Preventivita - pred tydnem velice zpomaleny

[KEnik]

Dobrý den,
prosím o kontrolu logu:

Logfile of random's system information tool 1.09 (written by random/random)
Run by PEPE at 2014-05-12 12:53:39
Microsoft Windows 7 Home Premium Service Pack 1
System drive C: has 137 GB (52%) free of 264 GB
Total RAM: 1791 MB (44% free)

HijackThis download failed

======Scheduled tasks folder======

C:\Windows\tasks\Adobe Flash Player Updater.job

=========Mozilla firefox=========

ProfilePath - C:\Users\PEPE\AppData\Roaming\Mozilla\Firefox\Profiles\x8yg01ox.default

"wrc@avast.com"=C:\Program Files\AVAST Software\Avast\WebRep\FF
"siteranker@siteranker.com"=C:\Program Files\SiteRanker\firefox\


[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 11.8.800.168 Plugin
"Path"=C:\Windows\system32\Macromed\Flash\NPSWF32_11_8_800_168.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf]
"Description"=
"Path"=C:\Program Files\Tracker Software\PDF Viewer\npPDFXCviewNPPlugin.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@Google.com/GoogleEarthPlugin]
"Description"=Google Earth in your browser
"Path"=C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@google.com/npPicasa3,version=3.0.0]
"Description"=Picasa3 plugin
"Path"=C:\Program Files\Google\Picasa3\npPicasa3.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@java.com/DTPlugin,version=1.6.0_35]
"Description"=
"Path"=C:\Windows\system32\npdeployJava1.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@java.com/JavaPlugin]
"Description"=Oracle® Next Generation Java™ Plug-In
"Path"=C:\Program Files\Java\jre6\bin\plugin2\npjp2.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/GENUINE]
"Description"=
"Path"=disabled

C:\Program Files\Mozilla Firefox\extensions\
{AB2CE124-6272-4b12-94A9-7303C7397BD1}
{CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA}

C:\Program Files\Mozilla Firefox\plugins\
NPOFF12.DLL
nppdf32.dll
npPDFXCviewNPPlugin.dll

C:\Users\PEPE\AppData\Roaming\Mozilla\Firefox\Profiles\x8yg01ox.default\extensions\
AppGraffiti@AppGraffiti.com

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{11BF46C6-B3DE-48BD-BF70-3AD85CAB80B5}]
C:\PROGRA~1\SITERA~1\SiteRank.dll [2012-10-25 343296]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2010-11-15 62376]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6F6A5334-78E9-4D9B-8182-8B41EA8C39EF}]
AppGraffiti - C:\PROGRA~1\APPGRA~1\APPGRA~1.DLL [2013-12-03 1038504]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}]
Groove GFS Browser Helper - C:\PROGRA~1\MICROS~2\Office12\GR469A~1.DLL [2006-10-27 2210608]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
Java(tm) Plug-In SSV Helper - C:\Program Files\Java\jre6\bin\ssv.dll [2012-10-08 329712]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8E5E2654-AD2D-48bf-AC2D-D17F00898D06}]
avast! Online Security - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll [2013-05-09 198688]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}]
Skype Plug-In - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll [2011-02-11 1246600]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C5D07EB6-BBCE-4DAE-ACBB-D13A8D28CB1F}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2012-10-08 59376]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - avast! Online Security - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll [2013-05-09 198688]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"avast"=C:\Program Files\AVAST Software\Avast\avastUI.exe [2013-05-09 4858968]
"LogMeIn GUI"=C:\Program Files\LogMeIn\x86\LogMeInSystray.exe [2012-10-10 63048]
"StartCCC"=C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [2013-04-30 642304]
"AMD AVT"=Cmd.exe /c start AMD Accelerated Video Transcoding device initialization /min C:\Program Files\AMD AVT\bin\kdbsync.exe aml []

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"AGupdate"=C:\Program Files\AppGraffiti\AGupdate.exe [2013-03-19 894048]
"Copy"=C:\Users\PEPE\AppData\Roaming\Copy\CopyAgent.exe [2014-04-16 13475984]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Users^PEPE^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OpenOffice.org 3.2.lnk]
C:\PROGRA~1\OPENOF~1.ORG\program\QUICKS~1.EXE [2010-06-07 1195520]

C:\Users\PEPE\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
Dropbox.lnk - C:\Users\PEPE\AppData\Roaming\Dropbox\bin\Dropbox.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\PROGRA~1\MICROS~2\Office12\GR469A~1.DLL [2006-10-27 2210608]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=5
"ConsentPromptBehaviorUser"=3
"EnableUIADesktopToggle"=0
"PromptOnSecureDesktop"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDrives"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDrives"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.msadpcm"=msadp32.acm
"midimapper"=midimap.dll
"wavemapper"=msacm32.drv
"VIDC.UYVY"=msyuv.dll
"VIDC.YUY2"=msyuv.dll
"VIDC.YVYU"=msyuv.dll
"VIDC.IYUV"=iyuv_32.dll
"vidc.i420"=iyuv_32.dll
"VIDC.YVU9"=tsbyuv.dll
"msacm.l3acm"=C:\Windows\System32\l3codeca.acm
"vidc.cvid"=iccvid.dll
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv
"vidc.ffds"=C:\PROGRA~1\COMBIN~1\Filters\FFDShow\ff_vfw.dll
"MSVideo8"=VfWWDM32.dll
"wave2"=wdmaud.drv
"midi2"=wdmaud.drv
"mixer2"=wdmaud.drv
"aux2"=wdmaud.drv
"wave1"=wdmaud.drv
"midi1"=wdmaud.drv
"mixer1"=wdmaud.drv
"aux1"=wdmaud.drv

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1

======List of files/folders created in the last 1 month======

2014-05-09 22:01:50 ----D---- C:\Program Files\Mozilla Firefox
2014-05-08 03:00:38 ----A---- C:\Windows\system32\mshtml.dll
2014-05-07 03:01:54 ----A---- C:\Windows\system32\vbscript.dll
2014-05-07 03:01:53 ----A---- C:\Windows\system32\ieui.dll
2014-05-07 03:01:37 ----A---- C:\Windows\system32\ieetwcollectorres.dll
2014-05-07 03:01:37 ----A---- C:\Windows\system32\ieapfltr.dll
2014-05-07 03:01:32 ----A---- C:\Windows\system32\msrating.dll
2014-05-07 03:01:31 ----A---- C:\Windows\system32\msfeeds.dll
2014-05-07 03:01:31 ----A---- C:\Windows\system32\jsproxy.dll
2014-05-07 03:01:29 ----A---- C:\Windows\system32\dxtrans.dll
2014-05-07 03:01:29 ----A---- C:\Windows\system32\dxtmsft.dll
2014-05-07 03:01:27 ----A---- C:\Windows\system32\ie4uinit.exe
2014-05-07 03:01:26 ----A---- C:\Windows\system32\ieUnatt.exe
2014-05-07 03:01:26 ----A---- C:\Windows\system32\iesetup.dll
2014-05-07 03:01:26 ----A---- C:\Windows\system32\iernonce.dll
2014-05-07 03:01:21 ----A---- C:\Windows\system32\jscript9diag.dll
2014-05-07 03:01:21 ----A---- C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-05-07 03:01:21 ----A---- C:\Windows\system32\ieetwproxystub.dll
2014-05-07 03:01:21 ----A---- C:\Windows\system32\ieetwcollector.exe
2014-05-07 03:01:19 ----A---- C:\Windows\system32\MsSpellCheckingFacility.exe
2014-05-07 03:01:07 ----A---- C:\Windows\system32\iertutil.dll
2014-05-07 03:01:06 ----A---- C:\Windows\system32\wininet.dll
2014-05-07 03:01:05 ----A---- C:\Windows\system32\urlmon.dll
2014-05-07 03:01:00 ----A---- C:\Windows\system32\ieframe.dll
2014-05-07 03:00:57 ----A---- C:\Windows\system32\jscript9.dll
2014-04-30 22:21:06 ----D---- C:\Program Files\Mozilla Thunderbird

======List of files/folders modified in the last 1 month======

2014-05-12 12:54:01 ----D---- C:\Program Files\trend micro
2014-05-12 12:53:30 ----D---- C:\Windows\Prefetch
2014-05-12 12:49:45 ----D---- C:\Users\PEPE\AppData\Roaming\Skype
2014-05-12 12:43:50 ----D---- C:\Users\PEPE\AppData\Roaming\Copy
2014-05-12 11:03:00 ----D---- C:\Windows\Temp
2014-05-12 08:09:59 ----D---- C:\Users\PEPE\AppData\Roaming\skypePM
2014-05-12 03:10:44 ----D---- C:\Windows\system32\config
2014-05-11 15:51:31 ----D---- C:\ProgramData\LogMeIn
2014-05-11 09:29:04 ----D---- C:\Program Files\Mozilla Maintenance Service
2014-05-11 09:29:00 ----RD---- C:\Program Files
2014-05-11 01:00:04 ----D---- C:\Windows\inf
2014-05-10 00:43:40 ----D---- C:\Users\PEPE\AppData\Roaming\Dropbox
2014-05-09 18:44:35 ----D---- C:\Windows
2014-05-09 15:56:20 ----D---- C:\Windows\debug
2014-05-08 03:18:26 ----D---- C:\Windows\winsxs
2014-05-08 03:16:57 ----D---- C:\Windows\System32
2014-05-08 03:00:46 ----D---- C:\Windows\system32\catroot
2014-05-08 03:00:25 ----SHD---- C:\System Volume Information
2014-05-07 04:08:54 ----D---- C:\Windows\rescache
2014-05-07 03:18:51 ----D---- C:\Windows\system32\en-US
2014-05-07 03:18:51 ----D---- C:\Windows\system32\cs-CZ
2014-05-07 03:18:51 ----D---- C:\Windows\PolicyDefinitions
2014-05-07 03:18:50 ----D---- C:\Program Files\Internet Explorer
2014-05-07 03:02:20 ----D---- C:\Windows\system32\catroot2
2014-05-01 20:11:27 ----A---- C:\Windows\system32\PerfStringBackup.INI
2014-04-18 19:23:37 ----D---- C:\Program Files\LogMeIn
2014-04-18 19:22:15 ----A---- C:\Windows\system32\LMIRfsClientNP.dll
2014-04-18 19:22:13 ----A---- C:\Windows\system32\LMIinit.dll

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 aswRvrt;aswRvrt; C:\Windows\system32\drivers\aswRvrt.sys [2013-05-09 49376]
R0 aswVmm;aswVmm; C:\Windows\system32\drivers\aswVmm.sys [2013-07-08 175176]
R0 pciide;pciide; C:\Windows\system32\drivers\pciide.sys [2009-07-14 12368]
R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2010-11-20 173440]
R1 aswRdr;aswRdr; C:\Windows\System32\Drivers\aswrdr2.sys [2013-05-09 61680]
R1 aswSnx;aswSnx; C:\Windows\system32\drivers\aswSnx.sys [2013-07-08 770344]
R1 aswSP;aswSP; C:\Windows\system32\drivers\aswSP.sys [2013-07-08 369584]
R1 aswTdi;avast! Network Shield Support; C:\Windows\system32\drivers\aswTdi.sys [2013-05-09 56080]
R1 dtsoftbus01;DAEMON Tools Virtual Bus Driver; C:\Windows\system32\DRIVERS\dtsoftbus01.sys [2012-09-03 242240]
R2 AODDriver4.1;AODDriver4.1; \??\C:\Program Files\ATI Technologies\ATI.ACE\Fuel\i386\AODDriver2.sys [2012-03-05 45184]
R2 aswFsBlk;aswFsBlk; C:\Windows\system32\drivers\aswFsBlk.sys [2013-05-09 29816]
R2 aswMonFlt;aswMonFlt; \??\C:\Windows\system32\drivers\aswMonFlt.sys [2013-05-09 66336]
R2 LMIInfo;LogMeIn Kernel Information Provider; \??\C:\Program Files\LogMeIn\x86\RaInfo.sys [2013-06-04 13624]
R2 LMIRfsDriver;LogMeIn Remote File System Driver; \??\C:\Windows\system32\drivers\LMIRfsDriver.sys [2012-08-24 47640]
R2 Parvdm;Parvdm; C:\Windows\system32\DRIVERS\parvdm.sys [2009-07-14 8704]
R2 SSPORT;SSPORT; \??\C:\Windows\system32\Drivers\SSPORT.sys [2009-07-12 5120]
R3 amdiox86;AMD IO Driver; C:\Windows\system32\DRIVERS\amdiox86.sys [2010-02-18 37944]
R3 amdkmdag;amdkmdag; C:\Windows\system32\DRIVERS\atikmdag.sys [2013-04-30 10070016]
R3 amdkmdap;amdkmdap; C:\Windows\system32\DRIVERS\atikmpag.sys [2013-04-30 290304]
R3 AtiHDAudioService;AMD Function Driver for HD Audio Service; C:\Windows\system32\drivers\AtihdW73.sys [2012-05-14 86656]
R3 lmimirr;lmimirr; C:\Windows\system32\DRIVERS\lmimirr.sys [2012-08-24 10144]
R3 RTL8167;Ovladač Realtek 8167 NT; C:\Windows\system32\DRIVERS\Rt86win7.sys [2009-07-14 139776]
S3 aic78xx;aic78xx; C:\Windows\system32\DRIVERS\djsvs.sys [2009-07-14 70720]
S3 amdagp;Ovladač filtru AMD portu AGP; C:\Windows\system32\drivers\amdagp.sys [2009-07-14 53312]
S3 atikmdag;atikmdag; C:\Windows\system32\DRIVERS\atikmdag.sys [2013-04-30 10070016]
S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0; C:\Windows\system32\DRIVERS\b57nd60x.sys [2009-07-14 229888]
S3 BridgeMP;@%SystemRoot%\system32\bridgeres.dll,-1; C:\Windows\system32\DRIVERS\bridge.sys [2009-07-14 78336]
S3 catchme;catchme; \??\C:\Users\PEPE\AppData\Local\Temp\catchme.sys []
S3 MBAMSwissArmy;MBAMSwissArmy; \??\C:\Windows\system32\drivers\mbamswissarmy.sys [2012-11-23 40776]
S3 sisagp;Filtr SIS sběrnice AGP; C:\Windows\system32\drivers\sisagp.sys [2009-07-14 52304]
S3 TsUsbFlt;@%SystemRoot%\system32\drivers\tsusbflt.sys,-1; C:\Windows\System32\drivers\tsusbflt.sys [2010-11-20 52224]
S3 VBoxNetAdp;VirtualBox Host-Only Ethernet Adapter; C:\Windows\system32\DRIVERS\VBoxNetAdp.sys [2012-09-13 104280]
S3 VBoxNetFlt;VirtualBox Bridged Networking Service; C:\Windows\system32\DRIVERS\VBoxNetFlt.sys []
S3 viaagp;Filtr VIA sběrnice AGP; C:\Windows\system32\drivers\viaagp.sys [2009-07-14 53328]
S3 ViaC7;VIA C7 Processor Driver; C:\Windows\system32\DRIVERS\viac7.sys [2009-07-14 52736]
S3 WinUsb;WinUsb; C:\Windows\system32\DRIVERS\WinUsb.sys [2010-11-20 35968]
S4 LMIRfsClientNP;LMIRfsClientNP; C:\Windows\system32\drivers\LMIRfsClientNP.sys []

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AMD External Events Utility;AMD External Events Utility; C:\Windows\system32\atiesrxx.exe [2013-04-30 217088]
R2 AMD FUEL Service;AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [2013-04-30 291840]
R2 avast! Antivirus;avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [2013-05-09 46808]
R2 LMIGuardianSvc;LMIGuardianSvc; C:\Program Files\LogMeIn\x86\LMIGuardianSvc.exe [2014-04-18 375120]
R2 LMIMaint;LogMeIn Maintenance Service; C:\Program Files\LogMeIn\x86\RaMaint.exe [2014-04-18 203088]
R2 LogMeIn;LogMeIn; C:\Program Files\LogMeIn\x86\LogMeIn.exe [2012-08-24 390528]
R2 TeamViewer7;TeamViewer 7; C:\Program Files\TeamViewer\Version7\TeamViewer_Service.exe [2012-08-31 2754984]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service; C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe [2013-10-09 257416]
S3 gusvc;Google Updater Service; C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe [2010-06-11 136120]
S3 IEEtwCollectorService;@%SystemRoot%\system32\ieetwcollectorres.dll,-1000; C:\Windows\system32\IEEtwCollector.exe [2014-03-06 108032]
S3 Microsoft Office Groove Audit Service;Microsoft Office Groove Audit Service; C:\Program Files\Microsoft Office\Office12\GrooveAuditService.exe [2006-10-27 65824]
S3 MozillaMaintenance;Mozilla Maintenance Service; C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe [2014-05-09 119408]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2006-10-26 441136]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 WatAdminSvc;@%SystemRoot%\system32\Wat\WatUX.exe,-601; C:\Windows\system32\Wat\WatAdminSvc.exe [2011-03-31 1343400]

-----------------EOF-----------------

[Roli]

Zdravím, smaž nepotřebné soubory

pomocí CCleaneru

návod :

Čistič - tady vyčistíš PC od nepotřebných souborů a vysypeš Koš

Registry - tady vyčistíš registry (před použitím doporučuji udělat jejich zálohu kterou CCleaner nabízí)

čištění registru je třeba několikrát zopakovat !

Nástroje - tady lze odinstalovat programy, upravit co se spustí po Startu systému a obnovit systém


Stáhni a ulož na plochu AdwCleaner,

ukonči všechny programy včetně prohlížeče a dvojklikem spusť,

objeví se okno kde vlevo nahoře klikni na Scan.

Po té proběhne sken a po jeho skončení klikni na Report a to co na Tebe vypadne mi sem zkopíruj


Pak použij Mbam z mého popdisu a dej mi sem z něj také log, předem nic nemazat !

[KEnik]

Zdravím,
díky.
Vyčištěno.

Adwcleaner
# AdwCleaner v3.208 - Report created 12/05/2014 at 22:46:44
# Updated 11/05/2014 by Xplode
# Operating System : Windows 7 Home Premium Service Pack 1 (32 bits)
# Username : PEPE - PEPE-PC
# Running from : C:\Users\PEPE\Downloads\adwcleaner.exe
# Option : Scan

***** [ Services ] *****


***** [ Files / Folders ] *****

Folder Found : C:\Program Files\24x7Help
Folder Found : C:\Program Files\AppGraffiti
Folder Found : C:\Program Files\SiteRanker
Folder Found : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AppGraffiti
Folder Found : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SiteRanker
Folder Found : C:\Users\PEPE\AppData\LocalLow\AppGraffiti
Folder Found : C:\Users\PEPE\AppData\LocalLow\SiteRanker
Folder Found : C:\Users\PEPE\AppData\Roaming\Mozilla\Firefox\Profiles\x8yg01ox.default\Extensions\AppGraffiti@AppGraffiti.com

***** [ Shortcuts ] *****


***** [ Registry ] *****

Key Found : HKCU\Software\AppGraffiti
Key Found : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{C04B7D22-5AEC-4561-8F49-27F6269208F6}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{6F6A5334-78E9-4D9B-8182-8B41EA8C39EF}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{CCB69577-088B-4004-9ED8-FF5BCC83A039}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{D3D233D5-9F6D-436C-B6C7-E63F77503B30}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{D7E97865-918F-41E4-9CD0-25AB1C574CE8}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{11BF46C6-B3DE-48BD-BF70-3AD85CAB80B5}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{6F6A5334-78E9-4D9B-8182-8B41EA8C39EF}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{11BF46C6-B3DE-48BD-BF70-3AD85CAB80B5}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{6F6A5334-78E9-4D9B-8182-8B41EA8C39EF}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{8736C681-37A0-40C6-A0F0-4C083409151C}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{CC99A798-FD3D-4AB4-969E-6071612524F9}
Key Found : HKCU\Software\SiteRanker
Key Found : HKCU\Software\wscontb
Key Found : HKLM\Software\AppGraffiti
Key Found : HKLM\SOFTWARE\Classes\AppGraffiti.AppGraffitiJS
Key Found : HKLM\SOFTWARE\Classes\CLSID\{11BF46C6-B3DE-48BD-BF70-3AD85CAB80B5}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{6F6A5334-78E9-4D9B-8182-8B41EA8C39EF}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{865D7100-82C7-42F4-9C06-860DEC0871B2}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{BC9FD17D-30F6-4464-9E53-596A90AFF023}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{CC99A798-FD3D-4AB4-969E-6071612524F9}
Key Found : HKLM\SOFTWARE\Classes\Interface\{022C9F90-2E96-47D6-A971-107650154563}
Key Found : HKLM\SOFTWARE\Classes\TypeLib\{DB02BC6B-B0F0-4074-99E6-884B70FCB6AE}
Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{11BF46C6-B3DE-48BD-BF70-3AD85CAB80B6}
Key Found : HKLM\SOFTWARE\Microsoft\Tracing\App24x7Help_RASAPI32
Key Found : HKLM\SOFTWARE\Microsoft\Tracing\App24x7Help_RASMANCS
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{11BF46C6-B3DE-48BD-BF70-3AD85CAB80B5}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6F6A5334-78E9-4D9B-8182-8B41EA8C39EF}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{6F6A5334-78E9-4D9B-8182-8B41EA8C39EF}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{CCB69577-088B-4004-9ED8-FF5BCC83A039}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{D3D233D5-9F6D-436C-B6C7-E63F77503B30}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{D7E97865-918F-41E4-9CD0-25AB1C574CE8}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{11BF46C6-B3DE-48BD-BF70-3AD85CAB80B5}_is1
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{6F6A5334-78E9-4D9B-8182-8B41EA8C39EF}_is1
Value Found : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{D7E97865-918F-41E4-9CD0-25AB1C574CE8}]
Value Found : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks [{D3D233D5-9F6D-436C-B6C7-E63F77503B30}]
Value Found : HKLM\SOFTWARE\Mozilla\Firefox\Extensions [siteranker@siteranker.com]

***** [ Browsers ] *****

-\\ Internet Explorer v11.0.9600.17041

Setting Found : HKCU\Software\Microsoft\Internet Explorer\Main [Start Page] - hxxp://www.inbox.com/homepage.aspx?tbid=82120&iwk=258&lng=cs

-\\ Mozilla Firefox v29.0.1 (cs)

[ File : C:\Users\PEPE\AppData\Roaming\Mozilla\Firefox\Profiles\x8yg01ox.default\prefs.js ]


-\\ Google Chrome v

[ File : C:\Users\PEPE\AppData\Local\Google\Chrome\User Data\Default\preferences ]


*************************

AdwCleaner[R0].txt - [4937 octets] - [12/05/2014 22:46:44]

########## EOF - C:\AdwCleaner\AdwCleaner[R0].txt - [4997 octets] ##########

MBAM spadnul rpi ukladani logu - neulozil.
Zitra jej znovu spustim a poslu - nasel asi to same. 40 objektu.

[KEnik]

Mbam:
Log ulozit jako TXT neni mozne. APlikace spadne pri ukladani.
Vlozeni do schranky nefugnuje.
Histrorie - zobrazi prazdny log.

Otevrel jsem tedy log rucne a vkladam XML:
<?xml version="1.0" encoding="UTF-16" ?>
<mbam-log>
<header>
<date>2014/05/13 07:02:42 +0200</date>
<log>mbam-log-2014-05-13 (06-52-56).xml</log>
<isadmin>yes</isadmin>
</header>
<engine>
<version>2.00.1.1004</version>
<rules-database>v2014.05.13.05</rules-database>
<swissarmy-database>v2014.03.27.01</swissarmy-database>
<license>trial</license>
<file-protection>enabled</file-protection>
<web-protection>enabled</web-protection>
<self-protection>disabled</self-protection>
</engine>
<system>
<osversion>Windows 7 Service Pack 1</osversion>
<arch>x86</arch>
<username>PEPE</username>
<filesys>NTFS</filesys>
</system>
<summary>
<type>threat</type>
<result>completed</result>
<objects>262257</objects>
<time>572</time>
<processes>0</processes>
<modules>0</modules>
<keys>15</keys>
<values>3</values>
<datas>1</datas>
<folders>4</folders>
<files>18</files>
<sectors>0</sectors>
</summary>
<options>
<memory>enabled</memory>
<startup>enabled</startup>
<filesystem>enabled</filesystem>
<archives>enabled</archives>
<rootkits>disabled</rootkits>
<deeprootkit>disabled</deeprootkit>
<shuriken>enabled</shuriken>
<pup>enabled</pup>
<pum>enabled</pum>
</options>
<items>
<key><path>HKLM\SOFTWARE\CLASSES\CLSID\{6F6A5334-78E9-4D9B-8182-8B41EA8C39EF}</path><vendor>PUP.Optional.AppGraffiti.A</vendor><action>none</action><hash>5a8f64ecc4b7b68005da99c04eb4f808</hash></key>
<key><path>HKLM\SOFTWARE\CLASSES\CLSID\{CC99A798-FD3D-4AB4-969E-6071612524F9}</path><vendor>PUP.Optional.AppGraffiti.A</vendor><action>none</action><hash>5a8f64ecc4b7b68005da99c04eb4f808</hash></key>
<key><path>HKLM\SOFTWARE\CLASSES\TYPELIB\{DB02BC6B-B0F0-4074-99E6-884B70FCB6AE}</path><vendor>PUP.Optional.AppGraffiti.A</vendor><action>none</action><hash>5a8f64ecc4b7b68005da99c04eb4f808</hash></key>
<key><path>HKLM\SOFTWARE\CLASSES\INTERFACE\{022C9F90-2E96-47D6-A971-107650154563}</path><vendor>PUP.Optional.AppGraffiti.A</vendor><action>none</action><hash>5a8f64ecc4b7b68005da99c04eb4f808</hash></key>
<key><path>HKLM\SOFTWARE\CLASSES\AppGraffiti.AppGraffitiJS</path><vendor>PUP.Optional.AppGraffiti.A</vendor><action>none</action><hash>5a8f64ecc4b7b68005da99c04eb4f808</hash></key>
<key><path>HKU\S-1-5-21-395694341-3193286174-3367658890-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{CC99A798-FD3D-4AB4-969E-6071612524F9}</path><vendor>PUP.Optional.AppGraffiti.A</vendor><action>none</action><hash>5a8f64ecc4b7b68005da99c04eb4f808</hash></key>
<key><path>HKLM\SOFTWARE\CLASSES\CLSID\{6F6A5334-78E9-4D9B-8182-8B41EA8C39EF}\INPROCSERVER32</path><vendor>PUP.Optional.AppGraffiti.A</vendor><action>none</action><hash>5a8f64ecc4b7b68005da99c04eb4f808</hash></key>
<key><path>HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{6F6A5334-78E9-4D9B-8182-8B41EA8C39EF}</path><vendor>PUP.Optional.AppGraffiti.A</vendor><action>none</action><hash>5a8f64ecc4b7b68005da99c04eb4f808</hash></key>
<key><path>HKU\S-1-5-21-395694341-3193286174-3367658890-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\SETTINGS\{6F6A5334-78E9-4D9B-8182-8B41EA8C39EF}</path><vendor>PUP.Optional.AppGraffiti.A</vendor><action>none</action><hash>5a8f64ecc4b7b68005da99c04eb4f808</hash></key>
<key><path>HKU\S-1-5-21-395694341-3193286174-3367658890-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{6F6A5334-78E9-4D9B-8182-8B41EA8C39EF}</path><vendor>PUP.Optional.AppGraffiti.A</vendor><action>none</action><hash>5a8f64ecc4b7b68005da99c04eb4f808</hash></key>
<key><path>HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\PREAPPROVED\{6F6A5334-78E9-4D9B-8182-8B41EA8C39EF}</path><vendor>PUP.Optional.AppGraffiti.A</vendor><action>none</action><hash>5a8f64ecc4b7b68005da99c04eb4f808</hash></key>
<key><path>HKLM\SOFTWARE\CLASSES\CLSID\{865D7100-82C7-42F4-9C06-860DEC0871B2}</path><vendor>PUP.Optional.24x7</vendor><action>none</action><hash>7b6e232d52290a2c6f81be9c57ab8e72</hash></key>
<key><path>HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\PREAPPROVED\{CCB69577-088B-4004-9ED8-FF5BCC83A039}</path><vendor>PUP.Optional.RebateInformer.A</vendor><action>none</action><hash>ab3e74dc5f1c5adc17073d1f2bd7cb35</hash></key>
<key><path>HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\PREAPPROVED\{D7E97865-918F-41E4-9CD0-25AB1C574CE8}</path><vendor>PUP.Optional.InboxToolBar.A</vendor><action>none</action><hash>e0090d43700b41f521fbcb91e81a22de</hash></key>
<key><path>HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{6F6A5334-78E9-4D9B-8182-8B41EA8C39EF}_is1</path><vendor>PUP.Optional.AppGraffiti.A</vendor><action>none</action><hash>1bce63ed116a9c9a642aa8028f74d12f</hash></key>
<value><path>HKU\S-1-5-21-395694341-3193286174-3367658890-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\TOOLBAR\WEBBROWSER</path><valuename>{D7E97865-918F-41E4-9CD0-25AB1C574CE8}</valuename><vendor>PUP.Optional.InboxToolBar.A</vendor><action>none</action><valuedata>exé׏‘äAśĐ%«WLč</valuedata><hash>e0090d43700b41f521fbcb91e81a22de</hash></value>
<value><path>HKU\S-1-5-21-395694341-3193286174-3367658890-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\TOOLBAR\WEBBROWSER\{D7E97865-918F-41E4-9CD0-25AB1C574CE8}</path><valuename></valuename><vendor>PUP.Optional.InboxToolBar.A</vendor><action>none</action><valuedata></valuedata><hash>c2274c04fa81c0760e0e471520e210f0</hash></value>
<value><path>HKU\S-1-5-21-395694341-3193286174-3367658890-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN</path><valuename>AGupdate</valuename><vendor>PUP.Optional.AppGraffiti.A</vendor><action>none</action><valuedata>C:\Program Files\AppGraffiti\AGupdate.exe</valuedata><hash>1bce63ed116a9c9a642aa8028f74d12f</hash></value>
<data><path>HKU\S-1-5-21-395694341-3193286174-3367658890-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN</path><valuename>Start Page</valuename><vendor>Hijack.StartPage</vendor><action>none</action><valuedata>http://www.inbox.com/homepage.aspx?tbid ... ash></data>
<folder><path>C:\Program Files\AppGraffiti</path><vendor>PUP.Optional.AppGraffiti.A</vendor><action>none</action><hash>1bce63ed116a9c9a642aa8028f74d12f</hash></folder>
<folder><path>C:\Program Files\AppGraffiti\Update</path><vendor>PUP.Optional.AppGraffiti.A</vendor><action>none</action><hash>1bce63ed116a9c9a642aa8028f74d12f</hash></folder>
<folder><path>C:\Program Files\24x7Help</path><vendor>PUP.Optional.24x7</vendor><action>none</action><hash>9257361a493289addb865a53dc27dd23</hash></folder>
<folder><path>C:\Program Files\24x7Help\Update</path><vendor>PUP.Optional.24x7</vendor><action>none</action><hash>9257361a493289addb865a53dc27dd23</hash></folder>
<file><path>C:\Program Files\AppGraffiti\AppGraffiti.dll</path><vendor>PUP.Optional.AppGraffiti.A</vendor><action>none</action><hash>5a8f64ecc4b7b68005da99c04eb4f808</hash></file>
<file><path>C:\Program Files\24x7Help\24x7desk.dll</path><vendor>PUP.Optional.24x7</vendor><action>none</action><hash>7b6e232d52290a2c6f81be9c57ab8e72</hash></file>
<file><path>C:\Program Files\AppGraffiti\unins000.dat</path><vendor>PUP.Optional.AppGraffiti.A</vendor><action>none</action><hash>1bce63ed116a9c9a642aa8028f74d12f</hash></file>
<file><path>C:\Program Files\AppGraffiti\AGupdate.exe</path><vendor>PUP.Optional.AppGraffiti.A</vendor><action>none</action><hash>1bce63ed116a9c9a642aa8028f74d12f</hash></file>
<file><path>C:\Program Files\AppGraffiti\AppGraffiti.exe</path><vendor>PUP.Optional.AppGraffiti.A</vendor><action>none</action><hash>1bce63ed116a9c9a642aa8028f74d12f</hash></file>
<file><path>C:\Program Files\AppGraffiti\AppGraffiti._dll</path><vendor>PUP.Optional.AppGraffiti.A</vendor><action>none</action><hash>1bce63ed116a9c9a642aa8028f74d12f</hash></file>
<file><path>C:\Program Files\AppGraffiti\AppGraffiti._exe</path><vendor>PUP.Optional.AppGraffiti.A</vendor><action>none</action><hash>1bce63ed116a9c9a642aa8028f74d12f</hash></file>
<file><path>C:\Program Files\AppGraffiti\AppGraffiti64.dll</path><vendor>PUP.Optional.AppGraffiti.A</vendor><action>none</action><hash>1bce63ed116a9c9a642aa8028f74d12f</hash></file>
<file><path>C:\Program Files\AppGraffiti\config.dat</path><vendor>PUP.Optional.AppGraffiti.A</vendor><action>none</action><hash>1bce63ed116a9c9a642aa8028f74d12f</hash></file>
<file><path>C:\Program Files\AppGraffiti\unins000.exe</path><vendor>PUP.Optional.AppGraffiti.A</vendor><action>none</action><hash>1bce63ed116a9c9a642aa8028f74d12f</hash></file>
<file><path>C:\Program Files\24x7Help\unins000.dat</path><vendor>PUP.Optional.24x7</vendor><action>none</action><hash>9257361a493289addb865a53dc27dd23</hash></file>
<file><path>C:\Program Files\24x7Help\24x7desk.64.dll</path><vendor>PUP.Optional.24x7</vendor><action>none</action><hash>9257361a493289addb865a53dc27dd23</hash></file>
<file><path>C:\Program Files\24x7Help\App24x7Help.exe</path><vendor>PUP.Optional.24x7</vendor><action>none</action><hash>9257361a493289addb865a53dc27dd23</hash></file>
<file><path>C:\Program Files\24x7Help\App24x7Hook.dll</path><vendor>PUP.Optional.24x7</vendor><action>none</action><hash>9257361a493289addb865a53dc27dd23</hash></file>
<file><path>C:\Program Files\24x7Help\App24x7Hook.exe</path><vendor>PUP.Optional.24x7</vendor><action>none</action><hash>9257361a493289addb865a53dc27dd23</hash></file>
<file><path>C:\Program Files\24x7Help\App24x7Svc.exe</path><vendor>PUP.Optional.24x7</vendor><action>none</action><hash>9257361a493289addb865a53dc27dd23</hash></file>
<file><path>C:\Program Files\24x7Help\unins000.exe</path><vendor>PUP.Optional.24x7</vendor><action>none</action><hash>9257361a493289addb865a53dc27dd23</hash></file>
<file><path>C:\Program Files\24x7Help\unins000.msg</path><vendor>PUP.Optional.24x7</vendor><action>none</action><hash>9257361a493289addb865a53dc27dd23</hash></file>
</items>
</mbam-log>

[Roli]

Znovu spusť AdwCleaner ale tentokrát klikni na Clean,

proběhne restart PC kdy dojde ke smazání nepořádku.

Po té mi sem zase zkopíruj Report.

Mbam:
Log ulozit jako TXT neni mozne. APlikace spadne pri ukladani.
Vlozeni do schranky nefugnuje.
Histrorie - zobrazi prazdny log.

Nevadí i tak je vidět co našel, nech tedy vše smazat.


Stáhni a ulož na plochu ComboFix,

spusť aplikaci jako Administrátor a povol instalaci Konzole pro zotavení - Recovery Console.

Poté se zobrazí okno s licenčními podmínkami které potvrdíš kliknutím na ANO,

pak ještě jednou klik na ANO a už to jede.

Celá akce trvá okolo 10 minut ale může i déle, během skenu se nepokoušej spouštět nic jiného.

Při skenovaní může být PC i restartováno nelekat se.

Upozornění: po dobu skenu vypni rezidentní štít Antiviru a AntiSpy programu,

protože Combofix se pokouší napadené soubory smazat a tyto programy mu můžou bránit.

Po dokončení skenu nebo následném restartu aplikace vytvoří log, uložený na C:/Combofix.txt

(při opakovaném použití jsou logy číslovány Combofix2.txt atd.), jeho obsah zkopíruj sem.


V případě nejasností je ZDE obrázkový návod.

[KEnik]

Zdravím, tak jsem spustil vše.
Posílám logy.

Díky moc.

# AdwCleaner v3.208 - Report created 13/05/2014 at 19:13:22
# Updated 11/05/2014 by Xplode
# Operating System : Windows 7 Home Premium Service Pack 1 (32 bits)
# Username : PEPE - PEPE-PC
# Running from : C:\Users\PEPE\Downloads\adwcleaner.exe
# Option : Clean

***** [ Services ] *****


***** [ Files / Folders ] *****

Folder Deleted : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AppGraffiti
Folder Deleted : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SiteRanker
Folder Deleted : C:\Program Files\24x7Help
Folder Deleted : C:\Program Files\AppGraffiti
Folder Deleted : C:\Program Files\SiteRanker
Folder Deleted : C:\Users\PEPE\AppData\LocalLow\AppGraffiti
Folder Deleted : C:\Users\PEPE\AppData\LocalLow\SiteRanker
Folder Deleted : C:\Users\PEPE\AppData\Roaming\Mozilla\Firefox\Profiles\x8yg01ox.default\Extensions\AppGraffiti@AppGraffiti.com

***** [ Shortcuts ] *****


***** [ Registry ] *****

Value Deleted : HKLM\SOFTWARE\Mozilla\Firefox\Extensions [siteranker@siteranker.com]
Key Deleted : HKLM\SOFTWARE\Classes\AppGraffiti.AppGraffitiJS
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\App24x7Help_RASAPI32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\App24x7Help_RASMANCS
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{11BF46C6-B3DE-48BD-BF70-3AD85CAB80B5}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{6F6A5334-78E9-4D9B-8182-8B41EA8C39EF}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{865D7100-82C7-42F4-9C06-860DEC0871B2}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{BC9FD17D-30F6-4464-9E53-596A90AFF023}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{CC99A798-FD3D-4AB4-969E-6071612524F9}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{022C9F90-2E96-47D6-A971-107650154563}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{DB02BC6B-B0F0-4074-99E6-884B70FCB6AE}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{11BF46C6-B3DE-48BD-BF70-3AD85CAB80B5}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6F6A5334-78E9-4D9B-8182-8B41EA8C39EF}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{11BF46C6-B3DE-48BD-BF70-3AD85CAB80B5}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{6F6A5334-78E9-4D9B-8182-8B41EA8C39EF}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{8736C681-37A0-40C6-A0F0-4C083409151C}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{CC99A798-FD3D-4AB4-969E-6071612524F9}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{11BF46C6-B3DE-48BD-BF70-3AD85CAB80B5}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{6F6A5334-78E9-4D9B-8182-8B41EA8C39EF}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{6F6A5334-78E9-4D9B-8182-8B41EA8C39EF}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{CCB69577-088B-4004-9ED8-FF5BCC83A039}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{D3D233D5-9F6D-436C-B6C7-E63F77503B30}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{D7E97865-918F-41E4-9CD0-25AB1C574CE8}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{6F6A5334-78E9-4D9B-8182-8B41EA8C39EF}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{CCB69577-088B-4004-9ED8-FF5BCC83A039}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{D3D233D5-9F6D-436C-B6C7-E63F77503B30}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{D7E97865-918F-41E4-9CD0-25AB1C574CE8}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{11BF46C6-B3DE-48BD-BF70-3AD85CAB80B6}
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{C04B7D22-5AEC-4561-8F49-27F6269208F6}
Value Deleted : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{D7E97865-918F-41E4-9CD0-25AB1C574CE8}]
Value Deleted : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks [{D3D233D5-9F6D-436C-B6C7-E63F77503B30}]
Key Deleted : HKCU\Software\AppGraffiti
Key Deleted : HKCU\Software\SiteRanker
Key Deleted : HKCU\Software\wscontb
Key Deleted : HKLM\Software\AppGraffiti
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{11BF46C6-B3DE-48BD-BF70-3AD85CAB80B5}_is1
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{6F6A5334-78E9-4D9B-8182-8B41EA8C39EF}_is1

***** [ Browsers ] *****

-\\ Internet Explorer v11.0.9600.17041

Setting Restored : HKCU\Software\Microsoft\Internet Explorer\Main [Start Page]

-\\ Mozilla Firefox v29.0.1 (cs)

[ File : C:\Users\PEPE\AppData\Roaming\Mozilla\Firefox\Profiles\x8yg01ox.default\prefs.js ]


-\\ Google Chrome v

[ File : C:\Users\PEPE\AppData\Local\Google\Chrome\User Data\Default\preferences ]


*************************

AdwCleaner[R0].txt - [5077 octets] - [12/05/2014 22:46:44]
AdwCleaner[R1].txt - [5137 octets] - [13/05/2014 19:12:28]
AdwCleaner[S0].txt - [5088 octets] - [13/05/2014 19:13:22]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [5148 octets] ##########

<items>
<value><path>HKU\S-1-5-21-395694341-3193286174-3367658890-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN</path><valuename>AGupdate</valuename><vendor>PUP.Optional.AppGraffiti.A</vendor><action>success</action><valuedata>C:\Program Files\AppGraffiti\AGupdate.exe</valuedata><hash>ea05d779df9cc6706039812a9d6626da</hash></value>
</items>

ComboFix 14-05-13.01 - PEPE 13.05.2014 22:12:06.2.2 - x86
Microsoft Windows 7 Home Premium 6.1.7601.1.1250.420.1029.18.1791.975 [GMT 2:00]
Spuštěný z: c:\users\PEPE\Downloads\ComboFix.exe
AV: avast! Antivirus *Disabled/Updated* {17AD7D40-BA12-9C46-7131-94903A54AD8B}
SP: avast! Antivirus *Disabled/Updated* {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\PEPE\Favorites\Thumbs.db
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2014-04-13 do 2014-05-13 )))))))))))))))))))))))))))))))
.
.
2014-05-13 20:19 . 2014-05-13 20:19 -------- d-----w- c:\users\PEPE\AppData\Local\temp
2014-05-13 20:19 . 2014-05-13 20:19 -------- d-----w- c:\users\Public\AppData\Local\temp
2014-05-13 20:19 . 2014-05-13 20:19 -------- d-----w- c:\users\Default\AppData\Local\temp
2014-05-13 20:19 . 2014-05-13 20:19 -------- d-----w- c:\users\Administrator\AppData\Local\temp
2014-05-13 05:11 . 2014-05-13 05:11 -------- d-sh--w- c:\users\PEPE\AppData\Local\EmieUserList
2014-05-13 05:11 . 2014-05-13 05:11 -------- d-sh--w- c:\users\PEPE\AppData\Local\EmieSiteList
2014-05-12 22:01 . 2014-05-12 22:01 -------- d-----w- c:\users\PEPE\AppData\Roaming\AVAST Software
2014-05-12 21:24 . 2014-05-12 21:24 67776 ----a-w- c:\windows\system32\drivers\aswStm.sys
2014-05-12 21:24 . 2014-05-12 21:24 24184 ----a-w- c:\windows\system32\drivers\aswHwid.sys
2014-05-12 21:24 . 2014-05-12 21:24 43152 ----a-w- c:\windows\avastSS.scr
2014-05-12 21:05 . 2014-05-12 21:05 -------- d-----w- c:\program files\Malwarebytes Anti-Malware
2014-05-12 21:05 . 2014-04-03 07:51 51416 ----a-w- c:\windows\system32\drivers\mwac.sys
2014-05-12 21:05 . 2014-04-03 07:51 73432 ----a-w- c:\windows\system32\drivers\mbamchameleon.sys
2014-05-12 21:05 . 2014-04-03 07:50 23256 ----a-w- c:\windows\system32\drivers\mbam.sys
2014-05-12 21:02 . 2014-05-12 21:02 -------- d-----w- c:\users\PEPE\AppData\Local\Programs
2014-05-12 20:46 . 2014-05-13 17:13 -------- d-----w- C:\AdwCleaner
2014-05-08 01:00 . 2014-04-29 12:34 2724864 ----a-w- c:\windows\system32\mshtml.tlb
2014-05-07 01:00 . 2014-03-06 07:46 4254720 ----a-w- c:\windows\system32\jscript9.dll
2014-04-30 20:21 . 2014-05-04 07:42 -------- d-----w- c:\program files\Mozilla Thunderbird
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2014-05-13 20:02 . 2012-11-23 15:33 107736 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2014-05-12 21:24 . 2013-07-08 15:58 180632 ----a-w- c:\windows\system32\drivers\aswVmm.sys
2014-05-12 21:24 . 2013-07-08 15:58 49944 ----a-w- c:\windows\system32\drivers\aswRvrt.sys
2014-05-12 21:24 . 2012-10-08 19:16 411552 ----a-w- c:\windows\system32\drivers\aswSP.sys
2014-05-12 21:24 . 2012-10-08 19:16 776976 ----a-w- c:\windows\system32\drivers\aswSnx.sys
2014-05-12 21:24 . 2012-10-08 19:16 67824 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys
2014-05-12 21:24 . 2012-10-08 19:16 81768 ----a-w- c:\windows\system32\drivers\aswRdr2.sys
2014-05-12 21:24 . 2012-10-08 19:16 271264 ----a-w- c:\windows\system32\aswBoot.exe
2014-04-18 17:22 . 2012-11-23 20:13 86888 ----a-w- c:\windows\system32\LMIRfsClientNP.dll
2014-04-18 17:22 . 2012-11-23 20:13 85832 ----a-w- c:\windows\system32\LMIinit.dll
2014-04-10 17:22 . 2012-11-23 20:13 86888 ----a-w- c:\windows\system32\LMIRfsClientNP.dll.000.bak
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2014-05-12 21:24 260976 ----a-w- c:\program files\AVAST Software\Avast\ashShell.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\1aCopyShExtError]
@="{83BEA36E-7680-4598-A4DF-994426F6E78D}"
[HKEY_CLASSES_ROOT\CLSID\{83BEA36E-7680-4598-A4DF-994426F6E78D}]
2014-02-07 13:07 3111936 ----a-w- c:\users\PEPE\AppData\Roaming\Copy\overlay\CopyShExt.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\2aCopyShExtSynced]
@="{845B7388-6F85-4F32-9FD5-F02DC7882B89}"
[HKEY_CLASSES_ROOT\CLSID\{845B7388-6F85-4F32-9FD5-F02DC7882B89}]
2014-02-07 13:07 3111936 ----a-w- c:\users\PEPE\AppData\Roaming\Copy\overlay\CopyShExt.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\3aCopyShExtSyncing]
@="{F6378A7A-F753-449B-AE1B-997A96132E61}"
[HKEY_CLASSES_ROOT\CLSID\{F6378A7A-F753-449B-AE1B-997A96132E61}]
2014-02-07 13:07 3111936 ----a-w- c:\users\PEPE\AppData\Roaming\Copy\overlay\CopyShExt.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\4aCopyShExtSyncingProg1]
@="{3A511828-777D-46F8-82F4-5B530C1B3D9E}"
[HKEY_CLASSES_ROOT\CLSID\{3A511828-777D-46F8-82F4-5B530C1B3D9E}]
2014-02-07 13:07 3111936 ----a-w- c:\users\PEPE\AppData\Roaming\Copy\overlay\CopyShExt.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\5aCopyShExtSyncingProg2]
@="{C8C88204-5B14-40EC-BA72-8AEBC762047E}"
[HKEY_CLASSES_ROOT\CLSID\{C8C88204-5B14-40EC-BA72-8AEBC762047E}]
2014-02-07 13:07 3111936 ----a-w- c:\users\PEPE\AppData\Roaming\Copy\overlay\CopyShExt.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\6aCopyShExtSyncingProg3]
@="{ACFF45C3-3EEB-4351-86C2-6696BA264239}"
[HKEY_CLASSES_ROOT\CLSID\{ACFF45C3-3EEB-4351-86C2-6696BA264239}]
2014-02-07 13:07 3111936 ----a-w- c:\users\PEPE\AppData\Roaming\Copy\overlay\CopyShExt.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\7aCopyShExtSyncingProg4]
@="{29AF997F-488B-46F0-AE78-7146F1B89CC3}"
[HKEY_CLASSES_ROOT\CLSID\{29AF997F-488B-46F0-AE78-7146F1B89CC3}]
2014-02-07 13:07 3111936 ----a-w- c:\users\PEPE\AppData\Roaming\Copy\overlay\CopyShExt.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\8aCopyShExtSyncingProg5]
@="{03F9AD29-1C78-4B66-8890-B177B5430C53}"
[HKEY_CLASSES_ROOT\CLSID\{03F9AD29-1C78-4B66-8890-B177B5430C53}]
2014-02-07 13:07 3111936 ----a-w- c:\users\PEPE\AppData\Roaming\Copy\overlay\CopyShExt.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2013-09-11 02:09 131248 ----a-w- c:\users\PEPE\AppData\Roaming\Dropbox\bin\DropboxExt.22.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2013-09-11 02:09 131248 ----a-w- c:\users\PEPE\AppData\Roaming\Dropbox\bin\DropboxExt.22.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2013-09-11 02:09 131248 ----a-w- c:\users\PEPE\AppData\Roaming\Dropbox\bin\DropboxExt.22.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]
@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
2013-09-11 02:09 131248 ----a-w- c:\users\PEPE\AppData\Roaming\Dropbox\bin\DropboxExt.22.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Copy"="c:\users\PEPE\AppData\Roaming\Copy\CopyAgent.exe" [2014-04-16 13475984]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AMD AVT"="start AMD Accelerated Video Transcoding device initialization" [X]
"LogMeIn GUI"="c:\program files\LogMeIn\x86\LogMeInSystray.exe" [2012-10-10 63048]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2013-04-29 642304]
"AvastUI.exe"="c:\program files\AVAST Software\Avast\AvastUI.exe" [2014-05-12 3873704]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"Copy"="c:\users\PEPE\AppData\Roaming\Copy\CopyAgent.exe" [2014-04-16 13475984]
.
c:\users\PEPE\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Dropbox.lnk - c:\users\PEPE\AppData\Roaming\Dropbox\bin\Dropbox.exe /systemstartup [2014-1-3 30714328]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKLM\~\startupfolder\C:^Users^PEPE^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OpenOffice.org 3.2.lnk]
path=c:\users\PEPE\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.2.lnk
backup=c:\windows\pss\OpenOffice.org 3.2.lnk.Startup
backupExtension=.Startup
.
R2 aswStm;aswStm;c:\windows\system32\drivers\aswStm.sys [2014-05-12 67776]
R2 MBAMService;MBAMService;c:\program files\Malwarebytes Anti-Malware\mbamservice.exe [2014-04-03 857912]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe [2014-03-06 108032]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2014-04-03 23256]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 52224]
R3 VBoxNetAdp;VirtualBox Host-Only Ethernet Adapter;c:\windows\system32\DRIVERS\VBoxNetAdp.sys [2012-09-13 104280]
R3 VBoxNetFlt;VirtualBox Bridged Networking Service;c:\windows\system32\DRIVERS\VBoxNetFlt.sys [x]
R3 WatAdminSvc;Služba Technologie aktivace Windows;c:\windows\system32\Wat\WatAdminSvc.exe [2011-03-30 1343400]
S0 aswRvrt;avast! Revert; [x]
S0 aswVmm;avast! VM Monitor; [x]
S1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys [2014-05-12 776976]
S1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [2014-05-12 411552]
S1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys [2012-09-03 242240]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2013-04-30 217088]
S2 AMD FUEL Service;AMD FUEL Service;c:\program files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [2013-04-29 291840]
S2 AODDriver4.1;AODDriver4.1;c:\program files\ATI Technologies\ATI.ACE\Fuel\i386\AODDriver2.sys [2012-03-05 45184]
S2 aswHwid;avast! HardwareID;c:\windows\system32\drivers\aswHwid.sys [2014-05-12 24184]
S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [2014-05-12 67824]
S2 LMIGuardianSvc;LMIGuardianSvc;c:\program files\LogMeIn\x86\LMIGuardianSvc.exe [2014-04-18 375120]
S2 LMIInfo;LogMeIn Kernel Information Provider;c:\program files\LogMeIn\x86\RaInfo.sys [2013-06-04 13624]
S2 SSPORT;SSPORT;c:\windows\system32\Drivers\SSPORT.sys [2009-07-12 5120]
S2 TeamViewer7;TeamViewer 7;c:\program files\TeamViewer\Version7\TeamViewer_Service.exe [2012-08-31 2754984]
S3 amdiox86;AMD IO Driver;c:\windows\system32\DRIVERS\amdiox86.sys [2010-02-18 37944]
S3 AtiHDAudioService;AMD Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW73.sys [2012-05-14 86656]
S3 RTL8167;Ovladač Realtek 8167 NT;c:\windows\system32\DRIVERS\Rt86win7.sys [2009-07-13 139776]
.
.
--- Ostatní služby/ovladače v paměti ---
.
*Deregistered* - MBAMWebAccessControl
.
Obsah adresáře 'Naplánované úlohy'
.
2014-05-13 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-08-12 11:23]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.google.com
uDefault_Search_URL = hxxp://www.google.com/ie
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.1.20
TCP: Interfaces\{5C2CA544-63AE-4DA3-BB13-6C3D08385B2E}: NameServer = 77.48.100.254,194.228.41.113
FF - ProfilePath - c:\users\PEPE\AppData\Roaming\Mozilla\Firefox\Profiles\x8yg01ox.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: network.proxy.type - 0
.
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil32_11_9_900_117_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil32_11_9_900_117_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Celkový čas: 2014-05-13 22:22:29
ComboFix-quarantined-files.txt 2014-05-13 20:22
ComboFix2.txt 2013-07-30 09:18
.
Před spuštěním: Volných bajtů: 142 896 152 576
Po spuštění: Volných bajtů: 142 880 944 128
.
- - End Of File - - 8E84D70712ADB30DC7F1DD42FF5D3150
A36C5E4F47E84449FF07ED3517B43A31

[Roli]

Pokud jsi tak ještě neučinil, přesuň Combofix na plochu

otevři si Poznámkový blok

do něj zkopíruj skript z následujícího okna:

Kód: Vybrat vše

RegLock:: 
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]

ulož Tebou vytvořený TXT soubor jako CFScript.txt na plochu,

po uložení uchop vytvořený skript levým myšítkem a přesuň ho nad ikonu Combofixu, kde ho upustíš:



Po aplikaci na Tebe vypadne další log, zkopíruj ho sem

Upozornění : může se stát, že po aplikaci skriptu a restartu Windows nenaběhnou,

v tom případě znovu restartuj a přitom mačkej F8 poté zvol Poslední známou funkční konfiguraci

[KEnik]

Zdravím,
PC obcas plne vytíží wmpnetwk.exe.mui
Stava se take ze PC nemuze na net ani an ping seznam.cz ( DNS 8.8.8.8, 8.8.4.4) cca na 30s
Chvilku to trvalo než jsem se k PC dostal.
Prikladam log diky.

ComboFix 14-05-13.01 - PEPE 19.05.2014 17:28:28.3.2 - x86
Microsoft Windows 7 Home Premium 6.1.7601.1.1250.420.1029.18.1791.1067 [GMT 2:00]
Spuštěný z: c:\users\PEPE\Desktop\ComboFix.exe
Použité ovládací přepínače :: c:\users\PEPE\Desktop\CFScript.txt
AV: avast! Antivirus *Disabled/Updated* {17AD7D40-BA12-9C46-7131-94903A54AD8B}
SP: avast! Antivirus *Disabled/Updated* {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* Vytvořen nový Bod Obnovení
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2014-04-19 do 2014-05-19 )))))))))))))))))))))))))))))))
.
.
2014-05-19 15:35 . 2014-05-19 15:35 -------- d-----w- c:\users\Public\AppData\Local\temp
2014-05-19 15:35 . 2014-05-19 15:35 -------- d-----w- c:\users\Default\AppData\Local\temp
2014-05-19 15:35 . 2014-05-19 15:35 -------- d-----w- c:\users\Administrator\AppData\Local\temp
2014-05-15 10:00 . 2014-05-15 10:00 -------- d-----w- c:\users\PEPE\AppData\Roaming\DropboxMaster
2014-05-15 01:00 . 2014-05-06 03:07 2724864 ----a-w- c:\windows\system32\mshtml.tlb
2014-05-13 20:22 . 2014-05-19 15:35 -------- d-----w- c:\users\PEPE\AppData\Local\temp
2014-05-13 05:11 . 2014-05-13 05:11 -------- d-sh--w- c:\users\PEPE\AppData\Local\EmieUserList
2014-05-13 05:11 . 2014-05-13 05:11 -------- d-sh--w- c:\users\PEPE\AppData\Local\EmieSiteList
2014-05-12 22:01 . 2014-05-12 22:01 -------- d-----w- c:\users\PEPE\AppData\Roaming\AVAST Software
2014-05-12 21:24 . 2014-05-15 09:24 68312 ----a-w- c:\windows\system32\drivers\aswstm.sys
2014-05-12 21:24 . 2014-05-12 21:24 24184 ----a-w- c:\windows\system32\drivers\aswHwid.sys
2014-05-12 21:24 . 2014-05-12 21:24 43152 ----a-w- c:\windows\avastSS.scr
2014-05-12 21:05 . 2014-05-12 21:05 -------- d-----w- c:\program files\Malwarebytes Anti-Malware
2014-05-12 21:05 . 2014-04-03 07:51 51416 ----a-w- c:\windows\system32\drivers\mwac.sys
2014-05-12 21:05 . 2014-04-03 07:51 73432 ----a-w- c:\windows\system32\drivers\mbamchameleon.sys
2014-05-12 21:05 . 2014-04-03 07:50 23256 ----a-w- c:\windows\system32\drivers\mbam.sys
2014-05-12 21:02 . 2014-05-12 21:02 -------- d-----w- c:\users\PEPE\AppData\Local\Programs
2014-05-12 20:46 . 2014-05-13 17:13 -------- d-----w- C:\AdwCleaner
2014-05-07 01:00 . 2014-03-06 07:46 4254720 ----a-w- c:\windows\system32\jscript9.dll
2014-04-30 20:21 . 2014-05-04 07:42 -------- d-----w- c:\program files\Mozilla Thunderbird
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2014-05-16 16:12 . 2012-11-23 15:33 107736 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2014-05-15 09:24 . 2012-10-08 19:16 777488 ----a-w- c:\windows\system32\drivers\aswsnx.sys
2014-05-15 09:24 . 2012-10-08 19:16 411680 ----a-w- c:\windows\system32\drivers\aswsp.sys
2014-05-12 21:24 . 2013-07-08 15:58 180632 ----a-w- c:\windows\system32\drivers\aswVmm.sys
2014-05-12 21:24 . 2013-07-08 15:58 49944 ----a-w- c:\windows\system32\drivers\aswRvrt.sys
2014-05-12 21:24 . 2012-10-08 19:16 411552 ----a-w- c:\windows\system32\drivers\aswsp.sys.1400145887468
2014-05-12 21:24 . 2012-10-08 19:16 776976 ----a-w- c:\windows\system32\drivers\aswsnx.sys.1400145887468
2014-05-12 21:24 . 2012-10-08 19:16 67824 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys
2014-05-12 21:24 . 2012-10-08 19:16 81768 ----a-w- c:\windows\system32\drivers\aswRdr2.sys
2014-05-12 21:24 . 2012-10-08 19:16 271264 ----a-w- c:\windows\system32\aswBoot.exe
2014-04-18 17:22 . 2012-11-23 20:13 86888 ----a-w- c:\windows\system32\LMIRfsClientNP.dll
2014-04-18 17:22 . 2012-11-23 20:13 85832 ----a-w- c:\windows\system32\LMIinit.dll
2014-04-10 17:22 . 2012-11-23 20:13 86888 ----a-w- c:\windows\system32\LMIRfsClientNP.dll.000.bak
2014-03-04 09:17 . 2014-05-14 02:25 247808 ----a-w- c:\windows\system32\schannel.dll
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2014-05-12 21:24 260976 ----a-w- c:\program files\AVAST Software\Avast\ashShell.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\1aCopyShExtError]
@="{83BEA36E-7680-4598-A4DF-994426F6E78D}"
[HKEY_CLASSES_ROOT\CLSID\{83BEA36E-7680-4598-A4DF-994426F6E78D}]
2014-02-07 13:07 3111936 ----a-w- c:\users\PEPE\AppData\Roaming\Copy\overlay\CopyShExt.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\2aCopyShExtSynced]
@="{845B7388-6F85-4F32-9FD5-F02DC7882B89}"
[HKEY_CLASSES_ROOT\CLSID\{845B7388-6F85-4F32-9FD5-F02DC7882B89}]
2014-02-07 13:07 3111936 ----a-w- c:\users\PEPE\AppData\Roaming\Copy\overlay\CopyShExt.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\3aCopyShExtSyncing]
@="{F6378A7A-F753-449B-AE1B-997A96132E61}"
[HKEY_CLASSES_ROOT\CLSID\{F6378A7A-F753-449B-AE1B-997A96132E61}]
2014-02-07 13:07 3111936 ----a-w- c:\users\PEPE\AppData\Roaming\Copy\overlay\CopyShExt.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\4aCopyShExtSyncingProg1]
@="{3A511828-777D-46F8-82F4-5B530C1B3D9E}"
[HKEY_CLASSES_ROOT\CLSID\{3A511828-777D-46F8-82F4-5B530C1B3D9E}]
2014-02-07 13:07 3111936 ----a-w- c:\users\PEPE\AppData\Roaming\Copy\overlay\CopyShExt.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\5aCopyShExtSyncingProg2]
@="{C8C88204-5B14-40EC-BA72-8AEBC762047E}"
[HKEY_CLASSES_ROOT\CLSID\{C8C88204-5B14-40EC-BA72-8AEBC762047E}]
2014-02-07 13:07 3111936 ----a-w- c:\users\PEPE\AppData\Roaming\Copy\overlay\CopyShExt.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\6aCopyShExtSyncingProg3]
@="{ACFF45C3-3EEB-4351-86C2-6696BA264239}"
[HKEY_CLASSES_ROOT\CLSID\{ACFF45C3-3EEB-4351-86C2-6696BA264239}]
2014-02-07 13:07 3111936 ----a-w- c:\users\PEPE\AppData\Roaming\Copy\overlay\CopyShExt.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\7aCopyShExtSyncingProg4]
@="{29AF997F-488B-46F0-AE78-7146F1B89CC3}"
[HKEY_CLASSES_ROOT\CLSID\{29AF997F-488B-46F0-AE78-7146F1B89CC3}]
2014-02-07 13:07 3111936 ----a-w- c:\users\PEPE\AppData\Roaming\Copy\overlay\CopyShExt.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\8aCopyShExtSyncingProg5]
@="{03F9AD29-1C78-4B66-8890-B177B5430C53}"
[HKEY_CLASSES_ROOT\CLSID\{03F9AD29-1C78-4B66-8890-B177B5430C53}]
2014-02-07 13:07 3111936 ----a-w- c:\users\PEPE\AppData\Roaming\Copy\overlay\CopyShExt.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2013-09-11 02:09 131248 ----a-w- c:\users\PEPE\AppData\Roaming\Dropbox\bin\DropboxExt.22.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2013-09-11 02:09 131248 ----a-w- c:\users\PEPE\AppData\Roaming\Dropbox\bin\DropboxExt.22.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2013-09-11 02:09 131248 ----a-w- c:\users\PEPE\AppData\Roaming\Dropbox\bin\DropboxExt.22.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]
@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
2013-09-11 02:09 131248 ----a-w- c:\users\PEPE\AppData\Roaming\Dropbox\bin\DropboxExt.22.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Copy"="c:\users\PEPE\AppData\Roaming\Copy\CopyAgent.exe" [2014-04-16 13475984]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AMD AVT"="start AMD Accelerated Video Transcoding device initialization" [X]
"LogMeIn GUI"="c:\program files\LogMeIn\x86\LogMeInSystray.exe" [2012-10-10 63048]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2013-04-29 642304]
"AvastUI.exe"="c:\program files\AVAST Software\Avast\AvastUI.exe" [2014-05-12 3873704]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"Copy"="c:\users\PEPE\AppData\Roaming\Copy\CopyAgent.exe" [2014-04-16 13475984]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKLM\~\startupfolder\C:^Users^PEPE^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OpenOffice.org 3.2.lnk]
path=c:\users\PEPE\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.2.lnk
backup=c:\windows\pss\OpenOffice.org 3.2.lnk.Startup
backupExtension=.Startup
.
R2 MBAMService;MBAMService;c:\program files\Malwarebytes Anti-Malware\mbamservice.exe [2014-04-03 857912]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe [2014-03-06 108032]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 52224]
R3 VBoxNetAdp;VirtualBox Host-Only Ethernet Adapter;c:\windows\system32\DRIVERS\VBoxNetAdp.sys [2012-09-13 104280]
R3 VBoxNetFlt;VirtualBox Bridged Networking Service;c:\windows\system32\DRIVERS\VBoxNetFlt.sys [x]
R3 WatAdminSvc;Služba Technologie aktivace Windows;c:\windows\system32\Wat\WatAdminSvc.exe [2011-03-30 1343400]
S0 aswRvrt;avast! Revert; [x]
S0 aswVmm;avast! VM Monitor; [x]
S1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys [2014-05-15 777488]
S1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [2014-05-15 411680]
S1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys [2012-09-03 242240]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2013-04-30 217088]
S2 AMD FUEL Service;AMD FUEL Service;c:\program files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [2013-04-29 291840]
S2 AODDriver4.1;AODDriver4.1;c:\program files\ATI Technologies\ATI.ACE\Fuel\i386\AODDriver2.sys [2012-03-05 45184]
S2 aswHwid;avast! HardwareID;c:\windows\system32\drivers\aswHwid.sys [2014-05-12 24184]
S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [2014-05-12 67824]
S2 aswStm;aswStm;c:\windows\system32\drivers\aswStm.sys [2014-05-15 68312]
S2 LMIGuardianSvc;LMIGuardianSvc;c:\program files\LogMeIn\x86\LMIGuardianSvc.exe [2014-04-18 375120]
S2 LMIInfo;LogMeIn Kernel Information Provider;c:\program files\LogMeIn\x86\RaInfo.sys [2013-06-04 13624]
S2 SSPORT;SSPORT;c:\windows\system32\Drivers\SSPORT.sys [2009-07-12 5120]
S2 TeamViewer7;TeamViewer 7;c:\program files\TeamViewer\Version7\TeamViewer_Service.exe [2012-08-31 2754984]
S3 amdiox86;AMD IO Driver;c:\windows\system32\DRIVERS\amdiox86.sys [2010-02-18 37944]
S3 AtiHDAudioService;AMD Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW73.sys [2012-05-14 86656]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2014-04-03 23256]
S3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\MBAMSwissArmy.sys [2014-05-16 107736]
S3 MBAMWebAccessControl;MBAMWebAccessControl;c:\windows\system32\drivers\mwac.sys [2014-04-03 51416]
S3 RTL8167;Ovladač Realtek 8167 NT;c:\windows\system32\DRIVERS\Rt86win7.sys [2009-07-13 139776]
.
.
--- Ostatní služby/ovladače v paměti ---
.
*NewlyCreated* - MBAMSWISSARMY
*NewlyCreated* - MBAMWEBACCESSCONTROL
.
Obsah adresáře 'Naplánované úlohy'
.
2014-05-19 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-08-12 11:23]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.google.com
uDefault_Search_URL = hxxp://www.google.com/ie
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.1.20
TCP: Interfaces\{5C2CA544-63AE-4DA3-BB13-6C3D08385B2E}: NameServer = 8.8.8.8,8.8.4.4
FF - ProfilePath - c:\users\PEPE\AppData\Roaming\Mozilla\Firefox\Profiles\x8yg01ox.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: network.proxy.type - 0
.
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil32_11_9_900_117_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil32_11_9_900_117_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
Celkový čas: 2014-05-19 17:38:11
ComboFix-quarantined-files.txt 2014-05-19 15:38
ComboFix2.txt 2014-05-13 20:22
ComboFix3.txt 2013-07-30 09:18
.
Před spuštěním: Volných bajtů: 136 557 723 648
Po spuštění: Volných bajtů: 143 735 975 936
.
- - End Of File - - 595E79EDBEAB3927A6D077BB573B2539
A36C5E4F47E84449FF07ED3517B43A31

[Roli]

Zdravím,
PC obcas plne vytíží wmpnetwk.exe.mui

Ahoj

Přes Start >> Všechny programy >> Příslušenství >> Spustit >> napiš - services.msc >> Enter. Najdi službu :

Služba Windows Media Player Network Sharing

dvojklikem se otevře karta kde nejprve službu zastav tlačítkem Zastavit u položky Typ spouštění vyber Zakázáno a klik na OK.


Přes Start >> Spustit zkopíruj do okna:

ComboFix /Uninstall

a stiskni Enter

To odinstaluje ComboFix a smaže s ním související soubory a složky.


Použij T-Cleaner, který smaže případné zbytky po aplikacích které jsme použili.

Jen před jeho stažením a při použití stopni antivir, protože ho muže detekovat jako vir ale není tomu tak.


Pak dej vědět jaký je stav PC.