Prosim o kontrolu

M√≠sto pro vaŇ°e HiJackThis logy a logy z dalŇ°√≠ch programŇĮ‚Ķ

Moder√°toŇôi: memphisto, Mods_senior, Security team

securit4k
Level 1
Level 1
PŇô√≠spńõvky: 70
Registrov√°n: prosinec 12
Pohlav√≠: MuŇĺ

Prosim o kontrolu

PŇô√≠spńõvekod securit4k » 26 lis 2017 00:01

Dobry den, mam pocit ze mam nejake chyby v pc, dekuju mco za kotrolu a vas cas, zatim :)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 0:03:20, on 26.11.2017
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v11.0 (11.00.9600.18838)


Boot mode: Normal

Running processes:
C:\Users\Petr\Desktop\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O17 - HKLM\System\CCS\Services\Tcpip\..\{9317833D-D4B3-4B9C-8B06-9B224515606B}: NameServer = 94.74.192.252,8.8.8.8
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: AMD External Events Utility - Unknown owner - C:\Windows\system32\atiesrxx.exe (file missing)
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\ieetwcollectorres.dll,-1000 (IEEtwCollectorService) - Unknown owner - C:\Windows\system32\IEEtwCollector.exe (file missing)
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Secunia PSI Agent - Secunia - C:\Program Files (x86)\Secunia\PSI\PSIA.exe
O23 - Service: Secunia Update Agent - Secunia - C:\Program Files (x86)\Secunia\PSI\sua.exe
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--
End of file - 4202 bytes



Reklama
UŇĺivatelsk√Ĺ avatar
jaro3
ńćlen Security t√Ĺmu
Guru Level 15
Guru Level 15
PŇô√≠spńõvky: 38711
Registrov√°n: ńćerven 07
BydliŇ°tńõ: JiŇĺn√≠ ńĆechy
Pohlav√≠: MuŇĺ

Re: Prosim o kontrolu

PŇô√≠spńõvekod jaro3 » 26 lis 2017 10:13

St√°hni si ATF Cleaner
Poklepej na ATF Cleaner.exe, klikni na select all found, poté:
-KdyŇĺ pouŇĺ√≠v√°Ň° Firefox (Mozzila), klikni na Firefox nahoŇôe a vyber: Select All, pot√© klikni na Empty Selected.
-KdyŇĺ pouŇĺ√≠v√°Ň° Operu, klikni nahoŇôe na Operu a vyber: Select All, pot√© klikni na Empty Selected. Pot√© klikni na Main (hlavn√≠ str√°nku ) a klikni na Empty Selected.
Po vyńćiŇ°tńõn√≠ klikni na Exit k zavŇôen√≠ programu.
ATF-Cleaner je jednoduch√Ĺ n√°stroj na odstranńõn√≠ historie z webov√©ho prohl√≠Ňĺeńće. Program dok√°Ňĺe odstranit cache, cookies, historii a dalŇ°√≠ stopy po surfov√°n√≠ na Internetu. Mezi podporovan√© prohl√≠Ňĺeńće patŇô√≠ Internet Explorer, Firefox a Opera. Aplikace nav√≠c um√≠ odstranit dońćasn√© soubory Windows, vysypat koŇ° atd.
- Pokud pouŇĺ√≠v√°Ň° jen Google Chrome , tak ATF nemus√≠Ň° pouŇĺ√≠t.


St√°hni si TFC
http://www.geekstogo.com/forum/files/fi ... -oldtimer/
OtevŇôi soubor a zavŇôi vŇ°echny ostatn√≠ okna, Klikni na Start k zah√°jen√≠ procesu. Program by nemńõl trvat dlouho.
Pot√© by se mńõl PC restartovat, pokud ne , proveńŹ s√°m.

St√°hni AdwCleaner (by Xplode
http://www.bleepingcomputer.com/download/adwcleaner/
http://www.adlice.com/downloadprogress/

UloŇĺ si ho na svoj√≠ plochu
Ukonńći vŇ°echny programy , okna a prohl√≠Ňĺeńće
SpusŇ• program poklep√°n√≠m a klikni na ‚ÄěScan‚Äú
Po skenu klikni na ‚ÄěLogfile‚Äú ,objev√≠ se okno ‚ÄěLog Manager‚Äú a pak poklepej na odpov√≠daj√≠c√≠ log , kter√Ĺ se otevŇôe. ( jinak je uloŇĺen syst√©movem disku jako C:\AdwCleaner [C?].txt ), jeho obsah sem cel√Ĺ vloŇĺ.

St√°hni si Malwarebytes' Anti-Malware
- PŇôi instalaci odeber zatrŇĺ√≠tko u ‚ÄěPovolit bezplatnou zkuŇ°ebn√≠ verzi Malwarebytes' Anti-Malware Premium‚Äú
Nainstaluj a spusҕ ho
- na konci instalace se ujisti Ňĺe m√°Ň° zvoleny/zatrhnuty obńõ moŇĺnosti:
Aktualizace Malwarebytes' Anti-Malware a Spustit aplikaci Malwarebytes' Anti-Malware, pokud jo tak klikni na tlańć√≠tko konec
-Pokud nen√≠ program aktu√°ln√≠ , klikni na moŇĺnost ‚ÄěAktualizovat nyn√≠‚Äú ńći ‚ÄěOpravit nyn√≠‚Äú.
- bude nalezena aktualizace a nainstaluje se.
- poté klikni na Skenovat nyní
- po probńõhnut√≠ programu se ti objev√≠ hl√°Ň°ka vpravo dole, tak klikni na UloŇĺit v√Ĺsledky a vyber zkop√≠rovat do schr√°nky a vloŇĺ sem cel√Ĺ log. Nebo klikni na ‚ÄěTextov√Ĺ soubor ( .txt)‚Äú a log si uloŇĺ.
-jinak se log nachází zde: C:\ProgramData\Malwarebytes\Malwarebytes Anti-Malware\Logs

- po t√© klikni na tlańć√≠tko Dokonńćit, a program zavŇôi kŇô√≠Ňĺkem vpravo nahoŇôe.
(zat√≠m nic nemaŇĺ!).
Pokud budou probl√©my , spusŇ• v nouz. reŇĺimu.
PŇôi pr√°ci s programy HJT, ComboFix,MbAM, SDFix aj. zavŇôete vŇ°echny ostatn√≠ aplikace a prohl√≠Ňĺeńće!
Nepos√≠lejte logy do soukrom√Ĺch zpr√°v.Po dobu m√© nepŇô√≠tomnosti mńõ zastupuje memphisto , ŇĹbeky a Orcus.
Pokud budete spokojeni , mŇĮŇĺete podpoŇôit naŇ°e forum:Podpora f√≥ra

securit4k
Level 1
Level 1
PŇô√≠spńõvky: 70
Registrov√°n: prosinec 12
Pohlav√≠: MuŇĺ

Re: Prosim o kontrolu

PŇô√≠spńõvekod securit4k » 26 lis 2017 18:19

ahoj, tady to je

# AdwCleaner 7.0.4.0 - Logfile created on Sun Nov 26 17:04:06 2017
# Updated on 2017/27/10 by Malwarebytes
# Database: 11-23-2017.1
# Running on Windows 7 Home Premium (X64)
# Mode: scan
# Support: https://www.malwarebytes.com/support

***** [ Services ] *****

No malicious services found.

***** [ Folders ] *****

No malicious folders found.

***** [ Files ] *****

PUP.Optional.Reimage, C:\Windows\Temp\ReimagePackage.exe


***** [ DLL ] *****

No malicious DLLs found.

***** [ WMI ] *****

No malicious WMI found.

***** [ Shortcuts ] *****

No malicious shortcuts found.

***** [ Tasks ] *****

No malicious tasks found.

***** [ Registry ] *****

PUP.Optional.Legacy, [Key] - HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{10ECCE17-29B5-4880-A8F5-EAD298611484}
PUP.Optional.Legacy, [Key] - HKLM\SOFTWARE\Classes\Interface\{9BB31AD8-5DB2-459E-A901-DEA536F23BA4}
PUP.Optional.Legacy, [Key] - HKLM\SOFTWARE\Classes\Interface\{BD51A48E-EB5F-4454-8774-EF962DF64546}
PUP.Optional.Legacy, [Key] - HKLM\SOFTWARE\Classes\TypeLib\{FA6468D2-FAA4-4951-A53B-2A5CF9CC0A36}
PUP.Optional.Legacy, [Key] - HKLM\SOFTWARE\Classes\AppID\{28FF42B8-A0DA-4BE5-9B81-E26DD59B350A}
PUP.Optional.Legacy, [Key] - HKLM\SOFTWARE\Classes\AppID\REI_AxControl.DLL
PUP.Optional.Reimage, [Key] - HKU\S-1-5-21-1176767682-3295121074-1802647030-1000\Software\Local AppWizard-Generated Applications\Reimage - Windows Problem Relief.
PUP.Optional.Reimage, [Key] - HKU\S-1-5-21-1176767682-3295121074-1802647030-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-11262017174727915\Software\Local AppWizard-Generated Applications\Reimage - Windows Problem Relief.
PUP.Optional.Reimage, [Key] - HKCU\Software\Local AppWizard-Generated Applications\Reimage - Windows Problem Relief.
PUP.Optional.Reimage, [Key] - HKLM\SOFTWARE\Reimage
PUP.Optional.Reimage, [Key] - HKU\S-1-5-21-1176767682-3295121074-1802647030-1000\Software\Reimage
PUP.Optional.Reimage, [Key] - HKU\S-1-5-21-1176767682-3295121074-1802647030-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-11262017174727915\Software\Reimage
PUP.Optional.Reimage, [Key] - HKCU\Software\Reimage
PUP.Optional.SlimCleanerPlus, [Key] - HKLM\SOFTWARE\SlimWare Utilities Inc
PUP.Optional.SlimCleanerPlus, [Key] - HKU\S-1-5-21-1176767682-3295121074-1802647030-1000\Software\SlimWare Utilities Inc
PUP.Optional.SlimCleanerPlus, [Key] - HKU\S-1-5-21-1176767682-3295121074-1802647030-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-11262017174727915\Software\SlimWare Utilities Inc
PUP.Optional.SlimCleanerPlus, [Key] - HKCU\Software\SlimWare Utilities Inc
PUP.Optional.SlimCleanerPlus, [Key] - HKLM\SOFTWARE\SLIMWARE UTILITIES, INC.


***** [ Firefox (and derivatives) ] *****

No malicious Firefox entries.

***** [ Chromium (and derivatives) ] *****

No malicious Chromium entries.

*************************

C:/AdwCleaner/AdwCleaner[C10].txt - [3987 B] - [2017/4/27 12:37:17]
C:/AdwCleaner/AdwCleaner[C11].txt - [4230 B] - [2017/5/14 17:24:42]
C:/AdwCleaner/AdwCleaner[C12].txt - [4225 B] - [2017/7/6 19:39:20]
C:/AdwCleaner/AdwCleaner[C1].txt - [1217 B] - [2016/2/12 22:59:30]
C:/AdwCleaner/AdwCleaner[C2].txt - [3479 B] - [2016/2/13 18:36:7]
C:/AdwCleaner/AdwCleaner[C3].txt - [2677 B] - [2016/2/13 18:41:16]
C:/AdwCleaner/AdwCleaner[C4].txt - [764 B] - [2016/2/13 20:13:37]
C:/AdwCleaner/AdwCleaner[C5].txt - [765 B] - [2016/2/14 10:5:54]
C:/AdwCleaner/AdwCleaner[C6].txt - [3722 B] - [2016/9/20 17:35:48]
C:/AdwCleaner/AdwCleaner[C7].txt - [3845 B] - [2016/11/5 14:54:44]
C:/AdwCleaner/AdwCleaner[C8].txt - [3316 B] - [2016/12/10 14:40:39]
C:/AdwCleaner/AdwCleaner[C9].txt - [4289 B] - [2017/4/11 17:42:47]
C:/AdwCleaner/AdwCleaner[S10].txt - [3803 B] - [2016/9/20 17:34:27]
C:/AdwCleaner/AdwCleaner[S11].txt - [2645 B] - [2016/9/20 17:39:1]
C:/AdwCleaner/AdwCleaner[S12].txt - [2720 B] - [2016/9/23 13:29:16]
C:/AdwCleaner/AdwCleaner[S13].txt - [2795 B] - [2016/9/23 15:20:34]
C:/AdwCleaner/AdwCleaner[S14].txt - [2870 B] - [2016/9/24 12:20:20]
C:/AdwCleaner/AdwCleaner[S15].txt - [2945 B] - [2016/9/28 22:33:19]
C:/AdwCleaner/AdwCleaner[S16].txt - [3020 B] - [2016/10/1 16:12:12]
C:/AdwCleaner/AdwCleaner[S17].txt - [3101 B] - [2016/10/12 14:58:53]
C:/AdwCleaner/AdwCleaner[S18].txt - [3176 B] - [2016/10/16 13:13:57]
C:/AdwCleaner/AdwCleaner[S19].txt - [1658 B] - [2015/12/18 18:23:27]
C:/AdwCleaner/AdwCleaner[S1].txt - [1074 B] - [2016/2/12 22:58:7]
C:/AdwCleaner/AdwCleaner[S20].txt - [1658 B] - [2015/12/19 16:23:12]
C:/AdwCleaner/AdwCleaner[S21].txt - [814 B] - [2015/12/19 19:40:26]
C:/AdwCleaner/AdwCleaner[S22].txt - [823 B] - [2015/12/25 1:11:54]
C:/AdwCleaner/AdwCleaner[S23].txt - [3251 B] - [2016/10/17 18:49:6]
C:/AdwCleaner/AdwCleaner[S24].txt - [3960 B] - [2016/11/5 14:54:10]
C:/AdwCleaner/AdwCleaner[S25].txt - [3489 B] - [2016/11/5 15:5:29]
C:/AdwCleaner/AdwCleaner[S26].txt - [3564 B] - [2016/11/6 11:57:32]
C:/AdwCleaner/AdwCleaner[S27].txt - [3626 B] - [2016/12/10 14:40:17]
C:/AdwCleaner/AdwCleaner[S28].txt - [3800 B] - [2017/1/11 19:52:32]
C:/AdwCleaner/AdwCleaner[S29].txt - [3876 B] - [2017/1/15 15:14:14]
C:/AdwCleaner/AdwCleaner[S2].txt - [3291 B] - [2016/2/13 18:22:4]
C:/AdwCleaner/AdwCleaner[S30].txt - [4500 B] - [2017/4/11 17:42:12]
C:/AdwCleaner/AdwCleaner[S31].txt - [4097 B] - [2017/4/11 18:1:0]
C:/AdwCleaner/AdwCleaner[S32].txt - [4169 B] - [2017/4/16 13:11:29]
C:/AdwCleaner/AdwCleaner[S33].txt - [4279 B] - [2017/4/27 12:37:0]
C:/AdwCleaner/AdwCleaner[S34].txt - [6190 B] - [2017/5/14 6:38:23]
C:/AdwCleaner/AdwCleaner[S35].txt - [4511 B] - [2017/5/14 17:22:46]
C:/AdwCleaner/AdwCleaner[S36].txt - [4613 B] - [2017/5/15 17:49:47]
C:/AdwCleaner/AdwCleaner[S37].txt - [4702 B] - [2017/7/6 19:34:50]
C:/AdwCleaner/AdwCleaner[S3].txt - [672 B] - [2016/2/13 19:32:52]
C:/AdwCleaner/AdwCleaner[S4].txt - [672 B] - [2016/2/13 20:12:52]
C:/AdwCleaner/AdwCleaner[S5].txt - [673 B] - [2016/2/13 21:25:41]
C:/AdwCleaner/AdwCleaner[S6].txt - [673 B] - [2016/2/14 10:4:55]


########## EOF - C:\AdwCleaner\AdwCleaner[S34].txt ##########


Malwarebytes
www.malwarebytes.com

-Podrobnosti logovacího souboru-
Datum skenování: 26.11.17
ńĆas skenov√°n√≠: 18:09
Logovací soubor: 8d150c8c-d2cc-11e7-bd91-6cf049d66c96.json
Spr√°vce: Ano

-Informace o softwaru-
Verze: 3.3.1.2183
Verze komponentŇĮ: 1.0.236
Aktualizovat verzi balíku komponent: 1.0.3350
Licence: Bezplatn√Ĺ

-Systémová informace-
OS: Windows 7 Service Pack 1
CPU: x64
Syst√©m souborŇĮ: NTFS
UŇĺivatel: Petr-PC\Petr

-Shrnutí skenování-
Typ skenování: Skenování hrozeb (Threat Scan)
V√Ĺsledek: Dokonńćeno
Skenované objekty: 331471
ZjiŇ°tńõn√© hrozby: 0
(Nebyly zjiŇ°tńõny Ňĺ√°dn√© Ň°kodliv√© poloŇĺky)
Hrozby um√≠stńõn√© do karant√©ny: 0
(Nebyly zjiŇ°tńõny Ňĺ√°dn√© Ň°kodliv√© poloŇĺky)
Uplynul√Ĺ ńćas: 5 min, 29 sek

-MoŇĺnosti skenov√°n√≠-
PamńõŇ•: Povoleno
Start: Povoleno
Syst√©m souborŇĮ: Povoleno
Archivy: Povoleno
Rootkity: Zak√°z√°no
Heuristika: Povoleno
Potenci√°lnńõ neŇĺ√°douc√≠ program: Detekovat
Potenci√°lnńõ neŇĺ√°douc√≠ modifikace: Detekovat

-Podrobnosti skenování-
Proces: 0
(Nebyly zjiŇ°tńõny Ňĺ√°dn√© Ň°kodliv√© poloŇĺky)

Modul: 0
(Nebyly zjiŇ°tńõny Ňĺ√°dn√© Ň°kodliv√© poloŇĺky)

Kl√≠ńć registru: 0
(Nebyly zjiŇ°tńõny Ňĺ√°dn√© Ň°kodliv√© poloŇĺky)

Hodnota v registru: 0
(Nebyly zjiŇ°tńõny Ňĺ√°dn√© Ň°kodliv√© poloŇĺky)

Data registrŇĮ: 0
(Nebyly zjiŇ°tńõny Ňĺ√°dn√© Ň°kodliv√© poloŇĺky)

Datové proudy: 0
(Nebyly zjiŇ°tńõny Ňĺ√°dn√© Ň°kodliv√© poloŇĺky)

Adres√°Ňô: 0
(Nebyly zjiŇ°tńõny Ňĺ√°dn√© Ň°kodliv√© poloŇĺky)

Soubor: 0
(Nebyly zjiŇ°tńõny Ňĺ√°dn√© Ň°kodliv√© poloŇĺky)

Fyzick√Ĺ sektor: 0
(Nebyly zjiŇ°tńõny Ňĺ√°dn√© Ň°kodliv√© poloŇĺky)


(end)


nechapu, omylem jsem prvni dal malware, 2x naslo prez 39 sracek a 2x shodil system stylem vytahnuti ze zasuvky, to same co se mi deje pri internetu pri prehravani filmu a dalsi zvlastnich prilezitostech, pozoruju delsi dobu, tak jsem dal prvi adw a uz nespadl a nenasel nic, asi to smaznul adw s tfc

UŇĺivatelsk√Ĺ avatar
jaro3
ńćlen Security t√Ĺmu
Guru Level 15
Guru Level 15
PŇô√≠spńõvky: 38711
Registrov√°n: ńćerven 07
BydliŇ°tńõ: JiŇĺn√≠ ńĆechy
Pohlav√≠: MuŇĺ

Re: Prosim o kontrolu

PŇô√≠spńõvekod jaro3 » 26 lis 2017 20:06

SpusŇ• znovu AdwCleaner (u Windows Vista ńći Windows7, klikni na AdwCleaner prav√Ĺm a vyber ‚ÄěSpustit jako spr√°vce‚Äú
klikni na ‚ÄěScan‚Äú, po prohled√°n√≠ klikni na ‚Äě Clean‚Äú

Program provede opravu, po automatick√©m restartu klikni na ‚ÄěLog Manager‚Äú a pak poklepej na odpov√≠daj√≠ log, (C:\AdwCleaner [C?].txt) , jeho obsah sem cel√Ĺ vloŇĺ.

St√°hni si Junkware Removal Tool by Thisisu
http://www.bleepingcomputer.com/downloa ... oval-tool/
https://downloads.malwarebytes.com/file/JRT-EOL
na svojí plochu.

Deaktivuj si svŇĮj antivirov√Ĺ program. Prav√Ĺm tl. myŇ°i klikni na JRT.exe a vyber ‚Äěspustit jako spr√°vce‚Äú. Pro pokrańćov√°n√≠ budeŇ° vyzv√°n ke stisknut√≠ jak√©koliv kl√°vesy. Na nńõjakou klikni.
Zańćne skenov√°n√≠ programu. Skenov√°n√≠ mŇĮŇĺe trvat dloho , podle mnoŇĺstv√≠ n√°kaz. Po ukonńćen√≠ skenu se objev√≠ log (JRT.txt) , kter√Ĺ se uloŇĺ√≠ na ploŇ°e.
Zkop√≠ruj sem pros√≠m cel√Ĺ jeho obsah.


Sophos Virus Removal Tool je praktick√Ĺ softwarov√Ĺ n√°stroj, kter√Ĺ by mohl odstranit infekce, kter√© antivirov√Ĺ program nedetekuje .
St√°hnńõte si ho zde z nńõkter√©ho odkazu:
http://www.majorgeeks.com/mg/get/sophos ... ool,1.html
http://www.majorgeeks.com/mg/getmirror/ ... ool,1.html
http://www.majorgeeks.com/mg/getmirror/ ... ool,2.html

Viry mohou zpomalit pońć√≠tańć, nebo se snaŇĺ√≠ ukr√°st vaŇ°e data, a ani nev√≠te , Ňĺe je m√°te. Co potŇôebujete, je rychl√Ĺ a snadn√Ĺ zpŇĮsob, jak je naj√≠t a zbavit se jich, pokud jiŇĺ m√°te antivirov√Ĺ program v pońć√≠tańći nainstalov√°n , mŇĮŇĺete nainstalovat i n√°stroj Sophos Virus Removal , kter√Ĺ identifikuje a vyńćist√≠ zbyl√© infekce, kter√© mohl V√°Ň° antivirov√Ĺ program pŇôehl√©dnout.
K pouŇĺit√≠ Sophos Virus Removal Tool na nńõj poklepejte a stisknńõte tlańć√≠tko ‚ÄěStart scanning‚Äú . Pak bude Sophos Virus Removal Tool vyhled√°vat a odstraŇąovat viry, kter√© najde. MŇĮŇĺe b√Ĺt vyŇĺadov√°n restart.

St√°hni si RogueKiller by Adlice Software
32bit.:
http://www.adlice.com/download/roguekil ... HlwZT14ODY
64bit.:
http://www.adlice.com/download/roguekil ... HlwZT14NjQ
na svojí plochu.
- ZavŇôi vŇ°echny ostatn√≠ programy a prohl√≠Ňĺeńće.
- Pro OS Vista a win7,8,10 spusŇ• program RogueKiller.exe jako spr√°vce , u XP poklep√°n√≠m.
- klikni na ‚ÄěStart Scan‚Äú. V nov√©m oknńõ nic nemńõŇą a klikni dole na ‚ÄěStart Scan‚Äú
- Program skenuje procesy PC. Po proskenov√°n√≠ klikni na ‚ÄěOpen Report ‚Äú , v oknńõ pak na ‚ÄěOpen TXT‚Äú a cel√Ĺ obsah logu sem zkop√≠ruj.
Pokud je program blokov√°n , zkus ho spustit nńõkolikr√°t. Pokud d√°le program nepŇĮjde spustit a pracovat, pŇôejmenuj ho na winlogon.exe.
-pokud bude m√≠t log v√≠ce neŇĺ 60.000 znakŇĮ , rozdńõl ho a vloŇĺ do v√≠ce pŇô√≠spńõvkŇĮ

dalŇ°√≠ odkazy:
http://www.adlice.com/download/roguekiller/
http://www.bleepingcomputer.com/download/roguekiller/
PŇôi pr√°ci s programy HJT, ComboFix,MbAM, SDFix aj. zavŇôete vŇ°echny ostatn√≠ aplikace a prohl√≠Ňĺeńće!
Nepos√≠lejte logy do soukrom√Ĺch zpr√°v.Po dobu m√© nepŇô√≠tomnosti mńõ zastupuje memphisto , ŇĹbeky a Orcus.
Pokud budete spokojeni , mŇĮŇĺete podpoŇôit naŇ°e forum:Podpora f√≥ra

securit4k
Level 1
Level 1
PŇô√≠spńõvky: 70
Registrov√°n: prosinec 12
Pohlav√≠: MuŇĺ

Re: Prosim o kontrolu

PŇô√≠spńõvekod securit4k » 26 lis 2017 22:33

# AdwCleaner 7.0.4.0 - Logfile created on Sun Nov 26 20:49:32 2017
# Updated on 2017/27/10 by Malwarebytes
# Running on Windows 7 Home Premium (X64)
# Mode: clean
# Support: https://www.malwarebytes.com/support

***** [ Services ] *****

No malicious services deleted.

***** [ Folders ] *****

No malicious folders deleted.

***** [ Files ] *****

No malicious files deleted.

***** [ DLL ] *****

No malicious DLLs cleaned.

***** [ WMI ] *****

No malicious WMI cleaned.

***** [ Shortcuts ] *****

No malicious shortcuts cleaned.

***** [ Tasks ] *****

No malicious tasks deleted.

***** [ Registry ] *****

Deleted: [Key] - HKLM\SOFTWARE\Classes\Interface\{9BB31AD8-5DB2-459E-A901-DEA536F23BA4}
Deleted: [Key] - HKLM\SOFTWARE\Classes\Interface\{BD51A48E-EB5F-4454-8774-EF962DF64546}


***** [ Firefox (and derivatives) ] *****

No malicious Firefox entries deleted.

***** [ Chromium (and derivatives) ] *****

No malicious Chromium entries deleted.

*************************

::Tracing keys deleted
::Winsock settings cleared
::Additional Actions: 0



*************************

C:/AdwCleaner/AdwCleaner[C10].txt - [3987 B] - [2017/4/27 12:37:17]
C:/AdwCleaner/AdwCleaner[C11].txt - [4230 B] - [2017/5/14 17:24:42]
C:/AdwCleaner/AdwCleaner[C12].txt - [5927 B] - [2017/7/6 19:39:20]
C:/AdwCleaner/AdwCleaner[C1].txt - [1217 B] - [2016/2/12 22:59:30]
C:/AdwCleaner/AdwCleaner[C2].txt - [3479 B] - [2016/2/13 18:36:7]
C:/AdwCleaner/AdwCleaner[C3].txt - [2677 B] - [2016/2/13 18:41:16]
C:/AdwCleaner/AdwCleaner[C4].txt - [764 B] - [2016/2/13 20:13:37]
C:/AdwCleaner/AdwCleaner[C5].txt - [765 B] - [2016/2/14 10:5:54]
C:/AdwCleaner/AdwCleaner[C6].txt - [3722 B] - [2016/9/20 17:35:48]
C:/AdwCleaner/AdwCleaner[C7].txt - [3845 B] - [2016/11/5 14:54:44]
C:/AdwCleaner/AdwCleaner[C8].txt - [3316 B] - [2016/12/10 14:40:39]
C:/AdwCleaner/AdwCleaner[C9].txt - [4289 B] - [2017/4/11 17:42:47]
C:/AdwCleaner/AdwCleaner[S10].txt - [3803 B] - [2016/9/20 17:34:27]
C:/AdwCleaner/AdwCleaner[S11].txt - [2645 B] - [2016/9/20 17:39:1]
C:/AdwCleaner/AdwCleaner[S12].txt - [2720 B] - [2016/9/23 13:29:16]
C:/AdwCleaner/AdwCleaner[S13].txt - [2795 B] - [2016/9/23 15:20:34]
C:/AdwCleaner/AdwCleaner[S14].txt - [2870 B] - [2016/9/24 12:20:20]
C:/AdwCleaner/AdwCleaner[S15].txt - [2945 B] - [2016/9/28 22:33:19]
C:/AdwCleaner/AdwCleaner[S16].txt - [3020 B] - [2016/10/1 16:12:12]
C:/AdwCleaner/AdwCleaner[S17].txt - [3101 B] - [2016/10/12 14:58:53]
C:/AdwCleaner/AdwCleaner[S18].txt - [3176 B] - [2016/10/16 13:13:57]
C:/AdwCleaner/AdwCleaner[S19].txt - [1658 B] - [2015/12/18 18:23:27]
C:/AdwCleaner/AdwCleaner[S1].txt - [1074 B] - [2016/2/12 22:58:7]
C:/AdwCleaner/AdwCleaner[S20].txt - [1658 B] - [2015/12/19 16:23:12]
C:/AdwCleaner/AdwCleaner[S21].txt - [814 B] - [2015/12/19 19:40:26]
C:/AdwCleaner/AdwCleaner[S22].txt - [823 B] - [2015/12/25 1:11:54]
C:/AdwCleaner/AdwCleaner[S23].txt - [3251 B] - [2016/10/17 18:49:6]
C:/AdwCleaner/AdwCleaner[S24].txt - [3960 B] - [2016/11/5 14:54:10]
C:/AdwCleaner/AdwCleaner[S25].txt - [3489 B] - [2016/11/5 15:5:29]
C:/AdwCleaner/AdwCleaner[S26].txt - [3564 B] - [2016/11/6 11:57:32]
C:/AdwCleaner/AdwCleaner[S27].txt - [3626 B] - [2016/12/10 14:40:17]
C:/AdwCleaner/AdwCleaner[S28].txt - [3800 B] - [2017/1/11 19:52:32]
C:/AdwCleaner/AdwCleaner[S29].txt - [3876 B] - [2017/1/15 15:14:14]
C:/AdwCleaner/AdwCleaner[S2].txt - [3291 B] - [2016/2/13 18:22:4]
C:/AdwCleaner/AdwCleaner[S30].txt - [4500 B] - [2017/4/11 17:42:12]
C:/AdwCleaner/AdwCleaner[S31].txt - [4097 B] - [2017/4/11 18:1:0]
C:/AdwCleaner/AdwCleaner[S32].txt - [4169 B] - [2017/4/16 13:11:29]
C:/AdwCleaner/AdwCleaner[S33].txt - [4279 B] - [2017/4/27 12:37:0]
C:/AdwCleaner/AdwCleaner[S34].txt - [4264 B] - [2017/5/14 6:38:23]
C:/AdwCleaner/AdwCleaner[S35].txt - [4511 B] - [2017/5/14 17:22:46]
C:/AdwCleaner/AdwCleaner[S36].txt - [4613 B] - [2017/5/15 17:49:47]
C:/AdwCleaner/AdwCleaner[S37].txt - [4702 B] - [2017/7/6 19:34:50]
C:/AdwCleaner/AdwCleaner[S3].txt - [672 B] - [2016/2/13 19:32:52]
C:/AdwCleaner/AdwCleaner[S4].txt - [672 B] - [2016/2/13 20:12:52]
C:/AdwCleaner/AdwCleaner[S5].txt - [673 B] - [2016/2/13 21:25:41]
C:/AdwCleaner/AdwCleaner[S6].txt - [673 B] - [2016/2/14 10:4:55]


########## EOF - C:\AdwCleaner\AdwCleaner[C12].txt ##########


~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Malwarebytes
Version: 8.1.4 (07.09.2017)
Operating System: Windows 7 Home Premium x64
Ran by Petr (Administrator) on ne 26.11.2017 at 21:52:07,42
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




File System: 10

Successfully deleted: C:\ProgramData\productdata (Folder)
Successfully deleted: C:\Users\Petr\AppData\Roaming\productdata (Folder)
Successfully deleted: C:\Users\Petr\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\558HRB3X (Temporary Internet Files Folder)
Successfully deleted: C:\Users\Petr\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DV44I0KC (Temporary Internet Files Folder)
Successfully deleted: C:\Users\Petr\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F39AYNA0 (Temporary Internet Files Folder)
Successfully deleted: C:\Users\Petr\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\QO43E162 (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\558HRB3X (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DV44I0KC (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F39AYNA0 (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\QO43E162 (Temporary Internet Files Folder)



Registry: 0





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on ne 26.11.2017 at 21:53:38,83
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

securit4k
Level 1
Level 1
PŇô√≠spńõvky: 70
Registrov√°n: prosinec 12
Pohlav√≠: MuŇĺ

Re: Prosim o kontrolu

PŇô√≠spńõvekod securit4k » 26 lis 2017 23:25

co jsou to ty bootstrap a bootloader?, btw jsem ty dve pum.dns nesmazal mel jsem? vypadato na moje nastaveni internetu pokud se nepletu, toto je druhy sken, pri prnvim sem to smazal a nejak prstal fungovat net, pak jsem dal restore a udelal znovu a uz jde net, mozna to je nahoda mozna tim nevim, musel jsem protoze jsem ztratil log, dik

RogueKiller V12.11.25.0 (x64) [Nov 20 2017] (Free) by Adlice Software
mail : http://www.adlice.com/contact/
Feedback : https://forum.adlice.com
Webov√° str√°nka : http://www.adlice.com/download/roguekiller/
Blog : http://www.adlice.com

Operańćn√≠ syst√©m : Windows 7 (6.1.7601 Service Pack 1) 64 bits version
SpuŇ°tńõno : Norm√°ln√≠ reŇĺim
UŇĺivatel : Petr [Pr√°va spr√°vce]
Started from : C:\Users\Petr\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VITSOFT\Vit Registry Fix\RogueKiller_portable64.exe
Mód : Prohledat -- Datum : 11/26/2017 23:03:44 (Duration : 00:17:39)

¤¤¤ Procesy : 0 ¤¤¤

¤¤¤ Registry : 2 ¤¤¤
[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\ControlSet002\Services\Tcpip\Parameters\Interfaces\{9317833D-D4B3-4B9C-8B06-9B224515606B} | NameServer : 94.74.192.252,8.8.8.8 ([Czech Republic][-]) -> Nalezeno
[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\ControlSet003\Services\Tcpip\Parameters\Interfaces\{9317833D-D4B3-4B9C-8B06-9B224515606B} | NameServer : 94.74.192.252,8.8.8.8 ([Czech Republic][-]) -> Nalezeno

¤¤¤ Úlohy : 0 ¤¤¤

¤¤¤ Soubory : 0 ¤¤¤

¤¤¤ WMI : 0 ¤¤¤

¤¤¤ Soubor HOSTS : 0 ¤¤¤

¤¤¤ Antirootkit : 0 (Driver: Nahrán) ¤¤¤

¬§¬§¬§ Webov√© prohl√≠Ňĺeńće : 0 ¬§¬§¬§

¤¤¤ Kontrola MBR : ¤¤¤
+++++ PhysicalDrive0: WDC WD10EZEX-00BN5A0 ATA Device +++++
--- User ---
[MBR] b96e826721bf05997f6261b4b233f62f
[BSP] de8104dc4ad33b6866b6dc0a259f12a3 : Windows Vista/7/8 MBR Code
Partition table:
0 - [ACTIVE] NTFS (0x7) [VISIBLE] Offset (sectors): 2048 | Size: 100 MB [Windows Vista/7/8 Bootstrap | Windows Vista/7/8 Bootloader]
1 - [XXXXXX] NTFS (0x7) [VISIBLE] Offset (sectors): 208848 | Size: 953767 MB [Windows Vista/7/8 Bootstrap | Windows Vista/7/8 Bootloader]
User = LL1 ... OK
User = LL2 ... OK

UŇĺivatelsk√Ĺ avatar
jaro3
ńćlen Security t√Ĺmu
Guru Level 15
Guru Level 15
PŇô√≠spńõvky: 38711
Registrov√°n: ńćerven 07
BydliŇ°tńõ: JiŇĺn√≠ ńĆechy
Pohlav√≠: MuŇĺ

Re: Prosim o kontrolu

PŇô√≠spńõvekod jaro3 » 27 lis 2017 09:45

ZavŇôi vŇ°echny programy a prohl√≠Ňĺeńće. Deaktivuj antivir a firewall.
Pros√≠m, odpoj vŇ°echny USB (kromńõ myŇ°i s kl√°vesnice) nebo extern√≠ disky z pońć√≠tańće pŇôed spuŇ°tńõn√≠m tohoto programu.
SpusŇ• znovu RogueKiller ( Pro Windows Vista nebo Windows 7, klepni prav√Ĺm a vyber "Spustit jako spr√°vce", ve Windows XP poklepej ke spuŇ°tńõn√≠).
- klikni na ‚ÄěStart Scan‚Äú. V nov√©m oknńõ nic nemńõŇą a klikni dole na ‚ÄěStart Scan‚Äú,
po jeho skonńćen√≠ - vŇ°e zatrhni (dej zatrŇĺ√≠tka vlevo od n√°lezŇĮ , do b√≠l√Ĺch pol√≠ńćek)
- pak klikni na "Remove Selected"
- Pońćkej, dokud Status box nezobraz√≠ " Removal finished, please review result "
- Klikni na "Open report " a pak na " Open TXT‚Äú a zkop√≠ruj ten log a vloŇĺ obsah t√© zpr√°vy pros√≠m sem. Log je moŇĺno nal√©zt v C:\ProgramData\RogueKiller\Logs - ZavŇôi RogueKiller.


Vypni antivir i firewall.
St√°hni Zoek.exe
http://download.bleepingcomputer.com/smeenk/zoek.exe
http://leteckaposta.cz/415997425
klik nahoŇôe vpravo na .rar-file a uloz si ho na plochu.
ZavŇôi vŇ°echny ostatn√≠ programy , okna i prohl√≠Ňĺeńće.
SpusŇ• Zoek.exe ( u win vista , win7, 8 klikni na nńõj prav√Ĺm a vyber : ‚ÄěSpustit jako spr√°vce‚Äú
-pozor , n√°bńõh programu mŇĮŇĺe trvat d√©le.
Do okna programu vloŇĺ skript n√≠Ňĺe:

K√≥d: Vybrat vŇ°e

autoclean;
emptyclsid;
iedefaults;
FFdefaults;
CHRdefaults;
emptyalltemp;
resethosts;

klikni na Run Script
Program provede sken , opravu, sken i oprava mŇĮŇĺe trvat i v√≠ce minut ,je tŇôeba poseńćkat do konce. Do okna neklikej!
Program nab√≠dne restart , potvrńŹ .
Po restartu se mŇĮŇĺe nńõjak√Ĺ ńćas uk√°zat pouze ńćern√° plocha , to je norm√°ln√≠. Je tŇôeba pońćkat aŇĺ se vytvoŇô√≠ log. Ten si mŇĮŇĺeŇ° uloŇĺit tŇôeba do dokumentŇĮ , jinak se s√°m ukl√°d√° do:
C:\zoek-results.log Zkop√≠ruj sem cel√Ĺ obsah toho logu.
Pokud budou probl√©my , spusŇ• zoek v nouz. reŇĺimu.

St√°hni si Zemana AntiMalware Free z tohoto odkazu:
https://www.zemana.com/Download/AntiMal ... .Setup.exe
a uloŇĺ si ho na plochu.
Poklepej na tento soubor na ploŇ°e a postupuj podle pokynŇĮ k instalaci programu.
PŇôijmi licenci k pouŇĺ√≠v√°n√≠ programu EULA , pokud se nab√≠dne.
Pokud je k dispozici aktualizace programu , klepni na tlańć√≠tko ‚ÄěUpdate now‚Äú ( aktualizovat nyn√≠).
MŇĮŇĺeŇ° si zatrhnout i vytvoŇôen√≠ bodu obnovy:
Klikni na ozuben√© koleńćko , pot√© na ‚ÄěSkenov√°n√≠‚Äú a zatrhni ‚Äěvytv√°Ňôet body obnovy‚Äú.
VraŇ• se zpńõt ( klikni na domeńćek).
ZavŇôi vŇ°echny otevŇôen√© soubory, sloŇĺky a prohl√≠Ňĺeńće
NemńõŇą Ňĺ√°dn√© nastaven√≠. Klikni na ‚ÄěSkenovat‚Äú.
Po skenu lze vidńõt , zda jsou nńõjak√© n√°kazy. Klikni na ‚ÄěDalŇ°√≠‚Äú. N√°kazy budou pŇôem√≠stńõny do karant√©ny.
KdyŇĺ je skenov√°n√≠ dokonńćeno, objev√≠ se tiskov√° zpr√°va , zkop√≠ruj sem cel√Ĺ obsah t√© zpr√°vy.
Jinak mŇĮŇĺeŇ° zpr√°vy vidńõt , kdyŇĺ klikneŇ° vpravo nahoŇôe na ‚Äě zpr√°vy‚Äú.


Vypni rez. ochranu u antiviru a antispywaru,pŇô√≠p. firewall..

St√°hni si ComboFix (by sUBs)
a uloŇĺ si ho na plochu.
Ukonńći vŇ°echna aktivn√≠ okna a spusŇ• ho.
- Po spuŇ°tńõn√≠ se zobraz√≠ podm√≠nky uŇĺit√≠, potvrńŹ je stiskem tlańć√≠tka Ano
- D√°le postupuj dle pokynŇĮ, bńõhem aplikov√°n√≠ ComboFixu neklikej do zobrazuj√≠c√≠ho se okna
- Po dokonńćen√≠ skenov√°n√≠ by mńõl program vytvoŇôit log - C:\ComboFix.txt - zkop√≠ruj sem pros√≠m cel√Ĺ jeho obsah
Pokud budou probl√©my , spusŇ• ho v nouz. reŇĺimu.

Upozornńõn√≠ : MŇĮŇĺe se st√°t, Ňĺe po aplikaci Combofixu a restartu pońć√≠tańće, Windows nenabńõhnou , nebo nenajede plocha , budou probl√©my s pŇôipojen√≠m, pak znovu restartuj pońć√≠tańć, pokud to nepomŇĮŇĺe , po restartu mańćkej kl√°vesu F8 a pak zvol posledn√≠ zn√°mou funkńćn√≠ konfiguraci. , ńći pouŇĺij bod obnovy.
PŇôi pr√°ci s programy HJT, ComboFix,MbAM, SDFix aj. zavŇôete vŇ°echny ostatn√≠ aplikace a prohl√≠Ňĺeńće!
Nepos√≠lejte logy do soukrom√Ĺch zpr√°v.Po dobu m√© nepŇô√≠tomnosti mńõ zastupuje memphisto , ŇĹbeky a Orcus.
Pokud budete spokojeni , mŇĮŇĺete podpoŇôit naŇ°e forum:Podpora f√≥ra

securit4k
Level 1
Level 1
PŇô√≠spńõvky: 70
Registrov√°n: prosinec 12
Pohlav√≠: MuŇĺ

Re: Prosim o kontrolu

PŇô√≠spńõvekod securit4k » 29 lis 2017 01:22

Cus, vyskytlo se par problemu, po smazani dvou nalezu z roguekilleru (adresa podobna mojemu konfigu) mi presel fungovat intenet, tak jsem musel dat restore, a u zemana po skenu jsem dal dalsi a autoamticky to se clearlo, ale asi vklidu xD

RogueKiller V12.11.26.0 (x64) [Nov 27 2017] (Free) by Adlice Software
mail : http://www.adlice.com/contact/
Feedback : https://forum.adlice.com
Webov√° str√°nka : http://www.adlice.com/download/roguekiller/
Blog : http://www.adlice.com

Operańćn√≠ syst√©m : Windows 7 (6.1.7601 Service Pack 1) 64 bits version
SpuŇ°tńõno : Norm√°ln√≠ reŇĺim
UŇĺivatel : Petr [Pr√°va spr√°vce]
Started from : C:\Users\PetrDownloads\RogueKiller_portable64.exe
Mód : Smazat -- Datum : 11/28/2017 02:10:38 (Duration : 00:15:25)

¤¤¤ Procesy : 0 ¤¤¤

¤¤¤ Registry : 2 ¤¤¤
[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\ControlSet002\Services\Tcpip\Parameters\Interfaces\{9317833D-D4B3-4B9C-8B06-9B224515606B} | NameServer : 94.74.192.252,8.8.8.8 ([Czech Republic][-]) -> Nahrazeno ()
[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\ControlSet003\Services\Tcpip\Parameters\Interfaces\{9317833D-D4B3-4B9C-8B06-9B224515606B} | NameServer : 94.74.192.252,8.8.8.8 ([Czech Republic][-]) -> Nahrazeno ()

¤¤¤ Úlohy : 0 ¤¤¤

¤¤¤ Soubory : 0 ¤¤¤

¤¤¤ WMI : 0 ¤¤¤

¤¤¤ Soubor HOSTS : 0 ¤¤¤

¤¤¤ Antirootkit : 0 (Driver: Nahrán) ¤¤¤

¬§¬§¬§ Webov√© prohl√≠Ňĺeńće : 0 ¬§¬§¬§

¤¤¤ Kontrola MBR : ¤¤¤
+++++ PhysicalDrive0: WDC WD10EZEX-00BN5A0 ATA Device +++++
--- User ---
[MBR] b96e826721bf05997f6261b4b233f62f
[BSP] de8104dc4ad33b6866b6dc0a259f12a3 : Windows Vista/7/8 MBR Code
Partition table:
0 - [ACTIVE] NTFS (0x7) [VISIBLE] Offset (sectors): 2048 | Size: 100 MB [Windows Vista/7/8 Bootstrap | Windows Vista/7/8 Bootloader]
1 - [XXXXXX] NTFS (0x7) [VISIBLE] Offset (sectors): 208848 | Size: 953767 MB [Windows Vista/7/8 Bootstrap | Windows Vista/7/8 Bootloader]
User = LL1 ... OK
User = LL2 ... OK



Zoek.exe v5.0.0.1 Updated 24-October-2017
Tool run by Petr on st 29.11.2017 at 0:42:58,76.
Microsoft Windows 7 Home Premium 6.1.7601 Service Pack 1 x64
Running in: Normal Mode No Internet Access Detected
Launched: C:\Users\Petr\Desktop\zoek.exe [Scan all users] [Script inserted]

==== System Restore Info ======================

29.11.2017 0:43:45 Zoek.exe System Restore Point Created Successfully.

==== Reset Hosts File ======================

# Copyright (c) 1993-2006 Microsoft Corp.
#
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
#
# This file contains the mappings of IP addresses to host names. Each
# entry should be kept on an individual line. The IP address should
# be placed in the first column followed by the corresponding host name.
# The IP address and the host name should be separated by at least one
# space.
#
# Additionally, comments (such as these) may be inserted on individual
# lines or following the machine name denoted by a '#' symbol.
#
# For example:
#
# 102.54.94.97 rhino.acme.com # source server
# 38.25.63.10 x.acme.com # x client host

# localhost name resolution is handled within DNS itself.
127.0.0.1 localhost
::1 localhost

==== Set IE to Default ======================

Old Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"="http://go.microsoft.com/fwlink/?LinkId=69157"
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes]
"DefaultScope"="{0633EE93-D776-472f-A0FF-E1416B8B2E3A}"

New Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"="http://go.microsoft.com/fwlink/?LinkId=69157"
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes]
"DefaultScope"="{0633EE93-D776-472f-A0FF-E1416B8B2E3A}"

==== All HKLM and HKCU SearchScopes ======================

HKLM\SearchScopes "DefaultScope"="{0633EE93-D776-472f-A0FF-E1416B8B2E3A}"
HKLM\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} - http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
HKLM\Wow6432Node\SearchScopes "DefaultScope"="{0633EE93-D776-472f-A0FF-E1416B8B2E3A}"
HKLM\Wow6432Node\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} - http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
HKCU\SearchScopes "DefaultScope"="{0633EE93-D776-472f-A0FF-E1416B8B2E3A}"
HKCU\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} - http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IESR02
HKCU\SearchScopes\{39ED13E7-4C0C-43E1-AA3C-35BD10C9E056} - http://tv.seznam.cz/hledej?w={searchTerms}&sourceid=QuickSearch_29530

==== Reset Google Chrome ======================

C:\Users\Petr\AppData\Local\Google\Chrome\User Data\Profile 1\Preferences was reset successfully
C:\Users\Petr\AppData\Local\Google\Chrome\User Data\Profile 1\Secure Preferences was reset successfully
C:\Users\Petr\AppData\Local\Google\Chrome\User Data\Profile 1\Web Data was reset successfully
C:\Users\Petr\AppData\Local\Google\Chrome\User Data\Profile 1\Web Data-journal was reset successfully

==== Empty IE Cache ======================

C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\Petr\AppData\Local\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\Petr\AppData\Local\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\Petr\AppData\Local\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\Petr\AppData\Local\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\Petr\AppData\Local\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\Petr\AppData\Local\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\Petr\AppData\Local\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\Petr\AppData\Local\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\Petr\AppData\Local\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\Petr\AppData\Local\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\Petr\AppData\Local\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\Petr\AppData\Local\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\Petr\AppData\Local\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\Petr\AppData\Local\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\Petr\AppData\Local\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\Petr\AppData\Local\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\Petr\AppData\Local\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\Petr\AppData\Local\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\Petr\AppData\Local\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\Petr\AppData\Local\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\Petr\AppData\Local\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\Petr\AppData\Local\Data aplikací\Data aplikací\Data aplikací\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\Petr\AppData\Local\Data aplikací\Data aplikací\Data aplikací\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\Petr\AppData\Local\Data aplikací\Data aplikací\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\Petr\AppData\Local\Data aplikací\Data aplikací\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\Petr\AppData\Local\Data aplikací\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\Petr\AppData\Local\Data aplikací\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\Petr\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\Petr\AppData\Local\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\Petr\Local Settings\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\Petr\Local Settings\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\Petr\Local Settings\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\Petr\Local Settings\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\Petr\Local Settings\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\Petr\Local Settings\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\Petr\Local Settings\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\Petr\Local Settings\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\Petr\Local Settings\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\Petr\Local Settings\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\Petr\Local Settings\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\Petr\Local Settings\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\Petr\Local Settings\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\Petr\Local Settings\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\Petr\Local Settings\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\Petr\Local Settings\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\Petr\Local Settings\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\Petr\Local Settings\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\Petr\Local Settings\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\Petr\Local Settings\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\Petr\Local Settings\Data aplikací\Data aplikací\Data aplikací\Data aplikací\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\Petr\Local Settings\Data aplikací\Data aplikací\Data aplikací\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\Petr\Local Settings\Data aplikací\Data aplikací\Data aplikací\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\Petr\Local Settings\Data aplikací\Data aplikací\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\Petr\Local Settings\Data aplikací\Data aplikací\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\Petr\Local Settings\Data aplikací\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\Petr\Local Settings\Data aplikací\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\Petr\Local Settings\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\Petr\Local Settings\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\serviceprofiles\Localservice\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\serviceprofiles\Localservice\AppData\Local\Temp\Temporary Internet Files\Content.IE5 emptied successfully

==== Empty FireFox Cache ======================

No FireFox Profiles found

==== Empty Chrome Cache ======================

C:\Users\Petr\AppData\Local\Google\Chrome\User Data\Profile 1\Cache emptied successfully

==== Empty All Flash Cache ======================

No Flash Cache Found

==== Empty All Java Cache ======================

No Java Cache Found

==== C:\zoek_backup content ======================

C:\zoek_backup (files=0 folders=0 0 bytes)

==== Empty Temp Folders ======================

C:\Users\Default\AppData\Local\temp emptied successfully
C:\Users\Default User\AppData\Local\temp emptied successfully
C:\Users\Petr\AppData\Local\Temp emptied successfully
C:\Users\Public\AppData\Local\temp emptied successfully
C:\Windows\serviceprofiles\networkservice\AppData\Local\Temp emptied successfully
C:\Windows\serviceprofiles\Localservice\AppData\Local\Temp emptied successfully
C:\Windows\Temp will be emptied at reboot

==== After Reboot ======================

==== Empty Temp Folders ======================

C:\Windows\Temp successfully emptied
C:\Windows\TEMP successfully emptied

==== Empty Recycle Bin ======================

C:\$RECYCLE.BIN successfully emptied

==== EOF on st 29.11.2017 at 0:45:49,42 ======================



Zemana AntiMalware 2.74.2.150 (instalańćn√≠ verze)

-------------------------------------------------------
Scan Result : Dokonńćeno
Scan Date : 2017.11.29
Operating System : Windows 7 64-bit
Processor : 4X AMD Athlon(tm) II X4 640 Processor
BIOS Mode : Legacy
CUID : 12B0FA295BE39D443A003C
Scan Type : Skenování systému
Duration : 11m 24s
Scanned Objects : 83188
Detected Objects : 1
Excluded Objects : 0
Read Level : SCSI
Auto Upload : Zapnuto
Detect All Extensions : Vypnuto
Scan Documents : Vypnuto
Domain Info : WORKGROUP,0,2

Detected Objects
-------------------------------------------------------

Chrome Shortcut
Status : Skenov√°no
Object : --app=http://go.playmmogames.com/aff_c?offer_id=1508&aff_id=1034&source=1&click_id=0005d2cb4cbac4c6f9bee9b6e13c326bdf1a5b38
MD5 : -
Publisher : -
Size : -
Version : -
Detection : PodezŇôel√© nastaven√≠ prohl√≠Ňĺeńće
Cleaning Action : Opravit
Related Objects :
Nastaven√≠ prohl√≠Ňĺeńće - Chrome Shortcut


Cleaning Result
-------------------------------------------------------
Cleaned : 1
Reported as safe : 0
Failed : 0




ComboFix 17-11-14.01 - Petr 29.11.2017 1:07.1.4 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1250.420.1029.18.4094.2144 [GMT 1:00]
SpuŇ°tńõn√Ĺ z: c:\users\Petr\Desktop\ComboFix.exe
AV: Microsoft Security Essentials *Disabled/Updated* {B7ECF8CD-0188-6703-DBA4-AA65C6ACFB0A}
SP: Microsoft Security Essentials *Disabled/Updated* {0C8D1929-27B2-688D-E114-9117BD2BB1B7}
.
.
((((((((((((((((((((((((((((((((((((((( Ostatn√≠ v√Ĺmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\programdata\ntuser.pol
c:\users\PetrDownloads\RogueKiller_portable64.exe
c:\windows\security\logs\scecomp.log
.
.
((((((((((((((((((((((((( Soubory vytvoŇôen√© od 2017-10-28 do 2017-11-29 )))))))))))))))))))))))))))))))
.
.
2017-11-29 00:13 . 2017-11-29 00:13 -------- d-----w- c:\users\Public\AppData\Local\temp
2017-11-29 00:13 . 2017-11-29 00:13 -------- d-----w- c:\users\Petr\AppData\Local\temp
2017-11-29 00:13 . 2017-11-29 00:13 -------- d-----w- c:\users\Default\AppData\Local\temp
2017-11-29 00:07 . 2017-11-29 00:07 75888 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{68A75D7B-7097-4CE6-A57F-4C6D4CEEF6A2}\offreg.892.dll
2017-11-29 00:05 . 2017-10-30 09:27 13771264 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{68A75D7B-7097-4CE6-A57F-4C6D4CEEF6A2}\mpengine.dll
2017-11-28 23:48 . 2017-11-28 23:48 203680 ----a-w- c:\windows\system32\drivers\zamguard64.sys
2017-11-28 23:48 . 2017-11-28 23:48 203680 ----a-w- c:\windows\system32\drivers\zam64.sys
2017-11-28 23:48 . 2017-11-28 23:48 -------- d-----w- c:\program files (x86)\Zemana AntiMalware
2017-11-28 23:46 . 2017-11-28 23:46 -------- d-----w- c:\users\Petr\AppData\Local\Zemana
2017-11-28 23:44 . 2017-11-28 23:42 24064 ----a-w- c:\windows\zoek-delete.exe
2017-11-28 23:44 . 2017-11-28 23:44 -------- d-----w- c:\users\Petr\AppData\Local\Data aplikac√Ě
2017-11-28 23:44 . 2017-11-28 23:45 -------- d-----w- C:\zoek
2017-11-28 01:04 . 2017-11-28 01:04 1313792 ----a-w- c:\users\Petr\AppData\Roaming\Microsoft\Windows\Start Menu\Programy\VITSOFT\Vit Registry Fix\zoek.exe
2017-11-28 01:04 . 2017-11-28 01:04 1313792 ----a-w- c:\users\Petr\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VITSOFT\Vit Registry Fix\zoek.exe
2017-11-27 21:45 . 2017-10-30 09:27 13771264 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2017-11-26 21:02 . 2017-11-28 01:10 28272 ----a-w- c:\windows\system32\drivers\TrueSight.sys
2017-11-26 21:02 . 2017-11-26 21:27 -------- d-----w- c:\programdata\RogueKiller
2017-11-26 20:59 . 2017-11-26 20:59 -------- d-----w- c:\programdata\Sophos
2017-11-26 20:58 . 2017-11-26 20:58 -------- d-----w- c:\program files (x86)\Sophos
2017-11-26 20:44 . 2017-11-26 20:44 26838600 ----a-w- c:\users\Petr\AppData\Roaming\Microsoft\Windows\Start Menu\Programy\VITSOFT\Vit Registry Fix\RogueKiller_portable64.exe
2017-11-26 20:44 . 2017-11-26 20:44 26838600 ----a-w- c:\users\Petr\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VITSOFT\Vit Registry Fix\RogueKiller_portable64.exe
2017-11-26 20:42 . 2017-11-26 20:43 1790024 ----a-w- c:\users\Petr\AppData\Roaming\Microsoft\Windows\Start Menu\Programy\VITSOFT\Vit Registry Fix\JRT.exe
2017-11-26 20:42 . 2017-11-26 20:43 1790024 ----a-w- c:\users\Petr\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VITSOFT\Vit Registry Fix\JRT.exe
2017-11-26 17:02 . 2017-11-26 17:02 8261584 ----a-w- c:\users\Petr\AppData\Roaming\Microsoft\Windows\Start Menu\Programy\VITSOFT\Vit Registry Fix\adwcleaner_7.0.4.0.exe
2017-11-26 17:02 . 2017-11-26 17:02 8261584 ----a-w- c:\users\Petr\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VITSOFT\Vit Registry Fix\adwcleaner_7.0.4.0.exe
2017-11-26 16:39 . 2017-11-01 07:54 77432 ----a-w- c:\windows\system32\drivers\mbae64.sys
2017-11-26 16:38 . 2017-11-26 16:38 448512 ----a-w- c:\users\Petr\AppData\Roaming\Microsoft\Windows\Start Menu\Programy\VITSOFT\Vit Registry Fix\TFC.exe
2017-11-26 16:38 . 2017-11-26 16:38 448512 ----a-w- c:\users\Petr\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VITSOFT\Vit Registry Fix\TFC.exe
2017-11-26 08:45 . 2017-11-26 16:49 -------- d-----w- c:\program files (x86)\7-Zip
2017-11-25 22:42 . 2017-11-25 22:42 -------- d-----w- c:\program files (x86)\Secunia
2017-11-25 21:01 . 2017-11-25 21:01 -------- d-----w- c:\programdata\Kaspersky Lab Setup Files
2017-11-18 10:49 . 2017-11-18 10:49 -------- d-----w- c:\program files (x86)\AMD
2017-11-18 10:48 . 2017-11-18 10:48 -------- d-----w- c:\program files\Common Files\ATI Technologies
2017-11-18 09:38 . 2017-09-29 09:10 1057976 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{127DE711-7649-4B6C-ADEF-99EF32A3805C}\gapaengine.dll
2017-11-16 19:48 . 2017-11-16 19:48 -------- d-----w- c:\program files\Malwarebytes
2017-11-16 19:24 . 2017-11-16 19:24 -------- d-----w- c:\users\Petr\AppData\Local\RadeonInstaller
2017-11-16 19:18 . 2017-11-16 19:40 122848 ----a-w- c:\windows\system32\RtNicProp64.dll
2017-11-16 19:18 . 2017-11-16 19:40 1074792 ----a-w- c:\windows\system32\drivers\Rt64win7.sys
2017-11-16 19:16 . 2017-11-16 19:16 3677160 ----a-w- c:\windows\system32\RTSnMg64.cpl
2017-11-16 00:46 . 2017-11-16 00:46 15948200 ----a-w- c:\windows\system32\atidxx64.dll
2017-11-16 00:46 . 2017-11-16 00:46 13141432 ----a-w- c:\windows\SysWow64\atidxx32.dll
2017-11-16 00:46 . 2017-11-16 00:46 9936 ----a-w- c:\windows\system32\detoured.dll
2017-11-16 00:46 . 2017-11-16 00:46 9936 ----a-w- c:\windows\SysWow64\detoured.dll
2017-11-16 00:46 . 2017-11-16 00:46 1931920 ----a-w- c:\windows\system32\aticfx64.dll
2017-11-16 00:46 . 2017-11-16 00:46 195888 ----a-w- c:\windows\system32\atiuxp64.dll
2017-11-16 00:46 . 2017-11-16 00:46 161344 ----a-w- c:\windows\SysWow64\atiuxpag.dll
2017-11-16 00:46 . 2017-11-16 00:46 1541080 ----a-w- c:\windows\SysWow64\aticfx32.dll
2017-11-16 00:44 . 2017-11-16 00:44 405384 ----a-w- c:\windows\system32\atieah64.exe
2017-11-16 00:43 . 2017-11-16 00:43 148360 ----a-w- c:\windows\system32\atisamu64.dll
2017-11-16 00:42 . 2017-11-16 00:42 543624 ----a-w- c:\windows\system32\amdmcl64.dll
2017-11-16 00:42 . 2017-11-16 00:42 373640 ----a-w- c:\windows\SysWow64\amdmcl32.dll
2017-11-16 00:42 . 2017-11-16 00:42 28929416 ----a-w- c:\windows\SysWow64\atioglxx.dll
2017-11-15 10:13 . 2017-10-18 02:34 134376 ----a-w- c:\windows\system32\CompatTelRunner.exe
2017-11-15 10:13 . 2017-10-18 02:30 605184 ----a-w- c:\windows\system32\aeinv.dll
2017-11-15 10:13 . 2017-10-15 22:04 407392 ----a-w- c:\windows\system32\centel.dll
2017-11-15 10:13 . 2017-10-04 13:04 670208 ----a-w- c:\windows\system32\generaltel.dll
2017-11-15 10:13 . 2017-10-04 13:04 603648 ----a-w- c:\windows\system32\devinv.dll
2017-11-15 10:13 . 2017-10-04 13:04 370688 ----a-w- c:\windows\system32\invagent.dll
2017-11-15 10:13 . 2017-10-04 13:04 241664 ----a-w- c:\windows\system32\aepic.dll
2017-11-15 10:13 . 2017-10-04 13:04 2023936 ----a-w- c:\windows\system32\aitstatic.exe
2017-11-15 10:13 . 2017-10-04 13:04 181760 ----a-w- c:\windows\system32\acmigration.dll
2017-11-15 10:13 . 2017-10-04 13:04 1570304 ----a-w- c:\windows\system32\appraiser.dll
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M v√Ĺpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2017-11-28 23:44 . 2016-08-19 15:31 65536 ----a-w- c:\windows\system32\spu_storage.bin
2017-11-25 22:50 . 2015-08-27 12:42 803328 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2017-11-25 22:50 . 2015-08-27 12:42 144896 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2017-11-20 20:32 . 2015-08-27 12:57 545440 ------w- c:\windows\system32\MpSigStub.exe
2017-11-16 19:40 . 2015-08-27 12:18 118816 ----a-w- c:\windows\system32\RTNUninst64.dll
2017-11-16 19:13 . 2017-10-12 13:08 127017032 -c--a-w- c:\windows\system32\MRT-KB890830.exe
2017-11-16 19:13 . 2015-08-30 11:53 127017032 -c--a-w- c:\windows\system32\MRT.exe
2017-11-16 00:45 . 2017-07-04 22:37 223112 ----a-w- c:\windows\system32\atig6txx.dll
2017-11-16 00:45 . 2017-07-04 22:37 144776 ----a-w- c:\windows\system32\atig6pxx.dll
2017-11-16 00:44 . 2017-04-03 22:22 1454984 ----a-w- c:\windows\system32\atiadlxx.dll
2017-11-16 00:42 . 2017-07-04 22:35 35220872 ----a-w- c:\windows\system32\atio6axx.dll
2017-09-29 09:10 . 2015-08-30 12:20 1057976 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\NISBackup\gapaengine.dll
2017-09-13 23:20 . 2017-09-13 23:20 798008 ----a-w- c:\windows\SysWow64\vulkan-1-1-0-61-0.dll
2017-09-13 23:20 . 2017-07-19 13:22 798008 ----a-w- c:\windows\SysWow64\vulkan-1.dll
2017-09-13 23:20 . 2017-09-13 23:20 490296 ----a-w- c:\windows\SysWow64\vulkaninfo-1-1-0-61-0.exe
2017-09-13 23:20 . 2017-07-19 13:22 490296 ----a-w- c:\windows\SysWow64\vulkaninfo.exe
2017-09-13 23:19 . 2017-09-13 23:19 927544 ----a-w- c:\windows\system32\vulkan-1-1-0-61-0.dll
2017-09-13 23:19 . 2017-07-19 13:22 927544 ----a-w- c:\windows\system32\vulkan-1.dll
2017-09-13 23:19 . 2017-09-13 23:19 591160 ----a-w- c:\windows\system32\vulkaninfo-1-1-0-61-0.exe
2017-09-13 23:19 . 2017-07-19 13:22 591160 ----a-w- c:\windows\system32\vulkaninfo.exe
2017-09-13 15:33 . 2017-10-11 13:41 631176 ----a-w- c:\windows\system32\winresume.efi
2017-09-13 15:32 . 2017-10-11 13:41 706792 ----a-w- c:\windows\system32\winload.efi
2017-09-13 15:32 . 2017-10-11 13:41 5547752 ----a-w- c:\windows\system32\ntoskrnl.exe
2017-09-13 15:32 . 2017-10-11 13:41 95464 ----a-w- c:\windows\system32\drivers\ksecdd.sys
2017-09-13 15:32 . 2017-10-11 13:41 154856 ----a-w- c:\windows\system32\drivers\ksecpkg.sys
2017-09-13 15:31 . 2017-10-11 13:41 1732864 ----a-w- c:\windows\system32\ntdll.dll
2017-09-13 15:28 . 2017-10-11 13:41 448512 ----a-w- c:\windows\system32\wlansec.dll
2017-09-13 15:28 . 2017-10-11 13:41 414208 ----a-w- c:\windows\system32\wlanmsm.dll
2017-09-13 15:28 . 2017-10-11 13:41 886272 ----a-w- c:\windows\system32\wlansvc.dll
2017-09-13 15:28 . 2017-10-11 13:41 118784 ----a-w- c:\windows\system32\wlanhlp.dll
2017-09-13 15:28 . 2017-10-11 13:41 113664 ----a-w- c:\windows\system32\wlanapi.dll
2017-09-13 15:28 . 2017-10-11 13:41 362496 ----a-w- c:\windows\system32\wow64win.dll
2017-09-13 15:28 . 2017-10-11 13:41 215552 ----a-w- c:\windows\system32\winsrv.dll
2017-09-13 15:28 . 2017-10-11 13:41 243712 ----a-w- c:\windows\system32\wow64.dll
2017-09-13 15:28 . 2017-10-11 13:41 13312 ----a-w- c:\windows\system32\wow64cpu.dll
2017-09-13 15:28 . 2017-10-11 13:41 86528 ----a-w- c:\windows\system32\TSpkg.dll
2017-09-13 15:28 . 2017-10-11 13:41 210432 ----a-w- c:\windows\system32\wdigest.dll
2017-09-13 15:28 . 2017-10-11 13:41 503808 ----a-w- c:\windows\system32\srcore.dll
2017-09-13 15:28 . 2017-10-11 13:41 135680 ----a-w- c:\windows\system32\sspicli.dll
2017-09-13 15:28 . 2017-10-11 13:41 50176 ----a-w- c:\windows\system32\srclient.dll
2017-09-13 15:28 . 2017-10-11 13:41 28672 ----a-w- c:\windows\system32\sspisrv.dll
2017-09-13 15:28 . 2017-10-11 13:41 63488 ----a-w- c:\windows\system32\setbcdlocale.dll
2017-09-13 15:28 . 2017-10-11 13:41 1212928 ----a-w- c:\windows\system32\rpcrt4.dll
2017-09-13 15:28 . 2017-10-11 13:41 345600 ----a-w- c:\windows\system32\schannel.dll
2017-09-13 15:28 . 2017-10-11 13:41 190464 ----a-w- c:\windows\system32\rpchttp.dll
2017-09-13 15:28 . 2017-10-11 13:41 28160 ----a-w- c:\windows\system32\secur32.dll
2017-09-13 15:28 . 2017-10-11 13:41 16384 ----a-w- c:\windows\system32\ntvdm64.dll
2017-09-13 15:28 . 2017-10-11 13:41 312320 ----a-w- c:\windows\system32\ncrypt.dll
2017-09-13 15:28 . 2017-10-11 13:41 1068544 ----a-w- c:\windows\system32\msctf.dll
2017-09-13 15:28 . 2017-10-11 13:41 316928 ----a-w- c:\windows\system32\msv1_0.dll
2017-09-13 15:28 . 2017-10-11 13:41 60416 ----a-w- c:\windows\system32\msobjs.dll
2017-09-13 15:28 . 2017-10-11 13:41 146432 ----a-w- c:\windows\system32\msaudite.dll
2017-09-13 15:27 . 2017-10-11 13:41 731648 ----a-w- c:\windows\system32\kerberos.dll
2017-09-13 15:27 . 2017-10-11 13:41 1460736 ----a-w- c:\windows\system32\lsasrv.dll
2017-09-13 15:27 . 2017-10-11 13:41 1163264 ----a-w- c:\windows\system32\kernel32.dll
2017-09-13 15:27 . 2017-10-11 13:41 419840 ----a-w- c:\windows\system32\KernelBase.dll
2017-09-13 15:27 . 2017-10-11 13:41 44032 ----a-w- c:\windows\system32\csrsrv.dll
2017-09-13 15:27 . 2017-10-11 13:41 43520 ----a-w- c:\windows\system32\cryptbase.dll
2017-09-13 15:27 . 2017-10-11 13:41 22016 ----a-w- c:\windows\system32\credssp.dll
2017-09-13 15:27 . 2017-10-11 13:41 463872 ----a-w- c:\windows\system32\certcli.dll
2017-09-13 15:27 . 2017-10-11 13:41 880640 ----a-w- c:\windows\system32\advapi32.dll
2017-09-13 15:27 . 2017-10-11 13:41 123904 ----a-w- c:\windows\system32\bcrypt.dll
2017-09-13 15:27 . 2017-10-11 13:41 59904 ----a-w- c:\windows\system32\appidapi.dll
2017-09-13 15:27 . 2017-10-11 13:41 34816 ----a-w- c:\windows\system32\appidsvc.dll
2017-09-13 15:27 . 2017-10-11 13:41 4608 ---ha-w- c:\windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2017-09-13 15:27 . 2017-10-11 13:41 4096 ---ha-w- c:\windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2017-09-13 15:27 . 2017-10-11 13:41 4096 ---ha-w- c:\windows\system32\api-ms-win-core-synch-l1-1-0.dll
2017-09-13 15:27 . 2017-10-11 13:41 3072 ---ha-w- c:\windows\system32\api-ms-win-core-util-l1-1-0.dll
2017-09-13 15:27 . 2017-10-11 13:41 6656 ----a-w- c:\windows\system32\apisetschema.dll
2017-09-13 15:27 . 2017-10-11 13:41 6144 ---ha-w- c:\windows\system32\api-ms-win-security-base-l1-1-0.dll
2017-09-13 15:27 . 2017-10-11 13:41 5120 ---ha-w- c:\windows\system32\api-ms-win-core-file-l1-1-0.dll
2017-09-13 15:27 . 2017-10-11 13:41 4608 ---ha-w- c:\windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2017-09-13 15:27 . 2017-10-11 13:41 4096 ---ha-w- c:\windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2017-09-13 15:27 . 2017-10-11 13:41 4096 ---ha-w- c:\windows\system32\api-ms-win-core-localization-l1-1-0.dll
2017-09-13 15:27 . 2017-10-11 13:41 3584 ---ha-w- c:\windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2017-09-13 15:27 . 2017-10-11 13:41 3584 ---ha-w- c:\windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2017-09-13 15:27 . 2017-10-11 13:41 3584 ---ha-w- c:\windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2017-09-13 15:27 . 2017-10-11 13:41 3584 ---ha-w- c:\windows\system32\api-ms-win-core-misc-l1-1-0.dll
2017-09-13 15:27 . 2017-10-11 13:41 3584 ---ha-w- c:\windows\system32\api-ms-win-core-memory-l1-1-0.dll
2017-09-13 15:27 . 2017-10-11 13:41 3584 ---ha-w- c:\windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2017-09-13 15:27 . 2017-10-11 13:41 3584 ---ha-w- c:\windows\system32\api-ms-win-core-heap-l1-1-0.dll
2017-09-13 15:27 . 2017-10-11 13:41 3072 ---ha-w- c:\windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2017-09-13 15:27 . 2017-10-11 13:41 3072 ---ha-w- c:\windows\system32\api-ms-win-core-string-l1-1-0.dll
2017-09-13 15:27 . 2017-10-11 13:41 3072 ---ha-w- c:\windows\system32\api-ms-win-core-profile-l1-1-0.dll
2017-09-13 15:27 . 2017-10-11 13:41 3072 ---ha-w- c:\windows\system32\api-ms-win-core-io-l1-1-0.dll
2017-09-13 15:27 . 2017-10-11 13:41 3072 ---ha-w- c:\windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2017-09-13 15:27 . 2017-10-11 13:41 3072 ---ha-w- c:\windows\system32\api-ms-win-core-handle-l1-1-0.dll
2017-09-13 15:27 . 2017-10-11 13:41 3072 ---ha-w- c:\windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2017-09-13 15:27 . 2017-10-11 13:41 3072 ---ha-w- c:\windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2017-09-13 15:27 . 2017-10-11 13:41 3072 ---ha-w- c:\windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2017-09-13 15:27 . 2017-10-11 13:41 3072 ---ha-w- c:\windows\system32\api-ms-win-core-debug-l1-1-0.dll
2017-09-13 15:27 . 2017-10-11 13:41 3072 ---ha-w- c:\windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2017-09-13 15:27 . 2017-10-11 13:41 3072 ---ha-w- c:\windows\system32\api-ms-win-core-console-l1-1-0.dll
2017-09-13 15:27 . 2017-10-11 13:41 690688 ----a-w- c:\windows\system32\adtschema.dll
2017-09-13 15:13 . 2017-10-11 13:41 4001512 ----a-w- c:\windows\SysWow64\ntkrnlpa.exe
2017-09-13 15:13 . 2017-10-11 13:41 3945704 ----a-w- c:\windows\SysWow64\ntoskrnl.exe
2017-09-13 15:10 . 2017-10-11 13:41 1314112 ----a-w- c:\windows\SysWow64\ntdll.dll
2017-09-13 15:09 . 2017-10-11 13:41 666112 ----a-w- c:\windows\SysWow64\rpcrt4.dll
2017-09-13 15:09 . 2017-10-11 13:41 96768 ----a-w- c:\windows\SysWow64\sspicli.dll
2017-09-13 15:09 . 2017-10-11 13:41 275456 ----a-w- c:\windows\SysWow64\KernelBase.dll
.
.
(((((((((((((((((((((((((((((((((( SpouŇ°tńõc√≠ body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Pozn√°mka* pr√°zdn√© z√°znamy a legitimn√≠ v√Ĺchoz√≠ √ļdaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
"EnableLinkedConnections"= 1 (0x1)
.
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoSimpleNetIDList"= 1 (0x1)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MBAMService]
@="Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R3 dtlitescsibus;DAEMON Tools Lite Virtual SCSI Bus;c:\windows\system32\DRIVERS\dtlitescsibus.sys;c:\windows\SYSNATIVE\DRIVERS\dtlitescsibus.sys [x]
R3 dtliteusbbus;DAEMON Tools Lite Virtual USB Bus;c:\windows\system32\DRIVERS\dtliteusbbus.sys;c:\windows\SYSNATIVE\DRIVERS\dtliteusbbus.sys [x]
R3 etdrv;etdrv;c:\windows\etdrv.sys;c:\windows\etdrv.sys [x]
R3 GVTDrv64;GVTDrv64;c:\windows\GVTDrv64.sys;c:\windows\GVTDrv64.sys [x]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x]
R3 lvpepf64;Volume Adapter;c:\windows\system32\DRIVERS\lv302a64.sys;c:\windows\SYSNATIVE\DRIVERS\lv302a64.sys [x]
R3 LVRS64;Logitech RightSound Filter Driver;c:\windows\system32\DRIVERS\lvrs64.sys;c:\windows\SYSNATIVE\DRIVERS\lvrs64.sys [x]
R3 LVUSBS64;Logitech USB Monitor Filter;c:\windows\system32\drivers\LVUSBS64.sys;c:\windows\SYSNATIVE\drivers\LVUSBS64.sys [x]
R3 MBAMService;Malwarebytes Service;c:\program files\Malwarebytes\Anti-Malware\mbamservice.exe;c:\program files\Malwarebytes\Anti-Malware\mbamservice.exe [x]
R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys;c:\windows\SYSNATIVE\DRIVERS\NisDrvWFP.sys [x]
R3 NisSrv;Kontrola s√≠tńõ Microsoft;c:\program files\Microsoft Security Client\NisSrv.exe;c:\program files\Microsoft Security Client\NisSrv.exe [x]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys;c:\windows\SYSNATIVE\drivers\rdpvideominiport.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 WatAdminSvc;SluŇĺba Technologie aktivace Windows;c:\windows\system32\Wat\WatAdminSvc.exe;c:\windows\SYSNATIVE\Wat\WatAdminSvc.exe [x]
R4 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]
R4 WsAppService;Wondershare Application Framework Service;c:\program files (x86)\Wondershare\WAF\2.4.3.225\WsAppService.exe;c:\program files (x86)\Wondershare\WAF\2.4.3.225\WsAppService.exe [x]
S0 amdide64;amdide64;c:\windows\system32\DRIVERS\amdide64.sys;c:\windows\SYSNATIVE\DRIVERS\amdide64.sys [x]
S1 HWiNFO32;HWiNFO32/64 Kernel Driver;c:\windows\SysWOW64\drivers\HWiNFO64A.SYS;c:\windows\SysWOW64\drivers\HWiNFO64A.SYS [x]
S1 ZAM;ZAM Helper Driver;c:\windows\System32\drivers\zam64.sys;c:\windows\SYSNATIVE\drivers\zam64.sys [x]
S1 ZAM_Guard;ZAM Guard Driver;c:\windows\System32\drivers\zamguard64.sys;c:\windows\SYSNATIVE\drivers\zamguard64.sys [x]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe;c:\windows\SYSNATIVE\atiesrxx.exe [x]
S2 DiagTrack;Diagnostics Tracking Service;c:\windows\System32\svchost.exe;c:\windows\SYSNATIVE\svchost.exe [x]
S2 ei2c;ei2c;c:\windows\system32\drivers\ei2c.sys;c:\windows\SYSNATIVE\drivers\ei2c.sys [x]
S2 mi2c;mi2c;c:\windows\system32\drivers\mi2c.sys;c:\windows\SYSNATIVE\drivers\mi2c.sys [x]
S2 ZAMSvc;ZAM Controller Service;c:\program files (x86)\Zemana AntiMalware\ZAM.exe;c:\program files (x86)\Zemana AntiMalware\ZAM.exe [x]
S3 amdiox64;AMD IO Driver;c:\windows\system32\DRIVERS\amdiox64.sys;c:\windows\SYSNATIVE\DRIVERS\amdiox64.sys [x]
S3 KYEKBPRO;IMPERATOR PRO Gaming Keyboard;c:\windows\system32\drivers\KYEKBPRO.sys;c:\windows\SYSNATIVE\drivers\KYEKBPRO.sys [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x]
.
.
--- Ostatn√≠ sluŇĺby/ovladańće v pamńõti ---
.
*NewlyCreated* - ZAM
*NewlyCreated* - ZAM_GUARD
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost]
LocalServiceAndNoImpersonation REG_MULTI_SZ SSDPSRV upnphost SCardSvr QWAVE wcncsvc
LocalDriverService REG_MULTI_SZ LDrvSvc
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ZAM"="c:\program files (x86)\Zemana AntiMalware\ZAM.exe" [2017-08-09 15775888]
.
------- DoplŇąkov√Ĺ sken -------
.
uLocal Page = c:\windows\system32\blank.htm
IE: S10 Autologin
IE: S10 Autotype...
TCP: Interfaces\{9317833D-D4B3-4B9C-8B06-9B224515606B}: NameServer = 94.74.192.252,8.8.8.8
.
- - - - NEPLATN√Č POLOŇĹKY ODSTRANńöN√Č Z REGISTRU - - - -
.
ShellIconOverlayIdentifiers-{056D528D-CE28-4194-9BA3-BA2E9197FF8C} - (no file)
ShellIconOverlayIdentifiers-{05B38830-F4E9-4329-978B-1DD28605D202} - (no file)
ShellIconOverlayIdentifiers-{0596C850-7BDD-4C9D-AFDF-873BE6890637} - (no file)
ShellIconOverlayIdentifiers-{056D528D-CE28-4194-9BA3-BA2E9197FF8C} - (no file)
ShellIconOverlayIdentifiers-{05B38830-F4E9-4329-978B-1DD28605D202} - (no file)
ShellIconOverlayIdentifiers-{0596C850-7BDD-4C9D-AFDF-873BE6890637} - (no file)
AddRemove-PunkBusterSvc - c:\windows\system32\pbsvc.exe
.
.
.
--------------------- ZAMKNUT√Č KL√ćńĆE V REGISTRU ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_27_0_0_187_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_27_0_0_187_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}]
@Denied: (A 2) (Everyone)
@="IFlashBroker6"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_27_0_0_187_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_27_0_0_187_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_27_0_0_187.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.27"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_27_0_0_187.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_27_0_0_187.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_27_0_0_187.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}]
@Denied: (A 2) (Everyone)
@="IFlashBroker6"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Celkov√Ĺ ńćas: 2017-11-29 01:15:02
ComboFix-quarantined-files.txt 2017-11-29 00:15
.
PŇôed spuŇ°tńõn√≠m: Voln√Ĺch bajtŇĮ: 646¬†074¬†597¬†376
Po spuŇ°tńõn√≠: Voln√Ĺch bajtŇĮ: 645¬†473¬†144¬†832
.
- - End Of File - - 4E2FED9699600A8F74806163DF575A23
A36C5E4F47E84449FF07ED3517B43A31

UŇĺivatelsk√Ĺ avatar
jaro3
ńćlen Security t√Ĺmu
Guru Level 15
Guru Level 15
PŇô√≠spńõvky: 38711
Registrov√°n: ńćerven 07
BydliŇ°tńõ: JiŇĺn√≠ ńĆechy
Pohlav√≠: MuŇĺ

Re: Prosim o kontrolu

PŇô√≠spńõvekod jaro3 » 29 lis 2017 10:10

Vypni rez. ochranu u antiviru a antispywaru,pŇô√≠p. firewall..

OtevŇôi si Pozn√°mkov√Ĺ blok (Start -> Spustit... a napiŇ° do okna Notepad a dej Ok.
Zkop√≠ruj do nńõj n√°sleduj√≠c√≠ cel√Ĺ text oznańćen√Ĺ zelenńõ:

K√≥d: Vybrat vŇ°e

ClearJavaCache::
KillAll::
Folder::
c:\program files (x86)\Skype\Updater

Driver::
SkypeUpdate

RegLock::
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_27_0_0_187_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_27_0_0_187_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}]
@Denied: (A 2) (Everyone)
@="IFlashBroker6"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_27_0_0_187_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_27_0_0_187_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_27_0_0_187.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.27"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_27_0_0_187.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_27_0_0_187.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_27_0_0_187.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}]
@Denied: (A 2) (Everyone)
@="IFlashBroker6"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\PCW\Security]
@Denied: (Full) (Everyone)


Zvol moŇĺnost Soubor -> UloŇĺit jako... a nastav tyto parametry:
N√°zev souboru: zde napiŇ°: CFScript.txt
UloŇĺit jako typ: tak tam vyber VŇ°echny soubory
UloŇĺ soubor na plochu.
Ukonńći vŇ°echna aktivn√≠ okna.

Uchop myŇ°√≠ vytvoŇôen√Ĺ skript CFScript.txt, pŇôem√≠sti ho nad staŇĺen√Ĺ program ComboFix.exe a kdyŇĺ se oba soubory pŇôekryj√≠, skript upusŇ•.
- Automaticky se spustí ComboFix
- VloŇĺ sem log, kter√Ĺ vybńõhne v z√°vńõru ńćist√≠c√≠ho procesu + nov√Ĺ log z HJT

Upozornńõn√≠ : MŇĮŇĺe se st√°t, Ňĺe po aplikaci Combofixu a restartu pońć√≠tańće, Windows nenabńõhnou , nebo nenajede plocha , budou probl√©my s pŇôipojen√≠m, pak znovu restartuj pońć√≠tańć, pokud to nepomŇĮŇĺe , po restartu mańćkej kl√°vesu F8 a pak zvol posledn√≠ zn√°mou funkńćn√≠ konfiguraci. , ńći pouŇĺij bod obnovy.

St√°hni si aswMBR
na svoj√≠ plochu. UzavŇôi vŇ°echna okna , programy a prohl√≠Ňĺeńće. Poklepej na aswMBR.exe. Pokud se objev√≠ hl√°Ň°ka o moŇĺnosti st√°hnut√≠ datab√°ze Avastu , klikni na NE. Pot√© klikni na ‚ÄěScan‚Äú . Po skenu klikni na ‚ÄěSave Log‚Äú a uloŇĺ si log na plochu .Zkop√≠ruj sem cel√Ĺ obsah toho logu. Pak klikni na ‚ÄěExit‚Äú k zavŇôen√≠ programu.
PŇôi pr√°ci s programy HJT, ComboFix,MbAM, SDFix aj. zavŇôete vŇ°echny ostatn√≠ aplikace a prohl√≠Ňĺeńće!
Nepos√≠lejte logy do soukrom√Ĺch zpr√°v.Po dobu m√© nepŇô√≠tomnosti mńõ zastupuje memphisto , ŇĹbeky a Orcus.
Pokud budete spokojeni , mŇĮŇĺete podpoŇôit naŇ°e forum:Podpora f√≥ra

securit4k
Level 1
Level 1
PŇô√≠spńõvky: 70
Registrov√°n: prosinec 12
Pohlav√≠: MuŇĺ

Re: Prosim o kontrolu

PŇô√≠spńõvekod securit4k » 02 pro 2017 20:32

cus po delsi dobe, objevila se po combofixu modra smrt tak jsem bootnul dvd a prez cmd zadal bcdedit /deletefalue default numproc + bcdedit /deletevalue default truncatememory, pac jinak neslo ani znama konfigurace ani obnvoeni, btw ty nalezy z rogue killeru jsem musel obnovit (restore) pac mi jinak nesel net at vis.


ComboFix 17-11-14.01 - Petr 02.12.2017 19:18:47.1.4 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1250.420.1029.18.3070.2028 [GMT 1:00]
SpuŇ°tńõn√Ĺ z: c:\users\Petr\Desktop\ComboFix.exe
PouŇĺit√© ovl√°dac√≠ pŇôep√≠nańće :: c:\users\Petr\Desktop\CFScript.txt
AV: Microsoft Security Essentials *Disabled/Updated* {B7ECF8CD-0188-6703-DBA4-AA65C6ACFB0A}
SP: Microsoft Security Essentials *Disabled/Updated* {0C8D1929-27B2-688D-E114-9117BD2BB1B7}
.
.
((((((((((((((((((((((((((((((((((((((( Ostatn√≠ v√Ĺmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\program files (x86)\Skype\Updater
c:\program files (x86)\Skype\Updater\Updater.dll
c:\program files (x86)\Skype\Updater\Updater.exe
c:\programdata\ntuser.pol
c:\windows\SysWow64\SET14D1.tmp
c:\windows\SysWow64\SET1A31.tmp
c:\windows\SysWow64\SET2185.tmp
c:\windows\SysWow64\SET30.tmp
c:\windows\SysWow64\SET39FC.tmp
c:\windows\SysWow64\SET4084.tmp
c:\windows\SysWow64\SET41FC.tmp
c:\windows\SysWow64\SET6AE5.tmp
c:\windows\SysWow64\SET795D.tmp
c:\windows\SysWow64\SETA11.tmp
c:\windows\SysWow64\SETA814.tmp
c:\windows\SysWow64\SETAE3.tmp
c:\windows\SysWow64\SETBB68.tmp
c:\windows\SysWow64\SETBCB2.tmp
c:\windows\SysWow64\SETCFCF.tmp
c:\windows\SysWow64\SETDC5A.tmp
c:\windows\SysWow64\SETE02E.tmp
c:\windows\SysWow64\SETE033.tmp
c:\windows\SysWow64\SETEFD0.tmp
c:\windows\SysWow64\SETF0FA.tmp
.
.
((((((((((((((((((((((((((((((((((((((( Ovladańće/SluŇĺby )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Service_SkypeUpdate
.
.
((((((((((((((((((((((((( Soubory vytvoŇôen√© od 2017-11-02 do 2017-12-02 )))))))))))))))))))))))))))))))
.
.
2017-12-02 19:17 . 2017-12-02 19:17 20250624 ----a-w- c:\windows\SysWow64\FlashPlayerInstaller.exe
2017-12-02 18:24 . 2017-12-02 18:24 -------- d-----w- c:\users\Public\AppData\Local\temp
2017-12-02 18:24 . 2017-12-02 18:24 -------- d-----w- c:\users\Petr\AppData\Local\temp
2017-12-02 18:24 . 2017-12-02 18:24 -------- d-----w- c:\users\Default\AppData\Local\temp
2017-12-02 17:56 . 2017-10-30 09:27 13771264 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{1CB06CB6-06A3-42FA-B092-B84C4C0785AA}\mpengine.dll
2017-12-02 17:50 . 2017-12-02 17:50 8187336 ----a-w- c:\users\Petr\AppData\Roaming\Microsoft\Windows\Start Menu\Programy\VITSOFT\Vit Registry Fix\adwcleaner_7.0.5.0.exe
2017-12-02 17:50 . 2017-12-02 17:50 8187336 ----a-w- c:\users\Petr\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VITSOFT\Vit Registry Fix\adwcleaner_7.0.5.0.exe
2017-11-30 21:28 . 2017-10-30 09:27 13771264 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2017-11-28 23:48 . 2017-11-29 21:52 -------- d-----w- c:\program files (x86)\Zemana AntiMalware
2017-11-28 23:46 . 2017-11-28 23:46 -------- d-----w- c:\users\Petr\AppData\Local\Zemana
2017-11-28 23:44 . 2017-11-28 23:44 -------- d-----w- c:\users\Petr\AppData\Local\Data aplikac√Ě
2017-11-28 23:44 . 2017-11-28 23:45 -------- d-----w- C:\zoek
2017-11-26 21:02 . 2017-11-26 21:27 -------- d-----w- c:\programdata\RogueKiller
2017-11-26 20:59 . 2017-11-26 20:59 -------- d-----w- c:\programdata\Sophos
2017-11-26 20:58 . 2017-11-26 20:58 -------- d-----w- c:\program files (x86)\Sophos
2017-11-26 08:45 . 2017-11-29 21:49 -------- d-----w- c:\program files (x86)\7-Zip
2017-11-25 22:42 . 2017-11-29 21:34 -------- d-----w- c:\program files (x86)\Secunia
2017-11-25 21:01 . 2017-11-25 21:01 -------- d-----w- c:\programdata\Kaspersky Lab Setup Files
2017-11-18 10:49 . 2017-11-18 10:49 -------- d-----w- c:\program files (x86)\AMD
2017-11-18 10:48 . 2017-11-18 10:48 -------- d-----w- c:\program files\Common Files\ATI Technologies
2017-11-18 09:38 . 2017-09-29 09:10 1057976 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{127DE711-7649-4B6C-ADEF-99EF32A3805C}\gapaengine.dll
2017-11-16 19:48 . 2017-11-16 19:48 -------- d-----w- c:\program files\Malwarebytes
2017-11-16 19:24 . 2017-11-16 19:24 -------- d-----w- c:\users\Petr\AppData\Local\RadeonInstaller
2017-11-16 19:18 . 2017-11-16 19:40 122848 ----a-w- c:\windows\system32\RtNicProp64.dll
2017-11-16 19:18 . 2017-11-16 19:40 1074792 ----a-w- c:\windows\system32\drivers\Rt64win7.sys
2017-11-16 19:16 . 2017-11-16 19:16 3677160 ----a-w- c:\windows\system32\RTSnMg64.cpl
2017-11-16 00:46 . 2017-11-16 00:46 15948200 ----a-w- c:\windows\system32\atidxx64.dll
2017-11-16 00:46 . 2017-11-16 00:46 13141432 ----a-w- c:\windows\SysWow64\atidxx32.dll
2017-11-16 00:46 . 2017-11-16 00:46 9936 ----a-w- c:\windows\system32\detoured.dll
2017-11-16 00:46 . 2017-11-16 00:46 9936 ----a-w- c:\windows\SysWow64\detoured.dll
2017-11-16 00:46 . 2017-11-16 00:46 1931920 ----a-w- c:\windows\system32\aticfx64.dll
2017-11-16 00:46 . 2017-11-16 00:46 195888 ----a-w- c:\windows\system32\atiuxp64.dll
2017-11-16 00:46 . 2017-11-16 00:46 161344 ----a-w- c:\windows\SysWow64\atiuxpag.dll
2017-11-16 00:46 . 2017-11-16 00:46 1541080 ----a-w- c:\windows\SysWow64\aticfx32.dll
2017-11-16 00:44 . 2017-11-16 00:44 405384 ----a-w- c:\windows\system32\atieah64.exe
2017-11-16 00:43 . 2017-11-16 00:43 148360 ----a-w- c:\windows\system32\atisamu64.dll
2017-11-16 00:42 . 2017-11-16 00:42 543624 ----a-w- c:\windows\system32\amdmcl64.dll
2017-11-16 00:42 . 2017-11-16 00:42 373640 ----a-w- c:\windows\SysWow64\amdmcl32.dll
2017-11-16 00:42 . 2017-11-16 00:42 28929416 ----a-w- c:\windows\SysWow64\atioglxx.dll
2017-11-15 10:13 . 2017-10-18 02:34 134376 ----a-w- c:\windows\system32\CompatTelRunner.exe
2017-11-15 10:13 . 2017-10-18 02:30 605184 ----a-w- c:\windows\system32\aeinv.dll
2017-11-15 10:13 . 2017-10-15 22:04 407392 ----a-w- c:\windows\system32\centel.dll
2017-11-15 10:13 . 2017-10-04 13:04 670208 ----a-w- c:\windows\system32\generaltel.dll
2017-11-15 10:13 . 2017-10-04 13:04 603648 ----a-w- c:\windows\system32\devinv.dll
2017-11-15 10:13 . 2017-10-04 13:04 370688 ----a-w- c:\windows\system32\invagent.dll
2017-11-15 10:13 . 2017-10-04 13:04 241664 ----a-w- c:\windows\system32\aepic.dll
2017-11-15 10:13 . 2017-10-04 13:04 2023936 ----a-w- c:\windows\system32\aitstatic.exe
2017-11-15 10:13 . 2017-10-04 13:04 181760 ----a-w- c:\windows\system32\acmigration.dll
2017-11-15 10:13 . 2017-10-04 13:04 1570304 ----a-w- c:\windows\system32\appraiser.dll
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M v√Ĺpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2017-12-02 18:24 . 2016-08-19 15:31 65536 ----a-w- c:\windows\system32\spu_storage.bin
2017-11-20 20:32 . 2015-08-27 12:57 545440 ----a-w- c:\windows\system32\MpSigStub.exe
2017-11-16 19:40 . 2015-08-27 12:18 118816 ----a-w- c:\windows\system32\RTNUninst64.dll
2017-11-16 19:13 . 2017-10-12 13:08 127017032 -c--a-w- c:\windows\system32\MRT-KB890830.exe
2017-11-16 19:13 . 2015-08-30 11:53 127017032 -c--a-w- c:\windows\system32\MRT.exe
2017-11-16 00:45 . 2017-07-04 22:37 223112 ----a-w- c:\windows\system32\atig6txx.dll
2017-11-16 00:45 . 2017-07-04 22:37 144776 ----a-w- c:\windows\system32\atig6pxx.dll
2017-11-16 00:44 . 2017-04-03 22:22 1454984 ----a-w- c:\windows\system32\atiadlxx.dll
2017-11-16 00:42 . 2017-07-04 22:35 35220872 ----a-w- c:\windows\system32\atio6axx.dll
2017-09-29 09:10 . 2015-08-30 12:20 1057976 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\NISBackup\gapaengine.dll
2017-09-13 23:20 . 2017-09-13 23:20 798008 ----a-w- c:\windows\SysWow64\vulkan-1-1-0-61-0.dll
2017-09-13 23:20 . 2017-07-19 13:22 798008 ----a-w- c:\windows\SysWow64\vulkan-1.dll
2017-09-13 23:20 . 2017-09-13 23:20 490296 ----a-w- c:\windows\SysWow64\vulkaninfo-1-1-0-61-0.exe
2017-09-13 23:20 . 2017-07-19 13:22 490296 ----a-w- c:\windows\SysWow64\vulkaninfo.exe
2017-09-13 23:19 . 2017-09-13 23:19 927544 ----a-w- c:\windows\system32\vulkan-1-1-0-61-0.dll
2017-09-13 23:19 . 2017-07-19 13:22 927544 ----a-w- c:\windows\system32\vulkan-1.dll
2017-09-13 23:19 . 2017-09-13 23:19 591160 ----a-w- c:\windows\system32\vulkaninfo-1-1-0-61-0.exe
2017-09-13 23:19 . 2017-07-19 13:22 591160 ----a-w- c:\windows\system32\vulkaninfo.exe
2017-09-13 15:33 . 2017-10-11 13:41 631176 ----a-w- c:\windows\system32\winresume.efi
2017-09-13 15:32 . 2017-10-11 13:41 706792 ----a-w- c:\windows\system32\winload.efi
2017-09-13 15:32 . 2017-10-11 13:41 5547752 ----a-w- c:\windows\system32\ntoskrnl.exe
2017-09-13 15:32 . 2017-10-11 13:41 95464 ----a-w- c:\windows\system32\drivers\ksecdd.sys
2017-09-13 15:32 . 2017-10-11 13:41 154856 ----a-w- c:\windows\system32\drivers\ksecpkg.sys
2017-09-13 15:31 . 2017-10-11 13:41 1732864 ----a-w- c:\windows\system32\ntdll.dll
2017-09-13 15:28 . 2017-10-11 13:41 448512 ----a-w- c:\windows\system32\wlansec.dll
2017-09-13 15:28 . 2017-10-11 13:41 414208 ----a-w- c:\windows\system32\wlanmsm.dll
2017-09-13 15:28 . 2017-10-11 13:41 886272 ----a-w- c:\windows\system32\wlansvc.dll
2017-09-13 15:28 . 2017-10-11 13:41 118784 ----a-w- c:\windows\system32\wlanhlp.dll
2017-09-13 15:28 . 2017-10-11 13:41 113664 ----a-w- c:\windows\system32\wlanapi.dll
2017-09-13 15:28 . 2017-10-11 13:41 362496 ----a-w- c:\windows\system32\wow64win.dll
2017-09-13 15:28 . 2017-10-11 13:41 215552 ----a-w- c:\windows\system32\winsrv.dll
2017-09-13 15:28 . 2017-10-11 13:41 243712 ----a-w- c:\windows\system32\wow64.dll
2017-09-13 15:28 . 2017-10-11 13:41 13312 ----a-w- c:\windows\system32\wow64cpu.dll
2017-09-13 15:28 . 2017-10-11 13:41 86528 ----a-w- c:\windows\system32\TSpkg.dll
2017-09-13 15:28 . 2017-10-11 13:41 210432 ----a-w- c:\windows\system32\wdigest.dll
2017-09-13 15:28 . 2017-10-11 13:41 503808 ----a-w- c:\windows\system32\srcore.dll
2017-09-13 15:28 . 2017-10-11 13:41 135680 ----a-w- c:\windows\system32\sspicli.dll
2017-09-13 15:28 . 2017-10-11 13:41 50176 ----a-w- c:\windows\system32\srclient.dll
2017-09-13 15:28 . 2017-10-11 13:41 28672 ----a-w- c:\windows\system32\sspisrv.dll
2017-09-13 15:28 . 2017-10-11 13:41 63488 ----a-w- c:\windows\system32\setbcdlocale.dll
2017-09-13 15:28 . 2017-10-11 13:41 1212928 ----a-w- c:\windows\system32\rpcrt4.dll
2017-09-13 15:28 . 2017-10-11 13:41 345600 ----a-w- c:\windows\system32\schannel.dll
2017-09-13 15:28 . 2017-10-11 13:41 190464 ----a-w- c:\windows\system32\rpchttp.dll
2017-09-13 15:28 . 2017-10-11 13:41 28160 ----a-w- c:\windows\system32\secur32.dll
2017-09-13 15:28 . 2017-10-11 13:41 16384 ----a-w- c:\windows\system32\ntvdm64.dll
2017-09-13 15:28 . 2017-10-11 13:41 312320 ----a-w- c:\windows\system32\ncrypt.dll
2017-09-13 15:28 . 2017-10-11 13:41 1068544 ----a-w- c:\windows\system32\msctf.dll
2017-09-13 15:28 . 2017-10-11 13:41 316928 ----a-w- c:\windows\system32\msv1_0.dll
2017-09-13 15:28 . 2017-10-11 13:41 60416 ----a-w- c:\windows\system32\msobjs.dll
2017-09-13 15:28 . 2017-10-11 13:41 146432 ----a-w- c:\windows\system32\msaudite.dll
2017-09-13 15:27 . 2017-10-11 13:41 731648 ----a-w- c:\windows\system32\kerberos.dll
2017-09-13 15:27 . 2017-10-11 13:41 1460736 ----a-w- c:\windows\system32\lsasrv.dll
2017-09-13 15:27 . 2017-10-11 13:41 1163264 ----a-w- c:\windows\system32\kernel32.dll
2017-09-13 15:27 . 2017-10-11 13:41 419840 ----a-w- c:\windows\system32\KernelBase.dll
2017-09-13 15:27 . 2017-10-11 13:41 44032 ----a-w- c:\windows\system32\csrsrv.dll
2017-09-13 15:27 . 2017-10-11 13:41 43520 ----a-w- c:\windows\system32\cryptbase.dll
2017-09-13 15:27 . 2017-10-11 13:41 22016 ----a-w- c:\windows\system32\credssp.dll
2017-09-13 15:27 . 2017-10-11 13:41 463872 ----a-w- c:\windows\system32\certcli.dll
2017-09-13 15:27 . 2017-10-11 13:41 880640 ----a-w- c:\windows\system32\advapi32.dll
2017-09-13 15:27 . 2017-10-11 13:41 123904 ----a-w- c:\windows\system32\bcrypt.dll
2017-09-13 15:27 . 2017-10-11 13:41 59904 ----a-w- c:\windows\system32\appidapi.dll
2017-09-13 15:27 . 2017-10-11 13:41 34816 ----a-w- c:\windows\system32\appidsvc.dll
2017-09-13 15:27 . 2017-10-11 13:41 4608 ---ha-w- c:\windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2017-09-13 15:27 . 2017-10-11 13:41 4096 ---ha-w- c:\windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2017-09-13 15:27 . 2017-10-11 13:41 4096 ---ha-w- c:\windows\system32\api-ms-win-core-synch-l1-1-0.dll
2017-09-13 15:27 . 2017-10-11 13:41 3072 ---ha-w- c:\windows\system32\api-ms-win-core-util-l1-1-0.dll
2017-09-13 15:27 . 2017-10-11 13:41 6656 ----a-w- c:\windows\system32\apisetschema.dll
2017-09-13 15:27 . 2017-10-11 13:41 6144 ---ha-w- c:\windows\system32\api-ms-win-security-base-l1-1-0.dll
2017-09-13 15:27 . 2017-10-11 13:41 5120 ---ha-w- c:\windows\system32\api-ms-win-core-file-l1-1-0.dll
2017-09-13 15:27 . 2017-10-11 13:41 4608 ---ha-w- c:\windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2017-09-13 15:27 . 2017-10-11 13:41 4096 ---ha-w- c:\windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2017-09-13 15:27 . 2017-10-11 13:41 4096 ---ha-w- c:\windows\system32\api-ms-win-core-localization-l1-1-0.dll
2017-09-13 15:27 . 2017-10-11 13:41 3584 ---ha-w- c:\windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2017-09-13 15:27 . 2017-10-11 13:41 3584 ---ha-w- c:\windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2017-09-13 15:27 . 2017-10-11 13:41 3584 ---ha-w- c:\windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2017-09-13 15:27 . 2017-10-11 13:41 3584 ---ha-w- c:\windows\system32\api-ms-win-core-misc-l1-1-0.dll
2017-09-13 15:27 . 2017-10-11 13:41 3584 ---ha-w- c:\windows\system32\api-ms-win-core-memory-l1-1-0.dll
2017-09-13 15:27 . 2017-10-11 13:41 3584 ---ha-w- c:\windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2017-09-13 15:27 . 2017-10-11 13:41 3584 ---ha-w- c:\windows\system32\api-ms-win-core-heap-l1-1-0.dll
2017-09-13 15:27 . 2017-10-11 13:41 3072 ---ha-w- c:\windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2017-09-13 15:27 . 2017-10-11 13:41 3072 ---ha-w- c:\windows\system32\api-ms-win-core-string-l1-1-0.dll
2017-09-13 15:27 . 2017-10-11 13:41 3072 ---ha-w- c:\windows\system32\api-ms-win-core-profile-l1-1-0.dll
2017-09-13 15:27 . 2017-10-11 13:41 3072 ---ha-w- c:\windows\system32\api-ms-win-core-io-l1-1-0.dll
2017-09-13 15:27 . 2017-10-11 13:41 3072 ---ha-w- c:\windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2017-09-13 15:27 . 2017-10-11 13:41 3072 ---ha-w- c:\windows\system32\api-ms-win-core-handle-l1-1-0.dll
2017-09-13 15:27 . 2017-10-11 13:41 3072 ---ha-w- c:\windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2017-09-13 15:27 . 2017-10-11 13:41 3072 ---ha-w- c:\windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2017-09-13 15:27 . 2017-10-11 13:41 3072 ---ha-w- c:\windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2017-09-13 15:27 . 2017-10-11 13:41 3072 ---ha-w- c:\windows\system32\api-ms-win-core-debug-l1-1-0.dll
2017-09-13 15:27 . 2017-10-11 13:41 3072 ---ha-w- c:\windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2017-09-13 15:27 . 2017-10-11 13:41 3072 ---ha-w- c:\windows\system32\api-ms-win-core-console-l1-1-0.dll
2017-09-13 15:27 . 2017-10-11 13:41 690688 ----a-w- c:\windows\system32\adtschema.dll
2017-09-13 15:13 . 2017-10-11 13:41 4001512 ----a-w- c:\windows\SysWow64\ntkrnlpa.exe
2017-09-13 15:13 . 2017-10-11 13:41 3945704 ----a-w- c:\windows\SysWow64\ntoskrnl.exe
2017-09-13 15:10 . 2017-10-11 13:41 1314112 ----a-w- c:\windows\SysWow64\ntdll.dll
2017-09-13 15:09 . 2017-10-11 13:41 666112 ----a-w- c:\windows\SysWow64\rpcrt4.dll
2017-09-13 15:09 . 2017-10-11 13:41 96768 ----a-w- c:\windows\SysWow64\sspicli.dll
2017-09-13 15:09 . 2017-10-11 13:41 275456 ----a-w- c:\windows\SysWow64\KernelBase.dll
2017-09-13 15:09 . 2017-10-11 13:41 5120 ----a-w- c:\windows\SysWow64\wow32.dll
2017-09-13 15:09 . 2017-10-11 13:41 392704 ----a-w- c:\windows\SysWow64\wlansec.dll
.
.
(((((((((((((((((((((((((((((((((( SpouŇ°tńõc√≠ body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Pozn√°mka* pr√°zdn√© z√°znamy a legitimn√≠ v√Ĺchoz√≠ √ļdaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
"EnableLinkedConnections"= 1 (0x1)
.
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoSimpleNetIDList"= 1 (0x1)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
R1 ESProtectionDriver;Malwarebytes Anti-Exploit;c:\windows\system32\drivers\mbae64.sys;c:\windows\SYSNATIVE\drivers\mbae64.sys [x]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R3 dtlitescsibus;DAEMON Tools Lite Virtual SCSI Bus;c:\windows\system32\DRIVERS\dtlitescsibus.sys;c:\windows\SYSNATIVE\DRIVERS\dtlitescsibus.sys [x]
R3 dtliteusbbus;DAEMON Tools Lite Virtual USB Bus;c:\windows\system32\DRIVERS\dtliteusbbus.sys;c:\windows\SYSNATIVE\DRIVERS\dtliteusbbus.sys [x]
R3 etdrv;etdrv;c:\windows\etdrv.sys;c:\windows\etdrv.sys [x]
R3 GVTDrv64;GVTDrv64;c:\windows\GVTDrv64.sys;c:\windows\GVTDrv64.sys [x]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x]
R3 lvpepf64;Volume Adapter;c:\windows\system32\DRIVERS\lv302a64.sys;c:\windows\SYSNATIVE\DRIVERS\lv302a64.sys [x]
R3 LVRS64;Logitech RightSound Filter Driver;c:\windows\system32\DRIVERS\lvrs64.sys;c:\windows\SYSNATIVE\DRIVERS\lvrs64.sys [x]
R3 LVUSBS64;Logitech USB Monitor Filter;c:\windows\system32\drivers\LVUSBS64.sys;c:\windows\SYSNATIVE\drivers\LVUSBS64.sys [x]
R3 MBAMFarflt;MBAMFarflt;c:\windows\system32\DRIVERS\farflt.sys;c:\windows\SYSNATIVE\DRIVERS\farflt.sys [x]
R3 MBAMProtection;MBAMProtection;c:\windows\system32\DRIVERS\mbam.sys;c:\windows\SYSNATIVE\DRIVERS\mbam.sys [x]
R3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\System32\Drivers\mbamswissarmy.sys;c:\windows\SYSNATIVE\Drivers\mbamswissarmy.sys [x]
R3 MBAMWebProtection;MBAMWebProtection;c:\windows\system32\DRIVERS\mwac.sys;c:\windows\SYSNATIVE\DRIVERS\mwac.sys [x]
R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys;c:\windows\SYSNATIVE\DRIVERS\NisDrvWFP.sys [x]
R3 NisSrv;Kontrola s√≠tńõ Microsoft;c:\program files\Microsoft Security Client\NisSrv.exe;c:\program files\Microsoft Security Client\NisSrv.exe [x]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys;c:\windows\SYSNATIVE\drivers\rdpvideominiport.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 WatAdminSvc;SluŇĺba Technologie aktivace Windows;c:\windows\system32\Wat\WatAdminSvc.exe;c:\windows\SYSNATIVE\Wat\WatAdminSvc.exe [x]
S0 amdide64;amdide64;c:\windows\system32\DRIVERS\amdide64.sys;c:\windows\SYSNATIVE\DRIVERS\amdide64.sys [x]
S1 HWiNFO32;HWiNFO32/64 Kernel Driver;c:\windows\SysWOW64\drivers\HWiNFO64A.SYS;c:\windows\SysWOW64\drivers\HWiNFO64A.SYS [x]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe;c:\windows\SYSNATIVE\atiesrxx.exe [x]
S2 DiagTrack;Diagnostics Tracking Service;c:\windows\System32\svchost.exe;c:\windows\SYSNATIVE\svchost.exe [x]
S2 ei2c;ei2c;c:\windows\system32\drivers\ei2c.sys;c:\windows\SYSNATIVE\drivers\ei2c.sys [x]
S2 mi2c;mi2c;c:\windows\system32\drivers\mi2c.sys;c:\windows\SYSNATIVE\drivers\mi2c.sys [x]
S2 WsAppService;Wondershare Application Framework Service;c:\program files (x86)\Wondershare\WAF\2.4.3.225\WsAppService.exe;c:\program files (x86)\Wondershare\WAF\2.4.3.225\WsAppService.exe [x]
S3 amdiox64;AMD IO Driver;c:\windows\system32\DRIVERS\amdiox64.sys;c:\windows\SYSNATIVE\DRIVERS\amdiox64.sys [x]
S3 KYEKBPRO;IMPERATOR PRO Gaming Keyboard;c:\windows\system32\drivers\KYEKBPRO.sys;c:\windows\SYSNATIVE\drivers\KYEKBPRO.sys [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x]
.
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost]
LocalServiceAndNoImpersonation REG_MULTI_SZ SSDPSRV upnphost SCardSvr QWAVE wcncsvc
LocalDriverService REG_MULTI_SZ LDrvSvc
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2017-11-16 18381792]
"msseces"="c:\program files\Microsoft Security Client\msseces.exe" [2015-04-29 1337000]
.
------- DoplŇąkov√Ĺ sken -------
.
uLocal Page = c:\windows\system32\blank.htm
IE: S10 Autologin
IE: S10 Autotype...
TCP: Interfaces\{9317833D-D4B3-4B9C-8B06-9B224515606B}: NameServer = 94.74.192.252,8.8.8.8
.
- - - - NEPLATN√Č POLOŇĹKY ODSTRANńöN√Č Z REGISTRU - - - -
.
ShellIconOverlayIdentifiers-{056D528D-CE28-4194-9BA3-BA2E9197FF8C} - (no file)
ShellIconOverlayIdentifiers-{05B38830-F4E9-4329-978B-1DD28605D202} - (no file)
ShellIconOverlayIdentifiers-{0596C850-7BDD-4C9D-AFDF-873BE6890637} - (no file)
SafeBoot-MBAMService
ShellIconOverlayIdentifiers-{056D528D-CE28-4194-9BA3-BA2E9197FF8C} - (no file)
ShellIconOverlayIdentifiers-{05B38830-F4E9-4329-978B-1DD28605D202} - (no file)
ShellIconOverlayIdentifiers-{0596C850-7BDD-4C9D-AFDF-873BE6890637} - (no file)
AddRemove-PunkBusterSvc - c:\windows\system32\pbsvc.exe
.
.
.
--------------------- ZAMKNUT√Č KL√ćńĆE V REGISTRU ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_20_0_0_228_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_20_0_0_228_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}]
@Denied: (A 2) (Everyone)
@="IFlashBroker6"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
------------------------ Jin√© spuŇ°ten√© procesy ------------------------
.
c:\program files (x86)\Google\Update\GoogleUpdate.exe
.
**************************************************************************
.
Celkov√Ĺ ńćas: 2017-12-02 20:21:37 - pońć√≠tańć byl restartov√°n
ComboFix-quarantined-files.txt 2017-12-02 19:21
ComboFix2.txt 2017-11-29 00:15
.
PŇôed spuŇ°tńõn√≠m: Voln√Ĺch bajtŇĮ: 642¬†612¬†158¬†464
Po spuŇ°tńõn√≠: Voln√Ĺch bajtŇĮ: 641¬†086¬†513¬†152
.
- - End Of File - - 30E79056A92531F311275255223CE888
A36C5E4F47E84449FF07ED3517B43A31


aswMBR version 1.0.1.2290 Copyright(c) 2014 AVAST Software
Run date: 2017-12-02 20:22:13
-----------------------------
20:22:13.830 OS Version: Windows x64 6.1.7601 Service Pack 1
20:22:13.830 Number of processors: 4 586 0x503
20:22:13.830 ComputerName: PETR-PC UserName: Petr
20:22:15.468 Initialize success
20:22:15.515 VM: initialized successfully
20:22:15.515 VM: Amd CPU BiosDisabled
20:23:27.153 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP1T0L0-1
20:23:27.153 Disk 0 Vendor: WDC_WD10EZEX-00BN5A0 01.01A01 Size: 953869MB BusType: 3
20:23:27.309 Disk 0 MBR read successfully
20:23:27.309 Disk 0 MBR scan
20:23:27.309 Disk 0 Windows 7 default MBR code
20:23:27.309 Disk 0 Partition 1 80 (A) 07 HPFS/NTFS NTFS 100 MB offset 2048
20:23:27.309 Disk 0 Boot: NTFS code=2
20:23:27.324 Disk 0 Partition 2 00 07 HPFS/NTFS NTFS 953767 MB offset 208848
20:23:27.324 Disk 0 scanning C:\Windows\system32\drivers
20:23:34.859 Service scanning
20:23:45.795 Modules scanning
20:23:45.795 Disk 0 trace - called modules:
20:23:46.309 ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys ataport.SYS amdide64.sys PCIIDEX.SYS hal.dll atapi.sys
20:23:46.309 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa8004dd9060]
20:23:46.309 3 CLASSPNP.SYS[fffff8800120143f] -> nt!IofCallDriver -> [0xfffffa8004b4e520]
20:23:46.309 5 ACPI.sys[fffff88000e947a1] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP1T0L0-1[0xfffffa8004b40680]
20:23:46.309 Disk 0 statistics 93034/0/0 @ 10,75 MB/s
20:23:46.325 Scan finished successfully
20:23:53.251 Disk 0 MBR has been saved successfully to "C:\Users\Petr\Desktop\MBR.dat"
20:23:53.283 The log file has been saved successfully to "C:\Users\Petr\Desktop\aswMBR.txt"

UŇĺivatelsk√Ĺ avatar
jaro3
ńćlen Security t√Ĺmu
Guru Level 15
Guru Level 15
PŇô√≠spńõvky: 38711
Registrov√°n: ńćerven 07
BydliŇ°tńõ: JiŇĺn√≠ ńĆechy
Pohlav√≠: MuŇĺ

Re: Prosim o kontrolu

PŇô√≠spńõvekod jaro3 » 03 pro 2017 09:58

S pŇô√≠kazov√Ĺm Ňô√°dkem nakl√°dat opatrnńõ..

Vypni rez. ochranu u antiviru a antispywaru,pŇô√≠p. firewall..

OtevŇôi si Pozn√°mkov√Ĺ blok (Start -> Spustit... a napiŇ° do okna Notepad a dej Ok.
Zkop√≠ruj do nńõj n√°sleduj√≠c√≠ cel√Ĺ text oznańćen√Ĺ zelenńõ:

K√≥d: Vybrat vŇ°e

ClearJavaCache::
KillAll::
Folder::
c:\program files (x86)\Google\Update

RegLock::
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_20_0_0_228_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_20_0_0_228_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}]
@Denied: (A 2) (Everyone)
@="IFlashBroker6"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"


Zvol moŇĺnost Soubor -> UloŇĺit jako... a nastav tyto parametry:
N√°zev souboru: zde napiŇ°: CFScript.txt
UloŇĺit jako typ: tak tam vyber VŇ°echny soubory
UloŇĺ soubor na plochu.
Ukonńći vŇ°echna aktivn√≠ okna.

Uchop myŇ°√≠ vytvoŇôen√Ĺ skript CFScript.txt, pŇôem√≠sti ho nad staŇĺen√Ĺ program ComboFix.exe a kdyŇĺ se oba soubory pŇôekryj√≠, skript upusŇ•.
- Automaticky se spustí ComboFix
- VloŇĺ sem log, kter√Ĺ vybńõhne v z√°vńõru ńćist√≠c√≠ho procesu + nov√Ĺ log z HJT

Upozornńõn√≠ : MŇĮŇĺe se st√°t, Ňĺe po aplikaci Combofixu a restartu pońć√≠tańće, Windows nenabńõhnou , nebo nenajede plocha , budou probl√©my s pŇôipojen√≠m, pak znovu restartuj pońć√≠tańć, pokud to nepomŇĮŇĺe , po restartu mańćkej kl√°vesu F8 a pak zvol posledn√≠ zn√°mou funkńćn√≠ konfiguraci. , ńći pouŇĺij bod obnovy.

Jaké jsou nyní problémy?
Zadal sis téma do sekce BSOD?
PŇôi pr√°ci s programy HJT, ComboFix,MbAM, SDFix aj. zavŇôete vŇ°echny ostatn√≠ aplikace a prohl√≠Ňĺeńće!
Nepos√≠lejte logy do soukrom√Ĺch zpr√°v.Po dobu m√© nepŇô√≠tomnosti mńõ zastupuje memphisto , ŇĹbeky a Orcus.
Pokud budete spokojeni , mŇĮŇĺete podpoŇôit naŇ°e forum:Podpora f√≥ra

securit4k
Level 1
Level 1
PŇô√≠spńõvky: 70
Registrov√°n: prosinec 12
Pohlav√≠: MuŇĺ

Re: Prosim o kontrolu

PŇô√≠spńõvekod securit4k » 03 pro 2017 12:41

Smrt tentokrat neprisla, mam problem jeste se samovolnym vypinanim pc (po tomto combofixu nevim, ale dost mozne ze furt), proste atvrdo jak kdybys to vythl ze zasuvky, myslel jsme ze se t odeje jen pri online filmach, vcera uz to dela i s normalnim filmem na plose po delsi dobe, u online trva rychleji, a pri hrani taky se to uz deje, jeto divne nechapu proc pc jsem vysal, deska,zdroje a procestor jsou stare kurvy, asi uz je treba vymena



ComboFix 17-11-14.01 - Petr 03.12.2017 12:27:42.2.4 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1250.420.1029.18.4094.2798 [GMT 1:00]
SpuŇ°tńõn√Ĺ z: c:\users\Petr\Desktop\ComboFix.exe
PouŇĺit√© ovl√°dac√≠ pŇôep√≠nańće :: c:\users\Petr\Desktop\CFScript.txt
AV: Microsoft Security Essentials *Disabled/Updated* {B7ECF8CD-0188-6703-DBA4-AA65C6ACFB0A}
SP: Microsoft Security Essentials *Disabled/Updated* {0C8D1929-27B2-688D-E114-9117BD2BB1B7}
.
.
((((((((((((((((((((((((((((((((((((((( Ostatn√≠ v√Ĺmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\program files (x86)\Google\Update
c:\program files (x86)\Google\Update\1.3.33.7\GoogleCrashHandler.exe
c:\program files (x86)\Google\Update\1.3.33.7\GoogleCrashHandler64.exe
c:\program files (x86)\Google\Update\1.3.33.7\GoogleUpdate.exe
c:\program files (x86)\Google\Update\1.3.33.7\GoogleUpdateBroker.exe
c:\program files (x86)\Google\Update\1.3.33.7\GoogleUpdateComRegisterShell64.exe
c:\program files (x86)\Google\Update\1.3.33.7\GoogleUpdateCore.exe
c:\program files (x86)\Google\Update\1.3.33.7\GoogleUpdateHelper.msi
c:\program files (x86)\Google\Update\1.3.33.7\GoogleUpdateOnDemand.exe
c:\program files (x86)\Google\Update\1.3.33.7\GoogleUpdateSetup.exe
c:\program files (x86)\Google\Update\1.3.33.7\GoogleUpdateWebPlugin.exe
c:\program files (x86)\Google\Update\1.3.33.7\goopdate.dll
c:\program files (x86)\Google\Update\1.3.33.7\goopdateres_am.dll
c:\program files (x86)\Google\Update\1.3.33.7\goopdateres_ar.dll
c:\program files (x86)\Google\Update\1.3.33.7\goopdateres_bg.dll
c:\program files (x86)\Google\Update\1.3.33.7\goopdateres_bn.dll
c:\program files (x86)\Google\Update\1.3.33.7\goopdateres_ca.dll
c:\program files (x86)\Google\Update\1.3.33.7\goopdateres_cs.dll
c:\program files (x86)\Google\Update\1.3.33.7\goopdateres_da.dll
c:\program files (x86)\Google\Update\1.3.33.7\goopdateres_de.dll
c:\program files (x86)\Google\Update\1.3.33.7\goopdateres_el.dll
c:\program files (x86)\Google\Update\1.3.33.7\goopdateres_en-GB.dll
c:\program files (x86)\Google\Update\1.3.33.7\goopdateres_en.dll
c:\program files (x86)\Google\Update\1.3.33.7\goopdateres_es-419.dll
c:\program files (x86)\Google\Update\1.3.33.7\goopdateres_es.dll
c:\program files (x86)\Google\Update\1.3.33.7\goopdateres_et.dll
c:\program files (x86)\Google\Update\1.3.33.7\goopdateres_fa.dll
c:\program files (x86)\Google\Update\1.3.33.7\goopdateres_fi.dll
c:\program files (x86)\Google\Update\1.3.33.7\goopdateres_fil.dll
c:\program files (x86)\Google\Update\1.3.33.7\goopdateres_fr.dll
c:\program files (x86)\Google\Update\1.3.33.7\goopdateres_gu.dll
c:\program files (x86)\Google\Update\1.3.33.7\goopdateres_hi.dll
c:\program files (x86)\Google\Update\1.3.33.7\goopdateres_hr.dll
c:\program files (x86)\Google\Update\1.3.33.7\goopdateres_hu.dll
c:\program files (x86)\Google\Update\1.3.33.7\goopdateres_id.dll
c:\program files (x86)\Google\Update\1.3.33.7\goopdateres_is.dll
c:\program files (x86)\Google\Update\1.3.33.7\goopdateres_it.dll
c:\program files (x86)\Google\Update\1.3.33.7\goopdateres_iw.dll
c:\program files (x86)\Google\Update\1.3.33.7\goopdateres_ja.dll
c:\program files (x86)\Google\Update\1.3.33.7\goopdateres_kn.dll
c:\program files (x86)\Google\Update\1.3.33.7\goopdateres_ko.dll
c:\program files (x86)\Google\Update\1.3.33.7\goopdateres_lt.dll
c:\program files (x86)\Google\Update\1.3.33.7\goopdateres_lv.dll
c:\program files (x86)\Google\Update\1.3.33.7\goopdateres_ml.dll
c:\program files (x86)\Google\Update\1.3.33.7\goopdateres_mr.dll
c:\program files (x86)\Google\Update\1.3.33.7\goopdateres_ms.dll
c:\program files (x86)\Google\Update\1.3.33.7\goopdateres_nl.dll
c:\program files (x86)\Google\Update\1.3.33.7\goopdateres_no.dll
c:\program files (x86)\Google\Update\1.3.33.7\goopdateres_pl.dll
c:\program files (x86)\Google\Update\1.3.33.7\goopdateres_pt-BR.dll
c:\program files (x86)\Google\Update\1.3.33.7\goopdateres_pt-PT.dll
c:\program files (x86)\Google\Update\1.3.33.7\goopdateres_ro.dll
c:\program files (x86)\Google\Update\1.3.33.7\goopdateres_ru.dll
c:\program files (x86)\Google\Update\1.3.33.7\goopdateres_sk.dll
c:\program files (x86)\Google\Update\1.3.33.7\goopdateres_sl.dll
c:\program files (x86)\Google\Update\1.3.33.7\goopdateres_sr.dll
c:\program files (x86)\Google\Update\1.3.33.7\goopdateres_sv.dll
c:\program files (x86)\Google\Update\1.3.33.7\goopdateres_sw.dll
c:\program files (x86)\Google\Update\1.3.33.7\goopdateres_ta.dll
c:\program files (x86)\Google\Update\1.3.33.7\goopdateres_te.dll
c:\program files (x86)\Google\Update\1.3.33.7\goopdateres_th.dll
c:\program files (x86)\Google\Update\1.3.33.7\goopdateres_tr.dll
c:\program files (x86)\Google\Update\1.3.33.7\goopdateres_uk.dll
c:\program files (x86)\Google\Update\1.3.33.7\goopdateres_ur.dll
c:\program files (x86)\Google\Update\1.3.33.7\goopdateres_vi.dll
c:\program files (x86)\Google\Update\1.3.33.7\goopdateres_zh-CN.dll
c:\program files (x86)\Google\Update\1.3.33.7\goopdateres_zh-TW.dll
c:\program files (x86)\Google\Update\1.3.33.7\npGoogleUpdate3.dll
c:\program files (x86)\Google\Update\1.3.33.7\psmachine.dll
c:\program files (x86)\Google\Update\1.3.33.7\psmachine_64.dll
c:\program files (x86)\Google\Update\1.3.33.7\psuser.dll
c:\program files (x86)\Google\Update\1.3.33.7\psuser_64.dll
c:\program files (x86)\Google\Update\Download\{430FD4D0-B729-4F61-AA34-91526481799D}\1.3.33.7\GoogleUpdateSetup.exe
c:\program files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\62.0.3202.94\62.0.3202.94_chrome_installer.exe
c:\program files (x86)\Google\Update\GoogleUpdate.exe
.
.
((((((((((((((((((((((((((((((((((((((( Ovladańće/SluŇĺby )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Service_gupdate
-------\Service_gupdatem
-------\Service_gupdate
-------\Service_gupdatem
.
.
((((((((((((((((((((((((( Soubory vytvoŇôen√© od 2017-11-03 do 2017-12-03 )))))))))))))))))))))))))))))))
.
.
2017-12-03 11:33 . 2017-12-03 11:33 -------- d-----w- c:\users\Public\AppData\Local\temp
2017-12-03 11:33 . 2017-12-03 11:33 -------- d-----w- c:\users\Petr\AppData\Local\temp
2017-12-03 11:33 . 2017-12-03 11:33 -------- d-----w- c:\users\Default\AppData\Local\temp
2017-12-02 23:05 . 2017-12-02 23:05 75888 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{B6FC7823-863B-45B1-89A5-228CB8D689CD}\offreg.896.dll
2017-12-02 22:40 . 2017-12-02 22:45 -------- d-----w- c:\users\Petr\AppData\Local\AMD
2017-12-02 22:37 . 2017-12-02 22:37 -------- d-----w- c:\program files (x86)\AMD
2017-12-02 22:36 . 2017-12-02 22:36 -------- d-----w- c:\program files\Common Files\ATI Technologies
2017-12-02 22:34 . 2017-09-13 23:20 798008 ----a-w- c:\windows\SysWow64\vulkan-1.dll
2017-12-02 22:34 . 2017-09-13 23:20 490296 ----a-w- c:\windows\SysWow64\vulkaninfo.exe
2017-12-02 22:34 . 2017-09-13 23:19 927544 ----a-w- c:\windows\system32\vulkan-1.dll
2017-12-02 22:34 . 2017-09-13 23:19 591160 ----a-w- c:\windows\system32\vulkaninfo.exe
2017-12-02 22:34 . 2017-12-02 22:34 -------- d-----w- c:\program files (x86)\VulkanRT
2017-12-02 22:21 . 2017-10-30 09:27 13771264 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{B6FC7823-863B-45B1-89A5-228CB8D689CD}\mpengine.dll
2017-12-02 19:41 . 2017-12-02 22:15 -------- d-----w- c:\program files (x86)\SpeedFan
2017-12-02 19:22 . 2017-10-30 09:27 13771264 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2017-12-02 19:17 . 2017-12-02 19:17 20250624 ----a-w- c:\windows\SysWow64\FlashPlayerInstaller.exe
2017-12-02 17:50 . 2017-12-02 17:50 5200384 ----a-w- c:\users\Petr\AppData\Roaming\Microsoft\Windows\Start Menu\Programy\VITSOFT\Vit Registry Fix\aswmbr.exe
2017-12-02 17:50 . 2017-12-02 17:50 5200384 ----a-w- c:\users\Petr\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VITSOFT\Vit Registry Fix\aswmbr.exe
2017-12-02 17:50 . 2017-12-02 17:50 8187336 ----a-w- c:\users\Petr\AppData\Roaming\Microsoft\Windows\Start Menu\Programy\VITSOFT\Vit Registry Fix\adwcleaner_7.0.5.0.exe
2017-12-02 17:50 . 2017-12-02 17:50 8187336 ----a-w- c:\users\Petr\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VITSOFT\Vit Registry Fix\adwcleaner_7.0.5.0.exe
2017-11-28 23:48 . 2017-11-29 21:52 -------- d-----w- c:\program files (x86)\Zemana AntiMalware
2017-11-28 23:46 . 2017-11-28 23:46 -------- d-----w- c:\users\Petr\AppData\Local\Zemana
2017-11-28 23:44 . 2017-11-28 23:44 -------- d-----w- c:\users\Petr\AppData\Local\Data aplikac√Ě
2017-11-28 23:44 . 2017-11-28 23:45 -------- d-----w- C:\zoek
2017-11-28 01:05 . 2017-11-28 01:05 15951808 ----a-w- c:\windows\system32\atidxx64.dll
2017-11-28 01:05 . 2017-11-28 01:05 13145552 ----a-w- c:\windows\SysWow64\atidxx32.dll
2017-11-28 01:05 . 2017-11-28 01:05 1931920 ----a-w- c:\windows\system32\aticfx64.dll
2017-11-28 01:05 . 2017-11-28 01:05 1541080 ----a-w- c:\windows\SysWow64\aticfx32.dll
2017-11-28 01:05 . 2017-11-28 01:05 9936 ----a-w- c:\windows\SysWow64\detoured.dll
2017-11-28 01:05 . 2017-11-28 01:05 9936 ----a-w- c:\windows\system32\detoured.dll
2017-11-28 01:05 . 2017-11-28 01:05 195888 ----a-w- c:\windows\system32\atiuxp64.dll
2017-11-28 01:05 . 2017-11-28 01:05 161344 ----a-w- c:\windows\SysWow64\atiuxpag.dll
2017-11-28 01:03 . 2017-11-28 01:03 12084104 ----a-w- c:\windows\system32\amdmantle64.dll
2017-11-28 01:02 . 2017-11-28 01:02 436616 ----a-w- c:\windows\system32\amdgfxinfo64.dll
2017-11-28 01:01 . 2017-11-28 01:01 35220872 ----a-w- c:\windows\system32\atio6axx.dll
2017-11-26 21:02 . 2017-11-26 21:27 -------- d-----w- c:\programdata\RogueKiller
2017-11-26 20:59 . 2017-11-26 20:59 -------- d-----w- c:\programdata\Sophos
2017-11-26 20:58 . 2017-11-26 20:58 -------- d-----w- c:\program files (x86)\Sophos
2017-11-26 08:45 . 2017-11-29 21:49 -------- d-----w- c:\program files (x86)\7-Zip
2017-11-25 22:42 . 2017-11-29 21:34 -------- d-----w- c:\program files (x86)\Secunia
2017-11-25 21:01 . 2017-11-25 21:01 -------- d-----w- c:\programdata\Kaspersky Lab Setup Files
2017-11-18 09:38 . 2017-09-29 09:10 1057976 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{127DE711-7649-4B6C-ADEF-99EF32A3805C}\gapaengine.dll
2017-11-16 19:48 . 2017-11-16 19:48 -------- d-----w- c:\program files\Malwarebytes
2017-11-16 19:24 . 2017-11-16 19:24 -------- d-----w- c:\users\Petr\AppData\Local\RadeonInstaller
2017-11-16 19:18 . 2017-11-16 19:40 122848 ----a-w- c:\windows\system32\RtNicProp64.dll
2017-11-16 19:18 . 2017-11-16 19:40 1074792 ----a-w- c:\windows\system32\drivers\Rt64win7.sys
2017-11-16 19:16 . 2017-11-16 19:16 3677160 ----a-w- c:\windows\system32\RTSnMg64.cpl
2017-11-15 10:13 . 2017-10-18 02:34 134376 ----a-w- c:\windows\system32\CompatTelRunner.exe
2017-11-15 10:13 . 2017-10-18 02:30 605184 ----a-w- c:\windows\system32\aeinv.dll
2017-11-15 10:13 . 2017-10-15 22:04 407392 ----a-w- c:\windows\system32\centel.dll
2017-11-15 10:13 . 2017-10-04 13:04 670208 ----a-w- c:\windows\system32\generaltel.dll
2017-11-15 10:13 . 2017-10-04 13:04 603648 ----a-w- c:\windows\system32\devinv.dll
2017-11-15 10:13 . 2017-10-04 13:04 370688 ----a-w- c:\windows\system32\invagent.dll
2017-11-15 10:13 . 2017-10-04 13:04 241664 ----a-w- c:\windows\system32\aepic.dll
2017-11-15 10:13 . 2017-10-04 13:04 2023936 ----a-w- c:\windows\system32\aitstatic.exe
2017-11-15 10:13 . 2017-10-04 13:04 181760 ----a-w- c:\windows\system32\acmigration.dll
2017-11-15 10:13 . 2017-10-04 13:04 1570304 ----a-w- c:\windows\system32\appraiser.dll
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M v√Ĺpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2017-12-03 11:33 . 2016-08-19 15:31 65536 ----a-w- c:\windows\system32\spu_storage.bin
2017-12-02 22:30 . 2015-08-27 12:42 803328 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2017-12-02 22:30 . 2015-08-27 12:42 144896 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2017-11-20 20:32 . 2015-08-27 12:57 545440 ----a-w- c:\windows\system32\MpSigStub.exe
2017-11-16 19:40 . 2015-08-27 12:18 118816 ----a-w- c:\windows\system32\RTNUninst64.dll
2017-11-16 19:13 . 2017-10-12 13:08 127017032 -c--a-w- c:\windows\system32\MRT-KB890830.exe
2017-11-16 19:13 . 2015-08-30 11:53 127017032 -c--a-w- c:\windows\system32\MRT.exe
2017-09-29 09:10 . 2015-08-30 12:20 1057976 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\NISBackup\gapaengine.dll
2017-09-13 23:20 . 2017-09-13 23:20 798008 ----a-w- c:\windows\SysWow64\vulkan-1-1-0-61-0.dll
2017-09-13 23:20 . 2017-09-13 23:20 490296 ----a-w- c:\windows\SysWow64\vulkaninfo-1-1-0-61-0.exe
2017-09-13 23:19 . 2017-09-13 23:19 927544 ----a-w- c:\windows\system32\vulkan-1-1-0-61-0.dll
2017-09-13 23:19 . 2017-09-13 23:19 591160 ----a-w- c:\windows\system32\vulkaninfo-1-1-0-61-0.exe
2017-09-13 15:33 . 2017-10-11 13:41 631176 ----a-w- c:\windows\system32\winresume.efi
2017-09-13 15:32 . 2017-10-11 13:41 706792 ----a-w- c:\windows\system32\winload.efi
2017-09-13 15:32 . 2017-10-11 13:41 5547752 ----a-w- c:\windows\system32\ntoskrnl.exe
2017-09-13 15:32 . 2017-10-11 13:41 95464 ----a-w- c:\windows\system32\drivers\ksecdd.sys
2017-09-13 15:32 . 2017-10-11 13:41 154856 ----a-w- c:\windows\system32\drivers\ksecpkg.sys
2017-09-13 15:31 . 2017-10-11 13:41 1732864 ----a-w- c:\windows\system32\ntdll.dll
2017-09-13 15:28 . 2017-10-11 13:41 448512 ----a-w- c:\windows\system32\wlansec.dll
2017-09-13 15:28 . 2017-10-11 13:41 414208 ----a-w- c:\windows\system32\wlanmsm.dll
2017-09-13 15:28 . 2017-10-11 13:41 886272 ----a-w- c:\windows\system32\wlansvc.dll
2017-09-13 15:28 . 2017-10-11 13:41 118784 ----a-w- c:\windows\system32\wlanhlp.dll
2017-09-13 15:28 . 2017-10-11 13:41 113664 ----a-w- c:\windows\system32\wlanapi.dll
2017-09-13 15:28 . 2017-10-11 13:41 362496 ----a-w- c:\windows\system32\wow64win.dll
2017-09-13 15:28 . 2017-10-11 13:41 215552 ----a-w- c:\windows\system32\winsrv.dll
2017-09-13 15:28 . 2017-10-11 13:41 243712 ----a-w- c:\windows\system32\wow64.dll
2017-09-13 15:28 . 2017-10-11 13:41 13312 ----a-w- c:\windows\system32\wow64cpu.dll
2017-09-13 15:28 . 2017-10-11 13:41 86528 ----a-w- c:\windows\system32\TSpkg.dll
2017-09-13 15:28 . 2017-10-11 13:41 210432 ----a-w- c:\windows\system32\wdigest.dll
2017-09-13 15:28 . 2017-10-11 13:41 503808 ----a-w- c:\windows\system32\srcore.dll
2017-09-13 15:28 . 2017-10-11 13:41 135680 ----a-w- c:\windows\system32\sspicli.dll
2017-09-13 15:28 . 2017-10-11 13:41 50176 ----a-w- c:\windows\system32\srclient.dll
2017-09-13 15:28 . 2017-10-11 13:41 28672 ----a-w- c:\windows\system32\sspisrv.dll
2017-09-13 15:28 . 2017-10-11 13:41 63488 ----a-w- c:\windows\system32\setbcdlocale.dll
2017-09-13 15:28 . 2017-10-11 13:41 1212928 ----a-w- c:\windows\system32\rpcrt4.dll
2017-09-13 15:28 . 2017-10-11 13:41 345600 ----a-w- c:\windows\system32\schannel.dll
2017-09-13 15:28 . 2017-10-11 13:41 190464 ----a-w- c:\windows\system32\rpchttp.dll
2017-09-13 15:28 . 2017-10-11 13:41 28160 ----a-w- c:\windows\system32\secur32.dll
2017-09-13 15:28 . 2017-10-11 13:41 16384 ----a-w- c:\windows\system32\ntvdm64.dll
2017-09-13 15:28 . 2017-10-11 13:41 312320 ----a-w- c:\windows\system32\ncrypt.dll
2017-09-13 15:28 . 2017-10-11 13:41 1068544 ----a-w- c:\windows\system32\msctf.dll
2017-09-13 15:28 . 2017-10-11 13:41 316928 ----a-w- c:\windows\system32\msv1_0.dll
2017-09-13 15:28 . 2017-10-11 13:41 60416 ----a-w- c:\windows\system32\msobjs.dll
2017-09-13 15:28 . 2017-10-11 13:41 146432 ----a-w- c:\windows\system32\msaudite.dll
2017-09-13 15:27 . 2017-10-11 13:41 731648 ----a-w- c:\windows\system32\kerberos.dll
2017-09-13 15:27 . 2017-10-11 13:41 1460736 ----a-w- c:\windows\system32\lsasrv.dll
2017-09-13 15:27 . 2017-10-11 13:41 1163264 ----a-w- c:\windows\system32\kernel32.dll
2017-09-13 15:27 . 2017-10-11 13:41 419840 ----a-w- c:\windows\system32\KernelBase.dll
2017-09-13 15:27 . 2017-10-11 13:41 44032 ----a-w- c:\windows\system32\csrsrv.dll
2017-09-13 15:27 . 2017-10-11 13:41 43520 ----a-w- c:\windows\system32\cryptbase.dll
2017-09-13 15:27 . 2017-10-11 13:41 22016 ----a-w- c:\windows\system32\credssp.dll
2017-09-13 15:27 . 2017-10-11 13:41 463872 ----a-w- c:\windows\system32\certcli.dll
2017-09-13 15:27 . 2017-10-11 13:41 880640 ----a-w- c:\windows\system32\advapi32.dll
2017-09-13 15:27 . 2017-10-11 13:41 123904 ----a-w- c:\windows\system32\bcrypt.dll
2017-09-13 15:27 . 2017-10-11 13:41 59904 ----a-w- c:\windows\system32\appidapi.dll
2017-09-13 15:27 . 2017-10-11 13:41 34816 ----a-w- c:\windows\system32\appidsvc.dll
2017-09-13 15:27 . 2017-10-11 13:41 4608 ---ha-w- c:\windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2017-09-13 15:27 . 2017-10-11 13:41 4096 ---ha-w- c:\windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2017-09-13 15:27 . 2017-10-11 13:41 4096 ---ha-w- c:\windows\system32\api-ms-win-core-synch-l1-1-0.dll
2017-09-13 15:27 . 2017-10-11 13:41 3072 ---ha-w- c:\windows\system32\api-ms-win-core-util-l1-1-0.dll
2017-09-13 15:27 . 2017-10-11 13:41 6656 ----a-w- c:\windows\system32\apisetschema.dll
2017-09-13 15:27 . 2017-10-11 13:41 6144 ---ha-w- c:\windows\system32\api-ms-win-security-base-l1-1-0.dll
2017-09-13 15:27 . 2017-10-11 13:41 5120 ---ha-w- c:\windows\system32\api-ms-win-core-file-l1-1-0.dll
2017-09-13 15:27 . 2017-10-11 13:41 4608 ---ha-w- c:\windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2017-09-13 15:27 . 2017-10-11 13:41 4096 ---ha-w- c:\windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2017-09-13 15:27 . 2017-10-11 13:41 4096 ---ha-w- c:\windows\system32\api-ms-win-core-localization-l1-1-0.dll
2017-09-13 15:27 . 2017-10-11 13:41 3584 ---ha-w- c:\windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2017-09-13 15:27 . 2017-10-11 13:41 3584 ---ha-w- c:\windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2017-09-13 15:27 . 2017-10-11 13:41 3584 ---ha-w- c:\windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2017-09-13 15:27 . 2017-10-11 13:41 3584 ---ha-w- c:\windows\system32\api-ms-win-core-misc-l1-1-0.dll
2017-09-13 15:27 . 2017-10-11 13:41 3584 ---ha-w- c:\windows\system32\api-ms-win-core-memory-l1-1-0.dll
2017-09-13 15:27 . 2017-10-11 13:41 3584 ---ha-w- c:\windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2017-09-13 15:27 . 2017-10-11 13:41 3584 ---ha-w- c:\windows\system32\api-ms-win-core-heap-l1-1-0.dll
2017-09-13 15:27 . 2017-10-11 13:41 3072 ---ha-w- c:\windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2017-09-13 15:27 . 2017-10-11 13:41 3072 ---ha-w- c:\windows\system32\api-ms-win-core-string-l1-1-0.dll
2017-09-13 15:27 . 2017-10-11 13:41 3072 ---ha-w- c:\windows\system32\api-ms-win-core-profile-l1-1-0.dll
2017-09-13 15:27 . 2017-10-11 13:41 3072 ---ha-w- c:\windows\system32\api-ms-win-core-io-l1-1-0.dll
2017-09-13 15:27 . 2017-10-11 13:41 3072 ---ha-w- c:\windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2017-09-13 15:27 . 2017-10-11 13:41 3072 ---ha-w- c:\windows\system32\api-ms-win-core-handle-l1-1-0.dll
2017-09-13 15:27 . 2017-10-11 13:41 3072 ---ha-w- c:\windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2017-09-13 15:27 . 2017-10-11 13:41 3072 ---ha-w- c:\windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2017-09-13 15:27 . 2017-10-11 13:41 3072 ---ha-w- c:\windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2017-09-13 15:27 . 2017-10-11 13:41 3072 ---ha-w- c:\windows\system32\api-ms-win-core-debug-l1-1-0.dll
2017-09-13 15:27 . 2017-10-11 13:41 3072 ---ha-w- c:\windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2017-09-13 15:27 . 2017-10-11 13:41 3072 ---ha-w- c:\windows\system32\api-ms-win-core-console-l1-1-0.dll
2017-09-13 15:27 . 2017-10-11 13:41 690688 ----a-w- c:\windows\system32\adtschema.dll
2017-09-13 15:13 . 2017-10-11 13:41 4001512 ----a-w- c:\windows\SysWow64\ntkrnlpa.exe
2017-09-13 15:13 . 2017-10-11 13:41 3945704 ----a-w- c:\windows\SysWow64\ntoskrnl.exe
2017-09-13 15:10 . 2017-10-11 13:41 1314112 ----a-w- c:\windows\SysWow64\ntdll.dll
2017-09-13 15:09 . 2017-10-11 13:41 666112 ----a-w- c:\windows\SysWow64\rpcrt4.dll
2017-09-13 15:09 . 2017-10-11 13:41 96768 ----a-w- c:\windows\SysWow64\sspicli.dll
2017-09-13 15:09 . 2017-10-11 13:41 275456 ----a-w- c:\windows\SysWow64\KernelBase.dll
2017-09-13 15:09 . 2017-10-11 13:41 5120 ----a-w- c:\windows\SysWow64\wow32.dll
2017-09-13 15:09 . 2017-10-11 13:41 392704 ----a-w- c:\windows\SysWow64\wlansec.dll
2017-09-13 15:09 . 2017-10-11 13:41 83968 ----a-w- c:\windows\SysWow64\wlanhlp.dll
2017-09-13 15:09 . 2017-10-11 13:41 80896 ----a-w- c:\windows\SysWow64\wlanapi.dll
2017-09-13 15:09 . 2017-10-11 13:41 428032 ----a-w- c:\windows\SysWow64\wlanmsm.dll
2017-09-13 15:09 . 2017-10-11 13:41 172032 ----a-w- c:\windows\SysWow64\wdigest.dll
2017-09-13 15:09 . 2017-10-11 13:41 82944 ----a-w- c:\windows\SysWow64\bcrypt.dll
2017-09-13 15:09 . 2017-10-11 13:41 65536 ----a-w- c:\windows\SysWow64\TSpkg.dll
.
.
(((((((((((((((((((((((((((((((((( SpouŇ°tńõc√≠ body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Pozn√°mka* pr√°zdn√© z√°znamy a legitimn√≠ v√Ĺchoz√≠ √ļdaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
"EnableLinkedConnections"= 1 (0x1)
.
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoSimpleNetIDList"= 1 (0x1)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
R1 ESProtectionDriver;Malwarebytes Anti-Exploit;c:\windows\system32\drivers\mbae64.sys;c:\windows\SYSNATIVE\drivers\mbae64.sys [x]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R3 dtlitescsibus;DAEMON Tools Lite Virtual SCSI Bus;c:\windows\system32\DRIVERS\dtlitescsibus.sys;c:\windows\SYSNATIVE\DRIVERS\dtlitescsibus.sys [x]
R3 dtliteusbbus;DAEMON Tools Lite Virtual USB Bus;c:\windows\system32\DRIVERS\dtliteusbbus.sys;c:\windows\SYSNATIVE\DRIVERS\dtliteusbbus.sys [x]
R3 etdrv;etdrv;c:\windows\etdrv.sys;c:\windows\etdrv.sys [x]
R3 GVTDrv64;GVTDrv64;c:\windows\GVTDrv64.sys;c:\windows\GVTDrv64.sys [x]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x]
R3 lvpepf64;Volume Adapter;c:\windows\system32\DRIVERS\lv302a64.sys;c:\windows\SYSNATIVE\DRIVERS\lv302a64.sys [x]
R3 LVRS64;Logitech RightSound Filter Driver;c:\windows\system32\DRIVERS\lvrs64.sys;c:\windows\SYSNATIVE\DRIVERS\lvrs64.sys [x]
R3 LVUSBS64;Logitech USB Monitor Filter;c:\windows\system32\drivers\LVUSBS64.sys;c:\windows\SYSNATIVE\drivers\LVUSBS64.sys [x]
R3 MBAMFarflt;MBAMFarflt;c:\windows\system32\DRIVERS\farflt.sys;c:\windows\SYSNATIVE\DRIVERS\farflt.sys [x]
R3 MBAMProtection;MBAMProtection;c:\windows\system32\DRIVERS\mbam.sys;c:\windows\SYSNATIVE\DRIVERS\mbam.sys [x]
R3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\System32\Drivers\mbamswissarmy.sys;c:\windows\SYSNATIVE\Drivers\mbamswissarmy.sys [x]
R3 MBAMWebProtection;MBAMWebProtection;c:\windows\system32\DRIVERS\mwac.sys;c:\windows\SYSNATIVE\DRIVERS\mwac.sys [x]
R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys;c:\windows\SYSNATIVE\DRIVERS\NisDrvWFP.sys [x]
R3 NisSrv;Kontrola s√≠tńõ Microsoft;c:\program files\Microsoft Security Client\NisSrv.exe;c:\program files\Microsoft Security Client\NisSrv.exe [x]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys;c:\windows\SYSNATIVE\drivers\rdpvideominiport.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 WatAdminSvc;SluŇĺba Technologie aktivace Windows;c:\windows\system32\Wat\WatAdminSvc.exe;c:\windows\SYSNATIVE\Wat\WatAdminSvc.exe [x]
S0 amdide64;amdide64;c:\windows\system32\DRIVERS\amdide64.sys;c:\windows\SYSNATIVE\DRIVERS\amdide64.sys [x]
S1 HWiNFO32;HWiNFO32/64 Kernel Driver;c:\windows\SysWOW64\drivers\HWiNFO64A.SYS;c:\windows\SysWOW64\drivers\HWiNFO64A.SYS [x]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe;c:\windows\SYSNATIVE\atiesrxx.exe [x]
S2 DiagTrack;Diagnostics Tracking Service;c:\windows\System32\svchost.exe;c:\windows\SYSNATIVE\svchost.exe [x]
S2 ei2c;ei2c;c:\windows\system32\drivers\ei2c.sys;c:\windows\SYSNATIVE\drivers\ei2c.sys [x]
S2 mi2c;mi2c;c:\windows\system32\drivers\mi2c.sys;c:\windows\SYSNATIVE\drivers\mi2c.sys [x]
S2 WsAppService;Wondershare Application Framework Service;c:\program files (x86)\Wondershare\WAF\2.4.3.225\WsAppService.exe;c:\program files (x86)\Wondershare\WAF\2.4.3.225\WsAppService.exe [x]
S3 amdiox64;AMD IO Driver;c:\windows\system32\DRIVERS\amdiox64.sys;c:\windows\SYSNATIVE\DRIVERS\amdiox64.sys [x]
S3 KYEKBPRO;IMPERATOR PRO Gaming Keyboard;c:\windows\system32\drivers\KYEKBPRO.sys;c:\windows\SYSNATIVE\drivers\KYEKBPRO.sys [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x]
.
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost]
LocalServiceAndNoImpersonation REG_MULTI_SZ SSDPSRV upnphost SCardSvr QWAVE wcncsvc
LocalDriverService REG_MULTI_SZ LDrvSvc
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2017-11-16 18381792]
.
------- DoplŇąkov√Ĺ sken -------
.
uLocal Page = c:\windows\system32\blank.htm
IE: S10 Autologin
IE: S10 Autotype...
TCP: Interfaces\{9317833D-D4B3-4B9C-8B06-9B224515606B}: NameServer = 94.74.192.252,8.8.8.8
.
- - - - NEPLATN√Č POLOŇĹKY ODSTRANńöN√Č Z REGISTRU - - - -
.
ShellIconOverlayIdentifiers-{056D528D-CE28-4194-9BA3-BA2E9197FF8C} - (no file)
ShellIconOverlayIdentifiers-{05B38830-F4E9-4329-978B-1DD28605D202} - (no file)
ShellIconOverlayIdentifiers-{0596C850-7BDD-4C9D-AFDF-873BE6890637} - (no file)
AddRemove-PunkBusterSvc - c:\windows\system32\pbsvc.exe
.
.
.
--------------------- ZAMKNUT√Č KL√ćńĆE V REGISTRU ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_20_0_0_228_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_20_0_0_228_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}]
@Denied: (A 2) (Everyone)
@="IFlashBroker6"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
Celkov√Ĺ ńćas: 2017-12-03 12:38:37 - pońć√≠tańć byl restartov√°n
ComboFix-quarantined-files.txt 2017-12-03 11:38
ComboFix2.txt 2017-12-02 19:21
ComboFix3.txt 2017-11-29 00:15
.
PŇôed spuŇ°tńõn√≠m: Voln√Ĺch bajtŇĮ: 640¬†768¬†794¬†624
Po spuŇ°tńõn√≠: Voln√Ĺch bajtŇĮ: 640¬†466¬†440¬†192
.
- - End Of File - - 9975E9266132E4ED59E49C5201EB25DC
A36C5E4F47E84449FF07ED3517B43A31


Zpńõt na ‚ÄúHiJackThis‚ÄĚ

Kdo je online

UŇĺivatel√© prohl√≠Ňĺej√≠c√≠ si toto f√≥rum: CommonCrawl [Bot] a 5 hostŇĮ