Addcash

[mifoIV]

Dobrý deň, poslednú dobu ma pri prechádzaní internetu, oddane sprevádza reklama addcah-u. Takmer po každom kliknutí na lubovolné stránky.

Logfile of random's system information tool 1.10 (written by random/random)
Run by admin at 2015-07-20 11:07:26
Microsoft® Windows Vista™ Home Premium Service Pack 2
System drive C: has 36 GB (48%) free of 76 GB
Total RAM: 2939 MB (49% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 11:07:38, on 20. 7. 2015
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Internet Explorer v9.00 (9.00.8112.16669)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Windows\RtHDVCpl.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\System32\igfxpers.exe
C:\Program Files\Toshiba\Power Saver\TPwrMain.exe
C:\Windows\system32\igfxsrvc.exe
C:\Program Files\Toshiba\SmoothView\SmoothView.exe
C:\Program Files\Toshiba\FlashCards\TCrdMain.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Client Software-4000(v2.0)\NetAppSoft.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
C:\Program Files\CCleaner\CCleaner.exe
C:\Program Files\CCleaner\CCleaner.exe
C:\Users\admin\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\admin\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\admin\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\admin\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Windows\system32\conime.exe
C:\Program Files\AVAST Software\Avast\ng\ngtool.exe
C:\Program Files\AVAST Software\Avast\avastUi.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\AVAST Software\Avast\ng\ngtool.exe
C:\Users\admin\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Users\admin\Downloads\RSIT.exe
C:\Program Files\trend micro\admin.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://go.microsoft.com/fwlink/?linkid=54896
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.sk/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://fr.msn.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: (no name) - - (no file)
O1 - Hosts: ˙ţ127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2 - BHO: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [TPwrMain] %ProgramFiles%\TOSHIBA\Power Saver\TPwrMain.EXE
O4 - HKLM\..\Run: [HSON] %ProgramFiles%\TOSHIBA\TBS\HSON.exe
O4 - HKLM\..\Run: [SmoothView] %ProgramFiles%\Toshiba\SmoothView\SmoothView.exe
O4 - HKLM\..\Run: [00TCrdMain] %ProgramFiles%\TOSHIBA\FlashCards\TCrdMain.exe
O4 - HKLM\..\Run: [Skytel] Skytel.exe
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [AvastUI.exe] "C:\Program Files\AVAST Software\Avast\AvastUI.exe" /nogui
O4 - HKCU\..\Run: [Google Update] "C:\Users\admin\AppData\Local\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [CCleaner Monitoring] "C:\Program Files\CCleaner\CCleaner.exe" /MONITOR
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - Startup: Client Software-4000(v2.0).lnk = C:\Program Files\Client Software-4000(v2.0)\NetAppSoft.exe
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O16 - DPF: {62789780-B744-11D0-986B-00609731A21D} (Autodesk MapGuide ActiveX Control) - http://195.28.70.134/kapor2/lib/mgaxctrl.cab
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\Windows\system32\browseui.dll
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - Agere Systems - C:\Windows\system32\agrsmsvc.exe
O23 - Service: Avast Antivirus (avast! Antivirus) - AVAST Software - C:\Program Files\AVAST Software\Avast\AvastSvc.exe
O23 - Service: AvastVBox COM Service (AvastVBoxSvc) - Avast Software - C:\Program Files\AVAST Software\Avast\ng\vbox\AvastVBoxSVC.exe
O23 - Service: ConfigFree Service - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
O23 - Service: FABS - Helping agent for MAGIX media database (Fabs) - MAGIX AG - C:\Program Files\Common Files\MAGIX Services\Database\bin\FABS.exe
O23 - Service: Firebird Server - MAGIX Instance (FirebirdServerMAGIXInstance) - MAGIX® - C:\Program Files\Common Files\MAGIX Services\Database\bin\fbserver.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: lxcc_device - Lexmark International, Inc. - C:\Windows\system32\lxcccoms.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies, Inc. - C:\Program Files\WinPcap\rpcapd.exe
O23 - Service: Skype Updater (SkypeUpdate) - Skype Technologies - C:\Program Files\Skype\Updater\Updater.exe
O23 - Service: SmartFaceVWatchSrv - Toshiba - C:\Program Files\Toshiba\SmartFaceV\SmartFaceVWatchSrv.exe
O23 - Service: TeamViewer 10 (TeamViewer) - TeamViewer GmbH - C:\Program Files\TeamViewer\TeamViewer_Service.exe
O23 - Service: TOSHIBA Navi Support Service (TNaviSrv) - TOSHIBA Corporation - C:\Program Files\Toshiba\TOSHIBA DVD PLAYER\TNaviSrv.exe
O23 - Service: TOSHIBA Optical Disc Drive Service (TODDSrv) - TOSHIBA Corporation - C:\Windows\system32\TODDSrv.exe
O23 - Service: TOSHIBA Power Saver (TosCoSrv) - TOSHIBA Corporation - C:\Program Files\Toshiba\Power Saver\TosCoSrv.exe
O23 - Service: TOSHIBA SMART Log Service - TOSHIBA Corporation - C:\Program Files\TOSHIBA\SMARTLogService\TosIPCSrv.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe

--
End of file - 6701 bytes

======Scheduled tasks folder======

C:\Windows\tasks\Adobe Flash Player Updater.job - C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1034233192-1315924873-3047747250-1000Core.job - C:\Users\admin\AppData\Local\Google\Update\GoogleUpdate.exe /c
C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1034233192-1315924873-3047747250-1000UA.job - C:\Users\admin\AppData\Local\Google\Update\GoogleUpdate.exe /ua /installsource scheduler

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8E5E2654-AD2D-48bf-AC2D-D17F00898D06}]
avast! Online Security - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll [2015-07-20 559624]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"SynTPEnh"=C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2008-08-14 1348904]
"RtHDVCpl"=C:\Windows\RtHDVCpl.exe [2008-04-08 6037504]
"IgfxTray"=C:\Windows\system32\igfxtray.exe [2008-06-25 150040]
"HotKeysCmds"=C:\Windows\system32\hkcmd.exe [2008-06-25 170520]
"Persistence"=C:\Windows\system32\igfxpers.exe [2008-06-25 145944]
"TPwrMain"=C:\Program Files\TOSHIBA\Power Saver\TPwrMain.EXE [2008-01-17 431456]
"HSON"=C:\Program Files\TOSHIBA\TBS\HSON.exe [2007-10-31 54608]
"SmoothView"=C:\Program Files\Toshiba\SmoothView\SmoothView.exe [2008-01-25 509816]
"00TCrdMain"=C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe [2008-03-19 716800]
"Skytel"=C:\Windows\Skytel.exe [2007-11-20 1826816]
"Windows Defender"=C:\Program Files\Windows Defender\MSASCui.exe [2008-01-21 1008184]
"AvastUI.exe"=C:\Program Files\AVAST Software\Avast\AvastUI.exe [2015-07-20 6109776]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Google Update"=C:\Users\admin\AppData\Local\Google\Update\GoogleUpdate.exe [2014-10-17 107912]
"WMPNSCFG"=C:\Program Files\Windows Media Player\WMPNSCFG.exe [2008-01-21 202240]
"CCleaner Monitoring"=C:\Program Files\CCleaner\CCleaner.exe [2015-06-01 6405912]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CCleaner Monitoring]
C:\Program Files\CCleaner\CCleaner.exe [2015-06-01 6405912]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ehTray.exe]
C:\Windows\ehome\ehTray.exe [2008-01-21 125952]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Update]
C:\Users\admin\AppData\Local\Google\Update\GoogleUpdate.exe [2014-10-17 107912]

C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
Client Software-4000(v2.0).lnk - C:\Program Files\Client Software-4000(v2.0)\NetAppSoft.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
C:\Windows\system32\igfxdev.dll [2008-06-12 208896]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfPf]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfRd]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfPf]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfRd]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfUsbccidDriver]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
"EnableUIADesktopToggle"=0
"SoftwareSASGeneration"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveAutoRun"=0
"NoDriveTypeAutoRun"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"BindDirectlyToPropertySetStorage"=0
"NoDriveAutoRun"=0
"NoDriveTypeAutoRun"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.msadpcm"=msadp32.acm
"midimapper"=midimap.dll
"wavemapper"=msacm32.drv
"VIDC.UYVY"=msyuv.dll
"VIDC.YUY2"=msyuv.dll
"VIDC.YVYU"=msyuv.dll
"VIDC.IYUV"=iyuv_32.dll
"vidc.i420"=iyuv_32.dll
"VIDC.YVU9"=tsbyuv.dll
"msacm.l3acm"=C:\Windows\System32\l3codeca.acm
"vidc.cvid"=iccvid.dll
"MSVideo8"=VfWWDM32.dll
"msacm.dvacm"=C:\PROGRA~1\COMMON~1\ULEADS~1\vio\dvacm.acm
"VIDC.FFDS"=ff_vfw.dll
"vidc.XVID"=xvidvfw.dll
"msacm.ac3filter"=ac3filter.acm
"msacm.avis"=ff_acm.acm
"VIDC.FMVC"=fmcodec.dll
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv
"wave1"=wdmaud.drv
"midi1"=wdmaud.drv
"mixer1"=wdmaud.drv
"aux1"=wdmaud.drv

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*

======List of files/folders created in the last 1 month======

2015-07-20 11:07:27 ----D---- C:\Program Files\trend micro
2015-07-20 11:07:26 ----D---- C:\rsit
2015-07-20 11:00:26 ----D---- C:\Windows\system32\vbox
2015-07-20 10:58:54 ----D---- C:\Users\admin\AppData\Roaming\AVAST Software
2015-07-20 10:57:45 ----A---- C:\Windows\system32\drivers\aswF72D.tmp
2015-07-20 10:57:45 ----A---- C:\Windows\system32\drivers\aswF651.tmp
2015-07-20 10:57:45 ----A---- C:\Windows\system32\drivers\aswF547.tmp
2015-07-20 10:57:45 ----A---- C:\Windows\system32\drivers\aswF46C.tmp
2015-07-20 10:57:44 ----A---- C:\Windows\system32\drivers\aswF371.tmp
2015-07-20 10:57:44 ----A---- C:\Windows\system32\drivers\aswF17D.tmp
2015-07-20 10:57:10 ----A---- C:\Windows\system32\drivers\aswTdi.sys
2015-07-20 10:57:10 ----A---- C:\Windows\system32\drivers\aswStmXP.sys
2015-07-20 10:57:09 ----A---- C:\Windows\system32\drivers\ngvss.sys
2015-07-20 10:57:09 ----A---- C:\Windows\system32\drivers\aswSnx.sys
2015-07-20 10:56:53 ----A---- C:\Windows\avastSS.scr
2015-07-20 10:51:51 ----D---- C:\Program Files\AVAST Software
2015-07-20 10:50:19 ----D---- C:\ProgramData\AVAST Software
2015-07-15 21:31:36 ----A---- C:\Windows\system32\win32k.sys
2015-07-15 21:30:44 ----A---- C:\Windows\system32\ole32.dll
2015-07-15 21:29:40 ----A---- C:\Windows\system32\msiexec.exe
2015-07-15 21:29:40 ----A---- C:\Windows\system32\msi.dll
2015-07-15 21:29:11 ----A---- C:\Windows\system32\gdi32.dll
2015-07-15 21:20:46 ----A---- C:\Windows\system32\atmlib.dll
2015-07-15 21:20:46 ----A---- C:\Windows\system32\atmfd.dll
2015-07-15 21:19:36 ----A---- C:\Windows\system32\cewmdm.dll
2015-07-15 21:18:27 ----A---- C:\Windows\system32\msv1_0.dll
2015-07-15 21:18:27 ----A---- C:\Windows\system32\drivers\mrxsmb20.sys
2015-07-15 21:18:27 ----A---- C:\Windows\system32\drivers\mrxsmb10.sys
2015-07-15 21:18:27 ----A---- C:\Windows\system32\drivers\mrxsmb.sys
2015-07-15 21:18:22 ----A---- C:\Windows\system32\rpcrt4.dll
2015-07-15 21:18:22 ----A---- C:\Windows\system32\kerberos.dll
2015-07-15 21:18:22 ----A---- C:\Windows\system32\advapi32.dll
2015-07-15 21:18:21 ----A---- C:\Windows\system32\drivers\ksecdd.sys
2015-07-14 21:55:21 ----A---- C:\Windows\system32\mshtml.dll
2015-07-14 21:55:04 ----A---- C:\Windows\system32\mshta.exe
2015-07-14 21:55:04 ----A---- C:\Windows\system32\msfeedssync.exe
2015-07-14 21:55:04 ----A---- C:\Windows\system32\msfeedsbs.dll
2015-07-14 21:55:04 ----A---- C:\Windows\system32\jsproxy.dll
2015-07-14 21:55:04 ----A---- C:\Windows\system32\dxtmsft.dll
2015-07-14 21:55:03 ----A---- C:\Windows\system32\vbscript.dll
2015-07-14 21:55:03 ----A---- C:\Windows\system32\urlmon.dll
2015-07-14 21:55:03 ----A---- C:\Windows\system32\ieUnatt.exe
2015-07-14 21:55:03 ----A---- C:\Windows\system32\iertutil.dll
2015-07-14 21:55:01 ----A---- C:\Windows\system32\jscript.dll
2015-07-14 21:55:00 ----A---- C:\Windows\system32\wininet.dll
2015-07-14 21:55:00 ----A---- C:\Windows\system32\msfeeds.dll
2015-07-14 21:54:59 ----A---- C:\Windows\system32\url.dll
2015-07-14 21:54:59 ----A---- C:\Windows\system32\ieui.dll
2015-07-14 21:54:59 ----A---- C:\Windows\system32\dxtrans.dll
2015-07-14 21:54:58 ----A---- C:\Windows\system32\mshtmled.dll
2015-07-14 21:54:58 ----A---- C:\Windows\system32\jscript9.dll
2015-07-14 21:54:57 ----A---- C:\Windows\system32\ieframe.dll

======List of files/folders modified in the last 1 month======

2015-07-20 11:07:38 ----D---- C:\Windows\Prefetch
2015-07-20 11:07:33 ----D---- C:\Windows\Temp
2015-07-20 11:07:27 ----RD---- C:\Program Files
2015-07-20 11:03:58 ----SHD---- C:\$RECYCLE.BIN
2015-07-20 11:00:26 ----AD---- C:\Windows\System32
2015-07-20 10:58:14 ----D---- C:\Windows
2015-07-20 10:57:45 ----D---- C:\Windows\system32\drivers
2015-07-20 10:57:33 ----D---- C:\Windows\system32\Tasks
2015-07-20 10:57:08 ----D---- C:\Windows\winsxs
2015-07-20 10:52:36 ----SHD---- C:\Windows\Installer
2015-07-20 10:52:35 ----SHD---- C:\Config.Msi
2015-07-20 10:51:53 ----SHD---- C:\System Volume Information
2015-07-20 10:51:27 ----D---- C:\Windows\inf
2015-07-20 10:50:19 ----HD---- C:\ProgramData
2015-07-20 10:44:04 ----A---- C:\Windows\system32\PerfStringBackup.INI
2015-07-20 10:39:34 ----D---- C:\RecordFile
2015-07-20 07:49:14 ----D---- C:\Windows\Debug
2015-07-20 07:49:13 ----D---- C:\Windows\Minidump
2015-07-20 07:36:13 ----D---- C:\Program Files\CCleaner
2015-07-18 15:39:57 ----D---- C:\Windows\system32\catroot2
2015-07-16 22:32:28 ----D---- C:\Windows\Tasks
2015-07-15 21:54:10 ----A---- C:\Windows\system32\FlashPlayerApp.exe
2015-07-15 21:47:05 ----D---- C:\Windows\system32\migration
2015-07-15 21:47:05 ----D---- C:\Program Files\Internet Explorer
2015-07-15 21:31:45 ----D---- C:\Windows\system32\catroot
2015-07-15 21:29:09 ----D---- C:\Windows\system32\MRT
2015-07-05 12:11:18 ----N---- C:\Windows\system32\MpSigStub.exe
2015-07-03 08:49:12 ----A---- C:\Windows\system32\mrt.exe

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 iaStor;Intel AHCI Controller; C:\Windows\system32\DRIVERS\iaStor.sys [2008-04-15 312344]
R0 ngvss;ngvss; C:\Windows\system32\drivers\ngvss.sys [2015-07-20 95112]
R0 sptd;sptd; C:\Windows\System32\Drivers\sptd.sys [2009-12-12 691696]
R0 tos_sps32;TOSHIBA tos_sps32 Service; C:\Windows\system32\DRIVERS\tos_sps32.sys [2008-07-18 279376]
R0 TVALZ;TOSHIBA ACPI-Based Value Added Logical and General Purpose Device Driver; C:\Windows\system32\DRIVERS\TVALZ_O.SYS [2007-11-09 23640]
R1 aswSnx;aswSnx; C:\Windows\system32\drivers\aswSnx.sys [2015-07-20 788784]
R2 null_flt;null_flt; \??\C:\Windows\System32\Drivers\null_flt.sys [2009-11-12 4736]
R2 rimmptsk;rimmptsk; C:\Windows\system32\DRIVERS\rimmptsk.sys [2008-02-15 46592]
R2 rimsptsk;rimsptsk; C:\Windows\system32\DRIVERS\rimsptsk.sys [2007-07-30 43008]
R2 rismxdp;Ricoh xD-Picture Card Driver; C:\Windows\system32\DRIVERS\rixdptsk.sys [2007-07-30 38400]
R2 VBoxAswDrv;VBoxAsw Support Driver; \??\C:\Program Files\AVAST Software\Avast\ng\vbox\VBoxAswDrv.sys [2015-07-20 220752]
R3 AgereSoftModem;TOSHIBA V92 Software Modem; C:\Windows\system32\DRIVERS\AGRSM.sys [2006-11-28 1161888]
R3 aswStmXP;Avast StreamFilter Driver; C:\Windows\system32\drivers\aswStmXP.sys [2015-07-20 161472]
R3 aswTdi;aswTdi; C:\Windows\system32\drivers\aswTdi.sys [2015-07-20 57888]
R3 FwLnk;FwLnk Driver; C:\Windows\system32\DRIVERS\FwLnk.sys [2006-11-20 7168]
R3 igfx;igfx; C:\Windows\system32\DRIVERS\igdkmd32.sys [2008-06-12 2381312]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\Windows\system32\drivers\RTKVHDA.sys [2008-04-09 2095512]
R3 IntcHdmiAddService;Intel(R) High Definition Audio HDMI; C:\Windows\system32\drivers\IntcHdmi.sys [2008-06-20 112128]
R3 NETw5v32;Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 32 Bit; C:\Windows\system32\DRIVERS\NETw5v32.sys [2008-11-17 3668480]
R3 RTL8169;Realtek 8169 NT Driver; C:\Windows\system32\DRIVERS\Rtlh86.sys [2008-04-15 118784]
R3 sdbus;sdbus; C:\Windows\system32\DRIVERS\sdbus.sys [2009-04-11 89088]
R3 SynTP;Synaptics TouchPad Driver; C:\Windows\system32\DRIVERS\SynTP.sys [2008-08-14 203312]
R3 tdcmdpst;TOSHIBA Writing Engine Filter Driver; C:\Windows\system32\DRIVERS\tdcmdpst.sys [2006-10-18 16128]
R3 usbvideo;Chicony USB 2.0 Camera; C:\Windows\System32\Drivers\usbvideo.sys [2013-07-12 134272]
R3 UVCFTR;UVCFTR; C:\Windows\System32\Drivers\UVCFTR_S.SYS [2008-07-15 17960]
R3 WudfPf;@%SystemRoot%\system32\drivers\Wudfpf.sys,-1000; C:\Windows\system32\drivers\WudfPf.sys [2012-07-26 66560]
S3 dg_ssudbus;SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.); C:\Windows\system32\DRIVERS\ssudbus.sys [2013-06-04 84248]
S3 drmkaud;Microsoft Kernel DRM Audio Descrambler; C:\Windows\system32\drivers\drmkaud.sys [2008-01-21 5632]
S3 HdAudAddService;Microsoft 1.1 UAA Function Driver for High Definition Audio Service; C:\Windows\system32\drivers\HdAudio.sys [2006-11-02 235520]
S3 MSKSSRV;Microsoft Streaming Service Proxy; C:\Windows\system32\drivers\MSKSSRV.sys [2008-01-21 8192]
S3 MSPCLOCK;Microsoft Streaming Clock Proxy; C:\Windows\system32\drivers\MSPCLOCK.sys [2008-01-21 5888]
S3 MSPQM;Microsoft Streaming Quality Manager Proxy; C:\Windows\system32\drivers\MSPQM.sys [2008-01-21 5504]
S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink Converter; C:\Windows\system32\drivers\MSTEE.sys [2008-01-21 6016]
S3 Tosrfcom;Tosrfcom; C:\Windows\system32\drivers\Tosrfcom.sys []
S3 tosrfec;Bluetooth ACPI; C:\Windows\system32\DRIVERS\tosrfec.sys [2006-10-23 9216]
S3 usbbus;LGE Mobile Composite USB Device; C:\Windows\system32\DRIVERS\lgusbbus.sys [2008-11-11 13056]
S3 UsbDiag;LGE Mobile USB Serial Port; C:\Windows\system32\DRIVERS\lgusbdiag.sys [2008-11-11 19968]
S3 USBModem;LGE Mobile USB Modem; C:\Windows\system32\DRIVERS\lgusbmodem.sys [2008-11-11 24832]
S3 usbscan;USB Scanner Driver; C:\Windows\system32\DRIVERS\usbscan.sys [2013-07-03 35328]
S3 WinUSB;SAMSUNG Android USB Driver; C:\Windows\system32\DRIVERS\WinUSB.sys [2009-07-14 34944]
S3 WpdUsb;WpdUsb; C:\Windows\system32\DRIVERS\wpdusb.sys [2009-10-01 40448]
S3 WUDFRd;WUDFRd; C:\Windows\system32\DRIVERS\WUDFRd.sys [2012-07-26 155136]
S4 ErrDev;Microsoft Hardware Error Device Driver; C:\Windows\system32\drivers\errdev.sys [2008-01-21 6656]
S4 MegaSR;MegaSR; C:\Windows\system32\drivers\megasr.sys [2008-01-21 386616]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AgereModemAudio;Agere Modem Call Progress Audio; C:\Windows\system32\agrsmsvc.exe [2006-10-05 9216]
R2 avast! Antivirus;Avast Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [2015-07-20 146600]
R2 ConfigFree Service;ConfigFree Service; C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe [2008-04-17 40960]
R2 Fabs;FABS - Helping agent for MAGIX media database; C:\Program Files\Common Files\MAGIX Services\Database\bin\FABS.exe [2009-08-27 1253376]
R2 FontCache;@%systemroot%\system32\FntCache.dll,-100; C:\Windows\system32\svchost.exe [2008-01-21 21504]
R2 TeamViewer;TeamViewer 10; C:\Program Files\TeamViewer\TeamViewer_Service.exe [2015-02-17 5436176]
R2 TNaviSrv;TOSHIBA Navi Support Service; C:\Program Files\Toshiba\TOSHIBA DVD PLAYER\TNaviSrv.exe [2008-07-18 83312]
R2 TODDSrv;TOSHIBA Optical Disc Drive Service; C:\Windows\system32\TODDSrv.exe [2007-11-21 129632]
R2 TosCoSrv;TOSHIBA Power Saver; C:\Program Files\Toshiba\Power Saver\TosCoSrv.exe [2008-01-17 431456]
R2 TOSHIBA SMART Log Service;TOSHIBA SMART Log Service; C:\Program Files\TOSHIBA\SMARTLogService\TosIPCSrv.exe [2007-12-03 126976]
R2 UleadBurningHelper;Ulead Burning Helper; C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe [2006-08-23 49152]
R3 AvastVBoxSvc;AvastVBox COM Service; C:\Program Files\AVAST Software\Avast\ng\vbox\AvastVBoxSVC.exe [2015-07-20 3218624]
R3 SmartFaceVWatchSrv;SmartFaceVWatchSrv; C:\Program Files\Toshiba\SmartFaceV\SmartFaceVWatchSrv.exe [2008-08-25 77824]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2013-09-11 105144]
S2 SkypeUpdate;Skype Updater; C:\Program Files\Skype\Updater\Updater.exe [2014-12-11 315496]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service; C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2015-07-15 268976]
S3 FirebirdServerMAGIXInstance;Firebird Server - MAGIX Instance; C:\Program Files\Common Files\MAGIX Services\Database\bin\fbserver.exe [2008-08-07 3276800]
S3 IDriverT;InstallDriver Table Manager; C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [2005-04-04 69632]
S3 lxcc_device;lxcc_device; C:\Windows\system32\lxcccoms.exe [2005-07-06 466944]
S3 rpcapd;Remote Packet Capture Protocol v.0 (experimental); C:\Program Files\WinPcap\rpcapd.exe [2009-11-16 117264]
S3 WPFFontCache_v0400;@C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe,-100; C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2013-09-11 770168]
S4 aspnet_state;ASP.NET State Service; C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe [2013-09-11 46688]
S4 NetMsmqActivator;@C:\Windows\Microsoft.NET\Framework\v4.0.30319\\ServiceModelInstallRC.dll,-8195; C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe [2013-09-11 139856]
S4 NetPipeActivator;@C:\Windows\Microsoft.NET\Framework\v4.0.30319\\ServiceModelInstallRC.dll,-8197; C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe [2013-09-11 139856]
S4 NetTcpActivator;@C:\Windows\Microsoft.NET\Framework\v4.0.30319\\ServiceModelInstallRC.dll,-8199; C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe [2013-09-11 139856]
S4 PnkBstrA;PnkBstrA; C:\Windows\system32\PnkBstrA.exe [2009-12-12 66872]
S4 PnkBstrB;PnkBstrB; C:\Windows\system32\PnkBstrB.exe [2009-12-12 107832]

-----------------EOF-----------------

[vyosek]

Zdravim

Stahnete AdwCleaner http://general-changelog-team.fr/fr/dow ... adwcleaner

• Ulozte nejlepe na plochu
• Ukoncete vsechny programy
• Po spusteni probehne stazeni databaze
• Kliknete na Scan a nasledne Clean
• Probehne oprava, restart PC a pak se objevi log, pripadne bude ulozen ve slozce c:\AdwCleaner\AdwCleaner[S?].txt, ten sem vlozte

[mifoIV]

Hotovo. Niečo to premazalo ale z reklamou to nepohlo

# AdwCleaner v4.208 - Log vytvorený 20/07/2015 at 15:06:47
# Aktualizované 09/07/2015 by Xplode
# Databáza : 2015-07-15.1 [Server]
# Operačný systém : Windows Vista (TM) Home Premium Service Pack 2 (x86)
# Uživateľské meno : admin - TOSHIBA
# Spustené z : C:\Users\admin\Desktop\adwcleaner_4.208.exe
# Nastavenia : Čistenie

***** [ Služby ] *****


***** [ Súbory / Priečinky ] *****

Priečinok Zmazané : C:\ProgramData\ICQ\ICQToolbar
Priečinok Zmazané : C:\Program Files\Conduit
Priečinok Zmazané : C:\Program Files\ConduitEngine
Priečinok Zmazané : C:\Users\admin\AppData\LocalLow\AskToolbar
Priečinok Zmazané : C:\Users\admin\AppData\LocalLow\Conduit
Priečinok Zmazané : C:\Users\admin\AppData\LocalLow\ConduitEngine
Priečinok Zmazané : C:\Users\admin\AppData\LocalLow\ToggleEN
Priečinok Zmazané : C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\2msv9gsk.default\Extensions\{038cb5c7-48ea-4af9-94e0-a1646542e62b}
Súbor Zmazané : C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\2msv9gsk.default\searchplugins\Askcom.xml
Súbor Zmazané : C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\2msv9gsk.default\searchplugins\Conduit.xml

***** [ Naplánované úlohy ] *****


***** [ Zástupcovia ] *****


***** [ Registre ] *****

Kľúč registra Zmazané : HKCU\Software\Microsoft\Internet Explorer\LowRegistry\ICQ\ICQToolBar
Hodnota Zmazané : HKCU\Software\Microsoft\Internet Explorer\Main [ICQ Search]
Kľúč registra Zmazané : HKLM\SOFTWARE\Classes\AppID\NCTAudioCDGrabber2.DLL
Kľúč registra Zmazané : HKLM\SOFTWARE\Classes\Conduit.Engine
Kľúč registra Zmazané : HKLM\SOFTWARE\Classes\Toolbar.CT2077543
Kľúč registra Zmazané : HKLM\SOFTWARE\Classes\Toolbar.CT2405280
Kľúč registra Zmazané : HKLM\SOFTWARE\Classes\AppID\
Kľúč registra Zmazané : HKLM\SOFTWARE\Classes\AppID\
Kľúč registra Zmazané : HKLM\SOFTWARE\Classes\AppID\
Kľúč registra Zmazané : HKLM\SOFTWARE\Classes\AppID\
Kľúč registra Zmazané : HKLM\SOFTWARE\Classes\AppID\
Kľúč registra Zmazané : HKLM\SOFTWARE\Classes\CLSID\{30F9B915-B755-4826-820B-08FBA6BD249D}
Kľúč registra Zmazané : HKLM\SOFTWARE\Classes\CLSID\{35B8892D-C3FB-4D88-990D-31DB2EBD72BD}
Kľúč registra Zmazané : HKLM\SOFTWARE\Classes\CLSID\{3C471948-F874-49F5-B338-4F214A2EE0B1}
Kľúč registra Zmazané : HKLM\SOFTWARE\Classes\CLSID\{5EB0259D-AB79-4AE6-A6E6-24FFE21C3DA4}
Kľúč registra Zmazané : HKLM\SOFTWARE\Classes\CLSID\{CADAF6BE-BF50-4669-8BFD-C27BD4E6181B}
Kľúč registra Zmazané : HKLM\SOFTWARE\Classes\CLSID\
Kľúč registra Zmazané : HKLM\SOFTWARE\Classes\CLSID\
Kľúč registra Zmazané : HKLM\SOFTWARE\Classes\CLSID\
Kľúč registra Zmazané : HKLM\SOFTWARE\Classes\CLSID\
Kľúč registra Zmazané : HKLM\SOFTWARE\Classes\CLSID\
Kľúč registra Zmazané : HKLM\SOFTWARE\Classes\Interface\{2BEF239C-752E-4001-8048-F256E0D8CD93}
Kľúč registra Zmazané : HKLM\SOFTWARE\Classes\Interface\{3F607E46-0D3C-4442-B1DE-DE7FA4768F5C}
Kľúč registra Zmazané : HKLM\SOFTWARE\Classes\Interface\{49C00A51-6E59-41FE-B3FA-2D2157FAD67B}
Kľúč registra Zmazané : HKLM\SOFTWARE\Classes\Interface\{6DFF5DBA-AE3A-46DB-B301-ECFFC6DB2982}
Kľúč registra Zmazané : HKLM\SOFTWARE\Classes\Interface\{DE34CD67-F1C8-4001-9A23-B8A68F63F377}
Kľúč registra Zmazané : HKLM\SOFTWARE\Classes\Interface\{FE0273D1-99DF-4AC0-87D5-1371C6271785}
Kľúč registra Zmazané : HKLM\SOFTWARE\Classes\Interface\
Kľúč registra Zmazané : HKLM\SOFTWARE\Classes\Interface\
Kľúč registra Zmazané : HKLM\SOFTWARE\Classes\Interface\
Kľúč registra Zmazané : HKLM\SOFTWARE\Classes\Interface\
Kľúč registra Zmazané : HKLM\SOFTWARE\Classes\Interface\
Kľúč registra Zmazané : HKLM\SOFTWARE\Classes\TypeLib\{93E3D79C-0786-48FF-9329-93BC9F6DC2B3}
Kľúč registra Zmazané : HKLM\SOFTWARE\Classes\TypeLib\
Kľúč registra Zmazané : HKLM\SOFTWARE\Classes\TypeLib\
Kľúč registra Zmazané : HKLM\SOFTWARE\Classes\TypeLib\
Kľúč registra Zmazané : HKLM\SOFTWARE\Classes\TypeLib\
Kľúč registra Zmazané : HKLM\SOFTWARE\Classes\TypeLib\
Kľúč registra Zmazané : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
Kľúč registra Zmazané : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{30F9B915-B755-4826-820B-08FBA6BD249D}
Kľúč registra Zmazané : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\
Kľúč registra Zmazané : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{30F9B915-B755-4826-820B-08FBA6BD249D}
Kľúč registra Zmazané : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\
Kľúč registra Zmazané : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\
Kľúč registra Zmazané : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\
Kľúč registra Zmazané : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\
Kľúč registra Zmazané : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\
Kľúč registra Zmazané : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\
Kľúč registra Zmazané : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\
Kľúč registra Zmazané : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{7CBB65A3-F7E9-424D-9E90-46A8F90AC766}
Kľúč registra Zmazané : HKLM\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\
Kľúč registra Zmazané : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\
Kľúč registra Zmazané : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\
Kľúč registra Zmazané : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\
Kľúč registra Zmazané : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\
Kľúč registra Zmazané : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{EEDC2FBC-785B-4AD7-A881-A56E6A57FBA3}
Kľúč registra Zmazané : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\
Kľúč registra Zmazané : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\
Hodnota Zmazané : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{D4027C7F-154A-4066-A1AD-4243D8127440}]
Hodnota Zmazané : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{038CB5C7-48EA-4AF9-94E0-A1646542E62B}]
Hodnota Zmazané : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks []
Hodnota Zmazané : HKLM\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks [{855F3B16-6D32-4FE6-8A56-BBB695989046}]
Hodnota Zmazané : HKLM\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks [{038CB5C7-48EA-4AF9-94E0-A1646542E62B}]
Hodnota Zmazané : HKLM\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks []
Kľúč registra Zmazané : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{171DEBEB-C3D4-40b7-AC73-056A5EBA4A7E}
Kľúč registra Zmazané : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{6552C7DD-90A4-4387-B795-F8F96747DE19}
Kľúč registra Zmazané : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{AD22EBAF-0D18-4fc7-90CC-5EA0ABBE9EB8}
Kľúč registra Zmazané : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}
Kľúč registra Zmazané : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}
Kľúč registra Zmazané : HKCU\Software\APN PIP
Kľúč registra Zmazané : HKCU\Software\Headlight
Kľúč registra Zmazané : HKCU\Software\PIP
Kľúč registra Zmazané : HKCU\Software\Softonic
Kľúč registra Zmazané : HKCU\Software\YahooPartnerToolbar
Kľúč registra Zmazané : HKCU\Software\AppDataLow\Toolbar
Kľúč registra Zmazané : HKCU\Software\AppDataLow\Software\Conduit
Kľúč registra Zmazané : HKCU\Software\AppDataLow\Software\conduitEngine
Kľúč registra Zmazané : HKCU\Software\AppDataLow\Software\ToggleEN
Kľúč registra Zmazané : HKLM\SOFTWARE\Conduit
Kľúč registra Zmazané : HKLM\SOFTWARE\conduitEngine
Kľúč registra Zmazané : HKLM\SOFTWARE\dt soft\daemon tools toolbar
Kľúč registra Zmazané : HKLM\SOFTWARE\ICQ\ICQToolbar
Kľúč registra Zmazané : HKLM\SOFTWARE\PIP
Kľúč registra Zmazané : HKLM\SOFTWARE\ToggleEN
Kľúč registra Zmazané : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\{86D4B82A-ABED-442A-BE86-96357B70F4FE}
Kľúč registra Zmazané : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\ICQToolbar
Kľúč registra Zmazané : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\ToggleEN Toolbar

***** [ Webové prehliadače ] *****

-\\ Internet Explorer v9.0.8112.16669

Nastavenie Obnovené : HKCU\Software\Microsoft\Internet Explorer\Main [ICQ Search]

-\\ Mozilla Firefox v

[2msv9gsk.default\prefs.js] - Riadok Zmazané : user_pref("CT2077543.AboutPrivacyUrl", "hxxp://www.conduit.com/privacy/Default.aspx");
[2msv9gsk.default\prefs.js] - Riadok Zmazané : user_pref("CT2077543.GroupingServiceUrl", "hxxp://grouping.services.conduit.com/");
[2msv9gsk.default\prefs.js] - Riadok Zmazané : user_pref("CT2077543.LanguagePackServiceUrl", "hxxp://translation.users.conduit.com/Translation.ashx");
[2msv9gsk.default\prefs.js] - Riadok Zmazané : user_pref("CT2077543.SearchEngine", "Searchhxxp://search.conduit.com/Results.aspx?q=UCM_SEARCH_TERM&ctid=CT2077543&octid=EB_ORIGINAL_CTID&SearchSource=1");
[2msv9gsk.default\prefs.js] - Riadok Zmazané : user_pref("CT2077543.SearchFromAddressBarUrl", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2077543&q=");
[2msv9gsk.default\prefs.js] - Riadok Zmazané : user_pref("CT2077543.SearchInNewTabServiceUrl", "hxxp://newtab.conduit-hosting.com/newtab/?ctid=EB_TOOLBAR_ID");
[2msv9gsk.default\prefs.js] - Riadok Zmazané : user_pref("CT2077543.SearchInNewTabUsageUrl", "hxxp://Usage.Hosting.conduit-services.com/UsageService.asmx/UsersRequests?ctid=EB_TOOLBAR_ID");
[2msv9gsk.default\prefs.js] - Riadok Zmazané : user_pref("CT2077543.backendstorage.hxxp://cmg1_conduit-widgets_com/pitsi.state", "4F50454E");
[2msv9gsk.default\prefs.js] - Riadok Zmazané : user_pref("CT2077543.clientLogServiceUrl", "hxxp://clientlog.users.conduit.com/ClientDiagnostics.asmx/ReportDiagnosticsEvent");
[2msv9gsk.default\prefs.js] - Riadok Zmazané : user_pref("CT2077543.myStuffSearchUrl", "hxxp://Apps.conduit.com/search?q=SEARCH_TERM&SearchSourceOrigin=29&ctid=EB_TOOLBAR_ID&octid=EB_ORIGINAL_CTID");
[2msv9gsk.default\prefs.js] - Riadok Zmazané : user_pref("CT2077543.myStuffServiceUrl", "hxxp://mystuff.conduit-services.com/MyStuffService.ashx?ComponentId=EB_MY_STUFF_INSTANCE_GUID&lut=EB_MY_STUFF_LUT");
[2msv9gsk.default\prefs.js] - Riadok Zmazané : user_pref("CT2077543.uninstallLogServiceUrl", "hxxp://uninstall.users.conduit.com/Uninstall.asmx/RegisterToolbarUninstallation");
[2msv9gsk.default\prefs.js] - Riadok Zmazané : user_pref("CommunityToolbar.SearchFromAddressBarSavedUrl", "chrome://browser-region/locale/region.properties");
[2msv9gsk.default\prefs.js] - Riadok Zmazané : user_pref("CommunityToolbar.ToolbarsList", "CT2077543");
[2msv9gsk.default\prefs.js] - Riadok Zmazané : user_pref("CommunityToolbar.ToolbarsList2", "CT2077543");
[2msv9gsk.default\prefs.js] - Riadok Zmazané : user_pref("CommunityToolbar.facebook.settingsLastCheckTime", "Sun Jan 02 2011 16:02:36 GMT+0100");
[2msv9gsk.default\prefs.js] - Riadok Zmazané : user_pref("CommunityToolbar.keywordURLSelectedCTID", "CT2077543");
[2msv9gsk.default\prefs.js] - Riadok Zmazané : user_pref("CommunityToolbar.twitter.user_16409683.LastCheckTime", "Mon Jan 03 2011 11:19:18 GMT+0100");
[2msv9gsk.default\prefs.js] - Riadok Zmazané : user_pref("CommunityToolbar.twitter.user_16727535.LastCheckTime", "Mon Jan 03 2011 11:19:18 GMT+0100");
[2msv9gsk.default\prefs.js] - Riadok Zmazané : user_pref("CommunityToolbar.twitter.user_18863815.LastCheckTime", "Mon Jan 03 2011 11:19:18 GMT+0100");
[2msv9gsk.default\prefs.js] - Riadok Zmazané : user_pref("CommunityToolbar.twitter.user_19058681.LastCheckTime", "Mon Jan 03 2011 11:19:18 GMT+0100");
[2msv9gsk.default\prefs.js] - Riadok Zmazané : user_pref("CommunityToolbar.twitter.user_19248106.LastCheckTime", "Mon Jan 03 2011 11:19:18 GMT+0100");
[2msv9gsk.default\prefs.js] - Riadok Zmazané : user_pref("CommunityToolbar.twitter.user_19554706.LastCheckTime", "Mon Jan 03 2011 11:19:18 GMT+0100");
[2msv9gsk.default\prefs.js] - Riadok Zmazané : user_pref("CommunityToolbar.twitter.user_20536157.LastCheckTime", "Mon Jan 03 2011 11:19:18 GMT+0100");
[2msv9gsk.default\prefs.js] - Riadok Zmazané : user_pref("CommunityToolbar.twitter.user_428333.LastCheckTime", "Mon Jan 03 2011 11:19:18 GMT+0100");
[2msv9gsk.default\prefs.js] - Riadok Zmazané : user_pref("CommunityToolbar.twitter.user_807095.LastCheckTime", "Mon Jan 03 2011 11:19:18 GMT+0100");
[2msv9gsk.default\prefs.js] - Riadok Zmazané : user_pref("CommunityToolbar.twitter.user_813286.LastCheckTime", "Mon Jan 03 2011 11:19:18 GMT+0100");
[2msv9gsk.default\prefs.js] - Riadok Zmazané : user_pref("browser.search.defaultengine", "Ask.com");
[2msv9gsk.default\prefs.js] - Riadok Zmazané : user_pref("browser.search.defaultenginename", "Ask.com");
[2msv9gsk.default\prefs.js] - Riadok Zmazané : user_pref("browser.search.defaultthis.engineName", "ToggleEN Customized Web Search");
[2msv9gsk.default\prefs.js] - Riadok Zmazané : user_pref("browser.search.defaulturl", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2077543&SearchSource=3&q={searchTerms}");
[2msv9gsk.default\prefs.js] - Riadok Zmazané : user_pref("browser.search.order.1", "Ask.com");
[2msv9gsk.default\prefs.js] - Riadok Zmazané : user_pref("browser.search.selectedEngine", "Ask.com");
[2msv9gsk.default\prefs.js] - Riadok Zmazané : user_pref("browser.startup.homepage", "hxxp://eu.ask.com?o=15573&l=dis");
[2msv9gsk.default\prefs.js] - Riadok Zmazané : user_pref("extensions.asktb.cbid", "A2");
[2msv9gsk.default\prefs.js] - Riadok Zmazané : user_pref("extensions.asktb.default-channel-url-mask", "hxxp://www.ask.com/web?q={query}&o={o}&l={l}&qsrc={qsrc}");
[2msv9gsk.default\prefs.js] - Riadok Zmazané : user_pref("extensions.asktb.dtid", "YYYYYYYYSK");
[2msv9gsk.default\prefs.js] - Riadok Zmazané : user_pref("extensions.asktb.first-launch-url", "file:///C:/eJay/HipHop%206/HTML%20Help/MAIN.html");
[2msv9gsk.default\prefs.js] - Riadok Zmazané : user_pref("extensions.asktb.fresh-install", false);
[2msv9gsk.default\prefs.js] - Riadok Zmazané : user_pref("extensions.asktb.l", "dis");
[2msv9gsk.default\prefs.js] - Riadok Zmazané : user_pref("extensions.asktb.last-config-req", "1293980556039");
[2msv9gsk.default\prefs.js] - Riadok Zmazané : user_pref("extensions.asktb.locale", "en_US");
[2msv9gsk.default\prefs.js] - Riadok Zmazané : user_pref("extensions.asktb.o", "10148");
[2msv9gsk.default\prefs.js] - Riadok Zmazané : user_pref("extensions.asktb.overlay-reloaded-using-restart", true);
[2msv9gsk.default\prefs.js] - Riadok Zmazané : user_pref("extensions.asktb.qsrc", "2871");
[2msv9gsk.default\prefs.js] - Riadok Zmazané : user_pref("extensions.asktb.r", "2");
[2msv9gsk.default\prefs.js] - Riadok Zmazané : user_pref("extensions.asktb.search-plugin-suggestions-url", "hxxp://ss.websearch.ask.com/query?qsrc=2922&li=ff&sstype=prefix&q={searchTerms}");
[2msv9gsk.default\prefs.js] - Riadok Zmazané : user_pref("extensions.asktb.search-suggestions-enabled", true);
[2msv9gsk.default\prefs.js] - Riadok Zmazané : user_pref("extensions.enabledItems", "{038cb5c7-48ea-4af9-94e0-a1646542e62b}:2.7.2.0,toolbar@ask.com:3.9.1.14019,{972ce4c6-7e08-4474-a285-3208198ce6fd}:3.6.13");

-\\ Google Chrome v

[C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Zmazané [Search Provider] : hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2405280
[C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Zmazané [Search Provider] : hxxp://www.daemon-search.com/search?q={searchTerms}

*************************

AdwCleaner[R0].txt - [19065 bajtov] - [20/07/2015 15:05:48]
AdwCleaner[S0].txt - [15793 bajtov] - [20/07/2015 15:06:47]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [15854 bajtov] ##########

[vyosek]

Stahnete Zoek.exe http://hijackthis.nl/smeenk/ a ulozte jej na plochu

• Pokud pouzivate Win Vista ci W7, kliknete na Zoek pravym a dejte Run As Administrator ci Spustit jako spravce
• Do okna vlozte skript nize

• Kód: Vybrat vše

  autoclean;
  resethosts;
  emptyclsid;
  IEdefaults;
  FFdefaults;
  CHRdefaults;
  emptyIEcache;
  emptyFFcache;
  emptyCHRcache;
  emptyalltemp;
  emptyflash;
  emptyjava;
  emptyrecycle.bin;
  

• Nasledne kliknete na Run Script
• PC provede opravu, restartuje se a da Vam log, jeho obsah vlozte sem

[mifoIV]

Link sa mi nepodarilo načítať, tak som program stiahol z inakade. Addcash mi ponúka svoje služby nadalej.
Zoek.exe v5.0.0.0 Updated 04-May-2015
Tool run by admin on po 20. 07. 2015 at 17:00:58,86.
Microsoft® Windows Vista™ Home Premium 6.0.6002 Service Pack 2 x86
Running in: Normal Mode Internet Access Detected
Launched: C:\Users\admin\Desktop\zoek.exe [Scan all users] [Script inserted]

==== System Restore Info ======================

20. 7. 2015 17:02:01 Zoek.exe System Restore Point Created Successfully.

==== Reset Hosts File ======================

# Copyright (c) 1993-2006 Microsoft Corp.
#
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
#
# This file contains the mappings of IP addresses to host names. Each
# entry should be kept on an individual line. The IP address should
# be placed in the first column followed by the corresponding host name.
# The IP address and the host name should be separated by at least one
# space.
#
# Additionally, comments (such as these) may be inserted on individual
# lines or following the machine name denoted by a '#' symbol.
#
# For example:
#
# 102.54.94.97 rhino.acme.com # source server
# 38.25.63.10 x.acme.com # x client host

127.0.0.1 localhost
::1 localhost

==== Empty Folders Check ======================

C:\PROGRA~2\Alwil Software deleted successfully
C:\PROGRA~2\PSPVC deleted successfully
C:\Users\admin\AppData\Roaming\PeerNetworking deleted successfully

==== Deleting CLSID Registry Keys ======================

HKEY_USERS\S-1-5-21-1034233192-1315924873-3047747250-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0A900DF-9611-4446-86BD-4B1D47E7DB2A} deleted successfully

==== Deleting CLSID Registry Values ======================


==== Deleting Services ======================


==== FireFox Fix ======================

Deleted from C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\2msv9gsk.default\prefs.js:
user_pref("browser.search.useDBForOrder", true);

Added to C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\2msv9gsk.default\prefs.js:
user_pref("browser.startup.homepage", "about:home");
user_pref("browser.newtab.url", "about:newtab");

ProfilePath: C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\2msv9gsk.default

user.js not found
---- Lines CT2077543 removed from prefs.js ----
user_pref("CT2077543.alertChannelId", "511572");
user_pref("CT2077543.clientLogIsEnabled", false);
user_pref("CT2077543.CTID", "CT2077543");
user_pref("CT2077543.CurrentServerDate", "3-1-2011");
user_pref("CT2077543.DialogsAlignMode", "LTR");
user_pref("CT2077543.DownloadReferralCookieData", "");
user_pref("CT2077543.EMailNotifierPollDate", "Mon Jan 03 2011 11:19:15 GMT+0100");
user_pref("CT2077543.ExternalComponentPollDate128975755269762860", "Mon Jan 03 2011 11:19:15 GMT+0100");
user_pref("CT2077543.ExternalComponentPollDate128981701947088292", "Mon Jan 03 2011 11:19:15 GMT+0100");
user_pref("CT2077543.ExternalComponentPollDate129006033237069158", "Mon Jan 03 2011 11:19:15 GMT+0100");
user_pref("CT2077543.FeedLastCount128728594662093846", 372);
user_pref("CT2077543.FeedLastCount129300601765607025", 500);
user_pref("CT2077543.FeedPollDate128728593579282204", "Mon Jan 03 2011 11:19:15 GMT+0100");
user_pref("CT2077543.FeedPollDate128728593868969193", "Mon Jan 03 2011 11:19:15 GMT+0100");
user_pref("CT2077543.FeedPollDate128728594303656973", "Mon Jan 03 2011 11:19:15 GMT+0100");
user_pref("CT2077543.FeedPollDate128728594641156345", "Mon Jan 03 2011 11:19:16 GMT+0100");
user_pref("CT2077543.FeedPollDate128728605119906817", "Mon Jan 03 2011 11:19:16 GMT+0100");
user_pref("CT2077543.FeedPollDate128728631330531749", "Mon Jan 03 2011 11:19:16 GMT+0100");
user_pref("CT2077543.FeedPollDate128728637292250655", "Mon Jan 03 2011 11:19:16 GMT+0100");
user_pref("CT2077543.FeedPollDate128728637427719582", "Mon Jan 03 2011 11:19:16 GMT+0100");
user_pref("CT2077543.FeedPollDate128728637736781257", "Mon Jan 03 2011 11:19:16 GMT+0100");
user_pref("CT2077543.FeedPollDate129300601766857027", "Mon Jan 03 2011 11:19:15 GMT+0100");
user_pref("CT2077543.FeedPollDate129300601766857028", "Mon Jan 03 2011 11:19:15 GMT+0100");
user_pref("CT2077543.FeedPollDate129300601766857029", "Mon Jan 03 2011 11:19:15 GMT+0100");
user_pref("CT2077543.FeedPollDate129300601766857030", "Mon Jan 03 2011 11:19:16 GMT+0100");
user_pref("CT2077543.FeedPollDate129300601766857031", "Mon Jan 03 2011 11:19:16 GMT+0100");
user_pref("CT2077543.FeedPollDate129300601766857032", "Mon Jan 03 2011 11:19:16 GMT+0100");
user_pref("CT2077543.FeedPollDate129300601766857033", "Mon Jan 03 2011 11:19:16 GMT+0100");
user_pref("CT2077543.FeedPollDate129300601766857034", "Mon Jan 03 2011 11:19:16 GMT+0100");
user_pref("CT2077543.FeedPollDate129300601766857035", "Mon Jan 03 2011 11:19:16 GMT+0100");
user_pref("CT2077543.FeedPollDate129300601766857036", "Mon Jan 03 2011 11:19:16 GMT+0100");
user_pref("CT2077543.FeedTTL128728593579282204", 5);
user_pref("CT2077543.FeedTTL128728637292250655", 15);
user_pref("CT2077543.FeedTTL129300601766857027", 40);
user_pref("CT2077543.FeedTTL129300601766857028", 40);
user_pref("CT2077543.FeedTTL129300601766857029", 40);
user_pref("CT2077543.FeedTTL129300601766857030", 40);
user_pref("CT2077543.FeedTTL129300601766857031", 40);
user_pref("CT2077543.FeedTTL129300601766857032", 40);
user_pref("CT2077543.FeedTTL129300601766857033", 40);
user_pref("CT2077543.FeedTTL129300601766857034", 40);
user_pref("CT2077543.FeedTTL129300601766857035", 40);
user_pref("CT2077543.FeedTTL129300601766857036", 40);
user_pref("CT2077543.FirstServerDate", "14-9-2010");
user_pref("CT2077543.FirstTime", true);
user_pref("CT2077543.FirstTimeFF3", true);
user_pref("CT2077543.FirstTimeSettingsDone", true);
user_pref("CT2077543.FixPageNotFoundErrors", true);
user_pref("CT2077543.GroupingServerCheckInterval", 1440);
user_pref("CT2077543.Initialize", true);
user_pref("CT2077543.InitializeCommonPrefs", true);
user_pref("CT2077543.InstallationAndCookieDataSentCount", 3);
user_pref("CT2077543.InstalledDate", "Tue Sep 14 2010 19:42:07 GMT+0200");
user_pref("CT2077543.InvalidateCache", false);
user_pref("CT2077543.IsGrouping", false);
user_pref("CT2077543.IsMulticommunity", false);
user_pref("CT2077543.IsOpenThankYouPage", true);
user_pref("CT2077543.IsOpenUninstallPage", true);
user_pref("CT2077543.LanguagePackLastCheckTime", "Mon Jan 03 2011 11:19:18 GMT+0100");
user_pref("CT2077543.LanguagePackReloadIntervalMM", 1440);
user_pref("CT2077543.LastLogin_2.7.2.0", "Mon Jan 03 2011 11:19:15 GMT+0100");
user_pref("CT2077543.LatestVersion", "3.2.5.2");
user_pref("CT2077543.Locale", "en-us");
user_pref("CT2077543.LoginCache", 4);
user_pref("CT2077543.MCDetectTooltipHeight", "83");
user_pref("CT2077543.MCDetectTooltipUrl", "http://@EB_INSTALL_LINK@/rank/tooltip/?version=1");
user_pref("CT2077543.MCDetectTooltipWidth", "295");
user_pref("CT2077543.myStuffEnabled", true);
user_pref("CT2077543.myStuffPublihserMinWidth", 400);
user_pref("CT2077543.myStuffServiceIntervalMM", 1440);
user_pref("CT2077543.RadioIsPodcast", false);
user_pref("CT2077543.RadioLastCheckTime", "Sun Jan 02 2011 16:02:37 GMT+0100");
user_pref("CT2077543.RadioLastUpdateIPServer", "3");
user_pref("CT2077543.RadioLastUpdateServer", "129300667913300000");
user_pref("CT2077543.RadioMediaID", "9395359");
user_pref("CT2077543.RadioMediaType", "Media Player");
user_pref("CT2077543.RadioMenuSelectedID", "EBRadioMenu_CT20775439395359");
user_pref("CT2077543.RadioStationName", "BBC%20live%205%20");
user_pref("CT2077543.RadioStationURL", "http://www.bbc.co.uk/fivelive/live/live.asx");
user_pref("CT2077543.SavedHomepage", "resource:/browserconfig.properties");
user_pref("CT2077543.SearchFromAddressBarIsInit", true);
user_pref("CT2077543.SearchInNewTabEnabled", true);
user_pref("CT2077543.SearchInNewTabIntervalMM", 1440);
user_pref("CT2077543.SearchInNewTabLastCheckTime", "Sun Jan 02 2011 16:02:36 GMT+0100");
user_pref("CT2077543.SettingsCheckIntervalMin", 120);
user_pref("CT2077543.SettingsLastCheckTime", "Mon Jan 03 2011 11:19:15 GMT+0100");
user_pref("CT2077543.SettingsLastUpdate", "1291980543");
user_pref("CT2077543.ThirdPartyComponentsInterval", 504);
user_pref("CT2077543.ThirdPartyComponentsLastCheck", "Tue Dec 28 2010 18:00:14 GMT+0100");
user_pref("CT2077543.ThirdPartyComponentsLastUpdate", "1246790578");
user_pref("CT2077543.TrusteLinkUrl", "http://www.truste.org/pvr.php?page=vali ... sealid=112");
user_pref("CT2077543.UserID", "UN13867870125788828");
user_pref("CT2077543.ValidationData_Toolbar", 2);
user_pref("CT2077543.WeatherNetwork", "");
user_pref("CT2077543.WeatherPollDate", "Mon Jan 03 2011 11:19:16 GMT+0100");
user_pref("CT2077543.WeatherUnit", "C");
---- FireFox user.js and prefs.js backups ----

prefs_201520.07._1728_.backup

==== Registry Fix Code ======================

Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
"Shell"="explorer.exe"

==== Deleting Files \ Folders ======================

C:\Users\admin\AppData\Roaming\GetRightToGo deleted
C:\PROGRA~2\mw2mmgr.txt deleted
C:\PROGRA~2\ICQ deleted
C:\Windows\system32\config\systemprofile\Searches deleted
C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\2msv9gsk.default\CT2077543 deleted
C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\2msv9gsk.default\conduit deleted
"C:\Users\admin\AppData\Roaming\VTExtra\cdcert.cat" deleted
"C:\Users\admin\AppData\Roaming\VTExtra" deleted

==== Firefox Start and Search pages ======================

ProfilePath: C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\2msv9gsk.default
user_pref("browser.startup.homepage", "about:home");
user_pref("browser.newtab.url", "about:newtab");

==== Firefox Extensions Registry ======================

[HKEY_LOCAL_MACHINE\Software\Mozilla\Firefox\Extensions]
"wrc@avast.com"="C:\Program Files\AVAST Software\Avast\WebRep\FF" [20. 07. 2015 13:26]

==== Firefox Extensions ======================

==== Firefox Plugins ======================

Profilepath: C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\2msv9gsk.default
28D2C5CE5944E1B027CF5C8004CF89A1 - C:\Program Files\Adobe\Reader 9.0\Reader\browser\nppdf32.dll - Adobe Acrobat
7C83A2809E13950359189767AC9D5DB8 - C:\Program Files\Java\jre1.6.0_07\bin\npjpi160_07.dll - Java(TM) Platform SE 6 U7
E7838D22B19B9C121AAF93E282256586 - C:\Program Files\VistaCodecPack\rm\browser\plugins\nppl3260.dll - RealPlayer(tm) G2 LiveConnect-Enabled Plug-In (32-bit)
01F0264937036BD962563F1ADF35CE72 - C:\Program Files\VistaCodecPack\rm\browser\plugins\nprpjplug.dll - RealPlayer Version Plugin


==== Chromium Look ======================

HKEY_LOCAL_MACHINE\SOFTWARE\Google\Chrome\Extensions
gomekmidlodglbbmalcneegieacbdmki - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx[20. 07. 2015 13:26]


==== Chromium Startpages ======================

C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
ame":"RealPlayer(tm) G2 LiveConnect-Enabled Plug-In (32-bit) ","path":"C:\\Program Files\\VistaCodecPack\\rm\\browser\\plugins\\nppl3260.dll","version":"6.0.12.448"},{"enabled":false,"name":"RealPlayer Version Plugin","path":"C:\\Program Files\\VistaCodecPack\\rm\\browser\\plugins\\nprpjplug.dll","version":"6.0.12.448"},{"enabled":true,"name":"RealPlayer"},{"enabled":false,"name":"Google Update","path":"C:\\Users\\admin\\AppData\\Local\\Google\\Update\\1.3.21.111\\npGoogleUpdate3.dll","version":"1.3.21.111"},{"enabled":false,"name":"Google Update"}],"removed_old_component_pepper_flash_settings":true},"printing":{"print_preview_sticky_settings":{"appState":"{\"version\":2,\"isGcpPromoDismissed\":false,\"selectedDestinationId\":\"Lexmark 3300 Series\",\"selectedDestinationOrigin\":\"local\",\"undefined\":{\"version\":\"1.0\",\"printer\":{\"collate\":{\"default\":true},\"color\":{\"option\":[{\"type\":\"STANDARD_COLOR\",\"is_default\":true},{\"type\":\"STANDARD_MONOCHROME\",\"is_default\":false}]},\"copies\":{\"default\":1},\"duplex\":{\"option\":[{\"type\":\"NO_DUPLEX\",\"is_default\":true},{\"type\":\"LONG_EDGE\",\"is_default\":false}]},\"page_orientation\":{\"option\":[{\"type\":\"PORTRAIT\",\"is_default\":true},{\"type\":\"LANDSCAPE\"}]}}},\"selectedDestinationName\":\"Lexmark 3300 Series\"}"}},"profile":{"avatar_index":0,"content_settings":{"clear_on_exit_migrated":true,"exceptions":{"app_banner":{},"auto_select_certificate":{},"automatic_downloads":{},"cookies":{},"fullscreen":{"[*.]www.teevee.sk,*":{"setting":1},"[*.]www.youtube.com,*":{"setting":1},"https://[*.]www.facebook.com:443,*":{"setting":1}},"geolocation":{},"images":{},"javascript":{},"media_stream":{},"media_stream_camera":{},"media_stream_mic":{},"metro_switch_to_desktop":{},"midi_sysex":{},"mixed_script":{},"mouselock":{},"notifications":{},"plugins":{},"popups":{},"ppapi_broker":{},"protocol_handlers":{},"push_messaging":{},"ssl_cert_decisions":{}},"pattern_pairs":{"[*.]www.teevee.sk,*":{"fullscreen":1},"[*.]www.youtube.com,*":{"fullscreen":1},"https://[*.]www.facebook.com:443,*":{"fullscreen":1}},"pref_version":1},"exit_type":"Normal","exited_cleanly":true,"icon_version":3,"managed_user_id":"","migrated_content_settings_exceptions":true,"migrated_default_content_settings":true,"migrated_default_media_stream_content_settings":true,"multiple_profile_prefs_version":1,"name":"PredvolenĂ˝ profil","per_host_zoom_levels":{}},"protection":{"macs":{}},"reverse_autologin":{"enabled":false},"savefile":{"default_directory":"C:\\Users\\admin\\Downloads"},"selectfile":{"last_directory":"C:\\Users\\admin\\Desktop"},"session":{"restore_on_startup_migrated":true,"startup_urls_migration_time":"13035061126504000"},"spdy":{"servers":["toolbarqueries.google.com:443"]},"sync":{"acknowledged_types":["Bookmarks","Preferences","Passwords","Autofill Profiles","Autofill","Themes","Typed URLs","Extensions","Search Engines","Sessions","Apps","App settings","Extension settings","App Notifications","Encryption keys"],"app_notifications":false,"app_settings":false,"apps":false,"autofill":false,"autofill_profile":false,"bookmarks":false,"extension_settings":false,"extensions":false,"keep_everything_synced":true,"passwords":false,"preferences":false,"search_engines":false,"session_sync_guid":"session_syncS1A6blkpROkDaj9YinlGEg==","sessions":false,"suppress_start":true,"themes":false,"typed_urls":false},"sync_promo":{"show_ntp_bubble":false,"user_skipped":true,"view_count":1},"tabs":{"use_compact_navigation_bar":false,"use_vertical_tabs":false},"translate_accepted_count":{"de":1,"en":0,"es":1,"nl":0,"ru":1,"sl":1},"translate_blocked_languages":["cs","en","sk"],"translate_denied_count":{"de":0,"en":8,"es":0,"nl":1,"ru":0,"sl":0},"translate_language_blacklist":["en"],"translate_last_denied_time":1437404218547.375,"translate_whitelists":{},"webkit":{"webprefs":{"inspector_settings":{"lastActivePanel":"elements"}}},"zerosuggest":{"cachedresults":""}}
*","https://www.google.com/*","https://www.googleapis.com/*"],"manifest_permissions":[]},"commands":{},"content_settings":[],"creation_flags":137,"events":["app.runtime.onLaunched","runtime.onConnectExternal"],"from_bookmark":false,"from_webstore":true,"granted_permissions":{"api":["identity","webview"],"explicit_host":["https://wallet-web.sandbox.google.com/* ... eapis.com/*"],"manifest_permissions":[]},"has_declarative_rules":{"declarativeContent":{"onPageChanged":false},"declarativeWebRequest":{"onRequest":false}},"incognito_content_settings":[],"incognito_preferences":{},"initial_keybindings_set":true,"install_time":"13077298520501965","lastpingday":"13081849199359001","location":10,"manifest":{"app":{"background":{"scripts":["craw_background.js"]}},"current_locale":"sk","default_locale":"en","description":"Peňaženka Google pre digitálne produkty","display_in_launcher":false,"display_in_new_tab_page":false,"icons":{"128":"images/icon_128.png","16":"images/icon_16.png"},"key":"MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCrKfMnLqViEyokd1wk57FxJtW2XXpGXzIHBzv9vQI/01UsuP0IV5/lj0wx7zJ/xcibUgDeIxobvv9XD+zO1MdjMWuqJFcKuSS4Suqkje6u+pMrTSGOSHq1bmBVh0kpToN8YoJs/P/yrRd7FEtAXTaFTGxQL4C385MeXSjaQfiRiQIDAQAB","manifest_version":2,"minimum_chrome_version":"29","name":"Peňaženka Google","oauth2":{"auto_approve":true,"client_id":"203784468217.apps.googleusercontent.com","scopes":["https://www.googleapis.com/auth/sierra" ... e.readonly"]},"permissions":["identity","webview","https://wallet.google.com/","https://wa ... eapis.com/*"],"update_url":"https://clients2.google.com/service/upd ... ons":{"api":["notifications"],"manifest_permissions":[]},"app_launcher_ordinal":"n","commands":{},"content_settings":[],"creation_flags":137,"events":[],"from_bookmark":false,"from_webstore":true,"granted_permissions":{"api":["notifications"],"manifest_permissions":[]},"incognito_content_settings":[],"incognito_preferences":{},"install_time":"13072636498490372","last_active_pingday":"13001587199663378","lastpingday":"13081849199359001","location":1,"manifest":{"app":{"launch":{"container":"tab","web_url":"https://mail.google.com/mail/ca"},"urls":["*://mail.google.com/mail/ca"]},"current_locale":"sk","default_locale":"en","description":"Rýchly e-mail s vyhľadávaním a bez spamu.","icons":{"128":"128.png"},"key":"MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDCuGglK43iAz3J9BEYK/Mz6ZhloIMMDqQSAaf3vJt4eHbTbSDsu4WdQ9dQDRcKlg8nwQdePBt0C3PSUBtiSNSS37Z3qEGfS7LCju3h6pI1Yr9MQtxw+jUa7kXXIS09VV73pEFUT/F7c6Qe8L5ZxgAcBvXBh1Fie63qb02I9XQ/CQIDAQAB","manifest_version":2,"name":"Gmail","options_page":"https://mail.google.com/mail/ca/#settings","permissions":["notifications"],"update_url":"http://clients2.google.com/service/upda ... artup_urls":["http://www.google.sk/"]},"sync":{"remaining_rollback_tries":0}}


==== Set IE to Default ======================

Old Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"="http://www.google.sk/"
"ICQ Search"="http://www.google.com"

New Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"ICQ Search"="http://go.microsoft.com/fwlink/?LinkId=54896"
"Start Page"="http://www.google.sk/"

==== All HKCU SearchScopes ======================

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes
"DefaultScope"="{0633EE93-D776-472f-A0FF-E1416B8B2E3A}"
{searchCLSID} Unknown Url="Not_Found"
{012E1000-F331-11DB-8314-0800200C9A66} Google Url="http://www.google.com/search?q={searchTerms}"
{0633EE93-D776-472f-A0FF-E1416B8B2E3A} Bing Url="http://www.bing.com/search?q={searchTer ... ORM=IE8SRC"
{D822A92A-42B2-4F51-865C-9FF1ACCD1233} Google Url="http://www.google.com/search?source=ie7 ... lz=1I7TSEA;"

==== Reset Google Chrome ======================

C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Preferences was reset successfully
C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences was reset successfully
C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Web Data was reset successfully
C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Web Data-journal was reset successfully

==== Empty IE Cache ======================

C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5 emptied successfully
C:\Windows\serviceprofiles\networkservice\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\serviceprofiles\Localservice\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat will be deleted at reboot
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat will be deleted at reboot
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat will be deleted at reboot

==== Empty FireFox Cache ======================

No FireFox Cache found

==== Empty Chrome Cache ======================

C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Cache emptied successfully

==== Empty All Flash Cache ======================

Flash Cache Emptied Successfully

==== Empty All Java Cache ======================

Java Cache cleared successfully

==== C:\zoek_backup content ======================

C:\zoek_backup (files=93 folders=18 468822 bytes)

==== Empty Temp Folders ======================

C:\Users\admin\AppData\Local\Temp will be emptied at reboot
C:\Users\Default\AppData\Local\Temp emptied successfully
C:\Users\Default User\AppData\Local\Temp emptied successfully
C:\Windows\serviceprofiles\networkservice\AppData\Local\Temp emptied successfully
C:\Windows\serviceprofiles\Localservice\AppData\Local\Temp emptied successfully
C:\Windows\Temp will be emptied at reboot

==== After Reboot ======================

==== Empty Temp Folders ======================

C:\Windows\Temp successfully emptied
C:\Users\admin\AppData\Local\Temp successfully emptied

==== Empty Recycle Bin ======================

C:\$RECYCLE.BIN successfully emptied
C:\RECYCLER successfully emptied

==== Deleting Files / Folders ======================

"C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat" not found
"C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat" not deleted
"C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat" not deleted

==== EOF on po 20. 07. 2015 at 17:34:05,38 ======================

[vyosek]

Poprosim o FRST http://forum.viry.cz/viewtopic.php?f=13&t=133100

[mifoIV]

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 20-07-2015
Ran by admin (administrator) on TOSHIBA on 20-07-2015 21:06:46
Running from C:\Users\admin\Desktop
Loaded Profiles: admin (Available Profiles: admin)
Platform: Microsoft® Windows Vista™ Home Premium Service Pack 2 (X86) OS Language: Slovenčina (Slovensko)
Internet Explorer Version 9 (Default browser: Chrome)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/33 ... scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe
(Microsoft Corporation) C:\Windows\System32\SLsvc.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(Agere Systems) C:\Windows\System32\agrsmsvc.exe
(TOSHIBA CORPORATION) C:\Program Files\Toshiba\ConfigFree\CFSvcs.exe
(MAGIX AG) C:\Program Files\Common Files\MAGIX Services\Database\bin\FABS.exe
(TeamViewer GmbH) C:\Program Files\TeamViewer\TeamViewer_Service.exe
(TOSHIBA Corporation) C:\Program Files\Toshiba\TOSHIBA DVD PLAYER\TNaviSrv.exe
(TOSHIBA Corporation) C:\Windows\System32\TODDSrv.exe
(TOSHIBA Corporation) C:\Program Files\Toshiba\Power Saver\TosCoSrv.exe
(TOSHIBA Corporation) C:\Program Files\Toshiba\SMARTLogService\TosIPCSrv.exe
(Ulead Systems, Inc.) C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
(Toshiba) C:\Program Files\Toshiba\SmartFaceV\SmartFaceVWatchSrv.exe
(Avast Software) C:\Program Files\AVAST Software\Avast\ng\vbox\AvastVBoxSVC.exe
(Microsoft Corporation) C:\Windows\System32\conime.exe
(Synaptics, Inc.) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Realtek Semiconductor) C:\Windows\RtHDVCpl.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(TOSHIBA Corporation) C:\Program Files\Toshiba\Power Saver\TPwrMain.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(TOSHIBA Corporation) C:\Program Files\Toshiba\SmoothView\SmoothView.exe
(TOSHIBA Corporation) C:\Program Files\Toshiba\FlashCards\TCrdMain.exe
(Microsoft Corporation) C:\Windows\System32\wbem\unsecapp.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastUI.exe
(Microsoft Corporation) C:\Program Files\Windows Media Player\wmpnscfg.exe
(Google Inc.) C:\Users\admin\AppData\Local\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Windows\System32\wbem\unsecapp.exe
(Piriform Ltd) C:\Program Files\CCleaner\CCleaner.exe
(Google Inc.) C:\Users\admin\AppData\Local\Google\Chrome\Application\chrome.exe
(Synaptics, Inc.) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Google Inc.) C:\Users\admin\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\admin\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\admin\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\admin\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\admin\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\admin\AppData\Local\Google\Chrome\Application\chrome.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1348904 2008-08-14] (Synaptics, Inc.)
HKLM\...\Run: [RtHDVCpl] => C:\Windows\RtHDVCpl.exe [6037504 2008-04-08] (Realtek Semiconductor)
HKLM\...\Run: [TPwrMain] => C:\Program Files\TOSHIBA\Power Saver\TPwrMain.EXE [431456 2008-01-17] (TOSHIBA Corporation)
HKLM\...\Run: [HSON] => C:\Program Files\TOSHIBA\TBS\HSON.exe [54608 2007-10-31] (TOSHIBA Corporation)
HKLM\...\Run: [SmoothView] => C:\Program Files\Toshiba\SmoothView\SmoothView.exe [509816 2008-01-25] (TOSHIBA Corporation)
HKLM\...\Run: [00TCrdMain] => C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe [716800 2008-03-19] (TOSHIBA Corporation)
HKLM\...\Run: [Skytel] => C:\Windows\Skytel.exe [1826816 2007-11-20] (Realtek Semiconductor Corp.)
HKLM\...\Run: [Windows Defender] => C:\Program Files\Windows Defender\MSASCui.exe [1008184 2008-01-21] (Microsoft Corporation)
HKLM\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [6109776 2015-07-20] (AVAST Software)
HKU\S-1-5-21-1034233192-1315924873-3047747250-1000\...\Run: [Google Update] => C:\Users\admin\AppData\Local\Google\Update\GoogleUpdate.exe [107912 2014-10-17] (Google Inc.)
HKU\S-1-5-21-1034233192-1315924873-3047747250-1000\...\Run: [WMPNSCFG] => C:\Program Files\Windows Media Player\WMPNSCFG.exe [202240 2008-01-21] (Microsoft Corporation)
HKU\S-1-5-21-1034233192-1315924873-3047747250-1000\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner.exe [6405912 2015-06-01] (Piriform Ltd)
HKU\S-1-5-21-1034233192-1315924873-3047747250-1000\...\Winlogon: [Shell] C:\Windows\explorer.exe [2926592 2009-04-11] (Microsoft Corporation) <==== ATTENTION
Startup: C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Client Software-4000(v2.0).lnk [2009-09-22]
ShortcutTarget: Client Software-4000(v2.0).lnk -> C:\Program Files\Client Software-4000(v2.0)\NetAppSoft.exe ()
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShell.dll [2015-07-20] (AVAST Software)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://fr.msn.com/
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dl ... r=iesearch
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.microsoft.com/isapi/redir.dl ... ar=msnhome
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.microsoft.com/isapi/redir.dl ... r=iesearch
HKU\S-1-5-21-1034233192-1315924873-3047747250-1000\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.sk/
HKU\S-1-5-21-1034233192-1315924873-3047747250-1000\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.microsoft.com/isapi/redir.dl ... ar=msnhome
HKU\S-1-5-21-1034233192-1315924873-3047747250-1000\Software\Microsoft\Internet Explorer\Main,Default_search_url = http://www.microsoft.com/isapi/redir.dl ... r=iesearch
SearchScopes: HKLM -> {D822A92A-42B2-4F51-865C-9FF1ACCD1233} URL = http://www.google.com/search?source=ie7 ... lz=1I7TSEA;
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-1034233192-1315924873-3047747250-1000 -> {012E1000-F331-11DB-8314-0800200C9A66} URL = http://www.google.com/search?q={searchTerms}
SearchScopes: HKU\S-1-5-21-1034233192-1315924873-3047747250-1000 -> {D822A92A-42B2-4F51-865C-9FF1ACCD1233} URL = http://www.google.com/search?source=ie7 ... lz=1I7TSEA;
DPF: {62789780-B744-11D0-986B-00609731A21D} http://195.28.70.134/kapor2/lib/mgaxctrl.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinsta ... s-i586.cab
DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinsta ... s-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinsta ... s-i586.cab
Tcpip\Parameters: [DhcpNameServer] 192.168.0.1
Tcpip\..\Interfaces\{D3BD7708-B276-40C0-B7E6-A304E3CA2D2B}: [DhcpNameServer] 192.168.0.1

FireFox:
========
FF ProfilePath: C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\2msv9gsk.default
FF NewTab: about:newtab
FF Homepage: about:home
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_18_0_0_209.dll [2015-07-15] ()
FF Plugin: @real.com/nppl3260;version=6.0.12.448 -> C:\Program Files\VistaCodecPack\rm\browser\plugins\nppl3260.dll [2009-09-04] (RealNetworks, Inc.)
FF Plugin: @real.com/nprpjplug;version=6.0.12.448 -> C:\Program Files\VistaCodecPack\rm\browser\plugins\nprpjplug.dll [2009-09-04] (RealNetworks, Inc.)
FF Plugin: @videolan.org/vlc,version=2.0.0 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2012-02-17] (VideoLAN)
FF Plugin HKU\S-1-5-21-1034233192-1315924873-3047747250-1000: @tools.google.com/Google Update;version=3 -> C:\Users\admin\AppData\Local\Google\Update\1.3.28.1\npGoogleUpdate3.dll [2015-07-16] (Google Inc.)
FF Plugin HKU\S-1-5-21-1034233192-1315924873-3047747250-1000: @tools.google.com/Google Update;version=9 -> C:\Users\admin\AppData\Local\Google\Update\1.3.28.1\npGoogleUpdate3.dll [2015-07-16] (Google Inc.)
FF HKLM\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: Avast Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2015-07-20]

Chrome:
=======
CHR Profile: C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Slides) - C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2015-07-20]
CHR Extension: (Google Docs) - C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2015-07-20]
CHR Extension: (Google Drive) - C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-07-20]
CHR Extension: (YouTube) - C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2011-12-19]
CHR Extension: (Google Search) - C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2011-12-19]
CHR Extension: (Google Sheets) - C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2015-07-20]
CHR Extension: (AdBlock) - C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2015-07-20]
CHR Extension: (Avast Online Security) - C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki [2015-07-20]
CHR Extension: (Google Wallet) - C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-09-11]
CHR Extension: (No Name) - C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2011-12-19]
CHR HKLM\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2015-07-20]
StartMenuInternet: Google Chrome - C:\Users\admin\AppData\Local\Google\Chrome\Application\chrome.exe

========================== Services (Whitelisted) =================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [146600 2015-07-20] (AVAST Software)
R3 AvastVBoxSvc; C:\Program Files\AVAST Software\Avast\ng\vbox\AvastVBoxSVC.exe [3218624 2015-07-20] (Avast Software)
R2 ConfigFree Service; C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe [40960 2008-04-17] (TOSHIBA CORPORATION) [File not signed]
R2 Fabs; C:\Program Files\Common Files\MAGIX Services\Database\bin\FABS.exe [1253376 2009-08-27] (MAGIX AG) [File not signed]
S3 FirebirdServerMAGIXInstance; C:\Program Files\Common Files\MAGIX Services\Database\bin\fbserver.exe [3276800 2008-08-07] (MAGIX®) [File not signed]
S3 IDriverT; C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [69632 2005-04-04] (Macrovision Corporation) [File not signed]
S3 lxcc_device; C:\Windows\system32\lxcccoms.exe [466944 2005-07-06] (Lexmark International, Inc.) [File not signed]
S4 PnkBstrA; C:\Windows\system32\PnkBstrA.exe [66872 2009-12-12] ()
S4 PnkBstrB; C:\Windows\system32\PnkBstrB.exe [107832 2009-12-12] ()
R3 SmartFaceVWatchSrv; C:\Program Files\Toshiba\SmartFaceV\SmartFaceVWatchSrv.exe [77824 2008-08-25] (Toshiba) [File not signed]
R2 TeamViewer; C:\Program Files\TeamViewer\TeamViewer_Service.exe [5436176 2015-02-17] (TeamViewer GmbH)
R2 TOSHIBA SMART Log Service; C:\Program Files\TOSHIBA\SMARTLogService\TosIPCSrv.exe [126976 2007-12-03] (TOSHIBA Corporation) [File not signed]
R2 UleadBurningHelper; C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe [49152 2006-08-23] (Ulead Systems, Inc.) [File not signed]
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [272952 2008-01-21] (Microsoft Corporation)
S3 rpcapd; "%ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini" [X]

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [24016 2015-07-20] (AVAST Software)
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [76000 2015-07-20] (AVAST Software)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr.sys [55200 2015-07-20] (AVAST Software)
R0 aswRvrt; C:\Windows\system32\Drivers\aswRvrt.sys [49776 2015-07-20] (AVAST Software)
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [788784 2015-07-20] (AVAST Software)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [433264 2015-07-20] (AVAST Software)
R3 aswStmXP; C:\Windows\system32\drivers\aswStmXP.sys [161472 2015-07-20] (AVAST Software)
S3 aswTdi; C:\Windows\system32\drivers\aswTdi.sys [57888 2015-07-20] (AVAST Software)
R0 aswVmm; C:\Windows\system32\Drivers\aswVmm.sys [208664 2015-07-20] (AVAST Software)
R0 ngvss; C:\Windows\system32\Drivers\ngvss.sys [95112 2015-07-20] (AVAST Software)
R2 null_flt; C:\Windows\System32\Drivers\null_flt.sys [4736 2009-11-12] (null_flt) [File not signed]
R0 sptd; C:\Windows\System32\Drivers\sptd.sys [691696 2009-12-12] () [File not signed]
S3 usbbus; C:\Windows\System32\DRIVERS\lgusbbus.sys [13056 2008-11-11] (LG Electronics Inc.)
S3 UsbDiag; C:\Windows\System32\DRIVERS\lgusbdiag.sys [19968 2008-11-11] (LG Electronics Inc.)
S3 USBModem; C:\Windows\System32\DRIVERS\lgusbmodem.sys [24832 2008-11-11] (LG Electronics Inc.)
R3 UVCFTR; C:\Windows\System32\Drivers\UVCFTR_S.SYS [17960 2008-07-15] (Chicony Electronics Co., Ltd.)
R2 VBoxAswDrv; C:\Program Files\AVAST Software\Avast\ng\vbox\VBoxAswDrv.sys [220752 2015-07-20] (Avast Software)
S3 IpInIp; system32\DRIVERS\ipinip.sys [X]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [X]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [X]
S3 Tosrfcom; No ImagePath

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-07-20 21:06 - 2015-07-20 21:07 - 00015545 _____ C:\Users\admin\Desktop\FRST.txt
2015-07-20 21:06 - 2015-07-20 21:06 - 00000000 ____D C:\FRST
2015-07-20 21:04 - 2015-07-20 21:05 - 01638912 _____ (Farbar) C:\Users\admin\Desktop\FRST.exe
2015-07-20 17:31 - 2015-07-20 17:00 - 00024064 _____ C:\Windows\zoek-delete.exe
2015-07-20 17:01 - 2015-07-20 17:34 - 00026818 _____ C:\zoek-results.log
2015-07-20 17:00 - 2015-07-20 17:29 - 00000000 ____D C:\zoek_backup
2015-07-20 16:59 - 2015-07-20 16:59 - 01295360 _____ C:\Users\admin\Desktop\zoek.exe
2015-07-20 16:00 - 2015-07-20 16:08 - 00000000 ____D C:\snapshots
2015-07-20 15:05 - 2015-07-20 15:07 - 00000000 ____D C:\AdwCleaner
2015-07-20 15:03 - 2015-07-20 15:03 - 00000000 ____D C:\Users\admin\AppData\Roaming\AVAST Software
2015-07-20 13:27 - 2015-07-20 13:27 - 00001834 _____ C:\Users\Public\Desktop\Avast Free Antivirus.lnk
2015-07-20 13:27 - 2015-07-20 13:27 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVAST Software
2015-07-20 13:26 - 2015-07-20 13:26 - 00788784 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSnx.sys
2015-07-20 13:26 - 2015-07-20 13:26 - 00433264 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSP.sys
2015-07-20 13:26 - 2015-07-20 13:26 - 00313472 _____ (AVAST Software) C:\Windows\system32\aswBoot.exe
2015-07-20 13:26 - 2015-07-20 13:26 - 00208664 _____ (AVAST Software) C:\Windows\system32\Drivers\aswVmm.sys
2015-07-20 13:26 - 2015-07-20 13:26 - 00161472 _____ (AVAST Software) C:\Windows\system32\Drivers\aswStmXP.sys
2015-07-20 13:26 - 2015-07-20 13:26 - 00095112 _____ (AVAST Software) C:\Windows\system32\Drivers\ngvss.sys
2015-07-20 13:26 - 2015-07-20 13:26 - 00076000 _____ (AVAST Software) C:\Windows\system32\Drivers\aswMonFlt.sys
2015-07-20 13:26 - 2015-07-20 13:26 - 00057888 _____ (AVAST Software) C:\Windows\system32\Drivers\aswTdi.sys
2015-07-20 13:26 - 2015-07-20 13:26 - 00055200 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRdr.sys
2015-07-20 13:26 - 2015-07-20 13:26 - 00049776 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRvrt.sys
2015-07-20 13:26 - 2015-07-20 13:26 - 00043112 _____ (AVAST Software) C:\Windows\avastSS.scr
2015-07-20 13:26 - 2015-07-20 13:26 - 00024016 _____ (AVAST Software) C:\Windows\system32\Drivers\aswHwid.sys
2015-07-20 13:23 - 2015-07-20 13:23 - 02248704 _____ C:\Users\admin\Desktop\adwcleaner_4.208.exe
2015-07-20 13:21 - 2015-07-20 13:21 - 00000000 ____D C:\Program Files\AVAST Software
2015-07-20 11:59 - 2015-07-20 17:33 - 00479098 _____ C:\Windows\PFRO.log
2015-07-20 11:07 - 2015-07-20 11:07 - 00000000 ____D C:\rsit
2015-07-20 11:07 - 2015-07-20 11:07 - 00000000 ____D C:\Program Files\trend micro
2015-07-20 11:06 - 2015-07-20 11:07 - 00000040 _____ C:\Users\admin\Desktop\Nový textový dokument.txt
2015-07-20 11:04 - 2015-07-20 11:04 - 01107968 _____ C:\Users\admin\Downloads\RSIT.exe
2015-07-20 11:00 - 2015-07-20 11:00 - 00000000 ____D C:\Windows\system32\vbox
2015-07-20 10:58 - 2015-07-20 10:58 - 00000000 _____ C:\Windows\setuperr.log
2015-07-20 10:58 - 2015-07-20 10:58 - 00000000 _____ C:\Windows\setupact.log
2015-07-20 10:50 - 2015-07-20 13:21 - 00000000 ____D C:\ProgramData\AVAST Software
2015-07-20 10:48 - 2015-07-20 10:49 - 05685544 _____ (AVAST Software) C:\Users\admin\Downloads\avast_free_antivirus_setup_online.exe
2015-07-20 07:36 - 2015-07-20 07:36 - 00000809 _____ C:\Users\Public\Desktop\CCleaner.lnk
2015-07-19 18:09 - 2015-07-19 18:09 - 00015183 _____ C:\Users\admin\Downloads\wirelesskeyview (1).zip
2015-07-19 18:08 - 2015-07-19 18:08 - 00015183 _____ C:\Users\admin\Downloads\wirelesskeyview.zip
2015-07-19 18:05 - 2015-07-19 18:05 - 00284074 _____ C:\Users\admin\Downloads\wifiinfoview.zip
2015-07-15 21:31 - 2015-06-25 04:57 - 02066432 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2015-07-15 21:30 - 2015-07-03 18:04 - 01316864 _____ (Microsoft Corporation) C:\Windows\system32\ole32.dll
2015-07-15 21:29 - 2015-06-17 18:50 - 02264576 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll
2015-07-15 21:29 - 2015-06-17 17:09 - 00073216 _____ (Microsoft Corporation) C:\Windows\system32\msiexec.exe
2015-07-15 21:29 - 2015-06-12 18:01 - 00298496 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2015-07-15 21:20 - 2015-07-07 17:58 - 00034304 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll
2015-07-15 21:20 - 2015-07-07 16:22 - 00296960 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll
2015-07-15 21:19 - 2015-05-31 10:11 - 00225792 _____ (Microsoft Corporation) C:\Windows\system32\cewmdm.dll
2015-07-15 21:18 - 2015-06-27 18:03 - 00783872 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2015-07-15 21:18 - 2015-06-27 18:02 - 00501248 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2015-07-15 21:18 - 2015-06-27 18:02 - 00218112 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2015-07-15 21:18 - 2015-06-27 18:01 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\advapi32.dll
2015-07-15 21:18 - 2015-06-27 16:21 - 00217088 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb10.sys
2015-07-15 21:18 - 2015-06-27 16:21 - 00081408 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb20.sys
2015-07-15 21:18 - 2015-06-12 15:13 - 00440768 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2015-07-15 21:18 - 2015-01-09 02:17 - 00107008 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb.sys
2015-07-14 21:55 - 2015-07-03 07:31 - 12386304 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2015-07-14 21:55 - 2015-07-03 07:18 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2015-07-14 21:55 - 2015-06-17 03:10 - 01139712 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2015-07-14 21:55 - 2015-06-17 03:09 - 01804288 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2015-07-14 21:55 - 2015-06-17 03:09 - 01427968 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2015-07-14 21:55 - 2015-06-17 03:09 - 01129472 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2015-07-14 21:55 - 2015-06-17 03:09 - 00421888 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2015-07-14 21:55 - 2015-06-17 03:08 - 00718336 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2015-07-14 21:55 - 2015-06-17 03:08 - 00607744 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2015-07-14 21:55 - 2015-06-17 03:08 - 00353792 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2015-07-14 21:55 - 2015-06-17 03:08 - 00142848 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2015-07-14 21:55 - 2015-06-17 03:08 - 00065024 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2015-07-14 21:55 - 2015-06-17 03:08 - 00041472 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll
2015-07-14 21:55 - 2015-06-17 03:08 - 00011776 _____ (Microsoft Corporation) C:\Windows\system32\mshta.exe
2015-07-14 21:55 - 2015-06-17 03:08 - 00010752 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe
2015-07-14 21:54 - 2015-06-17 03:14 - 01810432 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2015-07-14 21:54 - 2015-06-17 03:12 - 09750528 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2015-07-14 21:54 - 2015-06-17 03:12 - 00367616 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2015-07-14 21:54 - 2015-06-17 03:08 - 00231936 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2015-07-14 21:54 - 2015-06-17 03:08 - 00223232 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2015-07-14 21:54 - 2015-06-17 03:08 - 00176640 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2015-07-14 21:54 - 2015-06-17 03:08 - 00073216 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-07-20 21:01 - 2006-11-02 14:47 - 00003216 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2015-07-20 21:01 - 2006-11-02 14:47 - 00003216 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2015-07-20 20:53 - 2012-12-31 22:46 - 00000830 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-07-20 20:37 - 2011-08-04 21:24 - 00000946 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1034233192-1315924873-3047747250-1000UA.job
2015-07-20 19:25 - 2009-09-21 21:17 - 01615288 _____ C:\Windows\WindowsUpdate.log
2015-07-20 17:46 - 2009-09-22 15:24 - 00000000 ____D C:\RecordFile
2015-07-20 17:40 - 2008-01-21 07:30 - 00759582 _____ C:\Windows\system32\PerfStringBackup.INI
2015-07-20 17:33 - 2006-11-02 15:01 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2015-07-20 17:32 - 2006-11-02 15:01 - 00032564 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2015-07-20 11:07 - 2012-12-18 21:36 - 00001912 _____ C:\Windows\epplauncher.mif
2015-07-20 07:49 - 2011-03-30 18:36 - 00000000 ____D C:\Windows\Minidump
2015-07-20 07:36 - 2014-01-25 17:34 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner
2015-07-20 07:36 - 2010-12-30 14:48 - 00000000 ____D C:\Program Files\CCleaner
2015-07-19 21:32 - 2009-09-23 08:50 - 00065024 _____ C:\Users\admin\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2015-07-16 22:37 - 2011-08-04 21:24 - 00000894 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1034233192-1315924873-3047747250-1000Core.job
2015-07-15 21:54 - 2012-12-31 22:46 - 00778416 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2015-07-15 21:54 - 2012-12-31 22:46 - 00142512 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2015-07-15 21:50 - 2006-11-02 14:47 - 00418136 _____ C:\Windows\system32\FNTCACHE.DAT
2015-07-15 21:29 - 2013-07-28 11:36 - 00000000 ____D C:\Windows\system32\MRT
2015-07-14 21:35 - 2011-03-12 14:11 - 00002095 _____ C:\Users\admin\Desktop\Google Chrome.lnk
2015-07-03 08:49 - 2006-11-02 12:24 - 127070192 _____ (Microsoft Corporation) C:\Windows\system32\mrt.exe
2015-06-23 13:27 - 2010-06-08 19:26 - 00246952 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe

==================== Files in the root of some directories =======

2009-12-12 10:01 - 2009-12-12 10:01 - 0022328 _____ () C:\Users\admin\AppData\Roaming\PnkBstrK.sys
2009-12-20 12:07 - 2009-12-20 12:07 - 0024206 _____ () C:\Users\admin\AppData\Roaming\UserTile.png
2010-04-04 15:33 - 2010-04-04 15:33 - 0000680 _____ () C:\Users\admin\AppData\Local\d3d9caps.dat
2009-09-23 08:50 - 2015-07-19 21:32 - 0065024 _____ () C:\Users\admin\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2010-06-27 13:06 - 2010-06-27 13:06 - 0000056 ____H () C:\ProgramData\ezsidmv.dat
2010-02-26 22:34 - 2010-02-27 08:46 - 0002828 _____ () C:\ProgramData\mw2mmgr.inc

==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-07-20 17:42

==================== End of log ============================

[vyosek]

Tvorba fixlistu pro FRST

• Spustte poznamkovy blok (Start-spustit-notepad)
• Zkopirujte skript nize

• Kód: Vybrat vše

  Start
  CloseProcesses:
  CreateRestorePoint:
  
  HKU\S-1-5-21-1034233192-1315924873-3047747250-1000\...\Run: [Google Update] => C:\Users\admin\AppData\Local\Google\Update\GoogleUpdate.exe [107912 2014-10-17] (Google Inc.)
  HKU\S-1-5-21-1034233192-1315924873-3047747250-1000\...\Run: [WMPNSCFG] => C:\Program Files\Windows Media Player\WMPNSCFG.exe [202240 2008-01-21] (Microsoft Corporation)
  HKU\S-1-5-21-1034233192-1315924873-3047747250-1000\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner.exe [6405912 2015-06-01] (Piriform Ltd)
  HKU\S-1-5-21-1034233192-1315924873-3047747250-1000\...\Winlogon: [Shell] C:\Windows\explorer.exe [2926592 2009-04-11] (Microsoft Corporation) <==== ATTENTION 
  Startup: C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Client Software-4000(v2.0).lnk [2009-09-22]
  
  HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://fr.msn.com/
  HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dl ... r=iesearch
  HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.microsoft.com/isapi/redir.dl ... ar=msnhome
  HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.microsoft.com/isapi/redir.dl ... r=iesearch
  HKU\S-1-5-21-1034233192-1315924873-3047747250-1000\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.sk/
  HKU\S-1-5-21-1034233192-1315924873-3047747250-1000\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.microsoft.com/isapi/redir.dl ... ar=msnhome
  HKU\S-1-5-21-1034233192-1315924873-3047747250-1000\Software\Microsoft\Internet Explorer\Main,Default_search_url = http://www.microsoft.com/isapi/redir.dl ... r=iesearch
  SearchScopes: HKLM -> {D822A92A-42B2-4F51-865C-9FF1ACCD1233} URL = http://www.google.com/search?source=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7TSEA;
  SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
  SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
  SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
  
  S3 rpcapd; "%ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini" [X]
  S3 IpInIp; system32\DRIVERS\ipinip.sys [X]
  S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [X]
  S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [X]
  S3 Tosrfcom; No ImagePath
  
  2015-07-20 21:06 - 2015-07-20 21:07 - 00015545 _____ C:\Users\admin\Desktop\FRST.txt
  2015-07-20 17:31 - 2015-07-20 17:00 - 00024064 _____ C:\Windows\zoek-delete.exe
  2015-07-20 17:01 - 2015-07-20 17:34 - 00026818 _____ C:\zoek-results.log
  2015-07-20 17:00 - 2015-07-20 17:29 - 00000000 ____D C:\zoek_backup
  2015-07-20 16:59 - 2015-07-20 16:59 - 01295360 _____ C:\Users\admin\Desktop\zoek.exe
  2015-07-20 15:05 - 2015-07-20 15:07 - 00000000 ____D C:\AdwCleaner
  2015-07-20 11:07 - 2015-07-20 11:07 - 00000000 ____D C:\rsit
  2015-07-20 11:07 - 2015-07-20 11:07 - 00000000 ____D C:\Program Files\trend micro
  2015-07-20 11:04 - 2015-07-20 11:04 - 01107968 _____ C:\Users\admin\Downloads\RSIT.exe
  2015-07-20 10:48 - 2015-07-20 10:49 - 05685544 _____ (AVAST Software) C:\Users\admin\Downloads\avast_free_antivirus_setup_online.exe
  
  2015-07-20 20:53 - 2012-12-31 22:46 - 00000830 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
  2015-07-20 20:37 - 2011-08-04 21:24 - 00000946 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1034233192-1315924873-3047747250-1000UA.job
  
  Hosts:
  EmptyTemp:
  Reboot:
  End
  

• Ulozte vytvoreny TXT jako fixlist.txt
• Presunte vytvoreny fixlist vedle FRST

Spustte znovu FRST.exe

• Kliknete na Fix
• Probehne oprava a vytvori log Fixlog.txt

Restart PC a dejte mi sem fixlog.txt

[mifoIV]

Fix result of Farbar Recovery Scan Tool (x86) Version: 20-07-2015
Ran by admin at 2015-07-22 15:11:26 Run:1
Running from C:\Users\admin\Desktop
Loaded Profiles: admin (Available Profiles: admin)
Boot Mode: Normal

==============================================

fixlist content:
*****************
Start
CloseProcesses:
CreateRestorePoint:

HKU\S-1-5-21-1034233192-1315924873-3047747250-1000\...\Run: [Google Update] => C:\Users\admin\AppData\Local\Google\Update\GoogleUpdate.exe [107912 2014-10-17] (Google Inc.)
HKU\S-1-5-21-1034233192-1315924873-3047747250-1000\...\Run: [WMPNSCFG] => C:\Program Files\Windows Media Player\WMPNSCFG.exe [202240 2008-01-21] (Microsoft Corporation)
HKU\S-1-5-21-1034233192-1315924873-3047747250-1000\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner.exe [6405912 2015-06-01] (Piriform Ltd)
HKU\S-1-5-21-1034233192-1315924873-3047747250-1000\...\Winlogon: [Shell] C:\Windows\explorer.exe [2926592 2009-04-11] (Microsoft Corporation) <==== ATTENTION
Startup: C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Client Software-4000(v2.0).lnk [2009-09-22]

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://fr.msn.com/
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dl ... r=iesearch
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.microsoft.com/isapi/redir.dl ... ar=msnhome
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.microsoft.com/isapi/redir.dl ... r=iesearch
HKU\S-1-5-21-1034233192-1315924873-3047747250-1000\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.sk/
HKU\S-1-5-21-1034233192-1315924873-3047747250-1000\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.microsoft.com/isapi/redir.dl ... ar=msnhome
HKU\S-1-5-21-1034233192-1315924873-3047747250-1000\Software\Microsoft\Internet Explorer\Main,Default_search_url = http://www.microsoft.com/isapi/redir.dl ... r=iesearch
SearchScopes: HKLM -> {D822A92A-42B2-4F51-865C-9FF1ACCD1233} URL = http://www.google.com/search?source=ie7 ... lz=1I7TSEA;
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =

S3 rpcapd; "%ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini" [X]
S3 IpInIp; system32\DRIVERS\ipinip.sys [X]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [X]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [X]
S3 Tosrfcom; No ImagePath

2015-07-20 21:06 - 2015-07-20 21:07 - 00015545 _____ C:\Users\admin\Desktop\FRST.txt
2015-07-20 17:31 - 2015-07-20 17:00 - 00024064 _____ C:\Windows\zoek-delete.exe
2015-07-20 17:01 - 2015-07-20 17:34 - 00026818 _____ C:\zoek-results.log
2015-07-20 17:00 - 2015-07-20 17:29 - 00000000 ____D C:\zoek_backup
2015-07-20 16:59 - 2015-07-20 16:59 - 01295360 _____ C:\Users\admin\Desktop\zoek.exe
2015-07-20 15:05 - 2015-07-20 15:07 - 00000000 ____D C:\AdwCleaner
2015-07-20 11:07 - 2015-07-20 11:07 - 00000000 ____D C:\rsit
2015-07-20 11:07 - 2015-07-20 11:07 - 00000000 ____D C:\Program Files\trend micro
2015-07-20 11:04 - 2015-07-20 11:04 - 01107968 _____ C:\Users\admin\Downloads\RSIT.exe
2015-07-20 10:48 - 2015-07-20 10:49 - 05685544 _____ (AVAST Software) C:\Users\admin\Downloads\avast_free_antivirus_setup_online.exe

2015-07-20 20:53 - 2012-12-31 22:46 - 00000830 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-07-20 20:37 - 2011-08-04 21:24 - 00000946 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1034233192-1315924873-3047747250-1000UA.job

Hosts:
EmptyTemp:
Reboot:
End
*****************

Processes closed successfully.
Restore point was successfully created.
HKU\S-1-5-21-1034233192-1315924873-3047747250-1000\Software\Microsoft\Windows\CurrentVersion\Run\\Google Update => value removed successfully.
HKU\S-1-5-21-1034233192-1315924873-3047747250-1000\Software\Microsoft\Windows\CurrentVersion\Run\\WMPNSCFG => value removed successfully.
HKU\S-1-5-21-1034233192-1315924873-3047747250-1000\Software\Microsoft\Windows\CurrentVersion\Run\\CCleaner Monitoring => value removed successfully.
HKU\S-1-5-21-1034233192-1315924873-3047747250-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell => value removed successfully.
C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Client Software-4000(v2.0).lnk => moved successfully.
HKLM\Software\\Microsoft\Internet Explorer\Main\\Start Page => value restored successfully
HKLM\Software\\Microsoft\Internet Explorer\Main\\Search Page => value restored successfully
HKLM\Software\\Microsoft\Internet Explorer\Main\\Default_Page_URL => value restored successfully
HKLM\Software\\Microsoft\Internet Explorer\Main\\Default_Search_URL => value restored successfully
HKU\S-1-5-21-1034233192-1315924873-3047747250-1000\Software\Microsoft\Internet Explorer\Main\\Start Page => value restored successfully
HKU\S-1-5-21-1034233192-1315924873-3047747250-1000\Software\Microsoft\Internet Explorer\Main\\Default_Page_URL => value restored successfully
HKU\S-1-5-21-1034233192-1315924873-3047747250-1000\Software\Microsoft\Internet Explorer\Main\\Default_Search_URL => value restored successfully
"HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{D822A92A-42B2-4F51-865C-9FF1ACCD1233}" => key removed successfully.
HKCR\CLSID\{D822A92A-42B2-4F51-865C-9FF1ACCD1233} => key not found.
HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value removed successfully.
HKU\S-1-5-19\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value removed successfully.
HKU\S-1-5-20\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value removed successfully.
rpcapd => Service removed successfully.
IpInIp => Service removed successfully.
NwlnkFlt => Service removed successfully.
NwlnkFwd => Service removed successfully.
Tosrfcom => Service removed successfully.
C:\Users\admin\Desktop\FRST.txt => moved successfully.
C:\Windows\zoek-delete.exe => moved successfully.
C:\zoek-results.log => moved successfully.
C:\zoek_backup => moved successfully.
C:\Users\admin\Desktop\zoek.exe => moved successfully.
C:\AdwCleaner => moved successfully.
C:\rsit => moved successfully.
C:\Program Files\trend micro => moved successfully.
C:\Users\admin\Downloads\RSIT.exe => moved successfully.
C:\Users\admin\Downloads\avast_free_antivirus_setup_online.exe => moved successfully.
C:\Windows\Tasks\Adobe Flash Player Updater.job => moved successfully.
C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1034233192-1315924873-3047747250-1000UA.job => moved successfully.
C:\Windows\System32\Drivers\etc\hosts => moved successfully.
Hosts restored successfully.
EmptyTemp: => 80 MB temporary data Removed.


The system needed a reboot.

==== End of Fixlog 15:12:51 ====

[vyosek]

Jak se chova PC??

[mifoIV]

Robí to stále, či idem cez ie alebo chrome. A dokonca aj na telefónoch to stále vyskakuje. Aj na dalšom pc.

[vyosek]

Tak to bude napadeny i router Jak mate pripojeny internet??

[mifoIV]

Cez pevnú linku

[vyosek]

Jaky mate router??

[mifoIV]

T com dsl-2641r