Prosím o kontrolu logu

[Standa410]

Dobrý den,

prosím o kontrolu logu. Při nečinnosti se mi procesy pohybují v rozmezí 40 - 100%. Antivir ESET Smart Security mi nenašel žádný virus a už nevím kde je problém. Předem děkuji za pomoc.

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 19:16:38, on 26.10.2015
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v11.0 (11.00.9600.18057)

FIREFOX: 41.0.2 (x86 cs)
Boot mode: Normal

Running processes:
C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe
C:\Program Files (x86)\Skype\Phone\Skype.exe
C:\Program Files (x86)\Hewlett-Packard\HP QuickWeb\hpqwutils.exe
C:\Program Files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe
C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe
C:\Program Files (x86)\EPSON Software\Event Manager\EEventManager.exe
C:\Program Files (x86)\Mozilla Firefox\firefox.exe
C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe
C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_19_0_0_226.exe
C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_19_0_0_226.exe
C:\totalcmd\TOTALCMD.EXE
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
C:\Stáhnuté soubory\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.bing.com?pc=CPNTDF
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.cz/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/p/?LinkId=255141
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/p/?LinkId=255141
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F2 - REG:system.ini: UserInit=userinit.exe
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre1.8.0_45\bin\ssv.dll
O2 - BHO: Pomocná služba pro přihlášení ke službě Windows Live ID - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre1.8.0_45\bin\jp2ssv.dll
O2 - BHO: HP Network Check Helper - {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [HPQuickWebProxy] "C:\Program Files (x86)\Hewlett-Packard\HP QuickWeb\hpqwutils.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [HPOSD] C:\Program Files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe
O4 - HKLM\..\Run: [HP Quick Launch] C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe
O4 - HKLM\..\Run: [EEventManager] "C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe"
O4 - HKCU\..\Run: [EPLTarget\P0000000000000000] C:\Windows\system32\spool\DRIVERS\x64\3\E_IATIIKE.EXE /EPT "EPLTarget\P0000000000000000" /M "XP-302 303 305 306 Series"
O4 - HKCU\..\Run: [Skype] "C:\Program Files (x86)\Skype\Phone\Skype.exe" /minimized /regrun
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O8 - Extra context menu item: Odeslat obrázek do zařízení &Bluetooth... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O8 - Extra context menu item: Odeslat stránku do zařízení &Bluetooth... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: @C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1004 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: @C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1003 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: @C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll,-103 - {25510184-5A38-4A99-B273-DCA8EEF6CD08} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\NCLauncherFromIE.exe
O9 - Extra 'Tools' menuitem: @C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll,-102 - {25510184-5A38-4A99-B273-DCA8EEF6CD08} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\NCLauncherFromIE.exe
O9 - Extra button: Skype Click to Call settings - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Odeslat do zařízení Bluetooth - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: Odeslat do zařízení &Bluetooth... - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Protocol: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O18 - Protocol: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: Andrea RT Filters Service (AERTFilters) - Andrea Electronics Corporation - C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: AMD External Events Utility - Unknown owner - C:\Windows\system32\atiesrxx.exe (file missing)
O23 - Service: AMD FUEL Service - Advanced Micro Devices, Inc. - C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: ESET Service (ekrn) - ESET - C:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe
O23 - Service: EpsonBidirectionalService - SEIKO EPSON CORPORATION - C:\Program Files (x86)\Common Files\EPSON\EBAPI\eEBSVC.exe
O23 - Service: Epson Scanner Service (EpsonScanSvc) - Unknown owner - C:\Windows\system32\EscSvc64.exe (file missing)
O23 - Service: Easybits Services for Windows (ezSharedSvc) - EasyBits Software AS - C:\Windows\System32\ezSharedSvcHost.exe
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: GamesAppService - WildTangent, Inc. - C:\Program Files (x86)\WildTangent Games\App\GamesAppService.exe
O23 - Service: HP Support Assistant Service - Hewlett-Packard Company - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe
O23 - Service: HP Client Services (HPClientSvc) - Hewlett-Packard Company - C:\Program Files\Hewlett-Packard\HP Client Services\HPClientServices.exe
O23 - Service: HP Quick Synchronization Service (HPDrvMntSvc.exe) - Hewlett-Packard Company - C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe
O23 - Service: HP Software Framework Service (hpqwmiex) - Hewlett-Packard Company - C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe
O23 - Service: HPWMISVC - Hewlett-Packard Development Company, L.P. - C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe
O23 - Service: IconMan_R - Realsil Microelectronics Inc. - C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe
O23 - Service: @%SystemRoot%\system32\ieetwcollectorres.dll,-1000 (IEEtwCollectorService) - Unknown owner - C:\Windows\system32\IEEtwCollector.exe (file missing)
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Skype Updater (SkypeUpdate) - Skype Technologies - C:\Program Files (x86)\Skype\Updater\Updater.exe
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--
End of file - 12142 bytes

[Reklama]

[jerabina]

Ahoj, vítej na fóru PC-HELP!

V možnostech složky si povol zobrazování skrytých souborů a složek+ odškrtni zatržítko skrýt chráněné soubory operačního systému.

Toto otestuj na Virustotal
C:\Windows\system32\spool\DRIVERS\x64\3\E_IATIIKE.EXE

Klikni vpravo od okénka na Vybrat a v Exploreru najdi požadovaný soubor v Tvém PC. Označ ho myší a klikni na Otevřít , poté klikni na Send File. Pokud už byl soubor testován , objeví se okno ve kterém klikni na Reanalyze. Soubor se začne postupně testovat více antivirovými programy. Až skončí test posledního antiviru , objeví se nahoře result a červeně počet nákaz , např. 0/43 , nebo 1/43. Pak zkopíruj myší odkaz na tuto stránku a vlož ji do svého příspěvku.

Stáhni si ATF Cleaner
Poklepej na ATF Cleaner.exe, klikni na select all found, poté:
-Když používáš Firefox (Mozzila), klikni na Firefox nahoře a vyber: Select All, poté klikni na Empty Selected.
-Když používáš Operu, klikni nahoře na Operu a vyber: Select All, poté klikni na Empty Selected. Poté klikni na Main (hlavní stránku ) a klikni na Empty Selected.
Po vyčištění klikni na Exit k zavření programu.
ATF-Cleaner je jednoduchý nástroj na odstranění historie z webového prohlížeče. Program dokáže odstranit cache, cookies, historii a další stopy po surfování na Internetu. Mezi podporované prohlížeče patří Internet Explorer, Firefox a Opera. Aplikace navíc umí odstranit dočasné soubory Windows, vysypat koš atd.

- Pokud používáš jen Google Chrome , tak ATF nemusíš použít.

===================================================

Stáhni si TFC
Otevři soubor a zavři všechny ostatní okna, Klikni na Start k zahájení procesu. Program by neměl trvat dlouho.
Poté by se měl PC restartovat, pokud ne , proveď sám.

===================================================

Stáhni AdwCleaner (by Xplode)

Ulož si ho na svojí plochu
Ukonči všechny programy , okna a prohlížeče
Spusť program poklepáním a klikni na „Prohledat-Scan“
Po skenu se objeví log ( jinak je uložen systémovem disku jako AdwCleaner[R?].txt), jeho obsah sem celý vlož.

===================================================

Stáhni si Malwarebytes' Anti-Malware
- Při instalaci odeber zatržítko u „Povolit bezplatnou zkušební verzi Malwarebytes' Anti-Malware Premium“
Nainstaluj a spusť ho
- na konci instalace se ujisti že máš zvoleny/zatrhnuty obě možnosti:
Aktualizace Malwarebytes' Anti-Malware a Spustit aplikaci Malwarebytes' Anti-Malware, pokud jo tak klikni na tlačítko konec
- pokud bude nalezena aktualizace, tak se stáhne a nainstaluje
- program se po té spustí a klikni na Skenovat nyní a
- po proběhnutí programu se ti objeví hláška vpravo dole tak klikni na Kopírovat do schránky a a vlož sem celý log.

- po té klikni na tlačítko Exit, objeví se ti hláška tak zvol Ano
(zatím nic nemaž!).

Pokud budou problémy , spusť v nouz. režimu.

[Standa410]

Výsledek Virustotal:
https://www.virustotal.com/cs/file/8e90 ... 445890709/

[Standa410]

Výsledek AdwCleaner:
# AdwCleaner v5.015 - Logfile created 26/10/2015 at 21:37:16
# Updated 26/10/2015 by Xplode
# Database : 2015-10-26.2 [Server]
# Operating system : Windows 7 Home Premium Service Pack 1 (x64)
# Username : Kurilovi - KURILOVI-HP
# Running from : C:\Stáhnuté soubory\adwcleaner_5.015.exe
# Option : Cleaning
# Support : http://toolslib.net/forum

***** [ Services ] *****


***** [ Folders ] *****


***** [ Files ] *****


***** [ DLLs ] *****


***** [ Shortcuts ] *****


***** [ Scheduled tasks ] *****


***** [ Registry ] *****


***** [ Web browsers ] *****


*************************

:: Winsock settings cleared

########## EOF - C:\AdwCleaner\AdwCleaner[C2].txt - [658 bytes] ##########

[Standa410]

Výsledek Malwaresbytes:

Malwarebytes Anti-Malware
www.malwarebytes.org

Datum skenování: 26.10.2015
Čas skenování: 21:47
Protokol:
Správce: Ano

Verze: 2.2.0.1024
Databáze malwaru: v2015.10.26.06
Databáze rootkitů: v2015.10.23.01
Licence: Bezplatná verze
Ochrana proti malwaru: Vypnuto
Ochrana proti škodlivým webovým stránkám: Vypnuto
Ochrana programu: Vypnuto

OS: Windows 7 Service Pack 1
CPU: x64
Souborový systém: NTFS
Uživatel: Kurilovi

Typ skenu: Sken hrozeb
Výsledek: Dokončeno
Prohledaných objektů: 328177
Uplynulý čas: 35 min, 45 sek

Paměť: Zapnuto
Po spuštění: Zapnuto
Souborový systém: Zapnuto
Archivy: Zapnuto
Rootkity: Vypnuto
Heuristika: Zapnuto
PUP: Zapnuto
PUM: Zapnuto

Procesy: 0
(Nenalezeny žádné škodlivé položky)

Moduly: 0
(Nenalezeny žádné škodlivé položky)

Klíče registru: 0
(Nenalezeny žádné škodlivé položky)

Hodnoty registru: 0
(Nenalezeny žádné škodlivé položky)

Data registru: 0
(Nenalezeny žádné škodlivé položky)

Složky: 0
(Nenalezeny žádné škodlivé položky)

Soubory: 0
(Nenalezeny žádné škodlivé položky)

Fyzické sektory: 0
(Nenalezeny žádné škodlivé položky)


(end)

[jaro3]

Stáhni si Junkware Removal Tool by Thisisu
http://www.bleepingcomputer.com/downloa ... oval-tool/
na svojí plochu.

Deaktivuj si svůj antivirový program. Pravým tl. myši klikni na JRT.exe a vyber „spustit jako správce“. Pro pokračování budeš vyzván ke stisknutí jakékoliv klávesy. Na nějakou klikni.
Začne skenování programu. Skenování může trvat dloho , podle množství nákaz. Po ukončení skenu se objeví log (JRT.txt) , který se uloží na ploše.
Zkopíruj sem prosím celý jeho obsah.

Stáhni si RogueKiller by Adlice Software
32bit.:
http://www.sur-la-toile.com/RogueKiller/RogueKiller.exe
64bit.:
http://www.sur-la-toile.com/RogueKiller ... lerX64.exe
na svojí plochu.
- Zavři všechny ostatní programy a prohlížeče.
- Pro OS Vista a win7 spusť program RogueKiller.exe jako správce , u XP poklepáním.
- počkej až skončí Prescan -vyhledávání škodlivých procesů.
-Potom klikni na „Prohledat“.
- Program skenuje procesy PC. Po proskenování klikni na „Zpráva“ , v okně na pak na „Open TXT“ a celý obsah logu sem zkopíruj.
Pokud je program blokován , zkus ho spustit několikrát. Pokud dále program nepůjde spustit a pracovat, přejmenuj ho na winlogon.exe.

[Standa410]

Výsledek JRT:

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Malwarebytes
Version: 7.6.4 (09.28.2015:1)
OS: Windows 7 Home Premium x64
Ran by Kurilovi on Łt 27.10.2015 at 6:43:03,81
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Tasks



~~~ Registry Values



~~~ Registry Keys

Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{FE702C48-4CAA-40FD-B058-A0E2F2B68835}
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchScopes\{FE702C48-4CAA-40FD-B058-A0E2F2B68835}



~~~ Files



~~~ Folders

Successfully deleted: [Empty Folder] C:\Users\Kurilovi\Appdata\Local\{014C060D-4BA0-4E87-A0A3-5735B12F39A5}
Successfully deleted: [Empty Folder] C:\Users\Kurilovi\Appdata\Local\{0252D3D7-3777-4B5F-A9EC-6331F38BD798}
Successfully deleted: [Empty Folder] C:\Users\Kurilovi\Appdata\Local\{0479242B-1E08-4D70-8EFD-B9A6802D6DA1}
Successfully deleted: [Empty Folder] C:\Users\Kurilovi\Appdata\Local\{04DA15BC-9E03-44D5-AFF2-998B8A5CDD03}
Successfully deleted: [Empty Folder] C:\Users\Kurilovi\Appdata\Local\{05368E0D-5DDD-4672-853B-A9B565FA8F0D}
Successfully deleted: [Empty Folder] C:\Users\Kurilovi\Appdata\Local\{06A587CD-FF98-4840-8397-4A628F7D0501}
Successfully deleted: [Empty Folder] C:\Users\Kurilovi\Appdata\Local\{0820B06D-F96E-47C8-BF1C-7B6FF9B7A92A}
Successfully deleted: [Empty Folder] C:\Users\Kurilovi\Appdata\Local\{0905EA61-6575-4111-B983-8B6767CFFB14}
Successfully deleted: [Empty Folder] C:\Users\Kurilovi\Appdata\Local\{097BCE14-B3B6-4A38-A12E-9B999A6F0AE9}
Successfully deleted: [Empty Folder] C:\Users\Kurilovi\Appdata\Local\{09DF450B-EDAA-4554-848E-537BC214F834}
Successfully deleted: [Empty Folder] C:\Users\Kurilovi\Appdata\Local\{09F5667A-E25F-456E-91E0-20DAA9BFB7AA}
Successfully deleted: [Empty Folder] C:\Users\Kurilovi\Appdata\Local\{0BB615E6-52F1-4397-BF6E-DB6C1647B153}
Successfully deleted: [Empty Folder] C:\Users\Kurilovi\Appdata\Local\{0CA5CD5A-8041-43D9-9B1F-07C2B3B1796B}
Successfully deleted: [Empty Folder] C:\Users\Kurilovi\Appdata\Local\{0D0B4649-E5D5-4F42-B64C-6AF71EE02DBE}
Successfully deleted: [Empty Folder] C:\Users\Kurilovi\Appdata\Local\{0E180915-1F6B-43DC-9C81-0FD945B3ABE8}
Successfully deleted: [Empty Folder] C:\Users\Kurilovi\Appdata\Local\{0E87E31C-E33D-4D9C-866D-B1156796DFCE}
Successfully deleted: [Empty Folder] C:\Users\Kurilovi\Appdata\Local\{118D45C3-73CA-43B1-8B1E-A2227DA9399F}
Successfully deleted: [Empty Folder] C:\Users\Kurilovi\Appdata\Local\{12173AA5-25B9-4866-833C-9AF7EEEC9D8F}
Successfully deleted: [Empty Folder] C:\Users\Kurilovi\Appdata\Local\{12DFBC7B-46E4-48A3-96CC-8E6DCEFBC107}
Successfully deleted: [Empty Folder] C:\Users\Kurilovi\Appdata\Local\{16C00DDA-8DE8-47A6-9491-3EB8681AD62B}
Successfully deleted: [Empty Folder] C:\Users\Kurilovi\Appdata\Local\{17D05FC8-D077-498F-85A1-5E100FAD63E3}
Successfully deleted: [Empty Folder] C:\Users\Kurilovi\Appdata\Local\{1981A8BD-C989-4A55-B2FB-EF817B3575BD}
Successfully deleted: [Empty Folder] C:\Users\Kurilovi\Appdata\Local\{19F0437A-43BA-4D3E-8444-5FB87109675E}
Successfully deleted: [Empty Folder] C:\Users\Kurilovi\Appdata\Local\{1A2ADEE1-CBFC-40F7-B2E4-6C08623E86FD}
Successfully deleted: [Empty Folder] C:\Users\Kurilovi\Appdata\Local\{1A9A493B-C9B8-430F-9EEB-6A8629BAC7CC}
Successfully deleted: [Empty Folder] C:\Users\Kurilovi\Appdata\Local\{1B1F80EF-4319-4D51-B530-7B5367EFAEF0}
Successfully deleted: [Empty Folder] C:\Users\Kurilovi\Appdata\Local\{1CC12F5E-3CDF-4A2F-B57A-DCE6208655D3}
Successfully deleted: [Empty Folder] C:\Users\Kurilovi\Appdata\Local\{1D934F67-4F12-40AF-AD51-46ACC7ACD2C1}
Successfully deleted: [Empty Folder] C:\Users\Kurilovi\Appdata\Local\{1E76EA60-3A31-4FD6-9F50-CED19DD288B6}
Successfully deleted: [Empty Folder] C:\Users\Kurilovi\Appdata\Local\{20D801F0-6ED7-4B1C-A1B1-5C6520CFF120}
Successfully deleted: [Empty Folder] C:\Users\Kurilovi\Appdata\Local\{21836A12-CB82-4CE0-8B0F-4FA28D465FB8}
Successfully deleted: [Empty Folder] C:\Users\Kurilovi\Appdata\Local\{23CE64E7-B437-4A94-8243-7AE6125B0246}
Successfully deleted: [Empty Folder] C:\Users\Kurilovi\Appdata\Local\{23F1F3D2-95BA-42D6-9A29-47C08DB98533}
Successfully deleted: [Empty Folder] C:\Users\Kurilovi\Appdata\Local\{2448F266-C44E-4DCC-9E61-B612A0F7AC9A}
Successfully deleted: [Empty Folder] C:\Users\Kurilovi\Appdata\Local\{252DEE91-514D-431F-BC37-9188153984E3}
Successfully deleted: [Empty Folder] C:\Users\Kurilovi\Appdata\Local\{254BF2DD-33EC-4206-9108-118514E712F4}
Successfully deleted: [Empty Folder] C:\Users\Kurilovi\Appdata\Local\{29FBDC46-1751-471E-8714-286A8CC83E1C}
Successfully deleted: [Empty Folder] C:\Users\Kurilovi\Appdata\Local\{2D8B099E-1EE9-4DE2-BDC2-FFCA6B7E3F23}
Successfully deleted: [Empty Folder] C:\Users\Kurilovi\Appdata\Local\{2EA70421-D6BA-4EF9-A7EE-009266800A15}
Successfully deleted: [Empty Folder] C:\Users\Kurilovi\Appdata\Local\{345A10BF-2D89-4F81-9967-E1EFA6961C6F}
Successfully deleted: [Empty Folder] C:\Users\Kurilovi\Appdata\Local\{357F7CC1-6639-4CAD-807B-7809EBFE1E81}
Successfully deleted: [Empty Folder] C:\Users\Kurilovi\Appdata\Local\{35C98684-95FF-4360-86CD-972E98D6900F}
Successfully deleted: [Empty Folder] C:\Users\Kurilovi\Appdata\Local\{363E2DAB-8AB0-455C-9B5F-661F7B224134}
Successfully deleted: [Empty Folder] C:\Users\Kurilovi\Appdata\Local\{365108C2-FE43-4988-8D96-5CD85DCD5D4A}
Successfully deleted: [Empty Folder] C:\Users\Kurilovi\Appdata\Local\{378764DE-4F0B-457A-B012-0EAB58D97C51}
Successfully deleted: [Empty Folder] C:\Users\Kurilovi\Appdata\Local\{382F6683-0AC1-41A3-B42D-57AD91111376}
Successfully deleted: [Empty Folder] C:\Users\Kurilovi\Appdata\Local\{38A74B7C-95F1-4AF3-BAEA-84B9A4B450E5}
Successfully deleted: [Empty Folder] C:\Users\Kurilovi\Appdata\Local\{3C133E5C-7041-40D6-8DCC-AA6AA76DE8C7}
Successfully deleted: [Empty Folder] C:\Users\Kurilovi\Appdata\Local\{3CF67E0F-E184-4FEE-BFE8-A2E8FAFD4279}
Successfully deleted: [Empty Folder] C:\Users\Kurilovi\Appdata\Local\{3E52BDC6-3206-476A-AA08-4E49515445A6}
Successfully deleted: [Empty Folder] C:\Users\Kurilovi\Appdata\Local\{3F0EFC52-B345-431D-9AF7-3BE5C782D698}
Successfully deleted: [Empty Folder] C:\Users\Kurilovi\Appdata\Local\{43DD723C-6D1C-40A8-888D-CDC988923348}
Successfully deleted: [Empty Folder] C:\Users\Kurilovi\Appdata\Local\{4408D1E8-C85A-412D-9542-18EBF6DDBEC9}
Successfully deleted: [Empty Folder] C:\Users\Kurilovi\Appdata\Local\{446117B9-8E36-4ECF-B800-A663C7CADDFD}
Successfully deleted: [Empty Folder] C:\Users\Kurilovi\Appdata\Local\{44A7B5ED-0D7D-4EF2-AFF5-9A05D855F81F}
Successfully deleted: [Empty Folder] C:\Users\Kurilovi\Appdata\Local\{4530DD12-02BE-4DF9-9874-35737BDB8B76}
Successfully deleted: [Empty Folder] C:\Users\Kurilovi\Appdata\Local\{4550087C-75E9-436A-BA50-189F9D10F14B}
Successfully deleted: [Empty Folder] C:\Users\Kurilovi\Appdata\Local\{46709919-503B-444B-8784-98A753E7C86C}
Successfully deleted: [Empty Folder] C:\Users\Kurilovi\Appdata\Local\{4A219B44-EEE3-49E6-A066-7CA470617012}
Successfully deleted: [Empty Folder] C:\Users\Kurilovi\Appdata\Local\{4B7B4042-1237-4427-997D-613F8695B176}
Successfully deleted: [Empty Folder] C:\Users\Kurilovi\Appdata\Local\{4B8CCB75-3EC2-4054-B332-B2D7D72393C1}
Successfully deleted: [Empty Folder] C:\Users\Kurilovi\Appdata\Local\{4C089593-DF45-4BBE-B57E-D19F24165D03}
Successfully deleted: [Empty Folder] C:\Users\Kurilovi\Appdata\Local\{4E2378B2-78CE-4B91-A704-A4B248ABBE63}
Successfully deleted: [Empty Folder] C:\Users\Kurilovi\Appdata\Local\{4E6F5130-4462-4E10-B6EE-076A3C0EAAA3}
Successfully deleted: [Empty Folder] C:\Users\Kurilovi\Appdata\Local\{4EE2D0DC-B607-4990-8C73-D410213695DE}
Successfully deleted: [Empty Folder] C:\Users\Kurilovi\Appdata\Local\{4EFFD890-A6C3-42E1-A12B-4E7886BD7890}
Successfully deleted: [Empty Folder] C:\Users\Kurilovi\Appdata\Local\{4F758667-64BC-4420-9ACB-046EC0FA2305}
Successfully deleted: [Empty Folder] C:\Users\Kurilovi\Appdata\Local\{4FCCB033-DE3D-46C7-A80C-742F80FF7E51}
Successfully deleted: [Empty Folder] C:\Users\Kurilovi\Appdata\Local\{4FD8AA96-3C2C-4842-BEFB-EACAF806E550}
Successfully deleted: [Empty Folder] C:\Users\Kurilovi\Appdata\Local\{500712C5-0D88-4AD3-88B1-2ECC987BC3BC}
Successfully deleted: [Empty Folder] C:\Users\Kurilovi\Appdata\Local\{56826179-FD93-4315-BF00-3F279BEC889A}
Successfully deleted: [Empty Folder] C:\Users\Kurilovi\Appdata\Local\{59E5B0A8-1C18-49E8-9FB0-2382194886C6}
Successfully deleted: [Empty Folder] C:\Users\Kurilovi\Appdata\Local\{5B497502-2131-4D04-8188-B532391B480A}
Successfully deleted: [Empty Folder] C:\Users\Kurilovi\Appdata\Local\{5D8967EA-D750-479F-A01A-D63C3900307C}
Successfully deleted: [Empty Folder] C:\Users\Kurilovi\Appdata\Local\{5DF95045-7AD9-478F-9FAF-71EB6C0B4272}
Successfully deleted: [Empty Folder] C:\Users\Kurilovi\Appdata\Local\{5DFC3AA6-7795-4001-92A1-5D8E82AB86A5}
Successfully deleted: [Empty Folder] C:\Users\Kurilovi\Appdata\Local\{61A5EE1A-EE14-470C-9820-2A2463B91054}
Successfully deleted: [Empty Folder] C:\Users\Kurilovi\Appdata\Local\{65954E10-1A84-4D91-9847-FA45EE3214D9}
Successfully deleted: [Empty Folder] C:\Users\Kurilovi\Appdata\Local\{6612F279-A5EE-4284-B558-42358F4E901F}
Successfully deleted: [Empty Folder] C:\Users\Kurilovi\Appdata\Local\{66D8F631-B931-495A-9DB8-1AD4ABE58D33}
Successfully deleted: [Empty Folder] C:\Users\Kurilovi\Appdata\Local\{67BB3122-A544-413C-BC8F-22088260FCAB}
Successfully deleted: [Empty Folder] C:\Users\Kurilovi\Appdata\Local\{68544D0A-4521-4B80-BFE0-48B0AF866038}
Successfully deleted: [Empty Folder] C:\Users\Kurilovi\Appdata\Local\{69386D03-C251-43FA-9E95-5D3C21D2DAC4}
Successfully deleted: [Empty Folder] C:\Users\Kurilovi\Appdata\Local\{6C7494DE-66B6-434B-AB76-78B766CE4ED5}
Successfully deleted: [Empty Folder] C:\Users\Kurilovi\Appdata\Local\{6CDAAF36-D36E-4653-8281-62BAC028D522}
Successfully deleted: [Empty Folder] C:\Users\Kurilovi\Appdata\Local\{6DCF8B6E-3DD1-4206-B4A1-2047ED6C1862}
Successfully deleted: [Empty Folder] C:\Users\Kurilovi\Appdata\Local\{6E4BD1BC-46A9-41ED-B497-5A19D6E9DF90}
Successfully deleted: [Empty Folder] C:\Users\Kurilovi\Appdata\Local\{6E8B8B8F-3494-457D-9EB7-D88563CB468D}
Successfully deleted: [Empty Folder] C:\Users\Kurilovi\Appdata\Local\{6E8BBD0C-1A7A-4E04-A33E-5B7FFB45B33F}
Successfully deleted: [Empty Folder] C:\Users\Kurilovi\Appdata\Local\{6EE03044-CBEF-416B-A5AD-4F5883CFEC6C}
Successfully deleted: [Empty Folder] C:\Users\Kurilovi\Appdata\Local\{6FB5F4B3-E628-47EE-921B-C0570AD79A4D}
Successfully deleted: [Empty Folder] C:\Users\Kurilovi\Appdata\Local\{702D98DF-747F-466A-96B4-32EA7B7E0ED0}
Successfully deleted: [Empty Folder] C:\Users\Kurilovi\Appdata\Local\{70B96965-A571-4443-8E53-F8EF6FBC5B2D}
Successfully deleted: [Empty Folder] C:\Users\Kurilovi\Appdata\Local\{753B88DA-16CA-479E-A91C-4CD3DE7C1C90}
Successfully deleted: [Empty Folder] C:\Users\Kurilovi\Appdata\Local\{7923EAED-ADFD-4030-9096-D9C6E28D7AF8}
Successfully deleted: [Empty Folder] C:\Users\Kurilovi\Appdata\Local\{7AB59B22-EBF4-4174-A055-BDC37E8DF129}
Successfully deleted: [Empty Folder] C:\Users\Kurilovi\Appdata\Local\{7CBE150A-9483-4969-8709-C5ADC2CAC5D7}
Successfully deleted: [Empty Folder] C:\Users\Kurilovi\Appdata\Local\{7EB38F76-E7A6-4C64-BFD4-352F8397C17D}
Successfully deleted: [Empty Folder] C:\Users\Kurilovi\Appdata\Local\{7F341B1F-E87A-4887-9D45-32F8FCBDF5FF}
Successfully deleted: [Empty Folder] C:\Users\Kurilovi\Appdata\Local\{7FD6DA1C-B685-4E63-B504-AC6135AB770D}
Successfully deleted: [Empty Folder] C:\Users\Kurilovi\Appdata\Local\{803AF55C-40DB-4A3D-AD38-A2C35E481746}
Successfully deleted: [Empty Folder] C:\Users\Kurilovi\Appdata\Local\{819F7372-F6CA-4205-946A-4E5AEAEBA9E5}
Successfully deleted: [Empty Folder] C:\Users\Kurilovi\Appdata\Local\{81E4FCE4-B599-422E-87BD-5EB7E94CAFF0}
Successfully deleted: [Empty Folder] C:\Users\Kurilovi\Appdata\Local\{82600762-790B-423B-8A87-DA1AC7B3653D}
Successfully deleted: [Empty Folder] C:\Users\Kurilovi\Appdata\Local\{82D713AB-0530-4960-AB18-26516CC1FDB4}
Successfully deleted: [Empty Folder] C:\Users\Kurilovi\Appdata\Local\{8461A0D3-6A79-4FE2-8DB6-58E2E0A931E3}
Successfully deleted: [Empty Folder] C:\Users\Kurilovi\Appdata\Local\{885222E6-D2CF-49A7-B5C0-4D4F4FED2D05}
Successfully deleted: [Empty Folder] C:\Users\Kurilovi\Appdata\Local\{88DC41D1-15C2-4702-8172-22303F6645C8}
Successfully deleted: [Empty Folder] C:\Users\Kurilovi\Appdata\Local\{88FE4CF2-983E-4923-87A7-E8C38C5D8BA5}
Successfully deleted: [Empty Folder] C:\Users\Kurilovi\Appdata\Local\{8903B81D-D9F2-4C31-8B25-B8362066C630}
Successfully deleted: [Empty Folder] C:\Users\Kurilovi\Appdata\Local\{898AF328-DD1F-46CF-BB5D-926D9E671C53}
Successfully deleted: [Empty Folder] C:\Users\Kurilovi\Appdata\Local\{8B219B7D-A69C-4580-B69D-A3DC058D4B47}
Successfully deleted: [Empty Folder] C:\Users\Kurilovi\Appdata\Local\{8D5E8272-CEE8-4CCD-B9A6-2CF6B305DDC2}
Successfully deleted: [Empty Folder] C:\Users\Kurilovi\Appdata\Local\{8DBC64B1-CEE5-4909-A9CF-DA34585A410B}
Successfully deleted: [Empty Folder] C:\Users\Kurilovi\Appdata\Local\{8F083EB4-A8C7-4997-84A6-3687E69FED0E}
Successfully deleted: [Empty Folder] C:\Users\Kurilovi\Appdata\Local\{8F2A9E9A-D553-4C48-93E4-23C0DB8EEE86}
Successfully deleted: [Empty Folder] C:\Users\Kurilovi\Appdata\Local\{8F4CD790-79C3-47E4-8D09-6345E4AC69EC}
Successfully deleted: [Empty Folder] C:\Users\Kurilovi\Appdata\Local\{907442BE-19B9-4659-BDC5-7B20197EF7BE}
Successfully deleted: [Empty Folder] C:\Users\Kurilovi\Appdata\Local\{923A87E5-0121-4E39-85C3-ECDAB0595CC6}
Successfully deleted: [Empty Folder] C:\Users\Kurilovi\Appdata\Local\{9469808E-EDE0-4B43-9E34-47BDB5304CEF}
Successfully deleted: [Empty Folder] C:\Users\Kurilovi\Appdata\Local\{9480458B-E463-451A-A51C-2E3650E5B19B}
Successfully deleted: [Empty Folder] C:\Users\Kurilovi\Appdata\Local\{97697054-544A-44D4-B8F3-BC10830C3015}
Successfully deleted: [Empty Folder] C:\Users\Kurilovi\Appdata\Local\{990EB5E8-BBEB-4385-A5CA-454122D0592A}
Successfully deleted: [Empty Folder] C:\Users\Kurilovi\Appdata\Local\{9CC2DC18-A9EE-4F43-A7A8-94536C7C0FB9}
Successfully deleted: [Empty Folder] C:\Users\Kurilovi\Appdata\Local\{A03611C1-5E9F-4E48-982F-13EE134EF4CA}
Successfully deleted: [Empty Folder] C:\Users\Kurilovi\Appdata\Local\{A41BB253-C8B6-4AF7-8F0F-7D23A8A42323}
Successfully deleted: [Empty Folder] C:\Users\Kurilovi\Appdata\Local\{A4D66C2F-D389-48B4-B089-F222A436076D}
Successfully deleted: [Empty Folder] C:\Users\Kurilovi\Appdata\Local\{A80D35E6-678A-45E8-87AF-3460303D066C}
Successfully deleted: [Empty Folder] C:\Users\Kurilovi\Appdata\Local\{A99BE393-38B0-4FA5-8D9B-BAAD0D2404FB}
Successfully deleted: [Empty Folder] C:\Users\Kurilovi\Appdata\Local\{AAD3532F-F688-4F97-A78F-B556C4C93F2D}
Successfully deleted: [Empty Folder] C:\Users\Kurilovi\Appdata\Local\{AB581177-5664-40AA-8D67-00215E009A53}
Successfully deleted: [Empty Folder] C:\Users\Kurilovi\Appdata\Local\{AB7F4C73-803D-435F-93DA-BD35DDD7DF1A}
Successfully deleted: [Empty Folder] C:\Users\Kurilovi\Appdata\Local\{AC37B0C0-7ABE-460D-8A04-687CD4D64606}
Successfully deleted: [Empty Folder] C:\Users\Kurilovi\Appdata\Local\{ACD30055-84A8-433F-8619-37982D73D1AE}
Successfully deleted: [Empty Folder] C:\Users\Kurilovi\Appdata\Local\{AD3B3652-FD2D-4271-91CD-A1F2CD6180AE}
Successfully deleted: [Empty Folder] C:\Users\Kurilovi\Appdata\Local\{AE85C6EF-E16F-4585-83B6-F94A45A7CD58}
Successfully deleted: [Empty Folder] C:\Users\Kurilovi\Appdata\Local\{B3B667B1-0141-4D45-AAFD-5B4C6744D92E}
Successfully deleted: [Empty Folder] C:\Users\Kurilovi\Appdata\Local\{B9F14E2D-F485-4C82-B366-D340DCCB44E2}
Successfully deleted: [Empty Folder] C:\Users\Kurilovi\Appdata\Local\{BBF02068-1843-4EF1-8E4F-7AA9C1B09D33}
Successfully deleted: [Empty Folder] C:\Users\Kurilovi\Appdata\Local\{C174B633-1A6C-4F21-B327-EF6AC93232DA}
Successfully deleted: [Empty Folder] C:\Users\Kurilovi\Appdata\Local\{C1E3C8B5-2A91-44F4-8055-3FB2C8B849B1}
Successfully deleted: [Empty Folder] C:\Users\Kurilovi\Appdata\Local\{C31875C0-A6E7-48CF-93E1-067FB1D8F584}
Successfully deleted: [Empty Folder] C:\Users\Kurilovi\Appdata\Local\{C56D2339-3AB8-4109-874D-417C3B67AAEC}
Successfully deleted: [Empty Folder] C:\Users\Kurilovi\Appdata\Local\{C6363B70-312F-4C25-A5D9-76D4B2D42246}
Successfully deleted: [Empty Folder] C:\Users\Kurilovi\Appdata\Local\{C6395F93-FF77-4381-83E7-E0C1D9E0E02C}
Successfully deleted: [Empty Folder] C:\Users\Kurilovi\Appdata\Local\{C769C5A3-F569-4DDD-8FD3-1D3EADB34B8D}
Successfully deleted: [Empty Folder] C:\Users\Kurilovi\Appdata\Local\{C778A7DD-0BEF-4EC3-9FC4-FD42E23A240E}
Successfully deleted: [Empty Folder] C:\Users\Kurilovi\Appdata\Local\{CA5BE978-51C7-457A-AA54-3BDEF45BCE68}
Successfully deleted: [Empty Folder] C:\Users\Kurilovi\Appdata\Local\{CB8979B9-886F-4C00-A916-DF4C264AB923}
Successfully deleted: [Empty Folder] C:\Users\Kurilovi\Appdata\Local\{CD38BF14-2D05-4209-A585-AF386BEE907D}
Successfully deleted: [Empty Folder] C:\Users\Kurilovi\Appdata\Local\{CE2E99F6-ECFC-4A8E-BCC8-92BCD2574D57}
Successfully deleted: [Empty Folder] C:\Users\Kurilovi\Appdata\Local\{CE6BEB98-71E2-48B9-9C15-59C602A9DA26}
Successfully deleted: [Empty Folder] C:\Users\Kurilovi\Appdata\Local\{D017C252-0C0B-47A4-9CA0-98828581BC4C}
Successfully deleted: [Empty Folder] C:\Users\Kurilovi\Appdata\Local\{D444C108-FEC7-4B2C-9355-9E95F5C99056}
Successfully deleted: [Empty Folder] C:\Users\Kurilovi\Appdata\Local\{D5A8FFCC-A007-4E75-835D-303E0F9DBBAE}
Successfully deleted: [Empty Folder] C:\Users\Kurilovi\Appdata\Local\{D6D74840-F243-415E-841F-108C747B870A}
Successfully deleted: [Empty Folder] C:\Users\Kurilovi\Appdata\Local\{D7445050-2204-4000-A033-5E0DD0985288}
Successfully deleted: [Empty Folder] C:\Users\Kurilovi\Appdata\Local\{D8258493-E08A-4FCF-8B64-D1EC4FFD470F}
Successfully deleted: [Empty Folder] C:\Users\Kurilovi\Appdata\Local\{D84685A6-932A-4EAB-B306-2F8D756E92B6}
Successfully deleted: [Empty Folder] C:\Users\Kurilovi\Appdata\Local\{DC39E2B8-5F29-4BD3-830C-BEBEA5972F1E}
Successfully deleted: [Empty Folder] C:\Users\Kurilovi\Appdata\Local\{DDD504BD-B4A3-450A-AF32-777166CCE535}
Successfully deleted: [Empty Folder] C:\Users\Kurilovi\Appdata\Local\{E1F68D09-FD36-4CB8-9250-58D292C195EB}
Successfully deleted: [Empty Folder] C:\Users\Kurilovi\Appdata\Local\{E60737E7-3E47-4FA2-A3BF-7FD0BE000A8B}
Successfully deleted: [Empty Folder] C:\Users\Kurilovi\Appdata\Local\{E6CFD8AE-94FD-4F3C-AFD8-F2F963899C67}
Successfully deleted: [Empty Folder] C:\Users\Kurilovi\Appdata\Local\{E6DC439C-2CA1-46E7-BF67-8FB86F62D9B0}
Successfully deleted: [Empty Folder] C:\Users\Kurilovi\Appdata\Local\{E7283667-903C-46ED-B5E8-0DBF31A3475A}
Successfully deleted: [Empty Folder] C:\Users\Kurilovi\Appdata\Local\{E7BA8BC6-BC11-4541-A422-47D158D56342}
Successfully deleted: [Empty Folder] C:\Users\Kurilovi\Appdata\Local\{E8988BE1-4FCF-4F8A-8BCC-284E52D7388B}
Successfully deleted: [Empty Folder] C:\Users\Kurilovi\Appdata\Local\{EEE69530-2F2A-45D0-B747-F8D00B00C6BD}
Successfully deleted: [Empty Folder] C:\Users\Kurilovi\Appdata\Local\{F02E9D41-0615-4A18-A23F-F72A6CF4E470}
Successfully deleted: [Empty Folder] C:\Users\Kurilovi\Appdata\Local\{F10F1A79-D02F-430B-9E8F-75DBEECAEEB6}
Successfully deleted: [Empty Folder] C:\Users\Kurilovi\Appdata\Local\{F3E296C4-1ADE-45F3-8AE0-29C76CDE623B}
Successfully deleted: [Empty Folder] C:\Users\Kurilovi\Appdata\Local\{F4FC0826-461D-4494-A58F-98AEBA3D7224}
Successfully deleted: [Empty Folder] C:\Users\Kurilovi\Appdata\Local\{F6B9ACF9-BF8F-40C2-8D11-9AE5ED32E60E}
Successfully deleted: [Empty Folder] C:\Users\Kurilovi\Appdata\Local\{F6D59171-DCB8-4624-8335-ECD068743AF2}
Successfully deleted: [Empty Folder] C:\Users\Kurilovi\Appdata\Local\{F71ADD4D-4314-4301-87FD-DCCF4F451583}
Successfully deleted: [Empty Folder] C:\Users\Kurilovi\Appdata\Local\{F7C879C4-6D44-473E-9C14-F4DDA6DF4556}
Successfully deleted: [Empty Folder] C:\Users\Kurilovi\Appdata\Local\{F96A7E00-8B13-4DF8-9B1F-1F5FC2F0E471}
Successfully deleted: [Empty Folder] C:\Users\Kurilovi\Appdata\Local\{F9D9FD01-3352-4F92-8241-9FF53979E50D}
Successfully deleted: [Empty Folder] C:\Users\Kurilovi\Appdata\Local\{FA7B7C58-2690-4EEB-9063-91CEAF360618}
Successfully deleted: [Empty Folder] C:\Users\Kurilovi\Appdata\Local\{FB93C627-6A71-49B4-9CE3-20E9B8132B0A}
Successfully deleted: [Empty Folder] C:\Users\Kurilovi\Appdata\Local\{FD8D3241-4DF7-4FBE-BF75-09DCB7FBFA63}



~~~ FireFox

Emptied folder: C:\Users\Kurilovi\AppData\Roaming\mozilla\firefox\profiles\bzpw867r.default\minidumps [124 files]



~~~ Chrome


[C:\Users\Kurilovi\Appdata\Local\Google\Chrome\User Data\Default\Preferences] - default search provider reset

[C:\Users\Kurilovi\Appdata\Local\Google\Chrome\User Data\Default\Preferences] - Extensions Deleted:

[C:\Users\Kurilovi\Appdata\Local\Google\Chrome\User Data\Default\Secure Preferences] - default search provider reset

[C:\Users\Kurilovi\Appdata\Local\Google\Chrome\User Data\Default\Secure Preferences] - Extensions Deleted:





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on Łt 27.10.2015 at 6:52:39,47
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

[Standa410]

Výsledek RogueKiller:

RogueKiller V10.11.3.0 (x64) [Oct 26 2015] (Free) by Adlice Software
mail : http://www.adlice.com/contact/
Feedback : http://forum.adlice.com
Webová stránka : http://www.adlice.com/software/roguekiller/
Blog : http://www.adlice.com

Operační systém : Windows 7 (6.1.7601 Service Pack 1) 64 bits version
Spuštěno : Normální režim
Uživatel : Kurilovi [Práva správce]
Started from : C:\St??hnut?© soubory\RogueKillerX64.exe
Mód : Prohledat -- Datum : 10/27/2015 14:48:52

¤¤¤ Procesy : 0 ¤¤¤

¤¤¤ Registry : 0 ¤¤¤

¤¤¤ Úlohy : 0 ¤¤¤

¤¤¤ Soubory : 0 ¤¤¤

¤¤¤ Soubor HOSTS : 2 ¤¤¤
[C:\Windows\System32\drivers\etc\hosts] 127.0.0.1 localhost
[C:\Windows\System32\drivers\etc\hosts] ::1 localhost

¤¤¤ Antirootkit : 0 (Driver: Nahrán) ¤¤¤

¤¤¤ Webové prohlížeče : 0 ¤¤¤

¤¤¤ Kontrola MBR : ¤¤¤
+++++ PhysicalDrive0: +++++
--- User ---
[MBR] 7171d0871ecf422c6f1e6468e9514b75
[BSP] f6be99a16529a7bbd022531c496ff447 : Windows Vista/7/8 MBR Code
Partition table:
0 - [ACTIVE] NTFS (0x7) [VISIBLE] Offset (sectors): 2048 | Size: 199 MB [Windows Vista/7/8 Bootstrap | Windows Vista/7/8 Bootloader]
1 - [XXXXXX] NTFS (0x7) [VISIBLE] Offset (sectors): 409600 | Size: 456107 MB [Windows Vista/7/8 Bootstrap | Windows Vista/7/8 Bootloader]
2 - [XXXXXX] NTFS (0x7) [VISIBLE] Offset (sectors): 934516736 | Size: 16569 MB [Windows Vista/7/8 Bootstrap | Windows Vista/7/8 Bootloader]
3 - [XXXXXX] FAT32-LBA (0xc) [VISIBLE] Offset (sectors): 968450048 | Size: 4063 MB
User = LL1 ... OK
User = LL2 ... OK

[Orcus]

Ty procesy, které se pohybují, není to náhodou položka "Nečinné procesy systému Windows" ?

Stáhni
Zoek.exe

a ulož si ho na plochu.
Zavři všechny ostatní programy, okna i prohlížeče.
Spusť Zoek.exe ( u win vista , win7, 8 klikni na něj pravým a vyber : „Spustit jako správce“
- pozor, náběh programu může trvat déle.

Do okna programu vlož skript níže:

Kód: Vybrat vše

autoclean;
emptyclsid;
iedefaults;
FFdefaults;
CHRdefaults;
emptyalltemp;
resethosts;

Klikni na Run Script
Program provede sken, opravu, sken i oprava může trvat i více minut, je třeba posečkat do konce. Do okna neklikej!
Program nabídne restart , potvrď .

Po restartu se může nějaký čas ukázat pouze černá plocha , to je normální. Je třeba počkat až se vytvoří log. Ten si můžeš uložit třeba do dokumentů, jinak se sám ukládá do:
C:\zoek-results.log
Zkopíruj sem celý obsah toho logu.

====================================================

Vypni rezidentní štít antiviru a antispywaru
Stáhni si ComboFix (by sUBs)
a ulož si ho na plochu.
Ukonči všechna aktivní okna a spusť ho.
- Po spuštění se zobrazí podmínky užití, potvrď je stiskem tlačítka Ano
- Dále postupuj dle pokynů, během aplikování ComboFixu neklikej do zobrazujícího se okna
- Po dokončení skenování by měl program vytvořit log - C:\ComboFix.txt - zkopíruj sem prosím celý jeho obsah
Pokud bude po kontrole problém spustit aplikace nebo bude vyskakovat hláška o pokusu použít neplatnou operaci na klíč registru, který je označen pro odstranění, stačí restartovat počítač.

Pokud budou problémy , spusť v nouz. režimu.

[Standa410]

Výpis zoek:


Zoek.exe v5.0.0.1 Updated 25-October-2015
Tool run by Kurilovi on Łt 27.10.2015 at 7:11:17,75.
Microsoft Windows 7 Home Premium 6.1.7601 Service Pack 1 x64
Running in: Normal Mode Internet Access Detected
Launched: C:\Users\Kurilovi\Desktop\zoek.exe [Scan all users] [Script inserted]

==== System Restore Info ======================

27.10.2015 7:12:29 Zoek.exe System Restore Point Created Successfully.

==== Reset Hosts File ======================

# Copyright (c) 1993-2006 Microsoft Corp.
#
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
#
# This file contains the mappings of IP addresses to host names. Each
# entry should be kept on an individual line. The IP address should
# be placed in the first column followed by the corresponding host name.
# The IP address and the host name should be separated by at least one
# space.
#
# Additionally, comments (such as these) may be inserted on individual
# lines or following the machine name denoted by a '#' symbol.
#
# For example:
#
# 102.54.94.97 rhino.acme.com # source server
# 38.25.63.10 x.acme.com # x client host

# localhost name resolution is handled within DNS itself.
127.0.0.1 localhost
::1 localhost

==== Empty Folders Check ======================

C:\PROGRA~2\COMMON~1\Symantec Shared deleted successfully
C:\Users\Kurilovi\AppData\Roaming\TP deleted successfully
C:\Users\Kurilovi\AppData\Local\EmieBrowserModeList deleted successfully
C:\Users\Kurilovi\AppData\Local\EmieSiteList deleted successfully
C:\Users\Kurilovi\AppData\Local\EmieUserList deleted successfully
C:\Users\Kurilovi\AppData\Local\GHISLER deleted successfully
C:\Users\Kurilovi\AppData\Local\VirtualStore deleted successfully

==== Deleting CLSID Registry Keys ======================


==== Deleting CLSID Registry Values ======================

HKEY_USERS\S-1-5-21-3019679101-1790982347-430900124-1002\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} deleted successfully

==== Deleting Services ======================


==== FireFox Fix ======================

Deleted from C:\Users\Kurilovi\AppData\Roaming\Mozilla\Firefox\Profiles\bzpw867r.default\prefs.js:
user_pref("browser.startup.homepage", "https://www.google.cz/?gws_rd=ssl");
user_pref("browser.search.selectedEngine", "Bing ");
user_pref("keyword.URL", "http://www.bing.com/search?FORM=SKY2DF&PC=SKY2&q=");

Added to C:\Users\Kurilovi\AppData\Roaming\Mozilla\Firefox\Profiles\bzpw867r.default\prefs.js:
user_pref("browser.startup.homepage", "about:home");
user_pref("browser.newtab.url", "about:newtab");

==== Deleting Files \ Folders ======================

C:\PROGRA~3\{18165758-115C-4DC0-9EC2-FF89F725767F} deleted
C:\Windows\wininit.ini deleted
C:\Windows\SysNative\config\systemprofile\Searches deleted
C:\Users\Kurilovi\AppData\Roaming\Mozilla\Firefox\Profiles\bzpw867r.default\extensions\bingsearch.full@microsoft.com deleted
"C:\Windows\Installer\20978667.msi" deleted

==== Firefox Start and Search pages ======================

ProfilePath: C:\Users\Kurilovi\AppData\Roaming\Mozilla\Firefox\Profiles\bzpw867r.default
user_pref("browser.startup.homepage", "about:home");
user_pref("browser.newtab.url", "about:newtab");

==== Firefox Extensions Registry ======================

[HKEY_CURRENT_USER\Software\Mozilla\Firefox\Extensions]
"DSE"="true" []

==== Firefox Extensions ======================

ProfilePath: C:\Users\Kurilovi\AppData\Roaming\Mozilla\Firefox\Profiles\bzpw867r.default
- Adblock Plus - %ProfilePath%\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi

AppDir: C:\Program Files (x86)\Mozilla Firefox
- Default - %AppDir%\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
- Skype Click to Call - %AppDir%\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}.xpi

==== Firefox Plugins ======================

Profilepath: C:\Users\Kurilovi\AppData\Roaming\Mozilla\Firefox\Profiles\bzpw867r.default
855B79451ECF62602F20EB4D5C71F99B - C:\Windows\SysWoW64\Adobe\Director\np32dsw.dll - Shockwave for Director / Shockwave for Director
863AF0003392FEBC2667A8A790DED955 - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_19_0_0_226.dll - Shockwave Flash


==== Chromium Look ======================

Skype for Chromium - Kurilovi\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl

==== Set IE to Default ======================

Old Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"="http://www.google.cz/"
"Default_Page_URL"="http://www.bing.com?pc=CPNTDF"

New Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Default_Page_URL"="http://go.microsoft.com/fwlink/?LinkId=69157"
"Start Page"="http://www.google.cz/"

==== All HKCU SearchScopes ======================

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes
"DefaultScope"="{0633EE93-D776-472f-A0FF-E1416B8B2E3A}"
{012E1000-F331-11DB-8314-0800200C9A66} Google Url="http://www.google.com/search?q={searchTerms}"
{0633EE93-D776-472f-A0FF-E1416B8B2E3A} Bing Url="http://www.bing.com/search?q={searchTerms}&form=CPNTDF&pc=CPNTDF&src=IE-SearchBox"

==== Reset Google Chrome ======================

C:\Users\Kurilovi\AppData\Local\Google\Chrome\User Data\Default\Preferences was reset successfully
C:\Users\Kurilovi\AppData\Local\Google\Chrome\User Data\Default\Web Data was reset successfully

==== Deleting CLSID Registry Keys ======================


==== Deleting CLSID Registry Values ======================


==== Deleting Registry Keys ======================

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\AB1DAB1E8E0C810429187E2D6C0B4747 deleted successfully
HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{E1BAD1BA-C0E8-4018-9281-E7D2C6B07474} deleted successfully
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\AB1DAB1E8E0C810429187E2D6C0B4747 deleted successfully

==== Empty IE Cache ======================

C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\Kurilovi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\SysNative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully

==== Empty FireFox Cache ======================

C:\Users\Kurilovi\AppData\Local\Mozilla\Firefox\Profiles\bzpw867r.default\cache2 emptied successfully

==== Empty Chrome Cache ======================

C:\Users\Kurilovi\AppData\Local\Google\Chrome\User Data\Default\Cache emptied successfully

==== Empty All Flash Cache ======================

Flash Cache Emptied Successfully

==== Empty All Java Cache ======================

Java Cache cleared successfully

==== C:\zoek_backup content ======================

C:\zoek_backup (files=13 folders=3 53112925 bytes)

==== Empty Temp Folders ======================

C:\Users\Default\AppData\Local\Temp emptied successfully
C:\Users\Default User\AppData\Local\Temp emptied successfully
C:\Users\Kurilovi\AppData\Local\Temp will be emptied at reboot
C:\Windows\serviceprofiles\networkservice\AppData\Local\Temp will be emptied at reboot
C:\Windows\serviceprofiles\Localservice\AppData\Local\Temp emptied successfully
C:\Windows\Temp will be emptied at reboot

==== After Reboot ======================

==== Empty Temp Folders ======================

C:\Windows\Temp successfully emptied
C:\Users\Kurilovi\AppData\Local\Temp successfully emptied

==== Empty Recycle Bin ======================

C:\$RECYCLE.BIN successfully emptied

==== Deleting Files / Folders ======================

"C:\Windows\serviceprofiles\networkservice\AppData\Local\Temp\Low" not deleted

==== EOF on Łt 27.10.2015 at 7:50:12,00 ======================

[Standa410]

Výsledek ComboFix:

ComboFix 15-10-27.01 - Kurilovi 27.10.2015 16:07:45.1.2 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1250.420.1029.18.3691.1652 [GMT 1:00]
Spuštěný z: c:\st+íhnut+ę soubory\ComboFix.exe
AV: ESET Smart Security 8.0 *Enabled/Updated* {19259FAE-8396-A113-46DB-15B0E7DFA289}
FW: ESET Personální firewall *Enabled* {211E1E8B-C9F9-A04B-6D84-BC85190CE5F2}
SP: ESET Smart Security 8.0 *Enabled/Updated* {A2447E4A-A5AC-AE9D-7C6B-2EC29C58E834}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* Rezidentní štít AV je zapnutý
.
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2015-09-27 do 2015-10-27 )))))))))))))))))))))))))))))))
.
.
2015-10-27 16:27 . 2015-10-27 16:27 -------- d-----w- c:\users\Default\AppData\Local\temp
2015-10-27 15:13 . 2015-10-27 15:13 75888 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{69AAD736-C722-4A88-ADFF-4A4B16EF4EC7}\offreg.2136.dll
2015-10-27 13:26 . 2015-10-13 09:47 11140960 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{69AAD736-C722-4A88-ADFF-4A4B16EF4EC7}\mpengine.dll
2015-10-27 07:06 . 2015-10-27 07:06 -------- d-----w- c:\users\Kurilovi\AppData\Local\GHISLER
2015-10-27 06:49 . 2015-10-27 06:49 -------- d-----w- c:\users\Kurilovi\AppData\Local\VirtualStore
2015-10-27 06:47 . 2015-10-27 06:11 24064 ----a-w- c:\windows\zoek-delete.exe
2015-10-27 06:47 . 2015-10-27 16:27 -------- d-----w- c:\users\Kurilovi\AppData\Local\Temp
2015-10-27 06:11 . 2015-10-27 06:48 -------- d-----w- C:\zoek_backup
2015-10-27 05:59 . 2015-10-27 13:30 37624 ----a-w- c:\windows\system32\drivers\TrueSight.sys
2015-10-27 05:59 . 2015-10-27 06:04 -------- d-----w- c:\programdata\RogueKiller
2015-10-27 05:24 . 2015-07-16 19:11 7077376 ----a-w- c:\windows\system32\mstscax.dll
2015-10-27 05:24 . 2015-07-11 13:15 429568 ----a-w- c:\windows\system32\wksprt.exe
2015-10-27 05:24 . 2015-07-16 19:12 6131200 ----a-w- c:\windows\SysWow64\mstscax.dll
2015-10-27 05:24 . 2015-07-16 19:12 856064 ----a-w- c:\windows\SysWow64\rdvidcrl.dll
2015-10-27 05:24 . 2015-07-16 19:12 53248 ----a-w- c:\windows\SysWow64\tsgqec.dll
2015-10-27 05:24 . 2015-07-16 19:11 62976 ----a-w- c:\windows\system32\tsgqec.dll
2015-10-27 05:24 . 2015-07-16 19:11 1057792 ----a-w- c:\windows\system32\rdvidcrl.dll
2015-10-27 05:23 . 2014-12-11 17:47 87040 ----a-w- c:\windows\system32\TSWbPrxy.exe
2015-10-26 20:46 . 2015-10-26 20:47 192216 ----a-w- c:\windows\system32\drivers\MBAMSwissArmy.sys
2015-10-26 20:45 . 2015-10-05 08:50 63704 ----a-w- c:\windows\system32\drivers\mwac.sys
2015-10-26 20:45 . 2015-10-05 08:50 109272 ----a-w- c:\windows\system32\drivers\mbamchameleon.sys
2015-10-26 20:45 . 2015-10-05 08:50 25816 ----a-w- c:\windows\system32\drivers\mbam.sys
2015-10-26 20:45 . 2015-10-26 20:45 -------- d-----w- c:\program files (x86)\Malwarebytes Anti-Malware
2015-10-26 20:45 . 2015-10-26 20:45 -------- d-----w- c:\programdata\Malwarebytes
2015-10-26 19:51 . 2015-10-26 20:37 -------- d-----w- C:\AdwCleaner
2015-10-26 17:39 . 2013-10-02 01:10 44544 ----a-w- c:\windows\system32\TsUsbGDCoInstaller.dll
2015-10-26 17:39 . 2013-10-02 04:38 3072 ----a-w- c:\windows\system32\drivers\en-US\tsusbflt.sys.mui
2015-10-26 17:39 . 2013-10-02 02:22 56832 ----a-w- c:\windows\system32\drivers\TsUsbFlt.sys
2015-10-26 17:39 . 2013-10-02 02:11 13824 ----a-w- c:\windows\system32\TsUsbRedirectionGroupPolicyControl.exe
2015-10-26 17:39 . 2013-10-02 02:08 12800 ----a-w- c:\windows\system32\TsUsbRedirectionGroupPolicyExtension.dll
2015-10-26 17:39 . 2013-10-02 01:48 56832 ----a-w- c:\windows\system32\MsRdpWebAccess.dll
2015-10-26 17:39 . 2013-10-02 01:48 18944 ----a-w- c:\windows\system32\wksprtPS.dll
2015-10-26 17:39 . 2013-10-02 00:14 50176 ----a-w- c:\windows\SysWow64\MsRdpWebAccess.dll
2015-10-26 17:39 . 2013-10-02 00:14 17920 ----a-w- c:\windows\SysWow64\wksprtPS.dll
2015-10-26 17:39 . 2013-10-01 23:31 1147392 ----a-w- c:\windows\system32\mstsc.exe
2015-10-26 17:39 . 2013-10-01 22:34 1068544 ----a-w- c:\windows\SysWow64\mstsc.exe
2015-10-26 17:18 . 2015-08-06 18:04 14176768 ----a-w- c:\windows\system32\shell32.dll
2015-10-26 17:18 . 2015-08-06 18:03 1866752 ----a-w- c:\windows\system32\ExplorerFrame.dll
2015-10-26 17:18 . 2015-08-06 17:44 1498624 ----a-w- c:\windows\SysWow64\ExplorerFrame.dll
2015-10-26 17:17 . 2015-08-05 17:56 22528 ----a-w- c:\windows\system32\icaapi.dll
2015-10-26 17:17 . 2015-08-05 17:06 39936 ----a-w- c:\windows\system32\drivers\tssecsrv.sys
2015-10-26 17:15 . 2015-09-29 03:11 362496 ----a-w- c:\windows\system32\wow64win.dll
2015-10-26 17:13 . 2015-09-25 18:07 3168768 ----a-w- c:\windows\system32\wucltux.dll
2015-10-26 17:05 . 2015-07-18 13:08 984448 ----a-w- c:\windows\system32\ucrtbase.dll
2015-10-26 17:02 . 2015-09-14 19:45 3210240 ----a-w- c:\windows\system32\win32k.sys
2015-10-17 10:59 . 2015-10-17 10:59 3996360 ----a-w- c:\windows\SysWow64\FlashPlayerInstaller.exe
2015-10-13 08:13 . 2015-10-13 08:13 -------- d-----w- c:\program files\Common Files\AV
2015-10-13 08:03 . 2015-10-13 08:03 -------- d-----w- c:\program files\CCleaner
2015-10-13 07:59 . 2015-10-13 16:01 -------- d-----w- c:\programdata\Spybot - Search & Destroy
2015-10-13 07:59 . 2015-10-13 16:03 -------- d-----w- c:\program files (x86)\Spybot - Search & Destroy 2
2015-10-13 07:58 . 2015-10-13 07:58 -------- d-----w- c:\users\Kurilovi\AppData\Local\Programs
2015-10-12 18:02 . 2015-10-12 18:02 -------- d-----w- c:\users\Kurilovi\AppData\Roaming\IObit
2015-10-12 18:02 . 2015-10-12 18:02 -------- d-----w- c:\program files (x86)\IObit
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2015-10-26 17:43 . 2012-03-31 17:10 143481208 ----a-w- c:\windows\system32\MRT.exe
2015-10-17 10:59 . 2013-09-14 09:46 780488 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2015-10-17 10:59 . 2011-08-10 17:33 142536 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2015-09-29 02:58 . 2015-10-26 17:15 44032 ----a-w- c:\windows\apppatch\acwow64.dll
2015-09-15 18:11 . 2015-10-26 17:16 342016 ----a-w- c:\windows\system32\schannel.dll
2015-09-15 17:36 . 2015-10-26 17:16 248832 ----a-w- c:\windows\SysWow64\schannel.dll
2015-09-02 03:04 . 2015-09-12 10:37 41984 ----a-w- c:\windows\system32\lpk.dll
2015-09-02 03:04 . 2015-09-12 10:37 100864 ----a-w- c:\windows\system32\fontsub.dll
2015-09-02 03:04 . 2015-09-12 10:37 14336 ----a-w- c:\windows\system32\dciman32.dll
2015-09-02 03:04 . 2015-09-12 10:37 46080 ----a-w- c:\windows\system32\atmlib.dll
2015-09-02 02:48 . 2015-09-12 10:37 70656 ----a-w- c:\windows\SysWow64\fontsub.dll
2015-09-02 02:48 . 2015-09-12 10:37 10240 ----a-w- c:\windows\SysWow64\dciman32.dll
2015-09-02 02:48 . 2015-09-12 10:37 34304 ----a-w- c:\windows\SysWow64\atmlib.dll
2015-09-02 02:47 . 2015-09-12 10:37 25600 ----a-w- c:\windows\SysWow64\lpk.dll
2015-09-02 01:47 . 2015-09-12 10:37 372736 ----a-w- c:\windows\system32\atmfd.dll
2015-09-02 01:33 . 2015-09-12 10:37 299520 ----a-w- c:\windows\SysWow64\atmfd.dll
2015-08-27 18:18 . 2015-09-12 10:37 2004480 ----a-w- c:\windows\system32\msxml6.dll
2015-08-27 18:18 . 2015-09-12 10:37 1887232 ----a-w- c:\windows\system32\msxml3.dll
2015-08-27 18:13 . 2015-09-12 10:37 2048 ----a-w- c:\windows\system32\msxml6r.dll
2015-08-27 18:13 . 2015-09-12 10:37 2048 ----a-w- c:\windows\system32\msxml3r.dll
2015-08-27 17:58 . 2015-09-12 10:37 1391104 ----a-w- c:\windows\SysWow64\msxml6.dll
2015-08-27 17:58 . 2015-09-12 10:37 1241088 ----a-w- c:\windows\SysWow64\msxml3.dll
2015-08-27 17:51 . 2015-09-12 10:37 2048 ----a-w- c:\windows\SysWow64\msxml6r.dll
2015-08-27 17:51 . 2015-09-12 10:37 2048 ----a-w- c:\windows\SysWow64\msxml3r.dll
2015-08-26 07:28 . 2015-07-29 17:11 163504 ----a-w- c:\programdata\Microsoft\Windows\Sqm\Manifest\Sqm10145.bin
2015-08-05 17:56 . 2015-09-12 10:41 1110016 ----a-w- c:\windows\system32\schedsvc.dll
2015-08-05 17:56 . 2015-09-12 10:42 275456 ----a-w- c:\windows\system32\InkEd.dll
2015-08-05 17:40 . 2015-09-12 10:42 216064 ----a-w- c:\windows\SysWow64\InkEd.dll
2015-07-30 18:06 . 2015-08-14 10:23 1180160 ----a-w- c:\windows\system32\FntCache.dll
2015-07-30 18:06 . 2015-08-14 10:23 1648128 ----a-w- c:\windows\system32\DWrite.dll
2015-07-30 18:06 . 2015-08-14 10:23 2565120 ----a-w- c:\windows\system32\d3d10warp.dll
2015-07-30 17:57 . 2015-08-14 10:23 1251328 ----a-w- c:\windows\SysWow64\DWrite.dll
2015-07-30 17:57 . 2015-08-14 10:23 1987584 ----a-w- c:\windows\SysWow64\d3d10warp.dll
2015-07-30 13:13 . 2015-08-18 14:23 103120 ----a-w- c:\windows\SysWow64\PresentationCFFRasterizerNative_v0300.dll
2015-07-30 13:13 . 2015-08-18 14:23 124624 ----a-w- c:\windows\system32\PresentationCFFRasterizerNative_v0300.dll
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Skype"="c:\program files (x86)\Skype\Phone\Skype.exe" [2015-09-27 57981568]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2011-07-05 336384]
"HPQuickWebProxy"="c:\program files (x86)\Hewlett-Packard\HP QuickWeb\hpqwutils.exe" [2011-06-28 168504]
"Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe" [2015-09-24 40336]
"HPOSD"="c:\program files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe" [2011-06-13 336440]
"HP Quick Launch"="c:\program files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe" [2012-03-05 578944]
"EEventManager"="c:\program files (x86)\Epson Software\Event Manager\EEventManager.exe" [2011-10-31 1058400]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
"HideFastUserSwitching"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"EnableShellExecuteHooks"= 1 (0x1)
.
[hkey_local_machine\software\Wow6432Node\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0\0sdnclean64.exe
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Notification Packages REG_MULTI_SZ scecli c:\program files\WIDCOMM\Bluetooth Software\BtwProximityCP.dll
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes Anti-Malware\mbamservice.exe;c:\program files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [x]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]
R3 GamesAppService;GamesAppService;c:\program files (x86)\WildTangent Games\App\GamesAppService.exe;c:\program files (x86)\WildTangent Games\App\GamesAppService.exe [x]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x]
R3 MBAMWebAccessControl;MBAMWebAccessControl;c:\windows\system32\drivers\mwac.sys;c:\windows\SYSNATIVE\drivers\mwac.sys [x]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys;c:\windows\SYSNATIVE\drivers\rdpvideominiport.sys [x]
R3 SrvHsfHDA;SrvHsfHDA;c:\windows\system32\DRIVERS\VSTAZL6.SYS;c:\windows\SYSNATIVE\DRIVERS\VSTAZL6.SYS [x]
R3 SrvHsfV92;SrvHsfV92;c:\windows\system32\DRIVERS\VSTDPV6.SYS;c:\windows\SYSNATIVE\DRIVERS\VSTDPV6.SYS [x]
R3 SrvHsfWinac;SrvHsfWinac;c:\windows\system32\DRIVERS\VSTCNXT6.SYS;c:\windows\SYSNATIVE\DRIVERS\VSTCNXT6.SYS [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys;c:\windows\SYSNATIVE\drivers\TsUsbGD.sys [x]
R3 WatAdminSvc;Služba Technologie aktivace Windows;c:\windows\system32\Wat\WatAdminSvc.exe;c:\windows\SYSNATIVE\Wat\WatAdminSvc.exe [x]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe;c:\program files\Windows Live\Mesh\wlcrasvc.exe [x]
S0 amd_sata;amd_sata;c:\windows\system32\DRIVERS\amd_sata.sys;c:\windows\SYSNATIVE\DRIVERS\amd_sata.sys [x]
S0 amd_xata;amd_xata;c:\windows\system32\DRIVERS\amd_xata.sys;c:\windows\SYSNATIVE\DRIVERS\amd_xata.sys [x]
S0 epfwwfp;epfwwfp;c:\windows\system32\DRIVERS\epfwwfp.sys;c:\windows\SYSNATIVE\DRIVERS\epfwwfp.sys [x]
S1 eamonm;eamonm;c:\windows\system32\DRIVERS\eamonm.sys;c:\windows\SYSNATIVE\DRIVERS\eamonm.sys [x]
S1 ehdrv;ehdrv;c:\windows\system32\DRIVERS\ehdrv.sys;c:\windows\SYSNATIVE\DRIVERS\ehdrv.sys [x]
S1 EpfwLWF;Epfw NDIS LightWeight Filter;c:\windows\system32\DRIVERS\EpfwLWF.sys;c:\windows\SYSNATIVE\DRIVERS\EpfwLWF.sys [x]
S2 AERTFilters;Andrea RT Filters Service;c:\program files\Realtek\Audio\HDA\AERTSr64.exe;c:\program files\Realtek\Audio\HDA\AERTSr64.exe [x]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe;c:\windows\SYSNATIVE\atiesrxx.exe [x]
S2 AMD FUEL Service;AMD FUEL Service;c:\program files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe;c:\program files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [x]
S2 c2cautoupdatesvc;Skype Click to Call Updater;c:\program files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe;c:\program files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [x]
S2 c2cpnrsvc;Skype Click to Call PNR Service;c:\program files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe;c:\program files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [x]
S2 DiagTrack;Diagnostics Tracking Service;c:\windows\System32\svchost.exe;c:\windows\SYSNATIVE\svchost.exe [x]
S2 ekrn;ESET Service;c:\program files\ESET\ESET Smart Security\x86\ekrn.exe;c:\program files\ESET\ESET Smart Security\x86\ekrn.exe [x]
S2 EpsonScanSvc;Epson Scanner Service;c:\windows\system32\EscSvc64.exe;c:\windows\SYSNATIVE\EscSvc64.exe [x]
S2 ezSharedSvc;Easybits Services for Windows;c:\windows\System32\ezSharedSvcHost.exe;c:\windows\SYSNATIVE\ezSharedSvcHost.exe [x]
S2 HP Support Assistant Service;HP Support Assistant Service;c:\program files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe;c:\program files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe [x]
S2 HPClientSvc;HP Client Services;c:\program files\Hewlett-Packard\HP Client Services\HPClientServices.exe;c:\program files\Hewlett-Packard\HP Client Services\HPClientServices.exe [x]
S2 HPDrvMntSvc.exe;HP Quick Synchronization Service;c:\program files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe;c:\program files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe [x]
S2 HPWMISVC;HPWMISVC;c:\program files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe;c:\program files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe [x]
S2 IconMan_R;IconMan_R;c:\program files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe;c:\program files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe [x]
S3 amdiox64;AMD IO Driver;c:\windows\system32\DRIVERS\amdiox64.sys;c:\windows\SYSNATIVE\DRIVERS\amdiox64.sys [x]
S3 bcbtums;Bluetooth RAM Firmware Download USB Filter;c:\windows\system32\drivers\bcbtums.sys;c:\windows\SYSNATIVE\drivers\bcbtums.sys [x]
S3 btwampfl;btwampfl;c:\windows\system32\DRIVERS\btwampfl.sys;c:\windows\SYSNATIVE\DRIVERS\btwampfl.sys [x]
S3 BTWDPAN;Bluetooth Personal Area Network;c:\windows\system32\DRIVERS\btwdpan.sys;c:\windows\SYSNATIVE\DRIVERS\btwdpan.sys [x]
S3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\DRIVERS\btwl2cap.sys;c:\windows\SYSNATIVE\DRIVERS\btwl2cap.sys [x]
S3 clwvd;CyberLink WebCam Virtual Driver;c:\windows\system32\DRIVERS\clwvd.sys;c:\windows\SYSNATIVE\DRIVERS\clwvd.sys [x]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys;c:\windows\SYSNATIVE\drivers\mbam.sys [x]
S3 RSPCIESTOR;Realtek PCIE CardReader Driver;c:\windows\system32\DRIVERS\RtsPStor.sys;c:\windows\SYSNATIVE\DRIVERS\RtsPStor.sys [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x]
S3 usbfilter;AMD USB Filter Driver;c:\windows\system32\DRIVERS\usbfilter.sys;c:\windows\SYSNATIVE\DRIVERS\usbfilter.sys [x]
.
.
--- Ostatní služby/ovladače v paměti ---
.
*Deregistered* - TrueSight
.
Obsah adresáře 'Naplánované úlohy'
.
2015-10-27 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-09-14 10:59]
.
2015-10-07 c:\windows\Tasks\HPCeeScheduleForKurilovi.job
- c:\program files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2011-07-15 03:43]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDVCPL"="c:\program files\Realtek\Audio\HDA\RtkNGUI64.exe" [2011-01-11 6602856]
"SetDefault"="c:\program files\Hewlett-Packard\HP LaunchBox\SetDefault.exe" [2011-06-27 42808]
"egui"="c:\program files\ESET\ESET Smart Security\egui.exe" [2015-07-08 5595848]
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.google.cz/
IE: Odeslat obrázek do zařízení &Bluetooth... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: Odeslat stránku do zařízení &Bluetooth... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
TCP: DhcpNameServer = 192.168.1.1
FF - ProfilePath - c:\users\Kurilovi\AppData\Roaming\Mozilla\Firefox\Profiles\bzpw867r.default\
FF - prefs.js: browser.startup.homepage - hxxps://www.google.cz/?gws_rd=ssl
FF - prefs.js: network.proxy.type - 0
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
.
HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start
HKLM-Run-SynTPEnh - c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe
AddRemove-Adobe Shockwave Player - c:\windows\system32\Adobe\Shockwave 11\uninstaller.exe
AddRemove-EasyBits Magic Desktop - c:\windows\system32\ezMDUninstall.exe
.
.
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_19_0_0_226_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_19_0_0_226_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}]
@Denied: (A 2) (Everyone)
@="IFlashBroker6"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_19_0_0_226_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_19_0_0_226_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_19_0_0_226.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.19"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_19_0_0_226.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_19_0_0_226.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_19_0_0_226.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}]
@Denied: (A 2) (Everyone)
@="IFlashBroker6"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Celkový čas: 2015-10-27 17:33:44
ComboFix-quarantined-files.txt 2015-10-27 16:33
.
Před spuštěním: Volných bajtů: 414 355 427 328
Po spuštění: Volných bajtů: 413 902 991 360
.
- - End Of File - - BC2B944D8D3842177FBB1B98F0885852
A36C5E4F47E84449FF07ED3517B43A31

[jerabina]

Odinstaluj Spybot - Search & Destroy 2 a vše od IOBitu

Vypni rez. ochranu u antiviru a antispywaru,příp. firewall..

Otevři si Poznámkový blok (Start -> Spustit... a napiš do okna Notepad a dej Ok.
Zkopíruj do něj následující celý text označený zeleně:

Kód: Vybrat vše

ClearJavaCache::
KillAll::

Folder::
c:\programdata\Spybot - Search & Destroy
c:\program files (x86)\Spybot - Search & Destroy 2
c:\users\Kurilovi\AppData\Roaming\IObit
c:\program files (x86)\IObit
c:\program files (x86)\Skype\Updater
c:\program files (x86)\Skype\Toolbars\AutoUpdate

File::
c:\windows\Tasks\Adobe Flash Player Updater.job

Registry::
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Skype"=-

Driver::
SkypeUpdate
c2cautoupdatesvc

DDS::
FF - prefs.js: network.proxy.type - 0

RegLock::
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_19_0_0_226_ActiveX.exe,-101"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\Elevation]
"Enabled"=dword:00000001

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_19_0_0_226_ActiveX.exe"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}]
@Denied: (A 2) (Everyone)
@="IFlashBroker6"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_19_0_0_226_ActiveX.exe,-101"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\Elevation]
"Enabled"=dword:00000001

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_19_0_0_226_ActiveX.exe"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_19_0_0_226.ocx"
"ThreadingModel"="Apartment"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.19"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_19_0_0_226.ocx, 1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_19_0_0_226.ocx"
"ThreadingModel"="Apartment"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_19_0_0_226.ocx, 1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}]
@Denied: (A 2) (Everyone)
@="IFlashBroker6"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)

Zvol možnost Soubor -> Uložit jako... a nastav tyto parametry:
Název souboru: zde napiš: CFScript.txt
Uložit jako typ: tak tam vyber Všechny soubory
Ulož soubor na plochu.
Ukonči všechna aktivní okna.

Uchop myší vytvořený skript CFScript.txt, přemísti ho nad stažený program ComboFix.exe a když se oba soubory překryjí, skript upusť:

- Automaticky se spustí ComboFix
- Vlož sem log, který vyběhne v závěru čistícího procesu