PC-HELP.CZ

Dobrý den
Po spuštění pc se mi vždy spustí automaticky google chrome, s odkazem na nějakou pochybnou stránku, defender nic nenašel, tak bych rád požádal o pomoc s odstraněním problému. Děkuji předem.

Log z HJT:

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 9:36:21, on 11.10.2025
Platform: Unknown Windows (WinNT 6.02.1008)
MSIE: Internet Explorer v11.0 (11.00.26100.1882)


Boot mode: Normal

Running processes:
C:\Program Files\XPPen\PenTablet.exe
D:\Program Files (x86)\Steam\steam.exe
C:\Users\david\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/p/?LinkId=255141
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/p/?LinkId=255141
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/p/?LinkId=255141
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = %11%\blank.htm
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F2 - REG:system.ini: UserInit=
O2 - BHO: IEToEdge BHO - {1FD49718-1D00-4B19-AF5F-070AF6D5D54C} - C:\Program Files (x86)\Microsoft\Edge\Application\141.0.3537.57\BHO\ie_to_edge_bho.dll
O4 - HKCU\..\Run: [MicrosoftEdgeAutoLaunch_30FCCE2722F4190AAE310221237BB02B] "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
O4 - HKCU\..\Run: [OneDrive] "C:\Users\david\AppData\Local\Microsoft\OneDrive\OneDrive.exe" /background
O4 - HKCU\..\Run: [Discord] "C:\Users\david\AppData\Local\Discord\Update.exe" --processStart Discord.exe
O4 - HKCU\..\Run: [Wargaming.net Game Center] "C:\ProgramData\Wargaming.net\GameCenter\wgc.exe" --background
O4 - HKCU\..\Run: [AMDNoiseSuppression] "C:\WINDOWS\system32\AMD\ANR\AMDNoiseSuppression.exe"
O4 - HKCU\..\Run: [electron.app.LM Studio] C:\Program Files\LM Studio\LM Studio.exe --run-as-service
O4 - HKCU\..\Run: [david] cmd.exe /c start www.rongronger.click
O4 - HKUS\S-1-5-19\..\Run: [OneDriveSetup] C:\Windows\System32\OneDriveSetup.exe /thfirstsetup (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [OneDriveSetup] C:\Windows\System32\OneDriveSetup.exe /thfirstsetup (User 'NETWORK SERVICE')
O10 - Unknown file in Winsock LSP: c:\windows\system32\nlansp_c.dll
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O18 - Protocol: tbauth - {14654CA6-5711-491D-B89A-58E571679951} - C:\Windows\SysWOW64\tbauth.dll
O18 - Protocol: windows.tbauth - {14654CA6-5711-491D-B89A-58E571679951} - C:\Windows\SysWOW64\tbauth.dll
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\WINDOWS\System32\alg.exe (file missing)
O23 - Service: AMD Crash Defender Service - Advanced Micro Devices, Inc. - C:\WINDOWS\System32\DriverStore\FileRepository\amdfendr.inf_amd64_1aafc0a9b0693712\amdfendrsr.exe
O23 - Service: AMD External Events Utility - AMD - C:\WINDOWS\System32\DriverStore\FileRepository\u0418637.inf_amd64_4462a7afa694670e\B418564\atiesrxx.exe
O23 - Service: @oem6.inf,%AmdAppCompatSvc.DisplayName%;AMD Application Compatibility Database Service (AmdAppCompatSvc) - Advanced Micro Devices, Inc - C:\WINDOWS\System32\DriverStore\FileRepository\amdappcompat.inf_amd64_0cfc8ba812cdbaa8\AmdAppCompatSvc.exe
O23 - Service: @oem5.inf,%AmdPpkgSvc.DisplayName%;AMD Provisioning Packages Service (AmdPpkgSvc) - Advanced Micro Devices, Inc - C:\WINDOWS\System32\DriverStore\FileRepository\amdppkg.inf_amd64_2e5ec3779d1804d1\AmdPpkgSvc.exe
O23 - Service: Armoury Crate Download Tool (ArmouryCrateDownloadTool) - ASUSTeK Computer Inc. - C:\WINDOWS\System32\DriverStore\FileRepository\rogms.inf_amd64_3662b6ec6533ed67\ArmouryLiveUpdate.exe
O23 - Service: AsusUpdateCheck - Unknown owner - C:\WINDOWS\System32\AsusUpdateCheck.exe (file missing)
O23 - Service: @%SystemRoot%\system32\CredentialEnrollmentManager.exe,-100 (CredentialEnrollmentManagerUserSvc) - Unknown owner - C:\WINDOWS\system32\CredentialEnrollmentManager.exe (file missing)
O23 - Service: CredentialEnrollmentManagerUserSvc_85247 - Unknown owner - C:\WINDOWS\system32\CredentialEnrollmentManager.exe (file missing)
O23 - Service: Easy Anti-Cheat (Epic Online Services) (EasyAntiCheat_EOS) - Epic Games, Inc. - C:\Program Files (x86)\EasyAntiCheat_EOS\EasyAntiCheat_EOS.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\WINDOWS\System32\lsass.exe (file missing)
O23 - Service: NVIDIA FrameView SDK service (FvSvc) - NVIDIA - C:\Program Files\NVIDIA Corporation\FrameViewSDK\nvfvsdksvc_x64.exe
O23 - Service: @%systemroot%\system32\GameInputSvc.exe,-101 (GameInputSvc) - Unknown owner - C:\WINDOWS\System32\GameInputSvc.exe (file missing)
O23 - Service: Google Chrome Elevation Service (GoogleChromeElevationService) (GoogleChromeElevationService) - Google LLC - C:\Program Files\Google\Chrome\Application\141.0.7390.66\elevation_service.exe
O23 - Service: Intern aktualiza n slu ba Google (GoogleUpdaterInternalService142.0.7416.0) (GoogleUpdaterInternalService142.0.7416.0) - Google LLC - C:\Program Files (x86)\Google\GoogleUpdater\142.0.7416.0\updater.exe
O23 - Service: Aktualiza n slu ba Google (GoogleUpdaterService142.0.7416.0) (GoogleUpdaterService142.0.7416.0) - Google LLC - C:\Program Files (x86)\Google\GoogleUpdater\142.0.7416.0\updater.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\WINDOWS\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\System32\localkdcsvc.dll,-1 (LocalKdc) - Unknown owner - C:\WINDOWS\System32\lsass.exe (file missing)
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\WINDOWS\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\WINDOWS\system32\lsass.exe (file missing)
O23 - Service: NVIDIA LocalSystem Container (NvContainerLocalSystem) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe
O23 - Service: NVIDIA Display Container LS (NVDisplay.ContainerLocalSystem) - NVIDIA Corporation - C:\WINDOWS\System32\DriverStore\FileRepository\nvmdi.inf_amd64_cc0a63ee9d9b83b2\Display.NvContainer\NVDisplay.Container.exe
O23 - Service: Oculus VR Library Service (OVRLibraryService) - Facebook Technologies, LLC - C:\Program Files\Oculus\Support\oculus-librarian\OVRLibraryService.exe
O23 - Service: Oculus VR Runtime Service (OVRService) - Facebook Technologies, LLC - C:\Program Files\Oculus\Support\oculus-runtime\OVRServiceLauncher.exe
O23 - Service: @%systemroot%\system32\PerceptionSimulation\PerceptionSimulationService.exe,-101 (perceptionsimulation) - Unknown owner - C:\WINDOWS\system32\PerceptionSimulation\PerceptionSimulationService.exe (file missing)
O23 - Service: @%SystemRoot%\System32\ReFsDedupSvc.exe,-100 (refsdedupsvc) - Unknown owner - C:\WINDOWS\System32\ReFsDedupSvc.exe (file missing)
O23 - Service: Rockstar Game Library Service (Rockstar Service) - Rockstar Games - D:\Program Files\Rockstar Games\Launcher\RockstarService.exe
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\WINDOWS\system32\locator.exe (file missing)
O23 - Service: Realtek Audio Universal Service (RtkAudioUniversalService) - Realtek Semiconductor - C:\WINDOWS\System32\DriverStore\FileRepository\realtekservice.inf_amd64_b0c953b89f2097a9\RtkAudUService64.exe
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\WINDOWS\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\SecurityHealthAgent.dll,-1002 (SecurityHealthService) - Unknown owner - C:\WINDOWS\system32\SecurityHealthService.exe (file missing)
O23 - Service: @%ProgramFiles%\Windows Defender Advanced Threat Protection\MsSense.exe,-1001 (Sense) - Unknown owner - C:\Program Files (x86)\Windows Defender Advanced Threat Protection\MsSense.exe (file missing)
O23 - Service: @%SystemRoot%\system32\SensorDataService.exe,-101 (SensorDataService) - Unknown owner - C:\WINDOWS\System32\SensorDataService.exe (file missing)
O23 - Service: @firewallapi.dll,-50323 (SNMPTrap) - Unknown owner - C:\WINDOWS\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\WINDOWS\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\WINDOWS\system32\sppsvc.exe (file missing)
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files (x86)\Common Files\Steam\SteamService.exe
O23 - Service: SteelSeries GG Update Service Proxy (SteelSeriesGGUpdateServiceProxy) - Unknown owner - C:\Program Files\SteelSeries\GG\SteelSeriesGGUpdateServiceProxy.exe
O23 - Service: @%SystemRoot%\system32\TieringEngineService.exe,-702 (TieringEngineService) - Unknown owner - C:\WINDOWS\system32\TieringEngineService.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\WINDOWS\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\WINDOWS\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\WINDOWS\system32\vssvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\WINDOWS\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\WINDOWS\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--
End of file - 10121 bytes

Tuhle stránku na bitcoiny znáš?


Stáhni si ATF Cleaner
https://www.majorgeeks.com/mg/getmirror ... ner,2.html
Poklepej na ATF Cleaner.exe, klikni na select all, poté:
-Když používáš Firefox (Mozzila), klikni na Firefox nahoře a vyber: Select All, poté klikni na Empty Selected.
-Když používáš Operu, klikni nahoře na Operu a vyber: Select All, poté klikni na Empty Selected. Poté klikni na Main (hlavní stránku ) a klikni na Empty Selected.
Po vyčištění klikni na Exit k zavření programu.
ATF-Cleaner je jednoduchý nástroj na odstranění historie z webového prohlížeče. Program dokáže odstranit cache, cookies, historii a další stopy po surfování na Internetu. Mezi podporované prohlížeče patří Internet Explorer, Firefox a Opera. Aplikace navíc umí odstranit dočasné soubory Windows, vysypat koš atd.
- Pokud používáš jen Google Chrome ,Edge , tak ATF nemusíš použít.


Stáhni si TFC
http://www.geekstogo.com/forum/files/fi ... -oldtimer/
https://www.bleepingcomputer.com/download/tfc/
https://www.majorgeeks.com/files/detail ... eaner.html
https://www.majorgeeks.com/mg/get/temp_ ... ner,1.html

Otevři soubor a zavři všechny ostatní okna, Klikni na Start k zahájení procesu. Program by neměl trvat dlouho.
Poté by se měl PC restartovat, pokud ne , proveď sám.

Stáhni AdwCleaner (by Xplode)
http://www.bleepingcomputer.com/download/adwcleaner/
http://www.adlice.com/downloadprogress/
pro majitele win7 stáhni zde:
https://filehippo.com/download_adwcleaner/ ( nedávej aktualizaci!)

Ulož si ho na svojí plochu . Klikni na „Souhlasím“ k povrzení podmínek.
Ukonči všechny programy , okna a prohlížeče
Spusť program poklepáním a klikni na „Skenování“
Po skenu se objeví log , který se otevře. ( jinak je uložen systémovem disku jako) C:\AdwCleaner\Logs, jeho obsah sem celý vlož.

Stáhni si Malwarebytes' Anti-Malware
https://www.malwarebytes.com/mwb-download/thankyou/

na plochu , nainstaluj a spusť ho
-Pokud není program aktuální , klikni na možnost „Aktualizovat nyní“ či „Opravit nyní“.
- bude nalezena aktualizace a nainstaluje se.
- poté klikni na Spustit skenování
- po proběhnutí skenu se ti objeví hláška vpravo dole, tak klikni na Zobrazit zprávu a vyber Export a vyber Kopírovat do schránky a vlož sem celý log. Nebo klikni na „Textový soubor ( .txt)“ a log si ulož. A vlož sem.
-jinak se log nachází v programu po kliknutí na „Zprávy“ , nebo je uložen zde: C:\ProgramData\Malwarebytes\Malwarebytes Anti-Malware\Logs

- po té klikni na tlačítko Dokončit, a program zavři křížkem vpravo nahoře.
(zatím nic nemaž!).
Pokud budou problémy , spusť v nouz. režimu.
(Po skončení scanu klikni na vidličku save result a vyber export to TXT. Po chvilce se objeví okno a uložíš si log v txt kam chceš. Pak ho zkopíruj a vlož sem).

Tu stránku na bitcony neznám, jinak jsem si všiml, že před spuštěním náhodné stránky po spuštění pc, mi problikne příkazový řádek, takže to vypadá na nějaký script, co po spuštění pc aktivuje zapnutí chrome s odkazem reklamových stránek. Jinak logy:

ADWCleaner:

# -------------------------------
# Malwarebytes AdwCleaner 8.5.0.595
# -------------------------------
# Build: 03-05-2025
# Database: 2024-10-23.4 (Local)
# Support: https://www.malwarebytes.com/support
#
# -------------------------------
# Mode: Scan
# -------------------------------
# Start: 10-11-2025
# Duration: 00:00:08
# OS: Windows 11 (Build 26100.6584)
# Scanned: 32099
# Detected: 0


***** [ Services ] *****

No malicious services found.

***** [ Folders ] *****

No malicious folders found.

***** [ Files ] *****

No malicious files found.

***** [ DLL ] *****

No malicious DLLs found.

***** [ WMI ] *****

No malicious WMI found.

***** [ Shortcuts ] *****

No malicious shortcuts found.

***** [ Tasks ] *****

No malicious tasks found.

***** [ Registry ] *****

No malicious registry entries found.

***** [ Chromium (and derivatives) ] *****

No malicious Chromium entries found.

***** [ Chromium URLs ] *****

No malicious Chromium URLs found.

***** [ Firefox (and derivatives) ] *****

No malicious Firefox entries found.

***** [ Firefox URLs ] *****

No malicious Firefox URLs found.

***** [ Hosts File Entries ] *****

No malicious hosts file entries found.

***** [ Preinstalled Software ] *****

No Preinstalled Software found.


########## EOF - C:\AdwCleaner\Logs\AdwCleaner[S02].txt ##########

Malwarebytes log:

Malwarebytes
www.malwarebytes.com

-Log Details-
Scan Date: 10/11/2025
Scan Time: 7:14 PM
Log File: cb5a722c-a6c5-11f0-9ccb-a0ad9f06b149.json

-Software Information-
Version: 5.4.1.215
Components Version: 142.0.5389
Update Package Version: 1.0.103791
License: Trial

-System Information-
OS: Windows 11 (Build 26100.6584)
CPU: x64
File System: NTFS
User: gamer\david

-Scan Summary-
Scan Type: Threat Scan
Scan Initiated By: Manual
Result: Completed
Objects Scanned: 191236
Threats Detected: 0
Threats Quarantined: 0
Time Elapsed: 2 min, 12 sec

-Scan Options-
Memory: Enabled
Startup: Enabled
File system: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Detect
PUM: Detect

-Scan Details-
Process: 0
(No malicious items detected)

Module: 0
(No malicious items detected)

Registry Key: 0
(No malicious items detected)

Registry Value: 0
(No malicious items detected)

Registry Data: 0
(No malicious items detected)

Data Stream: 0
(No malicious items detected)

Folder: 0
(No malicious items detected)

File: 0
(No malicious items detected)

Physical Sector: 0
(No malicious items detected)

WMI: 0
(No malicious items detected)


(end)

Fixni v HJT:
O4 - HKCU\..\Run: [david] cmd.exe /c start www.rongronger.click

Stáhni si Junkware Removal Tool by Thisisu
http://www.bleepingcomputer.com/downloa ... oval-tool/
https://downloads.malwarebytes.com/file/JRT-EOL
na svojí plochu.

Deaktivuj si svůj antivirový program. Pravým tl. myši klikni na JRT.exe a vyber „spustit jako správce“. Pro pokračování budeš vyzván ke stisknutí jakékoliv klávesy. Na nějakou klikni.
Začne skenování programu. Skenování může trvat dlouho , podle množství nákaz. Po ukončení skenu se objeví log (JRT.txt) , který se uloží na ploše.
Zkopíruj sem prosím celý jeho obsah.


Sophos Virus Removal Tool je praktický softwarový nástroj, který by mohl odstranit infekce, které antivirový program nedetekuje .
Stáhněte si ho zde z některého odkazu:
https://www.majorgeeks.com/mg/getmirror ... ool,1.html
https://www.majorgeeks.com/mg/get/sopho ... ool,1.html
http://www.majorgeeks.com/mg/getmirror/ ... ool,1.html
http://www.majorgeeks.com/mg/getmirror/ ... ool,2.html

Viry mohou zpomalit počítač, nebo se snaží ukrást vaše data, a ani nevíte , že je máte. Co potřebujete, je rychlý a snadný způsob, jak je najít a zbavit se jich, pokud již máte antivirový program v počítači nainstalován , můžete nainstalovat i nástroj Sophos Virus Removal , který identifikuje a vyčistí zbylé infekce, které mohl Váš antivirový program přehlédnout.
K použití Sophos Virus Removal Tool na něj poklepejte a stiskněte tlačítko „Start scanning“ . Pak bude Sophos Virus Removal Tool vyhledávat a odstraňovat viry, které najde. Může být vyžadován restart.
Pokud byly nalezeny viry , tak po skenu klikni na „Details…“ a potom na „View log file“. Zkopíruj celý log a vlož ho sem. Potom zavři „threat detail“ a klikni na „Start cleanup“.
Jinak se log nachází zde:
C:\ProgramData\Sophos\Sophos Virus Removal Tool\Logs

Stáhni si RogueKiller by Adlice Software
http://www.adlice.com/download/roguekiller/
http://www.bleepingcomputer.com/download/roguekiller/
tutorial:
https://www.adlice.com/docs/roguekiller ... /tutorial/
na svojí plochu.
- Zavři všechny ostatní programy a prohlížeče.
- - klikni na „Scan“. V novém okně nic neměň a klikni dole na „Start“ ve sloupci „Quick Scan“
- Program skenuje procesy PC. Po proskenování klikni na „Results “ , v dalším okně pak levým t. na „Report“ a vyber : „Text File“ , log nazvi třeba RK a ulož do dokumentů nebo na plochu. Otevři soubor a celý obsah logu sem zkopíruj.
Pokud je program blokován , zkus ho spustit několikrát. Pokud dále program nepůjde spustit a pracovat, přejmenuj ho na winlogon.exe.
-pokud bude mít log více než 60.000 znaků , rozděl ho a vlož do více příspěvků
Pokud nepůjde uložit log, vyfoť si nákazy z obrazovky a vlož sem.

problém zmizel potom co jsem to odstranil v Hijack

každopádně logy JRT:

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Malwarebytes
Version: 8.1.4 (07.09.2017)
Operating System: Windows 10 Enterprise x64
Ran by david (Administrator) on 12.10.2025 at 21:52:19,17
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




File System: 0




Registry: 2

Successfully deleted: HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C} (Registry Key)
Successfully deleted: HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C} (Registry Key)




~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 12.10.2025 at 21:53:14,05
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~


Log Sohpos:

2025-10-12 19:57:10.633 Sophos Virus Removal Tool version 2.9.0
2025-10-12 19:57:10.633 Copyright (c) 2009-2021 Sophos Limited. All rights reserved.

2025-10-12 19:57:10.633 This tool will scan your computer for viruses and other threats. If it finds any, it will give you the option to remove them.

2025-10-12 19:57:10.633 Windows version 6.2 SP 0.0 build 9200 SM=0x100 PT=0x1 WOW64
2025-10-12 19:57:10.633 Checking for updates...
2025-10-12 19:57:10.639 Update progress: proxy server not available
2025-10-12 19:57:12.869 Update error: failed to read remote metadata (error 4)
[V46381] SU::Handle::readRemoteMetadata + SU::Handle::readRemoteMetadata()
[V75884] SU::Metadata::readRemoteMetadata SU::Metadata::readRemoteMetadata()
[I40394] Downloading customer file from sophos:1:1
[V81533] SU::createCachedPackageSource creating cached package source for sophos:1:1: url=SOPHOS
[V81533] SU::createCachedPackageSource creating http_source_specific_data to download customer file
[V81533] SU::createCachedPackageSource creating package source to download customer file
[E26245] Error fetching data from http://dci.sophosupd.com/update/d/8a/d8 ... 768996.dat: WinHttpSendRequest (error 12007)
[I26245] No proxy was used.
[I40394] Downloading customer file from sophos:2:1
[V81533] SU::createCachedPackageSource creating cached package source for sophos:2:1: url=SOPHOS
[V81533] SU::createCachedPackageSource creating http_source_specific_data to download customer file
[V81533] SU::createCachedPackageSource creating package source to download customer file
[E26245] Error fetching data from http://dci.sophosupd.net/update/d/8a/d8 ... 768996.dat: WinHttpSendRequest (error 12007)
[I26245] No proxy was used.
[I40394] Downloading customer file from sophos:3:1
[V81533] SU::createCachedPackageSource creating cached package source for sophos:3:1: url=SOPHOS
[V81533] SU::createCachedPackageSource creating http_source_specific_data to download customer file
[V81533] SU::createCachedPackageSource creating package source to download customer file
[E75373] Ran out of sophos aliases for this update source
[E35369] Out of update sources
[E99999] Out of sources
2025-10-12 19:57:16.108 Option all = no
2025-10-12 19:57:16.108 Option recurse = yes
2025-10-12 19:57:16.108 Option archive = no
2025-10-12 19:57:16.108 Option service = yes
2025-10-12 19:57:16.108 Option confirm = yes
2025-10-12 19:57:16.108 Option sxl = yes
2025-10-12 19:57:16.109 Option max-data-age = 35
2025-10-12 19:57:16.109 Option vdl-logging = yes
2025-10-12 19:57:16.112 Customer ID: 094260ca9b3af99f9d4a3909fc47a743
2025-10-12 19:57:16.112 Machine ID: cece76fc09dc4f53a333683c9923f49c
2025-10-12 19:57:16.115 Component SVRTcli.exe version 2.9.0
2025-10-12 19:57:16.115 Component control.dll version 2.9.0
2025-10-12 19:57:16.115 Component SVRTservice.exe version 2.9.0
2025-10-12 19:57:16.117 Component engine\osdp.dll version 1.44.1.2510
2025-10-12 19:57:16.119 Component engine\veex.dll version 3.81.0.2510
2025-10-12 19:57:16.119 Component engine\savi.dll version 9.0.23.2510
2025-10-12 19:57:16.146 Component rkdisk.dll version 1.5.33.1
2025-10-12 19:57:16.146 Version info: Product version 2.9.0
2025-10-12 19:57:16.146 Version info: Detection engine 3.81.0
2025-10-12 19:57:16.146 Version info: Detection data 5.82
2025-10-12 19:57:16.146 Version info: Build date 16.02.2021
2025-10-12 19:57:16.146 Version info: Data files added 208
2025-10-12 19:57:16.146 Version info: Last successful update (not yet updated)

2025-10-12 20:50:32.571 Could not open C:\hiberfil.sys
2025-10-12 20:50:32.573 Could not open C:\pagefile.sys
2025-10-12 20:58:54.537 Could not open C:\swapfile.sys
2025-10-12 20:58:54.557 Could not open C:\System Volume Information\{37300d14-a67d-11f0-8e8d-efb38796ba00}{3808876b-c176-4e48-b7ae-04046e6cc752}
2025-10-12 20:58:54.557 Could not open C:\System Volume Information\{37300d36-a67d-11f0-8e8d-efb38796ba00}{3808876b-c176-4e48-b7ae-04046e6cc752}
2025-10-12 20:58:54.557 Could not open C:\System Volume Information\{3808876b-c176-4e48-b7ae-04046e6cc752}
2025-10-12 20:58:54.557 Could not open C:\System Volume Information\{4175d106-a6c5-11f0-8e8e-c7215f9fe53d}{3808876b-c176-4e48-b7ae-04046e6cc752}
2025-10-12 20:58:54.557 Could not open C:\System Volume Information\{4175d69d-a6c5-11f0-8e8e-c7215f9fe53d}{3808876b-c176-4e48-b7ae-04046e6cc752}
2025-10-12 20:58:54.557 Could not open C:\System Volume Information\{4175d9a8-a6c5-11f0-8e8e-c7215f9fe53d}{3808876b-c176-4e48-b7ae-04046e6cc752}
2025-10-12 20:58:54.557 Could not open C:\System Volume Information\{735e55cb-a376-11f0-8e88-8757754b12d4}{3808876b-c176-4e48-b7ae-04046e6cc752}
2025-10-12 20:59:14.802 Could not open C:\Users\david\AppData\Local\Microsoft\WindowsApps\ActionsMcpHost.exe
2025-10-12 20:59:14.803 Could not open C:\Users\david\AppData\Local\Microsoft\WindowsApps\GameBarElevatedFT_Alias.exe
2025-10-12 20:59:14.803 Could not open C:\Users\david\AppData\Local\Microsoft\WindowsApps\GetHelp.exe
2025-10-12 20:59:14.804 Could not open C:\Users\david\AppData\Local\Microsoft\WindowsApps\MediaPlayer.exe
2025-10-12 20:59:14.805 Could not open C:\Users\david\AppData\Local\Microsoft\WindowsApps\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\python.exe
2025-10-12 20:59:14.805 Could not open C:\Users\david\AppData\Local\Microsoft\WindowsApps\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\python3.exe
2025-10-12 20:59:14.805 Could not open C:\Users\david\AppData\Local\Microsoft\WindowsApps\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\WindowsPackageManagerServer.exe
2025-10-12 20:59:14.805 Could not open C:\Users\david\AppData\Local\Microsoft\WindowsApps\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\winget.exe
2025-10-12 20:59:14.806 Could not open C:\Users\david\AppData\Local\Microsoft\WindowsApps\Microsoft.GamingApp_8wekyb3d8bbwe\XboxPcAppAdminServer.exe
2025-10-12 20:59:14.807 Could not open C:\Users\david\AppData\Local\Microsoft\WindowsApps\Microsoft.GamingApp_8wekyb3d8bbwe\XboxPcAppCE.exe
2025-10-12 20:59:14.808 Could not open C:\Users\david\AppData\Local\Microsoft\WindowsApps\Microsoft.GetHelp_8wekyb3d8bbwe\GetHelp.exe
2025-10-12 20:59:14.809 Could not open C:\Users\david\AppData\Local\Microsoft\WindowsApps\Microsoft.OutlookForWindows_8wekyb3d8bbwe\olk.exe
2025-10-12 20:59:14.810 Could not open C:\Users\david\AppData\Local\Microsoft\WindowsApps\Microsoft.Paint_8wekyb3d8bbwe\mspaint.exe
2025-10-12 20:59:14.810 Could not open C:\Users\david\AppData\Local\Microsoft\WindowsApps\Microsoft.Paint_8wekyb3d8bbwe\pbrush.exe
2025-10-12 20:59:14.811 Could not open C:\Users\david\AppData\Local\Microsoft\WindowsApps\Microsoft.PowerAutomateDesktop_8wekyb3d8bbwe\PAD.BrowserNativeMessageHost.exe
2025-10-12 20:59:14.811 Could not open C:\Users\david\AppData\Local\Microsoft\WindowsApps\Microsoft.PowerAutomateDesktop_8wekyb3d8bbwe\PAD.ChildSession.Service.Host.exe
2025-10-12 20:59:14.812 Could not open C:\Users\david\AppData\Local\Microsoft\WindowsApps\Microsoft.ScreenSketch_8wekyb3d8bbwe\SnippingTool.exe
2025-10-12 20:59:14.813 Could not open C:\Users\david\AppData\Local\Microsoft\WindowsApps\Microsoft.WindowsNotepad_8wekyb3d8bbwe\notepad.exe
2025-10-12 20:59:14.814 Could not open C:\Users\david\AppData\Local\Microsoft\WindowsApps\Microsoft.WindowsTerminal_8wekyb3d8bbwe\wt.exe
2025-10-12 20:59:14.815 Could not open C:\Users\david\AppData\Local\Microsoft\WindowsApps\Microsoft.XboxGamingOverlay_8wekyb3d8bbwe\GameBarElevatedFT_Alias.exe
2025-10-12 20:59:14.816 Could not open C:\Users\david\AppData\Local\Microsoft\WindowsApps\Microsoft.ZuneMusic_8wekyb3d8bbwe\MediaPlayer.exe
2025-10-12 20:59:14.818 Could not open C:\Users\david\AppData\Local\Microsoft\WindowsApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\ActionsMcpHost.exe
2025-10-12 20:59:14.818 Could not open C:\Users\david\AppData\Local\Microsoft\WindowsApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MicrosoftWindows.DesktopStickerEditorCentennial.exe
2025-10-12 20:59:14.818 Could not open C:\Users\david\AppData\Local\Microsoft\WindowsApps\MicrosoftWindows.DesktopStickerEditorCentennial.exe
2025-10-12 20:59:14.818 Could not open C:\Users\david\AppData\Local\Microsoft\WindowsApps\ms-teams.exe
2025-10-12 20:59:14.818 Could not open C:\Users\david\AppData\Local\Microsoft\WindowsApps\ms-teamsupdate.exe
2025-10-12 20:59:14.818 Could not open C:\Users\david\AppData\Local\Microsoft\WindowsApps\ms-teams_autostarter.exe
2025-10-12 20:59:14.819 Could not open C:\Users\david\AppData\Local\Microsoft\WindowsApps\ms-teams_modulehost_ac.exe
2025-10-12 20:59:14.819 Could not open C:\Users\david\AppData\Local\Microsoft\WindowsApps\mspaint.exe
2025-10-12 20:59:14.820 Could not open C:\Users\david\AppData\Local\Microsoft\WindowsApps\MSTeams_8wekyb3d8bbwe\ms-teams.exe
2025-10-12 20:59:14.820 Could not open C:\Users\david\AppData\Local\Microsoft\WindowsApps\MSTeams_8wekyb3d8bbwe\ms-teamsupdate.exe
2025-10-12 20:59:14.820 Could not open C:\Users\david\AppData\Local\Microsoft\WindowsApps\MSTeams_8wekyb3d8bbwe\ms-teams_autostarter.exe
2025-10-12 20:59:14.821 Could not open C:\Users\david\AppData\Local\Microsoft\WindowsApps\MSTeams_8wekyb3d8bbwe\ms-teams_modulehost_ac.exe
2025-10-12 20:59:14.821 Could not open C:\Users\david\AppData\Local\Microsoft\WindowsApps\notepad.exe
2025-10-12 20:59:14.821 Could not open C:\Users\david\AppData\Local\Microsoft\WindowsApps\olk.exe
2025-10-12 20:59:14.821 Could not open C:\Users\david\AppData\Local\Microsoft\WindowsApps\PAD.BrowserNativeMessageHost.exe
2025-10-12 20:59:14.821 Could not open C:\Users\david\AppData\Local\Microsoft\WindowsApps\PAD.ChildSession.Service.Host.exe
2025-10-12 20:59:14.821 Could not open C:\Users\david\AppData\Local\Microsoft\WindowsApps\pbrush.exe
2025-10-12 20:59:14.821 Could not open C:\Users\david\AppData\Local\Microsoft\WindowsApps\python.exe
2025-10-12 20:59:14.822 Could not open C:\Users\david\AppData\Local\Microsoft\WindowsApps\python3.exe
2025-10-12 20:59:14.822 Could not open C:\Users\david\AppData\Local\Microsoft\WindowsApps\SnippingTool.exe
2025-10-12 20:59:14.822 Could not open C:\Users\david\AppData\Local\Microsoft\WindowsApps\WindowsPackageManagerServer.exe
2025-10-12 20:59:14.822 Could not open C:\Users\david\AppData\Local\Microsoft\WindowsApps\winget.exe
2025-10-12 20:59:14.822 Could not open C:\Users\david\AppData\Local\Microsoft\WindowsApps\wt.exe
2025-10-12 20:59:14.822 Could not open C:\Users\david\AppData\Local\Microsoft\WindowsApps\XboxPcAppAdminServer.exe
2025-10-12 20:59:14.823 Could not open C:\Users\david\AppData\Local\Microsoft\WindowsApps\XboxPcAppCE.exe
2025-10-12 20:59:16.117 Could not open C:\Users\david\AppData\Local\NVIDIA Corporation\NVIDIA Overlay\CefCache\Default\Network\Cookies
2025-10-12 20:59:19.993 Could not open C:\Users\david\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\LocalState\EBWebView\Default\Network\Cookies
2025-10-12 20:59:19.993 Could not open C:\Users\david\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\LocalState\EBWebView\Default\Network\Cookies-journal
2025-10-12 20:59:20.013 Could not open C:\Users\david\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\LocalState\EBWebView\Default\Safe Browsing Network\Safe Browsing Cookies
2025-10-12 21:01:33.533 Could not open C:\Windows\System32\catroot2\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}\catdb
2025-10-12 21:01:33.534 Could not open C:\Windows\System32\catroot2\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\catdb
2025-10-12 21:01:47.685 Could not open C:\Windows\System32\config\BBI
2025-10-12 21:01:47.816 Could not open C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\WindowsApps\ActionsMcpHost.exe
2025-10-12 21:01:47.817 Could not open C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\WindowsApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\ActionsMcpHost.exe
2025-10-12 21:01:47.817 Could not open C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\WindowsApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MicrosoftWindows.DesktopStickerEditorCentennial.exe
2025-10-12 21:01:47.817 Could not open C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\WindowsApps\MicrosoftWindows.DesktopStickerEditorCentennial.exe
2025-10-12 21:25:51.987 Error level 0

2025-10-12 21:34:46.352 Scan completed.
2025-10-12 21:34:46.352

------------------------------------------------------------



log Roguekiller:

Program : RogueKillerSVC
Version : 3.4.1.0
x64 : Yes
Program Date : Oct 3 2025
Location : C:\Program Files\RogueKiller\RogueKillerSvc.exe
Premium : No
Company : Adlice Software
Website : https://www.adlice.com/
Operating System : Windows 11 (10.0.26100) 64-bit
64-bit OS : Yes
Startup : 0
WindowsPE : No
User : david
User is Admin : Yes
Date : 2025/10/12 21:38:36
Type : Scan
Aborted : No
Scan Mode : Standard
Duration : 72
Found items : 1
Total scanned : 53558
removed_count : 0
Signatures Version : 20251006_124525
Truesight Driver : Yes
Updates Count : 10
Custom Locations : N/A

************************* Warnings *************************

************************* Updates *************************
WinRAR 7.11 (64-bit) (64-bit), version 7.11.0
[+] Company : Alexander Roshal
[+] Available Version : 7.13
[+] Size : 0
[+] Wow6432 : No
[+] Portable : No
[+] update_location : C:\Program Files\WinRAR

Google Chrome (64-bit), version 141.0.7390.66
[+] Company : Google Inc.
[+] Available Version : 141.0.7390.77
[+] Size : 0
[+] Wow6432 : No
[+] Portable : No
[+] update_location : C:\Program Files\Google\Chrome\Application

kdenlive (64-bit), version 25.08.1
[+] Company : KDE
[+] Available Version : 25.08.2
[+] Size : 126267392
[+] Wow6432 : No
[+] Portable : No

LM Studio 0.3.27 (64-bit), version 0.3.27
[+] Company : LM Studio
[+] Available Version : 0.3.30
[+] Size : 1775286272
[+] Wow6432 : No
[+] Portable : No

Oculus (64-bit), version 1.103.0
[+] Company : Facebook Technologies, LLC
[+] Available Version : 3
[+] Size : 0
[+] Wow6432 : No
[+] Portable : No
[+] update_location : C:\Program Files\Oculus\

Unity Hub 3.14.0 (64-bit), version 3.14.0
[+] Company : Unity Technologies Inc.
[+] Available Version : 3.14.3
[+] Size : 530195456
[+] Wow6432 : No
[+] Portable : No

AMD Install Manager (64-bit), version 25.10.25237.0452
[+] Company : Advanced Micro Devices, Inc.
[+] Available Version : 25.10.25259.1500
[+] Size : 60430336
[+] Wow6432 : No
[+] Portable : No

AMD Chipset Software (32-bit), version 7.06.24.2226
[+] Company : Advanced Micro Devices, Inc.
[+] Available Version : 7.09.23.2230
[+] Size : 15903744
[+] Wow6432 : Yes
[+] Portable : No

Any Video Converter 7.0.3 (32-bit), version 7.0.3
[+] Company : Anvsoft
[+] Available Version : 9.1.4
[+] Size : 0
[+] Wow6432 : Yes
[+] Portable : No

Battlefield 1 (64-bit), version 1.0.0.0
[+] Company : Electronic Arts, Inc.
[+] Available Version : 1.0.57.44284
[+] Size : 0
[+] Wow6432 : No
[+] Portable : No
[+] update_location : D:\Program Files (x86)\Steam\steamapps\common\Battlefield 1


************************* Processes *************************

************************* Modules *************************

************************* Services *************************

************************* Scheduled Tasks *************************

************************* Registry *************************

************************* WMI *************************

************************* Hosts File *************************
is_too_big : No
hosts_file_path : C:\Windows\System32\drivers\etc\hosts


************************* Filesystem *************************
[MalPE.99|Cloud.Generic (Malicious)] (file) TFC.exe -- C:\Users\david\Desktop\TFC.exe -> Found

************************* Web Browsers *************************

************************* Antirootkit *************************

V HJT fixni tuto položku:
O4 - HKCU\..\Run: [david] cmd.exe /c start www.rongronger.click

Vypni antivir i firewall, RogueKiller, Malwarebytes Antimalware, windowsDefender
Stáhni zoek:
ttps://datoid.cz/zhmnlC/zoek-1-exe

Zavři všechny ostatní programy , okna i prohlížeče.
Spusť Zoek.exe ( u win vista , win7, 8 klikni na něj pravým a vyber : „Spustit jako správce“
-pozor , náběh programu může trvat déle.
Do okna programu vlož skript níže:

klikni na Run Script
Program provede sken , opravu, sken i oprava může trvat i více minut ,je třeba posečkat do konce. Do okna neklikej!
Program nabídne restart , potvrď .
Po restartu se může nějaký čas ukázat pouze černá plocha , to je normální. Je třeba počkat až se vytvoří log. Ten si můžeš uložit třeba do dokumentů , jinak se sám ukládá do:
C:\zoek-results.log Zkopíruj sem celý obsah toho logu.
Pokud budou problémy , spusť zoek v nouz. režimu.

Stáhni si Zemana AntiMalware Free z tohoto odkazu:
https://www.zemana.com/Download/AntiMal ... .Setup.exe

(posuvník dolu na download)
a ulož si ho na plochu.
Poklepej na tento soubor na ploše a postupuj podle pokynů k instalaci programu.
Přijmi licenci k používání programu EULA , pokud se nabídne.
Pokud je k dispozici aktualizace programu , klepni na tlačítko „Update now“ ( aktualizovat nyní).
Zavři všechny otevřené soubory, složky a prohlížeče
Neměň žádné nastavení. Klikni na „Skenovat nyní“.
Po skenu lze vidět , zda jsou nějaké nákazy. Klikni na „Vykonat“ ( vymazat). Nákazy budou přemístěny do karantény.
Když je skenování dokončeno, klikni vlevo na „zprávy“ a pak na „otevři zprávu“ a zkopíruj sem celý obsah té zprávy.

Při problémech se Zemana:
https://learn.microsoft.com/en-us/answe ... om-loading