http://red.installer.xyz

[Rudy]

Všechny nálezy smažte.

[Leoš Jelínek]

Tak je vše smazáno.

[Rudy]

Nastala nějaká změna?

[Leoš Jelínek]

Bohužel se IE opět spustil s tou samou stránkou.

[Rudy]

Zkuste smazat cache IE.

[Leoš Jelínek]

Bohužel žádná změna.

[Rudy]

Pokuste se IE opravit podle: https://support.microsoft.com/cs-cz/kb/318378 .

[Leoš Jelínek]

Tak jsem IE 11 úplně odstranil, oprava nepomohla. Tak uvidíme.

[Rudy]

Zkuste to takto:

Stahnete Zoek.exe http://hijackthis.nl/smeenk/ a ulozte jej na plochu

Pokud pouzivate Win Vista ci W7, kliknete na Zoek pravym a dejte Run As Administrator ci Spustit jako spravce
Do okna vlozte skript nize

autoclean;
autoclean;
resethosts;
emptyclsid;
IEdefaults;
FFdefaults;
CHRdefaults;
emptyIEcache;
emptyFFcache;
emptyCHRcache;
emptyalltemp;
emptyflash;
emptyjava;
emptyrecycle.bin;

Nasledne kliknete na Run Script
PC provede opravu, restartuje se a da Vam log, jeho obsah vlozte sem

[Leoš Jelínek]

Zoek.exe v5.0.0.0 Updated 04-May-2015
Tool run by Leoç on po 24.08.2015 at 22:07:12,60.
Microsoft Windows 7 Home Premium 6.1.7601 Service Pack 1 x86
Running in: Normal Mode Internet Access Detected
Launched: C:\Users\LEO~1\Downloads\zoek.exe [Scan all users] [Script inserted]

==== System Restore Info ======================

24.8.2015 22:08:13 Zoek.exe System Restore Point Created Successfully.

==== Reset Hosts File ======================

# Copyright (c) 1993-2006 Microsoft Corp.
#
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
#
# This file contains the mappings of IP addresses to host names. Each
# entry should be kept on an individual line. The IP address should
# be placed in the first column followed by the corresponding host name.
# The IP address and the host name should be separated by at least one
# space.
#
# Additionally, comments (such as these) may be inserted on individual
# lines or following the machine name denoted by a '#' symbol.
#
# For example:
#
# 102.54.94.97 rhino.acme.com # source server
# 38.25.63.10 x.acme.com # x client host

# localhost name resolution is handled within DNS itself.
127.0.0.1 localhost
::1 localhost

==== Empty Folders Check ======================

C:\Program Files\7-Zip deleted successfully
C:\Program Files\Fotolab deleted successfully
C:\Program Files\TNod User & Password Finder deleted successfully
C:\Users\LEO~1\AppData\Local\CrashDumps deleted successfully
C:\Users\LEO~1\AppData\Local\EmieBrowserModeList deleted successfully
C:\Users\LEO~1\AppData\Local\EmieSiteList deleted successfully
C:\Users\LEO~1\AppData\Local\EmieUserList deleted successfully
C:\Users\LEO~1\AppData\Local\GHISLER deleted successfully
C:\Users\LEO~1\AppData\Local\Opera deleted successfully
C:\Users\LEO~1\AppData\Local\Opera Software deleted successfully

==== Deleting CLSID Registry Keys ======================


==== Deleting CLSID Registry Values ======================


==== Deleting Services ======================


==== FireFox Fix ======================

Deleted from C:\Users\LEO~1\AppData\Roaming\Mozilla\Firefox\Profiles\l58ikph3.default\prefs.js:
user_pref("browser.startup.homepage", "https://www.google.cz/");
user_pref("browser.search.selectedEngine", "");
user_pref("browser.search.useDBForOrder", true);

Added to C:\Users\LEO~1\AppData\Roaming\Mozilla\Firefox\Profiles\l58ikph3.default\prefs.js:
user_pref("browser.startup.homepage", "about:home");
user_pref("browser.newtab.url", "about:newtab");

ProfilePath: C:\Users\LEO~1\AppData\Roaming\Mozilla\Firefox\Profiles\l58ikph3.default

user.js not found
---- Lines suggestor removed from prefs.js ----
user_pref("extensions.WinToFlashSuggestor.aid", "10045");
user_pref("extensions.WinToFlashSuggestor.uid", "503112b95335a7785614b0c4d16e4db9");
---- FireFox user.js and prefs.js backups ----

prefs_24.08.2015_2221_.backup

==== Deleting Files \ Folders ======================

C:\Program Files\7-Zip not found
C:\Program Files\Fotolab not found
C:\Program Files\TNod User & Password Finder not found
C:\Windows\system32\config\systemprofile\Searches deleted
C:\Users\LEO~1\Desktop\MRDownloader.exe deleted

==== Firefox Start and Search pages ======================

ProfilePath: C:\Users\LEO~1\AppData\Roaming\Mozilla\Firefox\Profiles\l58ikph3.default
user_pref("browser.startup.homepage", "about:home");
user_pref("browser.newtab.url", "about:newtab");

==== Firefox Extensions ======================

ProfilePath: C:\Users\LEO~1\AppData\Roaming\Mozilla\Firefox\Profiles\l58ikph3.default
- Undetermined - C:\Users\Leoš\AppData\Roaming\Mozilla\Firefox\Profiles\l58ikph3.default\extensions\{2d3fbcf7-be69-4433-8858-c621a8d0e58d}
- Widevine Media Optimizer - %ProfilePath%\extensions\{2d3fbcf7-be69-4433-8858-c621a8d0e58d}
- Linkificator - %ProfilePath%\extensions\linkificator@markapola.xpi
- Adblock Plus - %ProfilePath%\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi

AppDir: C:\Program Files\Mozilla Firefox
- Default - %AppDir%\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

==== Firefox Plugins ======================


==== Chromium Look ======================



==== Set IE to Default ======================

Old Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"="https://www.google.cz/?gws_rd=ssl"

New Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"="https://www.google.cz/?gws_rd=ssl"

==== All HKCU SearchScopes ======================

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes
"DefaultScope"="{0633EE93-D776-472f-A0FF-E1416B8B2E3A}"
{012E1000-F331-11DB-8314-0800200C9A66} Google Url="http://www.google.com/search?q={searchTerms}"
{0633EE93-D776-472f-A0FF-E1416B8B2E3A} Bing Url="http://www.bing.com/search?q={searchTer ... ORM=IESR02"

==== Reset Google Chrome ======================

C:\Users\LEO~1\AppData\Local\Google\Chrome\User Data\Default\Preferences was reset successfully
C:\Users\LEO~1\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences was reset successfully
C:\Users\LEO~1\AppData\Local\Google\Chrome\User Data\Default\Web Data was reset successfully

==== Deleting Registry Keys ======================

HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\FlashPlayerUpdate deleted successfully

==== Empty IE Cache ======================

C:\Users\LEO~1\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\LEO~1\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5 emptied successfully
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\serviceprofiles\networkservice\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\serviceprofiles\Localservice\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully

==== Empty FireFox Cache ======================

C:\Users\LEO~1\AppData\Local\Mozilla\Firefox\Profiles\l58ikph3.default\cache2 emptied successfully

==== Empty Chrome Cache ======================

C:\Users\LEO~1\AppData\Local\Google\Chrome\User Data\Default\Cache emptied successfully

==== Empty All Flash Cache ======================

Flash Cache Emptied Successfully

==== Empty All Java Cache ======================

Java Cache cleared successfully

==== C:\zoek_backup content ======================

C:\zoek_backup (files=5 folders=1 942840 bytes)

==== Empty Temp Folders ======================

C:\Users\Default\AppData\Local\Temp emptied successfully
C:\Users\Default User\AppData\Local\Temp emptied successfully
C:\Users\LEO~1\AppData\Local\Temp will be emptied at reboot
C:\Windows\serviceprofiles\networkservice\AppData\Local\Temp will be emptied at reboot
C:\Windows\serviceprofiles\Localservice\AppData\Local\Temp emptied successfully
C:\Windows\Temp will be emptied at reboot

==== After Reboot ======================

==== Empty Temp Folders ======================

C:\Windows\Temp successfully emptied
C:\Users\LEO~1\AppData\Local\Temp successfully emptied

==== Empty Recycle Bin ======================

C:\$RECYCLE.BIN successfully emptied

==== Deleting Files / Folders ======================

"C:\Windows\serviceprofiles\networkservice\AppData\Local\Temp\MpCmdRun.log" not found

==== EOF on po 24.08.2015 at 22:29:38,82 ======================

Bohužel se to objevilo i po tomhle.

[Rudy]

Tak ještě jednu utilitu:

Stahnete Junkware Removal Tool http://thisisudax.org/downloads/JRT.exe

Ulozte nejlepe na plochu
Po spusteni se zobrazi licencni podminky, stisknete libovolnou klavesu
Probehne vytvoreni zalohy a nasledne prohledavani
Probehne skenovani a pak se objevi log, pripadne bude ulozen v c:\JRT jako JRT.txt, ten sem vlozte

[Leoš Jelínek]

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Malwarebytes
Version: 7.5.7 (08.18.2015:1)
OS: Windows 7 Home Premium x86
Ran by Leoç on Łt 25.08.2015 at 16:45:41,29
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Tasks



~~~ Registry Values



~~~ Registry Keys

Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\APN PIP
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\PIP
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\PIP



~~~ Files

Successfully deleted: [File] C:\ProgramData\1376399078.bdinstall.bin



~~~ Folders

Successfully deleted: [Folder] C:\Program Files\myfree codec
Successfully deleted: [Folder] C:\Users\Leoç\AppData\Roaming\torrentstream



~~~ FireFox

Emptied folder: C:\Users\Leoç\AppData\Roaming\mozilla\firefox\profiles\l58ikph3.default\minidumps [492 files]



~~~ Chrome


[C:\Users\Leoç\Appdata\Local\Google\Chrome\User Data\Default\Preferences] - default search provider reset

[C:\Users\Leoç\Appdata\Local\Google\Chrome\User Data\Default\Preferences] - Extensions Deleted:

[C:\Users\Leoç\Appdata\Local\Google\Chrome\User Data\Default\Secure Preferences] - default search provider reset

[C:\Users\Leoç\Appdata\Local\Google\Chrome\User Data\Default\Secure Preferences] - Extensions Deleted:





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on Łt 25.08.2015 at 16:49:32,20
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

[Rudy]

Smazáno. Změnilo se něco?

[Leoš Jelínek]

Bohužel se nezměnilo nic.

[Rudy]

Ono se to v logách nikde neobjeví, takže nevím, co vlasně mazat. Zkusíme ještě ComboFix:

Stahnete a ulozte nejlepe na plochu ComboFix: http://download.bleepingcomputer.com/sUBs/ComboFix.exe

pote spustte aplikaci pod uctem s administratorskym opravnenim

hned po startu se zobrazi obrazovka s licencnimi podminkami, pokracujte kliknutim na tlacitko Ano.

v klidu si postavte na kafe (cela akce trva cca. 5-10 minut, nekdy i dele - dle toho, o jak rychly stroj se

jedna a kolika soubory se skener bude muset prodirat), behem skenu se nepokousejte spoustet zadne jine

aplikace ani nic jineho

behem skenovani nepropadejte panice, vas stroj muze byt restartovan (predevsim pri prvni aplikaci skeneru)

upozorneni: pokud pouzivate antispyware s rezidentnim stitem, prepnete jeho rezidentni stit do Install Mode,

pripadne jej po dobu skenu uplne deaktivujte, protoze dochazi pri skenu a vymazu pripadneho malware k

nezadoucim kolizim s rezidentem antispyware.