Logfile of Trend Micro HijackThis v2.0.5
Scan saved at 19:37:36, on 30.3.2016
Platform: Unknown Windows (WinNT 6.02.1008)
MSIE: Internet Explorer v11.0 (11.00.10586.0020)
FIREFOX: 45.0.1 (x86 cs)
Boot mode: Normal
Running processes:
C:\PROGRA~1\Lenovo\Zoom\TPSCREX.EXE
C:\Program Files\ESET\ESET Smart Security\egui.exe
C:\WINDOWS\system32\sihost.exe
C:\WINDOWS\system32\taskhostw.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Lenovo\iMController\PluginHost\Lenovo.Modern.ImController.PluginHost.exe
C:\Windows\System32\RuntimeBroker.exe
C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe
C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe
C:\WINDOWS\system32\SettingSyncHost.exe
C:\Program Files\Apoint2K\Apoint.exe
C:\Program Files\Lenovo\Communications Utility\TpKnrres.exe
C:\Program Files\Apoint2K\Apntex.exe
C:\WINDOWS\system32\conhost.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\Lenovo\Lenovo Solution Center\LSCNotify.exe
C:\Users\Ladicek\AppData\Local\Apps\2.0\R5982RNW.L8V\LAY5JG3A.7EZ\lsb...tion_91a10ba61c75c82d_0001.0005_a24d0d716055ed94\LSB.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Opera\36.0.2130.32\opera.exe
C:\Program Files\Opera\36.0.2130.32\opera_crashreporter.exe
C:\Program Files\Opera\36.0.2130.32\opera.exe
C:\Program Files\Opera\36.0.2130.32\opera.exe
C:\Program Files\Opera\36.0.2130.32\opera.exe
C:\Program Files\Opera\36.0.2130.32\opera.exe
C:\Program Files\Opera\36.0.2130.32\opera.exe
C:\Program Files\Opera\36.0.2130.32\opera.exe
C:\Program Files\Opera\36.0.2130.32\opera.exe
C:\Program Files\Opera\36.0.2130.32\opera.exe
C:\Program Files\Opera\36.0.2130.32\opera.exe
C:\Program Files\Opera\36.0.2130.32\opera.exe
C:\Program Files\Opera\36.0.2130.32\opera.exe
C:\Program Files\Opera\36.0.2130.32\opera.exe
C:\Program Files\Opera\36.0.2130.32\opera.exe
C:\Program Files\Opera\36.0.2130.32\opera.exe
C:\Program Files\Opera\36.0.2130.32\opera.exe
C:\Program Files\Opera\36.0.2130.32\opera.exe
C:\Program Files\Opera\36.0.2130.32\opera.exe
C:\Program Files\Opera\36.0.2130.32\opera.exe
C:\Program Files\Opera\36.0.2130.32\opera.exe
C:\Program Files\Opera\36.0.2130.32\opera.exe
C:\Program Files\Opera\36.0.2130.32\opera.exe
C:\Program Files\Opera\36.0.2130.32\opera.exe
C:\WINDOWS\system32\ApplicationFrameHost.exe
C:\WINDOWS\ImmersiveControlPanel\SystemSettings.exe
C:\Program Files\WindowsApps\Microsoft.Messaging_2.13.20000.0_x86__8wekyb3d8bbwe\SkypeHost.exe
C:\Program Files\Opera\36.0.2130.32\opera.exe
D:\Stažené soubory\scoped_dir_1360_9835\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/p/?LinkId=255141
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/p/?LinkId=255141
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~1\Office14\GROOVEEX.DLL
O2 - BHO: URLRedirectionBHO - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~1\MICROS~1\Office14\URLREDIR.DLL
O2 - BHO: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe
O4 - HKLM\..\Run: [FingerPrintSoftware] "C:\Program Files\Lenovo Fingerprint Software\fpapp.exe" \s
O4 - HKLM\..\Run: [FingerPrintSoftwareSplashScreen] "C:\Program Files\Lenovo Fingerprint Software\SplashScreen.exe" \s
O4 - HKLM\..\Run: [LENOVO.TPKNRRES] C:\Program Files\Lenovo\Communications Utility\TPKNRRES.exe
O4 - HKLM\..\Run: [PasswordManager] C:\Program Files\Lenovo\Password Manager\password_manager.exe
O4 - HKLM\..\Run: [hpqSRMon] C:\Program Files\HP\Digital Imaging\bin\hpqSRMon.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [AcWin7Hlpr] C:\Program Files\Lenovo\Access Connections\AcTBenabler.exe
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /minimized /regrun
O4 - Startup: MagicDisc.lnk = C:\Program Files\MagicDisc\MagicDisc.exe
O4 - Global Startup: Digital Line Detect.lnk = C:\Program Files\Digital Line Detect\DLG.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\Program Files\Microsoft Office\Office14\EXCEL.EXE/3000
O8 - Extra context menu item: Od&eslat do aplikace OneNote - res://C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll/105
O9 - Extra button: Odeslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Od&eslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll
O9 - Extra button: P&ropojené poznámky aplikace OneNote - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
O9 - Extra 'Tools' menuitem: P&ropojené poznámky aplikace OneNote - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
O9 - Extra button: Zobrazit nebo skrýt HP Smart Web Printing - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O15 - Trusted Zone: http://help.eset.com (HKLM)
O15 - ESC Trusted Zone: http://help.eset.com (HKLM)
O18 - Protocol: tbauth - {14654CA6-5711-491D-B89A-58E571679951} - C:\Windows\System32\tbauth.dll
O18 - Protocol: windows.tbauth - {14654CA6-5711-491D-B89A-58E571679951} - C:\Windows\System32\tbauth.dll
O18 - Filter hijack: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL
O23 - Service: AcPrfMgrSvc - Lenovo - C:\Program Files\Lenovo\Access Connections\AcPrfMgrSvc.exe
O23 - Service: AcSvc - Lenovo - C:\Program Files\Lenovo\Access Connections\AcSvc.exe
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: AuthenTec Fingerprint Service (ATService) - AuthenTec, Inc. - C:\Windows\system32\AtService.exe
O23 - Service: ESET Service (ekrn) - ESET - C:\Program Files\ESET\ESET Smart Security\ekrn.exe
O23 - Service: Firebird Guardian - DefaultInstance (FirebirdGuardianDefaultInstance) - Firebird Project - C:\Program Files\Firebird\Firebird_2_5\bin\fbguard.exe
O23 - Service: Firebird Server - DefaultInstance (FirebirdServerDefaultInstance) - Firebird Project - C:\Program Files\Firebird\Firebird_2_5\bin\fbserver.exe
O23 - Service: HiSuiteOuc.exe - Unknown owner - C:\ProgramData\HiSuiteOuc\HiSuiteOuc.exe
O23 - Service: HP SI Service (HPSIService) - HP - C:\WINDOWS\system32\HPSIsvc.exe
O23 - Service: HP Support Solutions Framework Service (HPSupportSolutionsFrameworkService) - Hewlett-Packard Company - C:\Program Files\Hewlett-Packard\HP Support Solutions\HPSupportSolutionsFrameworkService.exe
O23 - Service: HuaweiHiSuiteService.exe - Unknown owner - C:\ProgramData\HandSetService\HuaweiHiSuiteService.exe
O23 - Service: @oem6.inf,%ibm.svcDesc0%;Lenovo PM Service (IBMPMSVC) - Lenovo. - C:\WINDOWS\system32\ibmpmsvc.exe
O23 - Service: System Interface Foundation Service (ImControllerService) - Lenovo Group Limited - C:\Program Files\Lenovo\ImController\Service\Lenovo.Modern.ImController.exe
O23 - Service: Lenovo Camera Mute (LENOVO.CAMMUTE) - Lenovo Group Limited - C:\Program Files\Lenovo\Communications Utility\CAMMUTE.exe
O23 - Service: Lenovo Microphone Mute (LENOVO.MICMUTE) - Lenovo Group Limited - C:\Program Files\LENOVO\HOTKEY\MICMUTE.exe
O23 - Service: Lenovo Keyboard Noise Reduction (LENOVO.TPKNRSVC) - Lenovo Group Limited - C:\Program Files\Lenovo\Communications Utility\TPKNRSVC.exe
O23 - Service: LSCWinService - Lenovo - C:\Program Files\Lenovo\Lenovo Solution Center\App\LSCWinService.exe
O23 - Service: Skype Updater (SkypeUpdate) - Skype Technologies - C:\Program Files\Skype\Updater\Updater.exe
O23 - Service: System Update (SUService) - Unknown owner - C:\Program Files\Lenovo\System Update\SUService.exe
O23 - Service: Lenovo Hotkey Client Loader (TPHKLOAD) - Lenovo Group Limited - C:\Program Files\LENOVO\HOTKEY\TPHKLOAD.exe
O23 - Service: On Screen Display (TPHKSVC) - Lenovo Group Limited - C:\Program Files\LENOVO\HOTKEY\TPHKSVC.exe
--
End of file - 9760 bytes
nejdou i žádné ikony jak na ploše tak v průzkumníku díky
Prosím o kontrolu Vyřešeno
-
jaro3
- člen Security týmu
-
Guru Level 15
- Příspěvky: 43294
- Registrován: červen 07
- Bydliště: Jižní Čechy
- Pohlaví:
- Stav:
Offline
Re: Prosím o kontrolu
Stáhni si ATF Cleaner
Poklepej na ATF Cleaner.exe, klikni na select all found, poté:
-Když používáš Firefox (Mozzila), klikni na Firefox nahoře a vyber: Select All, poté klikni na Empty Selected.
-Když používáš Operu, klikni nahoře na Operu a vyber: Select All, poté klikni na Empty Selected. Poté klikni na Main (hlavní stránku ) a klikni na Empty Selected.
Po vyčištění klikni na Exit k zavření programu.
ATF-Cleaner je jednoduchý nástroj na odstranění historie z webového prohlížeče. Program dokáže odstranit cache, cookies, historii a další stopy po surfování na Internetu. Mezi podporované prohlížeče patří Internet Explorer, Firefox a Opera. Aplikace navíc umí odstranit dočasné soubory Windows, vysypat koš atd.
- Pokud používáš jen Google Chrome , tak ATF nemusíš použít.
===================================================
Stáhni si TFC
Otevři soubor a zavři všechny ostatní okna, Klikni na Start k zahájení procesu. Program by neměl trvat dlouho.
Poté by se měl PC restartovat, pokud ne , proveď sám.
===================================================
Stáhni AdwCleaner (by Xplode)
Ulož si ho na svojí plochu
Ukonči všechny programy , okna a prohlížeče
Spusť program poklepáním a klikni na „Prohledat-Scan“
Po skenu se objeví log ( jinak je uložen systémovem disku jako AdwCleaner[R?].txt), jeho obsah sem celý vlož.
===================================================
Stáhni si Malwarebytes' Anti-Malware
- Při instalaci odeber zatržítko u „Povolit bezplatnou zkušební verzi Malwarebytes' Anti-Malware Premium“
Nainstaluj a spusť ho
- na konci instalace se ujisti že máš zvoleny/zatrhnuty obě možnosti:
Aktualizace Malwarebytes' Anti-Malware a Spustit aplikaci Malwarebytes' Anti-Malware, pokud jo tak klikni na tlačítko konec
- pokud bude nalezena aktualizace, tak se stáhne a nainstaluje
- program se po té spustí a klikni na Skenovat nyní a
- po proběhnutí programu se ti objeví hláška vpravo dole tak klikni na Kopírovat do schránky a a vlož sem celý log.
- po té klikni na tlačítko Exit, objeví se ti hláška tak zvol Ano
(zatím nic nemaž!).
Pokud budou problémy , spusť v nouz. režimu.
Poklepej na ATF Cleaner.exe, klikni na select all found, poté:
-Když používáš Firefox (Mozzila), klikni na Firefox nahoře a vyber: Select All, poté klikni na Empty Selected.
-Když používáš Operu, klikni nahoře na Operu a vyber: Select All, poté klikni na Empty Selected. Poté klikni na Main (hlavní stránku ) a klikni na Empty Selected.
Po vyčištění klikni na Exit k zavření programu.
ATF-Cleaner je jednoduchý nástroj na odstranění historie z webového prohlížeče. Program dokáže odstranit cache, cookies, historii a další stopy po surfování na Internetu. Mezi podporované prohlížeče patří Internet Explorer, Firefox a Opera. Aplikace navíc umí odstranit dočasné soubory Windows, vysypat koš atd.
- Pokud používáš jen Google Chrome , tak ATF nemusíš použít.
===================================================
Stáhni si TFC
Otevři soubor a zavři všechny ostatní okna, Klikni na Start k zahájení procesu. Program by neměl trvat dlouho.
Poté by se měl PC restartovat, pokud ne , proveď sám.
===================================================
Stáhni AdwCleaner (by Xplode)
Ulož si ho na svojí plochu
Ukonči všechny programy , okna a prohlížeče
Spusť program poklepáním a klikni na „Prohledat-Scan“
Po skenu se objeví log ( jinak je uložen systémovem disku jako AdwCleaner[R?].txt), jeho obsah sem celý vlož.
===================================================
Stáhni si Malwarebytes' Anti-Malware
- Při instalaci odeber zatržítko u „Povolit bezplatnou zkušební verzi Malwarebytes' Anti-Malware Premium“
Nainstaluj a spusť ho
- na konci instalace se ujisti že máš zvoleny/zatrhnuty obě možnosti:
Aktualizace Malwarebytes' Anti-Malware a Spustit aplikaci Malwarebytes' Anti-Malware, pokud jo tak klikni na tlačítko konec
- pokud bude nalezena aktualizace, tak se stáhne a nainstaluje
- program se po té spustí a klikni na Skenovat nyní a
- po proběhnutí programu se ti objeví hláška vpravo dole tak klikni na Kopírovat do schránky a a vlož sem celý log.
- po té klikni na tlačítko Exit, objeví se ti hláška tak zvol Ano
(zatím nic nemaž!).
Pokud budou problémy , spusť v nouz. režimu.
Při práci s programy HJT, ComboFix,MbAM, SDFix aj. zavřete všechny ostatní aplikace a prohlížeče!
Neposílejte logy do soukromých zpráv.Po dobu mé nepřítomnosti mě zastupuje memphisto , Žbeky a Orcus.
Pokud budete spokojeni , můžete podpořit naše forum:Podpora fóra
Neposílejte logy do soukromých zpráv.Po dobu mé nepřítomnosti mě zastupuje memphisto , Žbeky a Orcus.
Pokud budete spokojeni , můžete podpořit naše forum:Podpora fóra
Re: Prosím o kontrolu
# AdwCleaner v5.112 - Log soubor vytvořen 23/04/2016 o 22:16:17
# Aktualizováno 17/04/2016 by Xplode
# Databáze : 2016-04-19.5 [Server]
# Operační systém : Windows 10 Pro (X86)
# Jméno uživatele : Ladicek - LADICEK-PC
# Spuštěno z : C:\Users\Ladicek\Desktop\AdwCleaner.exe
# Volba : Skenovat
# Podpora : http://toolslib.net/forum
***** [ Služby ] *****
***** [ Složky ] *****
***** [ Soubory ] *****
***** [ DLL ] *****
***** [ Zástupci ] *****
***** [ Naplánované úkoly ] *****
***** [ Registr ] *****
***** [ Webové prohlížeče ] *****
*************************
C:\AdwCleaner\AdwCleaner[S1].txt - [637 bytes] - [23/04/2016 22:16:17]
########## EOF - C:\AdwCleaner\AdwCleaner[S1].txt - [709 bytes] ##########
# Aktualizováno 17/04/2016 by Xplode
# Databáze : 2016-04-19.5 [Server]
# Operační systém : Windows 10 Pro (X86)
# Jméno uživatele : Ladicek - LADICEK-PC
# Spuštěno z : C:\Users\Ladicek\Desktop\AdwCleaner.exe
# Volba : Skenovat
# Podpora : http://toolslib.net/forum
***** [ Služby ] *****
***** [ Složky ] *****
***** [ Soubory ] *****
***** [ DLL ] *****
***** [ Zástupci ] *****
***** [ Naplánované úkoly ] *****
***** [ Registr ] *****
***** [ Webové prohlížeče ] *****
*************************
C:\AdwCleaner\AdwCleaner[S1].txt - [637 bytes] - [23/04/2016 22:16:17]
########## EOF - C:\AdwCleaner\AdwCleaner[S1].txt - [709 bytes] ##########
Re: Prosím o kontrolu
tento soubor mi nejde spustit Malwarebytes' Anti-Malware a ikony pořád nikde
-
jaro3
- člen Security týmu
-
Guru Level 15
- Příspěvky: 43294
- Registrován: červen 07
- Bydliště: Jižní Čechy
- Pohlaví:
- Stav:
Offline
Re: Prosím o kontrolu
Spusť znovu AdwCleaner (u Windows Vista či Windows7, klikni na AdwCleaner pravým a vyber „Spustit jako správce“
klikni na „Prohledat-Scan“, po prohledání klikni na „ Cleaning (Vymazat)“
Program provede opravu, po automatickém restartu neukáže log (C:\AdwCleaner [C?].txt) , jeho obsah sem celý vlož.
Stáhni si Junkware Removal Tool by Thisisu
http://www.bleepingcomputer.com/downloa ... oval-tool/
na svojí plochu.
Deaktivuj si svůj antivirový program. Pravým tl. myši klikni na JRT.exe a vyber „spustit jako správce“. Pro pokračování budeš vyzván ke stisknutí jakékoliv klávesy. Na nějakou klikni.
Začne skenování programu. Skenování může trvat dloho , podle množství nákaz. Po ukončení skenu se objeví log (JRT.txt) , který se uloží na ploše.
Zkopíruj sem prosím celý jeho obsah.
Stáhni si RogueKiller by Adlice Software
32bit.:
http://www.sur-la-toile.com/RogueKiller/RogueKiller.exe
64bit.:
http://www.sur-la-toile.com/RogueKiller ... lerX64.exe
na svojí plochu.
- Zavři všechny ostatní programy a prohlížeče.
- Pro OS Vista a win7,8,10 spusť program RogueKiller.exe jako správce , u XP poklepáním.
- klikni na „Start Scan“. V novém okně nic neměň a klikni dole na „Start Scan“
- Program skenuje procesy PC. Po proskenování klikni na „Zpráva“ , v okně pak na „Open TXT“ a celý obsah logu sem zkopíruj.
Pokud je program blokován , zkus ho spustit několikrát. Pokud dále program nepůjde spustit a pracovat, přejmenuj ho na winlogon.exe.
klikni na „Prohledat-Scan“, po prohledání klikni na „ Cleaning (Vymazat)“
Program provede opravu, po automatickém restartu neukáže log (C:\AdwCleaner [C?].txt) , jeho obsah sem celý vlož.
Stáhni si Junkware Removal Tool by Thisisu
http://www.bleepingcomputer.com/downloa ... oval-tool/
na svojí plochu.
Deaktivuj si svůj antivirový program. Pravým tl. myši klikni na JRT.exe a vyber „spustit jako správce“. Pro pokračování budeš vyzván ke stisknutí jakékoliv klávesy. Na nějakou klikni.
Začne skenování programu. Skenování může trvat dloho , podle množství nákaz. Po ukončení skenu se objeví log (JRT.txt) , který se uloží na ploše.
Zkopíruj sem prosím celý jeho obsah.
Stáhni si RogueKiller by Adlice Software
32bit.:
http://www.sur-la-toile.com/RogueKiller/RogueKiller.exe
64bit.:
http://www.sur-la-toile.com/RogueKiller ... lerX64.exe
na svojí plochu.
- Zavři všechny ostatní programy a prohlížeče.
- Pro OS Vista a win7,8,10 spusť program RogueKiller.exe jako správce , u XP poklepáním.
- klikni na „Start Scan“. V novém okně nic neměň a klikni dole na „Start Scan“
- Program skenuje procesy PC. Po proskenování klikni na „Zpráva“ , v okně pak na „Open TXT“ a celý obsah logu sem zkopíruj.
Pokud je program blokován , zkus ho spustit několikrát. Pokud dále program nepůjde spustit a pracovat, přejmenuj ho na winlogon.exe.
Při práci s programy HJT, ComboFix,MbAM, SDFix aj. zavřete všechny ostatní aplikace a prohlížeče!
Neposílejte logy do soukromých zpráv.Po dobu mé nepřítomnosti mě zastupuje memphisto , Žbeky a Orcus.
Pokud budete spokojeni , můžete podpořit naše forum:Podpora fóra
Neposílejte logy do soukromých zpráv.Po dobu mé nepřítomnosti mě zastupuje memphisto , Žbeky a Orcus.
Pokud budete spokojeni , můžete podpořit naše forum:Podpora fóra
Re: Prosím o kontrolu
# AdwCleaner v5.112 - Log soubor vytvořen 24/04/2016 o 00:07:29
# Aktualizováno 17/04/2016 by Xplode
# Databáze : 2016-04-19.5 [Server]
# Operační systém : Windows 10 Pro (X86)
# Jméno uživatele : Ladicek - LADICEK-PC
# Spuštěno z : D:\Stažené soubory\AdwCleaner.exe
# Volba : Čištění
# Podpora : http://toolslib.net/forum
***** [ Služby ] *****
***** [ Složky ] *****
***** [ Soubory ] *****
***** [ DLLs ] *****
***** [ Zástupci ] *****
***** [ Naplánované úkoly ] *****
***** [ Registr ] *****
***** [ Webové prohlížeče ] *****
*************************
:: "Tracing" odstraněných kláves
:: Nastavení Winsock odstraněno
*************************
C:\AdwCleaner\AdwCleaner[C1].txt - [740 bytes] - [24/04/2016 00:07:29]
C:\AdwCleaner\AdwCleaner[S1].txt - [1572 bytes] - [23/04/2016 22:16:17]
########## EOF - C:\AdwCleaner\AdwCleaner[C1].txt - [885 bytes] ##########
# Aktualizováno 17/04/2016 by Xplode
# Databáze : 2016-04-19.5 [Server]
# Operační systém : Windows 10 Pro (X86)
# Jméno uživatele : Ladicek - LADICEK-PC
# Spuštěno z : D:\Stažené soubory\AdwCleaner.exe
# Volba : Čištění
# Podpora : http://toolslib.net/forum
***** [ Služby ] *****
***** [ Složky ] *****
***** [ Soubory ] *****
***** [ DLLs ] *****
***** [ Zástupci ] *****
***** [ Naplánované úkoly ] *****
***** [ Registr ] *****
***** [ Webové prohlížeče ] *****
*************************
:: "Tracing" odstraněných kláves
:: Nastavení Winsock odstraněno
*************************
C:\AdwCleaner\AdwCleaner[C1].txt - [740 bytes] - [24/04/2016 00:07:29]
C:\AdwCleaner\AdwCleaner[S1].txt - [1572 bytes] - [23/04/2016 22:16:17]
########## EOF - C:\AdwCleaner\AdwCleaner[C1].txt - [885 bytes] ##########
Re: Prosím o kontrolu
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Malwarebytes
Version: 8.0.5 (04.20.2016)
Operating System: Windows 10 Pro x86
Ran by Ladicek (Administrator) on ne 24.04.2016 at 0:17:14,04
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
File System: 2
Successfully deleted: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\search.lnk (Shortcut)
Successfully deleted: C:\ProgramData\pdfforge (Folder)
Registry: 1
Successfully deleted: HKLM\SYSTEM\CurrentControlSet\services\SSSvc (Registry Key)
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on ne 24.04.2016 at 0:20:05,75
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Malwarebytes
Version: 8.0.5 (04.20.2016)
Operating System: Windows 10 Pro x86
Ran by Ladicek (Administrator) on ne 24.04.2016 at 0:17:14,04
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
File System: 2
Successfully deleted: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\search.lnk (Shortcut)
Successfully deleted: C:\ProgramData\pdfforge (Folder)
Registry: 1
Successfully deleted: HKLM\SYSTEM\CurrentControlSet\services\SSSvc (Registry Key)
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on ne 24.04.2016 at 0:20:05,75
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Re: Prosím o kontrolu
RogueKiller V12.1.3.0 [Apr 18 2016] (Free) by Adlice Software
mail : http://www.adlice.com/contact/
Feedback : http://forum.adlice.com
Webová stránka : http://www.adlice.com/software/roguekiller/
Blog : http://www.adlice.com
Operační systém : Windows 10 (10.0.10586) 32 bits version
Spuštěno : Normální režim
Uživatel : Ladicek [Práva správce]
Started from : C:\Users\Ladicek\Desktop\RogueKiller.exe
Mód : Prohledat -- Datum : 04/24/2016 00:40:58
¤¤¤ Procesy : 0 ¤¤¤
¤¤¤ Registry : 4 ¤¤¤
[PUM.Dns] HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters | DhcpNameServer : 77.48.254.254 77.48.100.254 ([Czech Republic][-]) -> Nalezeno
[PUM.Dns] HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Tcpip\Parameters | DhcpNameServer : 77.48.254.254 77.48.100.254 ([Czech Republic][-]) -> Nalezeno
[PUM.Dns] HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{b010c1ac-9cd6-41ba-abb8-2575f6c281a7} | DhcpNameServer : 77.48.254.254 77.48.100.254 ([Czech Republic][-]) -> Nalezeno
[PUM.Dns] HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Tcpip\Parameters\Interfaces\{b010c1ac-9cd6-41ba-abb8-2575f6c281a7} | DhcpNameServer : 77.48.254.254 77.48.100.254 ([Czech Republic][-]) -> Nalezeno
¤¤¤ Úlohy : 0 ¤¤¤
¤¤¤ Soubory : 0 ¤¤¤
¤¤¤ Soubor HOSTS : 0 ¤¤¤
¤¤¤ Antirootkit : 0 (Driver: Nahrán) ¤¤¤
¤¤¤ Webové prohlížeče : 0 ¤¤¤
¤¤¤ Kontrola MBR : ¤¤¤
+++++ PhysicalDrive0: Hitachi HTS543232L9A300 +++++
--- User ---
[MBR] 87dd5196eb69d05c5fd461c279e5cf8e
[BSP] 1f4689f0974fa1a87145bbfc4f017da1 : Windows Vista/7/8 MBR Code
Partition table:
0 - [ACTIVE] NTFS (0x7) [VISIBLE] Offset (sectors): 2048 | Size: 100 MB [Windows Vista/7/8 Bootstrap | Windows Vista/7/8 Bootloader]
1 - [XXXXXX] NTFS (0x7) [VISIBLE] Offset (sectors): 206848 | Size: 89550 MB [Windows Vista/7/8 Bootstrap | Windows Vista/7/8 Bootloader]
2 - [XXXXXX] ACER (0x27) [VISIBLE] Offset (sectors): 183605248 | Size: 450 MB
3 - [XXXXXX] NTFS (0x7) [VISIBLE] Offset (sectors): 184526848 | Size: 215143 MB [Windows Vista/7/8 Bootstrap | Windows Vista/7/8 Bootloader]
User = LL1 ... OK
User = LL2 ... OK
mail : http://www.adlice.com/contact/
Feedback : http://forum.adlice.com
Webová stránka : http://www.adlice.com/software/roguekiller/
Blog : http://www.adlice.com
Operační systém : Windows 10 (10.0.10586) 32 bits version
Spuštěno : Normální režim
Uživatel : Ladicek [Práva správce]
Started from : C:\Users\Ladicek\Desktop\RogueKiller.exe
Mód : Prohledat -- Datum : 04/24/2016 00:40:58
¤¤¤ Procesy : 0 ¤¤¤
¤¤¤ Registry : 4 ¤¤¤
[PUM.Dns] HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters | DhcpNameServer : 77.48.254.254 77.48.100.254 ([Czech Republic][-]) -> Nalezeno
[PUM.Dns] HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Tcpip\Parameters | DhcpNameServer : 77.48.254.254 77.48.100.254 ([Czech Republic][-]) -> Nalezeno
[PUM.Dns] HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{b010c1ac-9cd6-41ba-abb8-2575f6c281a7} | DhcpNameServer : 77.48.254.254 77.48.100.254 ([Czech Republic][-]) -> Nalezeno
[PUM.Dns] HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Tcpip\Parameters\Interfaces\{b010c1ac-9cd6-41ba-abb8-2575f6c281a7} | DhcpNameServer : 77.48.254.254 77.48.100.254 ([Czech Republic][-]) -> Nalezeno
¤¤¤ Úlohy : 0 ¤¤¤
¤¤¤ Soubory : 0 ¤¤¤
¤¤¤ Soubor HOSTS : 0 ¤¤¤
¤¤¤ Antirootkit : 0 (Driver: Nahrán) ¤¤¤
¤¤¤ Webové prohlížeče : 0 ¤¤¤
¤¤¤ Kontrola MBR : ¤¤¤
+++++ PhysicalDrive0: Hitachi HTS543232L9A300 +++++
--- User ---
[MBR] 87dd5196eb69d05c5fd461c279e5cf8e
[BSP] 1f4689f0974fa1a87145bbfc4f017da1 : Windows Vista/7/8 MBR Code
Partition table:
0 - [ACTIVE] NTFS (0x7) [VISIBLE] Offset (sectors): 2048 | Size: 100 MB [Windows Vista/7/8 Bootstrap | Windows Vista/7/8 Bootloader]
1 - [XXXXXX] NTFS (0x7) [VISIBLE] Offset (sectors): 206848 | Size: 89550 MB [Windows Vista/7/8 Bootstrap | Windows Vista/7/8 Bootloader]
2 - [XXXXXX] ACER (0x27) [VISIBLE] Offset (sectors): 183605248 | Size: 450 MB
3 - [XXXXXX] NTFS (0x7) [VISIBLE] Offset (sectors): 184526848 | Size: 215143 MB [Windows Vista/7/8 Bootstrap | Windows Vista/7/8 Bootloader]
User = LL1 ... OK
User = LL2 ... OK
-
jaro3
- člen Security týmu
-
Guru Level 15
- Příspěvky: 43294
- Registrován: červen 07
- Bydliště: Jižní Čechy
- Pohlaví:
- Stav:
Offline
Re: Prosím o kontrolu
Zavři všechny programy a prohlížeče. Deaktivuj antivir a firewall.
Prosím, odpoj všechny USB (kromě myši s klávesnice) nebo externí disky z počítače před spuštěním tohoto programu.
Spusť znovu RogueKiller ( Pro Windows Vista nebo Windows 7, klepni pravým a vyber "Spustit jako správce", ve Windows XP poklepej ke spuštění).
- klikni na „Start Scan“. V novém okně nic neměň a klikni dole na „Start Scan
- Pak klikni na "Prohledat " ,po jeho skončení:
- V záložkách (Registry , Tasks , Web Browser apod.) vše zatrhni (dej zatržítka)
(musíš dát myší zatržítko do toho čtverečku vlevo od registru ap.)
- Klikni na "Smazat"
- Počkej, dokud Status box nezobrazí " Mazání dokončeno "
- Klikni na "Zpráva " a zkopíruj a vlož obsah té zprávy prosím sem. Log je možno nalézt v RKreport [číslo]. txt na ploše.
- Zavři RogueKiller
Vypni antivir i firewall.
Stáhni
Zoek.exe
a uloz si ho na plochu.
Zavři všechny ostatní programy , okna i prohlížeče.
Spusť Zoek.exe ( u win vista , win7, 8 klikni na něj pravým a vyber : „Spustit jako správce“
- pozor , náběh programu může trvat déle.
Do okna programu vlož skript níže:
klikni na Run Script
Program provede sken , opravu, sken i oprava může trvat i více minut ,je třeba posečkat do konce. Do okna neklikej!
Program nabídne restart , potvrď .
Po restartu se může nějaký čas ukázat pouze černá plocha , to je normální. Je třeba počkat až se vytvoří log. Ten si můžeš uložit třeba do dokumentů , jinak se sám ukládá do:
C:\zoek-results.log
Zkopíruj sem celý obsah toho logu.
Vlož nový log z HJT + informuj o problémech
Prosím, odpoj všechny USB (kromě myši s klávesnice) nebo externí disky z počítače před spuštěním tohoto programu.
Spusť znovu RogueKiller ( Pro Windows Vista nebo Windows 7, klepni pravým a vyber "Spustit jako správce", ve Windows XP poklepej ke spuštění).
- klikni na „Start Scan“. V novém okně nic neměň a klikni dole na „Start Scan
- Pak klikni na "Prohledat " ,po jeho skončení:
- V záložkách (Registry , Tasks , Web Browser apod.) vše zatrhni (dej zatržítka)
(musíš dát myší zatržítko do toho čtverečku vlevo od registru ap.)
- Klikni na "Smazat"
- Počkej, dokud Status box nezobrazí " Mazání dokončeno "
- Klikni na "Zpráva " a zkopíruj a vlož obsah té zprávy prosím sem. Log je možno nalézt v RKreport [číslo]. txt na ploše.
- Zavři RogueKiller
Vypni antivir i firewall.
Stáhni
Zoek.exe
a uloz si ho na plochu.
Zavři všechny ostatní programy , okna i prohlížeče.
Spusť Zoek.exe ( u win vista , win7, 8 klikni na něj pravým a vyber : „Spustit jako správce“
- pozor , náběh programu může trvat déle.
Do okna programu vlož skript níže:
Kód: Vybrat vše
autoclean;
emptyclsid;
iedefaults;
FFdefaults;
CHRdefaults;
emptyalltemp;
resethosts; klikni na Run Script
Program provede sken , opravu, sken i oprava může trvat i více minut ,je třeba posečkat do konce. Do okna neklikej!
Program nabídne restart , potvrď .
Po restartu se může nějaký čas ukázat pouze černá plocha , to je normální. Je třeba počkat až se vytvoří log. Ten si můžeš uložit třeba do dokumentů , jinak se sám ukládá do:
C:\zoek-results.log
Zkopíruj sem celý obsah toho logu.
Vlož nový log z HJT + informuj o problémech
Při práci s programy HJT, ComboFix,MbAM, SDFix aj. zavřete všechny ostatní aplikace a prohlížeče!
Neposílejte logy do soukromých zpráv.Po dobu mé nepřítomnosti mě zastupuje memphisto , Žbeky a Orcus.
Pokud budete spokojeni , můžete podpořit naše forum:Podpora fóra
Neposílejte logy do soukromých zpráv.Po dobu mé nepřítomnosti mě zastupuje memphisto , Žbeky a Orcus.
Pokud budete spokojeni , můžete podpořit naše forum:Podpora fóra
Re: Prosím o kontrolu
RogueKiller V12.1.3.0 [Apr 18 2016] (Free) by Adlice Software
mail : http://www.adlice.com/contact/
Feedback : http://forum.adlice.com
Webová stránka : http://www.adlice.com/software/roguekiller/
Blog : http://www.adlice.com
Operační systém : Windows 10 (10.0.10586) 32 bits version
Spuštěno : Normální režim
Uživatel : Ladicek [Práva správce]
Started from : C:\Users\Ladicek\Desktop\RogueKiller.exe
Mód : Smazat -- Datum : 04/24/2016 21:05:29
¤¤¤ Procesy : 1 ¤¤¤
[Suspicious.Path] LSB.exe(6868) -- C:\Users\Ladicek\AppData\Local\Apps\2.0\OHEBRQ5C.MH4\06NPHXT4.QY3\lsb...tion_91a10ba61c75c82d_0001.0006_e3bbae03e10aca14\LSB.exe[7] -> Zastaveno [TermProc]
¤¤¤ Registry : 4 ¤¤¤
[PUM.Dns] HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters | DhcpNameServer : 77.48.254.254 77.48.100.254 ([X][X]) -> Nahrazeno ()
[PUM.Dns] HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Tcpip\Parameters | DhcpNameServer : 77.48.254.254 77.48.100.254 ([X][X]) -> Nahrazeno ()
[PUM.Dns] HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{b010c1ac-9cd6-41ba-abb8-2575f6c281a7} | DhcpNameServer : 77.48.254.254 77.48.100.254 ([X][X]) -> Nahrazeno ()
[PUM.Dns] HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Tcpip\Parameters\Interfaces\{b010c1ac-9cd6-41ba-abb8-2575f6c281a7} | DhcpNameServer : 77.48.254.254 77.48.100.254 ([X][X]) -> Nahrazeno ()
¤¤¤ Úlohy : 2 ¤¤¤
[Suspicious.Path] %WINDIR%\Tasks\HP Photo Creations Communicator.job -- C:\Users\Ladicek\AppData\Roaming\HP Photo Creations\Communicator.exe (--auto) -> Smazáno
[Suspicious.Path] \HP Photo Creations Communicator -- C:\Users\Ladicek\AppData\Roaming\HP Photo Creations\Communicator.exe (--auto) -> Smazáno
¤¤¤ Soubory : 0 ¤¤¤
¤¤¤ Soubor HOSTS : 0 ¤¤¤
¤¤¤ Antirootkit : 41 (Driver: Nahrán) ¤¤¤
[SSDT:Inl(Hook.SSDT)] ZwThawTransactions[32] : C:\Windows\System32\drivers\tm.sys @ 0xffffffff86192052 (jmp dword [0x81c8b2b8])
[SSDT:Inl(Hook.SSDT)] ZwSinglePhaseReject[44] : C:\Windows\System32\drivers\tm.sys @ 0xffffffff8618e6a6 (jmp dword [0x81c8b2f8])
[SSDT:Inl(Hook.SSDT)] ZwSetInformationTransactionManager[73] : C:\Windows\System32\drivers\tm.sys @ 0xffffffff86192d24 (jmp dword [0x81c8b2fc])
[SSDT:Inl(Hook.SSDT)] ZwSetInformationTransaction[74] : C:\Windows\System32\drivers\tm.sys @ 0xffffffff86191d12 (jmp dword [0x81c8b2bc])
[SSDT:Inl(Hook.SSDT)] ZwSetInformationResourceManager[77] : C:\Windows\System32\drivers\tm.sys @ 0xffffffff8618f0a6 (jmp dword [0x81c8b2c0])
[SSDT:Inl(Hook.SSDT)] ZwSetInformationEnlistment[83] : C:\Windows\System32\drivers\tm.sys @ 0xffffffff8618dfb8 (jmp dword [0x81c8b2c4])
[SSDT:Inl(Hook.SSDT)] ZwRollforwardTransactionManager[104] : C:\Windows\System32\drivers\tm.sys @ 0xffffffff8619269a (jmp dword [0x81c8b310])
[SSDT:Inl(Hook.SSDT)] ZwRollbackTransaction[105] : C:\Windows\System32\drivers\tm.sys @ 0xffffffff86191ca8 (jmp dword [0x81c8b2c8])
[SSDT:Inl(Hook.SSDT)] ZwRollbackEnlistment[106] : C:\Windows\System32\drivers\tm.sys @ 0xffffffff8618e3c6 (jmp dword [0x81c8b2cc])
[SSDT:Inl(Hook.SSDT)] ZwRollbackComplete[107] : C:\Windows\System32\drivers\tm.sys @ 0xffffffff8618e812 (jmp dword [0x81c8b2d0])
[SSDT:Inl(Hook.SSDT)] ZwRenameTransactionManager[122] : C:\Windows\System32\drivers\tm.sys @ 0xffffffff86192532 (jmp dword [0x81c8b314])
[SSDT:Inl(Hook.SSDT)] ZwRegisterProtocolAddressInformation[132] : C:\Windows\System32\drivers\tm.sys @ 0xffffffff86192e62 (jmp dword [0x81c8b318])
[SSDT:Inl(Hook.SSDT)] ZwRecoverTransactionManager[133] : C:\Windows\System32\drivers\tm.sys @ 0xffffffff86192752 (jmp dword [0x81c8b2d4])
[SSDT:Inl(Hook.SSDT)] ZwRecoverResourceManager[134] : C:\Windows\System32\drivers\tm.sys @ 0xffffffff8618ed32 (jmp dword [0x81c8b2d8])
[SSDT:Inl(Hook.SSDT)] ZwRecoverEnlistment[135] : C:\Windows\System32\drivers\tm.sys @ 0xffffffff8618dcfe (jmp dword [0x81c8b2dc])
[SSDT:Inl(Hook.SSDT)] ZwReadOnlyEnlistment[138] : C:\Windows\System32\drivers\tm.sys @ 0xffffffff8618e75c (jmp dword [0x81c8b334])
[SSDT:Inl(Hook.SSDT)] ZwQueryInformationTransactionManager[176] : C:\Windows\System32\drivers\tm.sys @ 0xffffffff861927ae (jmp dword [0x81c8b338])
[SSDT:Inl(Hook.SSDT)] ZwQueryInformationTransaction[177] : C:\Windows\System32\drivers\tm.sys @ 0xffffffff86191470 (jmp dword [0x81c8b33c])
[SSDT:Inl(Hook.SSDT)] ZwQueryInformationResourceManager[180] : C:\Windows\System32\drivers\tm.sys @ 0xffffffff8618ee98 (jmp dword [0x81c8b340])
[SSDT:Inl(Hook.SSDT)] ZwQueryInformationEnlistment[185] : C:\Windows\System32\drivers\tm.sys @ 0xffffffff8618dd5a (jmp dword [0x81c8b344])
[SSDT:Inl(Hook.SSDT)] ZwPropagationFailed[201] : C:\Windows\System32\drivers\tm.sys @ 0xffffffff861930f0 (jmp dword [0x81c8b348])
[SSDT:Inl(Hook.SSDT)] ZwPropagationComplete[202] : C:\Windows\System32\drivers\tm.sys @ 0xffffffff86193026 (jmp dword [0x81c8b34c])
[SSDT:Inl(Hook.SSDT)] ZwPrePrepareEnlistment[207] : C:\Windows\System32\drivers\tm.sys @ 0xffffffff8618e256 (jmp dword [0x81c8b358])
[SSDT:Inl(Hook.SSDT)] ZwPrePrepareComplete[208] : C:\Windows\System32\drivers\tm.sys @ 0xffffffff8618e536 (jmp dword [0x81c8b35c])
[SSDT:Inl(Hook.SSDT)] ZwPrepareEnlistment[209] : C:\Windows\System32\drivers\tm.sys @ 0xffffffff8618e19e (jmp dword [0x81c8b350])
[SSDT:Inl(Hook.SSDT)] ZwPrepareComplete[210] : C:\Windows\System32\drivers\tm.sys @ 0xffffffff8618e47e (jmp dword [0x81c8b354])
[SSDT:Inl(Hook.SSDT)] ZwOpenTransactionManager[213] : C:\Windows\System32\drivers\tm.sys @ 0xffffffff861922c0 (jmp dword [0x81c8b360])
[SSDT:Inl(Hook.SSDT)] ZwOpenTransaction[214] : C:\Windows\System32\drivers\tm.sys @ 0xffffffff86191272 (jmp dword [0x81c8b364])
[SSDT:Inl(Hook.SSDT)] ZwOpenResourceManager[223] : C:\Windows\System32\drivers\tm.sys @ 0xffffffff8618eb7e (jmp dword [0x81c8b368])
[SSDT:Inl(Hook.SSDT)] ZwOpenEnlistment[241] : C:\Windows\System32\drivers\tm.sys @ 0xffffffff8618db5a (jmp dword [0x81c8b36c])
[SSDT:Inl(Hook.SSDT)] ZwGetNotificationResourceManager[277] : C:\Windows\System32\drivers\tm.sys @ 0xffffffff8618ed8c (jmp dword [0x81c8b370])
[SSDT:Inl(Hook.SSDT)] ZwFreezeTransactions[289] : C:\Windows\System32\drivers\tm.sys @ 0xffffffff86191f7a (jmp dword [0x81c8b374])
[SSDT:Inl(Hook.SSDT)] ZwFlushWriteBuffer[293] : C:\Windows\System32\halmacpi.dll @ 0xffffffff81a1ed46 (call dword [0x81c8b134])
[SSDT:Inl(Hook.SSDT)] ZwEnumerateTransactionObject[307] : C:\Windows\System32\drivers\tm.sys @ 0xffffffff86191a30 (jmp dword [0x81c8b330])
[SSDT:Inl(Hook.SSDT)] ZwCreateTransactionManager[338] : C:\Windows\System32\drivers\tm.sys @ 0xffffffff861920a8 (jmp dword [0x81c8b32c])
[SSDT:Inl(Hook.SSDT)] ZwCreateTransaction[339] : C:\Windows\System32\drivers\tm.sys @ 0xffffffff86190f56 (jmp dword [0x81c8b328])
[SSDT:Inl(Hook.SSDT)] ZwCreateResourceManager[349] : C:\Windows\System32\drivers\tm.sys @ 0xffffffff8618e8c8 (jmp dword [0x81c8b324])
[SSDT:Inl(Hook.SSDT)] ZwCreateEnlistment[371] : C:\Windows\System32\drivers\tm.sys @ 0xffffffff8618d958 (jmp dword [0x81c8b2f4])
[SSDT:Inl(Hook.SSDT)] ZwCommitTransaction[383] : C:\Windows\System32\drivers\tm.sys @ 0xffffffff86191c3e (jmp dword [0x81c8b2f0])
[SSDT:Inl(Hook.SSDT)] ZwCommitEnlistment[384] : C:\Windows\System32\drivers\tm.sys @ 0xffffffff8618e30e (jmp dword [0x81c8b2ec])
[SSDT:Inl(Hook.SSDT)] ZwCommitComplete[385] : C:\Windows\System32\drivers\tm.sys @ 0xffffffff8618e5ee (jmp dword [0x81c8b2e8])
¤¤¤ Webové prohlížeče : 0 ¤¤¤
¤¤¤ Kontrola MBR : ¤¤¤
+++++ PhysicalDrive0: Hitachi HTS543232L9A300 +++++
--- User ---
[MBR] 87dd5196eb69d05c5fd461c279e5cf8e
[BSP] 1f4689f0974fa1a87145bbfc4f017da1 : Windows Vista/7/8 MBR Code
Partition table:
0 - [ACTIVE] NTFS (0x7) [VISIBLE] Offset (sectors): 2048 | Size: 100 MB [Windows Vista/7/8 Bootstrap | Windows Vista/7/8 Bootloader]
1 - [XXXXXX] NTFS (0x7) [VISIBLE] Offset (sectors): 206848 | Size: 89550 MB [Windows Vista/7/8 Bootstrap | Windows Vista/7/8 Bootloader]
2 - [XXXXXX] ACER (0x27) [VISIBLE] Offset (sectors): 183605248 | Size: 450 MB
3 - [XXXXXX] NTFS (0x7) [VISIBLE] Offset (sectors): 184526848 | Size: 215143 MB [Windows Vista/7/8 Bootstrap | Windows Vista/7/8 Bootloader]
User = LL1 ... OK
User = LL2 ... OK
mail : http://www.adlice.com/contact/
Feedback : http://forum.adlice.com
Webová stránka : http://www.adlice.com/software/roguekiller/
Blog : http://www.adlice.com
Operační systém : Windows 10 (10.0.10586) 32 bits version
Spuštěno : Normální režim
Uživatel : Ladicek [Práva správce]
Started from : C:\Users\Ladicek\Desktop\RogueKiller.exe
Mód : Smazat -- Datum : 04/24/2016 21:05:29
¤¤¤ Procesy : 1 ¤¤¤
[Suspicious.Path] LSB.exe(6868) -- C:\Users\Ladicek\AppData\Local\Apps\2.0\OHEBRQ5C.MH4\06NPHXT4.QY3\lsb...tion_91a10ba61c75c82d_0001.0006_e3bbae03e10aca14\LSB.exe[7] -> Zastaveno [TermProc]
¤¤¤ Registry : 4 ¤¤¤
[PUM.Dns] HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters | DhcpNameServer : 77.48.254.254 77.48.100.254 ([X][X]) -> Nahrazeno ()
[PUM.Dns] HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Tcpip\Parameters | DhcpNameServer : 77.48.254.254 77.48.100.254 ([X][X]) -> Nahrazeno ()
[PUM.Dns] HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{b010c1ac-9cd6-41ba-abb8-2575f6c281a7} | DhcpNameServer : 77.48.254.254 77.48.100.254 ([X][X]) -> Nahrazeno ()
[PUM.Dns] HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Tcpip\Parameters\Interfaces\{b010c1ac-9cd6-41ba-abb8-2575f6c281a7} | DhcpNameServer : 77.48.254.254 77.48.100.254 ([X][X]) -> Nahrazeno ()
¤¤¤ Úlohy : 2 ¤¤¤
[Suspicious.Path] %WINDIR%\Tasks\HP Photo Creations Communicator.job -- C:\Users\Ladicek\AppData\Roaming\HP Photo Creations\Communicator.exe (--auto) -> Smazáno
[Suspicious.Path] \HP Photo Creations Communicator -- C:\Users\Ladicek\AppData\Roaming\HP Photo Creations\Communicator.exe (--auto) -> Smazáno
¤¤¤ Soubory : 0 ¤¤¤
¤¤¤ Soubor HOSTS : 0 ¤¤¤
¤¤¤ Antirootkit : 41 (Driver: Nahrán) ¤¤¤
[SSDT:Inl(Hook.SSDT)] ZwThawTransactions[32] : C:\Windows\System32\drivers\tm.sys @ 0xffffffff86192052 (jmp dword [0x81c8b2b8])
[SSDT:Inl(Hook.SSDT)] ZwSinglePhaseReject[44] : C:\Windows\System32\drivers\tm.sys @ 0xffffffff8618e6a6 (jmp dword [0x81c8b2f8])
[SSDT:Inl(Hook.SSDT)] ZwSetInformationTransactionManager[73] : C:\Windows\System32\drivers\tm.sys @ 0xffffffff86192d24 (jmp dword [0x81c8b2fc])
[SSDT:Inl(Hook.SSDT)] ZwSetInformationTransaction[74] : C:\Windows\System32\drivers\tm.sys @ 0xffffffff86191d12 (jmp dword [0x81c8b2bc])
[SSDT:Inl(Hook.SSDT)] ZwSetInformationResourceManager[77] : C:\Windows\System32\drivers\tm.sys @ 0xffffffff8618f0a6 (jmp dword [0x81c8b2c0])
[SSDT:Inl(Hook.SSDT)] ZwSetInformationEnlistment[83] : C:\Windows\System32\drivers\tm.sys @ 0xffffffff8618dfb8 (jmp dword [0x81c8b2c4])
[SSDT:Inl(Hook.SSDT)] ZwRollforwardTransactionManager[104] : C:\Windows\System32\drivers\tm.sys @ 0xffffffff8619269a (jmp dword [0x81c8b310])
[SSDT:Inl(Hook.SSDT)] ZwRollbackTransaction[105] : C:\Windows\System32\drivers\tm.sys @ 0xffffffff86191ca8 (jmp dword [0x81c8b2c8])
[SSDT:Inl(Hook.SSDT)] ZwRollbackEnlistment[106] : C:\Windows\System32\drivers\tm.sys @ 0xffffffff8618e3c6 (jmp dword [0x81c8b2cc])
[SSDT:Inl(Hook.SSDT)] ZwRollbackComplete[107] : C:\Windows\System32\drivers\tm.sys @ 0xffffffff8618e812 (jmp dword [0x81c8b2d0])
[SSDT:Inl(Hook.SSDT)] ZwRenameTransactionManager[122] : C:\Windows\System32\drivers\tm.sys @ 0xffffffff86192532 (jmp dword [0x81c8b314])
[SSDT:Inl(Hook.SSDT)] ZwRegisterProtocolAddressInformation[132] : C:\Windows\System32\drivers\tm.sys @ 0xffffffff86192e62 (jmp dword [0x81c8b318])
[SSDT:Inl(Hook.SSDT)] ZwRecoverTransactionManager[133] : C:\Windows\System32\drivers\tm.sys @ 0xffffffff86192752 (jmp dword [0x81c8b2d4])
[SSDT:Inl(Hook.SSDT)] ZwRecoverResourceManager[134] : C:\Windows\System32\drivers\tm.sys @ 0xffffffff8618ed32 (jmp dword [0x81c8b2d8])
[SSDT:Inl(Hook.SSDT)] ZwRecoverEnlistment[135] : C:\Windows\System32\drivers\tm.sys @ 0xffffffff8618dcfe (jmp dword [0x81c8b2dc])
[SSDT:Inl(Hook.SSDT)] ZwReadOnlyEnlistment[138] : C:\Windows\System32\drivers\tm.sys @ 0xffffffff8618e75c (jmp dword [0x81c8b334])
[SSDT:Inl(Hook.SSDT)] ZwQueryInformationTransactionManager[176] : C:\Windows\System32\drivers\tm.sys @ 0xffffffff861927ae (jmp dword [0x81c8b338])
[SSDT:Inl(Hook.SSDT)] ZwQueryInformationTransaction[177] : C:\Windows\System32\drivers\tm.sys @ 0xffffffff86191470 (jmp dword [0x81c8b33c])
[SSDT:Inl(Hook.SSDT)] ZwQueryInformationResourceManager[180] : C:\Windows\System32\drivers\tm.sys @ 0xffffffff8618ee98 (jmp dword [0x81c8b340])
[SSDT:Inl(Hook.SSDT)] ZwQueryInformationEnlistment[185] : C:\Windows\System32\drivers\tm.sys @ 0xffffffff8618dd5a (jmp dword [0x81c8b344])
[SSDT:Inl(Hook.SSDT)] ZwPropagationFailed[201] : C:\Windows\System32\drivers\tm.sys @ 0xffffffff861930f0 (jmp dword [0x81c8b348])
[SSDT:Inl(Hook.SSDT)] ZwPropagationComplete[202] : C:\Windows\System32\drivers\tm.sys @ 0xffffffff86193026 (jmp dword [0x81c8b34c])
[SSDT:Inl(Hook.SSDT)] ZwPrePrepareEnlistment[207] : C:\Windows\System32\drivers\tm.sys @ 0xffffffff8618e256 (jmp dword [0x81c8b358])
[SSDT:Inl(Hook.SSDT)] ZwPrePrepareComplete[208] : C:\Windows\System32\drivers\tm.sys @ 0xffffffff8618e536 (jmp dword [0x81c8b35c])
[SSDT:Inl(Hook.SSDT)] ZwPrepareEnlistment[209] : C:\Windows\System32\drivers\tm.sys @ 0xffffffff8618e19e (jmp dword [0x81c8b350])
[SSDT:Inl(Hook.SSDT)] ZwPrepareComplete[210] : C:\Windows\System32\drivers\tm.sys @ 0xffffffff8618e47e (jmp dword [0x81c8b354])
[SSDT:Inl(Hook.SSDT)] ZwOpenTransactionManager[213] : C:\Windows\System32\drivers\tm.sys @ 0xffffffff861922c0 (jmp dword [0x81c8b360])
[SSDT:Inl(Hook.SSDT)] ZwOpenTransaction[214] : C:\Windows\System32\drivers\tm.sys @ 0xffffffff86191272 (jmp dword [0x81c8b364])
[SSDT:Inl(Hook.SSDT)] ZwOpenResourceManager[223] : C:\Windows\System32\drivers\tm.sys @ 0xffffffff8618eb7e (jmp dword [0x81c8b368])
[SSDT:Inl(Hook.SSDT)] ZwOpenEnlistment[241] : C:\Windows\System32\drivers\tm.sys @ 0xffffffff8618db5a (jmp dword [0x81c8b36c])
[SSDT:Inl(Hook.SSDT)] ZwGetNotificationResourceManager[277] : C:\Windows\System32\drivers\tm.sys @ 0xffffffff8618ed8c (jmp dword [0x81c8b370])
[SSDT:Inl(Hook.SSDT)] ZwFreezeTransactions[289] : C:\Windows\System32\drivers\tm.sys @ 0xffffffff86191f7a (jmp dword [0x81c8b374])
[SSDT:Inl(Hook.SSDT)] ZwFlushWriteBuffer[293] : C:\Windows\System32\halmacpi.dll @ 0xffffffff81a1ed46 (call dword [0x81c8b134])
[SSDT:Inl(Hook.SSDT)] ZwEnumerateTransactionObject[307] : C:\Windows\System32\drivers\tm.sys @ 0xffffffff86191a30 (jmp dword [0x81c8b330])
[SSDT:Inl(Hook.SSDT)] ZwCreateTransactionManager[338] : C:\Windows\System32\drivers\tm.sys @ 0xffffffff861920a8 (jmp dword [0x81c8b32c])
[SSDT:Inl(Hook.SSDT)] ZwCreateTransaction[339] : C:\Windows\System32\drivers\tm.sys @ 0xffffffff86190f56 (jmp dword [0x81c8b328])
[SSDT:Inl(Hook.SSDT)] ZwCreateResourceManager[349] : C:\Windows\System32\drivers\tm.sys @ 0xffffffff8618e8c8 (jmp dword [0x81c8b324])
[SSDT:Inl(Hook.SSDT)] ZwCreateEnlistment[371] : C:\Windows\System32\drivers\tm.sys @ 0xffffffff8618d958 (jmp dword [0x81c8b2f4])
[SSDT:Inl(Hook.SSDT)] ZwCommitTransaction[383] : C:\Windows\System32\drivers\tm.sys @ 0xffffffff86191c3e (jmp dword [0x81c8b2f0])
[SSDT:Inl(Hook.SSDT)] ZwCommitEnlistment[384] : C:\Windows\System32\drivers\tm.sys @ 0xffffffff8618e30e (jmp dword [0x81c8b2ec])
[SSDT:Inl(Hook.SSDT)] ZwCommitComplete[385] : C:\Windows\System32\drivers\tm.sys @ 0xffffffff8618e5ee (jmp dword [0x81c8b2e8])
¤¤¤ Webové prohlížeče : 0 ¤¤¤
¤¤¤ Kontrola MBR : ¤¤¤
+++++ PhysicalDrive0: Hitachi HTS543232L9A300 +++++
--- User ---
[MBR] 87dd5196eb69d05c5fd461c279e5cf8e
[BSP] 1f4689f0974fa1a87145bbfc4f017da1 : Windows Vista/7/8 MBR Code
Partition table:
0 - [ACTIVE] NTFS (0x7) [VISIBLE] Offset (sectors): 2048 | Size: 100 MB [Windows Vista/7/8 Bootstrap | Windows Vista/7/8 Bootloader]
1 - [XXXXXX] NTFS (0x7) [VISIBLE] Offset (sectors): 206848 | Size: 89550 MB [Windows Vista/7/8 Bootstrap | Windows Vista/7/8 Bootloader]
2 - [XXXXXX] ACER (0x27) [VISIBLE] Offset (sectors): 183605248 | Size: 450 MB
3 - [XXXXXX] NTFS (0x7) [VISIBLE] Offset (sectors): 184526848 | Size: 215143 MB [Windows Vista/7/8 Bootstrap | Windows Vista/7/8 Bootloader]
User = LL1 ... OK
User = LL2 ... OK
Re: Prosím o kontrolu
Zoek.exe v5.0.0.1 Updated 31-December-2015
Tool run by Ladicek on ne 24.04.2016 at 21:12:42,30.
Microsoft Windows 10 Pro 10.0.10586 x86
Running in: Normal Mode Internet Access Detected
Launched: C:\Users\Ladicek\Desktop\zoek.exe [Scan all users] [Script inserted]
==== System Restore Info ======================
24.4.2016 21:13:34 Zoek.exe System Restore Point Created Successfully.
==== Reset Hosts File ======================
# Copyright (c) 1993-2006 Microsoft Corp.
#
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
#
# This file contains the mappings of IP addresses to host names. Each
# entry should be kept on an individual line. The IP address should
# be placed in the first column followed by the corresponding host name.
# The IP address and the host name should be separated by at least one
# space.
#
# Additionally, comments (such as these) may be inserted on individual
# lines or following the machine name denoted by a '#' symbol.
#
# For example:
#
# 102.54.94.97 rhino.acme.com # source server
# 38.25.63.10 x.acme.com # x client host
127.0.0.1 localhost
==== Empty Folders Check ======================
C:\Program Files\Common Files\SWF Studio deleted successfully
C:\PROGRA~2\Comms deleted successfully
C:\PROGRA~2\HiSuiteOuc deleted successfully
C:\Users\DefaultAppPool\AppData\LocalLow deleted successfully
C:\Users\Ladicek\AppData\Local\ActiveSync deleted successfully
C:\Users\Ladicek\AppData\Local\PackageStaging deleted successfully
C:\Users\Ladicek\AppData\Local\PDFCreator deleted successfully
C:\Users\Ladicek\AppData\Local\PeerDistRepub deleted successfully
C:\Users\Souteze\AppData\Local\VirtualStore deleted successfully
C:\WINDOWS\serviceprofiles\networkservice\AppData\Local\Maps deleted successfully
C:\WINDOWS\serviceprofiles\networkservice\AppData\Local\PeerDistPub deleted successfully
C:\WINDOWS\serviceprofiles\networkservice\AppData\Local\PeerDistRepub deleted successfully
==== Deleting CLSID Registry Keys ======================
==== Deleting CLSID Registry Values ======================
==== Deleting Services ======================
==== Deleting Files \ Folders ======================
C:\Users\Ladicek\.android deleted
C:\PROGRA~2\Package Cache deleted
C:\WINDOWS\System32\SET5B57.tmp deleted
"C:\Users\Ladicek\AppData\Roaming\XnView" deleted
==== Firefox Extensions Registry ======================
[HKEY_LOCAL_MACHINE\Software\Mozilla\Firefox\Extensions]
"quickprint@hp.com"="C:\Program Files\Hewlett-Packard\SmartPrint\QPExtension" [26.01.2011 15:27]
==== Chromium Look ======================
==== Set IE to Default ======================
Old Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"="http://go.microsoft.com/fwlink/p/?LinkId=255141"
New Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"="http://go.microsoft.com/fwlink/p/?LinkId=255141"
==== All HKLM and HKCU SearchScopes ======================
HKLM\SearchScopes "DefaultScope"="{0633EE93-D776-472f-A0FF-E1416B8B2E3A}"
HKLM\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} - http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
HKCU\SearchScopes "DefaultScope"="{0633EE93-D776-472f-A0FF-E1416B8B2E3A}"
HKCU\SearchScopes\{012E1000-F331-11DB-8314-0800200C9A66} - http://www.google.com/search?q={searchTerms}
HKCU\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} - http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IESR02
==== Reset Google Chrome ======================
C:\Users\Ladicek\AppData\Local\Google\Chrome\User Data\Default\Preferences was reset successfully
C:\Users\Ladicek\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences was reset successfully
C:\Users\Ladicek\AppData\Local\Google\Chrome\User Data\Default\Web Data was reset successfully
C:\Users\Ladicek\AppData\Local\Google\Chrome\User Data\Default\Web Data-journal was reset successfully
==== Empty IE Cache ======================
C:\Users\Ladicek\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 emptied successfully
C:\Users\Ladicek\AppData\Local\Microsoft\Windows\INetCache\Low\Content.IE5 emptied successfully
C:\WINDOWS\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 emptied successfully
C:\WINDOWS\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 emptied successfully
C:\Users\Ladicek\AppData\Local\Microsoft\Windows\INetCache\Low\IE emptied successfully
C:\WINDOWS\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE emptied successfully
C:\Users\Ladicek\AppData\Local\Microsoft\Windows\INetCache\IE\60ZKKKZW will be deleted at reboot
C:\Users\Ladicek\AppData\Local\Microsoft\Windows\INetCache\IE\N72MIDE8 will be deleted at reboot
C:\Users\Ladicek\AppData\Local\Microsoft\Windows\INetCache\IE\OHXP5TFT will be deleted at reboot
C:\Users\Ladicek\AppData\Local\Microsoft\Windows\INetCache\IE\W97E19D5 will be deleted at reboot
==== Empty FireFox Cache ======================
No FireFox Profiles found
==== Empty Chrome Cache ======================
C:\Users\Ladicek\AppData\Local\Opera Software\Opera Stable\Cache emptied successfully
C:\Users\Ladicek\AppData\Local\Google\Chrome\User Data\Default\Cache emptied successfully
==== Empty All Flash Cache ======================
No Flash Cache Found
==== Empty All Java Cache ======================
No Java Cache Found
==== C:\zoek_backup content ======================
C:\zoek_backup (files=10 folders=10 6991297 bytes)
==== Empty Temp Folders ======================
C:\WINDOWS\Temp will be emptied at reboot
==== After Reboot ======================
==== Empty Temp Folders ======================
C:\WINDOWS\Temp successfully emptied
C:\Users\Ladicek\AppData\Local\Temp successfully emptied
==== Empty Recycle Bin ======================
C:\$RECYCLE.BIN successfully emptied
==== Deleting Files / Folders ======================
"C:\Users\Ladicek\AppData\Local\Microsoft\Windows\INetCache\IE\60ZKKKZW" not found
"C:\Users\Ladicek\AppData\Local\Microsoft\Windows\INetCache\IE\N72MIDE8" not found
"C:\Users\Ladicek\AppData\Local\Microsoft\Windows\INetCache\IE\OHXP5TFT" not found
"C:\Users\Ladicek\AppData\Local\Microsoft\Windows\INetCache\IE\W97E19D5" not found
==== EOF on ne 24.04.2016 at 21:34:32,06 ======================
Tool run by Ladicek on ne 24.04.2016 at 21:12:42,30.
Microsoft Windows 10 Pro 10.0.10586 x86
Running in: Normal Mode Internet Access Detected
Launched: C:\Users\Ladicek\Desktop\zoek.exe [Scan all users] [Script inserted]
==== System Restore Info ======================
24.4.2016 21:13:34 Zoek.exe System Restore Point Created Successfully.
==== Reset Hosts File ======================
# Copyright (c) 1993-2006 Microsoft Corp.
#
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
#
# This file contains the mappings of IP addresses to host names. Each
# entry should be kept on an individual line. The IP address should
# be placed in the first column followed by the corresponding host name.
# The IP address and the host name should be separated by at least one
# space.
#
# Additionally, comments (such as these) may be inserted on individual
# lines or following the machine name denoted by a '#' symbol.
#
# For example:
#
# 102.54.94.97 rhino.acme.com # source server
# 38.25.63.10 x.acme.com # x client host
127.0.0.1 localhost
==== Empty Folders Check ======================
C:\Program Files\Common Files\SWF Studio deleted successfully
C:\PROGRA~2\Comms deleted successfully
C:\PROGRA~2\HiSuiteOuc deleted successfully
C:\Users\DefaultAppPool\AppData\LocalLow deleted successfully
C:\Users\Ladicek\AppData\Local\ActiveSync deleted successfully
C:\Users\Ladicek\AppData\Local\PackageStaging deleted successfully
C:\Users\Ladicek\AppData\Local\PDFCreator deleted successfully
C:\Users\Ladicek\AppData\Local\PeerDistRepub deleted successfully
C:\Users\Souteze\AppData\Local\VirtualStore deleted successfully
C:\WINDOWS\serviceprofiles\networkservice\AppData\Local\Maps deleted successfully
C:\WINDOWS\serviceprofiles\networkservice\AppData\Local\PeerDistPub deleted successfully
C:\WINDOWS\serviceprofiles\networkservice\AppData\Local\PeerDistRepub deleted successfully
==== Deleting CLSID Registry Keys ======================
==== Deleting CLSID Registry Values ======================
==== Deleting Services ======================
==== Deleting Files \ Folders ======================
C:\Users\Ladicek\.android deleted
C:\PROGRA~2\Package Cache deleted
C:\WINDOWS\System32\SET5B57.tmp deleted
"C:\Users\Ladicek\AppData\Roaming\XnView" deleted
==== Firefox Extensions Registry ======================
[HKEY_LOCAL_MACHINE\Software\Mozilla\Firefox\Extensions]
"quickprint@hp.com"="C:\Program Files\Hewlett-Packard\SmartPrint\QPExtension" [26.01.2011 15:27]
==== Chromium Look ======================
==== Set IE to Default ======================
Old Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"="http://go.microsoft.com/fwlink/p/?LinkId=255141"
New Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"="http://go.microsoft.com/fwlink/p/?LinkId=255141"
==== All HKLM and HKCU SearchScopes ======================
HKLM\SearchScopes "DefaultScope"="{0633EE93-D776-472f-A0FF-E1416B8B2E3A}"
HKLM\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} - http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
HKCU\SearchScopes "DefaultScope"="{0633EE93-D776-472f-A0FF-E1416B8B2E3A}"
HKCU\SearchScopes\{012E1000-F331-11DB-8314-0800200C9A66} - http://www.google.com/search?q={searchTerms}
HKCU\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} - http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IESR02
==== Reset Google Chrome ======================
C:\Users\Ladicek\AppData\Local\Google\Chrome\User Data\Default\Preferences was reset successfully
C:\Users\Ladicek\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences was reset successfully
C:\Users\Ladicek\AppData\Local\Google\Chrome\User Data\Default\Web Data was reset successfully
C:\Users\Ladicek\AppData\Local\Google\Chrome\User Data\Default\Web Data-journal was reset successfully
==== Empty IE Cache ======================
C:\Users\Ladicek\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 emptied successfully
C:\Users\Ladicek\AppData\Local\Microsoft\Windows\INetCache\Low\Content.IE5 emptied successfully
C:\WINDOWS\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 emptied successfully
C:\WINDOWS\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 emptied successfully
C:\Users\Ladicek\AppData\Local\Microsoft\Windows\INetCache\Low\IE emptied successfully
C:\WINDOWS\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE emptied successfully
C:\Users\Ladicek\AppData\Local\Microsoft\Windows\INetCache\IE\60ZKKKZW will be deleted at reboot
C:\Users\Ladicek\AppData\Local\Microsoft\Windows\INetCache\IE\N72MIDE8 will be deleted at reboot
C:\Users\Ladicek\AppData\Local\Microsoft\Windows\INetCache\IE\OHXP5TFT will be deleted at reboot
C:\Users\Ladicek\AppData\Local\Microsoft\Windows\INetCache\IE\W97E19D5 will be deleted at reboot
==== Empty FireFox Cache ======================
No FireFox Profiles found
==== Empty Chrome Cache ======================
C:\Users\Ladicek\AppData\Local\Opera Software\Opera Stable\Cache emptied successfully
C:\Users\Ladicek\AppData\Local\Google\Chrome\User Data\Default\Cache emptied successfully
==== Empty All Flash Cache ======================
No Flash Cache Found
==== Empty All Java Cache ======================
No Java Cache Found
==== C:\zoek_backup content ======================
C:\zoek_backup (files=10 folders=10 6991297 bytes)
==== Empty Temp Folders ======================
C:\WINDOWS\Temp will be emptied at reboot
==== After Reboot ======================
==== Empty Temp Folders ======================
C:\WINDOWS\Temp successfully emptied
C:\Users\Ladicek\AppData\Local\Temp successfully emptied
==== Empty Recycle Bin ======================
C:\$RECYCLE.BIN successfully emptied
==== Deleting Files / Folders ======================
"C:\Users\Ladicek\AppData\Local\Microsoft\Windows\INetCache\IE\60ZKKKZW" not found
"C:\Users\Ladicek\AppData\Local\Microsoft\Windows\INetCache\IE\N72MIDE8" not found
"C:\Users\Ladicek\AppData\Local\Microsoft\Windows\INetCache\IE\OHXP5TFT" not found
"C:\Users\Ladicek\AppData\Local\Microsoft\Windows\INetCache\IE\W97E19D5" not found
==== EOF on ne 24.04.2016 at 21:34:32,06 ======================
Re: Prosím o kontrolu
Logfile of Trend Micro HijackThis v2.0.5
Scan saved at 21:39:18, on 24.4.2016
Platform: Unknown Windows (WinNT 6.02.1008)
MSIE: Internet Explorer v11.0 (11.00.10586.0020)
Boot mode: Normal
Running processes:
C:\WINDOWS\system32\sihost.exe
C:\WINDOWS\system32\taskhostw.exe
C:\WINDOWS\system32\rundll32.exe
C:\Windows\System32\RuntimeBroker.exe
C:\Program Files\Lenovo\iMController\PluginHost\Lenovo.Modern.ImController.PluginHost.exe
C:\Program Files\ESET\ESET Smart Security\egui.exe
C:\WINDOWS\system32\SettingSyncHost.exe
C:\Program Files\Apoint2K\Apoint.exe
C:\Program Files\Lenovo\USB Enhanced Performance Keyboard\Skdaemon.exe
C:\Program Files\HP\HP Software Update\hpwuschd2.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Apoint2K\ApMsgFwd.exe
C:\Program Files\Apoint2K\Apntex.exe
C:\WINDOWS\system32\conhost.exe
C:\Program Files\Opera\36.0.2130.65\opera.exe
C:\Program Files\Opera\36.0.2130.65\opera_crashreporter.exe
C:\Program Files\Opera\36.0.2130.65\opera.exe
C:\Program Files\WindowsApps\Microsoft.Messaging_2.15.20002.0_x86__8wekyb3d8bbwe\SkypeHost.exe
C:\Program Files\Opera\36.0.2130.65\opera.exe
C:\Program Files\Opera\36.0.2130.65\opera.exe
C:\Program Files\Opera\36.0.2130.65\opera.exe
C:\Program Files\Opera\36.0.2130.65\opera.exe
C:\Program Files\Opera\36.0.2130.65\opera.exe
C:\Program Files\Opera\36.0.2130.65\opera.exe
C:\Program Files\Opera\36.0.2130.65\opera.exe
C:\Program Files\Opera\36.0.2130.65\opera.exe
C:\Program Files\Opera\36.0.2130.65\opera.exe
C:\Program Files\Opera\36.0.2130.65\opera.exe
C:\Program Files\Opera\36.0.2130.65\opera.exe
C:\Program Files\Opera\36.0.2130.65\opera.exe
C:\Program Files\Opera\36.0.2130.65\opera.exe
C:\Program Files\Opera\36.0.2130.65\opera.exe
C:\Program Files\Opera\36.0.2130.65\opera.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Lenovo\iMController\PluginHost\Lenovo.Modern.ImController.PluginHost.exe
C:\Program Files\Lenovo\iMController\PluginHost\Lenovo.Modern.ImController.PluginHost.exe
C:\Program Files\Opera\36.0.2130.65\opera.exe
C:\Users\Ladicek\AppData\Local\Apps\2.0\OHEBRQ5C.MH4\06NPHXT4.QY3\lsb...tion_91a10ba61c75c82d_0001.0006_e3bbae03e10aca14\LSB.exe
C:\Windows\explorer.exe
C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe
C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe
C:\Program Files\TC UP\TCUP.exe
C:\Program Files\TC UP\TOTALCMD.EXE
C:\Program Files\Hewlett-Packard\HP Support Framework\HPSF.exe
C:\WINDOWS\system32\SearchProtocolHost.exe
C:\WINDOWS\system32\SearchFilterHost.exe
C:\Program Files\Lenovo\iMController\PluginHost\Lenovo.Modern.ImController.PluginHost.exe
C:\Program Files\Lenovo\iMController\PluginHost\Lenovo.Modern.ImController.PluginHost.exe
D:\Stažené soubory\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/p/?LinkId=255141
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/p/?LinkId=255141
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/p/?LinkId=255141
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = %11%\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~1\Office14\GROOVEEX.DLL
O2 - BHO: URLRedirectionBHO - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~1\MICROS~1\Office14\URLREDIR.DLL
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe
O4 - HKLM\..\Run: [BCSSync] "C:\Program Files\Microsoft Office\Office14\BCSSync.exe" /DelayServices
O4 - HKLM\..\Run: [AutoKMS] C:\WINDOWS\AutoKMS.exe
O4 - HKLM\..\Run: [HPUsageTrackingLEDM] "C:\Program Files\HP\HP UT LEDM\bin\hppusg.exe" "C:\Program Files\HP\HP UT LEDM\"
O4 - HKLM\..\Run: [Enhanced Performance Keyboard] C:\Program Files\Lenovo\USB Enhanced Performance Keyboard\SKDaemon.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /minimized /regrun
O4 - HKUS\S-1-5-19\..\Run: [OneDriveSetup] C:\Windows\System32\OneDriveSetup.exe /thfirstsetup (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [OneDriveSetup] C:\Windows\System32\OneDriveSetup.exe /thfirstsetup (User 'NETWORK SERVICE')
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~1\MICROS~1\Office14\EXCEL.EXE/3000
O8 - Extra context menu item: Od&eslat do aplikace OneNote - res://C:\PROGRA~1\MICROS~1\Office14\ONBttnIE.dll/105
O9 - Extra button: HP Smart Print - {22CC3EBD-C286-43aa-B8E6-06B115F74162} - C:\Program Files\Hewlett-Packard\SmartPrint\smartprintsetup.exe
O9 - Extra 'Tools' menuitem: SmartPrint - {22CC3EBD-C286-43aa-B8E6-06B115F74162} - C:\Program Files\Hewlett-Packard\SmartPrint\smartprintsetup.exe
O9 - Extra button: Odeslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Od&eslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll
O9 - Extra button: P&ropojené poznámky aplikace OneNote - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
O9 - Extra 'Tools' menuitem: P&ropojené poznámky aplikace OneNote - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O15 - Trusted Zone: http://help.eset.com (HKLM)
O15 - ESC Trusted Zone: http://help.eset.com (HKLM)
O18 - Protocol: tbauth - {14654CA6-5711-491D-B89A-58E571679951} - C:\Windows\System32\tbauth.dll
O18 - Protocol: windows.tbauth - {14654CA6-5711-491D-B89A-58E571679951} - C:\Windows\System32\tbauth.dll
O18 - Filter hijack: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: ESET Service (ekrn) - ESET - C:\Program Files\ESET\ESET Smart Security\ekrn.exe
O23 - Service: Firebird Guardian - DefaultInstance (FirebirdGuardianDefaultInstance) - Firebird Project - C:\Program Files\Firebird\Firebird_2_5\bin\fbguard.exe
O23 - Service: Firebird Server - DefaultInstance (FirebirdServerDefaultInstance) - Firebird Project - C:\Program Files\Firebird\Firebird_2_5\bin\fbserver.exe
O23 - Service: Služba Google Update (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Služba Google Update (gupdatem) (gupdatem) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: HP LaserJet Service - HP - C:\Program Files\HP\HPLaserJetService\HPLaserJetService.exe
O23 - Service: HP SI Service (HPSIService) - HP - C:\WINDOWS\system32\HPSIsvc.exe
O23 - Service: HP Support Solutions Framework Service (HPSupportSolutionsFrameworkService) - Hewlett-Packard Company - C:\Program Files\Hewlett-Packard\HP Support Solutions\HPSupportSolutionsFrameworkService.exe
O23 - Service: @oem21.inf,%ibm.svcDesc0%;Lenovo PM Service (IBMPMSVC) - Lenovo. - C:\WINDOWS\system32\ibmpmsvc.exe
O23 - Service: System Interface Foundation Service (ImControllerService) - Lenovo Group Limited - C:\Program Files\Lenovo\ImController\Service\Lenovo.Modern.ImController.exe
O23 - Service: LSCWinService - Lenovo - C:\Program Files\Lenovo\Lenovo Solution Center\App\LSCWinService.exe
O23 - Service: Lenovo Settings Power Service (Power Manager DBC Service) - Lenovo - C:\Program Files\ThinkPad\Utilities\PWMDBSVC.EXE
O23 - Service: Skype Updater (SkypeUpdate) - Skype Technologies - C:\Program Files\Skype\Updater\Updater.exe
O23 - Service: System Update (SUService) - Unknown owner - C:\Program Files\Lenovo\System Update\SUService.exe
--
End of file - 8915 bytes
Scan saved at 21:39:18, on 24.4.2016
Platform: Unknown Windows (WinNT 6.02.1008)
MSIE: Internet Explorer v11.0 (11.00.10586.0020)
Boot mode: Normal
Running processes:
C:\WINDOWS\system32\sihost.exe
C:\WINDOWS\system32\taskhostw.exe
C:\WINDOWS\system32\rundll32.exe
C:\Windows\System32\RuntimeBroker.exe
C:\Program Files\Lenovo\iMController\PluginHost\Lenovo.Modern.ImController.PluginHost.exe
C:\Program Files\ESET\ESET Smart Security\egui.exe
C:\WINDOWS\system32\SettingSyncHost.exe
C:\Program Files\Apoint2K\Apoint.exe
C:\Program Files\Lenovo\USB Enhanced Performance Keyboard\Skdaemon.exe
C:\Program Files\HP\HP Software Update\hpwuschd2.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Apoint2K\ApMsgFwd.exe
C:\Program Files\Apoint2K\Apntex.exe
C:\WINDOWS\system32\conhost.exe
C:\Program Files\Opera\36.0.2130.65\opera.exe
C:\Program Files\Opera\36.0.2130.65\opera_crashreporter.exe
C:\Program Files\Opera\36.0.2130.65\opera.exe
C:\Program Files\WindowsApps\Microsoft.Messaging_2.15.20002.0_x86__8wekyb3d8bbwe\SkypeHost.exe
C:\Program Files\Opera\36.0.2130.65\opera.exe
C:\Program Files\Opera\36.0.2130.65\opera.exe
C:\Program Files\Opera\36.0.2130.65\opera.exe
C:\Program Files\Opera\36.0.2130.65\opera.exe
C:\Program Files\Opera\36.0.2130.65\opera.exe
C:\Program Files\Opera\36.0.2130.65\opera.exe
C:\Program Files\Opera\36.0.2130.65\opera.exe
C:\Program Files\Opera\36.0.2130.65\opera.exe
C:\Program Files\Opera\36.0.2130.65\opera.exe
C:\Program Files\Opera\36.0.2130.65\opera.exe
C:\Program Files\Opera\36.0.2130.65\opera.exe
C:\Program Files\Opera\36.0.2130.65\opera.exe
C:\Program Files\Opera\36.0.2130.65\opera.exe
C:\Program Files\Opera\36.0.2130.65\opera.exe
C:\Program Files\Opera\36.0.2130.65\opera.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Lenovo\iMController\PluginHost\Lenovo.Modern.ImController.PluginHost.exe
C:\Program Files\Lenovo\iMController\PluginHost\Lenovo.Modern.ImController.PluginHost.exe
C:\Program Files\Opera\36.0.2130.65\opera.exe
C:\Users\Ladicek\AppData\Local\Apps\2.0\OHEBRQ5C.MH4\06NPHXT4.QY3\lsb...tion_91a10ba61c75c82d_0001.0006_e3bbae03e10aca14\LSB.exe
C:\Windows\explorer.exe
C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe
C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe
C:\Program Files\TC UP\TCUP.exe
C:\Program Files\TC UP\TOTALCMD.EXE
C:\Program Files\Hewlett-Packard\HP Support Framework\HPSF.exe
C:\WINDOWS\system32\SearchProtocolHost.exe
C:\WINDOWS\system32\SearchFilterHost.exe
C:\Program Files\Lenovo\iMController\PluginHost\Lenovo.Modern.ImController.PluginHost.exe
C:\Program Files\Lenovo\iMController\PluginHost\Lenovo.Modern.ImController.PluginHost.exe
D:\Stažené soubory\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/p/?LinkId=255141
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/p/?LinkId=255141
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/p/?LinkId=255141
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = %11%\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~1\Office14\GROOVEEX.DLL
O2 - BHO: URLRedirectionBHO - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~1\MICROS~1\Office14\URLREDIR.DLL
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe
O4 - HKLM\..\Run: [BCSSync] "C:\Program Files\Microsoft Office\Office14\BCSSync.exe" /DelayServices
O4 - HKLM\..\Run: [AutoKMS] C:\WINDOWS\AutoKMS.exe
O4 - HKLM\..\Run: [HPUsageTrackingLEDM] "C:\Program Files\HP\HP UT LEDM\bin\hppusg.exe" "C:\Program Files\HP\HP UT LEDM\"
O4 - HKLM\..\Run: [Enhanced Performance Keyboard] C:\Program Files\Lenovo\USB Enhanced Performance Keyboard\SKDaemon.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /minimized /regrun
O4 - HKUS\S-1-5-19\..\Run: [OneDriveSetup] C:\Windows\System32\OneDriveSetup.exe /thfirstsetup (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [OneDriveSetup] C:\Windows\System32\OneDriveSetup.exe /thfirstsetup (User 'NETWORK SERVICE')
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~1\MICROS~1\Office14\EXCEL.EXE/3000
O8 - Extra context menu item: Od&eslat do aplikace OneNote - res://C:\PROGRA~1\MICROS~1\Office14\ONBttnIE.dll/105
O9 - Extra button: HP Smart Print - {22CC3EBD-C286-43aa-B8E6-06B115F74162} - C:\Program Files\Hewlett-Packard\SmartPrint\smartprintsetup.exe
O9 - Extra 'Tools' menuitem: SmartPrint - {22CC3EBD-C286-43aa-B8E6-06B115F74162} - C:\Program Files\Hewlett-Packard\SmartPrint\smartprintsetup.exe
O9 - Extra button: Odeslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Od&eslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll
O9 - Extra button: P&ropojené poznámky aplikace OneNote - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
O9 - Extra 'Tools' menuitem: P&ropojené poznámky aplikace OneNote - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O15 - Trusted Zone: http://help.eset.com (HKLM)
O15 - ESC Trusted Zone: http://help.eset.com (HKLM)
O18 - Protocol: tbauth - {14654CA6-5711-491D-B89A-58E571679951} - C:\Windows\System32\tbauth.dll
O18 - Protocol: windows.tbauth - {14654CA6-5711-491D-B89A-58E571679951} - C:\Windows\System32\tbauth.dll
O18 - Filter hijack: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: ESET Service (ekrn) - ESET - C:\Program Files\ESET\ESET Smart Security\ekrn.exe
O23 - Service: Firebird Guardian - DefaultInstance (FirebirdGuardianDefaultInstance) - Firebird Project - C:\Program Files\Firebird\Firebird_2_5\bin\fbguard.exe
O23 - Service: Firebird Server - DefaultInstance (FirebirdServerDefaultInstance) - Firebird Project - C:\Program Files\Firebird\Firebird_2_5\bin\fbserver.exe
O23 - Service: Služba Google Update (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Služba Google Update (gupdatem) (gupdatem) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: HP LaserJet Service - HP - C:\Program Files\HP\HPLaserJetService\HPLaserJetService.exe
O23 - Service: HP SI Service (HPSIService) - HP - C:\WINDOWS\system32\HPSIsvc.exe
O23 - Service: HP Support Solutions Framework Service (HPSupportSolutionsFrameworkService) - Hewlett-Packard Company - C:\Program Files\Hewlett-Packard\HP Support Solutions\HPSupportSolutionsFrameworkService.exe
O23 - Service: @oem21.inf,%ibm.svcDesc0%;Lenovo PM Service (IBMPMSVC) - Lenovo. - C:\WINDOWS\system32\ibmpmsvc.exe
O23 - Service: System Interface Foundation Service (ImControllerService) - Lenovo Group Limited - C:\Program Files\Lenovo\ImController\Service\Lenovo.Modern.ImController.exe
O23 - Service: LSCWinService - Lenovo - C:\Program Files\Lenovo\Lenovo Solution Center\App\LSCWinService.exe
O23 - Service: Lenovo Settings Power Service (Power Manager DBC Service) - Lenovo - C:\Program Files\ThinkPad\Utilities\PWMDBSVC.EXE
O23 - Service: Skype Updater (SkypeUpdate) - Skype Technologies - C:\Program Files\Skype\Updater\Updater.exe
O23 - Service: System Update (SUService) - Unknown owner - C:\Program Files\Lenovo\System Update\SUService.exe
--
End of file - 8915 bytes
Kdo je online
Uživatelé prohlížející si toto fórum: Žádní registrovaní uživatelé a 5 hostů