prosím o preventivní kontrolu logu Vyřešeno

[Medievl]

Logfile of Trend Micro HijackThis v2.0.5
Scan saved at 23:21:23, on 20.03.2025
Platform: Unknown Windows (WinNT 6.02.1008)
MSIE: Internet Explorer v11.0 (11.00.26100.1882)


Boot mode: Normal

Running processes:
C:\Program Files (x86)\Samsung\Samsung Magician\SamsungMagician.exe
C:\Program Files (x86)\Samsung\Samsung Magician\SamsungMagician.exe
C:\Program Files (x86)\Samsung\Samsung Magician\SamsungMagician.exe
C:\Program Files (x86)\Samsung\Samsung Magician\SamsungMagician.exe
C:\Program Files (x86)\ControlCenter4\BrCtrlCntr.exe
C:\Program Files (x86)\ControlCenter4\BrCcUxSys.exe
C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe
C:\WINDOWS\SysWOW64\DllHost.exe
C:\Users\czroc\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/p/?LinkId=255141
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/p/?LinkId=255141
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/p/?LinkId=255141
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = %11%\blank.htm
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F2 - REG:system.ini: UserInit=
O2 - BHO: IEToEdge BHO - {1FD49718-1D00-4B19-AF5F-070AF6D5D54C} - C:\Program Files (x86)\Microsoft\Edge\Application\134.0.3124.72\BHO\ie_to_edge_bho.dll
O4 - HKLM\..\Run: [ControlCenter4] C:\Program Files (x86)\ControlCenter4\BrCcBoot.exe /autorun
O4 - HKLM\..\Run: [BrStsMon00] C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe /AUTORUN
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
O4 - HKCU\..\Run: [OneDrive] "C:\Users\czroc\AppData\Local\Microsoft\OneDrive\OneDrive.exe" /background
O4 - HKCU\..\Run: [CCleaner Smart Cleaning] "C:\Program Files\CCleaner\CCleaner64.exe" /MONITOR
O4 - HKCU\..\Run: [Steam] "C:\Program Files (x86)\Steam\steam.exe" -silent
O4 - HKCU\..\Run: [Gaijin.Net Updater] "C:\Users\czroc\AppData\Local\Gaijin\Program Files (x86)\NetAgent\gjagent.exe"
O4 - HKCU\..\Run: [Overwolf] "C:\Program Files (x86)\Overwolf\OverwolfLauncher.exe" -overwolfsilent
O4 - HKCU\..\Run: [RiotClient] C:\Riot Games\Riot Client\RiotClientServices.exe --launch-background-mode
O4 - HKCU\..\Run: [EpicGamesLauncher] "C:\Program Files (x86)\Epic Games\Launcher\Portal\Binaries\Win64\EpicGamesLauncher.exe" -silent -launchcontext=boot
O4 - HKCU\..\Run: [Opera Browser Assistant] C:\Users\czroc\AppData\Local\Programs\Opera\assistant\browser_assistant.exe
O4 - HKCU\..\Run: [Opera Stable] C:\Users\czroc\AppData\Local\Programs\Opera\opera.exe
O4 - HKCU\..\Run: [AMDNoiseSuppression] "C:\WINDOWS\system32\AMD\ANR\AMDNoiseSuppression.exe"
O4 - HKCU\..\Run: [EADM] "C:\Program Files\Electronic Arts\EA Desktop\EA Desktop\EALauncher.exe" -minimized
O4 - HKCU\..\Run: [MicrosoftEdgeAutoLaunch_9F3256D84EC3FD4A6542CCF768C6F0CF] "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
O4 - HKUS\S-1-5-19\..\Run: [OneDriveSetup] C:\Windows\System32\OneDriveSetup.exe /thfirstsetup (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [OneDriveSetup] C:\Windows\System32\OneDriveSetup.exe /thfirstsetup (User 'NETWORK SERVICE')
O10 - Unknown file in Winsock LSP: c:\windows\system32\nlansp_c.dll
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O17 - HKLM\System\CCS\Services\Tcpip\..\{34cb6e87-43a7-4a4f-b450-cf54549bee51}: NameServer = 8.8.8.8,8.8.4.4
O18 - Protocol: tbauth - {14654CA6-5711-491D-B89A-58E571679951} - C:\Windows\SysWOW64\tbauth.dll
O18 - Protocol: windows.tbauth - {14654CA6-5711-491D-B89A-58E571679951} - C:\Windows\SysWOW64\tbauth.dll
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\WINDOWS\System32\alg.exe (file missing)
O23 - Service: AMD Crash Defender Service - Advanced Micro Devices, Inc. - C:\WINDOWS\System32\DriverStore\FileRepository\amdfendr.inf_amd64_987f8cede005f427\amdfendrsr.exe
O23 - Service: AMD External Events Utility - AMD - C:\WINDOWS\System32\DriverStore\FileRepository\u0404579.inf_amd64_89599f81cb58902d\B404520\atiesrxx.exe
O23 - Service: AntiCheatExpert Protection - ANTICHEATEXPERT.COM - C:\Program Files\AntiCheatExpert\ACE-Service64.exe
O23 - Service: AntiCheatExpert Service - ANTICHEATEXPERT.COM - C:\Program Files\AntiCheatExpert\SGuard\x64\SGuardSvc64.exe
O23 - Service: Battle.net Update Helper Svc (battlenet_helpersvc) - Blizzard Entertainment - C:\ProgramData\Battle.net_components\battlenet_helpersvc\AgentHelper.exe
O23 - Service: BattlEye Service (BEService) - Unknown owner - C:\Program Files (x86)\Common Files\BattlEye\BEService.exe
O23 - Service: BrYNSvc - Brother Industries, Ltd. - C:\Program Files (x86)\Browny02\BrYNSvc.exe
O23 - Service: CCleaner Performance Optimizer Service (CCleanerPerformanceOptimizerService) - Gen Digital Inc. - C:\Program Files\CCleaner\CCleanerPerformanceOptimizerService.exe
O23 - Service: CMigrationService - Clonix & CottonCandy - C:\Program Files (x86)\Samsung\Samsung Magician\MigrationService\MigrationService.exe
O23 - Service: @%SystemRoot%\system32\CredentialEnrollmentManager.exe,-100 (CredentialEnrollmentManagerUserSvc) - Unknown owner - C:\WINDOWS\system32\CredentialEnrollmentManager.exe (file missing)
O23 - Service: CredentialEnrollmentManagerUserSvc_5f2a5 - Unknown owner - C:\WINDOWS\system32\CredentialEnrollmentManager.exe (file missing)
O23 - Service: EAAntiCheatService - Electronic Arts - C:\Program Files\EA\AC\eaanticheat.gameservice.exe
O23 - Service: EasyAntiCheat - Epic Games, Inc - C:\Program Files (x86)\EasyAntiCheat\EasyAntiCheat.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\WINDOWS\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\WINDOWS\system32\fxssvc.exe (file missing)
O23 - Service: @%systemroot%\system32\GameInputSvc.exe,-101 (GameInputSvc) - Unknown owner - C:\WINDOWS\System32\GameInputSvc.exe (file missing)
O23 - Service: Google Chrome Elevation Service (GoogleChromeElevationService) (GoogleChromeElevationService) - Google LLC - C:\Program Files\Google\Chrome\Application\134.0.6998.118\elevation_service.exe
O23 - Service: Intern aktualiza n slu ba Google (GoogleUpdaterInternalService135.0.7023.0) (GoogleUpdaterInternalService135.0.7023.0) - Google LLC - C:\Program Files (x86)\Google\GoogleUpdater\135.0.7023.0\updater.exe
O23 - Service: Aktualiza n slu ba Google (GoogleUpdaterService135.0.7023.0) (GoogleUpdaterService135.0.7023.0) - Google LLC - C:\Program Files (x86)\Google\GoogleUpdater\135.0.7023.0\updater.exe
O23 - Service: Slu ba Aktualizace Google (gupdate) (gupdate) - Google LLC - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Slu ba Aktualizace Google (gupdatem) (gupdatem) - Google LLC - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\WINDOWS\system32\lsass.exe (file missing)
O23 - Service: LibreOffice Maintenance Service (LibreOfficeMaintenance) - The Document Foundation - C:\Program Files\LibreOffice\program\update_service.exe
O23 - Service: @%SystemRoot%\System32\localkdcsvc.dll,-1 (LocalKdc) - Unknown owner - C:\WINDOWS\System32\lsass.exe (file missing)
O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\WINDOWS\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\WINDOWS\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\PerceptionSimulation\PerceptionSimulationService.exe,-101 (perceptionsimulation) - Unknown owner - C:\WINDOWS\system32\PerceptionSimulation\PerceptionSimulationService.exe (file missing)
O23 - Service: @%SystemRoot%\System32\ReFsDedupSvc.exe,-100 (refsdedupsvc) - Unknown owner - C:\WINDOWS\System32\ReFsDedupSvc.exe (file missing)
O23 - Service: Rockstar Game Library Service (Rockstar Service) - Rockstar Games - C:\Program Files\Rockstar Games\Launcher\RockstarService.exe
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\WINDOWS\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\WINDOWS\system32\lsass.exe (file missing)
O23 - Service: SamsungMagicianSVC - Samsung Electronics Co., Ltd. - C:\Program Files (x86)\Samsung\Samsung Magician\SamsungMagicianSVC.exe
O23 - Service: @%systemroot%\system32\SecurityHealthAgent.dll,-1002 (SecurityHealthService) - Unknown owner - C:\WINDOWS\system32\SecurityHealthService.exe (file missing)
O23 - Service: @%ProgramFiles%\Windows Defender Advanced Threat Protection\MsSense.exe,-1001 (Sense) - Unknown owner - C:\Program Files (x86)\Windows Defender Advanced Threat Protection\MsSense.exe (file missing)
O23 - Service: @%SystemRoot%\system32\SensorDataService.exe,-101 (SensorDataService) - Unknown owner - C:\WINDOWS\System32\SensorDataService.exe (file missing)
O23 - Service: @firewallapi.dll,-50323 (SNMPTrap) - Unknown owner - C:\WINDOWS\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\WINDOWS\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\WINDOWS\system32\sppsvc.exe (file missing)
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files (x86)\Common Files\Steam\steamservice.exe
O23 - Service: @%SystemRoot%\system32\TieringEngineService.exe,-702 (TieringEngineService) - Unknown owner - C:\WINDOWS\system32\TieringEngineService.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\WINDOWS\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\WINDOWS\System32\vds.exe (file missing)
O23 - Service: vgc - Riot Games, Inc. - C:\Program Files\Riot Vanguard\vgc.exe
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\WINDOWS\system32\vssvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\WINDOWS\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\WINDOWS\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--
End of file - 11571 bytes

[Reklama]

[jaro3]

Stáhni si ATF Cleaner
https://www.majorgeeks.com/mg/getmirror ... ner,2.html
Poklepej na ATF Cleaner.exe, klikni na select all, poté:
-Když používáš Firefox (Mozzila), klikni na Firefox nahoře a vyber: Select All, poté klikni na Empty Selected.
-Když používáš Operu, klikni nahoře na Operu a vyber: Select All, poté klikni na Empty Selected. Poté klikni na Main (hlavní stránku ) a klikni na Empty Selected.
Po vyčištění klikni na Exit k zavření programu.
ATF-Cleaner je jednoduchý nástroj na odstranění historie z webového prohlížeče. Program dokáže odstranit cache, cookies, historii a další stopy po surfování na Internetu. Mezi podporované prohlížeče patří Internet Explorer, Firefox a Opera. Aplikace navíc umí odstranit dočasné soubory Windows, vysypat koš atd.
- Pokud používáš jen Google Chrome ,Edge , tak ATF nemusíš použít.


Stáhni si TFC
http://www.geekstogo.com/forum/files/fi ... -oldtimer/
https://www.bleepingcomputer.com/download/tfc/
https://www.majorgeeks.com/files/detail ... eaner.html
https://www.majorgeeks.com/mg/get/temp_ ... ner,1.html

Otevři soubor a zavři všechny ostatní okna, Klikni na Start k zahájení procesu. Program by neměl trvat dlouho.
Poté by se měl PC restartovat, pokud ne , proveď sám.

Stáhni AdwCleaner (by Xplode)
http://www.bleepingcomputer.com/download/adwcleaner/
http://www.adlice.com/downloadprogress/
pro majitele win7 stáhni zde:
https://filehippo.com/download_adwcleaner/ ( nedávej aktualizaci!)

Ulož si ho na svojí plochu . Klikni na „Souhlasím“ k povrzení podmínek.
Ukonči všechny programy , okna a prohlížeče
Spusť program poklepáním a klikni na „Skenování“
Po skenu se objeví log , který se otevře. ( jinak je uložen systémovem disku jako) C:\AdwCleaner\Logs, jeho obsah sem celý vlož.

Stáhni si Malwarebytes' Anti-Malware
https://www.malwarebytes.com/mwb-download/thankyou/

na plochu , nainstaluj a spusť ho
-Pokud není program aktuální , klikni na možnost „Aktualizovat nyní“ či „Opravit nyní“.
- bude nalezena aktualizace a nainstaluje se.
- poté klikni na Spustit skenování
- po proběhnutí skenu se ti objeví hláška vpravo dole, tak klikni na Zobrazit zprávu a vyber Export a vyber Kopírovat do schránky a vlož sem celý log. Nebo klikni na „Textový soubor ( .txt)“ a log si ulož. A vlož sem.
-jinak se log nachází v programu po kliknutí na „Zprávy“ , nebo je uložen zde: C:\ProgramData\Malwarebytes\Malwarebytes Anti-Malware\Logs

- po té klikni na tlačítko Dokončit, a program zavři křížkem vpravo nahoře.
(zatím nic nemaž!).
Pokud budou problémy , spusť v nouz. režimu.
(Po skončení scanu klikni na vidličku save result a vyber export to TXT. Po chvilce se objeví okno a uložíš si log v txt kam chceš. Pak ho zkopíruj a vlož sem).

Další zítra. tedy vlastně už dnes odpoledne.

[Medievl]

u atf i přes spuštění přes správce mám možnosti firefox i opera zašedlé jinak ok

[Medievl]

# -------------------------------
# Malwarebytes AdwCleaner 8.5.0.595
# -------------------------------
# Build: 03-05-2025
# Database: 2024-10-23.4 (Local)
# Support: https://www.malwarebytes.com/support
#
# -------------------------------
# Mode: Scan
# -------------------------------
# Start: 03-22-2025
# Duration: 00:00:10
# OS: Windows 11 (Build 26100.3476)
# Scanned: 32108
# Detected: 14


***** [ Services ] *****

No malicious services found.

***** [ Folders ] *****

PUP.Optional.Legacy C:\Users\czroc\AppData\Roaming\Tencent

***** [ Files ] *****

PUP.Optional.Reimage C:\Windows\Reimage.ini

***** [ DLL ] *****

No malicious DLLs found.

***** [ WMI ] *****

No malicious WMI found.

***** [ Shortcuts ] *****

No malicious shortcuts found.

***** [ Tasks ] *****

No malicious tasks found.

***** [ Registry ] *****

PUP.Optional.Legacy HKLM\SOFTWARE\Classes\AppID\REI_AxControl.DLL
PUP.Optional.Legacy HKLM\Software\Classes\AppID\{28FF42B8-A0DA-4BE5-9B81-E26DD59B350A}
PUP.Optional.Legacy HKLM\Software\Classes\Interface\{9BB31AD8-5DB2-459E-A901-DEA536F23BA4}
PUP.Optional.Legacy HKLM\Software\Classes\Interface\{BD51A48E-EB5F-4454-8774-EF962DF64546}
PUP.Optional.Legacy HKLM\Software\Classes\TypeLib\{FA6468D2-FAA4-4951-A53B-2A5CF9CC0A36}
PUP.Optional.Legacy HKLM\Software\Wow6432Node\\Classes\AppID\REI_AxControl.DLL
PUP.Optional.Legacy HKLM\Software\Wow6432Node\\Classes\AppID\{28FF42B8-A0DA-4BE5-9B81-E26DD59B350A}
PUP.Optional.Legacy HKLM\Software\Wow6432Node\\Classes\Interface\{9BB31AD8-5DB2-459E-A901-DEA536F23BA4}
PUP.Optional.Legacy HKLM\Software\Wow6432Node\\Classes\Interface\{BD51A48E-EB5F-4454-8774-EF962DF64546}
PUP.Optional.Legacy HKLM\Software\Wow6432Node\\Classes\TypeLib\{FA6468D2-FAA4-4951-A53B-2A5CF9CC0A36}
PUP.Optional.Reimage HKCU\Software\Reimage
PUP.Optional.Reimage HKLM\Software\Reimage

***** [ Chromium (and derivatives) ] *****

No malicious Chromium entries found.

***** [ Chromium URLs ] *****

No malicious Chromium URLs found.

***** [ Firefox (and derivatives) ] *****

No malicious Firefox entries found.

***** [ Firefox URLs ] *****

No malicious Firefox URLs found.

***** [ Hosts File Entries ] *****

No malicious hosts file entries found.

***** [ Preinstalled Software ] *****

No Preinstalled Software found.



########## EOF - C:\AdwCleaner\Logs\AdwCleaner[S00].txt ##########

[Medievl]

Malwarebytes
http://www.malwarebytes.com

-Log Details-
Scan Date: 22.03.2025
Scan Time: 12:44
Log File: f68f9fc4-0712-11f0-8501-d8bbc1cc9a07.json

-Software Information-
Version: 5.2.8.173
Components Version: 128.0.5184
Update Package Version: 1.0.97415
License: Trial

-System Information-
OS: Windows 11 (Build 26100.3476)
CPU: x64
File System: NTFS
User: DESKTOP-08TVO88\Pavel

-Scan Summary-
Scan Type: Threat Scan
Scan Initiated By: Manual
Result: Completed
Objects Scanned: 268937
Threats Detected: 13
Threats Quarantined: 0
Time Elapsed: 5 min, 23 sec

-Scan Options-
Memory: Enabled
Startup: Enabled
File system: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Detect
PUM: Detect

-Scan Details-
Process: 0
(No malicious items detected)

Module: 0
(No malicious items detected)

Registry Key: 10
PUP.Optional.Reimage, HKLM\SOFTWARE\WOW6432NODE\CLASSES\APPID\REI_AxControl.DLL, No Action By User, 2888, 327193, 1.0.97415, , ame, , ,
PUP.Optional.Reimage, HKLM\SOFTWARE\CLASSES\APPID\REI_AxControl.DLL, No Action By User, 2888, 327193, 1.0.97415, , ame, , ,
PUP.Optional.Reimage, HKLM\SOFTWARE\CLASSES\WOW6432NODE\APPID\REI_AxControl.DLL, No Action By User, 2888, 327193, 1.0.97415, , ame, , ,
PUP.Optional.Reimage, HKU\S-1-5-21-3748560031-2723970751-817939281-1001\SOFTWARE\Reimage, No Action By User, 2888, 357494, 1.0.97415, , ame, , ,
PUP.Optional.Reimage, HKU\S-1-5-21-3748560031-2723970751-817939281-1001\SOFTWARE\REIMAGE\PC REPAIR, No Action By User, 2888, 327204, 1.0.97415, , ame, , ,
PUP.Optional.Reimage, HKLM\SOFTWARE\REIMAGE\Reimage Repair, No Action By User, 2888, 336077, 1.0.97415, , ame, , ,
PUP.Optional.Reimage, HKU\S-1-5-21-3748560031-2723970751-817939281-1001\SOFTWARE\LOCAL APPWIZARD-GENERATED APPLICATIONS\Fixer - Windows Problem Relief., No Action By User, 2888, 709541, 1.0.97415, , ame, , ,
PUP.Optional.Reimage, HKLM\SOFTWARE\WOW6432NODE\CLASSES\APPID\{28FF42B8-A0DA-4BE5-9B81-E26DD59B350A}, No Action By User, 2888, 332494, 1.0.97415, , ame, , ,
PUP.Optional.Reimage, HKLM\SOFTWARE\CLASSES\APPID\{28FF42B8-A0DA-4BE5-9B81-E26DD59B350A}, No Action By User, 2888, 332494, 1.0.97415, , ame, , ,
PUP.Optional.Reimage, HKLM\SOFTWARE\CLASSES\WOW6432NODE\APPID\{28FF42B8-A0DA-4BE5-9B81-E26DD59B350A}, No Action By User, 2888, 332494, 1.0.97415, , ame, , ,

Registry Value: 1
PUP.Optional.Reimage, HKU\S-1-5-21-3748560031-2723970751-817939281-1001\SOFTWARE\REIMAGE\PC REPAIR|QUITMESSAGE, No Action By User, 2888, 327204, 1.0.97415, , ame, , ,

Registry Data: 0
(No malicious items detected)

Data Stream: 0
(No malicious items detected)

Folder: 0
(No malicious items detected)

File: 2
PUP.Optional.Reimage, C:\WINDOWS\REIMAGE.INI, No Action By User, 2888, 412667, 1.0.97415, , ame, , 2957D5BBC613C848F0F6CA7AA5C242C6, 15BE062E3C07D16DFE85A04F10EE43EEEA8F1531F6850310CFC3B40784FC7D0D
Generic.Malware/Suspicious, C:\PROGRAM FILES (X86)\ROCKSTAR GAMES\GTA SAN ANDREAS\HLM-INTRO.EXE, No Action By User, 0, 392686, 1.0.97415, , shuriken, , 6B1114186B8F261EA6759673B0A3E604, 71BE3455199987166D45759C33F88051D87288BE518D2FE14A48EE2EC00E1552

Physical Sector: 0
(No malicious items detected)

WMI: 0
(No malicious items detected)


(end)

[jaro3]

Spusť znovu AdwCleaner (u Windows Vista či Windows7, klikni na AdwCleaner pravým a vyber „Spustit jako správce“
klikni na „Skenování“ , po prohledání klikni na „ do karantény“

Program provede opravu, po automatickém restartu klikni na Zobrazit logovací soubor“ a pak poklepej na odpovídají log, (C:\AdwCleaner [C?].txt) , jeho obsah sem celý vlož.

Stáhni si Junkware Removal Tool by Thisisu
http://www.bleepingcomputer.com/downloa ... oval-tool/
https://downloads.malwarebytes.com/file/JRT-EOL
na svojí plochu.

Deaktivuj si svůj antivirový program. Pravým tl. myši klikni na JRT.exe a vyber „spustit jako správce“. Pro pokračování budeš vyzván ke stisknutí jakékoliv klávesy. Na nějakou klikni.
Začne skenování programu. Skenování může trvat dlouho , podle množství nákaz. Po ukončení skenu se objeví log (JRT.txt) , který se uloží na ploše.
Zkopíruj sem prosím celý jeho obsah.



. spusť znovu Malwarebytes' Anti-Malware a dej Skenovat nyní
- po proběhnutí programu se ti objeví hláška tak klikni na „Vše do karantény(smazat vybrané)“ a na „Exportovat záznam“ a vyber „textový soubor“ , soubor nějak pojmenuj a někam ho ulož. Zkopíruj se celý obsah toho logu.



Stáhni si RogueKiller by Adlice Software
http://www.adlice.com/download/roguekiller/
http://www.bleepingcomputer.com/download/roguekiller/
tutorial:
https://www.adlice.com/docs/roguekiller ... /tutorial/
na svojí plochu.
- Zavři všechny ostatní programy a prohlížeče.
- - klikni na „Scan“. V novém okně nic neměň a klikni dole na „Start“ ve sloupci „Quick Scan“
- Program skenuje procesy PC. Po proskenování klikni na „Results “ , v dalším okně pak levým t. na „Report“ a vyber : „Text File“ , log nazvi třeba RK a ulož do dokumentů nebo na plochu. Otevři soubor a celý obsah logu sem zkopíruj.
Pokud je program blokován , zkus ho spustit několikrát. Pokud dále program nepůjde spustit a pracovat, přejmenuj ho na winlogon.exe.
-pokud bude mít log více než 60.000 znaků , rozděl ho a vlož do více příspěvků
Pokud nepůjde uložit log, vyfoť si nákazy z obrazovky a vlož sem.

[Medievl]

# -------------------------------
# Malwarebytes AdwCleaner 8.5.0.595
# -------------------------------
# Build: 03-05-2025
# Database: 2024-10-23.4 (Local)
# Support: https://www.malwarebytes.com/support
#
# -------------------------------
# Mode: Clean
# -------------------------------
# Start: 03-22-2025
# Duration: 00:00:01
# OS: Windows 11 (Build 26100.3476)
# Cleaned: 14
# Failed: 0


***** [ Services ] *****

No malicious services cleaned.

***** [ Folders ] *****

Deleted C:\Users\czroc\AppData\Roaming\Tencent

***** [ Files ] *****

Deleted C:\Windows\Reimage.ini

***** [ DLL ] *****

No malicious DLLs cleaned.

***** [ WMI ] *****

No malicious WMI cleaned.

***** [ Shortcuts ] *****

No malicious shortcuts cleaned.

***** [ Tasks ] *****

No malicious tasks cleaned.

***** [ Registry ] *****

Deleted HKCU\Software\Reimage
Deleted HKLM\SOFTWARE\Classes\AppID\REI_AxControl.DLL
Deleted HKLM\Software\Classes\AppID\{28FF42B8-A0DA-4BE5-9B81-E26DD59B350A}
Deleted HKLM\Software\Classes\Interface\{9BB31AD8-5DB2-459E-A901-DEA536F23BA4}
Deleted HKLM\Software\Classes\Interface\{BD51A48E-EB5F-4454-8774-EF962DF64546}
Deleted HKLM\Software\Classes\TypeLib\{FA6468D2-FAA4-4951-A53B-2A5CF9CC0A36}
Deleted HKLM\Software\Reimage
Deleted HKLM\Software\Wow6432Node\\Classes\AppID\REI_AxControl.DLL
Deleted HKLM\Software\Wow6432Node\\Classes\AppID\{28FF42B8-A0DA-4BE5-9B81-E26DD59B350A}
Deleted HKLM\Software\Wow6432Node\\Classes\Interface\{9BB31AD8-5DB2-459E-A901-DEA536F23BA4}
Deleted HKLM\Software\Wow6432Node\\Classes\Interface\{BD51A48E-EB5F-4454-8774-EF962DF64546}
Deleted HKLM\Software\Wow6432Node\\Classes\TypeLib\{FA6468D2-FAA4-4951-A53B-2A5CF9CC0A36}

***** [ Chromium (and derivatives) ] *****

No malicious Chromium entries cleaned.

***** [ Chromium URLs ] *****

No malicious Chromium URLs cleaned.

***** [ Firefox (and derivatives) ] *****

No malicious Firefox entries cleaned.

***** [ Firefox URLs ] *****

No malicious Firefox URLs cleaned.

***** [ Hosts File Entries ] *****

No malicious hosts file entries cleaned.

***** [ Preinstalled Software ] *****

No Preinstalled Software cleaned.


*************************

[+] Delete Tracing Keys
[+] Reset Winsock

*************************

AdwCleaner[S00].txt - [2610 octets] - [22/03/2025 12:38:55]
AdwCleaner[S01].txt - [2671 octets] - [22/03/2025 18:11:42]

########## EOF - C:\AdwCleaner\Logs\AdwCleaner[C01].txt ##########

[Medievl]

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Malwarebytes
Version: 8.1.4 (07.09.2017)
Operating System: Windows 10 Enterprise x64
Ran by Pavel (Administrator) on 22.03.2025 at 18:14:39,12
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




File System: 1

Successfully deleted: C:\ProgramData\mntemp (File)

Deleted the following from C:\Users\czroc\AppData\Roaming\Mozilla\Firefox\Profiles\tpgocem0.default-release\prefs.js
user_pref(browser.search.totalSearches, 11);



Registry: 2

Successfully deleted: HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C} (Registry Key)
Successfully deleted: HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C} (Registry Key)




~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 22.03.2025 at 18:16:08,10
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

[Medievl]

Malwarebytes
http://www.malwarebytes.com

-Log Details-
Scan Date: 22.03.2025
Scan Time: 18:16
Log File: 737da11a-0741-11f0-8c7f-d8bbc1cc9a07.json

-Software Information-
Version: 5.2.8.173
Components Version: 128.0.5184
Update Package Version: 1.0.97417
License: Trial

-System Information-
OS: Windows 11 (Build 26100.3476)
CPU: x64
File System: NTFS
User: DESKTOP-08TVO88\Pavel

-Scan Summary-
Scan Type: Threat Scan
Scan Initiated By: Manual
Result: Completed
Objects Scanned: 268970
Threats Detected: 2
Threats Quarantined: 2
Time Elapsed: 0 min, 41 sec

-Scan Options-
Memory: Enabled
Startup: Enabled
File system: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Detect
PUM: Detect

-Scan Details-
Process: 0
(No malicious items detected)

Module: 0
(No malicious items detected)

Registry Key: 1
PUP.Optional.Reimage, HKU\S-1-5-21-3748560031-2723970751-817939281-1001\SOFTWARE\LOCAL APPWIZARD-GENERATED APPLICATIONS\Fixer - Windows Problem Relief., Quarantined, 2888, 709541, 1.0.97417, , ame, , ,

Registry Value: 0
(No malicious items detected)

Registry Data: 0
(No malicious items detected)

Data Stream: 0
(No malicious items detected)

Folder: 0
(No malicious items detected)

File: 1
Generic.Malware/Suspicious, C:\PROGRAM FILES (X86)\ROCKSTAR GAMES\GTA SAN ANDREAS\HLM-INTRO.EXE, Quarantined, 0, 392686, 1.0.97417, , shuriken, , 6B1114186B8F261EA6759673B0A3E604, 71BE3455199987166D45759C33F88051D87288BE518D2FE14A48EE2EC00E1552

Physical Sector: 0
(No malicious items detected)

WMI: 0
(No malicious items detected)


(end)

[Medievl]

Program : RogueKillerSVC
Version : 3.1.1.0
x64 : Yes
Program Date : Mar 11 2025
Location : C:\Program Files\RogueKiller\RogueKillerSvc.exe
Premium : No
Company : Adlice Software
Website : https://www.adlice.com/
Operating System : Windows 11 (10.0.26100) 64-bit
64-bit OS : Yes
Startup : 0
WindowsPE : No
User : Pavel
User is Admin : Yes
Date : 2025/03/22 17:21:31
Type : Scan
Aborted : No
Scan Mode : Quick
Duration : 6
Found items : 0
Total scanned : 1021
removed_count : 0
Signatures Version : 20250319_081336
Truesight Driver : Yes
Updates Count : 0

************************* Warnings *************************

************************* Updates *************************

************************* Processes *************************

************************* Modules *************************

************************* Services *************************

************************* Scheduled Tasks *************************

************************* Registry *************************

************************* WMI *************************

************************* Hosts File *************************
is_too_big : No
hosts_file_path : N/A


************************* Filesystem *************************

************************* Web Browsers *************************

************************* Antirootkit *************************

[jaro3]

Vypni antivir i firewall, RogueKiller, Malwarebytes Antimalware, windowsDefender
Stáhni zoek:
https://datoid.cz/UeeEYf/zoek1-rar

Zavři všechny ostatní programy , okna i prohlížeče.
Spusť Zoek.exe ( u win vista , win7, 8 klikni na něj pravým a vyber : „Spustit jako správce“
-pozor , náběh programu může trvat déle.
Do okna programu vlož skript níže:

Kód: Vybrat vše

autoclean;
resethosts;
emptyclsid;
IEdefaults;
FFdefaults;
CHRdefaults;
emptyIEcache;
emptyFFcache;
emptyCHRcache;
emptyalltemp;
emptyflash;
emptyjava;
emptyrecycle.bin;

klikni na Run Script
Program provede sken , opravu, sken i oprava může trvat i více minut ,je třeba posečkat do konce. Do okna neklikej!
Program nabídne restart , potvrď .
Po restartu se může nějaký čas ukázat pouze černá plocha , to je normální. Je třeba počkat až se vytvoří log. Ten si můžeš uložit třeba do dokumentů , jinak se sám ukládá do:
C:\zoek-results.log Zkopíruj sem celý obsah toho logu.
Pokud budou problémy , spusť zoek v nouz. režimu.


Stáhni si Zemana AntiMalware Free z tohoto odkazu:
https://www.zemana.com/Download/AntiMal ... .Setup.exe

(posuvník dolu na download)
a ulož si ho na plochu.
Poklepej na tento soubor na ploše a postupuj podle pokynů k instalaci programu.
Přijmi licenci k používání programu EULA , pokud se nabídne.
Pokud je k dispozici aktualizace programu , klepni na tlačítko „Update now“ ( aktualizovat nyní).
Zavři všechny otevřené soubory, složky a prohlížeče
Neměň žádné nastavení. Klikni na „Skenovat nyní“.
Po skenu lze vidět , zda jsou nějaké nákazy. Klikni na „Vykonat“ ( vymazat). Nákazy budou přemístěny do karantény.
Když je skenování dokončeno, klikni vlevo na „zprávy“ a pak na „otevři zprávu“ a zkopíruj sem celý obsah té zprávy.

Vlož nový log z HJT + informuj o problémech

[Medievl]

Zoek.exe v5.0.0.2 Updated 03-May-2018(Online Version)
Tool run by Pavel on 24.03.2025 at 16:07:14,25.
Microsoft Windows 11 Pro 10.0.26100 x64
Running in: Normal Mode Internet Access Detected
Launched: C:\Users\czroc\Desktop\zoek (1).exe [Scan all users] [Script inserted]

==== System Restore Info ======================

24.03.2025 16:08:22 Zoek.exe System Restore Point Created Successfully.

==== Reset Hosts File ======================

# Copyright (c) 1993-2006 Microsoft Corp.
#
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
#
# This file contains the mappings of IP addresses to host names. Each
# entry should be kept on an individual line. The IP address should
# be placed in the first column followed by the corresponding host name.
# The IP address and the host name should be separated by at least one
# space.
#
# Additionally, comments (such as these) may be inserted on individual
# lines or following the machine name denoted by a '#' symbol.
#
# For example:
#
# 102.54.94.97 rhino.acme.com # source server
# 38.25.63.10 x.acme.com # x client host

# localhost name resolution is handled within DNS itself.
127.0.0.1 localhost
::1 localhost

==== Empty Folders Check ======================

C:\PROGRA~2\chrome_BITS_13588_1850530781 deleted successfully
C:\Program Files\EA Games deleted successfully
C:\Program Files\Common Files\Autodesk Shared deleted successfully
C:\PROGRA~3\Disc-Soft deleted successfully
C:\PROGRA~3\enlisted deleted successfully
C:\PROGRA~3\MetaQuotes deleted successfully
C:\PROGRA~3\SoftwareDistribution deleted successfully
C:\PROGRA~3\ssh deleted successfully
C:\PROGRA~3\WarThunder deleted successfully
C:\Users\czroc\AppData\Roaming\Albion deleted successfully
C:\Users\czroc\AppData\Roaming\Disc-Soft deleted successfully
C:\Users\czroc\AppData\Roaming\Easeware deleted successfully
C:\Users\czroc\AppData\Local\Battlestate Games deleted successfully
C:\Users\czroc\AppData\Local\DBG deleted successfully
C:\Users\czroc\AppData\Local\PeerDistRepub deleted successfully

==== Deleting CLSID Registry Keys ======================


==== Deleting CLSID Registry Values ======================


==== Deleting Services ======================


==== FireFox Fix ======================

Deleted from C:\Users\czroc\AppData\Roaming\Mozilla\Firefox\Profiles\tpgocem0.default-release\prefs.js:
user_pref("browser.startup.homepage", "www.seznam.cz");

Added to C:\Users\czroc\AppData\Roaming\Mozilla\Firefox\Profiles\tpgocem0.default-release\prefs.js:
user_pref("browser.startup.homepage", "about:home");
user_pref("browser.newtab.url", "about:newtab");

==== Deleting Files \ Folders ======================

C:\PROGRA~2\chrome_BITS_13588_1850530781 not found
C:\Users\czroc\AppData\Roaming\.technic deleted
C:\Users\czroc\AppData\Roaming\darkorbit-client deleted
C:\Users\czroc\AppData\Roaming\discord deleted
C:\Users\czroc\AppData\Roaming\The Witcher 3 deleted
C:\Users\czroc\AppData\Roaming\U.GG deleted
C:\Users\czroc\AppData\Roaming\Vortex deleted
C:\PROGRA~3\Package Cache deleted
C:\Users\czroc\AppData\Local\cache deleted
C:\Users\czroc\AppData\Local\CrashRpt deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-1690-5074-1098984.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-1690-5074-1098986.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-1690-5074-1098988.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-1690-5074-1098999.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-1690-5074-109899b.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-1690-5074-109899d.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-1690-5074-109899f.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-1690-5074-10989b1.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-1690-5074-10989b3.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-1690-5074-10989b5.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-1690-5074-10989b7.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-1690-5074-10989b9.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-1690-5074-10989cb.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-1690-5074-10989cd.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-1690-5074-10989cf.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-1690-5074-10989d1.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-1690-5074-10989e2.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-1690-5074-10989e4.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-1690-5074-10989e6.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-1690-5074-10989e8.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-1690-5074-10989fa.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-1690-5074-10989fc.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-1f54-28a8-b2cf0.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-1f54-28a8-b2cf2.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-1f54-28a8-b2cf4.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-1f54-28a8-b2d06.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-1f54-28a8-b2d08.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-1f54-28a8-b2d0a.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-1f54-28a8-b2d0c.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-1f54-28a8-b2d0e.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-1f54-28a8-b2d1f.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-1f54-28a8-b2d21.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-1f54-28a8-b2d23.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-1f54-28a8-b2d45.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-1f54-28a8-b2d47.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-1f54-28a8-b2d49.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-1f54-28a8-b2d4b.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-1f54-28a8-b2d4d.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-1f54-28a8-b2d4f.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-1f54-28a8-b2d60.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-1f54-28a8-b2d62.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-1f54-28a8-b2d64.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-1f54-28a8-b2d66.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-1f54-28a8-b2d68.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-21bc-20bc-95bda.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-21bc-20bc-95beb.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-21bc-20bc-95bed.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-21bc-20bc-95bef.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-21bc-20bc-95bf1.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-21bc-20bc-95bf3.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-21bc-20bc-95c05.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-21bc-20bc-95c07.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-21bc-20bc-95c09.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-21bc-20bc-95c0b.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-21bc-20bc-95c0d.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-21bc-20bc-95c1e.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-21bc-20bc-95c20.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-21bc-20bc-95c22.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-21bc-20bc-95c24.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-21bc-20bc-95c26.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-21bc-20bc-95c38.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-21bc-20bc-95c3a.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-21bc-20bc-95c3c.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-21bc-20bc-95c3e.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-21bc-20bc-95c40.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-21bc-20bc-95c52.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-28b4-27b4-b2bc7.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-28b4-27b4-b2bc9.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-28b4-27b4-b2bcb.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-28b4-27b4-b2bcd.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-28b4-27b4-b2bcf.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-28b4-27b4-b2be1.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-28b4-27b4-b2be3.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-28b4-27b4-b2be5.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-28b4-27b4-b2be7.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-28b4-27b4-b2be9.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-28b4-27b4-b2bfa.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-28b4-27b4-b2bfc.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-28b4-27b4-b2bfe.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-28b4-27b4-b2c00.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-28b4-27b4-b2c02.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-28b4-27b4-b2c14.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-28b4-27b4-b2c16.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-28b4-27b4-b2c18.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-28b4-27b4-b2c1a.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-28b4-27b4-b2c2c.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-28b4-27b4-b2c2e.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-28b4-27b4-b2c30.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-3958-3cec-22f9d64.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-3958-3cec-22f9d75.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-3958-3cec-22f9d77.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-3958-3cec-22f9d79.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-3958-3cec-22f9d7b.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-3958-3cec-22f9d7d.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-3958-3cec-22f9d8f.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-3958-3cec-22f9d91.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-3958-3cec-22f9d93.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-3958-3cec-22f9d95.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-3958-3cec-22f9da7.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-3958-3cec-22f9da9.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-3958-3cec-22f9dab.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-3958-3cec-22f9dad.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-3958-3cec-22f9daf.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-3958-3cec-22f9db1.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-3958-3cec-22f9dc2.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-3958-3cec-22f9dc4.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-3958-3cec-22f9dc6.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-3958-3cec-22f9dc8.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-3958-3cec-22f9dda.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-3958-3cec-22f9ddc.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-5100-1dec-356a1be.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-5100-1dec-356a1c0.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-5100-1dec-356a1d2.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-5100-1dec-356a1d4.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-5100-1dec-356a1d6.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-5100-1dec-356a1d8.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-5100-1dec-356a1da.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-5100-1dec-356a1eb.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-5100-1dec-356a1ed.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-5100-1dec-356a1ef.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-5100-1dec-356a1f1.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-5100-1dec-356a1f3.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-5100-1dec-356a1f5.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-5100-1dec-356a207.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-5100-1dec-356a209.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-5100-1dec-356a20b.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-5100-1dec-356a20d.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-5100-1dec-356a20f.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-5100-1dec-356a221.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-5100-1dec-356a223.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-5100-1dec-356a225.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-5100-1dec-356a227.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-790-2eb0-19b566.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-790-2eb0-19b568.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-790-2eb0-19b579.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-790-2eb0-19b57b.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-790-2eb0-19b57d.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-790-2eb0-19b57f.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-790-2eb0-19b591.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-790-2eb0-19b593.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-790-2eb0-19b595.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-790-2eb0-19b597.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-790-2eb0-19b599.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-790-2eb0-19b59b.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-790-2eb0-19b5ac.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-790-2eb0-19b5ae.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-790-2eb0-19b5b0.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-790-2eb0-19b5b2.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-790-2eb0-19b5c4.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-790-2eb0-19b5c6.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-790-2eb0-19b5c8.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-790-2eb0-19b5ca.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-790-2eb0-19b5cc.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-790-2eb0-19b5de.tmp deleted
C:\Users\czroc\AppData\LocalLow\Unity deleted
C:\windows\SysNative\GroupPolicy\Machine deleted
C:\windows\SysNative\GroupPolicy\User deleted
C:\windows\SysNative\GroupPolicy\gpt.ini deleted
"C:\Users\czroc\AppData\Local\AC2B970AEE58A1F641A841E2B918A11C" deleted
"C:\Users\czroc\AppData\Roaming\.machineId" deleted
"C:\ProgramData\mntemp" deleted
"C:\DumpStack.log.tmp" not deleted

==== Firefox Start and Search pages ======================

ProfilePath: C:\Users\czroc\AppData\Roaming\Mozilla\Firefox\Profiles\tpgocem0.default-release
user_pref("browser.startup.homepage", "about:home");
user_pref("browser.newtab.url", "about:newtab");

==== Firefox Extensions ======================

==== Firefox Plugins ======================


==== Chromium Look ======================


Edge relevant text changes - czroc\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha

==== Set IE to Default ======================

Old Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"="http://go.microsoft.com/fwlink/p/?LinkId=255141"

New Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"="http://go.microsoft.com/fwlink/p/?LinkId=255141"

==== All HKLM and HKCU SearchScopes ======================

HKLM\SearchScopes "DefaultScope"="{0633EE93-D776-472f-A0FF-E1416B8B2E3A}"
HKLM\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} - http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
HKLM\Wow6432Node\SearchScopes "DefaultScope"="{0633EE93-D776-472f-A0FF-E1416B8B2E3A}"
HKLM\Wow6432Node\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} - http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
HKCU\SearchScopes "DefaultScope"="{0633EE93-D776-472f-A0FF-E1416B8B2E3A}"
HKCU\SearchScopes\{012E1000-F331-11DB-8314-0800200C9A66} - http://www.google.com/search?q={searchTerms}
HKCU\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} - http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IESR02

==== Reset Google Chrome ======================

C:\Users\czroc\AppData\Local\Google\Chrome\User Data\Default\Preferences was reset successfully
C:\Users\czroc\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences was reset successfully
C:\Users\czroc\AppData\Local\Microsoft\Edge\User Data\Default\Preferences was reset successfully
C:\Users\czroc\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences was reset successfully
C:\Users\czroc\AppData\Local\Google\Chrome\User Data\Default\Web Data was reset successfully
C:\Users\czroc\AppData\Local\Google\Chrome\User Data\Default\Web Data-journal was reset successfully
C:\Users\czroc\AppData\Local\Microsoft\Edge\User Data\Default\Web Data was reset successfully
C:\Users\czroc\AppData\Local\Microsoft\Edge\User Data\Default\Web Data-journal was reset successfully

==== Empty IE Cache ======================

C:\WINDOWS\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\czroc\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 emptied successfully
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 emptied successfully
C:\Users\czroc\AppData\Local\Microsoft\Windows\INetCache\IE emptied successfully
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE emptied successfully

==== Empty FireFox Cache ======================

No FireFox Cache found

==== Empty Chrome Cache ======================

C:\Users\czroc\AppData\Local\Opera Software\Opera Stable\Cache emptied successfully
C:\Users\czroc\AppData\Local\Google\Chrome\User Data\Default\Cache emptied successfully
C:\Users\czroc\AppData\Local\Microsoft\Edge\User Data\Default\Cache emptied successfully

==== Empty All Flash Cache ======================

No Flash Cache Found

==== Empty All Java Cache ======================

Java Cache cleared successfully

==== C:\zoek_backup content ======================

C:\zoek_backup (files=28162 folders=2753 7592123813 bytes)

==== Empty Temp Folders ======================

C:\Users\czroc\AppData\Local\Temp will be emptied at reboot
C:\Users\Default\AppData\Local\Temp emptied successfully
C:\Users\Default User\AppData\Local\Temp emptied successfully
C:\WINDOWS\serviceprofiles\networkservice\AppData\Local\Temp emptied successfully
C:\WINDOWS\serviceprofiles\Localservice\AppData\Local\Temp emptied successfully
C:\WINDOWS\Temp will be emptied at reboot

==== After Reboot ======================

==== Empty Temp Folders ======================

C:\WINDOWS\Temp successfully emptied
C:\Users\czroc\AppData\Local\Temp successfully emptied

==== Empty Recycle Bin ======================

C:\$RECYCLE.BIN successfully emptied

==== Deleting Files / Folders ======================

"C:\DumpStack.log.tmp" not deleted

==== EOF on 24.03.2025 at 16:24:48,29 ======================