Nedaří se mi vyčistit PC

[kiRRow]

Dobrý den

Do chrome se neustále instaluje nechtěný modul, způsobuje změnu ve vyhledávání. Manuální odstranění a smazání souborů pomůže jen do příštího restartu. Prosím o kontrolu a radu jak tuto potvoru dostat pryč.

[Rudy]

Zdravín!
Spusťte tuto utilitu:

Ulozte na plochu AdwCleaner https://malwarebytes.com/adwcleaner/ nebo http://www.bleepingcomputer.com/download/adwcleaner/

ukoncete vsechny programy
odsouhlaste licencni podmiky (EULA) klikem na Souhlasim
kliknete pravym na ikonu AdwCleaneru a vyberte Spustit jako spravce (v pripade Win XP spustte obycejne dvojklikem)
kliknete na Skenovat nyni (Scan now), pote na Cisteni a opravy (Clean and Repair)
po restartu na Vas vyskoci log (pripadne jej najdete v C:\AdwCleaner\Logs\AdwCleaner[Cxx].txt), jehoz obsah zkopirujte do pristi odpovedi

[kiRRow]

Kód: Vybrat vše

# -------------------------------
# Malwarebytes AdwCleaner 8.3.1.0
# -------------------------------
# Build:    11-18-2021
# Database: 2021-12-02.1 (Cloud)
# Support:  https://www.malwarebytes.com/support
#
# -------------------------------
# Mode: Scan
# -------------------------------
# Start:    01-26-2022
# Duration: 00:00:04
# OS:       Windows 7 Enterprise
# Scanned:  32006
# Detected: 0


***** [ Services ] *****

No malicious services found.

***** [ Folders ] *****

No malicious folders found.

***** [ Files ] *****

No malicious files found.

***** [ DLL ] *****

No malicious DLLs found.

***** [ WMI ] *****

No malicious WMI found.

***** [ Shortcuts ] *****

No malicious shortcuts found.

***** [ Tasks ] *****

No malicious tasks found.

***** [ Registry ] *****

No malicious registry entries found.

***** [ Chromium (and derivatives) ] *****

No malicious Chromium entries found.

***** [ Chromium URLs ] *****

No malicious Chromium URLs found.

***** [ Firefox (and derivatives) ] *****

No malicious Firefox entries found.

***** [ Firefox URLs ] *****

No malicious Firefox URLs found.

***** [ Hosts File Entries ] *****

No malicious hosts file entries found.

***** [ Preinstalled Software ] *****

No Preinstalled Software found.



########## EOF - C:\AdwCleaner\Logs\AdwCleaner[S00].txt ##########

[Rudy]

Toto je OK. Otevřte poznámkový blok a zkopírujte do něj:

Start

CloseProcesses:
HKLM\SOFTWARE\Policies\Microsoft\Windows Defender: Restriction <==== ATTENTION
HKU\S-1-5-21-3394924902-1472214841-2261831438-1000\...\MountPoints2: {c4fee5a1-a902-11eb-a8eb-d71a721b466a} - E:\HiSuiteDownLoader.exe
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\AnyDesk.lnk [2021-05-04]
GroupPolicy: Restriction ? <==== ATTENTION
GroupPolicy\User: Restriction ? <==== ATTENTION
Policies: C:\ProgramData\NTUSER.pol: Restriction <==== ATTENTION
Policies: C:\Users\ZWL\NTUSER.pol: Restriction <==== ATTENTION
GroupPolicy: Restriction ? <==== ATTENTION
GroupPolicy\User: Restriction ? <==== ATTENTION
Task: {A06CF732-05BF-47ED-BB64-DB78FB6FD747} - System32\Tasks\Opera scheduled Autoupdate 1626364704 => C:\Users\ZWL\AppData\Local\Programs\Opera\launcher.exe --scheduledautoupdate $(Arg0) (No File)
Task: {DB0D9578-D780-4849-B5EE-59094F851E2B} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [154456 2021-04-29] (Google LLC -> Google LLC)
Task: {E1FD7C4C-F9B3-475D-9DFA-505E577FB626} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [154456 2021-04-29] (Google LLC -> Google LLC)
U4 DiagTrack; no ImagePath
U4 dmwappushservice; no ImagePath
C:\Windows\system32\Tasks\GoogleUpdateTaskMachineUA
C:\Windows\system32\Tasks\GoogleUpdateTaskMachineCore
FirewallRules: [TCP Query User{7883707F-78C2-464F-8732-56C5DBAF3D9F}C:\xampp\mysql\bin\mysqld.exe] => (Allow) C:\xampp\mysql\bin\mysqld.exe => No File
FirewallRules: [UDP Query User{06A1FBAA-F972-4518-B849-C77FA2ED07D9}C:\xampp\mysql\bin\mysqld.exe] => (Allow) C:\xampp\mysql\bin\mysqld.exe => No File
FirewallRules: [TCP Query User{5C6A5424-5141-4EA6-857B-90B0D5E04723}C:\uwamp\bin\database\mysql-5.7.11\bin\mysqld.exe] => (Allow) C:\uwamp\bin\database\mysql-5.7.11\bin\mysqld.exe => No File
FirewallRules: [UDP Query User{CDC735AD-9C36-412A-9E67-2468219E57EB}C:\uwamp\bin\database\mysql-5.7.11\bin\mysqld.exe] => (Allow) C:\uwamp\bin\database\mysql-5.7.11\bin\mysqld.exe => No File
FirewallRules: [{6B8A2852-7645-4F1A-AFCC-8900D2C295D7}] => (Allow) C:\Users\ZWL\AppData\Local\Programs\Opera\77.0.4054.254\opera.exe => No File
FirewallRules: [TCP Query User{E75DC0E1-C288-4B2E-9C7A-0919DC0736E3}D:\kirrow\apps\altium\circuitmaker.exe] => (Allow) D:\kirrow\apps\altium\circuitmaker.exe => No File
FirewallRules: [UDP Query User{77101757-FBC2-413D-ACF9-9C57BB3D6B62}D:\kirrow\apps\altium\circuitmaker.exe] => (Allow) D:\kirrow\apps\altium\circuitmaker.exe => No File

EmptyTemp:
End

Uložte do C:\Users\ZWL\Downloads jako fixlist.txt. Spusťte znovu FRST a klikněte na >Fix<. Po skončení akce se objeví log, který sem zkopírujte.

[kiRRow]

Kód: Vybrat vše

Fix result of Farbar Recovery Scan Tool (x64) Version: 26-01-2022
Ran by ZWL (26-01-2022 18:15:16) Run:1
Running from C:\Users\ZWL\Downloads
Loaded Profiles: ZWL
Boot Mode: Normal
==============================================

fixlist content:
*****************
Start

CloseProcesses:
HKLM\SOFTWARE\Policies\Microsoft\Windows Defender: Restriction <==== ATTENTION
HKU\S-1-5-21-3394924902-1472214841-2261831438-1000\...\MountPoints2: {c4fee5a1-a902-11eb-a8eb-d71a721b466a} - E:\HiSuiteDownLoader.exe
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\AnyDesk.lnk [2021-05-04]
GroupPolicy: Restriction ? <==== ATTENTION
GroupPolicy\User: Restriction ? <==== ATTENTION
Policies: C:\ProgramData\NTUSER.pol: Restriction <==== ATTENTION
Policies: C:\Users\ZWL\NTUSER.pol: Restriction <==== ATTENTION
GroupPolicy: Restriction ? <==== ATTENTION
GroupPolicy\User: Restriction ? <==== ATTENTION
Task: {A06CF732-05BF-47ED-BB64-DB78FB6FD747} - System32\Tasks\Opera scheduled Autoupdate 1626364704 => C:\Users\ZWL\AppData\Local\Programs\Opera\launcher.exe --scheduledautoupdate $(Arg0) (No File)
Task: {DB0D9578-D780-4849-B5EE-59094F851E2B} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [154456 2021-04-29] (Google LLC -> Google LLC)
Task: {E1FD7C4C-F9B3-475D-9DFA-505E577FB626} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [154456 2021-04-29] (Google LLC -> Google LLC)
U4 DiagTrack; no ImagePath
U4 dmwappushservice; no ImagePath
C:\Windows\system32\Tasks\GoogleUpdateTaskMachineUA
C:\Windows\system32\Tasks\GoogleUpdateTaskMachineCore
FirewallRules: [TCP Query User{7883707F-78C2-464F-8732-56C5DBAF3D9F}C:\xampp\mysql\bin\mysqld.exe] => (Allow) C:\xampp\mysql\bin\mysqld.exe => No File
FirewallRules: [UDP Query User{06A1FBAA-F972-4518-B849-C77FA2ED07D9}C:\xampp\mysql\bin\mysqld.exe] => (Allow) C:\xampp\mysql\bin\mysqld.exe => No File
FirewallRules: [TCP Query User{5C6A5424-5141-4EA6-857B-90B0D5E04723}C:\uwamp\bin\database\mysql-5.7.11\bin\mysqld.exe] => (Allow) C:\uwamp\bin\database\mysql-5.7.11\bin\mysqld.exe => No File
FirewallRules: [UDP Query User{CDC735AD-9C36-412A-9E67-2468219E57EB}C:\uwamp\bin\database\mysql-5.7.11\bin\mysqld.exe] => (Allow) C:\uwamp\bin\database\mysql-5.7.11\bin\mysqld.exe => No File
FirewallRules: [{6B8A2852-7645-4F1A-AFCC-8900D2C295D7}] => (Allow) C:\Users\ZWL\AppData\Local\Programs\Opera\77.0.4054.254\opera.exe => No File
FirewallRules: [TCP Query User{E75DC0E1-C288-4B2E-9C7A-0919DC0736E3}D:\kirrow\apps\altium\circuitmaker.exe] => (Allow) D:\kirrow\apps\altium\circuitmaker.exe => No File
FirewallRules: [UDP Query User{77101757-FBC2-413D-ACF9-9C57BB3D6B62}D:\kirrow\apps\altium\circuitmaker.exe] => (Allow) D:\kirrow\apps\altium\circuitmaker.exe => No File

EmptyTemp:
End
*****************

Processes closed successfully.
HKLM\SOFTWARE\Policies\Microsoft\Windows Defender => removed successfully
HKU\S-1-5-21-3394924902-1472214841-2261831438-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c4fee5a1-a902-11eb-a8eb-d71a721b466a} => removed successfully
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\AnyDesk.lnk => moved successfully
C:\Windows\system32\GroupPolicy\Machine => moved successfully
C:\Windows\system32\GroupPolicy\GPT.ini => moved successfully
C:\Windows\system32\GroupPolicy\User => moved successfully
C:\ProgramData\NTUSER.pol => moved successfully
C:\Users\ZWL\NTUSER.pol => moved successfully
"C:\Windows\system32\GroupPolicy\Machine" => not found
"C:\Windows\system32\GroupPolicy\User" => not found
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{A06CF732-05BF-47ED-BB64-DB78FB6FD747}" => removed successfully
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{A06CF732-05BF-47ED-BB64-DB78FB6FD747}" => removed successfully
C:\Windows\System32\Tasks\Opera scheduled Autoupdate 1626364704 => moved successfully
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Opera scheduled Autoupdate 1626364704" => removed successfully
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{DB0D9578-D780-4849-B5EE-59094F851E2B}" => removed successfully
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{DB0D9578-D780-4849-B5EE-59094F851E2B}" => removed successfully
C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA => moved successfully
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\GoogleUpdateTaskMachineUA" => removed successfully
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{E1FD7C4C-F9B3-475D-9DFA-505E577FB626}" => removed successfully
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{E1FD7C4C-F9B3-475D-9DFA-505E577FB626}" => removed successfully
C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore => moved successfully
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\GoogleUpdateTaskMachineCore" => removed successfully
HKLM\System\CurrentControlSet\Services\DiagTrack => removed successfully
DiagTrack => service removed successfully
HKLM\System\CurrentControlSet\Services\dmwappushservice => removed successfully
dmwappushservice => service removed successfully
"C:\Windows\system32\Tasks\GoogleUpdateTaskMachineUA" => not found
"C:\Windows\system32\Tasks\GoogleUpdateTaskMachineCore" => not found
"HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\TCP Query User{7883707F-78C2-464F-8732-56C5DBAF3D9F}C:\xampp\mysql\bin\mysqld.exe" => removed successfully
"HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\UDP Query User{06A1FBAA-F972-4518-B849-C77FA2ED07D9}C:\xampp\mysql\bin\mysqld.exe" => removed successfully
"HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\TCP Query User{5C6A5424-5141-4EA6-857B-90B0D5E04723}C:\uwamp\bin\database\mysql-5.7.11\bin\mysqld.exe" => removed successfully
"HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\UDP Query User{CDC735AD-9C36-412A-9E67-2468219E57EB}C:\uwamp\bin\database\mysql-5.7.11\bin\mysqld.exe" => removed successfully
"HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\{6B8A2852-7645-4F1A-AFCC-8900D2C295D7}" => removed successfully
"HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\TCP Query User{E75DC0E1-C288-4B2E-9C7A-0919DC0736E3}D:\kirrow\apps\altium\circuitmaker.exe" => removed successfully
"HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\UDP Query User{77101757-FBC2-413D-ACF9-9C57BB3D6B62}D:\kirrow\apps\altium\circuitmaker.exe" => removed successfully

=========== EmptyTemp: ==========

BITS transfer queue => 0 B
DOMStore, IE Recovery, AppCache, Feeds Cache, Thumbcache, IconCache => 54789738 B
Java, Flash, Steam htmlcache => 187353573 B
Windows/system/drivers => 6188630 B
Edge => 0 B
Chrome => 446779902 B
Firefox => 0 B
Opera => 0 B

Temp, IE cache, history, cookies, recent:
Default => 0 B
Public => 0 B
ProgramData => 0 B
systemprofile => 83565 B
systemprofile32 => 149793 B
LocalService => 282037 B
NetworkService => 10535855 B
ZWL => 1649273094 B

RecycleBin => 777272488 B
EmptyTemp: => 2.9 GB temporary data Removed.

================================


The system needed a reboot.

==== End of Fixlog 18:15:22 ====

[Rudy]

Smazáno. Nastala nějaká změna?

[kiRRow]

Bohužel ne. "Objekt se znovu objevil" - Zavře/Otevře se prohlížeč, a objeví se v něm plugin jménem vSecureGift ( moc pěkný dáreček ) ...

[Rudy]

Zkusíme prohlížeče vyčistit. Spusťte postupně tyto utility:

1. Stahnete Zoek.exe https://www.edisk.cz/stahni/21334/zoek.rar_1.3MB.html/ a ulozte jej na plochu

Pokud pouzivate Win Vista ci W7, kliknete na Zoek pravym a dejte Run As Administrator ci Spustit jako spravce
Do okna vlozte skript nize

autoclean;
resethosts;
emptyclsid;
IEdefaults;
FFdefaults;
CHRdefaults;
emptyIEcache;
emptyFFcache;
emptyCHRcache;
emptyalltemp;
emptyflash;
emptyjava;
emptyrecycle.bin;

Nasledne kliknete na Run Script
PC provede opravu, restartuje se a da Vam log, jeho obsah vlozte sem.

a

2. Junkware removal tool: https://www.stahuj.cz/utility_a_ostatni ... oval-tool/
•Ulozte nejlepe na plochu
•Po spusteni se zobrazi licencni podminky, stisknete libovolnou klavesu
•Probehne vytvoreni zalohy a nasledne prohledavani
•Probehne skenovani a pak se objevi log, pripadne bude ulozen v c:\JRT jako JRT.txt, ten sem vlozte.

[kiRRow]

Nebyl by prosím jinačí odkaz, než na edisk ?

[Rudy]

Bohužel výrobce to stáhl ze svého webu a jinde neexistuje. Mám ho sice v PC, ale i zabalený je příliš velký a fórum ho neakceptuje. Lituji.

[kiRRow]

Až se mi to podaří stáhnout, tak to okamžitě uploadnu jinam.

[Rudy]

OK. Sice nevím proč, ale je to vaše věc.

[kiRRow]

log z zoek :

Kód: Vybrat vše

Zoek.exe v5.0.0.0 Updated 04-May-2015
Tool run by ZWL on st 26.01.2022 at 22:44:23,34.
Microsoft Windows 7 Enterprise  6.1.7601 Service Pack 1 x64
Running in: Normal Mode No Internet Access Detected
Launched: C:\Users\ZWL\Desktop\zoek.exe [Scan all users] [Script inserted] 

==== System Restore Info ======================

26.1.2022 22:44:52 Zoek.exe System Restore Point Created Successfully.

==== Reset Hosts File ======================

# Copyright (c) 1993-2006 Microsoft Corp. 
# 
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows. 
# 
# This file contains the mappings of IP addresses to host names. Each 
# entry should be kept on an individual line. The IP address should 
# be placed in the first column followed by the corresponding host name. 
# The IP address and the host name should be separated by at least one 
# space. 
# 
# Additionally, comments (such as these) may be inserted on individual 
# lines or following the machine name denoted by a '#' symbol. 
# 
# For example: 
# 
#      102.54.94.97     rhino.acme.com          # source server 
#       38.25.63.10     x.acme.com              # x client host 
 
# localhost name resolution is handled within DNS itself. 
127.0.0.1       localhost 
::1             localhost 

==== Empty Folders Check ======================

C:\PROGRA~3\Altium Designer Winter 10 - Security deleted successfully
C:\PROGRA~3\Posse deleted successfully
C:\Users\ZWL\AppData\Roaming\cradge deleted successfully
C:\Users\ZWL\AppData\Roaming\Ogreism deleted successfully
C:\Users\ZWL\AppData\Roaming\Wickr, LLC deleted successfully
C:\Users\ZWL\AppData\Local\AltiumSecurityService deleted successfully
C:\Users\ZWL\AppData\Local\GHISLER deleted successfully
C:\Users\ZWL\AppData\Local\Opera Software deleted successfully

==== Deleting CLSID Registry Keys ======================


==== Deleting CLSID Registry Values ======================


==== Deleting Services ======================


==== Deleting Files \ Folders ======================

C:\PROGRA~3\Altium Designer Winter 10 - Security not found
C:\Users\ZWL\AppData\Roaming\Factorio deleted
C:\Users\ZWL\AppData\Roaming\uTorrent deleted
C:\PROGRA~3\Package Cache deleted
C:\Users\ZWL\AppData\Local\cache deleted

==== Chromium Look ======================

HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\Extensions
lmjegmlicamnimmfhcmpkclmigmmcbeh - No path found[]

uBlock₀ - ZWL\AppData\Local\Google\Chrome\User Data\Default\Extensions\cjpalhdlnbpafiamejdnhcphjbkeiagm

==== Set IE to Default ======================

Old Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"="http://go.microsoft.com/fwlink/?LinkId=69157"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\AboutURLs]
"Tabs"="res://ieframe.dll/tabswelcome.htm"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\AboutURLs]
"Tabs"="res://ieframe.dll/tabswelcome.htm"

New Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"="http://go.microsoft.com/fwlink/?LinkId=69157"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\AboutURLs]
"Tabs"="about:newtab"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\AboutURLs]
"Tabs"="about:newtab"

==== All HKCU SearchScopes ======================

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes
"DefaultScope"="{0633EE93-D776-472f-A0FF-E1416B8B2E3A}"
{012E1000-F331-11DB-8314-0800200C9A66} Google  Url="http://www.google.com/search?q={searchTerms}"
{0633EE93-D776-472f-A0FF-E1416B8B2E3A} Bing  Url="http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC"

==== Reset Google Chrome ======================

C:\Users\ZWL\AppData\Local\Google\Chrome\User Data\Default\Preferences was reset successfully
C:\Users\ZWL\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences was reset successfully
C:\Users\ZWL\AppData\Local\Google\Chrome\User Data\Default\Web Data will be reset at reboot
C:\Users\ZWL\AppData\Local\Google\Chrome\User Data\Default\Web Data-journal will be reset at reboot

==== Empty IE Cache ======================

C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\serviceprofiles\Localservice\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\ZWL\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat will be deleted at reboot

==== Empty FireFox Cache ======================

No FireFox Profiles found

==== Empty Chrome Cache ======================

C:\Users\ZWL\AppData\Local\Google\Chrome\User Data\Default\Cache will be emptied at reboot

==== Empty All Flash Cache ======================

No Flash Cache Found

==== Empty All Java Cache ======================

No Java Cache Found

==== C:\zoek_backup content ======================

C:\zoek_backup (files=2934 folders=273 1471701073 bytes)

==== Empty Temp Folders ======================

C:\Users\Default\AppData\Local\Temp emptied successfully
C:\Users\Default User\AppData\Local\Temp emptied successfully
C:\Users\ZWL\AppData\Local\Temp will be emptied at reboot
C:\Windows\sysWoW64\config\systemprofile\AppData\Local\Temp emptied successfully
C:\Windows\serviceprofiles\networkservice\AppData\Local\Temp emptied successfully
C:\Windows\serviceprofiles\Localservice\AppData\Local\Temp emptied successfully
C:\Windows\Temp will be emptied at reboot

==== After Reboot ======================

==== Empty Temp Folders ======================

C:\Windows\Temp successfully emptied
C:\Users\ZWL\AppData\Local\Temp successfully emptied

==== Empty Recycle Bin ======================

C:\$RECYCLE.BIN successfully emptied

==== Deleting Files / Folders ======================

"C:\Users\ZWL\AppData\Local\Google\Chrome\User Data\Default\Web Data" not found
"C:\Users\ZWL\AppData\Local\Google\Chrome\User Data\Default\Web Data-journal" not found
"C:\Users\ZWL\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat" not found

==== EOF on st 26.01.2022 at 22:52:37,45 ======================

log z JRT :

Kód: Vybrat vše

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Malwarebytes
Version: 8.1.4 (07.09.2017)
Operating System: Windows 7 Enterprise x64 
Ran by ZWL (Administrator) on st 26.01.2022 at 22:58:19,03
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




File System: 8 

Successfully deleted: C:\Users\ZWL\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9OUPCO7A (Temporary Internet Files Folder) 
Successfully deleted: C:\Users\ZWL\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\K0DIPXB3 (Temporary Internet Files Folder) 
Successfully deleted: C:\Users\ZWL\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\NLMIKFPH (Temporary Internet Files Folder) 
Successfully deleted: C:\Users\ZWL\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WC4F0FFI (Temporary Internet Files Folder) 
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9OUPCO7A (Temporary Internet Files Folder) 
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\K0DIPXB3 (Temporary Internet Files Folder) 
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\NLMIKFPH (Temporary Internet Files Folder) 
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WC4F0FFI (Temporary Internet Files Folder) 



Registry: 0 





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on st 26.01.2022 at 22:59:02,43
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

[Rudy]

OK. Smazáno. Změnilko se něco k lepšímu?

[kiRRow]

Bohužel, po restartu se opět objevil plugin v prohlížeči a jeho skrytá složka na disku.