Prosím o kontrolu logu.

[Simroth]

Je to jen preventivní. Před nedávnem sem měl nějaké problémy, tak to chci dočistit.

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 13:28:47, on 19.3.2016
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v11.0 (11.00.9600.17840)

FIREFOX: 44.0.2 (x86 cs)
Boot mode: Normal

Running processes:
C:\Program Files (x86)\ROCCAT\Power-Grid\ROCCATPowerGrid.exe
C:\Program Files (x86)\Gyazo\GyStation.exe
C:\Program Files (x86)\MSI Afterburner\MSIAfterburner.exe
C:\Program Files (x86)\Overwolf\Overwolf.exe
C:\ProgramData\Battle.net\Agent\Agent.4835\Agent.exe
C:\Program Files (x86)\Battle.net\Battle.net.6890\Battle.net.exe
C:\Program Files (x86)\Common Files\Overwolf\0.92.21.0\OverwolfHelper.exe
C:\Program Files (x86)\Samsung\Samsung Magician\Samsung Magician.exe
C:\Program Files (x86)\Steam\Steam.exe
C:\Program Files (x86)\Steam\bin\steamwebhelper.exe
C:\Program Files (x86)\Steam\bin\steamwebhelper.exe
C:\Program Files (x86)\Overwolf\0.92.21.0\OverwolfTSHelper.exe
C:\Program Files (x86)\MyPublicWiFi\MyPublicWiFi.exe
C:\Program Files (x86)\Mozilla Firefox\firefox.exe
C:\Program Files (x86)\Overwolf\0.92.21.0\OverwolfBrowser.exe
C:\Program Files (x86)\Overwolf\0.92.21.0\OverwolfBrowser.exe
C:\Windows\SysWOW64\muachost.exe
F:\Záloha Dominik - Windows\Ostatní\LOG a programy\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchAssistant = www.google.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = www.google.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = www.google.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/p/?LinkId=255141
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/p/?LinkId=255141
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,Default_Search_URL = www.google.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F2 - REG:system.ini: UserInit=userinit.exe,
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre1.8.0_71\bin\ssv.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre1.8.0_71\bin\jp2ssv.dll
O4 - HKLM\..\Run: [MyPublicWiFi] C:\Program Files (x86)\MyPublicWiFi\MyPublicWiFi.exe
O4 - HKLM\..\Run: [Command Center] C:\Program Files (x86)\MSI\Command Center\StartCommandCenter.exe
O4 - HKCU\..\Run: [Steam] "C:\Program Files (x86)\Steam\steam.exe" -silent
O4 - HKCU\..\Run: [CCleaner Monitoring] "C:\Program Files\CCleaner\CCleaner64.exe" /MONITOR
O4 - HKCU\..\Run: [RoccatPowerGrid] "C:\Program Files (x86)\ROCCAT\Power-Grid\ROCCATPowerGrid.exe" /m
O4 - HKCU\..\Run: [Battle.net] "C:\Program Files (x86)\Battle.net\Battle.net Launcher.exe" --autostarted
O4 - HKCU\..\Run: [Gyazo] C:\Program Files (x86)\Gyazo\GyStation.exe
O4 - HKCU\..\Run: [UDP Manager] C:\Users\PC\AppData\Roaming\BD7ACF7B-A17F-494C-9F15-8B14D5235892\UDP Manager\udpmgr.exe
O4 - HKCU\..\Run: [Overwolf] C:\Program Files (x86)\Overwolf\Overwolf.exe -silent
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\RunOnce: [SPReview] "C:\Windows\System32\SPReview\SPReview.exe" /sp:1 /errorfwlink:"http://go.microsoft.com/fwlink/?LinkID=122915" /build:7601 (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [SPReview] "C:\Windows\System32\SPReview\SPReview.exe" /sp:1 /errorfwlink:"http://go.microsoft.com/fwlink/?LinkID=122915" /build:7601 (User 'Default user')
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~2\MIF5BA~1\Office12\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MIF5BA~1\Office12\REFIEBAR.DLL
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: AMD External Events Utility - Unknown owner - C:\Windows\system32\atiesrxx.exe (file missing)
O23 - Service: BattlEye Service (BEService) - Unknown owner - C:\Program Files (x86)\Common Files\BattlEye\BEService.exe
O23 - Service: Disc Soft Lite Bus Service - Disc Soft Ltd - C:\Program Files\DAEMON Tools Lite\DiscSoftBusService.exe
O23 - Service: EasyAntiCheat - EasyAntiCheat Ltd - C:\Windows\system32\EasyAntiCheat.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: Futuremark SystemInfo Service - Futuremark - C:\Program Files (x86)\Futuremark\SystemInfo\FMSISvc.exe
O23 - Service: Intel(R) Integrated Clock Controller Service - Intel(R) ICCS (ICCS) - Intel Corporation - C:\Program Files (x86)\Intel\Intel(R) Integrated Clock Controller Service\ICCProxy.exe
O23 - Service: @%SystemRoot%\system32\ieetwcollectorres.dll,-1000 (IEEtwCollectorService) - Unknown owner - C:\Windows\system32\IEEtwCollector.exe (file missing)
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: MSI Command Center Clock Service (MSIClock_CC) - MSI - C:\Program Files (x86)\MSI\Command Center\ClockGen\MSIClockService.exe
O23 - Service: MSI Command Center Comm Service (MSICOMM_CC) - MSI - C:\Program Files (x86)\MSI\Command Center\MSICommService.exe
O23 - Service: MSI Command Center CPU Service (MSICPU_CC) - MSI - C:\Program Files (x86)\MSI\Command Center\CPU\MSICPUService.exe
O23 - Service: MSI Command Center control Service (MSICTL_CC) - MSI - C:\Program Files (x86)\MSI\Command Center\MSIControlService.exe
O23 - Service: MSI Command Center DDR Service (MSIDDR_CC) - MSI - C:\Program Files (x86)\MSI\Command Center\DDR\MSIDDRService.exe
O23 - Service: MSI Command Center SMBus Service (MSISMB_CC) - MSI - C:\Program Files (x86)\MSI\Command Center\SMBus\MSISMBService.exe
O23 - Service: MSI Command Center SuperIO Service (MSISuperIO_CC) - MSI - C:\Program Files (x86)\MSI\Command Center\SuperIO\MSISuperIOService.exe
O23 - Service: MyPublicWiFi Service (MyPublicWiFiService) - Unknown owner - C:\Program Files (x86)\MyPublicWiFi\PublicWiFiService.exe
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Origin Client Service - Electronic Arts - C:\Program Files (x86)\Origin\OriginClientService.exe
O23 - Service: Overwolf Updater Windows SCM (OverwolfUpdater) - Overwolf LTD - C:\Program Files (x86)\Overwolf\OverwolfUpdater.exe
O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files (x86)\Common Files\Steam\SteamService.exe
O23 - Service: TeamViewer 11 (TeamViewer) - TeamViewer GmbH - C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--
End of file - 10112 bytes

[Reklama]

[jaro3]

Stáhni si ATF Cleaner
Poklepej na ATF Cleaner.exe, klikni na select all found, poté:
-Když používáš Firefox (Mozzila), klikni na Firefox nahoře a vyber: Select All, poté klikni na Empty Selected.
-Když používáš Operu, klikni nahoře na Operu a vyber: Select All, poté klikni na Empty Selected. Poté klikni na Main (hlavní stránku ) a klikni na Empty Selected.
Po vyčištění klikni na Exit k zavření programu.
ATF-Cleaner je jednoduchý nástroj na odstranění historie z webového prohlížeče. Program dokáže odstranit cache, cookies, historii a další stopy po surfování na Internetu. Mezi podporované prohlížeče patří Internet Explorer, Firefox a Opera. Aplikace navíc umí odstranit dočasné soubory Windows, vysypat koš atd.

- Pokud používáš jen Google Chrome , tak ATF nemusíš použít.


Stáhni si TFC
http://www.geekstogo.com/forum/files/fi ... -oldtimer/
Otevři soubor a zavři všechny ostatní okna, Klikni na Start k zahájení procesu. Program by neměl trvat dlouho.
Poté by se měl PC restartovat, pokud ne , proveď sám.

Stáhni AdwCleaner (by Xplode)
http://www.bleepingcomputer.com/download/adwcleaner/

Ulož si ho na svojí plochu
Ukonči všechny programy , okna a prohlížeče
Spusť program poklepáním a klikni na „Prohledat-Scan“
Po skenu klikni na „Logfile“ ,objeví log ( jinak je uložen systémovem disku jako AdwCleaner[C?].txt), jeho obsah sem celý vlož.

Stáhni si Malwarebytes' Anti-Malware
- Při instalaci odeber zatržítko u „Povolit bezplatnou zkušební verzi Malwarebytes' Anti-Malware Premium“
Nainstaluj a spusť ho
- na konci instalace se ujisti že máš zvoleny/zatrhnuty obě možnosti:
Aktualizace Malwarebytes' Anti-Malware a Spustit aplikaci Malwarebytes' Anti-Malware, pokud jo tak klikni na tlačítko konec
- pokud bude nalezena aktualizace, tak se stáhne a nainstaluje
- program se po té spustí a klikni na Skenovat nyní a
- po proběhnutí programu se ti objeví hláška vpravo dole tak klikni na Kopírovat do schránky a vlož sem celý log.

- po té klikni na tlačítko Exit, objeví se ti hláška tak zvol Ano
(zatím nic nemaž!).

Pokud budou problémy , spusť v nouz. režimu.

[Simroth]

Malwarebytes Anti-Malware
www.malwarebytes.org

Datum skenování: 20.3.2016
Čas skenování: 14:22
Protokol:
Správce: Ano

Verze: 2.2.0.1024
Databáze malwaru: v2016.03.20.03
Databáze rootkitů: v2016.03.12.01
Licence: Zkušební verze
Ochrana proti malwaru: Zapnuto
Ochrana proti škodlivým webovým stránkám: Zapnuto
Ochrana programu: Vypnuto

OS: Windows 7 Service Pack 1
CPU: x64
Souborový systém: NTFS
Uživatel: PC

Typ skenu: Sken hrozeb
Výsledek: Dokončeno
Prohledaných objektů: 345106
Uplynulý čas: 2 min, 56 sek

Paměť: Zapnuto
Po spuštění: Zapnuto
Souborový systém: Zapnuto
Archivy: Zapnuto
Rootkity: Vypnuto
Heuristika: Zapnuto
PUP: Zapnuto
PUM: Zapnuto

Procesy: 0
(Nenalezeny žádné škodlivé položky)

Moduly: 0
(Nenalezeny žádné škodlivé položky)

Klíče registru: 0
(Nenalezeny žádné škodlivé položky)

Hodnoty registru: 0
(Nenalezeny žádné škodlivé položky)

Data registru: 0
(Nenalezeny žádné škodlivé položky)

Složky: 0
(Nenalezeny žádné škodlivé položky)

Soubory: 0
(Nenalezeny žádné škodlivé položky)

Fyzické sektory: 0
(Nenalezeny žádné škodlivé položky)


(end)
_______________________________________________________________________________________
# AdwCleaner v5.102 - Logfile created 20/03/2016 at 14:18:01
# Updated 13/03/2016 by Xplode
# Database : 2016-03-20.3 [Server]
# Operating system : Windows 7 Ultimate Service Pack 1 (x64)
# Username : PC - PC-PC
# Running from : C:\Users\PC\Desktop\AdwCleaner.exe
# Option : Scan
# Support : http://toolslib.net/forum

***** [ Services ] *****


***** [ Folders ] *****


***** [ Files ] *****


***** [ DLL ] *****


***** [ Shortcuts ] *****

Shortcut Infected : C:\Users\PC\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\WarThunder.lnk ( hxxp://mmotraffic.com/catalog/goplay/10 ... tCyCtByCyE )

***** [ Scheduled tasks ] *****


***** [ Registry ] *****

Key Found : HKCU\Software\PRODUCTSETUP
Key Found : HKU\S-1-5-21-1138721309-90681143-3877522351-1000\Software\PRODUCTSETUP

***** [ Web browsers ] *****


*************************

C:\Program Files (x86)\AdwCleaner\AdwCleaner[S1].txt - [977 bytes] - [20/03/2016 14:18:01]

########## EOF - C:\Program Files (x86)\AdwCleaner\AdwCleaner[S1].txt - [1069 bytes] ##########

[jerabina]

Spusť znovu AdwCleaner (u Windows Vista či Windows7, klikni na AdwCleaner pravým a vyber „Spustit jako správce“
klikni na „Prohledat-Scan“, po prohledání klikni na „ Vymazat-Clean“

Program provede opravu, po automatickém restartu neukáže log (C:\AdwCleaner [C?].txt) , jeho obsah sem celý vlož.

Stáhni si Junkware Removal Tool by Thisisu

na svojí plochu.

Deaktivuj si svůj antivirový program. Pravým tl. myši klikni na JRT.exe a vyber „spustit jako správce“. Pro pokračování budeš vyzván ke stisknutí jakékoliv klávesy. Na nějakou klikni.
Začne skenování programu. Skenování může trvat dloho , podle množství nákaz. Po ukončení skenu se objeví log (JRT.txt) , který se uloží na ploše.
Zkopíruj sem prosím celý jeho obsah.

Stáhni si RogueKiller
32bit.:
http://www.sur-la-toile.com/RogueKiller/RogueKiller.exe
64bit.:
http://www.sur-la-toile.com/RogueKiller ... lerX64.exe
na svojí plochu.
- Zavři všechny ostatní programy a prohlížeče.
- Pro OS Vista a win7 spusť program RogueKiller.exe jako správce , u XP poklepáním.
- počkej až skončí Prescan -vyhledávání škodlivých procesů.
-Potom klikni na „Prohledat“.
- Program skenuje procesy PC. Po proskenování klikni na „Zpráva“celý obsah logu sem zkopíruj.
Pokud je program blokován , zkus ho spustit několikrát. Pokud dále program nepůjde spustit a pracovat, přejmenuj ho na winlogon.exe.

[Simroth]

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Malwarebytes
Version: 8.0.4 (03.14.2016)
Operating System: Windows 7 Ultimate x64
Ran by PC (Administrator) on po 21.03.2016 at 7:58:15,76
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




File System: 8

Successfully deleted: C:\Users\PC\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\57HMNP1K (Temporary Internet Files Folder)
Successfully deleted: C:\Users\PC\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\BAZ2XI7P (Temporary Internet Files Folder)
Successfully deleted: C:\Users\PC\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F249E9EC (Temporary Internet Files Folder)
Successfully deleted: C:\Users\PC\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R201FZFI (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\57HMNP1K (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\BAZ2XI7P (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F249E9EC (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R201FZFI (Temporary Internet Files Folder)



Registry: 0





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on po 21.03.2016 at 7:58:52,93
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
________________________________________________________________________________________________________________________________________________________________
# AdwCleaner v5.103 - Logfile created 20/03/2016 at 22:29:55
# Updated 20/03/2016 by Xplode
# Database : 2016-03-20.7 [Server]
# Operating system : Windows 7 Ultimate Service Pack 1 (x64)
# Username : PC - PC-PC
# Running from : C:\Users\PC\Desktop\adwcleaner_5.103.exe
# Option : Clean
# Support : http://toolslib.net/forum

***** [ Services ] *****


***** [ Folders ] *****


***** [ Files ] *****


***** [ DLLs ] *****


***** [ Shortcuts ] *****

[-] Shortcut Disinfected : C:\Users\PC\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\WarThunder.lnk

***** [ Scheduled tasks ] *****


***** [ Registry ] *****

[-] Key Deleted : HKLM\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\3679CA35668772304D30A5FB873B0FA77BB70D54
[-] Key Deleted : HKCU\Software\PRODUCTSETUP

***** [ Web browsers ] *****


*************************

:: "Tracing" keys removed
:: Winsock settings cleared

*************************

C:\AdwCleaner\AdwCleaner[C1].txt - [978 bytes] - [20/03/2016 22:29:55]
C:\AdwCleaner\AdwCleaner[S1].txt - [1254 bytes] - [20/03/2016 22:29:13]

########## EOF - C:\AdwCleaner\AdwCleaner[C1].txt - [1123 bytes] ##########
_______________________________________________________________________________________________________________________________________________________
RogueKiller V12.0.2.0 (x64) [Mar 14 2016] (Free) by Adlice Software
mail : http://www.adlice.com/contact/
Feedback : http://forum.adlice.com
Webová stránka : http://www.adlice.com/software/roguekiller/
Blog : http://www.adlice.com

Operační systém : Windows 7 (6.1.7601 Service Pack 1) 64 bits version
Spuštěno : Normální režim
Uživatel : PC [Práva správce]
Started from : C:\Users\PC\Desktop\RogueKillerX64.exe
Mód : Prohledat -- Datum : 03/21/2016 11:46:49

¤¤¤ Procesy : 0 ¤¤¤

¤¤¤ Registry : 17 ¤¤¤
[Suspicious.Path] (X64) HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\GPUZ (\??\C:\Windows\TEMP\GPUZ.sys) -> Nalezeno
[Suspicious.Path] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\GPUZ (\??\C:\Windows\TEMP\GPUZ.sys) -> Nalezeno
[Suspicious.Path] (X64) HKEY_LOCAL_MACHINE\System\ControlSet002\Services\GPUZ (\??\C:\Windows\TEMP\GPUZ.sys) -> Nalezeno
[PUM.StartMenu] (X64) HKEY_USERS\S-1-5-21-1138721309-90681143-3877522351-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced | Start_ShowMyGames : 0 -> Nalezeno
[PUM.StartMenu] (X64) HKEY_USERS\S-1-5-21-1138721309-90681143-3877522351-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced | Start_ShowMyMusic : 0 -> Nalezeno
[PUM.StartMenu] (X64) HKEY_USERS\S-1-5-21-1138721309-90681143-3877522351-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced | Start_ShowHelp : 0 -> Nalezeno
[PUM.StartMenu] (X64) HKEY_USERS\S-1-5-21-1138721309-90681143-3877522351-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced | Start_ShowMyPics : 0 -> Nalezeno
[PUM.StartMenu] (X64) HKEY_USERS\S-1-5-21-1138721309-90681143-3877522351-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced | Start_ShowVideos : 0 -> Nalezeno
[PUM.StartMenu] (X64) HKEY_USERS\S-1-5-21-1138721309-90681143-3877522351-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced | Start_ShowSetProgramAccessAndDefaults : 0 -> Nalezeno
[PUM.StartMenu] (X64) HKEY_USERS\S-1-5-21-1138721309-90681143-3877522351-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced | Start_ShowPrinters : 0 -> Nalezeno
[PUM.StartMenu] (X86) HKEY_USERS\S-1-5-21-1138721309-90681143-3877522351-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced | Start_ShowMyGames : 0 -> Nalezeno
[PUM.StartMenu] (X86) HKEY_USERS\S-1-5-21-1138721309-90681143-3877522351-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced | Start_ShowMyMusic : 0 -> Nalezeno
[PUM.StartMenu] (X86) HKEY_USERS\S-1-5-21-1138721309-90681143-3877522351-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced | Start_ShowHelp : 0 -> Nalezeno
[PUM.StartMenu] (X86) HKEY_USERS\S-1-5-21-1138721309-90681143-3877522351-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced | Start_ShowMyPics : 0 -> Nalezeno
[PUM.StartMenu] (X86) HKEY_USERS\S-1-5-21-1138721309-90681143-3877522351-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced | Start_ShowVideos : 0 -> Nalezeno
[PUM.StartMenu] (X86) HKEY_USERS\S-1-5-21-1138721309-90681143-3877522351-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced | Start_ShowSetProgramAccessAndDefaults : 0 -> Nalezeno
[PUM.StartMenu] (X86) HKEY_USERS\S-1-5-21-1138721309-90681143-3877522351-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced | Start_ShowPrinters : 0 -> Nalezeno

¤¤¤ Úlohy : 0 ¤¤¤

¤¤¤ Soubory : 3 ¤¤¤
[Hidden.ADS][Stream] C:\Windows:{4B9A1497-0817-47C4-9612-D6A1C53ACF57} -> Nalezeno
[Hidden.ADS][Stream] C:\Windows:{DA6227CB-326B-4B4D-9A81-04B61F1538DD} -> Nalezeno
[Hidden.ADS][Stream] C:\Windows\System32:{DA6227CB-326B-4B4D-9A81-04B61F1538DD} -> Nalezeno

¤¤¤ Soubor HOSTS : 0 ¤¤¤

¤¤¤ Antirootkit : 0 (Driver: Nahrán) ¤¤¤

¤¤¤ Webové prohlížeče : 1 ¤¤¤
[PUM.HomePage][FIREFX:Config] v7awd53t.default-1450123443733 : user_pref("browser.startup.homepage", "about:newtab"); -> Nalezeno

¤¤¤ Kontrola MBR : ¤¤¤
+++++ PhysicalDrive0: Samsung SSD 850 EVO 120GB ATA Device +++++
--- User ---
[MBR] e8029d380707de7544214adae0077da1
[BSP] 71809c310fc2f840e4095debb5dcb459 : Windows Vista/7/8|VT.Unknown MBR Code
Partition table:
0 - [ACTIVE] NTFS (0x7) [VISIBLE] Offset (sectors): 2048 | Size: 102400 MB [Windows Vista/7/8 Bootstrap | Windows Vista/7/8 Bootloader]
User = LL1 ... OK
User = LL2 ... OK

+++++ PhysicalDrive1: SAMSUNG HD502IJ ATA Device +++++
--- User ---
[MBR] b362184755eced3f076ea3f5de43d363
[BSP] 95323091ecd7c3dc46803752c7e928e3 : Windows Vista/7/8|VT.Unknown MBR Code
Partition table:
0 - [ACTIVE] NTFS (0x7) [VISIBLE] Offset (sectors): 2048 | Size: 476936 MB [Windows Vista/7/8 Bootstrap | Windows Vista/7/8 Bootloader]
User = LL1 ... OK
User = LL2 ... OK

+++++ PhysicalDrive2: Samsung M3 Portable USB Device +++++
--- User ---
[MBR] 8f2a2b895fc6e5f340ff4a57322718c1
[BSP] 70a04fee94898615e9bee8f354539d68 : Windows XP|VT.Unknown MBR Code
Partition table:
0 - [ACTIVE] NTFS (0x7) [VISIBLE] Offset (sectors): 64 | Size: 476929 MB [Windows Vista/7/8 Bootstrap | Windows Vista/7/8 Bootloader]
User = LL1 ... OK
Error reading LL2 MBR! ([32] Po?adavek není podporován. )

[jerabina]

Zavři všechny programy a prohlížeče. Deaktivuj antivir a firewall.
Prosím, odpoj všechny USB (kromě myši s klávesnice) nebo externí disky z počítače před spuštěním tohoto programu.
Spusť znovu RogueKiller ( Pro Windows Vista nebo Windows 7, klepni pravým a vyber "Spustit jako správce", ve Windows XP poklepej ke spuštění).
- Počkej, až Prescan dokončí práci...
- Pak klikni na "Prohledat " ,po jeho skončení:
- V záložkách (Registry , Tasks , Web Browser apod.) vše zatrhni (dej zatržítka)
(musíš dát myší zatržítko do toho čtverečku vlevo od registru ap.)
- Klikni na "Smazat"
- Počkej, dokud Status box nezobrazí " Mazání dokončeno "
- Klikni na "Zpráva " a zkopíruj a vlož obsah té zprávy prosím sem. Log je možno nalézt v RKreport [číslo]. txt na ploše.
- Zavři RogueKiller

Vypni antivir
Stáhni
Zoek.exe

a uloz si ho na plochu.
Zavři všechny ostatní programy , okna i prohlížeče.
Spusť Zoek.exe ( u win vista , win7, 8 klikni na něj pravým a vyber : „Spustit jako správce“
- pozor , náběh programu může trvat déle.

Do okna programu vlož skript níže:

Kód: Vybrat vše

autoclean;
emptyclsid;
iedefaults;
FFdefaults;
CHRdefaults;
emptyalltemp;
resethosts;

klikni na Run Script
Program provede sken , opravu, sken i oprava může trvat i více minut ,je třeba posečkat do konce. Do okna neklikej!
Program nabídne restart , potvrď .

Po restartu se může nějaký čas ukázat pouze černá plocha , to je normální. Je třeba počkat až se vytvoří log. Ten si můžeš uložit třeba do dokumentů , jinak se sám ukládá do:
C:\zoek-results.log
Zkopíruj sem celý obsah toho logu.

Vypni rez. ochranu u antiviru a antispywaru,příp. firewall..

Stáhni si ComboFix (by sUBs)
a ulož si ho na plochu.
Ukonči všechna aktivní okna a spusť ho.
- Po spuštění se zobrazí podmínky užití, potvrď je stiskem tlačítka Ano
- Dále postupuj dle pokynů, během aplikování ComboFixu neklikej do zobrazujícího se okna
- Po dokončení skenování by měl program vytvořit log - C:\ComboFix.txt - zkopíruj sem prosím celý jeho obsah
Pokud budou problémy , spusť ho v nouz. režimu.

Upozornění : Může se stát, že po aplikaci Combofixu a restartu počítače, Windows nenaběhnou , nebo nenajede plocha , budou problémy s připojením, pak znovu restartuj počítač, pokud to nepomůže , po restartu mačkej klávesu F8 a pak zvol poslední známou funkční konfiguraci. , či použij bod obnovy.

[Simroth]

Po prvním RogueKilleru mi naběhla modrá smrt. Mel jsem tady vloženou hlášku, ale jak se mi restartoval FF, tak jsem o to přišel.
Ale ani ne tak doslova modrá. Jak sem dal Finish, tak jsem počkal těch 10sec a dal znova Finish. Najednou zčernala obrazovka, napsalo to Není Signál, a pak začal znovu nabíhat PC.


Zoek.exe v5.0.0.1 Updated 31-December-2015
Tool run by PC on po 21.03.2016 at 19:28:54,24.
Microsoft Windows 7 Ultimate 6.1.7601 Service Pack 1 x64
Running in: Normal Mode Internet Access Detected
Launched: C:\Users\PC\Desktop\zoek.exe [Scan all users] [Script inserted]

==== System Restore Info ======================

21.3.2016 19:29:07 Zoek.exe System Restore Point Created Successfully.

==== Reset Hosts File ======================

# Copyright (c) 1993-2006 Microsoft Corp.
#
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
#
# This file contains the mappings of IP addresses to host names. Each
# entry should be kept on an individual line. The IP address should
# be placed in the first column followed by the corresponding host name.
# The IP address and the host name should be separated by at least one
# space.
#
# Additionally, comments (such as these) may be inserted on individual
# lines or following the machine name denoted by a '#' symbol.
#
# For example:
#
# 102.54.94.97 rhino.acme.com # source server
# 38.25.63.10 x.acme.com # x client host

# localhost name resolution is handled within DNS itself.
127.0.0.1 localhost
::1 localhost

==== Empty Folders Check ======================

C:\PROGRA~2\Nov  slo§ka deleted successfully
C:\PROGRA~3\TamoSoft deleted successfully
C:\Users\PC\AppData\Roaming\dlg deleted successfully
C:\Users\PC\AppData\Roaming\Opera Software deleted successfully
C:\Users\PC\AppData\Roaming\WarThunder deleted successfully
C:\Users\PC\AppData\Local\Adobe deleted successfully
C:\Users\PC\AppData\Local\icsxml deleted successfully
C:\Users\PC\AppData\Local\ms-drivers deleted successfully
C:\Users\PC\AppData\Local\Opera Software deleted successfully
C:\Users\PC\AppData\Local\Sparta deleted successfully

==== Deleting CLSID Registry Keys ======================


==== Deleting CLSID Registry Values ======================


==== Deleting Services ======================


==== FireFox Fix ======================

Deleted from C:\Users\PC\AppData\Roaming\Mozilla\Firefox\Profiles\v7awd53t.default-1450123443733\prefs.js:

Added to C:\Users\PC\AppData\Roaming\Mozilla\Firefox\Profiles\v7awd53t.default-1450123443733\prefs.js:
user_pref("browser.startup.homepage", "about:home");
user_pref("browser.newtab.url", "about:newtab");

==== Deleting Files \ Folders ======================

C:\PROGRA~2\Nov  slo§ka not found
C:\PROGRA~2\Raptr deleted
C:\found.000 deleted
C:\Users\PC\AppData\Roaming\sparta111 deleted
C:\PROGRA~3\Package Cache deleted
C:\Users\PC\AppData\Roaming\Mozilla\Firefox\Profiles\v7awd53t.default-1450123443733\Invalidprefs.js deleted
"C:\Users\PC\AppData\Roaming\BPZMIAGfICdSICUHK" deleted
"C:\Users\PC\AppData\Roaming\ODIiCRLfZZXFhVPPb" deleted
"C:\Users\PC\AppData\Roaming\UiHVRScRGfOiOIYYb" deleted

==== Firefox Start and Search pages ======================

ProfilePath: C:\Users\PC\AppData\Roaming\Mozilla\Firefox\Profiles\v7awd53t.default-1450123443733
user_pref("browser.startup.homepage", "about:home");
user_pref("browser.newtab.url", "about:newtab");

==== Firefox Extensions ======================

ProfilePath: C:\Users\PC\AppData\Roaming\Mozilla\Firefox\Profiles\v7awd53t.default-1450123443733
- Auto Refresh em:version1.0.2.1-signed em:creatorGrizzly Ape em:descriptionRefresh tabs automatically at set intervals em:homepageURLhttp:www.grizzlyape.comaddonsauto-refresh em:iconURLchrome:autorefreshskinAuto Refresh 32X32.png em:optionsURLchrome:autorefreshcontentprefs-dialog.xul - %ProfilePath%\extensions\autorefresh@plugin.xpi
- Steam Database - %ProfilePath%\extensions\firefox-extension@steamdb.info.xpi
- Undetermined - %ProfilePath%\extensions\info@youtube-mp3.org.xpi
- 1-Click YouTube Video Downloader - %ProfilePath%\extensions\YoutubeDownloader@PeterOlayev.com.xpi
- YouTube High Definition - %ProfilePath%\extensions\{7b1bf0b6-a1b9-42b0-b75d-252036438bdc}.xpi
- Download YouTube Videos as MP4 - %ProfilePath%\extensions\{b9bfaf1c-a63f-47cd-8b9a-29526ced9060}.xpi
- Adblock Plus - %ProfilePath%\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi

AppDir: C:\Program Files (x86)\Mozilla Firefox
- Undetermined - %AppDir%\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}.xpi

==== Firefox Plugins ======================

Profilepath: C:\Users\PC\AppData\Roaming\Mozilla\Firefox\Profiles\v7awd53t.default-1450123443733
F627791AB91E01A9829A8D9B6E024D52 - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_21_0_0_182.dll - Shockwave Flash


==== Set IE to Default ======================

Old Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Use Search Asst"="yes"

New Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"="http://go.microsoft.com/fwlink/?LinkId=69157"
"Use Search Asst"="no"

==== All HKLM and HKCU SearchScopes ======================

HKLM\SearchScopes "DefaultScope"="{0633EE93-D776-472f-A0FF-E1416B8B2E3A}"
HKLM\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} - http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
HKLM\Wow6432Node\SearchScopes "DefaultScope"="{0633EE93-D776-472f-A0FF-E1416B8B2E3A}"
HKLM\Wow6432Node\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} - http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
HKCU\SearchScopes "DefaultScope"="{0633EE93-D776-472f-A0FF-E1416B8B2E3A}"
HKCU\SearchScopes\{012E1000-F331-11DB-8314-0800200C9A66} - http://www.google.com/search?q={searchTerms}
HKCU\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} - http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IESR02

==== Reset Google Chrome ======================

Nothing found to reset

==== Deleting Registry Keys ======================

HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogMeIn Hamachi Ui deleted successfully

==== Empty IE Cache ======================

C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\PC\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\SysNative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\serviceprofiles\networkservice\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\serviceprofiles\Localservice\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\serviceprofiles\Localservice\AppData\Local\Temp\Temporary Internet Files\Content.IE5 emptied successfully

==== Empty FireFox Cache ======================

C:\Users\PC\AppData\Local\Mozilla\Firefox\Profiles\v7awd53t.default-1450123443733\cache2 emptied successfully

==== Empty Chrome Cache ======================

No Chrome User Data found

==== Empty All Flash Cache ======================

Flash Cache Emptied Successfully

==== Empty All Java Cache ======================

No Java Cache Found

==== C:\zoek_backup content ======================

C:\zoek_backup (files=71 folders=57 64755386 bytes)

==== Empty Temp Folders ======================

C:\Users\Default\AppData\Local\Temp emptied successfully
C:\Users\Default User\AppData\Local\Temp emptied successfully
C:\Users\PC\AppData\Local\Temp will be emptied at reboot
C:\Windows\serviceprofiles\networkservice\AppData\Local\Temp will be emptied at reboot
C:\Windows\serviceprofiles\Localservice\AppData\Local\Temp emptied successfully
C:\Windows\Temp will be emptied at reboot

==== After Reboot ======================

==== Empty Temp Folders ======================

C:\Windows\Temp successfully emptied
C:\Users\PC\AppData\Local\Temp successfully emptied

==== Empty Recycle Bin ======================

C:\$RECYCLE.BIN successfully emptied

==== Deleting Files / Folders ======================

"C:\Windows\serviceprofiles\networkservice\AppData\Local\Temp\MpCmdRun-8A-53C9D589-6B66-4F30-9BAB-9A0193B0BAFC.lock" not found
"C:\Windows\serviceprofiles\networkservice\AppData\Local\Temp\MpCmdRun.log" not found

==== EOF on po 21.03.2016 at 19:55:39,17 ======================
__________________________________________________________________________________________________________________________________________________
ComboFix 16-03-19.01 - PC 21.03.2016 20:11:31.1.4 - x64
Microsoft Windows 7 Ultimate 6.1.7601.1.1250.420.1029.18.8120.4916 [GMT 1:00]
Spuštěný z: c:\users\PC\Desktop\ComboFix.exe
AV: Microsoft Security Essentials *Disabled/Updated* {768124D7-F5F7-6D2F-DDC2-94DFA4017C95}
SP: Microsoft Security Essentials *Disabled/Updated* {CDE0C533-D3CD-62A1-E772-AFADDF863628}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2016-02-21 do 2016-03-21 )))))))))))))))))))))))))))))))
.
.
2016-03-21 19:14 . 2016-03-21 19:14 -------- d-----w- c:\users\Default\AppData\Local\temp
2016-03-21 19:07 . 2016-03-21 19:07 75888 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{C136AD39-F537-456E-B47C-04CAA700A914}\offreg.3392.dll
2016-03-21 18:38 . 2016-03-21 18:28 24064 ----a-w- c:\windows\zoek-delete.exe
2016-03-21 18:38 . 2016-03-21 19:14 -------- d-----w- c:\users\PC\AppData\Local\Temp
2016-03-21 18:23 . 2016-03-10 11:51 11249080 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{C136AD39-F537-456E-B47C-04CAA700A914}\mpengine.dll
2016-03-21 12:04 . 2016-03-21 12:04 75888 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{5ED4464D-BBE6-4946-9F62-BE58850A4D5B}\offreg.884.dll
2016-03-21 12:04 . 2016-02-19 01:53 11249080 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{5ED4464D-BBE6-4946-9F62-BE58850A4D5B}\mpengine.dll
2016-03-21 10:43 . 2016-03-21 19:03 28272 ----a-w- c:\windows\system32\drivers\TrueSight.sys
2016-03-21 10:42 . 2016-03-21 18:17 -------- d-----w- c:\programdata\RogueKiller
2016-03-20 21:29 . 2016-03-20 21:29 -------- d-----w- C:\AdwCleaner
2016-03-20 14:38 . 2012-07-26 03:08 84992 ----a-w- c:\windows\system32\WUDFSvc.dll
2016-03-20 14:38 . 2012-07-26 03:08 194048 ----a-w- c:\windows\system32\WUDFPlatform.dll
2016-03-20 14:38 . 2012-07-26 02:26 87040 ----a-w- c:\windows\system32\drivers\WUDFPf.sys
2016-03-20 14:38 . 2012-07-26 02:26 198656 ----a-w- c:\windows\system32\drivers\WUDFRd.sys
2016-03-20 14:38 . 2012-07-26 03:08 229888 ----a-w- c:\windows\system32\WUDFHost.exe
2016-03-20 14:38 . 2012-07-26 03:08 744448 ----a-w- c:\windows\system32\WUDFx.dll
2016-03-20 14:38 . 2012-07-26 03:08 45056 ----a-w- c:\windows\system32\WUDFCoinstaller.dll
2016-03-20 14:32 . 2016-03-20 14:32 -------- d-----w- c:\users\Default\AppData\Local\Microsoft Help
2016-03-20 13:44 . 2016-02-08 20:38 47616 ----a-w- c:\windows\SysWow64\ieetwproxystub.dll
2016-03-20 13:44 . 2016-02-08 18:34 49664 ----a-w- c:\program files\Internet Explorer\DiagnosticsHub_is.dll
2016-03-20 13:44 . 2016-02-08 18:27 2887680 ----a-w- c:\windows\system32\iertutil.dll
2016-03-20 13:44 . 2016-02-08 18:26 48640 ----a-w- c:\windows\system32\ieetwproxystub.dll
2016-03-20 13:44 . 2016-02-08 18:18 34304 ----a-w- c:\windows\system32\iernonce.dll
2016-03-20 13:44 . 2016-02-08 18:14 114688 ----a-w- c:\windows\system32\ieetwcollector.exe
2016-03-20 13:44 . 2016-02-08 17:57 276480 ----a-w- c:\program files\Internet Explorer\DiagnosticsHub.ScriptedSandboxPlugin.dll
2016-03-20 13:42 . 2016-02-05 18:50 25600 ----a-w- c:\windows\SysWow64\lpk.dll
2016-03-20 13:36 . 2015-07-30 18:06 2565120 ----a-w- c:\windows\system32\d3d10warp.dll
2016-03-20 13:36 . 2015-07-30 17:57 1987584 ----a-w- c:\windows\SysWow64\d3d10warp.dll
2016-03-20 13:33 . 2015-02-03 03:31 1424896 ----a-w- c:\windows\system32\WindowsCodecs.dll
2016-03-20 13:33 . 2015-02-03 03:12 1230848 ----a-w- c:\windows\SysWow64\WindowsCodecs.dll
2016-03-20 13:32 . 2016-02-19 19:02 38336 ----a-w- c:\windows\system32\CompatTelRunner.exe
2016-03-20 13:32 . 2016-02-19 18:54 1168896 ----a-w- c:\windows\system32\aeinv.dll
2016-03-20 13:32 . 2016-02-19 14:07 1373184 ----a-w- c:\windows\system32\appraiser.dll
2016-03-20 13:32 . 2016-02-11 14:07 689152 ----a-w- c:\windows\system32\generaltel.dll
2016-03-20 13:32 . 2016-02-05 14:07 696832 ----a-w- c:\windows\system32\invagent.dll
2016-03-20 13:32 . 2016-02-05 14:07 499200 ----a-w- c:\windows\system32\devinv.dll
2016-03-20 13:32 . 2016-02-05 14:07 76800 ----a-w- c:\windows\system32\acmigration.dll
2016-03-20 13:32 . 2015-11-16 20:17 210432 ----a-w- c:\windows\system32\aepic.dll
2016-03-20 13:32 . 2012-02-11 06:36 559104 ----a-w- c:\windows\system32\spoolsv.exe
2016-03-20 13:32 . 2012-02-11 06:36 67072 ----a-w- c:\windows\splwow64.exe
2016-03-20 13:17 . 2016-03-20 13:18 -------- d-----w- c:\program files (x86)\AdwCleaner
2016-03-19 12:24 . 2016-03-19 12:24 -------- d-----w- c:\program files\WinRAR
2016-03-19 12:24 . 2012-12-28 11:03 89600 ----a-w- c:\windows\SysWow64\RAMDriv.dll
2016-03-19 12:24 . 2012-12-28 11:03 89600 ----a-w- c:\windows\system32\RAMDriv.dll
2016-03-19 12:24 . 2012-12-28 10:54 343032 ----a-w- c:\windows\SysWow64\RAMDiskImage.exe
2016-03-19 12:24 . 2012-12-27 18:06 81912 ----a-w- c:\windows\SysWow64\drivers\RAMDriv.sys
2016-03-19 12:24 . 2012-12-27 18:06 81912 ----a-w- c:\windows\system32\drivers\RAMDriv.sys
2016-03-19 12:22 . 2016-03-19 12:22 -------- d-----w- c:\program files (x86)\Intel
2016-03-19 12:22 . 2016-03-19 12:22 -------- d-----w- C:\Intel
2016-03-19 12:22 . 2015-08-18 08:51 1692840 ----a-w- c:\windows\SysWow64\muachost.exe
2016-03-19 12:22 . 2016-03-19 12:24 -------- d-----w- C:\MSI
2016-03-19 12:22 . 2016-03-19 12:22 -------- d-----w- c:\program files (x86)\MSI
2016-03-18 13:28 . 2015-11-01 17:07 1190000 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{FA9F91D7-EC26-4D5D-8626-1D64C404EEA3}\gapaengine.dll
2016-03-18 13:28 . 2016-02-19 01:53 11249080 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2016-03-11 22:48 . 2016-03-12 01:58 -------- d-----w- c:\users\PC\AppData\Roaming\Spintires
2016-03-11 02:05 . 2016-03-11 02:05 -------- d-----w- c:\users\PC\AppData\Roaming\Locktime Software
2016-03-09 21:40 . 2016-03-10 10:27 348360 ----a-w- c:\windows\SysWow64\PnkBstrB.xtr
2016-03-09 21:40 . 2016-03-09 21:40 -------- d-----w- c:\users\PC\AppData\Local\PunkBuster
2016-03-09 21:22 . 2016-03-09 21:22 -------- d-----w- c:\users\PC\AppData\Local\ESN
2016-03-09 21:22 . 2016-03-09 21:22 -------- d-----w- c:\program files (x86)\Battlelog Web Plugins
2016-03-09 21:15 . 2016-03-09 21:15 -------- d-----w- c:\programdata\EA Core
2016-03-09 21:15 . 2016-03-09 22:10 -------- d-----w- c:\programdata\EA Logs
2016-03-09 21:14 . 2016-03-10 10:27 348360 ----a-w- c:\windows\SysWow64\PnkBstrB.exe
2016-03-09 21:14 . 2016-03-10 10:27 280904 ----a-w- c:\windows\SysWow64\PnkBstrB.ex0
2016-03-09 21:14 . 2016-03-09 21:48 76152 ----a-w- c:\windows\SysWow64\PnkBstrA.exe
2016-03-08 23:14 . 2016-03-08 23:14 -------- d-----w- c:\programdata\Downloaded Installations
2016-03-08 16:34 . 2016-03-08 16:35 -------- d-----w- c:\program files (x86)\Overwolf
2016-03-08 16:34 . 2016-03-08 16:34 -------- d-----w- c:\program files (x86)\Common Files\Overwolf
2016-03-08 16:34 . 2016-03-08 16:38 -------- d-----w- c:\programdata\Overwolf
2016-03-08 16:32 . 2016-03-21 18:55 -------- d-----w- c:\users\PC\AppData\Local\Overwolf
2016-03-06 23:30 . 2016-03-06 23:30 -------- d-----w- c:\users\PC\VirtualBox VMs
2016-03-06 23:15 . 2016-03-06 23:41 -------- d-----w- c:\users\PC\.VirtualBox
2016-03-06 23:15 . 2016-03-04 16:29 982504 ----a-w- c:\windows\system32\drivers\VBoxDrv.sys
2016-03-06 23:15 . 2016-03-06 23:15 -------- dc----w- c:\windows\system32\DRVSTORE
2016-03-06 23:15 . 2016-03-04 16:29 148808 ----a-w- c:\windows\system32\drivers\VBoxUSBMon.sys
2016-03-06 23:15 . 2016-03-06 23:15 -------- d-----w- c:\program files\Oracle
2016-03-06 17:56 . 2016-03-06 23:31 -------- d-----w- c:\users\PC\AppData\Local\AMD
2016-03-06 17:53 . 2016-03-21 18:36 -------- d-----w- C:\zoek_backup
2016-03-04 16:29 . 2016-03-04 16:29 205784 ----a-w- c:\windows\system32\drivers\VBoxNetLwf.sys
2016-03-04 16:29 . 2016-03-04 16:29 127456 ----a-w- c:\windows\system32\drivers\VBoxNetAdp6.sys
2016-03-03 16:08 . 2016-03-03 16:07 242960 ----a-w- c:\windows\SysWow64\EasyAntiCheat.exe
2016-02-28 17:34 . 2016-02-28 17:34 -------- d-----w- c:\program files (x86)\Cheat Engine 6.5
2016-02-27 20:24 . 2016-02-27 20:27 -------- d-----w- c:\program files (x86)\OpenAL
2016-02-27 20:24 . 2016-02-27 20:24 466520 ----a-w- c:\windows\system32\wrap_oal.dll
2016-02-27 20:24 . 2016-02-27 20:24 445016 ----a-w- c:\windows\SysWow64\wrap_oal.dll
2016-02-27 20:24 . 2016-02-27 20:24 123480 ----a-w- c:\windows\system32\OpenAL32.dll
2016-02-27 20:24 . 2016-02-27 20:24 109144 ----a-w- c:\windows\SysWow64\OpenAL32.dll
2016-02-24 19:50 . 2016-02-24 19:50 -------- d-----w- c:\programdata\Insight Software Solutions
2016-02-24 19:50 . 2016-02-24 19:50 -------- d-----w- c:\program files (x86)\Common Files\Insight Software Solutions
2016-02-24 19:50 . 2016-02-24 19:50 -------- d-----w- c:\program files (x86)\Macro Express3
2016-02-24 19:39 . 2016-02-24 19:39 -------- d-----w- c:\program files (x86)\All Ten Fingers 8.5
2016-02-24 14:16 . 2016-02-24 14:16 -------- d-----w- c:\users\PC\AppData\Local\OCCT_-_Ocbase_-_Adrien_Me
2016-02-24 13:56 . 2016-02-24 13:56 -------- d-----w- c:\program files (x86)\OCCTPT
2016-02-23 13:27 . 2016-02-26 19:37 -------- d-----w- c:\users\PC\AppData\Local\Deployment
2016-02-23 13:10 . 2016-02-23 13:10 -------- d-----w- c:\programdata\Gyazo
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2016-03-21 18:55 . 2015-11-22 13:08 192216 ----a-w- c:\windows\system32\drivers\MBAMSwissArmy.sys
2016-03-20 14:25 . 2015-11-01 18:49 143659408 ----a-w- c:\windows\system32\MRT.exe
2016-03-10 22:51 . 2015-11-01 20:48 797376 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2016-03-10 22:51 . 2015-11-01 20:48 142528 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2016-02-12 10:38 . 2016-02-12 10:38 147528 ----a-w- c:\windows\system32\drivers\bflwfx64.sys
2016-02-12 09:32 . 2016-02-12 09:32 134296 ----a-w- c:\windows\system32\drivers\e2xw7x64.sys
2016-02-11 18:48 . 2016-03-20 13:43 344064 ----a-w- c:\windows\system32\schannel.dll
2016-02-11 18:37 . 2016-03-20 13:43 251392 ----a-w- c:\windows\SysWow64\schannel.dll
2016-02-11 18:30 . 2016-03-20 13:43 44032 ----a-w- c:\windows\apppatch\acwow64.dll
2016-01-22 17:16 . 2015-11-01 20:51 97888 ----a-w- c:\windows\SysWow64\WindowsAccessBridge-32.dll
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Steam"="c:\program files (x86)\Steam\steam.exe" [2016-03-10 3074128]
"CCleaner Monitoring"="c:\program files\CCleaner\CCleaner64.exe" [2016-02-12 8641240]
"RoccatPowerGrid"="c:\program files (x86)\ROCCAT\Power-Grid\ROCCATPowerGrid.exe" [2015-04-20 5149256]
"Gyazo"="c:\program files (x86)\Gyazo\GyStation.exe" [2016-02-17 3586848]
"Overwolf"="c:\program files (x86)\Overwolf\Overwolf.exe" [2016-02-11 45296]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"MyPublicWiFi"="c:\program files (x86)\MyPublicWiFi\MyPublicWiFi.exe" [2011-12-22 2002944]
"Command Center"="c:\program files (x86)\MSI\Command Center\StartCommandCenter.exe" [2016-02-16 830416]
"RemoteMedia"="c:\program files (x86)\MSI\Command Center\RemoteMedia.exe" [2014-03-27 1144304]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"aux1"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes Anti-Malware\mbamservice.exe;c:\program files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [x]
R2 MyPublicWiFiService;MyPublicWiFi Service;c:\program files (x86)\MyPublicWiFi\PublicWiFiService.exe;c:\program files (x86)\MyPublicWiFi\PublicWiFiService.exe [x]
R2 nldrv;nldrv;c:\program files\Locktime Software\NetLimiter 4\nldrv.sys;c:\program files\Locktime Software\NetLimiter 4\nldrv.sys [x]
R2 RAMDriv;MSI RAMDrive;c:\windows\system32\DRIVERS\ramdriv.sys;c:\windows\SYSNATIVE\DRIVERS\ramdriv.sys [x]
R3 athur;Wireless Network Adapter Service;c:\windows\system32\DRIVERS\athurx.sys;c:\windows\SYSNATIVE\DRIVERS\athurx.sys [x]
R3 atillk64;atillk64;c:\users\PC\Desktop\asdfghj\atillk64.sys;c:\users\PC\Desktop\asdfghj\atillk64.sys [x]
R3 BEService;BattlEye Service;c:\program files (x86)\Common Files\BattlEye\BEService.exe;c:\program files (x86)\Common Files\BattlEye\BEService.exe [x]
R3 cpuz138;cpuz138;c:\users\PC\AppData\Local\Temp\cpuz138\cpuz138_x64.sys;c:\users\PC\AppData\Local\Temp\cpuz138\cpuz138_x64.sys [x]
R3 CV2K1;CommView Network Monitor;c:\windows\system32\DRIVERS\cv2k1.sys;c:\windows\SYSNATIVE\DRIVERS\cv2k1.sys [x]
R3 DIRECTIO;DIRECTIO;c:\program files (x86)\PerformanceTest\DirectIo64.sys;c:\program files (x86)\PerformanceTest\DirectIo64.sys [x]
R3 Disc Soft Lite Bus Service;Disc Soft Lite Bus Service;c:\program files\DAEMON Tools Lite\DiscSoftBusService.exe;c:\program files\DAEMON Tools Lite\DiscSoftBusService.exe [x]
R3 EasyAntiCheat;EasyAntiCheat;c:\windows\system32\EasyAntiCheat.exe;c:\windows\SYSNATIVE\EasyAntiCheat.exe [x]
R3 Futuremark SystemInfo Service;Futuremark SystemInfo Service;c:\program files (x86)\Futuremark\SystemInfo\FMSISvc.exe;c:\program files (x86)\Futuremark\SystemInfo\FMSISvc.exe [x]
R3 ICCS;Intel(R) Integrated Clock Controller Service - Intel(R) ICCS;c:\program files (x86)\Intel\Intel(R) Integrated Clock Controller Service\ICCProxy.exe;c:\program files (x86)\Intel\Intel(R) Integrated Clock Controller Service\ICCProxy.exe [x]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x]
R3 KillerEth;NDIS Miniport Driver for Killer PCI-E Gigabit Ethernet Controller;c:\windows\system32\DRIVERS\e2xw7x64.sys;c:\windows\SYSNATIVE\DRIVERS\e2xw7x64.sys [x]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys;c:\windows\SYSNATIVE\drivers\mbam.sys [x]
R3 MBAMWebAccessControl;MBAMWebAccessControl;c:\windows\system32\drivers\mwac.sys;c:\windows\SYSNATIVE\drivers\mwac.sys [x]
R3 MSIClock_CC;MSI Command Center Clock Service;c:\program files (x86)\MSI\Command Center\ClockGen\MSIClockService.exe;c:\program files (x86)\MSI\Command Center\ClockGen\MSIClockService.exe [x]
R3 MSICOMM_CC;MSI Command Center Comm Service;c:\program files (x86)\MSI\Command Center\MSICommService.exe;c:\program files (x86)\MSI\Command Center\MSICommService.exe [x]
R3 MSICPU_CC;MSI Command Center CPU Service;c:\program files (x86)\MSI\Command Center\CPU\MSICPUService.exe;c:\program files (x86)\MSI\Command Center\CPU\MSICPUService.exe [x]
R3 MSISMB_CC;MSI Command Center SMBus Service;c:\program files (x86)\MSI\Command Center\SMBus\MSISMBService.exe;c:\program files (x86)\MSI\Command Center\SMBus\MSISMBService.exe [x]
R3 MSISuperIO_CC;MSI Command Center SuperIO Service;c:\program files (x86)\MSI\Command Center\SuperIO\MSISuperIOService.exe;c:\program files (x86)\MSI\Command Center\SuperIO\MSISuperIOService.exe [x]
R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys;c:\windows\SYSNATIVE\DRIVERS\NisDrvWFP.sys [x]
R3 NisSrv;Kontrola sítě Microsoft;c:\program files\Microsoft Security Client\NisSrv.exe;c:\program files\Microsoft Security Client\NisSrv.exe [x]
R3 Origin Client Service;Origin Client Service;c:\program files (x86)\Origin\OriginClientService.exe;c:\program files (x86)\Origin\OriginClientService.exe [x]
R3 OverwolfUpdater;Overwolf Updater Windows SCM;c:\program files (x86)\Overwolf\OverwolfUpdater.exe;c:\program files (x86)\Overwolf\OverwolfUpdater.exe [x]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys;c:\windows\SYSNATIVE\drivers\rdpvideominiport.sys [x]
R3 ScreamBAudioSvc;ScreamBee Audio;c:\windows\system32\drivers\ScreamingBAudio64.sys;c:\windows\SYSNATIVE\drivers\ScreamingBAudio64.sys [x]
R3 Synth3dVsc;Synth3dVsc;c:\windows\system32\drivers\synth3dvsc.sys;c:\windows\SYSNATIVE\drivers\synth3dvsc.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 tsusbhub;tsusbhub;c:\windows\system32\drivers\tsusbhub.sys;c:\windows\SYSNATIVE\drivers\tsusbhub.sys [x]
R3 VGPU;VGPU;c:\windows\system32\drivers\rdvgkmd.sys;c:\windows\SYSNATIVE\drivers\rdvgkmd.sys [x]
S1 ndisrd;WinpkFilter LightWeight Filter;c:\windows\system32\DRIVERS\ndisrd.sys;c:\windows\SYSNATIVE\DRIVERS\ndisrd.sys [x]
S1 VBoxDrv;VirtualBox Service;c:\windows\system32\DRIVERS\VBoxDrv.sys;c:\windows\SYSNATIVE\DRIVERS\VBoxDrv.sys [x]
S1 VBoxNetAdp;VirtualBox NDIS 6.0 Miniport Service;c:\windows\system32\DRIVERS\VBoxNetAdp6.sys;c:\windows\SYSNATIVE\DRIVERS\VBoxNetAdp6.sys [x]
S1 VBoxNetLwf;VirtualBox NDIS6 Bridged Networking Service;c:\windows\system32\DRIVERS\VBoxNetLwf.sys;c:\windows\SYSNATIVE\DRIVERS\VBoxNetLwf.sys [x]
S1 VBoxUSBMon;VirtualBox USB Monitor Driver;c:\windows\system32\DRIVERS\VBoxUSBMon.sys;c:\windows\SYSNATIVE\DRIVERS\VBoxUSBMon.sys [x]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe;c:\windows\SYSNATIVE\atiesrxx.exe [x]
S2 DiagTrack;Diagnostics Tracking Service;c:\windows\System32\svchost.exe;c:\windows\SYSNATIVE\svchost.exe [x]
S2 MSICTL_CC;MSI Command Center control Service;c:\program files (x86)\MSI\Command Center\MSIControlService.exe;c:\program files (x86)\MSI\Command Center\MSIControlService.exe [x]
S2 MSIDDR_CC;MSI Command Center DDR Service;c:\program files (x86)\MSI\Command Center\DDR\MSIDDRService.exe;c:\program files (x86)\MSI\Command Center\DDR\MSIDDRService.exe [x]
S3 AtiHDAudioService;AMD Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW76.sys;c:\windows\SYSNATIVE\drivers\AtihdW76.sys [x]
S3 dtlitescsibus;DAEMON Tools Lite Virtual SCSI Bus;c:\windows\system32\DRIVERS\dtlitescsibus.sys;c:\windows\SYSNATIVE\DRIVERS\dtlitescsibus.sys [x]
S3 NTIOLib_MSIDDR_CC;NTIOLib_MSIDDR_CC;c:\program files (x86)\MSI\Command Center\DDR\NTIOLib_X64.sys;c:\program files (x86)\MSI\Command Center\DDR\NTIOLib_X64.sys [x]
S3 ts_arnusb;[CommView] Atheros AR9271 Wireless Network Adapter Service;c:\windows\system32\DRIVERS\ts_arnusbx.sys;c:\windows\SYSNATIVE\DRIVERS\ts_arnusbx.sys [x]
.
.
--- Ostatní služby/ovladače v paměti ---
.
*NewlyCreated* - RTCORE64
*Deregistered* - RTCore64
*Deregistered* - TrueSight
.
Obsah adresáře 'Naplánované úlohy'
.
2016-03-21 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-11-01 22:51]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDVCPL"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2010-07-28 11101800]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2016-01-29 1340192]
"StartCN"="c:\program files\AMD\CNext\CNext\cnext.exe" [2015-11-18 4859592]
"Fences"="c:\program files (x86)\Stardock\Fences\Fences.exe" [2013-11-26 4031152]
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\SharedTaskScheduler]
"{1984DD45-52CF-49cd-AB77-18F378FEA264}"= "c:\program files (x86)\Stardock\Fences\FencesMenu64.dll" [2013-11-26 521904]
.
------- Doplňkový sken -------
.
uLocal Page = c:\windows\system32\blank.htm
mLocal Page = c:\windows\SysWOW64\blank.htm
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~2\MIF5BA~1\Office12\EXCEL.EXE/3000
TCP: DhcpNameServer = 8.8.8.8
FF - ProfilePath - c:\users\PC\AppData\Roaming\Mozilla\Firefox\Profiles\v7awd53t.default-1450123443733\
FF - prefs.js: browser.startup.homepage - about:home
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
.
Wow6432Node-HKCU-Run-Battle.net - c:\program files (x86)\Battle.net\Battle.net
Wow6432Node-HKU-Default-RunOnce-SPReview - c:\windows\System32\SPReview\SPReview.exe
AddRemove-Stardock Fences 2 - c:\program files (x86)\Stardock\Fences\uninstall.exe
AddRemove-{050d4fc8-5d48-4b8f-8972-47c82c46020f} - c:\programdata\Package Cache\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\vcredist_x64.exe
AddRemove-{23daf363-3020-4059-b3ae-dc4ad39fed19} - c:\programdata\Package Cache\{23daf363-3020-4059-b3ae-dc4ad39fed19}\VC_redist.x86.exe
AddRemove-{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f} - c:\programdata\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
AddRemove-{3ee5e5bb-b7cc-4556-8861-a00a82977d6c} - c:\programdata\Package Cache\{3ee5e5bb-b7cc-4556-8861-a00a82977d6c}\VC_redist.x64.exe
AddRemove-{a1909659-0a08-4554-8af1-2175904903a1} - c:\programdata\Package Cache\{a1909659-0a08-4554-8af1-2175904903a1}\vcredist_x64.exe
AddRemove-{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6} - c:\programdata\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
AddRemove-{f5aa1c48-f2dc-4f4f-a71d-65bd7d0dc5c5} - c:\programdata\Package Cache\{f5aa1c48-f2dc-4f4f-a71d-65bd7d0dc5c5}\3dmark-setup.exe
AddRemove-{f65db027-aff3-4070-886a-0d87064aabb1} - c:\programdata\Package Cache\{f65db027-aff3-4070-886a-0d87064aabb1}\vcredist_x86.exe
.
.
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Celkový čas: 2016-03-21 20:15:27
ComboFix-quarantined-files.txt 2016-03-21 19:15
.
Před spuštěním: Volných bajtů: 29 499 969 536
Po spuštění: Volných bajtů: 29 091 438 592
.
- - End Of File - - A18F8EE9198FAD76DABF7F4EC4D7D11C
A36C5E4F47E84449FF07ED3517B43A31

__________________________________________________________________________________________________________________________________________________
RogueKiller V12.0.3.0 (x64) [Mar 21 2016] (Free) by Adlice Software
mail : http://www.adlice.com/contact/
Feedback : http://forum.adlice.com
Webová stránka : http://www.adlice.com/software/roguekiller/
Blog : http://www.adlice.com

Operační systém : Windows 7 (6.1.7601 Service Pack 1) 64 bits version
Spuštěno : Normální režim
Uživatel : PC [Práva správce]
Started from : C:\Users\PC\Desktop\RogueKillerX64(1).exe
Mód : Prohledat -- Datum : 03/21/2016 20:07:19

¤¤¤ Procesy : 0 ¤¤¤

¤¤¤ Registry : 0 ¤¤¤

¤¤¤ Úlohy : 0 ¤¤¤

¤¤¤ Soubory : 0 ¤¤¤

¤¤¤ Soubor HOSTS : 0 ¤¤¤

¤¤¤ Antirootkit : 0 (Driver: Nahrán) ¤¤¤

¤¤¤ Webové prohlížeče : 0 ¤¤¤

¤¤¤ Kontrola MBR : ¤¤¤
+++++ PhysicalDrive0: Samsung SSD 850 EVO 120GB ATA Device +++++
--- User ---
[MBR] e8029d380707de7544214adae0077da1
[BSP] 71809c310fc2f840e4095debb5dcb459 : Windows Vista/7/8|VT.Unknown MBR Code
Partition table:
0 - [ACTIVE] NTFS (0x7) [VISIBLE] Offset (sectors): 2048 | Size: 102400 MB [Windows Vista/7/8 Bootstrap | Windows Vista/7/8 Bootloader]
User = LL1 ... OK
User = LL2 ... OK

+++++ PhysicalDrive1: SAMSUNG HD502IJ ATA Device +++++
--- User ---
[MBR] b362184755eced3f076ea3f5de43d363
[BSP] 95323091ecd7c3dc46803752c7e928e3 : Windows Vista/7/8|VT.Unknown MBR Code
Partition table:
0 - [ACTIVE] NTFS (0x7) [VISIBLE] Offset (sectors): 2048 | Size: 476936 MB [Windows Vista/7/8 Bootstrap | Windows Vista/7/8 Bootloader]
User = LL1 ... OK
User = LL2 ... OK

[jaro3]

V možnostech složky si povol zobrazování skrytých souborů a složek+ odškrtni zatržítko skrýt chráněné soubory operačního systému

Toto otestuj na Virustotal
c:\windows\system32\drivers\e2xw7x64.sys


Klikni vpravo od okénka na Vybrat a v Exploreru najdi požadovaný soubor v Tvém PC. Označ ho myší a klikni na Otevřít , poté klikni na Send File. Pokud už byl soubor testován , objeví se okno ve kterém klikni na Reanalyze. Soubor se začne postupně testovat více antivirovými programy. Až skončí test posledního antiviru , objeví se nahoře result a červeně počet nákaz , např. 0/43 , nebo 1/43. Pak zkopíruj myší odkaz na tuto stránku a vlož ji do svého příspěvku.

Nebo na:
http://www.virscan.org/


Stáhni si aswMBR
na svojí plochu. Uzavři všechna okna , programy a prohlížeče. Poklepej na aswMBR.exe. Pokud se objeví hláška o možnosti stáhnutí databáze Avastu , klikni na NE. Poté klikni na „Scan“ . Po skenu klikni na „Save Log“ a ulož si log na plochu .Zkopíruj sem celý obsah toho logu. Pak klikni na „Exit“ k zavření programu.

[Simroth]

Ty složky mam už odjakživa. Odškrtl jsem i to druhý, ale uvedený soubor nemůžu nalézt.

[jerabina]

Udělej ještě ten aswMBR.

[Simroth]

Tak já nevim. Po tom aswMBR jsem restartoval PC, abych nemusel programy zapínat znovu, a pořád mi vrtal hlavou ten soubor.
Tak jsem ho automaticky hledal normálně v Průzkumníku, a ejhle.. Našel jsem ho tam. Otevřu ten VirusTotal, a tam ho prostě nemůžu najít. (Přikládam obrázek)
Ale já už asi vim, od jakýho programu to je. Kámoš ná na sledování netu program Killer Suite, tak sem si ho stáhnul taky. Ale jelikož mám PC na Wifi, tak mi to bylo k ničemu a hned to šlo pryč.

Nakopíroval jsem ho teď na plochu, a oskenoval ho.


aswMBR version 1.0.1.2290 Copyright(c) 2014 AVAST Software
Run date: 2016-03-22 20:40:43
-----------------------------
20:40:43.837 OS Version: Windows x64 6.1.7601 Service Pack 1
20:40:43.837 Number of processors: 4 586 0x3C03
20:40:43.838 ComputerName: PC-PC UserName: PC
20:40:43.983 Initialize success
20:40:43.993 VM: initialized successfully
20:40:43.993 VM: Intel CPU supported
20:40:49.070 VM: supported disk I/O ataport.SYS
20:40:54.102 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP1T0L0-1
20:40:54.104 Disk 0 Vendor: Samsung_SSD_850_EVO_120GB EMT01B6Q Size: 114473MB BusType: 11
20:40:54.106 Disk 1 \Device\Harddisk1\DR1 -> \Device\Ide\IdeDeviceP0T0L0-0
20:40:54.107 Disk 1 Vendor: SAMSUNG_HD502IJ 1AA01113 Size: 476938MB BusType: 11
20:40:54.111 VM: Disk 0 MBR read successfully
20:40:54.113 Disk 0 MBR scan
20:40:54.114 Disk 0 Windows 7 default MBR code
20:40:54.116 Disk 0 Partition 1 80 (A) 07 HPFS/NTFS NTFS 102400 MB offset 2048
20:40:54.117 Disk 0 Boot: NTFS code=2
20:40:54.123 Disk 0 scanning C:\Windows\system32\drivers
20:40:54.753 Service scanning
20:40:56.586 Modules scanning
20:40:56.590 Disk 0 trace - called modules:
20:40:56.593 ntoskrnl.exe CLASSPNP.SYS disk.sys ataport.SYS PCIIDEX.SYS hal.dll msahci.sys
20:40:56.595 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa80077e6060]
20:40:56.597 3 CLASSPNP.SYS[fffff880019c243f] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP1T0L0-1[0xfffffa80075ef060]
20:40:56.599 Disk 0 statistics 102903/0/14 @ 129,52 MB/s
20:40:56.601 Scan finished successfully
20:41:01.952 Disk 0 MBR has been saved successfully to "C:\Users\PC\Desktop\MBR.dat"
20:41:01.954 The log file has been saved successfully to "C:\Users\PC\Desktop\aswMBR.txt"

[jerabina]

ComboFix se odinstaluje takto:
Start-Spustit a zadej ComboFix /Uninstall

Vyčisti systém CCleanerem

Stáhni si OTC

na plochu. Poklepej na něj. Potom klikni na Clean up!.
Restartuj PC , pokud Ti bude doporučeno.

Co problémy? + nový log z HJT