I přes aktualizovaný antivir (Avast), se mi podařilo do PC natahat nějaký balast. Spomalené PC, občas vyskakuje okno abych si nainstaloval Google Chrome. Něco se mi podařilo odstranit pomocí Spybot-S&D, Malwarebytes a SpyBot Search & Destroy. Jenže SpyHunter hlásí ještě dalších 88 hrozeb. Bohužel neodstraňuje.
Děkuji.
Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 9:58:38, on 4.6.2015
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v11.0 (11.00.9600.17801)
FIREFOX: 38.0.5 (x86 cs)
Boot mode: Normal
Running processes:
C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe
C:\Program Files (x86)\OKsoftware\Svátky a výročí\Vyroci.exe
C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe
C:\Program Files (x86)\DYMO\DYMO Label Software\DymoQuickPrint.exe
C:\Program Files (x86)\Google\Drive\googledrivesync.exe
C:\Program Files (x86)\PIXELA\Everio MediaBrowser 4\MBCameraMonitor.exe
C:\Program Files (x86)\Nero\Nero 10\Nero BackItUp\NBAgent.exe
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
C:\Program Files\AVAST Software\Avast Business\AvastUI.exe
C:\Users\skolnik\AppData\Roaming\Seznam.cz\bin\szndesktop.exe
C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe
C:\Program Files (x86)\Google\Drive\googledrivesync.exe
C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe
C:\Program Files (x86)\Mozilla Firefox\firefox.exe
C:\Program Files (x86)\Google\Chrome\Application\43.0.2357.81\Installer\setup.exe
C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe
C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_17_0_0_169.exe
C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_17_0_0_169.exe
D:\Downloads\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.seznam.cz/?clid=16194
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = localhost:8080
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F2 - REG:system.ini: UserInit=userinit.exe,
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre1.8.0_31\bin\ssv.dll
O2 - BHO: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast Business\aswWebRepIE.dll
O2 - BHO: Pomocná služba pro přihlášení k účtu Microsoft - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: URLRedirectionBHO - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre1.8.0_31\bin\jp2ssv.dll
O3 - Toolbar: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast Business\aswWebRepIE.dll
O4 - HKLM\..\Run: [NBAgent] "C:\Program Files (x86)\Nero\Nero 10\Nero BackItUp\NBAgent.exe" /WinStart
O4 - HKLM\..\Run: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [DLSService] "C:\Program Files (x86)\DYMO\DYMO Label Software\DLSService.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [avast] "C:\Program Files\AVAST Software\Avast Business\avastUI.exe" /nogui
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [seznam-listicka-distribuce] "C:\Program Files (x86)\Seznam.cz\distribution\szninstall.exe" -s -d listicka 1 szn-software-listicka cz.seznam.software.autoupdate
O4 - HKLM\..\Run: [SDTray] "C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe"
O4 - HKCU\..\Run: [Svátky a výročí] C:\Program Files (x86)\OKsoftware\Svátky a výročí\Vyroci.exe
O4 - HKCU\..\Run: [HydraVisionDesktopManager] "C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe"
O4 - HKCU\..\Run: [DymoQuickPrint] "C:\Program Files (x86)\DYMO\DYMO Label Software\DymoQuickPrint.exe" /startup
O4 - HKCU\..\Run: [GoogleDriveSync] "C:\Program Files (x86)\Google\Drive\googledrivesync.exe" /autostart
O4 - HKCU\..\Run: [cz.seznam.software.autoupdate] "C:\Users\skolnik\AppData\Roaming\Seznam.cz\szninstall.exe" -c
O4 - HKCU\..\Run: [cz.seznam.software.szndesktop] "C:\Users\skolnik\AppData\Roaming\Seznam.cz\bin\wszndesktop.exe" -q
O4 - HKCU\..\RunOnce: [Uninstall C:\Users\skolnik\AppData\Local\Microsoft\SkyDrive\16.4.6010.0727\amd64] C:\Windows\system32\cmd.exe /q /c rmdir /s /q "C:\Users\skolnik\AppData\Local\Microsoft\SkyDrive\16.4.6010.0727\amd64"
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O4 - Global Startup: Device Monitor 4.lnk = C:\Program Files (x86)\PIXELA\Everio MediaBrowser 4\MBCameraMonitor.exe
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~2\MICROS~1\Office14\EXCEL.EXE/3000
O8 - Extra context menu item: Od&eslat do aplikace OneNote - res://C:\PROGRA~2\MICROS~1\Office14\ONBttnIE.dll/105
O9 - Extra button: @C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1004 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: @C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1003 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Odeslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Od&eslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll
O9 - Extra button: P&ropojené poznámky aplikace OneNote - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
O9 - Extra 'Tools' menuitem: P&ropojené poznámky aplikace OneNote - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O16 - DPF: {5E013669-3103-47A0-90ED-F02AFE6BA38E} (4Mosa Control) - http://46.47.132.120/600series.cab
O16 - DPF: {A796D216-2DE1-4EA8-BABB-FE6E7C959098} (HPSDDX Class) - http://www.hp.com/cpso-support-new/SDD/ ... Signed.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/s ... wflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = zsl.local
O17 - HKLM\System\CCS\Services\Tcpip\..\{967984E7-2F32-4DAE-82CF-336EC1F8999A}: NameServer = 8.8.8.8,8.8.4.4,4.2.2.1,4.2.2.2,208.67.222.222,208.67.220.220,8.26.56.26,8.20.247.20,156.154.70.1,156.154.71.1
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = zsl.local
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = zsl.local
O18 - Protocol: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
O18 - Filter hijack: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL
O20 - Winlogon Notify: SDWinLogon - SDWinLogon.dll (file missing)
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: AMD External Events Utility - Unknown owner - C:\Windows\system32\atiesrxx.exe (file missing)
O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\AVAST Software\Avast Business\AvastSvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files (x86)\Bonjour\mDNSResponder.exe
O23 - Service: DYMO PnP Service (DymoPnpService) - Sanford, L.P. - C:\Program Files (x86)\DYMO\DYMO Label Software\DymoPnpService.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: Služba Google Update (gupdate) (gupdate) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Služba Google Update (gupdatem) (gupdatem) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: @%SystemRoot%\system32\ieetwcollectorres.dll,-1000 (IEEtwCollectorService) - Unknown owner - C:\Windows\system32\IEEtwCollector.exe (file missing)
O23 - Service: Intel(R) Capability Licensing Service Interface - Intel(R) Corporation - C:\Program Files\Intel\iCLS Client\HeciServer.exe
O23 - Service: Intel(R) Dynamic Application Loader Host Interface Service (jhi_service) - Intel Corporation - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Intel(R) Management and Security Application Local Management Service (LMS) - Intel Corporation - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
O23 - Service: MBAMScheduler - Malwarebytes Corporation - C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe
O23 - Service: MBAMService - Malwarebytes Corporation - C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe
O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @C:\Program Files (x86)\Nero\Update\NASvc.exe,-200 (NAUpdate) - Nero AG - C:\Program Files (x86)\Nero\Update\NASvc.exe
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Spybot-S&D 2 Scanner Service (SDScannerService) - Safer-Networking Ltd. - C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe
O23 - Service: Spybot-S&D 2 Updating Service (SDUpdateService) - Safer-Networking Ltd. - C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe
O23 - Service: Spybot-S&D 2 Security Center Service (SDWSCService) - Safer-Networking Ltd. - C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: SpyHunter 4 Service - Enigma Software Group USA, LLC. - C:\Program Files\Enigma Software Group\SpyHunter\SH4Service.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: Intel(R) Management and Security Application User Notification Service (UNS) - Intel Corporation - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
O23 - Service: UsbClientService - Unknown owner - C:\Program Files (x86)\Synology\Assistant\UsbClientService.exe
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)
--
End of file - 14104 bytes
Prosím o kontrolu logu Vyřešeno
-
jerabina
- člen Security týmu
-
Level 6
- Příspěvky: 3647
- Registrován: březen 13
- Bydliště: Litoměřice
- Pohlaví:
- Stav:
Offline
Re: Prosím o kontrolu logu
MBAM si dáme ještě jednou .. 
Stáhni si ATF Cleaner
Poklepej na ATF Cleaner.exe, klikni na select all found, poté:
-Když používáš Firefox (Mozzila), klikni na Firefox nahoře a vyber: Select All, poté klikni na Empty Selected.
-Když používáš Operu, klikni nahoře na Operu a vyber: Select All, poté klikni na Empty Selected. Poté klikni na Main (hlavní stránku ) a klikni na Empty Selected.
Po vyčištění klikni na Exit k zavření programu.
ATF-Cleaner je jednoduchý nástroj na odstranění historie z webového prohlížeče. Program dokáže odstranit cache, cookies, historii a další stopy po surfování na Internetu. Mezi podporované prohlížeče patří Internet Explorer, Firefox a Opera. Aplikace navíc umí odstranit dočasné soubory Windows, vysypat koš atd.
- Pokud používáš jen Google Chrome , tak ATF nemusíš použít.
===================================================
Stáhni si TFC
Otevři soubor a zavři všechny ostatní okna, Klikni na Start k zahájení procesu. Program by neměl trvat dlouho.
Poté by se měl PC restartovat, pokud ne , proveď sám.
===================================================
Stáhni AdwCleaner (by Xplode)
Ulož si ho na svojí plochu
Ukonči všechny programy , okna a prohlížeče
Spusť program poklepáním a klikni na „Prohledat-Scan“
Po skenu se objeví log ( jinak je uložen systémovem disku jako AdwCleaner[R?].txt), jeho obsah sem celý vlož.
===================================================
Stáhni si Malwarebytes' Anti-Malware
- Při instalaci odeber zatržítko u „Povolit bezplatnou zkušební verzi Malwarebytes' Anti-Malware Premium“
Nainstaluj a spusť ho
- na konci instalace se ujisti že máš zvoleny/zatrhnuty obě možnosti:
Aktualizace Malwarebytes' Anti-Malware a Spustit aplikaci Malwarebytes' Anti-Malware, pokud jo tak klikni na tlačítko konec
- pokud bude nalezena aktualizace, tak se stáhne a nainstaluje
- program se po té spustí a klikni na Skenovat nyní a
- po proběhnutí programu se ti objeví hláška vpravo dole tak klikni na Kopírovat do schránky a a vlož sem celý log.
- po té klikni na tlačítko Exit, objeví se ti hláška tak zvol Ano
(zatím nic nemaž!).
Pokud budou problémy , spusť v nouz. režimu.
Stáhni si ATF Cleaner
Poklepej na ATF Cleaner.exe, klikni na select all found, poté:
-Když používáš Firefox (Mozzila), klikni na Firefox nahoře a vyber: Select All, poté klikni na Empty Selected.
-Když používáš Operu, klikni nahoře na Operu a vyber: Select All, poté klikni na Empty Selected. Poté klikni na Main (hlavní stránku ) a klikni na Empty Selected.
Po vyčištění klikni na Exit k zavření programu.
ATF-Cleaner je jednoduchý nástroj na odstranění historie z webového prohlížeče. Program dokáže odstranit cache, cookies, historii a další stopy po surfování na Internetu. Mezi podporované prohlížeče patří Internet Explorer, Firefox a Opera. Aplikace navíc umí odstranit dočasné soubory Windows, vysypat koš atd.
- Pokud používáš jen Google Chrome , tak ATF nemusíš použít.
===================================================
Stáhni si TFC
Otevři soubor a zavři všechny ostatní okna, Klikni na Start k zahájení procesu. Program by neměl trvat dlouho.
Poté by se měl PC restartovat, pokud ne , proveď sám.
===================================================
Stáhni AdwCleaner (by Xplode)
Ulož si ho na svojí plochu
Ukonči všechny programy , okna a prohlížeče
Spusť program poklepáním a klikni na „Prohledat-Scan“
Po skenu se objeví log ( jinak je uložen systémovem disku jako AdwCleaner[R?].txt), jeho obsah sem celý vlož.
===================================================
Stáhni si Malwarebytes' Anti-Malware
- Při instalaci odeber zatržítko u „Povolit bezplatnou zkušební verzi Malwarebytes' Anti-Malware Premium“
Nainstaluj a spusť ho
- na konci instalace se ujisti že máš zvoleny/zatrhnuty obě možnosti:
Aktualizace Malwarebytes' Anti-Malware a Spustit aplikaci Malwarebytes' Anti-Malware, pokud jo tak klikni na tlačítko konec
- pokud bude nalezena aktualizace, tak se stáhne a nainstaluje
- program se po té spustí a klikni na Skenovat nyní a
- po proběhnutí programu se ti objeví hláška vpravo dole tak klikni na Kopírovat do schránky a a vlož sem celý log.
- po té klikni na tlačítko Exit, objeví se ti hláška tak zvol Ano
(zatím nic nemaž!).
Pokud budou problémy , spusť v nouz. režimu.
Když nevíš jak dál, přichází na řadu prostudovat manuál!
HJT návod
Pokud neodpovídám do vašich témat v sekci HJT když jsem online, tak je to jen proto, že jsem na mobilu kde je studování logů a psaní skriptů nemožné. Neberte to tedy prosím jako ignoraci.
HJT návod
Pokud neodpovídám do vašich témat v sekci HJT když jsem online, tak je to jen proto, že jsem na mobilu kde je studování logů a psaní skriptů nemožné. Neberte to tedy prosím jako ignoraci.
Re: Prosím o kontrolu logu
# AdwCleaner v4.206 - Log vytvořen 04/06/2015 v 11:12:00
# Aktualizováno 01/06/2015 by Xplode
# Databáze : 2015-06-01.1 [Server]
# Operační system : Windows 7 Professional Service Pack 1 (x64)
# Uživatelské jméno : skolnik - SKOLNIK-PC
# Spuštěno z : C:\Users\skolnik\Desktop\AdwCleaner.exe
# Nastavení : Sken
***** [ Služby ] *****
***** [ Soubory / Složky ] *****
Soubor Nalezeno : C:\Users\skolnik\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_www.mystartsearch.com_0.localstorage
Soubor Nalezeno : C:\Users\skolnik\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_www.mystartsearch.com_0.localstorage-journal
***** [ Naplánované úlohy ] *****
***** [ Zástupci ] *****
***** [ Registry ] *****
Data Nalezeno : HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings [ProxyServer] - localhost:8080
Hodnota Nalezeno : HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings [DefaultConnectionSettings]
Hodnota Nalezeno : HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings [SavedLegacySettings]
***** [ Prohlížeče ] *****
-\\ Internet Explorer v11.0.9600.17801
-\\ Mozilla Firefox v38.0.5 (x86 cs)
[75dgyfue.default] - Řádek Nalezeno : user_pref("extensions.a6a1a03975fde4c8690f6b883c36bc17d88519bfe704d8cae3851239com74253.74253.internaldb.__ICM_LITE__blacklist_domain.value", "%7B%22SLIDERS%22%3A%5B%226pm.com%22%2C%22amazon.co.uk%22%2[...]
[75dgyfue.default] - Řádek Nalezeno : user_pref("extensions.a6a1a03975fde4c8690f6b883c36bc17d88519bfe704d8cae3851239com74253.74253.internaldb.monetization_plugin_bundledUrls.value", "%7B%22dealply_s%22%3A%7B%22urls%22%3A%5B%22ssfiles.com%[...]
[75dgyfue.default] - Řádek Nalezeno : user_pref("extensions.snipit.searchAssistEnabled", true);
-\\ Google Chrome v43.0.2357.81
[C:\Users\skolnik\AppData\Local\Google\Chrome\User Data\Default\Web data] - Nalezeno [Search Provider] : hxxp://www.mystartsearch.com/web/?type= ... QGAD55Z&q={searchTerms}
[C:\Users\skolnik\AppData\Local\Google\Chrome\User Data\Default\Preferences] - Nalezeno [Homepage] : ","homepage_changed":true,"homepage_is_newtabpage":false,"hxxp_original_content_length":"158400","hxxp_received_content_length":"158400","intl":{"accept_languages":"cs-CZ,cs"},"invalidator":{"client_id":"fM/Qz9UBQL7l16JDlppRSQ=="},"media":{"device_id_salt":"S2jMHraetGkGT98QPk/3sQ=="},"net":{"hxxp_server_properties":{"servers":{"0.client-channel.google.com:443":{"alternative_service":[{"port":443,"probability":1.0,"protocol_str":"quic"}],"settings":{"4":100,"5":60,"6":0},"supports_spdy":true},"1-channel-proxy-07-ash2.facebook.com:443":{"supports_spdy":true},"2-channel-proxy-13-prn1.facebook.com:443":{"supports_spdy":true},"6-channel-proxy-06-ash2.facebook.com:443":{"supports_spdy":true},"accounts.google.com:443":{"alternative_service":[{"port":443,"probability":1.0,"protocol_str":"quic"}],"settings":{"4":100,"5":42,"6":0},"supports_spdy":true},"accounts.google.cz:443":{"alternative_service":[{"port":443,"probability":1.0,"protocol_str":"quic"}],"settings":{"4":100,"5":32,"6":0},"supports_spdy":true},"accounts.youtube.com:443":{"alternative_service":[{"port":443,"probability":1.0,"protocol_str":"quic"}],"settings":{"4":100,"5":32,"6":0},"supports_spdy":true},"ad.doubleclick.net:80":{"alternative_service":[{"port":80,"probability":1.0,"protocol_str":"quic"}]},"ajax.googleapis.com:443":{"alternative_service":[{"port":443,"probability":0.02,"protocol_str":"quic"}],"settings":{"4":100,"5":36,"6":0},"supports_spdy":true},"ajax.googleapis.com:80":{"alternative_service":[{"port":80,"probability":0.02,"protocol_str":"quic"}]},"analytics.twitter.com:443":{"supports_spdy":true},"android.clients.google.com:443":{"supports_spdy":true},"apis.google.com:443":{"alternative_service":[{"port":443,"probability":1.0,"protocol_str":"quic"}],"settings":{"4":100,"5":69,"6":0},"supports_spdy":true},"bid.g.doubleclick.net:80":{"alternative_service":[{"port":80,"probability":1.0,"protocol_str":"quic"}]},"cache.pack.google.com:80":{"alternative_service":[{"port":80,"probability":1.0,"protocol_str":"quic"}]},"cdnjs.cloudflare.com:443":{"supports_spdy":true},"channel-proxy-13-prn1.facebook.com:443":{"supports_spdy":true},"chrome.google.com:443":{"alternative_service":[{"port":443,"probability":1.0,"protocol_str":"quic"}],"settings":{"4":100,"5":363,"6":0},"supports_spdy":true},"clients1.google.com:443":{"settings":{"4":100},"supports_spdy":true},"clients2.google.com:443":{"settings":{"4":100,"5":7,"6":0},"supports_spdy":true},"clients2.google.com:80":{"alternative_service":[{"port":80,"probability":0.5,"protocol_str":"quic"}]},"clients2.googleusercontent.com:443":{"settings":{"4":100,"5":73,"6":0},"supports_spdy":true},"clients4.google.com:443":{"settings":{"4":100,"5":32,"6":0},"supports_spdy":true},"clients6.google.com:443":{"alternative_service":[{"port":443,"probability":1.0,"protocol_str":"quic"}],"settings":{"4":100,"5":32,"6":0},"supports_spdy":true},"cm.g.doubleclick.net:443":{"alternative_service":[{"port":443,"probability":1.0,"protocol_str":"quic"}],"settings":{"4":100,"5":32,"6":0},"supports_spdy":true},"compey.info:443":{"supports_spdy":true},"content.googleapis.com:443":{"alternative_service":[{"port":443,"probability":1.0,"protocol_str":"quic"}],"settings":{"4":100,"5":100,"6":0},"supports_spdy":true},"csi.gstatic.com:443":{"alternative_service":[{"port":443,"probability":1.0,"protocol_str":"quic"}],"settings":{"4":100,"5":32,"6":0},"supports_spdy":true},"cx.atdmt.com:443":{"supports_spdy":true},"direct_pop.unition.org:443":{"supports_spdy":true},"docs.google.com:443":{"alternative_service":[{"port":443,"probability":1.0,"protocol_str":"quic"}],"settings":{"4":100,"5":218,"6":0},"supports_spdy":true},"drive.google.com:443":{"alternative_service":[{"port":443,"probability":1.0,"protocol_str":"quic"}],"settings":{"4":100,"5":16,"6":0},"supports_spdy":true},"external-vie.xx.fbcdn.net:443":{"supports_spdy":true},"fbcdn-creative-a.akamaihd.net:443":{"settings":{"4":20,"7":65536},"supports_spdy":true},"fbcdn-photos-d-a.akamaihd.net:443":{"settings":{"4":20,"7":65536},"supports_spdy":true},"fbcdn-photos-g-a.akamaihd.net:443":{"settings":{"4":20,"7":65536},"supports_spdy":true},"fbcdn-photos-h-a.akamaihd.net:443":{"settings":{"4":20,"7":65536},"supports_spdy":true},"fbcdn-profile-a.akamaihd.net:443":{"settings":{"4":20,"7":65536},"supports_spdy":true},"fbstatic-a.akamaihd.net:443":{"settings":{"4":20,"7":65536},"supports_spdy":true},"fls.doubleclick.net:443":{"settings":{"4":100,"5":10},"supports_spdy":true},"fonts.googleapis.com:443":{"alternative_service":[{"port":443,"probability":0.02,"protocol_str":"quic"}],"settings":{"4":100,"5":32,"6":0},"supports_spdy":true},"fonts.googleapis.com:80":{"alternative_service":[{"port":80,"probability":1.0,"protocol_str":"quic"}]},"fonts.gstatic.com:443":{"alternative_service":[{"port":443,"probability":1.0,"protocol_str":"quic"}],"settings":{"4":100,"5":45,"6":0},"supports_spdy":true},"fonts.gstatic.com:80":{"alternative_service":[{"port":80,"probability":1.0,"protocol_str":"quic"}]},"google.cz:80":{"alternative_service":[{"port":80,"probability":1.0,"protocol_str":"quic"}]},"googleads.g.doubleclick.net:443":{"alternative_service":[{"port":443,"probability":1.0,"protocol_str":"quic"}],"settings":{"4":100,"5":10},"supports_spdy":true},"googleads.g.doubleclick.net:80":{"alternative_service":[{"port":80,"probability":0.02,"protocol_str":"quic"}]},"graph.facebook.com:443":{"supports_spdy":true},"i.ytimg.com:443":{"alternative_service":[{"port":443,"probability":0.02,"protocol_str":"quic"}],"settings":{"4":100},"supports_spdy":true},"lh3.googleusercontent.com:443":{"alternative_service":[{"port":443,"probability":1.0,"protocol_str":"quic"}],"settings":{"4":100,"5":100,"6":0},"supports_spdy":true},"lh4.googleusercontent.com:443":{"settings":{"4":100,"5":88,"6":0},"supports_spdy":true},"lh5.googleusercontent.com:443":{"settings":{"4":100,"5":123,"6":0},"supports_spdy":true},"lh6.googleusercontent.com:443":{"settings":{"4":100,"5":46,"6":0},"supports_spdy":true},"oauth.googleusercontent.com:443":{"settings":{"4":100,"5":38,"6":0},"supports_spdy":true},"pagead2.googlesyndication.com:80":{"alternative_service":[{"port":80,"probability":1.0,"protocol_str":"quic"}]},"partner.googleadservices.com:80":{"alternative_service":[{"port":80,"probability":1.0,"protocol_str":"quic"}]},"pixel.facebook.com:443":{"supports_spdy":true},"plus.google.com:443":{"alternative_service":[{"port":443,"probability":1.0,"protocol_str":"quic"}],"settings":{"4":100,"5":100,"6":0},"supports_spdy":true},"plusone.google.com:443":{"settings":{"4":100},"supports_spdy":true},"privilegesbox.net:443":{"supports_spdy":true},"pubads.g.doubleclick.net:80":{"alternative_service":[{"port":80,"probability":1.0,"protocol_str":"quic"}]},"r2---sn-2vq5-vnge.c.pack.google.com:80":{"alternative_service":[{"port":80,"probability":1.0,"protocol_str":"quic"}]},"s.ytimg.com:443":{"alternative_service":[{"port":443,"probability":0.02,"protocol_str":"quic"}],"settings":{"4":100},"supports_spdy":true},"s0.2mdn.net:80":{"alternative_service":[{"port":80,"probability":1.0,"protocol_str":"quic"}]},"s1.2mdn.net:80":{"alternative_service":[{"port":80,"probability":1.0,"protocol_str":"quic"}]},"scontent-a-vie.xx.fbcdn.net:443":{"supports_spdy":true},"scontent-b-vie.xx.fbcdn.net:443":{"supports_spdy":true},"securepubads.g.doubleclick.net:443":{"alternative_service":[{"port":443,"probability":1.0,"protocol_str":"quic"}],"settings":{"4":100,"5":34,"6":0},"supports_spdy":true},"ssl.google-analytics.com:443":{"alternative_service":[{"port":443,"probability":0.02,"protocol_str":"quic"}],"settings":{"4":100,"5":14,"6":0},"supports_spdy":true},"ssl.gstatic.com:443":{"alternative_service":[{"port":443,"probability":1.0,"protocol_str":"quic"}],"settings":{"4":100,"5":14,"6":0},"supports_spdy":true},"stats.g.doubleclick.net:443":{"alternative_service":[{"port":443,"probability":1.0,"protocol_str":"quic"}],"settings":{"4":100,"5":32,"6":0},"supports_spdy":true},"stats.g.doubleclick.net:80":{"alternative_service":[{"port":80,"probability":0.02,"protocol_str":"quic"}]},"themes.googleusercontent.com:443":{"settings":{"4":100,"5":59,"6":0},"supports_spdy":true},"tpc.googlesyndication.com:443":{"alternative_service":[{"port":443,"probability":1.0,"protocol_str":"quic"}],"settings":{"4":100,"5":103,"6":0},"supports_spdy":true},"tpc.googlesyndication.com:80":{"alternative_service":[{"port":80,"probability":1.0,"protocol_str":"quic"}]},"twitter.com:443":{"supports_spdy":true},"upload.docs.google.com:443":{"alternative_service":[{"port":443,"probability":1.0,"protocol_str":"quic"}],"settings":{"4":100,"5":6,"6":0},"supports_spdy":true},"www.facebook.com:443":{"supports_spdy":true},"www.google-analytics.com:443":{"alternative_service":[{"port":443,"probability":1.0,"protocol_str":"quic"}],"settings":{"4":100,"5":32,"6":0},"supports_spdy":true},"www.google-analytics.com:80":{"alternative_service":[{"port":80,"probability":0.0,"protocol_str":"quic"}]},"www.google.com:443":{"alternative_service":[{"port":443,"probability":1.0,"protocol_str":"quic"}],"settings":{"4":100,"5":100,"6":0},"supports_spdy":true},"www.google.com:80":{"alternative_service":[{"port":80,"probability":0.02,"protocol_str":"quic"}]},"www.google.cz:443":{"alternative_service":[{"port":443,"probability":1.0,"protocol_str":"quic"}],"settings":{"4":100,"5":47,"6":0},"supports_spdy":true},"www.google.cz:80":{"alternative_service":[{"port":80,"probability":1.0,"protocol_str":"quic"}]},"www.googleadservices.com:443":{"settings":{"4":100,"5":10},"supports_spdy":true},"www.googleadservices.com:80":{"alternative_service":[{"port":80,"probability":0.02,"protocol_str":"quic"}]},"www.googleapis.com:443":{"settings":{"4":100,"5":32,"6":0},"supports_spdy":true},"www.googletagmanager.com:443":{"alternative_service":[{"port":443,"probability":1.0,"protocol_str":"quic"}],"settings":{"4":100,"5":32,"6":0},"supports_spdy":true},"www.googletagmanager.com:80":{"alternative_service":[{"port":80,"probability":1.0,"protocol_str":"quic"}]},"www.googletagservices.com:80":{"alternative_service":[{"port":80,"probability":1.0,"protocol_str":"quic"}]},"www.gstatic.com:443":{"alternative_service":[{"port":443,"probability":1.0,"protocol_str":"quic"}],"settings":{"4":100,"5":80,"6":0},"supports_spdy":true},"www.gstatic.com:80":{"alternative_service":[{"port":80,"probability":1.0,"protocol_str":"quic"}]},"www.youtube.com:443":{"alternative_service":[{"port":443,"probability":0.02,"protocol_str":"quic"}],"settings":{"4":100},"supports_spdy":true},"www.youtube.com:80":{"alternative_service":[{"port":80,"probability":0.02,"protocol_str":"quic"}]}},"version":3}},"ntp":{"app_page_names":["Aplikace"],"pref_version":3,"promo_closed":false,"promo_end":1342994400.0,"promo_group":0,"promo_group_max":1,"promo_group_timeslice":0,"promo_increment":1,"promo_initial_segment":1,"promo_line":"Máte chytrý telefon nebo tablet? \u003Ca href=\"hxxps://www.google.com/chrome/mobile/?utm_source=chrome&utm_medium=ntp&utm_campaign=ntp-promo\"> Pořiďte si Chrome pro mobilní zařízení\u003C/a>","promo_num_groups":1,"promo_start":1341828000.0,"promo_views":0,"promo_views_max":15},"partition":{"per_host_zoom_levels":{"2166136261":{"pelmel.info":1.223901033401489}}},"pinned_tabs":[],"plugins":{"enabled_internal_pdf3":true,"enabled_nacl":true,"last_internal_directory":"C:\\Program Files (x86)\\Google\\Chrome\\Application\\43.0.2357.81","migrated_to_pepper_flash":true,"plugins_list":[{"enabled":true,"name":"Remoting Viewer","path":"internal-remoting-viewer","version":""},{"enabled":true,"name":"Remoting Viewer"},{"enabled":true,"name":"Native Client","path":"C:\\Program Files (x86)\\Google\\Chrome\\Application\\43.0.2357.81\\ppGoogleNaClPluginChrome.dll","version":""},{"enabled":true,"name":"Native Client"},{"enabled":true,"name":"Chrome PDF Viewer","path":"C:\\Program Files (x86)\\Google\\Chrome\\Application\\43.0.2357.81\\pdf.dll","version":""},{"enabled":true,"name":"Chrome PDF Viewer"},{"enabled":true,"name":"Shockwave Flash","path":"C:\\Program Files (x86)\\Google\\Chrome\\Application\\43.0.2357.81\\gcswf32.dll","version":"11,3,300,265"},{"enabled":true,"name":"Flash"},{"enabled":true,"name":"Google Update","path":"C:\\Program Files (x86)\\Google\\Update\\1.3.21.115\\npGoogleUpdate3.dll","version":"1.3.21.115"},{"enabled":true,"name":"Google Update"},{"enabled":true,"name":"Intel® Identity Protection Technology","path":"C:\\Program Files (x86)\\Intel\\Intel(R) Management Engine Components\\IPT\\npIntelWebAPIIPT.dll","version":"2.0.59.0"},{"enabled":true,"name":"Intel® Identity Protection Technology","path":"C:\\Program Files (x86)\\Intel\\Intel(R) Management Engine Components\\IPT\\npIntelWebAPIUpdater.dll","version":"2.0.59.0"},{"enabled":true,"name":"Intel® Identity Protection Technology"}],"removed_old_component_pepper_flash_settings":true},"printing":{"print_preview_sticky_settings":{"appState":"{\"version\":2,\"isGcpPromoDismissed\":false,\"selectedDestinationId\":\"Školník\",\"selectedDestinationOrigin\":\"local\",\"selectedDestinationAccount\":\"\",\"selectedDestinationCapabilities\":{\"printer\":{\"collate\":{\"default\":false},\"color\":{\"option\":[{\"is_default\":true,\"type\":\"STANDARD_COLOR\",\"vendor_id\":\"2\"}]},\"copies\":{},\"dpi\":{\"option\":[{\"horizontal_dpi\":600,\"is_default\":true,\"vertical_dpi\":600}]},\"media_size\":{\"option\":[{\"custom_display_name\":\"Letter\",\"height_microns\":279400,\"name\":\"NA_LETTER\",\"vendor_id\":\"1\",\"width_microns\":215900},{\"custom_display_name\":\"Legal\",\"height_microns\":355600,\"name\":\"NA_LEGAL\",\"vendor_id\":\"5\",\"width_microns\":215900},{\"custom_display_name\":\"Executive\",\"height_microns\":266700,\"name\":\"NA_EXECUTIVE\",\"vendor_id\":\"7\",\"width_microns\":184100},{\"custom_display_name\":\"A3\",\"height_microns\":420000,\"name\":\"ISO_A3\",\"vendor_id\":\"8\",\"width_microns\":297000},{\"custom_display_name\":\"A4\",\"height_microns\":297000,\"is_default\":true,\"name\":\"ISO_A4\",\"vendor_id\":\"9\",\"width_microns\":210000},{\"custom_display_name\":\"A5\",\"height_microns\":210000,\"name\":\"ISO_A5\",\"vendor_id\":\"11\",\"width_microns\":148000},{\"custom_display_name\":\"B4 (JIS)\",\"height_microns\":364000,\"name\":\"JIS_B4\",\"vendor_id\":\"12\",\"width_microns\":257000},{\"custom_display_name\":\"B5 (JIS)\",\"height_microns\":257000,\"name\":\"JIS_B5\",\"vendor_id\":\"13\",\"width_microns\":182000},{\"custom_display_name\":\"11x17\",\"height_microns\":431800,\"name\":\"NA_LEDGER\",\"vendor_id\":\"17\",\"width_microns\":279400},{\"custom_display_name\":\"Obálka č. 10\",\"height_microns\":241300,\"name\":\"NA_NUMBER_10\",\"vendor_id\":\"20\",\"width_microns\":104700},{\"custom_display_name\":\"Obálka DL\",\"height_microns\":220000,\"name\":\"ISO_DL\",\"vendor_id\":\"27\",\"width_microns\":110000},{\"custom_display_name\":\"Obálka C5\",\"height_microns\":229000,\"name\":\"ISO_C5\",\"vendor_id\":\"28\",\"width_microns\":162000},{\"custom_display_name\":\"Obálka B5\",\"height_microns\":250000,\"name\":\"ISO_B5\",\"vendor_id\":\"34\",\"width_microns\":176000},{\"custom_display_name\":\"Obálka Monarch\",\"height_microns\":190500,\"name\":\"NA_MONARCH\",\"vendor_id\":\"37\",\"width_microns\":98400},{\"custom_display_name\":\"Japonská pohlednice\",\"height_microns\":148000,\"name\":\"JPN_HAGAKI\",\"vendor_id\":\"43\",\"width_microns\":100000},{\"custom_display_name\":\"A6\",\"height_microns\":148000,\"name\":\"ISO_A6\",\"vendor_id\":\"70\",\"width_microns\":105000},{\"custom_display_name\":\"Japonská dv. pohlednice otočená\",\"height_microns\":200000,\"name\":\"JPN_OUFUKU\",\"vendor_id\":\"82\",\"width_microns\":148000},{\"custom_display_name\":\"B5 (ISO)\",\"height_microns\":249900,\"name\":\"ISO_B5\",\"vendor_id\":\"132\",\"width_microns\":175900},{\"custom_display_name\":\"8K\",\"height_microns\":393700,\"name\":\"ROC_8K\",\"vendor_id\":\"133\",\"width_microns\":273000},{\"custom_display_name\":\"16K 7.75x10.75 in\",\"height_microns\":273000,\"name\":\"ROC_16K\",\"vendor_id\":\"134\",\"width_microns\":196800},{\"custom_display_name\":\"16K 195x270 mm\",\"height_microns\":270000,\"vendor_id\":\"135\",\"width_microns\":195000},{\"custom_display_name\":\"16K 184x260 mm\",\"height_microns\":259900,\"vendor_id\":\"136\",\"width_microns\":184000},{\"custom_display_name\":\"8,5 x 13 (vlastní)\",\"height_microns\":330200,\"name\":\"JIS_EXEC\",\"vendor_id\":\"137\",\"width_microns\":215900}]},\"page_orientation\":{\"option\":[{\"is_default\":true,\"type\":\"PORTRAIT\"},{\"type\":\"LANDSCAPE\"},{\"type\":\"AUTO\"}]},\"supported_content_type\":[{\"content_type\":\"application/pdf\"}]},\"version\":\"1.0\"},\"selectedDestinationName\":\"Školník\",\"mediaSize\":{\"custom_display_name\":\"A4\",\"height_microns\":297000,\"is_default\":true,\"name\":\"ISO_A4\",\"vendor_id\":\"9\",\"width_microns\":210000}}"}},"profile":{"avatar_bubble_tutorial_shown":1,"avatar_index":0,"content_settings":{"clear_on_exit_migrated":true,"exceptions":{"app_banner":{},"auto_select_certificate":{},"automatic_downloads":{},"cookies":{},"fullscreen":{},"geolocation":{},"images":{},"javascript":{},"media_stream":{},"media_stream_camera":{},"media_stream_mic":{},"metro_switch_to_desktop":{},"midi_sysex":{},"mixed_script":{},"mouselock":{},"notifications":{},"plugins":{},"popups":{},"ppapi_broker":{},"protocol_handlers":{},"push_messaging":{},"ssl_cert_decisions":{}},"pattern_pairs":{},"pref_version":1},"exit_type":"Normal","exited_cleanly":true,"icon_version":3,"managed_user_id":"","migrated_content_settings_exceptions":true,"migrated_default_content_settings":true,"migrated_default_media_stream_content_settings":true,"name":"První uživatel","password_manager_groups_for_domains":[null,null,null,null,null,null,7],"per_host_zoom_levels":{}},"protection":{"macs":{"browser":{"show_home_button":"3D70C22F1939338B96D11D1345E9A8BB9FF5DD207F011F14436E1C7DE12C3034"},"default_search_provider":{"keyword":"B06B11EA44C8C6A17AF99DD70F1E4A508293CB122303E3EBEFA38263982E510A","name":"600C0407C74FC1EBC65577BD767AAE7CEC880D50312DCFAE1DACC98E02E256BE","search_url":"7CAC40CCF46555CFA08EEE191ADD3B1B5FE1BB01CE2A6442BD50E363CEF0754F"},"default_search_provider_data":{"template_url_data":"E347C2CDC769C6DDF7BBCA0378AA3A365204741A75AFD7B282BA1DDB52F0A7C7"},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":"2265B304078578F418E1B88441342B2F273FAE63967265CDC3676645A6D4809F","apdfllckaahabafndbhieahigkjlhalf":"437C06BFA534A0CBF1558E0352ECD7DD081A10D0DFF2748BC01F48175A5D820E","bepbmhgboaologfdajaanbcjmnhjmhfn":"BABD7C6C799B03C931196B9FEC2EB7ACA1240B2654C5633859505480D54BF112","dklimiggiafdoghgnphmpbeknieifjdm":"846D7C1D4DB021973178C906EF78C3DFF691AC3B63A740C3E94531DBF481811A","eemcgdkfndhakfknompkggombfjjjeno":"0325855B0D25F37789835E3A9A84DF0D0E1435B2EE8C8EB1E5C8B564310D607E","ennkphjdgehloodpbhlhldgbnhmacadg":"210B92A0122A0EA97F2EC8CDB917E01BAF5449BF86D5DEFB9F1D5EE268847F6B","gfdkimpbcpahaombhbimeihdjnejgicl":"A3E3BE996108F1D650A7A693EF6BC23351EDFABC0B0B3B4CFF9623AE6F6E6F22","gpjepemmidhpcafaildmapolgeemknfm":"2D10779763CB7C3C193E7973A8EBAAAC2E7D4E94154E3A15E32E2BDA931AB26E","icmlaeflemplmjndnaapfdbbnpncnbda":"71CB84C4FDA2F92FDE5640F47D47C04E65C7359A5BB88166F7BF8E61774C6A7C","kmendfapggjehodndflmmgagdbamhnfd":"3F6088669AD119B308A3B877DDEBB5FB23E65E9C6E8490152EB5904EF08797AB","lmjegmlicamnimmfhcmpkclmigmmcbeh":"7D4F28B9B4B4078FF5163B8664CC4B920F37D1B5AEB70B88078C3F75B63542A9","mfehgcgbbipciphmccgaenjidiccnmng":"E6326948ADACDBEE29F7D699CE5E7DFF7B32474FE6B5DC02DDAD0BA918B8032B","mfffpogegjflfpflabcdkioaeobkgjik":"463A48BF18CA828764953A75459973E95430E150001FEDB0A2D092962B593552","mgndgikekgjfcpckkfioiadnlibdjbkf":"A65951517BD9AB3C4AD7F61A69748B87DAF44B151246DDEA443F477AB1791CAA","mhjfbmdgcfjbbpaeojofohoefgiehjai":"DE3EC5102264CCF0C39DC4BE828220A866F0BF78D9BE4C46C374719AF5D4D149","neajdppkdcdipfabeoofebfddakdcjhd":"4E77E6102ED160192D43B7F732DB5E1A68010814C1DB752E499BEE3176761B50","nkeimhogjdpnpccoofpliimaahmaaome":"AA85F04016EDAC0889F08507759CBDA39332DE3E55C145D9332378AF4CFAE7EC","nmmhkkegccagdldgiimedpiccmgmieda":"D0C7C909C5A507F245D45677280B837FFFC2022DEC8238BD2E19B4CAD3F7756F","pafkbggdmjlpgkdkcbjmhmfcdpncadgh":"B727C7BDCC690258824BB3BBFA80D189AA1C4758E2E0AF2487A17D03429791C4"}},"google":{"services":{"last_username":"CB1E1151FD41EF0AEDEBC840C4ED261A8B35A5C4E210E08487A9CD73B198952A","username":"BC92F0C7FF75C3C8039D9FBADE0CD7B78D7DF91A84C9F28F690443D89A0F0BE3"}},"homepage":"FFB79255E8D9BE144EF0794F2B59A99C7305DFD308DE105B3655CC161C7570D5","homepage_is_newtabpage":"AD8CB53A3EC0B55214209B29C034749A5590F0904E067F9D5AD482D076121406","pinned_tabs":"5987E254EE8A50B854AA02A7B97E6B64A3D20E5F2BEA3DC4F6E03127683E0509","prefs":{"preference_reset_time":"2D03E6E0B1159342CCD3AEDE9B2731AEEB3E78C2E6B277BB78386EA9D0056F05"},"profile":{"reset_prompt_memento":"0798A8343A85818E117780B431BA4E60425A9F8AC9C2A8AAD6ABBFDBD98EBC9F"},"safebrowsing":{"incidents_sent":"23CFF71A9731612304BA3FB7781D537AFC1196BFF11ECEEC174ECC9B78DB2AF8"},"search_provider_overrides":"BFCA5062D096DECDA90695D3956EDC3AE0B10D1EDF47D3458A8FAAFEF4DB250D","session":{"restore_on_startup":"16779F8FE73F516AF5D362CC0FC546374C85B2B7E0C4DC18DAB7D9461D340BCE","startup_urls":"400FA1E10C2AD519D88E40BCCC31133595A4DDD791096E78996F6E2622C003B3"},"software_reporter":{"prompt_reason":"5CC8A633CC643012434EAD6956831CA2B6B0BFD2CF6E25BE6F9778A659CA901B","prompt_seed":"9DB319880E8717D958F829804792A83337D9B4C3AC78F3B0B83384E3AF2FA436","prompt_version":"B6B6FE03C31F915EE8B9A537C1D65853D9C51A7E4076D6E6C2E8CDE865E30921"},"sync":{"remaining_rollback_tries":"AA32BBEBBB7A679FD91722CDBE6FC6461FC2FD3CF58E99912145FED5DE31AD04"}}},"safebrowsing":{"incidents_sent":{"1":{"browser.show_home_button":"1477813002","extensions.settings":"1041862339","google.services.username":"3705243781","homepage":"719371104","session.startup_urls":"245095670"},"2":{"chrome.dll":"3774509266","chrome_child.dll":"3743713718"}}},"session":{"restore_on_startup":4,"restore_on_startup_migrated":true,"startup_urls":["hxxp://www.mystartsearch.com/?type=hp&ts=1419846897&from=wpc&uid=ST3500631NS_9QGAD55ZXXXX9QGAD55Z
[C:\Users\skolnik\AppData\Local\Google\Chrome\User Data\Default\Preferences] - Nalezeno [Startup_URLs] : 400FA1E10C2AD519D88E40BCCC31133595A4DDD791096E78996F6E2622C003B3"},"software_reporter":{"prompt_reason":"5CC8A633CC643012434EAD6956831CA2B6B0BFD2CF6E25BE6F9778A659CA901B","prompt_seed":"9DB319880E8717D958F829804792A83337D9B4C3AC78F3B0B83384E3AF2FA436","prompt_version":"B6B6FE03C31F915EE8B9A537C1D65853D9C51A7E4076D6E6C2E8CDE865E30921"},"sync":{"remaining_rollback_tries":"AA32BBEBBB7A679FD91722CDBE6FC6461FC2FD3CF58E99912145FED5DE31AD04"}}},"safebrowsing":{"incidents_sent":{"1":{"browser.show_home_button":"1477813002","extensions.settings":"1041862339","google.services.username":"3705243781","homepage":"719371104","session.startup_urls":"245095670"},"2":{"chrome.dll":"3774509266","chrome_child.dll":"3743713718"}}},"session":{"restore_on_startup":4,"restore_on_startup_migrated":true,"startup_urls":["hxxp://www.mystartsearch.com/?type=hp&ts=1419846897&from=wpc&uid=ST3500631NS_9QGAD55ZXXXX9QGAD55Z
*************************
AdwCleaner[R0].txt - [56064 bytů] - [05/01/2015 13:31:40]
AdwCleaner[R1].txt - [8873 bytů] - [03/06/2015 08:11:54]
AdwCleaner[R2].txt - [12825 bytů] - [03/06/2015 08:20:36]
AdwCleaner[R3].txt - [25460 bytů] - [04/06/2015 11:12:00]
AdwCleaner[S0].txt - [58311 bytů] - [05/01/2015 13:33:52]
AdwCleaner[S1].txt - [12150 bytů] - [03/06/2015 08:29:09]
########## EOF - C:\AdwCleaner\AdwCleaner[R3].txt - [25637 bytů] ##########
Malwarebytes Anti-Malware
www.malwarebytes.org
Datum skenování: 4.6.2015
Čas skenování: 11:45:44
Protokol:
Správce: Ano
Verze: 2.01.6.1022
Databáze malwaru: v2015.06.04.03
Databáze rootkitů: v2015.06.02.01
Licence: Zkušební verze
Ochrana proti malwaru: Zapnuto
Ochrana proti škodlivým webovým stránkám: Zapnuto
Ochrana programu: Vypnuto
OS: Windows 7 Service Pack 1
CPU: x64
Souborový systém: NTFS
Uživatel: skolnik
Typ skenu: Sken hrozeb
Výsledek: Dokončeno
Prohledaných objektů: 490326
Uplynulý čas: 21 min, 19 sek
Paměť: Zapnuto
Po spuštění: Zapnuto
Souborový systém: Zapnuto
Archivy: Zapnuto
Rootkity: Vypnuto
Heuristika: Zapnuto
PUP: Zapnuto
PUM: Zapnuto
Procesy: 0
(Nenalezeny žádné škodlivé položky)
Moduly: 0
(Nenalezeny žádné škodlivé položky)
Klíče registru: 0
(Nenalezeny žádné škodlivé položky)
Hodnoty registru: 0
(Nenalezeny žádné škodlivé položky)
Data registru: 0
(Nenalezeny žádné škodlivé položky)
Složky: 0
(Nenalezeny žádné škodlivé položky)
Soubory: 2
PUP.Optional.MyStartSearch.A, C:\Users\skolnik\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_www.mystartsearch.com_0.localstorage, , [bdf63d796723de58e4d83fb741c29d63],
PUP.Optional.MyStartSearch.A, C:\Users\skolnik\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_www.mystartsearch.com_0.localstorage-journal, , [9d16a90d830735019824bf3744bf5aa6],
Fyzické sektory: 0
(Nenalezeny žádné škodlivé položky)
(end)
# Aktualizováno 01/06/2015 by Xplode
# Databáze : 2015-06-01.1 [Server]
# Operační system : Windows 7 Professional Service Pack 1 (x64)
# Uživatelské jméno : skolnik - SKOLNIK-PC
# Spuštěno z : C:\Users\skolnik\Desktop\AdwCleaner.exe
# Nastavení : Sken
***** [ Služby ] *****
***** [ Soubory / Složky ] *****
Soubor Nalezeno : C:\Users\skolnik\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_www.mystartsearch.com_0.localstorage
Soubor Nalezeno : C:\Users\skolnik\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_www.mystartsearch.com_0.localstorage-journal
***** [ Naplánované úlohy ] *****
***** [ Zástupci ] *****
***** [ Registry ] *****
Data Nalezeno : HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings [ProxyServer] - localhost:8080
Hodnota Nalezeno : HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings [DefaultConnectionSettings]
Hodnota Nalezeno : HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings [SavedLegacySettings]
***** [ Prohlížeče ] *****
-\\ Internet Explorer v11.0.9600.17801
-\\ Mozilla Firefox v38.0.5 (x86 cs)
[75dgyfue.default] - Řádek Nalezeno : user_pref("extensions.a6a1a03975fde4c8690f6b883c36bc17d88519bfe704d8cae3851239com74253.74253.internaldb.__ICM_LITE__blacklist_domain.value", "%7B%22SLIDERS%22%3A%5B%226pm.com%22%2C%22amazon.co.uk%22%2[...]
[75dgyfue.default] - Řádek Nalezeno : user_pref("extensions.a6a1a03975fde4c8690f6b883c36bc17d88519bfe704d8cae3851239com74253.74253.internaldb.monetization_plugin_bundledUrls.value", "%7B%22dealply_s%22%3A%7B%22urls%22%3A%5B%22ssfiles.com%[...]
[75dgyfue.default] - Řádek Nalezeno : user_pref("extensions.snipit.searchAssistEnabled", true);
-\\ Google Chrome v43.0.2357.81
[C:\Users\skolnik\AppData\Local\Google\Chrome\User Data\Default\Web data] - Nalezeno [Search Provider] : hxxp://www.mystartsearch.com/web/?type= ... QGAD55Z&q={searchTerms}
[C:\Users\skolnik\AppData\Local\Google\Chrome\User Data\Default\Preferences] - Nalezeno [Homepage] : ","homepage_changed":true,"homepage_is_newtabpage":false,"hxxp_original_content_length":"158400","hxxp_received_content_length":"158400","intl":{"accept_languages":"cs-CZ,cs"},"invalidator":{"client_id":"fM/Qz9UBQL7l16JDlppRSQ=="},"media":{"device_id_salt":"S2jMHraetGkGT98QPk/3sQ=="},"net":{"hxxp_server_properties":{"servers":{"0.client-channel.google.com:443":{"alternative_service":[{"port":443,"probability":1.0,"protocol_str":"quic"}],"settings":{"4":100,"5":60,"6":0},"supports_spdy":true},"1-channel-proxy-07-ash2.facebook.com:443":{"supports_spdy":true},"2-channel-proxy-13-prn1.facebook.com:443":{"supports_spdy":true},"6-channel-proxy-06-ash2.facebook.com:443":{"supports_spdy":true},"accounts.google.com:443":{"alternative_service":[{"port":443,"probability":1.0,"protocol_str":"quic"}],"settings":{"4":100,"5":42,"6":0},"supports_spdy":true},"accounts.google.cz:443":{"alternative_service":[{"port":443,"probability":1.0,"protocol_str":"quic"}],"settings":{"4":100,"5":32,"6":0},"supports_spdy":true},"accounts.youtube.com:443":{"alternative_service":[{"port":443,"probability":1.0,"protocol_str":"quic"}],"settings":{"4":100,"5":32,"6":0},"supports_spdy":true},"ad.doubleclick.net:80":{"alternative_service":[{"port":80,"probability":1.0,"protocol_str":"quic"}]},"ajax.googleapis.com:443":{"alternative_service":[{"port":443,"probability":0.02,"protocol_str":"quic"}],"settings":{"4":100,"5":36,"6":0},"supports_spdy":true},"ajax.googleapis.com:80":{"alternative_service":[{"port":80,"probability":0.02,"protocol_str":"quic"}]},"analytics.twitter.com:443":{"supports_spdy":true},"android.clients.google.com:443":{"supports_spdy":true},"apis.google.com:443":{"alternative_service":[{"port":443,"probability":1.0,"protocol_str":"quic"}],"settings":{"4":100,"5":69,"6":0},"supports_spdy":true},"bid.g.doubleclick.net:80":{"alternative_service":[{"port":80,"probability":1.0,"protocol_str":"quic"}]},"cache.pack.google.com:80":{"alternative_service":[{"port":80,"probability":1.0,"protocol_str":"quic"}]},"cdnjs.cloudflare.com:443":{"supports_spdy":true},"channel-proxy-13-prn1.facebook.com:443":{"supports_spdy":true},"chrome.google.com:443":{"alternative_service":[{"port":443,"probability":1.0,"protocol_str":"quic"}],"settings":{"4":100,"5":363,"6":0},"supports_spdy":true},"clients1.google.com:443":{"settings":{"4":100},"supports_spdy":true},"clients2.google.com:443":{"settings":{"4":100,"5":7,"6":0},"supports_spdy":true},"clients2.google.com:80":{"alternative_service":[{"port":80,"probability":0.5,"protocol_str":"quic"}]},"clients2.googleusercontent.com:443":{"settings":{"4":100,"5":73,"6":0},"supports_spdy":true},"clients4.google.com:443":{"settings":{"4":100,"5":32,"6":0},"supports_spdy":true},"clients6.google.com:443":{"alternative_service":[{"port":443,"probability":1.0,"protocol_str":"quic"}],"settings":{"4":100,"5":32,"6":0},"supports_spdy":true},"cm.g.doubleclick.net:443":{"alternative_service":[{"port":443,"probability":1.0,"protocol_str":"quic"}],"settings":{"4":100,"5":32,"6":0},"supports_spdy":true},"compey.info:443":{"supports_spdy":true},"content.googleapis.com:443":{"alternative_service":[{"port":443,"probability":1.0,"protocol_str":"quic"}],"settings":{"4":100,"5":100,"6":0},"supports_spdy":true},"csi.gstatic.com:443":{"alternative_service":[{"port":443,"probability":1.0,"protocol_str":"quic"}],"settings":{"4":100,"5":32,"6":0},"supports_spdy":true},"cx.atdmt.com:443":{"supports_spdy":true},"direct_pop.unition.org:443":{"supports_spdy":true},"docs.google.com:443":{"alternative_service":[{"port":443,"probability":1.0,"protocol_str":"quic"}],"settings":{"4":100,"5":218,"6":0},"supports_spdy":true},"drive.google.com:443":{"alternative_service":[{"port":443,"probability":1.0,"protocol_str":"quic"}],"settings":{"4":100,"5":16,"6":0},"supports_spdy":true},"external-vie.xx.fbcdn.net:443":{"supports_spdy":true},"fbcdn-creative-a.akamaihd.net:443":{"settings":{"4":20,"7":65536},"supports_spdy":true},"fbcdn-photos-d-a.akamaihd.net:443":{"settings":{"4":20,"7":65536},"supports_spdy":true},"fbcdn-photos-g-a.akamaihd.net:443":{"settings":{"4":20,"7":65536},"supports_spdy":true},"fbcdn-photos-h-a.akamaihd.net:443":{"settings":{"4":20,"7":65536},"supports_spdy":true},"fbcdn-profile-a.akamaihd.net:443":{"settings":{"4":20,"7":65536},"supports_spdy":true},"fbstatic-a.akamaihd.net:443":{"settings":{"4":20,"7":65536},"supports_spdy":true},"fls.doubleclick.net:443":{"settings":{"4":100,"5":10},"supports_spdy":true},"fonts.googleapis.com:443":{"alternative_service":[{"port":443,"probability":0.02,"protocol_str":"quic"}],"settings":{"4":100,"5":32,"6":0},"supports_spdy":true},"fonts.googleapis.com:80":{"alternative_service":[{"port":80,"probability":1.0,"protocol_str":"quic"}]},"fonts.gstatic.com:443":{"alternative_service":[{"port":443,"probability":1.0,"protocol_str":"quic"}],"settings":{"4":100,"5":45,"6":0},"supports_spdy":true},"fonts.gstatic.com:80":{"alternative_service":[{"port":80,"probability":1.0,"protocol_str":"quic"}]},"google.cz:80":{"alternative_service":[{"port":80,"probability":1.0,"protocol_str":"quic"}]},"googleads.g.doubleclick.net:443":{"alternative_service":[{"port":443,"probability":1.0,"protocol_str":"quic"}],"settings":{"4":100,"5":10},"supports_spdy":true},"googleads.g.doubleclick.net:80":{"alternative_service":[{"port":80,"probability":0.02,"protocol_str":"quic"}]},"graph.facebook.com:443":{"supports_spdy":true},"i.ytimg.com:443":{"alternative_service":[{"port":443,"probability":0.02,"protocol_str":"quic"}],"settings":{"4":100},"supports_spdy":true},"lh3.googleusercontent.com:443":{"alternative_service":[{"port":443,"probability":1.0,"protocol_str":"quic"}],"settings":{"4":100,"5":100,"6":0},"supports_spdy":true},"lh4.googleusercontent.com:443":{"settings":{"4":100,"5":88,"6":0},"supports_spdy":true},"lh5.googleusercontent.com:443":{"settings":{"4":100,"5":123,"6":0},"supports_spdy":true},"lh6.googleusercontent.com:443":{"settings":{"4":100,"5":46,"6":0},"supports_spdy":true},"oauth.googleusercontent.com:443":{"settings":{"4":100,"5":38,"6":0},"supports_spdy":true},"pagead2.googlesyndication.com:80":{"alternative_service":[{"port":80,"probability":1.0,"protocol_str":"quic"}]},"partner.googleadservices.com:80":{"alternative_service":[{"port":80,"probability":1.0,"protocol_str":"quic"}]},"pixel.facebook.com:443":{"supports_spdy":true},"plus.google.com:443":{"alternative_service":[{"port":443,"probability":1.0,"protocol_str":"quic"}],"settings":{"4":100,"5":100,"6":0},"supports_spdy":true},"plusone.google.com:443":{"settings":{"4":100},"supports_spdy":true},"privilegesbox.net:443":{"supports_spdy":true},"pubads.g.doubleclick.net:80":{"alternative_service":[{"port":80,"probability":1.0,"protocol_str":"quic"}]},"r2---sn-2vq5-vnge.c.pack.google.com:80":{"alternative_service":[{"port":80,"probability":1.0,"protocol_str":"quic"}]},"s.ytimg.com:443":{"alternative_service":[{"port":443,"probability":0.02,"protocol_str":"quic"}],"settings":{"4":100},"supports_spdy":true},"s0.2mdn.net:80":{"alternative_service":[{"port":80,"probability":1.0,"protocol_str":"quic"}]},"s1.2mdn.net:80":{"alternative_service":[{"port":80,"probability":1.0,"protocol_str":"quic"}]},"scontent-a-vie.xx.fbcdn.net:443":{"supports_spdy":true},"scontent-b-vie.xx.fbcdn.net:443":{"supports_spdy":true},"securepubads.g.doubleclick.net:443":{"alternative_service":[{"port":443,"probability":1.0,"protocol_str":"quic"}],"settings":{"4":100,"5":34,"6":0},"supports_spdy":true},"ssl.google-analytics.com:443":{"alternative_service":[{"port":443,"probability":0.02,"protocol_str":"quic"}],"settings":{"4":100,"5":14,"6":0},"supports_spdy":true},"ssl.gstatic.com:443":{"alternative_service":[{"port":443,"probability":1.0,"protocol_str":"quic"}],"settings":{"4":100,"5":14,"6":0},"supports_spdy":true},"stats.g.doubleclick.net:443":{"alternative_service":[{"port":443,"probability":1.0,"protocol_str":"quic"}],"settings":{"4":100,"5":32,"6":0},"supports_spdy":true},"stats.g.doubleclick.net:80":{"alternative_service":[{"port":80,"probability":0.02,"protocol_str":"quic"}]},"themes.googleusercontent.com:443":{"settings":{"4":100,"5":59,"6":0},"supports_spdy":true},"tpc.googlesyndication.com:443":{"alternative_service":[{"port":443,"probability":1.0,"protocol_str":"quic"}],"settings":{"4":100,"5":103,"6":0},"supports_spdy":true},"tpc.googlesyndication.com:80":{"alternative_service":[{"port":80,"probability":1.0,"protocol_str":"quic"}]},"twitter.com:443":{"supports_spdy":true},"upload.docs.google.com:443":{"alternative_service":[{"port":443,"probability":1.0,"protocol_str":"quic"}],"settings":{"4":100,"5":6,"6":0},"supports_spdy":true},"www.facebook.com:443":{"supports_spdy":true},"www.google-analytics.com:443":{"alternative_service":[{"port":443,"probability":1.0,"protocol_str":"quic"}],"settings":{"4":100,"5":32,"6":0},"supports_spdy":true},"www.google-analytics.com:80":{"alternative_service":[{"port":80,"probability":0.0,"protocol_str":"quic"}]},"www.google.com:443":{"alternative_service":[{"port":443,"probability":1.0,"protocol_str":"quic"}],"settings":{"4":100,"5":100,"6":0},"supports_spdy":true},"www.google.com:80":{"alternative_service":[{"port":80,"probability":0.02,"protocol_str":"quic"}]},"www.google.cz:443":{"alternative_service":[{"port":443,"probability":1.0,"protocol_str":"quic"}],"settings":{"4":100,"5":47,"6":0},"supports_spdy":true},"www.google.cz:80":{"alternative_service":[{"port":80,"probability":1.0,"protocol_str":"quic"}]},"www.googleadservices.com:443":{"settings":{"4":100,"5":10},"supports_spdy":true},"www.googleadservices.com:80":{"alternative_service":[{"port":80,"probability":0.02,"protocol_str":"quic"}]},"www.googleapis.com:443":{"settings":{"4":100,"5":32,"6":0},"supports_spdy":true},"www.googletagmanager.com:443":{"alternative_service":[{"port":443,"probability":1.0,"protocol_str":"quic"}],"settings":{"4":100,"5":32,"6":0},"supports_spdy":true},"www.googletagmanager.com:80":{"alternative_service":[{"port":80,"probability":1.0,"protocol_str":"quic"}]},"www.googletagservices.com:80":{"alternative_service":[{"port":80,"probability":1.0,"protocol_str":"quic"}]},"www.gstatic.com:443":{"alternative_service":[{"port":443,"probability":1.0,"protocol_str":"quic"}],"settings":{"4":100,"5":80,"6":0},"supports_spdy":true},"www.gstatic.com:80":{"alternative_service":[{"port":80,"probability":1.0,"protocol_str":"quic"}]},"www.youtube.com:443":{"alternative_service":[{"port":443,"probability":0.02,"protocol_str":"quic"}],"settings":{"4":100},"supports_spdy":true},"www.youtube.com:80":{"alternative_service":[{"port":80,"probability":0.02,"protocol_str":"quic"}]}},"version":3}},"ntp":{"app_page_names":["Aplikace"],"pref_version":3,"promo_closed":false,"promo_end":1342994400.0,"promo_group":0,"promo_group_max":1,"promo_group_timeslice":0,"promo_increment":1,"promo_initial_segment":1,"promo_line":"Máte chytrý telefon nebo tablet? \u003Ca href=\"hxxps://www.google.com/chrome/mobile/?utm_source=chrome&utm_medium=ntp&utm_campaign=ntp-promo\"> Pořiďte si Chrome pro mobilní zařízení\u003C/a>","promo_num_groups":1,"promo_start":1341828000.0,"promo_views":0,"promo_views_max":15},"partition":{"per_host_zoom_levels":{"2166136261":{"pelmel.info":1.223901033401489}}},"pinned_tabs":[],"plugins":{"enabled_internal_pdf3":true,"enabled_nacl":true,"last_internal_directory":"C:\\Program Files (x86)\\Google\\Chrome\\Application\\43.0.2357.81","migrated_to_pepper_flash":true,"plugins_list":[{"enabled":true,"name":"Remoting Viewer","path":"internal-remoting-viewer","version":""},{"enabled":true,"name":"Remoting Viewer"},{"enabled":true,"name":"Native Client","path":"C:\\Program Files (x86)\\Google\\Chrome\\Application\\43.0.2357.81\\ppGoogleNaClPluginChrome.dll","version":""},{"enabled":true,"name":"Native Client"},{"enabled":true,"name":"Chrome PDF Viewer","path":"C:\\Program Files (x86)\\Google\\Chrome\\Application\\43.0.2357.81\\pdf.dll","version":""},{"enabled":true,"name":"Chrome PDF Viewer"},{"enabled":true,"name":"Shockwave Flash","path":"C:\\Program Files (x86)\\Google\\Chrome\\Application\\43.0.2357.81\\gcswf32.dll","version":"11,3,300,265"},{"enabled":true,"name":"Flash"},{"enabled":true,"name":"Google Update","path":"C:\\Program Files (x86)\\Google\\Update\\1.3.21.115\\npGoogleUpdate3.dll","version":"1.3.21.115"},{"enabled":true,"name":"Google Update"},{"enabled":true,"name":"Intel® Identity Protection Technology","path":"C:\\Program Files (x86)\\Intel\\Intel(R) Management Engine Components\\IPT\\npIntelWebAPIIPT.dll","version":"2.0.59.0"},{"enabled":true,"name":"Intel® Identity Protection Technology","path":"C:\\Program Files (x86)\\Intel\\Intel(R) Management Engine Components\\IPT\\npIntelWebAPIUpdater.dll","version":"2.0.59.0"},{"enabled":true,"name":"Intel® Identity Protection Technology"}],"removed_old_component_pepper_flash_settings":true},"printing":{"print_preview_sticky_settings":{"appState":"{\"version\":2,\"isGcpPromoDismissed\":false,\"selectedDestinationId\":\"Školník\",\"selectedDestinationOrigin\":\"local\",\"selectedDestinationAccount\":\"\",\"selectedDestinationCapabilities\":{\"printer\":{\"collate\":{\"default\":false},\"color\":{\"option\":[{\"is_default\":true,\"type\":\"STANDARD_COLOR\",\"vendor_id\":\"2\"}]},\"copies\":{},\"dpi\":{\"option\":[{\"horizontal_dpi\":600,\"is_default\":true,\"vertical_dpi\":600}]},\"media_size\":{\"option\":[{\"custom_display_name\":\"Letter\",\"height_microns\":279400,\"name\":\"NA_LETTER\",\"vendor_id\":\"1\",\"width_microns\":215900},{\"custom_display_name\":\"Legal\",\"height_microns\":355600,\"name\":\"NA_LEGAL\",\"vendor_id\":\"5\",\"width_microns\":215900},{\"custom_display_name\":\"Executive\",\"height_microns\":266700,\"name\":\"NA_EXECUTIVE\",\"vendor_id\":\"7\",\"width_microns\":184100},{\"custom_display_name\":\"A3\",\"height_microns\":420000,\"name\":\"ISO_A3\",\"vendor_id\":\"8\",\"width_microns\":297000},{\"custom_display_name\":\"A4\",\"height_microns\":297000,\"is_default\":true,\"name\":\"ISO_A4\",\"vendor_id\":\"9\",\"width_microns\":210000},{\"custom_display_name\":\"A5\",\"height_microns\":210000,\"name\":\"ISO_A5\",\"vendor_id\":\"11\",\"width_microns\":148000},{\"custom_display_name\":\"B4 (JIS)\",\"height_microns\":364000,\"name\":\"JIS_B4\",\"vendor_id\":\"12\",\"width_microns\":257000},{\"custom_display_name\":\"B5 (JIS)\",\"height_microns\":257000,\"name\":\"JIS_B5\",\"vendor_id\":\"13\",\"width_microns\":182000},{\"custom_display_name\":\"11x17\",\"height_microns\":431800,\"name\":\"NA_LEDGER\",\"vendor_id\":\"17\",\"width_microns\":279400},{\"custom_display_name\":\"Obálka č. 10\",\"height_microns\":241300,\"name\":\"NA_NUMBER_10\",\"vendor_id\":\"20\",\"width_microns\":104700},{\"custom_display_name\":\"Obálka DL\",\"height_microns\":220000,\"name\":\"ISO_DL\",\"vendor_id\":\"27\",\"width_microns\":110000},{\"custom_display_name\":\"Obálka C5\",\"height_microns\":229000,\"name\":\"ISO_C5\",\"vendor_id\":\"28\",\"width_microns\":162000},{\"custom_display_name\":\"Obálka B5\",\"height_microns\":250000,\"name\":\"ISO_B5\",\"vendor_id\":\"34\",\"width_microns\":176000},{\"custom_display_name\":\"Obálka Monarch\",\"height_microns\":190500,\"name\":\"NA_MONARCH\",\"vendor_id\":\"37\",\"width_microns\":98400},{\"custom_display_name\":\"Japonská pohlednice\",\"height_microns\":148000,\"name\":\"JPN_HAGAKI\",\"vendor_id\":\"43\",\"width_microns\":100000},{\"custom_display_name\":\"A6\",\"height_microns\":148000,\"name\":\"ISO_A6\",\"vendor_id\":\"70\",\"width_microns\":105000},{\"custom_display_name\":\"Japonská dv. pohlednice otočená\",\"height_microns\":200000,\"name\":\"JPN_OUFUKU\",\"vendor_id\":\"82\",\"width_microns\":148000},{\"custom_display_name\":\"B5 (ISO)\",\"height_microns\":249900,\"name\":\"ISO_B5\",\"vendor_id\":\"132\",\"width_microns\":175900},{\"custom_display_name\":\"8K\",\"height_microns\":393700,\"name\":\"ROC_8K\",\"vendor_id\":\"133\",\"width_microns\":273000},{\"custom_display_name\":\"16K 7.75x10.75 in\",\"height_microns\":273000,\"name\":\"ROC_16K\",\"vendor_id\":\"134\",\"width_microns\":196800},{\"custom_display_name\":\"16K 195x270 mm\",\"height_microns\":270000,\"vendor_id\":\"135\",\"width_microns\":195000},{\"custom_display_name\":\"16K 184x260 mm\",\"height_microns\":259900,\"vendor_id\":\"136\",\"width_microns\":184000},{\"custom_display_name\":\"8,5 x 13 (vlastní)\",\"height_microns\":330200,\"name\":\"JIS_EXEC\",\"vendor_id\":\"137\",\"width_microns\":215900}]},\"page_orientation\":{\"option\":[{\"is_default\":true,\"type\":\"PORTRAIT\"},{\"type\":\"LANDSCAPE\"},{\"type\":\"AUTO\"}]},\"supported_content_type\":[{\"content_type\":\"application/pdf\"}]},\"version\":\"1.0\"},\"selectedDestinationName\":\"Školník\",\"mediaSize\":{\"custom_display_name\":\"A4\",\"height_microns\":297000,\"is_default\":true,\"name\":\"ISO_A4\",\"vendor_id\":\"9\",\"width_microns\":210000}}"}},"profile":{"avatar_bubble_tutorial_shown":1,"avatar_index":0,"content_settings":{"clear_on_exit_migrated":true,"exceptions":{"app_banner":{},"auto_select_certificate":{},"automatic_downloads":{},"cookies":{},"fullscreen":{},"geolocation":{},"images":{},"javascript":{},"media_stream":{},"media_stream_camera":{},"media_stream_mic":{},"metro_switch_to_desktop":{},"midi_sysex":{},"mixed_script":{},"mouselock":{},"notifications":{},"plugins":{},"popups":{},"ppapi_broker":{},"protocol_handlers":{},"push_messaging":{},"ssl_cert_decisions":{}},"pattern_pairs":{},"pref_version":1},"exit_type":"Normal","exited_cleanly":true,"icon_version":3,"managed_user_id":"","migrated_content_settings_exceptions":true,"migrated_default_content_settings":true,"migrated_default_media_stream_content_settings":true,"name":"První uživatel","password_manager_groups_for_domains":[null,null,null,null,null,null,7],"per_host_zoom_levels":{}},"protection":{"macs":{"browser":{"show_home_button":"3D70C22F1939338B96D11D1345E9A8BB9FF5DD207F011F14436E1C7DE12C3034"},"default_search_provider":{"keyword":"B06B11EA44C8C6A17AF99DD70F1E4A508293CB122303E3EBEFA38263982E510A","name":"600C0407C74FC1EBC65577BD767AAE7CEC880D50312DCFAE1DACC98E02E256BE","search_url":"7CAC40CCF46555CFA08EEE191ADD3B1B5FE1BB01CE2A6442BD50E363CEF0754F"},"default_search_provider_data":{"template_url_data":"E347C2CDC769C6DDF7BBCA0378AA3A365204741A75AFD7B282BA1DDB52F0A7C7"},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":"2265B304078578F418E1B88441342B2F273FAE63967265CDC3676645A6D4809F","apdfllckaahabafndbhieahigkjlhalf":"437C06BFA534A0CBF1558E0352ECD7DD081A10D0DFF2748BC01F48175A5D820E","bepbmhgboaologfdajaanbcjmnhjmhfn":"BABD7C6C799B03C931196B9FEC2EB7ACA1240B2654C5633859505480D54BF112","dklimiggiafdoghgnphmpbeknieifjdm":"846D7C1D4DB021973178C906EF78C3DFF691AC3B63A740C3E94531DBF481811A","eemcgdkfndhakfknompkggombfjjjeno":"0325855B0D25F37789835E3A9A84DF0D0E1435B2EE8C8EB1E5C8B564310D607E","ennkphjdgehloodpbhlhldgbnhmacadg":"210B92A0122A0EA97F2EC8CDB917E01BAF5449BF86D5DEFB9F1D5EE268847F6B","gfdkimpbcpahaombhbimeihdjnejgicl":"A3E3BE996108F1D650A7A693EF6BC23351EDFABC0B0B3B4CFF9623AE6F6E6F22","gpjepemmidhpcafaildmapolgeemknfm":"2D10779763CB7C3C193E7973A8EBAAAC2E7D4E94154E3A15E32E2BDA931AB26E","icmlaeflemplmjndnaapfdbbnpncnbda":"71CB84C4FDA2F92FDE5640F47D47C04E65C7359A5BB88166F7BF8E61774C6A7C","kmendfapggjehodndflmmgagdbamhnfd":"3F6088669AD119B308A3B877DDEBB5FB23E65E9C6E8490152EB5904EF08797AB","lmjegmlicamnimmfhcmpkclmigmmcbeh":"7D4F28B9B4B4078FF5163B8664CC4B920F37D1B5AEB70B88078C3F75B63542A9","mfehgcgbbipciphmccgaenjidiccnmng":"E6326948ADACDBEE29F7D699CE5E7DFF7B32474FE6B5DC02DDAD0BA918B8032B","mfffpogegjflfpflabcdkioaeobkgjik":"463A48BF18CA828764953A75459973E95430E150001FEDB0A2D092962B593552","mgndgikekgjfcpckkfioiadnlibdjbkf":"A65951517BD9AB3C4AD7F61A69748B87DAF44B151246DDEA443F477AB1791CAA","mhjfbmdgcfjbbpaeojofohoefgiehjai":"DE3EC5102264CCF0C39DC4BE828220A866F0BF78D9BE4C46C374719AF5D4D149","neajdppkdcdipfabeoofebfddakdcjhd":"4E77E6102ED160192D43B7F732DB5E1A68010814C1DB752E499BEE3176761B50","nkeimhogjdpnpccoofpliimaahmaaome":"AA85F04016EDAC0889F08507759CBDA39332DE3E55C145D9332378AF4CFAE7EC","nmmhkkegccagdldgiimedpiccmgmieda":"D0C7C909C5A507F245D45677280B837FFFC2022DEC8238BD2E19B4CAD3F7756F","pafkbggdmjlpgkdkcbjmhmfcdpncadgh":"B727C7BDCC690258824BB3BBFA80D189AA1C4758E2E0AF2487A17D03429791C4"}},"google":{"services":{"last_username":"CB1E1151FD41EF0AEDEBC840C4ED261A8B35A5C4E210E08487A9CD73B198952A","username":"BC92F0C7FF75C3C8039D9FBADE0CD7B78D7DF91A84C9F28F690443D89A0F0BE3"}},"homepage":"FFB79255E8D9BE144EF0794F2B59A99C7305DFD308DE105B3655CC161C7570D5","homepage_is_newtabpage":"AD8CB53A3EC0B55214209B29C034749A5590F0904E067F9D5AD482D076121406","pinned_tabs":"5987E254EE8A50B854AA02A7B97E6B64A3D20E5F2BEA3DC4F6E03127683E0509","prefs":{"preference_reset_time":"2D03E6E0B1159342CCD3AEDE9B2731AEEB3E78C2E6B277BB78386EA9D0056F05"},"profile":{"reset_prompt_memento":"0798A8343A85818E117780B431BA4E60425A9F8AC9C2A8AAD6ABBFDBD98EBC9F"},"safebrowsing":{"incidents_sent":"23CFF71A9731612304BA3FB7781D537AFC1196BFF11ECEEC174ECC9B78DB2AF8"},"search_provider_overrides":"BFCA5062D096DECDA90695D3956EDC3AE0B10D1EDF47D3458A8FAAFEF4DB250D","session":{"restore_on_startup":"16779F8FE73F516AF5D362CC0FC546374C85B2B7E0C4DC18DAB7D9461D340BCE","startup_urls":"400FA1E10C2AD519D88E40BCCC31133595A4DDD791096E78996F6E2622C003B3"},"software_reporter":{"prompt_reason":"5CC8A633CC643012434EAD6956831CA2B6B0BFD2CF6E25BE6F9778A659CA901B","prompt_seed":"9DB319880E8717D958F829804792A83337D9B4C3AC78F3B0B83384E3AF2FA436","prompt_version":"B6B6FE03C31F915EE8B9A537C1D65853D9C51A7E4076D6E6C2E8CDE865E30921"},"sync":{"remaining_rollback_tries":"AA32BBEBBB7A679FD91722CDBE6FC6461FC2FD3CF58E99912145FED5DE31AD04"}}},"safebrowsing":{"incidents_sent":{"1":{"browser.show_home_button":"1477813002","extensions.settings":"1041862339","google.services.username":"3705243781","homepage":"719371104","session.startup_urls":"245095670"},"2":{"chrome.dll":"3774509266","chrome_child.dll":"3743713718"}}},"session":{"restore_on_startup":4,"restore_on_startup_migrated":true,"startup_urls":["hxxp://www.mystartsearch.com/?type=hp&ts=1419846897&from=wpc&uid=ST3500631NS_9QGAD55ZXXXX9QGAD55Z
[C:\Users\skolnik\AppData\Local\Google\Chrome\User Data\Default\Preferences] - Nalezeno [Startup_URLs] : 400FA1E10C2AD519D88E40BCCC31133595A4DDD791096E78996F6E2622C003B3"},"software_reporter":{"prompt_reason":"5CC8A633CC643012434EAD6956831CA2B6B0BFD2CF6E25BE6F9778A659CA901B","prompt_seed":"9DB319880E8717D958F829804792A83337D9B4C3AC78F3B0B83384E3AF2FA436","prompt_version":"B6B6FE03C31F915EE8B9A537C1D65853D9C51A7E4076D6E6C2E8CDE865E30921"},"sync":{"remaining_rollback_tries":"AA32BBEBBB7A679FD91722CDBE6FC6461FC2FD3CF58E99912145FED5DE31AD04"}}},"safebrowsing":{"incidents_sent":{"1":{"browser.show_home_button":"1477813002","extensions.settings":"1041862339","google.services.username":"3705243781","homepage":"719371104","session.startup_urls":"245095670"},"2":{"chrome.dll":"3774509266","chrome_child.dll":"3743713718"}}},"session":{"restore_on_startup":4,"restore_on_startup_migrated":true,"startup_urls":["hxxp://www.mystartsearch.com/?type=hp&ts=1419846897&from=wpc&uid=ST3500631NS_9QGAD55ZXXXX9QGAD55Z
*************************
AdwCleaner[R0].txt - [56064 bytů] - [05/01/2015 13:31:40]
AdwCleaner[R1].txt - [8873 bytů] - [03/06/2015 08:11:54]
AdwCleaner[R2].txt - [12825 bytů] - [03/06/2015 08:20:36]
AdwCleaner[R3].txt - [25460 bytů] - [04/06/2015 11:12:00]
AdwCleaner[S0].txt - [58311 bytů] - [05/01/2015 13:33:52]
AdwCleaner[S1].txt - [12150 bytů] - [03/06/2015 08:29:09]
########## EOF - C:\AdwCleaner\AdwCleaner[R3].txt - [25637 bytů] ##########
Malwarebytes Anti-Malware
www.malwarebytes.org
Datum skenování: 4.6.2015
Čas skenování: 11:45:44
Protokol:
Správce: Ano
Verze: 2.01.6.1022
Databáze malwaru: v2015.06.04.03
Databáze rootkitů: v2015.06.02.01
Licence: Zkušební verze
Ochrana proti malwaru: Zapnuto
Ochrana proti škodlivým webovým stránkám: Zapnuto
Ochrana programu: Vypnuto
OS: Windows 7 Service Pack 1
CPU: x64
Souborový systém: NTFS
Uživatel: skolnik
Typ skenu: Sken hrozeb
Výsledek: Dokončeno
Prohledaných objektů: 490326
Uplynulý čas: 21 min, 19 sek
Paměť: Zapnuto
Po spuštění: Zapnuto
Souborový systém: Zapnuto
Archivy: Zapnuto
Rootkity: Vypnuto
Heuristika: Zapnuto
PUP: Zapnuto
PUM: Zapnuto
Procesy: 0
(Nenalezeny žádné škodlivé položky)
Moduly: 0
(Nenalezeny žádné škodlivé položky)
Klíče registru: 0
(Nenalezeny žádné škodlivé položky)
Hodnoty registru: 0
(Nenalezeny žádné škodlivé položky)
Data registru: 0
(Nenalezeny žádné škodlivé položky)
Složky: 0
(Nenalezeny žádné škodlivé položky)
Soubory: 2
PUP.Optional.MyStartSearch.A, C:\Users\skolnik\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_www.mystartsearch.com_0.localstorage, , [bdf63d796723de58e4d83fb741c29d63],
PUP.Optional.MyStartSearch.A, C:\Users\skolnik\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_www.mystartsearch.com_0.localstorage-journal, , [9d16a90d830735019824bf3744bf5aa6],
Fyzické sektory: 0
(Nenalezeny žádné škodlivé položky)
(end)
-
jerabina
- člen Security týmu
-
Level 6
- Příspěvky: 3647
- Registrován: březen 13
- Bydliště: Litoměřice
- Pohlaví:
- Stav:
Offline
Re: Prosím o kontrolu logu
Spusť znovu AdwCleaner (u Windows Vista či Windows7, klikni na AdwCleaner pravým a vyber „Spustit jako správce“
klikni na „Prohledat-Scan“, po prohledání klikni na „ Vymazat-Clean“
Program provede opravu, po automatickém restartu neukáže log (C:\AdwCleaner [S?].txt) , jeho obsah sem celý vlož.
Spusť znovu MbAM a dej Skenovat nyní
- po proběhnutí programu se ti objeví hláška tak klikni na „Vše do karantény(smazat vybrané)“ a na „Exportovat záznam“ a vyber „textový soubor“ , soubor nějak pojmenuj a někam ho ulož. Zkopíruj se celý obsah toho logu.
Stáhni si Junkware Removal Tool by Thisisu
na svojí plochu.
Deaktivuj si svůj antivirový program. Pravým tl. myši klikni na JRT.exe a vyber „spustit jako správce“. Pro pokračování budeš vyzván ke stisknutí jakékoliv klávesy. Na nějakou klikni.
Začne skenování programu. Skenování může trvat dloho , podle množství nákaz. Po ukončení skenu se objeví log (JRT.txt) , který se uloží na ploše.
Zkopíruj sem prosím celý jeho obsah.
Stáhni si RogueKiller
32bit.:
http://www.sur-la-toile.com/RogueKiller/RogueKiller.exe
64bit.:
http://www.sur-la-toile.com/RogueKiller ... lerX64.exe
na svojí plochu.
- Zavři všechny ostatní programy a prohlížeče.
- Pro OS Vista a win7 spusť program RogueKiller.exe jako správce , u XP poklepáním.
- počkej až skončí Prescan -vyhledávání škodlivých procesů.
-Potom klikni na „Prohledat“.
- Program skenuje procesy PC. Po proskenování klikni na „Zpráva“celý obsah logu sem zkopíruj.
Pokud je program blokován , zkus ho spustit několikrát. Pokud dále program nepůjde spustit a pracovat, přejmenuj ho na winlogon.exe.
klikni na „Prohledat-Scan“, po prohledání klikni na „ Vymazat-Clean“
Program provede opravu, po automatickém restartu neukáže log (C:\AdwCleaner [S?].txt) , jeho obsah sem celý vlož.
Spusť znovu MbAM a dej Skenovat nyní
- po proběhnutí programu se ti objeví hláška tak klikni na „Vše do karantény(smazat vybrané)“ a na „Exportovat záznam“ a vyber „textový soubor“ , soubor nějak pojmenuj a někam ho ulož. Zkopíruj se celý obsah toho logu.
Stáhni si Junkware Removal Tool by Thisisu
na svojí plochu.
Deaktivuj si svůj antivirový program. Pravým tl. myši klikni na JRT.exe a vyber „spustit jako správce“. Pro pokračování budeš vyzván ke stisknutí jakékoliv klávesy. Na nějakou klikni.
Začne skenování programu. Skenování může trvat dloho , podle množství nákaz. Po ukončení skenu se objeví log (JRT.txt) , který se uloží na ploše.
Zkopíruj sem prosím celý jeho obsah.
Stáhni si RogueKiller
32bit.:
http://www.sur-la-toile.com/RogueKiller/RogueKiller.exe
64bit.:
http://www.sur-la-toile.com/RogueKiller ... lerX64.exe
na svojí plochu.
- Zavři všechny ostatní programy a prohlížeče.
- Pro OS Vista a win7 spusť program RogueKiller.exe jako správce , u XP poklepáním.
- počkej až skončí Prescan -vyhledávání škodlivých procesů.
-Potom klikni na „Prohledat“.
- Program skenuje procesy PC. Po proskenování klikni na „Zpráva“celý obsah logu sem zkopíruj.
Pokud je program blokován , zkus ho spustit několikrát. Pokud dále program nepůjde spustit a pracovat, přejmenuj ho na winlogon.exe.
Když nevíš jak dál, přichází na řadu prostudovat manuál!
HJT návod
Pokud neodpovídám do vašich témat v sekci HJT když jsem online, tak je to jen proto, že jsem na mobilu kde je studování logů a psaní skriptů nemožné. Neberte to tedy prosím jako ignoraci.
HJT návod
Pokud neodpovídám do vašich témat v sekci HJT když jsem online, tak je to jen proto, že jsem na mobilu kde je studování logů a psaní skriptů nemožné. Neberte to tedy prosím jako ignoraci.
Re: Prosím o kontrolu logu
MBAM nic nenašel - nebylo co dát do karantény.
Log z MBAM
Malwarebytes Anti-Malware
www.malwarebytes.org
Datum skenování: 4.6.2015
Čas skenování: 14:18:56
Protokol:
Správce: Ano
Verze: 2.01.6.1022
Databáze malwaru: v2015.06.04.03
Databáze rootkitů: v2015.06.02.01
Licence: Zkušební verze
Ochrana proti malwaru: Zapnuto
Ochrana proti škodlivým webovým stránkám: Zapnuto
Ochrana programu: Vypnuto
OS: Windows 7 Service Pack 1
CPU: x64
Souborový systém: NTFS
Uživatel: skolnik
Typ skenu: Sken hrozeb
Výsledek: Dokončeno
Prohledaných objektů: 490538
Uplynulý čas: 22 min, 15 sek
Paměť: Zapnuto
Po spuštění: Zapnuto
Souborový systém: Zapnuto
Archivy: Zapnuto
Rootkity: Vypnuto
Heuristika: Zapnuto
PUP: Zapnuto
PUM: Zapnuto
Procesy: 0
(Nenalezeny žádné škodlivé položky)
Moduly: 0
(Nenalezeny žádné škodlivé položky)
Klíče registru: 0
(Nenalezeny žádné škodlivé položky)
Hodnoty registru: 0
(Nenalezeny žádné škodlivé položky)
Data registru: 0
(Nenalezeny žádné škodlivé položky)
Složky: 0
(Nenalezeny žádné škodlivé položky)
Soubory: 0
(Nenalezeny žádné škodlivé položky)
Fyzické sektory: 0
(Nenalezeny žádné škodlivé položky)
(end)
.................................................................................................................................................................
Log z AdwCleaner
# AdwCleaner v4.206 - Log vytvořen 04/06/2015 v 14:07:27
# Aktualizováno 01/06/2015 by Xplode
# Databáze : 2015-06-01.1 [Server]
# Operační system : Windows 7 Professional Service Pack 1 (x64)
# Uživatelské jméno : skolnik - SKOLNIK-PC
# Spuštěno z : D:\Downloads\adwcleaner_4.206.exe
# Nastavení : Čištění
***** [ Služby ] *****
***** [ Soubory / Složky ] *****
Soubor Smazáno : C:\Users\skolnik\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_www.mystartsearch.com_0.localstorage
Soubor Smazáno : C:\Users\skolnik\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_www.mystartsearch.com_0.localstorage-journal
***** [ Naplánované úlohy ] *****
***** [ Zástupci ] *****
***** [ Registry ] *****
Data Smazáno : HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings [ProxyServer] - localhost:8080
***** [ Prohlížeče ] *****
-\\ Internet Explorer v11.0.9600.17801
-\\ Mozilla Firefox v38.0.5 (x86 cs)
[75dgyfue.default\prefs.js] - Řádek Smazáno : user_pref("extensions.a6a1a03975fde4c8690f6b883c36bc17d88519bfe704d8cae3851239com74253.74253.internaldb.__ICM_LITE__blacklist_domain.value", "%7B%22SLIDERS%22%3A%5B%226pm.com%22%2C%22amazon.co.uk%22%2[...]
[75dgyfue.default\prefs.js] - Řádek Smazáno : user_pref("extensions.a6a1a03975fde4c8690f6b883c36bc17d88519bfe704d8cae3851239com74253.74253.internaldb.monetization_plugin_bundledUrls.value", "%7B%22dealply_s%22%3A%7B%22urls%22%3A%5B%22ssfiles.com%[...]
[75dgyfue.default\prefs.js] - Řádek Smazáno : user_pref("extensions.snipit.searchAssistEnabled", true);
-\\ Google Chrome v43.0.2357.81
[C:\Users\skolnik\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Smazáno [Search Provider] : hxxp://www.mystartsearch.com/web/?type= ... QGAD55Z&q={searchTerms}
[C:\Users\skolnik\AppData\Local\Google\Chrome\User Data\Default\Preferences] - Smazáno [Homepage] :
[C:\Users\skolnik\AppData\Local\Google\Chrome\User Data\Default\Preferences] - Smazáno [Startup_URLs] : 400FA1E10C2AD519D88E40BCCC31133595A4DDD791096E78996F6E2622C003B3"},"software_reporter":{"prompt_reason":"5CC8A633CC643012434EAD6956831CA2B6B0BFD2CF6E25BE6F9778A659CA901B","prompt_seed":"9DB319880E8717D958F829804792A83337D9B4C3AC78F3B0B83384E3AF2FA436","prompt_version":"B6B6FE03C31F915EE8B9A537C1D65853D9C51A7E4076D6E6C2E8CDE865E30921"},"sync":{"remaining_rollback_tries":"AA32BBEBBB7A679FD91722CDBE6FC6461FC2FD3CF58E99912145FED5DE31AD04"}}},"safebrowsing":{"incidents_sent":{"1":{"browser.show_home_button":"1477813002","extensions.settings":"1041862339","google.services.username":"3705243781","homepage":"719371104","session.startup_urls":"245095670"},"2":{"chrome.dll":"3774509266","chrome_child.dll":"3743713718"}}},"session":{"restore_on_startup":4,"restore_on_startup_migrated":true,"startup_urls":["hxxp://www.mystartsearch.com/?type=hp&ts=1419846897&from=wpc&uid=ST3500631NS_9QGAD55ZXXXX9QGAD55Z
*************************
AdwCleaner[R0].txt - [56064 bytů] - [05/01/2015 13:31:40]
AdwCleaner[R1].txt - [8873 bytů] - [03/06/2015 08:11:54]
AdwCleaner[R2].txt - [12825 bytů] - [03/06/2015 08:20:36]
AdwCleaner[R3].txt - [25716 bytů] - [04/06/2015 11:12:00]
AdwCleaner[R4].txt - [25769 bytů] - [04/06/2015 14:05:09]
AdwCleaner[S0].txt - [58311 bytů] - [05/01/2015 13:33:52]
AdwCleaner[S1].txt - [12150 bytů] - [03/06/2015 08:29:09]
AdwCleaner[S2].txt - [3416 bytů] - [04/06/2015 14:07:27]
########## EOF - C:\AdwCleaner\AdwCleaner[S2].txt - [3474 bytů] ##########
Teď spustím, dle rady, Junkware Removal Tool a RogueKiller. Potom dám vědět. Zatím moc děkuji.
Log z MBAM
Malwarebytes Anti-Malware
www.malwarebytes.org
Datum skenování: 4.6.2015
Čas skenování: 14:18:56
Protokol:
Správce: Ano
Verze: 2.01.6.1022
Databáze malwaru: v2015.06.04.03
Databáze rootkitů: v2015.06.02.01
Licence: Zkušební verze
Ochrana proti malwaru: Zapnuto
Ochrana proti škodlivým webovým stránkám: Zapnuto
Ochrana programu: Vypnuto
OS: Windows 7 Service Pack 1
CPU: x64
Souborový systém: NTFS
Uživatel: skolnik
Typ skenu: Sken hrozeb
Výsledek: Dokončeno
Prohledaných objektů: 490538
Uplynulý čas: 22 min, 15 sek
Paměť: Zapnuto
Po spuštění: Zapnuto
Souborový systém: Zapnuto
Archivy: Zapnuto
Rootkity: Vypnuto
Heuristika: Zapnuto
PUP: Zapnuto
PUM: Zapnuto
Procesy: 0
(Nenalezeny žádné škodlivé položky)
Moduly: 0
(Nenalezeny žádné škodlivé položky)
Klíče registru: 0
(Nenalezeny žádné škodlivé položky)
Hodnoty registru: 0
(Nenalezeny žádné škodlivé položky)
Data registru: 0
(Nenalezeny žádné škodlivé položky)
Složky: 0
(Nenalezeny žádné škodlivé položky)
Soubory: 0
(Nenalezeny žádné škodlivé položky)
Fyzické sektory: 0
(Nenalezeny žádné škodlivé položky)
(end)
.................................................................................................................................................................
Log z AdwCleaner
# AdwCleaner v4.206 - Log vytvořen 04/06/2015 v 14:07:27
# Aktualizováno 01/06/2015 by Xplode
# Databáze : 2015-06-01.1 [Server]
# Operační system : Windows 7 Professional Service Pack 1 (x64)
# Uživatelské jméno : skolnik - SKOLNIK-PC
# Spuštěno z : D:\Downloads\adwcleaner_4.206.exe
# Nastavení : Čištění
***** [ Služby ] *****
***** [ Soubory / Složky ] *****
Soubor Smazáno : C:\Users\skolnik\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_www.mystartsearch.com_0.localstorage
Soubor Smazáno : C:\Users\skolnik\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_www.mystartsearch.com_0.localstorage-journal
***** [ Naplánované úlohy ] *****
***** [ Zástupci ] *****
***** [ Registry ] *****
Data Smazáno : HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings [ProxyServer] - localhost:8080
***** [ Prohlížeče ] *****
-\\ Internet Explorer v11.0.9600.17801
-\\ Mozilla Firefox v38.0.5 (x86 cs)
[75dgyfue.default\prefs.js] - Řádek Smazáno : user_pref("extensions.a6a1a03975fde4c8690f6b883c36bc17d88519bfe704d8cae3851239com74253.74253.internaldb.__ICM_LITE__blacklist_domain.value", "%7B%22SLIDERS%22%3A%5B%226pm.com%22%2C%22amazon.co.uk%22%2[...]
[75dgyfue.default\prefs.js] - Řádek Smazáno : user_pref("extensions.a6a1a03975fde4c8690f6b883c36bc17d88519bfe704d8cae3851239com74253.74253.internaldb.monetization_plugin_bundledUrls.value", "%7B%22dealply_s%22%3A%7B%22urls%22%3A%5B%22ssfiles.com%[...]
[75dgyfue.default\prefs.js] - Řádek Smazáno : user_pref("extensions.snipit.searchAssistEnabled", true);
-\\ Google Chrome v43.0.2357.81
[C:\Users\skolnik\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Smazáno [Search Provider] : hxxp://www.mystartsearch.com/web/?type= ... QGAD55Z&q={searchTerms}
[C:\Users\skolnik\AppData\Local\Google\Chrome\User Data\Default\Preferences] - Smazáno [Homepage] :
[C:\Users\skolnik\AppData\Local\Google\Chrome\User Data\Default\Preferences] - Smazáno [Startup_URLs] : 400FA1E10C2AD519D88E40BCCC31133595A4DDD791096E78996F6E2622C003B3"},"software_reporter":{"prompt_reason":"5CC8A633CC643012434EAD6956831CA2B6B0BFD2CF6E25BE6F9778A659CA901B","prompt_seed":"9DB319880E8717D958F829804792A83337D9B4C3AC78F3B0B83384E3AF2FA436","prompt_version":"B6B6FE03C31F915EE8B9A537C1D65853D9C51A7E4076D6E6C2E8CDE865E30921"},"sync":{"remaining_rollback_tries":"AA32BBEBBB7A679FD91722CDBE6FC6461FC2FD3CF58E99912145FED5DE31AD04"}}},"safebrowsing":{"incidents_sent":{"1":{"browser.show_home_button":"1477813002","extensions.settings":"1041862339","google.services.username":"3705243781","homepage":"719371104","session.startup_urls":"245095670"},"2":{"chrome.dll":"3774509266","chrome_child.dll":"3743713718"}}},"session":{"restore_on_startup":4,"restore_on_startup_migrated":true,"startup_urls":["hxxp://www.mystartsearch.com/?type=hp&ts=1419846897&from=wpc&uid=ST3500631NS_9QGAD55ZXXXX9QGAD55Z
*************************
AdwCleaner[R0].txt - [56064 bytů] - [05/01/2015 13:31:40]
AdwCleaner[R1].txt - [8873 bytů] - [03/06/2015 08:11:54]
AdwCleaner[R2].txt - [12825 bytů] - [03/06/2015 08:20:36]
AdwCleaner[R3].txt - [25716 bytů] - [04/06/2015 11:12:00]
AdwCleaner[R4].txt - [25769 bytů] - [04/06/2015 14:05:09]
AdwCleaner[S0].txt - [58311 bytů] - [05/01/2015 13:33:52]
AdwCleaner[S1].txt - [12150 bytů] - [03/06/2015 08:29:09]
AdwCleaner[S2].txt - [3416 bytů] - [04/06/2015 14:07:27]
########## EOF - C:\AdwCleaner\AdwCleaner[S2].txt - [3474 bytů] ##########
Teď spustím, dle rady, Junkware Removal Tool a RogueKiller. Potom dám vědět. Zatím moc děkuji.
-
Orcus
- člen Security týmu
-
Elite Level 10.5
- Příspěvky: 10645
- Registrován: duben 10
- Bydliště: Okolo rostou 3 růže =o)
- Pohlaví:
- Stav:
Offline
Re: Prosím o kontrolu logu
OK.
Láska hřeje, ale uhlí je uhlí. 
Log z HJT vkládejte do HJT sekce. Je-li moc dlouhý, rozděl jej do více zpráv.
Pár rad k bezpečnosti PC.
Po dobu mé nepřítomnosti mě zastupuje memphisto, jaro3 a Diallix
Pokud budete spokojeni , můžete podpořit naše fórum.
Log z HJT vkládejte do HJT sekce. Je-li moc dlouhý, rozděl jej do více zpráv.
Pár rad k bezpečnosti PC.
Po dobu mé nepřítomnosti mě zastupuje memphisto, jaro3 a Diallix
Pokud budete spokojeni , můžete podpořit naše fórum.
Re: Prosím o kontrolu logu
Log z JRT a jdu na RogueKiller
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.8.8 (06.03.2015:1)
OS: Windows 7 Professional x64
Ran by skolnik on źt 04.06.2015 at 14:57:59,65
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~ Services
~~~ Tasks
Successfully deleted: [Task] C:\Windows\system32\tasks\SpyHunter4Startup
~~~ Registry Values
~~~ Registry Keys
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5AA24EA-11B8-4113-95AE-9ED71DEAF12A}
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{6ADC4BE6-31FD-4D53-A645-61A5649DDD91}
~~~ Files
Successfully deleted: [File] C:\Windows\wininit.ini
~~~ Folders
Successfully deleted: [Folder] C:\Program Files (x86)\myashampoo
Successfully deleted: [Folder] C:\Users\skolnik\appdata\locallow\myashampoo
~~~ FireFox
Successfully deleted the following from C:\Users\skolnik\AppData\Roaming\mozilla\firefox\profiles\75dgyfue.default\prefs.js
user_pref(extensions.a6a1a03975fde4c8690f6b883c36bc17d88519bfe704d8cae3851239com74253.74253.internaldb.__ICM_LITE__fifty_test_rules.value, %7B%22DE%22%3A%7B%22ALL%22%3A%5B%
user_pref(extensions.register@pgport.com.data, {ef522540-89f5-46b9-b6fe-1829e2b572c6},0,9999,999.999.999,9999,|{c50ca3c4-5656-43c2-a061-13e717f73fc8},5300,5300,4.0.1,5300,f
Emptied folder: C:\Users\skolnik\AppData\Roaming\mozilla\firefox\profiles\75dgyfue.default\minidumps [112 files]
~~~ Chrome
[C:\Users\skolnik\appdata\local\Google\Chrome\User Data\Default\Preferences] - default search provider reset
[C:\Users\skolnik\appdata\local\Google\Chrome\User Data\Default\Preferences] - Extensions Deleted:
[C:\Users\skolnik\appdata\local\Google\Chrome\User Data\Default\Secure Preferences] - default search provider reset
[C:\Users\skolnik\appdata\local\Google\Chrome\User Data\Default\Secure Preferences] - Extensions Deleted:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on źt 04.06.2015 at 15:02:07,89
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.8.8 (06.03.2015:1)
OS: Windows 7 Professional x64
Ran by skolnik on źt 04.06.2015 at 14:57:59,65
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~ Services
~~~ Tasks
Successfully deleted: [Task] C:\Windows\system32\tasks\SpyHunter4Startup
~~~ Registry Values
~~~ Registry Keys
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5AA24EA-11B8-4113-95AE-9ED71DEAF12A}
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{6ADC4BE6-31FD-4D53-A645-61A5649DDD91}
~~~ Files
Successfully deleted: [File] C:\Windows\wininit.ini
~~~ Folders
Successfully deleted: [Folder] C:\Program Files (x86)\myashampoo
Successfully deleted: [Folder] C:\Users\skolnik\appdata\locallow\myashampoo
~~~ FireFox
Successfully deleted the following from C:\Users\skolnik\AppData\Roaming\mozilla\firefox\profiles\75dgyfue.default\prefs.js
user_pref(extensions.a6a1a03975fde4c8690f6b883c36bc17d88519bfe704d8cae3851239com74253.74253.internaldb.__ICM_LITE__fifty_test_rules.value, %7B%22DE%22%3A%7B%22ALL%22%3A%5B%
user_pref(extensions.register@pgport.com.data, {ef522540-89f5-46b9-b6fe-1829e2b572c6},0,9999,999.999.999,9999,|{c50ca3c4-5656-43c2-a061-13e717f73fc8},5300,5300,4.0.1,5300,f
Emptied folder: C:\Users\skolnik\AppData\Roaming\mozilla\firefox\profiles\75dgyfue.default\minidumps [112 files]
~~~ Chrome
[C:\Users\skolnik\appdata\local\Google\Chrome\User Data\Default\Preferences] - default search provider reset
[C:\Users\skolnik\appdata\local\Google\Chrome\User Data\Default\Preferences] - Extensions Deleted:
[C:\Users\skolnik\appdata\local\Google\Chrome\User Data\Default\Secure Preferences] - default search provider reset
[C:\Users\skolnik\appdata\local\Google\Chrome\User Data\Default\Secure Preferences] - Extensions Deleted:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on źt 04.06.2015 at 15:02:07,89
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Re: Prosím o kontrolu logu
Log z RogueKiller-u
RogueKiller V10.8.1.0 (x64) [Jun 3 2015] by Adlice Software
mail : http://www.adlice.com/contact/
Feedback : http://forum.adlice.com
Webová stránka : http://www.adlice.com/softwares/roguekiller/
Blog : http://www.adlice.com
Operační systém : Windows 7 (6.1.7601 Service Pack 1) 64 bits version
Spuštěno : Normální režim
Uživatel : skolnik [Práva správce]
Started from : C:\Users\skolnik\Desktop\RogueKillerX64.exe
Mód : Prohledat -- Datum : 06/04/2015 15:18:08
¤¤¤ Procesy : 0 ¤¤¤
¤¤¤ Registry : 9 ¤¤¤
[PUP] (X64) HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\PCSUUCDRV -> Nalezeno
[PUP] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\PCSUUCDRV -> Nalezeno
[PUP] (X64) HKEY_LOCAL_MACHINE\System\ControlSet002\Services\PCSUUCDRV -> Nalezeno
[PUM.HomePage] (X64) HKEY_USERS\S-1-5-21-1776103012-2186939331-3464947669-1000\Software\Microsoft\Internet Explorer\Main | Start Page : http://www.seznam.cz/?clid=16194 -> Nalezeno
[PUM.HomePage] (X86) HKEY_USERS\S-1-5-21-1776103012-2186939331-3464947669-1000\Software\Microsoft\Internet Explorer\Main | Start Page : http://www.seznam.cz/?clid=16194 -> Nalezeno
[PUM.Policies] (X64) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System | ConsentPromptBehaviorAdmin : 0 -> Nalezeno
[PUM.Policies] (X86) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System | ConsentPromptBehaviorAdmin : 0 -> Nalezeno
[PUM.StartMenu] (X64) HKEY_USERS\S-1-5-21-1776103012-2186939331-3464947669-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced | Start_ShowMyGames : 0 -> Nalezeno
[PUM.StartMenu] (X86) HKEY_USERS\S-1-5-21-1776103012-2186939331-3464947669-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced | Start_ShowMyGames : 0 -> Nalezeno
¤¤¤ Úlohy : 2 ¤¤¤
[Suspicious.Path] gyjqO13t.job -- C:\Users\skolnik\AppData\Roaming\gyjqO13t.exe (--c=dRunsQ6JfRkSTI6XWtlmmAXZbfDxVXburYlBt++RD+MwHxrMivz8Mh24pn8Pv5SrvSgbeOjod3b5wOAjG3p5db7ZikZI7k2e7VGvcuDB+IjSZQThFAizMWScLANQM+70eAbEmWeUEcXfe8v4wWEfpNetxKOqKgdB7MYg7n0jMGZmP79ZLKQI7Gf17Gyjytf+XmmmFSynD34Jxhz6073Bbo7itwXvo83oEzONm20d8+8p1OJnp5AomfIWzAnoQXA6VaOVrDA22iu8ahZ70HF6iTaVJ3TWLvetOOzPIzbgVNxI/MDWkLOYgYnDrh+x13fiDexZKg4FIVoUPPKGFk9pWg==) -> Nalezeno
[Suspicious.Path] ToawH01BTCwCR2YbP63ybO.job -- C:\Users\skolnik\AppData\Roaming\ToawH01BTCwCR2YbP63ybO.exe (--c=PpV6jndetMN94Cuv3e0eQ5vFcT95uc9fZ6aXuhbiv2gA/GAhuDh4O8AosdURtpO9slBWQdEztEMoS/ZoOGWm1Sgz8eYMa3PVrx7pohxplQAsZgIZhfSTiOcdR3wl1WFq2aEJFchiHh+i/OSovyyApRyaUs0d9zuw5ltgNvhr5162MYQ2OxoS61+I/s17+iLn9npQHyWj1pZSFDozBnzet37qWVV6AdQrvr+P71PTyGZvWk47eSW87a0197N1oBeBg6dB280W+A2f3CiXchJQX1SSqReDqcOFe7vZ7wvIOSl6cGDKGD7H7GVdMKyDLLotD7fkVgHnLzbWGeAb1mXnEA==) -> Nalezeno
¤¤¤ Soubory : 0 ¤¤¤
¤¤¤ Soubor HOSTS : 0 ¤¤¤
¤¤¤ Antirootkit : 0 (Driver: Nahrán) ¤¤¤
¤¤¤ Webové prohlížeče : 0 ¤¤¤
¤¤¤ Kontrola MBR : ¤¤¤
+++++ PhysicalDrive0: ST3500631NS ATA Device +++++
--- User ---
[MBR] 1aa964dbfdafcb34cfab185d9a740e32
[BSP] a8ba350e4630bef020fac709b2929259 : Windows Vista/7/8|VT.Unknown MBR Code
Partition table:
0 - [ACTIVE] NTFS (0x7) [VISIBLE] Offset (sectors): 2048 | Size: 100 MB [Windows Vista/7/8 Bootstrap | Windows Vista/7/8 Bootloader]
1 - [XXXXXX] NTFS (0x7) [VISIBLE] Offset (sectors): 206848 | Size: 99900 MB [Windows Vista/7/8 Bootstrap | Windows Vista/7/8 Bootloader]
2 - [XXXXXX] NTFS (0x7) [VISIBLE] Offset (sectors): 204802048 | Size: 376938 MB [Windows Vista/7/8 Bootstrap | Windows Vista/7/8 Bootloader]
User = LL1 ... OK
User = LL2 ... OK
+++++ PhysicalDrive1: Generic- SD/MMC USB Device +++++
Error reading User MBR! ([15] Za?ízení není p?ipraveno. )
Error reading LL1 MBR! NOT VALID!
Error reading LL2 MBR! ([32] Po?adavek není podporován. )
+++++ PhysicalDrive2: Generic- Compact Flash USB Device +++++
Error reading User MBR! ([15] Za?ízení není p?ipraveno. )
Error reading LL1 MBR! NOT VALID!
Error reading LL2 MBR! ([32] Po?adavek není podporován. )
+++++ PhysicalDrive3: Generic- SM/xD-Picture USB Device +++++
Error reading User MBR! ([15] Za?ízení není p?ipraveno. )
Error reading LL1 MBR! NOT VALID!
Error reading LL2 MBR! ([32] Po?adavek není podporován. )
+++++ PhysicalDrive4: Generic- MS/MS-Pro USB Device +++++
Error reading User MBR! ([15] Za?ízení není p?ipraveno. )
Error reading LL1 MBR! NOT VALID!
Error reading LL2 MBR! ([32] Po?adavek není podporován. )
RogueKiller V10.8.1.0 (x64) [Jun 3 2015] by Adlice Software
mail : http://www.adlice.com/contact/
Feedback : http://forum.adlice.com
Webová stránka : http://www.adlice.com/softwares/roguekiller/
Blog : http://www.adlice.com
Operační systém : Windows 7 (6.1.7601 Service Pack 1) 64 bits version
Spuštěno : Normální režim
Uživatel : skolnik [Práva správce]
Started from : C:\Users\skolnik\Desktop\RogueKillerX64.exe
Mód : Prohledat -- Datum : 06/04/2015 15:18:08
¤¤¤ Procesy : 0 ¤¤¤
¤¤¤ Registry : 9 ¤¤¤
[PUP] (X64) HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\PCSUUCDRV -> Nalezeno
[PUP] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\PCSUUCDRV -> Nalezeno
[PUP] (X64) HKEY_LOCAL_MACHINE\System\ControlSet002\Services\PCSUUCDRV -> Nalezeno
[PUM.HomePage] (X64) HKEY_USERS\S-1-5-21-1776103012-2186939331-3464947669-1000\Software\Microsoft\Internet Explorer\Main | Start Page : http://www.seznam.cz/?clid=16194 -> Nalezeno
[PUM.HomePage] (X86) HKEY_USERS\S-1-5-21-1776103012-2186939331-3464947669-1000\Software\Microsoft\Internet Explorer\Main | Start Page : http://www.seznam.cz/?clid=16194 -> Nalezeno
[PUM.Policies] (X64) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System | ConsentPromptBehaviorAdmin : 0 -> Nalezeno
[PUM.Policies] (X86) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System | ConsentPromptBehaviorAdmin : 0 -> Nalezeno
[PUM.StartMenu] (X64) HKEY_USERS\S-1-5-21-1776103012-2186939331-3464947669-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced | Start_ShowMyGames : 0 -> Nalezeno
[PUM.StartMenu] (X86) HKEY_USERS\S-1-5-21-1776103012-2186939331-3464947669-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced | Start_ShowMyGames : 0 -> Nalezeno
¤¤¤ Úlohy : 2 ¤¤¤
[Suspicious.Path] gyjqO13t.job -- C:\Users\skolnik\AppData\Roaming\gyjqO13t.exe (--c=dRunsQ6JfRkSTI6XWtlmmAXZbfDxVXburYlBt++RD+MwHxrMivz8Mh24pn8Pv5SrvSgbeOjod3b5wOAjG3p5db7ZikZI7k2e7VGvcuDB+IjSZQThFAizMWScLANQM+70eAbEmWeUEcXfe8v4wWEfpNetxKOqKgdB7MYg7n0jMGZmP79ZLKQI7Gf17Gyjytf+XmmmFSynD34Jxhz6073Bbo7itwXvo83oEzONm20d8+8p1OJnp5AomfIWzAnoQXA6VaOVrDA22iu8ahZ70HF6iTaVJ3TWLvetOOzPIzbgVNxI/MDWkLOYgYnDrh+x13fiDexZKg4FIVoUPPKGFk9pWg==) -> Nalezeno
[Suspicious.Path] ToawH01BTCwCR2YbP63ybO.job -- C:\Users\skolnik\AppData\Roaming\ToawH01BTCwCR2YbP63ybO.exe (--c=PpV6jndetMN94Cuv3e0eQ5vFcT95uc9fZ6aXuhbiv2gA/GAhuDh4O8AosdURtpO9slBWQdEztEMoS/ZoOGWm1Sgz8eYMa3PVrx7pohxplQAsZgIZhfSTiOcdR3wl1WFq2aEJFchiHh+i/OSovyyApRyaUs0d9zuw5ltgNvhr5162MYQ2OxoS61+I/s17+iLn9npQHyWj1pZSFDozBnzet37qWVV6AdQrvr+P71PTyGZvWk47eSW87a0197N1oBeBg6dB280W+A2f3CiXchJQX1SSqReDqcOFe7vZ7wvIOSl6cGDKGD7H7GVdMKyDLLotD7fkVgHnLzbWGeAb1mXnEA==) -> Nalezeno
¤¤¤ Soubory : 0 ¤¤¤
¤¤¤ Soubor HOSTS : 0 ¤¤¤
¤¤¤ Antirootkit : 0 (Driver: Nahrán) ¤¤¤
¤¤¤ Webové prohlížeče : 0 ¤¤¤
¤¤¤ Kontrola MBR : ¤¤¤
+++++ PhysicalDrive0: ST3500631NS ATA Device +++++
--- User ---
[MBR] 1aa964dbfdafcb34cfab185d9a740e32
[BSP] a8ba350e4630bef020fac709b2929259 : Windows Vista/7/8|VT.Unknown MBR Code
Partition table:
0 - [ACTIVE] NTFS (0x7) [VISIBLE] Offset (sectors): 2048 | Size: 100 MB [Windows Vista/7/8 Bootstrap | Windows Vista/7/8 Bootloader]
1 - [XXXXXX] NTFS (0x7) [VISIBLE] Offset (sectors): 206848 | Size: 99900 MB [Windows Vista/7/8 Bootstrap | Windows Vista/7/8 Bootloader]
2 - [XXXXXX] NTFS (0x7) [VISIBLE] Offset (sectors): 204802048 | Size: 376938 MB [Windows Vista/7/8 Bootstrap | Windows Vista/7/8 Bootloader]
User = LL1 ... OK
User = LL2 ... OK
+++++ PhysicalDrive1: Generic- SD/MMC USB Device +++++
Error reading User MBR! ([15] Za?ízení není p?ipraveno. )
Error reading LL1 MBR! NOT VALID!
Error reading LL2 MBR! ([32] Po?adavek není podporován. )
+++++ PhysicalDrive2: Generic- Compact Flash USB Device +++++
Error reading User MBR! ([15] Za?ízení není p?ipraveno. )
Error reading LL1 MBR! NOT VALID!
Error reading LL2 MBR! ([32] Po?adavek není podporován. )
+++++ PhysicalDrive3: Generic- SM/xD-Picture USB Device +++++
Error reading User MBR! ([15] Za?ízení není p?ipraveno. )
Error reading LL1 MBR! NOT VALID!
Error reading LL2 MBR! ([32] Po?adavek není podporován. )
+++++ PhysicalDrive4: Generic- MS/MS-Pro USB Device +++++
Error reading User MBR! ([15] Za?ízení není p?ipraveno. )
Error reading LL1 MBR! NOT VALID!
Error reading LL2 MBR! ([32] Po?adavek není podporován. )
-
jerabina
- člen Security týmu
-
Level 6
- Příspěvky: 3647
- Registrován: březen 13
- Bydliště: Litoměřice
- Pohlaví:
- Stav:
Offline
Re: Prosím o kontrolu logu
Zavři všechny programy a prohlížeče. Deaktivuj antivir a firewall.
Prosím, odpoj všechny USB (kromě myši s klávesnice) nebo externí disky z počítače před spuštěním tohoto programu.
Spusť znovu RogueKiller ( Pro Windows Vista nebo Windows 7, klepni pravým a vyber "Spustit jako správce", ve Windows XP poklepej ke spuštění).
- Počkej, až Prescan dokončí práci...
- Pak klikni na "Prohledat " ,po jeho skončení:
- V záložkách (Registry , Tasks , Web Browser apod.) vše zatrhni (dej zatržítka)
(musíš dát myší zatržítko do toho čtverečku vlevo od registru ap.)
- Klikni na "Smazat"
- Počkej, dokud Status box nezobrazí " Mazání dokončeno "
- Klikni na "Zpráva " a zkopíruj a vlož obsah té zprávy prosím sem. Log je možno nalézt v RKreport [číslo]. txt na ploše.
- Zavři RogueKiller
Vypni antivir
Stáhni
Zoek.exe
a uloz si ho na plochu.
Zavři všechny ostatní programy , okna i prohlížeče.
Spusť Zoek.exe ( u win vista , win7, 8 klikni na něj pravým a vyber : „Spustit jako správce“
- pozor , náběh programu může trvat déle.
Do okna programu vlož skript níže:
klikni na Run Script
Program provede sken , opravu, sken i oprava může trvat i více minut ,je třeba posečkat do konce. Do okna neklikej!
Program nabídne restart , potvrď .
Po restartu se může nějaký čas ukázat pouze černá plocha , to je normální. Je třeba počkat až se vytvoří log. Ten si můžeš uložit třeba do dokumentů , jinak se sám ukládá do:
C:\zoek-results.log
Zkopíruj sem celý obsah toho logu.
Vlož nový log z HJT + informuj o problémech.
Prosím, odpoj všechny USB (kromě myši s klávesnice) nebo externí disky z počítače před spuštěním tohoto programu.
Spusť znovu RogueKiller ( Pro Windows Vista nebo Windows 7, klepni pravým a vyber "Spustit jako správce", ve Windows XP poklepej ke spuštění).
- Počkej, až Prescan dokončí práci...
- Pak klikni na "Prohledat " ,po jeho skončení:
- V záložkách (Registry , Tasks , Web Browser apod.) vše zatrhni (dej zatržítka)
(musíš dát myší zatržítko do toho čtverečku vlevo od registru ap.)
- Klikni na "Smazat"
- Počkej, dokud Status box nezobrazí " Mazání dokončeno "
- Klikni na "Zpráva " a zkopíruj a vlož obsah té zprávy prosím sem. Log je možno nalézt v RKreport [číslo]. txt na ploše.
- Zavři RogueKiller
Vypni antivir
Stáhni
Zoek.exe
a uloz si ho na plochu.
Zavři všechny ostatní programy , okna i prohlížeče.
Spusť Zoek.exe ( u win vista , win7, 8 klikni na něj pravým a vyber : „Spustit jako správce“
- pozor , náběh programu může trvat déle.
Do okna programu vlož skript níže:
Kód: Vybrat vše
autoclean;
emptyclsid;
iedefaults;
FFdefaults;
CHRdefaults;
emptyalltemp;
resethosts; klikni na Run Script
Program provede sken , opravu, sken i oprava může trvat i více minut ,je třeba posečkat do konce. Do okna neklikej!
Program nabídne restart , potvrď .
Po restartu se může nějaký čas ukázat pouze černá plocha , to je normální. Je třeba počkat až se vytvoří log. Ten si můžeš uložit třeba do dokumentů , jinak se sám ukládá do:
C:\zoek-results.log
Zkopíruj sem celý obsah toho logu.
Vlož nový log z HJT + informuj o problémech.
Když nevíš jak dál, přichází na řadu prostudovat manuál!
HJT návod
Pokud neodpovídám do vašich témat v sekci HJT když jsem online, tak je to jen proto, že jsem na mobilu kde je studování logů a psaní skriptů nemožné. Neberte to tedy prosím jako ignoraci.
HJT návod
Pokud neodpovídám do vašich témat v sekci HJT když jsem online, tak je to jen proto, že jsem na mobilu kde je studování logů a psaní skriptů nemožné. Neberte to tedy prosím jako ignoraci.
Re: Prosím o kontrolu logu
Zpráva z RogueKiller
RogueKiller V10.8.1.0 (x64) [Jun 3 2015] by Adlice Software
mail : http://www.adlice.com/contact/
Feedback : http://forum.adlice.com
Webová stránka : http://www.adlice.com/softwares/roguekiller/
Blog : http://www.adlice.com
Operační systém : Windows 7 (6.1.7601 Service Pack 1) 64 bits version
Spuštěno : Normální režim
Uživatel : skolnik [Práva správce]
Started from : C:\Users\skolnik\Desktop\RogueKillerX64.exe
Mód : Smazat -- Datum : 06/04/2015 15:44:34
¤¤¤ Procesy : 0 ¤¤¤
¤¤¤ Registry : 9 ¤¤¤
[PUP] (X64) HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\PCSUUCDRV -> Smazáno
[PUP] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\PCSUUCDRV -> Smazáno
[PUP] (X64) HKEY_LOCAL_MACHINE\System\ControlSet002\Services\PCSUUCDRV -> Smazáno
[PUM.HomePage] (X64) HKEY_USERS\S-1-5-21-1776103012-2186939331-3464947669-1000\Software\Microsoft\Internet Explorer\Main | Start Page : http://www.seznam.cz/?clid=16194 -> Nahrazeno (http://go.microsoft.com/fwlink/p/?LinkId=255141)
[PUM.HomePage] (X86) HKEY_USERS\S-1-5-21-1776103012-2186939331-3464947669-1000\Software\Microsoft\Internet Explorer\Main | Start Page : http://www.seznam.cz/?clid=16194 -> Nahrazeno (http://go.microsoft.com/fwlink/p/?LinkId=255141)
[PUM.Policies] (X64) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System | ConsentPromptBehaviorAdmin : 0 -> Nahrazeno (2)
[PUM.Policies] (X86) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System | ConsentPromptBehaviorAdmin : 0 -> Nahrazeno (2)
[PUM.StartMenu] (X64) HKEY_USERS\S-1-5-21-1776103012-2186939331-3464947669-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced | Start_ShowMyGames : 0 -> Nahrazeno (1)
[PUM.StartMenu] (X86) HKEY_USERS\S-1-5-21-1776103012-2186939331-3464947669-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced | Start_ShowMyGames : 0 -> Nahrazeno (1)
¤¤¤ Úlohy : 2 ¤¤¤
[Suspicious.Path] gyjqO13t.job -- C:\Users\skolnik\AppData\Roaming\gyjqO13t.exe (--c=dRunsQ6JfRkSTI6XWtlmmAXZbfDxVXburYlBt++RD+MwHxrMivz8Mh24pn8Pv5SrvSgbeOjod3b5wOAjG3p5db7ZikZI7k2e7VGvcuDB+IjSZQThFAizMWScLANQM+70eAbEmWeUEcXfe8v4wWEfpNetxKOqKgdB7MYg7n0jMGZmP79ZLKQI7Gf17Gyjytf+XmmmFSynD34Jxhz6073Bbo7itwXvo83oEzONm20d8+8p1OJnp5AomfIWzAnoQXA6VaOVrDA22iu8ahZ70HF6iTaVJ3TWLvetOOzPIzbgVNxI/MDWkLOYgYnDrh+x13fiDexZKg4FIVoUPPKGFk9pWg==) -> Smazáno
[Suspicious.Path] ToawH01BTCwCR2YbP63ybO.job -- C:\Users\skolnik\AppData\Roaming\ToawH01BTCwCR2YbP63ybO.exe (--c=PpV6jndetMN94Cuv3e0eQ5vFcT95uc9fZ6aXuhbiv2gA/GAhuDh4O8AosdURtpO9slBWQdEztEMoS/ZoOGWm1Sgz8eYMa3PVrx7pohxplQAsZgIZhfSTiOcdR3wl1WFq2aEJFchiHh+i/OSovyyApRyaUs0d9zuw5ltgNvhr5162MYQ2OxoS61+I/s17+iLn9npQHyWj1pZSFDozBnzet37qWVV6AdQrvr+P71PTyGZvWk47eSW87a0197N1oBeBg6dB280W+A2f3CiXchJQX1SSqReDqcOFe7vZ7wvIOSl6cGDKGD7H7GVdMKyDLLotD7fkVgHnLzbWGeAb1mXnEA==) -> Smazáno
¤¤¤ Soubory : 0 ¤¤¤
¤¤¤ Soubor HOSTS : 0 ¤¤¤
¤¤¤ Antirootkit : 0 (Driver: Nahrán) ¤¤¤
¤¤¤ Webové prohlížeče : 2 ¤¤¤
[FIREFX:Addon] 75dgyfue.default : Adblock Plus [{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}] -> Smazáno
[FIREFX:Addon] 75dgyfue.default : avast! WebRep [wrc@avast.com] -> Smazáno
¤¤¤ Kontrola MBR : ¤¤¤
+++++ PhysicalDrive0: ST3500631NS ATA Device +++++
--- User ---
[MBR] 1aa964dbfdafcb34cfab185d9a740e32
[BSP] a8ba350e4630bef020fac709b2929259 : Windows Vista/7/8|VT.Unknown MBR Code
Partition table:
0 - [ACTIVE] NTFS (0x7) [VISIBLE] Offset (sectors): 2048 | Size: 100 MB [Windows Vista/7/8 Bootstrap | Windows Vista/7/8 Bootloader]
1 - [XXXXXX] NTFS (0x7) [VISIBLE] Offset (sectors): 206848 | Size: 99900 MB [Windows Vista/7/8 Bootstrap | Windows Vista/7/8 Bootloader]
2 - [XXXXXX] NTFS (0x7) [VISIBLE] Offset (sectors): 204802048 | Size: 376938 MB [Windows Vista/7/8 Bootstrap | Windows Vista/7/8 Bootloader]
User = LL1 ... OK
User = LL2 ... OK
+++++ PhysicalDrive1: Generic- SD/MMC USB Device +++++
Error reading User MBR! ([15] Za?ízení není p?ipraveno. )
Error reading LL1 MBR! NOT VALID!
Error reading LL2 MBR! ([32] Po?adavek není podporován. )
+++++ PhysicalDrive2: Generic- Compact Flash USB Device +++++
Error reading User MBR! ([15] Za?ízení není p?ipraveno. )
Error reading LL1 MBR! NOT VALID!
Error reading LL2 MBR! ([32] Po?adavek není podporován. )
+++++ PhysicalDrive3: Generic- SM/xD-Picture USB Device +++++
Error reading User MBR! ([15] Za?ízení není p?ipraveno. )
Error reading LL1 MBR! NOT VALID!
Error reading LL2 MBR! ([32] Po?adavek není podporován. )
+++++ PhysicalDrive4: Generic- MS/MS-Pro USB Device +++++
Error reading User MBR! ([15] Za?ízení není p?ipraveno. )
Error reading LL1 MBR! NOT VALID!
Error reading LL2 MBR! ([32] Po?adavek není podporován. )
============================================
RKreport_SCN_06042015_151808.log - RKreport_SCN_06042015_154257.log
RogueKiller V10.8.1.0 (x64) [Jun 3 2015] by Adlice Software
mail : http://www.adlice.com/contact/
Feedback : http://forum.adlice.com
Webová stránka : http://www.adlice.com/softwares/roguekiller/
Blog : http://www.adlice.com
Operační systém : Windows 7 (6.1.7601 Service Pack 1) 64 bits version
Spuštěno : Normální režim
Uživatel : skolnik [Práva správce]
Started from : C:\Users\skolnik\Desktop\RogueKillerX64.exe
Mód : Smazat -- Datum : 06/04/2015 15:44:34
¤¤¤ Procesy : 0 ¤¤¤
¤¤¤ Registry : 9 ¤¤¤
[PUP] (X64) HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\PCSUUCDRV -> Smazáno
[PUP] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\PCSUUCDRV -> Smazáno
[PUP] (X64) HKEY_LOCAL_MACHINE\System\ControlSet002\Services\PCSUUCDRV -> Smazáno
[PUM.HomePage] (X64) HKEY_USERS\S-1-5-21-1776103012-2186939331-3464947669-1000\Software\Microsoft\Internet Explorer\Main | Start Page : http://www.seznam.cz/?clid=16194 -> Nahrazeno (http://go.microsoft.com/fwlink/p/?LinkId=255141)
[PUM.HomePage] (X86) HKEY_USERS\S-1-5-21-1776103012-2186939331-3464947669-1000\Software\Microsoft\Internet Explorer\Main | Start Page : http://www.seznam.cz/?clid=16194 -> Nahrazeno (http://go.microsoft.com/fwlink/p/?LinkId=255141)
[PUM.Policies] (X64) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System | ConsentPromptBehaviorAdmin : 0 -> Nahrazeno (2)
[PUM.Policies] (X86) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System | ConsentPromptBehaviorAdmin : 0 -> Nahrazeno (2)
[PUM.StartMenu] (X64) HKEY_USERS\S-1-5-21-1776103012-2186939331-3464947669-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced | Start_ShowMyGames : 0 -> Nahrazeno (1)
[PUM.StartMenu] (X86) HKEY_USERS\S-1-5-21-1776103012-2186939331-3464947669-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced | Start_ShowMyGames : 0 -> Nahrazeno (1)
¤¤¤ Úlohy : 2 ¤¤¤
[Suspicious.Path] gyjqO13t.job -- C:\Users\skolnik\AppData\Roaming\gyjqO13t.exe (--c=dRunsQ6JfRkSTI6XWtlmmAXZbfDxVXburYlBt++RD+MwHxrMivz8Mh24pn8Pv5SrvSgbeOjod3b5wOAjG3p5db7ZikZI7k2e7VGvcuDB+IjSZQThFAizMWScLANQM+70eAbEmWeUEcXfe8v4wWEfpNetxKOqKgdB7MYg7n0jMGZmP79ZLKQI7Gf17Gyjytf+XmmmFSynD34Jxhz6073Bbo7itwXvo83oEzONm20d8+8p1OJnp5AomfIWzAnoQXA6VaOVrDA22iu8ahZ70HF6iTaVJ3TWLvetOOzPIzbgVNxI/MDWkLOYgYnDrh+x13fiDexZKg4FIVoUPPKGFk9pWg==) -> Smazáno
[Suspicious.Path] ToawH01BTCwCR2YbP63ybO.job -- C:\Users\skolnik\AppData\Roaming\ToawH01BTCwCR2YbP63ybO.exe (--c=PpV6jndetMN94Cuv3e0eQ5vFcT95uc9fZ6aXuhbiv2gA/GAhuDh4O8AosdURtpO9slBWQdEztEMoS/ZoOGWm1Sgz8eYMa3PVrx7pohxplQAsZgIZhfSTiOcdR3wl1WFq2aEJFchiHh+i/OSovyyApRyaUs0d9zuw5ltgNvhr5162MYQ2OxoS61+I/s17+iLn9npQHyWj1pZSFDozBnzet37qWVV6AdQrvr+P71PTyGZvWk47eSW87a0197N1oBeBg6dB280W+A2f3CiXchJQX1SSqReDqcOFe7vZ7wvIOSl6cGDKGD7H7GVdMKyDLLotD7fkVgHnLzbWGeAb1mXnEA==) -> Smazáno
¤¤¤ Soubory : 0 ¤¤¤
¤¤¤ Soubor HOSTS : 0 ¤¤¤
¤¤¤ Antirootkit : 0 (Driver: Nahrán) ¤¤¤
¤¤¤ Webové prohlížeče : 2 ¤¤¤
[FIREFX:Addon] 75dgyfue.default : Adblock Plus [{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}] -> Smazáno
[FIREFX:Addon] 75dgyfue.default : avast! WebRep [wrc@avast.com] -> Smazáno
¤¤¤ Kontrola MBR : ¤¤¤
+++++ PhysicalDrive0: ST3500631NS ATA Device +++++
--- User ---
[MBR] 1aa964dbfdafcb34cfab185d9a740e32
[BSP] a8ba350e4630bef020fac709b2929259 : Windows Vista/7/8|VT.Unknown MBR Code
Partition table:
0 - [ACTIVE] NTFS (0x7) [VISIBLE] Offset (sectors): 2048 | Size: 100 MB [Windows Vista/7/8 Bootstrap | Windows Vista/7/8 Bootloader]
1 - [XXXXXX] NTFS (0x7) [VISIBLE] Offset (sectors): 206848 | Size: 99900 MB [Windows Vista/7/8 Bootstrap | Windows Vista/7/8 Bootloader]
2 - [XXXXXX] NTFS (0x7) [VISIBLE] Offset (sectors): 204802048 | Size: 376938 MB [Windows Vista/7/8 Bootstrap | Windows Vista/7/8 Bootloader]
User = LL1 ... OK
User = LL2 ... OK
+++++ PhysicalDrive1: Generic- SD/MMC USB Device +++++
Error reading User MBR! ([15] Za?ízení není p?ipraveno. )
Error reading LL1 MBR! NOT VALID!
Error reading LL2 MBR! ([32] Po?adavek není podporován. )
+++++ PhysicalDrive2: Generic- Compact Flash USB Device +++++
Error reading User MBR! ([15] Za?ízení není p?ipraveno. )
Error reading LL1 MBR! NOT VALID!
Error reading LL2 MBR! ([32] Po?adavek není podporován. )
+++++ PhysicalDrive3: Generic- SM/xD-Picture USB Device +++++
Error reading User MBR! ([15] Za?ízení není p?ipraveno. )
Error reading LL1 MBR! NOT VALID!
Error reading LL2 MBR! ([32] Po?adavek není podporován. )
+++++ PhysicalDrive4: Generic- MS/MS-Pro USB Device +++++
Error reading User MBR! ([15] Za?ízení není p?ipraveno. )
Error reading LL1 MBR! NOT VALID!
Error reading LL2 MBR! ([32] Po?adavek není podporován. )
============================================
RKreport_SCN_06042015_151808.log - RKreport_SCN_06042015_154257.log
Re: Prosím o kontrolu logu
Log ze Zoek
......................................................................................
Zoek.exe v5.0.0.0 Updated 04-May-2015
Tool run by skolnik on źt 04.06.2015 at 15:50:43,03.
Microsoft Windows 7 Professional 6.1.7601 Service Pack 1 x64
Running in: Normal Mode Internet Access Detected
Launched: C:\Users\skolnik\Desktop\zoek.exe [Scan all users] [Script inserted]
==== System Restore Info ======================
4.6.2015 15:54:38 Zoek.exe System Restore Point Created Successfully.
==== Reset Hosts File ======================
# Copyright (c) 1993-2006 Microsoft Corp.
#
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
#
# This file contains the mappings of IP addresses to host names. Each
# entry should be kept on an individual line. The IP address should
# be placed in the first column followed by the corresponding host name.
# The IP address and the host name should be separated by at least one
# space.
#
# Additionally, comments (such as these) may be inserted on individual
# lines or following the machine name denoted by a '#' symbol.
#
# For example:
#
# 102.54.94.97 rhino.acme.com # source server
# 38.25.63.10 x.acme.com # x client host
# localhost name resolution is handled within DNS itself.
127.0.0.1 localhost
::1 localhost
==== Empty Folders Check ======================
C:\PROGRA~2\ce5fc4b4-60f1-45e1-b59f-8147d96488f9 deleted successfully
C:\PROGRA~2\MSXML 4.0 deleted successfully
C:\Program Files\Google deleted successfully
C:\PROGRA~3\Synology deleted successfully
C:\Users\skolnik\AppData\Roaming\Nico Mak Computing deleted successfully
C:\Users\skolnik\AppData\Roaming\Opera Software deleted successfully
C:\Users\skolnik\AppData\Roaming\PDF Producer deleted successfully
C:\Users\skolnik\AppData\Roaming\QuickScan deleted successfully
C:\Users\bilovmar\AppData\Local\VirtualStore deleted successfully
C:\Users\schimmar\AppData\Local\VirtualStore deleted successfully
C:\Users\skolnik\AppData\Local\Opera Software deleted successfully
C:\Users\skolnik\AppData\Local\PDFCreator deleted successfully
C:\Windows\serviceprofiles\Localservice\AppData\Local\CrashDumps deleted successfully
==== Deleting CLSID Registry Keys ======================
==== Deleting CLSID Registry Values ======================
HKEY_USERS\S-1-5-21-1776103012-2186939331-3464947669-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} deleted successfully
HKEY_USERS\S-1-5-21-1776103012-2186939331-3464947669-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\{2318C2B1-4965-11D4-9B18-009027A5CD4F} deleted successfully
==== Deleting Services ======================
==== FireFox Fix ======================
Deleted from C:\Users\schimmar\AppData\Roaming\Mozilla\Firefox\Profiles\gjrt218k.default\prefs.js:
user_pref("browser.startup.homepage", "http://www.google.cz/");
user_pref("browser.search.selectedEngine", "Google");
user_pref("browser.search.order.1", "Ask");
user_pref("browser.search.useDBForOrder", true);
Added to C:\Users\schimmar\AppData\Roaming\Mozilla\Firefox\Profiles\gjrt218k.default\prefs.js:
Deleted from C:\Users\schimmar\AppData\Roaming\Thunderbird\Profiles\qam11uni.default\prefs.js:
Added to C:\Users\schimmar\AppData\Roaming\Thunderbird\Profiles\qam11uni.default\prefs.js:
user_pref("browser.startup.homepage", "about:home");
user_pref("browser.newtab.url", "about:newtab");
Deleted from C:\Users\skolnik\AppData\Roaming\Mozilla\Firefox\Profiles\75dgyfue.default\prefs.js:
user_pref("browser.startup.homepage", "https://www.google.com/accounts/AccountChooser?hd=marschi.com&continue=http%3A%2F%2Fwww.google.com%2Fcalendar%2Fhosted%2Fmarschi.com%2Frender&followup=http%3A%2F%2Fwww.google.com%2Fcalendar%2Fhosted%2Fmarschi.com%2Frender&service=cl");
user_pref("services.sync.prefs.sync.browser.search.selectedEngine", true);
user_pref("browser.search.order.1", "Ask");
user_pref("browser.search.useDBForOrder", true);
Added to C:\Users\skolnik\AppData\Roaming\Mozilla\Firefox\Profiles\75dgyfue.default\prefs.js:
Deleted from C:\Users\skolnik\AppData\Roaming\Thunderbird\Profiles\fe2e4jiy.default\prefs.js:
Added to C:\Users\skolnik\AppData\Roaming\Thunderbird\Profiles\fe2e4jiy.default\prefs.js:
user_pref("browser.startup.homepage", "about:home");
user_pref("browser.newtab.url", "about:newtab");
ProfilePath: C:\Users\schimmar\AppData\Roaming\Mozilla\Firefox\Profiles\gjrt218k.default
user.js not found
---- FireFox user.js and prefs.js backups ----
prefs_04.06.2015_1608_.backup
ProfilePath: C:\Users\schimmar\AppData\Roaming\Thunderbird\Profiles\qam11uni.default
user.js not found
---- FireFox user.js and prefs.js backups ----
prefs_04.06.2015_1608_.backup
ProfilePath: C:\Users\skolnik\AppData\Roaming\Mozilla\Firefox\Profiles\75dgyfue.default
user.js not found
---- FireFox user.js and prefs.js backups ----
prefs_04.06.2015_1608_.backup
ProfilePath: C:\Users\skolnik\AppData\Roaming\Thunderbird\Profiles\fe2e4jiy.default
user.js not found
---- FireFox user.js and prefs.js backups ----
prefs_04.06.2015_1608_.backup
==== Deleting Files \ Folders ======================
C:\PROGRA~2\ce5fc4b4-60f1-45e1-b59f-8147d96488f9 not found
C:\PROGRA~2\Help Save deleted
C:\PROGRA~2\Wondershare deleted
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Bosch Divar 700 Control Center deleted
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Wondershare deleted
C:\windows\SysNative\Tasks\avastBCLRestartS-1-5-21-1776103012-2186939331-3464947669-1000 deleted
C:\Windows\SysNative\config\systemprofile\Searches deleted
C:\Users\schimmar\AppData\Roaming\Mozilla\Firefox\Profiles\gjrt218k.default\extensions\staged deleted
C:\Users\schimmar\AppData\Roaming\Mozilla\Firefox\Profiles\gjrt218k.default\CT2269050 deleted
C:\Users\skolnik\AppData\Roaming\Mozilla\Firefox\Profiles\75dgyfue.default\CT2269050 deleted
C:\Users\schimmar\AppData\Roaming\Mozilla\Firefox\Profiles\gjrt218k.default\conduit deleted
C:\Users\skolnik\AppData\Roaming\Mozilla\Firefox\Profiles\75dgyfue.default\conduit deleted
"C:\Users\skolnik\AppData\Roaming\gyjqO13t" deleted
"C:\Users\skolnik\AppData\Roaming\ToawH01BTCwCR2YbP63ybO" deleted
==== Firefox Start and Search pages ======================
ProfilePath: C:\Users\schimmar\AppData\Roaming\Thunderbird\Profiles\qam11uni.default
user_pref("browser.startup.homepage", "about:home");
user_pref("browser.newtab.url", "about:newtab");
ProfilePath: C:\Users\skolnik\AppData\Roaming\Thunderbird\Profiles\fe2e4jiy.default
user_pref("browser.startup.homepage", "about:home");
user_pref("browser.newtab.url", "about:newtab");
==== Firefox Extensions Registry ======================
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Mozilla\Firefox\Extensions]
"wrc@avast.com"="C:\Program Files\AVAST Software\Avast Business\WebRep\FF" [10.04.2015 06:11]
==== Firefox Extensions ======================
ProfilePath: C:\Users\schimmar\AppData\Roaming\Mozilla\Firefox\Profiles\gjrt218k.default
- esk slovnk pro kontrolu pravopisu - %ProfilePath%\extensions\cs@dictionaries.addons.mozilla.org
- Google Gears - %ProfilePath%\extensions\{000a9d1c-beef-4f90-9363-039d445309b8}
- Microsoft .NET Framework Assistant - %ProfilePath%\extensions\{20a82645-c095-46ed-80e3-08825760534b}
- FireGestures - %ProfilePath%\extensions\firegestures@xuldev.org.xpi
- All-in-One Sidebar - %ProfilePath%\extensions\{097d3191-e6fa-4728-9826-b533d755359d}.xpi
ProfilePath: C:\Users\schimmar\AppData\Roaming\Thunderbird\Profiles\qam11uni.default
- esk slovnk pro kontrolu pravopisu - %ProfilePath%\extensions\cs@dictionaries.addons.mozilla.org
- Provider for Google Calendar - %ProfilePath%\extensions\{a62ef8ec-5fdc-40c2-873c-223b8a6925cc}
- Lightning - %ProfilePath%\extensions\{e2fda1a4-762b-4020-b5ad-a41df1933103}
- Instrument Test - %ProfilePath%\extensions\tbtestpilot@labs.mozilla.com.xpi
ProfilePath: C:\Users\skolnik\AppData\Roaming\Mozilla\Firefox\Profiles\75dgyfue.default
- avast WebRep - C:\Program Files\AVAST Software\Avast Business\WebRep\FF
- esk slovnk pro kontrolu pravopisu - %ProfilePath%\extensions\cs@dictionaries.addons.mozilla.org
- Adblock Plus - %ProfilePath%\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
ProfilePath: C:\Users\skolnik\AppData\Roaming\Thunderbird\Profiles\fe2e4jiy.default
- esk slovnk pro kontrolu pravopisu - %ProfilePath%\extensions\cs@dictionaries.addons.mozilla.org
- Provider for Google Calendar - %ProfilePath%\extensions\{a62ef8ec-5fdc-40c2-873c-223b8a6925cc}
- Lightning - %ProfilePath%\extensions\{e2fda1a4-762b-4020-b5ad-a41df1933103}
AppDir: C:\Program Files (x86)\Mozilla Firefox
- Default - %AppDir%\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
==== Firefox Plugins ======================
Profilepath: C:\Users\skolnik\AppData\Roaming\Mozilla\Firefox\Profiles\75dgyfue.default
49BE1DC75CF6FA8422771A5D04FD50E1 - C:\Program Files\Tracker Software\PDF Viewer\Win32\npPDFXCviewNPPlugin.dll - PDF-XChange Viewer
9AE02005247DA91AB1743F5208DBEF76 - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_17_0_0_169.dll - Shockwave Flash
==== Chromium Look ======================
Google Chrome Version: 43.0.2357.81
HKEY_LOCAL_MACHINE\SOFTWARE\Google\Chrome\Extensions
aaaaoggiphohkihibdkcnhnokmkfmhnj - C:\Users\skolnik\AppData\Local\APN\GoogleCRXs\aaaaoggiphohkihibdkcnhnokmkfmhnj_7.17.0.0.crx[]
icmlaeflemplmjndnaapfdbbnpncnbda - C:\Program Files\AVAST Software\Avast Business\WebRep\Chrome\aswWebRepChrome.crx[14.01.2014 02:15]
HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\Extensions
apdfllckaahabafndbhieahigkjlhalf - C:\Users\skolnik\AppData\Local\Google\Drive\apdfllckaahabafndbhieahigkjlhalf_live.crx[27.11.2014 12:47]
lmjegmlicamnimmfhcmpkclmigmmcbeh - No path found[]
KMPlayer Toolbar - schimmar\AppData\Local\Google\Chrome\User Data\Default\Extensions\aaaaoggiphohkihibdkcnhnokmkfmhnj
Docs - schimmar\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake
avast WebRep - skolnik\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmlaeflemplmjndnaapfdbbnpncnbda
Google Drive App Launcher - skolnik\AppData\Local\Google\Chrome\User Data\Default\Extensions\lmjegmlicamnimmfhcmpkclmigmmcbeh
==== Chromium Startpages ======================
C:\Users\schimmar\AppData\Local\Google\Chrome\User Data\Default\Preferences
"homepage": "http://www.google.com",
"urls_to_restore_on_startup": [ "http://www.google.com" ]
==== Chromium Fix ======================
C:\Users\schimmar\AppData\Local\Google\Chrome\User Data\Default\Extensions\aaaaoggiphohkihibdkcnhnokmkfmhnj deleted successfully
==== Set IE to Default ======================
Old Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"="http://go.microsoft.com/fwlink/p/?LinkId=255141"
"Old Start Page"="http://www.google.com"
"Default_Page_URL"="http://www.google.com"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
"Default_Search_URL"="http://www.google.com"
"Default_Page_URL"="http://www.google.com"
"Start Page"="http://www.google.com"
"Search Page"="http://www.google.com"
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main]
"Default_Search_URL"="http://www.google.com"
"Default_Page_URL"="http://www.google.com"
"Start Page"="http://www.google.com"
"Search Page"="http://www.google.com"
New Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Default_Page_URL"="http://go.microsoft.com/fwlink/?LinkId=69157"
"Start Page"="http://go.microsoft.com/fwlink/p/?LinkId=255141"
"Old Start Page"="http://go.microsoft.com/fwlink/p/?LinkId=255141"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
"Default_Search_URL"="http://go.microsoft.com/fwlink/?LinkId=54896"
"Search Page"="http://go.microsoft.com/fwlink/?LinkId=54896"
"Default_Page_URL"="http://go.microsoft.com/fwlink/?LinkId=69157"
"Start Page"="http://go.microsoft.com/fwlink/?LinkId=69157"
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main]
"Default_Search_URL"="http://go.microsoft.com/fwlink/?LinkId=54896"
"Search Page"="http://go.microsoft.com/fwlink/?LinkId=54896"
"Default_Page_URL"="http://go.microsoft.com/fwlink/?LinkId=69157"
"Start Page"="http://go.microsoft.com/fwlink/?LinkId=69157"
==== All HKCU SearchScopes ======================
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes
"DefaultScope"="{0633EE93-D776-472f-A0FF-E1416B8B2E3A}"
{012E1000-F331-11DB-8314-0800200C9A66} Google Url="http://www.google.com/search?q={searchTerms}"
{0633EE93-D776-472f-A0FF-E1416B8B2E3A} Bing Url="http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC"
{079E75B2-BF88-4AD5-813B-6017223AF8EB} Encyklopedie Seznam Url="http://encyklopedie.seznam.cz/search?q={searchTerms}&sourceid=QuickSearch_16194"
{258DDFE0-8CD4-414F-9CA9-736512457D33} Zbo§ˇ.cz Url="http://www.zbozi.cz/?q={searchTerms}&r=campmoz&sourceid=QuickSearch_16194"
{2E1A8302-3DA5-4A8E-A3C9-7BF20FC750DB} Seznam TV Program Url="http://tv.seznam.cz/hledej?w={searchTerms}&sourceid=QuickSearch_16194"
{3158E95C-E90A-4376-866A-917D229877E6} Mapy.cz Url="http://www.mapy.cz/?query={searchTerms}&sourceid=QuickSearch_16194"
{4BF0AFB3-0CB4-4A6C-B59D-CCD3D92BB50A} Slovnˇk CZ/EN Url="http://slovnik.seznam.cz/?q={searchTerms}&lang=cz_en&sourceid=QuickSearch_16194"
{5E66F12D-4941-4996-9DC6-4A5A36ADE4E8} Novinky.cz Url="http://www.novinky.cz/hledej?w={searchTerms}&sourceid=QuickSearch_16194"
{6A1806CD-94D4-4689-BA73-E35EA1EA9990} Google Url="http://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7"
{92BD5379-C7A4-49FE-AE56-D718C1F0C92D} Slovnˇk EN/CZ Url="http://slovnik.seznam.cz/?q={searchTerms}&lang=en_cz&sourceid=QuickSearch_16194"
{EEF1AD4C-7A19-461F-A627-9358D4FF54EE} Firmy.cz Url="http://www.firmy.cz/?q={searchTerms}&sourceid=QuickSearch_16194"
==== Reset Google Chrome ======================
C:\Users\schimmar\AppData\Local\Google\Chrome\User Data\Default\Preferences was reset successfully
C:\Users\skolnik\AppData\Local\Google\Chrome\User Data\Default\Preferences was reset successfully
C:\Users\skolnik\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences was reset successfully
C:\Users\schimmar\AppData\Local\Google\Chrome\User Data\Default\Web Data was reset successfully
C:\Users\schimmar\AppData\Local\Google\Chrome\User Data\Default\Web Data-journal was reset successfully
C:\Users\skolnik\AppData\Local\Google\Chrome\User Data\Default\Web Data was reset successfully
==== Deleting Registry Keys ======================
HKEY_LOCAL_MACHINE\Software\wow6432node\Policies\Google deleted successfully
HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Google\Chrome\Extensions\aaaaoggiphohkihibdkcnhnokmkfmhnj deleted successfully
==== Empty IE Cache ======================
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\skolnik\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\skolnik\Desktop\Users\Default\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\skolnik\Desktop\Users\martin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\skolnik\Desktop\Users\Školník\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\skolnik\Desktop\Users\Školník\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5 emptied successfully
C:\Users\skolnik\Desktop\Users\Školník\AppData\Local\Temp\acro_rd_dir\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\SysNative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\sysWoW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\serviceprofiles\Localservice\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\serviceprofiles\Localservice\AppData\Local\Temp\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\sysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
==== Empty FireFox Cache ======================
C:\Users\skolnik\AppData\Local\Mozilla\Firefox\Profiles\75dgyfue.default\cache2 emptied successfully
==== Empty Chrome Cache ======================
C:\Users\schimmar\AppData\Local\Google\Chrome\User Data\Default\Cache emptied successfully
C:\Users\skolnik\AppData\Local\Google\Chrome\User Data\Default\Cache emptied successfully
==== Empty All Flash Cache ======================
Flash Cache Emptied Successfully
==== Empty All Java Cache ======================
Java Cache cleared successfully
==== C:\zoek_backup content ======================
C:\zoek_backup (files=878 folders=128 53612231 bytes)
==== Empty Temp Folders ======================
C:\Users\Administrator\AppData\Local\Temp emptied successfully
C:\Users\bilovmar\AppData\Local\Temp emptied successfully
C:\Users\Default\AppData\Local\Temp emptied successfully
C:\Users\Default User\AppData\Local\Temp emptied successfully
C:\Users\schimmar\AppData\Local\Temp emptied successfully
C:\Users\skolnik\AppData\Local\Temp will be emptied at reboot
C:\Windows\serviceprofiles\networkservice\AppData\Local\Temp emptied successfully
C:\Windows\serviceprofiles\Localservice\AppData\Local\Temp emptied successfully
C:\Windows\Temp will be emptied at reboot
==== After Reboot ======================
==== Empty Temp Folders ======================
C:\Windows\Temp successfully emptied
C:\Users\skolnik\AppData\Local\Temp successfully emptied
==== Empty Recycle Bin ======================
C:\$RECYCLE.BIN successfully emptied
==== EOF on źt 04.06.2015 at 16:41:31,80 ======================
::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
Log z HJT
Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 16:51:33, on 4.6.2015
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v11.0 (11.00.9600.17801)
FIREFOX: 38.0.5 (x86 cs)
Boot mode: Normal
Running processes:
C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe
C:\Program Files (x86)\OKsoftware\Svátky a výročí\Vyroci.exe
C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe
C:\Program Files (x86)\DYMO\DYMO Label Software\DymoQuickPrint.exe
C:\Program Files (x86)\Google\Drive\googledrivesync.exe
C:\Program Files (x86)\Nero\Nero 10\Nero BackItUp\NBAgent.exe
C:\Program Files (x86)\PIXELA\Everio MediaBrowser 4\MBCameraMonitor.exe
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
C:\Program Files\AVAST Software\Avast Business\AvastUI.exe
C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe
C:\Users\skolnik\AppData\Roaming\Seznam.cz\bin\szndesktop.exe
C:\Program Files (x86)\Google\Drive\googledrivesync.exe
C:\Program Files (x86)\Mozilla Firefox\firefox.exe
C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe
C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_17_0_0_169.exe
C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_17_0_0_169.exe
C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe
D:\Downloads\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/p/?LinkId=255141
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F2 - REG:system.ini: UserInit=userinit.exe,
O1 - Hosts: ::1 localhost
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre1.8.0_31\bin\ssv.dll
O2 - BHO: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast Business\aswWebRepIE.dll
O2 - BHO: Pomocná služba pro přihlášení k účtu Microsoft - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: URLRedirectionBHO - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre1.8.0_31\bin\jp2ssv.dll
O3 - Toolbar: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast Business\aswWebRepIE.dll
O4 - HKLM\..\Run: [NBAgent] "C:\Program Files (x86)\Nero\Nero 10\Nero BackItUp\NBAgent.exe" /WinStart
O4 - HKLM\..\Run: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [DLSService] "C:\Program Files (x86)\DYMO\DYMO Label Software\DLSService.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [avast] "C:\Program Files\AVAST Software\Avast Business\avastUI.exe" /nogui
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [seznam-listicka-distribuce] "C:\Program Files (x86)\Seznam.cz\distribution\szninstall.exe" -s -d listicka 1 szn-software-listicka cz.seznam.software.autoupdate
O4 - HKLM\..\Run: [SDTray] "C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe"
O4 - HKCU\..\Run: [Svátky a výročí] C:\Program Files (x86)\OKsoftware\Svátky a výročí\Vyroci.exe
O4 - HKCU\..\Run: [HydraVisionDesktopManager] "C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe"
O4 - HKCU\..\Run: [DymoQuickPrint] "C:\Program Files (x86)\DYMO\DYMO Label Software\DymoQuickPrint.exe" /startup
O4 - HKCU\..\Run: [GoogleDriveSync] "C:\Program Files (x86)\Google\Drive\googledrivesync.exe" /autostart
O4 - HKCU\..\Run: [cz.seznam.software.autoupdate] "C:\Users\skolnik\AppData\Roaming\Seznam.cz\szninstall.exe" -c
O4 - HKCU\..\Run: [cz.seznam.software.szndesktop] "C:\Users\skolnik\AppData\Roaming\Seznam.cz\bin\wszndesktop.exe" -q
O4 - HKCU\..\RunOnce: [Uninstall C:\Users\skolnik\AppData\Local\Microsoft\SkyDrive\16.4.6010.0727\amd64] C:\Windows\system32\cmd.exe /q /c rmdir /s /q "C:\Users\skolnik\AppData\Local\Microsoft\SkyDrive\16.4.6010.0727\amd64"
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O4 - Global Startup: Device Monitor 4.lnk = C:\Program Files (x86)\PIXELA\Everio MediaBrowser 4\MBCameraMonitor.exe
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~2\MICROS~1\Office14\EXCEL.EXE/3000
O8 - Extra context menu item: Od&eslat do aplikace OneNote - res://C:\PROGRA~2\MICROS~1\Office14\ONBttnIE.dll/105
O9 - Extra button: @C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1004 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: @C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1003 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Odeslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Od&eslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll
O9 - Extra button: P&ropojené poznámky aplikace OneNote - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
O9 - Extra 'Tools' menuitem: P&ropojené poznámky aplikace OneNote - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O16 - DPF: {5E013669-3103-47A0-90ED-F02AFE6BA38E} (4Mosa Control) - http://46.47.132.120/600series.cab
O16 - DPF: {A796D216-2DE1-4EA8-BABB-FE6E7C959098} (HPSDDX Class) - http://www.hp.com/cpso-support-new/SDD/ ... Signed.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/s ... wflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = zsl.local
O17 - HKLM\System\CCS\Services\Tcpip\..\{967984E7-2F32-4DAE-82CF-336EC1F8999A}: NameServer = 8.8.8.8,8.8.4.4,4.2.2.1,4.2.2.2,208.67.222.222,208.67.220.220,8.26.56.26,8.20.247.20,156.154.70.1,156.154.71.1
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = zsl.local
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = zsl.local
O18 - Protocol: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
O18 - Filter hijack: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL
O20 - Winlogon Notify: SDWinLogon - SDWinLogon.dll (file missing)
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: AMD External Events Utility - Unknown owner - C:\Windows\system32\atiesrxx.exe (file missing)
O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\AVAST Software\Avast Business\AvastSvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files (x86)\Bonjour\mDNSResponder.exe
O23 - Service: DYMO PnP Service (DymoPnpService) - Sanford, L.P. - C:\Program Files (x86)\DYMO\DYMO Label Software\DymoPnpService.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: Služba Google Update (gupdate) (gupdate) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Služba Google Update (gupdatem) (gupdatem) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: @%SystemRoot%\system32\ieetwcollectorres.dll,-1000 (IEEtwCollectorService) - Unknown owner - C:\Windows\system32\IEEtwCollector.exe (file missing)
O23 - Service: Intel(R) Capability Licensing Service Interface - Intel(R) Corporation - C:\Program Files\Intel\iCLS Client\HeciServer.exe
O23 - Service: Intel(R) Dynamic Application Loader Host Interface Service (jhi_service) - Intel Corporation - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Intel(R) Management and Security Application Local Management Service (LMS) - Intel Corporation - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
O23 - Service: MBAMScheduler - Malwarebytes Corporation - C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe
O23 - Service: MBAMService - Malwarebytes Corporation - C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe
O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @C:\Program Files (x86)\Nero\Update\NASvc.exe,-200 (NAUpdate) - Nero AG - C:\Program Files (x86)\Nero\Update\NASvc.exe
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Spybot-S&D 2 Scanner Service (SDScannerService) - Safer-Networking Ltd. - C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe
O23 - Service: Spybot-S&D 2 Updating Service (SDUpdateService) - Safer-Networking Ltd. - C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe
O23 - Service: Spybot-S&D 2 Security Center Service (SDWSCService) - Safer-Networking Ltd. - C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: SpyHunter 4 Service - Enigma Software Group USA, LLC. - C:\Program Files\Enigma Software Group\SpyHunter\SH4Service.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: Intel(R) Management and Security Application User Notification Service (UNS) - Intel Corporation - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
O23 - Service: UsbClientService - Unknown owner - C:\Program Files (x86)\Synology\Assistant\UsbClientService.exe
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)
--
End of file - 14540 bytes
:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
Zatím to vypadá dobře. Na plochu už žádné okno nevyskočilo, ani v prohlížeči nedochází k přesměrování na reklamní stránky.
Jste prostě JEDNIČKY!!!
Moc děkuji
......................................................................................
Zoek.exe v5.0.0.0 Updated 04-May-2015
Tool run by skolnik on źt 04.06.2015 at 15:50:43,03.
Microsoft Windows 7 Professional 6.1.7601 Service Pack 1 x64
Running in: Normal Mode Internet Access Detected
Launched: C:\Users\skolnik\Desktop\zoek.exe [Scan all users] [Script inserted]
==== System Restore Info ======================
4.6.2015 15:54:38 Zoek.exe System Restore Point Created Successfully.
==== Reset Hosts File ======================
# Copyright (c) 1993-2006 Microsoft Corp.
#
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
#
# This file contains the mappings of IP addresses to host names. Each
# entry should be kept on an individual line. The IP address should
# be placed in the first column followed by the corresponding host name.
# The IP address and the host name should be separated by at least one
# space.
#
# Additionally, comments (such as these) may be inserted on individual
# lines or following the machine name denoted by a '#' symbol.
#
# For example:
#
# 102.54.94.97 rhino.acme.com # source server
# 38.25.63.10 x.acme.com # x client host
# localhost name resolution is handled within DNS itself.
127.0.0.1 localhost
::1 localhost
==== Empty Folders Check ======================
C:\PROGRA~2\ce5fc4b4-60f1-45e1-b59f-8147d96488f9 deleted successfully
C:\PROGRA~2\MSXML 4.0 deleted successfully
C:\Program Files\Google deleted successfully
C:\PROGRA~3\Synology deleted successfully
C:\Users\skolnik\AppData\Roaming\Nico Mak Computing deleted successfully
C:\Users\skolnik\AppData\Roaming\Opera Software deleted successfully
C:\Users\skolnik\AppData\Roaming\PDF Producer deleted successfully
C:\Users\skolnik\AppData\Roaming\QuickScan deleted successfully
C:\Users\bilovmar\AppData\Local\VirtualStore deleted successfully
C:\Users\schimmar\AppData\Local\VirtualStore deleted successfully
C:\Users\skolnik\AppData\Local\Opera Software deleted successfully
C:\Users\skolnik\AppData\Local\PDFCreator deleted successfully
C:\Windows\serviceprofiles\Localservice\AppData\Local\CrashDumps deleted successfully
==== Deleting CLSID Registry Keys ======================
==== Deleting CLSID Registry Values ======================
HKEY_USERS\S-1-5-21-1776103012-2186939331-3464947669-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} deleted successfully
HKEY_USERS\S-1-5-21-1776103012-2186939331-3464947669-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\{2318C2B1-4965-11D4-9B18-009027A5CD4F} deleted successfully
==== Deleting Services ======================
==== FireFox Fix ======================
Deleted from C:\Users\schimmar\AppData\Roaming\Mozilla\Firefox\Profiles\gjrt218k.default\prefs.js:
user_pref("browser.startup.homepage", "http://www.google.cz/");
user_pref("browser.search.selectedEngine", "Google");
user_pref("browser.search.order.1", "Ask");
user_pref("browser.search.useDBForOrder", true);
Added to C:\Users\schimmar\AppData\Roaming\Mozilla\Firefox\Profiles\gjrt218k.default\prefs.js:
Deleted from C:\Users\schimmar\AppData\Roaming\Thunderbird\Profiles\qam11uni.default\prefs.js:
Added to C:\Users\schimmar\AppData\Roaming\Thunderbird\Profiles\qam11uni.default\prefs.js:
user_pref("browser.startup.homepage", "about:home");
user_pref("browser.newtab.url", "about:newtab");
Deleted from C:\Users\skolnik\AppData\Roaming\Mozilla\Firefox\Profiles\75dgyfue.default\prefs.js:
user_pref("browser.startup.homepage", "https://www.google.com/accounts/AccountChooser?hd=marschi.com&continue=http%3A%2F%2Fwww.google.com%2Fcalendar%2Fhosted%2Fmarschi.com%2Frender&followup=http%3A%2F%2Fwww.google.com%2Fcalendar%2Fhosted%2Fmarschi.com%2Frender&service=cl");
user_pref("services.sync.prefs.sync.browser.search.selectedEngine", true);
user_pref("browser.search.order.1", "Ask");
user_pref("browser.search.useDBForOrder", true);
Added to C:\Users\skolnik\AppData\Roaming\Mozilla\Firefox\Profiles\75dgyfue.default\prefs.js:
Deleted from C:\Users\skolnik\AppData\Roaming\Thunderbird\Profiles\fe2e4jiy.default\prefs.js:
Added to C:\Users\skolnik\AppData\Roaming\Thunderbird\Profiles\fe2e4jiy.default\prefs.js:
user_pref("browser.startup.homepage", "about:home");
user_pref("browser.newtab.url", "about:newtab");
ProfilePath: C:\Users\schimmar\AppData\Roaming\Mozilla\Firefox\Profiles\gjrt218k.default
user.js not found
---- FireFox user.js and prefs.js backups ----
prefs_04.06.2015_1608_.backup
ProfilePath: C:\Users\schimmar\AppData\Roaming\Thunderbird\Profiles\qam11uni.default
user.js not found
---- FireFox user.js and prefs.js backups ----
prefs_04.06.2015_1608_.backup
ProfilePath: C:\Users\skolnik\AppData\Roaming\Mozilla\Firefox\Profiles\75dgyfue.default
user.js not found
---- FireFox user.js and prefs.js backups ----
prefs_04.06.2015_1608_.backup
ProfilePath: C:\Users\skolnik\AppData\Roaming\Thunderbird\Profiles\fe2e4jiy.default
user.js not found
---- FireFox user.js and prefs.js backups ----
prefs_04.06.2015_1608_.backup
==== Deleting Files \ Folders ======================
C:\PROGRA~2\ce5fc4b4-60f1-45e1-b59f-8147d96488f9 not found
C:\PROGRA~2\Help Save deleted
C:\PROGRA~2\Wondershare deleted
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Bosch Divar 700 Control Center deleted
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Wondershare deleted
C:\windows\SysNative\Tasks\avastBCLRestartS-1-5-21-1776103012-2186939331-3464947669-1000 deleted
C:\Windows\SysNative\config\systemprofile\Searches deleted
C:\Users\schimmar\AppData\Roaming\Mozilla\Firefox\Profiles\gjrt218k.default\extensions\staged deleted
C:\Users\schimmar\AppData\Roaming\Mozilla\Firefox\Profiles\gjrt218k.default\CT2269050 deleted
C:\Users\skolnik\AppData\Roaming\Mozilla\Firefox\Profiles\75dgyfue.default\CT2269050 deleted
C:\Users\schimmar\AppData\Roaming\Mozilla\Firefox\Profiles\gjrt218k.default\conduit deleted
C:\Users\skolnik\AppData\Roaming\Mozilla\Firefox\Profiles\75dgyfue.default\conduit deleted
"C:\Users\skolnik\AppData\Roaming\gyjqO13t" deleted
"C:\Users\skolnik\AppData\Roaming\ToawH01BTCwCR2YbP63ybO" deleted
==== Firefox Start and Search pages ======================
ProfilePath: C:\Users\schimmar\AppData\Roaming\Thunderbird\Profiles\qam11uni.default
user_pref("browser.startup.homepage", "about:home");
user_pref("browser.newtab.url", "about:newtab");
ProfilePath: C:\Users\skolnik\AppData\Roaming\Thunderbird\Profiles\fe2e4jiy.default
user_pref("browser.startup.homepage", "about:home");
user_pref("browser.newtab.url", "about:newtab");
==== Firefox Extensions Registry ======================
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Mozilla\Firefox\Extensions]
"wrc@avast.com"="C:\Program Files\AVAST Software\Avast Business\WebRep\FF" [10.04.2015 06:11]
==== Firefox Extensions ======================
ProfilePath: C:\Users\schimmar\AppData\Roaming\Mozilla\Firefox\Profiles\gjrt218k.default
- esk slovnk pro kontrolu pravopisu - %ProfilePath%\extensions\cs@dictionaries.addons.mozilla.org
- Google Gears - %ProfilePath%\extensions\{000a9d1c-beef-4f90-9363-039d445309b8}
- Microsoft .NET Framework Assistant - %ProfilePath%\extensions\{20a82645-c095-46ed-80e3-08825760534b}
- FireGestures - %ProfilePath%\extensions\firegestures@xuldev.org.xpi
- All-in-One Sidebar - %ProfilePath%\extensions\{097d3191-e6fa-4728-9826-b533d755359d}.xpi
ProfilePath: C:\Users\schimmar\AppData\Roaming\Thunderbird\Profiles\qam11uni.default
- esk slovnk pro kontrolu pravopisu - %ProfilePath%\extensions\cs@dictionaries.addons.mozilla.org
- Provider for Google Calendar - %ProfilePath%\extensions\{a62ef8ec-5fdc-40c2-873c-223b8a6925cc}
- Lightning - %ProfilePath%\extensions\{e2fda1a4-762b-4020-b5ad-a41df1933103}
- Instrument Test - %ProfilePath%\extensions\tbtestpilot@labs.mozilla.com.xpi
ProfilePath: C:\Users\skolnik\AppData\Roaming\Mozilla\Firefox\Profiles\75dgyfue.default
- avast WebRep - C:\Program Files\AVAST Software\Avast Business\WebRep\FF
- esk slovnk pro kontrolu pravopisu - %ProfilePath%\extensions\cs@dictionaries.addons.mozilla.org
- Adblock Plus - %ProfilePath%\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
ProfilePath: C:\Users\skolnik\AppData\Roaming\Thunderbird\Profiles\fe2e4jiy.default
- esk slovnk pro kontrolu pravopisu - %ProfilePath%\extensions\cs@dictionaries.addons.mozilla.org
- Provider for Google Calendar - %ProfilePath%\extensions\{a62ef8ec-5fdc-40c2-873c-223b8a6925cc}
- Lightning - %ProfilePath%\extensions\{e2fda1a4-762b-4020-b5ad-a41df1933103}
AppDir: C:\Program Files (x86)\Mozilla Firefox
- Default - %AppDir%\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
==== Firefox Plugins ======================
Profilepath: C:\Users\skolnik\AppData\Roaming\Mozilla\Firefox\Profiles\75dgyfue.default
49BE1DC75CF6FA8422771A5D04FD50E1 - C:\Program Files\Tracker Software\PDF Viewer\Win32\npPDFXCviewNPPlugin.dll - PDF-XChange Viewer
9AE02005247DA91AB1743F5208DBEF76 - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_17_0_0_169.dll - Shockwave Flash
==== Chromium Look ======================
Google Chrome Version: 43.0.2357.81
HKEY_LOCAL_MACHINE\SOFTWARE\Google\Chrome\Extensions
aaaaoggiphohkihibdkcnhnokmkfmhnj - C:\Users\skolnik\AppData\Local\APN\GoogleCRXs\aaaaoggiphohkihibdkcnhnokmkfmhnj_7.17.0.0.crx[]
icmlaeflemplmjndnaapfdbbnpncnbda - C:\Program Files\AVAST Software\Avast Business\WebRep\Chrome\aswWebRepChrome.crx[14.01.2014 02:15]
HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\Extensions
apdfllckaahabafndbhieahigkjlhalf - C:\Users\skolnik\AppData\Local\Google\Drive\apdfllckaahabafndbhieahigkjlhalf_live.crx[27.11.2014 12:47]
lmjegmlicamnimmfhcmpkclmigmmcbeh - No path found[]
KMPlayer Toolbar - schimmar\AppData\Local\Google\Chrome\User Data\Default\Extensions\aaaaoggiphohkihibdkcnhnokmkfmhnj
Docs - schimmar\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake
avast WebRep - skolnik\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmlaeflemplmjndnaapfdbbnpncnbda
Google Drive App Launcher - skolnik\AppData\Local\Google\Chrome\User Data\Default\Extensions\lmjegmlicamnimmfhcmpkclmigmmcbeh
==== Chromium Startpages ======================
C:\Users\schimmar\AppData\Local\Google\Chrome\User Data\Default\Preferences
"homepage": "http://www.google.com",
"urls_to_restore_on_startup": [ "http://www.google.com" ]
==== Chromium Fix ======================
C:\Users\schimmar\AppData\Local\Google\Chrome\User Data\Default\Extensions\aaaaoggiphohkihibdkcnhnokmkfmhnj deleted successfully
==== Set IE to Default ======================
Old Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"="http://go.microsoft.com/fwlink/p/?LinkId=255141"
"Old Start Page"="http://www.google.com"
"Default_Page_URL"="http://www.google.com"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
"Default_Search_URL"="http://www.google.com"
"Default_Page_URL"="http://www.google.com"
"Start Page"="http://www.google.com"
"Search Page"="http://www.google.com"
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main]
"Default_Search_URL"="http://www.google.com"
"Default_Page_URL"="http://www.google.com"
"Start Page"="http://www.google.com"
"Search Page"="http://www.google.com"
New Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Default_Page_URL"="http://go.microsoft.com/fwlink/?LinkId=69157"
"Start Page"="http://go.microsoft.com/fwlink/p/?LinkId=255141"
"Old Start Page"="http://go.microsoft.com/fwlink/p/?LinkId=255141"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
"Default_Search_URL"="http://go.microsoft.com/fwlink/?LinkId=54896"
"Search Page"="http://go.microsoft.com/fwlink/?LinkId=54896"
"Default_Page_URL"="http://go.microsoft.com/fwlink/?LinkId=69157"
"Start Page"="http://go.microsoft.com/fwlink/?LinkId=69157"
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main]
"Default_Search_URL"="http://go.microsoft.com/fwlink/?LinkId=54896"
"Search Page"="http://go.microsoft.com/fwlink/?LinkId=54896"
"Default_Page_URL"="http://go.microsoft.com/fwlink/?LinkId=69157"
"Start Page"="http://go.microsoft.com/fwlink/?LinkId=69157"
==== All HKCU SearchScopes ======================
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes
"DefaultScope"="{0633EE93-D776-472f-A0FF-E1416B8B2E3A}"
{012E1000-F331-11DB-8314-0800200C9A66} Google Url="http://www.google.com/search?q={searchTerms}"
{0633EE93-D776-472f-A0FF-E1416B8B2E3A} Bing Url="http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC"
{079E75B2-BF88-4AD5-813B-6017223AF8EB} Encyklopedie Seznam Url="http://encyklopedie.seznam.cz/search?q={searchTerms}&sourceid=QuickSearch_16194"
{258DDFE0-8CD4-414F-9CA9-736512457D33} Zbo§ˇ.cz Url="http://www.zbozi.cz/?q={searchTerms}&r=campmoz&sourceid=QuickSearch_16194"
{2E1A8302-3DA5-4A8E-A3C9-7BF20FC750DB} Seznam TV Program Url="http://tv.seznam.cz/hledej?w={searchTerms}&sourceid=QuickSearch_16194"
{3158E95C-E90A-4376-866A-917D229877E6} Mapy.cz Url="http://www.mapy.cz/?query={searchTerms}&sourceid=QuickSearch_16194"
{4BF0AFB3-0CB4-4A6C-B59D-CCD3D92BB50A} Slovnˇk CZ/EN Url="http://slovnik.seznam.cz/?q={searchTerms}&lang=cz_en&sourceid=QuickSearch_16194"
{5E66F12D-4941-4996-9DC6-4A5A36ADE4E8} Novinky.cz Url="http://www.novinky.cz/hledej?w={searchTerms}&sourceid=QuickSearch_16194"
{6A1806CD-94D4-4689-BA73-E35EA1EA9990} Google Url="http://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7"
{92BD5379-C7A4-49FE-AE56-D718C1F0C92D} Slovnˇk EN/CZ Url="http://slovnik.seznam.cz/?q={searchTerms}&lang=en_cz&sourceid=QuickSearch_16194"
{EEF1AD4C-7A19-461F-A627-9358D4FF54EE} Firmy.cz Url="http://www.firmy.cz/?q={searchTerms}&sourceid=QuickSearch_16194"
==== Reset Google Chrome ======================
C:\Users\schimmar\AppData\Local\Google\Chrome\User Data\Default\Preferences was reset successfully
C:\Users\skolnik\AppData\Local\Google\Chrome\User Data\Default\Preferences was reset successfully
C:\Users\skolnik\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences was reset successfully
C:\Users\schimmar\AppData\Local\Google\Chrome\User Data\Default\Web Data was reset successfully
C:\Users\schimmar\AppData\Local\Google\Chrome\User Data\Default\Web Data-journal was reset successfully
C:\Users\skolnik\AppData\Local\Google\Chrome\User Data\Default\Web Data was reset successfully
==== Deleting Registry Keys ======================
HKEY_LOCAL_MACHINE\Software\wow6432node\Policies\Google deleted successfully
HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Google\Chrome\Extensions\aaaaoggiphohkihibdkcnhnokmkfmhnj deleted successfully
==== Empty IE Cache ======================
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\skolnik\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\skolnik\Desktop\Users\Default\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\skolnik\Desktop\Users\martin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\skolnik\Desktop\Users\Školník\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\skolnik\Desktop\Users\Školník\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5 emptied successfully
C:\Users\skolnik\Desktop\Users\Školník\AppData\Local\Temp\acro_rd_dir\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\SysNative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\sysWoW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\serviceprofiles\Localservice\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\serviceprofiles\Localservice\AppData\Local\Temp\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\sysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
==== Empty FireFox Cache ======================
C:\Users\skolnik\AppData\Local\Mozilla\Firefox\Profiles\75dgyfue.default\cache2 emptied successfully
==== Empty Chrome Cache ======================
C:\Users\schimmar\AppData\Local\Google\Chrome\User Data\Default\Cache emptied successfully
C:\Users\skolnik\AppData\Local\Google\Chrome\User Data\Default\Cache emptied successfully
==== Empty All Flash Cache ======================
Flash Cache Emptied Successfully
==== Empty All Java Cache ======================
Java Cache cleared successfully
==== C:\zoek_backup content ======================
C:\zoek_backup (files=878 folders=128 53612231 bytes)
==== Empty Temp Folders ======================
C:\Users\Administrator\AppData\Local\Temp emptied successfully
C:\Users\bilovmar\AppData\Local\Temp emptied successfully
C:\Users\Default\AppData\Local\Temp emptied successfully
C:\Users\Default User\AppData\Local\Temp emptied successfully
C:\Users\schimmar\AppData\Local\Temp emptied successfully
C:\Users\skolnik\AppData\Local\Temp will be emptied at reboot
C:\Windows\serviceprofiles\networkservice\AppData\Local\Temp emptied successfully
C:\Windows\serviceprofiles\Localservice\AppData\Local\Temp emptied successfully
C:\Windows\Temp will be emptied at reboot
==== After Reboot ======================
==== Empty Temp Folders ======================
C:\Windows\Temp successfully emptied
C:\Users\skolnik\AppData\Local\Temp successfully emptied
==== Empty Recycle Bin ======================
C:\$RECYCLE.BIN successfully emptied
==== EOF on źt 04.06.2015 at 16:41:31,80 ======================
::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
Log z HJT
Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 16:51:33, on 4.6.2015
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v11.0 (11.00.9600.17801)
FIREFOX: 38.0.5 (x86 cs)
Boot mode: Normal
Running processes:
C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe
C:\Program Files (x86)\OKsoftware\Svátky a výročí\Vyroci.exe
C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe
C:\Program Files (x86)\DYMO\DYMO Label Software\DymoQuickPrint.exe
C:\Program Files (x86)\Google\Drive\googledrivesync.exe
C:\Program Files (x86)\Nero\Nero 10\Nero BackItUp\NBAgent.exe
C:\Program Files (x86)\PIXELA\Everio MediaBrowser 4\MBCameraMonitor.exe
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
C:\Program Files\AVAST Software\Avast Business\AvastUI.exe
C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe
C:\Users\skolnik\AppData\Roaming\Seznam.cz\bin\szndesktop.exe
C:\Program Files (x86)\Google\Drive\googledrivesync.exe
C:\Program Files (x86)\Mozilla Firefox\firefox.exe
C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe
C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_17_0_0_169.exe
C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_17_0_0_169.exe
C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe
D:\Downloads\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/p/?LinkId=255141
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F2 - REG:system.ini: UserInit=userinit.exe,
O1 - Hosts: ::1 localhost
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre1.8.0_31\bin\ssv.dll
O2 - BHO: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast Business\aswWebRepIE.dll
O2 - BHO: Pomocná služba pro přihlášení k účtu Microsoft - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: URLRedirectionBHO - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre1.8.0_31\bin\jp2ssv.dll
O3 - Toolbar: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast Business\aswWebRepIE.dll
O4 - HKLM\..\Run: [NBAgent] "C:\Program Files (x86)\Nero\Nero 10\Nero BackItUp\NBAgent.exe" /WinStart
O4 - HKLM\..\Run: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [DLSService] "C:\Program Files (x86)\DYMO\DYMO Label Software\DLSService.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [avast] "C:\Program Files\AVAST Software\Avast Business\avastUI.exe" /nogui
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [seznam-listicka-distribuce] "C:\Program Files (x86)\Seznam.cz\distribution\szninstall.exe" -s -d listicka 1 szn-software-listicka cz.seznam.software.autoupdate
O4 - HKLM\..\Run: [SDTray] "C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe"
O4 - HKCU\..\Run: [Svátky a výročí] C:\Program Files (x86)\OKsoftware\Svátky a výročí\Vyroci.exe
O4 - HKCU\..\Run: [HydraVisionDesktopManager] "C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe"
O4 - HKCU\..\Run: [DymoQuickPrint] "C:\Program Files (x86)\DYMO\DYMO Label Software\DymoQuickPrint.exe" /startup
O4 - HKCU\..\Run: [GoogleDriveSync] "C:\Program Files (x86)\Google\Drive\googledrivesync.exe" /autostart
O4 - HKCU\..\Run: [cz.seznam.software.autoupdate] "C:\Users\skolnik\AppData\Roaming\Seznam.cz\szninstall.exe" -c
O4 - HKCU\..\Run: [cz.seznam.software.szndesktop] "C:\Users\skolnik\AppData\Roaming\Seznam.cz\bin\wszndesktop.exe" -q
O4 - HKCU\..\RunOnce: [Uninstall C:\Users\skolnik\AppData\Local\Microsoft\SkyDrive\16.4.6010.0727\amd64] C:\Windows\system32\cmd.exe /q /c rmdir /s /q "C:\Users\skolnik\AppData\Local\Microsoft\SkyDrive\16.4.6010.0727\amd64"
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O4 - Global Startup: Device Monitor 4.lnk = C:\Program Files (x86)\PIXELA\Everio MediaBrowser 4\MBCameraMonitor.exe
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~2\MICROS~1\Office14\EXCEL.EXE/3000
O8 - Extra context menu item: Od&eslat do aplikace OneNote - res://C:\PROGRA~2\MICROS~1\Office14\ONBttnIE.dll/105
O9 - Extra button: @C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1004 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: @C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1003 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Odeslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Od&eslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll
O9 - Extra button: P&ropojené poznámky aplikace OneNote - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
O9 - Extra 'Tools' menuitem: P&ropojené poznámky aplikace OneNote - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O16 - DPF: {5E013669-3103-47A0-90ED-F02AFE6BA38E} (4Mosa Control) - http://46.47.132.120/600series.cab
O16 - DPF: {A796D216-2DE1-4EA8-BABB-FE6E7C959098} (HPSDDX Class) - http://www.hp.com/cpso-support-new/SDD/ ... Signed.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/s ... wflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = zsl.local
O17 - HKLM\System\CCS\Services\Tcpip\..\{967984E7-2F32-4DAE-82CF-336EC1F8999A}: NameServer = 8.8.8.8,8.8.4.4,4.2.2.1,4.2.2.2,208.67.222.222,208.67.220.220,8.26.56.26,8.20.247.20,156.154.70.1,156.154.71.1
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = zsl.local
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = zsl.local
O18 - Protocol: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
O18 - Filter hijack: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL
O20 - Winlogon Notify: SDWinLogon - SDWinLogon.dll (file missing)
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: AMD External Events Utility - Unknown owner - C:\Windows\system32\atiesrxx.exe (file missing)
O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\AVAST Software\Avast Business\AvastSvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files (x86)\Bonjour\mDNSResponder.exe
O23 - Service: DYMO PnP Service (DymoPnpService) - Sanford, L.P. - C:\Program Files (x86)\DYMO\DYMO Label Software\DymoPnpService.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: Služba Google Update (gupdate) (gupdate) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Služba Google Update (gupdatem) (gupdatem) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: @%SystemRoot%\system32\ieetwcollectorres.dll,-1000 (IEEtwCollectorService) - Unknown owner - C:\Windows\system32\IEEtwCollector.exe (file missing)
O23 - Service: Intel(R) Capability Licensing Service Interface - Intel(R) Corporation - C:\Program Files\Intel\iCLS Client\HeciServer.exe
O23 - Service: Intel(R) Dynamic Application Loader Host Interface Service (jhi_service) - Intel Corporation - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Intel(R) Management and Security Application Local Management Service (LMS) - Intel Corporation - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
O23 - Service: MBAMScheduler - Malwarebytes Corporation - C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe
O23 - Service: MBAMService - Malwarebytes Corporation - C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe
O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @C:\Program Files (x86)\Nero\Update\NASvc.exe,-200 (NAUpdate) - Nero AG - C:\Program Files (x86)\Nero\Update\NASvc.exe
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Spybot-S&D 2 Scanner Service (SDScannerService) - Safer-Networking Ltd. - C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe
O23 - Service: Spybot-S&D 2 Updating Service (SDUpdateService) - Safer-Networking Ltd. - C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe
O23 - Service: Spybot-S&D 2 Security Center Service (SDWSCService) - Safer-Networking Ltd. - C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: SpyHunter 4 Service - Enigma Software Group USA, LLC. - C:\Program Files\Enigma Software Group\SpyHunter\SH4Service.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: Intel(R) Management and Security Application User Notification Service (UNS) - Intel Corporation - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
O23 - Service: UsbClientService - Unknown owner - C:\Program Files (x86)\Synology\Assistant\UsbClientService.exe
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)
--
End of file - 14540 bytes
:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
Zatím to vypadá dobře. Na plochu už žádné okno nevyskočilo, ani v prohlížeči nedochází k přesměrování na reklamní stránky.
Jste prostě JEDNIČKY!!!
Moc děkuji
-
jerabina
- člen Security týmu
-
Level 6
- Příspěvky: 3647
- Registrován: březen 13
- Bydliště: Litoměřice
- Pohlaví:
- Stav:
Offline
Re: Prosím o kontrolu logu
Pracujete ve školství?
Odinstaluj Spybot Search&Destroy
Zavři ostatní programy/prohlížeče, odpoj se od internetu a v HJT fixni:
NÁVOD
Stáhni si zde DelFix
https://toolslib.net/downloads/viewdownload/2-delfix/
ulož si soubor na plochu.
Poklepáním na ikonu spusť nástroj Delfix.exe
( Ve Windows Vista, Windows 7 a 8, musíš spustit soubor pravým tlačítkem myši -> Spustit jako správce .
V hlavním menu, zkontroluj tyto možnosti - Odstranění dezinfekce nástrojů (Remove desinfection tools) – Vyčistit body obnovy (Purge System Restore) .
Poté klikněte na tlačítko Spustit (Run) a nech nástroj dělat svoji práci.
Poté se zpráva se otevře (DelFix.txt). Vlož celý obsah zprávy sem. Jinak je zpráva zde:
v C: \ DelFix.txt
Odinstaluj Spybot Search&Destroy
Zavři ostatní programy/prohlížeče, odpoj se od internetu a v HJT fixni:
NÁVOD
Kód: Vybrat vše
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F2 - REG:system.ini: UserInit=userinit.exe,
O1 - Hosts: ::1 localhost
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [seznam-listicka-distribuce] "C:\Program Files (x86)\Seznam.cz\distribution\szninstall.exe" -s -d listicka 1 szn-software-listicka cz.seznam.software.autoupdate
O4 - HKLM\..\Run: [SDTray] "C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe"
O4 - HKCU\..\Run: [cz.seznam.software.autoupdate] "C:\Users\skolnik\AppData\Roaming\Seznam.cz\szninstall.exe" -c
O4 - HKCU\..\Run: [cz.seznam.software.szndesktop] "C:\Users\skolnik\AppData\Roaming\Seznam.cz\bin\wszndesktop.exe" -q
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O16 - DPF: {5E013669-3103-47A0-90ED-F02AFE6BA38E} (4Mosa Control) - http://46.47.132.120/600series.cab
O16 - DPF: {A796D216-2DE1-4EA8-BABB-FE6E7C959098} (HPSDDX Class) - http://www.hp.com/cpso-support-new/SDD/ ... Signed.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/s ... wflash.cab
O20 - Winlogon Notify: SDWinLogon - SDWinLogon.dll (file missing)Stáhni si zde DelFix
https://toolslib.net/downloads/viewdownload/2-delfix/
ulož si soubor na plochu.
Poklepáním na ikonu spusť nástroj Delfix.exe
( Ve Windows Vista, Windows 7 a 8, musíš spustit soubor pravým tlačítkem myši -> Spustit jako správce .
V hlavním menu, zkontroluj tyto možnosti - Odstranění dezinfekce nástrojů (Remove desinfection tools) – Vyčistit body obnovy (Purge System Restore) .
Poté klikněte na tlačítko Spustit (Run) a nech nástroj dělat svoji práci.
Poté se zpráva se otevře (DelFix.txt). Vlož celý obsah zprávy sem. Jinak je zpráva zde:
v C: \ DelFix.txt
Když nevíš jak dál, přichází na řadu prostudovat manuál!
HJT návod
Pokud neodpovídám do vašich témat v sekci HJT když jsem online, tak je to jen proto, že jsem na mobilu kde je studování logů a psaní skriptů nemožné. Neberte to tedy prosím jako ignoraci.
HJT návod
Pokud neodpovídám do vašich témat v sekci HJT když jsem online, tak je to jen proto, že jsem na mobilu kde je studování logů a psaní skriptů nemožné. Neberte to tedy prosím jako ignoraci.
Kdo je online
Uživatelé prohlížející si toto fórum: Žádní registrovaní uživatelé a 118 hostů