystartsearch.com/web/?utm_s ... default&q={searchTerms}, , [58a8b551eba066d04d991df8a95a8977]
PUP.Optional.MyStartSearch.ShrtCln, HKU\S-1-5-21-3337690945-2375857415-1498957166-1001\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{2023ECEC-E06A-4372-A1C7-0B49F9E0FFF0}|FaviconURL, http://www.mystartsearch.com//favicon.ico, , [2bd5b84e315acb6b32b417fe8c77629e]
PUP.Optional.MyStartSearch.ShrtCln, HKU\S-1-5-21-3337690945-2375857415-1498957166-1001\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{33BB0A4E-99AF-4226-BDF6-49120163DE86}|DisplayName, mystartsearch, , [f50b3dc9d9b2e254dd18465630d48e72]
PUP.Optional.MyStartSearch.ShrtCln, HKU\S-1-5-21-3337690945-2375857415-1498957166-1001\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{33BB0A4E-99AF-4226-BDF6-49120163DE86}|URL, http://www.mystartsearch.com/web/?type= ... PWJ9ASX&q={searchTerms}, , [946c38cef7949f9703e33cd9c43f2dd3]
PUP.Optional.MyStartSearch.ShrtCln, HKU\S-1-5-21-3337690945-2375857415-1498957166-1001\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{33BB0A4E-99AF-4226-BDF6-49120163DE86}|TopResultURL, http://www.mystartsearch.com/web/?type= ... PWJ9ASX&q={searchTerms}, , [07f976905833a5916a7ce3322cd73ec2]
PUP.Optional.MyStartSearch.ShrtCln, HKU\S-1-5-21-3337690945-2375857415-1498957166-1001\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{E733165D-CBCF-4FDA-883E-ADEF965B476C}|URL, http://www.mystartsearch.com/web/?utm_s ... default&q={searchTerms}, , [c83835d16427280e499d59bcb94ab050]
PUP.Optional.SweetSearch.A, HKU\S-1-5-21-3337690945-2375857415-1498957166-1001\SOFTWARE\MOZILLA\EXTENDS|appid, sweetsearch@gmail.com, , [a25e25e12a61191d16fba377e41f33cd]

Data registru: 10
PUP.Optional.MyStartSearch.ShrtCln, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Default_Search_URL, http://www.mystartsearch.com/web/?type= ... PWJ9ASX&q={searchTerms}, Dobré: (www.google.com), Špatné: (http://www.mystartsearch.com/web/?type= ... PWJ9ASX&q={searchTerms}),,[c838e71f0e7dc076164657e9b74e3fc1]
PUP.Optional.MyStartSearch.ShrtCln, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Search Page, http://www.mystartsearch.com/web/?type= ... PWJ9ASX&q={searchTerms}, Dobré: (www.google.com), Špatné: (http://www.mystartsearch.com/web/?type= ... PWJ9ASX&q={searchTerms}),,[43bd31d5fa9178be85d799a7a85d14ec]
PUP.Optional.Qone8, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES|DefaultScope, {33BB0A4E-99AF-4226-BDF6-49120163DE86}, Dobré: ({0633EE93-D776-472f-A0FF-E1416B8B2E3A}), Špatné: ({33BB0A4E-99AF-4226-BDF6-49120163DE86}),,[c43c07ffcebd3bfb9942272441c45ca4]
PUP.Optional.MyStartSearch.ShrtCln, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\MAIN|Default_Search_URL, http://www.mystartsearch.com/web/?type= ... PWJ9ASX&q={searchTerms}, Dobré: (www.google.com), Špatné: (http://www.mystartsearch.com/web/?type= ... PWJ9ASX&q={searchTerms}),,[16eaea1c8506bb7bdb81da6656afe31d]
PUP.Optional.MyStartSearch.ShrtCln, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\MAIN|Search Page, http://www.mystartsearch.com/web/?type= ... PWJ9ASX&q={searchTerms}, Dobré: (www.google.com), Špatné: (http://www.mystartsearch.com/web/?type= ... PWJ9ASX&q={searchTerms}),,[7987986eb8d383b3baa28db331d440c0]
PUP.Optional.Qone8, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES|DefaultScope, {33BB0A4E-99AF-4226-BDF6-49120163DE86}, Dobré: ({0633EE93-D776-472f-A0FF-E1416B8B2E3A}), Špatné: ({33BB0A4E-99AF-4226-BDF6-49120163DE86}),,[926ece38404bb482b12a3318ae57c739]
PUP.Optional.MyStartSearch.ShrtCln, HKU\S-1-5-21-3337690945-2375857415-1498957166-1001\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Search Page, http://www.mystartsearch.com/web/?type= ... PWJ9ASX&q={searchTerms}, Dobré: (www.google.com), Špatné: (http://www.mystartsearch.com/web/?type= ... PWJ9ASX&q={searchTerms}),,[8f71868067240630580573cda263d828]
PUP.Optional.HttpBreaker.A, HKU\S-1-5-21-3337690945-2375857415-1498957166-1001\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Start Page, http://www.mystartsearch.com/?type=hppp ... X4APWJ9ASX, Dobré: (www.google.com), Špatné: (http://www.mystartsearch.com/?type=hppp ... X4APWJ9ASX),,[b34d07ff800b231323d41c23778ebe42]
PUP.Optional.HttpBreaker.A, HKU\S-1-5-21-3337690945-2375857415-1498957166-1001\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Default_Page_URL, http://www.mystartsearch.com/?type=hppp ... X4APWJ9ASX, Dobré: (www.google.com), Špatné: (http://www.mystartsearch.com/?type=hppp ... X4APWJ9ASX),,[a55bbf474c3f77bf17e019261aeb9868]
PUP.Optional.MyStartSearch.ShrtCln, HKU\S-1-5-21-3337690945-2375857415-1498957166-1001\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Default_Search_URL, http://www.mystartsearch.com/web/?type= ... PWJ9ASX&q={searchTerms}, Dobré: (www.google.com), Špatné: (http://www.mystartsearch.com/web/?type= ... PWJ9ASX&q={searchTerms}),,[8d73d92d513af73f7de0f64aa85d51af]

Složky: 34
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab, , [d12f48be068516208ef165c46d96738d],
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\skin, , [d12f48be068516208ef165c46d96738d],
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\skin\image, , [d12f48be068516208ef165c46d96738d],
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web, , [d12f48be068516208ef165c46d96738d],
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\img, , [d12f48be068516208ef165c46d96738d],
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\js, , [d12f48be068516208ef165c46d96738d],
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\_locales, , [d12f48be068516208ef165c46d96738d],
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\_locales\en-US, , [d12f48be068516208ef165c46d96738d],
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\_locales\es-419, , [d12f48be068516208ef165c46d96738d],
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\_locales\es-ES, , [d12f48be068516208ef165c46d96738d],
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\_locales\fr-BE, , [d12f48be068516208ef165c46d96738d],
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\_locales\fr-CA, , [d12f48be068516208ef165c46d96738d],
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\_locales\fr-CH, , [d12f48be068516208ef165c46d96738d],
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\_locales\fr-FR, , [d12f48be068516208ef165c46d96738d],
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\_locales\fr-LU, , [d12f48be068516208ef165c46d96738d],
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\_locales\it-CH, , [d12f48be068516208ef165c46d96738d],
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\_locales\it-IT, , [d12f48be068516208ef165c46d96738d],
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\_locales\pl, , [d12f48be068516208ef165c46d96738d],
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\_locales\pt, , [d12f48be068516208ef165c46d96738d],
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\_locales\pt-BR, , [d12f48be068516208ef165c46d96738d],
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\_locales\ru, , [d12f48be068516208ef165c46d96738d],
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\_locales\ru-MO, , [d12f48be068516208ef165c46d96738d],
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\_locales\tr-TR, , [d12f48be068516208ef165c46d96738d],
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\_locales\vi-VI, , [d12f48be068516208ef165c46d96738d],
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\_locales\zh-CN, , [d12f48be068516208ef165c46d96738d],
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\_locales\zh-TW, , [d12f48be068516208ef165c46d96738d],
PUP.Optional.OpenCandy, C:\Users\Bazy\AppData\Roaming\OpenCandy, , [3fc147bf3c4fed49b82fdd0226dcbe42],
PUP.Optional.OpenCandy, C:\Users\Bazy\AppData\Roaming\OpenCandy\E656820E8162432EBCA71A7B23EE4F10, , [3fc147bf3c4fed49b82fdd0226dcbe42],
PUP.Optional.WPM.A, C:\ProgramData\WindowsMangerProtect, , [aa562bdb2d5ee650c2e2b839a95906fa],
PUP.Optional.WPM.A, C:\ProgramData\WindowsMangerProtect\update, , [aa562bdb2d5ee650c2e2b839a95906fa],
PUP.Optional.IHProtectUpDate.A, C:\ProgramData\IHProtectUpDate, , [a55b9472f2990b2b594dd233dd26936d],
PUP.Optional.IHProtectUpDate.A, C:\ProgramData\IHProtectUpDate\update, , [a55b9472f2990b2b594dd233dd26936d],
PUP.Optional.RazorWeb.A, C:\Users\Bazy\AppData\Roaming\Opera Software\Opera Stable\Extensions\dbkpiceddlihfkdpfggakggacikddfjg\1.0.5628.30062_0, , [27d976906625ad8904e4681abf46fb05],
PUP.Optional.RazorWeb.A, C:\Users\Bazy\AppData\Roaming\Opera Software\Opera Stable\Extensions\dbkpiceddlihfkdpfggakggacikddfjg, , [27d976906625ad8904e4681abf46fb05],

Soubory: 79
PUP.Optional.RazorWeb.A, C:\Users\Bazy\AppData\Roaming\OpenCandy\E656820E8162432EBCA71A7B23EE4F10\setup.exe, , [09f737cf206bac8abc4bf9878a7b46ba],
PUP.Optional.RazorWeb.A, C:\Users\Bazy\AppData\Roaming\RHEng\54729F61BEFB4403B429C999B88D7D30\setup.exe, , [6f91b155bbd07fb7d92e245c04010bf5],
PUP.Optional.PCMechanic, C:\Users\Bazy\AppData\Roaming\RHEng\767F6E66DCF04640A1C50190C9245A1D\pcmechanicpmROW_p1v3.exe, , [0000c83e6427f145a8c5f6d030d18b75],
PUP.Optional.Browserwatch, C:\Program Files (x86)\XTab\BrowerWatchCH.dll, , [80808086ef9c81b5417156d95da814ec],
PUP.Optional.Freemium.A, C:\Users\Bazy\Downloads\PDFCreator 1.2.0 Downloader.exe, , [669a62a49deec076c82279061ce9ac54],
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\uninstall.exe, , [d12f48be068516208ef165c46d96738d],
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\conf, , [d12f48be068516208ef165c46d96738d],
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\ffsearch_toolbar!1.0.0.1031.xpi, , [d12f48be068516208ef165c46d96738d],
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\install.data, , [d12f48be068516208ef165c46d96738d],
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\msvcp110.dll, , [d12f48be068516208ef165c46d96738d],
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\msvcr110.dll, , [d12f48be068516208ef165c46d96738d],
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\searchProvider.xml, , [d12f48be068516208ef165c46d96738d],
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\skin\about.png, , [d12f48be068516208ef165c46d96738d],
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\skin\about_bk.png, , [d12f48be068516208ef165c46d96738d],
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\skin\btn.png, , [d12f48be068516208ef165c46d96738d],
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\skin\btn_apply.png, , [d12f48be068516208ef165c46d96738d],
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\skin\close.png, , [d12f48be068516208ef165c46d96738d],
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\skin\conf.xml, , [d12f48be068516208ef165c46d96738d],
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\skin\conf_back.png, , [d12f48be068516208ef165c46d96738d],
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\skin\input_bk.png, , [d12f48be068516208ef165c46d96738d],
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\skin\logo.png, , [d12f48be068516208ef165c46d96738d],
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\skin\main.xml, , [d12f48be068516208ef165c46d96738d],
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\skin\radio_1.png, , [d12f48be068516208ef165c46d96738d],
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\skin\radio_2.png, , [d12f48be068516208ef165c46d96738d],
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\skin\rigth_arrow.png, , [d12f48be068516208ef165c46d96738d],
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\skin\settings.png, , [d12f48be068516208ef165c46d96738d],
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\data.html, , [d12f48be068516208ef165c46d96738d],
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\indexIE.html, , [d12f48be068516208ef165c46d96738d],
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\indexIE8.html, , [d12f48be068516208ef165c46d96738d],
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\main.css, , [d12f48be068516208ef165c46d96738d],
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\ver.txt, , [d12f48be068516208ef165c46d96738d],
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\img\google_trends.png, , [d12f48be068516208ef165c46d96738d],
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\img\icon128.png, , [d12f48be068516208ef165c46d96738d],
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\img\icon16.png, , [d12f48be068516208ef165c46d96738d],
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\img\icon48.png, , [d12f48be068516208ef165c46d96738d],
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\img\loading.gif, , [d12f48be068516208ef165c46d96738d],
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\img\logo32.ico, , [d12f48be068516208ef165c46d96738d],
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\js\common.js, , [d12f48be068516208ef165c46d96738d],
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\js\ga.js, , [d12f48be068516208ef165c46d96738d],
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\js\jquery-1.11.0.min.js, , [d12f48be068516208ef165c46d96738d],
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\js\jquery.autocomplete.js, , [d12f48be068516208ef165c46d96738d],
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\js\jquery.xdomainrequest.min.js, , [d12f48be068516208ef165c46d96738d],
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\js\js.js, , [d12f48be068516208ef165c46d96738d],
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\js\library.js, , [d12f48be068516208ef165c46d96738d],
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\js\xagainit-ie8.js, , [d12f48be068516208ef165c46d96738d],
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\js\xagainit2.0.js, , [d12f48be068516208ef165c46d96738d],
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\js\xdomain.min.js, , [d12f48be068516208ef165c46d96738d],
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\_locales\en-US\messages.json, , [d12f48be068516208ef165c46d96738d],
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\_locales\es-419\messages.json, , [d12f48be068516208ef165c46d96738d],
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\_locales\es-ES\messages.json, , [d12f48be068516208ef165c46d96738d],
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\_locales\fr-BE\messages.json, , [d12f48be068516208ef165c46d96738d],
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\_locales\fr-CA\messages.json, , [d12f48be068516208ef165c46d96738d],
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\_locales\fr-CH\messages.json, , [d12f48be068516208ef165c46d96738d],
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\_locales\fr-FR\messages.json, , [d12f48be068516208ef165c46d96738d],
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\_locales\fr-LU\messages.json, , [d12f48be068516208ef165c46d96738d],
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\_locales\it-CH\messages.json, , [d12f48be068516208ef165c46d96738d],
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\_locales\it-IT\messages.json, , [d12f48be068516208ef165c46d96738d],
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\_locales\pl\messages.json, , [d12f48be068516208ef165c46d96738d],
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\_locales\pt\messages.json, , [d12f48be068516208ef165c46d96738d],
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\_locales\pt-BR\messages.json, , [d12f48be068516208ef165c46d96738d],
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\_locales\ru\messages.json, , [d12f48be068516208ef165c46d96738d],
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\_locales\ru-MO\messages.json, , [d12f48be068516208ef165c46d96738d],
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\_locales\tr-TR\messages.json, , [d12f48be068516208ef165c46d96738d],
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\_locales\vi-VI\messages.json, , [d12f48be068516208ef165c46d96738d],
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\_locales\zh-CN\messages.json, , [d12f48be068516208ef165c46d96738d],
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\_locales\zh-TW\messages.json, , [d12f48be068516208ef165c46d96738d],
PUP.Optional.MyStartSearch.ShrtCln, C:\Users\Bazy\AppData\Roaming\Mozilla\Firefox\Profiles\6kl0v44j.default\searchplugins\mystartsearch.xml, , [48b8be48880354e278ff67c9fe0525db],
PUP.Optional.WPM.A, C:\ProgramData\WindowsMangerProtect\update\conf, , [aa562bdb2d5ee650c2e2b839a95906fa],
PUP.Optional.IHProtectUpDate.A, C:\ProgramData\IHProtectUpDate\update\conf, , [a55b9472f2990b2b594dd233dd26936d],
PUP.Optional.QuickStart.A, C:\Users\Bazy\AppData\Roaming\Mozilla\Firefox\Profiles\6kl0v44j.default\prefs.js, Dobré: (), Špatné: (user_pref("browser.newtab.url", "chrome://quick_start/content/index.html");), ,[87795aac513ad165c1e47b097c89a759]
PUP.Optional.CrossRider.A, C:\Users\Bazy\AppData\Roaming\Mozilla\Firefox\Profiles\6kl0v44j.default\prefs.js, Dobré: (), Špatné: (user_pref("extensions.crossrider.bic", "14dad60b79b0d70506d82cdaf64ce0a8");), ,[03fded194e3d39fde74297efa85d46ba]
PUP.Optional.MyStartSearch, C:\Users\Bazy\AppData\Roaming\Mozilla\Firefox\Profiles\6kl0v44j.default\prefs.js, Dobré: (), Špatné: (user_pref("browser.search.defaultenginename", "mystartsearch");), ,[cd33a4620289fd395eb394f3a263c838]
PUP.Optional.MyStartSearch, C:\Users\Bazy\AppData\Roaming\Mozilla\Firefox\Profiles\6kl0v44j.default\prefs.js, Dobré: (), Špatné: (user_pref("browser.search.selectedEngine", "mystartsearch");), ,[e8188e787516f5417d95fc8bd82ded13]
PUP.Optional.HttpBreaker.A, C:\Users\Bazy\AppData\Roaming\Mozilla\Firefox\Profiles\6kl0v44j.default\prefs.js, Dobré: (browser.startup.homepage", "https://www.malwarebytes.org/restorebrowser/), Špatné: (browser.startup.homepage", "http://www.mystartsearch.com/?type=hppp), ,[16ea49bd5932c373b0f11d6bc73e54ac]
PUP.Optional.MyStartSearch.ShrtCln, C:\Users\Bazy\AppData\Roaming\Mozilla\Firefox\Profiles\6kl0v44j.default\prefs.js, Dobré: (browser.startup.homepage", "https://www.malwarebytes.org/restorebrowser/), Špatné: (browser.startup.homepage", "http://www.mystartsearch.com), ,[19e7020415760d294672068207fe11ef]
PUP.Optional.RazorWeb.A, C:\Users\Bazy\AppData\Roaming\Opera Software\Opera Stable\Extensions\dbkpiceddlihfkdpfggakggacikddfjg\1.0.5628.30062_0\manifest.json, , [27d976906625ad8904e4681abf46fb05],
PUP.Optional.RazorWeb.A, C:\Users\Bazy\AppData\Roaming\Opera Software\Opera Stable\Extensions\dbkpiceddlihfkdpfggakggacikddfjg\1.0.5628.30062_0\background.js, , [27d976906625ad8904e4681abf46fb05],
PUP.Optional.RazorWeb.A, C:\Users\Bazy\AppData\Roaming\Opera Software\Opera Stable\Extensions\dbkpiceddlihfkdpfggakggacikddfjg\1.0.5628.30062_0\content.js, , [27d976906625ad8904e4681abf46fb05],
PUP.Optional.RazorWeb.A, C:\Users\Bazy\AppData\Roaming\Opera Software\Opera Stable\Extensions\dbkpiceddlihfkdpfggakggacikddfjg\1.0.5628.30062_0\icon.png, , [27d976906625ad8904e4681abf46fb05],

Fyzické sektory: 0
(Nenalezeny žádné škodlivé položky)


(end)

Re: Vzdálné nabourání PC ?

Napsal: 07 srp 2015 19:14
od jaro3
Spusť znovu AdwCleaner (u Windows Vista či Windows7, klikni na AdwCleaner pravým a vyber „Spustit jako správce“
klikni na „Prohledat-Scan“, po prohledání klikni na „ Vymazat-Clean“

Program provede opravu, po automatickém restartu neukáže log (C:\AdwCleaner [S?].txt) , jeho obsah sem celý vlož.

Stáhni si Junkware Removal Tool by Thisisu

na svojí plochu.

Deaktivuj si svůj antivirový program. Pravým tl. myši klikni na JRT.exe a vyber „spustit jako správce“. Pro pokračování budeš vyzván ke stisknutí jakékoliv klávesy. Na nějakou klikni.
Začne skenování programu. Skenování může trvat dloho , podle množství nákaz. Po ukončení skenu se objeví log (JRT.txt) , který se uloží na ploše.
Zkopíruj sem prosím celý jeho obsah.

. spusť znovu MbAM a dej Skenovat nyní
- po proběhnutí programu se ti objeví hláška tak klikni na „Vše do karantény(smazat vybrané)“ a na „Exportovat záznam“ a vyber „textový soubor“ , soubor nějak pojmenuj a někam ho ulož. Zkopíruj se celý obsah toho logu.

Stáhni si RogueKiller by Adlice Software
32bit.:
http://www.sur-la-toile.com/RogueKiller/RogueKiller.exe
64bit.:
http://www.sur-la-toile.com/RogueKiller ... lerX64.exe
na svojí plochu.
- Zavři všechny ostatní programy a prohlížeče.
- Pro OS Vista a win7 spusť program RogueKiller.exe jako správce , u XP poklepáním.
- počkej až skončí Prescan -vyhledávání škodlivých procesů.
-Potom klikni na „Prohledat“.
- Program skenuje procesy PC. Po proskenování klikni na „Zpráva“celý obsah logu sem zkopíruj.
Pokud je program blokován , zkus ho spustit několikrát. Pokud dále program nepůjde spustit a pracovat, přejmenuj ho na winlogon.exe.
Časové pásmo: UTC+02:00
Stránka 1 z 1
Powered by phpBB® Forum Software © phpBB Limited
https://www.phpbb.com/