Kontrola logu Vyřešeno

[sisik]

Zdravím,
prosím o kontrolu logu. Poslední dobou se počítač seká a zamrzává. Děkuji moc.

log z Hijackthis:

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 11:41:52, on 18.5.2014
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Internet Explorer v9.00 (9.00.8112.16545)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskeng.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\System32\igfxpers.exe
C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe
C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
C:\Program Files\DivX\DivX Update\DivXUpdate.exe
C:\Program Files\AVAST Software\Avast\avastui.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\McAfee Security Scan\3.8.141\SSScheduler.exe
C:\Windows\system32\igfxsrvc.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Motorola\Bluetooth\btplayerctrl.exe
C:\Windows\system32\conime.exe
C:\Windows\System32\mobsync.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_13_0_0_214.exe
C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_13_0_0_214.exe
c:\Users\Katka\Downloads\HiJackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R3 - URLSearchHook: UrlSearchHook Class - {00000000-6E41-4FD3-8538-502F5495E5FC} - C:\Program Files\Ask.com\GenericAskToolbar.dll
R3 - URLSearchHook: DivX Browser Bar Toolbar - {77e8143b-6759-416e-b521-82cfed75150b} - C:\Program Files\DivX_Browser_Bar\prxtbDivX.dll
O2 - BHO: MSS+ Identifier - {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} - C:\Program Files\McAfee Security Scan\3.8.141\McAfeeMSS_IE.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll
O2 - BHO: DivX Browser Bar - {77e8143b-6759-416e-b521-82cfed75150b} - C:\Program Files\DivX_Browser_Bar\prxtbDivX.dll
O2 - BHO: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Windows Live Messenger Companion Helper - {9FDDE16B-836F-4806-AB1F-1455CBEFF289} - C:\Program Files\Windows Live\Companion\companioncore.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll
O3 - Toolbar: DivX Browser Bar Toolbar - {77e8143b-6759-416e-b521-82cfed75150b} - C:\Program Files\DivX_Browser_Bar\prxtbDivX.dll
O3 - Toolbar: avast! Online Security - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [SMSERIAL] C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe
O4 - HKLM\..\Run: [IAStorIcon] C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
O4 - HKLM\..\Run: [BTMTrayAgent] rundll32.exe "C:\Program Files\Motorola\Bluetooth\btmshell.dll",TrayApp
O4 - HKLM\..\Run: [RTHDVCPL] C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe -s
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [DivXMediaServer] C:\Program Files\DivX\DivX Media Server\DivXMediaServer.exe
O4 - HKLM\..\Run: [DivXUpdate] "C:\Program Files\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW
O4 - HKLM\..\Run: [AvastUI.exe] "C:\Program Files\AVAST Software\Avast\AvastUI.exe" /nogui
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - Global Startup: McAfee Security Scan Plus.lnk = C:\Program Files\McAfee Security Scan\3.8.141\SSScheduler.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Office Excel - res://D:\programy\office\MSOFFI~1\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Převést cíl vazby do Adobe PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\WCIEActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Převést do Adobe PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\WCIEActiveX\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Připojit cíl vazby k existujícímu PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\WCIEActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Připojit k existujícímu PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\WCIEActiveX\AcroIEFavClient.dll/AcroIEAppend.html
O9 - Extra button: @C:\Program Files\Windows Live\Companion\companionlang.dll,-600 - {0000036B-C524-4050-81A0-243669A86B9F} - C:\Program Files\Windows Live\Companion\companioncore.dll
O9 - Extra button: @C:\Program Files\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1004 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: @C:\Program Files\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1003 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - D:\programy\ICQ7.2\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - D:\programy\ICQ7.2\ICQ.exe
O9 - Extra button: @C:\Program Files\Motorola\Bluetooth\btmshell.dll,-247 - {bd707fe6-39f6-4bda-9265-86a76719bdc5} - C:\Program Files\Motorola\Bluetooth\btmiesend.htm
O9 - Extra 'Tools' menuitem: @C:\Program Files\Motorola\Bluetooth\btmshell.dll,-247 - {bd707fe6-39f6-4bda-9265-86a76719bdc5} - C:\Program Files\Motorola\Bluetooth\btmiesend.htm
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Protocol: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\Windows\system32\browseui.dll
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: ADSM Service (ADSMService) - Unknown owner - C:\Program Files\ASUS\ASUS Data Security Manager\ADSMSrv.exe
O23 - Service: ASLDR Service (ASLDRService) - Unknown owner - C:\Program Files\ATK Hotkey\ASLDRSrv.exe
O23 - Service: ATKGFNEX Service (ATKGFNEXSrv) - Unknown owner - C:\Program Files\ATKGFNEX\GFNEXSrv.exe
O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\AVAST Software\Avast\AvastSvc.exe
O23 - Service: Bluetooth Device Manager - Motorola, Inc. - C:\Program Files\Motorola\Bluetooth\devmgrsrv.exe
O23 - Service: Bluetooth Media Service - Motorola, Inc. - C:\Program Files\Motorola\Bluetooth\audiosrv.exe
O23 - Service: Bluetooth OBEX Service - Motorola, Inc. - C:\Program Files\Motorola\Bluetooth\obexsrv.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Služba Google Update (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Služba Google Update (gupdatem) (gupdatem) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Úložná technologie Intel(R) Rapid (IAStorDataMgrSvc) - Intel Corporation - C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: McAfee Security Scan Component Host Service (McComponentHostService) - McAfee, Inc. - C:\Program Files\McAfee Security Scan\3.8.141\McCHSvc.exe
O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe
O23 - Service: Skype Updater (SkypeUpdate) - Skype Technologies - C:\Program Files\Skype\Updater\Updater.exe

--
End of file - 9465 bytes

[Reklama]

[Orcus]

Stáhni si ATF Cleaner
Poklepej na ATF Cleaner.exe, klikni na select all found, poté:
-Když používáš Firefox (Mozzila), klikni na Firefox nahoře a vyber: Select All, poté klikni na Empty Selected.
-Když používáš Operu, klikni nahoře na Operu a vyber: Select All, poté klikni na Empty Selected. Poté klikni na Main (hlavní stránku ) a klikni na Empty Selected.
Po vyčištění klikni na Exit k zavření programu.
ATF-Cleaner je jednoduchý nástroj na odstranění historie z webového prohlížeče. Program dokáže odstranit cache, cookies, historii a další stopy po surfování na Internetu. Mezi podporované prohlížeče patří Internet Explorer, Firefox a Opera. Aplikace navíc umí odstranit dočasné soubory Windows, vysypat koš atd.

- Pokud používáš jen Google Chrome , tak ATF nemusíš použít.

===================================================

Stáhni si TFC
Otevři soubor a zavři všechny ostatní okna, Klikni na Start k zahájení procesu. Program by neměl trvat dlouho.
Poté by se měl PC restartovat, pokud ne , proveď sám.

===================================================

Stáhni AdwCleaner (by Xplode)

Ulož si ho na svojí plochu
Ukonči všechny programy , okna a prohlížeče
Spusť program poklepáním a klikni na „Prohledat-Scan“
Po skenu se objeví log ( jinak je uložen systémovem disku jako AdwCleaner[R?].txt), jeho obsah sem celý vlož.

===================================================

Stáhni si Malwarebytes' Anti-Malware
- Při instalaci odeber zatržítko u „Povolit bezplatnou zkušební verzi Malwarebytes' Anti-Malware Premium“
Nainstaluj a spusť ho
- na konci instalace se ujisti že máš zvoleny/zatrhnuty obě možnosti:
Aktualizace Malwarebytes' Anti-Malware a Spustit aplikaci Malwarebytes' Anti-Malware, pokud jo tak klikni na tlačítko konec
- pokud bude nalezena aktualizace, tak se stáhne a nainstaluje
- program se po té spustí a klikni na Skenovat nyní a
- po proběhnutí programu se ti objeví hláška vpravo dole tak klikni na b] Kopírovat do schránky [/b]a a vlož sem celý log.

- po té klikni na tlačítko Exit, objeví se ti hláška tak zvol Ano
(zatím nic nemaž!).

Pokud budou problémy , spusť v nouz. režimu.

[sisik]

Log z AdwCleaner:

# AdwCleaner v3.208 - Report created 18/05/2014 at 12:14:56
# Updated 11/05/2014 by Xplode
# Operating System : Windows Vista (TM) Home Premium Service Pack 2 (32 bits)
# Username : Katka - KATKA-PC
# Running from : C:\Users\Katka\Downloads\AdwCleaner.exe
# Option : Scan

***** [ Services ] *****


***** [ Files / Folders ] *****

File Found : C:\END
File Found : C:\Program Files\Mozilla Firefox\browser\nsprotector.js
File Found : C:\Users\Katka\AppData\Roaming\Mozilla\Firefox\Profiles\4ps0mrbt.default-1384707640875\searchplugins\ask-web-search.xml
File Found : C:\Users\Katka\AppData\Roaming\Mozilla\Firefox\Profiles\4ps0mrbt.default-1384707640875\searchplugins\conduit-search.xml
File Found : C:\Users\Katka\daemonprocess.txt
File Found : C:\Windows\System32\Tasks\Scheduled Update for Ask Toolbar
Folder Found : C:\Program Files\Ask.com
Folder Found : C:\Program Files\Conduit
Folder Found : C:\Program Files\DivX_Browser_Bar
Folder Found : C:\Program Files\GreenTree Applications
Folder Found : C:\ProgramData\Ask
Folder Found : C:\ProgramData\Conduit
Folder Found : C:\ProgramData\Uniblue
Folder Found : C:\ProgramData\Uniblue\DriverScanner
Folder Found : C:\SearchProtect
Folder Found : C:\Users\Katka\AppData\Local\genienext
Folder Found : C:\Users\Katka\AppData\Local\Mobogenie
Folder Found : C:\Users\Katka\AppData\Local\SearchProtect
Folder Found : C:\Users\Katka\AppData\LocalLow\AskToolbar
Folder Found : C:\Users\Katka\AppData\LocalLow\Conduit
Folder Found : C:\Users\Katka\AppData\LocalLow\DivX_Browser_Bar
Folder Found : C:\Users\Katka\AppData\Roaming\Mozilla\Firefox\Profiles\4ps0mrbt.default-1384707640875\Allin1Convert_8h
Folder Found : C:\Users\Katka\AppData\Roaming\Mozilla\Firefox\Profiles\4ps0mrbt.default-1384707640875\Extensions\65ffxtbr@FromDocToPDF_65.com
Folder Found : C:\Users\Katka\AppData\Roaming\Mozilla\Firefox\Profiles\4ps0mrbt.default-1384707640875\FromDocToPDF_65
Folder Found : C:\Users\Katka\AppData\Roaming\Mozilla\Firefox\Profiles\4ps0mrbt.default-1384707640875\VideoDownloadConverter_4z
Folder Found : C:\Users\Katka\AppData\Roaming\SearchProtect
Folder Found : C:\Users\Katka\Documents\Mobogenie
Folder Found : C:\Windows\installer\{86d4b82a-abed-442a-be86-96357b70f4fe}
Folder Found : C:\Windows\system32\SearchProtect

***** [ Shortcuts ] *****


***** [ Registry ] *****

Key Found : HKCU\Software\APN
Key Found : HKCU\Software\APN PIP
Key Found : HKCU\Software\AppDataLow\Software\AskToolbar
Key Found : HKCU\Software\AppDataLow\Software\Conduit
Key Found : HKCU\Software\AppDataLow\Software\ConduitSearchScopes
Key Found : HKCU\Software\AppDataLow\Software\DivX_Browser_Bar
Key Found : HKCU\Software\AppDataLow\Software\SmartBar
Key Found : HKCU\Software\AppDataLow\Toolbar
Key Found : HKCU\Software\Ask.com
Key Found : HKCU\Software\Conduit
Key Found : HKCU\Software\ICQ\ICQToolbar
Key Found : HKCU\Software\Microsoft\Internet Explorer\LowRegistry\ICQ\ICQToolBar
Key Found : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{014DB5FA-EAFB-4592-A95B-F44D3EE87FA9}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\{79A765E1-C399-405B-85AF-466F52E918B0}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\{86D4B82A-ABED-442A-BE86-96357B70F4FE}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\{C2F8CA82-2BD9-4513-B2D1-08A47914C1DA}_is1
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\Mobogenie
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\SearchProtect
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{77E8143B-6759-416E-B521-82CFED75150B}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{D4027C7F-154A-4066-A1AD-4243D8127440}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{77E8143B-6759-416E-B521-82CFED75150B}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{D4027C7F-154A-4066-A1AD-4243D8127440}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\{79A765E1-C399-405B-85AF-466F52E918B0}
Key Found : HKCU\Software\YahooPartnerToolbar
Key Found : HKLM\Software\APN
Key Found : HKLM\Software\AskToolbar
Key Found : HKLM\SOFTWARE\Classes\AppID\{9B0CB95C-933A-4B8C-B6D4-EDCD19A43874}
Key Found : HKLM\SOFTWARE\Classes\AppID\GenericAskToolbar.DLL
Key Found : HKLM\SOFTWARE\Classes\CLSID\{00000000-6E41-4FD3-8538-502F5495E5FC}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{77E8143B-6759-416E-B521-82CFED75150B}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{DD937C23-9304-4E9E-9FD3-0E00B88E2C2E}
Key Found : HKLM\SOFTWARE\Classes\driverscanner
Key Found : HKLM\SOFTWARE\Classes\GenericAskToolbar.ToolbarWnd
Key Found : HKLM\SOFTWARE\Classes\GenericAskToolbar.ToolbarWnd.1
Key Found : HKLM\Software\Classes\Installer\Features\A28B4D68DEBAA244EB686953B7074FEF
Key Found : HKLM\Software\Classes\Installer\Products\A28B4D68DEBAA244EB686953B7074FEF
Key Found : HKLM\SOFTWARE\Classes\Interface\{6C434537-053E-486D-B62A-160059D9D456}
Key Found : HKLM\SOFTWARE\Classes\Interface\{91CF619A-4686-4CA4-9232-3B2E6B63AA92}
Key Found : HKLM\SOFTWARE\Classes\Interface\{AC71B60E-94C9-4EDE-BA46-E146747BB67E}
Key Found : HKLM\SOFTWARE\Classes\Toolbar.CT3288691
Key Found : HKLM\SOFTWARE\Classes\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}
Key Found : HKLM\Software\Conduit
Key Found : HKLM\Software\DivX\Install\Setup\WizardLayout\ConduitToolbar
Key Found : HKLM\Software\DivX_Browser_Bar
Key Found : HKLM\SOFTWARE\Google\Chrome\Extensions\aaaaojmikegpiepcfdkkjaplodkpfmlo
Key Found : HKLM\SOFTWARE\Google\Chrome\Extensions\bopakagnckmlgajfccecajhnimjiiedh
Key Found : HKLM\Software\ICQ\ICQToolbar
Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5AA24EA-11B8-4113-95AE-9ED71DEAF12A}
Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{B5237CD5-1550-4B61-ADA1-EF84BB335BDB}
Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C2490360-E03F-42D0-95F6-09D95E52399D}
Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{014DB5FA-EAFB-4592-A95B-F44D3EE87FA9}
Key Found : HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\ApnUpdater
Key Found : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{40791C9E-5FCD-459F-BFE1-7170BDAD4B1B}
Key Found : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{40791C9E-5FCD-459F-BFE1-7170BDAD4B1B}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\MobogenieAdd
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{77E8143B-6759-416E-B521-82CFED75150B}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{DD937C23-9304-4E9E-9FD3-0E00B88E2C2E}
Key Found : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UpgradeCodes\F928123A039649549966D4C29D35B1C9
Key Found : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\08121C32A9C319F4CB0C11FF059552A4
Key Found : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0CFE535C35F99574E8340BFA75BF92C2
Key Found : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0E12F736682067FDE4D1158D5940A82E
Key Found : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1A24B5BB8521B03E0C8D908F5ABC0AE6
Key Found : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\261F213D1F55267499B1F87D0CC3BCF7
Key Found : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\2B0D56C4F4C46D844A57FFED6F0D2852
Key Found : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\49D4375FE41653242AEA4C969E4E65E0
Key Found : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6AA0923513360135B272E8289C5F13FA
Key Found : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6F7467AF8F29C134CBBAB394ECCFDE96
Key Found : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\741B4ADF27276464790022C965AB6DA8
Key Found : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\7DE196B10195F5647A2B21B761F3DE01
Key Found : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\922525DCC5199162F8935747CA3D8E59
Key Found : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\9D4F5849367142E4685ED8C25E44C5ED
Key Found : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A5875B04372C19545BEB90D4D606C472
Key Found : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A876D9E80B896EC44A8620248CC79296
Key Found : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\B66FFAB725B92594C986DE826A867888
Key Found : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\BCDA179D619B91648538E3394CAC94CC
Key Found : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D677B1A9671D4D4004F6F2A4469E86EA
Key Found : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\DD1402A9DD4215A43ABDE169A41AFA0E
Key Found : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\E36E114A0EAD2AD46B381D23AD69CDDF
Key Found : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\EF8E618DB3AEDFBB384561B5C548F65E
Key Found : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\A28B4D68DEBAA244EB686953B7074FEF
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{86D4B82A-ABED-442A-BE86-96357B70F4FE}
Key Found : HKLM\Software\PIP
Key Found : HKLM\Software\SearchProtect
Key Found : HKLM\Software\Speedchecker Limited
Key Found : HKLM\Software\Uniblue
Value Found : HKCU\Software\Microsoft\Internet Explorer\Main [ICQ Search]
Value Found : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{77E8143B-6759-416E-B521-82CFED75150B}]
Value Found : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks [{00000000-6E41-4FD3-8538-502F5495E5FC}]
Value Found : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks [{77E8143B-6759-416E-B521-82CFED75150B}]
Value Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{77E8143B-6759-416E-B521-82CFED75150B}]
Value Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks [{77E8143B-6759-416E-B521-82CFED75150B}]

***** [ Browsers ] *****

-\\ Internet Explorer v9.0.8112.16545


-\\ Mozilla Firefox v29.0.1 (cs)

[ File : C:\Users\Katka\AppData\Roaming\Mozilla\Firefox\Profiles\4ps0mrbt.default-1384707640875\prefs.js ]

Line Found : user_pref("browser.newtab.url", "hxxp://www.trovigo.com/?gd=&ctid=CT3314958&octid=EB_ORIGINAL_CTID&SearchSource=69&CUI=&SSPV=&Lay=1&UM=4&UP=SPF16438FE-611E-4794-A73F-FABB79B4C3AF");
Line Found : user_pref("extensions.toolbar.mindspark._4zMembers_.BUTTON_STRUCTURE", "[{\"b\":221584481,\"c\":\"mindspark.magnify\",\"p\":\"L.0\"},{\"b\":221584482,\"c\":\"mindspark.entersearchterms\",\"p\":\"L.0.0[...]
Line Found : user_pref("extensions.toolbar.mindspark._4zMembers_.firstKnownVersion", "5.75.3.8617");
Line Found : user_pref("extensions.toolbar.mindspark._4zMembers_.homepage", "hxxp://home.tb.ask.com/index.jhtml?ptb=ED3B650B-EA66-4EB7-B711-C4178DFC418B&n=780ba9e1&p2=^HJ^xdm073^YYA^cz&si=pconvFF");
Line Found : user_pref("extensions.toolbar.mindspark._4zMembers_.hp.user.defined", true);
Line Found : user_pref("extensions.toolbar.mindspark._4zMembers_.initialized", true);
Line Found : user_pref("extensions.toolbar.mindspark._4zMembers_.installKeysSource", "LocalStorage");
Line Found : user_pref("extensions.toolbar.mindspark._4zMembers_.installType", "XPI");
Line Found : user_pref("extensions.toolbar.mindspark._4zMembers_.installation.contextKey", "");
Line Found : user_pref("extensions.toolbar.mindspark._4zMembers_.installation.installDate", "2014030305");
Line Found : user_pref("extensions.toolbar.mindspark._4zMembers_.installation.partnerId", "^HJ^xdm073^YYA^cz");
Line Found : user_pref("extensions.toolbar.mindspark._4zMembers_.installation.partnerSubId", "pconvFF");
Line Found : user_pref("extensions.toolbar.mindspark._4zMembers_.installation.pixelUrl", "hxxp://videodownloadconverter.dl.tb.ask.com/install_pixels.jhtml?partner=^HJ^xdm073^YYA^cz&coId=a4a679511daa4e97b7ca900e1fd[...]
Line Found : user_pref("extensions.toolbar.mindspark._4zMembers_.installation.success", true);
Line Found : user_pref("extensions.toolbar.mindspark._4zMembers_.installation.toolbarId", "ED3B650B-EA66-4EB7-B711-C4178DFC418B");
Line Found : user_pref("extensions.toolbar.mindspark._4zMembers_.isCompliantUninstallImplementation", true);
Line Found : user_pref("extensions.toolbar.mindspark._4zMembers_.lastActivePing", "1400398122472");
Line Found : user_pref("extensions.toolbar.mindspark._4zMembers_.lastKnownVersion", "6.33.3.58478");
Line Found : user_pref("extensions.toolbar.mindspark._4zMembers_.options.defaultSearch", false);
Line Found : user_pref("extensions.toolbar.mindspark._4zMembers_.options.homePageEnabled", false);
Line Found : user_pref("extensions.toolbar.mindspark._4zMembers_.options.keywordEnabled", false);
Line Found : user_pref("extensions.toolbar.mindspark._4zMembers_.options.tabEnabled", false);
Line Found : user_pref("extensions.toolbar.mindspark._4zMembers_.partnerPixelFired", true);
Line Found : user_pref("extensions.toolbar.mindspark._4zMembers_.toolbarCollapsed", true);
Line Found : user_pref("extensions.toolbar.mindspark._4zMembers_.weather.location", "10001");
Line Found : user_pref("extensions.toolbar.mindspark._65Members_.BUTTON_STRUCTURE", "[{\"b\":221359615,\"c\":\"mindspark.magnify\",\"p\":\"L.0\"},{\"b\":221359616,\"c\":\"mindspark.entersearchterms\",\"p\":\"L.0.0[...]
Line Found : user_pref("extensions.toolbar.mindspark._65Members_.firstKnownVersion", "5.79.3.12693");
Line Found : user_pref("extensions.toolbar.mindspark._65Members_.homepage", "hxxp://home.tb.ask.com/index.jhtml?ptb=79220D45-831E-4414-96E4-EF47CCF778B5&n=780ba9e1&p2=^Y6^xdm039^YYA^cz&si=swissconverter");
Line Found : user_pref("extensions.toolbar.mindspark._65Members_.hp.user.defined", true);
Line Found : user_pref("extensions.toolbar.mindspark._65Members_.initialized", true);
Line Found : user_pref("extensions.toolbar.mindspark._65Members_.installKeysSource", "LocalStorage");
Line Found : user_pref("extensions.toolbar.mindspark._65Members_.installType", "XPI");
Line Found : user_pref("extensions.toolbar.mindspark._65Members_.installation.contextKey", "");
Line Found : user_pref("extensions.toolbar.mindspark._65Members_.installation.installDate", "2014030305");
Line Found : user_pref("extensions.toolbar.mindspark._65Members_.installation.partnerId", "^Y6^xdm039^YYA^cz");
Line Found : user_pref("extensions.toolbar.mindspark._65Members_.installation.partnerSubId", "swissconverter");
Line Found : user_pref("extensions.toolbar.mindspark._65Members_.installation.pixelUrl", "hxxp://fromdoctopdf.dl.tb.ask.com/install_pixels.jhtml?partner=^Y6^xdm039^YYA^cz&coId=6fbc282845cd4e43a06af62081a2f546&cake[...]
Line Found : user_pref("extensions.toolbar.mindspark._65Members_.installation.success", true);
Line Found : user_pref("extensions.toolbar.mindspark._65Members_.installation.toolbarId", "79220D45-831E-4414-96E4-EF47CCF778B5");
Line Found : user_pref("extensions.toolbar.mindspark._65Members_.isCompliantUninstallImplementation", true);
Line Found : user_pref("extensions.toolbar.mindspark._65Members_.lastActivePing", "1400398122485");
Line Found : user_pref("extensions.toolbar.mindspark._65Members_.lastKnownVersion", "6.33.3.63617");
Line Found : user_pref("extensions.toolbar.mindspark._65Members_.options.defaultSearch", false);
Line Found : user_pref("extensions.toolbar.mindspark._65Members_.options.homePageEnabled", false);
Line Found : user_pref("extensions.toolbar.mindspark._65Members_.options.keywordEnabled", false);
Line Found : user_pref("extensions.toolbar.mindspark._65Members_.options.tabEnabled", false);
Line Found : user_pref("extensions.toolbar.mindspark._65Members_.partnerPixelFired", true);
Line Found : user_pref("extensions.toolbar.mindspark._65Members_.toolbarCollapsed", true);
Line Found : user_pref("extensions.toolbar.mindspark._65Members_.weather.location", "10001");
Line Found : user_pref("extensions.toolbar.mindspark._8hMembers_.lastActivePing", "1394918843963");
Line Found : user_pref("extensions.toolbar.mindspark._8hMembers_.weather.location", "10001");
Line Found : user_pref("extensions.toolbar.mindspark.hp.enabled", false);
Line Found : user_pref("extensions.toolbar.mindspark.hp.enabled.guid", "");
Line Found : user_pref("extensions.toolbar.mindspark.lastInstalled", "allin1convert@mindspark.com");

-\\ Google Chrome v34.0.1847.137

[ File : C:\Users\Katka\AppData\Local\Google\Chrome\User Data\Default\preferences ]

Found [Search Provider] : hxxp://www.trovigo.com/Results.aspx?gd= ... 9B4C3AF&q={searchTerms}&SSPV=
Found [Startup_urls] : hxxp://www.trovigo.com/?gd=&ctid=CT3314 ... C3AF&SSPV=
Found [Homepage] : hxxp://www.trovigo.com/?gd=&ctid=CT3314 ... C3AF&SSPV=

*************************

AdwCleaner[R0].txt - [17987 octets] - [18/05/2014 12:14:57]

########## EOF - C:\AdwCleaner\AdwCleaner[R0].txt - [18048 octets] ##########

[sisik]

Log z Malwarebytes:

Malwarebytes Anti-Malware
www.malwarebytes.org

Scan Date: 18.5.2014
Scan Time: 12:47:13
Logfile:
Administrator: Yes

Version: 2.00.1.1004
Malware Database: v2014.05.18.02
Rootkit Database: v2014.03.27.01
License: Trial
Malware Protection: Enabled
Malicious Website Protection: Enabled
Chameleon: Disabled

OS: Windows Vista Service Pack 2
CPU: x86
File System: NTFS
User: Katka

Scan Type: Threat Scan
Result: Completed
Objects Scanned: 242976
Time Elapsed: 22 min, 37 sec

Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Shuriken: Enabled
PUP: Enabled
PUM: Enabled

Processes: 0
(No malicious items detected)

Modules: 0
(No malicious items detected)

Registry Keys: 0
(No malicious items detected)

Registry Values: 0
(No malicious items detected)

Registry Data: 0
(No malicious items detected)

Folders: 11
PUP.Optional.MindSpark.A, C:\Users\Katka\AppData\Roaming\Mozilla\Firefox\Profiles\4ps0mrbt.default-1384707640875\extensions\4zffxtbr@VideoDownloadConverter_4z.com, , [59812f23ff7c3ff70ffc91e8db277888],
PUP.Optional.MindSpark.A, C:\Users\Katka\AppData\Roaming\Mozilla\Firefox\Profiles\4ps0mrbt.default-1384707640875\extensions\4zffxtbr@VideoDownloadConverter_4z.com\chrome, , [59812f23ff7c3ff70ffc91e8db277888],
PUP.Optional.MindSpark.A, C:\Users\Katka\AppData\Roaming\Mozilla\Firefox\Profiles\4ps0mrbt.default-1384707640875\extensions\4zffxtbr@VideoDownloadConverter_4z.com\META-INF, , [59812f23ff7c3ff70ffc91e8db277888],
PUP.Optional.MindSpark.A, C:\Users\Katka\AppData\Roaming\Mozilla\Firefox\Profiles\4ps0mrbt.default-1384707640875\extensions\4zffxtbr@VideoDownloadConverter_4z.com\plugins, , [59812f23ff7c3ff70ffc91e8db277888],
PUP.Optional.MindSpark.A, C:\Users\Katka\AppData\Roaming\Mozilla\Firefox\Profiles\4ps0mrbt.default-1384707640875\extensions\65ffxtbr@FromDocToPDF_65.com, , [7664c78b047788ae08db68129b67cc34],
PUP.Optional.MindSpark.A, C:\Users\Katka\AppData\Roaming\Mozilla\Firefox\Profiles\4ps0mrbt.default-1384707640875\extensions\65ffxtbr@FromDocToPDF_65.com\chrome, , [7664c78b047788ae08db68129b67cc34],
PUP.Optional.MindSpark.A, C:\Users\Katka\AppData\Roaming\Mozilla\Firefox\Profiles\4ps0mrbt.default-1384707640875\extensions\65ffxtbr@FromDocToPDF_65.com\META-INF, , [7664c78b047788ae08db68129b67cc34],
PUP.Optional.MindSpark.A, C:\Users\Katka\AppData\Roaming\Mozilla\Firefox\Profiles\4ps0mrbt.default-1384707640875\extensions\65ffxtbr@FromDocToPDF_65.com\plugins, , [7664c78b047788ae08db68129b67cc34],
PUP.Optional.MindSpark.A, C:\Users\Katka\AppData\Roaming\Mozilla\Firefox\Profiles\4ps0mrbt.default-1384707640875\Allin1Convert_8h, , [b723381a08732c0a9f8487f4d42e7987],
PUP.Optional.MindSpark.A, C:\Users\Katka\AppData\Roaming\Mozilla\Firefox\Profiles\4ps0mrbt.default-1384707640875\FromDocToPDF_65, , [cc0ebb9785f659dd38f4d2a93fc3768a],
PUP.Optional.MindSpark.A, C:\Users\Katka\AppData\Roaming\Mozilla\Firefox\Profiles\4ps0mrbt.default-1384707640875\VideoDownloadConverter_4z, , [617953ffc7b441f57ac7c4b78280b24e],

Files: 26
PUP.Optional.InstallCore.A, C:\Users\Katka\Downloads\IView428_setup - CHIP Downloader.exe, , [d60442103b40241231fd081e7094be42],
PUP.Optional.Conduit.A, C:\Users\Katka\AppData\Roaming\Mozilla\Firefox\Profiles\4ps0mrbt.default-1384707640875\searchplugins\conduit-search.xml, , [11c91939aecd71c5df5a2d65c53d49b7],
PUP.Optional.MindSpark.A, C:\Users\Katka\AppData\Roaming\Mozilla\Firefox\Profiles\4ps0mrbt.default-1384707640875\extensions\4zffxtbr@VideoDownloadConverter_4z.com\bootstrap.js, , [59812f23ff7c3ff70ffc91e8db277888],
PUP.Optional.MindSpark.A, C:\Users\Katka\AppData\Roaming\Mozilla\Firefox\Profiles\4ps0mrbt.default-1384707640875\extensions\4zffxtbr@VideoDownloadConverter_4z.com\chrome.manifest, , [59812f23ff7c3ff70ffc91e8db277888],
PUP.Optional.MindSpark.A, C:\Users\Katka\AppData\Roaming\Mozilla\Firefox\Profiles\4ps0mrbt.default-1384707640875\extensions\4zffxtbr@VideoDownloadConverter_4z.com\install.rdf, , [59812f23ff7c3ff70ffc91e8db277888],
PUP.Optional.MindSpark.A, C:\Users\Katka\AppData\Roaming\Mozilla\Firefox\Profiles\4ps0mrbt.default-1384707640875\extensions\4zffxtbr@VideoDownloadConverter_4z.com\install_no_bootstrap.rdf, , [59812f23ff7c3ff70ffc91e8db277888],
PUP.Optional.MindSpark.A, C:\Users\Katka\AppData\Roaming\Mozilla\Firefox\Profiles\4ps0mrbt.default-1384707640875\extensions\4zffxtbr@VideoDownloadConverter_4z.com\chrome\4zffxtbr.jar, , [59812f23ff7c3ff70ffc91e8db277888],
PUP.Optional.MindSpark.A, C:\Users\Katka\AppData\Roaming\Mozilla\Firefox\Profiles\4ps0mrbt.default-1384707640875\extensions\4zffxtbr@VideoDownloadConverter_4z.com\META-INF\manifest.mf, , [59812f23ff7c3ff70ffc91e8db277888],
PUP.Optional.MindSpark.A, C:\Users\Katka\AppData\Roaming\Mozilla\Firefox\Profiles\4ps0mrbt.default-1384707640875\extensions\4zffxtbr@VideoDownloadConverter_4z.com\META-INF\zigbert.rsa, , [59812f23ff7c3ff70ffc91e8db277888],
PUP.Optional.MindSpark.A, C:\Users\Katka\AppData\Roaming\Mozilla\Firefox\Profiles\4ps0mrbt.default-1384707640875\extensions\4zffxtbr@VideoDownloadConverter_4z.com\META-INF\zigbert.sf, , [59812f23ff7c3ff70ffc91e8db277888],
PUP.Optional.MindSpark.A, C:\Users\Katka\AppData\Roaming\Mozilla\Firefox\Profiles\4ps0mrbt.default-1384707640875\extensions\4zffxtbr@VideoDownloadConverter_4z.com\plugins\FF-NativeMessagingDispatcher.dll, , [59812f23ff7c3ff70ffc91e8db277888],
PUP.Optional.MindSpark.A, C:\Users\Katka\AppData\Roaming\Mozilla\Firefox\Profiles\4ps0mrbt.default-1384707640875\extensions\65ffxtbr@FromDocToPDF_65.com\bootstrap.js, , [7664c78b047788ae08db68129b67cc34],
PUP.Optional.MindSpark.A, C:\Users\Katka\AppData\Roaming\Mozilla\Firefox\Profiles\4ps0mrbt.default-1384707640875\extensions\65ffxtbr@FromDocToPDF_65.com\chrome.manifest, , [7664c78b047788ae08db68129b67cc34],
PUP.Optional.MindSpark.A, C:\Users\Katka\AppData\Roaming\Mozilla\Firefox\Profiles\4ps0mrbt.default-1384707640875\extensions\65ffxtbr@FromDocToPDF_65.com\install.rdf, , [7664c78b047788ae08db68129b67cc34],
PUP.Optional.MindSpark.A, C:\Users\Katka\AppData\Roaming\Mozilla\Firefox\Profiles\4ps0mrbt.default-1384707640875\extensions\65ffxtbr@FromDocToPDF_65.com\install_no_bootstrap.rdf, , [7664c78b047788ae08db68129b67cc34],
PUP.Optional.MindSpark.A, C:\Users\Katka\AppData\Roaming\Mozilla\Firefox\Profiles\4ps0mrbt.default-1384707640875\extensions\65ffxtbr@FromDocToPDF_65.com\chrome\65ffxtbr.jar, , [7664c78b047788ae08db68129b67cc34],
PUP.Optional.MindSpark.A, C:\Users\Katka\AppData\Roaming\Mozilla\Firefox\Profiles\4ps0mrbt.default-1384707640875\extensions\65ffxtbr@FromDocToPDF_65.com\META-INF\manifest.mf, , [7664c78b047788ae08db68129b67cc34],
PUP.Optional.MindSpark.A, C:\Users\Katka\AppData\Roaming\Mozilla\Firefox\Profiles\4ps0mrbt.default-1384707640875\extensions\65ffxtbr@FromDocToPDF_65.com\META-INF\zigbert.rsa, , [7664c78b047788ae08db68129b67cc34],
PUP.Optional.MindSpark.A, C:\Users\Katka\AppData\Roaming\Mozilla\Firefox\Profiles\4ps0mrbt.default-1384707640875\extensions\65ffxtbr@FromDocToPDF_65.com\META-INF\zigbert.sf, , [7664c78b047788ae08db68129b67cc34],
PUP.Optional.MindSpark.A, C:\Users\Katka\AppData\Roaming\Mozilla\Firefox\Profiles\4ps0mrbt.default-1384707640875\extensions\65ffxtbr@FromDocToPDF_65.com\plugins\FF-NativeMessagingDispatcher.dll, , [7664c78b047788ae08db68129b67cc34],
PUP.Optional.MindSpark.A, C:\Users\Katka\AppData\Roaming\Mozilla\Firefox\Profiles\4ps0mrbt.default-1384707640875\Allin1Convert_8h\3F56187A-CF8C-47EA-A2DA-4D153E93689A.sqlite, , [b723381a08732c0a9f8487f4d42e7987],
PUP.Optional.MindSpark.A, C:\Users\Katka\AppData\Roaming\Mozilla\Firefox\Profiles\4ps0mrbt.default-1384707640875\FromDocToPDF_65\79220D45-831E-4414-96E4-EF47CCF778B5.sqlite, , [cc0ebb9785f659dd38f4d2a93fc3768a],
PUP.Optional.MindSpark.A, C:\Users\Katka\AppData\Roaming\Mozilla\Firefox\Profiles\4ps0mrbt.default-1384707640875\VideoDownloadConverter_4z\ED3B650B-EA66-4EB7-B711-C4178DFC418B.sqlite, , [617953ffc7b441f57ac7c4b78280b24e],
PUP.Optional.Trovigo.A, C:\Users\Katka\AppData\Local\Google\Chrome\User Data\Default\Preferences, Good: (), Bad: ( "homepage": "http://www.trovigo.com/?gd=&ctid=CT3314958&octid=EB_ORIGINAL_CTID&SearchSource=55&CUI=&UM=4&UP=SPF16438FE-611E-4794-A73F-FABB79B4C3AF&SSPV=",), ,[92484a0890eba78f07ad98e14fb54db3]
PUP.Optional.Trovigo.A, C:\Users\Katka\AppData\Local\Google\Chrome\User Data\Default\Preferences, Good: (), Bad: ( "startup_urls": [ "http://www.trovigo.com/?gd=&ctid=CT3314958&octid=EB_ORIGINAL_CTID&SearchSource=55&CUI=&UM=4&UP=SPF16438FE-611E-4794-A73F-FABB79B4C3AF&SSPV=" ],), ,[a2382131205b59dde304bfba8e76926e]
PUP.Optional.Trovigo.A, C:\Users\Katka\AppData\Roaming\Mozilla\Firefox\Profiles\4ps0mrbt.default-1384707640875\prefs.js, Good: (), Bad: (user_pref("browser.newtab.url", "http://www.trovigo.com/?gd=&ctid=CT3314958&octid=EB_ORIGINAL_CTID&SearchSource=69&CUI=&SSPV=&Lay=1&UM=4&UP=SPF16438FE-611E-4794-A73F-FABB79B4C3AF");), ,[5387163c95e672c4bafd1068887c867a]

Physical Sectors: 0
(No malicious items detected)


(end)

[jaro3]

Spusť znovu AdwCleaner (u Windows Vista či Windows7, klikni na AdwCleaner pravým a vyber „Spustit jako správce“
klikni na „Prohledat-Scan“, po prohledání klikni na „ Vymazat-Clean“

Program provede opravu, po automatickém restartu neukáže log (C:\AdwCleaner [S?].txt) , jeho obsah sem celý vlož.

Stáhni si Junkware Removal Tool by Thisisu

na svojí plochu.

Deaktivuj si svůj antivirový program. Pravým tl. myši klikni na JRT.exe a vyber „spustit jako správce“. Pro pokračování budeš vyzván ke stisknutí jakékoliv klávesy. Na nějakou klikni.
Začne skenování programu. Skenování může trvat dloho , podle množství nákaz. Po ukončení skenu se objeví log (JRT.txt) , který se uloží na ploše.
Zkopíruj sem prosím celý jeho obsah.

. spusť znovu MbAM a dej Skenovat nyní
- po proběhnutí programu se ti objeví hláška tak klikni na „Vše do karantény“ a na „Exportovat záznam“ a vyber „textový soubor“ , soubor nějak pojmenuj a někam ho ulož. Zkopíruj se celý obsah toho logu.

Stáhni si RogueKiller by Adlice Software
32bit.:
http://www.sur-la-toile.com/RogueKiller/RogueKiller.exe
64bit.:
http://www.sur-la-toile.com/RogueKiller ... lerX64.exe
na svojí plochu.
- Zavři všechny ostatní programy a prohlížeče.
- Pro OS Vista a win7 spusť program RogueKiller.exe jako správce , u XP poklepáním.
- počkej až skončí Prescan -vyhledávání škodlivých procesů.
- Zkontroluj , zda máš zaškrtnuto:
Kontrola MBR
Kontrola Faked
Antirootkit
-Potom klikni na „Prohledat“.
- Program skenuje procesy PC. Po proskenování klikni na „Zpráva“celý obsah logu sem zkopíruj.
Pokud je program blokován , zkus ho spustit několikrát. Pokud dále program nepůjde spustit a pracovat, přejmenuj ho na winlogon.exe.

[sisik]

Log z ADW Cleaner:

# AdwCleaner v3.208 - Report created 18/05/2014 at 19:01:37
# Updated 11/05/2014 by Xplode
# Operating System : Windows Vista (TM) Home Premium Service Pack 2 (32 bits)
# Username : Katka - KATKA-PC
# Running from : C:\Users\Katka\Downloads\AdwCleaner.exe
# Option : Clean

***** [ Services ] *****


***** [ Files / Folders ] *****

Folder Deleted : C:\SearchProtect
Folder Deleted : C:\ProgramData\Ask
Folder Deleted : C:\ProgramData\Conduit
Folder Deleted : C:\ProgramData\Uniblue
Folder Deleted : C:\Program Files\Ask.com
Folder Deleted : C:\Program Files\Conduit
Folder Deleted : C:\Program Files\GreenTree Applications
Folder Deleted : C:\Program Files\DivX_Browser_Bar
Folder Deleted : C:\Windows\installer\{86d4b82a-abed-442a-be86-96357b70f4fe}
Folder Deleted : C:\Windows\system32\SearchProtect
Folder Deleted : C:\Users\Katka\AppData\Local\genienext
Folder Deleted : C:\Users\Katka\AppData\Local\Mobogenie
Folder Deleted : C:\Users\Katka\AppData\Local\SearchProtect
Folder Deleted : C:\Users\Katka\AppData\LocalLow\AskToolbar
Folder Deleted : C:\Users\Katka\AppData\LocalLow\Conduit
Folder Deleted : C:\Users\Katka\AppData\LocalLow\DivX_Browser_Bar
Folder Deleted : C:\Users\Katka\AppData\Roaming\SearchProtect
Folder Deleted : C:\Users\Katka\Documents\Mobogenie
Folder Deleted : C:\Users\Katka\AppData\Roaming\Mozilla\Firefox\Profiles\4ps0mrbt.default-1384707640875\Allin1Convert_8h
Folder Deleted : C:\Users\Katka\AppData\Roaming\Mozilla\Firefox\Profiles\4ps0mrbt.default-1384707640875\FromDocToPDF_65
Folder Deleted : C:\Users\Katka\AppData\Roaming\Mozilla\Firefox\Profiles\4ps0mrbt.default-1384707640875\VideoDownloadConverter_4z
Folder Deleted : C:\Users\Katka\AppData\Roaming\Mozilla\Firefox\Profiles\4ps0mrbt.default-1384707640875\Extensions\65ffxtbr@FromDocToPDF_65.com
File Deleted : C:\END
File Deleted : C:\Users\Katka\daemonprocess.txt
File Deleted : C:\Program Files\Mozilla Firefox\browser\nsprotector.js
File Deleted : C:\Users\Katka\AppData\Roaming\Mozilla\Firefox\Profiles\4ps0mrbt.default-1384707640875\searchplugins\ask-web-search.xml
File Deleted : C:\Users\Katka\AppData\Roaming\Mozilla\Firefox\Profiles\4ps0mrbt.default-1384707640875\searchplugins\conduit-search.xml
File Deleted : C:\Windows\System32\Tasks\Scheduled Update for Ask Toolbar

***** [ Shortcuts ] *****


***** [ Registry ] *****

Key Deleted : HKLM\SOFTWARE\Google\Chrome\Extensions\aaaaojmikegpiepcfdkkjaplodkpfmlo
Key Deleted : HKLM\SOFTWARE\Google\Chrome\Extensions\bopakagnckmlgajfccecajhnimjiiedh
[#] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{40791C9E-5FCD-459F-BFE1-7170BDAD4B1B}
[#] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{40791C9E-5FCD-459F-BFE1-7170BDAD4B1B}
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\LowRegistry\ICQ\ICQToolBar
Value Deleted : HKCU\Software\Microsoft\Internet Explorer\Main [ICQ Search]
Key Deleted : HKLM\SOFTWARE\Classes\AppID\GenericAskToolbar.DLL
Key Deleted : HKLM\SOFTWARE\Classes\driverscanner
Key Deleted : HKLM\SOFTWARE\Classes\GenericAskToolbar.ToolbarWnd
Key Deleted : HKLM\SOFTWARE\Classes\GenericAskToolbar.ToolbarWnd.1
Key Deleted : HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\ApnUpdater
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\MobogenieAdd
Key Deleted : HKLM\SOFTWARE\Classes\Toolbar.CT3288691
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{9B0CB95C-933A-4B8C-B6D4-EDCD19A43874}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{00000000-6E41-4FD3-8538-502F5495E5FC}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{77E8143B-6759-416E-B521-82CFED75150B}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{DD937C23-9304-4E9E-9FD3-0E00B88E2C2E}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{6C434537-053E-486D-B62A-160059D9D456}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{91CF619A-4686-4CA4-9232-3B2E6B63AA92}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{AC71B60E-94C9-4EDE-BA46-E146747BB67E}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{77E8143B-6759-416E-B521-82CFED75150B}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{D4027C7F-154A-4066-A1AD-4243D8127440}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{77E8143B-6759-416E-B521-82CFED75150B}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{D4027C7F-154A-4066-A1AD-4243D8127440}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{77E8143B-6759-416E-B521-82CFED75150B}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{DD937C23-9304-4E9E-9FD3-0E00B88E2C2E}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5AA24EA-11B8-4113-95AE-9ED71DEAF12A}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C2490360-E03F-42D0-95F6-09D95E52399D}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{B5237CD5-1550-4B61-ADA1-EF84BB335BDB}
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{014DB5FA-EAFB-4592-A95B-F44D3EE87FA9}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{014DB5FA-EAFB-4592-A95B-F44D3EE87FA9}
Value Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{77E8143B-6759-416E-B521-82CFED75150B}]
Value Deleted : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{77E8143B-6759-416E-B521-82CFED75150B}]
Value Deleted : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks [{00000000-6E41-4FD3-8538-502F5495E5FC}]
Value Deleted : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks [{77E8143B-6759-416E-B521-82CFED75150B}]
Value Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks [{77E8143B-6759-416E-B521-82CFED75150B}]
Key Deleted : HKCU\Software\APN PIP
Key Deleted : HKCU\Software\APN
Key Deleted : HKCU\Software\Ask.com
Key Deleted : HKCU\Software\Conduit
Key Deleted : HKCU\Software\ICQ\ICQToolbar
Key Deleted : HKCU\Software\YahooPartnerToolbar
Key Deleted : HKCU\Software\AppDataLow\Toolbar
Key Deleted : HKCU\Software\AppDataLow\Software\AskToolbar
Key Deleted : HKCU\Software\AppDataLow\Software\Conduit
Key Deleted : HKCU\Software\AppDataLow\Software\ConduitSearchScopes
Key Deleted : HKCU\Software\AppDataLow\Software\SmartBar
Key Deleted : HKCU\Software\AppDataLow\Software\DivX_Browser_Bar
Key Deleted : HKLM\Software\APN
Key Deleted : HKLM\Software\AskToolbar
Key Deleted : HKLM\Software\Conduit
Key Deleted : HKLM\Software\DivX\Install\Setup\WizardLayout\ConduitToolbar
Key Deleted : HKLM\Software\ICQ\ICQToolbar
Key Deleted : HKLM\Software\PIP
Key Deleted : HKLM\Software\SearchProtect
Key Deleted : HKLM\Software\Speedchecker Limited
Key Deleted : HKLM\Software\Uniblue
Key Deleted : HKLM\Software\DivX_Browser_Bar
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\{79A765E1-C399-405B-85AF-466F52E918B0}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{86D4B82A-ABED-442A-BE86-96357B70F4FE}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\{79A765E1-C399-405B-85AF-466F52E918B0}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\{86D4B82A-ABED-442A-BE86-96357B70F4FE}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\{C2F8CA82-2BD9-4513-B2D1-08A47914C1DA}_is1
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\Mobogenie
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\SearchProtect
Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\08121C32A9C319F4CB0C11FF059552A4
Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0CFE535C35F99574E8340BFA75BF92C2
Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0E12F736682067FDE4D1158D5940A82E
Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1A24B5BB8521B03E0C8D908F5ABC0AE6
Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\261F213D1F55267499B1F87D0CC3BCF7
Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\2B0D56C4F4C46D844A57FFED6F0D2852
Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\49D4375FE41653242AEA4C969E4E65E0
Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6AA0923513360135B272E8289C5F13FA
Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6F7467AF8F29C134CBBAB394ECCFDE96
Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\741B4ADF27276464790022C965AB6DA8
Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\7DE196B10195F5647A2B21B761F3DE01
Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\922525DCC5199162F8935747CA3D8E59
Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\9D4F5849367142E4685ED8C25E44C5ED
Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A5875B04372C19545BEB90D4D606C472
Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A876D9E80B896EC44A8620248CC79296
Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\B66FFAB725B92594C986DE826A867888
Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\BCDA179D619B91648538E3394CAC94CC
Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D677B1A9671D4D4004F6F2A4469E86EA
Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\DD1402A9DD4215A43ABDE169A41AFA0E
Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\E36E114A0EAD2AD46B381D23AD69CDDF
Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\EF8E618DB3AEDFBB384561B5C548F65E
Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\A28B4D68DEBAA244EB686953B7074FEF
Key Deleted : HKLM\Software\Classes\Installer\Features\A28B4D68DEBAA244EB686953B7074FEF
Key Deleted : HKLM\Software\Classes\Installer\Products\A28B4D68DEBAA244EB686953B7074FEF
Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UpgradeCodes\F928123A039649549966D4C29D35B1C9

***** [ Browsers ] *****

-\\ Internet Explorer v9.0.8112.16545


-\\ Mozilla Firefox v29.0.1 (cs)

[ File : C:\Users\Katka\AppData\Roaming\Mozilla\Firefox\Profiles\4ps0mrbt.default-1384707640875\prefs.js ]

Line Deleted : user_pref("browser.newtab.url", "hxxp://www.trovigo.com/?gd=&ctid=CT3314958&octid=EB_ORIGINAL_CTID&SearchSource=69&CUI=&SSPV=&Lay=1&UM=4&UP=SPF16438FE-611E-4794-A73F-FABB79B4C3AF");
Line Deleted : user_pref("extensions.toolbar.mindspark._4zMembers_.BUTTON_STRUCTURE", "[{\"b\":221584481,\"c\":\"mindspark.magnify\",\"p\":\"L.0\"},{\"b\":221584482,\"c\":\"mindspark.entersearchterms\",\"p\":\"L.0.0[...]
Line Deleted : user_pref("extensions.toolbar.mindspark._4zMembers_.firstKnownVersion", "5.75.3.8617");
Line Deleted : user_pref("extensions.toolbar.mindspark._4zMembers_.homepage", "hxxp://home.tb.ask.com/index.jhtml?ptb=ED3B650B-EA66-4EB7-B711-C4178DFC418B&n=780ba9e1&p2=^HJ^xdm073^YYA^cz&si=pconvFF");
Line Deleted : user_pref("extensions.toolbar.mindspark._4zMembers_.hp.user.defined", true);
Line Deleted : user_pref("extensions.toolbar.mindspark._4zMembers_.initialized", true);
Line Deleted : user_pref("extensions.toolbar.mindspark._4zMembers_.installKeysSource", "LocalStorage");
Line Deleted : user_pref("extensions.toolbar.mindspark._4zMembers_.installType", "XPI");
Line Deleted : user_pref("extensions.toolbar.mindspark._4zMembers_.installation.contextKey", "");
Line Deleted : user_pref("extensions.toolbar.mindspark._4zMembers_.installation.installDate", "2014030305");
Line Deleted : user_pref("extensions.toolbar.mindspark._4zMembers_.installation.partnerId", "^HJ^xdm073^YYA^cz");
Line Deleted : user_pref("extensions.toolbar.mindspark._4zMembers_.installation.partnerSubId", "pconvFF");
Line Deleted : user_pref("extensions.toolbar.mindspark._4zMembers_.installation.pixelUrl", "hxxp://videodownloadconverter.dl.tb.ask.com/install_pixels.jhtml?partner=^HJ^xdm073^YYA^cz&coId=a4a679511daa4e97b7ca900e1fd[...]
Line Deleted : user_pref("extensions.toolbar.mindspark._4zMembers_.installation.success", true);
Line Deleted : user_pref("extensions.toolbar.mindspark._4zMembers_.installation.toolbarId", "ED3B650B-EA66-4EB7-B711-C4178DFC418B");
Line Deleted : user_pref("extensions.toolbar.mindspark._4zMembers_.isCompliantUninstallImplementation", true);
Line Deleted : user_pref("extensions.toolbar.mindspark._4zMembers_.lastActivePing", "1400398122472");
Line Deleted : user_pref("extensions.toolbar.mindspark._4zMembers_.lastKnownVersion", "6.33.3.58478");
Line Deleted : user_pref("extensions.toolbar.mindspark._4zMembers_.options.defaultSearch", false);
Line Deleted : user_pref("extensions.toolbar.mindspark._4zMembers_.options.homePageEnabled", false);
Line Deleted : user_pref("extensions.toolbar.mindspark._4zMembers_.options.keywordEnabled", false);
Line Deleted : user_pref("extensions.toolbar.mindspark._4zMembers_.options.tabEnabled", false);
Line Deleted : user_pref("extensions.toolbar.mindspark._4zMembers_.partnerPixelFired", true);
Line Deleted : user_pref("extensions.toolbar.mindspark._4zMembers_.toolbarCollapsed", true);
Line Deleted : user_pref("extensions.toolbar.mindspark._4zMembers_.weather.location", "10001");
Line Deleted : user_pref("extensions.toolbar.mindspark._65Members_.BUTTON_STRUCTURE", "[{\"b\":221359615,\"c\":\"mindspark.magnify\",\"p\":\"L.0\"},{\"b\":221359616,\"c\":\"mindspark.entersearchterms\",\"p\":\"L.0.0[...]
Line Deleted : user_pref("extensions.toolbar.mindspark._65Members_.firstKnownVersion", "5.79.3.12693");
Line Deleted : user_pref("extensions.toolbar.mindspark._65Members_.homepage", "hxxp://home.tb.ask.com/index.jhtml?ptb=79220D45-831E-4414-96E4-EF47CCF778B5&n=780ba9e1&p2=^Y6^xdm039^YYA^cz&si=swissconverter");
Line Deleted : user_pref("extensions.toolbar.mindspark._65Members_.hp.user.defined", true);
Line Deleted : user_pref("extensions.toolbar.mindspark._65Members_.initialized", true);
Line Deleted : user_pref("extensions.toolbar.mindspark._65Members_.installKeysSource", "LocalStorage");
Line Deleted : user_pref("extensions.toolbar.mindspark._65Members_.installType", "XPI");
Line Deleted : user_pref("extensions.toolbar.mindspark._65Members_.installation.contextKey", "");
Line Deleted : user_pref("extensions.toolbar.mindspark._65Members_.installation.installDate", "2014030305");
Line Deleted : user_pref("extensions.toolbar.mindspark._65Members_.installation.partnerId", "^Y6^xdm039^YYA^cz");
Line Deleted : user_pref("extensions.toolbar.mindspark._65Members_.installation.partnerSubId", "swissconverter");
Line Deleted : user_pref("extensions.toolbar.mindspark._65Members_.installation.pixelUrl", "hxxp://fromdoctopdf.dl.tb.ask.com/install_pixels.jhtml?partner=^Y6^xdm039^YYA^cz&coId=6fbc282845cd4e43a06af62081a2f546&cake[...]
Line Deleted : user_pref("extensions.toolbar.mindspark._65Members_.installation.success", true);
Line Deleted : user_pref("extensions.toolbar.mindspark._65Members_.installation.toolbarId", "79220D45-831E-4414-96E4-EF47CCF778B5");
Line Deleted : user_pref("extensions.toolbar.mindspark._65Members_.isCompliantUninstallImplementation", true);
Line Deleted : user_pref("extensions.toolbar.mindspark._65Members_.lastActivePing", "1400398122485");
Line Deleted : user_pref("extensions.toolbar.mindspark._65Members_.lastKnownVersion", "6.33.3.63617");
Line Deleted : user_pref("extensions.toolbar.mindspark._65Members_.options.defaultSearch", false);
Line Deleted : user_pref("extensions.toolbar.mindspark._65Members_.options.homePageEnabled", false);
Line Deleted : user_pref("extensions.toolbar.mindspark._65Members_.options.keywordEnabled", false);
Line Deleted : user_pref("extensions.toolbar.mindspark._65Members_.options.tabEnabled", false);
Line Deleted : user_pref("extensions.toolbar.mindspark._65Members_.partnerPixelFired", true);
Line Deleted : user_pref("extensions.toolbar.mindspark._65Members_.toolbarCollapsed", true);
Line Deleted : user_pref("extensions.toolbar.mindspark._65Members_.weather.location", "10001");
Line Deleted : user_pref("extensions.toolbar.mindspark._8hMembers_.lastActivePing", "1394918843963");
Line Deleted : user_pref("extensions.toolbar.mindspark._8hMembers_.weather.location", "10001");
Line Deleted : user_pref("extensions.toolbar.mindspark.hp.enabled", false);
Line Deleted : user_pref("extensions.toolbar.mindspark.hp.enabled.guid", "");
Line Deleted : user_pref("extensions.toolbar.mindspark.lastInstalled", "allin1convert@mindspark.com");

-\\ Google Chrome v34.0.1847.137

[ File : C:\Users\Katka\AppData\Local\Google\Chrome\User Data\Default\preferences ]

Deleted [Search Provider] : hxxp://www.trovigo.com/Results.aspx?gd= ... 9B4C3AF&q={searchTerms}&SSPV=
Deleted [Startup_urls] : hxxp://www.trovigo.com/?gd=&ctid=CT3314 ... C3AF&SSPV=
Deleted [Homepage] : hxxp://www.trovigo.com/?gd=&ctid=CT3314 ... C3AF&SSPV=

*************************

AdwCleaner[R0].txt - [18129 octets] - [18/05/2014 12:14:57]
AdwCleaner[R1].txt - [18190 octets] - [18/05/2014 18:55:40]
AdwCleaner[S0].txt - [18419 octets] - [18/05/2014 19:01:37]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [18480 octets] ##########

[sisik]

log z JRT:

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.1.4 (04.06.2014:1)
OS: Windows Vista (TM) Home Premium x86
Ran by Katka on ne 18.05.2014 at 19:29:52,99
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values

Suspicious HKLM\..\Run entries found. Trojan:JS/Medfos.B?

Value Name Type Value Data
========================================================================================
BTMTrayAgent REG_SZ rundll32.exe "C:\Program Files\Motorola\Bluetooth\btmshell.dll",TrayApp




~~~ Registry Keys

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\installer\upgradecodes\f928123a039649549966d4c29d35b1c9
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{5043DCDC-D419-44B3-B7A3-0FE3BCDF35FB}
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{86CCFFDE-2E8A-4F81-8C07-29A829789ECD}
Successfully deleted: [Registry Key] "hkey_current_user\software\microsoft\internet explorer\low rights\elevationpolicy\{a5aa24ea-11b8-4113-95ae-9ed71deaf12a}"



~~~ Files



~~~ Folders

Successfully deleted: [Folder] "C:\ProgramData\ytd video downloader"
Successfully deleted: [Folder] "C:\Users\Katka\appdata\locallow\boost_interprocess"
Successfully deleted: [Folder] "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ytd video downloader"
Successfully deleted: [Empty Folder] C:\Users\Katka\appdata\local\{4181E995-4CB2-4E40-BA82-FB97D35B789C}
Successfully deleted: [Empty Folder] C:\Users\Katka\appdata\local\{59048D43-A07D-4020-A9C0-B747FCEA53B0}
Successfully deleted: [Empty Folder] C:\Users\Katka\appdata\local\{7C4A3B24-2B22-4711-BEC1-DCC93C44E59E}



~~~ FireFox

Successfully deleted: [Folder] C:\Users\Katka\AppData\Roaming\mozilla\firefox\profiles\4ps0mrbt.default-1384707640875\extensions\4zffxtbr@videodownloadconverter_4z.com
Successfully deleted the following from C:\Users\Katka\AppData\Roaming\mozilla\firefox\profiles\4ps0mrbt.default-1384707640875\prefs.js

user_pref("extensions.toolbar.mindspark._4zMembers_.BUTTON_STRUCTURE", "[{\"b\":221584481,\"c\":\"mindspark.magnify\",\"p\":\"L.0\"},{\"b\":221584482,\"c\":\"mindspark.enterse
user_pref("extensions.toolbar.mindspark._4zMembers_.firstKnownVersion", "6.33.3.58478");
user_pref("extensions.toolbar.mindspark._4zMembers_.homepage", "hxxp://home.tb.ask.com/index.jhtml?ptb=ED3B650B-EA66-4EB7-B711-C4178DFC418B&n=780ba9e1&p2=^HJ^xdm073^YYA^cz&si=
user_pref("extensions.toolbar.mindspark._4zMembers_.initialized", true);
user_pref("extensions.toolbar.mindspark._4zMembers_.installKeysSource", "LocalStorage");
user_pref("extensions.toolbar.mindspark._4zMembers_.installType", "XPI");
user_pref("extensions.toolbar.mindspark._4zMembers_.installation.contextKey", "");
user_pref("extensions.toolbar.mindspark._4zMembers_.installation.installDate", "2014030305");
user_pref("extensions.toolbar.mindspark._4zMembers_.installation.partnerId", "^HJ^xdm073^YYA^cz");
user_pref("extensions.toolbar.mindspark._4zMembers_.installation.partnerSubId", "pconvFF");
user_pref("extensions.toolbar.mindspark._4zMembers_.installation.pixelUrl", "hxxp://videodownloadconverter.dl.tb.ask.com/install_pixels.jhtml?partner=^HJ^xdm073^YYA^cz&coId=a4
user_pref("extensions.toolbar.mindspark._4zMembers_.installation.success", true);
user_pref("extensions.toolbar.mindspark._4zMembers_.installation.toolbarId", "ED3B650B-EA66-4EB7-B711-C4178DFC418B");
user_pref("extensions.toolbar.mindspark._4zMembers_.isCompliantUninstallImplementation", true);
user_pref("extensions.toolbar.mindspark._4zMembers_.lastActivePing", "1400433025926");
user_pref("extensions.toolbar.mindspark._4zMembers_.lastKnownVersion", "6.33.3.58478");
user_pref("extensions.toolbar.mindspark._4zMembers_.options.defaultSearch", false);
user_pref("extensions.toolbar.mindspark._4zMembers_.options.homePageEnabled", false);
user_pref("extensions.toolbar.mindspark._4zMembers_.options.keywordEnabled", false);
user_pref("extensions.toolbar.mindspark._4zMembers_.options.tabEnabled", false);
user_pref("extensions.toolbar.mindspark._4zMembers_.partnerPixelFired", true);
user_pref("extensions.toolbar.mindspark._4zMembers_.successUrl", "hxxp://pconverter.com/thankyou.php");
user_pref("extensions.toolbar.mindspark._4zMembers_.toolbarCollapsed", false);
user_pref("extensions.toolbar.mindspark.lastInstalled", "videodownloadconverter@mindspark.com");
Emptied folder: C:\Users\Katka\AppData\Roaming\mozilla\firefox\profiles\4ps0mrbt.default-1384707640875\minidumps [83 files]



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on ne 18.05.2014 at 19:45:12,22
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

[Orcus]

Ještě RogueKiller.

[sisik]

Log z malwares:

Malwarebytes Anti-Malware
http://www.malwarebytes.org

Datum skenování: 18.5.2014
Čas skenování: 20:14:48
Protokol: Malwarebytes Anti-Malware.txt
Správce: Ano

Verze: 2.00.1.1004
Databáze malwaru: v2014.05.18.06
Databáze rootkitů: v2014.03.27.01
Licence: Zkušební verze
Ochrana proti malwaru: Zapnuto
Ochrana proti škodlivým webovým stránkám: Zapnuto
Chameleon: Vypnuto

OS: Windows Vista Service Pack 2
CPU: x86
Souborový systém: NTFS
Uživatel: Katka

Typ skenu: Sken hrozeb
Výsledek: Dokončeno
Prohledaných objektů: 243261
Uplynulý čas: 23 min, 16 sek

Paměť: Zapnuto
Po spuštění: Zapnuto
Souborový systém: Zapnuto
Archivy: Zapnuto
Rootkity: Vypnuto
Shuriken: Zapnuto
PUP: Zapnuto
PUM: Zapnuto

Procesy: 0
(No malicious items detected)

Moduly: 0
(No malicious items detected)

Klíče registru: 0
(No malicious items detected)

Hodnoty registru: 0
(No malicious items detected)

Data registru: 0
(No malicious items detected)

Složky: 1
PUP.Optional.MindSpark.A, C:\Users\Katka\AppData\Roaming\Mozilla\Firefox\Profiles\4ps0mrbt.default-1384707640875\VideoDownloadConverter_4z, , [fae454febcbfba7c9507d5a610f2e818],

Soubory: 1
PUP.Optional.MindSpark.A, C:\Users\Katka\AppData\Roaming\Mozilla\Firefox\Profiles\4ps0mrbt.default-1384707640875\VideoDownloadConverter_4z\ED3B650B-EA66-4EB7-B711-C4178DFC418B.sqlite, , [fae454febcbfba7c9507d5a610f2e818],

Fyzické sektory: 0
(No malicious items detected)


(end)

[sisik]

Rogue Killer:

RogueKiller V8.8.15 [Mar 27 2014] by Adlice Software
mail : http://www.adlice.com/contact/
Podpora : http://forum.adlice.com
Webové stránky : http://www.adlice.com/softwares/roguekiller/
: http://www.adlice.com

Operační systém : Windows Vista (6.0.6002 Service Pack 2) 32 bits version
Spuštěno v : Normální režim
Uživatel : Katka [Práva správce]
Mód : Kontrola -- Datum : 05/18/2014 20:38:13
| ARK || FAK || MBR |

¤¤¤ Škodlivé procesy: : 0 ¤¤¤

¤¤¤ ¤¤¤ Záznamy Registrů: : 2 ¤¤¤
[HJ POL][PUM] HKCU\[...]\System : DisableTaskMgr (0) -> NALEZENO
[HJ POL][PUM] HKCU\[...]\System : DisableRegistryTools (0) -> NALEZENO

¤¤¤ naplánované úlohy : 0 ¤¤¤

¤¤¤ spuštění položky : 0 ¤¤¤

¤¤¤ Webové prohlížeče : 0 ¤¤¤

¤¤¤ Browser Addons : 0 ¤¤¤

¤¤¤ Zvláštní soubory / Složky: ¤¤¤

¤¤¤ Ovladač : [NAHRÁNO] ¤¤¤
[Address] IRP[IRP_MJ_CREATE] : C:\Windows\system32\DRIVERS\iaStor.sys -> HOOKED (Unknown @ 0x856531F8)
[Address] IRP[IRP_MJ_CLOSE] : C:\Windows\system32\DRIVERS\iaStor.sys -> HOOKED (Unknown @ 0x856531F8)
[Address] IRP[IRP_MJ_DEVICE_CONTROL] : C:\Windows\system32\DRIVERS\iaStor.sys -> HOOKED (Unknown @ 0x856531F8)
[Address] IRP[IRP_MJ_INTERNAL_DEVICE_CONTROL] : C:\Windows\system32\DRIVERS\iaStor.sys -> HOOKED (Unknown @ 0x856531F8)
[Address] IRP[IRP_MJ_POWER] : C:\Windows\system32\DRIVERS\iaStor.sys -> HOOKED (Unknown @ 0x856531F8)
[Address] IRP[IRP_MJ_SYSTEM_CONTROL] : C:\Windows\system32\DRIVERS\iaStor.sys -> HOOKED (Unknown @ 0x856531F8)
[Address] IRP[IRP_MJ_PNP] : C:\Windows\system32\DRIVERS\iaStor.sys -> HOOKED (Unknown @ 0x856531F8)

¤¤¤ Externí včelstvo: ¤¤¤

¤¤¤ Nákaza : ¤¤¤

¤¤¤ Soubor HOSTS: ¤¤¤
--> %SystemRoot%\System32\drivers\etc\hosts


127.0.0.1 localhost


¤¤¤ Kontrola MBR: ¤¤¤

+++++ PhysicalDrive0: (\\.\PHYSICALDRIVE0 @ IDE) ST9250827AS +++++
--- User ---
[MBR] a3e0cd1b90b20d819b3f1c9f53241118
[BSP] 3fa6e3582d7f481b34574db180f7a1b1 : Windows Vista MBR Code
Partition table:
0 - [XXXXXX] FAT32-LBA (0x1c) [HIDDEN!] Offset (sectors): 2048 | Size: 10000 MB
1 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 20482048 | Size: 119237 MB
2 - [XXXXXX] EXTEN-LBA (0x0f) [VISIBLE] Offset (sectors): 264679424 | Size: 109237 MB
User = LL1 ... OK!
User = LL2 ... OK!

+++++ PhysicalDrive1: (\\.\PHYSICALDRIVE1 @ USB) SEMC Mass Storage USB Device +++++
Error reading User MBR! ([0x15] Za?ízení není p?ipraveno. )
User = LL1 ... OK!
Error reading LL2 MBR! ([0x32] Po?adavek není podporován. )

Dokončeno : << RKreport[0]_S_05182014_203813.txt >>

[jaro3]

. spusť znovu MbAM a dej Skenovat nyní
- po proběhnutí programu se ti objeví hláška tak klikni na „Vše do karantény“ a na „Exportovat záznam“ a vyber „textový soubor“ , soubor nějak pojmenuj a někam ho ulož. Zkopíruj se celý obsah toho logu.

Zavři všechny programy a prohlížeče. Deaktivuj antivir a firewall.
Prosím, odpoj všechny USB nebo externí disky z počítače před spuštěním tohoto programu.
Spusť RogueKiller ( Pro Windows Vista nebo Windows 7, klepni pravým a vyber "Spustit jako správce", ve Windows XP poklepej ke spuštění).
- Počkej, až Prescan dokončí práci...
- Počkej, dokud status okno zobrazuje "Prohledat "
- Klikni na "Smazat"
- Počkej, dokud Status box zobrazuje " Mazání dokončeno "
- Klikni na "Zpráva " a zkopíruj a vlož obsah té zprávy prosím sem. Log je možno nalézt v RKreport [číslo]. txt na ploše.
- Zavři RogueKiller

Stáhni si TDSSKiller
Na svojí plochu.Ujisti se , že máš zavřeny všechny ostatní aplikace a prohlížeče. Rozbal soubor a spusť TDSSKiller.exe. Restartuj PC . Log z TDSSKilleru najdeš zde:
C:\TDSSKiller. 2.8.16.0_(datum)_log.txt , vlož sem prosím celý obsah logu.
-pokud bude mít log více než 60.000 znaků , rozděl ho a vlož do více příspěvků

[sisik]

Log z MbAM:
Malwarebytes Anti-Malware
www.malwarebytes.org

Datum skenování: 19.5.2014
Èas skenování: 20:13:14
Protokol: Malwarebytes Anti-Malware.txt
Správce: Ano

Verze: 2.00.1.1004
Databáze malwaru: v2014.05.19.09
Databáze rootkitù: v2014.03.27.01
Licence: Zkušební verze
Ochrana proti malwaru: Zapnuto
Ochrana proti škodlivým webovým stránkám: Zapnuto
Chameleon: Vypnuto

OS: Windows Vista Service Pack 2
CPU: x86
Souborový systém: NTFS
Uživatel: Katka

Typ skenu: Sken hrozeb
Výsledek: Dokonèeno
Prohledaných objektù: 243465
Uplynulý èas: 22 min, 21 sek

Pamì: Zapnuto
Po spuštìní: Zapnuto
Souborový systém: Zapnuto
Archivy: Zapnuto
Rootkity: Vypnuto
Shuriken: Zapnuto
PUP: Zapnuto
PUM: Zapnuto

Procesy: 0
(No malicious items detected)

Moduly: 0
(No malicious items detected)

Klíèe registru: 0
(No malicious items detected)

Hodnoty registru: 0
(No malicious items detected)

Data registru: 0
(No malicious items detected)

Složky: 1
PUP.Optional.MindSpark.A, C:\Users\Katka\AppData\Roaming\Mozilla\Firefox\Profiles\4ps0mrbt.default-1384707640875\VideoDownloadConverter_4z, , [af967cd7136838fe77c5cab28c7657a9],

Soubory: 1
PUP.Optional.MindSpark.A, C:\Users\Katka\AppData\Roaming\Mozilla\Firefox\Profiles\4ps0mrbt.default-1384707640875\VideoDownloadConverter_4z\ED3B650B-EA66-4EB7-B711-C4178DFC418B.sqlite, , [af967cd7136838fe77c5cab28c7657a9],

Fyzické sektory: 0
(No malicious items detected)


(end)