Nejspíše neodstranitelný bordel

[jerabina]

Prosím, postupuj následujícím způsobem:
Otevřít poznámkový blok (Start => Všechny programy => Příslušenství => Poznámkový blok).
Prosím, zkopíruj do něj celý obsah níže.

Kód: Vybrat vše

Start
CloseProcesses:

HKLM\...\Run: [beja] => wscript.exe //B "C:\Users\Ema\AppData\Local\Temp\beja.vbs" <===== ATTENTION
HKU\S-1-5-21-623479573-2184597712-2728334859-1002\...\Run: [Windows 8] => wscript.exe //B "C:\Users\Ema\AppData\Local\Temp\Windows 8.1 Activator 2015 .vbs" <===== ATTENTION
HKU\S-1-5-21-623479573-2184597712-2728334859-1002\...\Run: [beja] => wscript.exe //B "C:\Users\Ema\AppData\Local\Temp\beja.vbs" <===== ATTENTION
HKU\S-1-5-21-623479573-2184597712-2728334859-1002\...\Run: [icq] => C:\Users\Ema\AppData\Roaming\ICQM\icq.exe [39738376 2015-11-12] (ICQ)
HKU\S-1-5-21-623479573-2184597712-2728334859-1002\...\Run: [SpybotPostWindows10UpgradeReInstall] => C:\Program Files\Common Files\AV\Spybot - Search and Destroy\Test.exe [1011200 2015-07-28] (Safer-Networking Ltd.)
Startup: C:\Users\Ema\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a1.exe [2015-11-23] ()
Startup: C:\Users\Ema\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a10.exe [2015-11-23] ()
Startup: C:\Users\Ema\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a2.exe [2015-11-23] ()
Startup: C:\Users\Ema\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a3.exe [2015-11-23] ()
Startup: C:\Users\Ema\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a4.exe [2015-11-23] ()
Startup: C:\Users\Ema\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a5.exe [2015-11-23] ()
Startup: C:\Users\Ema\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a6.exe [2015-11-23] ()
Startup: C:\Users\Ema\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a7.exe [2015-11-23] ()
Startup: C:\Users\Ema\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a8.exe [2015-11-23] ()
Startup: C:\Users\Ema\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a9.exe [2015-11-23] ()
BootExecute: autocheck autochk * sdnclean64.exe

C:\Users\Ema\AppData\Local\Temp\beja.vbs
C:\Users\Ema\AppData\Local\Temp\Windows 8.1 Activator 2015 .vbs
C:\Users\Ema\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a1.exe
C:\Users\Ema\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a10.exe
C:\Users\Ema\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a2.exe
C:\Users\Ema\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a3.exe
C:\Users\Ema\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a4.exe
C:\Users\Ema\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a5.exe
C:\Users\Ema\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a6.exe
C:\Users\Ema\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a7.exe
C:\Users\Ema\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a8.exe
C:\Users\Ema\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a9.exe

C:\Program Files\Common Files\AV\Spybot - Search and Destroy
C:\Program Files (x86)\Spybot - Search & Destroy 2
C:\ProgramData\Spybot - Search & Destroy
C:\ProgramData\RogueKiller

Task: {277843A3-28C3-44A4-9150-7C59F172090B} - \Optimize Start Menu Cache Files-S-1-5-21-623479573-2184597712-2728334859-1001 -> No File <==== ATTENTION
Task: {37F84C47-5AFE-4BE3-9F37-A64B956BF8B3} - System32\Tasks\AutoKMS => C:\Windows\AutoKMS\AutoKMS.exe [2015-11-11] ()

C:\Program Files (x86)\KMSPico 10.0.6
C:\Windows\AutoKMS\AutoKMS.exe

FirewallRules: [{7DFA278B-506A-4E31-8085-7F2CF6C6DB4D}] => (Allow) C:\ProgramData\MicrosoftToolkit\MicrosoftToolkit\2.5.0.0\اسم مجلد اختار اي اسم لا يهم\MicrosoftToolkit.exe
FirewallRules: [{B4D62058-E525-4EB5-842C-9FFFCAEAE83B}] => (Allow) C:\ProgramData\MicrosoftToolkit\MicrosoftToolkit\2.5.0.0\اسم مجلد اختار اي اسم لا يهم\MicrosoftToolkit.exe

C:\ProgramData\MicrosoftToolkit\MicrosoftToolkit\

EmptyTemp:
End

(Můžeš použít funkci „vybrat vše“, klepni pravým tlačítkem myši na levé horní políčko v otevřeném poznámkovém bloku a zvol „ Vložit“).

Ulož jej na na plochu jako fixlist.txt

Spusťt FRST a stiskni tlačítko „Fix“ (Opravit) jen jednou a čekej.
Nástroj vypracuje log na ploše (Fixlog.txt), prosím zkopíruj sem celý jeho obsah.

[Reklama]

[emocuc]

Tady to je:

Fix result of Farbar Recovery Scan Tool (x64) Version:20-12-2015
Ran by Ema (2015-12-21 15:47:40) Run:1
Running from C:\Users\Ema\Desktop
Loaded Profiles: Ema (Available Profiles: Ema)
Boot Mode: Normal
==============================================

fixlist content:
*****************
Start
CloseProcesses:

HKLM\...\Run: [beja] => wscript.exe //B "C:\Users\Ema\AppData\Local\Temp\beja.vbs" <===== ATTENTION
HKU\S-1-5-21-623479573-2184597712-2728334859-1002\...\Run: [Windows 8] => wscript.exe //B "C:\Users\Ema\AppData\Local\Temp\Windows 8.1 Activator 2015 .vbs" <===== ATTENTION
HKU\S-1-5-21-623479573-2184597712-2728334859-1002\...\Run: [beja] => wscript.exe //B "C:\Users\Ema\AppData\Local\Temp\beja.vbs" <===== ATTENTION
HKU\S-1-5-21-623479573-2184597712-2728334859-1002\...\Run: [icq] => C:\Users\Ema\AppData\Roaming\ICQM\icq.exe [39738376 2015-11-12] (ICQ)
HKU\S-1-5-21-623479573-2184597712-2728334859-1002\...\Run: [SpybotPostWindows10UpgradeReInstall] => C:\Program Files\Common Files\AV\Spybot - Search and Destroy\Test.exe [1011200 2015-07-28] (Safer-Networking Ltd.)
Startup: C:\Users\Ema\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a1.exe [2015-11-23] ()
Startup: C:\Users\Ema\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a10.exe [2015-11-23] ()
Startup: C:\Users\Ema\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a2.exe [2015-11-23] ()
Startup: C:\Users\Ema\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a3.exe [2015-11-23] ()
Startup: C:\Users\Ema\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a4.exe [2015-11-23] ()
Startup: C:\Users\Ema\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a5.exe [2015-11-23] ()
Startup: C:\Users\Ema\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a6.exe [2015-11-23] ()
Startup: C:\Users\Ema\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a7.exe [2015-11-23] ()
Startup: C:\Users\Ema\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a8.exe [2015-11-23] ()
Startup: C:\Users\Ema\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a9.exe [2015-11-23] ()
BootExecute: autocheck autochk * sdnclean64.exe

C:\Users\Ema\AppData\Local\Temp\beja.vbs
C:\Users\Ema\AppData\Local\Temp\Windows 8.1 Activator 2015 .vbs
C:\Users\Ema\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a1.exe
C:\Users\Ema\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a10.exe
C:\Users\Ema\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a2.exe
C:\Users\Ema\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a3.exe
C:\Users\Ema\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a4.exe
C:\Users\Ema\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a5.exe
C:\Users\Ema\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a6.exe
C:\Users\Ema\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a7.exe
C:\Users\Ema\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a8.exe
C:\Users\Ema\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a9.exe

C:\Program Files\Common Files\AV\Spybot - Search and Destroy
C:\Program Files (x86)\Spybot - Search & Destroy 2
C:\ProgramData\Spybot - Search & Destroy
C:\ProgramData\RogueKiller

Task: {277843A3-28C3-44A4-9150-7C59F172090B} - \Optimize Start Menu Cache Files-S-1-5-21-623479573-2184597712-2728334859-1001 -> No File <==== ATTENTION
Task: {37F84C47-5AFE-4BE3-9F37-A64B956BF8B3} - System32\Tasks\AutoKMS => C:\Windows\AutoKMS\AutoKMS.exe [2015-11-11] ()

C:\Program Files (x86)\KMSPico 10.0.6
C:\Windows\AutoKMS\AutoKMS.exe

FirewallRules: [{7DFA278B-506A-4E31-8085-7F2CF6C6DB4D}] => (Allow) C:\ProgramData\MicrosoftToolkit\MicrosoftToolkit\2.5.0.0\??? ???? ????? ?? ??? ?? ???\MicrosoftToolkit.exe
FirewallRules: [{B4D62058-E525-4EB5-842C-9FFFCAEAE83B}] => (Allow) C:\ProgramData\MicrosoftToolkit\MicrosoftToolkit\2.5.0.0\??? ???? ????? ?? ??? ?? ???\MicrosoftToolkit.exe

C:\ProgramData\MicrosoftToolkit\MicrosoftToolkit\

EmptyTemp:
End
*****************

Processes closed successfully.
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\\beja => value removed successfully
HKU\S-1-5-21-623479573-2184597712-2728334859-1002\Software\Microsoft\Windows\CurrentVersion\Run\\Windows 8 => value removed successfully
HKU\S-1-5-21-623479573-2184597712-2728334859-1002\Software\Microsoft\Windows\CurrentVersion\Run\\beja => value removed successfully
HKU\S-1-5-21-623479573-2184597712-2728334859-1002\Software\Microsoft\Windows\CurrentVersion\Run\\icq => value removed successfully
HKU\S-1-5-21-623479573-2184597712-2728334859-1002\Software\Microsoft\Windows\CurrentVersion\Run\\SpybotPostWindows10UpgradeReInstall => value removed successfully
C:\Users\Ema\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a1.exe => moved successfully
C:\Users\Ema\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a10.exe => moved successfully
C:\Users\Ema\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a2.exe => moved successfully
C:\Users\Ema\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a3.exe => moved successfully
C:\Users\Ema\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a4.exe => moved successfully
C:\Users\Ema\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a5.exe => moved successfully
C:\Users\Ema\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a6.exe => moved successfully
C:\Users\Ema\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a7.exe => moved successfully
C:\Users\Ema\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a8.exe => moved successfully
C:\Users\Ema\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a9.exe => moved successfully
hklm\System\CurrentControlSet\Control\Session Manager\\BootExecute => value restored successfully
"C:\Users\Ema\AppData\Local\Temp\beja.vbs" => not found.
"C:\Users\Ema\AppData\Local\Temp\Windows 8.1 Activator 2015 .vbs" => not found.
"C:\Users\Ema\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a1.exe" => not found.
"C:\Users\Ema\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a10.exe" => not found.
"C:\Users\Ema\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a2.exe" => not found.
"C:\Users\Ema\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a3.exe" => not found.
"C:\Users\Ema\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a4.exe" => not found.
"C:\Users\Ema\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a5.exe" => not found.
"C:\Users\Ema\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a6.exe" => not found.
"C:\Users\Ema\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a7.exe" => not found.
"C:\Users\Ema\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a8.exe" => not found.
"C:\Users\Ema\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a9.exe" => not found.
C:\Program Files\Common Files\AV\Spybot - Search and Destroy => moved successfully
C:\Program Files (x86)\Spybot - Search & Destroy 2 => moved successfully
C:\ProgramData\Spybot - Search & Destroy => moved successfully
C:\ProgramData\RogueKiller => moved successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{277843A3-28C3-44A4-9150-7C59F172090B}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{277843A3-28C3-44A4-9150-7C59F172090B}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Optimize Start Menu Cache Files-S-1-5-21-623479573-2184597712-2728334859-1001" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Boot\{37F84C47-5AFE-4BE3-9F37-A64B956BF8B3}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{37F84C47-5AFE-4BE3-9F37-A64B956BF8B3}" => key removed successfully
C:\Windows\System32\Tasks\AutoKMS => moved successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\AutoKMS" => key removed successfully
C:\Program Files (x86)\KMSPico 10.0.6 => moved successfully
C:\Windows\AutoKMS\AutoKMS.exe => moved successfully
HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\{7DFA278B-506A-4E31-8085-7F2CF6C6DB4D} => value removed successfully
HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\{B4D62058-E525-4EB5-842C-9FFFCAEAE83B} => value removed successfully
C:\ProgramData\MicrosoftToolkit\MicrosoftToolkit => moved successfully
EmptyTemp: => 204.8 MB temporary data Removed.


The system needed a reboot.

==== End of Fixlog 15:47:48 ====

[jaro3]

Co problémy?

[emocuc]

Zatím sem nic nezaznamenal , ono sem i na začátku moc dobře nerozeznal že to mám zablešený.Snad už tam nic není.

[jerabina]

Stáhni si zde DelFix
https://toolslib.net/downloads/viewdownload/2-delfix/

ulož si soubor na plochu.
Poklepáním na ikonu spusť nástroj Delfix.exe
( Ve Windows Vista, Windows 7 a 8, musíš spustit soubor pravým tlačítkem myši -> Spustit jako správce .
V hlavním menu, zkontroluj tyto možnosti - Odstranění dezinfekce nástrojů (Remove desinfection tools) – Vyčistit body obnovy (Purge System Restore) .
Poté klikněte na tlačítko Spustit (Run) a nech nástroj dělat svoji práci.

Poté se zpráva se otevře (DelFix.txt). Vlož celý obsah zprávy sem. Jinak je zpráva zde:
v C: \ DelFix.txt

Pokud nejsou problémy, je to vše a můžeš dát vyřešeno - zelenou "fajfku"

[emocuc]

Tak tady:

# DelFix v1.011 - Logfile created 21/12/2015 at 16:41:31
# Updated 18/08/2015 by Xplode
# Username : Ema - EMIL
# Operating System : Windows 8.1 Pro (64 bits)

~ Removing disinfection tools ...

Deleted : C:\FRST
Deleted : C:\zoek_backup
Deleted : C:\AdwCleaner
Deleted : C:\zoek-results.log
Deleted : C:\Users\Ema\Desktop\Addition.txt
Deleted : C:\Users\Ema\Desktop\AdwCleaner found no malicious program on you pc.txt
Deleted : C:\Users\Ema\Desktop\AdwCleaner.exe
Deleted : C:\Users\Ema\Desktop\Fixlog.txt
Deleted : C:\Users\Ema\Desktop\FRST.txt
Deleted : C:\Users\Ema\Desktop\FRST64.exe
Deleted : C:\Users\Ema\Desktop\JRT.exe
Deleted : C:\Users\Ema\Desktop\JRT.txt
Deleted : C:\Users\Ema\Desktop\HijackThis.exe
Deleted : C:\Users\Ema\Desktop\hijackthis.log
Deleted : C:\Users\Ema\Desktop\MKV Player.lnk
Deleted : C:\Users\Ema\Desktop\RogueKillerX64.exe
Deleted : C:\Users\Ema\Desktop\zoek.exe
Deleted : C:\Users\Ema\Downloads\RSITx64.exe
Deleted : C:\Users\Ema\Downloads\TFC.exe
Deleted : HKLM\SOFTWARE\OldTimer Tools
Deleted : HKLM\SOFTWARE\AdwCleaner
Deleted : HKLM\SOFTWARE\TrendMicro\Hijackthis

~ Cleaning system restore ...

Deleted : RP #3 [Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.50727 | 11/11/2015 19:47:58]
Deleted : RP #4 [JRT Pre-Junkware Removal | 12/20/2015 21:09:10]

New restore point created !

########## - EOF - ##########


EI už mě nepadá a nehází to win hlášky takže to bude snad už v pohodě.

[emocuc]

Ještě jedna otázka , tenhle nástroj je k pomazání všech těch předešlejch nástroju?Sem se totiž ted pokusil smazat všechno co jsem za tu dobu použil a mám na ploše a tak nějak to nejde.Píše to že dané položky tam nejsou ale vizuálně jsou.

Edit: a ted sem zjistil že s tím IE je to furt stejné , když uzavřu internet hodí to win okno že to přestalo fungovat.

[jerabina]

Ano, tento program by měl odstranit všechny čistící nástroje.

Internet Explorer zkus přeinstalovat.

[emocuc]

Tak vám mockrát děkuju , zdá se že je pc bez havěti.
*vyřešeno*