Win32.Downloader.gen

[milav]

Dobrý den, Spybot mi detekoval Win32.Downloader.gen. Tímtéž programem jsem ho nechal zlikvidovat, ale jelikož jsem čekal, že to nebude tak jednoduché, při příštím startu jesem okamžitě spustil Spybot a samozřejmě tam byl znovu. Nová likvidace, vyčištění CCleanerem i registry, vymazání předešlých bodů obnovení a zakázání vytvoření nového bodu obnovení. Po novém zapnutí PC je tam šmejd znovu. Tady už si nevím rady a prosím o pomoc. Stáhnul jsem si RSIT opět vyčistil PC a udělal log, který zasílám. Předem děkuji.

Logfile of random's system information tool 1.09 (written by random/random)
Run by Milan at 2013-04-28 09:55:42
Microsoft Windows 7 Home Premium Service Pack 1
System drive C: has 48 GB (58%) free of 82 GB
Total RAM: 1953 MB (69% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 9:55:49, on 28.4.2013
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v8.00 (8.00.7601.17514)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskhost.exe
C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
C:\Windows\System32\igfxtray.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\System32\igfxpers.exe
C:\Program Files\Spyware Terminator\SpywareTerminatorShield.Exe
C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE
C:\Program Files\Hewlett-Packard\OrderReminder\OrderReminder.exe
C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
C:\Program Files\Microsoft Security Client\msseces.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Windows\System32\StikyNot.exe
C:\Windows\system32\NOTEPAD.EXE
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Users\Milan\Desktop\RSIT.exe
C:\Program Files\trend micro\Milan.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://search.conduit.com?SearchSource= ... =CT2475029
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: (no name) - {a1e75a0e-4397-4ba8-bb50-e19fb66890f4} - (no file)
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: PDF Architect Helper - {3A2D5EBA-F86D-4BD3-A177-019765996711} - C:\Program Files\PDF Architect\PDFIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O3 - Toolbar: PDF Architect Toolbar - {25A3A431-30BB-47C8-AD6A-E1063801134F} - C:\Program Files\PDF Architect\PDFIEPlugin.dll
O4 - HKLM\..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe -s
O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [SpywareTerminator] "C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe"
O4 - HKLM\..\Run: [CanonMyPrinter] C:\Program Files\Canon\MyPrinter\BJMyPrt.exe /logon
O4 - HKLM\..\Run: [CanonSolutionMenu] C:\Program Files\Canon\SolutionMenu\CNSLMAIN.exe /logon
O4 - HKLM\..\Run: [OrderReminder] C:\Program Files\Hewlett-Packard\OrderReminder\OrderReminder.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [MSC] "C:\Program Files\Microsoft Security Client\msseces.exe" -hide -runkey
O4 - HKLM\..\Run: [SearchProtectAll] C:\Program Files\SearchProtect\bin\cltmng.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /minimized /regrun
O4 - HKCU\..\Run: [RESTART_STICKY_NOTES] C:\Windows\System32\StikyNot.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O4 - Startup: Dropbox.lnk = Milan\AppData\Roaming\Dropbox\bin\Dropbox.exe
O4 - Startup: OpenOffice.org 3.3.lnk = C:\Program Files\OpenOffice.org 3\program\quickstart.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O9 - Extra button: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra 'Tools' menuitem: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: Search Protect by Conduit Updater (CltMngSvc) - Conduit - C:\Program Files\SearchProtect\bin\CltMngSvc.exe
O23 - Service: Služba Google Update (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Služba Google Update (gupdatem) (gupdatem) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Intel(R) Management and Security Application Local Management Service (LMS) - Intel Corporation - C:\Program Files\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe
O23 - Service: PDF Architect Helper Service - pdfforge GbR - C:\Program Files\PDF Architect\HelperService.exe
O23 - Service: PDF Architect Service - pdfforge GbR - C:\Program Files\PDF Architect\ConversionService.exe
O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
O23 - Service: Skype Updater (SkypeUpdate) - Skype Technologies - C:\Program Files\Skype\Updater\Updater.exe
O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - C:\Program Files\Spyware Terminator\sp_rsser.exe
O23 - Service: Intel(R) Management and Security Application User Notification Service (UNS) - Intel Corporation - C:\Program Files\Intel\Intel(R) Management Engine Components\UNS\UNS.exe

--
End of file - 7245 bytes

======Scheduled tasks folder======

C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
C:\Windows\tasks\GoogleUpdateTaskMachineUA.job

=========Mozilla firefox=========

ProfilePath - C:\Users\Milan\AppData\Roaming\Mozilla\Firefox\Profiles\qrar7tc0.default

prefs.js - "browser.search.useDBForOrder" - true
prefs.js - "browser.startup.homepage" - "http://www.seznam.cz/"
prefs.js - "keyword.URL" - "http://search.conduit.com/ResultsExt.as ... 21&UM=2&q="

"FFPDFArchitectConverter@pdfarchitect.com"=C:\Program Files\PDF Architect\FFPDFArchitectExt


[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 11.6.602.180 Plugin
"Path"=C:\Windows\system32\Macromed\Flash\NPSWF32_11_6_602_180.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@canon.com/EPPEX]
"Description"=Canon Easy-PhotoPrint EX
"Path"=C:\Program Files\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@Google.com/GoogleEarthPlugin]
"Description"=Google Earth in your browser
"Path"=C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/GENUINE]
"Description"=
"Path"=disabled

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@tools.google.com/Google Update;version=3]
"Description"=Google Update
"Path"=C:\Program Files\Google\Update\1.3.21.135\npGoogleUpdate3.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@tools.google.com/Google Update;version=9]
"Description"=Google Update
"Path"=C:\Program Files\Google\Update\1.3.21.135\npGoogleUpdate3.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\Adobe Reader]
"Description"=Handles PDFs in-place in Firefox
"Path"=C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll

C:\Program Files\Mozilla Firefox\extensions\
{972ce4c6-7e08-4474-a285-3208198ce6fd}
{AB2CE124-6272-4b12-94A9-7303C7397BD1}

C:\Program Files\Mozilla Firefox\components\
binary.manifest
browsercomps.dll
sprotector.js

C:\Program Files\Mozilla Firefox\plugins\
np-mswmp.dll
nppdf32.dll
WMP Firefox Plugin License.rtf
WMP Firefox Plugin RelNotes.txt

C:\Program Files\Mozilla Firefox\searchplugins\
google.xml
wikipedia-cz.xml
yahoo.xml

C:\Users\Milan\AppData\Roaming\Mozilla\Firefox\Profiles\qrar7tc0.default\extensions\
centrumpomocnik@centrum.cz
engine@conduit.com
{79b8e308-95a2-4044-932d-80e833a863cc}
{a1e75a0e-4397-4ba8-bb50-e19fb66890f4}
{ec8030f7-c20a-464f-9b0e-13a3a9e97384}

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2012-12-18 66280]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3A2D5EBA-F86D-4BD3-A177-019765996711}]
PDF Architect Helper - C:\Program Files\PDF Architect\PDFIEHelper.dll [2012-11-22 91784]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{53707962-6F74-2D53-2644-206D7942484F}]
Spybot-S&D IE Protection - C:\PROGRA~1\SPYBOT~1\SDHelper.dll [2009-01-26 1879896]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}]
Skype add-on for Internet Explorer - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll [2010-02-08 804136]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{25A3A431-30BB-47C8-AD6A-E1063801134F} - PDF Architect Toolbar - C:\Program Files\PDF Architect\PDFIEPlugin.dll [2012-11-22 731784]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"=C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [2010-11-19 9874024]
"IgfxTray"=C:\Windows\system32\igfxtray.exe [2011-10-21 142616]
"HotKeysCmds"=C:\Windows\system32\hkcmd.exe [2011-10-21 177432]
"Persistence"=C:\Windows\system32\igfxpers.exe [2011-10-21 176408]
"SpywareTerminator"=C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe [2011-12-24 2957824]
"CanonMyPrinter"=C:\Program Files\Canon\MyPrinter\BJMyPrt.exe [2009-07-27 1983816]
"CanonSolutionMenu"=C:\Program Files\Canon\SolutionMenu\CNSLMAIN.exe [2009-03-18 767312]
"OrderReminder"=C:\Program Files\Hewlett-Packard\OrderReminder\OrderReminder.exe [2005-03-18 98304]
"HP Software Update"=C:\Program Files\HP\HP Software Update\HPWuSchd2.exe [2007-03-11 49152]
"Adobe ARM"=C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2012-12-03 946352]
"MSC"=C:\Program Files\Microsoft Security Client\msseces.exe [2013-01-27 947152]
"SearchProtectAll"=C:\Program Files\SearchProtect\bin\cltmng.exe [2013-03-06 2731296]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"SpybotSD TeaTimer"=C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe [2009-03-05 2260480]
"Skype"=C:\Program Files\Skype\Phone\Skype.exe [2012-02-15 17146504]
"RESTART_STICKY_NOTES"=C:\Windows\System32\StikyNot.exe [2009-07-14 354304]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Users^Milan^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Dropbox.lnk]
C:\Users\Milan\AppData\Roaming\Dropbox\bin\Dropbox.exe [2013-03-12 29106336]

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
Adobe Gamma Loader.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe

C:\Users\Milan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
Dropbox.lnk - C:\Users\Milan\AppData\Roaming\Dropbox\bin\Dropbox.exe
OpenOffice.org 3.3.lnk - C:\Program Files\OpenOffice.org 3\program\quickstart.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
C:\Windows\system32\igfxdev.dll [2011-10-21 294400]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED}

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\MsMpSvc]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=5
"ConsentPromptBehaviorUser"=3
"EnableUIADesktopToggle"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.msadpcm"=msadp32.acm
"midimapper"=midimap.dll
"wavemapper"=msacm32.drv
"VIDC.UYVY"=msyuv.dll
"VIDC.YUY2"=msyuv.dll
"VIDC.YVYU"=msyuv.dll
"VIDC.IYUV"=iyuv_32.dll
"vidc.i420"=iyuv_32.dll
"VIDC.YVU9"=tsbyuv.dll
"msacm.l3acm"=C:\Windows\System32\l3codeca.acm
"vidc.cvid"=iccvid.dll
"MSVideo8"=VfWWDM32.dll
"wave1"=wdmaud.drv
"midi1"=wdmaud.drv
"mixer1"=wdmaud.drv
"aux1"=wdmaud.drv
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*

======List of files/folders created in the last 1 month======

2013-04-26 21:15:51 ----D---- C:\rsit
2013-04-26 21:15:51 ----D---- C:\Program Files\trend micro
2013-04-23 20:03:18 ----A---- C:\Windows\system32\drivers\ntfs.sys
2013-04-11 21:07:39 ----D---- C:\Program Files\Mozilla Firefox
2013-04-10 07:06:05 ----A---- C:\Windows\system32\win32k.sys
2013-04-10 07:06:04 ----A---- C:\Windows\system32\drivers\fvevol.sys
2013-04-10 07:06:01 ----A---- C:\Windows\system32\mshtml.dll
2013-04-10 07:06:01 ----A---- C:\Windows\system32\ieframe.dll
2013-04-10 07:06:00 ----A---- C:\Windows\system32\wininet.dll
2013-04-10 07:06:00 ----A---- C:\Windows\system32\urlmon.dll
2013-04-10 07:06:00 ----A---- C:\Windows\system32\msfeeds.dll
2013-04-10 07:06:00 ----A---- C:\Windows\system32\iertutil.dll
2013-04-10 07:05:59 ----A---- C:\Windows\system32\url.dll
2013-04-10 07:05:59 ----A---- C:\Windows\system32\mshtmled.dll
2013-04-10 07:05:59 ----A---- C:\Windows\system32\jsproxy.dll
2013-04-10 07:05:59 ----A---- C:\Windows\system32\ieui.dll
2013-04-10 07:05:45 ----A---- C:\Windows\system32\smss.exe
2013-04-10 07:05:45 ----A---- C:\Windows\system32\ntoskrnl.exe
2013-04-10 07:05:45 ----A---- C:\Windows\system32\ntkrnlpa.exe
2013-04-10 07:05:45 ----A---- C:\Windows\system32\csrsrv.dll
2013-04-08 22:11:41 ----D---- C:\Users\Milan\AppData\Roaming\Corel
2013-04-03 20:06:53 ----D---- C:\Program Files\Mozilla Thunderbird

======List of files/folders modified in the last 1 month======

2013-04-28 09:55:28 ----D---- C:\ProgramData\Spybot - Search & Destroy
2013-04-28 09:55:27 ----D---- C:\Windows\Temp
2013-04-28 09:36:09 ----A---- C:\Windows\DUO.INI
2013-04-28 09:10:26 ----HD---- C:\Users\Milan\AppData\Roaming\Skype
2013-04-27 19:47:03 ----D---- C:\ProgramData\Spyware Terminator
2013-04-27 19:47:03 ----D---- C:\Program Files\Spyware Terminator
2013-04-27 19:40:25 ----HD---- C:\Users\Milan\AppData\Roaming\Spyware Terminator
2013-04-27 18:24:24 ----D---- C:\Windows\system32\config
2013-04-27 18:14:12 ----D---- C:\Windows\Prefetch
2013-04-27 18:02:57 ----A---- C:\Windows\system32\log.txt
2013-04-27 18:02:28 ----D---- C:\Users\Milan\AppData\Roaming\Dropbox
2013-04-26 21:15:51 ----RD---- C:\Program Files
2013-04-26 10:40:42 ----SHD---- C:\System Volume Information
2013-04-25 21:54:46 ----D---- C:\Program Files\Common Files
2013-04-24 07:14:24 ----D---- C:\Windows\winsxs
2013-04-23 23:00:05 ----D---- C:\Windows\system32\drivers
2013-04-23 20:02:50 ----D---- C:\Windows\system32\catroot
2013-04-22 07:04:21 ----D---- C:\WinDUO
2013-04-20 23:58:01 ----SHD---- C:\Windows\Installer
2013-04-20 23:58:01 ----HD---- C:\Config.Msi
2013-04-20 23:53:44 ----D---- C:\Program Files\Google
2013-04-20 23:53:01 ----D---- C:\Windows\Tasks
2013-04-20 23:53:01 ----D---- C:\Windows\system32\Tasks
2013-04-15 07:12:45 ----D---- C:\Windows\system32\catroot2
2013-04-12 19:46:30 ----D---- C:\Program Files\Mozilla Maintenance Service
2013-04-10 14:47:13 ----D---- C:\Windows\System32
2013-04-10 14:47:12 ----D---- C:\Windows\system32\migration
2013-04-10 14:47:12 ----D---- C:\Program Files\Internet Explorer
2013-04-10 10:37:49 ----A---- C:\Windows\system32\MRT.exe
2013-04-08 07:05:24 ----D---- C:\Windows\inf
2013-04-08 07:05:24 ----A---- C:\Windows\system32\PerfStringBackup.INI
2013-04-05 20:11:36 ----D---- C:\Windows\system32\FxsTmp
2013-04-02 12:33:22 ----N---- C:\Windows\system32\MpSigStub.exe

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 MpFilter;Microsoft Malware Protection Driver; C:\Windows\system32\DRIVERS\MpFilter.sys [2013-01-20 195296]
R0 pciide;pciide; C:\Windows\system32\drivers\pciide.sys [2009-07-14 12368]
R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2010-11-20 173440]
R1 sp_rsdrv2;Spyware Terminator Driver 2; \??\C:\Windows\system32\drivers\sp_rsdrv2.sys [2011-12-24 138752]
R2 NisDrv;Microsoft Network Inspection System; C:\Windows\system32\DRIVERS\NisDrvWFP.sys [2013-01-20 100328]
R2 Parvdm;Parvdm; C:\Windows\system32\DRIVERS\parvdm.sys [2009-07-14 8704]
R3 asmthub3;ASMedia USB3 Hub Service; C:\Windows\system32\DRIVERS\asmthub3.sys [2011-02-24 100328]
R3 asmtxhci;ASMEDIA XHCI Service; C:\Windows\system32\DRIVERS\asmtxhci.sys [2011-02-24 308200]
R3 igfx;igfx; C:\Windows\system32\DRIVERS\igdkmd32.sys [2011-10-21 10858496]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\Windows\system32\drivers\RTKVHDA.sys [2010-11-23 3253352]
R3 MEI;Intel(R) Management Engine Interface; C:\Windows\system32\DRIVERS\HECI.sys [2010-10-19 41088]
R3 RTL8167;Realtek 8167 NT Driver; C:\Windows\system32\DRIVERS\Rt86win7.sys [2011-05-16 391272]
S3 aic78xx;aic78xx; C:\Windows\system32\drivers\djsvs.sys [2009-07-14 70720]
S3 amdagp;AMD AGP Bus Filter Driver; C:\Windows\system32\drivers\amdagp.sys [2009-07-14 53312]
S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0; C:\Windows\system32\DRIVERS\b57nd60x.sys [2009-07-14 229888]
S3 RdpVideoMiniport;Remote Desktop Video Miniport Driver; C:\Windows\System32\drivers\rdpvideominiport.sys [2012-08-23 14848]
S3 sisagp;SIS AGP Bus Filter; C:\Windows\system32\drivers\sisagp.sys [2009-07-14 52304]
S3 TsUsbFlt;@%SystemRoot%\system32\drivers\tsusbflt.sys,-1; C:\Windows\System32\drivers\tsusbflt.sys [2012-08-23 49664]
S3 TsUsbGD;Remote Desktop Generic USB Device; C:\Windows\system32\drivers\TsUsbGD.sys [2012-08-23 27136]
S3 usbscan;Ovladač skeneru USB; C:\Windows\system32\DRIVERS\usbscan.sys [2009-07-14 35840]
S3 viaagp;VIA AGP Bus Filter; C:\Windows\system32\drivers\viaagp.sys [2009-07-14 53328]
S3 ViaC7;VIA C7 Processor Driver; C:\Windows\system32\drivers\viac7.sys [2009-07-14 52736]
S3 WinUsb;WinUsb; C:\Windows\system32\DRIVERS\WinUsb.sys [2010-11-20 35968]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AdobeARMservice;Adobe Acrobat Update Service; C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe [2012-12-18 65192]
R2 CltMngSvc;Search Protect by Conduit Updater; C:\Program Files\SearchProtect\bin\CltMngSvc.exe [2013-03-06 93984]
R2 LMS;Intel(R) Management and Security Application Local Management Service; C:\Program Files\Intel\Intel(R) Management Engine Components\LMS\LMS.exe [2010-12-20 325656]
R2 MsMpSvc;Microsoft Antimalware Service; C:\Program Files\Microsoft Security Client\MsMpEng.exe [2013-01-27 20456]
R2 PDF Architect Helper Service;PDF Architect Helper Service; C:\Program Files\PDF Architect\HelperService.exe [2012-11-22 1522312]
R2 PDF Architect Service;PDF Architect Service; C:\Program Files\PDF Architect\ConversionService.exe [2012-11-22 905864]
R2 SBSDWSCService;SBSD Security Center Service; C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe [2009-01-26 1153368]
R2 sp_rssrv;Spyware Terminator Realtime Shield Service; C:\Program Files\Spyware Terminator\sp_rsser.exe [2011-12-24 1097216]
R2 UNS;Intel(R) Management and Security Application User Notification Service; C:\Program Files\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2010-12-20 2656280]
R3 NisSrv;@C:\Program Files\Microsoft Security Client\MpAsDesc.dll,-243; C:\Program Files\Microsoft Security Client\NisSrv.exe [2013-01-27 295232]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
S2 gupdate;Služba Google Update (gupdate); C:\Program Files\Google\Update\GoogleUpdate.exe [2013-04-20 116648]
S2 SkypeUpdate;Skype Updater; C:\Program Files\Skype\Updater\Updater.exe [2012-02-15 158856]
S3 gupdatem;Služba Google Update (gupdatem); C:\Program Files\Google\Update\GoogleUpdate.exe [2013-04-20 116648]
S3 hpqcxs08;hpqcxs08; C:\Windows\system32\svchost.exe [2009-07-14 20992]
S3 MozillaMaintenance;Mozilla Maintenance Service; C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe [2013-04-11 115608]
S3 WatAdminSvc;@%SystemRoot%\system32\Wat\WatUX.exe,-601; C:\Windows\system32\Wat\WatAdminSvc.exe [2011-12-26 1343400]

-----------------EOF-----------------

[vyosek]

Zdravim

Odinstalujte Spybot - Search & Destroy - program ma uz nejlepsi leta davno za sebou a posledni cca 3 roky neni schopen celit aktualnim hrozbam

Tez odinstalujte Spyeare Terminatora

Stahnete Junkware Removal Tool http://thisisudax.org/downloads/JRT.exe

• Ulozte nejlepe na plochu
• Po spusteni se zobrazi licencni podminky, stisknete libovolnou klavesu
• Probehne vytvoreni zalohy a nasledne prohledavani
• Probehne skenovani a pak se objevi log, pripadne bude ulozen v c:\JRT jako JRT.txt, ten sem vlozte

Stahnete AdwCleaner http://general-changelog-team.fr/fr/dow ... adwcleaner

• Ulozte nejlepe na plochu
• Ukoncete vsechny programy
• Kliknete na Prohledat
• Probehne skenovani a pak se objevi log, pripadne bude ulozen na systemovem disku jako AdwCleaner[R?].txt, ten sem vlozte

[milav]

Provedl jsem odinstalaci dle doporučení. PC vyžadovalt restart, takže tam šmejd určitě zase skočil.
Zasílám požadované logy.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 4.9.1 (04.27.2013:1)
OS: Windows 7 Home Premium x86
Ran by Milan on ne 28.04.2013 at 11:38:32,44
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values

Successfully deleted: [Registry Value] HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\searchprotect
Successfully deleted: [Registry Value] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\searchprotectall
Successfully repaired: [Registry Value] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\\Start Page
Successfully repaired: [Registry Value] HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Main\\Start Page
Successfully repaired: [Registry Value] HKEY_USERS\S-1-5-18\Software\Microsoft\Internet Explorer\Main\\Start Page
Successfully repaired: [Registry Value] HKEY_USERS\S-1-5-19\Software\Microsoft\Internet Explorer\Main\\Start Page
Successfully repaired: [Registry Value] HKEY_USERS\S-1-5-20\Software\Microsoft\Internet Explorer\Main\\Start Page
Successfully repaired: [Registry Value] HKEY_USERS\S-1-5-21-3185578175-294760507-565108644-1000\Software\Microsoft\Internet Explorer\Main\\Start Page



~~~ Registry Keys

Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\conduit
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\conduit
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\AppDataLow\Software\smartbar
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\appid\nctaudiocdgrabber2.dll
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\tracing\conduitinstaller_rasapi32
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\tracing\conduitinstaller_rasmancs
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\classes\Toolbar.CT3282722
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}



~~~ Files

Successfully deleted: [File] "C:\end"



~~~ Folders

Successfully deleted: [Folder] "C:\Users\Milan\AppData\Roaming\pdfforge"
Successfully deleted: [Folder] "C:\Users\Milan\AppData\Roaming\searchprotect"
Successfully deleted: [Folder] "C:\Users\Milan\appdata\local\conduit"
Successfully deleted: [Folder] "C:\Users\Milan\appdata\locallow\conduit"
Successfully deleted: [Folder] "C:\Program Files\conduit"
Successfully deleted: [Folder] "C:\Program Files\myashampoo"
Failed to delete: [Folder] "C:\Program Files\searchprotect"



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on ne 28.04.2013 at 11:39:13,70
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~






# AdwCleaner v2.202 - Log vytvooen 28/04/2013 v 11:40:40
# Aktualizováno 23/04/2013 Xplode
# Operaení systém : Windows 7 Home Premium Service Pack 1 (32 bits)
# Uživatel : Milan - MILAN-PC
# Spuštin systém : Normální
# Spuštino z : C:\Users\Milan\Desktop\adwcleaner.exe
# Volba [Prohledat]


***** [Služby] *****

Nalezeno : CltMngSvc

***** [Soubory / Složky] *****

Složka Nalezeno : C:\Program Files\SearchProtect
Složka Nalezeno : C:\Users\Milan\AppData\LocalLow\pdfforge
Složka Nalezeno : C:\Users\Milan\AppData\Roaming\Mozilla\Firefox\Profiles\qrar7tc0.default\CT3282722
Složka Nalezeno : C:\Users\Milan\AppData\Roaming\Mozilla\Firefox\Profiles\qrar7tc0.default\extensions\{79b8e308-95a2-4044-932d-80e833a863cc}
Složka Nalezeno : C:\Users\Milan\AppData\Roaming\Mozilla\Firefox\Profiles\qrar7tc0.default\extensions\{a1e75a0e-4397-4ba8-bb50-e19fb66890f4}
Složka Nalezeno : C:\Users\Milan\AppData\Roaming\Mozilla\Firefox\Profiles\qrar7tc0.default\extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}
Složka Nalezeno : C:\Users\Milan\AppData\Roaming\Mozilla\Firefox\Profiles\qrar7tc0.default\extensions\engine@conduit.com
Složka Nalezeno : C:\Users\Milan\AppData\Roaming\Mozilla\Firefox\Profiles\qrar7tc0.default\Smartbar

***** [Registry] *****

Hodnota Nalezeno : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks [{A1E75A0E-4397-4BA8-BB50-E19FB66890F4}]
Hodnota Nalezeno : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{25A3A431-30BB-47C8-AD6A-E1063801134F}]
Hodnota Nalezeno : HKLM\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks [{A1E75A0E-4397-4BA8-BB50-E19FB66890F4}]
Klíe Nalezeno : HKCU\Software\AppDataLow\Software\MyAshampoo\toolbar
Klíe Nalezeno : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{25A3A431-30BB-47C8-AD6A-E1063801134F}
Klíe Nalezeno : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{25A3A431-30BB-47C8-AD6A-E1063801134F}
Klíe Nalezeno : HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\grusskartencenter.com
Klíe Nalezeno : HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\EscDomains\grusskartencenter.com
Klíe Nalezeno : HKCU\Software\SearchProtect
Klíe Nalezeno : HKLM\SOFTWARE\Classes\CLSID\{25A3A431-30BB-47C8-AD6A-E1063801134F}
Klíe Nalezeno : HKLM\SOFTWARE\Classes\CLSID\{3C471948-F874-49F5-B338-4F214A2EE0B1}
Klíe Nalezeno : HKLM\SOFTWARE\Classes\CLSID\{CADAF6BE-BF50-4669-8BFD-C27BD4E6181B}
Klíe Nalezeno : HKLM\SOFTWARE\Classes\Interface\{3F607E46-0D3C-4442-B1DE-DE7FA4768F5C}
Klíe Nalezeno : HKLM\SOFTWARE\Classes\Interface\{49C00A51-6E59-41FE-B3FA-2D2157FAD67B}
Klíe Nalezeno : HKLM\SOFTWARE\Classes\Interface\{6DFF5DBA-AE3A-46DB-B301-ECFFC6DB2982}
Klíe Nalezeno : HKLM\SOFTWARE\Classes\Interface\{DE34CD67-F1C8-4001-9A23-B8A68F63F377}
Klíe Nalezeno : HKLM\SOFTWARE\Classes\Interface\{FE0273D1-99DF-4AC0-87D5-1371C6271785}
Klíe Nalezeno : HKLM\SOFTWARE\Classes\TypeLib\{93E3D79C-0786-48FF-9329-93BC9F6DC2B3}
Klíe Nalezeno : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SearchProtect
Klíe Nalezeno : HKLM\Software\SearchProtect

***** [Internetové prohlížeee] *****

-\\ Internet Explorer v8.0.7601.17514

[OK] Registry jsou eisté.

-\\ Mozilla Firefox v20.0.1 (cs)

Soubor : C:\Users\Milan\AppData\Roaming\Mozilla\Firefox\Profiles\qrar7tc0.default\prefs.js

Nalezeno : user_pref("CT3282722.1000082.isPlayDisplay", "true");
Nalezeno : user_pref("CT3282722.1000082.state", "{\"state\":\"stopped\",\"text\":\"Classic R...\",\"description[...]
Nalezeno : user_pref("CT3282722.3282722a130039643157408893000000paramsGK0.enc", "eyJ1cGRhdGVSZXFUaW1lIjoxMzYyOD[...]
Nalezeno : user_pref("CT3282722.CT3282722ads1.enc", "JTdCJTIyYWRzJTIyJTNBJTVCJTdCJTIyYWlkJTIyJTNBJTIyOTEwMTAlMj[...]
Nalezeno : user_pref("CT3282722.CT3282722current_term.enc", "amFrK3psaWt2aWRvdmF0K3Rvb2xiYXI=");
Nalezeno : user_pref("CT3282722.CT3282722sdate.enc", "OQ==");
Nalezeno : user_pref("CT3282722.ENABALE_HISTORY", "{\"dataType\":\"string\",\"data\":\"true\"}");
Nalezeno : user_pref("CT3282722.ENABLE_RETURN_WEB_SEARCH_ON_THE_PAGE", "{\"dataType\":\"string\",\"data\":\"tru[...]
Nalezeno : user_pref("CT3282722.FF19Solved", "true");
Nalezeno : user_pref("CT3282722.FirstTime", "true");
Nalezeno : user_pref("CT3282722.FirstTimeFF3", "true");
Nalezeno : user_pref("CT3282722.PG_ENABLE", "dHJ1ZQ==");
Nalezeno : user_pref("CT3282722.PrintItGreenStatus.enc", "dHJ1ZQ==");
Nalezeno : user_pref("CT3282722.RSS_Pub_Config.enc", "eyJzZXR0aW5ncyI6eyJpY29uIjoiaHR0cDovL3N0b3JhZ2UuY29uZHVpd[...]
Nalezeno : user_pref("CT3282722.RSSapp3282722a130039643157408893000000embeddedVersion.enc", "Mi40LjA=");
Nalezeno : user_pref("CT3282722.RSSapp3282722a130039643157408893000000lastReportTime.enc", "MTM2Mjg2NzkzNTc4NSA[...]
Nalezeno : user_pref("CT3282722.RSSapp3282722a130039643157408893000000newFeeds.enc", "bmV3RmVlZHM=");
Nalezeno : user_pref("CT3282722.UserID", "UN30334938432036921");
Nalezeno : user_pref("CT3282722.addressBarTakeOverEnabledInHidden", "true");
Nalezeno : user_pref("CT3282722.addressUrlXPETakeover", "true");
Nalezeno : user_pref("CT3282722.autoDisableScopes", -1);
Nalezeno : user_pref("CT3282722.enableFix404ByUser", "FALSE");
Nalezeno : user_pref("CT3282722.firstTimeDialogOpened", "true");
Nalezeno : user_pref("CT3282722.fixPageNotFoundErrorByUser", "TRUE");
Nalezeno : user_pref("CT3282722.fixPageNotFoundErrorInHidden", "true");
Nalezeno : user_pref("CT3282722.fixUrls", true);
Nalezeno : user_pref("CT3282722.hxxp___cdn_printitgreen_com.APP_WIN_FEATURES.enc", "cmVzaXphYmxlPW5vLGhzY3JvbGw[...]
Nalezeno : user_pref("CT3282722.installDate", "9/3/2013 23:19:36");
Nalezeno : user_pref("CT3282722.installType", "Unknown");
Nalezeno : user_pref("CT3282722.installerVersion", "1.3.6.5");
Nalezeno : user_pref("CT3282722.isCheckedStartAsHidden", true);
Nalezeno : user_pref("CT3282722.isEnableAllDialogs", "{\"dataType\":\"string\",\"data\":\"true\"}");
Nalezeno : user_pref("CT3282722.isFirstTimeToolbarLoading", "false");
Nalezeno : user_pref("CT3282722.isToolbarShrinked", "{\"dataType\":\"string\",\"data\":\"false\"}");
Nalezeno : user_pref("CT3282722.isWelcomPage", "{\"dataType\":\"boolean\",\"data\":\"true\"}");
Nalezeno : user_pref("CT3282722.keyword", "true");
Nalezeno : user_pref("CT3282722.lastNewTabSettings", "{\"isEnabled\":false,\"newTabUrl\":\"hxxp://search.condui[...]
Nalezeno : user_pref("CT3282722.lastVersion", "10.15.2.523");
Nalezeno : user_pref("CT3282722.mam_gk_installer_preapproved.enc", "VFJVRQ==");
Nalezeno : user_pref("CT3282722.migrateAppsAndComponents", true);
Nalezeno : user_pref("CT3282722.navigationAliasesJson", "{\"EB_SEARCH_TERM\":\"\",\"EB_MAIN_FRAME_URL\":\"hxxp%[...]
Nalezeno : user_pref("CT3282722.revertSettingsEnabled", "false");
Nalezeno : user_pref("CT3282722.search.searchAppId", "130039643153976796");
Nalezeno : user_pref("CT3282722.search.searchCount", "0");
Nalezeno : user_pref("CT3282722.searchInNewTabEnabledByUser", "false");
Nalezeno : user_pref("CT3282722.searchInNewTabEnabledInHidden", "true");
Nalezeno : user_pref("CT3282722.searchUserMode", "2");
Nalezeno : user_pref("CT3282722.selectToSearchBoxEnabled", "{\"dataType\":\"string\",\"data\":\"true\"}");
Nalezeno : user_pref("CT3282722.serviceLayer_service_login_isFirstLoginInvoked", "{\"dataType\":\"boolean\",\"d[...]
Nalezeno : user_pref("CT3282722.serviceLayer_service_login_loginCount", "{\"dataType\":\"number\",\"data\":\"4\[...]
Nalezeno : user_pref("CT3282722.serviceLayer_service_toolbarGrouping_activeCTID", "{\"dataType\":\"string\",\"d[...]
Nalezeno : user_pref("CT3282722.serviceLayer_service_toolbarGrouping_activeDownloadUrl", "{\"dataType\":\"strin[...]
Nalezeno : user_pref("CT3282722.serviceLayer_service_toolbarGrouping_activeToolbarName", "{\"dataType\":\"strin[...]
Nalezeno : user_pref("CT3282722.serviceLayer_service_toolbarGrouping_invoked", "{\"dataType\":\"string\",\"data[...]
Nalezeno : user_pref("CT3282722.serviceLayer_services_app.twitter.user-cnet_lastUpdate", "1362868025203");
Nalezeno : user_pref("CT3282722.serviceLayer_services_app.twitter.user-cnnbrk_lastUpdate", "1362868025294");
Nalezeno : user_pref("CT3282722.serviceLayer_services_app.twitter.user-computeractive_lastUpdate", "13628680253[...]
Nalezeno : user_pref("CT3282722.serviceLayer_services_app.twitter.user-dailymirror_lastUpdate", "1362868025369"[...]
Nalezeno : user_pref("CT3282722.serviceLayer_services_app.twitter.user-google_lastUpdate", "1362868025266");
Nalezeno : user_pref("CT3282722.serviceLayer_services_app.twitter.user-techcrunch_lastUpdate", "1362868025221")[...]
Nalezeno : user_pref("CT3282722.serviceLayer_services_app.twitter.user-time_lastUpdate", "1362868025460");
Nalezeno : user_pref("CT3282722.serviceLayer_services_app.twitter.user-wired_lastUpdate", "1362868025478");
Nalezeno : user_pref("CT3282722.serviceLayer_services_appTrackingFirstTime_lastUpdate", "1362868023509");
Nalezeno : user_pref("CT3282722.serviceLayer_services_appsMetadata_lastUpdate", "1362868023326");
Nalezeno : user_pref("CT3282722.serviceLayer_services_gottenAppsContextMenu_lastUpdate", "1362868023370");
Nalezeno : user_pref("CT3282722.serviceLayer_services_location_lastUpdate", "1367094060323");
Nalezeno : user_pref("CT3282722.serviceLayer_services_login_10.14.370.524_lastUpdate", "1363890529043");
Nalezeno : user_pref("CT3282722.serviceLayer_services_login_10.15.0.562_lastUpdate", "1365876101030");
Nalezeno : user_pref("CT3282722.serviceLayer_services_login_10.15.2.523_lastUpdate", "1367133162721");
Nalezeno : user_pref("CT3282722.serviceLayer_services_otherAppsContextMenu_lastUpdate", "1362868023406");
Nalezeno : user_pref("CT3282722.serviceLayer_services_searchAPI_lastUpdate", "1362868022744");
Nalezeno : user_pref("CT3282722.serviceLayer_services_serviceMap_lastUpdate", "1367094060152");
Nalezeno : user_pref("CT3282722.serviceLayer_services_setupAPI_lastUpdate", "1362868022818");
Nalezeno : user_pref("CT3282722.serviceLayer_services_toolbarContextMenu_lastUpdate", "1362868023336");
Nalezeno : user_pref("CT3282722.serviceLayer_services_toolbarSettings_lastUpdate", "1367141663234");
Nalezeno : user_pref("CT3282722.serviceLayer_services_translation_lastUpdate", "1367094060208");
Nalezeno : user_pref("CT3282722.settingsINI", true);
Nalezeno : user_pref("CT3282722.showToolbarPermission", "false");
Nalezeno : user_pref("CT3282722.smartbar.CTID", "CT3282722");
Nalezeno : user_pref("CT3282722.smartbar.Uninstall", "0");
Nalezeno : user_pref("CT3282722.smartbar.isHidden", true);
Nalezeno : user_pref("CT3282722.smartbar.toolbarName", "FreeOnlineRadioPlayerRecorder V1 ");
Nalezeno : user_pref("CT3282722.toolbarBornServerTime", "10-3-2013");
Nalezeno : user_pref("CT3282722.toolbarCurrentServerTime", "28-4-2013");
Nalezeno : user_pref("CT3282722.toolbarLoginClientTime", "Sat Mar 09 2013 23:26:13 GMT+0100");
Nalezeno : user_pref("CT3282722.url_history0001.enc", "aHR0cDovL3d3dy5kd24uY3ovP2g9c2t5cGUmc29ydD1zdGFobnV0bzo6[...]
Nalezeno : user_pref("CT3282722_Firefox.csv", "[{\"from\":\"Abs Layer\",\"action\":\"loading toolbar\",\"time\"[...]
Nalezeno : user_pref("Smartbar.SearchFromAddressBarSavedUrl", "hxxp://search.yahoo.com/search?fr=greentree_ff1&[...]
Nalezeno : user_pref("keyword.URL", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT3282722&SearchSource=2&CU[...]
Nalezeno : user_pref("smartbar.conduitSearchAddressUrlList", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT[...]
Nalezeno : user_pref("smartbar.machineId", "QBELZMQLDIQZ7CLRII3GQYJ1DHOZ8SGN6Y//YK8OYHDW10JVXPYXB8NRJJBRA8QHRFE[...]
Nalezeno : user_pref("smartbar.originalSearchAddressUrl", "hxxp://search.yahoo.com/search?fr=greentree_ff1&ei=u[...]

-\\ Google Chrome v [Nemohu získat verzi]

Soubor : C:\Users\Milan\AppData\Local\Google\Chrome\User Data\Default\Preferences

[OK] Soubor je eistý.

*************************

AdwCleaner[R1].txt - [11931 octets] - [28/04/2013 11:40:40]

########## EOF - C:\AdwCleaner[R1].txt - [11992 octets] ##########

[vyosek]

Spustte znovu AdwCleaner

• Pokud pouzivate Win Vista ci W7, kliknete na AdwCleaner pravym a dejte Run As Administrator ci Spustit jako spravce
• Kliknete na Smazat
• PC provede opravu, restartuje se a da Vam log (C:\AdwCleaner [S1].txt) , jeho obsah vlozte sem

[milav]

Provedeno. Zde je požadovaný log:

# AdwCleaner v2.202 - Log vytvooen 28/04/2013 v 12:59:33
# Aktualizováno 23/04/2013 Xplode
# Operaení systém : Windows 7 Home Premium Service Pack 1 (32 bits)
# Uživatel : Milan - MILAN-PC
# Spuštin systém : Normální
# Spuštino z : C:\Users\Milan\Desktop\adwcleaner.exe
# Volba [Vymazat]


***** [Služby] *****

Zastaveno & vymazáno : CltMngSvc

***** [Soubory / Složky] *****

Složka Vymazáno : C:\Program Files\SearchProtect
Složka Vymazáno : C:\Users\Milan\AppData\LocalLow\pdfforge
Složka Vymazáno : C:\Users\Milan\AppData\Roaming\Mozilla\Firefox\Profiles\qrar7tc0.default\CT3282722
Složka Vymazáno : C:\Users\Milan\AppData\Roaming\Mozilla\Firefox\Profiles\qrar7tc0.default\extensions\{79b8e308-95a2-4044-932d-80e833a863cc}
Složka Vymazáno : C:\Users\Milan\AppData\Roaming\Mozilla\Firefox\Profiles\qrar7tc0.default\extensions\{a1e75a0e-4397-4ba8-bb50-e19fb66890f4}
Složka Vymazáno : C:\Users\Milan\AppData\Roaming\Mozilla\Firefox\Profiles\qrar7tc0.default\extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}
Složka Vymazáno : C:\Users\Milan\AppData\Roaming\Mozilla\Firefox\Profiles\qrar7tc0.default\extensions\engine@conduit.com
Složka Vymazáno : C:\Users\Milan\AppData\Roaming\Mozilla\Firefox\Profiles\qrar7tc0.default\Smartbar

***** [Registry] *****

Hodnota Vymazáno : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks [{A1E75A0E-4397-4BA8-BB50-E19FB66890F4}]
Hodnota Vymazáno : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{25A3A431-30BB-47C8-AD6A-E1063801134F}]
Hodnota Vymazáno : HKLM\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks [{A1E75A0E-4397-4BA8-BB50-E19FB66890F4}]
Klíe Vymazáno : HKCU\Software\AppDataLow\Software\MyAshampoo\toolbar
Klíe Vymazáno : HKCU\Software\Conduit
Klíe Vymazáno : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{25A3A431-30BB-47C8-AD6A-E1063801134F}
Klíe Vymazáno : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{25A3A431-30BB-47C8-AD6A-E1063801134F}
Klíe Vymazáno : HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\grusskartencenter.com
Klíe Vymazáno : HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\EscDomains\grusskartencenter.com
Klíe Vymazáno : HKCU\Software\SearchProtect
Klíe Vymazáno : HKLM\SOFTWARE\Classes\CLSID\{25A3A431-30BB-47C8-AD6A-E1063801134F}
Klíe Vymazáno : HKLM\SOFTWARE\Classes\CLSID\{3C471948-F874-49F5-B338-4F214A2EE0B1}
Klíe Vymazáno : HKLM\SOFTWARE\Classes\CLSID\{CADAF6BE-BF50-4669-8BFD-C27BD4E6181B}
Klíe Vymazáno : HKLM\SOFTWARE\Classes\Interface\{3F607E46-0D3C-4442-B1DE-DE7FA4768F5C}
Klíe Vymazáno : HKLM\SOFTWARE\Classes\Interface\{49C00A51-6E59-41FE-B3FA-2D2157FAD67B}
Klíe Vymazáno : HKLM\SOFTWARE\Classes\Interface\{6DFF5DBA-AE3A-46DB-B301-ECFFC6DB2982}
Klíe Vymazáno : HKLM\SOFTWARE\Classes\Interface\{DE34CD67-F1C8-4001-9A23-B8A68F63F377}
Klíe Vymazáno : HKLM\SOFTWARE\Classes\Interface\{FE0273D1-99DF-4AC0-87D5-1371C6271785}
Klíe Vymazáno : HKLM\SOFTWARE\Classes\TypeLib\{93E3D79C-0786-48FF-9329-93BC9F6DC2B3}
Klíe Vymazáno : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SearchProtect
Klíe Vymazáno : HKLM\Software\SearchProtect

***** [Internetové prohlížeee] *****

-\\ Internet Explorer v8.0.7601.17514

[OK] Registry jsou eisté.

-\\ Mozilla Firefox v20.0.1 (cs)

Soubor : C:\Users\Milan\AppData\Roaming\Mozilla\Firefox\Profiles\qrar7tc0.default\prefs.js

Vymazáno : user_pref("CT3282722.1000082.isPlayDisplay", "true");
Vymazáno : user_pref("CT3282722.1000082.state", "{\"state\":\"stopped\",\"text\":\"Classic R...\",\"description[...]
Vymazáno : user_pref("CT3282722.3282722a130039643157408893000000paramsGK0.enc", "eyJ1cGRhdGVSZXFUaW1lIjoxMzYyOD[...]
Vymazáno : user_pref("CT3282722.CT3282722ads1.enc", "JTdCJTIyYWRzJTIyJTNBJTVCJTdCJTIyYWlkJTIyJTNBJTIyOTEwMTAlMj[...]
Vymazáno : user_pref("CT3282722.CT3282722current_term.enc", "amFrK3psaWt2aWRvdmF0K3Rvb2xiYXI=");
Vymazáno : user_pref("CT3282722.CT3282722sdate.enc", "OQ==");
Vymazáno : user_pref("CT3282722.ENABALE_HISTORY", "{\"dataType\":\"string\",\"data\":\"true\"}");
Vymazáno : user_pref("CT3282722.ENABLE_RETURN_WEB_SEARCH_ON_THE_PAGE", "{\"dataType\":\"string\",\"data\":\"tru[...]
Vymazáno : user_pref("CT3282722.FF19Solved", "true");
Vymazáno : user_pref("CT3282722.FirstTime", "true");
Vymazáno : user_pref("CT3282722.FirstTimeFF3", "true");
Vymazáno : user_pref("CT3282722.PG_ENABLE", "dHJ1ZQ==");
Vymazáno : user_pref("CT3282722.PrintItGreenStatus.enc", "dHJ1ZQ==");
Vymazáno : user_pref("CT3282722.RSS_Pub_Config.enc", "eyJzZXR0aW5ncyI6eyJpY29uIjoiaHR0cDovL3N0b3JhZ2UuY29uZHVpd[...]
Vymazáno : user_pref("CT3282722.RSSapp3282722a130039643157408893000000embeddedVersion.enc", "Mi40LjA=");
Vymazáno : user_pref("CT3282722.RSSapp3282722a130039643157408893000000lastReportTime.enc", "MTM2Mjg2NzkzNTc4NSA[...]
Vymazáno : user_pref("CT3282722.RSSapp3282722a130039643157408893000000newFeeds.enc", "bmV3RmVlZHM=");
Vymazáno : user_pref("CT3282722.UserID", "UN30334938432036921");
Vymazáno : user_pref("CT3282722.addressBarTakeOverEnabledInHidden", "true");
Vymazáno : user_pref("CT3282722.addressUrlXPETakeover", "true");
Vymazáno : user_pref("CT3282722.autoDisableScopes", -1);
Vymazáno : user_pref("CT3282722.enableFix404ByUser", "FALSE");
Vymazáno : user_pref("CT3282722.firstTimeDialogOpened", "true");
Vymazáno : user_pref("CT3282722.fixPageNotFoundErrorByUser", "TRUE");
Vymazáno : user_pref("CT3282722.fixPageNotFoundErrorInHidden", "true");
Vymazáno : user_pref("CT3282722.fixUrls", true);
Vymazáno : user_pref("CT3282722.hxxp___cdn_printitgreen_com.APP_WIN_FEATURES.enc", "cmVzaXphYmxlPW5vLGhzY3JvbGw[...]
Vymazáno : user_pref("CT3282722.installDate", "9/3/2013 23:19:36");
Vymazáno : user_pref("CT3282722.installType", "Unknown");
Vymazáno : user_pref("CT3282722.installerVersion", "1.3.6.5");
Vymazáno : user_pref("CT3282722.isCheckedStartAsHidden", true);
Vymazáno : user_pref("CT3282722.isEnableAllDialogs", "{\"dataType\":\"string\",\"data\":\"true\"}");
Vymazáno : user_pref("CT3282722.isFirstTimeToolbarLoading", "false");
Vymazáno : user_pref("CT3282722.isToolbarShrinked", "{\"dataType\":\"string\",\"data\":\"false\"}");
Vymazáno : user_pref("CT3282722.isWelcomPage", "{\"dataType\":\"boolean\",\"data\":\"true\"}");
Vymazáno : user_pref("CT3282722.keyword", "true");
Vymazáno : user_pref("CT3282722.lastNewTabSettings", "{\"isEnabled\":false,\"newTabUrl\":\"hxxp://search.condui[...]
Vymazáno : user_pref("CT3282722.lastVersion", "10.15.2.523");
Vymazáno : user_pref("CT3282722.mam_gk_installer_preapproved.enc", "VFJVRQ==");
Vymazáno : user_pref("CT3282722.migrateAppsAndComponents", true);
Vymazáno : user_pref("CT3282722.navigationAliasesJson", "{\"EB_SEARCH_TERM\":\"\",\"EB_MAIN_FRAME_URL\":\"hxxp%[...]
Vymazáno : user_pref("CT3282722.revertSettingsEnabled", "false");
Vymazáno : user_pref("CT3282722.search.searchAppId", "130039643153976796");
Vymazáno : user_pref("CT3282722.search.searchCount", "0");
Vymazáno : user_pref("CT3282722.searchInNewTabEnabledByUser", "false");
Vymazáno : user_pref("CT3282722.searchInNewTabEnabledInHidden", "true");
Vymazáno : user_pref("CT3282722.searchUserMode", "2");
Vymazáno : user_pref("CT3282722.selectToSearchBoxEnabled", "{\"dataType\":\"string\",\"data\":\"true\"}");
Vymazáno : user_pref("CT3282722.serviceLayer_service_login_isFirstLoginInvoked", "{\"dataType\":\"boolean\",\"d[...]
Vymazáno : user_pref("CT3282722.serviceLayer_service_login_loginCount", "{\"dataType\":\"number\",\"data\":\"4\[...]
Vymazáno : user_pref("CT3282722.serviceLayer_service_toolbarGrouping_activeCTID", "{\"dataType\":\"string\",\"d[...]
Vymazáno : user_pref("CT3282722.serviceLayer_service_toolbarGrouping_activeDownloadUrl", "{\"dataType\":\"strin[...]
Vymazáno : user_pref("CT3282722.serviceLayer_service_toolbarGrouping_activeToolbarName", "{\"dataType\":\"strin[...]
Vymazáno : user_pref("CT3282722.serviceLayer_service_toolbarGrouping_invoked", "{\"dataType\":\"string\",\"data[...]
Vymazáno : user_pref("CT3282722.serviceLayer_services_app.twitter.user-cnet_lastUpdate", "1362868025203");
Vymazáno : user_pref("CT3282722.serviceLayer_services_app.twitter.user-cnnbrk_lastUpdate", "1362868025294");
Vymazáno : user_pref("CT3282722.serviceLayer_services_app.twitter.user-computeractive_lastUpdate", "13628680253[...]
Vymazáno : user_pref("CT3282722.serviceLayer_services_app.twitter.user-dailymirror_lastUpdate", "1362868025369"[...]
Vymazáno : user_pref("CT3282722.serviceLayer_services_app.twitter.user-google_lastUpdate", "1362868025266");
Vymazáno : user_pref("CT3282722.serviceLayer_services_app.twitter.user-techcrunch_lastUpdate", "1362868025221")[...]
Vymazáno : user_pref("CT3282722.serviceLayer_services_app.twitter.user-time_lastUpdate", "1362868025460");
Vymazáno : user_pref("CT3282722.serviceLayer_services_app.twitter.user-wired_lastUpdate", "1362868025478");
Vymazáno : user_pref("CT3282722.serviceLayer_services_appTrackingFirstTime_lastUpdate", "1362868023509");
Vymazáno : user_pref("CT3282722.serviceLayer_services_appsMetadata_lastUpdate", "1362868023326");
Vymazáno : user_pref("CT3282722.serviceLayer_services_gottenAppsContextMenu_lastUpdate", "1362868023370");
Vymazáno : user_pref("CT3282722.serviceLayer_services_location_lastUpdate", "1367094060323");
Vymazáno : user_pref("CT3282722.serviceLayer_services_login_10.14.370.524_lastUpdate", "1363890529043");
Vymazáno : user_pref("CT3282722.serviceLayer_services_login_10.15.0.562_lastUpdate", "1365876101030");
Vymazáno : user_pref("CT3282722.serviceLayer_services_login_10.15.2.523_lastUpdate", "1367133162721");
Vymazáno : user_pref("CT3282722.serviceLayer_services_otherAppsContextMenu_lastUpdate", "1362868023406");
Vymazáno : user_pref("CT3282722.serviceLayer_services_searchAPI_lastUpdate", "1362868022744");
Vymazáno : user_pref("CT3282722.serviceLayer_services_serviceMap_lastUpdate", "1367094060152");
Vymazáno : user_pref("CT3282722.serviceLayer_services_setupAPI_lastUpdate", "1362868022818");
Vymazáno : user_pref("CT3282722.serviceLayer_services_toolbarContextMenu_lastUpdate", "1362868023336");
Vymazáno : user_pref("CT3282722.serviceLayer_services_toolbarSettings_lastUpdate", "1367141663234");
Vymazáno : user_pref("CT3282722.serviceLayer_services_translation_lastUpdate", "1367094060208");
Vymazáno : user_pref("CT3282722.settingsINI", true);
Vymazáno : user_pref("CT3282722.showToolbarPermission", "false");
Vymazáno : user_pref("CT3282722.smartbar.CTID", "CT3282722");
Vymazáno : user_pref("CT3282722.smartbar.Uninstall", "0");
Vymazáno : user_pref("CT3282722.smartbar.isHidden", true);
Vymazáno : user_pref("CT3282722.smartbar.toolbarName", "FreeOnlineRadioPlayerRecorder V1 ");
Vymazáno : user_pref("CT3282722.toolbarBornServerTime", "10-3-2013");
Vymazáno : user_pref("CT3282722.toolbarCurrentServerTime", "28-4-2013");
Vymazáno : user_pref("CT3282722.toolbarLoginClientTime", "Sat Mar 09 2013 23:26:13 GMT+0100");
Vymazáno : user_pref("CT3282722.url_history0001.enc", "aHR0cDovL3d3dy5kd24uY3ovP2g9c2t5cGUmc29ydD1zdGFobnV0bzo6[...]
Vymazáno : user_pref("CT3282722_Firefox.csv", "[{\"from\":\"Abs Layer\",\"action\":\"loading toolbar\",\"time\"[...]
Vymazáno : user_pref("Smartbar.SearchFromAddressBarSavedUrl", "hxxp://search.yahoo.com/search?fr=greentree_ff1&[...]
Vymazáno : user_pref("keyword.URL", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT3282722&SearchSource=2&CU[...]
Vymazáno : user_pref("smartbar.conduitSearchAddressUrlList", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT[...]
Vymazáno : user_pref("smartbar.machineId", "QBELZMQLDIQZ7CLRII3GQYJ1DHOZ8SGN6Y//YK8OYHDW10JVXPYXB8NRJJBRA8QHRFE[...]
Vymazáno : user_pref("smartbar.originalSearchAddressUrl", "hxxp://search.yahoo.com/search?fr=greentree_ff1&ei=u[...]

-\\ Google Chrome v [Nemohu získat verzi]

Soubor : C:\Users\Milan\AppData\Local\Google\Chrome\User Data\Default\Preferences

[OK] Soubor je eistý.

*************************

AdwCleaner[R1].txt - [12062 octets] - [28/04/2013 11:40:40]
AdwCleaner[S1].txt - [12041 octets] - [28/04/2013 12:59:33]

########## EOF - C:\AdwCleaner[S1].txt - [12102 octets] ##########

[vyosek]

PROSIM CTETE DUKLADNE NAVOD - TATO UTILITA MA VELKOU SCHOPNOST MAZAT A JE NUTNE JI APLIKOVAT JEN NA DOPORUCENI, JINAK VAM MUZE JIT SYSTEM DO KYTEK
Stahnete a ulozte na plochu Combofix http://download.bleepingcomputer.com/sUBs/ComboFix.exe

• Vypnete vsechny rezidentni bezpecnostní programy - firewally, antiviry, antispywary apod.
• Pokud mate Win XP spustte pod uctem Spravce\Administratora
• Pokud mate Win Vista ci Win 7, kliknete na Combofix pravym a dejte Run As Administrator ci Spustit jako spravce
• Ihned po startu se zobrazi stranka s licencnim ujednanim, pokracujte kliknutim na Ano
• Pokud Vam CF nabidne instalaci Konzoly pro zotaveni, tak souhlaste
• Dale postupujte dle pokynu, behem scanu nechte PC naprosto v klidu - nespoustejte zadne aplikace a neklikejte do zobrazujiciho se okna
• Scan by mel trvat cca 10 min, ale pokud bude PC hodne zaneseno, muze se cas prodlouzit
• Po dokonceni skenu a pripadnem restartu CF zobrazi log, pripadne jej najdete zde C:\ComboFix.txt, jeho obsah sem vlozte
• Detailni postup vc. obrazku mate zde http://www.bleepingcomputer.com/combofi ... t-combofix

[milav]

ComboFix 13-04-28.01 - Milan 29.04.2013 0:05.2.2 - x86
Microsoft Windows 7 Home Premium 6.1.7601.1.1250.420.1029.18.1953.1115 [GMT 2:00]
Spuštěný z: c:\users\Milan\Desktop\ComboFix.exe
AV: Microsoft Security Essentials *Disabled/Updated* {3F839487-C7A2-C958-E30C-E2825BA31FB5}
SP: Microsoft Security Essentials *Disabled/Updated* {84E27563-E198-C6D6-D9BC-D9F020245508}
SP: Spybot - Search and Destroy *Disabled/Updated* {9BC38DF1-3CCA-732D-A930-C1CA5F20A4B0}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* Vytvořen nový Bod Obnovení
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
---- Předchozí spuštění -------
.
c:\windows\IsUn0405.exe
c:\windows\security\Database\tmp.edb
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2013-03-28 do 2013-04-28 )))))))))))))))))))))))))))))))
.
.
2013-04-28 22:08 . 2013-04-28 22:08 -------- d-----w- c:\users\Default\AppData\Local\temp
2013-04-28 21:38 . 2013-04-28 22:08 -------- d-----w- c:\users\Milan\AppData\Local\temp
2013-04-28 18:22 . 2013-04-10 03:08 6906960 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{58F4FD15-F6CB-4B78-A0A2-4B41DF350AF9}\mpengine.dll
2013-04-28 18:14 . 2013-04-28 22:03 -------- d-----w- c:\program files\Spybot - Search & Destroy 2
2013-04-28 09:38 . 2013-04-28 09:38 -------- d-----w- c:\windows\ERUNT
2013-04-28 09:38 . 2013-04-28 09:38 -------- d-----w- C:\JRT
2013-04-27 16:14 . 2013-04-10 03:08 6906960 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2013-04-26 19:15 . 2013-04-28 07:55 -------- d-----w- c:\program files\trend micro
2013-04-26 19:15 . 2013-04-26 19:16 -------- d-----w- C:\rsit
2013-04-24 05:25 . 2013-04-24 05:25 706640 ------w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{3F5FD95B-288F-4C5B-BB8B-1730B9BABBEB}\gapaengine.dll
2013-04-23 18:03 . 2013-04-12 13:45 1211752 ----a-w- c:\windows\system32\drivers\ntfs.sys
2013-04-10 05:06 . 2013-03-01 03:09 2347008 ----a-w- c:\windows\system32\win32k.sys
2013-04-10 05:06 . 2013-01-24 04:47 196328 ----a-w- c:\windows\system32\drivers\fvevol.sys
2013-04-10 05:06 . 2013-03-02 04:58 981504 ----a-w- c:\windows\system32\wininet.dll
2013-04-10 05:06 . 2013-03-02 04:58 760320 ----a-w- c:\program files\Common Files\Microsoft Shared\VGX\VGX.dll
2013-04-10 05:06 . 2013-03-02 04:53 525312 ----a-w- c:\program files\Internet Explorer\jsdbgui.dll
2013-04-10 05:05 . 2013-03-02 04:52 163328 ----a-w- c:\program files\Internet Explorer\ieproxy.dll
2013-04-10 05:05 . 2013-03-02 04:52 860672 ----a-w- c:\program files\Internet Explorer\iedvtool.dll
2013-04-10 05:05 . 2013-03-02 03:22 1638912 ----a-w- c:\windows\system32\mshtml.tlb
2013-04-10 05:05 . 2013-03-19 05:04 3968856 ----a-w- c:\windows\system32\ntkrnlpa.exe
2013-04-10 05:05 . 2013-03-19 05:04 3913560 ----a-w- c:\windows\system32\ntoskrnl.exe
2013-04-10 05:05 . 2013-03-19 04:48 38912 ----a-w- c:\windows\system32\csrsrv.dll
2013-04-10 05:05 . 2013-03-19 02:49 69632 ----a-w- c:\windows\system32\smss.exe
2013-04-08 20:11 . 2013-04-08 20:11 -------- d-----w- c:\users\Milan\AppData\Roaming\Corel
2013-04-03 18:06 . 2013-04-04 05:09 -------- d-----w- c:\program files\Mozilla Thunderbird
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-04-02 10:33 . 2011-12-24 18:00 237088 ------w- c:\windows\system32\MpSigStub.exe
2013-03-18 20:28 . 2013-03-18 20:28 693976 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2013-03-18 20:28 . 2011-12-24 21:55 73432 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2013-03-06 10:38 . 2013-03-09 22:19 770384 ----a-w- c:\windows\system32\msvcr100.dll
2013-03-06 10:38 . 2013-03-09 22:19 421200 ----a-w- c:\windows\system32\msvcp100.dll
2013-02-12 04:48 . 2013-03-14 06:08 474112 ----a-w- c:\windows\apppatch\AcSpecfc.dll
2013-02-12 04:48 . 2013-03-14 06:08 2176512 ----a-w- c:\windows\apppatch\AcGenral.dll
2013-02-12 03:32 . 2013-03-23 21:01 15872 ----a-w- c:\windows\system32\drivers\usb8023.sys
2013-04-11 19:08 . 2013-04-11 19:07 263064 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2012-11-13 23:32 129272 ----a-w- c:\users\Milan\AppData\Roaming\Dropbox\bin\DropboxExt.17.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2012-11-13 23:32 129272 ----a-w- c:\users\Milan\AppData\Roaming\Dropbox\bin\DropboxExt.17.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2012-11-13 23:32 129272 ----a-w- c:\users\Milan\AppData\Roaming\Dropbox\bin\DropboxExt.17.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2012-02-15 17146504]
"RESTART_STICKY_NOTES"="c:\windows\System32\StikyNot.exe" [2009-07-14 354304]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe" [2010-11-19 9874024]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2011-10-21 142616]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2011-10-21 177432]
"Persistence"="c:\windows\system32\igfxpers.exe" [2011-10-21 176408]
"CanonMyPrinter"="c:\program files\Canon\MyPrinter\BJMyPrt.exe" [2009-07-27 1983816]
"CanonSolutionMenu"="c:\program files\Canon\SolutionMenu\CNSLMAIN.exe" [2009-03-18 767312]
"OrderReminder"="c:\program files\Hewlett-Packard\OrderReminder\OrderReminder.exe" [2005-03-18 98304]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2007-03-11 49152]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-12-03 946352]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2013-01-27 947152]
.
c:\users\Milan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Dropbox.lnk - c:\users\Milan\AppData\Roaming\Dropbox\bin\Dropbox.exe [2013-3-12 29106336]
OpenOffice.org 3.3.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2010-12-13 1198592]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2011-12-26 113664]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0\0sdnclean.exe
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
[HKLM\~\startupfolder\C:^Users^Milan^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Dropbox.lnk]
path=c:\users\Milan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
backup=c:\windows\pss\Dropbox.lnk.Startup
backupExtension=.Startup
.
R2 SkypeUpdate;Skype Updater;c:\program files\Skype\Updater\Updater.exe [x]
R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys [x]
R3 NisSrv;Kontrola sítě Microsoft;c:\program files\Microsoft Security Client\NisSrv.exe [x]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [x]
R3 WatAdminSvc;Služba Technologie aktivace Windows;c:\windows\system32\Wat\WatAdminSvc.exe [x]
S2 PDF Architect Helper Service;PDF Architect Helper Service;c:\program files\PDF Architect\HelperService.exe [x]
S2 PDF Architect Service;PDF Architect Service;c:\program files\PDF Architect\ConversionService.exe [x]
S2 UNS;Intel(R) Management and Security Application User Notification Service;c:\program files\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [x]
S3 asmthub3;ASMedia USB3 Hub Service;c:\windows\system32\DRIVERS\asmthub3.sys [x]
S3 asmtxhci;ASMEDIA XHCI Service;c:\windows\system32\DRIVERS\asmtxhci.sys [x]
S3 MEI;Intel(R) Management Engine Interface;c:\windows\system32\DRIVERS\HECI.sys [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt86win7.sys [x]
.
.
--- Ostatní služby/ovladače v paměti ---
.
*NewlyCreated* - WS2IFSL
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceAndNoImpersonation REG_MULTI_SZ SSDPSRV upnphost SCardSvr TBS fdrespub AppIDSvc QWAVE wcncsvc Mcx2Svc SensrSvc
hpdevmgmt REG_MULTI_SZ hpqcxs08
GPSvcGroup REG_MULTI_SZ GPSvc
.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - LocalService
FontCache
.
.
Obsah adresáře 'Naplánované úlohy'
.
2013-04-28 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2013-04-20 21:52]
.
2013-04-28 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2013-04-20 21:52]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.google.com
TCP: DhcpNameServer = 10.0.0.138
FF - ProfilePath - c:\users\Milan\AppData\Roaming\Mozilla\Firefox\Profiles\qrar7tc0.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.seznam.cz/
.
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (LocalSystem)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,fa,9d,bb,40,77,64,52,4b,a3,5d,9d,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,fa,9d,bb,40,77,64,52,4b,a3,5d,9d,\
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
--------------------- Knihovny navázané na běžící procesy ---------------------
.
- - - - - - - > 'Explorer.exe'(2224)
c:\users\Milan\AppData\Roaming\Dropbox\bin\DropboxExt.17.dll
.
Celkový čas: 2013-04-29 00:09:43
ComboFix-quarantined-files.txt 2013-04-28 22:09
.
Před spuštěním: Volných bajtů: 49 756 098 560
Po spuštění: Volných bajtů: 49 693 437 952
.
- - End Of File - - 53192F9EFC2C817CDCAEE4FDFCBE7F60

[vyosek]

Tak jeste uklidime

Odinstalujte Combofix

• Prejmenujte ComboFix na Uninstall
• Spustte jej
• Tohle smaze Combofix a jeho slozky

T-Cleaner http://vyosek.ic.cz/pro_usery/T-Cleaner.exe

• Stahnete a spustte
• Pro potvrzeni volby mackejte A, Enter
• Po pouziti utilitu smazte
• Antiviry touhou utilitu chybne oznacit jako vir - jedna se o falesny poplach - takze v pohode stahnete (pripadne vypnete pri stahovani antivir)

OTC http://oldtimer.geekstogo.com/OTC.exe

• Stahnete a spustte
• Kliknete na CleanUp a potvrdte YES
• Program uklidi a restartuje PC

TFC http://oldtimer.geekstogo.com/TFC.exe

• Stahnete a spustte
• Kliknete na Start a potvrdte OK
• Program uklidi a restartuje pc
• Po pouziti utilitu smazte

Stahnete Ccleaner http://forum.viry.cz/viewtopic.php?t=7478
Panel čistič

• Vse nechte jak je, jen dejte Analyzovat a pote Spustit CCleaner

Panel registry

• dejte Hledej problémy
• nasledne Opravit problémy - zalohu registru doporucuji udelat, opravte vsechny problemy
• postup opakujte dokud nebude bez problemu - vetsinou cca 3x

Panel nástroje

• Zde muzete odinstalovat nepotrebne programy

CCleaner doporucuji pouzivat cca jednou za tyden

A pokud nejsou problemy ci dotazy, je to z me strany vse

[milav]

Vše jsem provedl podle instrukcí, ale program TFC se choval jinak než bylo napsáno. Po zmáčknutí tlačítka Start nechtěl potvrzení OK ale začal hned s úklidem. To asi není důležité. Po úklidu mi nabídnul obrazovku, na které byly vypsány uklizené soubory a aktivní bylo jen tlačítko EXIT. Po jeho zmáčknutí se PC nerestartovl, tak jsem to udělal za něj. Na ploše mi ještě zůstal program JRT. Mám ho smazat? Jinak moc děkuji za pomoc.

[vyosek]

Ano, JRT muzete smazat

A melo by to byt vse, nemate zac, rado se stalo

[milav]

Ještě jednou díky, mějte se hezky.

[vyosek]

Nemate zac, rad jsem pomohl Zase nekdy

A na zaklade Pravidla o zamykani temat