Vyplo mi prehliadac, v spravcovi uloh bol podozrivy proces

Zpráva

totti962806 · #1 Příspěvek od **totti962806** » 04 čer 2015 11:59

Zdravim, mam podozrenie ze mam v PC isty druh virusu. Dneska som mal zapnutu mozillu a z nicoho nic ju vyplo a nasledne vyhodilo asi 2 alebo 3krat za sebou command prompt ale hned ho vyplo. Ked som pozrel v spravcovi uloh bezali tam dva procesy, ktore mali nazov iba z nahodnych cislic nasledne jeden zmizol a objavil sa dalsi a znova zmizol a ostal tam len jeden. Ked som dal otvorit umiestnenie suboru otvorilo mi zlozku AppData\Local\Temp a v nej okrem beznych suborov bolo mnozstvo inych, ktore mali nazvy z nahodnych cislic a pismen.

Obrázek

Virus sa mi mohol nainstalovat ked som instaloval jeden torrent downloader a spolu s nim mi nainstalovalo dost vela plug-in-ov do prehliadaca, ktore mi zmenili domovsku stranku ako aj vyhladavaci nastroj a ine, tie som odinstaloval ale asi nie uplne.

Log z RSIT-u mi nejde pridat, pretoze sprava prekroci max pocet znakov.

Vdaka za kazdu radu.

totti962806 · #2 Příspěvek od **totti962806** » 04 čer 2015 12:04

tu je log:

http://www.upnito.sk/subor/1c346d4982cb ... 80c99.html

totti962806 · #3 Příspěvek od **totti962806** » 04 čer 2015 12:30

Tu je log z AdwCleaner-u:

# AdwCleaner v4.206 - Log vytvorený 04/06/2015 at 13:17:49
# Aktualizované 01/06/2015 by Xplode
# Databáza : 2015-06-01.1 [Server]
# Operačný systém : Windows 7 Professional N Service Pack 1 (x64)
# Uživateľské meno : Mato - MATO-PC
# Spustené z : C:\Users\Mato\Desktop\adwcleaner_4.206.exe
# Nastavenia : Čistenie

***** [ Služby ] *****

[#] Služba Zmazané : WindowsMangerProtect

***** [ Súbory / Priečinky ] *****

Priečinok Zmazané : C:\ProgramData\WindowsMangerProtect
Priečinok Zmazané : C:\ProgramData\IHProtectUpDate
Priečinok Zmazané : C:\ProgramData\598caff4000020a7
Priečinok Zmazané : C:\ProgramData\{72bf4786-6de5-05fa-72bf-f47866de1e19}
Priečinok Zmazané : C:\ProgramData\{cf024a35-2778-fa02-cf02-24a3527728d4}
Priečinok Zmazané : C:\Users\Mato\AppData\Local\globalUpdate
Priečinok Zmazané : C:\Users\Mato\AppData\Roaming\{D2020D47-707D-4E26-B4D9-739C4F4C2E9A}
Priečinok Zmazané : C:\Users\Mato\AppData\Roaming\Mozilla\Firefox\Profiles\lzvsh8f9.default\Extensions\mnahjyiibogdqka@koccuxuiefpc_ruaqp.edu
Súbor Zmazané : C:\Program Files (x86)\mozilla firefox\dbghelp.dll
Súbor Zmazané : C:\Users\Mato\AppData\Roaming\BYAIAMUF
Súbor Zmazané : C:\Users\Mato\AppData\Roaming\BYAIAMUF.exe
Súbor Zmazané : C:\Users\Mato\AppData\Roaming\GNOK
Súbor Zmazané : C:\Users\Mato\AppData\Roaming\GNOK.exe
Súbor Zmazané : C:\Users\Mato\AppData\Roaming\Mozilla\Firefox\Profiles\lzvsh8f9.default\user.js

***** [ Naplánované úlohy ] *****

Úloha Zmazané : amiupdaterExd
Úloha Zmazané : amiupdaterExi
Úloha Zmazané : BYAIAMUF
Úloha Zmazané : GNOK

***** [ Zástupcovia ] *****

***** [ Registre ] *****

Hodnota Zmazané : HKLM\SOFTWARE\Mozilla\Firefox\Extensions [sweetsearch@gmail.com]
Hodnota Zmazané : HKLM\SOFTWARE\Mozilla\Firefox\Extensions [searchffv2@gmail.com]
Kľúč registra Zmazané : HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Application\WindowsMangerProtect
Kľúč registra Zmazané : HKCU\Software\Mozilla\Extends
Kľúč registra Zmazané : HKLM\SOFTWARE\Classes\AppID\Gamble32.DLL
Kľúč registra Zmazané : HKLM\SOFTWARE\82cff653-e9ab-6d33-39c2-0a54f0fef481
Kľúč registra Zmazané : HKLM\SOFTWARE\Classes\AppID\{425F4ABF-B8E4-402D-9E49-06E494EB8DBF}
Kľúč registra Zmazané : HKLM\SOFTWARE\Classes\AppID\{5781F5E2-21D8-419B-9633-298383F578E8}
Kľúč registra Zmazané : HKLM\SOFTWARE\Classes\CLSID\{7D8DAE88-BC05-4578-8C29-E541FFBA5757}
Kľúč registra Zmazané : HKLM\SOFTWARE\Classes\Interface\{E4C3E50F-5761-4BF8-95A0-939A819DF1C3}
Kľúč registra Zmazané : HKLM\SOFTWARE\Classes\Interface\{A9582D7B-F24A-441D-9D26-450D58F3CD17}
Kľúč registra Zmazané : HKLM\SOFTWARE\Classes\Interface\{EE0D8859-2ED4-4B0D-9812-16865B9AFD65}
Kľúč registra Zmazané : HKLM\SOFTWARE\Classes\TypeLib\{9AE7A6AE-162E-44C4-9A2B-A6B4EF19909D}
Kľúč registra Zmazané : HKLM\SOFTWARE\Classes\TypeLib\{14EF423E-3EE8-44AE-9337-07AC3F27B744}
Kľúč registra Zmazané : HKLM\SOFTWARE\Classes\TypeLib\{33B8CF8E-1B37-40DD-A652-F97EDFCA9565}
Kľúč registra Zmazané : HKLM\SOFTWARE\Classes\TypeLib\{CBD6173B-4061-4104-BF2F-C8E81389DB27}
Kľúč registra Zmazané : [x64] HKLM\SOFTWARE\Classes\Interface\{E4C3E50F-5761-4BF8-95A0-939A819DF1C3}
Kľúč registra Zmazané : [x64] HKLM\SOFTWARE\Classes\Interface\{A9582D7B-F24A-441D-9D26-450D58F3CD17}
Kľúč registra Zmazané : [x64] HKLM\SOFTWARE\Classes\Interface\{EE0D8859-2ED4-4B0D-9812-16865B9AFD65}
Kľúč registra Zmazané : [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{2023ECEC-E06A-4372-A1C7-0B49F9E0FFF0}
Dáta Obnovené : HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\IEXPLORE.EXE\shell\open\command
Kľúč registra Zmazané : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}
Kľúč registra Zmazané : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}
Kľúč registra Zmazané : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{E733165D-CBCF-4FDA-883E-ADEF965B476C}
Kľúč registra Zmazané : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}
Kľúč registra Zmazané : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}
Kľúč registra Zmazané : HKCU\Software\APN PIP
Kľúč registra Zmazané : HKCU\Software\Crossrider
Kľúč registra Zmazané : HKCU\Software\GlobalUpdate
Kľúč registra Zmazané : HKCU\Software\HomeTab
Kľúč registra Zmazané : HKCU\Software\simplytech
Kľúč registra Zmazané : HKCU\Software\TNT2
Kľúč registra Zmazané : HKCU\Software\WajIntEnhance
Kľúč registra Zmazané : HKCU\Software\SearchProtectWS
Kľúč registra Zmazané : HKCU\Software\Linkey
Kľúč registra Zmazané : HKCU\Software\{A7FC5860-2A3A-4554-AFB1-C7F4DD432693}
Kľúč registra Zmazané : HKLM\SOFTWARE\{3A7D3E19-1B79-4E4E-BD96-5467DA2C4EF0}
Kľúč registra Zmazané : HKLM\SOFTWARE\AskPartnerNetwork
Kľúč registra Zmazané : HKLM\SOFTWARE\Conduit
Kľúč registra Zmazané : HKLM\SOFTWARE\Crossrider
Kľúč registra Zmazané : HKLM\SOFTWARE\GlobalUpdate
Kľúč registra Zmazané : HKLM\SOFTWARE\Iminent
Kľúč registra Zmazané : HKLM\SOFTWARE\SearchProtect
Kľúč registra Zmazané : HKLM\SOFTWARE\SupDp
Kľúč registra Zmazané : HKLM\SOFTWARE\SupTab
Kľúč registra Zmazané : HKLM\SOFTWARE\supWindowsMangerProtect
Kľúč registra Zmazané : HKLM\SOFTWARE\IHProtect
Kľúč registra Zmazané : HKLM\SOFTWARE\{12A61307-94CD-4F8E-94BC-918E511FAA81}
Kľúč registra Zmazané : HKLM\SOFTWARE\WajIntEnhance
Kľúč registra Zmazané : HKLM\SOFTWARE\SpeedBit
Kľúč registra Zmazané : HKLM\SOFTWARE\AIM Toolbar
Kľúč registra Zmazané : HKLM\SOFTWARE\oursurfingSoftware
Kľúč registra Zmazané : HKLM\SOFTWARE\FFPluginHp
Kľúč registra Zmazané : HKU\.DEFAULT\Software\{A7FC5860-2A3A-4554-AFB1-C7F4DD432693}
Kľúč registra Zmazané : HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\IMBoosterARP
Kľúč registra Zmazané : HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\IminentToolbar
Kľúč registra Zmazané : HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\SearchProtect
Kľúč registra Zmazané : HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\WajIntEnhance
Kľúč registra Zmazané : HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\Vosteran.com
Kľúč registra Zmazané : HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\Linkey
Kľúč registra Zmazané : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IMBoosterARP
Kľúč registra Zmazané : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IminentToolbar
Kľúč registra Zmazané : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SearchProtect
Kľúč registra Zmazané : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WajIntEnhance
Kľúč registra Zmazané : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Vosteran.com
Kľúč registra Zmazané : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Linkey
Kľúč registra Zmazané : HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\oursurfing.com

***** [ Webové prehliadače ] *****

-\\ Internet Explorer v11.0.9600.17801

Nastavenie Obnovené : HKCU\Software\Microsoft\Internet Explorer\Main [Search Page]
Nastavenie Obnovené : HKCU\Software\Microsoft\Internet Explorer\Main [Default_Page_URL]
Nastavenie Obnovené : HKCU\Software\Microsoft\Internet Explorer\Main [Default_Search_URL]
Nastavenie Obnovené : HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Start Page]
Nastavenie Obnovené : HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Default_Search_URL]
Nastavenie Obnovené : HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Default_Page_URL]
Nastavenie Obnovené : HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Search Page]
Nastavenie Obnovené : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Start Page]
Nastavenie Obnovené : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Default_Search_URL]
Nastavenie Obnovené : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Default_Page_URL]
Nastavenie Obnovené : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Search Page]

-\\ Mozilla Firefox v38.0.1 (x86 sk)

[lzvsh8f9.default\prefs.js] - Riadok Zmazané : user_pref("browser.search.searchengine.iconURL", "hxxp://www.oursurfing.com/web/favicon.ico");
[lzvsh8f9.default\prefs.js] - Riadok Zmazané : user_pref("extensions.crossrider.bic", "14d9a178fabf1c94806c3d09420f5f15");
[lzvsh8f9.default\prefs.js] - Riadok Zmazané : user_pref("extensions.dPwUzsosMNXcMMVm.scode", "(function(){try{if(window.location.href.indexOf(\"rjaEpds4pdgEqjY6rjnGpdUHqa\")>-1){return;}}catch(e){}try{var d=[[\"investkingdom.com\",\"www.viracure.[...]
[lzvsh8f9.default\prefs.js] - Riadok Zmazané : user_pref("extensions.mifEC4VFNZATJF4e.scode", "(function(){try{if(window.location.href.indexOf(\"rjaEpds4pdgEqjY6rjnGpdUHqa\")>-1){return;}}catch(e){}try{var d=[[\"investkingdom.com\",\"www.viracure.[...]
[lzvsh8f9.default\prefs.js] - Riadok Zmazané : user_pref("extensions.quick_start.enable_search1", false);
[lzvsh8f9.default\prefs.js] - Riadok Zmazané : user_pref("extensions.quick_start.sd.closeWindowWithLastTab_prev_state", false);

*************************

AdwCleaner[R0].txt - [12731 bajtov] - [04/06/2015 13:17:13]
AdwCleaner[S0].txt - [9133 bajtov] - [04/06/2015 13:17:49]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [9193 bajtov] ##########

A tu je log z Zoek-u:

Zoek.exe v5.0.0.0 Updated 04-May-2015
Tool run by Mato on çt 04. 06. 2015 at 13:19:48,54.
Microsoft Windows 7 Professional N 6.1.7601 Service Pack 1 x64
Running in: Normal Mode Internet Access Detected
Launched: C:\Users\Mato\Desktop\zoek.exe [Scan all users] [Script inserted]

==== System Restore Info ======================

4. 6. 2015 13:20:04 Zoek.exe System Restore Point Created Successfully.

==== Reset Hosts File ======================

# Copyright (c) 1993-2006 Microsoft Corp.
#
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
#
# This file contains the mappings of IP addresses to host names. Each
# entry should be kept on an individual line. The IP address should
# be placed in the first column followed by the corresponding host name.
# The IP address and the host name should be separated by at least one
# space.
#
# Additionally, comments (such as these) may be inserted on individual
# lines or following the machine name denoted by a '#' symbol.
#
# For example:
#
# 102.54.94.97 rhino.acme.com # source server
# 38.25.63.10 x.acme.com # x client host

# localhost name resolution is handled within DNS itself.
127.0.0.1 localhost
::1 localhost

==== Empty Folders Check ======================

C:\PROGRA~2\COMMON~1\Blizzard Entertainment deleted successfully
C:\Users\Mato\AppData\Local\VirtualStore deleted successfully

==== Deleting CLSID Registry Keys ======================

==== Deleting CLSID Registry Values ======================

HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Approved Extensions\{3C2C21F7-FDB6-4b10-B605-FA4A281E3016} deleted successfully
HKEY_USERS\S-1-5-19\Software\Microsoft\Internet Explorer\Approved Extensions\{3C2C21F7-FDB6-4b10-B605-FA4A281E3016} deleted successfully
HKEY_USERS\S-1-5-20\Software\Microsoft\Internet Explorer\Approved Extensions\{3C2C21F7-FDB6-4b10-B605-FA4A281E3016} deleted successfully
HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\{3C2C21F7-FDB6-4b10-B605-FA4A281E3016} deleted successfully
HKEY_LOCAL_MACHINE\software\Wow6432Node\mozilla\Firefox\extensions\{3C2C21F7-FDB6-4b10-B605-FA4A281E3016} deleted successfully

==== Deleting Services ======================

==== FireFox Fix ======================

Deleted from C:\Users\Mato\AppData\Roaming\Mozilla\Firefox\Profiles\lzvsh8f9.default\prefs.js:
user_pref("browser.startup.homepage", "https://www.google.sk/");
user_pref("browser.search.selectedEngine", "Google");
user_pref("browser.search.useDBForOrder", true);

Added to C:\Users\Mato\AppData\Roaming\Mozilla\Firefox\Profiles\lzvsh8f9.default\prefs.js:
user_pref("browser.startup.homepage", "about:home");
user_pref("browser.newtab.url", "about:newtab");

ProfilePath: C:\Users\Mato\AppData\Roaming\Mozilla\Firefox\Profiles\lzvsh8f9.default

user.js not found
---- Lines {3C2C21F7-FDB6-4b10-B605-FA4A281E3016} removed from prefs.js ----
user_pref("{3C2C21F7-FDB6-4b10-B605-FA4A281E3016}.extensionFirstRun", false);
user_pref("{3C2C21F7-FDB6-4b10-B605-FA4A281E3016}.lastExtensionVersion", "2.0.0.458");
user_pref("{3C2C21F7-FDB6-4b10-B605-FA4A281E3016}.ScriptData_install_time", "28-05-2015");
user_pref("{3C2C21F7-FDB6-4b10-B605-FA4A281E3016}.ScriptData_installer_name", "vbates_amntrwex-00-12186_.exe");
user_pref("{3C2C21F7-FDB6-4b10-B605-FA4A281E3016}.ScriptData_product_name", "shopper-z");
user_pref("{3C2C21F7-FDB6-4b10-B605-FA4A281E3016}.ScriptData_product_version", "2.0.0.458");
user_pref("{3C2C21F7-FDB6-4b10-B605-FA4A281E3016}.ScriptData_pxl_VBATES_dailyPing", "dailyPing|||1432895759153");
user_pref("{3C2C21F7-FDB6-4b10-B605-FA4A281E3016}.ScriptData_temp_installer_name", "vbates_amntrwex-00-12186_.exe");
user_pref("{3C2C21F7-FDB6-4b10-B605-FA4A281E3016}.ScriptData_temp_version", "2.0.0.458|||8641432809344922");
user_pref("{3C2C21F7-FDB6-4b10-B605-FA4A281E3016}.ScriptData_toolbarID", "a049dd4563bb4de983bab4b86f3d7584");
user_pref("{3C2C21F7-FDB6-4b10-B605-FA4A281E3016}.ScriptData_VBATES_executeCode", "not set");
user_pref("{3C2C21F7-FDB6-4b10-B605-FA4A281E3016}.ScriptData_VBATES_ga_redirected", "not set");
user_pref("{3C2C21F7-FDB6-4b10-B605-FA4A281E3016}.ScriptData_VBATES_ga_redirectedUrl", "not set");
user_pref("{3C2C21F7-FDB6-4b10-B605-FA4A281E3016}.ScriptData_VBATES_lastUpdate", "1432809356908|||8641432809356909");
user_pref("{3C2C21F7-FDB6-4b10-B605-FA4A281E3016}.ScriptData_VBATES_redirectURL", "|||8641432809357730");
user_pref("{3C2C21F7-FDB6-4b10-B605-FA4A281E3016}.ScriptData_VBATES_referer", "|||8641432809357730");
user_pref("{3C2C21F7-FDB6-4b10-B605-FA4A281E3016}.ScriptData_VBATES_status", "active");
user_pref("{3C2C21F7-FDB6-4b10-B605-FA4A281E3016}.ScriptData_VBATES_whiteList", "{}|||8641432809357730");
user_pref("{3C2C21F7-FDB6-4b10-B605-FA4A281E3016}.ScriptData_vbts_geo", "not set");
user_pref("{3C2C21F7-FDB6-4b10-B605-FA4A281E3016}.setdefaultsearch_2.0.0.458", false);
user_pref("{3C2C21F7-FDB6-4b10-B605-FA4A281E3016}.setdnscatch_2.0.0.458", false);
user_pref("{3C2C21F7-FDB6-4b10-B605-FA4A281E3016}.sethomepage_2.0.0.458", false);
user_pref("{3C2C21F7-FDB6-4b10-B605-FA4A281E3016}.setndsvalue_2.0.0.458", false);
---- Lines extensions.dPwUzsosMNXcMMVm removed from prefs.js ----
user_pref("extensions.dPwUzsosMNXcMMVm.epoch", "1433499776");
user_pref("extensions.dPwUzsosMNXcMMVm.url", "http://systemocean.info/sync2/?q=hfZ9of ... TaEqShIC7n
---- Lines extensions.mifEC4VFNZATJF4e removed from prefs.js ----
user_pref("extensions.mifEC4VFNZATJF4e.epoch", "1432894898");
user_pref("extensions.mifEC4VFNZATJF4e.url", "http://jobfirstall.in/sync2/?q=hfZ9oemM ... EtMFHhd9Fq
---- FireFox user.js and prefs.js backups ----

prefs_201504.06._1324_.backup

==== Deleting Files \ Folders ======================

C:\windows\SysNative\Tasks\Bidaily Synchronize Task[d492] deleted
C:\windows\SysNative\Tasks\ContradeAccess deleted
C:\PROGRA~3\10638587597303296040 deleted
C:\Users\Mato\AppData\Roaming\Company deleted
C:\PROGRA~3\Package Cache deleted
C:\Users\Mato\AppData\LocalLow\Company deleted
C:\Windows\SysNative\config\systemprofile\Searches deleted
C:\Users\Mato\AppData\Roaming\Mozilla\Firefox\Profiles\lzvsh8f9.default\extensions\staged deleted

==== Firefox Start and Search pages ======================

ProfilePath: C:\Users\Mato\AppData\Roaming\Mozilla\Firefox\Profiles\lzvsh8f9.default
user_pref("browser.startup.homepage", "about:home");
user_pref("browser.newtab.url", "about:newtab");

==== Firefox Extensions ======================

AppDir: C:\Program Files (x86)\Mozilla Firefox
- Default - %AppDir%\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

==== Firefox Plugins ======================

Profilepath: C:\Users\Mato\AppData\Roaming\Mozilla\Firefox\Profiles\lzvsh8f9.default
2E661988463BCFA1B95D4DAAB9B0B6FA - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_17_0_0_188.dll - Shockwave Flash

==== Set IE to Default ======================

Old Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"="http://www.google.sk/"
"Search Page"="http://www.google.com"
"Default_Page_URL"="http://www.google.com"
"Default_Search_URL"="http://www.google.com"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
"Start Page"="http://www.google.com"
"Default_Search_URL"="http://www.google.com"
"Default_Page_URL"="http://www.google.com"
"Search Page"="http://www.google.com"
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main]
"Start Page"="http://www.google.com"
"Default_Search_URL"="http://www.google.com"
"Default_Page_URL"="http://www.google.com"
"Search Page"="http://www.google.com"

New Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Search Page"="http://go.microsoft.com/fwlink/?LinkId=54896"
"Default_Search_URL"="http://go.microsoft.com/fwlink/?LinkId=54896"
"Default_Page_URL"="http://go.microsoft.com/fwlink/?LinkId=69157"
"Start Page"="http://www.google.sk/"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
"Default_Search_URL"="http://go.microsoft.com/fwlink/?LinkId=54896"
"Search Page"="http://go.microsoft.com/fwlink/?LinkId=54896"
"Start Page"="http://go.microsoft.com/fwlink/?LinkId=69157"
"Default_Page_URL"="http://go.microsoft.com/fwlink/?LinkId=69157"
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main]
"Default_Search_URL"="http://go.microsoft.com/fwlink/?LinkId=54896"
"Search Page"="http://go.microsoft.com/fwlink/?LinkId=54896"
"Start Page"="http://go.microsoft.com/fwlink/?LinkId=69157"
"Default_Page_URL"="http://go.microsoft.com/fwlink/?LinkId=69157"

==== All HKCU SearchScopes ======================

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes
"DefaultScope"="{0633EE93-D776-472f-A0FF-E1416B8B2E3A}"
{012E1000-F331-11DB-8314-0800200C9A66} Google Url="http://www.google.com/search?q={searchTerms}"
{0633EE93-D776-472f-A0FF-E1416B8B2E3A} Bing Url="http://www.bing.com/search?q={searchTer ... ORM=IE8SRC"

==== Reset Google Chrome ======================

Nothing found to reset

==== Empty IE Cache ======================

C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\Mato\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\Mato\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5 emptied successfully
C:\Users\Mato\AppData\Local\Temp\acro_rd_dir\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\SysNative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\sysWoW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\sysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully

==== Empty FireFox Cache ======================

C:\Users\Mato\AppData\Local\Mozilla\Firefox\Profiles\lzvsh8f9.default\cache2 emptied successfully

==== Empty Chrome Cache ======================

No Chrome User Data found

==== Empty All Flash Cache ======================

Flash Cache Emptied Successfully

==== Empty All Java Cache ======================

Java Cache cleared successfully

==== C:\zoek_backup content ======================

C:\zoek_backup (files=20 folders=13 3067800 bytes)

==== Empty Temp Folders ======================

C:\Users\Default\AppData\Local\Temp emptied successfully
C:\Users\Default User\AppData\Local\Temp emptied successfully
C:\Users\Mato\AppData\Local\Temp will be emptied at reboot
C:\Windows\serviceprofiles\networkservice\AppData\Local\Temp emptied successfully
C:\Windows\serviceprofiles\Localservice\AppData\Local\Temp emptied successfully
C:\Windows\Temp will be emptied at reboot

==== After Reboot ======================

==== Empty Temp Folders ======================

C:\Windows\Temp successfully emptied
C:\Users\Mato\AppData\Local\Temp successfully emptied

==== Empty Recycle Bin ======================

C:\$RECYCLE.BIN successfully emptied

==== EOF on çt 04. 06. 2015 at 13:26:25,52 ======================

Idem este vytvorit logy z RSIT-u a FRST-u

totti962806 · #4 Příspěvek od **totti962806** » 04 čer 2015 12:43

Tu je log z FRST-u + subor Addition.txt:

http://www.upnito.sk/subor/2e09fe931e35 ... 8d6b8.html

http://www.upnito.sk/subor/f99dca8b5876 ... 680a4.html

+Log z RSIT-u:

http://www.upnito.sk/subor/d3f843970454 ... 74630.html

totti962806 · #5 Příspěvek od **totti962806** » 04 čer 2015 13:11

Prve dva subory som vymazal, treti neexistoval ale boli tam 3 podobne no s inymi znakmi.

Tie dva subory v programdata neexistovali.

Problemy ale uz nie su, takze velka vdaka za pomoc a prajem prijemny den.

VIRY.CZ

Vyplo mi prehliadac, v spravcovi uloh bol podozrivy proces

Vyplo mi prehliadac, v spravcovi uloh bol podozrivy proces

Re: Vyplo mi prehliadac, v spravcovi uloh bol podozrivy proc

Re: Vyplo mi prehliadac, v spravcovi uloh bol podozrivy proc

Re: Vyplo mi prehliadac, v spravcovi uloh bol podozrivy proc

Re: Vyplo mi prehliadac, v spravcovi uloh bol podozrivy proc