prosim o kontrolu logu

[Green1692]

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.1.9 (09.20.2014:1)
OS: Windows 7 Home Premium x64
Ran by Martin on ne 21. 09. 2014 at 12:18:27,38
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values



~~~ Registry Keys



~~~ Files



~~~ Folders



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on ne 21. 09. 2014 at 12:37:41,00
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

[Reklama]

[Orcus]

Zavři všechny programy a prohlížeče. Deaktivuj antivir a firewall.
Prosím, odpoj všechny USB nebo externí disky z počítače před spuštěním tohoto programu.
Spusť RogueKiller ( Pro Windows Vista nebo Windows 7, klepni pravým a vyber "Spustit jako správce", ve Windows XP poklepej ke spuštění).
- Počkej, až Prescan dokončí práci...
- Počkej, dokud status okno zobrazuje "Prohledat "
- V záložkách (Registry , Tasks , Web Browser apod.) vše zatrhni (dej zatržítka).
- Klikni na "Smazat"
- Počkej, dokud Status box zobrazuje " Mazání dokončeno "
- Klikni na "Zpráva" a zkopíruj a vlož obsah té zprávy prosím sem. Log je možno nalézt v RKreport [číslo]. txt na ploše.
- Zavři RogueKiller

====================================================

Stáhni
Zoek.exe

a ulož si ho na plochu.
Zavři všechny ostatní programy, okna i prohlížeče.
Spusť Zoek.exe ( u win vista , win7, 8 klikni na něj pravým a vyber : „Spustit jako správce“
- pozor, náběh programu může trvat déle.

Do okna programu vlož skript níže:

Kód: Vybrat vše

autoclean;
emptyclsid;
iedefaults;
FFdefaults;
CHRdefaults;
emptyalltemp;
resethosts;

Klikni na Run Script
Program provede sken, opravu, sken i oprava může trvat i více minut, je třeba posečkat do konce. Do okna neklikej!
rogram nabídne restart , potvrď .

Po restartu se může nějaký čas ukázat pouze černá plocha , to je normální. Je třeba počkat až se vytvoří log. Ten si můžeš uložit třeba do dokumentů, jinak se sám ukládá do:
C:\zoek-results.log
Zkopíruj sem celý obsah toho logu.

[Green1692]

RogueKiller V9.2.11.0 (x64) [Sep 9 2014] by Adlice Software
mail : http://www.adlice.com/contact/
Feedback : http://forum.adlice.com
Webové stránky : http://www.adlice.com/softwares/roguekiller/
Blog : http://www.adlice.com

Operačný systém : Windows 7 (6.1.7601 Service Pack 1) 64 bits version
Spustené v : Normálny režim
Užívateľ : Martin [Práva Správcu]
Režim : Odebrať -- Dátum : 09/21/2014 19:50:24

¤¤¤ Škodlivé procesy : 0 ¤¤¤

¤¤¤ Záznamy Registrov : 22 ¤¤¤
[PUM.Policies] (X64) HKEY_USERS\S-1-5-21-3847133570-3116631850-505908550-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System | DisableRegistryTools : 0 -> VYMAZANÉ
[PUM.Policies] (X64) HKEY_USERS\S-1-5-21-3847133570-3116631850-505908550-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System | DisableTaskMgr : 0 -> VYMAZANÉ
[PUM.Policies] (X86) HKEY_USERS\S-1-5-21-3847133570-3116631850-505908550-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System | DisableRegistryTools : 0 -> ERROR [2]
[PUM.Policies] (X86) HKEY_USERS\S-1-5-21-3847133570-3116631850-505908550-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System | DisableTaskMgr : 0 -> ERROR [2]
[PUM.Policies] (X64) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System | DisableRegistryTools : 0 -> VYMAZANÉ
[PUM.Policies] (X86) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System | DisableRegistryTools : 0 -> ERROR [2]
[PUM.Policies] (X64) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System | EnableLUA : 0 -> NAHRADENÉ (1)
[PUM.Policies] (X86) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System | EnableLUA : 0 -> NAHRADENÉ (1)
[PUM.Policies] (X64) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System | ConsentPromptBehaviorAdmin : 0 -> NAHRADENÉ (2)
[PUM.Policies] (X86) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System | ConsentPromptBehaviorAdmin : 0 -> NAHRADENÉ (2)
[PUM.DesktopIcons] (X86) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {20D04FE0-3AEA-1069-A2D8-08002B30309D} : 1 -> NAHRADENÉ (0)
[PUM.DesktopIcons] (X86) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {59031a47-3f72-44a7-89c5-5595fe6b30ee} : 1 -> NAHRADENÉ (0)
[PUM.HomePage] (X64) HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Main | Start Page : http://www.microsoft.com/isapi/redir.dl ... ar=msnhome -> NAHRADENÉ (http://go.microsoft.com/fwlink/p/?LinkId=255141)
[PUM.HomePage] (X86) HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Main | Start Page : http://www.microsoft.com/isapi/redir.dl ... ar=msnhome -> NAHRADENÉ (http://go.microsoft.com/fwlink/p/?LinkId=255141)
[PUM.HomePage] (X64) HKEY_USERS\S-1-5-18\Software\Microsoft\Internet Explorer\Main | Start Page : http://www.microsoft.com/isapi/redir.dl ... ar=msnhome -> NAHRADENÉ (http://go.microsoft.com/fwlink/p/?LinkId=255141)
[PUM.HomePage] (X86) HKEY_USERS\S-1-5-18\Software\Microsoft\Internet Explorer\Main | Start Page : http://www.microsoft.com/isapi/redir.dl ... ar=msnhome -> NAHRADENÉ (http://go.microsoft.com/fwlink/p/?LinkId=255141)
[PUM.SearchPage] (X64) HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Main | Search Page : http://www.microsoft.com/isapi/redir.dl ... r=iesearch -> NAHRADENÉ (http://go.microsoft.com/fwlink/?LinkId=54896)
[PUM.SearchPage] (X86) HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Main | Search Page : http://www.microsoft.com/isapi/redir.dl ... r=iesearch -> NAHRADENÉ (http://go.microsoft.com/fwlink/?LinkId=54896)
[PUM.SearchPage] (X64) HKEY_USERS\S-1-5-21-3847133570-3116631850-505908550-1000\Software\Microsoft\Internet Explorer\Main | Search Page : http://www.microsoft.com/isapi/redir.dl ... r=iesearch -> NAHRADENÉ (http://go.microsoft.com/fwlink/?LinkId=54896)
[PUM.SearchPage] (X86) HKEY_USERS\S-1-5-21-3847133570-3116631850-505908550-1000\Software\Microsoft\Internet Explorer\Main | Search Page : http://www.microsoft.com/isapi/redir.dl ... r=iesearch -> NAHRADENÉ (http://go.microsoft.com/fwlink/?LinkId=54896)
[PUM.SearchPage] (X64) HKEY_USERS\S-1-5-18\Software\Microsoft\Internet Explorer\Main | Search Page : http://www.microsoft.com/isapi/redir.dl ... r=iesearch -> NAHRADENÉ (http://go.microsoft.com/fwlink/?LinkId=54896)
[PUM.SearchPage] (X86) HKEY_USERS\S-1-5-18\Software\Microsoft\Internet Explorer\Main | Search Page : http://www.microsoft.com/isapi/redir.dl ... r=iesearch -> NAHRADENÉ (http://go.microsoft.com/fwlink/?LinkId=54896)

¤¤¤ naplánované úlohy : 13 ¤¤¤
[Suspicious.Path] BXHQTQEE.job -- C:\Users\Martin\AppData\Roaming\BXHQTQEE.exe (/infocmdline=ho54rsyz9TBe33fVTqjx07FdWhr1UfFhzamvQh2VPgEoZcHd7tb9U33ku1wjLs6l+AGlHhSAYvqhwd1Sv/2ZMU/a2JdW+PeuqzAEV0zY66OXDtdBC8njFs0Mw2+WNZX2ZInmfyGJu2x7WdjemueF5aJfHwFUWgv0YS+gZMdDIt9r7RqUYz7kiWgsWq25HKqUirb3+EKratR3jkQHOfIVvlAkyjgilxz/zGovxttIgX6uN5DsE+z2Tsvf26Th1HkwXlcY73PUhBgYOZIb18L/icZiRpLEI3WA/0O0Mxs6zuH4v5GYqELWxb5pnQyhaCb5qUi2SEIwbyUj4Wd7Q30Ba5FI2AS60kL0OOC6opeSwxoRJEAvCfdjxNn/pNX/jG/LoCcS3sEW5KAjRXJhe6TucBroVC6On91LXfMlAH86eT4ESEZkYzCjgthChije521KDAEKGeUj/rcGS2CxL7saE4yqG2hf7xU3jdURamAvo+W8lAAKfhiyaIzrsdxLzky9sZkLutK+wRg09MBTdV6esMVJAnVrHQ18v7KwLAnjHLQ6qygpZwcc4FRKmt288xLM80NNLghoNjL7A5LleUPNwEK91s0rHvKmd83SdnKb64/+DklNpVBvfiP1S7ufH9ZR3T06y0c1dfgiSyZsKto8dEXbr5D/fQu+D2xz3adWKyg=) -> VYMAZANÉ
[Suspicious.Path] CMKO.job -- C:\Users\Martin\AppData\Roaming\CMKO.exe (/infocmdline=u0Mg58hRoJwaWJ3tIIukwW9hKaI7cYTgO+SyShvOlnIvjVy5lXZZsyXkv+CyP8pd7FEHHo7oWHIgX3kWpSz77l/ntvJAnDZALERRJOnvWHkqcgENT8zAtwRiU3ZA3o8ixxXBv24tbZlFUvfDzZqk7keguYlr0dFRMOkRexYEKYpPI3Wm//TKne/zz+dtLO66f9ewvDGwwMfNBDoRs53TL5S1GAEXh5X7fs7+0L8dxannsmPi8HJ0AZcKnlj87HqA/Gy0sN3PYiOhlF5JAvfq5aA+tYfWVLZMQcU4ie46v/QeQ8JfTnRzgnmUNc+UJpM1DG+PWenJezVEbWO3IvmkNKFjt5nlrln1N5aQKsJukj1eIbA5giadstJ/8MTcEZhU5AkEr5SEHn2WA9/sM1REX/pp5PPRjwDvTtLfpQi+LglUxcn9LBxYypjaSgdsX9i3zzrg72yYyYqxpdbsROXen1VfrCddBCIhFWaXEkOfUe1NpoCE/q8uqW8EqTxY7oWA) -> VYMAZANÉ
[Suspicious.Path] ET.job -- C:\Users\Martin\AppData\Roaming\ET.exe (/infocmdline=JshfO3K/KcOlgXKSbARUbgGm9Xl3CQyA522NlegmgH5q6dx3FaAcCnqb9qPlPDPcT4d7S9ztYbDSgnuXI7lX7oXp3RfeboeYIyyQIRiTms5a/FDcxHYlWU4LGzgMixmmsC/8Rl/GWLV5k986zEcXVDAs5xk1C1srF2/+AtRKSKyG1AJPMxv6KcZyC5VXBKZvVoTPxoDCy7UcwnZu2BD055Rbn3j+lIijH3jVOcP9yO1Fh0vQIu+/zrirba++JAfrKGtYLa6qyZFiCAi/dWHYD0Hn0fiwgfOSQo3L2S6TLvQG0hGFdZbYhNI1DvHej+4VRoS70uJeUwf5N1k5/np9rUFK6S1soH96HRp4Nn88+YbAlYBiqdwWBRK30MyFuGQAJnB6Wi0ONmbGfoOn+hjPKbF/S4mfreyITpXntETyMBja5AZN/z04yO13txDLL3SKbrUPzgQXpkUQH63fy7DlzAr84FcbhT5yk5K+fihQby0IgZayZ2mlPB1RX50weg9E) -> VYMAZANÉ
[Suspicious.Path] EZ.job -- C:\Users\Martin\AppData\Roaming\EZ.exe (/infocmdline=M0JZNtU9IyzqBAPKBYl5X1mGVPH8hTkbB3YXDenPKEWeiKu2Egt4H6vcQDTAJkvZwJL+vCEHNIEQ2+hbxxrjso39lPfBRAwt7fBjSgTnogHL8t92rfdyYu48MHQz0aPr55vQbnGZLrE3mrkqSBcYvDufe+Pvdr12nPMM/DVpKFWG1AJPMxv6KcZyC5VXBKZvVoTPxoDCy7UcwnZu2BD055Rbn3j+lIijH3jVOcP9yO1Fh0vQIu+/zrirba++JAfrKGtYLa6qyZFiCAi/dWHYD0Hn0fiwgfOSQo3L2S6TLvQG0hGFdZbYhNI1DvHej+4VRoS70uJeUwf5N1k5/np9racJoNYV4UDKM0T8klUUgjPNB773U0I5U5mLsYNjhZdJtanlkrO2skMP7Ml98/2Kdh1jIInF26FN1qMMlDn9dlKvZeiNXOsLE+yPoVD/gz5WHUbfCUInvIh4kM7zBP+GzLX0PALmyBczi9BpULPzLauCwa4I691cocqhN2h+Dcjt) -> VYMAZANÉ
[Suspicious.Path] JDSN.job -- C:\Users\Martin\AppData\Roaming\JDSN.exe (/infocmdline=uYmFks7Ya629Pul9P027Ualpw8/c09Dy+BN0yHbatlGTuzF82DWWAZH4qDczz/GNMsqeXjZlZcknSLoGqwuxNR1TbrOskjbiAEBKewDoY68/XUw0RpEOMhKfMJpXgtitbKPPWXrG50/c5j19WTYCfHff3uLF07oOtv+abspUHiTFR3oRi2wKAMzkKDewKUHyeMiKZmOfsssdjYi+9B4mr/OHkeA5zzH0dIWRWAtMyAzbLcVRuEOYRGbovpBpp8xgsO+MlSnZGcv7uaM0A8hoDlrI4Juc2HkluKM30QIpUcZOkwKx6Yg8vMSXkn90808L2deNp9xo7LBwESa1InEhMn0W2/V54MSDvhgw4iHs06MySb2PBmM4dql+0WFQturTD3Z6I9hOriPxZ7AUSuQ+a2dGxtS3x3NzRu1vjhkIsP3ShxofpPVepujQQfNrKbXeILZzXavbaIlVXclwrV7QRQCWJbyrP7YrPbxNyx56kxEiNzfvz6Vc9lnDLmkXzV1h) -> VYMAZANÉ
[Suspicious.Path] MNFUP.job -- C:\Users\Martin\AppData\Roaming\MNFUP.exe (/infocmdline=LKd4ULr9E/f4Cd2LDAMVpTnDpyCn4qgB1LEjBi1OiD3F3mSwiKCr7Tw9dvXwUcunGPWaMsQ9F6Q5fsp+uZKnrn5ejuOsIuuoE9MIga+WsEU258wGBDGBrlY1Lm1CTbvehTZIK+4CcjVMgoLIKCST5k8pLb7fXqObY2iBZvl/7KuwzUmDuZRIQ38jQbVvdW+X/Y8tyq1BYvsGx9da0886/mNjNOIUdEKfc6fhb12b8vmvAyEZDCE9RJzxEjvKC6MzNHJEhZHryjOO+ioLWjg96qb/ZJHHplaAiIqvWiwVFDVrl1RfZt5Dw1Mg7/oG3vkwGfYQ/ao4LhM++HX42U+cgiRMp/dDuiX6LSQqfoWaKZAkia9XHXqiE2BkMPss/4Mig9gCLNRV7xfAn8HDngD1bw0kHekUfRamAAciT8v2PfY6EcwrNsrPGEdKCAeh2Ez7+g9Nm9zef+tYC3ZY5brVgL2rA0a9tNSgWMFkNPZWiLJoy9A75QyDvYBQmxLpeEZO) -> VYMAZANÉ
[Suspicious.Path] \\BXHQTQEE -- C:\Users\Martin\AppData\Roaming\BXHQTQEE.exe (/infocmdline=ho54rsyz9TBe33fVTqjx07FdWhr1UfFhzamvQh2VPgEoZcHd7tb9U33ku1wjLs6l+AGlHhSAYvqhwd1Sv/2ZMU/a2JdW+PeuqzAEV0zY66OXDtdBC8njFs0Mw2+WNZX2ZInmfyGJu2x7WdjemueF5aJfHwFUWgv0YS+gZMdDIt9r7RqUYz7kiWgsWq25HKqUirb3+EKratR3jkQHOfIVvlAkyjgilxz/zGovxttIgX6uN5DsE+z2Tsvf26Th1HkwXlcY73PUhBgYOZIb18L/icZiRpLEI3WA/0O0Mxs6zuH4v5GYqELWxb5pnQyhaCb5qUi2SEIwbyUj4Wd7Q30Ba5FI2AS60kL0OOC6opeSwxoRJEAvCfdjxNn/pNX/jG/LoCcS3sEW5KAjRXJhe6TucBroVC6On91LXfMlAH86eT4ESEZkYzCjgthChije521KDAEKGeUj/rcGS2CxL7saE4yqG2hf7xU3jdURamAvo+W8lAAKfhiyaIzrsdxLzky9sZkLutK+wRg09MBTdV6esMVJAnVrHQ18v7KwLAnjHLQ6qygpZwcc4FRKmt288xLM80NNLghoNjL7A5LleUPNwEK91s0rHvKmd83SdnKb64/+DklNpVBvfiP1S7ufH9ZR3T06y0c1dfgiSyZsKto8dEXbr5D/fQu+D2xz3adWKyg=) -> VYMAZANÉ
[Suspicious.Path] \\CMKO -- C:\Users\Martin\AppData\Roaming\CMKO.exe (/infocmdline=u0Mg58hRoJwaWJ3tIIukwW9hKaI7cYTgO+SyShvOlnIvjVy5lXZZsyXkv+CyP8pd7FEHHo7oWHIgX3kWpSz77l/ntvJAnDZALERRJOnvWHkqcgENT8zAtwRiU3ZA3o8ixxXBv24tbZlFUvfDzZqk7keguYlr0dFRMOkRexYEKYpPI3Wm//TKne/zz+dtLO66f9ewvDGwwMfNBDoRs53TL5S1GAEXh5X7fs7+0L8dxannsmPi8HJ0AZcKnlj87HqA/Gy0sN3PYiOhlF5JAvfq5aA+tYfWVLZMQcU4ie46v/QeQ8JfTnRzgnmUNc+UJpM1DG+PWenJezVEbWO3IvmkNKFjt5nlrln1N5aQKsJukj1eIbA5giadstJ/8MTcEZhU5AkEr5SEHn2WA9/sM1REX/pp5PPRjwDvTtLfpQi+LglUxcn9LBxYypjaSgdsX9i3zzrg72yYyYqxpdbsROXen1VfrCddBCIhFWaXEkOfUe1NpoCE/q8uqW8EqTxY7oWA) -> ERROR [0]
[Suspicious.Path] \\ET -- C:\Users\Martin\AppData\Roaming\ET.exe (/infocmdline=JshfO3K/KcOlgXKSbARUbgGm9Xl3CQyA522NlegmgH5q6dx3FaAcCnqb9qPlPDPcT4d7S9ztYbDSgnuXI7lX7oXp3RfeboeYIyyQIRiTms5a/FDcxHYlWU4LGzgMixmmsC/8Rl/GWLV5k986zEcXVDAs5xk1C1srF2/+AtRKSKyG1AJPMxv6KcZyC5VXBKZvVoTPxoDCy7UcwnZu2BD055Rbn3j+lIijH3jVOcP9yO1Fh0vQIu+/zrirba++JAfrKGtYLa6qyZFiCAi/dWHYD0Hn0fiwgfOSQo3L2S6TLvQG0hGFdZbYhNI1DvHej+4VRoS70uJeUwf5N1k5/np9rUFK6S1soH96HRp4Nn88+YbAlYBiqdwWBRK30MyFuGQAJnB6Wi0ONmbGfoOn+hjPKbF/S4mfreyITpXntETyMBja5AZN/z04yO13txDLL3SKbrUPzgQXpkUQH63fy7DlzAr84FcbhT5yk5K+fihQby0IgZayZ2mlPB1RX50weg9E) -> ERROR [0]
[Suspicious.Path] \\EZ -- C:\Users\Martin\AppData\Roaming\EZ.exe (/infocmdline=M0JZNtU9IyzqBAPKBYl5X1mGVPH8hTkbB3YXDenPKEWeiKu2Egt4H6vcQDTAJkvZwJL+vCEHNIEQ2+hbxxrjso39lPfBRAwt7fBjSgTnogHL8t92rfdyYu48MHQz0aPr55vQbnGZLrE3mrkqSBcYvDufe+Pvdr12nPMM/DVpKFWG1AJPMxv6KcZyC5VXBKZvVoTPxoDCy7UcwnZu2BD055Rbn3j+lIijH3jVOcP9yO1Fh0vQIu+/zrirba++JAfrKGtYLa6qyZFiCAi/dWHYD0Hn0fiwgfOSQo3L2S6TLvQG0hGFdZbYhNI1DvHej+4VRoS70uJeUwf5N1k5/np9racJoNYV4UDKM0T8klUUgjPNB773U0I5U5mLsYNjhZdJtanlkrO2skMP7Ml98/2Kdh1jIInF26FN1qMMlDn9dlKvZeiNXOsLE+yPoVD/gz5WHUbfCUInvIh4kM7zBP+GzLX0PALmyBczi9BpULPzLauCwa4I691cocqhN2h+Dcjt) -> ERROR [0]
[Suspicious.Path] \\JDSN -- C:\Users\Martin\AppData\Roaming\JDSN.exe (/infocmdline=uYmFks7Ya629Pul9P027Ualpw8/c09Dy+BN0yHbatlGTuzF82DWWAZH4qDczz/GNMsqeXjZlZcknSLoGqwuxNR1TbrOskjbiAEBKewDoY68/XUw0RpEOMhKfMJpXgtitbKPPWXrG50/c5j19WTYCfHff3uLF07oOtv+abspUHiTFR3oRi2wKAMzkKDewKUHyeMiKZmOfsssdjYi+9B4mr/OHkeA5zzH0dIWRWAtMyAzbLcVRuEOYRGbovpBpp8xgsO+MlSnZGcv7uaM0A8hoDlrI4Juc2HkluKM30QIpUcZOkwKx6Yg8vMSXkn90808L2deNp9xo7LBwESa1InEhMn0W2/V54MSDvhgw4iHs06MySb2PBmM4dql+0WFQturTD3Z6I9hOriPxZ7AUSuQ+a2dGxtS3x3NzRu1vjhkIsP3ShxofpPVepujQQfNrKbXeILZzXavbaIlVXclwrV7QRQCWJbyrP7YrPbxNyx56kxEiNzfvz6Vc9lnDLmkXzV1h) -> VYMAZANÉ
[Suspicious.Path] \\MNFUP -- C:\Users\Martin\AppData\Roaming\MNFUP.exe (/infocmdline=LKd4ULr9E/f4Cd2LDAMVpTnDpyCn4qgB1LEjBi1OiD3F3mSwiKCr7Tw9dvXwUcunGPWaMsQ9F6Q5fsp+uZKnrn5ejuOsIuuoE9MIga+WsEU258wGBDGBrlY1Lm1CTbvehTZIK+4CcjVMgoLIKCST5k8pLb7fXqObY2iBZvl/7KuwzUmDuZRIQ38jQbVvdW+X/Y8tyq1BYvsGx9da0886/mNjNOIUdEKfc6fhb12b8vmvAyEZDCE9RJzxEjvKC6MzNHJEhZHryjOO+ioLWjg96qb/ZJHHplaAiIqvWiwVFDVrl1RfZt5Dw1Mg7/oG3vkwGfYQ/ao4LhM++HX42U+cgiRMp/dDuiX6LSQqfoWaKZAkia9XHXqiE2BkMPss/4Mig9gCLNRV7xfAn8HDngD1bw0kHekUfRamAAciT8v2PfY6EcwrNsrPGEdKCAeh2Ez7+g9Nm9zef+tYC3ZY5brVgL2rA0a9tNSgWMFkNPZWiLJoy9A75QyDvYBQmxLpeEZO) -> ERROR [0]
[Suspicious.Path] \\Only-search Udpater -- C:\Users\Martin\AppData\Local\onlysearch\onlysearch\1.3.12.9\onlysetup.exe -> VYMAZANÉ

¤¤¤ Súbory : 0 ¤¤¤

¤¤¤ Súbor HOSTS : 1 ¤¤¤
[C:\Windows\System32\drivers\etc\hosts] 127.0.0.1 localhost -> VYMAZANÉ

¤¤¤ Antirootkit : 1 (Driver: NAHRATÉ) ¤¤¤
[Filter(Kernel.Filter)] \Driver\atapi @ Unknown : \Driver\Disk @ \Device\Harddisk0\DR0 (\SystemRoot\system32\DRIVERS\hpdskflt.sys)

¤¤¤ webové prehliadače : 18 ¤¤¤
[FIREFX:Addon] tt0a1tnw.default : DigitalPersona Extension [otis@digitalpersona.com] -> VYMAZANÉ
[FIREFX:Addon] tt0a1tnw.default : Skype Click to Call [{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}] -> VYMAZANÉ
[FIREFX:Addon] tt0a1tnw.default : GOSave [E@mK188H.net] -> VYMAZANÉ
[FIREFX:Addon] tt0a1tnw.default : Fast Start [faststartff@gmail.com] -> VYMAZANÉ
[FIREFX:Addon] tt0a1tnw.default : HD01-V2.1V19.09 [0cd1569197354ecf9be03@d3ee3bc4210848f7b5a58324f064f.com] -> VYMAZANÉ
[FIREFX:Addon] tt0a1tnw.default : SavePass 1.1 [VJKPXI46039420@JMZUIOB85844870.com] -> VYMAZANÉ
[PUP][FIREFX:Addon] tt0a1tnw.default : Shopper-Pro [{746505DC-0E21-4667-97F8-72EA6BCF5EEF}] -> VYMAZANÉ
[FIREFX:Addon] tt0a1tnw.default : Ge-Force [45633fba7e7d40fea9c29@9dc18447eea04021a325caf3.com] -> VYMAZANÉ
[FIREFX:Addon] tt0a1tnw.default : Sense [warnerroberts@hotmail.com] -> VYMAZANÉ
[FIREFX:Addon] tt0a1tnw.default : snipsmart [{6ccfd995-07be-49cf-8ad6-1422dc08761a}] -> VYMAZANÉ
[FIREFX:Addon] tt0a1tnw.default : TheGoPhoto.it V10 [EWBNO58637124@CLP39222015.com] -> VYMAZANÉ
[CHROME:Addon] Default : Google Docs [aohghmighlieiainnegkcijnfilokake] -> VYMAZANÉ
[CHROME:Addon] Default : Google Drive [apdfllckaahabafndbhieahigkjlhalf] -> ERROR [2]
[CHROME:Addon] Default : YouTube [blpcfgokakmgnkcojhhkbfbldkacnbeo] -> ERROR [2]
[CHROME:Addon] Default : Google Search [coobgpohoikkiipiblmjeljniedjpjpf] -> ERROR [2]
[CHROME:Addon] Default : GOSave [flnieocdfjglmnmlkfohhlcgjkggemol] -> ERROR [2]
[CHROME:Addon] Default : Google Wallet [nmmhkkegccagdldgiimedpiccmgmieda] -> ERROR [2]
[CHROME:Addon] Default : Gmail [pjkljhegncpnkpknbcohdijeoejaedia] -> ERROR [2]

¤¤¤ Kontrola MBR : ¤¤¤
+++++ PhysicalDrive0: +++++
--- User ---
[MBR] f01c25d13381ad5a5a3b829f29b8f377
[BSP] 70d612c5ce59166ebe123d5fe276d6d5 : Unknown MBR Code
Partition table:
0 - [ACTIVE] NTFS (0x7) [VISIBLE] Offset (sectors): 2048 | Size: 199 MB
1 - [XXXXXX] NTFS (0x7) [VISIBLE] Offset (sectors): 409600 | Size: 291863 MB
2 - [XXXXXX] NTFS (0x7) [VISIBLE] Offset (sectors): 598145024 | Size: 13181 MB
User = LL1 ... OK
User = LL2 ... OK


============================================
RKreport_SCN_09212014_114924.log - RKreport_SCN_09212014_194634.log

[Green1692]

Zoek.exe v5.0.0.0 Updated 20-September-2014
Tool run by Martin on ne 21. 09. 2014 at 19:56:42,50.
Microsoft Windows 7 Home Premium 6.1.7601 Service Pack 1 x64
Running in: Normal Mode Internet Access Detected
Launched: C:\Users\Martin\Desktop\zoek.com [Scan all users] [Script inserted]

==== System Restore Info ======================

21. 9. 2014 19:57:53 Zoek.exe System Restore Point Created Succesfully.

==== Reset Hosts File ======================

# Copyright (c) 1993-2006 Microsoft Corp.
#
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
#
# This file contains the mappings of IP addresses to host names. Each
# entry should be kept on an individual line. The IP address should
# be placed in the first column followed by the corresponding host name.
# The IP address and the host name should be separated by at least one
# space.
#
# Additionally, comments (such as these) may be inserted on individual
# lines or following the machine name denoted by a '#' symbol.
#
# For example:
#
# 102.54.94.97 rhino.acme.com # source server
# 38.25.63.10 x.acme.com # x client host

# localhost name resolution is handle within DNS itself.
127.0.0.1 localhost
::1 localhost

==== Deleting CLSID Registry Keys ======================

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9FDDE16B-836F-4806-AB1F-1455CBEFF289} deleted successfully

==== Deleting CLSID Registry Values ======================


==== Deleting Services ======================

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ReimageRealTimeProtector deleted successfully
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\ReimageRealTimeProtector deleted successfully

==== FireFox Fix ======================

Deleted from C:\Users\Martin\AppData\Roaming\Mozilla\Firefox\Profiles\tt0a1tnw.default\prefs.js:

Added to C:\Users\Martin\AppData\Roaming\Mozilla\Firefox\Profiles\tt0a1tnw.default\prefs.js:
user_pref("browser.startup.homepage", "http://www.google.com");
user_pref("browser.search.defaulturl", "http://www.google.com/search?btnG=Google+Search&q=");
user_pref("browser.newtab.url", "http://www.google.com/");
user_pref("browser.search.defaultengine", "Google");
user_pref("browser.search.defaultenginename", "Google");
user_pref("browser.search.selectedEngine", "Google");
user_pref("browser.search.order.1", "Google");
user_pref("keyword.URL", "http://www.google.com/search?btnG=Google+Search&q=");
user_pref("browser.search.suggest.enabled", true);
user_pref("browser.search.useDBForOrder", true);

ProfilePath: C:\Users\Martin\AppData\Roaming\Mozilla\Firefox\Profiles\tt0a1tnw.default

user.js not found
---- Lines aVJKPXI46039420JMZUIOB85844870com63429 removed from prefs.js ----
user_pref("extensions.aVJKPXI46039420JMZUIOB85844870com63429.63429.active", true);
user_pref("extensions.aVJKPXI46039420JMZUIOB85844870com63429.63429.addressbar", "NA");
user_pref("extensions.aVJKPXI46039420JMZUIOB85844870com63429.63429.addressbarenhanced", "");
user_pref("extensions.aVJKPXI46039420JMZUIOB85844870com63429.63429.asyncdb.was_copied", "true");
user_pref("extensions.aVJKPXI46039420JMZUIOB85844870com63429.63429.asyncinternaldb.was_copied", "true");
user_pref("extensions.aVJKPXI46039420JMZUIOB85844870com63429.63429.backgroundver", 1);
user_pref("extensions.aVJKPXI46039420JMZUIOB85844870com63429.63429.certdomaininstaller", "");
user_pref("extensions.aVJKPXI46039420JMZUIOB85844870com63429.63429.cookie.InstallationTime.expiration", "Fri Feb 01 2030 00:00:00 GMT+0100");
user_pref("extensions.aVJKPXI46039420JMZUIOB85844870com63429.63429.cookie.InstallationTime.value", "%221411115375%22");
user_pref("extensions.aVJKPXI46039420JMZUIOB85844870com63429.63429.cookie.InstallerParams.expiration", "Fri Feb 01 2030 00:00:00 GMT+0100");
user_pref("extensions.aVJKPXI46039420JMZUIOB85844870com63429.63429.cookie.InstallerParams.value", "%7B%22source_id%22%3A%22001504%22%2C%22sub_id%22%3A
user_pref("extensions.aVJKPXI46039420JMZUIOB85844870com63429.63429.description", "Just Save");
user_pref("extensions.aVJKPXI46039420JMZUIOB85844870com63429.63429.domain", "");
user_pref("extensions.aVJKPXI46039420JMZUIOB85844870com63429.63429.enablesearch", false);
user_pref("extensions.aVJKPXI46039420JMZUIOB85844870com63429.63429.homepage", "");
user_pref("extensions.aVJKPXI46039420JMZUIOB85844870com63429.63429.changeprevious", false);
user_pref("extensions.aVJKPXI46039420JMZUIOB85844870com63429.63429.iframe", false);
user_pref("extensions.aVJKPXI46039420JMZUIOB85844870com63429.63429.InstallationThankYouPage", true);
user_pref("extensions.aVJKPXI46039420JMZUIOB85844870com63429.63429.InstallationTime", 1411115375);
user_pref("extensions.aVJKPXI46039420JMZUIOB85844870com63429.63429.internaldb.__defualt_browser__.expiration", "Fri Feb 01 2030 00:00:00 GMT+0100");
user_pref("extensions.aVJKPXI46039420JMZUIOB85844870com63429.63429.internaldb.__defualt_browser__.value", "%22ch%22");
user_pref("extensions.aVJKPXI46039420JMZUIOB85844870com63429.63429.internaldb._installer_additional_info.expiration", "Fri Feb 01 2030 00:00:00 GMT+01
user_pref("extensions.aVJKPXI46039420JMZUIOB85844870com63429.63429.internaldb._installer_additional_info.value", "%7B%22asw%22%3A%5B0%2C12582917%2C0%5
user_pref("extensions.aVJKPXI46039420JMZUIOB85844870com63429.63429.internaldb.installer.expiration", "Fri Feb 01 2030 00:00:00 GMT+0100");
user_pref("extensions.aVJKPXI46039420JMZUIOB85844870com63429.63429.internaldb.installer.value", "%7B%22InstallerIdentifiers%22%3A%7B%22installer_bic%2
user_pref("extensions.aVJKPXI46039420JMZUIOB85844870com63429.63429.internaldb.InstallerIdentifiers.expiration", "Fri Feb 01 2030 00:00:00 GMT+0100");
user_pref("extensions.aVJKPXI46039420JMZUIOB85844870com63429.63429.internaldb.InstallerIdentifiers.value", "%7B%22installer_bic%22%3A%22753F1FFDA5DC49
user_pref("extensions.aVJKPXI46039420JMZUIOB85844870com63429.63429.internaldb.InstallerParams.expiration", "Fri Feb 01 2030 00:00:00 GMT+0100");
user_pref("extensions.aVJKPXI46039420JMZUIOB85844870com63429.63429.internaldb.InstallerParams.value", "%7B%22source_id%22%3A%22001504%22%2C%22sub_id%2
user_pref("extensions.aVJKPXI46039420JMZUIOB85844870com63429.63429.internaldb.InstallerParamsCache.expiration", "Fri Feb 01 2030 00:00:00 GMT+0100");
user_pref("extensions.aVJKPXI46039420JMZUIOB85844870com63429.63429.internaldb.InstallerParamsCache.value", "%7B%22source_id%22%3A%22001504%22%2C%22sub
user_pref("extensions.aVJKPXI46039420JMZUIOB85844870com63429.63429.internaldb.InstallerUserIdentifiersCache.expiration", "Fri Feb 01 2030 00:00:00 GMT
user_pref("extensions.aVJKPXI46039420JMZUIOB85844870com63429.63429.internaldb.InstallerUserIdentifiersCache.value", "%7B%22installer_bic%22%3A%22753F1
user_pref("extensions.aVJKPXI46039420JMZUIOB85844870com63429.63429.internaldb.monetization_plugin_bundledUrls.expiration", "Fri Feb 01 2030 00:00:00 G
user_pref("extensions.aVJKPXI46039420JMZUIOB85844870com63429.63429.internaldb.monetization_plugin_bundledWithHash.expiration", "Fri Feb 01 2030 00:00:
user_pref("extensions.aVJKPXI46039420JMZUIOB85844870com63429.63429.internaldb.monetization_plugin_bundledWithHash.value", "null");
user_pref("extensions.aVJKPXI46039420JMZUIOB85844870com63429.63429.internaldb.monetization_plugin_notBundledArr_.expiration", "Fri Feb 01 2030 00:00:0
user_pref("extensions.aVJKPXI46039420JMZUIOB85844870com63429.63429.internaldb.monetization_plugin_notBundledArr_.value", "%5B%5D");
user_pref("extensions.aVJKPXI46039420JMZUIOB85844870com63429.63429.internaldb.monetization_plugin_regBundledWithSoftware.expiration", "Fri Feb 01 2030
user_pref("extensions.aVJKPXI46039420JMZUIOB85844870com63429.63429.internaldb.monetization_plugin_regBundledWithSoftware.value", "%7B%7D");
user_pref("extensions.aVJKPXI46039420JMZUIOB85844870com63429.63429.internaldb.Resources_appVer.expiration", "Fri Feb 01 2030 00:00:00 GMT+0100");
user_pref("extensions.aVJKPXI46039420JMZUIOB85844870com63429.63429.internaldb.Resources_appVer.value", "22");
user_pref("extensions.aVJKPXI46039420JMZUIOB85844870com63429.63429.internaldb.Resources_lastVersion.expiration", "Fri Feb 01 2030 00:00:00 GMT+0100");
user_pref("extensions.aVJKPXI46039420JMZUIOB85844870com63429.63429.internaldb.Resources_lastVersion.value", "1");
user_pref("extensions.aVJKPXI46039420JMZUIOB85844870com63429.63429.internaldb.Resources_meta.expiration", "Fri Feb 01 2030 00:00:00 GMT+0100");
user_pref("extensions.aVJKPXI46039420JMZUIOB85844870com63429.63429.internaldb.Resources_meta.value", "%7B%7D");
user_pref("extensions.aVJKPXI46039420JMZUIOB85844870com63429.63429.internaldb.Resources_nextCheck.expiration", "Fri Sep 19 2014 18:04:59 GMT+0200");
user_pref("extensions.aVJKPXI46039420JMZUIOB85844870com63429.63429.internaldb.Resources_nextCheck.value", "true");
user_pref("extensions.aVJKPXI46039420JMZUIOB85844870com63429.63429.internaldb.Resources_queue.expiration", "Fri Feb 01 2030 00:00:00 GMT+0100");
user_pref("extensions.aVJKPXI46039420JMZUIOB85844870com63429.63429.internaldb.Resources_queue.value", "%7B%7D");
user_pref("extensions.aVJKPXI46039420JMZUIOB85844870com63429.63429.lastDailyReport", "1411121094355");
user_pref("extensions.aVJKPXI46039420JMZUIOB85844870com63429.63429.lastUpdate", "1411121093293");
user_pref("extensions.aVJKPXI46039420JMZUIOB85844870com63429.63429.manifesturl", "");
user_pref("extensions.aVJKPXI46039420JMZUIOB85844870com63429.63429.name", "SavePass 1.1");
user_pref("extensions.aVJKPXI46039420JMZUIOB85844870com63429.63429.newtab", "");
user_pref("extensions.aVJKPXI46039420JMZUIOB85844870com63429.63429.opensearch", "");
user_pref("extensions.aVJKPXI46039420JMZUIOB85844870com63429.63429.pluginsurl", "http://js.newclientonlinestorage.com/plugin/apps/63429/plugins/na/ff/
user_pref("extensions.aVJKPXI46039420JMZUIOB85844870com63429.63429.pluginsversion", 17);
user_pref("extensions.aVJKPXI46039420JMZUIOB85844870com63429.63429.publisher", "OB");
user_pref("extensions.aVJKPXI46039420JMZUIOB85844870com63429.63429.searchstatus", 0);
user_pref("extensions.aVJKPXI46039420JMZUIOB85844870com63429.63429.setnewtab", false);
user_pref("extensions.aVJKPXI46039420JMZUIOB85844870com63429.63429.thankyou", "");
user_pref("extensions.aVJKPXI46039420JMZUIOB85844870com63429.63429.updateinterval", 360);
user_pref("extensions.aVJKPXI46039420JMZUIOB85844870com63429.63429.ver", 22);
user_pref("extensions.aVJKPXI46039420JMZUIOB85844870com63429.63429.VJKPXI46039420@JMZUIOB85844870.comasyncdb_dbWasSet", true);
user_pref("extensions.aVJKPXI46039420JMZUIOB85844870com63429.63429.VJKPXI46039420@JMZUIOB85844870.comasyncdb_dbWasSet_FF25_FIX", true);
user_pref("extensions.aVJKPXI46039420JMZUIOB85844870com63429.63429.VJKPXI46039420@JMZUIOB85844870.comasyncinternaldb_dbWasSet", true);
user_pref("extensions.aVJKPXI46039420JMZUIOB85844870com63429.63429.VJKPXI46039420@JMZUIOB85844870.comasyncinternaldb_dbWasSet_FF25_FIX", true);
user_pref("extensions.aVJKPXI46039420JMZUIOB85844870com63429.63429.VJKPXI46039420@JMZUIOB85844870.comaVJKPXI46039420JMZUIOB85844870com63429_dbWasSet",
user_pref("extensions.aVJKPXI46039420JMZUIOB85844870com63429.63429.VJKPXI46039420@JMZUIOB85844870.comaVJKPXI46039420JMZUIOB85844870com63429_dbWasSet_F
user_pref("extensions.aVJKPXI46039420JMZUIOB85844870com63429.apps", "63429");
user_pref("extensions.aVJKPXI46039420JMZUIOB85844870com63429.bic", "1488d5f1ecee4ac2f238d86a49c8d086");
user_pref("extensions.aVJKPXI46039420JMZUIOB85844870com63429.cid", 63429);
user_pref("extensions.aVJKPXI46039420JMZUIOB85844870com63429.firstrun", false);
user_pref("extensions.aVJKPXI46039420JMZUIOB85844870com63429.hadappinstalled", true);
user_pref("extensions.aVJKPXI46039420JMZUIOB85844870com63429.installationdate", 1411121094);
user_pref("extensions.aVJKPXI46039420JMZUIOB85844870com63429.installerAdditionalInfo", "{\"asw\":[0, 12582917, 0],\"browser_name\":\"ff\"}");
user_pref("extensions.aVJKPXI46039420JMZUIOB85844870com63429.modetype", "production");
user_pref("extensions.aVJKPXI46039420JMZUIOB85844870com63429.reportInstall", true);
user_pref("extensions.aVJKPXI46039420JMZUIOB85844870com63429.statsDailyCounter", 1);
---- Lines extensions.IjYk1XGr1JxL3HKL removed from prefs.js ----
user_pref("extensions.IjYk1XGr1JxL3HKL.epoch", "1411207497");
user_pref("extensions.IjYk1XGr1JxL3HKL.url", "http://liveprosoftwaregreat.in/sync2/?q=hfZ9ofbMDMnMCyVUojw6tMqLDe49CNU0k9IMCMlNhd9Fqda4rjrEpda5rdwMBzqU
---- FireFox user.js and prefs.js backups ----

prefs_201421.09._2019_.backup

==== Deleting Files \ Folders ======================

C:\PROGRA~3\Reimage Protector deleted
C:\PROGRA~3\InstallMate deleted
C:\Users\Martin\AppData\Local\CrashRpt deleted
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Reimage Repair deleted
C:\rei deleted
C:\Windows\Reimage.ini deleted
C:\windows\SysNative\tasks\ReimageUpdater deleted
C:\windows\SysNative\tasks\YTDownloaderUpd deleted
C:\windows\SysNative\tasks\Microsoft\Windows\Maintenance\SMupdate2 deleted
C:\windows\SysNative\tasks\Microsoft\Windows\Multimedia\SMupdate3 deleted
C:\windows\SysNative\tasks\temp_04d09637-39d5-4668-8635-e397858e58b1 deleted
C:\windows\SysNative\tasks\temp_2047bae6-eea9-4b6e-8639-0e49c6422d76-6 deleted
C:\windows\SysNative\tasks\temp_21ed3ea4-a896-446e-97d8-9d3d7b7a0247 deleted
C:\windows\SysNative\tasks\temp_7abad424-0b2a-452a-a110-32d11125f0b4-2 deleted
C:\Windows\SysNative\config\systemprofile\Searches deleted
C:\Users\Martin\AppData\Roaming\Mozilla\Firefox\Profiles\tt0a1tnw.default\searchplugins\MyOnlineSearch.xml deleted
C:\Users\Martin\Desktop\Search.lnk deleted
C:\Users\Martin\nssm.exe deleted
C:\Users\Martin\utorrent.exe deleted
"C:\Users\Martin\AppData\Roaming\BXHQTQEE" deleted
"C:\Users\Martin\AppData\Roaming\CMKO" deleted
"C:\Users\Martin\AppData\Roaming\ET" deleted
"C:\Users\Martin\AppData\Roaming\EZ" deleted
"C:\Users\Martin\AppData\Roaming\JDSN" deleted
"C:\Users\Martin\AppData\Roaming\MNFUP" deleted
"C:\PROGRA~3\c772245289bdad83\{C87834EB-A2A0-B9D4-AA9A-C263D1191051}.20140913100814" deleted
"C:\PROGRA~3\c772245289bdad83" deleted

==== Firefox Extensions Registry ======================

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Mozilla\Firefox\Extensions]
"otis@digitalpersona.com"="C:\Program Files (x86)\DigitalPersona\Bin\FirefoxExt" [22. 04. 2014 12:49]
[HKEY_CURRENT_USER\Software\Mozilla\Firefox\Extensions]
"otis@digitalpersona.com"="C:\Program Files (x86)\DigitalPersona\Bin\firefoxext" [22. 04. 2014 12:49]

==== Firefox Extensions ======================

AppDir: C:\Program Files (x86)\Mozilla Firefox
- Default - %AppDir%\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
- Skype Click to Call - %AppDir%\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}.xpi

==== Firefox Plugins ======================

Profilepath: C:\Users\Martin\AppData\Roaming\Mozilla\Firefox\Profiles\tt0a1tnw.default
DFC9460CC37E5C414DC4680B10C19E7A - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_15_0_0_152.dll - Shockwave Flash


==== Chromium Look ======================

HKEY_LOCAL_MACHINE\SOFTWARE\Google\Chrome\Extensions
lifbcibllhkdhoafpjfnlhfpfgnpldfl - C:\Program Files (x86)\Skype\Toolbars\ChromeExtension\skype_chrome_extension.crx[14. 07. 2014 18:22]

GOSave - Administrator\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\flnieocdfjglmnmlkfohhlcgjkggemol
GOSave - Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\flnieocdfjglmnmlkfohhlcgjkggemol
GOSave - Administrator\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\flnieocdfjglmnmlkfohhlcgjkggemol
GOSave - Guest\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\flnieocdfjglmnmlkfohhlcgjkggemol
GOSave - Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\flnieocdfjglmnmlkfohhlcgjkggemol
GOSave - Guest\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\flnieocdfjglmnmlkfohhlcgjkggemol
GOSave - HomeGroupUser$\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\flnieocdfjglmnmlkfohhlcgjkggemol
GOSave - HomeGroupUser$\AppData\Local\Google\Chrome\User Data\Default\Extensions\flnieocdfjglmnmlkfohhlcgjkggemol
GOSave - HomeGroupUser$\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\flnieocdfjglmnmlkfohhlcgjkggemol
GOSave - Martin\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\flnieocdfjglmnmlkfohhlcgjkggemol
GOSave - Martin\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\flnieocdfjglmnmlkfohhlcgjkggemol

==== Chromium Fix ======================

C:\Users\Martin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\https_www.superfish.com_0.localstorage deleted successfully
C:\Users\Martin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\https_www.superfish.com_0.localstorage-journal deleted successfully
C:\Users\Martin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_www.speedanalysis.net_0.localstorage deleted successfully
C:\Users\Martin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_www.speedanalysis.net_0.localstorage-journal deleted successfully
C:\Users\Martin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_www.istartsurf.com_0.localstorage deleted successfully
C:\Users\Martin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_www.istartsurf.com_0.localstorage-journal deleted successfully
C:\Users\Administrator\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\flnieocdfjglmnmlkfohhlcgjkggemol deleted successfully
C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\flnieocdfjglmnmlkfohhlcgjkggemol deleted successfully
C:\Users\Administrator\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\flnieocdfjglmnmlkfohhlcgjkggemol deleted successfully
C:\Users\Guest\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\flnieocdfjglmnmlkfohhlcgjkggemol deleted successfully
C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\flnieocdfjglmnmlkfohhlcgjkggemol deleted successfully
C:\Users\Guest\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\flnieocdfjglmnmlkfohhlcgjkggemol deleted successfully
C:\Users\HomeGroupUser$\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\flnieocdfjglmnmlkfohhlcgjkggemol deleted successfully
C:\Users\HomeGroupUser$\AppData\Local\Google\Chrome\User Data\Default\Extensions\flnieocdfjglmnmlkfohhlcgjkggemol deleted successfully
C:\Users\HomeGroupUser$\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\flnieocdfjglmnmlkfohhlcgjkggemol deleted successfully
C:\Users\Martin\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\flnieocdfjglmnmlkfohhlcgjkggemol deleted successfully
C:\Users\Martin\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\flnieocdfjglmnmlkfohhlcgjkggemol deleted successfully

==== Set IE to Default ======================

Old Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"="http://www.google.com"
"Default_Page_URL"="http://www.google.com"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
"Default_Search_URL"="http://www.google.com"
"Default_Page_URL"="http://www.google.com"
"Start Page"="http://www.google.com"
"Search Page"="http://www.google.com"
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main]
"Default_Search_URL"="http://www.google.com"
"Default_Page_URL"="http://www.google.com"
"Start Page"="http://www.google.com"
"Search Page"="http://www.google.com"
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes]
No DefaultScope Set For HKCU

New Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Default_Page_URL"="http://go.microsoft.com/fwlink/?LinkId=69157"
"Start Page"="http://www.google.com"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
"Default_Search_URL"="http://go.microsoft.com/fwlink/?LinkId=54896"
"Search Page"="http://go.microsoft.com/fwlink/?LinkId=54896"
"Default_Page_URL"="http://go.microsoft.com/fwlink/?LinkId=69157"
"Start Page"="http://go.microsoft.com/fwlink/?LinkId=69157"
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main]
"Default_Search_URL"="http://go.microsoft.com/fwlink/?LinkId=54896"
"Search Page"="http://go.microsoft.com/fwlink/?LinkId=54896"
"Default_Page_URL"="http://go.microsoft.com/fwlink/?LinkId=69157"
"Start Page"="http://go.microsoft.com/fwlink/?LinkId=69157"
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes]
"DefaultScope"="{012E1000-F331-11DB-8314-0800200C9A66}"

==== All HKCU SearchScopes ======================

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes
{012E1000-F331-11DB-8314-0800200C9A66} Google Url="http://www.google.com/search?q={searchTerms}"
{0633EE93-D776-472f-A0FF-E1416B8B2E3A} Bing Url="http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC"

==== Reset Google Chrome ======================

C:\Users\Martin\AppData\Local\Google\Chrome\User Data\Default\Preferences was reset successfully
C:\Users\Martin\AppData\Local\Google\Chrome\User Data\Default\Web Data was reset successfully

==== Deleting Registry Keys ======================

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\Reimage Repair deleted successfully
HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\YTDownloader deleted successfully

==== Empty IE Cache ======================

C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\Martin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\SysNative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\sysWoW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\serviceprofiles\Localservice\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\sysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully

==== Empty FireFox Cache ======================

No FireFox Cache found

==== Empty Chrome Cache ======================

C:\Users\Martin\AppData\Local\Google\Chrome\User Data\Default\Cache emptied successfully

==== Empty All Flash Cache ======================

Flash Cache Emptied Successfully

==== Empty All Java Cache ======================

No Java Cache Found

==== C:\zoek_backup content ======================

C:\zoek_backup (files=130 folders=45 9126881 bytes)

==== Empty Temp Folders ======================

C:\Users\Default\AppData\Local\temp emptied successfully
C:\Users\Default User\AppData\Local\temp emptied successfully
C:\Users\Martin\AppData\Local\Temp will be emptied at reboot
C:\Users\Public\AppData\Local\temp emptied successfully
C:\Windows\serviceprofiles\networkservice\AppData\Local\Temp will be emptied at reboot
C:\Windows\serviceprofiles\Localservice\AppData\Local\Temp emptied successfully
C:\Windows\Temp will be emptied at reboot

==== After Reboot ======================

==== Empty Temp Folders ======================

C:\Windows\Temp successfully emptied
C:\Users\Martin\AppData\Local\Temp successfully emptied

==== Empty Recycle Bin ======================

C:\$RECYCLE.BIN successfully emptied

==== Deleting Files / Folders ======================

"C:\Windows\serviceprofiles\networkservice\AppData\Local\Temp\Low" not deleted

==== EOF on ne 21. 09. 2014 at 20:32:13,54 ======================

[jaro3]

Vypni rez. ochranu u antiviru a antispywaru,příp. firewall..

Stáhni si ComboFix (by sUBs)
a ulož si ho na plochu.
Ukonči všechna aktivní okna a spusť ho.
- Po spuštění se zobrazí podmínky užití, potvrď je stiskem tlačítka Ano
- Dále postupuj dle pokynů, během aplikování ComboFixu neklikej do zobrazujícího se okna
- Po dokončení skenování by měl program vytvořit log - C:\ComboFix.txt - zkopíruj sem prosím celý jeho obsah
Pokud budou problémy , spusť ho v nouz. režimu.

Upozornění : Může se stát, že po aplikaci Combofixu a restartu počítače, Windows nenaběhnou , nebo nenajede plocha , budou problémy s připojením, pak znovu restartuj počítač, pokud to nepomůže , po restartu mačkej klávesu F8 a pak zvol poslední známou funkční konfiguraci. , či použij bod obnovy.

[Green1692]

wComboFix 14-09-22.01 - Martin . 09. 2014 22:44:23.1.2 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1250.421.1051.18.4063.2459 [GMT 2:00]
Running from: c:\users\Martin\Desktop\ComboFix.exe
AV: ESET Smart Security 7.0 *Disabled/Updated* {19259FAE-8396-A113-46DB-15B0E7DFA289}
FW: ESET personal firewall *Disabled* {211E1E8B-C9F9-A04B-6D84-BC85190CE5F2}
SP: ESET Smart Security 7.0 *Disabled/Updated* {A2447E4A-A5AC-AE9D-7C6B-2EC29C58E834}
SP: Windows Defender *Enabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((( Files Created from 2014-08-22 to 2014-09-22 )))))))))))))))))))))))))))))))
.
.
2014-09-22 20:52 . 2014-09-22 20:52 -------- d-----w- c:\users\Public\AppData\Local\temp
2014-09-21 17:55 . 2014-09-21 18:30 -------- d-----w- C:\zoek_backup
2014-09-21 09:38 . 2014-09-21 17:36 36456 ----a-w- c:\windows\system32\drivers\TrueSight.sys
2014-09-21 09:38 . 2014-09-21 09:38 -------- d-----w- c:\programdata\RogueKiller
2014-09-20 14:04 . 2014-09-20 14:05 -------- d-----w- c:\program files (x86)\Malwarebytes Anti-Malware
2014-09-20 14:04 . 2014-05-12 05:26 63704 ----a-w- c:\windows\system32\drivers\mwac.sys
2014-09-20 14:04 . 2014-05-12 05:26 91352 ----a-w- c:\windows\system32\drivers\mbamchameleon.sys
2014-09-20 14:04 . 2014-05-12 05:25 25816 ----a-w- c:\windows\system32\drivers\mbam.sys
2014-09-20 13:59 . 2014-09-21 07:03 -------- d-----w- C:\AdwCleaner
2014-09-19 13:19 . 2014-09-19 13:19 -------- d-----w- c:\program files (x86)\Reimageplus.com
2014-09-18 13:44 . 2008-04-30 13:02 414632 ----a-w- c:\windows\system32\drivers\difxapi.dll
2014-09-18 13:44 . 2008-04-30 13:02 52736 ----a-w- c:\windows\system32\drivers\umpusbvista.sys
2014-09-18 13:44 . 2008-07-24 10:03 101760 ----a-w- c:\windows\SysWow64\drivers\hwusbser.sys
2014-09-18 13:44 . 2008-03-28 09:34 2560 ----a-w- c:\windows\SysWow64\SHCDMACoInstaller.dll
2014-09-18 13:44 . 2014-09-19 13:16 -------- d-----w- c:\program files (x86)\PC Suite
2014-09-15 17:06 . 2014-09-15 17:06 -------- d-----w- c:\users\Martin\AppData\Local\Mega Limited
2014-09-15 17:04 . 2014-09-15 17:09 -------- d-----w- c:\users\Martin\AppData\Local\MEGAsync
2014-09-15 16:46 . 2014-09-15 16:46 -------- d-----w- c:\users\Martin\AppData\Roaming\Awesomium
2014-09-15 16:39 . 2014-09-15 16:39 -------- d-----w- c:\users\Martin\AppData\Local\BNSUpdater
2014-09-15 16:26 . 2014-09-15 16:26 -------- d-----w- c:\program files (x86)\PlayBns.com
2014-09-14 15:23 . 2014-09-15 17:08 -------- d-----w- c:\users\Martin\AppData\Local\Glyph
2014-09-14 15:23 . 2014-09-14 15:23 -------- d-----w- c:\programdata\Glyph
2014-09-14 15:23 . 2014-09-15 17:08 -------- d-----w- c:\program files (x86)\Glyph
2014-09-14 15:20 . 2014-09-15 17:13 -------- d-----w- c:\program files (x86)\RIFT
2014-09-13 12:07 . 2014-09-13 12:07 -------- d-----w- c:\program files (x86)\Electronic Arts
2014-09-13 10:02 . 2014-09-19 13:02 -------- d-----w- c:\users\Martin\AppData\Roaming\BitTorrent
2014-09-13 08:08 . 2014-09-13 08:08 -------- d-----w- c:\users\Martin\AppData\Local\Comodo
2014-09-13 08:08 . 2014-09-13 08:08 -------- d-----w- c:\users\HomeGroupUser$
2014-09-13 08:08 . 2014-09-13 08:08 -------- d-----w- c:\users\Guest
2014-09-13 08:08 . 2014-09-13 08:08 -------- d-----w- c:\users\Administrator
2014-09-12 18:18 . 2014-09-12 18:20 -------- d-----w- c:\users\Martin\AppData\Roaming\DarkSoulsII
2014-09-12 17:29 . 2014-09-19 08:51 -------- d-----w- c:\program files (x86)\Dark Souls II
2014-09-12 17:27 . 2014-09-12 17:27 -------- d-----w- c:\users\Martin\dlimagecache
2014-09-12 17:27 . 2014-09-12 17:27 -------- d-----w- c:\users\Martin\apps
2014-09-12 17:27 . 2014-07-07 09:00 54 ----a-w- c:\users\Martin\uninstall.cmd
2014-09-12 17:27 . 2014-07-07 09:00 276 ----a-w- c:\users\Martin\install.cmd
2014-09-12 09:45 . 2014-09-12 09:45 -------- d-----w- c:\users\Martin\AppData\Local\Soul-Aion
2014-09-10 15:25 . 2014-09-10 15:25 17903792 ----a-w- c:\windows\SysWow64\FlashPlayerInstaller.exe
2014-09-06 06:50 . 2014-08-21 09:24 11319192 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{720E50D1-2782-41FB-A915-75A093CD980F}\mpengine.dll
2014-09-05 06:12 . 2014-09-05 06:12 -------- d-----w- C:\Hry
2014-09-04 20:33 . 2014-09-04 20:33 -------- d-----w- c:\users\Public\CyberLink
2014-09-03 22:11 . 2014-09-22 09:58 458064 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight-2\SpotlightResources.dll
2014-09-03 10:59 . 2014-09-15 18:38 -------- d-----w- C:\Downloads
2014-09-03 10:59 . 2014-09-12 14:28 -------- d-----w- C:\Torrents
2014-09-03 10:56 . 2014-09-22 20:48 -------- d-----w- C:\uTorrent
2014-09-03 10:40 . 2014-09-20 17:12 -------- d-----w- c:\program files (x86)\The KMPlayer
2014-09-02 07:07 . 2014-09-22 06:56 48648 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\UpdateableMarkup-2\Markup.dll
2014-08-29 17:59 . 2014-08-29 17:59 -------- d-----w- c:\program files (x86)\Common Files\Skype
2014-08-29 12:28 . 2014-09-14 07:25 48648 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\UpdateableMarkup\Markup.dll
2014-08-29 12:28 . 2014-09-19 06:11 458064 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight\SpotlightResources.dll
2014-08-28 16:07 . 2014-08-28 16:17 -------- d-----w- C:\Nový priečinok
2014-08-25 08:48 . 2014-08-25 08:48 819560 ----a-w- c:\program files\Common Files\System\SysMenu64.dll
2014-08-25 08:48 . 2014-08-25 08:48 648040 ----a-w- c:\program files\Common Files\System\SysMenu.dll
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2014-09-22 19:28 . 2014-04-24 17:11 122584 ----a-w- c:\windows\system32\drivers\MBAMSwissArmy.sys
2014-09-22 08:38 . 2014-07-18 15:30 163504 ----a-w- c:\programdata\Microsoft\Windows\Sqm\Manifest\Sqm10145.bin
2014-09-10 15:25 . 2014-05-21 13:07 71344 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2014-09-10 15:25 . 2014-05-21 13:07 701104 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2014-08-31 06:58 . 2010-06-24 09:33 23256 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll
2014-08-25 04:53 . 2014-04-22 11:37 270496 ------w- c:\windows\system32\MpSigStub.exe
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LightScribe Control Panel"="c:\program files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe" [2009-06-17 2363392]
"Skype"="c:\program files (x86)\Skype\Phone\Skype.exe" [2014-07-24 21650016]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2009-07-02 98304]
"HPCam_Menu"="c:\program files (x86)\Hewlett-Packard\Media\Webcam\MUITransfer\MUIStartMenu.exe" [2009-02-25 218408]
"DpAgent"="c:\program files (x86)\DigitalPersona\Bin\dpagent.exe" [2009-07-17 842816]
"QlbCtrl.exe"="c:\program files (x86)\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2009-11-24 323640]
"UpdatePRCShortCut"="c:\program files (x86)\Hewlett-Packard\Recovery\MUITransfer\MUIStartMenu.exe" [2009-05-19 222504]
"SunJavaUpdateSched"="c:\program files (x86)\Java\jre6\bin\jusched.exe" [2009-09-18 148888]
"HP Software Update"="c:\program files (x86)\Hp\HP Software Update\HPWuSchd2.exe" [2008-12-08 54576]
"WirelessAssistant"="c:\program files (x86)\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2009-07-23 498744]
"Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2009-7-30 1079584]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\system]
"WallpaperStyle"= 2
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"mixer2"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]
R3 cpuz134;cpuz134;c:\users\Martin\AppData\Local\Temp\cpuz134\cpuz134_x64.sys;c:\users\Martin\AppData\Local\Temp\cpuz134\cpuz134_x64.sys [x]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x]
R3 mvusbews;USB EWS Device;c:\windows\system32\Drivers\mvusbews.sys;c:\windows\SYSNATIVE\Drivers\mvusbews.sys [x]
R3 NETw1v64;Intel(R) Wireless WiFi Link 1000 Series Adapter Driver for Windows Vista 64 Bit;c:\windows\system32\DRIVERS\NETw1v64.sys;c:\windows\SYSNATIVE\DRIVERS\NETw1v64.sys [x]
R3 netw5v64;Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 64 Bit;c:\windows\system32\DRIVERS\netw5v64.sys;c:\windows\SYSNATIVE\DRIVERS\netw5v64.sys [x]
R3 SrvHsfHDA;SrvHsfHDA;c:\windows\system32\DRIVERS\VSTAZL6.SYS;c:\windows\SYSNATIVE\DRIVERS\VSTAZL6.SYS [x]
R3 SrvHsfV92;SrvHsfV92;c:\windows\system32\DRIVERS\VSTDPV6.SYS;c:\windows\SYSNATIVE\DRIVERS\VSTDPV6.SYS [x]
R3 SrvHsfWinac;SrvHsfWinac;c:\windows\system32\DRIVERS\VSTCNXT6.SYS;c:\windows\SYSNATIVE\DRIVERS\VSTCNXT6.SYS [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 WatAdminSvc;Služba Windows Activation Technologies;c:\windows\system32\Wat\WatAdminSvc.exe;c:\windows\SYSNATIVE\Wat\WatAdminSvc.exe [x]
R3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;c:\windows\system32\DRIVERS\yk62x64.sys;c:\windows\SYSNATIVE\DRIVERS\yk62x64.sys [x]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe;c:\program files\Windows Live\Mesh\wlcrasvc.exe [x]
S0 epfwwfp;epfwwfp;c:\windows\system32\DRIVERS\epfwwfp.sys;c:\windows\SYSNATIVE\DRIVERS\epfwwfp.sys [x]
S1 eamonm;eamonm;c:\windows\system32\DRIVERS\eamonm.sys;c:\windows\SYSNATIVE\DRIVERS\eamonm.sys [x]
S1 ehdrv;ehdrv;c:\windows\system32\DRIVERS\ehdrv.sys;c:\windows\SYSNATIVE\DRIVERS\ehdrv.sys [x]
S1 EpfwLWF;Epfw NDIS LightWeight Filter;c:\windows\system32\DRIVERS\EpfwLWF.sys;c:\windows\SYSNATIVE\DRIVERS\EpfwLWF.sys [x]
S2 AESTFilters;Andrea ST Filters Service;c:\windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_ccf0dd3cb081af84\AESTSr64.exe;c:\windows\SYSNATIVE\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_ccf0dd3cb081af84\AESTSr64.exe [x]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe;c:\windows\SYSNATIVE\atiesrxx.exe [x]
S2 c2cautoupdatesvc;Skype Click to Call Updater;c:\program files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe;c:\program files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [x]
S2 c2cpnrsvc;Skype Click to Call PNR Service;c:\program files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe;c:\program files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [x]
S2 ekrn;ESET Service;c:\program files\ESET\ESET Smart Security\x86\ekrn.exe;c:\program files\ESET\ESET Smart Security\x86\ekrn.exe [x]
S2 HPSIService;HP SI Service;c:\windows\system32\HPSIsvc.exe;c:\windows\SYSNATIVE\HPSIsvc.exe [x]
S2 hpsrv;HP Service;c:\windows\system32\Hpservice.exe;c:\windows\SYSNATIVE\Hpservice.exe [x]
S2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes Anti-Malware\mbamservice.exe;c:\program files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [x]
S2 uTorrent Server;uTorrent Server;c:\utorrent\nssm.exe;c:\utorrent\nssm.exe [x]
S2 vfsFPService;Validity Fingerprint Service;c:\windows\system32\vfsFPService.exe;c:\windows\SYSNATIVE\vfsFPService.exe [x]
S3 AVerAF15;HP DVB-T TV Tuner;c:\windows\system32\Drivers\AVerAF15.sys;c:\windows\SYSNATIVE\Drivers\AVerAF15.sys [x]
S3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\DRIVERS\btwl2cap.sys;c:\windows\SYSNATIVE\DRIVERS\btwl2cap.sys [x]
S3 Com4QLBEx;Com4QLBEx;c:\program files (x86)\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe;c:\program files (x86)\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe [x]
S3 enecir;ENE CIR Receiver;c:\windows\system32\DRIVERS\enecir.sys;c:\windows\SYSNATIVE\DRIVERS\enecir.sys [x]
S3 JMCR;JMCR;c:\windows\system32\DRIVERS\jmcr.sys;c:\windows\SYSNATIVE\DRIVERS\jmcr.sys [x]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys;c:\windows\SYSNATIVE\drivers\mbam.sys [x]
S3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\MBAMSwissArmy.sys;c:\windows\SYSNATIVE\drivers\MBAMSwissArmy.sys [x]
S3 MBAMWebAccessControl;MBAMWebAccessControl;c:\windows\system32\drivers\mwac.sys;c:\windows\SYSNATIVE\drivers\mwac.sys [x]
S3 NETw5s64;Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows 7 - 64 Bit;c:\windows\system32\DRIVERS\NETw5s64.sys;c:\windows\SYSNATIVE\DRIVERS\NETw5s64.sys [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x]
.
.
--- Other Services/Drivers In Memory ---
.
*NewlyCreated* - MBAMSWISSARMY
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
2009-06-17 10:11 451872 ----a-w- c:\program files (x86)\Common Files\LightScribe\LSRunOnce.exe
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2014-04-22 12:24 1077576 ----a-w- c:\program files (x86)\Google\Chrome\Application\34.0.1847.116\Installer\chrmstp.exe
.
Contents of the 'Scheduled Tasks' folder
.
2014-09-22 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-05-21 15:25]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SysTrayApp"="c:\program files\IDT\WDM\sttray64.exe" [2009-07-22 450048]
"SmartMenu"="c:\program files\Hewlett-Packard\HP MediaSmart\SmartMenu.exe" [2009-07-21 610872]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-09-18 171520]
"egui"="c:\program files\ESET\ESET Smart Security\egui.exe" [2013-09-12 5618456]
"Zune Launcher"="c:\program files\Zune\ZuneLauncher.exe" [2011-08-05 163552]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"NCPluginUpdater"="c:\program files (x86)\Hewlett-Packard\HP Health Check\ActiveCheck\product_line\NCPluginUpdater.exe" [2014-08-19 21720]
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com
uLocal Page = c:\windows\system32\blank.htm
mLocal Page = c:\windows\SysWOW64\blank.htm
IE: E&xportovať do programu Microsoft Excel - c:\progra~2\MICROS~1\Office12\EXCEL.EXE/3000
IE: Send image to &Bluetooth Device... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: Send page to &Bluetooth Device... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
TCP: DhcpNameServer = 192.168.2.1
FF - ProfilePath - c:\users\Martin\AppData\Roaming\Mozilla\Firefox\Profiles\tt0a1tnw.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?btnG=Google+Search&q=
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com
FF - prefs.js: keyword.URL - hxxp://www.google.com/search?btnG=Google+Search&q=
.
- - - - ORPHANS REMOVED - - - -
.
ShellIconOverlayIdentifiers-{056D528D-CE28-4194-9BA3-BA2E9197FF8C} - (no file)
ShellIconOverlayIdentifiers-{05B38830-F4E9-4329-978B-1DD28605D202} - (no file)
ShellIconOverlayIdentifiers-{0596C850-7BDD-4C9D-AFDF-873BE6890637} - (no file)
Wow6432Node-HKLM-Run-<NO NAME> - (no file)
HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start
ShellIconOverlayIdentifiers-{056D528D-CE28-4194-9BA3-BA2E9197FF8C} - (no file)
ShellIconOverlayIdentifiers-{05B38830-F4E9-4329-978B-1DD28605D202} - (no file)
ShellIconOverlayIdentifiers-{0596C850-7BDD-4C9D-AFDF-873BE6890637} - (no file)
HKLM-Run-SynTPEnh - c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe
.
.
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
Completion time: 2014-09-22 22:55:05
ComboFix-quarantined-files.txt 2014-09-22 20:55
.
Pre-Run: 95 606 767 616 bytes free
Post-Run: 95 117 758 464 bytes free
.
- - End Of File - - D77BA3FB76AAAA0A60092EAC2A224A7A
1E7DBE638BD97CB3CB6AED759F0DC92D

[jaro3]

Vypni rez. ochranu u antiviru a antispywaru,příp. firewall..

Otevři si Poznámkový blok (Start -> Spustit... a napiš do okna Notepad a dej Ok.
Zkopíruj do něj následující celý text označený zeleně:

Kód: Vybrat vše

ClearJavaCache::
KillAll::
Folder::
c:\program files (x86)\Skype\Updater

Driver::
SkypeUpdate

RegLock::
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]

Zvol možnost Soubor -> Uložit jako... a nastav tyto parametry:
Název souboru: zde napiš: CFScript.txt
Uložit jako typ: tak tam vyber Všechny soubory
Ulož soubor na plochu.
Ukonči všechna aktivní okna.

Uchop myší vytvořený skript CFScript.txt, přemísti ho nad stažený program ComboFix.exe a když se oba soubory překryjí, skript upusť.
- Automaticky se spustí ComboFix
- Vlož sem log, který vyběhne v závěru čistícího procesu + nový log z HJT

Upozornění : Může se stát, že po aplikaci Combofixu a restartu počítače, Windows nenaběhnou , nebo nenajede plocha , budou problémy s připojením, pak znovu restartuj počítač, pokud to nepomůže , po restartu mačkej klávesu F8 a pak zvol poslední známou funkční konfiguraci. , či použij bod obnovy.

Stáhni si aswMBR
na svojí plochu. Uzavři všechna okna , programy a prohlížeče. Poklepej na aswMBR.exe. Pokud se objeví hláška o možnosti stáhnutí databáze Avastu , klikni na NE. Poté klikni na „Scan“ . Po skenu klikni na „Save Log“ a ulož si log na plochu .Zkopíruj sem celý obsah toho logu. Pak klikni na „Exit“ k zavření programu.