Prosím o kontrolu - vyskakovací okna

Příspěvekod **Pic** » 22 úno 2016 15:59

Avast nic nenajde. Vyskakovací okna v podstatě zablokují především pc-help. Takže mám velký problém se na pc-help dostat.Jinak zatím v jiných programech žádný problém. Děkuji za pomoc.

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 12:48:01, on 22.2.2016
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Unable to get Internet Explorer version!

FIREFOX: 40.0.2 (x86 cs)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskhost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\System32\rundll32.exe
C:\Program Files\TeamViewer\TeamViewer.exe
C:\Windows\system32\GWX\GWX.exe
C:\Program Files\Logitech\Logitech WebCam Software\LWS.exe
C:\Windows\vVX1000.exe
C:\Program Files\Common Files\Logishrd\LQCVFX\COCIManager.exe
C:\totalcmd\TOTALCMD.EXE
D:\Stah\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.seznam.cz/?clid=22668
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.seznam.cz/?clid=22668
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = <-loopback>
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
O2 - BHO: Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files\Epson Software\Easy Photo Print\EPTBL.dll
O3 - Toolbar: Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files\Epson Software\Easy Photo Print\EPTBL.dll
O4 - HKLM\..\Run: [AvastUI.exe] "C:\Program Files\AVAST Software\Avast\AvastUI.exe" /nogui
O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Program Files\Logitech\Logitech WebCam Software\LWS.exe" /hide
O4 - HKLM\..\Run: [LifeCam] "C:\Program Files\Microsoft LifeCam\LifeExp.exe"
O4 - HKLM\..\Run: [VX1000] C:\Windows\vVX1000.exe
O4 - HKCU\..\Run: [EPSON SX100 Series] C:\Windows\system32\spool\DRIVERS\W32X86\3\E_FATIEDE.EXE /FU "C:\Windows\TEMP\E_S4B06.tmp" /EF "HKCU"
O4 - HKUS\S-1-5-18\..\RunOnce: [SPReview] "C:\Windows\System32\SPReview\SPReview.exe" /sp:1 /errorfwlink:"http://go.microsoft.com/fwlink/?LinkID=122915" /build:7601 (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [SPReview] "C:\Windows\System32\SPReview\SPReview.exe" /sp:1 /errorfwlink:"http://go.microsoft.com/fwlink/?LinkID=122915" /build:7601 (User 'Default user')
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Office Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Zdroje informací - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O17 - HKLM\System\CS4\Services\Tcpip\Parameters: NameServer = 8.8.8.8,8.8.8.4
O17 - HKLM\System\CS5\Services\Tcpip\Parameters: NameServer = 8.8.8.8,8.8.8.4
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 8.8.8.8,8.8.8.4
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: Avast Antivirus (avast! Antivirus) - AVAST Software - C:\Program Files\AVAST Software\Avast\AvastSvc.exe
O23 - Service: EPSON V5 Service4(01) (EPSON_EB_RPCV4_01) - SEIKO EPSON CORPORATION - C:\ProgramData\EPSON\EPW!3 SSRP\E_S40ST7.EXE
O23 - Service: EPSON V3 Service4(01) (EPSON_PM_RPCV4_01) - SEIKO EPSON CORPORATION - C:\ProgramData\EPSON\EPW!3 SSRP\E_S40RP7.EXE
O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
O23 - Service: MBAMService - Malwarebytes - C:\Program Files\Malwarebytes Anti-Malware\mbamservice.exe
O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
O23 - Service: NVIDIA Update Service Daemon (nvUpdatusService) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
O23 - Service: Skype Updater (SkypeUpdate) - Skype Technologies - C:\Program Files\Skype\Updater\Updater.exe
O23 - Service: TeamViewer 11 (TeamViewer) - TeamViewer GmbH - C:\Program Files\TeamViewer\TeamViewer_Service.exe

--
End of file - 4519 bytes

Reklama

Příspěvekod **jaro3** » 22 úno 2016 17:10

Stáhni si ATF Cleaner
Poklepej na ATF Cleaner.exe, klikni na select all found, poté:
-Když používáš Firefox (Mozzila), klikni na Firefox nahoře a vyber: Select All, poté klikni na Empty Selected.
-Když používáš Operu, klikni nahoře na Operu a vyber: Select All, poté klikni na Empty Selected. Poté klikni na Main (hlavní stránku ) a klikni na Empty Selected.
Po vyčištění klikni na Exit k zavření programu.
ATF-Cleaner je jednoduchý nástroj na odstranění historie z webového prohlížeče. Program dokáže odstranit cache, cookies, historii a další stopy po surfování na Internetu. Mezi podporované prohlížeče patří Internet Explorer, Firefox a Opera. Aplikace navíc umí odstranit dočasné soubory Windows, vysypat koš atd.

- Pokud používáš jen Google Chrome , tak ATF nemusíš použít.

Stáhni si TFC
http://www.geekstogo.com/forum/files/fi ... -oldtimer/
Otevři soubor a zavři všechny ostatní okna, Klikni na Start k zahájení procesu. Program by neměl trvat dlouho.
Poté by se měl PC restartovat, pokud ne , proveď sám.

Stáhni AdwCleaner (by Xplode)
http://www.bleepingcomputer.com/download/adwcleaner/

Ulož si ho na svojí plochu
Ukonči všechny programy , okna a prohlížeče
Spusť program poklepáním a klikni na „Prohledat-Scan“
Po skenu klikni na „Logfile“ ,objeví log ( jinak je uložen systémovem disku jako AdwCleaner[C?].txt), jeho obsah sem celý vlož.

Stáhni si Malwarebytes' Anti-Malware
- Při instalaci odeber zatržítko u „Povolit bezplatnou zkušební verzi Malwarebytes' Anti-Malware Premium“
Nainstaluj a spusť ho
- na konci instalace se ujisti že máš zvoleny/zatrhnuty obě možnosti:
Aktualizace Malwarebytes' Anti-Malware a Spustit aplikaci Malwarebytes' Anti-Malware, pokud jo tak klikni na tlačítko konec
- pokud bude nalezena aktualizace, tak se stáhne a nainstaluje
- program se po té spustí a klikni na Skenovat nyní a
- po proběhnutí programu se ti objeví hláška vpravo dole tak klikni na Kopírovat do schránky a vlož sem celý log.

- po té klikni na tlačítko Exit, objeví se ti hláška tak zvol Ano
(zatím nic nemaž!).

Pokud budou problémy , spusť v nouz. režimu.

Příspěvekod **Pic** » 23 úno 2016 13:56

# AdwCleaner v5.036 - Logfile created 23/02/2016 at 13:53:24
# Updated 22/02/2016 by Xplode
# Database : 2016-02-22.2 [Server]
# Operating system : Windows 7 Professional Service Pack 1 (x86)
# Username : Petr - PETR-PC
# Running from : D:\Stah\adwcleaner_5.036.exe
# Option : Scan
# Support : http://toolslib.net/forum

***** [ Services ] *****

Service Found : ReimageRealTimeProtector
Service Found : Winsere

***** [ Folders ] *****

Folder Found : C:\Program Files\DriverToolkit
Folder Found : C:\Program Files\Reimage
Folder Found : C:\Program Files\SearchesToYesbnd
Folder Found : C:\Program Files\Winsere
Folder Found : C:\Program Files\WinTaske
Folder Found : C:\ProgramData\Reimage Protector
Folder Found : C:\ProgramData\simplitec
Folder Found : C:\ProgramData\Uniblue
Folder Found : C:\ProgramData\559d147b-0d55-0
Folder Found : C:\ProgramData\559d147b-1111-0
Folder Found : C:\ProgramData\6d7664cd-5191-0
Folder Found : C:\ProgramData\6d7664cd-72c5-1
Folder Found : C:\ProgramData\{020f40ce-212c-0}
Folder Found : C:\ProgramData\{17c9f63b-612c-1}
Folder Found : C:\ProgramData\{1b130adb-312c-0}
Folder Found : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DriverToolkit
Folder Found : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\UpdateAdmin
Folder Found : C:\Users\Petr\AppData\Roaming\Mozilla\Firefox\Profiles\83jbu109.default-1453815860554\extensions\{ea614400-e918-4741-9a97-7a972ff7c30b}
Folder Found : C:\Windows\system32\Tasks\UpdateAdmin
Folder Found : C:\Windows\system32\Tasks\WinTaske

***** [ Files ] *****

File Found : C:\ProgramData\{262E20B8-6E20-4CEF-B1FD-D022AB1085F5}.dat
File Found : C:\Windows\Reimage.ini
File Found : C:\Windows\system32\lavasofttcpservice.dll

***** [ DLL ] *****

***** [ Shortcuts ] *****

Shortcut Infected : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Opera.lnk ( hxxp://www.istartsurf.com/?type=sc&ts=1 ... 9998399983 )

***** [ Scheduled tasks ] *****

Task Found : ReimageUpdater
Task Found : UpdateAdmin
Task Found : WinTaske
Task Found : ReimageUpdater

***** [ Registry ] *****

Key Found : HKCU\Software\Mozilla\Extends
Key Found : HKLM\SOFTWARE\Classes\AppID\REI_AxControl.DLL
Value Found : HKLM\SOFTWARE\Mozilla\Firefox\Extensions [defsearchp@gmail.com]
Value Found : HKLM\SOFTWARE\Mozilla\Firefox\Extensions [deskCutv2@gmail.com]
Key Found : HKLM\SOFTWARE\Classes\AppID\{28FF42B8-A0DA-4BE5-9B81-E26DD59B350A}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{02478D38-C3F9-4EFB-9B51-7695ECA05670}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{EF99BD32-C1FB-11D2-892F-0090271D4F88}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{10ECCE17-29B5-4880-A8F5-EAD298611484}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{801B440B-1EE3-49B0-B05D-2AB076D4E8CB}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{B853E835-9F24-4F4B-B55C-E554D15CCCD2}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{F83D1872-D9FF-47F8-B5A0-49CC51E24EE8}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{8BF0126F-A5B7-4720-ABB2-2414A0AF5474}
Key Found : HKLM\SOFTWARE\Classes\Interface\{22E9CC7A-04B2-4558-A993-763395274E42}
Key Found : HKLM\SOFTWARE\Classes\Interface\{9BB31AD8-5DB2-459E-A901-DEA536F23BA4}
Key Found : HKLM\SOFTWARE\Classes\Interface\{BD51A48E-EB5F-4454-8774-EF962DF64546}
Key Found : HKLM\SOFTWARE\Classes\Interface\{0FEB2313-F89B-4AC6-8153-84025604A06A}
Key Found : HKLM\SOFTWARE\Classes\Interface\{02F878DF-E2BE-4B85-8CB4-A0D2D4E2ED7F}
Key Found : HKLM\SOFTWARE\Classes\Interface\{2AF343DD-3102-4F9D-AC95-DCA4C95382C7}
Key Found : HKLM\SOFTWARE\Classes\Interface\{3137BC14-D8D7-4B67-8FFA-2E0B2E9D541B}
Key Found : HKLM\SOFTWARE\Classes\Interface\{4CA2AC92-971B-47B1-ACB6-357B552155AC}
Key Found : HKLM\SOFTWARE\Classes\Interface\{52C5395B-1FCD-47FA-A834-FD830701C2D5}
Key Found : HKLM\SOFTWARE\Classes\Interface\{5D3DCC39-9233-4330-94E9-DA92BE49CA1A}
Key Found : HKLM\SOFTWARE\Classes\Interface\{615FACDF-DADB-440D-AC91-8AAB0AE9E3AD}
Key Found : HKLM\SOFTWARE\Classes\Interface\{762D463B-C45A-456D-A80D-8689C297C91E}
Key Found : HKLM\SOFTWARE\Classes\Interface\{7A6BE473-7960-44D0-BD54-D23DA76353DF}
Key Found : HKLM\SOFTWARE\Classes\Interface\{803F550E-BAAE-42BB-8917-64BA0006AB17}
Key Found : HKLM\SOFTWARE\Classes\Interface\{8D5BC51D-C9D3-43B9-B728-B30677B7C7E8}
Key Found : HKLM\SOFTWARE\Classes\Interface\{991C9D8D-A789-4DB9-BDFC-5F33398B04BF}
Key Found : HKLM\SOFTWARE\Classes\Interface\{A5ACC874-D943-483F-A2D1-14598D51F872}
Key Found : HKLM\SOFTWARE\Classes\Interface\{B0474212-0D9D-4361-90B3-B89D1A44275D}
Key Found : HKLM\SOFTWARE\Classes\Interface\{BFDE183A-C6FE-41D2-80F9-586C29210AC2}
Key Found : HKLM\SOFTWARE\Classes\Interface\{D83C83BF-3EDD-4410-ADAB-5295116DD8C7}
Key Found : HKLM\SOFTWARE\Classes\Interface\{DD260902-9420-4055-A956-9152EB4F3E6A}
Key Found : HKLM\SOFTWARE\Classes\Interface\{EB1F9F3C-5526-4DAE-BD4B-3EAA7715DA9F}
Key Found : HKLM\SOFTWARE\Classes\Interface\{F1912128-469A-4138-AA26-9699C15BB13E}
Key Found : HKLM\SOFTWARE\Classes\Interface\{F68DC16C-9C2B-455B-8853-7E4D34BAA3F4}
Key Found : HKLM\SOFTWARE\Classes\Interface\{FBA8498F-B3A0-4942-A2BF-E0CB7BC7E000}
Key Found : HKLM\SOFTWARE\Classes\TypeLib\{506DDB16-455A-4746-AD77-D23228955FD3}
Key Found : HKLM\SOFTWARE\Classes\TypeLib\{FA6468D2-FAA4-4951-A53B-2A5CF9CC0A36}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{DEDAF650-12B8-48F5-A843-BBA100716106}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{00011268-E188-40DF-A514-835FCD78B1BF}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{EF99BD32-C1FB-11D2-892F-0090271D4F88}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{10ECCE17-29B5-4880-A8F5-EAD298611484}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{00011268-E188-40DF-A514-835FCD78B1BF}
Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{72A6AB0F-2FA8-4C73-9FCB-1E62A608F001}
Value Found : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{00011268-E188-40DF-A514-835FCD78B1BF}]
Key Found : HKCU\Software\DownloadAdmin
Key Found : HKCU\Software\DriverToolkit
Key Found : HKCU\Software\Mozilla\Extends
Key Found : HKCU\Software\PRODUCTSETUP
Key Found : HKCU\Software\Reimage
Key Found : HKCU\Software\TNT2
Key Found : HKCU\Software\Yahoo\Companion
Key Found : HKCU\Software\Yahoo\YFriendsBar
Key Found : HKCU\Software\Local AppWizard-Generated Applications\Reimage - Windows Problem Relief.
Key Found : HKLM\SOFTWARE\FFPluginHp
Key Found : HKLM\SOFTWARE\istartsurfSoftware
Key Found : HKLM\SOFTWARE\Reimage
Key Found : HKLM\SOFTWARE\simplitec
Key Found : HKLM\SOFTWARE\Uniblue
Key Found : HKLM\SOFTWARE\WdsManPro
Key Found : HKLM\SOFTWARE\Yahoo\Companion
Key Found : HKLM\SOFTWARE\yessearchesSoftware
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{D66BF89F-B0A2-48F5-A2E4-242EB645AB76}_is1
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Reimage Protector
Key Found : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{625E97B6-CC20-4160-BC1D-BC8A45D2BB1F}

***** [ Web browsers ] *****

[C:\Users\Petr\AppData\Roaming\Mozilla\Firefox\Profiles\41A66E7E5EE1\prefs.js] [Preference] Found : user_pref("browser.newtab.url", "hxxp://www.yessearches.com/?ts=AHEpB34kBnQqA0..&v=20160121&uid=978C82EA9C861FA553C4DB013E7F4D4A&ptid=cos&mode=ffseng");
[C:\Users\Petr\AppData\Roaming\Mozilla\Firefox\Profiles\41A66E7E5EE1\prefs.js] [Preference] Found : user_pref("browser.search.defaultenginename.US", "data:text/plain,browser.search.defaultenginename.US=yessearches");
[C:\Users\Petr\AppData\Roaming\Mozilla\Firefox\Profiles\41A66E7E5EE1\prefs.js] [Preference] Found : user_pref("browser.search.searchengine.hp", "hxxp://www.yessearches.com/?ts=AHEpB34kBnQqA0..&v=20160121&uid=978C82EA9C861FA553C4DB013E7F4D4A&ptid=cos&mode=ffsengext");
[C:\Users\Petr\AppData\Roaming\Mozilla\Firefox\Profiles\41A66E7E5EE1\prefs.js] [Preference] Found : user_pref("browser.search.searchengine.sp", "hxxp://www.yessearches.com/chrome.php?mode=ffsengext&ptid=cos&q={searchTerms}&ts=AHEpB34kBnQqA0..&uid=978C82EA9C861FA553C4DB013E7F4D4A&v=20160121");
[C:\Users\Petr\AppData\Roaming\Mozilla\Firefox\Profiles\41A66E7E5EE1\prefs.js] [Preference] Found : user_pref("browser.search.searchengine.url", "hxxp://www.yessearches.com/chrome.php?mode=ffsengext&ptid=cos&q={searchTerms}&ts=AHEpB34kBnQqA0..&uid=978C82EA9C861FA553C4DB013E7F4D4A&v=20160121");
[C:\Users\Petr\AppData\Roaming\Mozilla\Firefox\Profiles\41A66E7E5EE1\prefs.js] [Preference] Found : user_pref("browser.search.selectedEngine", "yessearches");
[C:\Users\Petr\AppData\Roaming\Mozilla\Firefox\Profiles\41A66E7E5EE1\prefs.js] [Preference] Found : user_pref("extensions.foxcub.prev.HP", "hxxp://www.yessearches.com/?ts=AHEpB34kBnQqA0..&v=20160121&uid=978C82EA9C861FA553C4DB013E7F4D4A&ptid=cos&mode=ffseng");
[C:\Users\Petr\AppData\Roaming\Mozilla\Firefox\Profiles\41A66E7E5EE1\prefs.js] [Preference] Found : user_pref("extensions.foxcub.prev.KWD", "hxxp://www.yessearches.com/chrome.php?uid=978C82EA9C861FA553C4DB013E7F4D4A&ptid=cos&ts=AHEpB34kBnQqA0..&v=20160121&mode=ffexttoolbar&q=");
[C:\Users\Petr\AppData\Roaming\Mozilla\Firefox\Profiles\41A66E7E5EE1\prefs.js] [Preference] Found : user_pref("extensions.mywebsearch.prevKwdEnabled", true);
[C:\Users\Petr\AppData\Roaming\Mozilla\Firefox\Profiles\41A66E7E5EE1\prefs.js] [Preference] Found : user_pref("extensions.mywebsearch.prevKwdURL", "hxxp://search.seznam.cz/?sourceid=FFListicka_14875&q=");
[C:\Users\Petr\AppData\Roaming\Mozilla\Firefox\Profiles\41A66E7E5EE1\prefs.js] [Preference] Found : user_pref("extensions.toolbar.mindspark._brMembers_.BUTTON_STRUCTURE", "[{\"b\":224520315,\"c\":\"mindspark.magnify\",\"p\":\"L.0\"},{\"b\":224520316,\"c\":\"mindspark.entersearchterms\",\"p\":\"L.0.0[...]
[C:\Users\Petr\AppData\Roaming\Mozilla\Firefox\Profiles\41A66E7E5EE1\prefs.js] [Preference] Found : user_pref("extensions.toolbar.mindspark._brMembers_.browser.version.last", "43.0");
[C:\Users\Petr\AppData\Roaming\Mozilla\Firefox\Profiles\41A66E7E5EE1\prefs.js] [Preference] Found : user_pref("extensions.toolbar.mindspark._brMembers_.firstKnownVersion", "7.38.8.45986");
[C:\Users\Petr\AppData\Roaming\Mozilla\Firefox\Profiles\41A66E7E5EE1\prefs.js] [Preference] Found : user_pref("extensions.toolbar.mindspark._brMembers_.homepage", "/index.jhtml?n=7829ead5");
[C:\Users\Petr\AppData\Roaming\Mozilla\Firefox\Profiles\41A66E7E5EE1\prefs.js] [Preference] Found : user_pref("extensions.toolbar.mindspark._brMembers_.hp.enabled", true);
[C:\Users\Petr\AppData\Roaming\Mozilla\Firefox\Profiles\41A66E7E5EE1\prefs.js] [Preference] Found : user_pref("extensions.toolbar.mindspark._brMembers_.hp.guardType", "HPR");
[C:\Users\Petr\AppData\Roaming\Mozilla\Firefox\Profiles\41A66E7E5EE1\prefs.js] [Preference] Found : user_pref("extensions.toolbar.mindspark._brMembers_.initialized", true);
[C:\Users\Petr\AppData\Roaming\Mozilla\Firefox\Profiles\41A66E7E5EE1\prefs.js] [Preference] Found : user_pref("extensions.toolbar.mindspark._brMembers_.installation.installDate", "2016013013");
[C:\Users\Petr\AppData\Roaming\Mozilla\Firefox\Profiles\41A66E7E5EE1\prefs.js] [Preference] Found : user_pref("extensions.toolbar.mindspark._brMembers_.installation.success", true);
[C:\Users\Petr\AppData\Roaming\Mozilla\Firefox\Profiles\41A66E7E5EE1\prefs.js] [Preference] Found : user_pref("extensions.toolbar.mindspark._brMembers_.lastActivePing", "1454157623060");
[C:\Users\Petr\AppData\Roaming\Mozilla\Firefox\Profiles\41A66E7E5EE1\prefs.js] [Preference] Found : user_pref("extensions.toolbar.mindspark._brMembers_.lastKnownVersion", "7.38.8.45986");
[C:\Users\Petr\AppData\Roaming\Mozilla\Firefox\Profiles\41A66E7E5EE1\prefs.js] [Preference] Found : user_pref("extensions.toolbar.mindspark._brMembers_.lssState", "{\"previousLocales\":[\"cs\",\"en-US\",\"en\"],\"supportedLocales\":[\"de\",\"es\",\"pt\",\"ja\",\"en\"],\"defaultLocale\":\"en\",\"supp[...]
[C:\Users\Petr\AppData\Roaming\Mozilla\Firefox\Profiles\41A66E7E5EE1\prefs.js] [Preference] Found : user_pref("extensions.toolbar.mindspark._brMembers_.options.defaultSearch", false);
[C:\Users\Petr\AppData\Roaming\Mozilla\Firefox\Profiles\41A66E7E5EE1\prefs.js] [Preference] Found : user_pref("extensions.toolbar.mindspark._brMembers_.options.homePageEnabled", false);
[C:\Users\Petr\AppData\Roaming\Mozilla\Firefox\Profiles\41A66E7E5EE1\prefs.js] [Preference] Found : user_pref("extensions.toolbar.mindspark._brMembers_.options.keywordEnabled", true);
[C:\Users\Petr\AppData\Roaming\Mozilla\Firefox\Profiles\41A66E7E5EE1\prefs.js] [Preference] Found : user_pref("extensions.toolbar.mindspark._brMembers_.options.tabEnabled", false);
[C:\Users\Petr\AppData\Roaming\Mozilla\Firefox\Profiles\41A66E7E5EE1\prefs.js] [Preference] Found : user_pref("extensions.toolbar.mindspark._brMembers_.productDeliveryOption.language", "en");
[C:\Users\Petr\AppData\Roaming\Mozilla\Firefox\Profiles\41A66E7E5EE1\prefs.js] [Preference] Found : user_pref("extensions.toolbar.mindspark._brMembers_.productDeliveryOption.type", "Toolbar");
[C:\Users\Petr\AppData\Roaming\Mozilla\Firefox\Profiles\41A66E7E5EE1\prefs.js] [Preference] Found : user_pref("extensions.toolbar.mindspark._brMembers_.successUrl", "hxxp://www.yessearches.com/chrome.php?uid=978C82EA9C861FA553C4DB013E7F4D4A&ptid=cos&ts=AHEpB34kBnQqA0..&v=20160121&mode=ffexttoolbar&q[...]
[C:\Users\Petr\AppData\Roaming\Mozilla\Firefox\Profiles\41A66E7E5EE1\prefs.js] [Preference] Found : user_pref("extensions.toolbar.mindspark._brMembers_.toolbarCollapsed", true);
[C:\Users\Petr\AppData\Roaming\Mozilla\Firefox\Profiles\41A66E7E5EE1\prefs.js] [Preference] Found : user_pref("extensions.toolbar.mindspark._brMembers_.uninstallTasks", "{\"prefBranchesToDelete\":[\"extensions.toolbar.mindspark._brMembers_.\"],\"filesToDelete\":[\"C:\\\\Users\\\\Petr\\\\AppData\\\\R[...]
[C:\Users\Petr\AppData\Roaming\Mozilla\Firefox\Profiles\41A66E7E5EE1\prefs.js] [Preference] Found : user_pref("extensions.toolbar.mindspark.hp.enabled", true);
[C:\Users\Petr\AppData\Roaming\Mozilla\Firefox\Profiles\41A66E7E5EE1\prefs.js] [Preference] Found : user_pref("extensions.toolbar.mindspark.hp.enabled.guid", "yourGSearchfinder@GSearch.com");
[C:\Users\Petr\AppData\Roaming\Mozilla\Firefox\Profiles\41A66E7E5EE1\prefs.js] [Preference] Found : user_pref("extensions.toolbar.mindspark.lastInstalled", "yourGSearchfinder@GSearch.com");
[C:\Users\Petr\AppData\Roaming\Mozilla\Firefox\Profiles\41A66E7E5EE1\prefs.js] [Preference] Found : user_pref("keyword.URL", "hxxp://www.yessearches.com/chrome.php?uid=978C82EA9C861FA553C4DB013E7F4D4A&ptid=cos&ts=AHEpB34kBnQqA0..&v=20160121&mode=ffexttoolbar&q=");
[C:\Users\Petr\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\prefs.js] [Preference] Found : user_pref("browser.newtab.url", "hxxp://www.yessearches.com/?ts=AHEpB34kBnQqA0..&v=20160121&uid=978C82EA9C861FA553C4DB013E7F4D4A&ptid=cos&mode=ffseng");
[C:\Users\Petr\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\prefs.js] [Preference] Found : user_pref("browser.search.defaultenginename.US", "data:text/plain,browser.search.defaultenginename.US=yessearches");
[C:\Users\Petr\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\prefs.js] [Preference] Found : user_pref("browser.search.searchengine.hp", "hxxp://www.yessearches.com/?ts=AHEpB34kBnQqA0..&v=20160121&uid=978C82EA9C861FA553C4DB013E7F4D4A&ptid=cos&mode=ffsengext");
[C:\Users\Petr\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\prefs.js] [Preference] Found : user_pref("browser.search.searchengine.sp", "hxxp://www.yessearches.com/chrome.php?mode=ffsengext&ptid=cos&q={searchTerms}&ts=AHEpB34kBnQqA0..&uid=978C82EA9C861FA553C4DB013E7F4D4A&v=20160121");
[C:\Users\Petr\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\prefs.js] [Preference] Found : user_pref("browser.search.searchengine.url", "hxxp://www.yessearches.com/chrome.php?mode=ffsengext&ptid=cos&q={searchTerms}&ts=AHEpB34kBnQqA0..&uid=978C82EA9C861FA553C4DB013E7F4D4A&v=20160121");
[C:\Users\Petr\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\prefs.js] [Preference] Found : user_pref("browser.search.selectedEngine", "yessearches");
[C:\Users\Petr\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\prefs.js] [Preference] Found : user_pref("extensions.mywebsearch.prevKwdEnabled", true);
[C:\Users\Petr\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\prefs.js] [Preference] Found : user_pref("extensions.toolbar.mindspark._brMembers_.BUTTON_STRUCTURE", "[{\"b\":224520315,\"c\":\"mindspark.magnify\",\"p\":\"L.0\"},{\"b\":224520316,\"c\":\"mindspark.entersearchterms\",\"p\":\"L.0.0[...]
[C:\Users\Petr\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\prefs.js] [Preference] Found : user_pref("extensions.toolbar.mindspark._brMembers_.browser.version.last", "43.0");
[C:\Users\Petr\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\prefs.js] [Preference] Found : user_pref("extensions.toolbar.mindspark._brMembers_.firstKnownVersion", "7.38.8.45986");
[C:\Users\Petr\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\prefs.js] [Preference] Found : user_pref("extensions.toolbar.mindspark._brMembers_.homepage", "/index.jhtml?n=7829eac8");
[C:\Users\Petr\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\prefs.js] [Preference] Found : user_pref("extensions.toolbar.mindspark._brMembers_.hp.enabled", true);
[C:\Users\Petr\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\prefs.js] [Preference] Found : user_pref("extensions.toolbar.mindspark._brMembers_.hp.guardType", "HPR");
[C:\Users\Petr\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\prefs.js] [Preference] Found : user_pref("extensions.toolbar.mindspark._brMembers_.initialized", true);
[C:\Users\Petr\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\prefs.js] [Preference] Found : user_pref("extensions.toolbar.mindspark._brMembers_.installation.installDate", "2016013000");
[C:\Users\Petr\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\prefs.js] [Preference] Found : user_pref("extensions.toolbar.mindspark._brMembers_.installation.success", true);
[C:\Users\Petr\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\prefs.js] [Preference] Found : user_pref("extensions.toolbar.mindspark._brMembers_.lastActivePing", "1454157238334");
[C:\Users\Petr\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\prefs.js] [Preference] Found : user_pref("extensions.toolbar.mindspark._brMembers_.lastKnownVersion", "7.38.8.45986");
[C:\Users\Petr\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\prefs.js] [Preference] Found : user_pref("extensions.toolbar.mindspark._brMembers_.lssState", "{\"previousLocales\":[\"cs\",\"en-US\",\"en\"],\"supportedLocales\":[\"de\",\"es\",\"pt\",\"ja\",\"en\"],\"defaultLocale\":\"en\",\"supp[...]
[C:\Users\Petr\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\prefs.js] [Preference] Found : user_pref("extensions.toolbar.mindspark._brMembers_.options.defaultSearch", false);
[C:\Users\Petr\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\prefs.js] [Preference] Found : user_pref("extensions.toolbar.mindspark._brMembers_.options.homePageEnabled", false);
[C:\Users\Petr\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\prefs.js] [Preference] Found : user_pref("extensions.toolbar.mindspark._brMembers_.options.keywordEnabled", true);
[C:\Users\Petr\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\prefs.js] [Preference] Found : user_pref("extensions.toolbar.mindspark._brMembers_.options.tabEnabled", false);
[C:\Users\Petr\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\prefs.js] [Preference] Found : user_pref("extensions.toolbar.mindspark._brMembers_.productDeliveryOption.language", "en");
[C:\Users\Petr\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\prefs.js] [Preference] Found : user_pref("extensions.toolbar.mindspark._brMembers_.productDeliveryOption.type", "Toolbar");
[C:\Users\Petr\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\prefs.js] [Preference] Found : user_pref("extensions.toolbar.mindspark._brMembers_.successUrl", "hxxp://www.yessearches.com/chrome.php?uid=978C82EA9C861FA553C4DB013E7F4D4A&ptid=cos&ts=AHEpB34kBnQqA0..&v=20160121&mode=ffexttoolbar&q[...]
[C:\Users\Petr\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\prefs.js] [Preference] Found : user_pref("extensions.toolbar.mindspark._brMembers_.toolbarCollapsed", true);
[C:\Users\Petr\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\prefs.js] [Preference] Found : user_pref("extensions.toolbar.mindspark._brMembers_.uninstallTasks", "{\"prefBranchesToDelete\":[\"extensions.toolbar.mindspark._brMembers_.\"],\"filesToDelete\":[\"C:\\\\Users\\\\Petr\\\\AppData\\\\R[...]
[C:\Users\Petr\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\prefs.js] [Preference] Found : user_pref("extensions.toolbar.mindspark.hp.enabled", true);
[C:\Users\Petr\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\prefs.js] [Preference] Found : user_pref("extensions.toolbar.mindspark.hp.enabled.guid", "yourGSearchfinder@GSearch.com");
[C:\Users\Petr\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\prefs.js] [Preference] Found : user_pref("extensions.toolbar.mindspark.lastInstalled", "yourGSearchfinder@GSearch.com");
[C:\Users\Petr\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\prefs.js] [Preference] Found : user_pref("keyword.URL", "hxxp://www.yessearches.com/chrome.php?uid=978C82EA9C861FA553C4DB013E7F4D4A&ptid=cos&ts=AHEpB34kBnQqA0..&v=20160121&mode=ffexttoolbar&q=");

*************************

C:\AdwCleaner\AdwCleaner[S1].txt - [22482 bytes] - [23/02/2016 13:53:24]

########## EOF - C:\AdwCleaner\AdwCleaner[S1].txt - [22556 bytes] ##########

Příspěvekod **Pic** » 23 úno 2016 14:09

Malwarebytes Anti-Malware
www.malwarebytes.org

Datum skenování: 23.2.2016
Čas skenování: 14:03
Protokol:
Správce: Ano

Verze: 2.2.0.1024
Databáze malwaru: v2016.02.23.03
Databáze rootkitů: v2016.02.17.01
Licence: Bezplatná verze
Ochrana proti malwaru: Vypnuto
Ochrana proti škodlivým webovým stránkám: Vypnuto
Ochrana programu: Vypnuto

OS: Windows 7 Service Pack 1
CPU: x86
Souborový systém: NTFS
Uživatel: Petr

Typ skenu: Sken hrozeb
Výsledek: Dokončeno
Prohledaných objektů: 345352
Uplynulý čas: 4 min, 1 sek

Paměť: Zapnuto
Po spuštění: Zapnuto
Souborový systém: Zapnuto
Archivy: Zapnuto
Rootkity: Vypnuto
Heuristika: Zapnuto
PUP: Zapnuto
PUM: Zapnuto

Procesy: 0
(Nenalezeny žádné škodlivé položky)

Moduly: 0
(Nenalezeny žádné škodlivé položky)

Klíče registru: 31
PUP.Optional.YesSearches, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\Winsere, , [e9366ef6d8c1ff37acf5b733728f966a],
PUP.Optional.Yontoo, HKLM\SOFTWARE\CLASSES\CLSID\{B853E835-9F24-4F4B-B55C-E554D15CCCD2}, , [2ef171f3514891a545ff1c6406fc7c84],
PUP.Optional.Yontoo, HKLM\SOFTWARE\CLASSES\CLSID\{F83D1872-D9FF-47F8-B5A0-49CC51E24EE8}, , [44dbef75edac77bf8cbc136d57abf20e],
PUP.Optional.FindWide, HKU\S-1-5-21-2865040539-3082706522-2485382742-1003_Classes\CLSID\{0FEB2313-F89B-4AC6-8153-84025604A06A}, , [1f00e87c6336d066ca3206a461a102fe],
PUP.Optional.FindWide, HKLM\SOFTWARE\CLASSES\INTERFACE\{0FEB2313-F89B-4AC6-8153-84025604A06A}, , [1f00e87c6336d066ca3206a461a102fe],
PUP.Optional.FindWide, HKU\S-1-5-21-2865040539-3082706522-2485382742-1003_Classes\INTERFACE\{0FEB2313-F89B-4AC6-8153-84025604A06A}, , [1f00e87c6336d066ca3206a461a102fe],
PUP.Optional.FindWide, HKU\S-1-5-21-2865040539-3082706522-2485382742-1003_Classes\CLSID\{554EBE31-AEC1-4E34-BCE3-606467760D88}, , [60bf9fc5eaafa98d19e4eebc936fe41c],
PUP.Optional.SweetIM, HKU\S-1-5-21-2865040539-3082706522-2485382742-1001\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{DEDAF650-12B8-48F5-A843-BBA100716106}, , [98876ff50d8c5dd9e51764441ee4a25e],
PUP.Optional.TidyNetwork, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\ELEVATIONPOLICY\{72A6AB0F-2FA8-4C73-9FCB-1E62A608F001}, , [a976d58f4e4b56e03be9ebbe0cf613ed],
PUP.Optional.FFPluginHp, HKLM\SOFTWARE\FFPluginHp, , [ff204321e9b0a492d1041bd1f70c6898],
PUP.Optional.IStartSurf.ShrtCln, HKLM\SOFTWARE\istartsurfSoftware, , [20ffdd87c3d6b87ed655f55141c3827e],
PUP.Optional.WdsManPro, HKLM\SOFTWARE\WdsManPro, , [f02fafb5bcddbc7ae8445bc320e48e72],
PUP.Optional.YesSearches, HKLM\SOFTWARE\yessearchesSoftware, , [24fb046078215fd7b92fe27d2cd8c040],
PUP.Optional.eShield, HKLM\SOFTWARE\GOOGLE\CHROME\EXTENSIONS\dkmjljdbbgogihjcapfhgkonfmccbffp, , [031c2d37435683b3a7f0a843a063b848],
PUP.Optional.eShield, HKLM\SOFTWARE\GOOGLE\CHROME\NATIVEMESSAGINGHOSTS\com.eshield.extension_host, , [8b946afa9108f83ea386a1a59b690ff1],
PUP.Optional.TidyNetwork, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\DRAGDROP\{70BC1CDB-0744-4172-BDA0-B5A487D00C3A}, , [da4514500d8ca39348dc947e24e0f808],
PUP.Optional.PCSpeedUp, HKLM\SOFTWARE\MICROSOFT\TRACING\PCSUSpeedTest_RASAPI32, , [64bb501427727fb73cb9021ee71d857b],
PUP.Optional.PCSpeedUp, HKLM\SOFTWARE\MICROSOFT\TRACING\PCSUSpeedTest_RASMANCS, , [c25da6be2574b0866e87021eed17ed13],
PUP.Optional.UpdateAdmin, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{952B0523-0121-434D-BEE8-10AD8AAE87DA}, , [0817afb5702900367415d198976d48b8],
PUP.Optional.UpdateAdmin, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TREE\UpdateAdmin, , [9d82c3a11f7a0d29699c957f9d67837d],
PUP.Optional.WinTaske, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TREE\WinTaske, , [64bb8adaa1f8ac8a4ad7fb6a19ebcc34],
PUP.Optional.UpdateAdmin, HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{81F17B54-5D57-485E-88CC-F6D20D66B5E0}, , [958a3e26b1e8d95d877ff024ca3a8e72],
PUP.Optional.YesSearches, HKLM\SOFTWARE\MOZILLA\FIREFOX\{EB52F1AB-3C2B-424F-9794-833C687025CF}, , [50cfd0943564999d1214b44851b1aa56],
PUP.Optional.WindowsProtectionManager, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\EVENTLOG\APPLICATION\WdsManPro, , [46d9bfa5198068cecef8a659fd058e72],
PUP.Optional.TNT, HKU\S-1-5-21-2865040539-3082706522-2485382742-1001\SOFTWARE\TNT2, , [8897df85e6b33bfb55f1d63c877d9967],
PUP.Optional.UpdateAdmin, HKU\S-1-5-21-2865040539-3082706522-2485382742-1001\SOFTWARE\DOWNLOADADMIN\UpdateAdmin, , [73ac273d613872c4af54e133cc3854ac],
PUP.Optional.TNT, HKU\S-1-5-21-2865040539-3082706522-2485382742-1001\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{625E97B6-CC20-4160-BC1D-BC8A45D2BB1F}, , [3ee173f14e4b46f05ee78092e51f7789],
PUP.Optional.TNT, HKU\S-1-5-21-2865040539-3082706522-2485382742-1001\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{C0C3A6C6-03BC-4195-8FCB-AEA091301353}, , [d54ab3b18118ab8b74d1090936ce8c74],
PUP.Optional.DeskCut, HKU\S-1-5-21-2865040539-3082706522-2485382742-1001\SOFTWARE\MOZILLA\EXTENDS, , [c35ce0845c3db48216a316d2a3609a66],
PUP.Optional.YesSearches, HKU\S-1-5-21-2865040539-3082706522-2485382742-1001\SOFTWARE\MOZILLA\FIREFOX\{EB52F1AB-3C2B-424F-9794-833C687025CF}, , [72ad263efe9b49edee341a4b8084c13f],
PUP.Optional.OneSystemCare, HKU\S-1-5-21-2865040539-3082706522-2485382742-1003\SOFTWARE\ONE SYSTEM CARE, , [2ef192d23762be78201bc73905ff956b],

Hodnoty registru: 23
PUP.Optional.UpdateAdmin, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{952B0523-0121-434D-BEE8-10AD8AAE87DA}|Path, \UpdateAdmin, , [0817afb5702900367415d198976d48b8]
PUP.Optional.UpdateAdmin, HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{81F17B54-5D57-485E-88CC-F6D20D66B5E0}|Publisher, DownloadAdmin, , [958a3e26b1e8d95d877ff024ca3a8e72]
PUP.Optional.DefaultSearchProtected, HKLM\SOFTWARE\MOZILLA\FIREFOX\EXTENSIONS|defsearchp@gmail.com, C:\Users\Petr\AppData\Roaming\Mozilla\Firefox\Profiles\qx5muqms.default\extensions\defsearchp@gmail.com, , [44dbfc68c5d4c571d0b88662bd46ae52]
PUP.Optional.DeskCut, HKLM\SOFTWARE\MOZILLA\FIREFOX\EXTENSIONS|deskCutv2@gmail.com, C:\Users\Petr\AppData\Roaming\Mozilla\Firefox\Profiles\qx5muqms.default\extensions\deskCutv2@gmail.com, , [c55a3c28445554e28b2fc820e41f2ad6]
PUP.Optional.YesSearches, HKLM\SOFTWARE\MOZILLA\FIREFOX\{EB52F1AB-3C2B-424F-9794-833C687025CF}|hp, http://www.yessearches.com/?ts=AHEpB34k ... =ffsengext, , [50cfd0943564999d1214b44851b1aa56]
PUP.Optional.YesSearches, HKLM\SOFTWARE\MOZILLA\FIREFOX\{EB52F1AB-3C2B-424F-9794-833C687025CF}|tab, http://www.yessearches.com/?ts=AHEpB34k ... =ffsengext, , [f827f0749ffadd5933f337c5b15160a0]
PUP.Optional.YesSearches, HKLM\SOFTWARE\MOZILLA\FIREFOX\{EB52F1AB-3C2B-424F-9794-833C687025CF}|sp, http://www.yessearches.com/chrome.php?u ... tid=cos&q={searchTerms}&ts=AHEpB34kBnQqA0..&v=20160121&mode=ffsengext, , [28f7065eeeab3303f630cf2d828049b7]
PUP.Optional.YesSearches, HKLM\SOFTWARE\MOZILLA\FIREFOX\{EB52F1AB-3C2B-424F-9794-833C687025CF}|surl, http://www.yessearches.com/chrome.php?u ... toolbar&q=, , [0916451f9cfd39fd3de9ce2e659dca36]
PUP.Optional.Winsere, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\WINSERE|ImagePath, "C:\Program Files\Winsere\Winsere\Winsere.exe" {79740E79-A383-47A7-B513-3DF6563D007F} {A16B1AF7-982D-40C3-B5C1-633E1A6A6678}, , [110ec89c5d3c5bdb9ad706f659a95ea2]
PUP.Optional.OneSystemCare, HKU\S-1-5-21-2865040539-3082706522-2485382742-1001\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN\FEATURECONTROL\FEATURE_BROWSER_EMULATION|SystemCash.exe, 11000, , [a37ceb79b4e540f642d806567a8ad22e]
PUP.Optional.TNT, HKU\S-1-5-21-2865040539-3082706522-2485382742-1001\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{625E97B6-CC20-4160-BC1D-BC8A45D2BB1F}|OSDFileURL, file:///C:/Users/Petr/AppData/Local/TNT2/Profiles/11467/os11467.xml, , [3ee173f14e4b46f05ee78092e51f7789]
PUP.Optional.TNT, HKU\S-1-5-21-2865040539-3082706522-2485382742-1001\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{625E97B6-CC20-4160-BC1D-BC8A45D2BB1F}|FaviconURL, http://mirror.mirror-files.com/tnt2/109 ... eld_16.ico, , [75aaca9a2c6d72c49ca9f41e34d058a8]
PUP.Optional.eShield, HKU\S-1-5-21-2865040539-3082706522-2485382742-1001\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{625E97B6-CC20-4160-BC1D-BC8A45D2BB1F}|URL, http://search.eshield.com/serp?guid={4D3E4101-992D-480C-9F36-33059D95E91C}&action=default_search&k={searchTerms}, , [a07f8dd7336611254353c42750b34eb2]
PUP.Optional.TNT, HKU\S-1-5-21-2865040539-3082706522-2485382742-1001\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{C0C3A6C6-03BC-4195-8FCB-AEA091301353}|FaviconURL, http://mirror.mirror-files.com/tnt2/1/Y1404.ico, , [d54ab3b18118ab8b74d1090936ce8c74]
PUP.Optional.TNT, HKU\S-1-5-21-2865040539-3082706522-2485382742-1001\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{C0C3A6C6-03BC-4195-8FCB-AEA091301353}|OSDFileURL, file:///C:/Users/Petr/AppData/Local/TNT2/Profiles/11467/yah11467.xml, , [9689b4b0f8a1dd593a0b021036ce6f91]
PUP.Optional.DeskCut, HKU\S-1-5-21-2865040539-3082706522-2485382742-1001\SOFTWARE\MOZILLA\EXTENDS|appid, deskCutv2@gmail.com, , [c35ce0845c3db48216a316d2a3609a66]
PUP.Optional.YesSearches, HKU\S-1-5-21-2865040539-3082706522-2485382742-1001\SOFTWARE\MOZILLA\FIREFOX\{EB52F1AB-3C2B-424F-9794-833C687025CF}|hp, http://www.yessearches.com/?ts=AHEpB34k ... =ffsengext, , [72ad263efe9b49edee341a4b8084c13f]
PUP.Optional.YesSearches, HKU\S-1-5-21-2865040539-3082706522-2485382742-1001\SOFTWARE\MOZILLA\FIREFOX\{EB52F1AB-3C2B-424F-9794-833C687025CF}|tab, http://www.yessearches.com/?ts=AHEpB34k ... =ffsengext, , [7aa593d11485df570a18b7aea2628d73]
PUP.Optional.YesSearches, HKU\S-1-5-21-2865040539-3082706522-2485382742-1001\SOFTWARE\MOZILLA\FIREFOX\{EB52F1AB-3C2B-424F-9794-833C687025CF}|sp, http://www.yessearches.com/chrome.php?u ... tid=cos&q={searchTerms}&ts=AHEpB34kBnQqA0..&v=20160121&mode=ffsengext, , [57c81c483a5fe74fc45e66ffe91b5fa1]
PUP.Optional.YesSearches, HKU\S-1-5-21-2865040539-3082706522-2485382742-1001\SOFTWARE\MOZILLA\FIREFOX\{EB52F1AB-3C2B-424F-9794-833C687025CF}|surl, http://www.yessearches.com/chrome.php?u ... toolbar&q=, , [e639481c1b7eb383ce543431cd375ca4]
PUP.Optional.OneSystemCare, HKU\S-1-5-21-2865040539-3082706522-2485382742-1003\SOFTWARE\ONE SYSTEM CARE|OSID, 6.1, , [2ef192d23762be78201bc73905ff956b]
PUP.Optional.OneSystemCare, HKU\S-1-5-21-2865040539-3082706522-2485382742-1003\SOFTWARE\ONE SYSTEM CARE|AdvertsLink1, http://dl.softservers.net/121002110/DriverPro.exe, , [a47bc89c15845ed851e9c53bae567987]
PUP.Optional.OneSystemCare, HKU\S-1-5-21-2865040539-3082706522-2485382742-1003\SOFTWARE\ONE SYSTEM CARE|AdvertsLink2, http://dl.softservers.net/171002110/LiveSupport.exe, , [79a6ec78badf47ef47f32dd36d97718f]

Data registru: 0
(Nenalezeny žádné škodlivé položky)

Složky: 8
PUP.Optional.WinTaske, C:\Program Files\WinTaske\WinTaske, , [43dcd2925f3ab68066bf4ab227db966a],
PUP.Optional.WinTaske, C:\Program Files\WinTaske, , [43dcd2925f3ab68066bf4ab227db966a],
PUP.Optional.UpdateAdmin, C:\ProgramData\Microsoft\Windows\Start Menu\Programs\UpdateAdmin, , [a37c3a2a277279bd9a65a3704db7847c],
PUP.Optional.UpdateAdmin, C:\Windows\Installer\{81F17B54-5D57-485E-88CC-F6D20D66B5E0}, , [b56aea7a4e4b6ccaccafcc8c030141bf],
PUP.Optional.YesSearches, C:\Program Files\SearchesToYesbnd, , [25faa9bb9900280e2955e811a16104fc],
PUP.Optional.YesSearches, C:\Program Files\SearchesToYesbnd\dmp, , [25faa9bb9900280e2955e811a16104fc],
PUP.Optional.YesSearches, C:\Program Files\SearchesToYesbnd\dmp\Winsere.exe, , [25faa9bb9900280e2955e811a16104fc],
PUP.Optional.YesSearches, C:\Program Files\SearchesToYesbnd\dmp\WinTaske.exe, , [25faa9bb9900280e2955e811a16104fc],

Soubory: 12
PUP.Optional.YesSearches, C:\Program Files\Winsere\Winsere\Winsere.exe, , [e9366ef6d8c1ff37acf5b733728f966a],
PUP.Optional.WinTaske, C:\Program Files\WinTaske\WinTaske\WinTaske.exe, , [43dcd2925f3ab68066bf4ab227db966a],
PUP.Optional.UpdateAdmin, C:\ProgramData\Microsoft\Windows\Start Menu\Programs\UpdateAdmin\UpdateAdmin.lnk, , [a37c3a2a277279bd9a65a3704db7847c],
PUP.Optional.UpdateAdmin, C:\Windows\System32\Tasks\UpdateAdmin, , [59c6a0c4772248eed030fc1839cbef11],
PUP.Optional.UpdateAdmin, C:\Windows\Installer\{81F17B54-5D57-485E-88CC-F6D20D66B5E0}\icon.ico, , [b56aea7a4e4b6ccaccafcc8c030141bf],
PUP.Optional.WinTaske, C:\Windows\System32\Tasks\WinTaske, , [fb2400644f4ad85e2bf4fd68996b3bc5],
PUP.Optional.YesSearches, C:\Users\Petr\AppData\Roaming\Mozilla\Firefox\Profiles\41A66E7E5EE1\prefs.js, Dobré: (), Špatné: (user_pref("keyword.URL", "http://www.yessearches.com/chrome.php?uid=978C82EA9C861FA553C4DB013E7F4D4A&ptid=cos&ts=AHEpB34kBnQqA0..&v=20160121&mode=ffexttoolbar&q=");), ,[8d92c89c4f4a6acce9760a16cc391ae6]
PUP.Optional.YesSearches, C:\Users\Petr\AppData\Roaming\Mozilla\Firefox\Profiles\41A66E7E5EE1\prefs.js, Dobré: (), Špatné: (user_pref("browser.newtab.url", "http://www.yessearches.com/?ts=AHEpB34kBnQqA0..&v=20160121&uid=978C82EA9C861FA553C4DB013E7F4D4A&ptid=cos&mode=ffseng");), ,[1c035c08f6a3df573545ba6634d103fd]
PUP.Optional.YesSearches, C:\Users\Petr\AppData\Roaming\Mozilla\Firefox\Profiles\41A66E7E5EE1\prefs.js, Dobré: (), Špatné: (user_pref("browser.search.searchengine.url", "http://www.yessearches.com/chrome.php?mode=ffsengext&ptid=cos&q={searchTerms}&ts=AHEpB34kBnQqA0..&uid=978C82EA9C861FA553C4DB013E7F4D4A&v=20160121");), ,[c65983e1e6b31d1997e4b66a689dbb45]
PUP.Optional.YesSearches, C:\Users\Petr\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\prefs.js, Dobré: (), Špatné: (user_pref("keyword.URL", "http://www.yessearches.com/chrome.php?uid=978C82EA9C861FA553C4DB013E7F4D4A&ptid=cos&ts=AHEpB34kBnQqA0..&v=20160121&mode=ffexttoolbar&q=");), ,[47d869fbd1c8c76f2d322ff18d78c23e]
PUP.Optional.YesSearches, C:\Users\Petr\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\prefs.js, Dobré: (), Špatné: (user_pref("browser.newtab.url", "http://www.yessearches.com/?ts=AHEpB34kBnQqA0..&v=20160121&uid=978C82EA9C861FA553C4DB013E7F4D4A&ptid=cos&mode=ffseng");), ,[938c22426237f442dd9d5ac64abb18e8]
PUP.Optional.YesSearches, C:\Users\Petr\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\prefs.js, Dobré: (), Špatné: (user_pref("browser.search.searchengine.url", "http://www.yessearches.com/chrome.php?mode=ffsengext&ptid=cos&q={searchTerms}&ts=AHEpB34kBnQqA0..&uid=978C82EA9C861FA553C4DB013E7F4D4A&v=20160121");), ,[d24d3b29a8f1280ea9d269b7f114ac54]

Fyzické sektory: 0
(Nenalezeny žádné škodlivé položky)

(end)

Příspěvekod **jaro3** » 23 úno 2016 17:18

Spusť znovu AdwCleaner (u Windows Vista či Windows7, klikni na AdwCleaner pravým a vyber „Spustit jako správce“
klikni na „Prohledat-Scan“, po prohledání klikni na „ Cleaning (Vymazat)“

Program provede opravu, po automatickém restartu neukáže log (C:\AdwCleaner [C?].txt) , jeho obsah sem celý vlož.

Stáhni si Junkware Removal Tool by Thisisu
http://www.bleepingcomputer.com/downloa ... oval-tool/
na svojí plochu.

Deaktivuj si svůj antivirový program. Pravým tl. myši klikni na JRT.exe a vyber „spustit jako správce“. Pro pokračování budeš vyzván ke stisknutí jakékoliv klávesy. Na nějakou klikni.
Začne skenování programu. Skenování může trvat dloho , podle množství nákaz. Po ukončení skenu se objeví log (JRT.txt) , který se uloží na ploše.
Zkopíruj sem prosím celý jeho obsah.

. spusť znovu Malwarebytes' Anti-Malware a dej Skenovat nyní
- po proběhnutí programu se ti objeví hláška tak klikni na „Vše do karantény(smazat vybrané)“ a na „Exportovat záznam“ a vyber „textový soubor“ , soubor nějak pojmenuj a někam ho ulož. Zkopíruj se celý obsah toho logu.

Stáhni si RogueKiller by Adlice Software
32bit.:
http://www.sur-la-toile.com/RogueKiller/RogueKiller.exe
64bit.:
http://www.sur-la-toile.com/RogueKiller ... lerX64.exe
na svojí plochu.
- Zavři všechny ostatní programy a prohlížeče.
- Pro OS Vista a win7 spusť program RogueKiller.exe jako správce , u XP poklepáním.
- počkej až skončí Prescan -vyhledávání škodlivých procesů.
-Potom klikni na „Prohledat“.
- Program skenuje procesy PC. Po proskenování klikni na „Zpráva“ , v okně na pak na „Open TXT“ a celý obsah logu sem zkopíruj.
Pokud je program blokován , zkus ho spustit několikrát. Pokud dále program nepůjde spustit a pracovat, přejmenuj ho na winlogon.exe.

Příspěvekod **Pic** » 23 úno 2016 18:00

# AdwCleaner v5.036 - Logfile created 23/02/2016 at 17:56:19
# Updated 22/02/2016 by Xplode
# Database : 2016-02-22.2 [Server]
# Operating system : Windows 7 Professional Service Pack 1 (x86)
# Username : Petr - PETR-PC
# Running from : D:\Stah\adwcleaner_5.036.exe
# Option : Cleaning
# Support : http://toolslib.net/forum

***** [ Services ] *****

[-] Service Deleted : ReimageRealTimeProtector
[-] Service Deleted : Winsere

***** [ Folders ] *****

[-] Folder Deleted : C:\Program Files\DriverToolkit
[-] Folder Deleted : C:\Program Files\Reimage
[-] Folder Deleted : C:\Program Files\SearchesToYesbnd
[-] Folder Deleted : C:\Program Files\Winsere
[-] Folder Deleted : C:\Program Files\WinTaske
[-] Folder Deleted : C:\ProgramData\Reimage Protector
[-] Folder Deleted : C:\ProgramData\simplitec
[-] Folder Deleted : C:\ProgramData\Uniblue
[-] Folder Deleted : C:\ProgramData\559d147b-0d55-0
[-] Folder Deleted : C:\ProgramData\559d147b-1111-0
[-] Folder Deleted : C:\ProgramData\6d7664cd-5191-0
[-] Folder Deleted : C:\ProgramData\6d7664cd-72c5-1
[-] Folder Deleted : C:\ProgramData\{020f40ce-212c-0}
[-] Folder Deleted : C:\ProgramData\{17c9f63b-612c-1}
[-] Folder Deleted : C:\ProgramData\{1b130adb-312c-0}
[-] Folder Deleted : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DriverToolkit
[-] Folder Deleted : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\UpdateAdmin
[-] Folder Deleted : C:\Users\Petr\AppData\Roaming\Mozilla\Firefox\Profiles\83jbu109.default-1453815860554\extensions\{ea614400-e918-4741-9a97-7a972ff7c30b}
[#] Folder Deleted : C:\Windows\system32\Tasks\UpdateAdmin
[#] Folder Deleted : C:\Windows\system32\Tasks\WinTaske

***** [ Files ] *****

[-] File Deleted : C:\ProgramData\{262E20B8-6E20-4CEF-B1FD-D022AB1085F5}.dat
[-] File Deleted : C:\Windows\Reimage.ini
[-] File Deleted : C:\Windows\system32\lavasofttcpservice.dll

***** [ DLLs ] *****

***** [ Shortcuts ] *****

[-] Shortcut Disinfected : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Opera.lnk

***** [ Scheduled tasks ] *****

[-] Task Deleted : ReimageUpdater
[-] Task Deleted : UpdateAdmin
[-] Task Deleted : WinTaske
[-] Task Deleted : ReimageUpdater

***** [ Registry ] *****

[-] Key Deleted : HKCU\Software\Mozilla\Extends
[-] Key Deleted : HKLM\SOFTWARE\Classes\AppID\REI_AxControl.DLL
[-] Value Deleted : HKLM\SOFTWARE\Mozilla\Firefox\Extensions [defsearchp@gmail.com]
[-] Value Deleted : HKLM\SOFTWARE\Mozilla\Firefox\Extensions [deskCutv2@gmail.com]
[-] Key Deleted : HKLM\SOFTWARE\Classes\AppID\{28FF42B8-A0DA-4BE5-9B81-E26DD59B350A}
[-] Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{02478D38-C3F9-4EFB-9B51-7695ECA05670}
[-] Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{EF99BD32-C1FB-11D2-892F-0090271D4F88}
[-] Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{10ECCE17-29B5-4880-A8F5-EAD298611484}
[-] Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{801B440B-1EE3-49B0-B05D-2AB076D4E8CB}
[-] Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{B853E835-9F24-4F4B-B55C-E554D15CCCD2}
[-] Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{F83D1872-D9FF-47F8-B5A0-49CC51E24EE8}
[-] Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{8BF0126F-A5B7-4720-ABB2-2414A0AF5474}
[-] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{22E9CC7A-04B2-4558-A993-763395274E42}
[-] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{9BB31AD8-5DB2-459E-A901-DEA536F23BA4}
[-] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{BD51A48E-EB5F-4454-8774-EF962DF64546}
[-] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{0FEB2313-F89B-4AC6-8153-84025604A06A}
[-] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{02F878DF-E2BE-4B85-8CB4-A0D2D4E2ED7F}
[-] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{2AF343DD-3102-4F9D-AC95-DCA4C95382C7}
[-] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{3137BC14-D8D7-4B67-8FFA-2E0B2E9D541B}
[-] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{4CA2AC92-971B-47B1-ACB6-357B552155AC}
[-] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{52C5395B-1FCD-47FA-A834-FD830701C2D5}
[-] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{5D3DCC39-9233-4330-94E9-DA92BE49CA1A}
[-] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{615FACDF-DADB-440D-AC91-8AAB0AE9E3AD}
[-] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{762D463B-C45A-456D-A80D-8689C297C91E}
[-] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{7A6BE473-7960-44D0-BD54-D23DA76353DF}
[-] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{803F550E-BAAE-42BB-8917-64BA0006AB17}
[-] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{8D5BC51D-C9D3-43B9-B728-B30677B7C7E8}
[-] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{991C9D8D-A789-4DB9-BDFC-5F33398B04BF}
[-] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{A5ACC874-D943-483F-A2D1-14598D51F872}
[-] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{B0474212-0D9D-4361-90B3-B89D1A44275D}
[-] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{BFDE183A-C6FE-41D2-80F9-586C29210AC2}
[-] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{D83C83BF-3EDD-4410-ADAB-5295116DD8C7}
[-] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{DD260902-9420-4055-A956-9152EB4F3E6A}
[-] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{EB1F9F3C-5526-4DAE-BD4B-3EAA7715DA9F}
[-] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{F1912128-469A-4138-AA26-9699C15BB13E}
[-] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{F68DC16C-9C2B-455B-8853-7E4D34BAA3F4}
[-] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{FBA8498F-B3A0-4942-A2BF-E0CB7BC7E000}
[-] Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{506DDB16-455A-4746-AD77-D23228955FD3}
[-] Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{FA6468D2-FAA4-4951-A53B-2A5CF9CC0A36}
[-] Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{DEDAF650-12B8-48F5-A843-BBA100716106}
[-] Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{00011268-E188-40DF-A514-835FCD78B1BF}
[-] Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{EF99BD32-C1FB-11D2-892F-0090271D4F88}
[-] Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{10ECCE17-29B5-4880-A8F5-EAD298611484}
[-] Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{00011268-E188-40DF-A514-835FCD78B1BF}
[-] Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{72A6AB0F-2FA8-4C73-9FCB-1E62A608F001}
[-] Value Deleted : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{00011268-E188-40DF-A514-835FCD78B1BF}]
[-] Key Deleted : HKCU\Software\DownloadAdmin
[-] Key Deleted : HKCU\Software\DriverToolkit
[!] Key Not Deleted : HKCU\Software\Mozilla\Extends
[-] Key Deleted : HKCU\Software\PRODUCTSETUP
[-] Key Deleted : HKCU\Software\Reimage
[-] Key Deleted : HKCU\Software\TNT2
[-] Key Deleted : HKCU\Software\Yahoo\Companion
[-] Key Deleted : HKCU\Software\Yahoo\YFriendsBar
[-] Key Deleted : HKCU\Software\Local AppWizard-Generated Applications\Reimage - Windows Problem Relief.
[-] Key Deleted : HKLM\SOFTWARE\FFPluginHp
[-] Key Deleted : HKLM\SOFTWARE\istartsurfSoftware
[-] Key Deleted : HKLM\SOFTWARE\Reimage
[-] Key Deleted : HKLM\SOFTWARE\simplitec
[-] Key Deleted : HKLM\SOFTWARE\Uniblue
[-] Key Deleted : HKLM\SOFTWARE\WdsManPro
[-] Key Deleted : HKLM\SOFTWARE\Yahoo\Companion
[-] Key Deleted : HKLM\SOFTWARE\yessearchesSoftware
[-] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{D66BF89F-B0A2-48F5-A2E4-242EB645AB76}_is1
[-] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Reimage Protector
[-] Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{625E97B6-CC20-4160-BC1D-BC8A45D2BB1F}

***** [ Web browsers ] *****

[-] [C:\Users\Petr\AppData\Roaming\Mozilla\Firefox\Profiles\41A66E7E5EE1\prefs.js] [Preference] Deleted : user_pref("browser.newtab.url", "hxxp://www.yessearches.com/?ts=AHEpB34kBnQqA0..&v=20160121&uid=978C82EA9C861FA553C4DB013E7F4D4A&ptid=cos&mode=ffseng");
[-] [C:\Users\Petr\AppData\Roaming\Mozilla\Firefox\Profiles\41A66E7E5EE1\prefs.js] [Preference] Deleted : user_pref("browser.search.defaultenginename.US", "data:text/plain,browser.search.defaultenginename.US=yessearches");
[-] [C:\Users\Petr\AppData\Roaming\Mozilla\Firefox\Profiles\41A66E7E5EE1\prefs.js] [Preference] Deleted : user_pref("browser.search.searchengine.hp", "hxxp://www.yessearches.com/?ts=AHEpB34kBnQqA0..&v=20160121&uid=978C82EA9C861FA553C4DB013E7F4D4A&ptid=cos&mode=ffsengext");
[-] [C:\Users\Petr\AppData\Roaming\Mozilla\Firefox\Profiles\41A66E7E5EE1\prefs.js] [Preference] Deleted : user_pref("browser.search.searchengine.sp", "hxxp://www.yessearches.com/chrome.php?mode=ffsengext&ptid=cos&q={searchTerms}&ts=AHEpB34kBnQqA0..&uid=978C82EA9C861FA553C4DB013E7F4D4A&v=20160121");
[-] [C:\Users\Petr\AppData\Roaming\Mozilla\Firefox\Profiles\41A66E7E5EE1\prefs.js] [Preference] Deleted : user_pref("browser.search.searchengine.url", "hxxp://www.yessearches.com/chrome.php?mode=ffsengext&ptid=cos&q={searchTerms}&ts=AHEpB34kBnQqA0..&uid=978C82EA9C861FA553C4DB013E7F4D4A&v=20160121");
[-] [C:\Users\Petr\AppData\Roaming\Mozilla\Firefox\Profiles\41A66E7E5EE1\prefs.js] [Preference] Deleted : user_pref("browser.search.selectedEngine", "yessearches");
[-] [C:\Users\Petr\AppData\Roaming\Mozilla\Firefox\Profiles\41A66E7E5EE1\prefs.js] [Preference] Deleted : user_pref("extensions.foxcub.prev.HP", "hxxp://www.yessearches.com/?ts=AHEpB34kBnQqA0..&v=20160121&uid=978C82EA9C861FA553C4DB013E7F4D4A&ptid=cos&mode=ffseng");
[-] [C:\Users\Petr\AppData\Roaming\Mozilla\Firefox\Profiles\41A66E7E5EE1\prefs.js] [Preference] Deleted : user_pref("extensions.foxcub.prev.KWD", "hxxp://www.yessearches.com/chrome.php?uid=978C82EA9C861FA553C4DB013E7F4D4A&ptid=cos&ts=AHEpB34kBnQqA0..&v=20160121&mode=ffexttoolbar&q=");
[-] [C:\Users\Petr\AppData\Roaming\Mozilla\Firefox\Profiles\41A66E7E5EE1\prefs.js] [Preference] Deleted : user_pref("extensions.mywebsearch.prevKwdEnabled", true);
[-] [C:\Users\Petr\AppData\Roaming\Mozilla\Firefox\Profiles\41A66E7E5EE1\prefs.js] [Preference] Deleted : user_pref("extensions.mywebsearch.prevKwdURL", "hxxp://search.seznam.cz/?sourceid=FFListicka_14875&q=");
[-] [C:\Users\Petr\AppData\Roaming\Mozilla\Firefox\Profiles\41A66E7E5EE1\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._brMembers_.BUTTON_STRUCTURE", "[{\"b\":224520315,\"c\":\"mindspark.magnify\",\"p\":\"L.0\"},{\"b\":224520316,\"c\":\"mindspark.entersearchterms\",\"p\":\"L.0.0[...]
[-] [C:\Users\Petr\AppData\Roaming\Mozilla\Firefox\Profiles\41A66E7E5EE1\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._brMembers_.browser.version.last", "43.0");
[-] [C:\Users\Petr\AppData\Roaming\Mozilla\Firefox\Profiles\41A66E7E5EE1\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._brMembers_.firstKnownVersion", "7.38.8.45986");
[-] [C:\Users\Petr\AppData\Roaming\Mozilla\Firefox\Profiles\41A66E7E5EE1\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._brMembers_.homepage", "/index.jhtml?n=7829ead5");
[-] [C:\Users\Petr\AppData\Roaming\Mozilla\Firefox\Profiles\41A66E7E5EE1\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._brMembers_.hp.enabled", true);
[-] [C:\Users\Petr\AppData\Roaming\Mozilla\Firefox\Profiles\41A66E7E5EE1\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._brMembers_.hp.guardType", "HPR");
[-] [C:\Users\Petr\AppData\Roaming\Mozilla\Firefox\Profiles\41A66E7E5EE1\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._brMembers_.initialized", true);
[-] [C:\Users\Petr\AppData\Roaming\Mozilla\Firefox\Profiles\41A66E7E5EE1\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._brMembers_.installation.installDate", "2016013013");
[-] [C:\Users\Petr\AppData\Roaming\Mozilla\Firefox\Profiles\41A66E7E5EE1\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._brMembers_.installation.success", true);
[-] [C:\Users\Petr\AppData\Roaming\Mozilla\Firefox\Profiles\41A66E7E5EE1\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._brMembers_.lastActivePing", "1454157623060");
[-] [C:\Users\Petr\AppData\Roaming\Mozilla\Firefox\Profiles\41A66E7E5EE1\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._brMembers_.lastKnownVersion", "7.38.8.45986");
[-] [C:\Users\Petr\AppData\Roaming\Mozilla\Firefox\Profiles\41A66E7E5EE1\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._brMembers_.lssState", "{\"previousLocales\":[\"cs\",\"en-US\",\"en\"],\"supportedLocales\":[\"de\",\"es\",\"pt\",\"ja\",\"en\"],\"defaultLocale\":\"en\",\"supp[...]
[-] [C:\Users\Petr\AppData\Roaming\Mozilla\Firefox\Profiles\41A66E7E5EE1\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._brMembers_.options.defaultSearch", false);
[-] [C:\Users\Petr\AppData\Roaming\Mozilla\Firefox\Profiles\41A66E7E5EE1\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._brMembers_.options.homePageEnabled", false);
[-] [C:\Users\Petr\AppData\Roaming\Mozilla\Firefox\Profiles\41A66E7E5EE1\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._brMembers_.options.keywordEnabled", true);
[-] [C:\Users\Petr\AppData\Roaming\Mozilla\Firefox\Profiles\41A66E7E5EE1\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._brMembers_.options.tabEnabled", false);
[-] [C:\Users\Petr\AppData\Roaming\Mozilla\Firefox\Profiles\41A66E7E5EE1\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._brMembers_.productDeliveryOption.language", "en");
[-] [C:\Users\Petr\AppData\Roaming\Mozilla\Firefox\Profiles\41A66E7E5EE1\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._brMembers_.productDeliveryOption.type", "Toolbar");
[-] [C:\Users\Petr\AppData\Roaming\Mozilla\Firefox\Profiles\41A66E7E5EE1\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._brMembers_.successUrl", "hxxp://www.yessearches.com/chrome.php?uid=978C82EA9C861FA553C4DB013E7F4D4A&ptid=cos&ts=AHEpB34kBnQqA0..&v=20160121&mode=ffexttoolbar&q[...]
[-] [C:\Users\Petr\AppData\Roaming\Mozilla\Firefox\Profiles\41A66E7E5EE1\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._brMembers_.toolbarCollapsed", true);
[-] [C:\Users\Petr\AppData\Roaming\Mozilla\Firefox\Profiles\41A66E7E5EE1\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._brMembers_.uninstallTasks", "{\"prefBranchesToDelete\":[\"extensions.toolbar.mindspark._brMembers_.\"],\"filesToDelete\":[\"C:\\\\Users\\\\Petr\\\\AppData\\\\R[...]
[-] [C:\Users\Petr\AppData\Roaming\Mozilla\Firefox\Profiles\41A66E7E5EE1\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark.hp.enabled", true);
[-] [C:\Users\Petr\AppData\Roaming\Mozilla\Firefox\Profiles\41A66E7E5EE1\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark.hp.enabled.guid", "yourGSearchfinder@GSearch.com");
[-] [C:\Users\Petr\AppData\Roaming\Mozilla\Firefox\Profiles\41A66E7E5EE1\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark.lastInstalled", "yourGSearchfinder@GSearch.com");
[-] [C:\Users\Petr\AppData\Roaming\Mozilla\Firefox\Profiles\41A66E7E5EE1\prefs.js] [Preference] Deleted : user_pref("keyword.URL", "hxxp://www.yessearches.com/chrome.php?uid=978C82EA9C861FA553C4DB013E7F4D4A&ptid=cos&ts=AHEpB34kBnQqA0..&v=20160121&mode=ffexttoolbar&q=");
[-] [C:\Users\Petr\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\prefs.js] [Preference] Deleted : user_pref("browser.newtab.url", "hxxp://www.yessearches.com/?ts=AHEpB34kBnQqA0..&v=20160121&uid=978C82EA9C861FA553C4DB013E7F4D4A&ptid=cos&mode=ffseng");
[-] [C:\Users\Petr\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\prefs.js] [Preference] Deleted : user_pref("browser.search.defaultenginename.US", "data:text/plain,browser.search.defaultenginename.US=yessearches");
[-] [C:\Users\Petr\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\prefs.js] [Preference] Deleted : user_pref("browser.search.searchengine.hp", "hxxp://www.yessearches.com/?ts=AHEpB34kBnQqA0..&v=20160121&uid=978C82EA9C861FA553C4DB013E7F4D4A&ptid=cos&mode=ffsengext");
[-] [C:\Users\Petr\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\prefs.js] [Preference] Deleted : user_pref("browser.search.searchengine.sp", "hxxp://www.yessearches.com/chrome.php?mode=ffsengext&ptid=cos&q={searchTerms}&ts=AHEpB34kBnQqA0..&uid=978C82EA9C861FA553C4DB013E7F4D4A&v=20160121");
[-] [C:\Users\Petr\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\prefs.js] [Preference] Deleted : user_pref("browser.search.searchengine.url", "hxxp://www.yessearches.com/chrome.php?mode=ffsengext&ptid=cos&q={searchTerms}&ts=AHEpB34kBnQqA0..&uid=978C82EA9C861FA553C4DB013E7F4D4A&v=20160121");
[-] [C:\Users\Petr\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\prefs.js] [Preference] Deleted : user_pref("browser.search.selectedEngine", "yessearches");
[-] [C:\Users\Petr\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\prefs.js] [Preference] Deleted : user_pref("extensions.mywebsearch.prevKwdEnabled", true);
[-] [C:\Users\Petr\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._brMembers_.BUTTON_STRUCTURE", "[{\"b\":224520315,\"c\":\"mindspark.magnify\",\"p\":\"L.0\"},{\"b\":224520316,\"c\":\"mindspark.entersearchterms\",\"p\":\"L.0.0[...]
[-] [C:\Users\Petr\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._brMembers_.browser.version.last", "43.0");
[-] [C:\Users\Petr\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._brMembers_.firstKnownVersion", "7.38.8.45986");
[-] [C:\Users\Petr\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._brMembers_.homepage", "/index.jhtml?n=7829eac8");
[-] [C:\Users\Petr\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._brMembers_.hp.enabled", true);
[-] [C:\Users\Petr\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._brMembers_.hp.guardType", "HPR");
[-] [C:\Users\Petr\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._brMembers_.initialized", true);
[-] [C:\Users\Petr\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._brMembers_.installation.installDate", "2016013000");
[-] [C:\Users\Petr\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._brMembers_.installation.success", true);
[-] [C:\Users\Petr\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._brMembers_.lastActivePing", "1454157238334");
[-] [C:\Users\Petr\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._brMembers_.lastKnownVersion", "7.38.8.45986");
[-] [C:\Users\Petr\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._brMembers_.lssState", "{\"previousLocales\":[\"cs\",\"en-US\",\"en\"],\"supportedLocales\":[\"de\",\"es\",\"pt\",\"ja\",\"en\"],\"defaultLocale\":\"en\",\"supp[...]
[-] [C:\Users\Petr\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._brMembers_.options.defaultSearch", false);
[-] [C:\Users\Petr\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._brMembers_.options.homePageEnabled", false);
[-] [C:\Users\Petr\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._brMembers_.options.keywordEnabled", true);
[-] [C:\Users\Petr\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._brMembers_.options.tabEnabled", false);
[-] [C:\Users\Petr\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._brMembers_.productDeliveryOption.language", "en");
[-] [C:\Users\Petr\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._brMembers_.productDeliveryOption.type", "Toolbar");
[-] [C:\Users\Petr\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._brMembers_.successUrl", "hxxp://www.yessearches.com/chrome.php?uid=978C82EA9C861FA553C4DB013E7F4D4A&ptid=cos&ts=AHEpB34kBnQqA0..&v=20160121&mode=ffexttoolbar&q[...]
[-] [C:\Users\Petr\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._brMembers_.toolbarCollapsed", true);
[-] [C:\Users\Petr\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._brMembers_.uninstallTasks", "{\"prefBranchesToDelete\":[\"extensions.toolbar.mindspark._brMembers_.\"],\"filesToDelete\":[\"C:\\\\Users\\\\Petr\\\\AppData\\\\R[...]
[-] [C:\Users\Petr\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark.hp.enabled", true);
[-] [C:\Users\Petr\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark.hp.enabled.guid", "yourGSearchfinder@GSearch.com");
[-] [C:\Users\Petr\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark.lastInstalled", "yourGSearchfinder@GSearch.com");
[-] [C:\Users\Petr\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\prefs.js] [Preference] Deleted : user_pref("keyword.URL", "hxxp://www.yessearches.com/chrome.php?uid=978C82EA9C861FA553C4DB013E7F4D4A&ptid=cos&ts=AHEpB34kBnQqA0..&v=20160121&mode=ffexttoolbar&q=");

*************************

:: "Tracing" keys removed
:: Winsock settings cleared

*************************

C:\AdwCleaner\AdwCleaner[C1].txt - [23404 bytes] - [23/02/2016 17:56:19]
C:\AdwCleaner\AdwCleaner[S1].txt - [22636 bytes] - [23/02/2016 13:53:24]
C:\AdwCleaner\AdwCleaner[S2].txt - [22710 bytes] - [23/02/2016 17:55:17]

########## EOF - C:\AdwCleaner\AdwCleaner[C1].txt - [23626 bytes] ##########

Příspěvekod **Pic** » 23 úno 2016 18:24

Junkware Removal Tool (JRT) by Malwarebytes
Version: 8.0.3 (02.09.2016)
Operating System: Windows 7 Professional x86
Ran by Petr (Administrator) on Łt 23.02.2016 at 18:10:15,48
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

File System: 9

Successfully deleted: C:\Windows\wininit.ini (File)
Successfully deleted: C:\Users\Petr\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5WUWRAN3 (Temporary Internet Files Folder)
Successfully deleted: C:\Users\Petr\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\66GPQ4MV (Temporary Internet Files Folder)
Successfully deleted: C:\Users\Petr\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\EC9LEBNI (Temporary Internet Files Folder)
Successfully deleted: C:\Users\Petr\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\FVB1QBFQ (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5WUWRAN3 (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\66GPQ4MV (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\EC9LEBNI (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\FVB1QBFQ (Temporary Internet Files Folder)

Registry: 2

Successfully deleted: HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{15C4DF55-4B67-495A-A3D3-A497C4A49EE0} (Registry Key)
Successfully deleted: HKLM\Software\Microsoft\Internet Explorer\SearchScopes\{15C4DF55-4B67-495A-A3D3-A497C4A49EE0} (Registry Key)

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on Łt 23.02.2016 at 18:21:30,41
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Příspěvekod **Pic** » 23 úno 2016 20:06

RogueKiller V11.0.13.0 [Feb 22 2016] (Free) by Adlice Software
mail : http://www.adlice.com/contact/
Feedback : http://forum.adlice.com
Webová stránka : http://www.adlice.com/software/roguekiller/
Blog : http://www.adlice.com

Operační systém : Windows 7 (6.1.7601 Service Pack 1) 32 bits version
Spuštěno : Normální režim
Uživatel : Petr [Práva správce]
Started from : D:\Stah\RogueKiller.exe
Mód : Prohledat -- Datum : 02/23/2016 20:00:28

¤¤¤ Procesy : 0 ¤¤¤

¤¤¤ Registry : 15 ¤¤¤
[PUM.HomePage] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main | Start Page : https://www.seznam.cz/?clid=22668 -> Nalezeno
[PUM.HomePage] HKEY_USERS\S-1-5-21-2865040539-3082706522-2485382742-1001\Software\Microsoft\Internet Explorer\Main | Start Page : https://www.seznam.cz/?clid=22668 -> Nalezeno
[PUM.Dns] HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters | DhcpNameServer : 84.16.96.129 84.16.96.2 ([X][-]) -> Nalezeno
[PUM.Dns] HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Tcpip\Parameters | DhcpNameServer : 84.16.96.129 84.16.96.2 ([X][-]) -> Nalezeno
[PUM.Dns] HKEY_LOCAL_MACHINE\System\ControlSet002\Services\Tcpip\Parameters | DhcpNameServer : 84.16.96.129 84.16.96.2 ([X][-]) -> Nalezeno
[PUM.Dns] HKEY_LOCAL_MACHINE\System\ControlSet003\Services\Tcpip\Parameters | DhcpNameServer : 84.16.96.129 84.16.96.2 ([X][-]) -> Nalezeno
[PUM.Dns] HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{2C5688D2-36B8-4674-B087-6F55D15583C5} | DhcpNameServer : 84.16.96.129 84.16.96.2 ([X][-]) -> Nalezeno
[PUM.Dns] HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{4040E858-D207-4991-9438-3EC8CE34BAAE} | DhcpNameServer : 84.16.96.129 84.16.96.2 ([X][-]) -> Nalezeno
[PUM.Dns] HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Tcpip\Parameters\Interfaces\{2C5688D2-36B8-4674-B087-6F55D15583C5} | DhcpNameServer : 84.16.96.129 84.16.96.2 ([X][-]) -> Nalezeno
[PUM.Dns] HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Tcpip\Parameters\Interfaces\{4040E858-D207-4991-9438-3EC8CE34BAAE} | DhcpNameServer : 84.16.96.129 84.16.96.2 ([X][-]) -> Nalezeno
[PUM.Dns] HKEY_LOCAL_MACHINE\System\ControlSet002\Services\Tcpip\Parameters\Interfaces\{2C5688D2-36B8-4674-B087-6F55D15583C5} | DhcpNameServer : 84.16.96.129 84.16.96.2 ([X][-]) -> Nalezeno
[PUM.Dns] HKEY_LOCAL_MACHINE\System\ControlSet002\Services\Tcpip\Parameters\Interfaces\{4040E858-D207-4991-9438-3EC8CE34BAAE} | DhcpNameServer : 84.16.96.129 84.16.96.2 ([X][-]) -> Nalezeno
[PUM.Dns] HKEY_LOCAL_MACHINE\System\ControlSet003\Services\Tcpip\Parameters\Interfaces\{2C5688D2-36B8-4674-B087-6F55D15583C5} | DhcpNameServer : 84.16.96.129 84.16.96.2 ([X][-]) -> Nalezeno
[PUM.Dns] HKEY_LOCAL_MACHINE\System\ControlSet003\Services\Tcpip\Parameters\Interfaces\{4040E858-D207-4991-9438-3EC8CE34BAAE} | DhcpNameServer : 84.16.96.129 84.16.96.2 ([X][-]) -> Nalezeno
[PUM.StartMenu] HKEY_USERS\S-1-5-21-2865040539-3082706522-2485382742-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced | Start_ShowMyGames : 0 -> Nalezeno

¤¤¤ Úlohy : 0 ¤¤¤

¤¤¤ Soubory : 0 ¤¤¤

¤¤¤ Soubor HOSTS : 0 ¤¤¤

Malvare - proběhla kontrola i odstranění nalezeného, ale zpráva se bohužel nezobrazila.

¤¤¤ Antirootkit : 0 (Driver: Nahrán) ¤¤¤

¤¤¤ Webové prohlížeče : 1 ¤¤¤
[PUM.HomePage][FIREFX:Config] 41A66E7E5EE1 : user_pref("browser.startup.homepage", "http://www.seznam.cz/?clid=14875"); -> Nalezeno

¤¤¤ Kontrola MBR : ¤¤¤
+++++ PhysicalDrive0: WDC WD10EZEX-00RKKA0 ATA Device +++++
--- User ---
[MBR] 9ecd885b38fb60496bedf2e16460cc91
[BSP] 512f2bb1d6a83143d4ce6216855eacc9 : Windows Vista/7/8|VT.Unknown MBR Code
Partition table:
0 - [ACTIVE] FAT16 (0x6) [VISIBLE] Offset (sectors): 63 | Size: 280000 MB
1 - [XXXXXX] NTFS (0x7) [VISIBLE] Offset (sectors): 573440175 | Size: 673867 MB [Windows XP Bootstrap | Windows XP Bootloader]
User = LL1 ... OK
User = LL2 ... OK

+++++ PhysicalDrive1: WDC WD5000AAKX-00ERMA0 ATA Device +++++
--- User ---
[MBR] cccce6943e068bffffa06a0fe182b14c
[BSP] dc0fa909b460d4e1a2a2cfd019c6273c : Windows Vista/7/8|VT.Unknown MBR Code
Partition table:
0 - [ACTIVE] NTFS (0x7) [VISIBLE] Offset (sectors): 63 | Size: 106002 MB [Windows XP Bootstrap | Windows XP Bootloader]
1 - [XXXXXX] NTFS (0x7) [VISIBLE] Offset (sectors): 217092960 | Size: 370934 MB [Windows XP Bootstrap | Windows XP Bootloader]
User = LL1 ... OK
User = LL2 ... OK

Příspěvekod **Pic** » 23 úno 2016 22:41

Tady je ztracený log z malvare.
<?xml version="1.0" encoding="UTF-16" ?>
<mbam-log>
<header>
<date>2016/02/23 19:36:07 +0100</date>
<logfile>mbam-log-2016-02-23 (19-36-05).xml</logfile>
<isadmin>yes</isadmin>
</header>
<engine>
<version>2.2.0.1024</version>
<malware-database>v2016.02.23.04</malware-database>
<rootkit-database>v2016.02.17.01</rootkit-database>
<license>free</license>
<file-protection>disabled</file-protection>
<web-protection>disabled</web-protection>
<self-protection>disabled</self-protection>
</engine>
<system>
<hostname>PETR-PC</hostname>
<ip>192.168.1.193</ip>
<osversion>Windows 7 Service Pack 1</osversion>
<arch>x86</arch>
<username>Petr</username>
<filesys>NTFS</filesys>
</system>
<summary>
<type>threat</type>
<result>completed</result>
<objects>345877</objects>
<time>267</time>
<processes>0</processes>
<modules>0</modules>
<keys>0</keys>
<values>0</values>
<datas>0</datas>
<folders>0</folders>
<files>0</files>
<sectors>0</sectors>
</summary>
<options>
<memory>enabled</memory>
<startup>enabled</startup>
<filesystem>enabled</filesystem>
<archives>enabled</archives>
<rootkits>disabled</rootkits>
<deeprootkit>disabled</deeprootkit>
<heuristics>enabled</heuristics>
<pup>enabled</pup>
<pum>enabled</pum>
</options>
<items>
</items>
</mbam-log>

Jinak se zdá, že je již vše OK. Okna zatím nevyskakují a neblokují Firefox.

Příspěvekod **jaro3** » 24 úno 2016 09:07

Zavři všechny programy a prohlížeče. Deaktivuj antivir a firewall.
Prosím, odpoj všechny USB (kromě myši s klávesnice) nebo externí disky z počítače před spuštěním tohoto programu.
Spusť znovu RogueKiller ( Pro Windows Vista nebo Windows 7, klepni pravým a vyber "Spustit jako správce", ve Windows XP poklepej ke spuštění).
- Počkej, až Prescan dokončí práci...
- Pak klikni na "Prohledat " ,po jeho skončení:

- V záložkách (Registry , Tasks , Web Browser apod.) vše zatrhni (dej zatržítka)
(musíš dát myší zatržítko do toho čtverečku vlevo od registru ap.)

- Klikni na "Smazat"
- Počkej, dokud Status box nezobrazí " Mazání dokončeno "
- Klikni na "Zpráva " a zkopíruj a vlož obsah té zprávy prosím sem. Log je možno nalézt v RKreport [číslo]. txt na ploše.
- Zavři RogueKiller

Vypni antivir i firewall.
Stáhni
Zoek.exe

a uloz si ho na plochu.
Zavři všechny ostatní programy , okna i prohlížeče.
Spusť Zoek.exe ( u win vista , win7, 8 klikni na něj pravým a vyber : „Spustit jako správce“
- pozor , náběh programu může trvat déle.

Do okna programu vlož skript níže:

Kód: Vybrat vše

autoclean;
emptyclsid;
iedefaults;
FFdefaults;
CHRdefaults;
emptyalltemp;
resethosts;

klikni na Run Script
Program provede sken , opravu, sken i oprava může trvat i více minut ,je třeba posečkat do konce. Do okna neklikej!
Program nabídne restart , potvrď .

Po restartu se může nějaký čas ukázat pouze černá plocha , to je normální. Je třeba počkat až se vytvoří log. Ten si můžeš uložit třeba do dokumentů , jinak se sám ukládá do:
C:\zoek-results.log
Zkopíruj sem celý obsah toho logu.

Vlož nový log z HJT + informuj o problémech.

Příspěvekod **Pic** » 24 úno 2016 14:02

RogueKiller V11.0.13.0 [Feb 22 2016] (Free) by Adlice Software
mail : http://www.adlice.com/contact/
Feedback : http://forum.adlice.com
Webová stránka : http://www.adlice.com/software/roguekiller/
Blog : http://www.adlice.com

Operační systém : Windows 7 (6.1.7601 Service Pack 1) 32 bits version
Spuštěno : Normální režim
Uživatel : Petr [Práva správce]
Started from : D:\Stah\RogueKiller.exe
Mód : Smazat -- Datum : 02/24/2016 13:49:30

¤¤¤ Procesy : 0 ¤¤¤

¤¤¤ Registry : 17 ¤¤¤
[Suspicious.Path] HKEY_USERS\S-1-5-21-2865040539-3082706522-2485382742-1001\Software\Microsoft\Windows\CurrentVersion\Run | cz.seznam.software.autoupdate : "C:\Users\Petr\AppData\Roaming\Seznam.cz\szninstall.exe" -c [7][x] -> Smazáno
[Suspicious.Path] HKEY_USERS\S-1-5-21-2865040539-3082706522-2485382742-1001\Software\Microsoft\Windows\CurrentVersion\Run | cz.seznam.software.szndesktop : "C:\Users\Petr\AppData\Roaming\Seznam.cz\bin\wszndesktop.exe" -q [7][x] -> Smazáno
[PUM.HomePage] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main | Start Page : https://www.seznam.cz/?clid=22668 -> Nahrazeno (http://go.microsoft.com/fwlink/p/?LinkId=255141)
[PUM.HomePage] HKEY_USERS\S-1-5-21-2865040539-3082706522-2485382742-1001\Software\Microsoft\Internet Explorer\Main | Start Page : https://www.seznam.cz/?clid=22668 -> Nahrazeno (http://go.microsoft.com/fwlink/p/?LinkId=255141)
[PUM.Dns] HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters | DhcpNameServer : 84.16.96.129 84.16.96.2 ([X][X]) -> Nahrazeno ()
[PUM.Dns] HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Tcpip\Parameters | DhcpNameServer : 84.16.96.129 84.16.96.2 ([X][X]) -> Nahrazeno ()
[PUM.Dns] HKEY_LOCAL_MACHINE\System\ControlSet002\Services\Tcpip\Parameters | DhcpNameServer : 84.16.96.129 84.16.96.2 ([X][X]) -> Nahrazeno ()
[PUM.Dns] HKEY_LOCAL_MACHINE\System\ControlSet003\Services\Tcpip\Parameters | DhcpNameServer : 84.16.96.129 84.16.96.2 ([X][X]) -> Nahrazeno ()
[PUM.Dns] HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{2C5688D2-36B8-4674-B087-6F55D15583C5} | DhcpNameServer : 84.16.96.129 84.16.96.2 ([X][X]) -> Nahrazeno ()
[PUM.Dns] HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{4040E858-D207-4991-9438-3EC8CE34BAAE} | DhcpNameServer : 84.16.96.129 84.16.96.2 ([X][X]) -> Nahrazeno ()
[PUM.Dns] HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Tcpip\Parameters\Interfaces\{2C5688D2-36B8-4674-B087-6F55D15583C5} | DhcpNameServer : 84.16.96.129 84.16.96.2 ([X][X]) -> Nahrazeno ()
[PUM.Dns] HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Tcpip\Parameters\Interfaces\{4040E858-D207-4991-9438-3EC8CE34BAAE} | DhcpNameServer : 84.16.96.129 84.16.96.2 ([X][X]) -> Nahrazeno ()
[PUM.Dns] HKEY_LOCAL_MACHINE\System\ControlSet002\Services\Tcpip\Parameters\Interfaces\{2C5688D2-36B8-4674-B087-6F55D15583C5} | DhcpNameServer : 84.16.96.129 84.16.96.2 ([X][X]) -> Nahrazeno ()
[PUM.Dns] HKEY_LOCAL_MACHINE\System\ControlSet002\Services\Tcpip\Parameters\Interfaces\{4040E858-D207-4991-9438-3EC8CE34BAAE} | DhcpNameServer : 84.16.96.129 84.16.96.2 ([X][X]) -> Nahrazeno ()
[PUM.Dns] HKEY_LOCAL_MACHINE\System\ControlSet003\Services\Tcpip\Parameters\Interfaces\{2C5688D2-36B8-4674-B087-6F55D15583C5} | DhcpNameServer : 84.16.96.129 84.16.96.2 ([X][X]) -> Nahrazeno ()
[PUM.Dns] HKEY_LOCAL_MACHINE\System\ControlSet003\Services\Tcpip\Parameters\Interfaces\{4040E858-D207-4991-9438-3EC8CE34BAAE} | DhcpNameServer : 84.16.96.129 84.16.96.2 ([X][X]) -> Nahrazeno ()
[PUM.StartMenu] HKEY_USERS\S-1-5-21-2865040539-3082706522-2485382742-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced | Start_ShowMyGames : 0 -> Nahrazeno (1)

¤¤¤ Úlohy : 0 ¤¤¤

¤¤¤ Soubory : 0 ¤¤¤

¤¤¤ Soubor HOSTS : 0 ¤¤¤

¤¤¤ Antirootkit : 2 (Driver: Nahrán) ¤¤¤
[SSDT:Inl(Hook.SSDT)] ZwDeleteAtom[99] : C:\Windows\System32\win32k.sys @ 0xffffffff9c1b7e76 (call dword [0x83b34d14])
[SSDT:Inl(Hook.SSDT)] ZwFlushWriteBuffer[129] : C:\Windows\System32\halmacpi.dll @ 0xffffffff83e30468 (call dword [0x83a0b0b4])

¤¤¤ Webové prohlížeče : 9 ¤¤¤
[FIREFX:Addon] 41A66E7E5EE1 : Adblock Plus Pop-up Addon [adblockpopups@jessehakanen.net] -> Smazáno
[FIREFX:Addon] 41A66E7E5EE1 : Avast Online Security [wrc@avast.com] -> Smazáno
[FIREFX:Addon] 41A66E7E5EE1 : Avast SafePrice [sp@avast.com] -> Smazáno
[FIREFX:Addon] 83jbu109.default-1453815860554 : Avast Online Security [wrc@avast.com] -> Smazáno
[FIREFX:Addon] 83jbu109.default-1453815860554 : Avast SafePrice [sp@avast.com] -> Smazáno
[FIREFX:Addon] CCACCBF1-7AB4-4CF5-B32D-668C686A539F : Avast Online Security [wrc@avast.com] -> Smazáno
[FIREFX:Addon] CCACCBF1-7AB4-4CF5-B32D-668C686A539F : Avast SafePrice [sp@avast.com] -> Smazáno
[FIREFX:Addon] CCACCBF1-7AB4-4CF5-B32D-668C686A539F : GsearchFinder [@E9438230-A7DF-4D1F-8F2D-CA1D0F0F7924] -> Smazáno
[PUM.HomePage][FIREFX:Config] 41A66E7E5EE1 : user_pref("browser.startup.homepage", "http://www.seznam.cz/?clid=14875"); -> Nahrazeno (about:home)

¤¤¤ Kontrola MBR : ¤¤¤
+++++ PhysicalDrive0: WDC WD10EZEX-00RKKA0 ATA Device +++++
--- User ---
[MBR] 9ecd885b38fb60496bedf2e16460cc91
[BSP] 512f2bb1d6a83143d4ce6216855eacc9 : Windows Vista/7/8 MBR Code
Partition table:
0 - [ACTIVE] FAT16 (0x6) [VISIBLE] Offset (sectors): 63 | Size: 280000 MB
1 - [XXXXXX] NTFS (0x7) [VISIBLE] Offset (sectors): 573440175 | Size: 673867 MB [Windows XP Bootstrap | Windows XP Bootloader]
User = LL1 ... OK
User = LL2 ... OK

+++++ PhysicalDrive1: WDC WD5000AAKX-00ERMA0 ATA Device +++++
--- User ---
[MBR] cccce6943e068bffffa06a0fe182b14c
[BSP] dc0fa909b460d4e1a2a2cfd019c6273c : Windows Vista/7/8 MBR Code
Partition table:
0 - [ACTIVE] NTFS (0x7) [VISIBLE] Offset (sectors): 63 | Size: 106002 MB [Windows XP Bootstrap | Windows XP Bootloader]
1 - [XXXXXX] NTFS (0x7) [VISIBLE] Offset (sectors): 217092960 | Size: 370934 MB [Windows XP Bootstrap | Windows XP Bootloader]
User = LL1 ... OK
User = LL2 ... OK

Je zajímavé, že problém se zahlcením otevíráním dalších stránek (až 16) byl jen po připojení k pc-help. Na jiných stránkách ve Firefoxu vše běhalo normálně.

Příspěvekod **jaro3** » 24 úno 2016 16:55

ještě zoek , hjt

Prosím o kontrolu - vyskakovací okna Vyřešeno

Prosím o kontrolu - vyskakovací okna Vyřešeno

Re: Prosím o kontrolu - vyskakovací okna

Re: Prosím o kontrolu - vyskakovací okna

Re: Prosím o kontrolu - vyskakovací okna

Re: Prosím o kontrolu - vyskakovací okna

Re: Prosím o kontrolu - vyskakovací okna

Re: Prosím o kontrolu - vyskakovací okna

Re: Prosím o kontrolu - vyskakovací okna

Re: Prosím o kontrolu - vyskakovací okna

Re: Prosím o kontrolu - vyskakovací okna

Re: Prosím o kontrolu - vyskakovací okna

Re: Prosím o kontrolu - vyskakovací okna

Kdo je online