Prosím o kontrolu logu

staclu · Příspěvekod **staclu** » 31 říj 2015 13:41

Důvod: viewtopic.php?p=1291002

Logfile of Trend Micro HijackThis v2.0.5
Scan saved at 13:37:31, on 31.10.2015
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v11.0 (11.00.9600.17840)

FIREFOX: 26.0 (en-US)
Boot mode: Normal

Running processes:
E:\Fraps\fraps.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
E:\Program Files (x86)\IObit\Advanced SystemCare 8\ASCTray.exe
E:\Program Files\AVAST Software\Avast\avastui.exe
C:\Users\Lukáš\AppData\Roaming\Dropbox\bin\Dropbox.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Users\Lukáš\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.bing.com/search?q={searchTerms}&FORM=AVASDF&PC=AV01
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 77.81.105.7:8089
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F2 - REG:system.ini: UserInit=userinit.exe,
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - (no file)
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre1.8.0_45\bin\ssv.dll
O2 - BHO: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - E:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
O2 - BHO: URLRedirectionBHO - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - (no file)
O2 - BHO: Advanced SystemCare Surfing Protection - {BA0C978D-D909-49B6-AFE2-8BDE245DC7E6} - C:\PROGRA~2\IObit\SURFIN~1\BROWER~1\ASCPLU~1.DLL
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre1.8.0_45\bin\jp2ssv.dll
O4 - HKLM\..\Run: [AvastUI.exe] "E:\Program Files\AVAST Software\Avast\AvastUI.exe" /nogui
O4 - HKLM\..\Run: [StartCCC] "E:\Program Files\AMD\ATI.ACE\Core-Static\amd64\CLIStart.exe" MSRun
O4 - HKLM\..\RunOnce: [InstallShieldSetup] C:\PROGRA~2\INSTAL~1\{9D15E~1\setup.exe -rebootC:\PROGRA~2\INSTAL~1\{9D15E~1\reboot.ini
O4 - HKLM\..\RunOnce: [InstallShieldSetup1] C:\PROGRA~2\INSTAL~1\{9D15E~1\setup.exe -rebootC:\PROGRA~2\INSTAL~1\{9D15E~1\reboot.ini
O4 - HKLM\..\RunOnce: [InstallShieldSetup2] C:\PROGRA~2\INSTAL~1\{9D15E~1\setup.exe -rebootC:\PROGRA~2\INSTAL~1\{9D15E~1\reboot.ini
O4 - HKLM\..\RunOnce: [InstallShieldSetup3] C:\PROGRA~2\INSTAL~1\{9D15E~1\setup.exe -rebootC:\PROGRA~2\INSTAL~1\{9D15E~1\reboot.ini
O4 - HKLM\..\RunOnce: [InstallShieldSetup4] C:\PROGRA~2\INSTAL~1\{9D15E~1\setup.exe -rebootC:\PROGRA~2\INSTAL~1\{9D15E~1\reboot.ini
O4 - HKCU\..\Run: [GoogleChromeAutoLaunch_032E85145F9C73D9B43D5ED2AF6BF5BD] "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --no-startup-window
O4 - HKCU\..\Run: [Advanced SystemCare 8] "E:\Program Files (x86)\IObit\Advanced SystemCare 8\ASCTray.exe" /Auto
O4 - HKCU\..\Run: [DAEMON Tools Lite] "E:\Lukáš\Programy\Program files\DAEMON Tools Lite\DTLite.exe" -autorun
O4 - HKCU\..\Run: [Dropbox Update] "C:\Users\Lukáš\AppData\Local\Dropbox\Update\DropboxUpdate.exe" /c
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O4 - Startup: Dropbox.lnk = ?
O8 - Extra context menu item: E&xport to Microsoft Excel - res://E:\PROGRA~1\MICROS~1\Office14\EXCEL.EXE/3000
O8 - Extra context menu item: Se&nd to OneNote - res://E:\PROGRA~1\MICROS~1\Office14\ONBttnIE.dll/105
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Se&nd to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll
O9 - Extra button: OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
O9 - Extra 'Tools' menuitem: OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O17 - HKLM\System\CCS\Services\Tcpip\..\{C944AB88-246C-4FF9-8C4D-AC534369EF21}: NameServer = 8.8.8.8
O17 - HKLM\System\CCS\Services\Tcpip\..\{F1D35DCC-FA8D-4E36-90BD-88EFB1F83797}: NameServer = 8.8.8.8
O18 - Filter hijack: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL
O23 - Service: ArcSoft Connect Daemon (ACDaemon) - Unknown owner - (no file)
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: Advanced SystemCare Service 8 (AdvancedSystemCareService8) - IObit - E:\Program Files (x86)\IObit\Advanced SystemCare 8\ASCService.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: AMD External Events Utility - Unknown owner - C:\Windows\system32\atiesrxx.exe (file missing)
O23 - Service: AMD FUEL Service - Advanced Micro Devices, Inc. - E:\Program Files\AMD\ATI.ACE\Fuel\Fuel.Service.exe
O23 - Service: Apple Mobile Device Service - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: Avast Antivirus (avast! Antivirus) - AVAST Software - E:\Program Files\AVAST Software\Avast\AvastSvc.exe
O23 - Service: AvastVBox COM Service (AvastVBoxSvc) - Avast Software - E:\Program Files\AVAST Software\Avast\ng\vbox\AvastVBoxSVC.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: Futuremark SystemInfo Service - Futuremark Corporation - C:\Program Files (x86)\Futuremark\Futuremark SystemInfo\FMSISvc.exe
O23 - Service: Služba Google Update (gupdate) (gupdate) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Služba Google Update (gupdatem) (gupdatem) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: @%SystemRoot%\system32\ieetwcollectorres.dll,-1000 (IEEtwCollectorService) - Unknown owner - C:\Windows\system32\IEEtwCollector.exe (file missing)
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Skype Updater (SkypeUpdate) - Skype Technologies - E:\Program Files (x86)\Skype\Updater\Updater.exe
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: TeamViewer 8 (TeamViewer8) - TeamViewer GmbH - E:\Program Files (x86)\TeamViewer\Version8\TeamViewer_Service.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)

--
End of file - 10153 bytes

Reklama

Příspěvekod **jerabina** » 31 říj 2015 16:20

Odinstaluj Advanced SystemCare 8

Stáhni si ATF Cleaner
Poklepej na ATF Cleaner.exe, klikni na select all found, poté:
-Když používáš Firefox (Mozzila), klikni na Firefox nahoře a vyber: Select All, poté klikni na Empty Selected.
-Když používáš Operu, klikni nahoře na Operu a vyber: Select All, poté klikni na Empty Selected. Poté klikni na Main (hlavní stránku ) a klikni na Empty Selected.
Po vyčištění klikni na Exit k zavření programu.
ATF-Cleaner je jednoduchý nástroj na odstranění historie z webového prohlížeče. Program dokáže odstranit cache, cookies, historii a další stopy po surfování na Internetu. Mezi podporované prohlížeče patří Internet Explorer, Firefox a Opera. Aplikace navíc umí odstranit dočasné soubory Windows, vysypat koš atd.

- Pokud používáš jen Google Chrome , tak ATF nemusíš použít.

===================================================

Stáhni si TFC
Otevři soubor a zavři všechny ostatní okna, Klikni na Start k zahájení procesu. Program by neměl trvat dlouho.
Poté by se měl PC restartovat, pokud ne , proveď sám.

===================================================

Stáhni AdwCleaner (by Xplode)

Ulož si ho na svojí plochu
Ukonči všechny programy , okna a prohlížeče
Spusť program poklepáním a klikni na „Prohledat-Scan“
Po skenu se objeví log ( jinak je uložen systémovem disku jako AdwCleaner[R?].txt), jeho obsah sem celý vlož.

===================================================

Stáhni si Malwarebytes' Anti-Malware
- Při instalaci odeber zatržítko u „Povolit bezplatnou zkušební verzi Malwarebytes' Anti-Malware Premium“
Nainstaluj a spusť ho
- na konci instalace se ujisti že máš zvoleny/zatrhnuty obě možnosti:
Aktualizace Malwarebytes' Anti-Malware a Spustit aplikaci Malwarebytes' Anti-Malware, pokud jo tak klikni na tlačítko konec
- pokud bude nalezena aktualizace, tak se stáhne a nainstaluje
- program se po té spustí a klikni na Skenovat nyní a
- po proběhnutí programu se ti objeví hláška vpravo dole tak klikni na Kopírovat do schránky a a vlož sem celý log.

- po té klikni na tlačítko Exit, objeví se ti hláška tak zvol Ano
(zatím nic nemaž!).

Pokud budou problémy , spusť v nouz. režimu.

staclu · Příspěvekod **staclu** » 31 říj 2015 19:34

# AdwCleaner v5.015 - Logfile created 31/10/2015 at 18:43:53
# Updated 26/10/2015 by Xplode
# Database : 2015-10-29.1 [Server]
# Operating system : Windows 7 Ultimate Service Pack 1 (x64)
# Username : Lukáš - PC-DOLE
# Running from : C:\Users\Lukáš\Desktop\adwcleaner_5.015.exe
# Option : Scan
# Support : http://toolslib.net/forum

***** [ Services ] *****

***** [ Folders ] *****

Folder Found : C:\Program Files (x86)\GetPrivate
Folder Found : C:\Program Files (x86)\SimilarSites
Folder Found : C:\ProgramData\apn
Folder Found : C:\ProgramData\ytd video downloader
Folder Found : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ytd video downloader
Folder Found : C:\Users\Lukáš\AppData\Local\Google\Chrome\User Data\Default\Extensions\omioeahgfecgfpfldejlnideemfidnkc
Folder Found : C:\Users\Lukáš\AppData\Roaming\SimilarSites
Folder Found : C:\Users\Lukáš\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\GetPrivate

***** [ Files ] *****

File Found : C:\Users\Lukáš\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_www.savemygame.fr_0.localstorage-journal
File Found : C:\Users\Lukáš\AppData\Roaming\Mozilla\Firefox\Profiles\fsym9r3c.default\user.js
File Found : C:\Users\Public\Desktop\YTD Video Downloader.lnk

***** [ DLLs ] *****

***** [ Shortcuts ] *****

***** [ Scheduled tasks ] *****

***** [ Registry ] *****

Key Found : HKCU\Software\5ffdd8ab03fbe41
Key Found : HKLM\SOFTWARE\Classes\CLSID\{BA0C978D-D909-49B6-AFE2-8BDE245DC7E6}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{363F46BE-27B4-4C8D-99E7-B1E049B84376}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{3CCC052E-BDEE-408A-BEA7-90914EF2964B}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{61F47056-E400-43D3-AF1E-AB7DFFD4C4AD}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{90A9B7D2-3794-45EA-9E23-140E3938D2D9}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{A753A1EC-973E-4718-AF8E-A3F554D45C44}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{E2B98EEA-EE55-4E9B-A8C1-6E5288DF785A}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{02AFA80F-4BEE-41FD-8572-214B58A9EF90}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{BA0C978D-D909-49B6-AFE2-8BDE245DC7E6}
Key Found : HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{BA0C978D-D909-49B6-AFE2-8BDE245DC7E6}
Key Found : HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{BA0C978D-D909-49B6-AFE2-8BDE245DC7E6}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{BA0C978D-D909-49B6-AFE2-8BDE245DC7E6}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{10921475-03CE-4E04-90CE-E2E7EF20C814}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{BA0C978D-D909-49B6-AFE2-8BDE245DC7E6}
Value Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID [{FE69C007-C452-4D3E-86D2-1730DF8BC871}]
Key Found : [x64] HKLM\SOFTWARE\Classes\CLSID\{10921475-03CE-4E04-90CE-E2E7EF20C814}
Key Found : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{10921475-03CE-4E04-90CE-E2E7EF20C814}
Key Found : HKCU\Software\RocketTabInstalled
Key Found : HKCU\Software\Search Extensions
Key Found : HKCU\Software\GetPrivate
Key Found : HKCU\Software\rttasks
Key Found : HKCU\Software\SlimWare Utilities Inc
Key Found : HKLM\SOFTWARE\DataMngr
Key Found : HKLM\SOFTWARE\GetPrivate
Key Found : HKLM\SOFTWARE\SlimWare Utilities Inc
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\bi_uninstaller
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\GetPrivate
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1a413f37-ed88-4fec-9666-5c48dc4b7bb7}
Key Found : [x64] HKCU\Software\RocketTabInstalled
Key Found : [x64] HKCU\Software\Search Extensions
Key Found : [x64] HKCU\Software\GetPrivate
Key Found : [x64] HKCU\Software\rttasks
Key Found : [x64] HKCU\Software\SlimWare Utilities Inc

***** [ Web browsers ] *****

[C:\Users\Lukáš\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences] [Startup_URLs] Found : hxxp://blekko.com/ws/?source=5f97ddbe&t ... 242126461d
[C:\Users\Lukáš\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences] [Extension] Found : cpngackimfmofbokmjmljamhdncknpmg
[C:\Users\Lukáš\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences] [Extension] Found : omioeahgfecgfpfldejlnideemfidnkc

########## EOF - C:\AdwCleaner\AdwCleaner[S1].txt - [4452 bytes] ##########

staclu · Příspěvekod **staclu** » 31 říj 2015 19:34

Malwarebytes Anti-Malware
www.malwarebytes.org

Datum skenování: 31.10.2015
Čas skenování: 18:47
Protokol: malware log.txt
Správce: Ano

Verze: 2.2.0.1024
Databáze malwaru: v2015.10.31.04
Databáze rootkitů: v2015.10.28.01
Licence: Bezplatná verze
Ochrana proti malwaru: Vypnuto
Ochrana proti škodlivým webovým stránkám: Vypnuto
Ochrana programu: Vypnuto

OS: Windows 7 Service Pack 1
CPU: x64
Souborový systém: NTFS
Uživatel: *****

Typ skenu: Sken hrozeb
Výsledek: Dokončeno
Prohledaných objektů: 450274
Uplynulý čas: 31 min, 28 sek

Paměť: Zapnuto
Po spuštění: Zapnuto
Souborový systém: Zapnuto
Archivy: Zapnuto
Rootkity: Vypnuto
Heuristika: Zapnuto
PUP: Zapnuto
PUM: Zapnuto

Procesy: 0
(Nenalezeny žádné škodlivé položky)

Moduly: 0
(Nenalezeny žádné škodlivé položky)

Klíče registru: 5
PUP.Optional.GetPrivate, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\GetPrivate, , [0a76dc811d6e56e0c00780e4fb089f61],
PUP.Optional.DataMngr, HKLM\SOFTWARE\WOW6432NODE\DataMngr, , [38481c416a217eb80a048b0949bac23e],
PUP.Optional.GetPrivate, HKLM\SOFTWARE\WOW6432NODE\GETPRIVATE, , [4e329ebfe8a30e28a02ab5af0df6f50b],
PUP.Optional.RocketTab.PrxySvrRST, HKU\S-1-5-21-3589600250-368458386-2505973026-1001\SOFTWARE\RocketTabInstalled, , [324e7ae3a4e79d99b75a642006fc3bc5],
PUP.Optional.RocketTab.PrxySvrRST, HKU\S-1-5-21-3589600250-368458386-2505973026-1001\SOFTWARE\SEARCH EXTENSIONS, , [fb8563faf19ab18567bb6ad5a261bb45],

Hodnoty registru: 2
PUP.Optional.GetPrivate, HKLM\SOFTWARE\WOW6432NODE\GETPRIVATE|Path, C:\Program Files (x86)\GetPrivate, , [4e329ebfe8a30e28a02ab5af0df6f50b]
PUP.Optional.RocketTab.PrxySvrRST, HKU\S-1-5-21-3589600250-368458386-2505973026-1001\SOFTWARE\SEARCH EXTENSIONS|RocketTab, 1, , [fb8563faf19ab18567bb6ad5a261bb45]

Data registru: 1
PUM.Optional.DisabledSecurityCenter, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\SECURITY CENTER|AntiVirusDisableNotify, 1, Dobré: (0), Špatné: (1),,[225ebba2dbb0e84ed0c956e843c1fe02]

Složky: 3
PUP.Optional.GetPrivate, C:\Program Files (x86)\GetPrivate, , [0a76dc811d6e56e0c00780e4fb089f61],
PUP.Optional.APNToolBar.Gen, C:\ProgramData\APN\APN-Stub, , [1b65bba2672482b4f9d294b252b033cd],
PUP.Optional.SimilarSites, C:\Users\Lukáš\AppData\Roaming\SimilarSites, , [7f01a7b6eaa165d127803a2f34cec838],

Soubory: 7
PUP.Optional.Spigot, C:\ProgramData\YTD Video Downloader\ytd_installer.exe, , [d0b072ebfb9037ffd1379d1bac5402fe],
PUP.Optional.BitCoinMiner, C:\Windows\SysWOW64\acumncxuxkg.exe, , [3f4189d47a11b87e071a7570e51cca36],
Trojan.Agent.BCM, C:\Windows\SysWOW64\lcpmncxuxkg.exe, , [a2de67f68efd51e5c31ef1ac55abc53b],
Trojan.BitCoinMiner, C:\Windows\SysWOW64\dcgmncxuxkg.exe, , [4c349fbea0ebbe782d1604e13dc45da3],
PUP.Optional.GetPrivate, C:\Program Files (x86)\GetPrivate\VPN.dll, , [0a76dc811d6e56e0c00780e4fb089f61],
PUP.Optional.GetPrivate, C:\Program Files (x86)\GetPrivate\GetPrivate.exe, , [0a76dc811d6e56e0c00780e4fb089f61],
PUP.Optional.GetPrivate, C:\Program Files (x86)\GetPrivate\uninstall.exe, , [0a76dc811d6e56e0c00780e4fb089f61],

Fyzické sektory: 0
(Nenalezeny žádné škodlivé položky)

(end)

Příspěvekod **jerabina** » 31 říj 2015 20:32

Spusť znovu AdwCleaner (u Windows Vista či Windows7, klikni na AdwCleaner pravým a vyber „Spustit jako správce“
klikni na „Prohledat-Scan“, po prohledání klikni na „ Vymazat-Clean“

Program provede opravu, po automatickém restartu neukáže log (C:\AdwCleaner [C?].txt) , jeho obsah sem celý vlož.

Spusť znovu MbAM a dej Skenovat nyní
- po proběhnutí programu se ti objeví hláška tak klikni na „Vše do karantény(smazat vybrané)“ a na „Exportovat záznam“ a vyber „textový soubor“ , soubor nějak pojmenuj a někam ho ulož. Zkopíruj se celý obsah toho logu.

Stáhni si Junkware Removal Tool by Thisisu

na svojí plochu.

Deaktivuj si svůj antivirový program. Pravým tl. myši klikni na JRT.exe a vyber „spustit jako správce“. Pro pokračování budeš vyzván ke stisknutí jakékoliv klávesy. Na nějakou klikni.
Začne skenování programu. Skenování může trvat dloho , podle množství nákaz. Po ukončení skenu se objeví log (JRT.txt) , který se uloží na ploše.
Zkopíruj sem prosím celý jeho obsah.

Stáhni si RogueKiller
32bit.:
http://www.sur-la-toile.com/RogueKiller/RogueKiller.exe
64bit.:
http://www.sur-la-toile.com/RogueKiller ... lerX64.exe
na svojí plochu.
- Zavři všechny ostatní programy a prohlížeče.
- Pro OS Vista a win7 spusť program RogueKiller.exe jako správce , u XP poklepáním.
- počkej až skončí Prescan -vyhledávání škodlivých procesů.
-Potom klikni na „Prohledat“.
- Program skenuje procesy PC. Po proskenování klikni na „Zpráva“celý obsah logu sem zkopíruj.
Pokud je program blokován , zkus ho spustit několikrát. Pokud dále program nepůjde spustit a pracovat, přejmenuj ho na winlogon.exe.

staclu · Příspěvekod **staclu** » 01 lis 2015 13:30

# AdwCleaner v5.015 - Logfile created 01/11/2015 at 11:38:47
# Updated 26/10/2015 by Xplode
# Database : 2015-10-29.1 [Server]
# Operating system : Windows 7 Ultimate Service Pack 1 (x64)
# Username : Lukáš - PC-DOLE
# Running from : C:\Users\Lukáš\Desktop\adwcleaner_5.015.exe
# Option : Cleaning
# Support : http://toolslib.net/forum

***** [ Services ] *****

***** [ Folders ] *****

[-] Folder Deleted : C:\Program Files (x86)\GetPrivate
[-] Folder Deleted : C:\Program Files (x86)\SimilarSites
[-] Folder Deleted : C:\ProgramData\apn
[-] Folder Deleted : C:\ProgramData\ytd video downloader
[-] Folder Deleted : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ytd video downloader
[-] Folder Deleted : C:\Users\Lukáš\AppData\Local\Google\Chrome\User Data\Default\Extensions\omioeahgfecgfpfldejlnideemfidnkc
[-] Folder Deleted : C:\Users\Lukáš\AppData\Roaming\SimilarSites
[-] Folder Deleted : C:\Users\Lukáš\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\GetPrivate

***** [ Files ] *****

[-] File Deleted : C:\Users\Lukáš\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_www.savemygame.fr_0.localstorage-journal
[-] File Deleted : C:\Users\Lukáš\AppData\Roaming\Mozilla\Firefox\Profiles\fsym9r3c.default\user.js
[-] File Deleted : C:\Users\Public\Desktop\YTD Video Downloader.lnk

***** [ DLLs ] *****

***** [ Shortcuts ] *****

***** [ Scheduled tasks ] *****

***** [ Registry ] *****

[-] Key Deleted : HKCU\Software\5ffdd8ab03fbe41
[-] Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{BA0C978D-D909-49B6-AFE2-8BDE245DC7E6}
[-] Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{363F46BE-27B4-4C8D-99E7-B1E049B84376}
[-] Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{3CCC052E-BDEE-408A-BEA7-90914EF2964B}
[-] Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{61F47056-E400-43D3-AF1E-AB7DFFD4C4AD}
[-] Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{90A9B7D2-3794-45EA-9E23-140E3938D2D9}
[-] Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{A753A1EC-973E-4718-AF8E-A3F554D45C44}
[-] Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{E2B98EEA-EE55-4E9B-A8C1-6E5288DF785A}
[-] Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{02AFA80F-4BEE-41FD-8572-214B58A9EF90}
[-] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{BA0C978D-D909-49B6-AFE2-8BDE245DC7E6}
[-] Key Deleted : HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{BA0C978D-D909-49B6-AFE2-8BDE245DC7E6}
[-] Key Deleted : HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{BA0C978D-D909-49B6-AFE2-8BDE245DC7E6}
[-] Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{BA0C978D-D909-49B6-AFE2-8BDE245DC7E6}
[-] Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{10921475-03CE-4E04-90CE-E2E7EF20C814}
[-] Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{BA0C978D-D909-49B6-AFE2-8BDE245DC7E6}
[-] Value Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID [{FE69C007-C452-4D3E-86D2-1730DF8BC871}]
[-] Key Deleted : [x64] HKLM\SOFTWARE\Classes\CLSID\{10921475-03CE-4E04-90CE-E2E7EF20C814}
[-] Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{10921475-03CE-4E04-90CE-E2E7EF20C814}
[-] Key Deleted : HKCU\Software\RocketTabInstalled
[-] Key Deleted : HKCU\Software\Search Extensions
[-] Key Deleted : HKCU\Software\GetPrivate
[-] Key Deleted : HKCU\Software\rttasks
[-] Key Deleted : HKCU\Software\SlimWare Utilities Inc
[-] Key Deleted : HKLM\SOFTWARE\DataMngr
[-] Key Deleted : HKLM\SOFTWARE\GetPrivate
[-] Key Deleted : HKLM\SOFTWARE\SlimWare Utilities Inc
[-] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\bi_uninstaller
[-] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\GetPrivate
[-] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1a413f37-ed88-4fec-9666-5c48dc4b7bb7}
[!] Key Not Deleted : [x64] HKCU\Software\RocketTabInstalled
[!] Key Not Deleted : [x64] HKCU\Software\Search Extensions
[!] Key Not Deleted : [x64] HKCU\Software\GetPrivate
[!] Key Not Deleted : [x64] HKCU\Software\rttasks
[!] Key Not Deleted : [x64] HKCU\Software\SlimWare Utilities Inc

***** [ Web browsers ] *****

[-] [C:\Users\Lukáš\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences] [Startup_URLs] Deleted : hxxp://blekko.com/ws/?source=5f97ddbe&t ... 242126461d
[-] [C:\Users\Lukáš\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences] [Extension] Deleted : cpngackimfmofbokmjmljamhdncknpmg
[-] [C:\Users\Lukáš\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences] [Extension] Deleted : omioeahgfecgfpfldejlnideemfidnkc

*************************

:: Winsock settings cleared

########## EOF - C:\AdwCleaner\AdwCleaner[C1].txt - [4824 bytes] ##########

------------------------------------------------------------------------------------------------------------------------------------------------

Malwarebytes Anti-Malware
www.malwarebytes.org

Datum skenování: 1.11.2015
Čas skenování: 11:48
Protokol: malware log2.txt
Správce: Ano

Verze: 2.2.0.1024
Databáze malwaru: v2015.11.01.02
Databáze rootkitů: v2015.10.28.01
Licence: Bezplatná verze
Ochrana proti malwaru: Vypnuto
Ochrana proti škodlivým webovým stránkám: Vypnuto
Ochrana programu: Vypnuto

OS: Windows 7 Service Pack 1
CPU: x64
Souborový systém: NTFS
Uživatel: Lukáš

Typ skenu: Sken hrozeb
Výsledek: Dokončeno
Prohledaných objektů: 450941
Uplynulý čas: 32 min, 48 sek

Paměť: Zapnuto
Po spuštění: Zapnuto
Souborový systém: Zapnuto
Archivy: Zapnuto
Rootkity: Vypnuto
Heuristika: Zapnuto
PUP: Zapnuto
PUM: Zapnuto

Procesy: 0
(Nenalezeny žádné škodlivé položky)

Moduly: 0
(Nenalezeny žádné škodlivé položky)

Klíče registru: 0
(Nenalezeny žádné škodlivé položky)

Hodnoty registru: 0
(Nenalezeny žádné škodlivé položky)

Data registru: 1
PUM.Optional.DisabledSecurityCenter, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\SECURITY CENTER|AntiVirusDisableNotify, 1, Dobré: (0), Špatné: (1),Nahrazeno,[c313adcb0289f24490acad9247bd3ec2]

Složky: 0
(Nenalezeny žádné škodlivé položky)

Soubory: 3
PUP.Optional.BitCoinMiner, C:\Windows\SysWOW64\acumncxuxkg.exe, Do karantény, [c1153642c1cafa3c88f1d510926f7b85],
Trojan.Agent.BCM, C:\Windows\SysWOW64\lcpmncxuxkg.exe, Do karantény, [7f57fd7b503b59ddf011623c0ef2e818],
Trojan.BitCoinMiner, C:\Windows\SysWOW64\dcgmncxuxkg.exe, Do karantény, [12c4393fe8a390a6eab19e471be6f60a],

Fyzické sektory: 0
(Nenalezeny žádné škodlivé položky)

(end)

staclu · Příspěvekod **staclu** » 01 lis 2015 13:34

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Malwarebytes
Version: 7.6.4 (09.28.2015:1)
OS: Windows 7 Ultimate x64
Ran by Luk ç on ne 01.11.2015 at 12:33:25,30
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

~~~ Services

~~~ Tasks

Successfully deleted: [Task] C:\Windows\system32\tasks\Uninstaller_SkipUac_Administrator
Successfully deleted: [Task] C:\Windows\system32\tasks\Uninstaller_SkipUac_GTA_V
Successfully deleted: [Task] C:\Windows\system32\tasks\Uninstaller_SkipUac_Luk ç

~~~ Registry Values

Successfully deleted: [Registry Value] HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\GoogleChromeAutoLaunch_032E85145F9C73D9B43D5ED2AF6BF5BD

~~~ Registry Keys

Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{FFEBBF0A-C22C-4172-89FF-45215A135AC7}
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Policies\Google

~~~ Files

Successfully deleted: [File] C:\Users\Luk ç\Appdata\Local\google\chrome\user data\default\local storage\hxxp_www.savemygame.fr_0.localstorage

~~~ Folders

Successfully deleted: [Folder] C:\Program Files (x86)\iobit\driver booster
Successfully deleted: [Folder] C:\ProgramData\iobit\driver booster
Successfully deleted: [Folder] C:\ProgramData\Microsoft\Windows\Start Menu\Programs\driver booster 2
Successfully deleted: [Folder] C:\ProgramData\productdata
Successfully deleted: [Folder] C:\Users\Luk ç\AppData\Roaming\iobit\driver booster
Successfully deleted: [Folder] C:\Users\Luk ç\AppData\Roaming\productdata
Successfully deleted: [Folder] C:\users\Public\Documents\downloaded installers
Successfully deleted: [Folder] C:\Windows\SysWOW64\ai_recyclebin

~~~ Chrome

[C:\Users\Luk ç\Appdata\Local\Google\Chrome\User Data\Default\Preferences] - default search provider reset

[C:\Users\Luk ç\Appdata\Local\Google\Chrome\User Data\Default\Preferences] - Extensions Deleted:

[C:\Users\Luk ç\Appdata\Local\Google\Chrome\User Data\Default\Secure Preferences] - default search provider reset

[C:\Users\Luk ç\Appdata\Local\Google\Chrome\User Data\Default\Secure Preferences] - Extensions Deleted:
[]

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on ne 01.11.2015 at 12:37:22,04
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

---------------------------------------------------------------------------------------------------------------------------------------------

RogueKiller V10.11.3.0 (x64) [Oct 26 2015] (Free) by Adlice Software
mail : http://www.adlice.com/contact/
Feedback : http://forum.adlice.com
Webová stránka : http://www.adlice.com/software/roguekiller/
Blog : http://www.adlice.com

Operační systém : Windows 7 (6.1.7601 Service Pack 1) 64 bits version
Spuštěno : Normální režim
Uživatel : Luká? [Práva správce]
Started from : C:\Users\Luká?\Desktop\RogueKillerX64.exe
Mód : Prohledat -- Datum : 11/01/2015 13:24:20

¤¤¤ Procesy : 0 ¤¤¤

¤¤¤ Registry : 104 ¤¤¤
[PUP] (X64) HKEY_LOCAL_MACHINE\RK_Software_ON_D_B618\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{00A6FAF1-072E-44cf-8957-5838F569A31D} -> Nalezeno
[PUP] (X64) HKEY_LOCAL_MACHINE\RK_Software_ON_D_B618\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{07B18EA1-A523-4961-B6BB-170DE4475CCA} -> Nalezeno
[PUP] (X64) HKEY_LOCAL_MACHINE\RK_Software_ON_D_B618\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{10921475-03CE-4E04-90CE-E2E7EF20C814} -> Nalezeno
[PUP] (X64) HKEY_LOCAL_MACHINE\RK_Software_ON_D_B618\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2EECD738-5844-4a99-B4B6-146BF802613B} -> Nalezeno
[PUP] (X64) HKEY_LOCAL_MACHINE\RK_Software_ON_D_B618\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{75EBB0AA-4214-4CB4-90EC-E3E07ECD04F7} -> Nalezeno
[PUP] (X64) HKEY_LOCAL_MACHINE\RK_Software_ON_D_B618\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{95289393-33EA-4F8D-B952-483415B9C955} -> Nalezeno
[PUP] (X64) HKEY_LOCAL_MACHINE\RK_Software_ON_D_B618\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AD4DF010-E2FD-43CE-864A-6BD1EDC59AC2} -> Nalezeno
[PUP] (X64) HKEY_LOCAL_MACHINE\RK_Software_ON_D_B618\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{BA0C978D-D909-49B6-AFE2-8BDE245DC7E6} -> Nalezeno
[PUP] (X64) HKEY_LOCAL_MACHINE\RK_Software_ON_D_B618\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{BAE35237-8D73-44D0-905C-8A95EA1E7E69} -> Nalezeno
[PUP] (X64) HKEY_LOCAL_MACHINE\RK_Software_ON_D_B618\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{CA4520F3-AE13-4FB1-A513-58E23991C86D} -> Nalezeno
[PUP] (X86) HKEY_LOCAL_MACHINE\RK_Software_ON_D_B618\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{00A6FAF1-072E-44cf-8957-5838F569A31D} -> Nalezeno
[PUP] (X86) HKEY_LOCAL_MACHINE\RK_Software_ON_D_B618\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{07B18EA1-A523-4961-B6BB-170DE4475CCA} -> Nalezeno
[PUP] (X86) HKEY_LOCAL_MACHINE\RK_Software_ON_D_B618\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{10921475-03CE-4E04-90CE-E2E7EF20C814} -> Nalezeno
[PUP] (X86) HKEY_LOCAL_MACHINE\RK_Software_ON_D_B618\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2EECD738-5844-4a99-B4B6-146BF802613B} -> Nalezeno
[PUP] (X86) HKEY_LOCAL_MACHINE\RK_Software_ON_D_B618\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{75EBB0AA-4214-4CB4-90EC-E3E07ECD04F7} -> Nalezeno
[PUP] (X86) HKEY_LOCAL_MACHINE\RK_Software_ON_D_B618\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{95289393-33EA-4F8D-B952-483415B9C955} -> Nalezeno
[PUP] (X86) HKEY_LOCAL_MACHINE\RK_Software_ON_D_B618\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AD4DF010-E2FD-43CE-864A-6BD1EDC59AC2} -> Nalezeno
[PUP] (X86) HKEY_LOCAL_MACHINE\RK_Software_ON_D_B618\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{BA0C978D-D909-49B6-AFE2-8BDE245DC7E6} -> Nalezeno
[PUP] (X86) HKEY_LOCAL_MACHINE\RK_Software_ON_D_B618\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{BAE35237-8D73-44D0-905C-8A95EA1E7E69} -> Nalezeno
[PUP] (X86) HKEY_LOCAL_MACHINE\RK_Software_ON_D_B618\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{CA4520F3-AE13-4FB1-A513-58E23991C86D} -> Nalezeno
[PUP] (X64) HKEY_LOCAL_MACHINE\RK_Software_ON_D_B618\Microsoft\Internet Explorer\Toolbar | {07B18EA9-A523-4961-B6BB-170DE4475CCA} : -> Nalezeno
[PUP] (X64) HKEY_LOCAL_MACHINE\RK_Software_ON_D_B618\Microsoft\Internet Explorer\Toolbar | {EECF410C-006C-4A05-AD13-6741A0814DBF} : Blekko Search Bar Toolbar -> Nalezeno
[PUP] (X64) HKEY_LOCAL_MACHINE\RK_Software_ON_D_B618\Microsoft\Internet Explorer\Toolbar | {10921475-03CE-4E04-90CE-E2E7EF20C814} : -> Nalezeno
[PUP] (X86) HKEY_LOCAL_MACHINE\RK_Software_ON_D_B618\Microsoft\Internet Explorer\Toolbar | {07B18EA9-A523-4961-B6BB-170DE4475CCA} : -> Nalezeno
[PUP] (X86) HKEY_LOCAL_MACHINE\RK_Software_ON_D_B618\Microsoft\Internet Explorer\Toolbar | {EECF410C-006C-4A05-AD13-6741A0814DBF} : Blekko Search Bar Toolbar -> Nalezeno
[PUP] (X86) HKEY_LOCAL_MACHINE\RK_Software_ON_D_B618\Microsoft\Internet Explorer\Toolbar | {10921475-03CE-4E04-90CE-E2E7EF20C814} : -> Nalezeno
[PUP] (X64) HKEY_USERS\RK_Luká?_ON_D_8974\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser | {EEE6C35B-6118-11DC-9C72-001320C79847} : -> Nalezeno
[PUP] (X64) HKEY_USERS\RK_Luká?_ON_D_8974\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser | {07B18EA9-A523-4961-B6BB-170DE4475CCA} : -> Nalezeno
[PUP] (X64) HKEY_USERS\RK_Luká?_ON_D_8974\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser | {D4027C7F-154A-4066-A1AD-4243D8127440} : -> Nalezeno
[PUP] (X64) HKEY_USERS\RK_Luká?_ON_D_8974\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser | {CE10BF86-DA68-441E-91FA-38336363E3CD} : -> Nalezeno
[PUP] (X64) HKEY_USERS\RK_Luká?_ON_D_8974\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser | {E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} : -> Nalezeno
[PUP] (X86) HKEY_USERS\RK_Luká?_ON_D_8974\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser | {EEE6C35B-6118-11DC-9C72-001320C79847} : -> Nalezeno
[PUP] (X86) HKEY_USERS\RK_Luká?_ON_D_8974\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser | {07B18EA9-A523-4961-B6BB-170DE4475CCA} : -> Nalezeno
[PUP] (X86) HKEY_USERS\RK_Luká?_ON_D_8974\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser | {D4027C7F-154A-4066-A1AD-4243D8127440} : -> Nalezeno
[PUP] (X86) HKEY_USERS\RK_Luká?_ON_D_8974\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser | {CE10BF86-DA68-441E-91FA-38336363E3CD} : -> Nalezeno
[PUP] (X86) HKEY_USERS\RK_Luká?_ON_D_8974\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser | {E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} : -> Nalezeno
[PUP] (X64) HKEY_USERS\RK_uzivatel_ON_D_F4F1\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser | {D4027C7F-154A-4066-A1AD-4243D8127440} : -> Nalezeno
[PUP] (X64) HKEY_USERS\RK_uzivatel_ON_D_F4F1\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser | {EEE6C35B-6118-11DC-9C72-001320C79847} : -> Nalezeno
[PUP] (X64) HKEY_USERS\RK_uzivatel_ON_D_F4F1\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser | {07B18EA9-A523-4961-B6BB-170DE4475CCA} : -> Nalezeno
[PUP] (X64) HKEY_USERS\RK_uzivatel_ON_D_F4F1\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser | {E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} : -> Nalezeno
[PUP] (X86) HKEY_USERS\RK_uzivatel_ON_D_F4F1\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser | {D4027C7F-154A-4066-A1AD-4243D8127440} : -> Nalezeno
[PUP] (X86) HKEY_USERS\RK_uzivatel_ON_D_F4F1\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser | {EEE6C35B-6118-11DC-9C72-001320C79847} : -> Nalezeno
[PUP] (X86) HKEY_USERS\RK_uzivatel_ON_D_F4F1\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser | {07B18EA9-A523-4961-B6BB-170DE4475CCA} : -> Nalezeno
[PUP] (X86) HKEY_USERS\RK_uzivatel_ON_D_F4F1\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser | {E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} : -> Nalezeno
[PUP] (X64) HKEY_USERS\RK_Luká?_ON_D_8974\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks | {95289393-33EA-4F8D-B952-483415B9C955} : -> Nalezeno
[PUP] (X64) HKEY_USERS\RK_Luká?_ON_D_8974\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks | {00A6FAF6-072E-44cf-8957-5838F569A31D} : -> Nalezeno
[PUP] (X64) HKEY_USERS\RK_Luká?_ON_D_8974\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks | {ce10bf86-da68-441e-91fa-38336363e3cd} : -> Nalezeno
[PUP] (X86) HKEY_USERS\RK_Luká?_ON_D_8974\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks | {95289393-33EA-4F8D-B952-483415B9C955} : -> Nalezeno
[PUP] (X86) HKEY_USERS\RK_Luká?_ON_D_8974\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks | {00A6FAF6-072E-44cf-8957-5838F569A31D} : -> Nalezeno
[PUP] (X86) HKEY_USERS\RK_Luká?_ON_D_8974\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks | {ce10bf86-da68-441e-91fa-38336363e3cd} : -> Nalezeno
[PUP] (X64) HKEY_USERS\RK_uzivatel_ON_D_F4F1\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks | {95289393-33EA-4F8D-B952-483415B9C955} : qipbar -> Nalezeno
[PUP] (X64) HKEY_USERS\RK_uzivatel_ON_D_F4F1\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks | {EEE6C35D-6118-11DC-9C72-001320C79847} : -> Nalezeno
[PUP] (X64) HKEY_USERS\RK_uzivatel_ON_D_F4F1\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks | {00A6FAF6-072E-44cf-8957-5838F569A31D} : -> Nalezeno
[PUP] (X86) HKEY_USERS\RK_uzivatel_ON_D_F4F1\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks | {95289393-33EA-4F8D-B952-483415B9C955} : qipbar -> Nalezeno
[PUP] (X86) HKEY_USERS\RK_uzivatel_ON_D_F4F1\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks | {EEE6C35D-6118-11DC-9C72-001320C79847} : -> Nalezeno
[PUP] (X86) HKEY_USERS\RK_uzivatel_ON_D_F4F1\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks | {00A6FAF6-072E-44cf-8957-5838F569A31D} : -> Nalezeno
[PUP] (X64) HKEY_LOCAL_MACHINE\RK_System_ON_D_74E4\ControlSet001\Services\MyWebSearchService (D:\PROGRA~1\MYWEBS~1\bar\1.bin\mwssvc.exe) -> Nalezeno
[PUP] (X64) HKEY_LOCAL_MACHINE\RK_System_ON_D_74E4\ControlSet002\Services\MyWebSearchService (D:\PROGRA~1\MYWEBS~1\bar\1.bin\mwssvc.exe) -> Nalezeno
[PUP] (X64) HKEY_LOCAL_MACHINE\RK_System_ON_D_74E4\ControlSet003\Services\MyWebSearchService (D:\PROGRA~1\MYWEBS~1\bar\1.bin\mwssvc.exe) -> Nalezeno
[PUM.Proxy] (X64) HKEY_USERS\S-1-5-21-3589600250-368458386-2505973026-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings | ProxyServer : 77.81.105.7:8089 -> Nalezeno
[PUM.Proxy] (X86) HKEY_USERS\S-1-5-21-3589600250-368458386-2505973026-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings | ProxyServer : 77.81.105.7:8089 -> Nalezeno
[PUM.HomePage] (X64) HKEY_LOCAL_MACHINE\RK_Software_ON_D_B618\Microsoft\Internet Explorer\Main | Start Page : http://home.sweetim.com/?st=1&barid={ADC780F9-C9F9-464C-9A63-4710EBF19335} -> Nalezeno
[PUM.HomePage] (X86) HKEY_LOCAL_MACHINE\RK_Software_ON_D_B618\Microsoft\Internet Explorer\Main | Start Page : http://home.sweetim.com/?st=1&barid={ADC780F9-C9F9-464C-9A63-4710EBF19335} -> Nalezeno
[PUM.HomePage] (X64) HKEY_USERS\RK_Luká?_ON_D_8974\Software\Microsoft\Internet Explorer\Main | Start Page : http://blekko.com/ws/?source=5f97ddbe&t ... 242126461d -> Nalezeno
[PUM.HomePage] (X86) HKEY_USERS\RK_Luká?_ON_D_8974\Software\Microsoft\Internet Explorer\Main | Start Page : http://blekko.com/ws/?source=5f97ddbe&t ... 242126461d -> Nalezeno
[PUM.HomePage] (X64) HKEY_USERS\RK_uzivatel_ON_D_F4F1\Software\Microsoft\Internet Explorer\Main | Start Page : http://www.seznam.cz/ -> Nalezeno
[PUM.HomePage] (X86) HKEY_USERS\RK_uzivatel_ON_D_F4F1\Software\Microsoft\Internet Explorer\Main | Start Page : http://www.seznam.cz/ -> Nalezeno
[PUM.HomePage] (X64) HKEY_USERS\RK_Luká?_ON_D_8974\Software\Microsoft\Internet Explorer\Main | Default_Page_URL : http://qip.ru -> Nalezeno
[PUM.HomePage] (X86) HKEY_USERS\RK_Luká?_ON_D_8974\Software\Microsoft\Internet Explorer\Main | Default_Page_URL : http://qip.ru -> Nalezeno
[PUM.SearchPage] (X64) HKEY_USERS\RK_Luká?_ON_D_8974\Software\Microsoft\Internet Explorer\Main | Search Page : -> Nalezeno
[PUM.SearchPage] (X86) HKEY_USERS\RK_Luká?_ON_D_8974\Software\Microsoft\Internet Explorer\Main | Search Page : -> Nalezeno
[PUM.SearchPage] (X64) HKEY_USERS\S-1-5-21-3589600250-368458386-2505973026-1001\Software\Microsoft\Internet Explorer\Main | Search Page : http://www.bing.com/search?q={searchTerms}&FORM=AVASDF&PC=AV01 -> Nalezeno
[PUM.SearchPage] (X86) HKEY_USERS\S-1-5-21-3589600250-368458386-2505973026-1001\Software\Microsoft\Internet Explorer\Main | Search Page : http://www.bing.com/search?q={searchTerms}&FORM=AVASDF&PC=AV01 -> Nalezeno
[PUM.SearchPage] (X64) HKEY_USERS\RK_Luká?_ON_D_8974\Software\Microsoft\Internet Explorer\Main | Search Bar : -> Nalezeno
[PUM.SearchPage] (X86) HKEY_USERS\RK_Luká?_ON_D_8974\Software\Microsoft\Internet Explorer\Main | Search Bar : -> Nalezeno
[PUM.SearchPage] (X64) HKEY_USERS\RK_Luká?_ON_D_8974\Software\Microsoft\Internet Explorer\Main | Default_Search_URL : http://search.qip.ru -> Nalezeno
[PUM.SearchPage] (X86) HKEY_USERS\RK_Luká?_ON_D_8974\Software\Microsoft\Internet Explorer\Main | Default_Search_URL : http://search.qip.ru -> Nalezeno
[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters | DhcpNameServer : 10.0.0.138 ([(Private Address) (XX)]) -> Nalezeno
[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\RK_System_ON_D_74E4\ControlSet001\Services\Tcpip\Parameters | DhcpNameServer : 10.0.0.138 ([(Private Address) (XX)]) -> Nalezeno
[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Tcpip\Parameters | DhcpNameServer : 10.0.0.138 ([(Private Address) (XX)]) -> Nalezeno
[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\RK_System_ON_D_74E4\ControlSet002\Services\Tcpip\Parameters | DhcpNameServer : 10.0.0.138 ([(Private Address) (XX)]) -> Nalezeno
[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\ControlSet002\Services\Tcpip\Parameters | DhcpNameServer : 10.0.0.138 ([(Private Address) (XX)]) -> Nalezeno
[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\RK_System_ON_D_74E4\ControlSet003\Services\Tcpip\Parameters | DhcpNameServer : 10.0.0.138 ([(Private Address) (XX)]) -> Nalezeno
[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\ControlSet003\Services\Tcpip\Parameters | DhcpNameServer : 10.0.0.138 ([(Private Address) (XX)]) -> Nalezeno
[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{08DB6434-6278-4CFC-AFC2-BC3053BFA8AC} | DhcpNameServer : 10.0.0.138 ([(Private Address) (XX)]) -> Nalezeno
[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\RK_System_ON_D_74E4\ControlSet001\Services\Tcpip\Parameters\Interfaces\{DB336010-9657-4894-9C88-D1CFE307F41C} | DhcpNameServer : 10.0.0.138 ([(Private Address) (XX)]) -> Nalezeno
[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Tcpip\Parameters\Interfaces\{08DB6434-6278-4CFC-AFC2-BC3053BFA8AC} | DhcpNameServer : 10.0.0.138 ([(Private Address) (XX)]) -> Nalezeno
[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\RK_System_ON_D_74E4\ControlSet002\Services\Tcpip\Parameters\Interfaces\{DB336010-9657-4894-9C88-D1CFE307F41C} | DhcpNameServer : 10.0.0.138 ([(Private Address) (XX)]) -> Nalezeno
[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\ControlSet002\Services\Tcpip\Parameters\Interfaces\{08DB6434-6278-4CFC-AFC2-BC3053BFA8AC} | DhcpNameServer : 10.0.0.138 ([(Private Address) (XX)]) -> Nalezeno
[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\RK_System_ON_D_74E4\ControlSet003\Services\Tcpip\Parameters\Interfaces\{DB336010-9657-4894-9C88-D1CFE307F41C} | DhcpNameServer : 10.0.0.138 ([(Private Address) (XX)]) -> Nalezeno
[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\ControlSet003\Services\Tcpip\Parameters\Interfaces\{08DB6434-6278-4CFC-AFC2-BC3053BFA8AC} | DhcpNameServer : 10.0.0.138 ([(Private Address) (XX)]) -> Nalezeno
[PUM.Policies] (X64) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System | ConsentPromptBehaviorAdmin : 0 -> Nalezeno
[PUM.Policies] (X86) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System | ConsentPromptBehaviorAdmin : 0 -> Nalezeno
[PUM.SecurityCenter] (X64) HKEY_LOCAL_MACHINE\RK_Software_ON_D_B618\Microsoft\Security Center | FirewallDisableNotify : 1 -> Nalezeno
[PUM.SecurityCenter] (X86) HKEY_LOCAL_MACHINE\RK_Software_ON_D_B618\Microsoft\Security Center | FirewallDisableNotify : 1 -> Nalezeno
[PUM.SecurityCenter] (X86) HKEY_LOCAL_MACHINE\Software\Microsoft\Security Center | AntiVirusDisableNotify : 0 -> Nalezeno
[PUM.StartMenu] (X64) HKEY_USERS\RK_Luká?_ON_D_8974\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced | Start_ShowPrinters : 0 -> Nalezeno
[PUM.StartMenu] (X64) HKEY_USERS\RK_Luká?_ON_D_8974\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced | Start_ShowRecentDocs : 2 -> Nalezeno
[PUM.StartMenu] (X86) HKEY_USERS\RK_Luká?_ON_D_8974\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced | Start_ShowPrinters : 0 -> Nalezeno
[PUM.StartMenu] (X86) HKEY_USERS\RK_Luká?_ON_D_8974\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced | Start_ShowRecentDocs : 2 -> Nalezeno
[PUM.StartMenu] (X64) HKEY_USERS\S-1-5-21-3589600250-368458386-2505973026-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced | Start_ShowMyGames : 0 -> Nalezeno
[PUM.StartMenu] (X64) HKEY_USERS\S-1-5-21-3589600250-368458386-2505973026-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced | Start_ShowHelp : 0 -> Nalezeno
[PUM.StartMenu] (X86) HKEY_USERS\S-1-5-21-3589600250-368458386-2505973026-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced | Start_ShowMyGames : 0 -> Nalezeno
[PUM.StartMenu] (X86) HKEY_USERS\S-1-5-21-3589600250-368458386-2505973026-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced | Start_ShowHelp : 0 -> Nalezeno

¤¤¤ Úlohy : 0 ¤¤¤

¤¤¤ Soubory : 5 ¤¤¤
[PUP][Složka] C:\ProgramData\{3C5CBD7B-3D1D-411E-96C2-513FFCA84D2D} -> Nalezeno
[PUP][Složka] C:\ProgramData\{BAF091CA-86C4-4627-ADA1-897E2621C1B0} -> Nalezeno
[PUP][Složka] C:\ProgramData\{CED89F1A-945F-46EC-B23C-5EAF6D2DB12A} -> Nalezeno
[PUP][Složka] C:\ProgramData\{D76294E6-03B8-4971-AF2E-3F846161A690} -> Nalezeno
[PUP][Složka] C:\ProgramData\{E1ED556E-3EA0-4F44-8BE7-CC5FB0F4B424} -> Nalezeno

¤¤¤ Soubor HOSTS : 3 ¤¤¤
[C:\Windows\System32\drivers\etc\hosts] 127.0.0.1 patches.rockstargames.com
[C:\Windows\System32\drivers\etc\hosts] 127.0.0.1 prod.ros.rockstargames.com
[C:\Windows\System32\drivers\etc\hosts] 127.0.0.1 activate.adobe.com

¤¤¤ Antirootkit : 30 (Driver: Nahrán) ¤¤¤
[IAT:Inl(Hook.IEAT)] (explorer.exe) ntdll!NtSetSystemInformation : Unknown @ 0x776101f0 (jmp 0x162c30|call 0xfffffffffffffda0|jmp 0x19d)
[IAT:Inl(Hook.IEAT)] (explorer.exe @ kernel32.dll) ntdll!NtWriteVirtualMemory : Unknown @ 0x776103b0 (jmp 0x164140|call 0xfffffffffffffbe0|jmp 0x19d)
[IAT:Inl(Hook.IEAT)] (explorer.exe @ kernel32.dll) ntdll!NtDuplicateObject : Unknown @ 0x77610390 (jmp 0x164100|call 0xfffffffffffffc00|jmp 0x19d)
[IAT:Inl(Hook.IEAT)] (explorer.exe @ kernel32.dll) ntdll!NtCreateEvent : Unknown @ 0x776102d0 (jmp 0x163f80|call 0xfffffffffffffcc0|jmp 0x19d)
[IAT:Inl(Hook.IEAT)] (explorer.exe @ kernel32.dll) ntdll!NtNotifyChangeKey : Unknown @ 0x77610490 (jmp 0x1636e0|call 0xfffffffffffffb00|jmp 0x19d)
[IAT:Inl(Hook.IEAT)] (explorer.exe @ kernel32.dll) ntdll!NtTerminateProcess : Unknown @ 0x776103e0 (jmp 0x164250|call 0xfffffffffffffbb0|jmp 0x19d)
[IAT:Inl(Hook.IEAT)] (explorer.exe @ kernel32.dll) ntdll!NtOpenEvent : Unknown @ 0x776102e0 (jmp 0x164010|call 0xfffffffffffffcb0|jmp 0x19d)
[IAT:Inl(Hook.IEAT)] (explorer.exe @ kernel32.dll) ntdll!NtAssignProcessToJobObject : Unknown @ 0x776103a0 (jmp 0x163c50|call 0xfffffffffffffbf0|jmp 0x19d)
[IAT:Inl(Hook.IEAT)] (explorer.exe @ kernel32.dll) ntdll!NtSetContextThread : Unknown @ 0x77610400 (jmp 0x163000|call 0xfffffffffffffb90|jmp 0x19d)
[IAT:Inl(Hook.IEAT)] (explorer.exe @ kernel32.dll) ntdll!NtCreateSection : Unknown @ 0x77610310 (jmp 0x163fa0|call 0xfffffffffffffc70|jmp 0x19d)
[IAT:Inl(Hook.IEAT)] (explorer.exe @ kernel32.dll) ntdll!NtOpenProcess : Unknown @ 0x77610370 (jmp 0x164240|call 0xfffffffffffffc10|jmp 0x19d)
[IAT:Inl(Hook.IEAT)] (explorer.exe @ kernel32.dll) ntdll!NtNotifyChangeMultipleKeys : Unknown @ 0x776104a0 (jmp 0x1636e0|call 0xfffffffffffffaf0|jmp 0x19d)
[IAT:Inl(Hook.IEAT)] (explorer.exe @ KERNELBASE.dll) ntdll!NtCreateIoCompletion : Unknown @ 0x77610350 (jmp 0x163b10|call 0xfffffffffffffc30|jmp 0x19d)
[IAT:Inl(Hook.IEAT)] (explorer.exe @ KERNELBASE.dll) ntdll!NtQueryObject : Unknown @ 0x77610450 (jmp 0x164480|call 0xfffffffffffffb40|jmp 0x19d)
[IAT:Inl(Hook.IEAT)] (explorer.exe @ KERNELBASE.dll) ntdll!NtOpenSection : Unknown @ 0x77610320 (jmp 0x1640e0|call 0xfffffffffffffc60|jmp 0x19d)
[IAT:Inl(Hook.IEAT)] (explorer.exe @ KERNELBASE.dll) ntdll!NtCreateSemaphore : Unknown @ 0x776102b0 (jmp 0x163980|call 0xfffffffffffffce0|jmp 0x19d)
[IAT:Inl(Hook.IEAT)] (explorer.exe @ KERNELBASE.dll) ntdll!NtOpenSemaphore : Unknown @ 0x776102c0 (jmp 0x163410|call 0xfffffffffffffcd0|jmp 0x19d)
[IAT:Inl(Hook.IEAT)] (explorer.exe @ KERNELBASE.dll) ntdll!NtCreateMutant : Unknown @ 0x77610290 (jmp 0x1639f0|call 0xfffffffffffffd00|jmp 0x19d)
[IAT:Inl(Hook.IEAT)] (explorer.exe @ KERNELBASE.dll) ntdll!NtOpenMutant : Unknown @ 0x776102a0 (jmp 0x163440|call 0xfffffffffffffcf0|jmp 0x19d)
[IAT:Inl(Hook.IEAT)] (explorer.exe @ KERNELBASE.dll) ntdll!NtCreateTimer : Unknown @ 0x77610330 (jmp 0x1639d0|call 0xfffffffffffffc50|jmp 0x19d)
[IAT:Inl(Hook.IEAT)] (explorer.exe @ KERNELBASE.dll) ntdll!NtOpenTimer : Unknown @ 0x77610340 (jmp 0x163450|call 0xfffffffffffffc40|jmp 0x19d)
[IAT:Inl(Hook.IEAT)] (explorer.exe @ KERNELBASE.dll) ntdll!NtCreateThreadEx : Unknown @ 0x776103d0 (jmp 0x163a80|call 0xfffffffffffffbc0|jmp 0x19d)
[IAT:Inl(Hook.IEAT)] (explorer.exe @ KERNELBASE.dll) ntdll!NtTerminateThread : Unknown @ 0x776103f0 (jmp 0x163ff0|call 0xfffffffffffffba0|jmp 0x19d)
[IAT:Inl(Hook.IEAT)] (explorer.exe @ KERNELBASE.dll) ntdll!NtOpenThread : Unknown @ 0x77610380 (jmp 0x1634a0|call 0xfffffffffffffc10|jmp 0x19d)
[IAT:Inl(Hook.IEAT)] (explorer.exe @ KERNELBASE.dll) ntdll!NtSuspendThread : Unknown @ 0x77610430 (jmp 0x162d80|call 0xfffffffffffffb60|jmp 0x19d)
[IAT:Inl(Hook.IEAT)] (explorer.exe @ rpcrt4.dll) ntdll!NtAlpcSendWaitReceivePort : Unknown @ 0x77610480 (jmp 0x163d60|call 0xfffffffffffffb10|jmp 0x19d)
[IAT:Inl(Hook.IEAT)] (explorer.exe @ rpcrt4.dll) ntdll!NtQueueApcThreadEx : Unknown @ 0x77610440 (jmp 0x163260|call 0xfffffffffffffb50|jmp 0x19d)
[IAT:Inl(Hook.IEAT)] (explorer.exe @ gdi32.dll) ntdll!NtVdmControl : Unknown @ 0x77610280 (jmp 0x162ae0|call 0xfffffffffffffd10|jmp 0x19d)
[IAT:Inl(Hook.IEAT)] (explorer.exe @ ntmarta.dll) ntdll!NtOpenEventPair : Unknown @ 0x77610300 (jmp 0x163510|call 0xfffffffffffffc90|jmp 0x19d)
[IAT:Inl(Hook.IEAT)] (explorer.exe @ ws2_32.dll) ntdll!NtLoadDriver : Unknown @ 0x776101e0 (jmp 0x163520|call 0xfffffffffffffdb0|jmp 0x19d)

¤¤¤ Webové prohlížeče : 2 ¤¤¤
[PUM.Proxy][FIREFX:Config] fsym9r3c.default : user_pref("network.proxy.http", "117.163.98.255"); -> Nalezeno
[PUM.Proxy][FIREFX:Config] fsym9r3c.default : user_pref("network.proxy.http_port", 8123); -> Nalezeno

¤¤¤ Kontrola MBR : ¤¤¤
+++++ PhysicalDrive0: +++++
--- User ---
[MBR] 4fea89a0a1e71efaa9bb82e6a2dd43ca
[BSP] 2a021c11679a2c558d62d42263b4025e : Windows Vista/7/8|VT.Unknown MBR Code
Partition table:
0 - [ACTIVE] NTFS (0x7) [VISIBLE] Offset (sectors): 63 | Size: 63530 MB [Windows Vista/7/8 Bootstrap | Windows Vista/7/8 Bootloader]
1 - [XXXXXX] EXTEN-LBA (0xf) [VISIBLE] Offset (sectors): 130126502 | Size: 50932 MB
User = LL1 ... OK
User = LL2 ... OK

+++++ PhysicalDrive1: +++++
--- User ---
[MBR] cd462af4ce9d13d583d6370e2bf0b969
[BSP] 59f50929da3b88e9e9e3c2214a59f04e : Linux|VT.Unknown MBR Code
Partition table:
0 - [ACTIVE] NTFS (0x7) [VISIBLE] Offset (sectors): 63 | Size: 66754 MB [Windows Vista/7/8 Bootstrap | Windows Vista/7/8 Bootloader]
1 - [XXXXXX] EXTEN-LBA (0xf) [VISIBLE] Offset (sectors): 136713150 | Size: 238488 MB
User = LL1 ... OK
User = LL2 ... OK

KedarCZE · Příspěvekod **KedarCZE** » 01 lis 2015 15:07

No myslím že tohle se nevyplatí GTA V + Adobe Photoshop (typuji) vs Tvůj komp.
Rada do života cokoliv kde je napsáno booster je na 99% fake a většinou to mívá opačné účinky.

Příspěvekod **Orcus** » 01 lis 2015 16:24

ČedarCZE: Jsi v HJT sekci!

AdwCleaner ještě jednou, nesmazaly se všechny položky.

Zavři všechny programy a prohlížeče. Deaktivuj antivir a firewall.
Prosím, odpoj všechny USB nebo externí disky z počítače před spuštěním tohoto programu.
Spusť RogueKiller ( Pro Windows Vista nebo Windows 7, klepni pravým a vyber "Spustit jako správce", ve Windows XP poklepej ke spuštění).
- Počkej, až Prescan dokončí práci...
- Počkej, dokud status okno zobrazuje "Prohledat "
- V záložkách (Registry , Tasks , Web Browser apod.) vše zatrhni (dej zatržítka).
- Klikni na "Smazat"
- Počkej, dokud Status box zobrazuje " Mazání dokončeno "
- Klikni na "Zpráva" a zkopíruj a vlož obsah té zprávy prosím sem. Log je možno nalézt v RKreport [číslo]. txt na ploše.
- Zavři RogueKiller

====================================================

Stáhni
Zoek.exe

a ulož si ho na plochu.
Zavři všechny ostatní programy, okna i prohlížeče.
Spusť Zoek.exe ( u win vista , win7, 8 klikni na něj pravým a vyber : „Spustit jako správce“
- pozor, náběh programu může trvat déle.

Do okna programu vlož skript níže:

Kód: Vybrat vše

autoclean;
emptyclsid;
iedefaults;
FFdefaults;
CHRdefaults;
emptyalltemp;
resethosts;

Klikni na Run Script
Program provede sken, opravu, sken i oprava může trvat i více minut, je třeba posečkat do konce. Do okna neklikej!
Program nabídne restart , potvrď .

Po restartu se může nějaký čas ukázat pouze černá plocha , to je normální. Je třeba počkat až se vytvoří log. Ten si můžeš uložit třeba do dokumentů, jinak se sám ukládá do:
C:\zoek-results.log
Zkopíruj sem celý obsah toho logu.

staclu · Příspěvekod **staclu** » 01 lis 2015 18:51

RogueKiller V10.11.3.0 (x64) [Oct 26 2015] (Free) by Adlice Software
mail : http://www.adlice.com/contact/
Feedback : http://forum.adlice.com
Webová stránka : http://www.adlice.com/software/roguekiller/
Blog : http://www.adlice.com

Operační systém : Windows 7 (6.1.7601 Service Pack 1) 64 bits version
Spuštěno : Normální režim
Uživatel : Luká? [Práva správce]
Started from : C:\Users\Luká?\Desktop\RogueKillerX64.exe
Mód : Smazat -- Datum : 11/01/2015 18:10:52

¤¤¤ Procesy : 0 ¤¤¤

¤¤¤ Registry : 104 ¤¤¤
[PUP] (X64) HKEY_LOCAL_MACHINE\RK_Software_ON_D_2492\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{00A6FAF1-072E-44cf-8957-5838F569A31D} -> Smazáno
[PUP] (X64) HKEY_LOCAL_MACHINE\RK_Software_ON_D_2492\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{07B18EA1-A523-4961-B6BB-170DE4475CCA} -> Smazáno
[PUP] (X64) HKEY_LOCAL_MACHINE\RK_Software_ON_D_2492\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{10921475-03CE-4E04-90CE-E2E7EF20C814} -> Smazáno
[PUP] (X64) HKEY_LOCAL_MACHINE\RK_Software_ON_D_2492\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2EECD738-5844-4a99-B4B6-146BF802613B} -> Smazáno
[PUP] (X64) HKEY_LOCAL_MACHINE\RK_Software_ON_D_2492\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{75EBB0AA-4214-4CB4-90EC-E3E07ECD04F7} -> Smazáno
[PUP] (X64) HKEY_LOCAL_MACHINE\RK_Software_ON_D_2492\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{95289393-33EA-4F8D-B952-483415B9C955} -> Smazáno
[PUP] (X64) HKEY_LOCAL_MACHINE\RK_Software_ON_D_2492\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AD4DF010-E2FD-43CE-864A-6BD1EDC59AC2} -> Smazáno
[PUP] (X64) HKEY_LOCAL_MACHINE\RK_Software_ON_D_2492\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{BA0C978D-D909-49B6-AFE2-8BDE245DC7E6} -> Smazáno
[PUP] (X64) HKEY_LOCAL_MACHINE\RK_Software_ON_D_2492\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{BAE35237-8D73-44D0-905C-8A95EA1E7E69} -> Smazáno
[PUP] (X64) HKEY_LOCAL_MACHINE\RK_Software_ON_D_2492\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{CA4520F3-AE13-4FB1-A513-58E23991C86D} -> Smazáno
[PUP] (X86) HKEY_LOCAL_MACHINE\RK_Software_ON_D_2492\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{00A6FAF1-072E-44cf-8957-5838F569A31D} -> Smazáno
[PUP] (X86) HKEY_LOCAL_MACHINE\RK_Software_ON_D_2492\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{07B18EA1-A523-4961-B6BB-170DE4475CCA} -> Smazáno
[PUP] (X86) HKEY_LOCAL_MACHINE\RK_Software_ON_D_2492\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{10921475-03CE-4E04-90CE-E2E7EF20C814} -> Smazáno
[PUP] (X86) HKEY_LOCAL_MACHINE\RK_Software_ON_D_2492\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2EECD738-5844-4a99-B4B6-146BF802613B} -> Smazáno
[PUP] (X86) HKEY_LOCAL_MACHINE\RK_Software_ON_D_2492\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{75EBB0AA-4214-4CB4-90EC-E3E07ECD04F7} -> Smazáno
[PUP] (X86) HKEY_LOCAL_MACHINE\RK_Software_ON_D_2492\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{95289393-33EA-4F8D-B952-483415B9C955} -> Smazáno
[PUP] (X86) HKEY_LOCAL_MACHINE\RK_Software_ON_D_2492\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AD4DF010-E2FD-43CE-864A-6BD1EDC59AC2} -> Smazáno
[PUP] (X86) HKEY_LOCAL_MACHINE\RK_Software_ON_D_2492\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{BA0C978D-D909-49B6-AFE2-8BDE245DC7E6} -> Smazáno
[PUP] (X86) HKEY_LOCAL_MACHINE\RK_Software_ON_D_2492\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{BAE35237-8D73-44D0-905C-8A95EA1E7E69} -> Smazáno
[PUP] (X86) HKEY_LOCAL_MACHINE\RK_Software_ON_D_2492\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{CA4520F3-AE13-4FB1-A513-58E23991C86D} -> Smazáno
[PUP] (X64) HKEY_LOCAL_MACHINE\RK_Software_ON_D_2492\Microsoft\Internet Explorer\Toolbar | {07B18EA9-A523-4961-B6BB-170DE4475CCA} : -> Smazáno
[PUP] (X64) HKEY_LOCAL_MACHINE\RK_Software_ON_D_2492\Microsoft\Internet Explorer\Toolbar | {EECF410C-006C-4A05-AD13-6741A0814DBF} : Blekko Search Bar Toolbar -> Smazáno
[PUP] (X64) HKEY_LOCAL_MACHINE\RK_Software_ON_D_2492\Microsoft\Internet Explorer\Toolbar | {10921475-03CE-4E04-90CE-E2E7EF20C814} : -> Smazáno
[PUP] (X86) HKEY_LOCAL_MACHINE\RK_Software_ON_D_2492\Microsoft\Internet Explorer\Toolbar | {07B18EA9-A523-4961-B6BB-170DE4475CCA} : -> ERROR [2]
[PUP] (X86) HKEY_LOCAL_MACHINE\RK_Software_ON_D_2492\Microsoft\Internet Explorer\Toolbar | {EECF410C-006C-4A05-AD13-6741A0814DBF} : Blekko Search Bar Toolbar -> ERROR [2]
[PUP] (X86) HKEY_LOCAL_MACHINE\RK_Software_ON_D_2492\Microsoft\Internet Explorer\Toolbar | {10921475-03CE-4E04-90CE-E2E7EF20C814} : -> ERROR [2]
[PUP] (X64) HKEY_USERS\RK_Luká?_ON_D_F73E\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser | {EEE6C35B-6118-11DC-9C72-001320C79847} : -> Smazáno
[PUP] (X64) HKEY_USERS\RK_Luká?_ON_D_F73E\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser | {07B18EA9-A523-4961-B6BB-170DE4475CCA} : -> Smazáno
[PUP] (X64) HKEY_USERS\RK_Luká?_ON_D_F73E\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser | {D4027C7F-154A-4066-A1AD-4243D8127440} : -> Smazáno
[PUP] (X64) HKEY_USERS\RK_Luká?_ON_D_F73E\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser | {CE10BF86-DA68-441E-91FA-38336363E3CD} : -> Smazáno
[PUP] (X64) HKEY_USERS\RK_Luká?_ON_D_F73E\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser | {E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} : -> Smazáno
[PUP] (X86) HKEY_USERS\RK_Luká?_ON_D_F73E\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser | {EEE6C35B-6118-11DC-9C72-001320C79847} : -> ERROR [2]
[PUP] (X86) HKEY_USERS\RK_Luká?_ON_D_F73E\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser | {07B18EA9-A523-4961-B6BB-170DE4475CCA} : -> ERROR [2]
[PUP] (X86) HKEY_USERS\RK_Luká?_ON_D_F73E\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser | {D4027C7F-154A-4066-A1AD-4243D8127440} : -> ERROR [2]
[PUP] (X86) HKEY_USERS\RK_Luká?_ON_D_F73E\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser | {CE10BF86-DA68-441E-91FA-38336363E3CD} : -> ERROR [2]
[PUP] (X86) HKEY_USERS\RK_Luká?_ON_D_F73E\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser | {E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} : -> ERROR [2]
[PUP] (X64) HKEY_USERS\RK_uzivatel_ON_D_FE67\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser | {D4027C7F-154A-4066-A1AD-4243D8127440} : -> Smazáno
[PUP] (X64) HKEY_USERS\RK_uzivatel_ON_D_FE67\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser | {EEE6C35B-6118-11DC-9C72-001320C79847} : -> Smazáno
[PUP] (X64) HKEY_USERS\RK_uzivatel_ON_D_FE67\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser | {07B18EA9-A523-4961-B6BB-170DE4475CCA} : -> Smazáno
[PUP] (X64) HKEY_USERS\RK_uzivatel_ON_D_FE67\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser | {E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} : -> Smazáno
[PUP] (X86) HKEY_USERS\RK_uzivatel_ON_D_FE67\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser | {D4027C7F-154A-4066-A1AD-4243D8127440} : -> ERROR [2]
[PUP] (X86) HKEY_USERS\RK_uzivatel_ON_D_FE67\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser | {EEE6C35B-6118-11DC-9C72-001320C79847} : -> ERROR [2]
[PUP] (X86) HKEY_USERS\RK_uzivatel_ON_D_FE67\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser | {07B18EA9-A523-4961-B6BB-170DE4475CCA} : -> ERROR [2]
[PUP] (X86) HKEY_USERS\RK_uzivatel_ON_D_FE67\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser | {E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} : -> ERROR [2]
[PUP] (X64) HKEY_USERS\RK_Luká?_ON_D_F73E\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks | {95289393-33EA-4F8D-B952-483415B9C955} : -> Smazáno
[PUP] (X64) HKEY_USERS\RK_Luká?_ON_D_F73E\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks | {00A6FAF6-072E-44cf-8957-5838F569A31D} : -> Smazáno
[PUP] (X64) HKEY_USERS\RK_Luká?_ON_D_F73E\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks | {ce10bf86-da68-441e-91fa-38336363e3cd} : -> Smazáno
[PUP] (X86) HKEY_USERS\RK_Luká?_ON_D_F73E\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks | {95289393-33EA-4F8D-B952-483415B9C955} : -> ERROR [2]
[PUP] (X86) HKEY_USERS\RK_Luká?_ON_D_F73E\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks | {00A6FAF6-072E-44cf-8957-5838F569A31D} : -> ERROR [2]
[PUP] (X86) HKEY_USERS\RK_Luká?_ON_D_F73E\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks | {ce10bf86-da68-441e-91fa-38336363e3cd} : -> ERROR [2]
[PUP] (X64) HKEY_USERS\RK_uzivatel_ON_D_FE67\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks | {95289393-33EA-4F8D-B952-483415B9C955} : qipbar -> Smazáno
[PUP] (X64) HKEY_USERS\RK_uzivatel_ON_D_FE67\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks | {EEE6C35D-6118-11DC-9C72-001320C79847} : -> Smazáno
[PUP] (X64) HKEY_USERS\RK_uzivatel_ON_D_FE67\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks | {00A6FAF6-072E-44cf-8957-5838F569A31D} : -> Smazáno
[PUP] (X86) HKEY_USERS\RK_uzivatel_ON_D_FE67\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks | {95289393-33EA-4F8D-B952-483415B9C955} : qipbar -> ERROR [2]
[PUP] (X86) HKEY_USERS\RK_uzivatel_ON_D_FE67\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks | {EEE6C35D-6118-11DC-9C72-001320C79847} : -> ERROR [2]
[PUP] (X86) HKEY_USERS\RK_uzivatel_ON_D_FE67\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks | {00A6FAF6-072E-44cf-8957-5838F569A31D} : -> ERROR [2]
[PUP] (X64) HKEY_LOCAL_MACHINE\RK_System_ON_D_9AF3\ControlSet001\Services\MyWebSearchService (D:\PROGRA~1\MYWEBS~1\bar\1.bin\mwssvc.exe) -> Smazáno
[PUP] (X64) HKEY_LOCAL_MACHINE\RK_System_ON_D_9AF3\ControlSet002\Services\MyWebSearchService (D:\PROGRA~1\MYWEBS~1\bar\1.bin\mwssvc.exe) -> Smazáno
[PUP] (X64) HKEY_LOCAL_MACHINE\RK_System_ON_D_9AF3\ControlSet003\Services\MyWebSearchService (D:\PROGRA~1\MYWEBS~1\bar\1.bin\mwssvc.exe) -> Smazáno
[PUM.Proxy] (X64) HKEY_USERS\S-1-5-21-3589600250-368458386-2505973026-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings | ProxyServer : 77.81.105.7:8089 -> Smazáno
[PUM.Proxy] (X86) HKEY_USERS\S-1-5-21-3589600250-368458386-2505973026-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings | ProxyServer : 77.81.105.7:8089 -> ERROR [2]
[PUM.HomePage] (X64) HKEY_LOCAL_MACHINE\RK_Software_ON_D_2492\Microsoft\Internet Explorer\Main | Start Page : http://home.sweetim.com/?st=1&barid={ADC780F9-C9F9-464C-9A63-4710EBF19335} -> Nahrazeno (http://go.microsoft.com/fwlink/p/?LinkId=255141)
[PUM.HomePage] (X86) HKEY_LOCAL_MACHINE\RK_Software_ON_D_2492\Microsoft\Internet Explorer\Main | Start Page : http://home.sweetim.com/?st=1&barid={ADC780F9-C9F9-464C-9A63-4710EBF19335} -> Nahrazeno (http://go.microsoft.com/fwlink/p/?LinkId=255141)
[PUM.HomePage] (X64) HKEY_USERS\RK_Luká?_ON_D_F73E\Software\Microsoft\Internet Explorer\Main | Start Page : http://blekko.com/ws/?source=5f97ddbe&t ... 242126461d -> Nahrazeno (http://go.microsoft.com/fwlink/p/?LinkId=255141)
[PUM.HomePage] (X86) HKEY_USERS\RK_Luká?_ON_D_F73E\Software\Microsoft\Internet Explorer\Main | Start Page : http://blekko.com/ws/?source=5f97ddbe&t ... 242126461d -> Nahrazeno (http://go.microsoft.com/fwlink/p/?LinkId=255141)
[PUM.HomePage] (X64) HKEY_USERS\RK_uzivatel_ON_D_FE67\Software\Microsoft\Internet Explorer\Main | Start Page : http://www.seznam.cz/ -> Nahrazeno (http://go.microsoft.com/fwlink/p/?LinkId=255141)
[PUM.HomePage] (X86) HKEY_USERS\RK_uzivatel_ON_D_FE67\Software\Microsoft\Internet Explorer\Main | Start Page : http://www.seznam.cz/ -> Nahrazeno (http://go.microsoft.com/fwlink/p/?LinkId=255141)
[PUM.HomePage] (X64) HKEY_USERS\RK_Luká?_ON_D_F73E\Software\Microsoft\Internet Explorer\Main | Default_Page_URL : http://qip.ru -> Nahrazeno (http://www.microsoft.com/isapi/redir.dl ... ar=msnhome)
[PUM.HomePage] (X86) HKEY_USERS\RK_Luká?_ON_D_F73E\Software\Microsoft\Internet Explorer\Main | Default_Page_URL : http://qip.ru -> Nahrazeno (http://www.microsoft.com/isapi/redir.dl ... ar=msnhome)
[PUM.SearchPage] (X64) HKEY_USERS\RK_Luká?_ON_D_F73E\Software\Microsoft\Internet Explorer\Main | Search Page : http://go.microsoft.com/fwlink/?LinkId=54896 -> Nahrazeno (http://go.microsoft.com/fwlink/?LinkId=54896)
[PUM.SearchPage] (X86) HKEY_USERS\RK_Luká?_ON_D_F73E\Software\Microsoft\Internet Explorer\Main | Search Page : http://go.microsoft.com/fwlink/?LinkId=54896 -> Nahrazeno (http://go.microsoft.com/fwlink/?LinkId=54896)
[PUM.SearchPage] (X64) HKEY_USERS\S-1-5-21-3589600250-368458386-2505973026-1001\Software\Microsoft\Internet Explorer\Main | Search Page : http://www.bing.com/search?q={searchTerms}&FORM=AVASDF&PC=AV01 -> Nahrazeno (http://go.microsoft.com/fwlink/?LinkId=54896)
[PUM.SearchPage] (X86) HKEY_USERS\S-1-5-21-3589600250-368458386-2505973026-1001\Software\Microsoft\Internet Explorer\Main | Search Page : http://www.bing.com/search?q={searchTerms}&FORM=AVASDF&PC=AV01 -> Nahrazeno (http://go.microsoft.com/fwlink/?LinkId=54896)
[PUM.SearchPage] (X64) HKEY_USERS\RK_Luká?_ON_D_F73E\Software\Microsoft\Internet Explorer\Main | Search Bar : http://search.msn.com/spbasic.htm -> Nahrazeno (http://search.msn.com/spbasic.htm)
[PUM.SearchPage] (X86) HKEY_USERS\RK_Luká?_ON_D_F73E\Software\Microsoft\Internet Explorer\Main | Search Bar : http://search.msn.com/spbasic.htm -> Nahrazeno (http://search.msn.com/spbasic.htm)
[PUM.SearchPage] (X64) HKEY_USERS\RK_Luká?_ON_D_F73E\Software\Microsoft\Internet Explorer\Main | Default_Search_URL : http://search.qip.ru -> Nahrazeno (http://www.microsoft.com/isapi/redir.dl ... r=iesearch)
[PUM.SearchPage] (X86) HKEY_USERS\RK_Luká?_ON_D_F73E\Software\Microsoft\Internet Explorer\Main | Default_Search_URL : http://search.qip.ru -> Nahrazeno (http://www.microsoft.com/isapi/redir.dl ... r=iesearch)
[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters | DhcpNameServer : 10.0.0.138 ([X]) -> Nahrazeno ()
[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\RK_System_ON_D_9AF3\ControlSet001\Services\Tcpip\Parameters | DhcpNameServer : 10.0.0.138 ([X]) -> Nahrazeno ()
[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Tcpip\Parameters | DhcpNameServer : 10.0.0.138 ([X]) -> Nahrazeno ()
[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\RK_System_ON_D_9AF3\ControlSet002\Services\Tcpip\Parameters | DhcpNameServer : 10.0.0.138 ([X]) -> Nahrazeno ()
[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\ControlSet002\Services\Tcpip\Parameters | DhcpNameServer : 10.0.0.138 ([X]) -> Nahrazeno ()
[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\RK_System_ON_D_9AF3\ControlSet003\Services\Tcpip\Parameters | DhcpNameServer : 10.0.0.138 ([X]) -> Nahrazeno ()
[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\ControlSet003\Services\Tcpip\Parameters | DhcpNameServer : 10.0.0.138 ([X]) -> Nahrazeno ()
[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{08DB6434-6278-4CFC-AFC2-BC3053BFA8AC} | DhcpNameServer : 10.0.0.138 ([X]) -> Nahrazeno ()
[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\RK_System_ON_D_9AF3\ControlSet001\Services\Tcpip\Parameters\Interfaces\{DB336010-9657-4894-9C88-D1CFE307F41C} | DhcpNameServer : 10.0.0.138 ([X]) -> Nahrazeno ()
[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Tcpip\Parameters\Interfaces\{08DB6434-6278-4CFC-AFC2-BC3053BFA8AC} | DhcpNameServer : 10.0.0.138 ([X]) -> Nahrazeno ()
[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\RK_System_ON_D_9AF3\ControlSet002\Services\Tcpip\Parameters\Interfaces\{DB336010-9657-4894-9C88-D1CFE307F41C} | DhcpNameServer : 10.0.0.138 ([X]) -> Nahrazeno ()
[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\ControlSet002\Services\Tcpip\Parameters\Interfaces\{08DB6434-6278-4CFC-AFC2-BC3053BFA8AC} | DhcpNameServer : 10.0.0.138 ([X]) -> Nahrazeno ()
[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\RK_System_ON_D_9AF3\ControlSet003\Services\Tcpip\Parameters\Interfaces\{DB336010-9657-4894-9C88-D1CFE307F41C} | DhcpNameServer : 10.0.0.138 ([X]) -> Nahrazeno ()
[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\ControlSet003\Services\Tcpip\Parameters\Interfaces\{08DB6434-6278-4CFC-AFC2-BC3053BFA8AC} | DhcpNameServer : 10.0.0.138 ([X]) -> Nahrazeno ()
[PUM.Policies] (X64) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System | ConsentPromptBehaviorAdmin : 0 -> Nahrazeno (2)
[PUM.Policies] (X86) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System | ConsentPromptBehaviorAdmin : 0 -> Nahrazeno (2)
[PUM.SecurityCenter] (X64) HKEY_LOCAL_MACHINE\RK_Software_ON_D_2492\Microsoft\Security Center | FirewallDisableNotify : 1 -> Smazáno
[PUM.SecurityCenter] (X86) HKEY_LOCAL_MACHINE\RK_Software_ON_D_2492\Microsoft\Security Center | FirewallDisableNotify : 1 -> ERROR [2]
[PUM.SecurityCenter] (X86) HKEY_LOCAL_MACHINE\Software\Microsoft\Security Center | AntiVirusDisableNotify : 0 -> Smazáno
[PUM.StartMenu] (X64) HKEY_USERS\RK_Luká?_ON_D_F73E\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced | Start_ShowPrinters : 0 -> Nahrazeno (1)
[PUM.StartMenu] (X64) HKEY_USERS\RK_Luká?_ON_D_F73E\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced | Start_ShowRecentDocs : 2 -> Nahrazeno (1)
[PUM.StartMenu] (X86) HKEY_USERS\RK_Luká?_ON_D_F73E\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced | Start_ShowPrinters : 0 -> Nahrazeno (1)
[PUM.StartMenu] (X86) HKEY_USERS\RK_Luká?_ON_D_F73E\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced | Start_ShowRecentDocs : 2 -> Nahrazeno (1)
[PUM.StartMenu] (X64) HKEY_USERS\S-1-5-21-3589600250-368458386-2505973026-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced | Start_ShowMyGames : 0 -> Nahrazeno (1)
[PUM.StartMenu] (X64) HKEY_USERS\S-1-5-21-3589600250-368458386-2505973026-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced | Start_ShowHelp : 0 -> Nahrazeno (1)
[PUM.StartMenu] (X86) HKEY_USERS\S-1-5-21-3589600250-368458386-2505973026-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced | Start_ShowMyGames : 0 -> Nahrazeno (1)
[PUM.StartMenu] (X86) HKEY_USERS\S-1-5-21-3589600250-368458386-2505973026-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced | Start_ShowHelp : 0 -> Nahrazeno (1)

¤¤¤ Úlohy : 0 ¤¤¤

¤¤¤ Soubory : 5 ¤¤¤
[PUP][Složka] C:\ProgramData\{3C5CBD7B-3D1D-411E-96C2-513FFCA84D2D} -> Smazáno
[PUP][Složka] C:\ProgramData\{BAF091CA-86C4-4627-ADA1-897E2621C1B0} -> Smazáno
[PUP][Složka] C:\ProgramData\{CED89F1A-945F-46EC-B23C-5EAF6D2DB12A} -> Smazáno
[PUP][Složka] C:\ProgramData\{D76294E6-03B8-4971-AF2E-3F846161A690} -> Smazáno
[PUP][Soubor] C:\ProgramData\{D76294E6-03B8-4971-AF2E-3F846161A690}\desktop.ini -> Smazáno
[PUP][Složka] C:\ProgramData\{E1ED556E-3EA0-4F44-8BE7-CC5FB0F4B424} -> Odstraněno při restartu [91]
[PUP][Soubor] C:\ProgramData\{E1ED556E-3EA0-4F44-8BE7-CC5FB0F4B424}\desktop.ini -> Odstraněno při restartu [5]

¤¤¤ Soubor HOSTS : 3 ¤¤¤
[C:\Windows\System32\drivers\etc\hosts] 127.0.0.1 patches.rockstargames.com
[C:\Windows\System32\drivers\etc\hosts] 127.0.0.1 prod.ros.rockstargames.com
[C:\Windows\System32\drivers\etc\hosts] 127.0.0.1 activate.adobe.com

¤¤¤ Antirootkit : 30 (Driver: Nahrán) ¤¤¤
[IAT:Inl(Hook.IEAT)] (explorer.exe) ntdll!NtSetSystemInformation : Unknown @ 0x701f0 (jmp 0xffffffff88742c30|call 0xfffffffffffffda0|jmp 0x19d)
[IAT:Inl(Hook.IEAT)] (explorer.exe @ kernel32.dll) ntdll!NtWriteVirtualMemory : Unknown @ 0x703b0 (jmp 0xffffffff88744140|call 0xfffffffffffffbe0|jmp 0x19d)
[IAT:Inl(Hook.IEAT)] (explorer.exe @ kernel32.dll) ntdll!NtDuplicateObject : Unknown @ 0x70390 (jmp 0xffffffff88744100|call 0xfffffffffffffc00|jmp 0x19d)
[IAT:Inl(Hook.IEAT)] (explorer.exe @ kernel32.dll) ntdll!NtCreateEvent : Unknown @ 0x702d0 (jmp 0xffffffff88743f80|call 0xfffffffffffffcc0|jmp 0x19d)
[IAT:Inl(Hook.IEAT)] (explorer.exe @ kernel32.dll) ntdll!NtNotifyChangeKey : Unknown @ 0x70490 (jmp 0xffffffff887436e0|call 0xfffffffffffffb00|jmp 0x19d)
[IAT:Inl(Hook.IEAT)] (explorer.exe @ kernel32.dll) ntdll!NtTerminateProcess : Unknown @ 0x703e0 (jmp 0xffffffff88744250|call 0xfffffffffffffbb0|jmp 0x19d)
[IAT:Inl(Hook.IEAT)] (explorer.exe @ kernel32.dll) ntdll!NtOpenEvent : Unknown @ 0x702e0 (jmp 0xffffffff88744010|call 0xfffffffffffffcb0|jmp 0x19d)
[IAT:Inl(Hook.IEAT)] (explorer.exe @ kernel32.dll) ntdll!NtAssignProcessToJobObject : Unknown @ 0x703a0 (jmp 0xffffffff88743c50|call 0xfffffffffffffbf0|jmp 0x19d)
[IAT:Inl(Hook.IEAT)] (explorer.exe @ kernel32.dll) ntdll!NtSetContextThread : Unknown @ 0x70400 (jmp 0xffffffff88743000|call 0xfffffffffffffb90|jmp 0x19d)
[IAT:Inl(Hook.IEAT)] (explorer.exe @ kernel32.dll) ntdll!NtCreateSection : Unknown @ 0x70310 (jmp 0xffffffff88743fa0|call 0xfffffffffffffc70|jmp 0x19d)
[IAT:Inl(Hook.IEAT)] (explorer.exe @ kernel32.dll) ntdll!NtOpenProcess : Unknown @ 0x70370 (jmp 0xffffffff88744240|call 0xfffffffffffffc10|jmp 0x19d)
[IAT:Inl(Hook.IEAT)] (explorer.exe @ kernel32.dll) ntdll!NtNotifyChangeMultipleKeys : Unknown @ 0x704a0 (jmp 0xffffffff887436e0|call 0xfffffffffffffaf0|jmp 0x19d)
[IAT:Inl(Hook.IEAT)] (explorer.exe @ KERNELBASE.dll) ntdll!NtCreateIoCompletion : Unknown @ 0x70350 (jmp 0xffffffff88743b10|call 0xfffffffffffffc30|jmp 0x19d)
[IAT:Inl(Hook.IEAT)] (explorer.exe @ KERNELBASE.dll) ntdll!NtQueryObject : Unknown @ 0x70450 (jmp 0xffffffff88744480|call 0xfffffffffffffb40|jmp 0x19d)
[IAT:Inl(Hook.IEAT)] (explorer.exe @ KERNELBASE.dll) ntdll!NtOpenSection : Unknown @ 0x70320 (jmp 0xffffffff887440e0|call 0xfffffffffffffc60|jmp 0x19d)
[IAT:Inl(Hook.IEAT)] (explorer.exe @ KERNELBASE.dll) ntdll!NtCreateSemaphore : Unknown @ 0x702b0 (jmp 0xffffffff88743980|call 0xfffffffffffffce0|jmp 0x19d)
[IAT:Inl(Hook.IEAT)] (explorer.exe @ KERNELBASE.dll) ntdll!NtOpenSemaphore : Unknown @ 0x702c0 (jmp 0xffffffff88743410|call 0xfffffffffffffcd0|jmp 0x19d)
[IAT:Inl(Hook.IEAT)] (explorer.exe @ KERNELBASE.dll) ntdll!NtCreateMutant : Unknown @ 0x70290 (jmp 0xffffffff887439f0|call 0xfffffffffffffd00|jmp 0x19d)
[IAT:Inl(Hook.IEAT)] (explorer.exe @ KERNELBASE.dll) ntdll!NtOpenMutant : Unknown @ 0x702a0 (jmp 0xffffffff88743440|call 0xfffffffffffffcf0|jmp 0x19d)
[IAT:Inl(Hook.IEAT)] (explorer.exe @ KERNELBASE.dll) ntdll!NtCreateTimer : Unknown @ 0x70330 (jmp 0xffffffff887439d0|call 0xfffffffffffffc50|jmp 0x19d)
[IAT:Inl(Hook.IEAT)] (explorer.exe @ KERNELBASE.dll) ntdll!NtOpenTimer : Unknown @ 0x70340 (jmp 0xffffffff88743450|call 0xfffffffffffffc40|jmp 0x19d)
[IAT:Inl(Hook.IEAT)] (explorer.exe @ KERNELBASE.dll) ntdll!NtCreateThreadEx : Unknown @ 0x703d0 (jmp 0xffffffff88743a80|call 0xfffffffffffffbc0|jmp 0x19d)
[IAT:Inl(Hook.IEAT)] (explorer.exe @ KERNELBASE.dll) ntdll!NtTerminateThread : Unknown @ 0x703f0 (jmp 0xffffffff88743ff0|call 0xfffffffffffffba0|jmp 0x19d)
[IAT:Inl(Hook.IEAT)] (explorer.exe @ KERNELBASE.dll) ntdll!NtOpenThread : Unknown @ 0x70380 (jmp 0xffffffff887434a0|call 0xfffffffffffffc10|jmp 0x19d)
[IAT:Inl(Hook.IEAT)] (explorer.exe @ KERNELBASE.dll) ntdll!NtSuspendThread : Unknown @ 0x70430 (jmp 0xffffffff88742d80|call 0xfffffffffffffb60|jmp 0x19d)
[IAT:Inl(Hook.IEAT)] (explorer.exe @ rpcrt4.dll) ntdll!NtAlpcSendWaitReceivePort : Unknown @ 0x70480 (jmp 0xffffffff88743d60|call 0xfffffffffffffb10|jmp 0x19d)
[IAT:Inl(Hook.IEAT)] (explorer.exe @ rpcrt4.dll) ntdll!NtQueueApcThreadEx : Unknown @ 0x70440 (jmp 0xffffffff88743260|call 0xfffffffffffffb50|jmp 0x19d)
[IAT:Inl(Hook.IEAT)] (explorer.exe @ gdi32.dll) ntdll!NtVdmControl : Unknown @ 0x70280 (jmp 0xffffffff88742ae0|call 0xfffffffffffffd10|jmp 0x19d)
[IAT:Inl(Hook.IEAT)] (explorer.exe @ ntmarta.dll) ntdll!NtOpenEventPair : Unknown @ 0x70300 (jmp 0xffffffff88743510|call 0xfffffffffffffc90|jmp 0x19d)
[IAT:Inl(Hook.IEAT)] (explorer.exe @ ws2_32.dll) ntdll!NtLoadDriver : Unknown @ 0x701e0 (jmp 0xffffffff88743520|call 0xfffffffffffffdb0|jmp 0x19d)

¤¤¤ Webové prohlížeče : 2 ¤¤¤
[PUM.Proxy][FIREFX:Config] fsym9r3c.default : user_pref("network.proxy.http", "117.163.98.255"); -> Smazáno
[PUM.Proxy][FIREFX:Config] fsym9r3c.default : user_pref("network.proxy.http_port", 8123); -> Smazáno

¤¤¤ Kontrola MBR : ¤¤¤
+++++ PhysicalDrive0: +++++
--- User ---
[MBR] 4fea89a0a1e71efaa9bb82e6a2dd43ca
[BSP] 2a021c11679a2c558d62d42263b4025e : Windows Vista/7/8|VT.Unknown MBR Code
Partition table:
0 - [ACTIVE] NTFS (0x7) [VISIBLE] Offset (sectors): 63 | Size: 63530 MB [Windows Vista/7/8 Bootstrap | Windows Vista/7/8 Bootloader]
1 - [XXXXXX] EXTEN-LBA (0xf) [VISIBLE] Offset (sectors): 130126502 | Size: 50932 MB
User = LL1 ... OK
User = LL2 ... OK

+++++ PhysicalDrive1: +++++
--- User ---
[MBR] cd462af4ce9d13d583d6370e2bf0b969
[BSP] 59f50929da3b88e9e9e3c2214a59f04e : Linux|VT.Unknown MBR Code
Partition table:
0 - [ACTIVE] NTFS (0x7) [VISIBLE] Offset (sectors): 63 | Size: 66754 MB [Windows Vista/7/8 Bootstrap | Windows Vista/7/8 Bootloader]
1 - [XXXXXX] EXTEN-LBA (0xf) [VISIBLE] Offset (sectors): 136713150 | Size: 238488 MB
User = LL1 ... OK
User = LL2 ... OK

-----------------------------------------------------------------------------------------------------------------------------------------

Zoek.exe v5.0.0.1 Updated 31-October-2015
Tool run by Luk ç on ne 01.11.2015 at 18:23:39,52.
Microsoft Windows 7 Ultimate 6.1.7601 Service Pack 1 x64
Running in: Normal Mode Internet Access Detected
Launched: C:\Users\LUK~1\Desktop\zoek.exe [Scan all users] [Script inserted]

==== System Restore Info ======================

1.11.2015 18:26:21 Zoek.exe System Restore Point Created Successfully.

==== Reset Hosts File ======================

# Copyright (c) 1993-2006 Microsoft Corp.
#
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
#
# This file contains the mappings of IP addresses to host names. Each
# entry should be kept on an individual line. The IP address should
# be placed in the first column followed by the corresponding host name.
# The IP address and the host name should be separated by at least one
# space.
#
# Additionally, comments (such as these) may be inserted on individual
# lines or following the machine name denoted by a '#' symbol.
#
# For example:
#
# 102.54.94.97 rhino.acme.com # source server
# 38.25.63.10 x.acme.com # x client host

# localhost name resolution is handled within DNS itself.
127.0.0.1 localhost
::1 localhost

==== Empty Folders Check ======================

C:\PROGRA~2\MSXML 4.0 deleted successfully
C:\PROGRA~2\Real deleted successfully
C:\PROGRA~2\COMMON~1\Pegasus Imaging deleted successfully
C:\PROGRA~2\COMMON~1\Windows Live deleted successfully
C:\Program Files\CPUID deleted successfully
C:\Users\LUK~1\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Flux deleted successfully
C:\PROGRA~3\BlueStacks deleted successfully
C:\PROGRA~3\Freemake deleted successfully
C:\PROGRA~3\ProductData deleted successfully
C:\Users\Default\AppData\\LocalGoogle deleted successfully
C:\Users\GTA V\AppData\\LocalGoogle deleted successfully
C:\Users\Guest\AppData\\LocalGoogle deleted successfully
C:\Users\LUK~1\AppData\\LocalGoogle deleted successfully
C:\Windows\serviceprofiles\networkservice\AppData\\LocalLow deleted successfully
C:\Users\GTA V\AppData\Local\EmieBrowserModeList deleted successfully
C:\Users\GTA V\AppData\Local\EmieSiteList deleted successfully
C:\Users\GTA V\AppData\Local\EmieUserList deleted successfully
C:\Users\LUK~1\AppData\Local\EmieBrowserModeList deleted successfully
C:\Users\LUK~1\AppData\Local\EmieSiteList deleted successfully
C:\Users\LUK~1\AppData\Local\EmieUserList deleted successfully
C:\Users\LUK~1\AppData\Local\Macromedia deleted successfully
C:\Users\LUK~1\AppData\Local\WMTools Downloaded Files deleted successfully
C:\Windows\serviceprofiles\Localservice\AppData\Local\CrashDumps deleted successfully

==== Deleting CLSID Registry Keys ======================

HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{3049C3E9-B461-4BC5-8870-4C09146192CA} deleted successfully
HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{3049C3E9-B461-4BC5-8870-4C09146192CA} deleted successfully
HKEY_USERS\S-1-5-21-3589600250-368458386-2505973026-1001\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{3049C3E9-B461-4BC5-8870-4C09146192CA} deleted successfully

==== Deleting CLSID Registry Values ======================

HKEY_USERS\S-1-5-21-3589600250-368458386-2505973026-1001\Software\Microsoft\Internet Explorer\Approved Extensions\{4D2D3B0F-69BE-477A-90F5-FDDB05357975} deleted successfully
HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Approved Extensions\{3049C3E9-B461-4BC5-8870-4C09146192CA} deleted successfully
HKEY_USERS\S-1-5-21-3589600250-368458386-2505973026-1001\Software\Microsoft\Internet Explorer\Approved Extensions\{3049C3E9-B461-4BC5-8870-4C09146192CA} deleted successfully
HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Approved Extensions\{BA0C978D-D909-49B6-AFE2-8BDE245DC7E6} deleted successfully
HKEY_USERS\S-1-5-21-3589600250-368458386-2505973026-1001\Software\Microsoft\Internet Explorer\Approved Extensions\{BA0C978D-D909-49B6-AFE2-8BDE245DC7E6} deleted successfully
HKEY_LOCAL_MACHINE\software\Wow6432Node\mozilla\Firefox\extensions\{ABDE892B-13A8-4d1b-88E6-365A6E755758} deleted successfully

==== Deleting Services ======================

==== FireFox Fix ======================

Deleted from C:\Users\LUK~1\AppData\Roaming\Mozilla\Firefox\Profiles\fsym9r3c.default\prefs.js:

Added to C:\Users\LUK~1\AppData\Roaming\Mozilla\Firefox\Profiles\fsym9r3c.default\prefs.js:
user_pref("browser.startup.homepage", "about:home");
user_pref("browser.newtab.url", "about:newtab");

ProfilePath: C:\Users\LUK~1\AppData\Roaming\Mozilla\Firefox\Profiles\fsym9r3c.default

user.js not found
---- Lines browser.startup.page removed from prefs.js ----
user_pref("browser.startup.page", 1);
---- FireFox user.js and prefs.js backups ----

prefs_01.11.2015_1839_.backup

==== Deleting Files \ Folders ======================

C:\PROGRA~2\Real not found
C:\Users\Lukáš\AppData\Roaming\Mozilla\Firefox\Profiles\fsym9r3c.default\extensions\iobitascsurfingprotection@iobit.com not found
C:\PROGRA~3\{E1ED556E-3EA0-4F44-8BE7-CC5FB0F4B424} deleted
C:\PROGRA~3\Package Cache deleted
C:\Users\LUK~1\AppData\Local\Unity deleted
C:\Users\LUK~1\AppData\Roaming\Mozilla\Firefox\Profiles\fsym9r3c.default\extensions\iobitascsurfingprotection@iobit.com deleted
"C:\Users\LUK~1\AppData\Local???????????????????" not deleted

==== Firefox Start and Search pages ======================

ProfilePath: C:\Users\LUK~1\AppData\Roaming\Mozilla\Firefox\Profiles\fsym9r3c.default
user_pref("browser.newtab.url", "about:newtab");

==== Firefox Proxy Settings ======================

ProfilePath: C:\Users\LUK~1\AppData\Roaming\Mozilla\Firefox\Profiles\fsym9r3c.default
user_pref("network.proxy.backup.ftp", "");
user_pref("network.proxy.backup.ftp_port", 0);
user_pref("network.proxy.backup.socks", "");
user_pref("network.proxy.backup.socks_port", 0);
user_pref("network.proxy.backup.ssl", "");
user_pref("network.proxy.backup.ssl_port", 0);
user_pref("network.proxy.ftp", "117.163.98.255");
user_pref("network.proxy.ftp_port", 8123);
user_pref("network.proxy.share_proxy_settings", true);
user_pref("network.proxy.socks", "117.163.98.255");
user_pref("network.proxy.socks_port", 8123);
user_pref("network.proxy.ssl", "117.163.98.255");
user_pref("network.proxy.ssl_port", 8123);
user_pref("network.proxy.type", 1);

==== Firefox Extensions Registry ======================

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Mozilla\Firefox\Extensions]
"wrc@avast.com"="E:\Program Files\AVAST Software\Avast\WebRep\FF" [14.08.2015 10:12]

==== Firefox Extensions ======================

ProfilePath: C:\Users\LUK~1\AppData\Roaming\Mozilla\Firefox\Profiles\fsym9r3c.default
- Undetermined - C:\Users\Lukáš\AppData\Roaming\Mozilla\Firefox\Profiles\fsym9r3c.default\extensions\iobitascsurfingprotection@iobit.com

==== Firefox Plugins ======================

==== Fake Chromium Profiles Check ======================

Fake profile C:\Users\Guest\AppData\Local\Google\Chrome deleted

==== Chromium Look ======================

Google Chrome Version: 46.0.2490.80

HKEY_LOCAL_MACHINE\SOFTWARE\Google\Chrome\Extensions
gomekmidlodglbbmalcneegieacbdmki - E:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx[21.04.2015 11:24]

HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\Extensions
apdfllckaahabafndbhieahigkjlhalf - No path found[]

Angry Birds - LUK~1\AppData\Local\Google\Chrome\User Data\Default\Extensions\aknpkdffaafgjchaibgeefbgmgeghloj
Embed WMPlayer inline - LUK~1\AppData\Local\Google\Chrome\User Data\Default\Extensions\bamkbfdmckphehgiafpenehgebjgdlli
Reaction gifs and memes for facebook chat - LUK~1\AppData\Local\Google\Chrome\User Data\Default\Extensions\dcjoingkjjihkkcjmcaldeolkdiffodf
AdBlock - LUK~1\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom
Avast Online Security - LUK~1\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki
Pub Toolbar - LUK~1\AppData\Local\Google\Chrome\User Data\Default\Extensions\omioeahgfecgfpfldejlnideemfidnkc

==== Chromium Fix ======================

C:\Users\LUK~1\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_savelocations.wikia.com_0.localstorage deleted successfully
C:\Users\LUK~1\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_savelocations.wikia.com_0.localstorage-journal deleted successfully
C:\Users\LUK~1\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_www.savegames.us_0.localstorage deleted successfully
C:\Users\LUK~1\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_www.savegames.us_0.localstorage-journal deleted successfully
C:\Users\GTA V\AppData\Local\Google\Chrome\User Data\Default\Local Storage\https_c.betrad.com_0.localstorage deleted successfully
C:\Users\GTA V\AppData\Local\Google\Chrome\User Data\Default\Local Storage\https_c.betrad.com_0.localstorage-journal deleted successfully
C:\Users\GTA V\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_c.betrad.com_0.localstorage deleted successfully
C:\Users\LUK~1\AppData\Local\Google\Chrome\User Data\Default\Local Storage\https_c.betrad.com_0.localstorage deleted successfully
C:\Users\LUK~1\AppData\Local\Google\Chrome\User Data\Default\Local Storage\https_c.betrad.com_0.localstorage-journal deleted successfully
C:\Users\LUK~1\AppData\Local\Google\Chrome\User Data\Default\Extensions\omioeahgfecgfpfldejlnideemfidnkc deleted successfully

==== Set IE to Default ======================

Old Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"="http://google.com/"

New Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"="http://google.com/"

==== All HKCU SearchScopes ======================

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes
"DefaultScope"="{FFEBBF0A-C22C-4172-89FF-45215A135AC7}"
{012E1000-F331-11DB-8314-0800200C9A66} Google Url="http://www.google.com/search?q={searchTerms}"
{0633EE93-D776-472f-A0FF-E1416B8B2E3A} Bing Url="http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IESR02"
{632F07F3-19A1-4d16-A23F-E6CE9486BAB5} Microsoft (Bing) Url="http://www.bing.com/search?q={searchTerms}&FORM=AVASDF&PC=AV01"
{FFEBBF0A-C22C-4172-89FF-45215A135AC7} ?????@Mail.Ru? Url="http://go.mail.ru/search?q={SearchTerms}&fr=ntg&gp=custom2"

==== Reset Google Chrome ======================

C:\Users\GTA V\AppData\Local\Google\Chrome\User Data\Default\Preferences was reset successfully
C:\Users\GTA V\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences was reset successfully
C:\Users\LUK~1\AppData\Local\Google\Chrome\User Data\Default\Preferences was reset successfully
C:\Users\LUK~1\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences was reset successfully
C:\Users\GTA V\AppData\Local\Google\Chrome\User Data\Default\Web Data was reset successfully
C:\Users\GTA V\AppData\Local\Google\Chrome\User Data\Default\Web Data-journal was reset successfully
C:\Users\GTA V\AppData\Local\Google\Chrome\User Data\Default\Web Data.ReadOnly was reset successfully
C:\Users\LUK~1\AppData\Local\Google\Chrome\User Data\Default\Web Data was reset successfully
C:\Users\LUK~1\AppData\Local\Google\Chrome\User Data\Default\Web Data-journal was reset successfully
C:\Users\LUK~1\AppData\Local\Google\Chrome\User Data\Default\Web Data.ReadOnly was reset successfully

==== Deleting Registry Keys ======================

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\UnityWebPlayer deleted successfully
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdobeCS6ServiceManager deleted successfully
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AMD AVT deleted successfully
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\amd_dc_opt deleted successfully
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ApnTBMon deleted successfully
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ArcSoft Connection Service deleted successfully
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\f.lux deleted successfully
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GetPrivate deleted successfully
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update deleted successfully
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HydraVisionDesktopManager deleted successfully
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper deleted successfully
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Live Update 5 deleted successfully
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Pando Media Booster deleted successfully
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype deleted successfully
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\StartCCC deleted successfully
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched deleted successfully
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SwitchBoard deleted successfully
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe deleted successfully
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\winupdater deleted successfully

==== Empty IE Cache ======================

C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\LUK~1\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully

==== Empty FireFox Cache ======================

No FireFox Cache found

==== Empty Chrome Cache ======================

C:\Users\GTA V\AppData\Local\Google\Chrome\User Data\Default\Cache emptied successfully
C:\Users\LUK~1\AppData\Local\Google\Chrome\User Data\Default\Cache emptied successfully

==== Empty All Flash Cache ======================

No Flash Cache Found

==== Empty All Java Cache ======================

Java Cache cleared successfully

==== C:\zoek_backup content ======================

C:\zoek_backup (files=280 folders=87 50402939 bytes)

==== Empty Temp Folders ======================

C:\Users\Default\AppData\Local\Temp emptied successfully
C:\Users\Default User\AppData\Local\Temp emptied successfully
C:\Users\GTA V\AppData\Local\Temp emptied successfully
C:\Users\Guest\AppData\Local\Temp emptied successfully
C:\Users\LUK~1\AppData\Local\Temp will be emptied at reboot
C:\Windows\serviceprofiles\networkservice\AppData\Local\Temp emptied successfully
C:\Windows\serviceprofiles\Localservice\AppData\Local\Temp emptied successfully
C:\Windows\Temp will be emptied at reboot

==== After Reboot ======================

==== Empty Temp Folders ======================

C:\Windows\Temp successfully emptied
C:\Users\LUK~1\AppData\Local\Temp successfully emptied

==== Empty Recycle Bin ======================

C:\$RECYCLE.BIN successfully emptied
C:\RECYCLER successfully emptied

==== Deleting Files / Folders ======================

"C:\Users\LUK~1\AppData\Local???????????????????" not deleted

==== EOF on ne 01.11.2015 at 18:45:09,91 ======================

Příspěvekod **jerabina** » 01 lis 2015 18:54

Co ten AdwCleaner? Udělej ho ještě jednou, nálezy vymaž a log sem vlož

+

Vypni rez. ochranu u antiviru a antispywaru,příp. firewall..

Stáhni si ComboFix (by sUBs)
a ulož si ho na plochu.
Ukonči všechna aktivní okna a spusť ho.
- Po spuštění se zobrazí podmínky užití, potvrď je stiskem tlačítka Ano
- Dále postupuj dle pokynů, během aplikování ComboFixu neklikej do zobrazujícího se okna
- Po dokončení skenování by měl program vytvořit log - C:\ComboFix.txt - zkopíruj sem prosím celý jeho obsah
Pokud budou problémy , spusť ho v nouz. režimu.

Upozornění : Může se stát, že po aplikaci Combofixu a restartu počítače, Windows nenaběhnou , nebo nenajede plocha , budou problémy s připojením, pak znovu restartuj počítač, pokud to nepomůže , po restartu mačkej klávesu F8 a pak zvol poslední známou funkční konfiguraci. , či použij bod obnovy.

staclu · Příspěvekod **staclu** » 01 lis 2015 19:48

# AdwCleaner v5.015 - Logfile created 01/11/2015 at 17:32:01
# Updated 26/10/2015 by Xplode
# Database : 2015-10-29.1 [Server]
# Operating system : Windows 7 Ultimate Service Pack 1 (x64)
# Username : Lukáš - PC-DOLE
# Running from : C:\Users\Lukáš\Desktop\adwcleaner_5.015.exe
# Option : Cleaning
# Support : http://toolslib.net/forum

***** [ Services ] *****

***** [ Folders ] *****

[-] Folder Deleted : C:\Users\Lukáš\AppData\Local\Google\Chrome\User Data\Default\Extensions\omioeahgfecgfpfldejlnideemfidnkc

***** [ Files ] *****

***** [ DLLs ] *****

***** [ Shortcuts ] *****

***** [ Scheduled tasks ] *****

***** [ Registry ] *****

***** [ Web browsers ] *****

[-] [C:\Users\Lukáš\AppData\Local\Google\Chrome\User Data\Default\Web Data] [Search Provider] Deleted : minecraft.en.softonic.com
[-] [C:\Users\Lukáš\AppData\Local\Google\Chrome\User Data\Default\Web Data] [Search Provider] Deleted : search.conduit.com
[-] [C:\Users\Lukáš\AppData\Local\Google\Chrome\User Data\Default\Web Data] [Search Provider] Deleted : ask.com
[-] [C:\Users\Lukáš\AppData\Local\Google\Chrome\User Data\Default\Web Data] [Search Provider] Deleted : morphvox-voice-changer.en.softonic.com
[-] [C:\Users\Lukáš\AppData\Local\Google\Chrome\User Data\Default\Web Data] [Search Provider] Deleted : yahoo.com
[-] [C:\Users\Lukáš\AppData\Local\Google\Chrome\User Data\Default\Web Data] [Search Provider] Deleted : websearch
[-] [C:\Users\Lukáš\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences] [Extension] Deleted : cpngackimfmofbokmjmljamhdncknpmg
[-] [C:\Users\Lukáš\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences] [Extension] Deleted : omioeahgfecgfpfldejlnideemfidnkc

*************************

:: Winsock settings cleared

########## EOF - C:\AdwCleaner\AdwCleaner[C2].txt - [1801 bytes] ##########

Prosím o kontrolu logu Vyřešeno

Prosím o kontrolu logu Vyřešeno

Re: Prosím o kontrolu logu

Re: Prosím o kontrolu logu

Re: Prosím o kontrolu logu

Re: Prosím o kontrolu logu

Re: Prosím o kontrolu logu

Re: Prosím o kontrolu logu

Re: Prosím o kontrolu logu

Re: Prosím o kontrolu logu

Re: Prosím o kontrolu logu

Re: Prosím o kontrolu logu

Re: Prosím o kontrolu logu

Kdo je online