Prosím o kontrolu logu , při spuštění vyskočí hláška Vyřešeno

[misut]

Prosím o kontrolu , při spuštění PC se objevila hláška viz obr.l , pomocí Tune Up jsem soubor našel a dal obnovit. Nyní vyskakuje hláška obr.2. Program ?? ComponentRent nějak vznikl před dvěma dny?? Nevím jak , ale dnes po pravidelném čištění PC pomocí SpyHunter a po restartu se tato hláška začala objevovat
Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 19:06:41, on 14.11.2015
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)

FIREFOX: 42.0 (x86 cs)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\ESET\ESET Smart Security\egui.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\CCleaner\CCleaner.exe
C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
C:\Program Files\CyberLink\PowerDVD11\Kernel\DMP\CLHNServiceForPowerDVD.exe
C:\Program Files\CyberLink\PowerDVD11\Common\MediaServer\CLMSMonitorService.exe
C:\Program Files\CyberLink\PowerDVD11\Common\MediaServer\CLMSServerForPDVD11.exe
C:\Program Files\ESET\ESET Smart Security\ekrn.exe
C:\Program Files\Nero\Update\NASvc.exe
C:\Program Files\RealNetworks\RealDownloader\rndlresolversvc.exe
C:\WINDOWS\System32\ssins.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\TuneUp Utilities 2013\TuneUpUtilitiesService32.exe
C:\Program Files\TuneUp Utilities 2013\TuneUpUtilitiesApp32.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Josef\Plocha\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
O2 - BHO: RealNetworks Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Documents and Settings\All Users\Data aplikací\RealNetworks\RealDownloader\BrowserPlugins\IE\rndlbrowserrecordplugin.dll
O3 - Toolbar: WebTranslator - {BFC32E1D-EE75-4A48-BC60-104E11EE2431} - (no file)
O3 - Toolbar: (no name) - {10EDB994-47F8-43F7-AE96-F2EA63E9F90F} - (no file)
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET Smart Security\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [SpyHunter Security Suite] "C:\DOCUME~1\Josef\LOCALS~1\Temp\RarSFX0\SpyHunter4.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [PCSpeedUp] C:\Program Files\Zrychleni Pocitace\PCSUNotifier.exe
O4 - HKCU\..\Run: [CCleaner Monitoring] "C:\Program Files\CCleaner\CCleaner.exe" /MONITOR
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Send To &Bluetooth - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O9 - Extra button: Odeslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Od&eslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: WebTran - {7E6A20FB-153F-402c-A84B-1A64E1955D3D} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {BFC32E1D-EE75-4A48-BC60-104E11EE2431} - (no file)
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748449} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra 'Tools' menuitem: &Nastavit překladač - {CC963627-B1DC-40E0-B52A-CF21EE748449} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748450} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra 'Tools' menuitem: &Slovník - {CC963627-B1DC-40E0-B52A-CF21EE748450} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748451} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra 'Tools' menuitem: Přeložit &označený text - {CC963627-B1DC-40E0-B52A-CF21EE748451} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748452} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra 'Tools' menuitem: Přeložit &stránku - {CC963627-B1DC-40E0-B52A-CF21EE748452} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O20 - AppInit_DLLs: c:\docume~1\alluse~1\dataap~1\browse~1\23796~1.11\{16cdf~1\browse~1.dll
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Proces mezipaměti kategorií součástí - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
O23 - Service: CLHNServiceForPowerDVD - Unknown owner - C:\Program Files\CyberLink\PowerDVD11\Kernel\DMP\CLHNServiceForPowerDVD.exe
O23 - Service: CyberLink PowerDVD 11.0 Monitor Service - CyberLink - C:\Program Files\CyberLink\PowerDVD11\Common\MediaServer\CLMSMonitorService.exe
O23 - Service: CyberLink PowerDVD 11.0 Service - CyberLink - C:\Program Files\CyberLink\PowerDVD11\Common\MediaServer\CLMSServerForPDVD11.exe
O23 - Service: ESET Service (ekrn) - ESET - C:\Program Files\ESET\ESET Smart Security\ekrn.exe
O23 - Service: @C:\Program Files\Nero\Update\NASvc.exe,-200 (NAUpdate) - Nero AG - C:\Program Files\Nero\Update\NASvc.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: RealNetworks Downloader Resolver Service - Unknown owner - C:\Program Files\RealNetworks\RealDownloader\rndlresolversvc.exe
O23 - Service: SInstalátor (ssinstall) - PS Media s.r.o. - C:\WINDOWS\System32\ssins.exe
O23 - Service: TuneUp Utilities Service (TuneUp.UtilitiesSvc) - TuneUp Software - C:\Program Files\TuneUp Utilities 2013\TuneUpUtilitiesService32.exe

--
End of file - 7401 bytes
Děkuji

[Reklama]

[misut]

[Orcus]

Odinstaluj:
TuneUp Utilities 2013 - to je to co ti bordel v OS nadělá a né vyřeší
SpyHunter
Zrychleni Pocitace - stejný jak TuneUp Utiliities

V HJT fixni:
O2 - BHO: RealNetworks Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Documents and Settings\All Users\Data aplikací\RealNetworks\RealDownloader\BrowserPlugins\IE\rndlbrowserrecordplugin.dll
O3 - Toolbar: WebTranslator - {BFC32E1D-EE75-4A48-BC60-104E11EE2431} - (no file)
O3 - Toolbar: (no name) - {10EDB994-47F8-43F7-AE96-F2EA63E9F90F} - (no file)
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k

+

Stáhni si ATF Cleaner
Poklepej na ATF Cleaner.exe, klikni na select all found, poté:
-Když používáš Firefox (Mozzila), klikni na Firefox nahoře a vyber: Select All, poté klikni na Empty Selected.
-Když používáš Operu, klikni nahoře na Operu a vyber: Select All, poté klikni na Empty Selected. Poté klikni na Main (hlavní stránku ) a klikni na Empty Selected.
Po vyčištění klikni na Exit k zavření programu.
ATF-Cleaner je jednoduchý nástroj na odstranění historie z webového prohlížeče. Program dokáže odstranit cache, cookies, historii a další stopy po surfování na Internetu. Mezi podporované prohlížeče patří Internet Explorer, Firefox a Opera. Aplikace navíc umí odstranit dočasné soubory Windows, vysypat koš atd.

- Pokud používáš jen Google Chrome , tak ATF nemusíš použít.

===================================================

Stáhni si TFC
Otevři soubor a zavři všechny ostatní okna, Klikni na Start k zahájení procesu. Program by neměl trvat dlouho.
Poté by se měl PC restartovat, pokud ne , proveď sám.

===================================================

Stáhni AdwCleaner (by Xplode)

Ulož si ho na svojí plochu
Ukonči všechny programy , okna a prohlížeče
Spusť program poklepáním a klikni na „Prohledat-Scan“
Po skenu se objeví log ( jinak je uložen systémovem disku jako AdwCleaner[R?].txt), jeho obsah sem celý vlož.

===================================================

Stáhni si Malwarebytes' Anti-Malware
- Při instalaci odeber zatržítko u „Povolit bezplatnou zkušební verzi Malwarebytes' Anti-Malware Premium“
- Nainstaluj a spusť ho
- na konci instalace se ujisti že máš zvoleny/zatrhnuty obě možnosti:

Aktualizace Malwarebytes' Anti-Malware
Spustit aplikaci Malwarebytes' Anti-Malware, pokud jo tak klikni na tlačítko konec

- pokud bude nalezena aktualizace, tak se stáhne a nainstaluje
- program se po té spustí a klikni na Skenovat nyní a
- po proběhnutí programu se ti objeví hláška vpravo dole tak klikni na Kopírovat do schránky a a vlož sem celý log.

- po té klikni na tlačítko Exit, objeví se ti hláška tak zvol Ano
(zatím nic nemaž!).

Pokud budou problémy , spusť v nouz. režimu.

[misut]

# AdwCleaner v5.020 - Logfile created 14/11/2015 at 20:42:28
# Updated 13/11/2015 by Xplode
# Database : 2015-11-13.3 [Server]
# Operating system : Microsoft Windows XP Service Pack 3 (x86)
# Username : Josef - MISUT
# Running from : C:\Documents and Settings\Josef\Plocha\AdwCleaner.exe
# Option : Scan
# Support : http://toolslib.net/forum

***** [ Services ] *****


***** [ Folders ] *****

Folder Found : C:\Documents and Settings\All Users\Data aplikací\apn
Folder Found : C:\Documents and Settings\All Users\Data aplikací\speedypc software
Folder Found : C:\Documents and Settings\All Users\Data aplikací\Systweak
Folder Found : C:\Documents and Settings\All Users\Data aplikací\Tarma Installer
Folder Found : C:\Documents and Settings\All Users\Nabídka Start\Programy\RegClean Pro
Folder Found : C:\Documents and Settings\All Users\Nabídka Start\Programy\Advanced System~Protector
Folder Found : C:\Documents and Settings\Josef\Data aplikací\DriverCure
Folder Found : C:\Documents and Settings\Josef\Data aplikací\speedypc software
Folder Found : C:\Documents and Settings\Josef\Data aplikací\Systweak
Folder Found : C:\Documents and Settings\Josef\Data aplikací\RPEng
Folder Found : C:\Documents and Settings\Josef\Local Settings\Data aplikací\globalUpdate
Folder Found : C:\Documents and Settings\Josef\Local Settings\Data aplikací\Systweak
Folder Found : C:\Program Files\Browser
Folder Found : C:\Program Files\uanisales
Folder Found : C:\Program Files\unisaeleSo
Folder Found : C:\Program Files\uuniiSalles
Folder Found : C:\WINDOWS\assembly\GAC_MSIL\QuickStoresToolbar

***** [ Files ] *****

File Found : C:\Documents and Settings\Josef\Data aplikací\Mozilla\Firefox\Profiles\pvst96ez.default-1447488994359\user.js
File Found : C:\WINDOWS\system32\roboot.exe
File Found : C:\WINDOWS\system32\sasnative32.exe

***** [ DLL ] *****


***** [ Shortcuts ] *****


***** [ Scheduled tasks ] *****

Task Found : f1a4a264-cde6-4974-96eb-6107201c720a-1-6
Task Found : f1a4a264-cde6-4974-96eb-6107201c720a-1-7
Task Found : f1a4a264-cde6-4974-96eb-6107201c720a-10_user
Task Found : f1a4a264-cde6-4974-96eb-6107201c720a-3
Task Found : f1a4a264-cde6-4974-96eb-6107201c720a-4
Task Found : f1a4a264-cde6-4974-96eb-6107201c720a-5
Task Found : f1a4a264-cde6-4974-96eb-6107201c720a-6
Task Found : f1a4a264-cde6-4974-96eb-6107201c720a-7

***** [ Registry ] *****

Value Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Run [pcspeedup]
Key Found : HKLM\SOFTWARE\Classes\globalUpdate.OneClickCtrl.10
Key Found : HKLM\SOFTWARE\Classes\globalUpdate.OneClickProcessLauncherMachine
Key Found : HKLM\SOFTWARE\Classes\globalUpdate.OneClickProcessLauncherMachine.1.0
Key Found : HKLM\SOFTWARE\Classes\globalUpdate.Update3WebControl.4
Key Found : HKLM\SOFTWARE\Classes\globalUpdateUpdate.CoCreateAsync
Key Found : HKLM\SOFTWARE\Classes\globalUpdateUpdate.CoCreateAsync.1.0
Key Found : HKLM\SOFTWARE\Classes\globalUpdateUpdate.CoreClass
Key Found : HKLM\SOFTWARE\Classes\globalUpdateUpdate.CoreClass.1
Key Found : HKLM\SOFTWARE\Classes\globalUpdateUpdate.CoreMachineClass
Key Found : HKLM\SOFTWARE\Classes\globalUpdateUpdate.CoreMachineClass.1
Key Found : HKLM\SOFTWARE\Classes\globalUpdateUpdate.CredentialDialogMachine
Key Found : HKLM\SOFTWARE\Classes\globalUpdateUpdate.CredentialDialogMachine.1.0
Key Found : HKLM\SOFTWARE\Classes\globalUpdateUpdate.OnDemandCOMClassMachine
Key Found : HKLM\SOFTWARE\Classes\globalUpdateUpdate.OnDemandCOMClassMachine.1.0
Key Found : HKLM\SOFTWARE\Classes\globalUpdateUpdate.OnDemandCOMClassMachineFallback
Key Found : HKLM\SOFTWARE\Classes\globalUpdateUpdate.OnDemandCOMClassMachineFallback.1.0
Key Found : HKLM\SOFTWARE\Classes\globalUpdateUpdate.OnDemandCOMClassSvc
Key Found : HKLM\SOFTWARE\Classes\globalUpdateUpdate.OnDemandCOMClassSvc.1.0
Key Found : HKLM\SOFTWARE\Classes\globalUpdateUpdate.ProcessLauncher
Key Found : HKLM\SOFTWARE\Classes\globalUpdateUpdate.ProcessLauncher.1.0
Key Found : HKLM\SOFTWARE\Classes\globalUpdateUpdate.Update3COMClassService
Key Found : HKLM\SOFTWARE\Classes\globalUpdateUpdate.Update3COMClassService.1.0
Key Found : HKLM\SOFTWARE\Classes\globalUpdateUpdate.Update3WebMachine
Key Found : HKLM\SOFTWARE\Classes\globalUpdateUpdate.Update3WebMachine.1.0
Key Found : HKLM\SOFTWARE\Classes\globalUpdateUpdate.Update3WebMachineFallback
Key Found : HKLM\SOFTWARE\Classes\globalUpdateUpdate.Update3WebMachineFallback.1.0
Key Found : HKLM\SOFTWARE\Classes\globalUpdateUpdate.Update3WebSvc
Key Found : HKLM\SOFTWARE\Classes\globalUpdateUpdate.Update3WebSvc.1.0
Key Found : HKLM\SOFTWARE\Classes\Prod.cap
Key Found : HKLM\SOFTWARE\MozillaPlugins\@staging.google.com/globalUpdate Update;version=10
Key Found : HKLM\SOFTWARE\MozillaPlugins\@staging.google.com/globalUpdate Update;version=4
Key Found : HKLM\SOFTWARE\Classes\AppID\globalupdate.exe
Key Found : HKCU\Software\5c6dddee66dee46
Key Found : HKLM\SOFTWARE\5ffc9b8f-8f7b-4758-b842-515fee0beba7
Key Found : HKLM\SOFTWARE\Google\Chrome\Extensions\pgafcinpmmpklohkojmllohdhomoefph
Key Found : HKLM\SOFTWARE\Classes\AppID\{4D076AB4-7562-427A-B5D2-BD96E19DEE56}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{059EACC2-1ABE-49E8-928D-DC8BD355B7A9}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{826D7151-8D99-434B-8540-082B8C2AE556}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{DE9028D0-5FFA-4E69-94E3-89EE8741F468}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}
Key Found : HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}
Key Found : HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8FFE}
Key Found : HKLM\SOFTWARE\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}
Key Found : HKLM\SOFTWARE\Classes\TypeLib\{11549FE4-7C5A-4C17-9FC3-56FC5162A994}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{98889811-442D-49DD-99D7-DC866BE87DBC}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{5645E0E7-FC12-43BF-A6E4-F9751942B298}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{C7BF8F4B-7BC7-4F42-B944-3D28A3A86D8A}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{5645E0E7-FC12-43BF-A6E4-F9751942B298}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{C7BF8F4B-7BC7-4F42-B944-3D28A3A86D8A}
Value Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID [{FE69C007-C452-4D3E-86D2-1730DF8BC871}]
Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5645E0E7-FC12-43BF-A6E4-F9751942B298}
Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5E89ACE9-E16B-499A-87B4-0DBF742404C1}
Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C7BF8F4B-7BC7-4F42-B944-3D28A3A86D8A}
Key Found : HKCU\Software\APN PIP
Key Found : HKCU\Software\InstalledBrowserExtensions
Key Found : HKCU\Software\OCS
Key Found : HKCU\Software\speedypc software
Key Found : HKCU\Software\systweak
Key Found : HKCU\Software\YahooPartnerToolbar
Key Found : HKCU\Software\_CrossriderRegNamePlaceHolder_
Key Found : HKCU\Software\WEBAPP
Key Found : HKCU\Software\Reg\Clean
Key Found : HKLM\SOFTWARE\InstalledBrowserExtensions
Key Found : HKLM\SOFTWARE\PIP
Key Found : HKLM\SOFTWARE\systweak
Key Found : HKLM\SOFTWARE\Tarma Installer
Key Found : HKLM\SOFTWARE\_CrossriderRegNamePlaceHolder_
Key Found : HKLM\SOFTWARE\Reg\Clean
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\MyFreeCodec
Key Found : HKU\.DEFAULT\Software\AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\A28B4D68DEBAA244EB686953B7074FEF
Key Found : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GLOBALUPDATE.EXE
Data Found : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows [AppInit_DLLs] - c:\docume~1\alluse~1\dataap~1\browse~1\23796~1.11\{16cdf~1\browse~1.dll

***** [ Web browsers ] *****

[C:\Documents and Settings\Josef\Data aplikací\Mozilla\Firefox\Profiles\o3t1ixmf.default-1399573057593\prefs.js] [Preference] Found : user_pref("browser.search.defaultenginename", "AVG Secure Search");
[C:\Documents and Settings\Josef\Data aplikací\Mozilla\Firefox\Profiles\o3t1ixmf.default-1399573057593\prefs.js] [Preference] Found : user_pref("browser.search.selectedEngine", "AVG Secure Search");
[C:\Documents and Settings\Josef\Data aplikací\Mozilla\Firefox\Profiles\o3t1ixmf.default-1399573057593\prefs.js] [Preference] Found : user_pref("browser.startup.homepage", "hxxps://isearch.avg.com/?cid={891EA42D-236A-4578-95C9-0290424830C9}&mid=&lang=en&ds=tt014&pr=sa&d=&v=&sap=hp");
[C:\Documents and Settings\Josef\Local Settings\Data aplikací\Google\Chrome\User Data\Default\Web data] [Search Provider] Found : istart.webssearches.com
[C:\Documents and Settings\Josef\Local Settings\Data aplikací\Google\Chrome\User Data\Default\Web data] [Search Provider] Found : webssearches

########## EOF - C:\AdwCleaner\AdwCleaner[S2].txt - [9120 bytes] ##########

Provedl jsem vše mimo posledního Malwarebytes' Anti-Malware , stáhl jsem ho z tvého odkazu a nejde naistalovat -
- runtime error 112:109

[jerabina]

MBAM tedy přeskočíme, na XP občas blbne.

Spusť znovu AdwCleaner (u Windows Vista či Windows7, klikni na AdwCleaner pravým a vyber „Spustit jako správce“
klikni na „Prohledat-Scan“, po prohledání klikni na „ Vymazat-Clean“

Program provede opravu, po automatickém restartu neukáže log (C:\AdwCleaner [C?].txt) , jeho obsah sem celý vlož.

Stáhni si Junkware Removal Tool by Thisisu

na svojí plochu.

Deaktivuj si svůj antivirový program. Pravým tl. myši klikni na JRT.exe a vyber „spustit jako správce“. Pro pokračování budeš vyzván ke stisknutí jakékoliv klávesy. Na nějakou klikni.
Začne skenování programu. Skenování může trvat dloho , podle množství nákaz. Po ukončení skenu se objeví log (JRT.txt) , který se uloží na ploše.
Zkopíruj sem prosím celý jeho obsah.

Stáhni si RogueKiller
32bit.:
http://www.sur-la-toile.com/RogueKiller/RogueKiller.exe
64bit.:
http://www.sur-la-toile.com/RogueKiller ... lerX64.exe
na svojí plochu.
- Zavři všechny ostatní programy a prohlížeče.
- Pro OS Vista a win7 spusť program RogueKiller.exe jako správce , u XP poklepáním.
- počkej až skončí Prescan -vyhledávání škodlivých procesů.
-Potom klikni na „Prohledat“.
- Program skenuje procesy PC. Po proskenování klikni na „Zpráva“celý obsah logu sem zkopíruj.
Pokud je program blokován , zkus ho spustit několikrát. Pokud dále program nepůjde spustit a pracovat, přejmenuj ho na winlogon.exe.

[misut]

AdwCleaner:

# AdwCleaner v5.021 - Logfile created 15/11/2015 at 09:13:21
# Updated 14/11/2015 by Xplode
# Database : 2015-11-13.3 [Server]
# Operating system : Microsoft Windows XP Service Pack 3 (x86)
# Username : Josef - MISUT
# Running from : C:\Documents and Settings\Josef\Plocha\adwcleaner_5.021.exe
# Option : Cleaning
# Support : http://toolslib.net/forum

***** [ Services ] *****


***** [ Folders ] *****

[-] Folder Deleted : C:\Documents and Settings\All Users\Data aplikací\apn
[-] Folder Deleted : C:\Documents and Settings\All Users\Data aplikací\speedypc software
[-] Folder Deleted : C:\Documents and Settings\All Users\Data aplikací\Systweak
[-] Folder Deleted : C:\Documents and Settings\All Users\Data aplikací\Tarma Installer
[-] Folder Deleted : C:\Documents and Settings\All Users\Nabídka Start\Programy\RegClean Pro
[-] Folder Deleted : C:\Documents and Settings\All Users\Nabídka Start\Programy\Advanced System~Protector
[-] Folder Deleted : C:\Documents and Settings\Josef\Data aplikací\DriverCure
[-] Folder Deleted : C:\Documents and Settings\Josef\Data aplikací\speedypc software
[-] Folder Deleted : C:\Documents and Settings\Josef\Data aplikací\Systweak
[-] Folder Deleted : C:\Documents and Settings\Josef\Data aplikací\RPEng
[-] Folder Deleted : C:\Documents and Settings\Josef\Local Settings\Data aplikací\globalUpdate
[-] Folder Deleted : C:\Documents and Settings\Josef\Local Settings\Data aplikací\Systweak
[-] Folder Deleted : C:\Program Files\Browser
[-] Folder Deleted : C:\Program Files\uanisales
[-] Folder Deleted : C:\Program Files\unisaeleSo
[-] Folder Deleted : C:\Program Files\uuniiSalles
[-] Folder Deleted : C:\WINDOWS\assembly\GAC_MSIL\QuickStoresToolbar

***** [ Files ] *****

[-] File Deleted : C:\Documents and Settings\Josef\Data aplikací\Mozilla\Firefox\Profiles\pvst96ez.default-1447488994359\user.js
[-] File Deleted : C:\WINDOWS\system32\roboot.exe
[-] File Deleted : C:\WINDOWS\system32\sasnative32.exe

***** [ DLLs ] *****


***** [ Shortcuts ] *****


***** [ Scheduled tasks ] *****

[-] Task Deleted : f1a4a264-cde6-4974-96eb-6107201c720a-1-6
[-] Task Deleted : f1a4a264-cde6-4974-96eb-6107201c720a-1-7
[-] Task Deleted : f1a4a264-cde6-4974-96eb-6107201c720a-10_user
[-] Task Deleted : f1a4a264-cde6-4974-96eb-6107201c720a-3
[-] Task Deleted : f1a4a264-cde6-4974-96eb-6107201c720a-4
[-] Task Deleted : f1a4a264-cde6-4974-96eb-6107201c720a-5
[-] Task Deleted : f1a4a264-cde6-4974-96eb-6107201c720a-6
[-] Task Deleted : f1a4a264-cde6-4974-96eb-6107201c720a-7

***** [ Registry ] *****

[-] Value Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Run [pcspeedup]
[-] Key Deleted : HKLM\SOFTWARE\Classes\globalUpdate.OneClickCtrl.10
[-] Key Deleted : HKLM\SOFTWARE\Classes\globalUpdate.OneClickProcessLauncherMachine
[-] Key Deleted : HKLM\SOFTWARE\Classes\globalUpdate.OneClickProcessLauncherMachine.1.0
[-] Key Deleted : HKLM\SOFTWARE\Classes\globalUpdate.Update3WebControl.4
[-] Key Deleted : HKLM\SOFTWARE\Classes\globalUpdateUpdate.CoCreateAsync
[-] Key Deleted : HKLM\SOFTWARE\Classes\globalUpdateUpdate.CoCreateAsync.1.0
[-] Key Deleted : HKLM\SOFTWARE\Classes\globalUpdateUpdate.CoreClass
[-] Key Deleted : HKLM\SOFTWARE\Classes\globalUpdateUpdate.CoreClass.1
[-] Key Deleted : HKLM\SOFTWARE\Classes\globalUpdateUpdate.CoreMachineClass
[-] Key Deleted : HKLM\SOFTWARE\Classes\globalUpdateUpdate.CoreMachineClass.1
[-] Key Deleted : HKLM\SOFTWARE\Classes\globalUpdateUpdate.CredentialDialogMachine
[-] Key Deleted : HKLM\SOFTWARE\Classes\globalUpdateUpdate.CredentialDialogMachine.1.0
[-] Key Deleted : HKLM\SOFTWARE\Classes\globalUpdateUpdate.OnDemandCOMClassMachine
[-] Key Deleted : HKLM\SOFTWARE\Classes\globalUpdateUpdate.OnDemandCOMClassMachine.1.0
[-] Key Deleted : HKLM\SOFTWARE\Classes\globalUpdateUpdate.OnDemandCOMClassMachineFallback
[-] Key Deleted : HKLM\SOFTWARE\Classes\globalUpdateUpdate.OnDemandCOMClassMachineFallback.1.0
[-] Key Deleted : HKLM\SOFTWARE\Classes\globalUpdateUpdate.OnDemandCOMClassSvc
[-] Key Deleted : HKLM\SOFTWARE\Classes\globalUpdateUpdate.OnDemandCOMClassSvc.1.0
[-] Key Deleted : HKLM\SOFTWARE\Classes\globalUpdateUpdate.ProcessLauncher
[-] Key Deleted : HKLM\SOFTWARE\Classes\globalUpdateUpdate.ProcessLauncher.1.0
[-] Key Deleted : HKLM\SOFTWARE\Classes\globalUpdateUpdate.Update3COMClassService
[-] Key Deleted : HKLM\SOFTWARE\Classes\globalUpdateUpdate.Update3COMClassService.1.0
[-] Key Deleted : HKLM\SOFTWARE\Classes\globalUpdateUpdate.Update3WebMachine
[-] Key Deleted : HKLM\SOFTWARE\Classes\globalUpdateUpdate.Update3WebMachine.1.0
[-] Key Deleted : HKLM\SOFTWARE\Classes\globalUpdateUpdate.Update3WebMachineFallback
[-] Key Deleted : HKLM\SOFTWARE\Classes\globalUpdateUpdate.Update3WebMachineFallback.1.0
[-] Key Deleted : HKLM\SOFTWARE\Classes\globalUpdateUpdate.Update3WebSvc
[-] Key Deleted : HKLM\SOFTWARE\Classes\globalUpdateUpdate.Update3WebSvc.1.0
[-] Key Deleted : HKLM\SOFTWARE\Classes\Prod.cap
[-] Key Deleted : HKLM\SOFTWARE\MozillaPlugins\@staging.google.com/globalUpdate Update;version=10
[-] Key Deleted : HKLM\SOFTWARE\MozillaPlugins\@staging.google.com/globalUpdate Update;version=4
[-] Key Deleted : HKLM\SOFTWARE\Classes\AppID\globalupdate.exe
[-] Key Deleted : HKCU\Software\5c6dddee66dee46
[-] Key Deleted : HKLM\SOFTWARE\5ffc9b8f-8f7b-4758-b842-515fee0beba7
[-] Key Deleted : HKLM\SOFTWARE\Google\Chrome\Extensions\pgafcinpmmpklohkojmllohdhomoefph
[-] Key Deleted : HKLM\SOFTWARE\Classes\AppID\{4D076AB4-7562-427A-B5D2-BD96E19DEE56}
[-] Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{059EACC2-1ABE-49E8-928D-DC8BD355B7A9}
[-] Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{826D7151-8D99-434B-8540-082B8C2AE556}
[-] Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{DE9028D0-5FFA-4E69-94E3-89EE8741F468}
[-] Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}
[-] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}
[-] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8FFE}
[-] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}
[-] Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{11549FE4-7C5A-4C17-9FC3-56FC5162A994}
[-] Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{98889811-442D-49DD-99D7-DC866BE87DBC}
[-] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{5645E0E7-FC12-43BF-A6E4-F9751942B298}
[-] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{C7BF8F4B-7BC7-4F42-B944-3D28A3A86D8A}
[-] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{5645E0E7-FC12-43BF-A6E4-F9751942B298}
[-] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{C7BF8F4B-7BC7-4F42-B944-3D28A3A86D8A}
[-] Value Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID [{FE69C007-C452-4D3E-86D2-1730DF8BC871}]
[-] Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5645E0E7-FC12-43BF-A6E4-F9751942B298}
[-] Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5E89ACE9-E16B-499A-87B4-0DBF742404C1}
[-] Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C7BF8F4B-7BC7-4F42-B944-3D28A3A86D8A}
[-] Key Deleted : HKCU\Software\APN PIP
[-] Key Deleted : HKCU\Software\InstalledBrowserExtensions
[-] Key Deleted : HKCU\Software\OCS
[-] Key Deleted : HKCU\Software\speedypc software
[-] Key Deleted : HKCU\Software\systweak
[-] Key Deleted : HKCU\Software\YahooPartnerToolbar
[-] Key Deleted : HKCU\Software\_CrossriderRegNamePlaceHolder_
[-] Key Deleted : HKCU\Software\WEBAPP
[-] Key Deleted : HKCU\Software\Reg\Clean
[-] Key Deleted : HKLM\SOFTWARE\InstalledBrowserExtensions
[-] Key Deleted : HKLM\SOFTWARE\PIP
[-] Key Deleted : HKLM\SOFTWARE\systweak
[-] Key Deleted : HKLM\SOFTWARE\Tarma Installer
[-] Key Deleted : HKLM\SOFTWARE\_CrossriderRegNamePlaceHolder_
[-] Key Deleted : HKLM\SOFTWARE\Reg\Clean
[-] Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\MyFreeCodec
[-] Key Deleted : HKU\.DEFAULT\Software\AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}
[-] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\A28B4D68DEBAA244EB686953B7074FEF
[-] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GLOBALUPDATE.EXE
[-] Data Restored : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows [AppInit_DLLs]

***** [ Web browsers ] *****

[-] [C:\Documents and Settings\Josef\Data aplikací\Mozilla\Firefox\Profiles\o3t1ixmf.default-1399573057593\prefs.js] [Preference] Deleted : user_pref("browser.search.defaultenginename", "AVG Secure Search");
[-] [C:\Documents and Settings\Josef\Data aplikací\Mozilla\Firefox\Profiles\o3t1ixmf.default-1399573057593\prefs.js] [Preference] Deleted : user_pref("browser.search.selectedEngine", "AVG Secure Search");
[-] [C:\Documents and Settings\Josef\Data aplikací\Mozilla\Firefox\Profiles\o3t1ixmf.default-1399573057593\prefs.js] [Preference] Deleted : user_pref("browser.startup.homepage", "hxxps://isearch.avg.com/?cid={891EA42D-236A-4578-95C9-0290424830C9}&mid=&lang=en&ds=tt014&pr=sa&d=&v=&sap=hp");
[-] [C:\Documents and Settings\Josef\Local Settings\Data aplikací\Google\Chrome\User Data\Default\Web Data] [Search Provider] Deleted : istart.webssearches.com
[-] [C:\Documents and Settings\Josef\Local Settings\Data aplikací\Google\Chrome\User Data\Default\Web Data] [Search Provider] Deleted : webssearches

*************************

:: "Tracing" keys removed
:: Winsock settings cleared

########## EOF - C:\AdwCleaner\AdwCleaner[C1].txt - [9787 bytes] ##########


Junkware Removal Tool by Thisisu :

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Malwarebytes
Version: 7.6.4 (09.28.2015:1)
OS: Microsoft Windows XP x86
Ran by Josef on ne 15.11.2015 at 10:25:35,95
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services

Successfully deleted: [Service] pcsuucdrv [Reboot required]



~~~ Tasks



~~~ Registry Values

Successfully repaired: [Registry Value] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\\DisplayName
Successfully repaired: [Registry Value] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\\URL



~~~ Registry Keys

Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer



~~~ Files

Successfully deleted: [File] C:\Documents and Settings\Josef\Data aplikací\Microsoft\Internet Explorer\Quick Launch\tuneup 1-click maintenance.lnk



~~~ Folders

Successfully deleted: [Folder] C:\Program Files\driver-soft





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on ne 15.11.2015 at 10:27:50,76
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~


RogueKiller :

RogueKiller V10.11.5.0 [Nov 9 2015] (Free) by Adlice Software
mail : http://www.adlice.com/contact/
Feedback : http://forum.adlice.com
Webová stránka : http://www.adlice.com/software/roguekiller/
Blog : http://www.adlice.com

Operační systém : Windows XP (5.1.2600 Service Pack 3) 32 bits version
Spuštěno : Normální režim
Uživatel : Josef [Práva správce]
Started from : C:\Documents and Settings\Josef\Plocha\RogueKiller.exe
Mód : Prohledat -- Datum : 11/15/2015 11:08:10

¤¤¤ Procesy : 0 ¤¤¤

¤¤¤ Registry : 2 ¤¤¤
[Suspicious.Path] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run | SpyHunter Security Suite : "C:\DOCUME~1\Josef\LOCALS~1\Temp\RarSFX0\SpyHunter4.exe" [x] -> Nalezeno
[PUM.StartMenu] HKEY_USERS\S-1-5-21-2659733977-570214497-571619954-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced | Start_ShowRecentDocs : 2 -> Nalezeno

¤¤¤ Úlohy : 1 ¤¤¤
[Suspicious.Path|VT.Unknown] %WINDIR%\Tasks\Component Rest.job -- C:\WINDOWS\system32\rundll32.exe ("C:\Documents and Settings\Josef\Local Settings\Application Data\Component Rest\xBin\ComponentRest.dll",#3) -> Nalezeno

¤¤¤ Soubory : 214 ¤¤¤
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2079403$ -> Nalezeno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2115168$ -> Nalezeno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2229593$ -> Nalezeno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2296011$ -> Nalezeno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2345886$ -> Nalezeno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2347290$ -> Nalezeno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2360937$ -> Nalezeno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2378111_WM9$ -> Nalezeno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2387149$ -> Nalezeno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2393802$ -> Nalezeno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2412687$ -> Nalezeno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2419632$ -> Nalezeno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2423089$ -> Nalezeno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2440591$ -> Nalezeno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2443105$ -> Nalezeno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2467659$ -> Nalezeno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2476490$ -> Nalezeno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2478960$ -> Nalezeno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2478971$ -> Nalezeno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2479943$ -> Nalezeno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2481109$ -> Nalezeno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2483185$ -> Nalezeno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2485663$ -> Nalezeno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2492386$ -> Nalezeno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2506212$ -> Nalezeno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2507618$ -> Nalezeno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2507938$ -> Nalezeno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2508272$ -> Nalezeno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2508429$ -> Nalezeno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2509553$ -> Nalezeno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2510581$ -> Nalezeno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2535512$ -> Nalezeno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2536276-v2$ -> Nalezeno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2541763$ -> Nalezeno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2544521$ -> Nalezeno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2544893-v2$ -> Nalezeno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2562937$ -> Nalezeno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2564958$ -> Nalezeno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2566454$ -> Nalezeno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2567053$ -> Nalezeno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2567680$ -> Nalezeno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2570222$ -> Nalezeno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2570791$ -> Nalezeno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2570947$ -> Nalezeno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2584146$ -> Nalezeno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2585542$ -> Nalezeno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2586448$ -> Nalezeno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2592799$ -> Nalezeno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2598479$ -> Nalezeno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2603381$ -> Nalezeno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2618451$ -> Nalezeno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2619339$ -> Nalezeno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2620712$ -> Nalezeno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2621440$ -> Nalezeno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2624667$ -> Nalezeno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2631813$ -> Nalezeno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2633171$ -> Nalezeno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2633952$ -> Nalezeno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2639417$ -> Nalezeno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2641653$ -> Nalezeno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2641690$ -> Nalezeno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2646524$ -> Nalezeno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2647518$ -> Nalezeno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2653956$ -> Nalezeno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2655992$ -> Nalezeno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2659262$ -> Nalezeno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2660465$ -> Nalezeno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2661254-v2$ -> Nalezeno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2661637$ -> Nalezeno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2676562$ -> Nalezeno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2685939$ -> Nalezeno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2686509$ -> Nalezeno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2691442$ -> Nalezeno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2695962$ -> Nalezeno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2698365$ -> Nalezeno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2705219$ -> Nalezeno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2707511$ -> Nalezeno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2709162$ -> Nalezeno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2712808$ -> Nalezeno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2718523$ -> Nalezeno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2718704$ -> Nalezeno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2719985$ -> Nalezeno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2723135$ -> Nalezeno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2724197$ -> Nalezeno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2727528$ -> Nalezeno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2731847$ -> Nalezeno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2736233$ -> Nalezeno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2749655$ -> Nalezeno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2753842$ -> Nalezeno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2753842-v2$ -> Nalezeno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2756822$ -> Nalezeno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2757638$ -> Nalezeno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2758857$ -> Nalezeno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2761226$ -> Nalezeno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2770660$ -> Nalezeno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2778344$ -> Nalezeno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2779030$ -> Nalezeno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2779562$ -> Nalezeno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2780091$ -> Nalezeno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2799494$ -> Nalezeno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2802968$ -> Nalezeno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2807986$ -> Nalezeno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2808679$ -> Nalezeno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2808735$ -> Nalezeno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2813170$ -> Nalezeno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2813345$ -> Nalezeno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2820197$ -> Nalezeno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2820917$ -> Nalezeno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2829361$ -> Nalezeno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2834886$ -> Nalezeno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2834904-v2_WM11$ -> Nalezeno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2834904_WM11$ -> Nalezeno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2839229$ -> Nalezeno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2845187$ -> Nalezeno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2847311$ -> Nalezeno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2849470$ -> Nalezeno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2850851$ -> Nalezeno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2850869$ -> Nalezeno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2859537$ -> Nalezeno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2862152$ -> Nalezeno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2862330$ -> Nalezeno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2862335$ -> Nalezeno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2863058$ -> Nalezeno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2864063$ -> Nalezeno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2868038$ -> Nalezeno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2868626$ -> Nalezeno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2876217$ -> Nalezeno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2876315$ -> Nalezeno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2876331$ -> Nalezeno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2883150$ -> Nalezeno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2892075$ -> Nalezeno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2893294$ -> Nalezeno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2893984$ -> Nalezeno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2898715$ -> Nalezeno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2900986$ -> Nalezeno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2904266$ -> Nalezeno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2916036$ -> Nalezeno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2929961$ -> Nalezeno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB832353$ -> Nalezeno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB898461$ -> Nalezeno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB915800-v4$ -> Nalezeno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB923561$ -> Nalezeno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB929399$ -> Nalezeno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB939683$ -> Nalezeno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB940157$ -> Nalezeno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB941569$ -> Nalezeno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB942288-v3$ -> Nalezeno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB946648$ -> Nalezeno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB950762$ -> Nalezeno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB950974$ -> Nalezeno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB951376-v2$ -> Nalezeno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB951978$ -> Nalezeno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB952004$ -> Nalezeno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB952069_WM9$ -> Nalezeno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB952287$ -> Nalezeno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB952954$ -> Nalezeno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB954154_WM11$ -> Nalezeno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB954155_WM9$ -> Nalezeno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB954459$ -> Nalezeno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB955759$ -> Nalezeno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB956572$ -> Nalezeno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB956744$ -> Nalezeno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB956802$ -> Nalezeno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB956844$ -> Nalezeno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB958644$ -> Nalezeno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB959426$ -> Nalezeno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB960803$ -> Nalezeno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB960859$ -> Nalezeno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB961118$ -> Nalezeno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB961501$ -> Nalezeno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB963093$ -> Nalezeno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB968389$ -> Nalezeno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB968930$ -> Nalezeno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB969059$ -> Nalezeno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB970430$ -> Nalezeno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB971029$ -> Nalezeno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB971657$ -> Nalezeno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB971737$ -> Nalezeno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB972270$ -> Nalezeno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB973507$ -> Nalezeno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB973540_WM9$ -> Nalezeno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB973687$ -> Nalezeno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB973815$ -> Nalezeno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB973869$ -> Nalezeno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB973904$ -> Nalezeno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB974112$ -> Nalezeno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB974318$ -> Nalezeno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB974392$ -> Nalezeno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB974571$ -> Nalezeno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB975025$ -> Nalezeno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB975467$ -> Nalezeno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB975558_WM8$ -> Nalezeno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB975560$ -> Nalezeno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB975562$ -> Nalezeno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB975713$ -> Nalezeno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB977816$ -> Nalezeno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB977914$ -> Nalezeno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB978338$ -> Nalezeno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB978542$ -> Nalezeno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB978601$ -> Nalezeno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB978695_WM9$ -> Nalezeno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB978706$ -> Nalezeno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB979309$ -> Nalezeno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB979482$ -> Nalezeno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB979687$ -> Nalezeno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB980436$ -> Nalezeno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB981322$ -> Nalezeno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB981997$ -> Nalezeno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB982132$ -> Nalezeno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB982665$ -> Nalezeno
[PUP][Složka] C:\Documents and Settings\All Users\Data aplikací\{C4ABDBC8-1C81-42C9-BFFC-4A68511E9E4F} -> Nalezeno
[Hj.Name][Soubor] C:\RECYCLER\S-1-5-21-2659733977-570214497-571619954-1004\Dc34\Windows\rundll32.exe -> Nalezeno
[Hj.Name][Soubor] C:\RECYCLER\S-1-5-21-2659733977-570214497-571619954-1004\Dc34\Windows\svchost.exe -> Nalezeno
[Hj.Name][Soubor] C:\RECYCLER\S-1-5-21-2659733977-570214497-571619954-1004\Dc34\Windows\winlogon.exe -> Nalezeno

¤¤¤ Soubor HOSTS : 0 [Too big!] ¤¤¤

¤¤¤ Antirootkit : 0 (Driver: Nahrán) ¤¤¤

¤¤¤ Webové prohlížeče : 1 ¤¤¤
[PUM.HomePage][FIREFX:Config] pvst96ez.default-1447488994359 : user_pref("browser.startup.homepage", "https://www.seznam.cz/"); -> Nalezeno

¤¤¤ Kontrola MBR : ¤¤¤
+++++ PhysicalDrive0: HDT722525DLA380 41N3150LEN +++++
--- User ---
[MBR] f67de06e6ce4904d155cd536a1a9b3c1
[BSP] 3b3a93081167d64c1672dc7270f73629 : Windows XP|VT.Unknown MBR Code
Partition table:
0 - [ACTIVE] NTFS (0x7) [VISIBLE] Offset (sectors): 63 | Size: 131618 MB [Windows XP Bootstrap | Windows XP Bootloader]
1 - [XXXXXX] EXTEN-LBA (0xf) [VISIBLE] Offset (sectors): 269554635 | Size: 106854 MB
User = LL1 ... OK
User = LL2 ... OK

+++++ PhysicalDrive1: +++++
--- User ---
[MBR] 7cff954acd819733a1aa50b979a73e1e
[BSP] d823fe3b1f3c755e246aecd7413cfcfa : Windows Vista/7/8|VT.Unknown MBR Code
Partition table:
0 - [ACTIVE] NTFS (0x7) [VISIBLE] Offset (sectors): 63 | Size: 61483 MB [Windows XP Bootstrap | Windows XP Bootloader]
1 - [XXXXXX] EXTEN-LBA (0xf) [VISIBLE] Offset (sectors): 125917471 | Size: 91142 MB
User = LL1 ... OK
User = LL2 ... OK

RogueKiller v průběhu prohlédání našel cestu k componentRest.dll is uknown neznámý a jestli chci polračovat - dal jsem ano a program pokračoval a dal log.

[jerabina]

Zavři všechny programy a prohlížeče. Deaktivuj antivir a firewall.
Prosím, odpoj všechny USB (kromě myši s klávesnice) nebo externí disky z počítače před spuštěním tohoto programu.
Spusť znovu RogueKiller ( Pro Windows Vista nebo Windows 7, klepni pravým a vyber "Spustit jako správce", ve Windows XP poklepej ke spuštění).
- Počkej, až Prescan dokončí práci...
- Pak klikni na "Prohledat " ,po jeho skončení:
- V záložkách (Registry , Tasks , Web Browser apod.) vše zatrhni (dej zatržítka)
(musíš dát myší zatržítko do toho čtverečku vlevo od registru ap.)
- Klikni na "Smazat"
- Počkej, dokud Status box nezobrazí " Mazání dokončeno "
- Klikni na "Zpráva " a zkopíruj a vlož obsah té zprávy prosím sem. Log je možno nalézt v RKreport [číslo]. txt na ploše.
- Zavři RogueKiller

Vypni antivir
Stáhni
Zoek.exe

a uloz si ho na plochu.
Zavři všechny ostatní programy , okna i prohlížeče.
Spusť Zoek.exe ( u win vista , win7, 8 klikni na něj pravým a vyber : „Spustit jako správce“
- pozor , náběh programu může trvat déle.

Do okna programu vlož skript níže:

Kód: Vybrat vše

autoclean;
emptyclsid;
iedefaults;
FFdefaults;
CHRdefaults;
emptyalltemp;
resethosts;

klikni na Run Script
Program provede sken , opravu, sken i oprava může trvat i více minut ,je třeba posečkat do konce. Do okna neklikej!
Program nabídne restart , potvrď .

Po restartu se může nějaký čas ukázat pouze černá plocha , to je normální. Je třeba počkat až se vytvoří log. Ten si můžeš uložit třeba do dokumentů , jinak se sám ukládá do:
C:\zoek-results.log
Zkopíruj sem celý obsah toho logu.

Vypni rez. ochranu u antiviru a antispywaru,příp. firewall..

Stáhni si ComboFix (by sUBs)
a ulož si ho na plochu.
Ukonči všechna aktivní okna a spusť ho.
- Po spuštění se zobrazí podmínky užití, potvrď je stiskem tlačítka Ano
- Dále postupuj dle pokynů, během aplikování ComboFixu neklikej do zobrazujícího se okna
- Po dokončení skenování by měl program vytvořit log - C:\ComboFix.txt - zkopíruj sem prosím celý jeho obsah
Pokud budou problémy , spusť ho v nouz. režimu.

Upozornění : Může se stát, že po aplikaci Combofixu a restartu počítače, Windows nenaběhnou , nebo nenajede plocha , budou problémy s připojením, pak znovu restartuj počítač, pokud to nepomůže , po restartu mačkej klávesu F8 a pak zvol poslední známou funkční konfiguraci. , či použij bod obnovy.

[misut]

RogueKiller:
RogueKiller V10.11.5.0 [Nov 9 2015] (Free) by Adlice Software
mail : http://www.adlice.com/contact/
Feedback : http://forum.adlice.com
Webová stránka : http://www.adlice.com/software/roguekiller/
Blog : http://www.adlice.com

Operační systém : Windows XP (5.1.2600 Service Pack 3) 32 bits version
Spuštěno : Normální režim
Uživatel : Josef [Práva správce]
Started from : C:\Documents and Settings\Josef\Plocha\RogueKiller.exe
Mód : Smazat -- Datum : 11/16/2015 10:21:26

¤¤¤ Procesy : 0 ¤¤¤

¤¤¤ Registry : 2 ¤¤¤
[Suspicious.Path] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run | SpyHunter Security Suite : "C:\DOCUME~1\Josef\LOCALS~1\Temp\RarSFX0\SpyHunter4.exe" [x] -> Smazáno
[PUM.StartMenu] HKEY_USERS\S-1-5-21-2659733977-570214497-571619954-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced | Start_ShowRecentDocs : 2 -> Nahrazeno (1)

¤¤¤ Úlohy : 0 ¤¤¤

¤¤¤ Soubory : 214 ¤¤¤
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2079403$ -> Smazáno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2115168$ -> Smazáno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2229593$ -> Smazáno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2296011$ -> Smazáno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2345886$ -> Smazáno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2347290$ -> Smazáno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2360937$ -> Smazáno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2378111_WM9$ -> Smazáno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2387149$ -> Smazáno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2393802$ -> Smazáno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2412687$ -> Smazáno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2419632$ -> Smazáno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2423089$ -> Smazáno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2440591$ -> Smazáno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2443105$ -> Smazáno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2467659$ -> Smazáno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2476490$ -> Smazáno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2478960$ -> Smazáno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2478971$ -> Smazáno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2479943$ -> Smazáno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2481109$ -> Smazáno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2483185$ -> Smazáno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2485663$ -> Smazáno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2492386$ -> Smazáno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2506212$ -> Smazáno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2507618$ -> Smazáno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2507938$ -> Smazáno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2508272$ -> Smazáno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2508429$ -> Smazáno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2509553$ -> Smazáno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2510581$ -> Smazáno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2535512$ -> Smazáno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2536276-v2$ -> Smazáno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2541763$ -> Smazáno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2544521$ -> Smazáno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2544893-v2$ -> Smazáno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2562937$ -> Smazáno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2564958$ -> Smazáno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2566454$ -> Smazáno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2567053$ -> Smazáno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2567680$ -> Smazáno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2570222$ -> Smazáno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2570791$ -> Smazáno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2570947$ -> Smazáno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2584146$ -> Smazáno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2585542$ -> Smazáno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2586448$ -> Smazáno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2592799$ -> Smazáno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2598479$ -> Smazáno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2603381$ -> Smazáno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2618451$ -> Smazáno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2619339$ -> Smazáno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2620712$ -> Smazáno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2621440$ -> Smazáno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2624667$ -> Smazáno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2631813$ -> Smazáno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2633171$ -> Smazáno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2633952$ -> Smazáno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2639417$ -> Smazáno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2641653$ -> Smazáno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2641690$ -> Smazáno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2646524$ -> Smazáno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2647518$ -> Smazáno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2653956$ -> Smazáno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2655992$ -> Smazáno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2659262$ -> Smazáno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2660465$ -> Smazáno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2661254-v2$ -> Smazáno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2661637$ -> Smazáno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2676562$ -> Smazáno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2685939$ -> Smazáno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2686509$ -> Smazáno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2691442$ -> Smazáno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2695962$ -> Smazáno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2698365$ -> Smazáno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2705219$ -> Smazáno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2707511$ -> Smazáno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2709162$ -> Smazáno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2712808$ -> Smazáno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2718523$ -> Smazáno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2718704$ -> Smazáno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2719985$ -> Smazáno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2723135$ -> Smazáno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2724197$ -> Smazáno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2727528$ -> Smazáno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2731847$ -> Smazáno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2736233$ -> Smazáno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2749655$ -> Smazáno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2753842$ -> Smazáno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2753842-v2$ -> Smazáno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2756822$ -> Smazáno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2757638$ -> Smazáno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2758857$ -> Smazáno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2761226$ -> Smazáno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2770660$ -> Smazáno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2778344$ -> Smazáno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2779030$ -> Smazáno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2779562$ -> Smazáno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2780091$ -> Smazáno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2799494$ -> Smazáno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2802968$ -> Smazáno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2807986$ -> Smazáno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2808679$ -> Smazáno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2808735$ -> Smazáno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2813170$ -> Smazáno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2813345$ -> Smazáno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2820197$ -> Smazáno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2820917$ -> Smazáno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2829361$ -> Smazáno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2834886$ -> Smazáno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2834904-v2_WM11$ -> Smazáno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2834904_WM11$ -> Smazáno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2839229$ -> Smazáno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2845187$ -> Smazáno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2847311$ -> Smazáno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2849470$ -> Smazáno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2850851$ -> Smazáno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2850869$ -> Smazáno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2859537$ -> Smazáno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2862152$ -> Smazáno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2862330$ -> Smazáno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2862335$ -> Smazáno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2863058$ -> Smazáno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2864063$ -> Smazáno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2868038$ -> Smazáno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2868626$ -> Smazáno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2876217$ -> Smazáno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2876315$ -> Smazáno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2876331$ -> Smazáno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2883150$ -> Smazáno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2892075$ -> Smazáno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2893294$ -> Smazáno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2893984$ -> Smazáno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2898715$ -> Smazáno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2900986$ -> Smazáno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2904266$ -> Smazáno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2916036$ -> Smazáno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB2929961$ -> Smazáno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB832353$ -> Smazáno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB898461$ -> Smazáno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB915800-v4$ -> Smazáno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB923561$ -> Smazáno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB929399$ -> Smazáno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB939683$ -> Smazáno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB940157$ -> Smazáno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB941569$ -> Smazáno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB942288-v3$ -> Smazáno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB946648$ -> Smazáno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB950762$ -> Smazáno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB950974$ -> Smazáno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB951376-v2$ -> Smazáno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB951978$ -> Smazáno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB952004$ -> Smazáno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB952069_WM9$ -> Smazáno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB952287$ -> Smazáno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB952954$ -> Smazáno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB954154_WM11$ -> Smazáno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB954155_WM9$ -> Smazáno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB954459$ -> Smazáno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB955759$ -> Smazáno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB956572$ -> Smazáno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB956744$ -> Smazáno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB956802$ -> Smazáno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB956844$ -> Smazáno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB958644$ -> Smazáno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB959426$ -> Smazáno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB960803$ -> Smazáno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB960859$ -> Smazáno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB961118$ -> Smazáno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB961501$ -> Smazáno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB963093$ -> Smazáno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB968389$ -> Smazáno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB968930$ -> Smazáno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB969059$ -> Smazáno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB970430$ -> Smazáno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB971029$ -> Smazáno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB971657$ -> Smazáno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB971737$ -> Smazáno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB972270$ -> Smazáno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB973507$ -> Smazáno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB973540_WM9$ -> Smazáno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB973687$ -> Smazáno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB973815$ -> Smazáno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB973869$ -> Smazáno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB973904$ -> Smazáno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB974112$ -> Smazáno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB974318$ -> Smazáno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB974392$ -> Smazáno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB974571$ -> Smazáno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB975025$ -> Smazáno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB975467$ -> Smazáno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB975558_WM8$ -> Smazáno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB975560$ -> Smazáno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB975562$ -> Smazáno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB975713$ -> Smazáno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB977816$ -> Smazáno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB977914$ -> Smazáno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB978338$ -> Smazáno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB978542$ -> Smazáno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB978601$ -> Smazáno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB978695_WM9$ -> Smazáno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB978706$ -> Smazáno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB979309$ -> Smazáno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB979482$ -> Smazáno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB979687$ -> Smazáno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB980436$ -> Smazáno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB981322$ -> Smazáno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB981997$ -> Smazáno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB982132$ -> Smazáno
[ZeroAccess][Složka] C:\WINDOWS\$NtUninstallKB982665$ -> Smazáno
[PUP][Složka] C:\Documents and Settings\All Users\Data aplikací\{C4ABDBC8-1C81-42C9-BFFC-4A68511E9E4F} -> Smazáno
[Hj.Name][Soubor] C:\RECYCLER\S-1-5-21-2659733977-570214497-571619954-1004\Dc34\Windows\rundll32.exe -> Smazáno
[Hj.Name][Soubor] C:\RECYCLER\S-1-5-21-2659733977-570214497-571619954-1004\Dc34\Windows\svchost.exe -> Smazáno
[Hj.Name][Soubor] C:\RECYCLER\S-1-5-21-2659733977-570214497-571619954-1004\Dc34\Windows\winlogon.exe -> Smazáno

¤¤¤ Soubor HOSTS : 0 [Too big!] ¤¤¤

¤¤¤ Antirootkit : 0 (Driver: Nahrán) ¤¤¤

¤¤¤ Webové prohlížeče : 3 ¤¤¤
[FIREFX:Addon] pvst96ez.default-1447488994359 : Microsoft .NET Framework Assistant [{20a82645-c095-46ed-80e3-08825760534b}] -> Smazáno
[FIREFX:Addon] pvst96ez.default-1447488994359 : RealDownloader [{DF153AFF-6948-45d7-AC98-4FC4AF8A08E2}] -> Smazáno
[PUM.HomePage][FIREFX:Config] pvst96ez.default-1447488994359 : user_pref("browser.startup.homepage", "https://www.seznam.cz/"); -> Nahrazeno (about:home)

¤¤¤ Kontrola MBR : ¤¤¤
+++++ PhysicalDrive0: HDT722525DLA380 41N3150LEN +++++
--- User ---
[MBR] f67de06e6ce4904d155cd536a1a9b3c1
[BSP] 3b3a93081167d64c1672dc7270f73629 : Windows XP|VT.Unknown MBR Code
Partition table:
0 - [ACTIVE] NTFS (0x7) [VISIBLE] Offset (sectors): 63 | Size: 131618 MB [Windows XP Bootstrap | Windows XP Bootloader]
1 - [XXXXXX] EXTEN-LBA (0xf) [VISIBLE] Offset (sectors): 269554635 | Size: 106854 MB
User = LL1 ... OK
User = LL2 ... OK

+++++ PhysicalDrive1: +++++
--- User ---
[MBR] 7cff954acd819733a1aa50b979a73e1e
[BSP] d823fe3b1f3c755e246aecd7413cfcfa : Windows Vista/7/8|VT.Unknown MBR Code
Partition table:
0 - [ACTIVE] NTFS (0x7) [VISIBLE] Offset (sectors): 63 | Size: 61483 MB [Windows XP Bootstrap | Windows XP Bootloader]
1 - [XXXXXX] EXTEN-LBA (0xf) [VISIBLE] Offset (sectors): 125917471 | Size: 91142 MB
User = LL1 ... OK
User = LL2 ... OK

Zoek.exe :

Zoek.exe v5.0.0.1 Updated 15-November-2015
Tool run by Josef on po 16.11.2015 at 10:27:31,32.
Systém Microsoft Windows XP Professional 5.1.2600 Service Pack 3 x86
Running in: Normal Mode Internet Access Detected
Launched: C:\Documents and Settings\Josef\Plocha\zoek.exe [Scan all users] [Script inserted]

==== System Restore Info ======================

16.11.2015 10:29:19 Zoek.exe System Restore Point Created Successfully.

==== Reset Hosts File ======================

# Copyright (c) 1993-2006 Microsoft Corp.
#
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
#
# This file contains the mappings of IP addresses to host names. Each
# entry should be kept on an individual line. The IP address should
# be placed in the first column followed by the corresponding host name.
# The IP address and the host name should be separated by at least one
# space.
#
# Additionally, comments (such as these) may be inserted on individual
# lines or following the machine name denoted by a '#' symbol.
#
# For example:
#
# 102.54.94.97 rhino.acme.com # source server
# 38.25.63.10 x.acme.com # x client host

127.0.0.1 localhost

==== Suspicious Entries Found ======================

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"139:TCP"="139:TCP:*:Enabled:@xpsp2res.dll,-22004"
"445:TCP"="445:TCP:*:Enabled:@xpsp2res.dll,-22005"
"137:UDP"="137:UDP:*:Enabled:@xpsp2res.dll,-22001"
"138:UDP"="138:UDP:*:Enabled:@xpsp2res.dll,-22002"
"3389:TCP"="3389:TCP:*:Disabled:@xpsp2res.dll,-22009"
"1900:UDP"="1900:UDP:LocalSubNet:Disabled:@xpsp2res.dll,-22007"
"2869:TCP"="2869:TCP:LocalSubNet:Disabled:@xpsp2res.dll,-22008"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"5985:TCP"="5985:TCP:*:Disabled:Vzdálená správa systému Windows "
"139:TCP"="139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004"
"445:TCP"="445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005"
"137:UDP"="137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001"
"138:UDP"="138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002"
"1900:UDP"="1900:UDP:LocalSubNet:Disabled:@xpsp2res.dll,-22007"
"2869:TCP"="2869:TCP:LocalSubNet:Disabled:@xpsp2res.dll,-22008"
"3389:TCP"="3389:TCP:*:Disabled:@xpsp2res.dll,-22009"

==== Empty Folders Check ======================

C:\Program Files\BlazeVideo deleted successfully
C:\Program Files\iOrgSoft deleted successfully
C:\Program Files\Opera deleted successfully
C:\Program Files\Saving Flash deleted successfully
C:\Program Files\WinAVI deleted successfully
C:\Documents and Settings\All Users\Nabídka Start\Programy\DriverEasy deleted successfully
C:\Documents and Settings\All Users\Nabídka Start\Programy\Spybot - Search & Destroy deleted successfully
C:\Documents and Settings\Josef\Nabídka Start\Programy\PC Translator deleted successfully
C:\DOCUME~1\ALLUSE~1\DATAAP~1\Atheros deleted successfully
C:\DOCUME~1\ALLUSE~1\DATAAP~1\BigFishCache deleted successfully
C:\DOCUME~1\ALLUSE~1\DATAAP~1\BlazeVideo deleted successfully
C:\DOCUME~1\ALLUSE~1\DATAAP~1\DAEMON Tools Pro deleted successfully
C:\DOCUME~1\ALLUSE~1\DATAAP~1\DivX deleted successfully
C:\DOCUME~1\ALLUSE~1\DATAAP~1\install_clap deleted successfully
C:\DOCUME~1\ALLUSE~1\DATAAP~1\LangSoft deleted successfully
C:\Documents and Settings\Administrator\Data aplikací\WinRAR deleted successfully
C:\Documents and Settings\Josef\Data aplikací\Broad Intelligence deleted successfully
C:\Documents and Settings\Josef\Data aplikací\DVDVideoSoft deleted successfully
C:\Documents and Settings\Josef\Data aplikací\Opera Software deleted successfully
C:\Documents and Settings\Josef\Data aplikací\Vso deleted successfully
C:\Documents and Settings\LocalService\Data aplikací\QuickScan deleted successfully
C:\Documents and Settings\NetworkService\Data aplikací\QuickScan deleted successfully
C:\Documents and Settings\Josef\Local Settings\Data aplikací\Downloaded Installations deleted successfully
C:\Documents and Settings\Josef\Local Settings\Data aplikací\Opera Software deleted successfully
C:\Documents and Settings\Josef\Local Settings\Data aplikací\Samsung deleted successfully
C:\Documents and Settings\Josef\Local Settings\Data aplikací\SubtitleCreator deleted successfully
C:\Documents and Settings\Josef\Local Settings\Data aplikací\WMTools Downloaded Files deleted successfully

==== Deleting CLSID Registry Keys ======================


==== Deleting CLSID Registry Values ======================


==== Deleting Services ======================


==== FireFox Fix ======================

Deleted from C:\Documents and Settings\Josef\Data aplikací\Mozilla\Firefox\Profiles\o3t1ixmf.default-1399573057593\prefs.js:

Added to C:\Documents and Settings\Josef\Data aplikací\Mozilla\Firefox\Profiles\o3t1ixmf.default-1399573057593\prefs.js:
user_pref("browser.startup.homepage", "about:home");
user_pref("browser.newtab.url", "about:newtab");

Deleted from C:\Documents and Settings\Josef\Data aplikací\Mozilla\Firefox\Profiles\pvst96ez.default-1447488994359\prefs.js:

Added to C:\Documents and Settings\Josef\Data aplikací\Mozilla\Firefox\Profiles\pvst96ez.default-1447488994359\prefs.js:
user_pref("browser.startup.homepage", "about:home");
user_pref("browser.newtab.url", "about:newtab");

==== Deleting Files \ Folders ======================

C:\Program Files\BlazeVideo not found
C:\Program Files\iOrgSoft not found
C:\Program Files\Opera not found
C:\Program Files\Saving Flash not found
C:\Program Files\WinAVI not found
C:\Program Files\WindowsUpdate deleted
C:\Program Files\0ef7eb06-bfac-47be-ad8f-e6aed6cc1173 deleted
C:\Documents and Settings\Josef\Data aplikací\calibre deleted
C:\Documents and Settings\Josef\.android deleted
C:\Documents and Settings\Josef\Data aplikací\MPUI.ini deleted
C:\Documents and Settings\Josef\Data aplikací\HPCOM_48BitScanUpdate.log deleted
C:\DOCUME~1\ALLUSE~1\DATAAP~1\DriverGenius deleted
C:\WINDOWS\wininit.ini deleted
C:\WINDOWS\system32\GroupPolicy\ADM deleted
C:\Documents and Settings\Josef\Data aplikací\Mozilla\Firefox\Profiles\pvst96ez.default-1447488994359\Invalidprefs.js deleted
C:\Documents and Settings\Josef\Data aplikací\Mozilla\Firefox\Profiles\pvst96ez.default-1447488994359\jetpack deleted

==== Firefox Start and Search pages ======================

ProfilePath: C:\Documents and Settings\Josef\Data aplikací\Mozilla\Firefox\Profiles\o3t1ixmf.default-1399573057593
user_pref("browser.startup.homepage", "about:home");
user_pref("browser.newtab.url", "about:newtab");

ProfilePath: C:\Documents and Settings\Josef\Data aplikací\Mozilla\Firefox\Profiles\pvst96ez.default-1447488994359
user_pref("browser.startup.homepage", "about:home");
user_pref("browser.newtab.url", "about:newtab");

==== Firefox Extensions Registry ======================

[HKEY_LOCAL_MACHINE\Software\Mozilla\Firefox\Extensions]
"{DF153AFF-6948-45d7-AC98-4FC4AF8A08E2}"="C:\Documents and Settings\All Users\Data aplikací\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext" [22.03.2015 15:52]

==== Firefox Extensions ======================

ExtDir: C:\Documents and Settings\Josef\Data aplikací\Mozilla\Extensions
- WebSite Recommendation - %ExtDir%\WebSiteRecommendation@weliketheweb.com
- Google Translator for Firefox - %ExtDir%\translator@zoli.bod.xpi

AppDir: C:\Program Files\Mozilla Firefox
- Default - %AppDir%\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

==== Firefox Plugins ======================

Profilepath: C:\Documents and Settings\Josef\Data aplikací\Mozilla\Firefox\Profiles\pvst96ez.default-1447488994359
D33D39A318AEA70691CED7530E2D9DF9 - C:\Program Files\Windows Media Player\npdsplay.dll - Windows Media Player Plug-in Dynamic Link Library
CFBC726A1712BD8DC9914EA06DBCE20B - C:\Program Files\Windows Media Player\npwmsdrm.dll - Microsoft® DRM
7E54D1EC87CE306CB1A26CE59AFE6E37 - C:\Program Files\Windows Media Player\npdrmv2.dll - Microsoft® DRM
421CB2C1010522B3BF7C00725520B844 - C:\Program Files\Adobe\Reader 11.0\Reader\browser\nppdf32.dll - Adobe Acrobat
005EBE4A4E6E9C9A7967F6C3F413C1DF - C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll - Adobe Acrobat
52CE0DBFD9738AE528CF525A0367EBEB - C:\Program Files\VideoLAN\VLC\npvlc.dll - VLC Web Plugin
A06C5E4980D2B235B510E3EBB6183446 - C:\Program Files\Google\Update\1.3.28.17\npGoogleUpdate3.dll - Google Update
0FCEAA7D12B7B0BA825E5C770B1DCA48 - C:\Program Files\Real\RealPlayer\Netscape6\nprpplugin.dll - RealPlayer Download Plugin
3A9E1940B4459CC97FDCBB24FCB69004 - C:\Program Files\Real\RealPlayer\Netscape6\nppl3260.dll - RealPlayer(tm) G2 LiveConnect-Enabled Plug-In (32-bit)
AB87EEFFD18F2BAAFC274E7075EA6C67 - c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll - Windows Presentation Foundation / Windows Presentation Foundation
893BF7D2261C56C24F813405D9D018E0 - C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll - Silverlight Plug-In
F114FBA6246530B89DD1E04351E0EAC5 - C:\WINDOWS\system32\Macromed\Flash\NPSWF32_19_0_0_245.dll - Shockwave Flash
8DA2ED6B04EA33F2EAE8BA883F903729 - C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrlui.dll - Microsoft® Silverlight


==== Deleted Firefox Extensions ======================

C:\Documents and Settings\Josef\Data aplikací\Mozilla\Extensions\WebSiteRecommendation@weliketheweb.com deleted

==== Chromium Look ======================

HKEY_LOCAL_MACHINE\SOFTWARE\Google\Chrome\Extensions
idhngdhcfkoamngbedgpaokgjbnpdiji - C:\Documents and Settings\All Users\Data aplikací\RealNetworks\RealDownloader\BrowserPlugins\Chrome\Ext\realdownloader.crx[14.08.2013 15:24]

RealDownloader - Josef\Local Settings\Data aplikací\Google\Chrome\User Data\Default\Extensions\idhngdhcfkoamngbedgpaokgjbnpdiji

==== Set IE to Default ======================

Old Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"="http://www.msn.com/es-es/"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\AboutURLs]
"Tabs"="http://www.google.com"

New Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"="http://www.msn.com/es-es/"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\AboutURLs]
"Tabs"="about:newtab"

==== All HKLM and HKCU SearchScopes ======================

HKLM\SearchScopes "DefaultScope"="{0633EE93-D776-472f-A0FF-E1416B8B2E3A}"
HKLM\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} - http://www.bing.com/search
HKCU\SearchScopes "DefaultScope"="{0633EE93-D776-472f-A0FF-E1416B8B2E3A}"
HKCU\SearchScopes\{012E1000-F331-11DB-8314-0800200C9A66} - http://www.google.com/search?q={searchTerms}
HKCU\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} - http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC

==== Reset Google Chrome ======================

C:\Documents and Settings\Josef\Local Settings\Data aplikací\Google\Chrome\User Data\Default\Preferences was reset successfully
C:\Documents and Settings\Josef\Local Settings\Data aplikací\Google\Chrome\User Data\Default\Secure Preferences was reset successfully
C:\Documents and Settings\Josef\Local Settings\Data aplikací\Google\Chrome\User Data\Default\Web Data was reset successfully

==== Deleting Registry Keys ======================

HKEY_LOCAL_MACHINE\Software\Policies\Google deleted successfully

==== Empty IE Cache ======================

C:\Documents and Settings\Josef\Local Settings\Temporary Internet Files\Content.IE5\index.dat will be deleted at reboot
C:\Documents and Settings\LocalService\Local Settings\temp\Temporary Internet Files\Content.IE5\index.dat will be deleted at reboot
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat will be deleted at reboot

==== Empty FireFox Cache ======================

C:\Documents and Settings\Josef\Local Settings\Data aplikací\Mozilla\Firefox\Profiles\pvst96ez.default-1447488994359\cache2 emptied successfully

==== Empty Chrome Cache ======================

C:\Documents and Settings\Josef\Local Settings\Data aplikací\Google\Chrome\User Data\Default\Cache emptied successfully

==== Empty All Flash Cache ======================

Flash Cache Emptied Successfully

==== Empty All Java Cache ======================

No Java Cache Found

==== C:\zoek_backup content ======================

C:\zoek_backup (files=52 folders=23 6573390 bytes)

==== Empty Temp Folders ======================

C:\Documents and Settings\Administrator\Local Settings\temp emptied successfully
C:\Documents and Settings\Default User\Local Settings\Temp emptied successfully
C:\Documents and Settings\Josef\Local Settings\Temp will be emptied at reboot
C:\Documents and Settings\LocalService\Local Settings\temp will be emptied at reboot
C:\Documents and Settings\NetworkService\Local Settings\temp emptied successfully
C:\WINDOWS\Temp will be emptied at reboot

==== After Reboot ======================

==== Empty Temp Folders ======================

C:\WINDOWS\Temp successfully emptied
C:\DOCUME~1\Josef\LOCALS~1\Temp successfully emptied

==== Empty Recycle Bin ======================

C:\RECYCLER successfully emptied

==== Deleting Files / Folders ======================

"C:\Documents and Settings\Josef\Local Settings\Temporary Internet Files\Content.IE5\index.dat" not deleted
"C:\Documents and Settings\LocalService\Local Settings\temp\Temporary Internet Files\Content.IE5\index.dat" not found
"C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat" not found
"C:\Documents and Settings\LocalService\Local Settings\temp\Cookies" not found
"C:\Documents and Settings\LocalService\Local Settings\temp\History" not found
"C:\Documents and Settings\LocalService\Local Settings\temp\Temporary Internet Files" not found

==== EOF on po 16.11.2015 at 10:49:15,79 ======================



ComboFix :
ComboFix 15-11-15.01 - Josef 16.11.2015 10:58:06.2.2 - x86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.420.1029.18.3062.2367 [GMT 1:00]
Spuštěný z: c:\documents and settings\Josef\Plocha\ComboFix.exe
AV: ESET Smart Security 8.0 *Disabled/Updated* {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
FW: ESET Personální firewall *Enabled* {E5E70D32-0101-4340-86A3-A7B0F1C8FFE0}
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\Josef\WINDOWS
c:\program files\ACD Systems\92778b05-fd08-4164-9512-a1d5a67df1ae.dll
c:\program files\Common
c:\program files\Common\cookies.txt
.
c:\windows\system32\drivers\i8042prt.sys . . . chybí !!
.
.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Legacy_GLOBALUPDATE
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2015-10-16 do 2015-11-16 )))))))))))))))))))))))))))))))
.
.
2015-11-16 09:46 . 2015-11-16 09:27 24064 ----a-w- c:\windows\zoek-delete.exe
2015-11-16 09:27 . 2015-11-16 09:49 -------- d-----w- C:\zoek_backup
2015-11-15 09:41 . 2015-11-16 08:54 35064 ----a-w- c:\windows\system32\drivers\TrueSight.sys
2015-11-15 09:41 . 2015-11-15 10:09 -------- d-----w- c:\documents and settings\All Users\Data aplikací\RogueKiller
2015-11-14 19:47 . 2015-11-14 19:47 -------- d-----w- c:\documents and settings\All Users\Data aplikací\Malwarebytes
2015-11-14 19:47 . 2015-10-05 08:50 121560 ----a-w- c:\windows\system32\drivers\mbamchameleon.sys
2015-11-14 19:47 . 2015-10-05 08:50 23256 ----a-w- c:\windows\system32\drivers\mbam.sys
2015-11-14 19:40 . 2015-11-15 09:20 -------- d-----w- C:\AdwCleaner
2015-11-14 16:37 . 2015-11-14 16:37 -------- d-sh--w- c:\documents and settings\Default User\IETldCache
2015-11-14 16:37 . 2015-11-14 16:51 780488 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2015-11-14 16:37 . 2015-11-14 16:51 142536 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2015-11-14 16:35 . 2015-11-14 16:35 2324216 ----a-w- c:\windows\system32\ssins.exe
2015-11-14 08:40 . 2010-05-13 17:34 14232 ----a-w- c:\windows\system32\sh4native.exe
2015-11-01 18:53 . 2015-11-01 18:53 -------- d-----w- c:\documents and settings\Josef\Local Settings\Data aplikací\Showtime
2015-10-27 10:57 . 2015-10-29 10:09 -------- d-----w- C:\Output
2015-10-26 10:58 . 2015-10-26 11:27 -------- d-----w- c:\program files\pazera-software
2015-10-26 09:29 . 2015-10-26 09:29 -------- d-----w- C:\DVDFabDecrypter_Temp
2015-10-22 07:28 . 2015-10-22 07:28 -------- d-----w- c:\program files\Common Files\Skype
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2015-03-05 13:05 . 2015-03-15 18:26 2260 -c--a-w- c:\program files\voucher.bin
2013-03-13 07:03 . 2013-03-13 07:03 2174976 -c--a-w- c:\program files\Common Files\atimpenc.dll
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\NBHShellExt]
@="{8D2223A2-B3C6-4e32-B096-CDD11F628C60}"
[HKEY_CLASSES_ROOT\CLSID\{8D2223A2-B3C6-4e32-B096-CDD11F628C60}]
2009-10-16 08:44 97072 ----a-w- c:\program files\Nero\Tools\InCD\NBHshx.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"egui"="c:\program files\ESET\ESET Smart Security\egui.exe" [2014-10-01 5088456]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-11-21 959904]
"BluetoothAuthenticationAgent"="bthprops.cpl" [2008-04-14 110592]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLinkedConnections"= 1 (0x1)
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-24 304128]
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"24c54e38"=2 (0x2)
.
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"ctfmon.exe"=c:\windows\system32\ctfmon.exe
"Adobe Reader Synchronizer"="c:\program files\Adobe\Reader 11.0\Reader\AdobeCollabSync.exe"
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"BluetoothAuthenticationAgent"=rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
"TkBellExe"="c:\program files\real\realplayer\update\realsched.exe" -osboot
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\Nero\\Nero 11\\Nero BackItUp\\BackItUp.exe"=
"g:\\instalace\\GAME\\Kyodai Mahjongg\\kmj.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"5985:TCP"= 5985:TCP:*:Disabled:Vzdálená správa systému Windows
"3389:TCP"= 3389:TCP:*:Disabled:@xpsp2res.dll,-22009
.
R?2 ssinstall;SInstalátor;c:\windows\system32\ssins.exe [14.11.2015 17:35 2324216]
R0 NBVol;Nero Backup Volume Filter Driver;c:\windows\system32\drivers\NBVol.sys [21.11.2011 12:30 56496]
R0 NBVolUp;Nero Backup Volume Upper Filter Driver;c:\windows\system32\drivers\NBVolUp.sys [21.11.2011 12:30 12464]
R1 BIOS;BIOS;c:\windows\system32\drivers\BIOS.sys [16.12.2012 9:41 13696]
R1 eamonm;eamonm;c:\windows\system32\drivers\eamonm.sys [10.10.2014 8:59 191928]
R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [10.10.2014 8:59 135296]
R2 {329F96B6-DF1E-4328-BFDA-39EA953C1312};Power Control [2012/04/16 14:52];c:\program files\CyberLink\PowerDVD11\Common\NavFilter\000.fcl [1.9.2011 21:51 77296]
R2 CLHNServiceForPowerDVD;CLHNServiceForPowerDVD;c:\program files\CyberLink\PowerDVD11\Kernel\DMP\CLHNServiceForPowerDVD.exe [16.4.2012 13:51 83240]
R2 CyberLink PowerDVD 11.0 Monitor Service;CyberLink PowerDVD 11.0 Monitor Service;c:\program files\CyberLink\PowerDVD11\Common\MediaServer\CLMSMonitorService.exe [16.4.2012 13:51 75048]
R2 CyberLink PowerDVD 11.0 Service;CyberLink PowerDVD 11.0 Service;c:\program files\CyberLink\PowerDVD11\Common\MediaServer\CLMSServerForPDVD11.exe [16.4.2012 13:51 292136]
R2 ekrn;ESET Service;c:\program files\ESET\ESET Smart Security\ekrn.exe [1.10.2014 14:40 1349576]
R2 NAUpdate;@c:\program files\Nero\Update\NASvc.exe,-200;c:\program files\Nero\Update\NASvc.exe [23.9.2011 18:37 641832]
R2 NeroRegInCDSrv;Nero Registry InCD Service;c:\program files\Nero\Tools\InCD\NBHRegInCDSrv.exe [16.10.2009 9:44 53560]
R2 ntk_PowerDVD;ntk_PowerDVD;c:\program files\CyberLink\PowerDVD11\Kernel\DMP\ntk_PowerDVD.sys [16.4.2012 13:51 71664]
R2 PassThru Service;Internet Pass-Through Service;c:\program files\HTC\Internet Pass-Through\PassThruSvr.exe [11.5.2014 16:00 167424]
R2 RealNetworks Downloader Resolver Service;RealNetworks Downloader Resolver Service;c:\program files\RealNetworks\RealDownloader\rndlresolversvc.exe [14.8.2013 15:19 39056]
R2 SkypeUpdate;Skype Updater;c:\program files\Skype\Updater\Updater.exe [9.7.2015 12:14 327296]
R2 thdudf;TOSHIBA UDF2.5 Reader File System Driver;c:\windows\system32\drivers\thdudf.sys [25.11.2013 15:01 66944]
S3 AR9271;Wireless Network Adapter Service;c:\windows\system32\drivers\athuw.sys [1.3.2013 21:35 1763584]
S3 BioNT_BS;BioNT_BS;\??\g:\program files\bluescrn\BioNT_bs.sys --> g:\program files\bluescrn\BioNT_bs.sys [?]
S3 dgderdrv;dgderdrv;c:\windows\system32\drivers\dgderdrv.sys [19.3.2014 22:17 20032]
S3 epmntdrv;epmntdrv;c:\windows\system32\epmntdrv.sys [28.11.2014 22:35 13896]
S3 EsgScanner;EsgScanner;c:\windows\system32\drivers\EsgScanner.sys [14.2.2015 13:24 19984]
S3 EuGdiDrv;EuGdiDrv;c:\windows\system32\EuGdiDrv.sys [28.11.2014 22:35 9160]
S3 HTCAND32;HTC Device Driver;c:\windows\system32\drivers\ANDROIDUSB.sys [11.5.2014 16:00 24576]
S3 htcnprot;HTC NDIS Protocol Driver;c:\windows\system32\drivers\htcnprot.sys [7.12.2012 17:27 21248]
S3 IT9135BDA;IT9135 BDA Devices;c:\windows\system32\drivers\IT9135BDA.SYS [3.2.2013 15:20 145280]
S3 Revoflt;Revoflt;c:\windows\system32\drivers\revoflt.sys [29.11.2011 18:32 27064]
.
--- Ostatní služby/ovladače v paměti ---
.
*NewlyCreated* - WS2IFSL
.
Obsah adresáře 'Naplánované úlohy'
.
2015-11-16 c:\windows\Tasks\Component Rest.job
- c:\documents and settings\Josef\Local Settings\Application Data\Component Rest\xBin\ComponentRest.dll [2015-11-14 10:41]
.
2015-11-14 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2015-01-26 17:30]
.
2015-11-14 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2015-01-26 17:30]
.
2015-04-26 c:\windows\Tasks\RealDownloaderDownloaderScheduledTaskS-1-5-21-2659733977-570214497-571619954-1004.job
- c:\program files\RealNetworks\RealDownloader\recordingmanager.exe [2013-08-14 14:19]
.
2015-11-16 c:\windows\Tasks\RealDownloaderRealUpgradeLogonTaskS-1-5-21-2659733977-570214497-571619954-1004.job
- c:\program files\RealNetworks\RealDownloader\realupgrade.exe [2013-08-14 14:19]
.
2015-11-14 c:\windows\Tasks\RealDownloaderRealUpgradeScheduledTaskS-1-5-21-2659733977-570214497-571619954-1004.job
- c:\program files\RealNetworks\RealDownloader\realupgrade.exe [2013-08-14 14:19]
.
2015-11-16 c:\windows\Tasks\RealPlayerRealUpgradeLogonTaskS-1-5-21-2659733977-570214497-571619954-1004.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2013-08-14 16:13]
.
2015-11-16 c:\windows\Tasks\RealPlayerRealUpgradeScheduledTaskS-1-5-21-2659733977-570214497-571619954-1004.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2013-08-14 16:13]
.
2015-11-16 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-2659733977-570214497-571619954-1004.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2013-08-14 16:13]
.
2015-10-30 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-2659733977-570214497-571619954-1004.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2013-08-14 16:13]
.
2015-11-15 c:\windows\Tasks\User_Feed_Synchronization-{02D609C1-B138-47A6-B631-4C8C2E89B3B5}.job
- c:\windows\system32\msfeedssync.exe [2007-08-13 03:31]
.
.
------- Doplňkový sken -------
.
uInternet Connection Wizard,ShellNext = iexplore
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: Send To &Bluetooth - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: {{7E6A20FB-153F-402c-A84B-1A64E1955D3D} - {7E6A20FB-153F-402c-A84B-1A64E1955D3D} -
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748449} - {CC963627-B1DC-40E0-B52A-CF21EE748450} -
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748450} - {CC963627-B1DC-40E0-B52A-CF21EE748450} -
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748451} - {CC963627-B1DC-40E0-B52A-CF21EE748451} -
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748452} - {CC963627-B1DC-40E0-B52A-CF21EE748452} -
TCP: DhcpNameServer = 192.168.1.1
FF - ProfilePath - c:\documents and settings\Josef\Data aplikací\Mozilla\Firefox\Profiles\pvst96ez.default-1447488994359\
FF - prefs.js: browser.startup.homepage - about:home
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2015-11-16 11:05
Windows 5.1.2600 Service Pack 3 NTFS
.
skenování skrytých procesů ...
.
skenování skrytých položek 'Po spuštění' ...
.
skenování skrytých souborů ...
.
.
c:\windows\TEMP\9y5ht12u.TMP 616448 bytes
.
sken byl úspešně dokončen
skryté soubory: 1
.
**************************************************************************
.
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\{329F96B6-DF1E-4328-BFDA-39EA953C1312}]
"ImagePath"="\??\c:\program files\CyberLink\PowerDVD11\Common\NavFilter\000.fcl"
.
--------------------- Knihovny navázané na běžící procesy ---------------------
.
- - - - - - - > 'explorer.exe'(568)
c:\program files\Nero\Tools\InCD\NBHshx.dll
c:\windows\system32\msi.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\btncopy.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\program files\Nero\Tools\InCD\InCDSrv.exe
c:\program files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
c:\windows\system32\rundll32.exe
c:\windows\system32\imapi.exe
c:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Celkový čas: 2015-11-16 11:06:48 - počítač byl restartován
ComboFix-quarantined-files.txt 2015-11-16 10:06
.
Před spuštěním: Volných bajtů: 80 079 347 712
Po spuštění: Volných bajtů: 79 893 786 624
.
WindowsXP-KB310994-SP2-Pro-BootDisk-CSY.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect
.
- - End Of File - - EF633BBACDBEA74D686A2E07D0C4C8CD
413FC2A0C716421B3158746D63736515

[jaro3]

Vypni rez. ochranu u antiviru a antispywaru,příp. firewall..

Otevři si Poznámkový blok (Start -> Spustit... a napiš do okna Notepad a dej Ok.
Zkopíruj do něj následující celý text označený zeleně:

Kód: Vybrat vše

ClearJavaCache::
KillAll::
RESTORE::
c:\windows\system32\drivers\i8042prt.sys

File::
c:\windows\Tasks\Component Rest.job
c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
c:\windows\Tasks\RealDownloaderDownloaderScheduledTaskS-1-5-21-2659733977-570214497-571619954-1004.job
c:\windows\Tasks\RealDownloaderRealUpgradeLogonTaskS-1-5-21-2659733977-570214497-571619954-1004.job
c:\windows\Tasks\RealDownloaderRealUpgradeScheduledTaskS-1-5-21-2659733977-570214497-571619954-1004.job
c:\windows\Tasks\RealPlayerRealUpgradeLogonTaskS-1-5-21-2659733977-570214497-571619954-1004.job
c:\windows\Tasks\RealPlayerRealUpgradeScheduledTaskS-1-5-21-2659733977-570214497-571619954-1004.job
c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-2659733977-570214497-571619954-1004.job
c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-2659733977-570214497-571619954-1004.job
c:\windows\TEMP\9y5ht12u.TMP

Folder::
c:\program files\Skype\Updater
c:\documents and settings\Josef\Local Settings\Application Data\Component Rest
c:\program files\Google\Update

Driver::
SkypeUpdate
BioNT_BS

Registry::
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"24c54e38"=-

DDS::
IE: {{7E6A20FB-153F-402c-A84B-1A64E1955D3D} - {7E6A20FB-153F-402c-A84B-1A64E1955D3D} -
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748449} - {CC963627-B1DC-40E0-B52A-CF21EE748450} -
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748450} - {CC963627-B1DC-40E0-B52A-CF21EE748450} -
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748451} - {CC963627-B1DC-40E0-B52A-CF21EE748451} -
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748452} - {CC963627-B1DC-40E0-B52A-CF21EE748452} –


Zvol možnost Soubor -> Uložit jako... a nastav tyto parametry:
Název souboru: zde napiš: CFScript.txt
Uložit jako typ: tak tam vyber Všechny soubory
Ulož soubor na plochu.
Ukonči všechna aktivní okna.

Uchop myší vytvořený skript CFScript.txt, přemísti ho nad stažený program ComboFix.exe a když se oba soubory překryjí, skript upusť.
- Automaticky se spustí ComboFix
- Vlož sem log, který vyběhne v závěru čistícího procesu + nový log z HJT

Upozornění : Může se stát, že po aplikaci Combofixu a restartu počítače, Windows nenaběhnou , nebo nenajede plocha , budou problémy s připojením, pak znovu restartuj počítač, pokud to nepomůže , po restartu mačkej klávesu F8 a pak zvol poslední známou funkční konfiguraci. , či použij bod obnovy.

Stáhni si aswMBR
na svojí plochu. Uzavři všechna okna , programy a prohlížeče. Poklepej na aswMBR.exe. Pokud se objeví hláška o možnosti stáhnutí databáze Avastu , klikni na NE. Poté klikni na „Scan“ . Po skenu klikni na „Save Log“ a ulož si log na plochu .Zkopíruj sem celý obsah toho logu. Pak klikni na „Exit“ k zavření programu.

V možnostech složky si povol zobrazování skrytých souborů a složek+ odškrtni zatržítko skrýt chráněné soubory operačního systému

Toto otestuj na Virustotal
c:\program files\voucher.bin

Klikni vpravo od okénka na Vybrat a v Exploreru najdi požadovaný soubor v Tvém PC. Označ ho myší a klikni na Otevřít , poté klikni na Send File. Pokud už byl soubor testován , objeví se okno ve kterém klikni na Reanalyze. Soubor se začne postupně testovat více antivirovými programy. Až skončí test posledního antiviru , objeví se nahoře result a červeně počet nákaz , např. 0/43 , nebo 1/43. Pak zkopíruj myší odkaz na tuto stránku a vlož ji do svého příspěvku.

Nebo na:
http://www.virscan.org/

[misut]

píšu od souseda protože jsem dělal to co mi napsal jerabina a po překrytí *txt přes combofix se při aut.restartu Pc sekl na
závěrečné modré stránce windows -- vypínání --- co teď??? natvrdo ?? Dívám se , že pokyn od jerabina zmizel a je tady nový od Jaro3 . co nyní ???

[misut]

Vyřešeno !! vypla elektrika !! už píšu ze svého a přikládám *.txt z combofixu dle Jerabina , při
otestování na Virustotal /dle pokynu Jarabina bylo vše OK ppouze druhý test , ale už nevím který to byl protože se vše smazalo myslím něco na ss...?? byl nalezen vír.
https://www.virustotal.com/cs/file/9a7d ... 447685624/ -- nalezeno v histrorii.
https://www.virustotal.com/cs/file/e16e ... 447685442/ -- nalezeno v historii

ComboFix 15-11-15.01 - Josef 16.11.2015 16:16:54.3.2 - x86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.420.1029.18.3062.2116 [GMT 1:00]
Spuštěný z: c:\documents and settings\Josef\Plocha\ComboFix.exe
Použité ovládací přepínače :: c:\documents and settings\Josef\Plocha\CFScript.txt
AV: ESET Smart Security 8.0 *Disabled/Updated* {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
FW: ESET Personální firewall *Enabled* {E5E70D32-0101-4340-86A3-A7B0F1C8FFE0}
.
FILE ::
"c:\windows\Tasks\Component Rest.job"
"c:\windows\Tasks\GoogleUpdateTaskMachineCore.job"
"c:\windows\Tasks\GoogleUpdateTaskMachineUA.job"
"c:\windows\Tasks\RealDownloaderDownloaderScheduledTaskS-1-5-21-2659733977-570214497-571619954-1004.job"
"c:\windows\Tasks\RealDownloaderRealUpgradeLogonTaskS-1-5-21-2659733977-570214497-571619954-1004.job"
"c:\windows\Tasks\RealDownloaderRealUpgradeScheduledTaskS-1-5-21-2659733977-570214497-571619954-1004.job"
"c:\windows\Tasks\RealPlayerRealUpgradeLogonTaskS-1-5-21-2659733977-570214497-571619954-1004.job"
"c:\windows\Tasks\RealPlayerRealUpgradeScheduledTaskS-1-5-21-2659733977-570214497-571619954-1004.job"
"c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-2659733977-570214497-571619954-1004.job"
"c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-2659733977-570214497-571619954-1004.job"
"c:\windows\Tasks\User_Feed_Synchronization-{02D609C1-B138-47A6-B631-4C8C2E89B3B5}.job"
"c:\windows\TEMP\9y5ht12u.TMP"
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\program files\Google\Update
c:\program files\Google\Update\1.3.28.17\GoogleCrashHandler.exe
c:\program files\Google\Update\1.3.28.17\GoogleCrashHandler64.exe
c:\program files\Google\Update\1.3.28.17\GoogleUpdate.exe
c:\program files\Google\Update\1.3.28.17\GoogleUpdateBroker.exe
c:\program files\Google\Update\1.3.28.17\GoogleUpdateComRegisterShell64.exe
c:\program files\Google\Update\1.3.28.17\GoogleUpdateHelper.msi
c:\program files\Google\Update\1.3.28.17\GoogleUpdateOnDemand.exe
c:\program files\Google\Update\1.3.28.17\GoogleUpdateSetup.exe
c:\program files\Google\Update\1.3.28.17\GoogleUpdateWebPlugin.exe
c:\program files\Google\Update\1.3.28.17\goopdate.dll
c:\program files\Google\Update\1.3.28.17\goopdateres_am.dll
c:\program files\Google\Update\1.3.28.17\goopdateres_ar.dll
c:\program files\Google\Update\1.3.28.17\goopdateres_bg.dll
c:\program files\Google\Update\1.3.28.17\goopdateres_bn.dll
c:\program files\Google\Update\1.3.28.17\goopdateres_ca.dll
c:\program files\Google\Update\1.3.28.17\goopdateres_cs.dll
c:\program files\Google\Update\1.3.28.17\goopdateres_da.dll
c:\program files\Google\Update\1.3.28.17\goopdateres_de.dll
c:\program files\Google\Update\1.3.28.17\goopdateres_el.dll
c:\program files\Google\Update\1.3.28.17\goopdateres_en-GB.dll
c:\program files\Google\Update\1.3.28.17\goopdateres_en.dll
c:\program files\Google\Update\1.3.28.17\goopdateres_es-419.dll
c:\program files\Google\Update\1.3.28.17\goopdateres_es.dll
c:\program files\Google\Update\1.3.28.17\goopdateres_et.dll
c:\program files\Google\Update\1.3.28.17\goopdateres_fa.dll
c:\program files\Google\Update\1.3.28.17\goopdateres_fi.dll
c:\program files\Google\Update\1.3.28.17\goopdateres_fil.dll
c:\program files\Google\Update\1.3.28.17\goopdateres_fr.dll
c:\program files\Google\Update\1.3.28.17\goopdateres_gu.dll
c:\program files\Google\Update\1.3.28.17\goopdateres_hi.dll
c:\program files\Google\Update\1.3.28.17\goopdateres_hr.dll
c:\program files\Google\Update\1.3.28.17\goopdateres_hu.dll
c:\program files\Google\Update\1.3.28.17\goopdateres_id.dll
c:\program files\Google\Update\1.3.28.17\goopdateres_is.dll
c:\program files\Google\Update\1.3.28.17\goopdateres_it.dll
c:\program files\Google\Update\1.3.28.17\goopdateres_iw.dll
c:\program files\Google\Update\1.3.28.17\goopdateres_ja.dll
c:\program files\Google\Update\1.3.28.17\goopdateres_kn.dll
c:\program files\Google\Update\1.3.28.17\goopdateres_ko.dll
c:\program files\Google\Update\1.3.28.17\goopdateres_lt.dll
c:\program files\Google\Update\1.3.28.17\goopdateres_lv.dll
c:\program files\Google\Update\1.3.28.17\goopdateres_ml.dll
c:\program files\Google\Update\1.3.28.17\goopdateres_mr.dll
c:\program files\Google\Update\1.3.28.17\goopdateres_ms.dll
c:\program files\Google\Update\1.3.28.17\goopdateres_nl.dll
c:\program files\Google\Update\1.3.28.17\goopdateres_no.dll
c:\program files\Google\Update\1.3.28.17\goopdateres_pl.dll
c:\program files\Google\Update\1.3.28.17\goopdateres_pt-BR.dll
c:\program files\Google\Update\1.3.28.17\goopdateres_pt-PT.dll
c:\program files\Google\Update\1.3.28.17\goopdateres_ro.dll
c:\program files\Google\Update\1.3.28.17\goopdateres_ru.dll
c:\program files\Google\Update\1.3.28.17\goopdateres_sk.dll
c:\program files\Google\Update\1.3.28.17\goopdateres_sl.dll
c:\program files\Google\Update\1.3.28.17\goopdateres_sr.dll
c:\program files\Google\Update\1.3.28.17\goopdateres_sv.dll
c:\program files\Google\Update\1.3.28.17\goopdateres_sw.dll
c:\program files\Google\Update\1.3.28.17\goopdateres_ta.dll
c:\program files\Google\Update\1.3.28.17\goopdateres_te.dll
c:\program files\Google\Update\1.3.28.17\goopdateres_th.dll
c:\program files\Google\Update\1.3.28.17\goopdateres_tr.dll
c:\program files\Google\Update\1.3.28.17\goopdateres_uk.dll
c:\program files\Google\Update\1.3.28.17\goopdateres_ur.dll
c:\program files\Google\Update\1.3.28.17\goopdateres_vi.dll
c:\program files\Google\Update\1.3.28.17\goopdateres_zh-CN.dll
c:\program files\Google\Update\1.3.28.17\goopdateres_zh-TW.dll
c:\program files\Google\Update\1.3.28.17\npGoogleUpdate3.dll
c:\program files\Google\Update\1.3.28.17\psmachine.dll
c:\program files\Google\Update\1.3.28.17\psmachine_64.dll
c:\program files\Google\Update\1.3.28.17\psuser.dll
c:\program files\Google\Update\1.3.28.17\psuser_64.dll
c:\program files\Google\Update\Download\{4DC8B4CA-1BDA-483E-B5FA-D3C12E15B62D}\46.0.2490.86\46.0.2490.86_chrome_installer.exe
c:\program files\Google\Update\GoogleUpdate.exe
c:\program files\Google\Update\Install\{C6650D7B-BEF9-456B-895E-2A594E38A593}\46.0.2490.86_chrome_installer.exe
c:\program files\Google\Update\Install\{DEF3C533-1444-4D8D-A2C3-33C47516DCC2}\40.0.2214.93_chrome_installer.exe
c:\program files\Skype\Updater
c:\program files\Skype\Updater\Updater.dll
c:\program files\Skype\Updater\Updater.exe
.
c:\windows\system32\drivers\i8042prt.sys . . . chybí !!
.
.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Legacy_SKYPEUPDATE
-------\Service_SkypeUpdate
-------\Legacy_gupdate
-------\Legacy_gupdate
-------\Service_gupdate
-------\Service_gupdatem
-------\Service_gupdate
-------\Service_gupdatem
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2015-10-16 do 2015-11-16 )))))))))))))))))))))))))))))))
.
.
2015-11-16 09:46 . 2015-11-16 09:27 24064 ----a-w- c:\windows\zoek-delete.exe
2015-11-16 09:27 . 2015-11-16 09:49 -------- d-----w- C:\zoek_backup
2015-11-15 09:41 . 2015-11-16 10:50 35064 ----a-w- c:\windows\system32\drivers\TrueSight.sys
2015-11-15 09:41 . 2015-11-15 10:09 -------- d-----w- c:\documents and settings\All Users\Data aplikací\RogueKiller
2015-11-14 19:47 . 2015-11-14 19:47 -------- d-----w- c:\documents and settings\All Users\Data aplikací\Malwarebytes
2015-11-14 19:47 . 2015-10-05 08:50 121560 ----a-w- c:\windows\system32\drivers\mbamchameleon.sys
2015-11-14 19:47 . 2015-10-05 08:50 23256 ----a-w- c:\windows\system32\drivers\mbam.sys
2015-11-14 19:40 . 2015-11-15 09:20 -------- d-----w- C:\AdwCleaner
2015-11-14 16:37 . 2015-11-14 16:37 -------- d-sh--w- c:\documents and settings\Default User\IETldCache
2015-11-14 16:37 . 2015-11-14 16:51 780488 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2015-11-14 16:37 . 2015-11-14 16:51 142536 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2015-11-14 16:35 . 2015-11-14 16:35 2324216 ----a-w- c:\windows\system32\ssins.exe
2015-11-14 08:40 . 2010-05-13 17:34 14232 ----a-w- c:\windows\system32\sh4native.exe
2015-11-01 18:53 . 2015-11-01 18:53 -------- d-----w- c:\documents and settings\Josef\Local Settings\Data aplikací\Showtime
2015-10-27 10:57 . 2015-10-29 10:09 -------- d-----w- C:\Output
2015-10-26 10:58 . 2015-10-26 11:27 -------- d-----w- c:\program files\pazera-software
2015-10-26 09:29 . 2015-10-26 09:29 -------- d-----w- C:\DVDFabDecrypter_Temp
2015-10-22 07:28 . 2015-10-22 07:28 -------- d-----w- c:\program files\Common Files\Skype
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2015-03-05 13:05 . 2015-03-15 18:26 2260 -c--a-w- c:\program files\voucher.bin
2013-03-13 07:03 . 2013-03-13 07:03 2174976 -c--a-w- c:\program files\Common Files\atimpenc.dll
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\NBHShellExt]
@="{8D2223A2-B3C6-4e32-B096-CDD11F628C60}"
[HKEY_CLASSES_ROOT\CLSID\{8D2223A2-B3C6-4e32-B096-CDD11F628C60}]
2009-10-16 08:44 97072 ----a-w- c:\program files\Nero\Tools\InCD\NBHshx.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"egui"="c:\program files\ESET\ESET Smart Security\egui.exe" [2014-10-01 5088456]
"BluetoothAuthenticationAgent"="bthprops.cpl" [2008-04-14 110592]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLinkedConnections"= 1 (0x1)
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-24 304128]
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"24c54e38"=2 (0x2)
.
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"ctfmon.exe"=c:\windows\system32\ctfmon.exe
"Adobe Reader Synchronizer"="c:\program files\Adobe\Reader 11.0\Reader\AdobeCollabSync.exe"
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"BluetoothAuthenticationAgent"=rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
"TkBellExe"="c:\program files\real\realplayer\update\realsched.exe" -osboot
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\Nero\\Nero 11\\Nero BackItUp\\BackItUp.exe"=
"g:\\instalace\\GAME\\Kyodai Mahjongg\\kmj.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"5985:TCP"= 5985:TCP:*:Disabled:Vzdálená správa systému Windows
"3389:TCP"= 3389:TCP:*:Disabled:@xpsp2res.dll,-22009
.
R?2 ssinstall;SInstalátor;c:\windows\system32\ssins.exe [14.11.2015 17:35 2324216]
R0 NBVol;Nero Backup Volume Filter Driver;c:\windows\system32\drivers\NBVol.sys [21.11.2011 12:30 56496]
R0 NBVolUp;Nero Backup Volume Upper Filter Driver;c:\windows\system32\drivers\NBVolUp.sys [21.11.2011 12:30 12464]
R1 BIOS;BIOS;c:\windows\system32\drivers\BIOS.sys [16.12.2012 9:41 13696]
R1 eamonm;eamonm;c:\windows\system32\drivers\eamonm.sys [10.10.2014 8:59 191928]
R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [10.10.2014 8:59 135296]
R2 {329F96B6-DF1E-4328-BFDA-39EA953C1312};Power Control [2012/04/16 14:52];c:\program files\CyberLink\PowerDVD11\Common\NavFilter\000.fcl [1.9.2011 21:51 77296]
R2 CLHNServiceForPowerDVD;CLHNServiceForPowerDVD;c:\program files\CyberLink\PowerDVD11\Kernel\DMP\CLHNServiceForPowerDVD.exe [16.4.2012 13:51 83240]
R2 CyberLink PowerDVD 11.0 Monitor Service;CyberLink PowerDVD 11.0 Monitor Service;c:\program files\CyberLink\PowerDVD11\Common\MediaServer\CLMSMonitorService.exe [16.4.2012 13:51 75048]
R2 CyberLink PowerDVD 11.0 Service;CyberLink PowerDVD 11.0 Service;c:\program files\CyberLink\PowerDVD11\Common\MediaServer\CLMSServerForPDVD11.exe [16.4.2012 13:51 292136]
R2 ekrn;ESET Service;c:\program files\ESET\ESET Smart Security\ekrn.exe [1.10.2014 14:40 1349576]
R2 NAUpdate;@c:\program files\Nero\Update\NASvc.exe,-200;c:\program files\Nero\Update\NASvc.exe [23.9.2011 18:37 641832]
R2 NeroRegInCDSrv;Nero Registry InCD Service;c:\program files\Nero\Tools\InCD\NBHRegInCDSrv.exe [16.10.2009 9:44 53560]
R2 ntk_PowerDVD;ntk_PowerDVD;c:\program files\CyberLink\PowerDVD11\Kernel\DMP\ntk_PowerDVD.sys [16.4.2012 13:51 71664]
R2 PassThru Service;Internet Pass-Through Service;c:\program files\HTC\Internet Pass-Through\PassThruSvr.exe [11.5.2014 16:00 167424]
R2 RealNetworks Downloader Resolver Service;RealNetworks Downloader Resolver Service;c:\program files\RealNetworks\RealDownloader\rndlresolversvc.exe [14.8.2013 15:19 39056]
R2 thdudf;TOSHIBA UDF2.5 Reader File System Driver;c:\windows\system32\drivers\thdudf.sys [25.11.2013 15:01 66944]
S3 AR9271;Wireless Network Adapter Service;c:\windows\system32\drivers\athuw.sys [1.3.2013 21:35 1763584]
S3 BioNT_BS;BioNT_BS;\??\g:\program files\bluescrn\BioNT_bs.sys --> g:\program files\bluescrn\BioNT_bs.sys [?]
S3 dgderdrv;dgderdrv;c:\windows\system32\drivers\dgderdrv.sys [19.3.2014 22:17 20032]
S3 epmntdrv;epmntdrv;c:\windows\system32\epmntdrv.sys [28.11.2014 22:35 13896]
S3 EsgScanner;EsgScanner;c:\windows\system32\drivers\EsgScanner.sys [14.2.2015 13:24 19984]
S3 EuGdiDrv;EuGdiDrv;c:\windows\system32\EuGdiDrv.sys [28.11.2014 22:35 9160]
S3 HTCAND32;HTC Device Driver;c:\windows\system32\drivers\ANDROIDUSB.sys [11.5.2014 16:00 24576]
S3 htcnprot;HTC NDIS Protocol Driver;c:\windows\system32\drivers\htcnprot.sys [7.12.2012 17:27 21248]
S3 IT9135BDA;IT9135 BDA Devices;c:\windows\system32\drivers\IT9135BDA.SYS [3.2.2013 15:20 145280]
S3 Revoflt;Revoflt;c:\windows\system32\drivers\revoflt.sys [29.11.2011 18:32 27064]
.
Obsah adresáře 'Naplánované úlohy'
.
2015-11-16 c:\windows\Tasks\Component Rest.job
- c:\documents and settings\Josef\Local Settings\Application Data\Component Rest\xBin\ComponentRest.dll [2015-11-14 10:41]
.
2015-04-26 c:\windows\Tasks\RealDownloaderDownloaderScheduledTaskS-1-5-21-2659733977-570214497-571619954-1004.job
- c:\program files\RealNetworks\RealDownloader\recordingmanager.exe [2013-08-14 14:19]
.
2015-11-16 c:\windows\Tasks\RealDownloaderRealUpgradeLogonTaskS-1-5-21-2659733977-570214497-571619954-1004.job
- c:\program files\RealNetworks\RealDownloader\realupgrade.exe [2013-08-14 14:19]
.
2015-11-14 c:\windows\Tasks\RealDownloaderRealUpgradeScheduledTaskS-1-5-21-2659733977-570214497-571619954-1004.job
- c:\program files\RealNetworks\RealDownloader\realupgrade.exe [2013-08-14 14:19]
.
2015-11-16 c:\windows\Tasks\RealPlayerRealUpgradeLogonTaskS-1-5-21-2659733977-570214497-571619954-1004.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2013-08-14 16:13]
.
2015-11-16 c:\windows\Tasks\RealPlayerRealUpgradeScheduledTaskS-1-5-21-2659733977-570214497-571619954-1004.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2013-08-14 16:13]
.
2015-11-16 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-2659733977-570214497-571619954-1004.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2013-08-14 16:13]
.
2015-10-30 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-2659733977-570214497-571619954-1004.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2013-08-14 16:13]
.
2015-11-16 c:\windows\Tasks\User_Feed_Synchronization-{02D609C1-B138-47A6-B631-4C8C2E89B3B5}.job
- c:\windows\system32\msfeedssync.exe [2007-08-13 03:31]
.
.
------- Doplňkový sken -------
.
uInternet Connection Wizard,ShellNext = iexplore
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: Send To &Bluetooth - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: {{7E6A20FB-153F-402c-A84B-1A64E1955D3D} - {7E6A20FB-153F-402c-A84B-1A64E1955D3D} -
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748449} - {CC963627-B1DC-40E0-B52A-CF21EE748450} -
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748450} - {CC963627-B1DC-40E0-B52A-CF21EE748450} -
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748451} - {CC963627-B1DC-40E0-B52A-CF21EE748451} -
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748452} - {CC963627-B1DC-40E0-B52A-CF21EE748452} -
TCP: DhcpNameServer = 192.168.1.1
FF - ProfilePath - c:\documents and settings\Josef\Data aplikací\Mozilla\Firefox\Profiles\pvst96ez.default-1447488994359\
FF - prefs.js: browser.startup.homepage - hxxps://www.seznam.cz/
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2015-11-16 17:20
Windows 5.1.2600 Service Pack 3 NTFS
.
skenování skrytých procesů ...
.
skenování skrytých položek 'Po spuštění' ...
.
skenování skrytých souborů ...
.
sken byl úspešně dokončen
skryté soubory: 0
.
**************************************************************************
.
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\{329F96B6-DF1E-4328-BFDA-39EA953C1312}]
"ImagePath"="\??\c:\program files\CyberLink\PowerDVD11\Common\NavFilter\000.fcl"
.
--------------------- Knihovny navázané na běžící procesy ---------------------
.
- - - - - - - > 'explorer.exe'(3048)
c:\program files\Nero\Tools\InCD\NBHshx.dll
c:\windows\system32\msi.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\btncopy.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\program files\Nero\Tools\InCD\InCDSrv.exe
c:\program files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
c:\windows\system32\rundll32.exe
c:\windows\system32\imapi.exe
c:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Celkový čas: 2015-11-16 17:21:54 - počítač byl restartován
ComboFix-quarantined-files.txt 2015-11-16 16:21
ComboFix2.txt 2015-11-16 10:06
.
Před spuštěním: Volných bajtů: 79 644 856 320
Po spuštění: Volných bajtů: 79 622 496 256
.
- - End Of File - - B60FAEC8E45000E0FDD723E1203F5CD0
413FC2A0C716421B3158746D63736515

co dál

[Orcus]

ComboFix se odinstaluje takto:
Start-Spustit a zadej ComboFix /Uninstall

====================================================

Vyčisti systém CCleanerem

====================================================

Stáhni si zde DelFix
http://general-changelog-team.fr/fr/dow ... e/9-delfix

ulož si soubor na plochu.
Poklepáním na ikonu spusť nástroj Delfix.exe
( Ve Windows Vista, Windows 7 a 8, musíš spustit soubor pravým tlačítkem myši -> Spustit jako správce .
V hlavním menu, zkontroluj tyto možnosti - Odstranění dezinfekce nástrojů (Remove desinfection tools) – Vyčistit body obnovy (Purge System Restore) .
Poté klikněte na tlačítko Spustit (Run) a nech nástroj dělat svoji práci.

Poté se zpráva se otevře (DelFix.txt). Vlož celý obsah zprávy sem. Jinak je zpráva zde:
v C: \ DelFix.txt

Co problémy? + nový log z HJT