preventivní kontrola děkuji

[NOSAK]

Log z FRSTlauncheru není možné dodat, protože po spuštění FRSTlauncheru hlácí že není platná aplikace win32...

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 03-12-2014
Ran by Petr (administrator) on DOMA on 06-12-2014 11:35:34
Running from C:\Documents and Settings\Petr\Plocha
Loaded Profile: Petr (Available profiles: Petr)
Platform: Systém Microsoft Windows XP Professional Service Pack 3 (X86) OS Language: Čeština
Internet Explorer Version 8
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/33 ... scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(ATI Technologies Inc.) C:\WINDOWS\system32\ati2evxx.exe
(ATI Technologies Inc.) C:\WINDOWS\system32\ati2evxx.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2015\avgui.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2015\avgfws.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2015\avgwdsvc.exe
(Malwarebytes Corporation) C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\plugin-container.exe
(Ghisler Software GmbH) C:\totalcmd\TOTALCMD.EXE
(Microsoft Corporation) C:\WINDOWS\system32\wscntfy.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [PtiuPbmd] => Rundll32.exe ptipbm.dll,SetWriteBack
HKLM\...\Run: [AVG_UI] => C:\Program Files\AVG\AVG2015\avgui.exe [3653136 2014-11-09] (AVG Technologies CZ, s.r.o.)
Winlogon\Notify\AtiExtEvent: C:\WINDOWS\system32\Ati2evxx.dll (ATI Technologies Inc.)
BootExecute: autocheck autochk * C:\PROGRA~1\AVG\AVG2015\avgrsx.exe /sync /restart

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKU\S-1-5-21-1085031214-764733703-1177238915-1004\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dl ... r=iesearch
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.microsoft.com/isapi/redir.dl ... ar=msnhome
HKU\S-1-5-21-1085031214-764733703-1177238915-1004\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dl ... r=iesearch
HKU\S-1-5-21-1085031214-764733703-1177238915-1004\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.reerd.com
SearchScopes: HKU\S-1-5-21-1085031214-764733703-1177238915-1004 -> DefaultScope {E2C7EB41-5D9F-4AC1-9E89-ED8AE9B81BAB} URL = https://search.yahoo.com/search?fr=chr- ... earchTerms}
SearchScopes: HKU\S-1-5-21-1085031214-764733703-1177238915-1004 -> {E2C7EB41-5D9F-4AC1-9E89-ED8AE9B81BAB} URL = https://search.yahoo.com/search?fr=chr- ... earchTerms}
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinsta ... s-i586.cab
DPF: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinsta ... s-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinsta ... s-i586.cab
ShellExecuteHooks: Windows Desktop Search Namespace Manager - {56F9679E-7826-4C84-81F3-532071A8BCC5} - C:\Program Files\Windows Desktop Search\MSNLNamespaceMgr.dll [304128 2011-01-25] (Microsoft Corporation)
ShellExecuteHooks: - {AEB6717E-7E19-11d0-97EE-00C04FD91972} - No File [ ]
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1

FireFox:
========
FF ProfilePath: C:\Documents and Settings\Petr\Data aplikací\Mozilla\Firefox\Profiles\kpcngiae.default
FF DefaultSearchEngine: Yahoo!
FF Homepage: https://seznam.cz/
FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF32_15_0_0_223.dll ()
FF Plugin: @java.com/JavaPlugin -> C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~3\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~1\MICROS~3\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin: @microsoft.com/WPF,version=3.5 -> c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF SearchPlugin: C:\Documents and Settings\Petr\Data aplikací\Mozilla\Firefox\Profiles\kpcngiae.default\searchplugins\firmycz.xml
FF SearchPlugin: C:\Documents and Settings\Petr\Data aplikací\Mozilla\Firefox\Profiles\kpcngiae.default\searchplugins\yahoo_ff.xml
FF SearchPlugin: C:\Documents and Settings\Petr\Data aplikací\Mozilla\Firefox\Profiles\kpcngiae.default\searchplugins\zbocz.xml
FF Extension: Start Page - C:\Documents and Settings\Petr\Data aplikací\Mozilla\Firefox\Profiles\kpcngiae.default\Extensions\{62DD0A97-FDD4-421b-94A5-D1A9434450C7} [2014-12-03]
FF Extension: Ebay Shopping Assistant by Spigot - C:\Documents and Settings\Petr\Data aplikací\Mozilla\Firefox\Profiles\kpcngiae.default\Extensions\{CA8C84C6-3918-41b1-BE77-049B2BDD887C} [2014-12-03]
FF Extension: Amazon Shopping Assistant by Spigot - C:\Documents and Settings\Petr\Data aplikací\Mozilla\Firefox\Profiles\kpcngiae.default\Extensions\{DE1C78C1-2762-47f6-A1D9-1B7866FE7EB4} [2014-12-03]
FF Extension: Seznam lištička - C:\Documents and Settings\Petr\Data aplikací\Mozilla\Firefox\Profiles\kpcngiae.default\Extensions\{ea614400-e918-4741-9a97-7a972ff7c30b} [2014-11-17]
FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF Extension: Microsoft .NET Framework Assistant - C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension [2014-11-17]

Chrome:
=======

========================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 Ati HotKey Poller; C:\WINDOWS\system32\Ati2evxx.exe [643072 2014-01-07] (ATI Technologies Inc.) [File not signed]
S2 ATI Smart; C:\WINDOWS\system32\ati2sgag.exe [593920 2007-09-14] () [File not signed]
R2 avgfws; C:\Program Files\AVG\AVG2015\avgfws.exe [1486664 2014-11-09] (AVG Technologies CZ, s.r.o.)
S2 AVGIDSAgent; C:\Program Files\AVG\AVG2015\avgidsagent.exe [3488784 2014-11-09] (AVG Technologies CZ, s.r.o.)
R2 avgwd; C:\Program Files\AVG\AVG2015\avgwdsvc.exe [298080 2014-11-09] (AVG Technologies CZ, s.r.o.)
R2 MBAMScheduler; C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
S2 MBAMService; C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R3 Afc; C:\WINDOWS\System32\drivers\Afc.sys [11776 2005-02-23] (Arcsoft, Inc.) [File not signed]
R3 ati2mtag; C:\WINDOWS\System32\DRIVERS\ati2mtag.sys [7875072 2014-01-07] (ATI Technologies Inc.) [File not signed]
R1 Avgdiskx; C:\WINDOWS\System32\DRIVERS\avgdiskx.sys [121624 2014-06-18] (AVG Technologies CZ, s.r.o.)
R3 Avgfwdx; C:\WINDOWS\System32\DRIVERS\avgfwdx.sys [30944 2012-01-12] (AVG Technologies CZ, s.r.o.)
S3 Avgfwfd; C:\WINDOWS\System32\DRIVERS\avgfwdx.sys [30944 2012-01-12] (AVG Technologies CZ, s.r.o.)
R1 AVGIDSDriverl; C:\WINDOWS\System32\DRIVERS\avgidsdriverlx.sys [198936 2014-10-29] (AVG Technologies CZ, s.r.o.)
R0 AVGIDSHX; C:\WINDOWS\System32\DRIVERS\avgidshx.sys [147736 2014-06-18] (AVG Technologies CZ, s.r.o.)
R1 AVGIDSShim; C:\WINDOWS\System32\DRIVERS\avgidsshimx.sys [21272 2014-06-18] (AVG Technologies CZ, s.r.o.)
R1 Avgldx86; C:\WINDOWS\System32\DRIVERS\avgldx86.sys [192792 2014-08-28] (AVG Technologies CZ, s.r.o.)
R0 Avglogx; C:\WINDOWS\System32\DRIVERS\avglogx.sys [230680 2014-07-18] (AVG Technologies CZ, s.r.o.)
R0 Avgmfx86; C:\WINDOWS\System32\DRIVERS\avgmfx86.sys [98584 2014-10-05] (AVG Technologies CZ, s.r.o.)
R0 Avgrkx86; C:\WINDOWS\System32\DRIVERS\avgrkx86.sys [27416 2014-06-18] (AVG Technologies CZ, s.r.o.)
R1 Avgtdix; C:\WINDOWS\System32\DRIVERS\avgtdix.sys [200984 2014-10-10] (AVG Technologies CZ, s.r.o.)
S3 CCDECODE; C:\WINDOWS\System32\DRIVERS\CCDECODE.sys [16384 2004-07-09] (Microsoft Corporation)
R3 cmuda; C:\WINDOWS\System32\drivers\cmuda.sys [743367 2003-05-01] (C-Media Inc)
S1 DumpDrv; C:\WINDOWS\system32\Drivers\DumpDrv.sys [9472 2011-01-25] (Microsoft Corporation)
R3 MBAMProtector; C:\WINDOWS\system32\drivers\mbam.sys [22856 2013-04-04] (Malwarebytes Corporation)
S3 NdisIP; C:\WINDOWS\System32\DRIVERS\NdisIP.sys [10112 2004-07-09] (Microsoft Corporation)
R3 ovt530; C:\WINDOWS\System32\Drivers\ov530vid.sys [161792 2005-03-15] (OmniVision Technologies, Inc.) [File not signed]
R0 UlSata; C:\WINDOWS\System32\DRIVERS\ulsata.sys [64256 2003-01-26] (Promise Technology, Inc.) [File not signed]
R0 viaagp1; C:\WINDOWS\System32\DRIVERS\viaagp1.sys [26880 2002-12-27] (VIA Technologies, Inc.)
R0 viasraid; C:\WINDOWS\System32\drivers\viasraid.sys [75904 2003-06-12] (VIA Technologies inc,.ltd) [File not signed]
S3 vulfnths; C:\WINDOWS\System32\Drivers\vulfnth.sys [6912 2002-10-24] (VIA Technologies, Inc.) [File not signed]
R3 vulfntrs; C:\WINDOWS\System32\Drivers\vulfntr.sys [10496 2002-11-13] (VIA Technologies, Inc.) [File not signed]
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
S3 GMSIPCI; \??\G:\INSTALL\GMSIPCI.SYS [X]
S4 IntelIde; No ImagePath
S3 NTACCESS; \??\G:\NTACCESS.sys [X]
U5 Sdbus; C:\Windows\System32\Drivers\Sdbus.sys [80384 2011-01-25] (Microsoft Corporation)
S3 SetupNTGLM7X; \??\G:\NTGLM7X.sys [X]

==================== NetSvcs (Whitelisted) ===================


(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== End Of Log ============================

[Márty84]

Jeeezis, proc zrovna AVG


Otevrete si poznamkovy blok a zkopirujte do nej tento skript

Kód: Vybrat vše

Start
CloseProcesses:

HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKU\S-1-5-21-1085031214-764733703-1177238915-1004\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKU\S-1-5-21-1085031214-764733703-1177238915-1004\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.reerd.com
SearchScopes: HKU\S-1-5-21-1085031214-764733703-1177238915-1004 -> DefaultScope {E2C7EB41-5D9F-4AC1-9E89-ED8AE9B81BAB} URL = https://search.yahoo.com/search?fr=chr- ... =201117&p={searchTerms}
SearchScopes: HKU\S-1-5-21-1085031214-764733703-1177238915-1004 -> {E2C7EB41-5D9F-4AC1-9E89-ED8AE9B81BAB} URL = https://search.yahoo.com/search?fr=chr- ... =201117&p={searchTerms}
ShellExecuteHooks: - {AEB6717E-7E19-11d0-97EE-00C04FD91972} - No File [ ]

FF DefaultSearchEngine: Yahoo!
FF SearchPlugin: C:\Documents and Settings\Petr\Data aplikací\Mozilla\Firefox\Profiles\kpcngiae.default\searchplugins\yahoo_ff.xml
FF Extension: Start Page - C:\Documents and Settings\Petr\Data aplikací\Mozilla\Firefox\Profiles\kpcngiae.default\Extensions\{62DD0A97-FDD4-421b-94A5-D1A9434450C7} [2014-12-03]
FF Extension: Ebay Shopping Assistant by Spigot - C:\Documents and Settings\Petr\Data aplikací\Mozilla\Firefox\Profiles\kpcngiae.default\Extensions\{CA8C84C6-3918-41b1-BE77-049B2BDD887C} [2014-12-03]
FF Extension: Amazon Shopping Assistant by Spigot - C:\Documents and Settings\Petr\Data aplikací\Mozilla\Firefox\Profiles\kpcngiae.default\Extensions\{DE1C78C1-2762-47f6-A1D9-1B7866FE7EB4} [2014-12-03]
FF Extension: Seznam lištička - C:\Documents and Settings\Petr\Data aplikací\Mozilla\Firefox\Profiles\kpcngiae.default\Extensions\{ea614400-e918-4741-9a97-7a972ff7c30b} [2014-11-17]

Hosts:
EmptyTemp:
Reboot:
End

Vlevo nahore kliknete na napis Soubor
Kliknete na napis Ulozit jako...
Napiste spravne ten cerveny nazev fixlist a ulozte na plochu.
Vypnete antivir i dalsi pripadne zabezpeceni.
Spustte FRST jako spravce, kliknete na napis Fix a program vykona prikazy.
Po restartu pc by se mel objevit novy log - s nazvem fixlog, ten mi sem zase zkopirujte.

[NOSAK]

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version: 03-12-2014
Ran by Petr at 2014-12-06 13:33:37 Run:1
Running from C:\Documents and Settings\Petr\Plocha
Loaded Profile: Petr (Available profiles: Petr)
Boot Mode: Normal

==============================================

Content of fixlist:
*****************
Start
CloseProcesses:

HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKU\S-1-5-21-1085031214-764733703-1177238915-1004\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKU\S-1-5-21-1085031214-764733703-1177238915-1004\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.reerd.com
SearchScopes: HKU\S-1-5-21-1085031214-764733703-1177238915-1004 -> DefaultScope {E2C7EB41-5D9F-4AC1-9E89-ED8AE9B81BAB} URL = https://search.yahoo.com/search?fr=chr- ... =201117&p={searchTerms}
SearchScopes: HKU\S-1-5-21-1085031214-764733703-1177238915-1004 -> {E2C7EB41-5D9F-4AC1-9E89-ED8AE9B81BAB} URL = https://search.yahoo.com/search?fr=chr- ... =201117&p={searchTerms}
ShellExecuteHooks: - {AEB6717E-7E19-11d0-97EE-00C04FD91972} - No File [ ]

FF DefaultSearchEngine: Yahoo!
FF SearchPlugin: C:\Documents and Settings\Petr\Data aplikací\Mozilla\Firefox\Profiles\kpcngiae.default\searchplugins\yahoo_ff.xml
FF Extension: Start Page - C:\Documents and Settings\Petr\Data aplikací\Mozilla\Firefox\Profiles\kpcngiae.default\Extensions\{62DD0A97-FDD4-421b-94A5-D1A9434450C7} [2014-12-03]
FF Extension: Ebay Shopping Assistant by Spigot - C:\Documents and Settings\Petr\Data aplikací\Mozilla\Firefox\Profiles\kpcngiae.default\Extensions\{CA8C84C6-3918-41b1-BE77-049B2BDD887C} [2014-12-03]
FF Extension: Amazon Shopping Assistant by Spigot - C:\Documents and Settings\Petr\Data aplikací\Mozilla\Firefox\Profiles\kpcngiae.default\Extensions\{DE1C78C1-2762-47f6-A1D9-1B7866FE7EB4} [2014-12-03]
FF Extension: Seznam lištička - C:\Documents and Settings\Petr\Data aplikací\Mozilla\Firefox\Profiles\kpcngiae.default\Extensions\{ea614400-e918-4741-9a97-7a972ff7c30b} [2014-11-17]

Hosts:
EmptyTemp:
Reboot:
End
*****************

Processes closed successfully.
"HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer" => Key deleted successfully.
"HKU\S-1-5-21-1085031214-764733703-1177238915-1004\SOFTWARE\Policies\Microsoft\Internet Explorer" => Key deleted successfully.
HKU\S-1-5-21-1085031214-764733703-1177238915-1004\Software\Microsoft\Internet Explorer\Main\\Start Page => Value was restored successfully.
HKU\S-1-5-21-1085031214-764733703-1177238915-1004\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value deleted successfully.
"HKU\S-1-5-21-1085031214-764733703-1177238915-1004\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{E2C7EB41-5D9F-4AC1-9E89-ED8AE9B81BAB}" => Key deleted successfully.
"HKCR\CLSID\{E2C7EB41-5D9F-4AC1-9E89-ED8AE9B81BAB}" => Key not found.
HKLM\Software\Microsoft\Windows\CurrentVersion\explorer\ShellExecuteHooks\\{AEB6717E-7E19-11d0-97EE-00C04FD91972} => value deleted successfully.
"HKCR\CLSID\{AEB6717E-7E19-11d0-97EE-00C04FD91972}" => Key not found.
Firefox DefaultSearchEngine deleted successfully.
C:\Documents and Settings\Petr\Data aplikací\Mozilla\Firefox\Profiles\kpcngiae.default\searchplugins\yahoo_ff.xml => Moved successfully.
C:\Documents and Settings\Petr\Data aplikací\Mozilla\Firefox\Profiles\kpcngiae.default\Extensions\{62DD0A97-FDD4-421b-94A5-D1A9434450C7} => Moved successfully.
C:\Documents and Settings\Petr\Data aplikací\Mozilla\Firefox\Profiles\kpcngiae.default\Extensions\{CA8C84C6-3918-41b1-BE77-049B2BDD887C} => Moved successfully.
C:\Documents and Settings\Petr\Data aplikací\Mozilla\Firefox\Profiles\kpcngiae.default\Extensions\{DE1C78C1-2762-47f6-A1D9-1B7866FE7EB4} => Moved successfully.
C:\Documents and Settings\Petr\Data aplikací\Mozilla\Firefox\Profiles\kpcngiae.default\Extensions\{ea614400-e918-4741-9a97-7a972ff7c30b} => Moved successfully.
C:\Windows\System32\Drivers\etc\hosts => Moved successfully.
Hosts was reset successfully.
EmptyTemp: => Removed 359.3 MB temporary data.


The system needed a reboot.

==== End of Fixlog ====

[Márty84]

Jak je na tom pc? Porad neco vyskakuje?

[NOSAK]

nee, v pohodě

[Márty84]

Prejmenujte ComboFix na Uninstall a spustte ho. CF by se mel odinstalovat.

T-Cleaner http://tharifas.sweb.cz/T-Cleaner.exe

• Stahnete a spustte
• Pro potvrzeni volby mackejte A, Enter
• Po pouziti utilitu smazte
• Antiviry mohou utilitu chybne oznacit jako vir - jedna se o falesny poplach - takze v pohode stahnete (pripadne vypnete pri stahovani antivir)

A pokud vse pobezi jak ma, mame hotovo

[NOSAK]

provedu a mockrát děkuji, ikdyž to se mnou nebylo asi nejjednodušší, díky

[Márty84]

No, nejjednodussi sice ne, ale jinak v pohode

Pak tedy napiste, zda vse probehlo v poradku a tema uzavreme.

A neni zac!

[NOSAK]

tak proveden restart i vypnuti a zapnutí a PC je rychlejší a HLAVNĚ neotravují žádné hlášky,
jeětě jednou děkuji

[Márty84]

To jsem rad, nemate zac!

Mejte se a treba zase nekdy