vyskakovacie okno v mozille

Zpráva

#16 Příspěvek od **vyosek** » 13 Srp 2014 20:50

Tvorba fixlistu pro FRST

Spustte poznamkovy blok (Start-spustit-notepad)
Zkopirujte skript nize

Start
ShellIconOverlayIdentifiers: DropboxExt1 -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => No File
ShellIconOverlayIdentifiers: DropboxExt2 -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => No File
ShellIconOverlayIdentifiers: DropboxExt3 -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => No File
ShellIconOverlayIdentifiers: DropboxExt4 -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => No File

HKCU\Software\Microsoft\Internet Explorer\Main,ICQ Search = http://search.icq.com/search/results.php?ch_id=xmas&q={searchTerms}
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM-x32 - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKCU - DefaultScope {F45F5DA7-5444-492A-8725-1B67FA717524} URL =
SearchScopes: HKCU - {012E1000-F331-11DB-8314-0800200C9A66} URL = http://www.google.com/search?q={searchTerms}
SearchScopes: HKCU - {A2250064-82EE-497B-91DD-34FF770927E1} URL =
SearchScopes: HKCU - {F45F5DA7-5444-492A-8725-1B67FA717524} URL = 

S2 Angelnt; \SystemRoot\System32\Drivers\ANGELNT.SYS [X]
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
S3 ew_hwusbdev; system32\DRIVERS\ew_hwusbdev.sys [X]
S3 ew_usbenumfilter; system32\DRIVERS\ew_usbenumfilter.sys [X]
S3 huawei_cdcacm; system32\DRIVERS\ew_jucdcacm.sys [X]
S3 huawei_enumerator; system32\DRIVERS\ew_jubusenum.sys [X]
S3 huawei_ext_ctrl; system32\DRIVERS\ew_juextctrl.sys [X]
S3 huawei_wwanecm; system32\DRIVERS\ew_juwwanecm.sys [X]

2014-08-12 12:32 - 2014-08-12 12:34 - 00014721 _____ () C:\Users\saul\Desktop\FRST.txt
2014-08-12 12:31 - 2014-08-12 12:31 - 00112640 _____ (forum.viry.cz) C:\Users\saul\Desktop\FRSTLauncher.exe
2014-08-11 14:22 - 2014-08-11 14:22 - 00000000 ____D () C:\zoek
2014-08-11 14:14 - 2014-08-07 21:29 - 00001303 _____ () C:\zoek-results2014-08-07-192930.log
2014-08-07 21:38 - 2014-08-11 14:22 - 00000042 _____ () C:\folders.log
2014-08-07 21:28 - 2014-08-11 14:22 - 00002913 _____ () C:\runcheck.txt
2014-08-07 21:28 - 2014-08-11 14:14 - 00001277 _____ () C:\zoek-results.log
2014-08-07 21:26 - 2014-08-07 21:26 - 00000000 ____D () C:\zoek_backup
2014-08-07 21:25 - 2014-08-07 21:26 - 01288704 _____ () C:\Users\saul\Desktop\zoek.exe
2014-08-07 10:35 - 2014-08-07 13:07 - 00000000 ____D () C:\AdwCleaner
2014-08-07 10:33 - 2014-08-07 10:33 - 00002755 _____ () C:\Users\saul\Desktop\JRT.txt
2014-08-07 10:25 - 2014-08-07 10:25 - 01475072 _____ () C:\Users\saul\Desktop\adwcleaner_3.303.exe
2014-08-07 10:25 - 2014-08-07 10:25 - 01016261 _____ (Thisisu) C:\Users\saul\Desktop\JRT.exe
2014-08-07 10:25 - 2014-08-07 10:25 - 00000000 ____D () C:\Windows\ERUNT
C:\Users\saul\AppData\Local\Temp\7za.exe
C:\Users\saul\AppData\Local\Temp\hijackthis.exe
C:\Users\saul\AppData\Local\Temp\jre-8u11-windows-au.exe
C:\Users\saul\AppData\Local\Temp\NirCmd.exe
C:\Users\saul\AppData\Local\Temp\PEVZ.EXE
C:\Users\saul\AppData\Local\Temp\Quarantine.exe
C:\Users\saul\AppData\Local\Temp\remove.exe
C:\Users\saul\AppData\Local\Temp\sed.exe
C:\Users\saul\AppData\Local\Temp\shortcut.exe
C:\Users\saul\AppData\Local\Temp\swreg.exe
C:\Users\saul\AppData\Local\Temp\swxcacls.exe
C:\Users\saul\AppData\Local\Temp\wget.exe
C:\Users\saul\AppData\Local\Temp\zoek-delete.exe

Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

REG: reg delete "HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM" /f
REG: reg delete "HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BCSSync" /f
REG: reg delete "HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DivXMediaServer" /f
REG: reg delete "HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DivXUpdate" /f
REG: reg delete "HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ICQ" /f
REG: reg delete "HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype" /f
REG: reg delete "HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched" /f

Hosts:
Reboot:
End

Ulozte vytvoreny TXT jako fixlist.txt
Presunte vytvoreny fixlist vedle FRST

Spustte znovu FRST.exe

Kliknete na Fix
Probehne oprava a vytvori log Fixlog.txt

Restart PC a dejte mi sem fixlog.txt

5manager5 · #17 Příspěvek od **5manager5** » 14 Srp 2014 09:11

systém windows nejako dlhšie štartoval :/
a v správcovi uloh beží aj toto atieclxx.exe

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 13-08-2014 01
Ran by saul at 2014-08-14 10:07:00 Run:1
Running from C:\Users\saul\Desktop
Boot Mode: Normal
==============================================

Content of fixlist:
*****************
Start
ShellIconOverlayIdentifiers: DropboxExt1 -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => No File
ShellIconOverlayIdentifiers: DropboxExt2 -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => No File
ShellIconOverlayIdentifiers: DropboxExt3 -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => No File
ShellIconOverlayIdentifiers: DropboxExt4 -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => No File

HKCU\Software\Microsoft\Internet Explorer\Main,ICQ Search = http://search.icq.com/search/results.ph ... earchTerms}
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM-x32 - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKCU - DefaultScope {F45F5DA7-5444-492A-8725-1B67FA717524} URL =
SearchScopes: HKCU - {012E1000-F331-11DB-8314-0800200C9A66} URL = http://www.google.com/search?q={searchTerms}
SearchScopes: HKCU - {A2250064-82EE-497B-91DD-34FF770927E1} URL =
SearchScopes: HKCU - {F45F5DA7-5444-492A-8725-1B67FA717524} URL =

S2 Angelnt; \SystemRoot\System32\Drivers\ANGELNT.SYS [X]
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
S3 ew_hwusbdev; system32\DRIVERS\ew_hwusbdev.sys [X]
S3 ew_usbenumfilter; system32\DRIVERS\ew_usbenumfilter.sys [X]
S3 huawei_cdcacm; system32\DRIVERS\ew_jucdcacm.sys [X]
S3 huawei_enumerator; system32\DRIVERS\ew_jubusenum.sys [X]
S3 huawei_ext_ctrl; system32\DRIVERS\ew_juextctrl.sys [X]
S3 huawei_wwanecm; system32\DRIVERS\ew_juwwanecm.sys [X]

2014-08-12 12:32 - 2014-08-12 12:34 - 00014721 _____ () C:\Users\saul\Desktop\FRST.txt
2014-08-12 12:31 - 2014-08-12 12:31 - 00112640 _____ (forum.viry.cz) C:\Users\saul\Desktop\FRSTLauncher.exe
2014-08-11 14:22 - 2014-08-11 14:22 - 00000000 ____D () C:\zoek
2014-08-11 14:14 - 2014-08-07 21:29 - 00001303 _____ () C:\zoek-results2014-08-07-192930.log
2014-08-07 21:38 - 2014-08-11 14:22 - 00000042 _____ () C:\folders.log
2014-08-07 21:28 - 2014-08-11 14:22 - 00002913 _____ () C:\runcheck.txt
2014-08-07 21:28 - 2014-08-11 14:14 - 00001277 _____ () C:\zoek-results.log
2014-08-07 21:26 - 2014-08-07 21:26 - 00000000 ____D () C:\zoek_backup
2014-08-07 21:25 - 2014-08-07 21:26 - 01288704 _____ () C:\Users\saul\Desktop\zoek.exe
2014-08-07 10:35 - 2014-08-07 13:07 - 00000000 ____D () C:\AdwCleaner
2014-08-07 10:33 - 2014-08-07 10:33 - 00002755 _____ () C:\Users\saul\Desktop\JRT.txt
2014-08-07 10:25 - 2014-08-07 10:25 - 01475072 _____ () C:\Users\saul\Desktop\adwcleaner_3.303.exe
2014-08-07 10:25 - 2014-08-07 10:25 - 01016261 _____ (Thisisu) C:\Users\saul\Desktop\JRT.exe
2014-08-07 10:25 - 2014-08-07 10:25 - 00000000 ____D () C:\Windows\ERUNT
C:\Users\saul\AppData\Local\Temp\7za.exe
C:\Users\saul\AppData\Local\Temp\hijackthis.exe
C:\Users\saul\AppData\Local\Temp\jre-8u11-windows-au.exe
C:\Users\saul\AppData\Local\Temp\NirCmd.exe
C:\Users\saul\AppData\Local\Temp\PEVZ.EXE
C:\Users\saul\AppData\Local\Temp\Quarantine.exe
C:\Users\saul\AppData\Local\Temp\remove.exe
C:\Users\saul\AppData\Local\Temp\sed.exe
C:\Users\saul\AppData\Local\Temp\shortcut.exe
C:\Users\saul\AppData\Local\Temp\swreg.exe
C:\Users\saul\AppData\Local\Temp\swxcacls.exe
C:\Users\saul\AppData\Local\Temp\wget.exe
C:\Users\saul\AppData\Local\Temp\zoek-delete.exe

Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

REG: reg delete "HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM" /f
REG: reg delete "HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BCSSync" /f
REG: reg delete "HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DivXMediaServer" /f
REG: reg delete "HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DivXUpdate" /f
REG: reg delete "HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ICQ" /f
REG: reg delete "HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype" /f
REG: reg delete "HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched" /f

Hosts:
Reboot:
End
*****************

"HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\DropboxExt1" => Key deleted successfully.
"HKCR\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}" => Key not found.
"HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\DropboxExt2" => Key deleted successfully.
"HKCR\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}" => Key not found.
"HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\DropboxExt3" => Key deleted successfully.
"HKCR\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}" => Key not found.
"HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\DropboxExt4" => Key deleted successfully.
"HKCR\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}" => Key not found.
HKCU\Software\Microsoft\Internet Explorer\Main\\ICQ Search => value deleted successfully.
HKLM\SOFTWARE\Clients\StartMenuInternet\IEXPLORE.EXE\shell\open\command\\Default => Value was restored successfully.
"HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}" => Key deleted successfully.
"HKCR\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}" => Key not found.
"HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}" => Key Deleted successfully.
"HKCR\Wow6432Node\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}" => Key not found.
HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value deleted successfully.
"HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{012E1000-F331-11DB-8314-0800200C9A66}" => Key deleted successfully.
"HKCR\CLSID\{012E1000-F331-11DB-8314-0800200C9A66}" => Key not found.
"HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{A2250064-82EE-497B-91DD-34FF770927E1}" => Key deleted successfully.
"HKCR\CLSID\{A2250064-82EE-497B-91DD-34FF770927E1}" => Key not found.
"HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{F45F5DA7-5444-492A-8725-1B67FA717524}" => Key deleted successfully.
"HKCR\CLSID\{F45F5DA7-5444-492A-8725-1B67FA717524}" => Key not found.
Angelnt => Service deleted successfully.
catchme => Service deleted successfully.
ew_hwusbdev => Service deleted successfully.
ew_usbenumfilter => Service deleted successfully.
huawei_cdcacm => Service deleted successfully.
huawei_enumerator => Service deleted successfully.
huawei_ext_ctrl => Service deleted successfully.
huawei_wwanecm => Service deleted successfully.
"C:\Users\saul\Desktop\FRST.txt" => File/Directory not found.
"C:\Users\saul\Desktop\FRSTLauncher.exe" => File/Directory not found.
C:\zoek => Moved successfully.
C:\zoek-results2014-08-07-192930.log => Moved successfully.
C:\folders.log => Moved successfully.
C:\runcheck.txt => Moved successfully.
C:\zoek-results.log => Moved successfully.
C:\zoek_backup => Moved successfully.
C:\Users\saul\Desktop\zoek.exe => Moved successfully.
C:\AdwCleaner => Moved successfully.
C:\Users\saul\Desktop\JRT.txt => Moved successfully.
C:\Users\saul\Desktop\adwcleaner_3.303.exe => Moved successfully.
C:\Users\saul\Desktop\JRT.exe => Moved successfully.
C:\Windows\ERUNT => Moved successfully.
C:\Users\saul\AppData\Local\Temp\7za.exe => Moved successfully.
C:\Users\saul\AppData\Local\Temp\hijackthis.exe => Moved successfully.
C:\Users\saul\AppData\Local\Temp\jre-8u11-windows-au.exe => Moved successfully.
C:\Users\saul\AppData\Local\Temp\NirCmd.exe => Moved successfully.
C:\Users\saul\AppData\Local\Temp\PEVZ.EXE => Moved successfully.
C:\Users\saul\AppData\Local\Temp\Quarantine.exe => Moved successfully.
C:\Users\saul\AppData\Local\Temp\remove.exe => Moved successfully.
C:\Users\saul\AppData\Local\Temp\sed.exe => Moved successfully.
C:\Users\saul\AppData\Local\Temp\shortcut.exe => Moved successfully.
C:\Users\saul\AppData\Local\Temp\swreg.exe => Moved successfully.
C:\Users\saul\AppData\Local\Temp\swxcacls.exe => Moved successfully.
C:\Users\saul\AppData\Local\Temp\wget.exe => Moved successfully.
C:\Users\saul\AppData\Local\Temp\zoek-delete.exe => Moved successfully.
C:\Windows\Tasks\Adobe Flash Player Updater.job => Moved successfully.
C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => Moved successfully.
C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => Moved successfully.

========= reg delete "HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM" /f =========

Oper cia sa Łspeçne dokonźila.

========= End of Reg: =========

========= reg delete "HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BCSSync" /f =========

Oper cia sa Łspeçne dokonźila.

========= End of Reg: =========

========= reg delete "HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DivXMediaServer" /f =========

Oper cia sa Łspeçne dokonźila.

========= End of Reg: =========

========= reg delete "HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DivXUpdate" /f =========

Oper cia sa Łspeçne dokonźila.

========= End of Reg: =========

========= reg delete "HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ICQ" /f =========

Oper cia sa Łspeçne dokonźila.

========= End of Reg: =========

========= reg delete "HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype" /f =========

Oper cia sa Łspeçne dokonźila.

========= End of Reg: =========

========= reg delete "HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched" /f =========

Oper cia sa Łspeçne dokonźila.

========= End of Reg: =========

C:\Windows\System32\Drivers\etc\hosts => Moved successfully.
Hosts was reset successfully.

The system needed a reboot.

==== End of Fixlog ====

#18 Příspěvek od **vyosek** » 14 Srp 2014 09:21

Ten start mohl byt zpusoben provadenymi opravami

Tak jeste uklidime

T-Cleaner http://vyosek.tym.cz/pro_usery/T-Cleaner.exe

Stahnete a spustte
Pro potvrzeni volby mackejte A, Enter
Po pouziti utilitu smazte
Antiviry touhou utilitu chybne oznacit jako vir - jedna se o falesny poplach - takze v pohode stahnete (pripadne vypnete pri stahovani antivir)

OTC http://oldtimer.geekstogo.com/OTC.exe

Stahnete a spustte
Kliknete na CleanUp a potvrdte YES
Program uklidi a restartuje PC

TFC http://oldtimer.geekstogo.com/TFC.exe

Stahnete a spustte
Kliknete na Start a potvrdte OK
Program uklidi a restartuje pc
Po pouziti utilitu smazte

Stahnete Ccleaner http://forum.viry.cz/viewtopic.php?t=7478
Panel čistič

Vse nechte jak je, jen dejte Analyzovat a pote Spustit CCleaner

Panel registry

dejte Hledej problémy
nasledne Opravit problémy - zalohu registru doporucuji udelat, opravte vsechny problemy
postup opakujte dokud nebude bez problemu - vetsinou cca 3x

Panel nástroje

Zde muzete odinstalovat nepotrebne programy

CCleaner doporucuji pouzivat cca jednou za tyden

A pokud nejsou problemy ci dotazy, je to z me strany vse

5manager5 · #19 Příspěvek od **5manager5** » 14 Srp 2014 09:22

ok to spravím ale pýtal som sa ešte na jednu vec vyššie

a reštartoval som viackrat a ide to rovnako

#20 Příspěvek od **vyosek** » 14 Srp 2014 09:27

atieclxx.exe je legitimni soubor, patri ke graficek karte AMD http://www.file.net/process/atieclxx.exe.html

5manager5 · #21 Příspěvek od **5manager5** » 14 Srp 2014 09:43

ok ak je notebook čistý a to spravanie windows normálne tak vdaka a mozte zatvorit

#22 Příspěvek od **vyosek** » 14 Srp 2014 09:49

Nemate zac, rad jsem pomohl

Zase nekdy Obrázek

A na zaklade Pravidla o zamykani temat

VIRY.CZ

vyskakovacie okno v mozille

Re: vyskakovacie okno v mozille

Re: vyskakovacie okno v mozille

Re: vyskakovacie okno v mozille

Re: vyskakovacie okno v mozille

Re: vyskakovacie okno v mozille

Re: vyskakovacie okno v mozille

Re: vyskakovacie okno v mozille