Pomalý notebook - Podezření na vir

Zpráva

Majkl55 · #1 Příspěvek od **Majkl55** » 08 Ún 2014 18:23

Tady to je...

Logfile of random's system information tool 1.09 (written by random/random)
Run by Ondra at 2014-02-08 17:36:13
Microsoft® Windows Vista™ Home Premium Service Pack 2
System drive C: has 83 GB (55%) free of 153 GB
Total RAM: 3071 MB (53% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 17:36:51, on 8.2.2014
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Internet Explorer v9.00 (9.00.8112.16470)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\SYSTEM32\WISPTIS.EXE
C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\ASUS\SmartLogon\sensorsrv.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\ASUS\ASUS CopyProtect\aspg.exe
C:\Program files\P4G\BatteryLife.exe
C:\Program Files\ASUS\ASUS Live Update\ALU.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\CyberLink\Power2Go\CLMLSvc.exe
C:\Program Files\ASUS\ATK Hotkey\HControlUser.exe
C:\Program Files\ASUS\ATKOSD2\ATKOSD2.exe
C:\Program Files\ASUS\ATK Media\DMedia.exe
C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Windows\AsScrPro.exe
C:\Program Files\Vodafone\Vodafone Mobile Connect\Bin\MobileConnect.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
C:\Program Files\ESET\ESET Smart Security\egui.exe
C:\Program Files\SMART Technologies\SMART Board Drivers\SMARTSNMPAgent.exe
C:\Program Files\SMART Technologies\SMART Board Drivers\SMARTBoardService.exe
C:\Program Files\QuickTime\qttask.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\SRS Labs\SRS Premium Sound\SRSPremiumSoundBig_Small.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\Program Files\McAfee Security Scan\3.8.130\SSScheduler.exe
C:\Program Files\SMART Technologies\SMART Board Drivers\SMARTBoardTools.exe
C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
C:\Windows\system32\NOTEPAD.EXE
C:\Windows\ehome\ehmsas.exe
C:\Program Files\SMART Technologies\SMART Board Drivers\Aware.exe
C:\Program Files\SMART Technologies\SMART Board Drivers\Marker.exe
C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
C:\Program Files\Common Files\Microsoft Shared\Ink\InputPersonalization.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Google\Google Toolbar\GoogleToolbarUser_32.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Windows\system32\Macromed\Flash\FlashUtil32_12_0_0_44_ActiveX.exe
C:\Windows\system32\wuauclt.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Users\Ondra\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\GLCWIY7N\RSIT.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Program Files\trend micro\Ondra.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.seznam.cz/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: MSS+ Identifier - {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} - C:\Program Files\McAfee Security Scan\3.8.130\McAfeeMSS_IE.dll
O2 - BHO: UTubeNooAds - {245C9EB7-922D-907E-3CFB-BCB3B5D41E90} - C:\ProgramData\UTubeNooAds\HlKVjH.dll (file missing)
O2 - BHO: SMART Notebook Download Plugin - {67BCF957-85FC-4036-8DC4-D4D80E00A77B} - C:\Program Files\SMART Technologies\Notebook Software\NotebookPlugin.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [CLMLServer] "C:\Program Files\CyberLink\Power2Go\CLMLSvc.exe"
O4 - HKLM\..\Run: [P2Go_Menu] "C:\Program Files\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe" "C:\Program Files\CyberLink\Power2Go" UpdateWithCreateOnce "SOFTWARE\CyberLink\Power2Go\6.0"
O4 - HKLM\..\Run: [HControlUser] C:\Program Files\ASUS\ATK Hotkey\HControlUser.exe
O4 - HKLM\..\Run: [ATKOSD2] C:\Program Files\ASUS\ATKOSD2\ATKOSD2.exe
O4 - HKLM\..\Run: [ATKMEDIA] C:\Program Files\ASUS\ATK Media\DMedia.exe
O4 - HKLM\..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
O4 - HKLM\..\Run: [ADSMTray] C:\Program Files\ASUS\ASUS Data Security Manager\ADSMTray.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [ACMON] C:\Program Files\ASUS\Splendid\ACMON.exe
O4 - HKLM\..\Run: [ASUS Screen Saver Protector] C:\Windows\AsScrPro.exe
O4 - HKLM\..\Run: [ASUS Camera ScreenSaver] C:\Windows\AsScrProlog.exe
O4 - HKLM\..\Run: [MobileConnect] %programfiles%\Vodafone\Vodafone Mobile Connect\Bin\MobileConnect.exe /silent
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET Smart Security\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [SMART SNMP Agent] C:\Program Files\SMART Technologies\SMART Board Drivers\SMARTSNMPAgent.exe -e
O4 - HKLM\..\Run: [SMART Board Service] C:\Program Files\SMART Technologies\SMART Board Drivers\SMARTBoardService.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\DTLite.exe" -autorun
O4 - HKCU\..\Run: [SRS Premium Sound] "C:\Program Files\SRS Labs\SRS Premium Sound\SRSPremiumSoundBig_Small.exe" /hideme
O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O4 - HKCU\..\Run: [SearchProtection] "C:\Users\Ondra\AppData\Roaming\Search Protection\SearchProtection.EXE" /autostart
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - Startup: Výřezy obrazovky a spuštění aplikace OneNote 2007.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
O4 - Global Startup: Bluetooth.lnk = ?
O4 - Global Startup: FancyStart daemon.lnk = ?
O4 - Global Startup: McAfee Security Scan Plus.lnk = C:\Program Files\McAfee Security Scan\3.8.130\SSScheduler.exe
O4 - Global Startup: SMART Board Tools.lnk = C:\Program Files\SMART Technologies\SMART Board Drivers\SMARTBoardTools.exe
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\Windows\system32\GPhotos.scr/200
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Přidat na blog - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Přidat na blog Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Odeslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Od&eslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O16 - DPF: {44990B00-3C9D-426D-81DF-AAB636FA4345} (Symantec Configuration Class) - https://www-secure.symantec.com/techsup ... gctlcm.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/s ... wflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{400211BB-8E7D-476A-B18B-BADBBB9EDD13}: NameServer = 10.255.255.10,10.255.255.20
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: c:\progra~1\gse7cc~1.ena
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\Windows\system32\browseui.dll
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: ADSM Service (ADSMService) - ASUSTek Computer Inc. - C:\Program Files\ASUS\ASUS Data Security Manager\ADSMSrv.exe
O23 - Service: ASLDR Service (ASLDRService) - Unknown owner - C:\Program Files\ASUS\ATK Hotkey\ASLDRSrv.exe
O23 - Service: ATKGFNEX Service (ATKGFNEXSrv) - Unknown owner - C:\Program Files\ATKGFNEX\GFNEXSrv.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
O23 - Service: ESET Service (ekrn) - ESET - C:\Program Files\ESET\ESET Smart Security\ekrn.exe
O23 - Service: Služba Google Update (gupdate1ca06351bc16190) (gupdate1ca06351bc16190) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Služba Google Update (gupdatem) (gupdatem) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: McAfee Security Scan Component Host Service (McComponentHostService) - McAfee, Inc. - C:\Program Files\McAfee Security Scan\3.8.130\McCHSvc.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
O23 - Service: Skype Updater (SkypeUpdate) - Skype Technologies - C:\Program Files\Skype\Updater\Updater.exe
O23 - Service: Vodafone Mobile Connect Service (VMCService) - Vodafone - C:\Program Files\Vodafone\Vodafone Mobile Connect\Bin\VMCService.exe

--
End of file - 11336 bytes

======Scheduled tasks folder======

C:\Windows\tasks\Adobe Flash Player Updater.job
C:\Windows\tasks\Google Software Updater.job
C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
C:\Windows\tasks\User_Feed_Synchronization-{988B65A6-90BC-4A1F-9E18-A33B9253E832}.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0E8A89AD-95D7-40EB-8D9D-083EF7066A01}]
MSS+ Identifier - C:\Program Files\McAfee Security Scan\3.8.130\McAfeeMSS_IE.dll [2013-09-06 95648]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{245C9EB7-922D-907E-3CFB-BCB3B5D41E90}]
UTubeNooAds - C:\ProgramData\UTubeNooAds\HlKVjH.dll []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{67BCF957-85FC-4036-8DC4-D4D80E00A77B}]
CIEDownload Object - C:\Program Files\SMART Technologies\Notebook Software\NotebookPlugin.dll [2008-07-31 558376]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}]
Groove GFS Browser Helper - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-26 2217832]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AA58ED58-01DD-4d91-8333-CF10577473F7}]
Google Toolbar Helper - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll [2013-12-12 194128]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{2318C2B1-4965-11d4-9B18-009027A5CD4F} - Google Toolbar - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll [2013-12-12 194128]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"=C:\Program Files\Windows Defender\MSASCui.exe [2008-01-21 1008184]
"CLMLServer"=C:\Program Files\CyberLink\Power2Go\CLMLSvc.exe [2008-07-19 104936]
"P2Go_Menu"=C:\Program Files\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe [2008-06-14 210216]
"HControlUser"=C:\Program Files\ASUS\ATK Hotkey\HControlUser.exe [2008-08-18 98304]
"ATKOSD2"=C:\Program Files\ASUS\ATKOSD2\ATKOSD2.exe [2008-09-03 8105984]
"ATKMEDIA"=C:\Program Files\ASUS\ATK Media\DMedia.exe [2008-12-29 159744]
"RtHDVCpl"=C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [2009-02-11 6711840]
"ADSMTray"=C:\Program Files\ASUS\ASUS Data Security Manager\ADSMTray.exe [2008-04-01 266240]
"SynTPEnh"=C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2007-12-06 1029416]
"ACMON"=C:\Program Files\ASUS\Splendid\ACMON.exe [2008-10-01 851968]
"ASUS Screen Saver Protector"=C:\Windows\AsScrPro.exe [2009-06-10 3054136]
"ASUS Camera ScreenSaver"=C:\Windows\AsScrProlog.exe [2009-06-10 47672]
"MobileConnect"=C:\Program Files\Vodafone\Vodafone Mobile Connect\Bin\MobileConnect.exe [2008-10-09 2086912]
"GrooveMonitor"=C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe [2009-02-26 30040]
"NvCplDaemon"=C:\Windows\system32\NvCpl.dll [2009-07-02 13789728]
"Adobe ARM"=C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2013-04-04 958576]
""= []
"egui"=C:\Program Files\ESET\ESET Smart Security\egui.exe [2011-08-09 3076144]
"SMART SNMP Agent"=C:\Program Files\SMART Technologies\SMART Board Drivers\SMARTSNMPAgent.exe [2008-07-31 1037608]
"SMART Board Service"=C:\Program Files\SMART Technologies\SMART Board Drivers\SMARTBoardService.exe [2008-08-08 2123048]
"QuickTime Task"=C:\Program Files\QuickTime\qttask.exe [2011-06-15 421888]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"WindowsWelcomeCenter"=oobefldr.dll,ShowWelcomeCenter []
"ehTray.exe"=C:\Windows\ehome\ehTray.exe [2008-01-21 125952]
"DAEMON Tools Lite"=C:\Program Files\DAEMON Tools Lite\DTLite.exe [2012-08-28 3671904]
"SRS Premium Sound"=C:\Program Files\SRS Labs\SRS Premium Sound\SRSPremiumSoundBig_Small.exe [2009-03-05 3257592]
"swg"=C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [2009-06-10 39408]
"SearchProtection"=C:\Users\Ondra\AppData\Roaming\Search Protection\SearchProtection.EXE /autostart []

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
Bluetooth.lnk - C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
FancyStart daemon.lnk - C:\Windows\Installer\{F9F20920-313D-4D6F-866B-2737B77E1857}\_DC60F4E342E06843E7FCD0.exe
McAfee Security Scan Plus.lnk - C:\Program Files\McAfee Security Scan\3.8.130\SSScheduler.exe
SMART Board Tools.lnk - C:\Program Files\SMART Technologies\SMART Board Drivers\SMARTBoardTools.exe

C:\Users\Ondra\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
Výřezy obrazovky a spuštění aplikace OneNote 2007.lnk - C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"="c:\progra~1\gse7cc~1.ena"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-26 2217832]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa]
"notification packages"=scecli
C:\Program Files\ASUS\ASUS Data Security Manager\ASPWDFLT

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfPf]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfRd]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfPf]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfRd]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfUsbccidDriver]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
"EnableUIADesktopToggle"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"BindDirectlyToPropertySetStorage"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.msadpcm"=msadp32.acm
"midimapper"=midimap.dll
"wavemapper"=msacm32.drv
"VIDC.UYVY"=msyuv.dll
"VIDC.YUY2"=msyuv.dll
"VIDC.YVYU"=msyuv.dll
"VIDC.IYUV"=iyuv_32.dll
"vidc.i420"=iyuv_32.dll
"VIDC.YVU9"=tsbyuv.dll
"msacm.l3acm"=C:\Windows\System32\l3codeca.acm
"vidc.cvid"=iccvid.dll
"MSVideo8"=VfWWDM32.dll
"msacm.l3codecp"=l3codecp.acm
"wave3"=wdmaud.drv
"midi3"=wdmaud.drv
"mixer3"=wdmaud.drv
"wave4"=wdmaud.drv
"midi4"=wdmaud.drv
"mixer4"=wdmaud.drv
"wave2"=wdmaud.drv
"midi2"=wdmaud.drv
"mixer2"=wdmaud.drv
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv
"wave1"=wdmaud.drv
"midi1"=wdmaud.drv
"mixer1"=wdmaud.drv
"vidc.tscc"=tsccvid.dll

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*

======List of files/folders created in the last 2 months======

2014-02-08 17:36:13 ----D---- C:\rsit
2014-02-08 17:21:13 ----D---- C:\AdwCleaner
2014-02-06 20:58:25 ----D---- C:\ProgramData\UTubeNooAds
2014-02-06 20:58:24 ----D---- C:\ProgramData\lehbennpidioacohbompdkicldafcoen
2014-02-02 16:24:35 ----D---- C:\Windows\system32\MRT
2014-01-31 20:40:18 ----D---- C:\ProgramData\UTiubeAdBlock
2014-01-31 20:40:17 ----D---- C:\ProgramData\ggcmfjgbkdpknngfcdeedaoomenlenkl
2014-01-26 21:04:45 ----RSD---- C:\assembly
2014-01-19 18:32:57 ----D---- C:\ProgramData\House Of Soft
2014-01-19 18:32:26 ----A---- C:\Program Files\GSSvc.dll
2014-01-19 18:32:13 ----D---- C:\ProgramData\YoutubeAdblocker
2014-01-19 18:32:13 ----D---- C:\Program Files\YoutubeAdblocker
2014-01-19 18:32:08 ----D---- C:\ProgramData\greAttsaver
2014-01-19 18:32:08 ----D---- C:\Program Files\greAttsaver
2014-01-19 18:32:03 ----D---- C:\ProgramData\dfbcdfee34f10b72
2014-01-19 18:30:57 ----D---- C:\ProgramData\InstallMate

======List of files/folders modified in the last 2 months======

2014-02-08 17:36:34 ----D---- C:\Windows\Prefetch
2014-02-08 17:36:26 ----D---- C:\Windows\Temp
2014-02-08 17:36:24 ----D---- C:\Program Files\trend micro
2014-02-08 17:31:57 ----D---- C:\Windows\System32
2014-02-08 17:31:57 ----A---- C:\Windows\system32\PerfStringBackup.INI
2014-02-08 17:31:56 ----D---- C:\Windows\inf
2014-02-08 17:27:19 ----HD---- C:\ASUS.DAT
2014-02-08 17:26:13 ----A---- C:\Windows\system32\acovcnt.exe
2014-02-08 17:24:40 ----RD---- C:\Program Files
2014-02-06 21:48:58 ----SHD---- C:\System Volume Information
2014-02-06 21:17:25 ----A---- C:\Windows\system32\FlashPlayerApp.exe
2014-02-06 20:58:25 ----HD---- C:\ProgramData
2014-02-06 20:52:31 ----D---- C:\Windows\system32\catroot2
2014-02-06 20:30:55 ----D---- C:\Windows\winsxs
2014-02-06 20:30:54 ----D---- C:\Windows\system32\Msdtc
2014-02-06 20:30:50 ----D---- C:\Windows\system32\wbem
2014-02-06 20:30:50 ----D---- C:\Windows
2014-02-06 20:29:49 ----D---- C:\Windows\system32\config
2014-02-06 20:28:39 ----RSD---- C:\Windows\Media
2014-02-06 20:28:39 ----D---- C:\Windows\ShellNew
2014-02-06 20:28:30 ----HD---- C:\Windows\system32\GroupPolicy
2014-02-06 20:28:30 ----D---- C:\Windows\Tasks
2014-02-06 20:28:30 ----D---- C:\Windows\system32\Tasks
2014-02-06 20:28:30 ----D---- C:\Windows\system32\spool
2014-02-06 20:28:30 ----D---- C:\Windows\system32\RTCOM
2014-02-06 20:28:30 ----D---- C:\Windows\system32\drivers
2014-02-06 20:28:29 ----D---- C:\Windows\system32\CodeIntegrity
2014-02-06 20:28:29 ----D---- C:\Windows\rescache
2014-02-06 20:28:25 ----D---- C:\Users\Ondra\AppData\Roaming\uTorrent
2014-02-06 20:28:08 ----D---- C:\ProgramData\P4G
2014-02-06 20:28:08 ----D---- C:\ProgramData\Microsoft Help
2014-02-06 20:28:08 ----D---- C:\ProgramData\McAfee Security Scan
2014-02-06 20:27:46 ----D---- C:\Windows\registration
2014-02-06 20:18:15 ----D---- C:\Windows\Logs
2014-02-03 20:50:27 ----D---- C:\Windows\Microsoft.NET
2014-02-03 20:49:17 ----RSD---- C:\Windows\assembly
2014-02-02 22:15:35 ----D---- C:\Users\Ondra\AppData\Roaming\Skype
2014-02-02 16:44:39 ----D---- C:\Windows\system32\catroot
2014-02-02 16:43:32 ----SHD---- C:\Windows\Installer
2014-02-02 16:39:25 ----D---- C:\Windows\system32\en-US
2014-02-02 16:39:16 ----D---- C:\Program Files\Microsoft.NET
2014-02-02 16:39:13 ----SD---- C:\ProgramData\Microsoft
2014-02-02 16:24:29 ----D---- C:\Windows\Debug
2014-01-19 18:32:02 ----RD---- C:\Users
2013-12-21 17:47:07 ----D---- C:\Program Files\Google
2013-12-18 06:13:56 ----N---- C:\Windows\system32\MpSigStub.exe

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 AsDsm;AsDsm; C:\Windows\system32\drivers\AsDsm.sys [2009-06-10 30264]
R0 epfwwfp;epfwwfp; C:\Windows\system32\DRIVERS\epfwwfp.sys [2011-08-04 50624]
R0 lullaby;lullaby; C:\Windows\system32\DRIVERS\lullaby.sys [2008-05-29 15416]
R0 sptd;sptd; C:\Windows\System32\Drivers\sptd.sys [2009-07-08 717296]
R1 dtsoftbus01;DAEMON Tools Virtual Bus Driver; C:\Windows\system32\DRIVERS\dtsoftbus01.sys [2012-10-07 242240]
R1 ehdrv;ehdrv; C:\Windows\system32\DRIVERS\ehdrv.sys [2011-08-04 118104]
R1 EpfwLWF;Epfw NDIS LightWeight Filter; C:\Windows\system32\DRIVERS\EpfwLWF.sys [2011-08-04 33656]
R2 ASMMAP;ASMMAP; \??\C:\Program Files\ATKGFNEX\ASMMAP.sys [2007-07-24 13880]
R2 eamonm;eamonm; C:\Windows\system32\DRIVERS\eamonm.sys [2011-08-09 163424]
R2 epfw;epfw; C:\Windows\system32\DRIVERS\epfw.sys [2011-08-04 147480]
R2 irda;IrDA Protocol; C:\Windows\system32\DRIVERS\irda.sys [2008-01-21 95744]
R3 athr;Atheros Extensible Wireless LAN device driver; C:\Windows\system32\DRIVERS\athr.sys [2009-09-05 1183744]
R3 GEARAspiWDM;GEARAspiWDM; C:\Windows\System32\Drivers\GEARAspiWDM.sys [2008-01-29 16168]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\Windows\system32\drivers\RTKVHDA.sys [2009-02-11 2317536]
R3 kbfiltr;Keyboard Filter; C:\Windows\system32\DRIVERS\kbfiltr.sys [2008-06-03 15928]
R3 MTsensor;ATK0100 ACPI UTILITY; C:\Windows\system32\DRIVERS\ATKACPI.sys [2006-12-14 7680]
R3 nvlddmkm;nvlddmkm; C:\Windows\system32\DRIVERS\nvlddmkm.sys [2009-07-02 9786752]
R3 RTSTOR;Realtek USB 2.0 Card Reader; C:\Windows\system32\drivers\RTSTOR.SYS [2008-05-07 62976]
R3 SiSGbeLH;SiS191/SiS190 Ethernet Device NDIS 6.0 Driver; C:\Windows\system32\DRIVERS\SiSGB6.sys [2008-05-02 48128]
R3 SMARTMouseFilterx86;HID-compliant mouse; C:\Windows\system32\DRIVERS\SMARTMouseFilterx86.sys [2008-07-30 11048]
R3 SMARTVHidMini2000x86;SMART HID Device; C:\Windows\system32\DRIVERS\SMARTVHidMini2000x86.sys [2008-07-30 14120]
R3 SMARTVTabletPCx86;SMART Virtual TabletPC; C:\Windows\system32\DRIVERS\SMARTVTabletPCx86.sys [2008-07-30 16808]
R3 SNP2UVC;USB2.0 PC Camera (SNP2UVC); C:\Windows\system32\DRIVERS\snp2uvc.sys [2009-03-16 1753984]
R3 SRS_PremiumSound_Service;SRS Labs Premium Sound; C:\Windows\system32\drivers\srs_PremiumSound_i386.sys [2009-01-14 230952]
R3 SynTP;Synaptics TouchPad Driver; C:\Windows\system32\DRIVERS\SynTP.sys [2007-12-06 196400]
R3 WudfPf;@%SystemRoot%\system32\drivers\Wudfpf.sys,-1000; C:\Windows\system32\drivers\WudfPf.sys [2012-07-26 66560]
S3 akan5xaz;akan5xaz; C:\Windows\system32\drivers\akan5xaz.sys []
S3 Bridge;@%SystemRoot%\system32\bridgeres.dll,-3; C:\Windows\system32\DRIVERS\bridge.sys [2009-04-11 93696]
S3 BridgeMP;@%SystemRoot%\system32\bridgeres.dll,-1; C:\Windows\system32\DRIVERS\bridge.sys [2009-04-11 93696]
S3 BthEnum;Služba Bluetooth Enumerator; C:\Windows\system32\DRIVERS\BthEnum.sys [2009-04-11 22528]
S3 BthPan;Bluetooth Device (Personal Area Network); C:\Windows\system32\DRIVERS\bthpan.sys [2008-01-21 92160]
S3 BTHPORT;Ovladač portu Bluetooth; C:\Windows\System32\Drivers\BTHport.sys [2011-04-21 508416]
S3 BTHUSB;Ovladač rozhraní USB radiostanice Bluetooth; C:\Windows\System32\Drivers\BTHUSB.sys [2009-06-17 30208]
S3 btwaudio;Bluetooth Audio Device Service; C:\Windows\system32\drivers\btwaudio.sys [2008-07-09 81960]
S3 btwavdt;Bluetooth AVDT Service; C:\Windows\system32\drivers\btwavdt.sys [2008-05-13 100392]
S3 btwl2cap;Bluetooth L2CAP Service; C:\Windows\system32\DRIVERS\btwl2cap.sys [2008-01-29 29736]
S3 btwrchid;btwrchid; C:\Windows\system32\DRIVERS\btwrchid.sys [2008-05-13 17320]
S3 drmkaud;Dekodér zvuků DRM jádra společnosti Microsoft; C:\Windows\system32\drivers\drmkaud.sys [2008-01-21 5632]
S3 fssfltr;FssFltr; C:\Windows\system32\DRIVERS\fssfltr.sys [2008-12-08 55264]
S3 HdAudAddService;Microsoft 1.1 UAA Function Driver for High Definition Audio Service; C:\Windows\system32\drivers\HdAudio.sys [2006-11-02 235520]
S3 hwdatacard;Huawei DataCard USB Modem and USB Serial; C:\Windows\system32\DRIVERS\ewusbmdm.sys [2008-07-04 101504]
S3 MSKSSRV;Microsoft Streaming Service Proxy; C:\Windows\system32\drivers\MSKSSRV.sys [2008-01-21 8192]
S3 MSPCLOCK;Microsoft Streaming Clock Proxy; C:\Windows\system32\drivers\MSPCLOCK.sys [2008-01-21 5888]
S3 MSPQM;Microsoft Streaming Quality Manager Proxy; C:\Windows\system32\drivers\MSPQM.sys [2008-01-21 5504]
S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink Converter; C:\Windows\system32\drivers\MSTEE.sys [2008-01-21 6016]
S3 RFCOMM;Zařízení Bluetooth (RFCOMM protokol TDI); C:\Windows\system32\DRIVERS\rfcomm.sys [2009-04-11 148992]
S3 smserial;smserial; C:\Windows\system32\DRIVERS\smserial.sys [2006-11-02 1010560]
S3 STIrUsb;SigmaTel USB-IrDA Dongle; C:\Windows\system32\DRIVERS\irstusb.sys [2008-01-21 30208]
S3 usbvideo;USB Video Device (WDM); C:\Windows\System32\Drivers\usbvideo.sys [2008-01-21 134016]
S3 WpdUsb;WpdUsb; C:\Windows\system32\DRIVERS\wpdusb.sys [2009-10-01 40448]
S3 WUDFRd;WUDFRd; C:\Windows\system32\DRIVERS\WUDFRd.sys [2012-07-26 155136]
S3 yukonwlh;NDIS6.0 Miniport Driver for Marvell Yukon Ethernet Controller; C:\Windows\system32\DRIVERS\yk60x86.sys [2006-11-02 194048]
S4 ErrDev;Microsoft Hardware Error Device Driver; C:\Windows\system32\drivers\errdev.sys [2008-01-21 6656]
S4 MegaSR;MegaSR; C:\Windows\system32\drivers\megasr.sys [2008-01-21 386616]
S4 sdbus;sdbus; C:\Windows\system32\DRIVERS\sdbus.sys [2008-01-21 88576]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 916e5338;GS.Supporter; c:\progra~1\GSSvc.dll [2014-01-19 146768]
R2 AdobeARMservice;Adobe Acrobat Update Service; C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe [2013-05-10 65640]
R2 ADSMService;ADSM Service; C:\Program Files\ASUS\ASUS Data Security Manager\ADSMSrv.exe [2008-03-31 225280]
R2 ASLDRService;ASLDR Service; C:\Program Files\ASUS\ATK Hotkey\ASLDRSrv.exe [2008-08-14 100920]
R2 ATKGFNEXSrv;ATKGFNEX Service; C:\Program Files\ATKGFNEX\GFNEXSrv.exe [2007-08-08 94208]
R2 BthServ;@%SystemRoot%\System32\bthserv.dll,-101; C:\Windows\system32\svchost.exe [2008-01-21 21504]
R2 btwdins;Bluetooth Service; C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe [2008-07-30 522792]
R2 ekrn;ESET Service; C:\Program Files\ESET\ESET Smart Security\ekrn.exe [2011-08-09 974944]
R2 FontCache;@%systemroot%\system32\FntCache.dll,-100; C:\Windows\system32\svchost.exe [2008-01-21 21504]
R2 Irmon;@%SystemRoot%\System32\irmon.dll,-2000; C:\Windows\system32\svchost.exe [2008-01-21 21504]
R2 LightScribeService;LightScribeService Direct Disc Labeling Service; C:\Program Files\Common Files\LightScribe\LSSrvc.exe [2008-06-09 73728]
R2 nvsvc;NVIDIA Display Driver Service; C:\Windows\system32\nvvsvc.exe [2009-07-02 211488]
R2 VMCService;Vodafone Mobile Connect Service; C:\Program Files\Vodafone\Vodafone Mobile Connect\Bin\VMCService.exe [2008-10-09 14336]
S2 gupdate1ca06351bc16190;Služba Google Update (gupdate1ca06351bc16190); C:\Program Files\Google\Update\GoogleUpdate.exe [2009-07-16 133104]
S2 gusvc;Google Software Updater; C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe [2012-09-16 194032]
S2 SkypeUpdate;Skype Updater; C:\Program Files\Skype\Updater\Updater.exe [2013-09-05 171680]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service; C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2014-02-06 257928]
S3 fsssvc;Windows Live Zabezpečení rodiny; C:\Program Files\Windows Live\Family Safety\fsssvc.exe [2008-12-08 533344]
S3 gupdatem;Služba Google Update (gupdatem); C:\Program Files\Google\Update\GoogleUpdate.exe [2009-07-16 133104]
S3 McComponentHostService;McAfee Security Scan Component Host Service; C:\Program Files\McAfee Security Scan\3.8.130\McCHSvc.exe [2013-09-06 235216]
S3 Microsoft Office Groove Audit Service;Microsoft Office Groove Audit Service; C:\Program Files\Microsoft Office\Office12\GrooveAuditService.exe [2009-02-26 64856]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2011-07-20 440696]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]

-----------------EOF-----------------

#2 Příspěvek od **vyosek** » 08 Ún 2014 18:30

Zdravim

A budeme vesit z kristalove koule nebo logru od kafe

Kdyz se podivate nahoru, tak je tam takovej veeeeelkej oranzovej obdelnik

Majkl55 · #3 Příspěvek od **Majkl55** » 08 Ún 2014 19:04

prosil bych z logu

#4 Příspěvek od **vyosek** » 08 Ún 2014 19:12

Jenze ten jste jaksi dodal az ted, pri zalozeni tematu tu nebyl...

Odinstalujte McAfee Security Scan

Stahnete Malwarebytes' Anti-Malware (zkracene MBAM) http://forum.viry.cz/viewtopic.php?f=29&t=115222

Provedte aktualizaci
Provedte uplny sken - nic nemazte
MBAM miva obcas falesne detekce, proto vlozte log do prispevku a pockejte na posouzeni

Majkl55 · #5 Příspěvek od **Majkl55** » 08 Ún 2014 22:59

Malwarebytes Anti-Malware (Zkušební verze Malwarebytes Anti-Malware.) 1.75.0.1300
www.malwarebytes.org

Verze: v2014.02.08.07

Windows Vista Service Pack 2 x86 NTFS
Internet Explorer 9.0.8112.16421
Ondra :: ONDRA-PC [administrátor]

Ochrana: Povolena

8.2.2014 19:50:31
mbam-log-2014-02-08 (19-50-31).txt

Typ: Kompletní kontrola (C:\|D:\|F:\|G:\|)
Nastavení kontroly povoleno: Paměť | Po spuštění | Registr | Systémové soubory | Heuristická analýza Extra | Heuristická analýza Shuriken | PUP | PUM
Nastavení kontroly zakázáno: P2P
Kontrolované objekty: 438867
Uplynulý čas: 1 hodin, 29 minut, 20 sekund

Nalezené procesy v paměti: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené moduly v paměti: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené klíče v registru: 3
HKLM\SOFTWARE\{77D46E27-0E41-4478-87A6-AABE6FBCF252} (PUP.Optional.GreatSaver.A) -> Nebyla provedena žádná instrukce.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{4820778D-AB0D-6D18-C316-52A6A0E1D507} (PUP.Optional.MultiPlug.A) -> Nebyla provedena žádná instrukce.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{CA41BB14-E67B-1653-C57B-5CA99418A866} (PUP.Optional.MultiPlug.A) -> Nebyla provedena žádná instrukce.

Nalezené hodnoty v registru: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené datové položky v registru: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené složky: 2
C:\Program Files\YoutubeAdblocker (PUP.Optional.Multiplug) -> Nebyla provedena žádná instrukce.
C:\Program Files\greAttsaver (PUP.Optional.Multiplug) -> Nebyla provedena žádná instrukce.

Nalezené soubory: 8
C:\ProgramData\YoutubeAdblocker\cuuc_3.exe (PUP.Optional.MultiPlug.A) -> Nebyla provedena žádná instrukce.
C:\ProgramData\YTD YouTube Downloader & Converter\ytd_installer.exe (PUP.Optional.Spigot.A) -> Nebyla provedena žádná instrukce.
C:\ProgramData\greAttsaver\UkI7O8s0Dv.exe (PUP.Optional.MultiPlug.A) -> Nebyla provedena žádná instrukce.
C:\Users\Ondra\Downloads\Setup.exe (PUP.Optional.BundleInstaller.A) -> Nebyla provedena žádná instrukce.
F:\K\ONDREJ\LGS 10\Staff Training\SC - stuff\Youtube downloader\YTDSetup.exe (PUP.Optional.Spigot.A) -> Nebyla provedena žádná instrukce.
D:\Software\Programy\Daemon Tools\daemon4112-lite.exe (Adware.Vomba) -> Přesun do karantény a smazání se zdařilo.
G:\D\Brozzy\Software\NORTON 2008 ULTIMATE PACK 3in1[Must Have][h33t][shahaz]\NORTON 2008 ULTIMATE PACK 3in1[Must Have][h33t][shahaz]\Keygen\keygen_noUPX.exe (Malware.Tool) -> Přesun do karantény a smazání se zdařilo.
G:\D\Brozzy\Software\QuickTime 6.02\Crack\Keygen.exe (Trojan.Agent.CK) -> Přesun do karantény a smazání se zdařilo.

(konec)

Majkl55 · #6 Příspěvek od **Majkl55** » 09 Ún 2014 00:27

nechal jsem to jet ještě jednou

Malwarebytes Anti-Malware (Zkušební verze Malwarebytes Anti-Malware.) 1.75.0.1300
www.malwarebytes.org

Verze: v2014.02.08.08

Windows Vista Service Pack 2 x86 NTFS
Internet Explorer 9.0.8112.16421
Ondra :: ONDRA-PC [administrátor]

Ochrana: Povolena

8.2.2014 21:53:22
MBAM-log-2014-02-08 (23-21-41).txt

Typ: Kompletní kontrola (C:\|D:\|F:\|G:\|)
Nastavení kontroly povoleno: Paměť | Po spuštění | Registr | Systémové soubory | Heuristická analýza Extra | Heuristická analýza Shuriken | PUP | PUM
Nastavení kontroly zakázáno: P2P
Kontrolované objekty: 439009
Uplynulý čas: 1 hodin, 27 minut, 5 sekund

Nalezené procesy v paměti: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené moduly v paměti: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené klíče v registru: 3
HKLM\SOFTWARE\{77D46E27-0E41-4478-87A6-AABE6FBCF252} (PUP.Optional.GreatSaver.A) -> Nebyla provedena žádná instrukce.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{4820778D-AB0D-6D18-C316-52A6A0E1D507} (PUP.Optional.MultiPlug.A) -> Nebyla provedena žádná instrukce.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{CA41BB14-E67B-1653-C57B-5CA99418A866} (PUP.Optional.MultiPlug.A) -> Nebyla provedena žádná instrukce.

Nalezené hodnoty v registru: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené datové položky v registru: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené složky: 2
C:\Program Files\YoutubeAdblocker (PUP.Optional.Multiplug) -> Nebyla provedena žádná instrukce.
C:\Program Files\greAttsaver (PUP.Optional.Multiplug) -> Nebyla provedena žádná instrukce.

Nalezené soubory: 5
C:\ProgramData\YoutubeAdblocker\cuuc_3.exe (PUP.Optional.MultiPlug.A) -> Nebyla provedena žádná instrukce.
C:\ProgramData\YTD YouTube Downloader & Converter\ytd_installer.exe (PUP.Optional.Spigot.A) -> Nebyla provedena žádná instrukce.
C:\ProgramData\greAttsaver\UkI7O8s0Dv.exe (PUP.Optional.MultiPlug.A) -> Nebyla provedena žádná instrukce.
C:\Users\Ondra\Downloads\Setup.exe (PUP.Optional.BundleInstaller.A) -> Nebyla provedena žádná instrukce.
F:\K\ONDREJ\LGS 10\Staff Training\SC - stuff\Youtube downloader\YTDSetup.exe (PUP.Optional.Spigot.A) -> Nebyla provedena žádná instrukce.

(konec)

#7 Příspěvek od **vyosek** » 09 Ún 2014 10:22

Nalezy MBAMu smazte, objevi se log, ten rad uvidim

Majkl55 · #8 Příspěvek od **Majkl55** » 09 Ún 2014 14:49

alwarebytes Anti-Malware (Zkušební verze Malwarebytes Anti-Malware.) 1.75.0.1300
www.malwarebytes.org

Verze: v2014.02.09.02

Windows Vista Service Pack 2 x86 NTFS
Internet Explorer 9.0.8112.16421
Ondra :: ONDRA-PC [administrátor]

Ochrana: Povolena

9.2.2014 13:42:18
mbam-log-2014-02-09 (13-42-18).txt

Typ: Blesková kontrola
Nastavení kontroly povoleno: Paměť | Po spuštění | Heuristická analýza Extra | Heuristická analýza Shuriken | PUP | PUM
Nastavení kontroly zakázáno: Registr | Systémové soubory | P2P
Kontrolované objekty: 172789
Uplynulý čas: 3 minut, 40 sekund

Nalezené procesy v paměti: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené moduly v paměti: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené klíče v registru: 0
(Žádné škodlivé položky nebyly zjištěny)

tady to je...

Nalezené hodnoty v registru: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené datové položky v registru: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené složky: 2
C:\Program Files\YoutubeAdblocker (PUP.Optional.Multiplug) -> Přesun do karantény a smazání se zdařilo.
C:\Program Files\greAttsaver (PUP.Optional.Multiplug) -> Přesun do karantény a smazání se zdařilo.

Nalezené soubory: 0
(Žádné škodlivé položky nebyly zjištěny)

(konec)

#9 Příspěvek od **vyosek** » 09 Ún 2014 14:50

Ted jste delal jen bleskovou kontrolu, predtim kompletni. Takze poprosim o kompletni kontrolu i nyni

Majkl55 · #10 Příspěvek od **Majkl55** » 09 Ún 2014 16:30

Tady je kompletni

Malwarebytes Anti-Malware (Zkušební verze Malwarebytes Anti-Malware.) 1.75.0.1300
www.malwarebytes.org

Verze: v2014.02.09.02

Windows Vista Service Pack 2 x86 NTFS
Internet Explorer 9.0.8112.16421
Ondra :: ONDRA-PC [administrátor]

Ochrana: Povolena

9.2.2014 13:49:52
mbam-log-2014-02-09 (13-49-52).txt

Typ: Kompletní kontrola (C:\|D:\|F:\|G:\|)
Nastavení kontroly povoleno: Paměť | Po spuštění | Registr | Systémové soubory | Heuristická analýza Extra | Heuristická analýza Shuriken | PUP | PUM
Nastavení kontroly zakázáno: P2P
Kontrolované objekty: 438930
Uplynulý čas: 1 hodin, 28 minut, 50 sekund

Nalezené procesy v paměti: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené moduly v paměti: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené klíče v registru: 3
HKLM\SOFTWARE\{77D46E27-0E41-4478-87A6-AABE6FBCF252} (PUP.Optional.GreatSaver.A) -> Přesun do karantény a smazání se zdařilo.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{4820778D-AB0D-6D18-C316-52A6A0E1D507} (PUP.Optional.MultiPlug.A) -> Přesun do karantény a smazání se zdařilo.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{CA41BB14-E67B-1653-C57B-5CA99418A866} (PUP.Optional.MultiPlug.A) -> Přesun do karantény a smazání se zdařilo.

Nalezené hodnoty v registru: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené datové položky v registru: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené složky: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené soubory: 5
C:\ProgramData\YoutubeAdblocker\cuuc_3.exe (PUP.Optional.MultiPlug.A) -> Přesun do karantény a smazání se zdařilo.
C:\ProgramData\YTD YouTube Downloader & Converter\ytd_installer.exe (PUP.Optional.Spigot.A) -> Přesun do karantény a smazání se zdařilo.
C:\ProgramData\greAttsaver\UkI7O8s0Dv.exe (PUP.Optional.MultiPlug.A) -> Přesun do karantény a smazání se zdařilo.
C:\Users\Ondra\Downloads\Setup.exe (PUP.Optional.BundleInstaller.A) -> Přesun do karantény a smazání se zdařilo.
F:\K\ONDREJ\LGS 10\Staff Training\SC - stuff\Youtube downloader\YTDSetup.exe (PUP.Optional.Spigot.A) -> Přesun do karantény a smazání se zdařilo.

(konec)

#11 Příspěvek od **vyosek** » 09 Ún 2014 22:39

Stahnete Zoek.exe http://hijackthis.nl/smeenk/ a ulozte jej na plochu

Pokud pouzivate Win Vista ci W7, kliknete na Zoek pravym a dejte Run As Administrator ci Spustit jako spravce
Do okna vlozte skript nize

Kód: Vybrat vše

srinfo;
autoclean;
emptyclsid;
iedefaults;
FFdefaults;
CHRdefaults;
emptyalltemp;
resethosts;

Nasledne kliknete na Run Script
PC provede opravu, restartuje se a da Vam log, jeho obsah vlozte sem

Majkl55 · #12 Příspěvek od **Majkl55** » 10 Ún 2014 00:05

Zoek.exe v5.0.0.0 Updated 07-February-2014
Tool run by Ondra on ne 09.02.2014 at 22:50:55,39.
Microsoft® Windows Vista™ Home Premium 6.0.6002 Service Pack 2 x86
Running in: Normal Mode Internet Access Detected
Launched: C:\Users\Ondra\Desktop\zoek.exe [Scan all users] [Script inserted]

===== Runcheck 22:52:03,32 =====

--- Create Environment Variables 22:52:04,59
--- Checking Input 22:52:31,57
--- Reset Hosts File 22:52:37,77
--- AU AppData Check 22:52:39,09
--- Remove From Windows Installer 22:52:42,30
--- IE Startpage Check 22:54:49,91
--- Program Files DB Check 22:55:27,55
--- C:\Users\Default\AppData\Roaming DB Check 22:56:45,47
--- C:\Users\Ondra\AppData\Roaming DB Check 22:56:45,47
--- C:\Windows\system32\config\systemprofile\AppData\Roaming DB Check 22:56:45,47
--- C:\Windows\serviceprofiles\networkservice\AppData\Roaming DB Check 22:56:45,47
--- C:\Windows\serviceprofiles\Localservice\AppData\Roaming DB Check 22:56:45,47
--- C:\Users\Ondra DB Check 22:59:04,37
--- DB Check 22:59:31,86
--- C:\Users\Administrator\AppData\Local DB Check 22:59:33,31
--- C:\Users\Default\AppData\Local DB Check 22:59:33,31
--- C:\Users\Guest\AppData\Local DB Check 22:59:33,31
--- C:\Users\Ondra\AppData\Local DB Check 22:59:33,31
--- C:\Windows\system32\config\systemprofile\AppData\Local DB Check 22:59:33,31
--- C:\Windows\serviceprofiles\networkservice\AppData\Local DB Check 22:59:33,31
--- C:\Windows\serviceprofiles\Localservice\AppData\Local DB Check 22:59:33,31
--- C:\ProgramData\Microsoft\Windows\Start Menu\Programs DB Check 23:02:07,65
--- C:\Users\Ondra\AppData\Roaming\Microsoft\Windows\Start Menu\Programs DB Check 23:02:25,37
--- Tasks DB Check 23:02:35,19
--- Downloads DB Check 23:02:42,23
--- C:\Users\Ondra\AppData\LocalLow DB Check 23:02:55,40
--- C:\Windows\system32\config\systemprofile\AppData\LocalLow DB Check 23:02:55,40
--- C:\Windows\serviceprofiles\networkservice\AppData\LocalLow DB Check 23:02:55,40
--- C:\Windows\serviceprofiles\Localservice\AppData\LocalLow DB Check 23:02:55,40

Majkl55 · #13 Příspěvek od **Majkl55** » 10 Ún 2014 00:07

Zoek.exe v5.0.0.0 Updated 07-February-2014
Tool run by Ondra on ne 09.02.2014 at 22:50:55,39.
Microsoft® Windows Vista™ Home Premium 6.0.6002 Service Pack 2 x86
Running in: Normal Mode Internet Access Detected
Launched: C:\Users\Ondra\Desktop\zoek.exe [Scan all users] [Script inserted]

===== Runcheck 22:52:03,32 =====

--- Create Environment Variables 22:52:04,59
--- Checking Input 22:52:31,57
--- Reset Hosts File 22:52:37,77
--- AU AppData Check 22:52:39,09
--- Remove From Windows Installer 22:52:42,30
--- IE Startpage Check 22:54:49,91
--- Program Files DB Check 22:55:27,55
--- C:\Users\Default\AppData\Roaming DB Check 22:56:45,47
--- C:\Users\Ondra\AppData\Roaming DB Check 22:56:45,47
--- C:\Windows\system32\config\systemprofile\AppData\Roaming DB Check 22:56:45,47
--- C:\Windows\serviceprofiles\networkservice\AppData\Roaming DB Check 22:56:45,47
--- C:\Windows\serviceprofiles\Localservice\AppData\Roaming DB Check 22:56:45,47
--- C:\Users\Ondra DB Check 22:59:04,37
--- DB Check 22:59:31,86
--- C:\Users\Administrator\AppData\Local DB Check 22:59:33,31
--- C:\Users\Default\AppData\Local DB Check 22:59:33,31
--- C:\Users\Guest\AppData\Local DB Check 22:59:33,31
--- C:\Users\Ondra\AppData\Local DB Check 22:59:33,31
--- C:\Windows\system32\config\systemprofile\AppData\Local DB Check 22:59:33,31
--- C:\Windows\serviceprofiles\networkservice\AppData\Local DB Check 22:59:33,31
--- C:\Windows\serviceprofiles\Localservice\AppData\Local DB Check 22:59:33,31
--- C:\ProgramData\Microsoft\Windows\Start Menu\Programs DB Check 23:02:07,65
--- C:\Users\Ondra\AppData\Roaming\Microsoft\Windows\Start Menu\Programs DB Check 23:02:25,37
--- Tasks DB Check 23:02:35,19
--- Downloads DB Check 23:02:42,23
--- C:\Users\Ondra\AppData\LocalLow DB Check 23:02:55,40
--- C:\Windows\system32\config\systemprofile\AppData\LocalLow DB Check 23:02:55,40
--- C:\Windows\serviceprofiles\networkservice\AppData\LocalLow DB Check 23:02:55,40
--- C:\Windows\serviceprofiles\Localservice\AppData\LocalLow DB Check 23:02:55,40

#14 Příspěvek od **vyosek** » 10 Ún 2014 08:10

Dal jste prosim Run Script

Majkl55 · #15 Příspěvek od **Majkl55** » 16 Ún 2014 11:59

Omlouvám se, že to tak trvalo. Několikrát se to seklo a musel jsem začínat znova.

Zoek.exe v5.0.0.0 Updated 15-February-2014
Tool run by Ondra on so 15.02.2014 at 22:53:15,96.
Microsoft® Windows Vista™ Home Premium 6.0.6002 Service Pack 2 x86
Running in: Normal Mode Internet Access Detected
Launched: C:\Users\Ondra\Desktop\zoek.exe [Scan all users] [Script inserted]

==== Older Logs ======================

C:\zoek-results2014-02-09-221302.log 419 bytes
C:\zoek-results2014-02-09-231030.log 3812 bytes
C:\zoek-results2014-02-15-182750.log 9427 bytes

==== Reset Hosts File ======================

# Copyright (c) 1993-2006 Microsoft Corp.
#
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
#
# This file contains the mappings of IP addresses to host names. Each
# entry should be kept on an individual line. The IP address should
# be placed in the first column followed by the corresponding host name.
# The IP address and the host name should be separated by at least one
# space.
#
# Additionally, comments (such as these) may be inserted on individual
# lines or following the machine name denoted by a '#' symbol.
#
# For example:
#
# 102.54.94.97 rhino.acme.com # source server
# 38.25.63.10 x.acme.com # x client host

127.0.0.1 localhost
::1 localhost

==== Deleting CLSID Registry Keys ======================

==== Deleting CLSID Registry Values ======================

==== Deleting Services ======================

==== FireFox Fix ======================

Deleted from C:\Users\Ondra\AppData\Roaming\Mozilla\Firefox\Profiles\0\prefs.js:
user_pref("browser.startup.homepage", "http://www.google.com");
user_pref("browser.search.defaulturl", "http://www.google.com/search?btnG=Google+Search&q=");
user_pref("browser.newtab.url", "http://www.google.com/");
user_pref("browser.search.defaultengine", "Google");
user_pref("browser.search.defaultenginename", "Google");
user_pref("browser.search.selectedEngine", "Google");
user_pref("browser.search.order.1", "Google");
user_pref("keyword.URL", "http://www.google.com/search?btnG=Google+Search&q=");
user_pref("browser.search.suggest.enabled", true);
user_pref("browser.search.useDBForOrder", true);

Added to C:\Users\Ondra\AppData\Roaming\Mozilla\Firefox\Profiles\0\prefs.js:
user_pref("browser.startup.homepage", "http://www.google.com");
user_pref("browser.search.defaulturl", "http://www.google.com/search?btnG=Google+Search&q=");
user_pref("browser.newtab.url", "http://www.google.com/");
user_pref("browser.search.defaultengine", "Google");
user_pref("browser.search.defaultenginename", "Google");
user_pref("browser.search.selectedEngine", "Google");
user_pref("browser.search.order.1", "Google");
user_pref("keyword.URL", "http://www.google.com/search?btnG=Google+Search&q=");
user_pref("browser.search.suggest.enabled", true);
user_pref("browser.search.useDBForOrder", true);

==== Deleting Files \ Folders ======================

======== System Restore Points ========

RP647: 24.1.2014 20:19:58 - Windows Update
RP648: 25.1.2014 13:15:58 - Naplánovaný kontrolní bod
RP649: 26.1.2014 22:49:30 - Naplánovaný kontrolní bod
RP650: 28.1.2014 19:07:21 - Naplánovaný kontrolní bod
RP651: 31.1.2014 20:20:13 - Windows Update
RP652: 2.2.2014 16:23:10 - Windows Update
RP653: 5.2.2014 20:31:35 - Naplánovaný kontrolní bod
RP653: 5.2.2014 20:31:35 - Naplánovaný kontrolní bod
RP654: 6.2.2014 20:10:13 - Windows Update
RP655: 6.2.2014 20:19:42 - Operace obnovení
RP656: 6.2.2014 21:12:35 - Windows Update
RP657: 9.2.2014 16:45:32 - Naplánovaný kontrolní bod
RP658: 9.2.2014 22:12:41 - zoek.exe restore point

==== Firefox Extensions Registry ======================

[HKEY_LOCAL_MACHINE\Software\Mozilla\Firefox\Extensions]
"{20a82645-c095-46ed-80e3-08825760534b}"="c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension" [08.07.2009 20:38]

==== Firefox Extensions ======================

==== Firefox Plugins ======================

==== Chrome Look ======================

HKEY_LOCAL_MACHINE\SOFTWARE\Google\Chrome\Extensions
mhkaekfpcppmmioggniknbnbdbcigpkk - C:\Program Files\Common Files\Spigot\GC\coupons_2.3.crx[]

gRaeatsaver - Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\ckajljfbnjgppcddpobijbnilhhnfoan
YoutubeAdblocker - Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\dbddnljcgdflcfleagjkkpbphnmnbioe
SEO Website Analysis - Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\hlngmmdolgbdnnimbmblfhhndibdipaf
YTBookMMark - Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\kdfkimjghcbmoihiljcjpdnoebhanlhh
gRaeatsaver - Administrator\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\ckajljfbnjgppcddpobijbnilhhnfoan
YoutubeAdblocker - Administrator\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\dbddnljcgdflcfleagjkkpbphnmnbioe
SEO Website Analysis - Administrator\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\hlngmmdolgbdnnimbmblfhhndibdipaf
YTBookMMark - Administrator\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\kdfkimjghcbmoihiljcjpdnoebhanlhh
gRaeatsaver - Administrator\AppData\Local\Torch\User Data\Default\Extensions\ckajljfbnjgppcddpobijbnilhhnfoan
YoutubeAdblocker - Administrator\AppData\Local\Torch\User Data\Default\Extensions\dbddnljcgdflcfleagjkkpbphnmnbioe
SEO Website Analysis - Administrator\AppData\Local\Torch\User Data\Default\Extensions\hlngmmdolgbdnnimbmblfhhndibdipaf
YTBookMMark - Administrator\AppData\Local\Torch\User Data\Default\Extensions\kdfkimjghcbmoihiljcjpdnoebhanlhh
gRaeatsaver - Administrator\AppData\Local\COMODO\Dragon\User Data\Default\Extensions\ckajljfbnjgppcddpobijbnilhhnfoan
YoutubeAdblocker - Administrator\AppData\Local\COMODO\Dragon\User Data\Default\Extensions\dbddnljcgdflcfleagjkkpbphnmnbioe
SEO Website Analysis - Administrator\AppData\Local\COMODO\Dragon\User Data\Default\Extensions\hlngmmdolgbdnnimbmblfhhndibdipaf
YTBookMMark - Administrator\AppData\Local\COMODO\Dragon\User Data\Default\Extensions\kdfkimjghcbmoihiljcjpdnoebhanlhh
gRaeatsaver - Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\ckajljfbnjgppcddpobijbnilhhnfoan
YoutubeAdblocker - Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\dbddnljcgdflcfleagjkkpbphnmnbioe
SEO Website Analysis - Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\hlngmmdolgbdnnimbmblfhhndibdipaf
YTBookMMark - Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\kdfkimjghcbmoihiljcjpdnoebhanlhh
gRaeatsaver - Guest\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\ckajljfbnjgppcddpobijbnilhhnfoan
YoutubeAdblocker - Guest\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\dbddnljcgdflcfleagjkkpbphnmnbioe
SEO Website Analysis - Guest\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\hlngmmdolgbdnnimbmblfhhndibdipaf
YTBookMMark - Guest\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\kdfkimjghcbmoihiljcjpdnoebhanlhh
gRaeatsaver - Guest\AppData\Local\Torch\User Data\Default\Extensions\ckajljfbnjgppcddpobijbnilhhnfoan
YoutubeAdblocker - Guest\AppData\Local\Torch\User Data\Default\Extensions\dbddnljcgdflcfleagjkkpbphnmnbioe
SEO Website Analysis - Guest\AppData\Local\Torch\User Data\Default\Extensions\hlngmmdolgbdnnimbmblfhhndibdipaf
YTBookMMark - Guest\AppData\Local\Torch\User Data\Default\Extensions\kdfkimjghcbmoihiljcjpdnoebhanlhh
gRaeatsaver - Guest\AppData\Local\COMODO\Dragon\User Data\Default\Extensions\ckajljfbnjgppcddpobijbnilhhnfoan
YoutubeAdblocker - Guest\AppData\Local\COMODO\Dragon\User Data\Default\Extensions\dbddnljcgdflcfleagjkkpbphnmnbioe
SEO Website Analysis - Guest\AppData\Local\COMODO\Dragon\User Data\Default\Extensions\hlngmmdolgbdnnimbmblfhhndibdipaf
YTBookMMark - Guest\AppData\Local\COMODO\Dragon\User Data\Default\Extensions\kdfkimjghcbmoihiljcjpdnoebhanlhh
gRaeatsaver - Ondra\AppData\Local\Google\Chrome\User Data\Default\Extensions\ckajljfbnjgppcddpobijbnilhhnfoan
YoutubeAdblocker - Ondra\AppData\Local\Google\Chrome\User Data\Default\Extensions\dbddnljcgdflcfleagjkkpbphnmnbioe
SEO Website Analysis - Ondra\AppData\Local\Google\Chrome\User Data\Default\Extensions\hlngmmdolgbdnnimbmblfhhndibdipaf
YTBookMMark - Ondra\AppData\Local\Google\Chrome\User Data\Default\Extensions\kdfkimjghcbmoihiljcjpdnoebhanlhh
gRaeatsaver - Ondra\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\ckajljfbnjgppcddpobijbnilhhnfoan
YoutubeAdblocker - Ondra\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\dbddnljcgdflcfleagjkkpbphnmnbioe
SEO Website Analysis - Ondra\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\hlngmmdolgbdnnimbmblfhhndibdipaf
YTBookMMark - Ondra\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\kdfkimjghcbmoihiljcjpdnoebhanlhh
gRaeatsaver - Ondra\AppData\Local\COMODO\Dragon\User Data\Default\Extensions\ckajljfbnjgppcddpobijbnilhhnfoan
YoutubeAdblocker - Ondra\AppData\Local\COMODO\Dragon\User Data\Default\Extensions\dbddnljcgdflcfleagjkkpbphnmnbioe
SEO Website Analysis - Ondra\AppData\Local\COMODO\Dragon\User Data\Default\Extensions\hlngmmdolgbdnnimbmblfhhndibdipaf
YTBookMMark - Ondra\AppData\Local\COMODO\Dragon\User Data\Default\Extensions\kdfkimjghcbmoihiljcjpdnoebhanlhh

==== Chrome Fix ======================

C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\ckajljfbnjgppcddpobijbnilhhnfoan deleted successfully
C:\Users\Administrator\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\ckajljfbnjgppcddpobijbnilhhnfoan deleted successfully
C:\Users\Administrator\AppData\Local\Torch\User Data\Default\Extensions\ckajljfbnjgppcddpobijbnilhhnfoan deleted successfully
C:\Users\Administrator\AppData\Local\COMODO\Dragon\User Data\Default\Extensions\ckajljfbnjgppcddpobijbnilhhnfoan deleted successfully
C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\ckajljfbnjgppcddpobijbnilhhnfoan deleted successfully
C:\Users\Guest\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\ckajljfbnjgppcddpobijbnilhhnfoan deleted successfully
C:\Users\Guest\AppData\Local\Torch\User Data\Default\Extensions\ckajljfbnjgppcddpobijbnilhhnfoan deleted successfully
C:\Users\Guest\AppData\Local\COMODO\Dragon\User Data\Default\Extensions\ckajljfbnjgppcddpobijbnilhhnfoan deleted successfully
C:\Users\Ondra\AppData\Local\Google\Chrome\User Data\Default\Extensions\ckajljfbnjgppcddpobijbnilhhnfoan deleted successfully
C:\Users\Ondra\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\ckajljfbnjgppcddpobijbnilhhnfoan deleted successfully
C:\Users\Ondra\AppData\Local\COMODO\Dragon\User Data\Default\Extensions\ckajljfbnjgppcddpobijbnilhhnfoan deleted successfully
C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\dbddnljcgdflcfleagjkkpbphnmnbioe deleted successfully
C:\Users\Administrator\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\dbddnljcgdflcfleagjkkpbphnmnbioe deleted successfully
C:\Users\Administrator\AppData\Local\Torch\User Data\Default\Extensions\dbddnljcgdflcfleagjkkpbphnmnbioe deleted successfully
C:\Users\Administrator\AppData\Local\COMODO\Dragon\User Data\Default\Extensions\dbddnljcgdflcfleagjkkpbphnmnbioe deleted successfully
C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\dbddnljcgdflcfleagjkkpbphnmnbioe deleted successfully
C:\Users\Guest\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\dbddnljcgdflcfleagjkkpbphnmnbioe deleted successfully
C:\Users\Guest\AppData\Local\Torch\User Data\Default\Extensions\dbddnljcgdflcfleagjkkpbphnmnbioe deleted successfully
C:\Users\Guest\AppData\Local\COMODO\Dragon\User Data\Default\Extensions\dbddnljcgdflcfleagjkkpbphnmnbioe deleted successfully
C:\Users\Ondra\AppData\Local\Google\Chrome\User Data\Default\Extensions\dbddnljcgdflcfleagjkkpbphnmnbioe deleted successfully
C:\Users\Ondra\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\dbddnljcgdflcfleagjkkpbphnmnbioe deleted successfully
C:\Users\Ondra\AppData\Local\COMODO\Dragon\User Data\Default\Extensions\dbddnljcgdflcfleagjkkpbphnmnbioe deleted successfully
C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\hlngmmdolgbdnnimbmblfhhndibdipaf deleted successfully
C:\Users\Administrator\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\hlngmmdolgbdnnimbmblfhhndibdipaf deleted successfully
C:\Users\Administrator\AppData\Local\Torch\User Data\Default\Extensions\hlngmmdolgbdnnimbmblfhhndibdipaf deleted successfully
C:\Users\Administrator\AppData\Local\COMODO\Dragon\User Data\Default\Extensions\hlngmmdolgbdnnimbmblfhhndibdipaf deleted successfully
C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\hlngmmdolgbdnnimbmblfhhndibdipaf deleted successfully
C:\Users\Guest\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\hlngmmdolgbdnnimbmblfhhndibdipaf deleted successfully
C:\Users\Guest\AppData\Local\Torch\User Data\Default\Extensions\hlngmmdolgbdnnimbmblfhhndibdipaf deleted successfully
C:\Users\Guest\AppData\Local\COMODO\Dragon\User Data\Default\Extensions\hlngmmdolgbdnnimbmblfhhndibdipaf deleted successfully
C:\Users\Ondra\AppData\Local\Google\Chrome\User Data\Default\Extensions\hlngmmdolgbdnnimbmblfhhndibdipaf deleted successfully
C:\Users\Ondra\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\hlngmmdolgbdnnimbmblfhhndibdipaf deleted successfully
C:\Users\Ondra\AppData\Local\COMODO\Dragon\User Data\Default\Extensions\hlngmmdolgbdnnimbmblfhhndibdipaf deleted successfully
C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\kdfkimjghcbmoihiljcjpdnoebhanlhh deleted successfully
C:\Users\Administrator\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\kdfkimjghcbmoihiljcjpdnoebhanlhh deleted successfully
C:\Users\Administrator\AppData\Local\Torch\User Data\Default\Extensions\kdfkimjghcbmoihiljcjpdnoebhanlhh deleted successfully
C:\Users\Administrator\AppData\Local\COMODO\Dragon\User Data\Default\Extensions\kdfkimjghcbmoihiljcjpdnoebhanlhh deleted successfully
C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\kdfkimjghcbmoihiljcjpdnoebhanlhh deleted successfully
C:\Users\Guest\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\kdfkimjghcbmoihiljcjpdnoebhanlhh deleted successfully
C:\Users\Guest\AppData\Local\Torch\User Data\Default\Extensions\kdfkimjghcbmoihiljcjpdnoebhanlhh deleted successfully
C:\Users\Guest\AppData\Local\COMODO\Dragon\User Data\Default\Extensions\kdfkimjghcbmoihiljcjpdnoebhanlhh deleted successfully
C:\Users\Ondra\AppData\Local\Google\Chrome\User Data\Default\Extensions\kdfkimjghcbmoihiljcjpdnoebhanlhh deleted successfully
C:\Users\Ondra\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\kdfkimjghcbmoihiljcjpdnoebhanlhh deleted successfully
C:\Users\Ondra\AppData\Local\COMODO\Dragon\User Data\Default\Extensions\kdfkimjghcbmoihiljcjpdnoebhanlhh deleted successfully

==== Set IE to Default ======================

Old Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"="http://www.seznam.cz/"
"Default_Page_URL"="http://www.google.com/ig/redirectdomain ... &bmod=ASUS"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
"Start Page"="http://www.google.com"
"Default_Page_URL"="http://www.google.com/ig/redirectdomain ... &bmod=ASUS"

New Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Default_Page_URL"="http://go.microsoft.com/fwlink/?LinkId=69157"
"Start Page"="http://www.seznam.cz/"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
"Start Page"="http://go.microsoft.com/fwlink/?LinkId=69157"
"Default_Page_URL"="http://go.microsoft.com/fwlink/?LinkId=69157"

==== All HKCU SearchScopes ======================

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes
"DefaultScope"="{A8BD5B79-93F2-41E5-8180-A5EB5B5F5A08}"
{0633EE93-D776-472f-A0FF-E1416B8B2E3A} @ieframe.dll,-12512 Url="http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC"
{67A2568C-7A0A-4EED-AECC-B5405DE63B64} Google Url="http://www.google.co.uk/search?sourceid ... US_csCZ333"
{6A1806CD-94D4-4689-BA73-E35EA1EA9990} Google Url="http://www.google.com/search?q={searchT ... {startPage}"
{A8BD5B79-93F2-41E5-8180-A5EB5B5F5A08} Google Url="http://www.google.com/search?sourceid=i ... US_csCZ333"
{B12AB271-AC3B-4B73-A7BA-F207AFFCE24E} (www.google.com) Google Url="http://www.google.com/search?q={searchT ... utEncoding?}"

==== Reset Google Chrome ======================

C:\Users\Ondra\AppData\Local\Google\Chrome\User Data\Default\preferences was reset successfully
C:\Users\Ondra\AppData\Local\Google\Chrome\User Data\Default\Web Data was reset successfully

==== Deleting Registry Keys ======================

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\2c6c7b61-7b6f-4796-bc02-9d0c60d5247a deleted successfully
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\9165bc87-975a-48f5-a644-f9547be5567e deleted successfully
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\c9d7f33b-b52b-4592-9059-e1bc0ea75d86 deleted successfully
HKEY_LOCAL_MACHINE\SOFTWARE\Google\Chrome\Extensions\mhkaekfpcppmmioggniknbnbdbcigpkk deleted successfully
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{5F189DF5-2D05-472B-9091-84D9848AE48B}{916e5338} deleted successfully

==== Empty IE Cache ======================

C:\Users\Default\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\Ondra\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5 emptied successfully
C:\Users\Ondra\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low(359)\Content.IE5 emptied successfully
C:\Users\Ondra\AppData\Local\Temp\Low\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\serviceprofiles\networkservice\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\serviceprofiles\Localservice\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\serviceprofiles\Localservice\AppData\Local\Temp\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\Ondra\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat will be deleted at reboot

==== Empty FireFox Cache ======================

No FireFox Cache found

==== Empty Chrome Cache ======================

C:\Users\Ondra\AppData\Local\Google\Chrome\User Data\Default\Cache emptied successfully

==== Empty All Flash Cache ======================

Flash Cache Emptied Successfully

==== Empty All Java Cache ======================

No Java Cache Found

==== C:\zoek_backup content ======================

C:\zoek_backup (files=242 folders=95 5593695 bytes)

==== Empty Temp Folders ======================

C:\Users\Default\AppData\Local\Temp emptied successfully
C:\Windows\serviceprofiles\networkservice\AppData\Local\Temp emptied successfully
C:\Windows\serviceprofiles\Localservice\AppData\Local\Temp emptied successfully
C:\Users\Ondra\AppData\Local\Temp will be emptied at reboot
C:\Windows\Temp will be emptied at reboot

==== After Reboot ======================

==== Empty Temp Folders ======================

C:\Windows\Temp successfully emptied
C:\Users\Ondra\AppData\Local\Temp successfully emptied

==== Empty Recycle Bin ======================

C:\$RECYCLE.BIN successfully emptied

==== Deleting Files / Folders ======================

"C:\Users\Ondra\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat" not found

==== EOF on ne 16.02.2014 at 3:18:35,76 ======================

VIRY.CZ

Pomalý notebook - Podezření na vir

Pomalý notebook - Podezření na vir

Re: Pomalý notebook - Podezření na vir

Re: Pomalý notebook - Podezření na vir

Re: Pomalý notebook - Podezření na vir

Re: Pomalý notebook - Podezření na vir

Re: Pomalý notebook - Podezření na vir

Re: Pomalý notebook - Podezření na vir

Re: Pomalý notebook - Podezření na vir

Re: Pomalý notebook - Podezření na vir

Re: Pomalý notebook - Podezření na vir

Re: Pomalý notebook - Podezření na vir

Re: Pomalý notebook - Podezření na vir

Re: Pomalý notebook - Podezření na vir

Re: Pomalý notebook - Podezření na vir

Re: Pomalý notebook - Podezření na vir