VIRY.CZ

Uvědomte si, že všichni zde jsme dobrovolníci a nemůžeme si dovolit pracovat na fóru v zaměstnání. To by mne asi zaměstnavatel nepochválil. Takže až nyní: Všechny nalezené položky smažte.

Jasné člověče. Já tu přidal komentáře, jen proto, aby se na moje téma nezapomnělo, když už jsme si tu dali nějakou práci s tím problémem. Mnohokrát díky za pomoc

Tady jiný rádce do cizího vlákna nevstoupí, leda na vyžádání. Před vámi tu byli různí týpci, kteří jevili řekněme nervozitu. Proto jsem na to upozornil. Jinak nic proti vám. Já na svá vlákna obvykle nezapomenu. Nemáte zač!

Já to chápu, taky chodím do práce. Tady ten napadený počítač také čistím mému otci, který není schopen si s tím poradit a přiznám se, je to také nad moje síly, jsem rád, že tohle fórum tady je

Mimochodem projel jsem to tím Malwarebytes Anti-Malware. Ten smazal nalezené hrozby. A stejně, když zas zapnu prohlížeč, tak už se na mě valí reklamy a nová okna s neznámými stránkami.

Udělejte ještě tyto skeny:

1. Stahnete Zoek.exe http://hijackthis.nl/smeenk/ a ulozte jej na plochu

Pokud pouzivate Win Vista ci W7, kliknete na Zoek pravym a dejte Run As Administrator ci Spustit jako spravce
Do okna vlozte skript nize

autoclean;
resethosts;
emptyclsid;
IEdefaults;
FFdefaults;
CHRdefaults;
emptyIEcache;
emptyFFcache;
emptyCHRcache;
emptyalltemp;
emptyflash;
emptyjava;
emptyrecycle.bin;

Nasledne kliknete na Run Script
PC provede opravu, restartuje se a da Vam log, jeho obsah vlozte sem.

a

2. Junkware removal tool: http://thisisudax.org/downloads/JRT.exe
•Ulozte nejlepe na plochu
•Po spusteni se zobrazi licencni podminky, stisknete libovolnou klavesu
•Probehne vytvoreni zalohy a nasledne prohledavani
•Probehne skenovani a pak se objevi log, pripadne bude ulozen v c:\JRT jako JRT.txt, ten sem vlozte.

Tady je log ze ZOEK.EXE


Zoek.exe v5.0.0.1 Updated 31-December-2015
Tool run by Hubert on po 14. 03. 2016 at 21:40:08,62.
Microsoft Windows 8.1 6.3.9600 x64
Running in: Normal Mode Internet Access Detected
Launched: C:\Users\Hubert\Desktop\zoek.exe [Scan all users] [Script inserted]

==== System Restore Info ======================

14. 3. 2016 21:42:16 Zoek.exe System Restore Point Created Successfully.

==== Reset Hosts File ======================

# Copyright (c) 1993-2006 Microsoft Corp.
#
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
#
# This file contains the mappings of IP addresses to host names. Each
# entry should be kept on an individual line. The IP address should
# be placed in the first column followed by the corresponding host name.
# The IP address and the host name should be separated by at least one
# space.
#
# Additionally, comments (such as these) may be inserted on individual
# lines or following the machine name denoted by a '#' symbol.
#
# For example:
#
# 102.54.94.97 rhino.acme.com # source server
# 38.25.63.10 x.acme.com # x client host

127.0.0.1 localhost

==== Empty Folders Check ======================

C:\PROGRA~2\AGEIA Technologies deleted successfully
C:\PROGRA~3\a9bfe22 deleted successfully
C:\Users\Hubert\AppData\Roaming\Opera Software deleted successfully
C:\Users\Hubert\AppData\Local\EmieSiteList deleted successfully
C:\Users\Hubert\AppData\Local\EmieUserList deleted successfully
C:\Users\Hubert\AppData\Local\GHISLER deleted successfully
C:\Users\Hubert\AppData\Local\Opera Software deleted successfully
C:\Users\Hubert\AppData\Local\Steam deleted successfully

==== Deleting CLSID Registry Keys ======================

HKEY_USERS\S-1-5-21-416052096-752880450-10621532-1001\Software\Microsoft\Internet Explorer\SearchScopes\oldsearch deleted successfully
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\oldsearch deleted successfully

==== Deleting CLSID Registry Values ======================


==== Deleting Services ======================

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\McODS deleted successfully
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\McODS deleted successfully

==== FireFox Fix ======================

Deleted from C:\Users\Hubert\AppData\Roaming\Mozilla\Firefox\Profiles\n3uguvu9.default\prefs.js:
user_pref("browser.startup.homepage", "https://www.seznam.cz/");
user_pref("browser.newtab.url", "");
user_pref("browser.search.selectedEngine", "Default");
user_pref("browser.search.useDBForOrder", true);

Added to C:\Users\Hubert\AppData\Roaming\Mozilla\Firefox\Profiles\n3uguvu9.default\prefs.js:
user_pref("browser.startup.homepage", "about:home");
user_pref("browser.newtab.url", "about:newtab");

ProfilePath: C:\Users\Hubert\AppData\Roaming\Mozilla\Firefox\Profiles\n3uguvu9.default

user.js not found
---- Lines searches removed from prefs.js ----
user_pref("browser.urlbar.suggest.searches", true);
---- FireFox user.js and prefs.js backups ----

prefs_201614.03._2200_.backup

==== Deleting Files \ Folders ======================

C:\PROGRA~2\AGEIA Technologies not found
C:\windows\SysNative\Tasks\EDSUpdSrv deleted
C:\PROGRA~3\Package Cache deleted
C:\Users\Hubert\AppData\Local\Avast Software deleted
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Search.lnk deleted
"C:\windows\Installer\a3b75.msi" deleted

==== Orphaned Tasks deleted from Registry ======================

EDSUpdSrv deleted

==== Firefox Start and Search pages ======================

ProfilePath: C:\Users\Hubert\AppData\Roaming\Mozilla\Firefox\Profiles\n3uguvu9.default
user_pref("browser.startup.homepage", "about:home");
user_pref("browser.newtab.url", "about:newtab");

==== Firefox Extensions ======================

ProfilePath: C:\Users\Hubert\AppData\Roaming\Mozilla\Firefox\Profiles\n3uguvu9.default
- Adblock Plus - %ProfilePath%\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi

AppDir: C:\Program Files (x86)\Mozilla Firefox
- Default - %AppDir%\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

==== Firefox Plugins ======================

Profilepath: C:\Users\Hubert\AppData\Roaming\Mozilla\Firefox\Profiles\n3uguvu9.default
F627791AB91E01A9829A8D9B6E024D52 - C:\windows\SysWOW64\Macromed\Flash\NPSWF32_21_0_0_182.dll - Shockwave Flash


==== Chromium Look ======================


AdBlock - Hubert\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom
Avast Online Security - Hubert\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki

==== Set IE to Default ======================

Old Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes]
No DefaultScope Set For HKCU

New Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"="http://go.microsoft.com/fwlink/?LinkId=69157"
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes]
"DefaultScope"="{012E1000-F331-11DB-8314-0800200C9A66}"

==== All HKLM and HKCU SearchScopes ======================

HKLM\SearchScopes "DefaultScope"="{7765FA40-9EF3-49EA-A705-FE7AF4CBD466}"
HKLM\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} - No_Url_Value
HKLM\Wow6432Node\SearchScopes "DefaultScope"="{7765FA40-9EF3-49EA-A705-FE7AF4CBD466}"
HKLM\Wow6432Node\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} - No_Url_Value
HKLM\Wow6432Node\SearchScopes\{7765FA40-9EF3-49EA-A705-FE7AF4CBD466} - http://www.bing.com/search?q={searchTer ... TR&pc=LCJB
HKCU\SearchScopes "DefaultScope"="{012E1000-F331-11DB-8314-0800200C9A66}"
HKCU\SearchScopes\{012E1000-F331-11DB-8314-0800200C9A66} - http://www.google.com/search?q={searchTerms}
HKCU\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} - http://www.bing.com/search?q={searchTer ... ORM=IE8SRC

==== Reset Google Chrome ======================

C:\Users\Hubert\AppData\Local\Google\Chrome\User Data\Default\Preferences was reset successfully
C:\Users\Hubert\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences was reset successfully
C:\Users\Hubert\AppData\Local\Google\Chrome\User Data\Default\Web Data was reset successfully
C:\Users\Hubert\AppData\Local\Google\Chrome\User Data\Default\Web Data-journal was reset successfully

==== Deleting Registry Keys ======================

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\A0A5CBD84C137C642B25B695E31AA178 deleted successfully
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\A0A5CBD84C137C642B25B695E31AA178 deleted successfully

==== Empty IE Cache ======================

C:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\Hubert\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 emptied successfully
C:\Users\Hubert\AppData\Local\Microsoft\Windows\INetCache\Low\Content.IE5 emptied successfully
C:\windows\SysNative\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 emptied successfully
C:\windows\sysWoW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 emptied successfully
C:\windows\sysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 emptied successfully
C:\Users\Hubert\AppData\Local\Microsoft\Windows\INetCache\IE emptied successfully
C:\Users\Hubert\AppData\Local\Microsoft\Windows\INetCache\Low\IE emptied successfully
C:\windows\SysNative\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE emptied successfully
C:\windows\sysWoW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE emptied successfully

==== Empty FireFox Cache ======================

C:\Users\Hubert\AppData\Local\Mozilla\Firefox\Profiles\n3uguvu9.default\cache2 emptied successfully

==== Empty Chrome Cache ======================

C:\Users\Hubert\AppData\Local\Google\Chrome\User Data\Default\Cache emptied successfully

==== Empty All Flash Cache ======================

Flash Cache Emptied Successfully

==== Empty All Java Cache ======================

No Java Cache Found

==== C:\zoek_backup content ======================

C:\zoek_backup (files=33 folders=18 27572677 bytes)

==== Empty Temp Folders ======================

C:\Users\Default\AppData\Local\Temp emptied successfully
C:\Users\Default User\AppData\Local\Temp emptied successfully
C:\Users\Hubert\AppData\Local\Temp will be emptied at reboot
C:\windows\serviceprofiles\networkservice\AppData\Local\Temp emptied successfully
C:\windows\serviceprofiles\Localservice\AppData\Local\Temp emptied successfully
C:\windows\Temp will be emptied at reboot

==== After Reboot ======================

==== Empty Temp Folders ======================

C:\windows\Temp successfully emptied
C:\Users\Hubert\AppData\Local\Temp successfully emptied

==== Empty Recycle Bin ======================

C:\$RECYCLE.BIN successfully emptied

==== EOF on po 14. 03. 2016 at 22:14:15,46 ======================

A druhý log ze JRT.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Malwarebytes
Version: 8.0.3 (02.09.2016)
Operating System: Windows 8.1 x64
Ran by Hubert (Administrator) on po 14. 03. 2016 at 22:18:42,37
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




File System: 1

Successfully deleted: C:\windows\prefetch\AVAST_FREE_ANTIVIRUS_SETUP_ON-49B14D85.pf (File)



Registry: 2

Successfully deleted: HKLM\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} (Registry Key)
Successfully deleted: HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} (Registry Key)




~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on po 14. 03. 2016 at 22:22:17,80
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Změnilo se něco teď?

No myslím, že je to dobrý Zatím projíždím v prohlížeči různé stránky a nic na mě už nevyskakuje a prohlížení stránek je najednou svižnější. Tak asi bude problém vyřešen, díky moc Rudy, jste třída

Děkuji za pochvalu a vy nemáte zač!