VIRY.CZ

Tak jsem se koukl do nainstalovaných programů, zda tam nefiguruje něco podezřelého a hned nahoře jsem narazil na Adanak - z webu jsem zjistil, že se jedná o onoho původce těch vyjíždějících reklamních oken a některých dalších podivností, ovšem návody na odstranění byly stejně podezřelé, jako původce nákazy sám - zde tedy vyčkám na Tvoje rady, jak se toho programu zbavit a ani se jej nebudu pokoušet odinstalovávat

Aha, tak onen Adanak není sám. Zároveň s ním se mi tam přiinstalilo ještě toto:

cosstminn
Feature Update Service (YFD)
Suporter 1.80

Pak tam je ještě pár věcí, které mi nic moc neříkají, ale datum instalace je o dost starší

Otevřte poznámkový blok a zkopírujte do něj:

KillAll::

File::
c:\program files (x86)\Supporter
c:\program files (x86)\cosstminn
c:\programdata\cosstminn
c:\program files (x86)\Adanak
c:\windows\system32\roboot64.exe
c:\program files (x86)\YourFileDownloader Updater
c:\windows\SYSNATIVE\svchost.exe
c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
c:\windows\Tasks\GoogleUpdateTaskMachineUA.job


Registry::
[-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\~\Browser Helper Objects\{A3479F92-6C4F-CD97-611F-3B614C4EF10B}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\~\Browser Helper Objects\{ef05f09c-9b2a-43a0-8155-fab1d641215a}]

Driver::
be0fb33b
{2f0ff925-183b-4210-98f5-cb2ffd917f2b}Gw64
Update Adanak
Util Adanak

RegLock::
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Nico Mak Computing\WinZip]

Reboot::

Uložte na plochu jako CFScript.txt. Pak jej myší přetáhněte nad ikonu ComboFix a pusťte. CF se spustí a vykoná příkazy ze skriptu

Trošku problémy s vykonáním CFScriptu - hlásilo to, že CF je "pokažený" a nakonec zmizel. Poté se nevedlo stáhnout a nainstalovat nový. Až po restartu a vypnutí Avastu se nainstaloval. Když jsem na něj přesunul script, tak proběhl kompletní scan. Neumím říct, zda se script vykonal, ale s ohledem na to, že reklamní okna už nevyskakují, tak usuzuji, že ano....

C se týká TB, tak ten zůstal odposledně beze změny - tj, že potvrzení výjimky už (zatím) neotravuje, ale procházení poštou a RSSfeedy je nadále nepříjemně "sekané" (přerušované) - zde neumím říct co je příčinou. Kdybych chtěl přejít na nějakého lehčího a rychlejšího klienta, co bys mi doporučil?

Jo, a tu je log z CF:


ComboFix 14-07-16.01 - Renca 16.07.2014 10:15:01.8.2 - x64
Microsoft Windows 7 Ultimate 6.1.7601.1.1250.420.1029.18.4095.2648 [GMT 2:00]
Spuštěný z: c:\users\Renca\Desktop\ComboFix1.exe
Použité ovládací přepínače :: c:\users\Renca\Desktop\CFScript.txt
AV: avast! Antivirus *Disabled/Updated* {17AD7D40-BA12-9C46-7131-94903A54AD8B}
SP: avast! Antivirus *Disabled/Updated* {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
FILE ::
"c:\program files (x86)\Adanak"
"c:\program files (x86)\cosstminn"
"c:\program files (x86)\Supporter"
"c:\program files (x86)\YourFileDownloader Updater"
"c:\programdata\cosstminn"
"c:\windows\system32\svchost.exe"
"c:\windows\system32\roboot64.exe"
"c:\windows\Tasks\GoogleUpdateTaskMachineCore.job"
"c:\windows\Tasks\GoogleUpdateTaskMachineUA.job"
.
ADS - Windows: deleted 0 bytes in 1 streams.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\program files (x86)\cosstminn
c:\program files (x86)\cosstminn\wJQPbZZWej.dat
c:\program files (x86)\cosstminn\wJQPbZZWej.dll
c:\program files (x86)\cosstminn\wJQPbZZWej.tlb
c:\program files (x86)\cosstminn\wJQPbZZWej.x64.dll
c:\programdata\cosstminn
c:\programdata\cosstminn\XE4dbzufkKC.dat
c:\programdata\cosstminn\XE4dbzufkKC.exe
c:\users\Administrator\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\kcpghjjebdibocnpnlapilikkddddepl
c:\users\Administrator\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\kcpghjjebdibocnpnlapilikkddddepl
c:\users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\kcpghjjebdibocnpnlapilikkddddepl
c:\users\Administrator\AppData\Local\Chromatic Browser\User Data\Default\Extensions\kcpghjjebdibocnpnlapilikkddddepl
c:\users\Administrator\AppData\Local\Torch\User Data\Default\Extensions\kcpghjjebdibocnpnlapilikkddddepl
c:\users\Guest\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\kcpghjjebdibocnpnlapilikkddddepl
c:\users\Guest\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\kcpghjjebdibocnpnlapilikkddddepl
c:\users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\kcpghjjebdibocnpnlapilikkddddepl
c:\users\Guest\AppData\Local\Chromatic Browser\User Data\Default\Extensions\kcpghjjebdibocnpnlapilikkddddepl
c:\users\Guest\AppData\Local\Torch\User Data\Default\Extensions\kcpghjjebdibocnpnlapilikkddddepl
c:\users\HomeGroupUser$\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\kcpghjjebdibocnpnlapilikkddddepl
c:\users\HomeGroupUser$\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\kcpghjjebdibocnpnlapilikkddddepl
c:\users\HomeGroupUser$\AppData\Local\Google\Chrome\User Data\Default\Extensions\kcpghjjebdibocnpnlapilikkddddepl
c:\users\HomeGroupUser$\AppData\Local\Chromatic Browser\User Data\Default\Extensions\kcpghjjebdibocnpnlapilikkddddepl
c:\users\HomeGroupUser$\AppData\Local\Torch\User Data\Default\Extensions\kcpghjjebdibocnpnlapilikkddddepl
c:\users\Renca\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\kcpghjjebdibocnpnlapilikkddddepl
c:\users\Renca\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\kcpghjjebdibocnpnlapilikkddddepl\2.0\background.html
c:\users\Renca\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\kcpghjjebdibocnpnlapilikkddddepl\2.0\content.js
c:\users\Renca\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\kcpghjjebdibocnpnlapilikkddddepl\2.0\lsdb.js
c:\users\Renca\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\kcpghjjebdibocnpnlapilikkddddepl\2.0\manifest.json
c:\users\Renca\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\kcpghjjebdibocnpnlapilikkddddepl\2.0\re_IrPUhxZ7s.js
c:\users\Renca\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\kcpghjjebdibocnpnlapilikkddddepl
c:\users\Renca\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\kcpghjjebdibocnpnlapilikkddddepl\2.0\background.html
c:\users\Renca\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\kcpghjjebdibocnpnlapilikkddddepl\2.0\content.js
c:\users\Renca\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\kcpghjjebdibocnpnlapilikkddddepl\2.0\lsdb.js
c:\users\Renca\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\kcpghjjebdibocnpnlapilikkddddepl\2.0\manifest.json
c:\users\Renca\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\kcpghjjebdibocnpnlapilikkddddepl\2.0\re_IrPUhxZ7s.js
c:\users\Renca\AppData\Local\Google\Chrome\User Data\Default\Preferences
c:\users\Renca\AppData\Local\Chromatic Browser\User Data\Default\Extensions\kcpghjjebdibocnpnlapilikkddddepl
c:\users\Renca\AppData\Local\Chromatic Browser\User Data\Default\Extensions\kcpghjjebdibocnpnlapilikkddddepl\2.0\background.html
c:\users\Renca\AppData\Local\Chromatic Browser\User Data\Default\Extensions\kcpghjjebdibocnpnlapilikkddddepl\2.0\content.js
c:\users\Renca\AppData\Local\Chromatic Browser\User Data\Default\Extensions\kcpghjjebdibocnpnlapilikkddddepl\2.0\lsdb.js
c:\users\Renca\AppData\Local\Chromatic Browser\User Data\Default\Extensions\kcpghjjebdibocnpnlapilikkddddepl\2.0\manifest.json
c:\users\Renca\AppData\Local\Chromatic Browser\User Data\Default\Extensions\kcpghjjebdibocnpnlapilikkddddepl\2.0\re_IrPUhxZ7s.js
c:\users\Renca\AppData\Local\Temp\_MEI39122\_ctypes.pyd
c:\users\Renca\AppData\Local\Temp\_MEI39122\_elementtree.pyd
c:\users\Renca\AppData\Local\Temp\_MEI39122\_hashlib.pyd
c:\users\Renca\AppData\Local\Temp\_MEI39122\_multiprocessing.pyd
c:\users\Renca\AppData\Local\Temp\_MEI39122\_socket.pyd
c:\users\Renca\AppData\Local\Temp\_MEI39122\_ssl.pyd
c:\users\Renca\AppData\Local\Temp\_MEI39122\hashobjs_ext.pyd
c:\users\Renca\AppData\Local\Temp\_MEI39122\pyexpat.pyd
c:\users\Renca\AppData\Local\Temp\_MEI39122\pysqlite2._sqlite.pyd
c:\users\Renca\AppData\Local\Temp\_MEI39122\python27.dll
c:\users\Renca\AppData\Local\Temp\_MEI39122\pythoncom27.dll
c:\users\Renca\AppData\Local\Temp\_MEI39122\PyWinTypes27.dll
c:\users\Renca\AppData\Local\Temp\_MEI39122\select.pyd
c:\users\Renca\AppData\Local\Temp\_MEI39122\unicodedata.pyd
c:\users\Renca\AppData\Local\Temp\_MEI39122\win32api.pyd
c:\users\Renca\AppData\Local\Temp\_MEI39122\win32com.shell.shell.pyd
c:\users\Renca\AppData\Local\Temp\_MEI39122\win32crypt.pyd
c:\users\Renca\AppData\Local\Temp\_MEI39122\win32event.pyd
c:\users\Renca\AppData\Local\Temp\_MEI39122\win32file.pyd
c:\users\Renca\AppData\Local\Temp\_MEI39122\win32gui.pyd
c:\users\Renca\AppData\Local\Temp\_MEI39122\win32inet.pyd
c:\users\Renca\AppData\Local\Temp\_MEI39122\win32pdh.pyd
c:\users\Renca\AppData\Local\Temp\_MEI39122\win32pipe.pyd
c:\users\Renca\AppData\Local\Temp\_MEI39122\win32process.pyd
c:\users\Renca\AppData\Local\Temp\_MEI39122\win32profile.pyd
c:\users\Renca\AppData\Local\Temp\_MEI39122\win32security.pyd
c:\users\Renca\AppData\Local\Temp\_MEI39122\win32ts.pyd
c:\users\Renca\AppData\Local\Temp\_MEI39122\windows._lib_cacheinvalidation.pyd
c:\users\Renca\AppData\Local\Temp\_MEI39122\wx._animate.pyd
c:\users\Renca\AppData\Local\Temp\_MEI39122\wx._controls_.pyd
c:\users\Renca\AppData\Local\Temp\_MEI39122\wx._core_.pyd
c:\users\Renca\AppData\Local\Temp\_MEI39122\wx._gdi_.pyd
c:\users\Renca\AppData\Local\Temp\_MEI39122\wx._html2.pyd
c:\users\Renca\AppData\Local\Temp\_MEI39122\wx._misc_.pyd
c:\users\Renca\AppData\Local\Temp\_MEI39122\wx._windows_.pyd
c:\users\Renca\AppData\Local\Temp\_MEI39122\wx._wizard.pyd
c:\users\Renca\AppData\Local\Temp\_MEI39122\wxbase294u_net_vc90.dll
c:\users\Renca\AppData\Local\Temp\_MEI39122\wxbase294u_vc90.dll
c:\users\Renca\AppData\Local\Temp\_MEI39122\wxmsw294u_adv_vc90.dll
c:\users\Renca\AppData\Local\Temp\_MEI39122\wxmsw294u_core_vc90.dll
c:\users\Renca\AppData\Local\Temp\_MEI39122\wxmsw294u_html_vc90.dll
c:\users\Renca\AppData\Local\Temp\_MEI39122\wxmsw294u_webview_vc90.dll
c:\users\Renca\AppData\Local\Temp\pdk-Renca-4528\31638f63e39b38d3e250a9a57cb9d1c5\Cwd.dll
c:\users\Renca\AppData\Local\Temp\pdk-Renca-4528\32785c19dc6898fbbbf06f3b776edd08\Fcntl.dll
c:\users\Renca\AppData\Local\Temp\pdk-Renca-4528\3a7ccbf8181ee5a145227a6dfce3594c\WinError.dll
c:\users\Renca\AppData\Local\Temp\pdk-Renca-4528\4461f48e31bde5c56b31b973b773de09\List.dll
c:\users\Renca\AppData\Local\Temp\pdk-Renca-4528\5ffd05b2cbd58528e56519784ca9c869\Hostname.dll
c:\users\Renca\AppData\Local\Temp\pdk-Renca-4528\60ff464e01c2cd5526dbdad5a125081d\Dumper.dll
c:\users\Renca\AppData\Local\Temp\pdk-Renca-4528\7ef0d901bf4203fbcf7a0fff0e82aa5f\Encode.dll
c:\users\Renca\AppData\Local\Temp\pdk-Renca-4528\93e7e3d6030f426844228042348210cf\Service.dll
c:\users\Renca\AppData\Local\Temp\pdk-Renca-4528\bd5179a413bc0c4b82eedc22c6cab101\re.dll
c:\users\Renca\AppData\Local\Temp\pdk-Renca-4528\c5cce8d16a1bd48692b421dcf46d3396\Util.dll
c:\users\Renca\AppData\Local\Temp\pdk-Renca-4528\d10c2c06ba2044cccc247c4315f5c7d3\Process.dll
c:\users\Renca\AppData\Local\Temp\pdk-Renca-4528\d1e7c33431cd8713f2ce3582829a8b14\Socket.dll
c:\users\Renca\AppData\Local\Temp\pdk-Renca-4528\de446fdd1ae335c7d2b9e62bb8cdf765\B.dll
c:\users\Renca\AppData\Local\Temp\pdk-Renca-4528\df1ba73f49c38cbbc7a11c779c3506d2\OLE.dll
c:\users\Renca\AppData\Local\Temp\pdk-Renca-4528\e56c61f7248672819579325af3387035\POSIX.dll
c:\users\Renca\AppData\Local\Temp\pdk-Renca-4528\eaeabd54205de2f10c00aea80bbf0d83\Registry.dll
c:\users\Renca\AppData\Local\Temp\pdk-Renca-4528\eb138ef0e4282611dbf485a302784646\LibYAML.dll
c:\users\Renca\AppData\Local\Temp\pdk-Renca-4528\f233f63b6654362865c7577442edb9e3\Win32.dll
c:\users\Renca\AppData\Local\Temp\pdk-Renca-4528\perl514.dll
c:\users\Renca\AppData\Local\Torch\User Data\Default\Extensions\kcpghjjebdibocnpnlapilikkddddepl
c:\users\Renca\AppData\Local\Torch\User Data\Default\Extensions\kcpghjjebdibocnpnlapilikkddddepl\2.0\background.html
c:\users\Renca\AppData\Local\Torch\User Data\Default\Extensions\kcpghjjebdibocnpnlapilikkddddepl\2.0\content.js
c:\users\Renca\AppData\Local\Torch\User Data\Default\Extensions\kcpghjjebdibocnpnlapilikkddddepl\2.0\lsdb.js
c:\users\Renca\AppData\Local\Torch\User Data\Default\Extensions\kcpghjjebdibocnpnlapilikkddddepl\2.0\manifest.json
c:\users\Renca\AppData\Local\Torch\User Data\Default\Extensions\kcpghjjebdibocnpnlapilikkddddepl\2.0\re_IrPUhxZ7s.js
c:\users\Renca\AppData\LocalLow\{A3479F92-6C4F-CD97-611F-3B614C4EF10B}
c:\users\Renca\AppData\LocalLow\{A3479F92-6C4F-CD97-611F-3B614C4EF10B}\cosstminn.2.9.dat
c:\windows\system32\svchost.exe
c:\windows\system32\roboot64.exe
c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
.
.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Legacy_{2F0FF925-183B-4210-98F5-CB2FFD917F2B}GW64
-------\Service_{2f0ff925-183b-4210-98f5-cb2ffd917f2b}Gw64
-------\Service_be0fb33b
-------\Service_Update Adanak
-------\Service_Util Adanak
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2014-06-16 do 2014-07-16 )))))))))))))))))))))))))))))))
.
.
2014-07-16 08:29 . 2014-07-16 08:29 -------- d-----w- c:\users\Public\AppData\Local\temp
2014-07-16 08:29 . 2014-07-16 08:29 -------- d-----w- c:\users\Default\AppData\Local\temp
2014-07-16 08:29 . 2014-07-16 08:29 -------- d-----w- c:\users\NB-IVO\AppData\Local\temp
2014-07-14 17:34 . 2014-07-14 17:34 -------- d-sh--w- c:\users\Renca\AppData\Local\EmieUserList
2014-07-14 17:34 . 2014-07-14 17:34 -------- d-sh--w- c:\users\Renca\AppData\Local\EmieSiteList
2014-07-14 17:29 . 2014-07-14 17:31 -------- d-----w- c:\users\Renca\AppData\Roaming\Google Chrome Backup
2014-07-14 17:29 . 2014-07-14 17:29 -------- d-----w- c:\program files (x86)\Google Chrome Backup
2014-07-14 15:31 . 2014-07-08 16:42 61112 ----a-w- c:\windows\system32\drivers\{2f0ff925-183b-4210-98f5-cb2ffd917f2b}Gw64.sys
2014-07-14 14:27 . 2014-07-15 20:57 -------- d-----w- c:\program files (x86)\Supporter
2014-07-14 14:27 . 2014-07-14 14:27 -------- d-----w- c:\programdata\259d42d7d7337449
2014-07-14 14:27 . 2014-07-14 14:27 -------- d-----w- c:\users\Renca\AppData\Local\Packages
2014-07-14 14:27 . 2014-07-14 14:27 -------- d-----w- c:\users\Renca\AppData\Local\Torch
2014-07-14 14:27 . 2014-07-14 14:27 -------- d-----w- c:\users\Renca\AppData\Local\Chromatic Browser
2014-07-14 14:26 . 2014-07-14 14:26 -------- d-----w- c:\users\HomeGroupUser$
2014-07-14 14:26 . 2014-07-14 14:26 -------- d-----w- c:\users\Guest
2014-07-14 14:26 . 2014-07-14 14:26 -------- d-----w- c:\users\Administrator
2014-07-14 14:26 . 2014-07-14 15:30 -------- d-----w- c:\program files (x86)\Adanak
2014-07-14 14:26 . 2014-07-14 14:26 -------- d-----w- c:\program files (x86)\YourFileDownloader Updater
2014-07-09 04:55 . 2014-06-06 10:10 624128 ----a-w- c:\windows\system32\qedit.dll
2014-07-09 04:55 . 2014-06-03 10:02 1719296 ----a-w- c:\program files\Windows Journal\NBDoc.DLL
2014-07-09 04:55 . 2014-06-03 10:02 1380864 ----a-w- c:\program files\Windows Journal\JNTFiltr.dll
2014-07-09 04:55 . 2014-06-03 10:02 1389568 ----a-w- c:\program files\Windows Journal\JNWDRV.dll
2014-07-09 04:55 . 2014-06-03 10:02 1354240 ----a-w- c:\program files\Common Files\Microsoft Shared\ink\journal.dll
2014-07-09 04:55 . 2014-06-03 09:29 936960 ----a-w- c:\program files (x86)\Common Files\Microsoft Shared\ink\journal.dll
2014-07-09 04:49 . 2014-06-05 14:45 1460736 ----a-w- c:\windows\system32\lsasrv.dll
2014-07-09 04:27 . 2014-07-09 04:27 -------- d-----w- c:\users\Default\AppData\Local\Google
2014-07-08 06:57 . 2014-07-16 00:00 -------- d-----w- c:\users\Renca\AppData\Local\Adobe
2014-07-08 05:15 . 2014-07-08 05:15 -------- d-----w- c:\programdata\IM
2014-07-08 05:15 . 2014-07-08 05:17 -------- d-----w- c:\users\Renca\AppData\Local\IM
2014-07-08 05:15 . 2014-07-08 05:15 -------- d-----w- c:\programdata\IncrediMail
2014-06-29 05:03 . 2014-07-16 08:04 -------- d-----r- c:\users\Renca\Disk Google
2014-06-16 17:36 . 2014-06-16 17:36 -------- d-----w- c:\programdata\GRETECH
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2014-07-10 08:13 . 2012-08-15 16:02 96441528 ----a-w- c:\windows\system32\MRT.exe
2014-07-09 09:26 . 2012-08-08 05:25 71344 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2014-07-09 09:26 . 2012-08-08 05:25 699056 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2014-06-27 19:41 . 2013-12-18 18:31 18960 ----a-w- c:\windows\system32\drivers\LNonPnP.sys
2014-06-18 23:56 . 2014-07-09 12:45 2724864 ----a-w- c:\windows\SysWow64\mshtml.tlb
2014-06-18 23:38 . 2014-07-09 12:45 455168 ----a-w- c:\windows\SysWow64\vbscript.dll
2014-06-18 23:37 . 2014-07-09 12:45 61952 ----a-w- c:\windows\SysWow64\iesetup.dll
2014-06-18 23:36 . 2014-07-09 12:45 51200 ----a-w- c:\windows\SysWow64\ieetwproxystub.dll
2014-06-18 23:35 . 2014-07-09 12:45 62464 ----a-w- c:\windows\SysWow64\MshtmlDac.dll
2014-06-18 23:23 . 2014-07-09 12:45 112128 ----a-w- c:\windows\SysWow64\ieUnatt.exe
2014-06-18 23:22 . 2014-07-09 12:45 592896 ----a-w- c:\windows\SysWow64\jscript9diag.dll
2014-06-18 23:06 . 2014-07-09 12:45 32256 ----a-w- c:\windows\SysWow64\JavaScriptCollectionAgent.dll
2014-06-18 22:52 . 2014-07-09 12:45 4254720 ----a-w- c:\windows\SysWow64\jscript9.dll
2014-06-18 22:46 . 2014-07-09 12:45 1068032 ----a-w- c:\windows\SysWow64\mshtmlmedia.dll
2014-06-18 22:45 . 2014-07-09 12:45 1964544 ----a-w- c:\windows\SysWow64\inetcpl.cpl
2014-06-18 22:13 . 2014-07-09 12:45 1791488 ----a-w- c:\windows\SysWow64\wininet.dll
2014-06-18 01:51 . 2014-07-09 04:53 646144 ----a-w- c:\windows\SysWow64\osk.exe
2014-06-09 21:12 . 2014-06-09 21:12 348160 ----a-w- c:\windows\SysWow64\msvcr71.dll
2014-06-09 21:12 . 2014-06-09 21:12 1060864 ----a-w- c:\windows\SysWow64\mfc71.dll
2014-06-09 21:12 . 2014-06-09 21:11 1700352 ----a-w- c:\windows\SysWow64\gdiplus.dll
2014-06-06 09:44 . 2014-07-09 04:55 509440 ----a-w- c:\windows\SysWow64\qedit.dll
2014-06-05 14:26 . 2014-07-09 04:49 22016 ----a-w- c:\windows\SysWow64\secur32.dll
2014-06-05 14:25 . 2014-07-09 04:49 96768 ----a-w- c:\windows\SysWow64\sspicli.dll
2014-05-30 07:52 . 2014-07-09 04:53 172032 ----a-w- c:\windows\SysWow64\wdigest.dll
2014-05-30 07:52 . 2014-07-09 04:53 65536 ----a-w- c:\windows\SysWow64\TSpkg.dll
2014-05-30 07:52 . 2014-07-09 04:53 247808 ----a-w- c:\windows\SysWow64\schannel.dll
2014-05-30 07:52 . 2014-07-09 04:53 220160 ----a-w- c:\windows\SysWow64\ncrypt.dll
2014-05-30 07:52 . 2014-07-09 04:53 259584 ----a-w- c:\windows\SysWow64\msv1_0.dll
2014-05-30 07:52 . 2014-07-09 04:53 550912 ----a-w- c:\windows\SysWow64\kerberos.dll
2014-05-09 06:14 . 2014-05-14 17:00 477184 ----a-w- c:\windows\system32\aepdu.dll
2014-05-09 06:11 . 2014-05-14 17:00 424448 ----a-w- c:\windows\system32\aeinv.dll
2014-05-08 09:32 . 2014-06-13 04:06 3178496 ----a-w- c:\windows\system32\rdpcorets.dll
2014-05-08 09:32 . 2014-06-13 04:06 16384 ----a-w- c:\windows\system32\RdpGroupPolicyExtension.dll
2014-04-25 02:34 . 2014-06-13 04:07 801280 ----a-w- c:\windows\system32\usp10.dll
2014-04-25 02:06 . 2014-06-13 04:07 626688 ----a-w- c:\windows\SysWow64\usp10.dll
2013-11-24 17:34 . 2013-11-24 17:34 13024768 ----a-w- c:\program files (x86)\Common Files\lpuninstall.exe
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\~\Browser Helper Objects\{ef05f09c-9b2a-43a0-8155-fab1d641215a}]
2014-07-14 01:59 249624 ----a-w- c:\program files (x86)\Adanak\AdanakBHO.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2013-09-10 23:54 131248 ----a-w- c:\users\Renca\AppData\Roaming\Dropbox\bin\DropboxExt.22.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2013-09-10 23:54 131248 ----a-w- c:\users\Renca\AppData\Roaming\Dropbox\bin\DropboxExt.22.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2013-09-10 23:54 131248 ----a-w- c:\users\Renca\AppData\Roaming\Dropbox\bin\DropboxExt.22.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]
@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
2013-09-10 23:54 131248 ----a-w- c:\users\Renca\AppData\Roaming\Dropbox\bin\DropboxExt.22.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"StickIt"="c:\program files (x86)\StickIt\StickIt3.exe" [2010-06-22 344064]
"WinOrganizer"="c:\program files (x86)\WinOrganizer\WinOrganizer.exe" [2011-08-08 3629568]
"Boxoft Tools"="c:\programdata\Boxtools\Boxofttoolbox.exe" [2010-12-15 514048]
"T-Mobile CManager"="c:\program files (x86)\T-Mobile\T-Mobile Internet Manager\Manager.exe" [2013-10-31 2166552]
"AtomicAlarmClock6"="c:\program files\Atomic Alarm Clock\AtomicAlarmClock.exe" [2013-12-20 1609728]
"GoogleDriveSync"="c:\program files (x86)\Google\Drive\googledrivesync.exe" [2014-06-27 24477056]
"uTorrent"="c:\users\Renca\AppData\Roaming\uTorrent\uTorrent.exe" [2014-07-03 1326672]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 90112]
"QlbCtrl.exe"="c:\program files (x86)\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2009-11-11 287800]
"SwitchBoard"="c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe" [2010-02-19 517096]
"AdobeCS6ServiceManager"="c:\program files (x86)\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe" [2012-03-09 1073312]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-11-21 959904]
"AvastUI.exe"="c:\program files\AVAST Software\Avast\AvastUI.exe" [2013-12-31 3764024]
"SoundMAXPnP"="c:\program files (x86)\Analog Devices\Core\smax4pnp.exe" [2007-02-21 1183744]
.
c:\users\Renca\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Dropbox.lnk - c:\users\Renca\AppData\Roaming\Dropbox\bin\Dropbox.exe /systemstartup [2014-5-20 33322312]
Stardock ObjectDock.lnk - c:\program files (x86)\Stardock\ObjectDock Plus\ObjectDock.exe [2011-11-12 4152536]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2009-7-1 1079584]
Install LastPass FF RunOnce.lnk - c:\program files (x86)\Common Files\lpuninstall.exe -q -name=LastPass -ffuuid support@lastpass.com [2013-11-24 13024768]
Nástroj schránky Logitech Media Server.lnk - c:\program files (x86)\Squeezebox\SqueezeTray.exe [2013-12-28 3051619]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"mixer1"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\fsproflt2]
@="Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]
R3 ATICDSDr;ATICDSDr;c:\users\Renca\AppData\Local\Temp\ATICDSDr.sys;c:\users\Renca\AppData\Local\Temp\ATICDSDr.sys [x]
R3 dg_ssudbus;SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudbus.sys;c:\windows\SYSNATIVE\DRIVERS\ssudbus.sys [x]
R3 ew_hwusbdev;Huawei MobileBroadband USB PNP Device;c:\windows\system32\DRIVERS\ew_hwusbdev.sys;c:\windows\SYSNATIVE\DRIVERS\ew_hwusbdev.sys [x]
R3 ew_usbenumfilter;huawei_CompositeFilter;c:\windows\system32\DRIVERS\ew_usbenumfilter.sys;c:\windows\SYSNATIVE\DRIVERS\ew_usbenumfilter.sys [x]
R3 huawei_cdcacm;huawei_cdcacm;c:\windows\system32\DRIVERS\ew_jucdcacm.sys;c:\windows\SYSNATIVE\DRIVERS\ew_jucdcacm.sys [x]
R3 huawei_ext_ctrl;huawei_ext_ctrl;c:\windows\system32\DRIVERS\ew_juextctrl.sys;c:\windows\SYSNATIVE\DRIVERS\ew_juextctrl.sys [x]
R3 huawei_wwanecm;huawei_wwanecm;c:\windows\system32\DRIVERS\ew_juwwanecm.sys;c:\windows\SYSNATIVE\DRIVERS\ew_juwwanecm.sys [x]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x]
R3 LEqdUsb;Logitech SetPoint Unifying KMDF USB Filter;c:\windows\system32\DRIVERS\LEqdUsb.Sys;c:\windows\SYSNATIVE\DRIVERS\LEqdUsb.Sys [x]
R3 LHidEqd;Logitech SetPoint Unifying KMDF HID Filter;c:\windows\system32\DRIVERS\LHidEqd.Sys;c:\windows\SYSNATIVE\DRIVERS\LHidEqd.Sys [x]
R3 massfilter;Mass Storage Filter Driver;c:\windows\system32\drivers\massfilter.sys;c:\windows\SYSNATIVE\drivers\massfilter.sys [x]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys;c:\windows\SYSNATIVE\drivers\rdpvideominiport.sys [x]
R3 ssudmdm;SAMSUNG Mobile USB Modem Drivers (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudmdm.sys;c:\windows\SYSNATIVE\DRIVERS\ssudmdm.sys [x]
R3 SwitchBoard;SwitchBoard;c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe;c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [x]
R3 Synth3dVsc;Synth3dVsc;c:\windows\system32\drivers\synth3dvsc.sys;c:\windows\SYSNATIVE\drivers\synth3dvsc.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 tsusbhub;tsusbhub;c:\windows\system32\drivers\tsusbhub.sys;c:\windows\SYSNATIVE\drivers\tsusbhub.sys [x]
R3 VGPU;VGPU;c:\windows\system32\drivers\rdvgkmd.sys;c:\windows\SYSNATIVE\drivers\rdvgkmd.sys [x]
R3 VsEtwService120;Visual Studio ETW Event Collection Service;c:\program files (x86)\Microsoft Visual Studio 12.0\Common7\Packages\Debugger\Services\VsEtwService.exe;c:\program files (x86)\Microsoft Visual Studio 12.0\Common7\Packages\Debugger\Services\VsEtwService.exe [x]
R3 WatAdminSvc;Služba Technologie aktivace Windows;c:\windows\system32\Wat\WatAdminSvc.exe;c:\windows\SYSNATIVE\Wat\WatAdminSvc.exe [x]
S0 aswRvrt;avast! Revert; [x]
S0 aswVmm;avast! VM Monitor; [x]
S0 FSProFilter2;FSPro File Filter 2;c:\windows\System32\Drivers\FSPFltd2.sys;c:\windows\SYSNATIVE\Drivers\FSPFltd2.sys [x]
S1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys;c:\windows\SYSNATIVE\drivers\aswSnx.sys [x]
S1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys;c:\windows\SYSNATIVE\drivers\aswSP.sys [x]
S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys;c:\windows\SYSNATIVE\drivers\aswMonFlt.sys [x]
S2 AtomicAlarmClock;Atomic Alarm Clock Time;c:\program files\Atomic Alarm Clock\timeserv.exe;c:\program files\Atomic Alarm Clock\timeserv.exe [x]
S2 fsproflt2;FSPro Filter Service 2;c:\windows\SysWOW64\fsproflt2.exe;c:\windows\SysWOW64\fsproflt2.exe [x]
S2 MbnExt;Mobile Broadband Extension Service;c:\windows\system32\svchost.exe;c:\windows\SYSNATIVE\svchost.exe [x]
S2 nlsX86cc;Nalpeiron Licensing Service;c:\windows\SysWOW64\nlssrv32.exe;c:\windows\SysWOW64\nlssrv32.exe [x]
S3 AIDA64Driver;FinalWire AIDA64 Kernel Driver;c:\program files (x86)\FinalWire\AIDA64 Extreme\kerneld.x64;c:\program files (x86)\FinalWire\AIDA64 Extreme\kerneld.x64 [x]
S3 aswStm;aswStm;c:\windows\system32\drivers\aswStm.sys;c:\windows\SYSNATIVE\drivers\aswStm.sys [x]
S3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\DRIVERS\btwl2cap.sys;c:\windows\SYSNATIVE\DRIVERS\btwl2cap.sys [x]
S3 Com4QLBEx;Com4QLBEx;c:\program files (x86)\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe;c:\program files (x86)\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe [x]
S3 huawei_enumerator;huawei_enumerator;c:\windows\system32\DRIVERS\ew_jubusenum.sys;c:\windows\SYSNATIVE\DRIVERS\ew_jubusenum.sys [x]
.
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost]
MbnExt REG_MULTI_SZ MbnExt
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2014-07-14 18:02 1091912 ----a-w- c:\program files (x86)\Google\Chrome\Application\35.0.1916.153\Installer\chrmstp.exe
.
Obsah adresáře 'Naplánované úlohy'
.
2014-07-16 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-08-08 09:26]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2013-12-31 10:22 287280 ----a-w- c:\program files\AVAST Software\Avast\ashShA64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2013-09-10 23:54 164016 ----a-w- c:\users\Renca\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2013-09-10 23:54 164016 ----a-w- c:\users\Renca\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2013-09-10 23:54 164016 ----a-w- c:\users\Renca\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]
@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
2013-09-10 23:54 164016 ----a-w- c:\users\Renca\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveBlacklistedOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42}]
2014-06-27 12:20 777032 ----a-w- c:\program files (x86)\Google\Drive\googledrivesync64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSharedEditOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44}]
2014-06-27 12:20 777032 ----a-w- c:\program files (x86)\Google\Drive\googledrivesync64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSharedViewOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D43}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D43}]
2014-06-27 12:20 777032 ----a-w- c:\program files (x86)\Google\Drive\googledrivesync64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSyncedOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40}]
2014-06-27 12:20 777032 ----a-w- c:\program files (x86)\Google\Drive\googledrivesync64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSyncingOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41}]
2014-06-27 12:20 777032 ----a-w- c:\program files (x86)\Google\Drive\googledrivesync64.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2008-03-28 1234216]
"AdobeAAMUpdater-1.0"="c:\program files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2012-04-04 446392]
"EvtMgr6"="c:\program files\Logitech\SetPointP\SetPoint.exe" [2013-07-31 3091224]
.
------- Doplňkový sken -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://www.google.com
mLocal Page = c:\windows\SysWOW64\blank.htm
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~2\MICROS~1\Office12\EXCEL.EXE/3000
IE: Odeslat obrázek do zařízení &Bluetooth... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: Odeslat stránku do zařízení &Bluetooth... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
Trusted Zone: mojebanka.cz\*
Trusted Zone: mojebanka.cz\etrading
Trusted Zone: mojebanka.cz\www
Trusted Zone: mojebanka.cz\*
Trusted Zone: mojebanka.cz\etrading
TCP: DhcpNameServer = 192.168.1.1
TCP: Interfaces\{788A3804-7946-4A50-BB32-DCCADDAF9CDC}: NameServer = 93.153.117.1 93.153.117.33
TCP: Interfaces\{850A5427-2841-4C2E-A225-654A46031765}: NameServer = 93.153.117.1 93.153.117.33
TCP: Interfaces\{EEC97EFE-C21F-42EC-96A6-65F0D9E132BD}: NameServer = 93.153.117.1 93.153.117.33
FF - ProfilePath - c:\users\Renca\AppData\Roaming\Mozilla\Firefox\Profiles\o86nuz98.default\
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
.
BHO-{A3479F92-6C4F-CD97-611F-3B614C4EF10B} - c:\program files (x86)\cosstminn\wJQPbZZWej.dll
AddRemove-dBpoweramp FLAC Codec - c:\windows\system32\SpoonUninstall.exe
AddRemove-dBpoweramp [Calculate Audio CRC] Codec - c:\windows\system32\SpoonUninstall.exe
AddRemove-{5F189DF5-2D05-472B-9091-84D9848AE48B}{be0fb33b} - c:\progra~2\SUPPOR~1\SUPPOR~1.DLL
AddRemove-{a742cecc-7f50-4aac-a250-b406935bbc24} - c:\programdata\Package Cache\{a742cecc-7f50-4aac-a250-b406935bbc24}\wdexpress_langpack.exe
AddRemove-{bec3d87e-1d6d-4b15-8383-29068c86b888} - c:\programdata\Package Cache\{bec3d87e-1d6d-4b15-8383-29068c86b888}\wdexpress_full.exe
AddRemove-{CE681A67-9477-CBE6-EB9D-FE534875F98D} - c:\programdata\cosstminn\XE4dbzufkKC.exe
.
.
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AIDA64Driver]
"ImagePath"="\??\c:\program files (x86)\FinalWire\AIDA64 Extreme\kerneld.x64"
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Nico Mak Computing\WinZip]
"SymbolicLinkValue"=hex(6):5c,00,52,00,65,00,67,00,69,00,73,00,74,00,72,00,79,
00,5c,00,4d,00,41,00,43,00,48,00,49,00,4e,00,45,00,5c,00,53,00,6f,00,66,00,\
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\program files\AVAST Software\Avast\AvastSvc.exe
c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
c:\program files\Hide Folders 2012\hf.exe
c:\program files (x86)\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe
c:\program files (x86)\Google\Update\GoogleUpdate.exe
c:\program files (x86)\FinalWire\AIDA64 Extreme\aida64.exe
c:\programdata\Boxtools\Toolbox.exe
c:\program files (x86)\Hewlett-Packard\HP Quick Launch Buttons\VolCtrl.exe
c:\program files (x86)\Hewlett-Packard\Shared\hpqwmiex.exe
c:\program files\WIDCOMM\Bluetooth Software\BluetoothHeadsetProxy.exe
c:\users\Renca\AppData\Roaming\Dropbox\bin\Dropbox.exe
.
**************************************************************************
.
Celkový čas: 2014-07-16 10:44:06 - počítač byl restartován
ComboFix-quarantined-files.txt 2014-07-16 08:44
ComboFix2.txt 2014-07-15 21:14
.
Před spuštěním: Volných bajtů: 24 956 518 400
Po spuštění: Volných bajtů: 24 290 025 472
.
- - End Of File - - B6BB34B197C7AB964775D4E68388F5DF
A36C5E4F47E84449FF07ED3517B43A31

Ivošisko píše:Aha, tak onen Adanak není sám. Zároveň s ním se mi tam přiinstalilo ještě toto:

cosstminn
Feature Update Service (YFD)
Suporter 1.80

Pak tam je ještě pár věcí, které mi nic moc neříkají, ale datum instalace je o dost starší

Hm, tak teď jsem kouknul do správce programů a všechny tyto věci tam zůstaly, takže nevím, zda v čase opět nezačnou vystrkovat růžky

Podle logu zbylo jen tohle:

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\~\Browser Helper Objects\{ef05f09c-9b2a-43a0-8155-fab1d641215a}]
2014-07-14 01:59 249624 ----a-w- c:\program files (x86)\Adanak\AdanakBHO.dll

Podle návodu http://forum.viry.cz/viewtopic.php?f=46&t=2791 otevřte regedit a klíč odmázněte ručně. To co je uvedeno ve správci programů už není funkční, tak by problém být neměl.

Dobrá....takže jsem se zkusil tento klíč v registrech máznout (jestli jsem byl šikovný neumím říct )

Co bych si měl podle Tebe místo Thunderbirdu nainstalovat?

Mám dát ty 4 blbosti ve správci programů odinstalovat ať tam zbytečně nevisí?

A mám ještě jeden problém, o kterém jsem zde nehovořil - při každém startu/restartu mi vyskakuje tato hláška (a přitom je tento driver pro ASUS (já mám HP Compaq)) - jak se toho zbavit?:

Mám dát ty 4 blbosti ve správci programů odinstalovat ať tam zbytečně nevisí?

Ono to možná nepůjde, zničili jsme to přes logy, ale zkusit to můžete.

Co bych si měl podle Tebe místo Thunderbirdu nainstalovat?

Nevím, krom Thunderbirdu a Outlooku vím už jen o WindowsMail: http://windows.microsoft.com/cs-cz/wind ... overviewxp

A mám ještě jeden problém, o kterém jsem zde nehovořil - při každém startu/restartu mi vyskakuje tato hláška (a přitom je tento driver pro ASUS (já mám HP Compaq)) - jak se toho zbavit?:

Jedině nainstalovat: http://support.asus.com/Download.aspx?S ... kage&os=30 V PC bude něco, co hlídá stav softwaru. A hýbät s tím by nemuselo dobře dopadnout.

Takže nyní se to chová normálně - velké díky Rudy - jsi borec

Rádo se stalo!