Positive add problém přetrvává

Máte problém s virem? Vložte sem log z FRST nebo RSIT.

Moderátor: Moderátoři

Pravidla fóra
Pokud chcete pomoc, vložte log z FRST [návod zde] nebo RSIT [návod zde]

Jednotlivé thready budou po vyřešení uzamčeny. Stejně tak ty, které budou nečinné déle než 14 dní. Vizte Pravidlo o zamykání témat. Děkujeme za pochopení.

!NOVINKA!
Nově lze využívat služby vzdálené pomoci, kdy se k vašemu počítači připojí odborník a bližší informace o problému si od vás získá telefonicky! Více na www.neslape.cz

Vážení uživaterlé!
Ve dnech 4. - 6-9.2026 budou někteříí naši členové na každoročním srazu fóra. Žádáme vás, abyste měli strpení, nemusí se na na řešení vašeho problému hned. Děkujeme za pochopení.
Zamčeno
Zpráva
Autor
papperwing
Návštěvník
Návštěvník
Příspěvky: 139
Registrován: 13 Bře 2013 20:34

Positive add problém přetrvává

#1 Příspěvek od papperwing »

Dobrý den,
před pár dny jsem řešil problém se šmejdem Positive add a reklamy na chvíli zmizely. Během těch dní jsem windows využíval méně a nenavštěvoval jsem žádné nebezpečné stránky a šmej se vrátil.

zde zasílám rsit:

Logfile of random's system information tool 1.10 (written by random/random)
Run by jakub_000 at 2015-02-09 12:36:56
Microsoft Windows 8 Pro
System drive C: has 44 GB (15%) free of 300 GB
Total RAM: 4030 MB (54% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 12:38:03, on 9. 2. 2015
Platform: Unknown Windows (WinNT 6.02.1008)
MSIE: Internet Explorer v10.0 (10.00.9200.17183)
Boot mode: Normal

Running processes:
C:\Program Files (x86)\EaseUS\EaseUS Partition Master 10.2\bin\EpmNews.exe
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
C:\Program Files (x86)\EaseUS\EaseUS Partition Master 10.2\bin\TrayPopupE\TrayTipAgentE.exe
C:\ProgramData\d2d4a9d3-f3f1-4c52-8d3f-dddc91fe0602\plugins\3\plugin.exe
C:\Users\jakub_000\AppData\Roaming\Dropbox\bin\Dropbox.exe
C:\Users\jakub_000\AppData\Local\Google\Update\GoogleUpdate.exe
C:\Program Files (x86)\Unity\MonoDevelop\bin\MonoDevelop.exe
C:\Program Files (x86)\Unity\Editor\Unity.exe
C:\Program Files (x86)\Mozilla Firefox\firefox.exe
C:\Program Files\trend micro\jakub_000.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/p/?LinkId=255141
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/p/?LinkId=255141
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,First Home Page = http://g.msn.com/1ewenusDefaultPack/UP97_FRPage
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F2 - REG:system.ini: UserInit=userinit.exe
O1 - Hosts: ::1 localhost
O2 - BHO: Positive Finds - {30c85a3d-1d96-4589-b63f-91fb7ef45a41} - C:\Program Files (x86)\Positive Finds\Extensions\30c85a3d-1d96-4589-b63f-91fb7ef45a41.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll
O2 - BHO: Evernote extension - {92EF2EAD-A7CE-4424-B0DB-499CF856608E} - C:\Program Files (x86)\Evernote\Evernote\EvernoteIE.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll
O4 - HKLM\..\Run: [EaseUS EPM tray] C:\Program Files (x86)\EaseUS\EaseUS Partition Master 10.2\bin\EpmNews.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [EaseUS EPM Tray Agent] "C:\Program Files (x86)\EaseUS\EaseUS Partition Master 10.2\bin\TrayPopupE\TrayTipAgentE.exe"
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe" -autorun
O4 - HKCU\..\Run: [EADM] "C:\Program Files (x86)\Origin\Origin.exe" -AutoStart
O4 - HKCU\..\Run: [Google Update] "C:\Users\jakub_000\AppData\Local\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [Steam] "C:\Program Files (x86)\Steam\steam.exe" -silent
O4 - Startup: Dropbox.lnk = jakub_000\AppData\Roaming\Dropbox\bin\Dropbox.exe
O4 - Startup: EvernoteClipper.lnk = C:\Program Files (x86)\Evernote\Evernote\EvernoteClipper.exe
O8 - Extra context menu item: Clip bookmark - C:\Program Files (x86)\Evernote\Evernote\EvernoteIERes\Clip.html?clipAction=0
O8 - Extra context menu item: Clip image - C:\Program Files (x86)\Evernote\Evernote\EvernoteIERes\Clip.html?clipAction=4
O8 - Extra context menu item: Clip selection - C:\Program Files (x86)\Evernote\Evernote\EvernoteIERes\Clip.html?clipAction=3
O8 - Extra context menu item: Clip this page - C:\Program Files (x86)\Evernote\Evernote\EvernoteIERes\Clip.html?clipAction=1
O8 - Extra context menu item: New note - C:\Program Files (x86)\Evernote\Evernote\EvernoteIERes\NewNote.html
O8 - Extra context menu item: Nová poznámka - C:\Program Files (x86)\Evernote\Evernote\\EvernoteIERes\NewNote.html
O8 - Extra context menu item: Oříznout tuto stránku - C:\Program Files (x86)\Evernote\Evernote\\EvernoteIERes\Clip.html?clipAction=1
O8 - Extra context menu item: Vystřihnout obrázek - C:\Program Files (x86)\Evernote\Evernote\\EvernoteIERes\Clip.html?clipAction=4
O8 - Extra context menu item: Vystřihnout URL - C:\Program Files (x86)\Evernote\Evernote\\EvernoteIERes\Clip.html?clipAction=0
O8 - Extra context menu item: Výběr oříznutí - C:\Program Files (x86)\Evernote\Evernote\\EvernoteIERes\Clip.html?clipAction=3
O9 - Extra button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: @C:\Program Files (x86)\Evernote\Evernote\OLIEResource.dll,-101 - {A95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\Program Files (x86)\Evernote\Evernote\\EvernoteIERes\AddNote.html
O9 - Extra 'Tools' menuitem: @C:\Program Files (x86)\Evernote\Evernote\OLIEResource.dll,-101 - {A95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\Program Files (x86)\Evernote\Evernote\\EvernoteIERes\AddNote.html
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O15 - Trusted Zone: *.clonewarsadventures.com
O15 - Trusted Zone: *.freerealms.com
O15 - Trusted Zone: *.soe.com
O15 - Trusted Zone: *.sony.com
O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs:
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\windows\System32\alg.exe (file missing)
O23 - Service: AtherosSvc - Unknown owner - C:\windows\system32\AdminService.exe (file missing)
O23 - Service: BattlEye Service (BEService) - Unknown owner - C:\Program Files (x86)\Common Files\BattlEye\BEService.exe
O23 - Service: Intel(R) Content Protection HECI Service (cphs) - Intel Corporation - C:\windows\SysWow64\IntelCpHeciSvc.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\windows\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\windows\system32\fxssvc.exe (file missing)
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\windows\system32\lsass.exe (file missing)
O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\windows\system32\lsass.exe (file missing)
O23 - Service: Origin Client Service - Electronic Arts - C:\Program Files (x86)\Origin\OriginClientService.exe
O23 - Service: Overwolf Updater Service (OverwolfUpdaterService) - Unknown owner - C:\Program Files (x86)\Overwolf\OverwolfUpdater.exe (file missing)
O23 - Service: PnkBstrA - Unknown owner - C:\windows\system32\PnkBstrA.exe
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\windows\system32\lsass.exe (file missing)
O23 - Service: Service Mgr PositiveFinds - Unknown owner - C:\ProgramData\d2d4a9d3-f3f1-4c52-8d3f-dddc91fe0602\plugincontainer.exe
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\windows\system32\sppsvc.exe (file missing)
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files (x86)\Common Files\Steam\SteamService.exe
O23 - Service: TeamViewer 9 (TeamViewer9) - TeamViewer GmbH - C:\Program Files (x86)\TeamViewer\Version9\TeamViewer_Service.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\windows\system32\UI0Detect.exe (file missing)
O23 - Service: Update Mgr PositiveFinds - Unknown owner - C:\Program Files (x86)\Common Files\d2d4a9d3-f3f1-4c52-8d3f-dddc91fe0602\updater.exe
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\windows\system32\vssvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\windows\system32\wbengine.exe (file missing)
O23 - Service: @%ProgramFiles%\Windows Defender\MpAsDesc.dll,-310 (WinDefend) - Unknown owner - C:\Program Files (x86)\Windows Defender\MsMpEng.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--
End of file - 9904 bytes

======Listing Processes======



\SystemRoot\System32\smss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
wininit.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
winlogon.exe
C:\windows\system32\services.exe
C:\windows\system32\lsass.exe
C:\windows\system32\svchost.exe -k DcomLaunch
C:\windows\system32\svchost.exe -k RPCSS
C:\windows\System32\svchost.exe -k LocalServiceNetworkRestricted
"dwm.exe"
C:\windows\system32\svchost.exe -k netsvcs
C:\windows\system32\svchost.exe -k LocalService
C:\windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\windows\system32\svchost.exe -k NetworkService
C:\windows\System32\spoolsv.exe
C:\windows\system32\svchost.exe -k LocalServiceNoNetwork
"C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe"
C:\windows\system32\AdminService.exe
dashost.exe {67aab0f5-323c-4f26-8fa1b2c073d54f20}
C:\windows\SysWOW64\PnkBstrA.exe
C:\windows\system32\svchost.exe -k imgsvc
"C:\Program Files (x86)\TeamViewer\Version9\TeamViewer_Service.exe"
"C:\Program Files\Windows Defender\MsMpEng.exe"
C:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\windows\System32\svchost.exe -k LocalServicePeerNet
taskhostex.exe
"C:\Program Files\Synaptics\SynTP\SynTPEnh.exe"
C:\windows\Explorer.EXE
taskhost.exe USER
"C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.0.1119.516_x64__8wekyb3d8bbwe\LiveComm.exe" -ServerName:Microsoft.WindowsLive.Platform.Server
C:\windows\system32\SearchIndexer.exe /Embedding
"C:\Program Files (x86)\EaseUS\EaseUS Partition Master 10.2\bin\EpmNews.exe"
"C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
C:\Windows\System32\RuntimeBroker.exe -Embedding
"C:\Program Files (x86)\EaseUS\EaseUS Partition Master 10.2\bin\TrayPopupE\TrayTipAgentE.exe"
"C:\PROGRAM FILES\SYNAPTICS\SYNTP\SYNTPHELPER.EXE"
"C:\Program Files (x86)\Common Files\d2d4a9d3-f3f1-4c52-8d3f-dddc91fe0602\updater.exe"
"C:\ProgramData\d2d4a9d3-f3f1-4c52-8d3f-dddc91fe0602\plugincontainer.exe"

"C:\Program Files\Windows Media Player\wmpnetwk.exe"
"C:\ProgramData\d2d4a9d3-f3f1-4c52-8d3f-dddc91fe0602\plugins\8\plugin.exe" u
"C:\ProgramData\d2d4a9d3-f3f1-4c52-8d3f-dddc91fe0602\plugins\5\plugin.exe" u
"C:\ProgramData\d2d4a9d3-f3f1-4c52-8d3f-dddc91fe0602\plugins\3\plugin.exe"
"C:\ProgramData\d2d4a9d3-f3f1-4c52-8d3f-dddc91fe0602\plugins\3\plugin.exe"
"C:\Users\jakub_000\AppData\Roaming\Dropbox\bin\Dropbox.exe" /home
taskeng.exe {6654750C-96CC-4010-8141-CE85DC1A9044}
C:\Users\jakub_000\AppData\Local\Google\Update\GoogleUpdate.exe /c
"C:\Program Files (x86)\Unity\MonoDevelop\bin\MonoDevelop.exe" --nologo "C:\Users\jakub_000\Documents\New Unity Project\New Unity Project.sln" "C:\Users\jakub_000\Documents\New Unity Project\Assets\Scripts\LevelScripts\LevelBuilder.cs;-1"
"C:\Windows\System32\WUDFHost.exe" -HostGUID:{193a1820-d9ac-4997-8c55-be817523f6aa} -IoEventPortName:HostProcess-4707637f-2662-4f27-8d49-d7580a7183c5 -SystemEventPortName:HostProcess-5adb53cb-c12e-4b90-99c7-8ca036b4712b -IoCancelEventPortName:HostProcess-93bd7c25-2efe-445c-a872-591844b2a4b0 -NonStateChangingEventPortName:HostProcess-d779b845-4e58-4f4d-b5b5-4857bb5cecfc -ServiceSID:S-1-5-80-2652678385-582572993-1835434367-1344795993-749280709 -LifetimeId:aec57c71-fed6-4071-8dcb-8ca79aa55a4b -DeviceGroupId:WudfDefaultDevicePool
"C:\Program Files (x86)\Unity\Editor\Unity.exe"
C:\windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
"C:\Program Files (x86)\Mozilla Firefox\firefox.exe"
C:\windows\system32\wbem\wmiprvse.exe
taskeng.exe {9A5938CB-E469-4CDB-B6BE-282DEC5EB97E}
C:\windows\System32\svchost.exe -k WerSvcGroup
"C:\Users\jakub_000\Desktop\RSITx64.exe"

=========Mozilla firefox=========

ProfilePath - C:\Users\jakub_000\AppData\Roaming\Mozilla\Firefox\Profiles\0zrrz33f.default-1423126443143

prefs.js - "browser.startup.homepage" - "about:home"

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 16.0.0.305 Plugin
"Path"=C:\windows\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_305.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@esn/esnlaunch,version=2.1.7]
"Description"=
"Path"=C:\Program Files (x86)\Battlelog Web Plugins\2.1.7\npesnlaunch.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@java.com/DTPlugin,version=10.21.2]
"Description"=Java™ Deployment Toolkit
"Path"=C:\Windows\SysWOW64\npDeployJava1.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@java.com/JavaPlugin,version=10.21.2]
"Description"=Oracle® Next Generation Java™ Plug-In
"Path"=C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0]
"Description"=Ag Player Plugin
"Path"=c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@videolan.org/vlc,version=2.0.6]
"Description"=VLC Multimedia Plugin
"Path"=C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@videolan.org/vlc,version=2.1.5]
"Description"=VLC Multimedia Plugin
"Path"=C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\Adobe Reader]
"Description"=Handles PDFs in-place in Firefox
"Path"=C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll


[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 16.0.0.305 Plugin
"Path"=C:\windows\system32\Macromed\Flash\NPSWF64_16_0_0_305.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@java.com/DTPlugin,version=11.31.2]
"Description"=Java™ Deployment Toolkit
"Path"=C:\Program Files\Java\jre1.8.0_31\bin\dtplugin\npDeployJava1.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@java.com/JavaPlugin,version=11.31.2]
"Description"=Oracle® Next Generation Java™ Plug-In
"Path"=C:\Program Files\Java\jre1.8.0_31\bin\plugin2\npjp2.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0]
"Description"=Ag Player Plugin
"Path"=c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll


======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
Java(tm) Plug-In SSV Helper - C:\Program Files\Java\jre1.8.0_31\bin\ssv.dll [2015-01-26 551848]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre1.8.0_31\bin\jp2ssv.dll [2015-01-26 212904]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{30c85a3d-1d96-4589-b63f-91fb7ef45a41}]
Positive Finds - C:\Program Files (x86)\Positive Finds\Extensions\30c85a3d-1d96-4589-b63f-91fb7ef45a41.dll [2015-02-04 145656]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
Java(tm) Plug-In SSV Helper - C:\Program Files (x86)\Java\jre7\bin\ssv.dll [2013-04-20 462752]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{92EF2EAD-A7CE-4424-B0DB-499CF856608E}]
Evernote extension - C:\Program Files (x86)\Evernote\Evernote\EvernoteIE.dll [2014-08-26 626528]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll [2013-04-20 171424]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"=C:\windows\system32\igfxtray.exe [2013-11-07 171992]
"HotKeysCmds"=C:\windows\system32\hkcmd.exe [2013-11-07 399832]
"Persistence"=C:\windows\system32\igfxpers.exe [2013-11-07 442328]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"DAEMON Tools Lite"=C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe [2013-03-14 3672640]
"EADM"=C:\Program Files (x86)\Origin\Origin.exe [2014-12-26 3618648]
"Google Update"=C:\Users\jakub_000\AppData\Local\Google\Update\GoogleUpdate.exe [2013-08-12 116648]
"Steam"=C:\Program Files (x86)\Steam\steam.exe [2015-01-23 1942720]

[HKEY_LOCAL_MACHINE\Software\wow6432node\Microsoft\Windows\CurrentVersion\Run]
"EaseUS EPM tray"=C:\Program Files (x86)\EaseUS\EaseUS Partition Master 10.2\bin\EpmNews.exe [2014-11-18 2089056]
"SunJavaUpdateSched"=C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [2014-12-17 508800]
"EaseUS EPM Tray Agent"=C:\Program Files (x86)\EaseUS\EaseUS Partition Master 10.2\bin\TrayPopupE\TrayTipAgentE.exe [2014-11-18 255072]

C:\Users\jakub_000\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
Dropbox.lnk - C:\Users\jakub_000\AppData\Roaming\Dropbox\bin\Dropbox.exe
EvernoteClipper.lnk - C:\Program Files (x86)\Evernote\Evernote\EvernoteClipper.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=" "

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
C:\windows\system32\igfxdev.dll [2013-11-07 442880]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"DisableTaskMgr"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"msacm.l3acm"=C:\Windows\System32\l3codeca.acm
"VIDC.YUY2"=msyuv.dll
"vidc.i420"=iyuv_32.dll
"msacm.msgsm610"=msgsm32.acm
"msacm.msg711"=msg711.acm
"VIDC.YVYU"=msyuv.dll
"VIDC.YVU9"=tsbyuv.dll
"wavemapper"=msacm32.drv
"midimapper"=midimap.dll
"VIDC.UYVY"=msyuv.dll
"VIDC.IYUV"=iyuv_32.dll
"vidc.mrle"=msrle32.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msadpcm"=msadp32.acm
"vidc.msvc"=msvidc32.dll
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv
"wave1"=wdmaud.drv
"midi1"=wdmaud.drv
"mixer1"=wdmaud.drv
"aux1"=wdmaud.drv
"MSVideo8"=VfWWDM32.dll

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*

======List of files/folders created in the last 1 month======

2015-02-05 11:41:42 ----SHD---- C:\$RECYCLE.BIN
2015-02-05 11:39:00 ----A---- C:\windows\zoek-delete.exe
2015-02-05 11:38:59 ----D---- C:\windows\Temp
2015-02-05 11:28:44 ----D---- C:\zoek_backup
2015-02-04 17:54:15 ----A---- C:\windows\SYSWOW64\EuEpmGdi.dll
2015-02-04 17:54:15 ----A---- C:\windows\SYSWOW64\BootMan.exe
2015-02-04 17:54:15 ----A---- C:\windows\system32\setupempdrvx64.exe
2015-02-04 17:54:15 ----A---- C:\windows\system32\EuGdiDrv.sys
2015-02-04 17:54:15 ----A---- C:\windows\system32\EuEpmGdi.dll
2015-02-04 17:54:15 ----A---- C:\windows\system32\BootMan.exe
2015-02-04 17:54:14 ----A---- C:\windows\SYSWOW64\setupempdrv03.exe
2015-02-04 17:54:14 ----A---- C:\windows\SYSWOW64\EuGdiDrv.sys
2015-02-04 17:54:14 ----A---- C:\windows\SYSWOW64\epmntdrv.sys
2015-02-04 17:54:14 ----A---- C:\windows\system32\epmntdrv.sys
2015-02-04 17:54:08 ----D---- C:\ProgramData\d2d4a9d3-f3f1-4c52-8d3f-dddc91fe0602
2015-02-04 17:54:05 ----D---- C:\Program Files (x86)\Positive Finds
2015-02-02 14:17:47 ----D---- C:\Users\jakub_000\AppData\Roaming\ShoeBox
2015-02-02 14:17:44 ----D---- C:\Program Files (x86)\ShoeBox
2015-01-27 08:11:58 ----D---- C:\Program Files (x86)\Mozilla Firefox
2015-01-26 10:52:54 ----A---- C:\windows\system32\WindowsAccessBridge-64.dll
2015-01-26 10:48:35 ----D---- C:\Program Files\Java
2015-01-25 17:40:35 ----D---- C:\Users\jakub_000\AppData\Roaming\Factorio
2015-01-21 19:25:42 ----D---- C:\Program Files (x86)\PlayDance
2015-01-21 18:35:35 ----D---- C:\Program Files (x86)\StepMania
2015-01-19 14:09:18 ----D---- C:\Program Files (x86)\OpenAL
2015-01-19 14:09:18 ----A---- C:\windows\SYSWOW64\wrap_oal.dll
2015-01-19 14:09:18 ----A---- C:\windows\SYSWOW64\OpenAL32.dll
2015-01-19 14:09:18 ----A---- C:\windows\system32\wrap_oal.dll
2015-01-19 14:09:18 ----A---- C:\windows\system32\OpenAL32.dll
2015-01-18 18:18:28 ----D---- C:\Users\jakub_000\AppData\Roaming\six-updater
2015-01-18 18:18:27 ----D---- C:\Users\jakub_000\AppData\Roaming\six-zsync
2015-01-18 17:54:21 ----D---- C:\Program Files (x86)\SIX Projects
2015-01-17 10:39:44 ----A---- C:\windows\SYSWOW64\aspnet_counters.dll
2015-01-17 10:38:23 ----A---- C:\windows\system32\aspnet_counters.dll
2015-01-14 11:54:18 ----A---- C:\windows\system32\vbscript.dll
2015-01-14 11:54:17 ----A---- C:\windows\SYSWOW64\vbscript.dll
2015-01-14 11:53:54 ----A---- C:\windows\system32\localspl.dll
2015-01-14 11:53:53 ----A---- C:\windows\system32\win32spl.dll
2015-01-14 11:53:53 ----A---- C:\windows\system32\services.exe
2015-01-14 11:53:51 ----A---- C:\windows\system32\drivers\vhdmp.sys
2015-01-14 11:53:01 ----A---- C:\windows\system32\wucltux.dll
2015-01-14 11:53:01 ----A---- C:\windows\system32\wuaueng.dll
2015-01-14 11:53:00 ----A---- C:\windows\SYSWOW64\wuapi.dll
2015-01-14 11:53:00 ----A---- C:\windows\system32\WUSettingsProvider.dll
2015-01-14 11:53:00 ----A---- C:\windows\system32\wuauclt.exe
2015-01-14 11:53:00 ----A---- C:\windows\system32\wuapi.dll
2015-01-14 11:52:59 ----A---- C:\windows\SYSWOW64\wuwebv.dll
2015-01-14 11:52:59 ----A---- C:\windows\SYSWOW64\wudriver.dll
2015-01-14 11:52:59 ----A---- C:\windows\system32\wuwebv.dll
2015-01-14 11:52:59 ----A---- C:\windows\system32\storewuauth.dll
2015-01-14 11:52:58 ----A---- C:\windows\SYSWOW64\wuapp.exe
2015-01-14 11:52:58 ----A---- C:\windows\system32\wudriver.dll
2015-01-14 11:52:58 ----A---- C:\windows\system32\wuapp.exe
2015-01-14 11:51:25 ----A---- C:\windows\system32\profsvc.dll
2015-01-14 11:51:07 ----A---- C:\windows\SYSWOW64\nlaapi.dll
2015-01-14 11:51:07 ----A---- C:\windows\system32\nlasvc.dll
2015-01-14 11:51:07 ----A---- C:\windows\system32\nlaapi.dll
2015-01-14 11:51:07 ----A---- C:\windows\system32\ncsi.dll
2015-01-14 11:51:06 ----A---- C:\windows\system32\wer.dll
2015-01-14 11:51:05 ----A---- C:\windows\SYSWOW64\wer.dll
2015-01-14 11:51:05 ----A---- C:\windows\SYSWOW64\Faultrep.dll
2015-01-14 11:51:05 ----A---- C:\windows\system32\WerFaultSecure.exe
2015-01-14 11:51:05 ----A---- C:\windows\system32\Faultrep.dll
2015-01-14 11:51:04 ----A---- C:\windows\SYSWOW64\WerFaultSecure.exe
2015-01-14 11:51:04 ----A---- C:\windows\system32\EncDump.dll
2015-01-14 11:51:04 ----A---- C:\windows\system32\audiosrv.dll
2015-01-14 11:51:03 ----A---- C:\windows\system32\TSWbPrxy.exe
2015-01-14 11:51:03 ----A---- C:\windows\system32\drivers\mrxdav.sys
2015-01-14 11:51:02 ----A---- C:\windows\system32\ntoskrnl.exe
2015-01-11 15:35:14 ----HD---- C:\ProgramData\CanonBJ
2015-01-11 15:34:33 ----A---- C:\windows\system32\CNMLMBA.DLL
2015-01-10 20:53:59 ----D---- C:\2-click run

======List of files/folders modified in the last 1 month======

2015-02-09 12:38:00 ----D---- C:\Program Files\trend micro
2015-02-09 12:36:45 ----D---- C:\windows\Prefetch
2015-02-09 12:08:14 ----D---- C:\windows\system32\config
2015-02-09 12:00:00 ----D---- C:\windows\system32\sru
2015-02-09 11:39:57 ----D---- C:\ProgramData\Unity
2015-02-09 10:24:27 ----RD---- C:\windows\System32
2015-02-09 10:24:27 ----D---- C:\windows\Inf
2015-02-09 10:24:27 ----A---- C:\windows\system32\PerfStringBackup.INI
2015-02-09 09:18:53 ----D---- C:\windows\CbsTemp
2015-02-09 09:16:35 ----D---- C:\Users\jakub_000\AppData\Roaming\Dropbox
2015-02-05 22:38:53 ----D---- C:\Users\jakub_000\AppData\Roaming\vlc
2015-02-05 21:37:28 ----D---- C:\Windows
2015-02-05 14:10:05 ----SHD---- C:\System Volume Information
2015-02-05 11:37:29 ----SHD---- C:\windows\Installer
2015-02-05 11:37:28 ----HD---- C:\ProgramData
2015-02-05 11:30:48 ----RD---- C:\Program Files (x86)
2015-02-05 11:30:48 ----RD---- C:\Program Files
2015-02-05 11:30:08 ----D---- C:\windows\system32\drivers\etc
2015-02-05 11:28:45 ----D---- C:\windows\SysWOW64
2015-02-05 11:04:41 ----D---- C:\windows\Tasks
2015-02-05 11:03:32 ----D---- C:\AdwCleaner
2015-02-05 10:29:06 ----D---- C:\windows\Microsoft.NET
2015-02-05 09:11:13 ----D---- C:\windows\system32\Tasks
2015-02-05 09:08:22 ----D---- C:\windows\debug
2015-02-04 17:54:09 ----D---- C:\Program Files (x86)\Common Files
2015-02-04 17:53:54 ----D---- C:\Program Files (x86)\EaseUS
2015-02-02 21:16:10 ----D---- C:\Users\jakub_000\AppData\Roaming\Skype
2015-02-02 21:12:27 ----D---- C:\Program Files (x86)\Steam
2015-02-02 19:29:59 ----D---- C:\windows\system32\catroot2
2015-02-02 14:17:31 ----D---- C:\Users\jakub_000\AppData\Roaming\Adobe
2015-02-02 14:17:31 ----D---- C:\ProgramData\Adobe
2015-02-02 14:17:12 ----D---- C:\Program Files (x86)\Adobe
2015-02-01 19:16:16 ----D---- C:\Users\jakub_000\AppData\Roaming\uTorrent
2015-01-30 00:39:24 ----D---- C:\Users\jakub_000\AppData\Roaming\Mozilla
2015-01-29 09:14:34 ----D---- C:\windows\WinSxS
2015-01-27 17:05:04 ----D---- C:\Program Files (x86)\Mozilla Maintenance Service
2015-01-26 11:36:47 ----D---- C:\Program Files (x86)\Origin
2015-01-25 17:38:57 ----D---- C:\Program Files\Factorio
2015-01-24 21:20:14 ----A---- C:\windows\SYSWOW64\FlashPlayerApp.exe
2015-01-19 14:08:25 ----RSD---- C:\windows\assembly
2015-01-17 10:41:39 ----SD---- C:\ProgramData\Microsoft
2015-01-17 10:36:45 ----D---- C:\windows\SoftwareDistribution
2015-01-16 17:55:32 ----D---- C:\windows\system32\MRT
2015-01-16 17:48:41 ----A---- C:\windows\system32\MRT.exe
2015-01-15 09:12:17 ----D---- C:\windows\rescache
2015-01-15 08:38:16 ----D---- C:\windows\system32\en-US
2015-01-15 08:37:59 ----D---- C:\windows\system32\Drivers
2015-01-15 08:37:57 ----D---- C:\windows\system32\DriverStore
2015-01-12 16:08:12 ----D---- C:\windows\AUInstallAgent
2015-01-12 13:42:02 ----D---- C:\ProgramData\Origin
2015-01-11 15:36:54 ----HD---- C:\Program Files\WindowsApps
2015-01-11 15:36:33 ----D---- C:\windows\system32\FxsTmp

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 dtsoftbus01;@oem8.inf,%DTSoftBus.SVCDESC%;DAEMON Tools Virtual Bus Driver; C:\windows\System32\drivers\dtsoftbus01.sys [2013-05-01 283200]
R1 vwififlt;@%SystemRoot%\System32\drivers\vwififlt.sys,-259; C:\windows\system32\DRIVERS\vwififlt.sys [2012-07-26 64000]
R3 athr;@netathrx.inf,%ATHR.Service.DispName%;Qualcomm Atheros Extensible Wireless LAN device driver; C:\windows\system32\DRIVERS\athrx.sys [2012-06-02 2935808]
R3 BtFilter;BtFilter; C:\windows\system32\DRIVERS\btfilter.sys [2012-02-10 294000]
R3 BthEnum;@tdibth.inf,%BthEnum.DisplayName%;Bluetooth Enumerator Service; C:\windows\System32\drivers\BthEnum.sys [2013-01-09 51712]
R3 BthPan;@bthpan.inf,%BthPan.DisplayName%;Bluetooth Device (Personal Area Network); C:\windows\system32\DRIVERS\bthpan.sys [2012-07-26 119808]
R3 BTHUSB;@bth.inf,%BTHUSB.SvcDesc%;Bluetooth Radio USB Driver; C:\windows\System32\Drivers\BTHUSB.sys [2013-01-09 74752]
R3 igfx;igfx; C:\windows\system32\DRIVERS\igdkmd64.sys [2013-11-07 5363200]
R3 RFCOMM;@tdibth.inf,%RFCOMM.DisplayName%;Bluetooth Device (RFCOMM Protocol TDI); C:\windows\System32\drivers\rfcomm.sys [2013-03-01 156672]
R3 RTL8168;@netrt630x64.inf,%rtl8168.Service.DispName%;Realtek 8168 NT Driver; C:\windows\system32\DRIVERS\Rt630x64.sys [2012-06-02 589824]
R3 SNP2UVC;@oem4.inf,%SERVICE_DISPLAY_NAME%;USB2.0 PC Camera (SNP2UVC); C:\windows\system32\DRIVERS\snp2uvc.sys [2012-11-28 1866080]
R3 SynTP;@oem11.inf,%SynTP.SvcDesc%;Synaptics TouchPad Driver; C:\windows\system32\DRIVERS\SynTP.sys [2013-10-30 549104]
R3 vwifimp;@%SystemRoot%\System32\drivers\vwifimp.sys,-261; C:\windows\system32\DRIVERS\vwifimp.sys [2012-07-26 17920]
R3 WinUsb;@wpdmtp.inf,%WinUsb.SvcDesc%;WinUsb; C:\windows\system32\DRIVERS\WinUsb.sys [2012-07-26 57344]
R3 WUDFSensorLP;@locationprovider.inf,%WudfLocationProviderDisplayName%;UMDF Reflector service for LocationProvider; C:\windows\system32\DRIVERS\WUDFRd.sys [2012-07-26 198656]
S3 amdkmdag;amdkmdag; C:\windows\system32\DRIVERS\atikmdag.sys [2012-07-25 11926528]
S3 amdkmdap;amdkmdap; C:\windows\system32\DRIVERS\atikmpag.sys [2012-06-29 360448]
S3 BTHPORT;@bth.inf,%BTHPORT.SvcDesc%;Bluetooth Port Driver; C:\windows\System32\Drivers\BTHport.sys [2013-03-01 1175040]
S3 dg_ssudbus;@oem15.inf,%ssud.Service.DeviceDesc%;SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.); C:\windows\system32\DRIVERS\ssudbus.sys [2014-01-22 108800]
S3 epmntdrv;epmntdrv; \??\C:\windows\syswow64\epmntdrv.sys [2014-11-18 14944]
S3 EuGdiDrv;EuGdiDrv; \??\C:\windows\syswow64\EuGdiDrv.sys [2014-11-18 10208]
S3 hamachi;LogMeIn Hamachi Virtual Miniport); C:\windows\system32\DRIVERS\Hamdrv.sys [2013-07-03 46136]
S3 MEIx64;@oem5.inf,%HECI_SvcDesc%;Intel(R) Management Engine Interface ; C:\windows\System32\drivers\HECIx64.sys [2010-10-19 56344]
S3 ssudmdm;@oem16.inf,%ssud.Service.Name%;SAMSUNG Mobile USB Modem Drivers (DEVGURU Ver.); C:\windows\system32\DRIVERS\ssudmdm.sys [2014-01-22 206080]
S3 usbvideo;@usbvideo.inf,%USBVideo.SvcDesc%;USB Video Device (WDM); C:\windows\System32\Drivers\usbvideo.sys [2013-07-05 210560]
S3 WSDPrintDevice;@WSDPrint.Inf,%WSDPrintDevice.SVCDESC%;WSD Print Support; C:\windows\System32\drivers\WSDPrint.sys [2012-07-26 21504]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AdobeARMservice;Adobe Acrobat Update Service; C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2014-12-19 81088]
R2 AtherosSvc;AtherosSvc; C:\windows\system32\AdminService.exe [2012-02-02 189440]
R2 PnkBstrA;PnkBstrA; C:\windows\syswow64\PnkBstrA.exe [2013-07-26 76888]
R2 Service Mgr PositiveFinds;Service Mgr PositiveFinds; C:\ProgramData\d2d4a9d3-f3f1-4c52-8d3f-dddc91fe0602\plugincontainer.exe [2015-02-08 577272]
R2 TeamViewer9;TeamViewer 9; C:\Program Files (x86)\TeamViewer\Version9\TeamViewer_Service.exe [2014-04-25 5024576]
R2 Update Mgr PositiveFinds;Update Mgr PositiveFinds; C:\Program Files (x86)\Common Files\d2d4a9d3-f3f1-4c52-8d3f-dddc91fe0602\updater.exe [2015-02-08 384760]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service; C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-02-04 267440]
S3 BEService;BattlEye Service; C:\Program Files (x86)\Common Files\BattlEye\BEService.exe [2015-02-01 448384]
S3 cphs;Intel(R) Content Protection HECI Service; C:\windows\SysWow64\IntelCpHeciSvc.exe [2013-11-07 279000]
S3 FontCache3.0.0.0;@%SystemRoot%\system32\PresentationHost.exe,-3309; C:\windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe [2012-07-06 43616]
S3 MozillaMaintenance;Mozilla Maintenance Service; C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2015-01-27 114800]
S3 Origin Client Service;Origin Client Service; C:\Program Files (x86)\Origin\OriginClientService.exe [2014-12-26 1903472]
S3 OverwolfUpdaterService;Overwolf Updater Service; C:\Program Files (x86)\Overwolf\OverwolfUpdater.exe []
S3 Steam Client Service;Steam Client Service; C:\Program Files (x86)\Common Files\Steam\SteamService.exe [2015-01-19 834752]

-----------------EOF-----------------
Nahoru
altrok
Moderátor
Moderátor
Příspěvky: 7328
Registrován: 15 Lis 2012 22:26
Místo/Bydliště: Znojmo

Re: Positive add problém přetrvává

#2 Příspěvek od altrok »

Zdravim :bye:

:arrow: Dejte mi jeste logy FRST.txt a prilozte i Addition.txt - http://forum.viry.cz/viewtopic.php?f=30&t=133101
Pokud je cokoliv nejasného, ihned se ptej.
V případě spokojenosti prosím podpořte forum.
Pro dotazy, které se nehodí na forum, je možné využít altrokzavináčforum.viry.cz
Máš-li chuť pomáhat návštěvníkům tohoto fora, přihlas se do naší školičky.
Nahoru
papperwing
Návštěvník
Návštěvník
Příspěvky: 139
Registrován: 13 Bře 2013 20:34

Re: Positive add problém přetrvává

#3 Příspěvek od papperwing »

Zde zasílám scan z FRST:
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 08-02-2015
Ran by jakub_000 (administrator) on PAPPERPOST on 10-02-2015 19:56:58
Running from C:\Users\jakub_000\Desktop
Loaded Profiles: jakub_000 (Available profiles: jakub_000)
Platform: Windows 8 Pro (X64) OS Language: English (United States)
Internet Explorer Version 10 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/33 ... scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Atheros Commnucations) C:\Windows\System32\AdminService.exe
(Microsoft Corporation) C:\Windows\System32\dasHost.exe
() C:\Windows\SysWOW64\PnkBstrA.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer_Service.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MsMpEng.exe
() C:\Program Files (x86)\Common Files\d2d4a9d3-f3f1-4c52-8d3f-dddc91fe0602\updater.exe
() C:\ProgramData\d2d4a9d3-f3f1-4c52-8d3f-dddc91fe0602\plugincontainer.exe
() C:\ProgramData\d2d4a9d3-f3f1-4c52-8d3f-dddc91fe0602\plugins\8\Plugin.exe
() C:\ProgramData\d2d4a9d3-f3f1-4c52-8d3f-dddc91fe0602\plugins\3\Plugin.exe
() C:\ProgramData\d2d4a9d3-f3f1-4c52-8d3f-dddc91fe0602\plugins\5\Plugin.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
() C:\ProgramData\d2d4a9d3-f3f1-4c52-8d3f-dddc91fe0602\plugins\3\Plugin.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.0.1119.516_x64__8wekyb3d8bbwe\LiveComm.exe
(CHENGDU YIWO Tech Development Co., Ltd) C:\Program Files (x86)\EaseUS\EaseUS Partition Master 10.2\bin\EpmNews.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
() C:\Program Files (x86)\EaseUS\EaseUS Partition Master 10.2\bin\TrayPopupE\TrayTipAgentE.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM-x32\...\Run: [EaseUS EPM tray] => C:\Program Files (x86)\EaseUS\EaseUS Partition Master 10.2\bin\EpmNews.exe [2089056 2014-11-18] (CHENGDU YIWO Tech Development Co., Ltd)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [508800 2014-12-17] (Oracle Corporation)
HKLM-x32\...\Run: [EaseUS EPM Tray Agent] => C:\Program Files (x86)\EaseUS\EaseUS Partition Master 10.2\bin\TrayPopupE\TrayTipAgentE.exe [255072 2014-11-18] ()
Winlogon\Notify\igfxcui: C:\windows\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-21-164938143-4175652460-2459810496-1001\...\Run: [DAEMON Tools Lite] => C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe [3672640 2013-03-14] (Disc Soft Ltd)
HKU\S-1-5-21-164938143-4175652460-2459810496-1001\...\Run: [EADM] => C:\Program Files (x86)\Origin\Origin.exe [3618648 2014-12-26] (Electronic Arts)
HKU\S-1-5-21-164938143-4175652460-2459810496-1001\...\Run: [Google Update] => C:\Users\jakub_000\AppData\Local\Google\Update\GoogleUpdate.exe [116648 2013-08-12] (Google Inc.)
HKU\S-1-5-21-164938143-4175652460-2459810496-1001\...\Run: [Steam] => C:\Program Files (x86)\Steam\steam.exe [1942720 2015-01-23] (Valve Corporation)
HKU\S-1-5-21-164938143-4175652460-2459810496-1001\...\MountPoints2: {0a5d8dad-b1c9-11e2-be6f-74de2b4cb138} - "H:\this_war_of_mine_drmfree.exe"
HKU\S-1-5-21-164938143-4175652460-2459810496-1001\...\MountPoints2: {cdae1096-7caa-11e4-80ba-74de2b4cb138} - "I:\LaunchU3.exe" -a
Startup: C:\Users\jakub_000\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\jakub_000\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
Startup: C:\Users\jakub_000\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EvernoteClipper.lnk
ShortcutTarget: EvernoteClipper.lnk -> C:\Program Files (x86)\Evernote\Evernote\EvernoteClipper.exe (Evernote Corp., 305 Walnut Street, Redwood City, CA 94063)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKU\S-1-5-21-164938143-4175652460-2459810496-1001\Software\Microsoft\Internet Explorer\Main,First Home Page = http://g.msn.com/1ewenusDefaultPack/UP97_FRPage
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-164938143-4175652460-2459810496-1001 -> {012E1000-F331-11DB-8314-0800200C9A66} URL = http://www.google.com/search?q={searchTerms}
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_31\bin\ssv.dll (Oracle Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_31\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: Positive Finds -> {30c85a3d-1d96-4589-b63f-91fb7ef45a41} -> C:\Program Files (x86)\Positive Finds\Extensions\30c85a3d-1d96-4589-b63f-91fb7ef45a41.dll ()
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Evernote extension -> {92EF2EAD-A7CE-4424-B0DB-499CF856608E} -> C:\Program Files (x86)\Evernote\Evernote\EvernoteIE.dll (Evernote Corp., 305 Walnut Street, Redwood City, CA 94063)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Microsoft Corporation)
Handler-x32: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

FireFox:
========
FF ProfilePath: C:\Users\jakub_000\AppData\Roaming\Mozilla\Firefox\Profiles\0zrrz33f.default-1423126443143
FF Homepage: about:home
FF Plugin: @adobe.com/FlashPlayer -> C:\windows\system32\Macromed\Flash\NPSWF64_16_0_0_305.dll ()
FF Plugin: @java.com/DTPlugin,version=11.31.2 -> C:\Program Files\Java\jre1.8.0_31\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=11.31.2 -> C:\Program Files\Java\jre1.8.0_31\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\windows\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_305.dll ()
FF Plugin-x32: @esn/esnlaunch,version=2.1.7 -> C:\Program Files (x86)\Battlelog Web Plugins\2.1.7\npesnlaunch.dll (ESN Social Software AB)
FF Plugin-x32: @java.com/DTPlugin,version=10.21.2 -> C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.21.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @videolan.org/vlc,version=2.0.6 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.1.5 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-164938143-4175652460-2459810496-1001: @talk.google.com/GoogleTalkPlugin -> C:\Users\jakub_000\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll (Google)
FF Plugin HKU\S-1-5-21-164938143-4175652460-2459810496-1001: @talk.google.com/O1DPlugin -> C:\Users\jakub_000\AppData\Roaming\Mozilla\plugins\npo1d.dll (Google)
FF Plugin HKU\S-1-5-21-164938143-4175652460-2459810496-1001: @tools.google.com/Google Update;version=3 -> C:\Users\jakub_000\AppData\Local\Google\Update\1.3.26.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKU\S-1-5-21-164938143-4175652460-2459810496-1001: @tools.google.com/Google Update;version=9 -> C:\Users\jakub_000\AppData\Local\Google\Update\1.3.26.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKU\S-1-5-21-164938143-4175652460-2459810496-1001: @unity3d.com/UnityPlayer,version=1.0 -> C:\Users\jakub_000\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
FF Plugin ProgramFiles/Appdata: C:\Users\jakub_000\AppData\Roaming\mozilla\plugins\npgoogletalk.dll (Google)
FF Plugin ProgramFiles/Appdata: C:\Users\jakub_000\AppData\Roaming\mozilla\plugins\npo1d.dll (Google)
FF Extension: Positive Finds - C:\Users\jakub_000\AppData\Roaming\Mozilla\Firefox\Profiles\0zrrz33f.default-1423126443143\Extensions\{27b7c23c-50cd-4b3c-a6c1-8e45175b2442}.xpi [2015-02-05]
FF Extension: No Name - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}.xpi [2015-01-27]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 AtherosSvc; C:\Windows\system32\AdminService.exe [189440 2012-02-02] (Atheros Commnucations)
S3 BEService; C:\Program Files (x86)\Common Files\BattlEye\BEService.exe [448384 2015-02-01] ()
S3 Origin Client Service; C:\Program Files (x86)\Origin\OriginClientService.exe [1903472 2014-12-26] (Electronic Arts)
R2 PnkBstrA; C:\windows\SysWOW64\PnkBstrA.exe [76888 2013-07-26] ()
R2 Service Mgr PositiveFinds; C:\ProgramData\d2d4a9d3-f3f1-4c52-8d3f-dddc91fe0602\plugincontainer.exe [577272 2015-02-10] ()
R2 Update Mgr PositiveFinds; C:\Program Files (x86)\Common Files\d2d4a9d3-f3f1-4c52-8d3f-dddc91fe0602\updater.exe [384760 2015-02-10] ()
R2 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [16032 2014-09-22] (Microsoft Corporation)
S3 OverwolfUpdaterService; C:\Program Files (x86)\Overwolf\OverwolfUpdater.exe [X]

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R1 dtsoftbus01; C:\Windows\System32\drivers\dtsoftbus01.sys [283200 2013-05-01] (DT Soft Ltd)
S3 epmntdrv; C:\windows\system32\epmntdrv.sys [18528 2014-11-18] ()
S3 epmntdrv; C:\windows\SysWOW64\epmntdrv.sys [14944 2014-11-18] ()
S3 EuGdiDrv; C:\windows\system32\EuGdiDrv.sys [10848 2014-11-18] ()
S3 EuGdiDrv; C:\windows\SysWOW64\EuGdiDrv.sys [10208 2014-11-18] ()
S3 hamachi; C:\Windows\system32\DRIVERS\Hamdrv.sys [46136 2013-07-03] (LogMeIn Inc.)
S3 Secdrv; C:\windows\SysWOW64\drivers\SECDRV.SYS [14368 1968-04-08] () [File not signed]
R3 SNP2UVC; C:\Windows\system32\DRIVERS\snp2uvc.sys [1866080 2012-11-28] ()

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-02-10 19:56 - 2015-02-10 19:57 - 00011773 _____ () C:\Users\jakub_000\Desktop\FRST.txt
2015-02-10 19:56 - 2015-02-10 19:57 - 00000000 ____D () C:\FRST
2015-02-10 19:55 - 2015-02-10 19:55 - 02132992 _____ (Farbar) C:\Users\jakub_000\Desktop\FRST64.exe
2015-02-09 14:30 - 2015-02-09 14:30 - 00002277 _____ () C:\Users\jakub_000\Downloads\releasekeystore.keystore
2015-02-05 21:37 - 2015-02-05 21:37 - 00000000 _____ () C:\windows\setuperr.log
2015-02-05 21:37 - 2015-02-05 21:37 - 00000000 _____ () C:\windows\setupact.log
2015-02-05 11:44 - 2015-02-09 11:27 - 00000000 ____D () C:\Users\jakub_000\.android
2015-02-05 11:39 - 2015-02-05 11:28 - 00024064 _____ () C:\windows\zoek-delete.exe
2015-02-05 11:30 - 2015-02-05 11:41 - 00007973 _____ () C:\zoek-results.log
2015-02-05 11:28 - 2015-02-05 11:37 - 00000000 ____D () C:\zoek_backup
2015-02-05 11:28 - 2015-02-05 11:28 - 01295360 _____ () C:\Users\jakub_000\Downloads\zoek.exe
2015-02-05 11:28 - 2015-02-05 11:28 - 01295360 _____ () C:\Users\jakub_000\Desktop\zoek.exe
2015-02-05 11:04 - 2015-02-10 19:47 - 00000006 ____H () C:\windows\Tasks\SA.DAT
2015-02-05 11:04 - 2015-02-05 11:40 - 00000640 _____ () C:\windows\PFRO.log
2015-02-05 10:47 - 2015-02-05 10:47 - 00000937 _____ () C:\Users\jakub_000\Desktop\JRT.txt
2015-02-05 10:44 - 2015-02-05 10:44 - 02194432 _____ () C:\Users\jakub_000\Downloads\AdwCleaner.exe
2015-02-05 10:43 - 2015-02-05 10:43 - 01388274 _____ (Thisisu) C:\Users\jakub_000\Downloads\JRT.exe
2015-02-05 10:01 - 2015-02-05 10:01 - 01222144 _____ () C:\Users\jakub_000\Desktop\RSITx64.exe
2015-02-05 09:54 - 2015-02-05 09:54 - 00000000 ____D () C:\Users\jakub_000\Desktop\Old Firefox Data
2015-02-04 21:35 - 2015-02-04 21:53 - 170714072 _____ () C:\Users\jakub_000\Downloads\Doctor.Who.2005.S08E11.Dark.Water.720p.WEB-DL.2CH.x265.HEVC-PSA.mkv.part
2015-02-04 20:46 - 2015-02-04 21:05 - 334955953 _____ () C:\Users\jakub_000\Downloads\Doctor.Who.2005.S08E10.In.The.Forest.Of.The.Night.720p.WEB-DL.2CH.x265.HEVC-PSA.mkv.part
2015-02-04 17:54 - 2015-02-10 19:48 - 00000000 ____D () C:\ProgramData\d2d4a9d3-f3f1-4c52-8d3f-dddc91fe0602
2015-02-04 17:54 - 2015-02-04 17:54 - 00001384 _____ () C:\Users\Public\Desktop\EaseUS Partition Master 10.2.lnk
2015-02-04 17:54 - 2015-02-04 17:54 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\EaseUS Partition Master 10.2
2015-02-04 17:54 - 2015-02-04 17:54 - 00000000 ____D () C:\Program Files (x86)\Positive Finds
2015-02-04 17:54 - 2014-11-18 14:46 - 03384928 _____ () C:\windows\system32\BootMan.exe
2015-02-04 17:54 - 2014-11-18 14:46 - 02502240 _____ () C:\windows\SysWOW64\BootMan.exe
2015-02-04 17:54 - 2014-11-18 14:46 - 00021088 _____ () C:\windows\SysWOW64\EuEpmGdi.dll
2015-02-04 17:54 - 2014-11-18 14:46 - 00017504 _____ () C:\windows\system32\EuEpmGdi.dll
2015-02-04 17:54 - 2014-11-18 14:39 - 00018528 _____ () C:\windows\system32\epmntdrv.sys
2015-02-04 17:54 - 2014-11-18 14:39 - 00014944 _____ () C:\windows\SysWOW64\epmntdrv.sys
2015-02-04 17:54 - 2014-11-18 14:39 - 00010848 _____ () C:\windows\system32\EuGdiDrv.sys
2015-02-04 17:54 - 2014-11-18 14:39 - 00010208 _____ () C:\windows\SysWOW64\EuGdiDrv.sys
2015-02-04 17:54 - 2014-11-18 14:38 - 00101984 _____ () C:\windows\system32\setupempdrvx64.exe
2015-02-04 17:54 - 2014-11-18 14:38 - 00088160 _____ () C:\windows\SysWOW64\setupempdrv03.exe
2015-02-03 20:34 - 2015-02-03 20:35 - 24743106 _____ () C:\Users\jakub_000\Downloads\vlc-2.1.5-win32.exe
2015-02-03 20:29 - 2015-02-03 20:42 - 220085196 _____ () C:\Users\jakub_000\Downloads\Doctor.Who.2005.S08E09.Flatline.720p.WEB-DL.2CH.x265.HEVC-PSA.mkv.part
2015-02-03 17:40 - 2015-02-03 17:40 - 30603720 _____ (EaseUS ) C:\Users\jakub_000\Downloads\epm.exe
2015-02-02 14:17 - 2015-02-02 14:17 - 00000869 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ShoeBox.lnk
2015-02-02 14:17 - 2015-02-02 14:17 - 00000857 _____ () C:\Users\Public\Desktop\ShoeBox.lnk
2015-02-02 14:17 - 2015-02-02 14:17 - 00000000 ____D () C:\Users\jakub_000\AppData\Roaming\ShoeBox
2015-02-02 14:17 - 2015-02-02 14:17 - 00000000 ____D () C:\Users\Default\AppData\Roaming\Macromedia
2015-02-02 14:17 - 2015-02-02 14:17 - 00000000 ____D () C:\Users\Default User\AppData\Roaming\Macromedia
2015-02-02 14:17 - 2015-02-02 14:17 - 00000000 ____D () C:\Program Files (x86)\ShoeBox
2015-02-02 14:11 - 2015-02-02 14:14 - 17709352 _____ (Adobe Systems Inc.) C:\Users\jakub_000\Downloads\AdobeAIRInstaller.exe
2015-02-02 14:09 - 2015-02-02 14:10 - 02683059 _____ () C:\Users\jakub_000\Downloads\ShoeBox_3.5.4_public.air
2015-02-01 20:58 - 2015-02-01 21:07 - 00000000 ____D () C:\Users\jakub_000\Documents\DayZ
2015-02-01 18:54 - 2015-02-01 19:24 - 533045877 _____ () C:\Users\jakub_000\Downloads\Friends.S03E09.mHD.BluRay.DD5.1.x264-EPiK.mkv.part
2015-02-01 14:18 - 2015-02-01 14:18 - 00000840 _____ () C:\Users\jakub_000\AppData\Local\recently-used.xbel
2015-01-27 08:11 - 2015-01-27 08:12 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2015-01-26 10:52 - 2015-01-26 10:52 - 00111016 _____ (Oracle Corporation) C:\windows\system32\WindowsAccessBridge-64.dll
2015-01-26 10:49 - 2015-01-26 10:49 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java Development Kit
2015-01-26 10:49 - 2015-01-26 10:49 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2015-01-26 10:48 - 2015-01-26 10:51 - 00000000 ____D () C:\Program Files\Java
2015-01-25 17:40 - 2015-01-29 21:20 - 00000000 ____D () C:\Users\jakub_000\AppData\Roaming\Factorio
2015-01-25 17:38 - 2015-01-25 17:38 - 00001880 _____ () C:\Users\Public\Desktop\Factorio.lnk
2015-01-25 17:38 - 2015-01-25 17:38 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Factorio
2015-01-22 18:44 - 2015-01-22 18:44 - 00001091 _____ () C:\Users\jakub_000\Desktop\ADT-1 - Shortcut.lnk
2015-01-22 16:30 - 2015-02-01 14:18 - 00022717 _____ () C:\Users\jakub_000\Documents\Výkaz za leden.ods
2015-01-22 16:16 - 2015-01-22 16:16 - 01321595 _____ () C:\Users\jakub_000\Downloads\Harmonogram_Bukovjan_Jiri.xlsx
2015-01-21 19:26 - 2015-01-21 19:26 - 00001019 _____ () C:\Users\Public\Desktop\PlayDance.lnk
2015-01-21 19:26 - 2015-01-21 19:26 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PlayDance
2015-01-21 19:25 - 2015-01-21 19:26 - 00000000 ____D () C:\Program Files (x86)\PlayDance
2015-01-21 18:45 - 2015-01-21 18:45 - 00001141 _____ () C:\Users\jakub_000\Desktop\StepMania 3.9.lnk
2015-01-21 18:45 - 2015-01-21 18:45 - 00000000 ____D () C:\Users\jakub_000\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\StepMania
2015-01-21 18:45 - 2015-01-21 18:45 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StepMania
2015-01-21 18:35 - 2015-01-21 19:31 - 00000000 ____D () C:\Program Files (x86)\StepMania
2015-01-20 19:36 - 2015-01-20 19:36 - 00000222 _____ () C:\Users\jakub_000\Desktop\Insurgency.url
2015-01-19 14:09 - 2015-01-19 14:09 - 00466520 _____ (Creative Labs) C:\windows\system32\wrap_oal.dll
2015-01-19 14:09 - 2015-01-19 14:09 - 00445016 _____ (Creative Labs) C:\windows\SysWOW64\wrap_oal.dll
2015-01-19 14:09 - 2015-01-19 14:09 - 00123480 _____ (Portions (C) Creative Labs Inc. and NVIDIA Corp.) C:\windows\system32\OpenAL32.dll
2015-01-19 14:09 - 2015-01-19 14:09 - 00109144 _____ (Portions (C) Creative Labs Inc. and NVIDIA Corp.) C:\windows\SysWOW64\OpenAL32.dll
2015-01-19 14:09 - 2015-01-19 14:09 - 00000000 ____D () C:\Program Files (x86)\OpenAL
2015-01-19 13:55 - 2015-01-19 13:55 - 00000221 _____ () C:\Users\jakub_000\Desktop\Arma Cold War Assault.url
2015-01-19 12:46 - 2015-01-19 12:47 - 15486288 _____ (SIX Networks) C:\Users\jakub_000\Desktop\withSIX-Play.exe
2015-01-18 18:18 - 2015-01-18 18:18 - 00000000 ____D () C:\Users\jakub_000\AppData\Roaming\six-zsync
2015-01-18 18:18 - 2015-01-18 18:18 - 00000000 ____D () C:\Users\jakub_000\AppData\Roaming\six-updater
2015-01-18 17:54 - 2015-01-18 17:54 - 00000000 ____D () C:\Program Files (x86)\SIX Projects
2015-01-17 10:42 - 2015-01-17 11:48 - 00000000 ____D () C:\Users\jakub_000\Documents\Arma 3
2015-01-17 10:39 - 2013-08-14 13:41 - 00028776 _____ (Microsoft Corporation) C:\windows\SysWOW64\aspnet_counters.dll
2015-01-17 10:38 - 2013-08-14 13:40 - 00030312 _____ (Microsoft Corporation) C:\windows\system32\aspnet_counters.dll
2015-01-14 11:54 - 2014-11-27 03:40 - 00600576 _____ (Microsoft Corporation) C:\windows\system32\vbscript.dll
2015-01-14 11:54 - 2014-11-27 02:28 - 00523264 _____ (Microsoft Corporation) C:\windows\SysWOW64\vbscript.dll
2015-01-14 11:53 - 2014-11-15 07:06 - 00059392 _____ (Microsoft Corporation) C:\windows\system32\wuauclt.exe
2015-01-14 11:53 - 2014-11-15 06:13 - 03286016 _____ (Microsoft Corporation) C:\windows\system32\wuaueng.dll
2015-01-14 11:53 - 2014-11-15 06:13 - 01623552 _____ (Microsoft Corporation) C:\windows\system32\wucltux.dll
2015-01-14 11:53 - 2014-11-15 06:13 - 00775168 _____ (Microsoft Corporation) C:\windows\system32\wuapi.dll
2015-01-14 11:53 - 2014-11-15 06:13 - 00253440 _____ (Microsoft Corporation) C:\windows\system32\WUSettingsProvider.dll
2015-01-14 11:53 - 2014-11-15 04:53 - 00630272 _____ (Microsoft Corporation) C:\windows\SysWOW64\wuapi.dll
2015-01-14 11:53 - 2014-11-05 07:40 - 00733184 _____ (Microsoft Corporation) C:\windows\system32\win32spl.dll
2015-01-14 11:53 - 2014-11-05 07:39 - 01024512 _____ (Microsoft Corporation) C:\windows\system32\localspl.dll
2015-01-14 11:53 - 2014-11-01 07:28 - 00417280 _____ (Microsoft Corporation) C:\windows\system32\services.exe
2015-01-14 11:53 - 2014-10-29 15:21 - 00499008 _____ (Microsoft Corporation) C:\windows\system32\Drivers\vhdmp.sys
2015-01-14 11:53 - 2014-10-27 23:10 - 00390841 _____ () C:\windows\system32\ApnDatabase.xml
2015-01-14 11:52 - 2014-11-15 06:13 - 00144384 _____ (Microsoft Corporation) C:\windows\system32\wuwebv.dll
2015-01-14 11:52 - 2014-11-15 06:13 - 00100352 _____ (Microsoft Corporation) C:\windows\system32\wudriver.dll
2015-01-14 11:52 - 2014-11-15 06:13 - 00040448 _____ (Microsoft Corporation) C:\windows\system32\wuapp.exe
2015-01-14 11:52 - 2014-11-15 06:12 - 00176640 _____ (Microsoft Corporation) C:\windows\system32\storewuauth.dll
2015-01-14 11:52 - 2014-11-15 04:54 - 00035328 _____ (Microsoft Corporation) C:\windows\SysWOW64\wuapp.exe
2015-01-14 11:52 - 2014-11-15 04:53 - 00128000 _____ (Microsoft Corporation) C:\windows\SysWOW64\wuwebv.dll
2015-01-14 11:52 - 2014-11-15 04:53 - 00086528 _____ (Microsoft Corporation) C:\windows\SysWOW64\wudriver.dll
2015-01-14 11:51 - 2014-12-19 07:48 - 00210432 _____ (Microsoft Corporation) C:\windows\system32\profsvc.dll
2015-01-14 11:51 - 2014-12-19 05:35 - 00142336 _____ (Microsoft Corporation) C:\windows\system32\Drivers\mrxdav.sys
2015-01-14 11:51 - 2014-12-11 08:35 - 06973248 _____ (Microsoft Corporation) C:\windows\system32\ntoskrnl.exe
2015-01-14 11:51 - 2014-12-11 07:51 - 00062976 _____ (Microsoft Corporation) C:\windows\system32\TSWbPrxy.exe
2015-01-14 11:51 - 2014-12-06 08:53 - 00458240 _____ (Microsoft Corporation) C:\windows\system32\wer.dll
2015-01-14 11:51 - 2014-12-06 08:53 - 00026112 _____ (Microsoft Corporation) C:\windows\system32\WerFaultSecure.exe
2015-01-14 11:51 - 2014-12-06 08:52 - 00384000 _____ (Microsoft Corporation) C:\windows\system32\ncsi.dll
2015-01-14 11:51 - 2014-12-06 08:52 - 00357376 _____ (Microsoft Corporation) C:\windows\system32\nlasvc.dll
2015-01-14 11:51 - 2014-12-06 08:52 - 00072192 _____ (Microsoft Corporation) C:\windows\system32\nlaapi.dll
2015-01-14 11:51 - 2014-12-06 08:51 - 00370688 _____ (Microsoft Corporation) C:\windows\system32\Faultrep.dll
2015-01-14 11:51 - 2014-12-06 08:51 - 00267264 _____ (Microsoft Corporation) C:\windows\system32\EncDump.dll
2015-01-14 11:51 - 2014-12-06 08:50 - 00783872 _____ (Microsoft Corporation) C:\windows\system32\audiosrv.dll
2015-01-14 11:51 - 2014-12-06 07:10 - 00355840 _____ (Microsoft Corporation) C:\windows\SysWOW64\wer.dll
2015-01-14 11:51 - 2014-12-06 07:10 - 00023552 _____ (Microsoft Corporation) C:\windows\SysWOW64\WerFaultSecure.exe
2015-01-14 11:51 - 2014-12-06 07:09 - 00332800 _____ (Microsoft Corporation) C:\windows\SysWOW64\Faultrep.dll
2015-01-14 11:51 - 2014-12-06 07:09 - 00055296 _____ (Microsoft Corporation) C:\windows\SysWOW64\nlaapi.dll
2015-01-11 15:35 - 2015-01-11 15:35 - 00000000 ___HD () C:\ProgramData\CanonBJ
2015-01-11 15:34 - 2012-04-16 05:00 - 00389120 _____ (CANON INC.) C:\windows\system32\CNMLMBA.DLL

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-02-10 19:57 - 2013-04-20 09:49 - 00003596 _____ () C:\windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-164938143-4175652460-2459810496-1001
2015-02-09 16:03 - 2013-06-02 17:38 - 01113777 _____ () C:\windows\WindowsUpdate.log
2015-02-09 16:03 - 2012-07-26 06:26 - 00786432 ___SH () C:\windows\system32\config\BBI
2015-02-09 16:01 - 2014-12-17 09:52 - 00000000 ____D () C:\Users\jakub_000\Documents\New Unity Project
2015-02-09 15:02 - 2012-07-26 09:12 - 00000000 ____D () C:\windows\system32\sru
2015-02-09 14:26 - 2013-04-21 23:03 - 00000000 ____D () C:\Users\jakub_000\AppData\Roaming\vlc
2015-02-09 12:38 - 2013-06-02 12:04 - 00000000 ____D () C:\Program Files\trend micro
2015-02-09 11:39 - 2014-10-02 09:59 - 00000000 ____D () C:\ProgramData\Unity
2015-02-09 10:24 - 2012-07-26 08:28 - 00848230 _____ () C:\windows\system32\PerfStringBackup.INI
2015-02-09 09:18 - 2012-07-26 08:59 - 00000000 ____D () C:\windows\CbsTemp
2015-02-09 09:16 - 2014-10-21 10:24 - 00000000 ___RD () C:\Users\jakub_000\Dropbox
2015-02-09 09:16 - 2014-10-21 10:20 - 00000000 ____D () C:\Users\jakub_000\AppData\Roaming\Dropbox
2015-02-05 11:44 - 2013-04-20 09:39 - 00000000 ____D () C:\Users\jakub_000
2015-02-05 11:38 - 2013-05-17 21:57 - 00000000 ____D () C:\Users\jakub_000\AppData\Local\Google
2015-02-05 11:18 - 2014-12-19 13:41 - 00097792 ___SH () C:\Users\jakub_000\Documents\Thumbs.db
2015-02-05 11:03 - 2014-07-20 16:53 - 00000000 ____D () C:\AdwCleaner
2015-02-04 20:36 - 2013-04-21 00:09 - 00003718 _____ () C:\windows\System32\Tasks\Adobe Flash Player Updater
2015-02-04 17:53 - 2014-07-18 11:30 - 00000000 ____D () C:\Program Files (x86)\EaseUS
2015-02-04 09:39 - 2013-08-12 19:52 - 00003954 _____ () C:\windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-164938143-4175652460-2459810496-1001UA
2015-02-04 09:39 - 2013-08-12 19:52 - 00003574 _____ () C:\windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-164938143-4175652460-2459810496-1001Core
2015-02-03 20:39 - 2013-06-04 21:26 - 00001066 _____ () C:\Users\Public\Desktop\VLC media player.lnk
2015-02-03 20:39 - 2013-06-04 21:26 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoLAN
2015-02-03 20:29 - 2014-10-18 19:24 - 00714184 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerApp.exe
2015-02-03 20:29 - 2014-10-18 19:24 - 00106440 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-02-02 21:16 - 2013-04-20 09:45 - 00000000 ____D () C:\Users\jakub_000\AppData\Roaming\Skype
2015-02-02 21:12 - 2013-08-27 20:54 - 00000000 ____D () C:\Program Files (x86)\Steam
2015-02-02 14:17 - 2014-11-25 11:43 - 00000000 ____D () C:\Program Files (x86)\Adobe
2015-02-02 14:17 - 2014-10-23 08:29 - 00000000 ____D () C:\Users\jakub_000\AppData\Local\Adobe
2015-02-02 14:17 - 2013-04-21 00:07 - 00000000 ____D () C:\ProgramData\Adobe
2015-02-02 14:17 - 2013-04-20 09:41 - 00000000 ____D () C:\Users\jakub_000\AppData\Roaming\Adobe
2015-02-01 21:02 - 2013-12-17 09:58 - 00000000 ____D () C:\Users\jakub_000\AppData\Local\DayZ
2015-02-01 19:16 - 2013-04-27 00:31 - 00000000 ____D () C:\Users\jakub_000\AppData\Roaming\uTorrent
2015-02-01 17:55 - 2013-12-16 22:59 - 00000222 _____ () C:\Users\jakub_000\Desktop\DayZ.url
2015-02-01 14:19 - 2014-12-24 14:33 - 00000000 ____D () C:\Users\jakub_000\.gimp-2.8
2015-01-30 00:39 - 2013-04-21 00:04 - 00000000 ____D () C:\Users\jakub_000\AppData\Roaming\Mozilla
2015-01-29 08:50 - 2014-10-03 12:00 - 00000000 ____D () C:\Users\jakub_000\Documents\Já
2015-01-29 08:50 - 2014-09-23 22:26 - 00564736 ___SH () C:\Users\jakub_000\Downloads\Thumbs.db
2015-01-27 17:05 - 2013-05-24 11:17 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2015-01-26 18:36 - 2013-10-10 21:08 - 00000000 ____D () C:\Users\jakub_000\AppData\Local\Arma 3
2015-01-26 11:36 - 2013-05-08 09:30 - 00000000 ____D () C:\Program Files (x86)\Origin
2015-01-25 17:38 - 2013-08-06 14:32 - 00000000 ____D () C:\Program Files\Factorio
2015-01-20 19:05 - 2013-12-17 10:14 - 00212480 ___SH () C:\Users\jakub_000\Desktop\Thumbs.db
2015-01-19 22:52 - 2014-10-03 11:59 - 00000000 ____D () C:\Users\jakub_000\Documents\Škola
2015-01-19 12:49 - 2013-06-23 13:45 - 00000000 ____D () C:\Users\jakub_000\AppData\Local\Downloaded Installations
2015-01-18 17:54 - 2013-06-23 13:45 - 00002573 _____ () C:\Users\Public\Desktop\Six Updater.lnk
2015-01-18 17:54 - 2013-06-23 13:45 - 00002573 _____ () C:\Users\Public\Desktop\Six Launcher.lnk
2015-01-16 17:55 - 2013-08-14 11:24 - 00000000 ____D () C:\windows\system32\MRT
2015-01-16 17:48 - 2013-04-21 12:53 - 113365784 _____ (Microsoft Corporation) C:\windows\system32\MRT.exe
2015-01-15 09:12 - 2013-12-13 21:23 - 00000000 ____D () C:\windows\rescache
2015-01-12 23:29 - 2015-01-10 20:54 - 00000000 ____D () C:\Users\jakub_000\AppData\Local\Game Dev Tycoon - Steam
2015-01-12 16:08 - 2012-07-26 09:12 - 00000000 ____D () C:\windows\AUInstallAgent
2015-01-12 13:42 - 2013-05-08 09:30 - 00000000 ____D () C:\ProgramData\Origin
2015-01-11 15:37 - 2013-04-20 09:40 - 00000000 ____D () C:\Users\jakub_000\AppData\Local\Packages
2015-01-11 15:36 - 2012-07-26 09:12 - 00000000 ____D () C:\windows\system32\FxsTmp

==================== Files in the root of some directories =======

2014-11-10 21:05 - 2014-12-26 22:07 - 0000600 _____ () C:\Users\jakub_000\AppData\Local\PUTTY.RND
2015-02-01 14:18 - 2015-02-01 14:18 - 0000840 _____ () C:\Users\jakub_000\AppData\Local\recently-used.xbel

Some content of TEMP:
====================
C:\Users\jakub_000\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmppigusp.dll


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-02-04 09:43

==================== End Of Log ============================

přikládám addition.txt
Přílohy
Addition.rar
(9.31 KiB) Staženo 71 x
Nahoru
altrok
Moderátor
Moderátor
Příspěvky: 7328
Registrován: 15 Lis 2012 22:26
Místo/Bydliště: Znojmo

Re: Positive add problém přetrvává

#4 Příspěvek od altrok »

:arrow: Odinstalujte Skype Click to Call a starou verzi Javy Java 7 Update 21 - ponechte jen tu aktualni (Java 8U31)

  • Do Poznamkoveho bloku (Start -> spustit -> notepad) zkopirujte obsah bileho pole
  • ulozte na plochu jako fixlist (Typ souboru: Textovy dokument)
  • znovu spustte FRST a kliknete na Fix
  • po restartu na Vas vyskoci fixlog (pripadne bude ulozen na Plose), jehoz obsah mi vlozte do pristi odpovedi

    Kód: Vybrat vše

    Start
CloseProcesses:
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [508800 2014-12-17] (Oracle Corporation)
HKU\S-1-5-21-164938143-4175652460-2459810496-1001\...\Run: [DAEMON Tools Lite] => C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe [3672640 2013-03-14] (Disc Soft Ltd)
HKU\S-1-5-21-164938143-4175652460-2459810496-1001\...\Run: [Google Update] => C:\Users\jakub_000\AppData\Local\Google\Update\GoogleUpdate.exe [116648 2013-08-12] (Google Inc.)
HKU\S-1-5-21-164938143-4175652460-2459810496-1001\...\MountPoints2: {0a5d8dad-b1c9-11e2-be6f-74de2b4cb138} - "H:\this_war_of_mine_drmfree.exe"
HKU\S-1-5-21-164938143-4175652460-2459810496-1001\...\MountPoints2: {cdae1096-7caa-11e4-80ba-74de2b4cb138} - "I:\LaunchU3.exe" -a

SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
BHO-x32: Positive Finds -> {30c85a3d-1d96-4589-b63f-91fb7ef45a41} -> C:\Program Files (x86)\Positive Finds\Extensions\30c85a3d-1d96-4589-b63f-91fb7ef45a41.dll ()
FF Extension: Positive Finds - C:\Users\jakub_000\AppData\Roaming\Mozilla\Firefox\Profiles\0zrrz33f.default-1423126443143\Extensions\{27b7c23c-50cd-4b3c-a6c1-8e45175b2442}.xpi [2015-02-05]

R2 Service Mgr PositiveFinds; C:\ProgramData\d2d4a9d3-f3f1-4c52-8d3f-dddc91fe0602\plugincontainer.exe [577272 2015-02-10] ()
R2 Update Mgr PositiveFinds; C:\Program Files (x86)\Common Files\d2d4a9d3-f3f1-4c52-8d3f-dddc91fe0602\updater.exe [384760 2015-02-10] ()
C:\ProgramData\d2d4a9d3-f3f1-4c52-8d3f-dddc91fe0602
C:\Program Files (x86)\Common Files\d2d4a9d3-f3f1-4c52-8d3f-dddc91fe0602

2015-02-10 19:56 - 2015-02-10 19:57 - 00011773 _____ () C:\Users\jakub_000\Desktop\FRST.txt
2015-02-05 11:39 - 2015-02-05 11:28 - 00024064 _____ () C:\windows\zoek-delete.exe
2015-02-05 11:30 - 2015-02-05 11:41 - 00007973 _____ () C:\zoek-results.log
2015-02-05 11:28 - 2015-02-05 11:37 - 00000000 ____D () C:\zoek_backup
2015-02-05 11:28 - 2015-02-05 11:28 - 01295360 _____ () C:\Users\jakub_000\Downloads\zoek.exe
2015-02-05 11:28 - 2015-02-05 11:28 - 01295360 _____ () C:\Users\jakub_000\Desktop\zoek.exe
2015-02-05 10:47 - 2015-02-05 10:47 - 00000937 _____ () C:\Users\jakub_000\Desktop\JRT.txt
2015-02-05 10:44 - 2015-02-05 10:44 - 02194432 _____ () C:\Users\jakub_000\Downloads\AdwCleaner.exe
2015-02-05 10:43 - 2015-02-05 10:43 - 01388274 _____ (Thisisu) C:\Users\jakub_000\Downloads\JRT.exe
2015-02-05 10:01 - 2015-02-05 10:01 - 01222144 _____ () C:\Users\jakub_000\Desktop\RSITx64.exe
2015-02-04 17:54 - 2015-02-10 19:48 - 00000000 ____D () C:\ProgramData\d2d4a9d3-f3f1-4c52-8d3f-dddc91fe0602
2015-02-04 17:54 - 2015-02-04 17:54 - 00000000 ____D () C:\Program Files (x86)\Positive Finds
2015-02-05 11:03 - 2014-07-20 16:53 - 00000000 ____D () C:\AdwCleaner

Task: {04D80486-4E01-4E69-BBB0-47CD6652E183} - System32\Tasks\{02ABBAF8-1A38-4A9A-8227-317BF9DFE300} => pcalua.exe -a "C:\Users\jakub_000\Downloads\[PC] Mafia  [ENG]-[RIP] [dopeman]\Mafia\Game.exe" -d "C:\Users\jakub_000\Downloads\[PC] Mafia  [ENG]-[RIP] [dopeman]\Mafia"
Task: {191AB24B-EF31-4DCD-B6FC-8BE9902F0897} - System32\Tasks\{59A35D4D-D0BB-479F-94E9-5962E7029025} => pcalua.exe -a H:\MafiaSetup.exe -d H:\
Task: {4C2CF6B3-52E4-47C9-AED3-A64F8D9D4053} - System32\Tasks\{911DDACA-D000-4568-A8BD-0A99202F5C37} => pcalua.exe -a F:\Powerdrome.exe -d F:\
Task: {7C3AF094-0295-4EFB-BF02-5F5A5E8E8586} - System32\Tasks\{0E77C26D-9871-4077-B385-28303FCB630C} => pcalua.exe -a "C:\Users\jakub_000\Downloads\Age-of-Empires-II---PLNÁ-HRA!!-+-čeština\Age of Empires II - Conquerors\SETUPREG.EXE" -d "C:\Users\jakub_000\Downloads\Age-of-Empires-II---PLNÁ-HRA!!-+-čeština\Age of Empires II - Conquerors"
Task: {E027EFE1-91D8-4F24-A4B1-72D68D6814FE} - System32\Tasks\{AAF4BBEF-2237-4E08-8CD4-21FB80651298} => pcalua.exe -a H:\Detinst.exe -d H:\
Task: {F3C88C6F-E049-478E-9CCD-0F37494CA257} - System32\Tasks\{27DC3E27-6A9B-43FC-8717-845FAB0095A4} => pcalua.exe -a C:\Users\jakub_000\Downloads\Mortal-Kombat-4-(for-PC)\Setup.exe -d C:\Users\jakub_000\Downloads\Mortal-Kombat-4-(for-PC)
EmptyTemp:
End
Pokud je cokoliv nejasného, ihned se ptej.
V případě spokojenosti prosím podpořte forum.
Pro dotazy, které se nehodí na forum, je možné využít altrokzavináčforum.viry.cz
Máš-li chuť pomáhat návštěvníkům tohoto fora, přihlas se do naší školičky.
Nahoru
papperwing
Návštěvník
Návštěvník
Příspěvky: 139
Registrován: 13 Bře 2013 20:34

Re: Positive add problém přetrvává

#5 Příspěvek od papperwing »

Ta odinstalace se provede těmi kroky s FRST nebo ten skype mám odinstalovat přes ovládací panely?
Nahoru
altrok
Moderátor
Moderátor
Příspěvky: 7328
Registrován: 15 Lis 2012 22:26
Místo/Bydliště: Znojmo

Re: Positive add problém přetrvává

#6 Příspěvek od altrok »

Pres ovladaci panely. Fixlist smaze positive find a podobnou havet, takze pak testujte vyskakovani reklam a podobne nestandardni chovani.
Pokud je cokoliv nejasného, ihned se ptej.
V případě spokojenosti prosím podpořte forum.
Pro dotazy, které se nehodí na forum, je možné využít altrokzavináčforum.viry.cz
Máš-li chuť pomáhat návštěvníkům tohoto fora, přihlas se do naší školičky.
Nahoru
papperwing
Návštěvník
Návštěvník
Příspěvky: 139
Registrován: 13 Bře 2013 20:34

Re: Positive add problém přetrvává

#7 Příspěvek od papperwing »

zde je log:
Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 08-02-2015
Ran by jakub_000 at 2015-02-10 22:29:32 Run:1
Running from C:\Users\jakub_000\Desktop
Loaded Profiles: jakub_000 (Available profiles: jakub_000)
Boot Mode: Normal
==============================================

Content of fixlist:
*****************
Start
CloseProcesses:
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [508800 2014-12-17] (Oracle Corporation)
HKU\S-1-5-21-164938143-4175652460-2459810496-1001\...\Run: [DAEMON Tools Lite] => C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe [3672640 2013-03-14] (Disc Soft Ltd)
HKU\S-1-5-21-164938143-4175652460-2459810496-1001\...\Run: [Google Update] => C:\Users\jakub_000\AppData\Local\Google\Update\GoogleUpdate.exe [116648 2013-08-12] (Google Inc.)
HKU\S-1-5-21-164938143-4175652460-2459810496-1001\...\MountPoints2: {0a5d8dad-b1c9-11e2-be6f-74de2b4cb138} - "H:\this_war_of_mine_drmfree.exe"
HKU\S-1-5-21-164938143-4175652460-2459810496-1001\...\MountPoints2: {cdae1096-7caa-11e4-80ba-74de2b4cb138} - "I:\LaunchU3.exe" -a

SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
BHO-x32: Positive Finds -> {30c85a3d-1d96-4589-b63f-91fb7ef45a41} -> C:\Program Files (x86)\Positive Finds\Extensions\30c85a3d-1d96-4589-b63f-91fb7ef45a41.dll ()
FF Extension: Positive Finds - C:\Users\jakub_000\AppData\Roaming\Mozilla\Firefox\Profiles\0zrrz33f.default-1423126443143\Extensions\{27b7c23c-50cd-4b3c-a6c1-8e45175b2442}.xpi [2015-02-05]

R2 Service Mgr PositiveFinds; C:\ProgramData\d2d4a9d3-f3f1-4c52-8d3f-dddc91fe0602\plugincontainer.exe [577272 2015-02-10] ()
R2 Update Mgr PositiveFinds; C:\Program Files (x86)\Common Files\d2d4a9d3-f3f1-4c52-8d3f-dddc91fe0602\updater.exe [384760 2015-02-10] ()
C:\ProgramData\d2d4a9d3-f3f1-4c52-8d3f-dddc91fe0602
C:\Program Files (x86)\Common Files\d2d4a9d3-f3f1-4c52-8d3f-dddc91fe0602

2015-02-10 19:56 - 2015-02-10 19:57 - 00011773 _____ () C:\Users\jakub_000\Desktop\FRST.txt
2015-02-05 11:39 - 2015-02-05 11:28 - 00024064 _____ () C:\windows\zoek-delete.exe
2015-02-05 11:30 - 2015-02-05 11:41 - 00007973 _____ () C:\zoek-results.log
2015-02-05 11:28 - 2015-02-05 11:37 - 00000000 ____D () C:\zoek_backup
2015-02-05 11:28 - 2015-02-05 11:28 - 01295360 _____ () C:\Users\jakub_000\Downloads\zoek.exe
2015-02-05 11:28 - 2015-02-05 11:28 - 01295360 _____ () C:\Users\jakub_000\Desktop\zoek.exe
2015-02-05 10:47 - 2015-02-05 10:47 - 00000937 _____ () C:\Users\jakub_000\Desktop\JRT.txt
2015-02-05 10:44 - 2015-02-05 10:44 - 02194432 _____ () C:\Users\jakub_000\Downloads\AdwCleaner.exe
2015-02-05 10:43 - 2015-02-05 10:43 - 01388274 _____ (Thisisu) C:\Users\jakub_000\Downloads\JRT.exe
2015-02-05 10:01 - 2015-02-05 10:01 - 01222144 _____ () C:\Users\jakub_000\Desktop\RSITx64.exe
2015-02-04 17:54 - 2015-02-10 19:48 - 00000000 ____D () C:\ProgramData\d2d4a9d3-f3f1-4c52-8d3f-dddc91fe0602
2015-02-04 17:54 - 2015-02-04 17:54 - 00000000 ____D () C:\Program Files (x86)\Positive Finds
2015-02-05 11:03 - 2014-07-20 16:53 - 00000000 ____D () C:\AdwCleaner

Task: {04D80486-4E01-4E69-BBB0-47CD6652E183} - System32\Tasks\{02ABBAF8-1A38-4A9A-8227-317BF9DFE300} => pcalua.exe -a "C:\Users\jakub_000\Downloads\[PC] Mafia [ENG]-[RIP] [dopeman]\Mafia\Game.exe" -d "C:\Users\jakub_000\Downloads\[PC] Mafia [ENG]-[RIP] [dopeman]\Mafia"
Task: {191AB24B-EF31-4DCD-B6FC-8BE9902F0897} - System32\Tasks\{59A35D4D-D0BB-479F-94E9-5962E7029025} => pcalua.exe -a H:\MafiaSetup.exe -d H:\
Task: {4C2CF6B3-52E4-47C9-AED3-A64F8D9D4053} - System32\Tasks\{911DDACA-D000-4568-A8BD-0A99202F5C37} => pcalua.exe -a F:\Powerdrome.exe -d F:\
Task: {7C3AF094-0295-4EFB-BF02-5F5A5E8E8586} - System32\Tasks\{0E77C26D-9871-4077-B385-28303FCB630C} => pcalua.exe -a "C:\Users\jakub_000\Downloads\Age-of-Empires-II---PLNÁ-HRA!!-+-čeština\Age of Empires II - Conquerors\SETUPREG.EXE" -d "C:\Users\jakub_000\Downloads\Age-of-Empires-II---PLNÁ-HRA!!-+-čeština\Age of Empires II - Conquerors"
Task: {E027EFE1-91D8-4F24-A4B1-72D68D6814FE} - System32\Tasks\{AAF4BBEF-2237-4E08-8CD4-21FB80651298} => pcalua.exe -a H:\Detinst.exe -d H:\
Task: {F3C88C6F-E049-478E-9CCD-0F37494CA257} - System32\Tasks\{27DC3E27-6A9B-43FC-8717-845FAB0095A4} => pcalua.exe -a C:\Users\jakub_000\Downloads\Mortal-Kombat-4-(for-PC)\Setup.exe -d C:\Users\jakub_000\Downloads\Mortal-Kombat-4-(for-PC)
EmptyTemp:
End
*****************

Processes closed successfully.
HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\SunJavaUpdateSched => Value not found.
HKU\S-1-5-21-164938143-4175652460-2459810496-1001\Software\Microsoft\Windows\CurrentVersion\Run\\DAEMON Tools Lite => value deleted successfully.
HKU\S-1-5-21-164938143-4175652460-2459810496-1001\Software\Microsoft\Windows\CurrentVersion\Run\\Google Update => value deleted successfully.
"HKU\S-1-5-21-164938143-4175652460-2459810496-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{0a5d8dad-b1c9-11e2-be6f-74de2b4cb138}" => Key deleted successfully.
HKCR\CLSID\{0a5d8dad-b1c9-11e2-be6f-74de2b4cb138} => Key not found.
"HKU\S-1-5-21-164938143-4175652460-2459810496-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{cdae1096-7caa-11e4-80ba-74de2b4cb138}" => Key deleted successfully.
HKCR\CLSID\{cdae1096-7caa-11e4-80ba-74de2b4cb138} => Key not found.
HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value deleted successfully.
HKU\S-1-5-19\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value deleted successfully.
HKU\S-1-5-20\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value deleted successfully.
"HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{30c85a3d-1d96-4589-b63f-91fb7ef45a41}" => Key deleted successfully.
"HKCR\Wow6432Node\CLSID\{30c85a3d-1d96-4589-b63f-91fb7ef45a41}" => Key deleted successfully.
C:\Users\jakub_000\AppData\Roaming\Mozilla\Firefox\Profiles\0zrrz33f.default-1423126443143\Extensions\{27b7c23c-50cd-4b3c-a6c1-8e45175b2442}.xpi not found.
Service Mgr PositiveFinds => Service stopped successfully.
Service Mgr PositiveFinds => Service deleted successfully.
Update Mgr PositiveFinds => Service deleted successfully.
C:\ProgramData\d2d4a9d3-f3f1-4c52-8d3f-dddc91fe0602 => Moved successfully.
C:\Program Files (x86)\Common Files\d2d4a9d3-f3f1-4c52-8d3f-dddc91fe0602 => Moved successfully.
C:\Users\jakub_000\Desktop\FRST.txt => Moved successfully.
C:\windows\zoek-delete.exe => Moved successfully.
C:\zoek-results.log => Moved successfully.
C:\zoek_backup => Moved successfully.
C:\Users\jakub_000\Downloads\zoek.exe => Moved successfully.
C:\Users\jakub_000\Desktop\zoek.exe => Moved successfully.
C:\Users\jakub_000\Desktop\JRT.txt => Moved successfully.
C:\Users\jakub_000\Downloads\AdwCleaner.exe => Moved successfully.
C:\Users\jakub_000\Downloads\JRT.exe => Moved successfully.
C:\Users\jakub_000\Desktop\RSITx64.exe => Moved successfully.
"C:\ProgramData\d2d4a9d3-f3f1-4c52-8d3f-dddc91fe0602" => File/Directory not found.
C:\Program Files (x86)\Positive Finds => Moved successfully.
C:\AdwCleaner => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{04D80486-4E01-4E69-BBB0-47CD6652E183}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{04D80486-4E01-4E69-BBB0-47CD6652E183}" => Key deleted successfully.
C:\Windows\System32\Tasks\{02ABBAF8-1A38-4A9A-8227-317BF9DFE300} => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{02ABBAF8-1A38-4A9A-8227-317BF9DFE300}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{191AB24B-EF31-4DCD-B6FC-8BE9902F0897}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{191AB24B-EF31-4DCD-B6FC-8BE9902F0897}" => Key deleted successfully.
C:\Windows\System32\Tasks\{59A35D4D-D0BB-479F-94E9-5962E7029025} => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{59A35D4D-D0BB-479F-94E9-5962E7029025}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{4C2CF6B3-52E4-47C9-AED3-A64F8D9D4053}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{4C2CF6B3-52E4-47C9-AED3-A64F8D9D4053}" => Key deleted successfully.
C:\Windows\System32\Tasks\{911DDACA-D000-4568-A8BD-0A99202F5C37} => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{911DDACA-D000-4568-A8BD-0A99202F5C37}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{7C3AF094-0295-4EFB-BF02-5F5A5E8E8586}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{7C3AF094-0295-4EFB-BF02-5F5A5E8E8586}" => Key deleted successfully.
C:\Windows\System32\Tasks\{0E77C26D-9871-4077-B385-28303FCB630C} => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{0E77C26D-9871-4077-B385-28303FCB630C}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{E027EFE1-91D8-4F24-A4B1-72D68D6814FE}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{E027EFE1-91D8-4F24-A4B1-72D68D6814FE}" => Key deleted successfully.
C:\Windows\System32\Tasks\{AAF4BBEF-2237-4E08-8CD4-21FB80651298} => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{AAF4BBEF-2237-4E08-8CD4-21FB80651298}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{F3C88C6F-E049-478E-9CCD-0F37494CA257}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{F3C88C6F-E049-478E-9CCD-0F37494CA257}" => Key deleted successfully.
C:\Windows\System32\Tasks\{27DC3E27-6A9B-43FC-8717-845FAB0095A4} => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{27DC3E27-6A9B-43FC-8717-845FAB0095A4}" => Key deleted successfully.
EmptyTemp: => Removed 577.2 MB temporary data.


The system needed a reboot.

==== End of Fixlog 22:30:56 ====
Nahoru
altrok
Moderátor
Moderátor
Příspěvky: 7328
Registrován: 15 Lis 2012 22:26
Místo/Bydliště: Znojmo

Re: Positive add problém přetrvává

#8 Příspěvek od altrok »

OK, pozorujte chovani PC, vyskakovani reklam apod.

Pripadne uz jen uklidime.
Pokud je cokoliv nejasného, ihned se ptej.
V případě spokojenosti prosím podpořte forum.
Pro dotazy, které se nehodí na forum, je možné využít altrokzavináčforum.viry.cz
Máš-li chuť pomáhat návštěvníkům tohoto fora, přihlas se do naší školičky.
Nahoru
papperwing
Návštěvník
Návštěvník
Příspěvky: 139
Registrován: 13 Bře 2013 20:34

Re: Positive add problém přetrvává

#9 Příspěvek od papperwing »

Zatím to vypadá dobře. Reklamy nevyskakují a v mozile už mi mezi addonama nevyskakuje.

Děkuji moc za pomoc.
Nahoru
altrok
Moderátor
Moderátor
Příspěvky: 7328
Registrován: 15 Lis 2012 22:26
Místo/Bydliště: Znojmo

Re: Positive add problém přetrvává

#10 Příspěvek od altrok »

Takze jeste uklidime.
A pokud nejsou dotazy ci jine problemy, je to ode mne vse.
Pokud je cokoliv nejasného, ihned se ptej.
V případě spokojenosti prosím podpořte forum.
Pro dotazy, které se nehodí na forum, je možné využít altrokzavináčforum.viry.cz
Máš-li chuť pomáhat návštěvníkům tohoto fora, přihlas se do naší školičky.
Nahoru
papperwing
Návštěvník
Návštěvník
Příspěvky: 139
Registrován: 13 Bře 2013 20:34

Re: Positive add problém přetrvává

#11 Příspěvek od papperwing »

Děkuji moc, zde zasílám ještě log:
# DelFix v10.8 - Logfile created 11/02/2015 at 13:01:02
# Updated 29/07/2014 by Xplode
# Username : jakub_000 - PAPPERPOST
# Operating System : Windows 8 Pro (64 bits)

~ Removing disinfection tools ...

Deleted : C:\_OTM
Deleted : C:\RSIT
Deleted : C:\FRST
Deleted : C:\AdwCleaner[R1].txt
Deleted : C:\AdwCleaner[S1].txt
Deleted : C:\Users\jakub_000\Desktop\Addition.txt
Deleted : C:\Users\jakub_000\Desktop\adwcleaner_3.310.exe
Deleted : C:\Users\jakub_000\Desktop\Fixlog.txt
Deleted : C:\Users\jakub_000\Desktop\FRST64.exe
Deleted : C:\Users\jakub_000\Desktop\OTM.exe
Deleted : HKLM\SOFTWARE\OldTimer Tools
Deleted : HKLM\SOFTWARE\AdwCleaner
Deleted : HKLM\SOFTWARE\TrendMicro\Hijackthis

########## - EOF - ##########
Nahoru
altrok
Moderátor
Moderátor
Příspěvky: 7328
Registrován: 15 Lis 2012 22:26
Místo/Bydliště: Znojmo

Re: Positive add problém přetrvává

#12 Příspěvek od altrok »

Tento soubor ( C:\delfix.txt ) muzete rucne smazat stejne jako pripadne zbytky po utilitach.

Nemate zac, rad jsem pomohl :worship:


Mejte se krasne a treba zase nekdy :bye:
Pokud je cokoliv nejasného, ihned se ptej.
V případě spokojenosti prosím podpořte forum.
Pro dotazy, které se nehodí na forum, je možné využít altrokzavináčforum.viry.cz
Máš-li chuť pomáhat návštěvníkům tohoto fora, přihlas se do naší školičky.
Nahoru
Zamčeno

Vrátit se na „Řešení problémů, logy“