Prosim o kontrolu logu. Vyřešeno

[Orcus]

Ještě dodej log z MBAM po smazání / přesunu do karantény.


Zavři všechny programy a prohlížeče. Deaktivuj antivir a firewall.
Prosím, odpoj všechny USB nebo externí disky z počítače před spuštěním tohoto programu.
Spusť RogueKiller ( Pro Windows Vista nebo Windows 7, klepni pravým a vyber "Spustit jako správce", ve Windows XP poklepej ke spuštění).
- Počkej, až Prescan dokončí práci...
- Počkej, dokud status okno zobrazuje "Prohledat "
- V záložkách (Registry , Tasks , Web Browser apod.) vše zatrhni (dej zatržítka).
- Klikni na "Smazat"
- Počkej, dokud Status box zobrazuje " Mazání dokončeno "
- Klikni na "Zpráva" a zkopíruj a vlož obsah té zprávy prosím sem. Log je možno nalézt v RKreport [číslo]. txt na ploše.
- Zavři RogueKiller

====================================================

Stáhni
Zoek.exe

a ulož si ho na plochu.
Zavři všechny ostatní programy, okna i prohlížeče.
Spusť Zoek.exe ( u win vista , win7, 8 klikni na něj pravým a vyber : „Spustit jako správce“
- pozor, náběh programu může trvat déle.

Do okna programu vlož skript níže:

Kód: Vybrat vše

autoclean;
emptyclsid;
iedefaults;
FFdefaults;
CHRdefaults;
emptyalltemp;
resethosts;

Klikni na Run Script
Program provede sken, opravu, sken i oprava může trvat i více minut, je třeba posečkat do konce. Do okna neklikej!
rogram nabídne restart , potvrď .

Po restartu se může nějaký čas ukázat pouze černá plocha , to je normální. Je třeba počkat až se vytvoří log. Ten si můžeš uložit třeba do dokumentů, jinak se sám ukládá do:
C:\zoek-results.log

[Reklama]

[W.Geronimo]

Malwarebytes Anti-Malware
www.malwarebytes.org

Dátum skenovania: 16.11.2014
Scan čas: 13:13:25
Logfile: Log 2.txt
Správca: áno

Verzia: 2.00.3.1025
Malware databázy: v2014.11.16.02
Rootkit databázy: v2014.11.12.01
Licencia: ?????????
Ochrana pred škodlivým softvérom: Telesne
Škodlivých webových stránok Ochrana: Telesne
Sebaobrany: Telesne

OS: Windows 7 Service Pack 1
CPU: x64
Systém súborov: NTFS
Používateľ: Geronimo

Typ skenu: Hrozba Scan
Výsledok: Dokončené
Objekty naskenované: 355252
Uplynulý čas: 5 min, 46 sec

Pamäť: Povolené
Pri spustení: Povolené
Súborový systém: Povolené
Archív: Povolené
Rootkity: Telesne
Heuristiky: Povolené
ŠTEŇA: Povolené
VYKUROVAC: Povolené

Procesy: 0
(Žiadne zákernej položky neboli zistené)

Moduly: 0
(Žiadne zákernej položky neboli zistené)

Kľúče databázy Registry: 0
(Žiadne zákernej položky neboli zistené)

Hodnoty databázy Registry: 0
(Žiadne zákernej položky neboli zistené)

Údaje databázy Registry: 0
(Žiadne zákernej položky neboli zistené)

Priečinky: 0
(Žiadne zákernej položky neboli zistené)

Súbory: 1
PUP.Optional.SweetIM.A, C:\Users\Geronimo\AppData\Local\Google\Chrome\User Data\Default\Preferences, Dobrá:)), Zlá:) "startup_urls": [ "http://home.sweetim.com/?barid={CAC59E6D-DBE4-11E2-9074-6CF049051BDF}&crg=3.1010000.10039&st=23&ptr=100" ],), ,[452d221aa4d8ed492cd796ecec192ad6]

Fyzický sektory: 0
(Žiadne zákernej položky neboli zistené)


(end)

[W.Geronimo]

RogueKiller V10.0.6.0 (x64) [Nov 13 2014] by Adlice Software
mail : http://www.adlice.com/contact/
Feedback : http://forum.adlice.com
Webová stránka : http://www.adlice.com/softwares/roguekiller/
Blog : http://www.adlice.com

Operační systém : Windows 7 (6.1.7601 Service Pack 1) 64 bits version
Spuštěno : Normální režim
Uživatel : Geronimo [Práva správce]
Mód : Smazat -- Datum : 11/16/2014 13:31:17

¤¤¤ Procesy : 0 ¤¤¤

¤¤¤ Registry : 12 ¤¤¤
[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters | DhcpNameServer : 10.255.255.10 10.255.255.20 [(Private Address) (XX)][(Private Address) (XX)] -> Nahrazeno ()
[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Tcpip\Parameters | DhcpNameServer : 10.255.255.10 10.255.255.20 [(Private Address) (XX)][(Private Address) (XX)] -> Nahrazeno ()
[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\ControlSet002\Services\Tcpip\Parameters | DhcpNameServer : 10.255.255.10 10.255.255.20 [(Private Address) (XX)][(Private Address) (XX)] -> Nahrazeno ()
[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{3F2279BC-C926-4BAF-8522-A056A2FE7B9D} | DhcpNameServer : 10.255.255.10 10.255.255.20 [(Private Address) (XX)][(Private Address) (XX)] -> Nahrazeno ()
[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Tcpip\Parameters\Interfaces\{3F2279BC-C926-4BAF-8522-A056A2FE7B9D} | DhcpNameServer : 10.255.255.10 10.255.255.20 [(Private Address) (XX)][(Private Address) (XX)] -> Nahrazeno ()
[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\ControlSet002\Services\Tcpip\Parameters\Interfaces\{3F2279BC-C926-4BAF-8522-A056A2FE7B9D} | DhcpNameServer : 10.255.255.10 10.255.255.20 [(Private Address) (XX)][(Private Address) (XX)] -> Nahrazeno ()
[PUM.Policies] (X64) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System | ConsentPromptBehaviorAdmin : 0 -> Nahrazeno (2)
[PUM.Policies] (X86) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System | ConsentPromptBehaviorAdmin : 0 -> Nahrazeno (2)
[PUM.DesktopIcons] (X64) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {20D04FE0-3AEA-1069-A2D8-08002B30309D} : 1 -> Nahrazeno (0)
[PUM.DesktopIcons] (X64) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {59031a47-3f72-44a7-89c5-5595fe6b30ee} : 1 -> Nahrazeno (0)
[PUM.DesktopIcons] (X86) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {20D04FE0-3AEA-1069-A2D8-08002B30309D} : 1 -> Nahrazeno (0)
[PUM.DesktopIcons] (X86) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {59031a47-3f72-44a7-89c5-5595fe6b30ee} : 1 -> Nahrazeno (0)

¤¤¤ Úlohy : 0 ¤¤¤

¤¤¤ Soubory : 0 ¤¤¤

¤¤¤ Soubor HOSTS : 0 ¤¤¤

¤¤¤ Antirootkit : 7 (Driver: Nahrán) ¤¤¤
[IRP:Addr(Hook.IRP)] \SystemRoot\system32\DRIVERS\intelide.sys - IRP_MJ_CREATE[0] : Unknown @ 0x740a2c0
[IRP:Addr(Hook.IRP)] \SystemRoot\system32\DRIVERS\intelide.sys - IRP_MJ_CLOSE[2] : Unknown @ 0x740a2c0
[IRP:Addr(Hook.IRP)] \SystemRoot\system32\DRIVERS\intelide.sys - IRP_MJ_DEVICE_CONTROL[14] : Unknown @ 0x740a2c0
[IRP:Addr(Hook.IRP)] \SystemRoot\system32\DRIVERS\intelide.sys - IRP_MJ_INTERNAL_DEVICE_CONTROL[15] : Unknown @ 0x740a2c0
[IRP:Addr(Hook.IRP)] \SystemRoot\system32\DRIVERS\intelide.sys - IRP_MJ_POWER[22] : Unknown @ 0x740a2c0
[IRP:Addr(Hook.IRP)] \SystemRoot\system32\DRIVERS\intelide.sys - IRP_MJ_SYSTEM_CONTROL[23] : Unknown @ 0x740a2c0
[IRP:Addr(Hook.IRP)] \SystemRoot\system32\DRIVERS\intelide.sys - IRP_MJ_PNP[27] : Unknown @ 0x740a2c0

¤¤¤ Webové prohlížeče : 2 ¤¤¤
[FIREFX:Addon] 49ld5ks5.default : Seznam lištička [{ea614400-e918-4741-9a97-7a972ff7c30b}] -> Smazáno
[PUM.HomePage][FIREFX:Config] 49ld5ks5.default : user_pref("browser.startup.homepage", "http://www.seznam.cz/"); -> Nahrazeno (about:home)

¤¤¤ Kontrola MBR : ¤¤¤
+++++ PhysicalDrive0: WDC WD1500HLFS-01G6U SCSI Disk Device +++++
--- User ---
[MBR] 70fa80752a988fb2723a044de3c5c901
[BSP] f93b272f73ad96b9886e98d83e2ef0dd : Windows Vista/7/8 MBR Code
Partition table:
0 - [ACTIVE] NTFS (0x7) [VISIBLE] Offset (sectors): 2048 | Size: 100 MB
1 - [XXXXXX] NTFS (0x7) [VISIBLE] Offset (sectors): 206848 | Size: 142986 MB
User = LL1 ... OK
Error reading LL2 MBR! ([1] Nesprávná funkce. )

+++++ PhysicalDrive1: ST380013AS SCSI Disk Device +++++
--- User ---
[MBR] 0ee5536e9372b7ddb0e6981e9ef69a4d
[BSP] e369c52a29fa35a7385ab24464490b66 : Windows XP MBR Code
Partition table:
1 - [XXXXXX] EXTEN-LBA (0xf) [VISIBLE] Offset (sectors): 2048 | Size: 76317 MB
User = LL1 ... OK
Error reading LL2 MBR! ([1] Nesprávná funkce. )

+++++ PhysicalDrive2: WDC WD20EURS-63S48Y0 ATA Device +++++
--- User ---
[MBR] 0d1dc93e269fd065e7124c2966f95890
[BSP] 21f7af98fa11a624696527102bfebc7f : Windows Vista/7/8 MBR Code
Partition table:
0 - [ACTIVE] NTFS (0x7) [VISIBLE] Offset (sectors): 2048 | Size: 1907727 MB
User = LL1 ... OK
User = LL2 ... OK


============================================
RKreport_SCN_11152014_125407.log - RKreport_SCN_11162014_133017.log

[W.Geronimo]

Zoek.exe v5.0.0.0 Updated 16-November-2014
Tool run by Geronimo on ne 16.11.2014 at 13:33:12,69.
Microsoft Windows 7 Ultimate 6.1.7601 Service Pack 1 x64
Running in: Normal Mode Internet Access Detected
Launched: C:\Users\Geronimo\Desktop\zoek.exe [Scan all users] [Script inserted]

==== System Restore Info ======================

16.11.2014 13:33:52 Zoek.exe System Restore Point Created Succesfully.

==== Reset Hosts File ======================

# Copyright (c) 1993-2006 Microsoft Corp.
#
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
#
# This file contains the mappings of IP addresses to host names. Each
# entry should be kept on an individual line. The IP address should
# be placed in the first column followed by the corresponding host name.
# The IP address and the host name should be separated by at least one
# space.
#
# Additionally, comments (such as these) may be inserted on individual
# lines or following the machine name denoted by a '#' symbol.
#
# For example:
#
# 102.54.94.97 rhino.acme.com # source server
# 38.25.63.10 x.acme.com # x client host

# localhost name resolution is handle within DNS itself.
127.0.0.1 localhost
::1 localhost

==== Deleting CLSID Registry Keys ======================

HKEY_USERS\S-1-5-21-4280150779-3759393089-3733435221-1001\Software\Microsoft\Internet Explorer\SearchScopes\{2FBC26E6-9D2A-4125-9708-2D18A5511BD8} deleted successfully
HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{0E8A89AD-95D7-40EB-8D9D-083EF7066A01} deleted successfully
HKEY_USERS\S-1-5-21-4280150779-3759393089-3733435221-1001\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{0E8A89AD-95D7-40EB-8D9D-083EF7066A01} deleted successfully
HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{0E8A89AD-95D7-40EB-8D9D-083EF7066A01} deleted successfully
HKEY_USERS\S-1-5-21-4280150779-3759393089-3733435221-1001\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{0E8A89AD-95D7-40EB-8D9D-083EF7066A01} deleted successfully
HKEY_CLASSES_ROOT\CLSID\{0E8A89AD-95D7-40EB-8D9D-083EF7066A01} deleted successfully

==== Deleting CLSID Registry Values ======================


==== Deleting Services ======================


==== FireFox Fix ======================

Deleted from C:\Users\Geronimo\AppData\Roaming\Mozilla\Firefox\Profiles\49ld5ks5.default\prefs.js:
user_pref("browser.startup.homepage", "http://www.seznam.cz/");
user_pref("browser.search.defaultenginename", "Google");
user_pref("browser.search.selectedEngine", "Google");
user_pref("keyword.url", "http://search.icq.com/search/afe_results.php?ch_id=afex&tb_ver=1.1.9&q=");
user_pref("browser.search.useDBForOrder", false);

Added to C:\Users\Geronimo\AppData\Roaming\Mozilla\Firefox\Profiles\49ld5ks5.default\prefs.js:
user_pref("browser.startup.homepage", "http://www.google.com");
user_pref("browser.search.defaulturl", "http://www.google.com/search?btnG=Google+Search&q=");
user_pref("browser.newtab.url", "http://www.google.com/");
user_pref("browser.search.defaultengine", "Google");
user_pref("browser.search.defaultenginename", "Google");
user_pref("browser.search.selectedEngine", "Google");
user_pref("browser.search.order.1", "Google");
user_pref("keyword.URL", "http://www.google.com/search?btnG=Google+Search&q=");
user_pref("browser.search.suggest.enabled", true);
user_pref("browser.search.useDBForOrder", true);

ProfilePath: C:\Users\Geronimo\AppData\Roaming\Mozilla\Firefox\Profiles\49ld5ks5.default

user.js not found
---- Lines browser.startup.page removed from prefs.js ----
user_pref("browser.startup.page", 1);
---- Lines extensions.BE5cUvjmOe5cdZ2n removed from prefs.js ----
user_pref("extensions.BE5cUvjmOe5cdZ2n.epoch", "1416075744");
user_pref("extensions.BE5cUvjmOe5cdZ2n.url", "http://civicpacemgoldguru.org/sync2/?q=hfZ9ofbMDMnMCyVUojr8qjsMg708BNmGWj8deShGheDUojw9rjaEqdwEqjkFqShIC
---- Lines extensions.JiRJoYUOUdYMXZud removed from prefs.js ----
user_pref("extensions.JiRJoYUOUdYMXZud.epoch", "1416075744");
---- FireFox user.js and prefs.js backups ----

prefs_16.11.2014_1342_.backup

==== Deleting Files \ Folders ======================

C:\PROGRA~3\{3C5CBD7B-3D1D-411E-96C2-513FFCA84D2D} deleted
C:\PROGRA~3\SummerSoft deleted
C:\PROGRA~2\Mozilla Firefox\defaults\preferences\autoconfig.js deleted
C:\PROGRA~2\Mozilla Firefox\defaults\preferences\pref.js deleted
C:\PROGRA~2\A-PDF Restrictions Remover deleted
C:\PROGRA~3\ProductData deleted
C:\PROGRA~3\InstallMate deleted
C:\Windows\SysNative\config\systemprofile\Searches deleted
C:\windows\SysNative\GroupPolicy\Machine deleted
C:\windows\SysNative\GroupPolicy\User deleted
C:\windows\SysNative\GroupPolicy\GPT.INI deleted
C:\Windows\Syswow64\GroupPolicy\gpt.ini deleted
C:\Users\Geronimo\AppData\Roaming\Mozilla\Firefox\Profiles\49ld5ks5.default\ICQToolbarData deleted
C:\Users\Geronimo\AppData\Roaming\Mozilla\Firefox\Profiles\49ld5ks5.default\CT2786678 deleted
C:\Users\Geronimo\AppData\Roaming\Mozilla\Firefox\Profiles\49ld5ks5.default\conduit deleted
C:\Users\Geronimo\AppData\Roaming\Mozilla\Firefox\Profiles\49ld5ks5.default\ConduitEngine deleted

==== Firefox Extensions ======================

ProfilePath: C:\Users\Geronimo\AppData\Roaming\Mozilla\Firefox\Profiles\49ld5ks5.default
- Undetermined - C:\Program Files (x86)\IObit Apps Toolbar\FF
- Undetermined - {ea614400-e918-4741-9a97-7a972ff7c30b}
- Advanced SystemCare Surfing Protection - %ProfilePath%\extensions\ascsurfingprotection@iobit.com

AppDir: C:\Program Files (x86)\Mozilla Firefox
- Java Console - %AppDir%\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA}
- Java Console - %AppDir%\extensions\{CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA}
- Java Console - %AppDir%\extensions\{CAFEEFAC-0016-0000-0037-ABCDEFFEDCBA}
- Default - %AppDir%\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

==== Firefox Plugins ======================

Profilepath: C:\Users\Geronimo\AppData\Roaming\Mozilla\Firefox\Profiles\49ld5ks5.default
67D325B5AEB28E381B84E8DE1A90C7A8 - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_15_0_0_223.dll - Shockwave Flash


==== Fake Chromium Profiles Check ======================

Fake profile C:\Users\Administrator\AppData\Local\Google\Chrome deleted
Fake profile C:\Users\Administrator\AppData\Local\Google\Chrome SxS deleted
Fake profile C:\Users\Administrator\AppData\Local\Comodo\Dragon deleted
Fake profile C:\Users\Geronimo\AppData\Local\Google\Chrome SxS deleted
Fake profile C:\Users\Guest\AppData\Local\Google\Chrome deleted
Fake profile C:\Users\Guest\AppData\Local\Google\Chrome SxS deleted
Fake profile C:\Users\Guest\AppData\Local\Comodo\Dragon deleted
Fake profile C:\Users\HomeGroupUser$\AppData\Local\Google\Chrome deleted
Fake profile C:\Users\HomeGroupUser$\AppData\Local\Google\Chrome SxS deleted
Fake profile C:\Users\HomeGroupUser$\AppData\Local\Comodo\Dragon deleted

==== Chromium Look ======================

Ask Toolbar - Geronimo\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\aaaalipaokhkccgmgkdglfinfnfhflko
Comodo Drag&Drop Service - Geronimo\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\aneodkojaglhnkkdbbdnmmmgimlcaogo
Comodo Web Inspector - Geronimo\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\bdngekjahnmlkinegnhdmmbcfnmbclnn
Comodo Media Downloader - Geronimo\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\dihmnpngfonlhjmgkflpnibiaaliendo
Best Save - Geronimo\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\ifkgichhpmabepjkbkmfeclembjdbpml
AdBlock - Geronimo\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom
Best Save - Geronimo\AppData\Local\Google\Chrome\User Data\Default\Extensions\ifkgichhpmabepjkbkmfeclembjdbpml

==== Chromium Startpages ======================

C:\Users\Geronimo\AppData\Local\Chromium\User Data\Default\Preferences
{"homepage_is_newtabpage":false,"homepage":"http://www.seznam.cz/?clid=6826","session":{"urls_to_restore_on_startup":["http://www.seznam.cz/?clid=6826"]},"browser":{"show_home_button":true}}

C:\Users\Geronimo\AppData\Local\Google\Chrome\User Data\Default\Preferences
"homepage": "http://www.seznam.cz/",
"startup_urls": [ "http://home.sweetim.com/?barid={CAC59E6D-DBE4-11E2-9074-6CF049051BDF}&crg=3.1010000.10039&st=23&ptr=100" ],


==== Chromium Fix ======================

C:\Users\Geronimo\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\aaaalipaokhkccgmgkdglfinfnfhflko deleted successfully
C:\Users\Geronimo\AppData\Local\Comodo\Dragon\User Data\Default\Local Storage\chrome-extension_aaaalipaokhkccgmgkdglfinfnfhflko_0.localstorage deleted successfully
C:\Users\Geronimo\AppData\Local\Comodo\Dragon\User Data\Default\Local Storage\chrome-extension_aaaalipaokhkccgmgkdglfinfnfhflko_0.localstorage-journal deleted successfully
C:\Users\Geronimo\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\ifkgichhpmabepjkbkmfeclembjdbpml deleted successfully
C:\Users\Geronimo\AppData\Local\Google\Chrome\User Data\Default\Extensions\ifkgichhpmabepjkbkmfeclembjdbpml deleted successfully
C:\Users\Geronimo\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_ifkgichhpmabepjkbkmfeclembjdbpml_0.localstorage deleted successfully
C:\Users\Geronimo\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_ifkgichhpmabepjkbkmfeclembjdbpml_0.localstorage-journal deleted successfully

==== Set IE to Default ======================

Old Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"="http://www.msn.com/?ocid=iehp"

New Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"="http://www.msn.com/?ocid=iehp"

==== All HKCU SearchScopes ======================

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes
"DefaultScope"="{0633EE93-D776-472f-A0FF-E1416B8B2E3A}"
{012E1000-F331-11DB-8314-0800200C9A66} Google Url="http://www.google.com/search?q={searchTerms}"
{0633EE93-D776-472f-A0FF-E1416B8B2E3A} Bing Url="http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE10SR"
{08D5636A-C37B-4AB1-920F-698018FBFBDF} Zbo§ˇ.cz Url="http://www.zbozi.cz/?q={searchTerms}&r=campmoz&sourceid=QuickSearch_16194"
{37189E9B-C283-4DD6-8B15-DEF8E3412EF1} Mapy.cz Url="http://www.mapy.cz/?query={searchTerms}&sourceid=QuickSearch_16194"
{3C2410B2-173C-4828-8700-8DF5987EE94B} Firmy.cz Url="http://www.firmy.cz/?q={searchTerms}&sourceid=QuickSearch_16194"
{524214A4-9CA0-4370-BEB0-5D1C5E7C8987} Slovnˇk CZ/EN Url="http://slovnik.seznam.cz/?q={searchTerms}&lang=cz_en&sourceid=QuickSearch_16194"
{62045D62-8B00-4cb5-AB41-724635135E42} Google Url="http://www.google.com/custom?client=pub-3794288947762788&forid=1&channel=1975384696&ie=UTF-8&oe=UTF-8&safe=active&cof=GALT%3A%23008000%3BGL%3A1%3BDIV%3A%23336699%3BVLC%3A663399%3BAH%3Acenter%3BBGC%3AFFFFFF%3BLBGC%3A336699%3BALC%3A0000FF%3BLC%3A0000FF%3BT%3A000000%3BGFNT%3A0000FF%3BGIMP%3A0000FF%3BFORID%3A1&hl=cs&q={searchTerms}"
{7D543CB7-67C4-482B-A7E0-86B9D19EBCCB} Slovnˇk EN/CZ Url="http://slovnik.seznam.cz/?q={searchTerms}&lang=en_cz&sourceid=QuickSearch_16194"
{A67BB831-D081-40CB-94D8-1AE672006AC1} Seznam TV Program Url="http://tv.seznam.cz/hledej?w={searchTerms}&sourceid=QuickSearch_16194"
{F43B2C4B-F0D3-4C1A-B467-C158328CC9C0} Encyklopedie Seznam Url="http://encyklopedie.seznam.cz/search?q={searchTerms}&sourceid=QuickSearch_16194"
{F89D8AEC-6BD0-4BE7-A6D1-D09F8655CA95} Novinky.cz Url="http://www.novinky.cz/hledej?w={searchTerms}&sourceid=QuickSearch_16194"

==== Reset Google Chrome ======================

C:\Users\Geronimo\AppData\Local\Chromium\User Data\Default\Preferences was reset successfully
C:\Users\Geronimo\AppData\Local\Comodo\Dragon\User Data\Default\Preferences was reset successfully
C:\Users\Geronimo\AppData\Local\Google\Chrome\User Data\Default\Preferences was reset successfully
C:\Users\Geronimo\AppData\Local\Chromium\User Data\Default\Web Data was reset successfully
C:\Users\Geronimo\AppData\Local\Comodo\Dragon\User Data\Default\Web Data was reset successfully
C:\Users\Geronimo\AppData\Local\Google\Chrome\User Data\Default\Web Data was reset successfully

==== Deleting Registry Keys ======================

HKEY_LOCAL_MACHINE\Software\wow6432node\Policies\Google deleted successfully
HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Easy Driver Pro_is1 deleted successfully
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Praetorian deleted successfully

==== Empty IE Cache ======================

C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\Geronimo\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\SysNative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\sysWoW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\serviceprofiles\networkservice\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\serviceprofiles\Localservice\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\sysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully

==== Empty FireFox Cache ======================

C:\Users\Geronimo\AppData\Local\Mozilla\Firefox\Profiles\49ld5ks5.default\cache2 emptied successfully

==== Empty Chrome Cache ======================

C:\Users\Geronimo\AppData\Local\Comodo\Dragon\User Data\Default\Cache emptied successfully
C:\Users\Geronimo\AppData\Local\Google\Chrome\User Data\Default\Cache emptied successfully

==== Empty All Flash Cache ======================

Flash Cache Emptied Successfully

==== Empty All Java Cache ======================

Java Cache cleared successfully

==== C:\zoek_backup content ======================

C:\zoek_backup (files=400 folders=134 5716073 bytes)

==== Empty Temp Folders ======================

C:\Users\Default\AppData\Local\Temp emptied successfully
C:\Users\Default User\AppData\Local\Temp emptied successfully
C:\Users\Geronimo\AppData\Local\Temp will be emptied at reboot
C:\Windows\serviceprofiles\networkservice\AppData\Local\Temp emptied successfully
C:\Windows\serviceprofiles\Localservice\AppData\Local\Temp emptied successfully
C:\Windows\Temp will be emptied at reboot

==== After Reboot ======================

==== EOF on ne 16.11.2014 at 13:47:47,58 ======================

[jaro3]

. spusť znovu MbAM a dej Skenovat nyní
- po proběhnutí programu se ti objeví hláška tak klikni na „Vše do karantény(smazat vybrané)“ a na „Exportovat záznam“ a vyber „textový soubor“ , soubor nějak pojmenuj a někam ho ulož. Zkopíruj se celý obsah toho logu.

Vypni rez. ochranu u antiviru a antispywaru,příp. firewall..

Stáhni si ComboFix (by sUBs)
a ulož si ho na plochu.
Ukonči všechna aktivní okna a spusť ho.
- Po spuštění se zobrazí podmínky užití, potvrď je stiskem tlačítka Ano
- Dále postupuj dle pokynů, během aplikování ComboFixu neklikej do zobrazujícího se okna
- Po dokončení skenování by měl program vytvořit log - C:\ComboFix.txt - zkopíruj sem prosím celý jeho obsah
Pokud budou problémy , spusť ho v nouz. režimu.

Upozornění : Může se stát, že po aplikaci Combofixu a restartu počítače, Windows nenaběhnou , nebo nenajede plocha , budou problémy s připojením, pak znovu restartuj počítač, pokud to nepomůže , po restartu mačkej klávesu F8 a pak zvol poslední známou funkční konfiguraci. , či použij bod obnovy.

[W.Geronimo]

Udelam zase o vikendu. Jen me zajima v cem mam jeste problem. Hlasky v chromu uz nevyskakuji a vse se jevi byt v poradku. Nasel jsi v poslednim logu jeste nejakej problem??Docela me to zajima. Dekuji za odpoved a hlavne za pomoc.

[jaro3]

jen balast.

[W.Geronimo]

Malwarebytes Anti-Malware
www.malwarebytes.org

Dátum skenovania: 19.11.2014
Scan čas: 16:35:09
Logfile:
Správca: áno

Verzia: 2.00.3.1025
Malware databázy: v2014.11.19.05
Rootkit databázy: v2014.11.18.01
Licencia: Бесплатно
Ochrana pred škodlivým softvérom: Telesne
Škodlivých webových stránok Ochrana: Telesne
Sebaobrany: Telesne

OS: Windows 7 Service Pack 1
CPU: x64
Systém súborov: NTFS
Používateľ: Geronimo

Typ skenu: Hrozba Scan
Výsledok: Dokončené
Objekty naskenované: 355914
Uplynulý čas: 6 min, 3 sec

Pamäť: Povolené
Pri spustení: Povolené
Súborový systém: Povolené
Archív: Povolené
Rootkity: Telesne
Heuristiky: Povolené
ŠTEŇA: Povolené
VYKUROVAC: Povolené

Procesy: 0
(Žiadne zákernej položky neboli zistené)

Moduly: 0
(Žiadne zákernej položky neboli zistené)

Kľúče databázy Registry: 0
(Žiadne zákernej položky neboli zistené)

Hodnoty databázy Registry: 0
(Žiadne zákernej položky neboli zistené)

Údaje databázy Registry: 0
(Žiadne zákernej položky neboli zistené)

Priečinky: 0
(Žiadne zákernej položky neboli zistené)

Súbory: 0
(Žiadne zákernej položky neboli zistené)

Fyzický sektory: 0
(Žiadne zákernej položky neboli zistené)


(end)

[W.Geronimo]

ComboFix 14-11-17.01 - Geronimo 19.11.2014 17:44:42.1.4 - x64
Microsoft Windows 7 Ultimate 6.1.7601.1.1250.420.1029.18.8183.6370 [GMT 1:00]
Spuštěný z: c:\users\Geronimo\Downloads\ComboFix.exe
AV: ESET Smart Security 4.2 *Disabled/Updated* {77DEAFED-8149-104B-25A1-21771CA47CD1}
FW: ESET personal firewall *Enabled* {4FE52EC8-CB26-1113-0EFE-8842E2773BAA}
SP: ESET Smart Security 4.2 *Disabled/Updated* {CCBF4E09-A773-1FC5-1F11-1A056723366C}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\program files (x86)\ESET\MiNODLogin
c:\program files (x86)\ESET\MiNODLogin\MiNODLogin.exe
c:\program files (x86)\ESET\MiNODLogin\MiNODLogin.jar
c:\program files (x86)\ESET\MiNODLogin\MiNODLoginLib.dll
c:\program files (x86)\ESET\MiNODLogin\MiNODLoginUninst.exe
c:\program files (x86)\ESET\MiNODLogin\servidores.xml
c:\programdata\ntuser.pol
c:\windows\pkunzip.pif
c:\windows\pkzip.pif
c:\windows\ST6UNST.000
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2014-10-19 do 2014-11-19 )))))))))))))))))))))))))))))))
.
.
2014-11-19 15:28 . 2014-11-02 04:20 11632448 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{03A1959B-27F3-4072-B0AB-8F4E1D29ED64}\mpengine.dll
2014-11-16 12:44 . 2014-11-16 12:33 24064 ----a-w- c:\windows\zoek-delete.exe
2014-11-16 12:33 . 2014-11-16 12:43 -------- d-----w- C:\zoek_backup
2014-11-15 15:10 . 2014-11-05 17:56 304640 ----a-w- c:\windows\system32\generaltel.dll
2014-11-15 15:10 . 2014-11-05 17:56 228864 ----a-w- c:\windows\system32\aepdu.dll
2014-11-15 15:10 . 2014-11-05 17:52 424448 ----a-w- c:\windows\system32\aeinv.dll
2014-11-15 15:10 . 2014-10-14 02:13 3241984 ----a-w- c:\windows\system32\msi.dll
2014-11-15 15:10 . 2014-10-14 01:50 2363904 ----a-w- c:\windows\SysWow64\msi.dll
2014-11-15 15:08 . 2014-08-21 06:43 1882624 ----a-w- c:\windows\system32\msxml3.dll
2014-11-15 11:51 . 2014-11-16 12:27 37624 ----a-w- c:\windows\system32\drivers\TrueSight.sys
2014-11-15 11:51 . 2014-11-15 11:51 -------- d-----w- c:\programdata\RogueKiller
2014-11-15 11:45 . 2014-11-15 11:45 -------- d-----w- c:\windows\ERUNT
2014-11-09 12:39 . 2014-11-19 15:35 129752 ----a-w- c:\windows\system32\drivers\MBAMSwissArmy.sys
2014-11-09 12:38 . 2014-10-01 10:11 63704 ----a-w- c:\windows\system32\drivers\mwac.sys
2014-11-09 12:38 . 2014-10-01 10:11 93400 ----a-w- c:\windows\system32\drivers\mbamchameleon.sys
2014-11-09 12:38 . 2014-10-01 10:11 25816 ----a-w- c:\windows\system32\drivers\mbam.sys
2014-11-09 12:38 . 2014-11-09 12:38 -------- d-----w- c:\program files (x86)\Malwarebytes Anti-Malware
2014-11-09 12:38 . 2014-11-09 12:38 -------- d-----w- c:\programdata\Malwarebytes
2014-11-09 12:32 . 2014-11-15 11:39 -------- d-----w- C:\AdwCleaner
2014-11-05 16:07 . 2014-11-05 16:07 94720 ----a-w- c:\windows\system32\drivers\AtihdW76.sys
2014-11-05 16:07 . 2014-11-05 16:07 110080 ----a-w- c:\windows\system32\DelayAPO.dll
2014-11-02 19:02 . 2014-11-02 19:02 -------- d-----w- c:\program files (x86)\Seznam.cz
2014-11-02 19:02 . 2014-11-02 19:02 -------- d-----w- c:\users\Geronimo\AppData\Roaming\QuickScan
2014-11-02 19:02 . 2014-11-15 11:36 -------- d-----w- c:\users\Geronimo\AppData\Roaming\Seznam.cz
2014-11-02 19:01 . 2014-11-02 19:13 -------- d-----w- c:\program files (x86)\Zrychleni Pocitace
2014-11-02 18:49 . 2014-11-02 18:49 -------- d-----w- c:\users\Geronimo\AppData\Roaming\Day 1 Studios
2014-10-29 15:50 . 2014-10-29 15:50 -------- d-----w- c:\users\Geronimo\AppData\Local\Adobe
2014-10-29 15:40 . 2014-10-29 15:40 941784 ----a-w- c:\windows\system32\drivers\Rt64win7.sys
2014-10-29 15:40 . 2014-10-29 15:40 73800 ----a-w- c:\windows\system32\RtNicProp64.dll
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2014-11-15 20:08 . 2012-06-24 12:15 103374192 ----a-w- c:\windows\system32\MRT.exe
2014-11-14 15:38 . 2012-06-24 09:52 71344 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2014-11-14 15:38 . 2012-06-24 09:52 701104 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2014-11-04 13:30 . 2012-06-24 09:52 275080 ------w- c:\windows\system32\MpSigStub.exe
2014-11-02 18:39 . 2013-08-28 10:35 281688 ----a-w- c:\windows\SysWow64\PnkBstrB.exe
2014-11-02 18:39 . 2012-10-20 21:11 281688 ----a-w- c:\windows\SysWow64\PnkBstrB.xtr
2014-10-29 15:40 . 2012-08-22 21:23 107552 ----a-w- c:\windows\system32\RTNUninst64.dll
2014-10-04 07:04 . 2014-10-04 07:04 519680 ----a-w- c:\windows\SysWow64\qdvd.dll
2014-10-04 07:04 . 2014-10-04 07:04 371712 ----a-w- c:\windows\system32\qdvd.dll
2014-09-26 14:07 . 2014-09-26 14:07 2048 ----a-w- c:\windows\system32\tzres.dll
2014-09-26 14:07 . 2014-09-26 14:07 2048 ----a-w- c:\windows\SysWow64\tzres.dll
2014-09-20 08:45 . 2014-09-20 08:45 57096 ----a-w- c:\windows\system32\certsentry.dll
2014-09-20 08:45 . 2014-09-20 08:45 48392 ----a-w- c:\windows\SysWow64\certsentry.dll
2014-09-19 15:17 . 2014-09-19 15:17 7168 ----a-w- c:\windows\SysWow64\KBDYAK.DLL
2014-09-19 15:17 . 2014-09-19 15:17 7168 ----a-w- c:\windows\system32\KBDYAK.DLL
2014-09-19 15:17 . 2014-09-19 15:17 7168 ----a-w- c:\windows\system32\KBDTAT.DLL
2014-09-19 15:17 . 2014-09-19 15:17 7168 ----a-w- c:\windows\system32\KBDRU1.DLL
2014-09-19 15:17 . 2014-09-19 15:17 7168 ----a-w- c:\windows\system32\KBDBASH.DLL
2014-09-19 15:17 . 2014-09-19 15:17 6656 ----a-w- c:\windows\SysWow64\KBDBASH.DLL
2014-09-19 15:17 . 2014-09-19 15:17 6656 ----a-w- c:\windows\system32\KBDRU.DLL
2014-09-19 09:23 . 2014-11-15 15:08 248832 ----a-w- c:\windows\SysWow64\schannel.dll
2014-09-13 08:48 . 2014-09-13 08:48 2565120 ----a-w- c:\windows\system32\d3d10warp.dll
2014-09-13 08:48 . 2014-09-13 08:48 1987584 ----a-w- c:\windows\SysWow64\d3d10warp.dll
2014-09-13 08:47 . 2014-09-13 08:47 793600 ----a-w- c:\windows\SysWow64\TSWorkspace.dll
2014-09-13 08:47 . 2014-09-13 08:47 1031168 ----a-w- c:\windows\system32\TSWorkspace.dll
2014-09-13 08:44 . 2014-09-13 08:44 2777088 ----a-w- c:\windows\system32\msmpeg2vdec.dll
2014-09-13 08:44 . 2014-09-13 08:44 2285056 ----a-w- c:\windows\SysWow64\msmpeg2vdec.dll
2014-09-04 05:23 . 2014-10-17 14:23 424448 ----a-w- c:\windows\system32\rastls.dll
2014-09-04 05:04 . 2014-10-17 14:23 372736 ----a-w- c:\windows\SysWow64\rastls.dll
2014-08-29 02:07 . 2014-10-17 14:23 44032 ----a-w- c:\windows\system32\tsgqec.dll
2014-08-29 02:07 . 2014-10-17 14:23 3179520 ----a-w- c:\windows\system32\rdpcorets.dll
2014-08-29 02:07 . 2014-10-17 14:23 5780480 ----a-w- c:\windows\system32\mstscax.dll
2014-08-29 02:07 . 2014-10-17 14:23 322560 ----a-w- c:\windows\system32\aaclient.dll
2014-08-29 02:06 . 2014-10-17 14:23 1125888 ----a-w- c:\windows\system32\mstsc.exe
2014-08-29 01:44 . 2014-10-17 14:23 37376 ----a-w- c:\windows\SysWow64\tsgqec.dll
2014-08-29 01:44 . 2014-10-17 14:23 4922368 ----a-w- c:\windows\SysWow64\mstscax.dll
2014-08-29 01:44 . 2014-10-17 14:23 269312 ----a-w- c:\windows\SysWow64\aaclient.dll
2014-08-29 01:44 . 2014-10-17 14:23 1050112 ----a-w- c:\windows\SysWow64\mstsc.exe
2014-08-23 02:07 . 2014-08-30 08:50 404480 ----a-w- c:\windows\system32\gdi32.dll
2014-08-23 01:45 . 2014-08-30 08:50 311808 ----a-w- c:\windows\SysWow64\gdi32.dll
2014-08-22 15:56 . 2014-08-22 15:56 14175744 ----a-w- c:\windows\system32\shell32.dll
2014-08-22 15:55 . 2014-08-22 15:55 99480 ----a-w- c:\windows\SysWow64\infocardapi.dll
2014-08-22 15:55 . 2014-08-22 15:55 8856 ----a-w- c:\windows\SysWow64\icardres.dll
2014-08-22 15:55 . 2014-08-22 15:55 8856 ----a-w- c:\windows\system32\icardres.dll
2014-08-22 15:55 . 2014-08-22 15:55 619672 ----a-w- c:\windows\SysWow64\icardagt.exe
2014-08-22 15:55 . 2014-08-22 15:55 35480 ----a-w- c:\windows\SysWow64\TsWpfWrp.exe
2014-08-22 15:55 . 2014-08-22 15:55 35480 ----a-w- c:\windows\system32\TsWpfWrp.exe
2014-08-22 15:55 . 2014-08-22 15:55 171160 ----a-w- c:\windows\system32\infocardapi.dll
2014-08-22 15:55 . 2014-08-22 15:55 1389208 ----a-w- c:\windows\system32\icardagt.exe
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Steam"="c:\program files (x86)\Steam\steam.exe" [2014-11-12 1940160]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-20 1475584]
"Advanced SystemCare 7"="c:\program files (x86)\IObit\Advanced SystemCare 7\ASCTray.exe" [2014-04-21 2295584]
"HydraVisionDesktopManager"="c:\program files (x86)\ATI Technologies\HydraVision\HydraDM.exe" [2009-04-28 380928]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"AMD AVT"="start AMD Accelerated Video Transcoding device initialization" [X]
"JMB36X IDE Setup"="c:\windows\RaidTool\xInsIDE.exe" [2007-03-20 36864]
"Razer Barracuda AC-1 Gaming Audio Card"="c:\program files (x86)\Razer Barracuda AC-1 Gaming Audio Card\Razer Barracuda AC-1 Gaming Audio card.exe" [2010-03-02 1205248]
"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2012-07-04 641704]
"SwitchBoard"="c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe" [2010-02-19 517096]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 LiveUpdateSvc;LiveUpdate;c:\program files (x86)\IObit\LiveUpdate\LiveUpdate.exe;c:\program files (x86)\IObit\LiveUpdate\LiveUpdate.exe [x]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]
R3 androidusb;SAMSUNG Android Composite ADB Interface Driver;c:\windows\system32\Drivers\ssadadb.sys;c:\windows\SYSNATIVE\Drivers\ssadadb.sys [x]
R3 dg_ssudbus;SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudbus.sys;c:\windows\SYSNATIVE\DRIVERS\ssudbus.sys [x]
R3 dgderdrv;dgderdrv;c:\windows\system32\drivers\dgderdrv.sys;c:\windows\SYSNATIVE\drivers\dgderdrv.sys [x]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys;c:\windows\SYSNATIVE\drivers\rdpvideominiport.sys [x]
R3 ssadbus;SAMSUNG Android USB Composite Device driver (WDM);c:\windows\system32\DRIVERS\ssadbus.sys;c:\windows\SYSNATIVE\DRIVERS\ssadbus.sys [x]
R3 ssadmdfl;SAMSUNG Android USB Modem (Filter);c:\windows\system32\DRIVERS\ssadmdfl.sys;c:\windows\SYSNATIVE\DRIVERS\ssadmdfl.sys [x]
R3 ssadmdm;SAMSUNG Android USB Modem Drivers;c:\windows\system32\DRIVERS\ssadmdm.sys;c:\windows\SYSNATIVE\DRIVERS\ssadmdm.sys [x]
R3 ssadserd;SAMSUNG Android USB Diagnostic Serial Port (WDM);c:\windows\system32\DRIVERS\ssadserd.sys;c:\windows\SYSNATIVE\DRIVERS\ssadserd.sys [x]
R3 ssudmdm;SAMSUNG Mobile USB Modem Drivers (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudmdm.sys;c:\windows\SYSNATIVE\DRIVERS\ssudmdm.sys [x]
R3 SwitchBoard;SwitchBoard;c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe;c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [x]
R3 Synth3dVsc;Synth3dVsc;c:\windows\system32\drivers\synth3dvsc.sys;c:\windows\SYSNATIVE\drivers\synth3dvsc.sys [x]
R3 TeamViewer9;TeamViewer 9;c:\program files (x86)\TeamViewer\Version9\TeamViewer_Service.exe;c:\program files (x86)\TeamViewer\Version9\TeamViewer_Service.exe [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 tsusbhub;tsusbhub;c:\windows\system32\drivers\tsusbhub.sys;c:\windows\SYSNATIVE\drivers\tsusbhub.sys [x]
R3 VGPU;VGPU;c:\windows\system32\drivers\rdvgkmd.sys;c:\windows\SYSNATIVE\drivers\rdvgkmd.sys [x]
R3 WatAdminSvc;Služba Technologie aktivace Windows;c:\windows\system32\Wat\WatAdminSvc.exe;c:\windows\SYSNATIVE\Wat\WatAdminSvc.exe [x]
R3 WinRing0_1_2_0;WinRing0_1_2_0;c:\program files (x86)\IObit\Game Booster 3\Driver\WinRing0x64.sys;c:\program files (x86)\IObit\Game Booster 3\Driver\WinRing0x64.sys [x]
S0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys;c:\windows\SYSNATIVE\Drivers\sptd.sys [x]
S1 ehdrv;ehdrv;c:\windows\system32\DRIVERS\ehdrv.sys;c:\windows\SYSNATIVE\DRIVERS\ehdrv.sys [x]
S2 AdvancedSystemCareService7;Advanced SystemCare Service 7;c:\program files (x86)\IObit\Advanced SystemCare 7\ASCService.exe;c:\program files (x86)\IObit\Advanced SystemCare 7\ASCService.exe [x]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe;c:\windows\SYSNATIVE\atiesrxx.exe [x]
S2 DragonUpdater;COMODO Dragon Update Service;c:\program files (x86)\Comodo\Dragon\dragon_updater.exe;c:\program files (x86)\Comodo\Dragon\dragon_updater.exe [x]
S2 eamonm;eamonm;c:\windows\system32\DRIVERS\eamonm.sys;c:\windows\SYSNATIVE\DRIVERS\eamonm.sys [x]
S2 ekrn;ESET Service;c:\program files\ESET\ESET Smart Security\x86\ekrn.exe;c:\program files\ESET\ESET Smart Security\x86\ekrn.exe [x]
S2 epfwwfp;epfwwfp;c:\windows\system32\DRIVERS\epfwwfp.sys;c:\windows\SYSNATIVE\DRIVERS\epfwwfp.sys [x]
S3 AtiHDAudioService;AMD Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW76.sys;c:\windows\SYSNATIVE\drivers\AtihdW76.sys [x]
S3 cmudaxp;Razer Barracuda AC-1 Gaming Interface;c:\windows\system32\drivers\cmudaxp.sys;c:\windows\SYSNATIVE\drivers\cmudaxp.sys [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x]
S3 SaiK0CCB;SaiK0CCB;c:\windows\system32\DRIVERS\SaiK0CCB.sys;c:\windows\SYSNATIVE\DRIVERS\SaiK0CCB.sys [x]
S3 SaiU0CCB;SaiU0CCB;c:\windows\system32\DRIVERS\SaiU0CCB.sys;c:\windows\SYSNATIVE\DRIVERS\SaiU0CCB.sys [x]
.
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2014-09-26 14:28 1096520 ----a-w- c:\program files (x86)\Google\Chrome\Application\37.0.2062.124\Installer\chrmstp.exe
.
Obsah adresáře 'Naplánované úlohy'
.
2014-11-19 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-06-24 15:38]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{10921475-03CE-4E04-90CE-E2E7EF20C814}]
2014-06-28 07:09 2471744 ----a-w- c:\program files (x86)\IObit\IObit Uninstaller\UninstallExplorer64.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ProfilerU"="c:\program files\Saitek\SD6\Software\ProfilerU.exe" [2010-04-21 378880]
"SaiMfd"="c:\program files\Saitek\SD6\Software\SaiMfd.exe" [2010-04-21 195072]
"egui"="c:\program files\ESET\ESET Smart Security\egui.exe" [2010-08-12 2916584]
"CanonSolutionMenu"="c:\program files (x86)\Canon\SolutionMenu\CNSLMAIN.exe" [2007-05-14 644696]
"PAC7302_Monitor"="c:\windows\PixArt\PAC7302\Monitor.exe" [2007-12-10 323584]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2014-06-28 13672152]
.
------- Doplňkový sken -------
.
uLocal Page = c:\windows\system32\blank.htm
mLocal Page = c:\windows\SysWOW64\blank.htm
TCP: DhcpNameServer = 10.255.255.10 10.255.255.20
FF - ProfilePath - c:\users\Geronimo\AppData\Roaming\Mozilla\Firefox\Profiles\49ld5ks5.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?btnG=Google+Search&q=
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.seznam.cz/
FF - prefs.js: keyword.URL - hxxp://search.icq.com/search/afe_result ... r=1.1.9&q=
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
.
HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start
AddRemove-MiNODLogin - c:\program files (x86)\ESET\MiNODLogin\MiNODLoginUninst.exe
AddRemove-PunkBusterSvc - c:\windows\system32\pbsvc.exe
.
.
Binary file temp00 matches
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (LocalSystem)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,76,63,7a,77,6f,ef,a1,48,b5,c0,62,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,76,63,7a,77,6f,ef,a1,48,b5,c0,62,\
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0004\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0005\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0006\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
c:\program files (x86)\IObit\Advanced SystemCare 7\Monitor.exe
c:\windows\SysWOW64\PnkBstrA.exe
c:\program files (x86)\Steam\bin\steamwebhelper.exe
c:\program files (x86)\IObit\Advanced SystemCare 7\RealTimeProtector.exe
.
**************************************************************************
.
Celkový čas: 2014-11-19 18:02:14 - počítač byl restartován
ComboFix-quarantined-files.txt 2014-11-19 17:02
.
Před spuštěním: Volných bajtů: 33 324 634 112
Po spuštění: Volných bajtů: 33 080 647 680
.
- - End Of File - - 2D145C96250F5B68421DB23B862916F2

[W.Geronimo]

combofix probehl bez problemu.Nutnost startovat v nouzaku nebyla. Sice mi smaznul minilogin na esset ale ten ja uz stejne nepouzivam tak je to jen dobre.
Jsem zvedavej jestli v logu najdes jeste nejaky odolny balast.
Jeste jednou dekuji za trpelivost a vstricnost!

[jaro3]

ESS máš legální?

Vypni rez. ochranu u antiviru a antispywaru,příp. firewall..

Otevři si Poznámkový blok (Start -> Spustit... a napiš do okna Notepad a dej Ok.
Zkopíruj do něj následující celý text označený zeleně:

Kód: Vybrat vše

ClearJavaCache::
KillAll::

Folder::
c:\program files (x86)\Skype\Updater

Driver::
SkypeUpdate

RegLock::
[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (LocalSystem)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
 d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,76,63,7a,77,6f,ef,a1,48,b5,c0,62,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
 d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,76,63,7a,77,6f,ef,a1,48,b5,c0,62,\
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0004\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0005\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0006\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)

Zvol možnost Soubor -> Uložit jako... a nastav tyto parametry:
Název souboru: zde napiš: CFScript.txt
Uložit jako typ: tak tam vyber Všechny soubory
Ulož soubor na plochu.
Ukonči všechna aktivní okna.

Uchop myší vytvořený skript CFScript.txt, přemísti ho nad stažený program ComboFix.exe a když se oba soubory překryjí, skript upusť.
- Automaticky se spustí ComboFix
- Vlož sem log, který vyběhne v závěru čistícího procesu + nový log z HJT

Upozornění : Může se stát, že po aplikaci Combofixu a restartu počítače, Windows nenaběhnou , nebo nenajede plocha , budou problémy s připojením, pak znovu restartuj počítač, pokud to nepomůže , po restartu mačkej klávesu F8 a pak zvol poslední známou funkční konfiguraci. , či použij bod obnovy.

Stáhni si aswMBR
na svojí plochu. Uzavři všechna okna , programy a prohlížeče. Poklepej na aswMBR.exe. Pokud se objeví hláška o možnosti stáhnutí databáze Avastu , klikni na NE. Poté klikni na „Scan“ . Po skenu klikni na „Save Log“ a ulož si log na plochu .Zkopíruj sem celý obsah toho logu. Pak klikni na „Exit“ k zavření programu

[W.Geronimo]

ESS legalni??:-)) no nejspis bych nepouzival minilogin ,-)