VIRY.CZ

Dobrý den,

prosim o kontrolu, mam tam malware

Logfile of random's system information tool 1.10 (written by random/random)
Run by Vojtak at 2015-05-28 22:18:22
Microsoft Windows 7 Professional Service Pack 1
System drive C: has 18 GB (10%) free of 177 GB
Total RAM: 4094 MB (50% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 22:18:28, on 28.5.2015
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v11.0 (11.00.9600.17801)
Boot mode: Normal

Running processes:
C:\Users\Vojtak\AppData\Roaming\uTorrent\uTorrent.exe
C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\acrotray.exe
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
C:\Program Files (x86)\iTunes\iTunesHelper.exe
C:\Program Files\TortoiseGit\bin\pageant.exe
C:\Program Files (x86)\Skype\Phone\Skype.exe
C:\Program Files (x86)\Windows Media Player\wmplayer.exe
C:\totalcmd\TOTALCMD.EXE
C:\ProgramData\87737dd0-ad90-4193-bd48-336966b8d777\plugins\3\plugin.exe
C:\Program Files (x86)\Mozilla Firefox\firefox.exe
C:\Users\Vojtak\AppData\Local\TNT2\2.0.0.1983\TNT2User.exe
C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe
C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_17_0_0_169.exe
C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_17_0_0_169.exe
C:\Program Files\trend micro\Vojtak.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://services.eshield.com/general/new ... D6BB2C}&i=
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://services.eshield.com/general/new ... D6BB2C}&i=
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/p/?LinkId=255141
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/p/?LinkId=255141
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F2 - REG:system.ini: UserInit=userinit.exe
O2 - BHO: ContributeBHO Class - {074C1DC5-9320-4A9A-947D-C042949C6216} - C:\Program Files (x86)\Adobe\/Adobe Contribute CS4/contributeieplugin.dll
O2 - BHO: MSS+ Identifier - {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} - C:\Program Files\McAfee Security Scan\3.8.150\McAfeeMSS_IE.dll
O2 - BHO: Record Page - {2335267c-dbba-4dd5-a9d0-c4db8e6a75a4} - C:\Program Files (x86)\Record Page\Extensions\2335267c-dbba-4dd5-a9d0-c4db8e6a75a4.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll
O2 - BHO: SmartSelect - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O3 - Toolbar: Contribute Toolbar - {517BDDE4-E3A7-4570-B21E-2B52B6139FC7} - C:\Program Files (x86)\Adobe\/Adobe Contribute CS4/contributeieplugin.dll
O3 - Toolbar: eShield - {B1261B83-C283-4F44-8D82-2594974CD988} - C:\Program Files (x86)\TNT2\2.0.0.1983\ietoolbar.dll
O4 - HKLM\..\Run: [AdobeCS4ServiceManager] "C:\Program Files (x86)\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" -launchedbylogin
O4 - HKLM\..\Run: [Adobe Acrobat Speed Launcher] "C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe"
O4 - HKLM\..\Run: [Acrobat Assistant 8.0] "C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe"
O4 - HKLM\..\Run: [Adobe_ID0ENQBO] C:\PROGRA~2\COMMON~1\Adobe\ADOBEV~1\Server\bin\VERSIO~2.EXE
O4 - HKLM\..\Run: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKCU\..\Run: [Facebook Update] "C:\Users\Vojtak\AppData\Local\Facebook\Update\FacebookUpdate.exe" /c /nocrashserver
O4 - HKCU\..\Run: [Google Update] "C:\Users\Vojtak\AppData\Local\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe" -autorun
O4 - HKCU\..\Run: [Monotype SkyFonts System Extension] C:\Program Files\Monotype\SkyFonts\SkyFonts.exe
O4 - HKCU\..\Run: [uTorrent] "C:\Users\Vojtak\AppData\Roaming\uTorrent\uTorrent.exe" /MINIMIZED
O4 - HKCU\..\Run: [Skype] "C:\Program Files (x86)\Skype\Phone\Skype.exe" /minimized /regrun
O4 - HKCU\..\Run: [Monotype SkyFonts Rack Up] C:\Program Files\Monotype\SkyFonts\SFC.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O4 - Global Startup: McAfee Security Scan Plus.lnk = C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Převést cíl vazby do Adobe PDF - res://C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Převést do Adobe PDF - res://C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Připojit cíl vazby k existujícímu PDF - res://C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Připojit k existujícímu PDF - res://C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
O9 - Extra button: Odeslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Od&eslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~1\Office12\REFIEBAR.DLL
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveSystemServices.dll
O23 - Service: Adobe Version Cue CS4 - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\Adobe Version Cue CS4\Server\bin\VersionCueCS4.exe
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: Apache2.4 - Apache Software Foundation - C:\xampp\apache\bin\httpd.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: Ati External Event Utility - Unknown owner - C:\Windows\system32\Ati2evxx.exe (file missing)
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: FLEXnet Licensing Service 64 - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe
O23 - Service: HP LaserJet Professional M1210 MFP Series Receive Fax Service (HPM1210RcvFaxSrvc) - HP - C:\Program Files\HP\HP LaserJet M1210 MFP Series\ReceiveFaxUtility.exe
O23 - Service: HP SI Service (HPSIService) - Unknown owner - C:\Windows\system32\HPSIsvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\ieetwcollectorres.dll,-1000 (IEEtwCollectorService) - Unknown owner - C:\Windows\system32\IEEtwCollector.exe (file missing)
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: McAfee Security Scan Component Host Service (McComponentHostService) - McAfee, Inc. - C:\Program Files\McAfee Security Scan\3.8.150\McCHSvc.exe
O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: mysql - Unknown owner - C:\xampp\mysql\bin\mysqld.exe
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Service Mgr RecordPage - Unknown owner - C:\ProgramData\87737dd0-ad90-4193-bd48-336966b8d777\plugincontainer.exe
O23 - Service: SkyFontsService - Monotype Inc. - C:\Program Files\Monotype\SkyFonts\Monotype.SkyFonts.Service.exe
O23 - Service: Skype Updater (SkypeUpdate) - Skype Technologies - C:\Program Files (x86)\Skype\Updater\Updater.exe
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: Update Mgr RecordPage - Unknown owner - C:\Program Files (x86)\Common Files\87737dd0-ad90-4193-bd48-336966b8d777\updater.exe
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--
End of file - 13085 bytes

======Listing Processes======



\SystemRoot\System32\smss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
wininit.exe
winlogon.exe
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k RPCSS
"C:\Program Files\Microsoft Security Client\MsMpEng.exe"
C:\Windows\system32\Ati2evxx.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k netsvcs

Ati2evxx.exe -Client
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
"C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe"
"C:\xampp\apache\bin\httpd.exe" -k runservice
"C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe"
"C:\Program Files\Bonjour\mDNSResponder.exe"
"C:\Program Files\HP\HP LaserJet M1210 MFP Series\ReceiveFaxUtility.exe"
C:\Windows\system32\HPSIsvc.exe
C:\xampp\mysql\bin\mysqld.exe --defaults-file=c:\xampp\mysql\bin\my.ini mysql
C:\xampp\apache\bin\httpd.exe -d C:/xampp/apache
"taskhost.exe"
"C:\Windows\system32\Dwm.exe"
C:\Windows\Explorer.EXE
"C:\Program Files\Microsoft Security Client\msseces.exe" -hide -runkey
"C:\Program Files\Hewlett-Packard\PrnStatusMX\PrnStatusMX.exe"
"C:\Program Files\TortoiseSVN\bin\TSVNCache.exe"
"C:\Users\Vojtak\AppData\Roaming\uTorrent\uTorrent.exe" /MINIMIZED
C:\Windows\system32\svchost.exe -k imgsvc
"C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe"
"C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\acrotray.exe"
"C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
"C:\Program Files (x86)\iTunes\iTunesHelper.exe"
"C:\Program Files\Monotype\SkyFonts\Monotype.SkyFonts.Service.exe"
"C:\Program Files\iPod\bin\iPodService.exe"
C:\Windows\system32\SearchIndexer.exe /Embedding
C:\Windows\system32\svchost.exe -k bthsvcs
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
"C:\Windows\system32\wuauclt.exe"
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
"C:\Program Files\TortoiseGit\bin\pageant.exe" "C:\dev\prog\keys\privatekey.ppk" -c "C:\Program Files\TortoiseGit\bin\tgittouch.exe" "C:\Users\Vojtak\AppData\Local\Temp\TortoiseGit\Pat8B53.tmp"
"C:\Program Files\Microsoft Security Client\NisSrv.exe"
"C:\Program Files (x86)\Skype\Phone\Skype.exe"
"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /Enqueue -Embedding
"C:\totalcmd\TOTALCMD.EXE"
"C:\Program Files\TortoiseGit\bin\TGitCache.exe"
"C:\ProgramData\87737dd0-ad90-4193-bd48-336966b8d777\plugincontainer.exe"
"C:\Program Files (x86)\Common Files\87737dd0-ad90-4193-bd48-336966b8d777\updater.exe"
"C:\ProgramData\87737dd0-ad90-4193-bd48-336966b8d777\plugins\3\plugin.exe" u
"C:\ProgramData\87737dd0-ad90-4193-bd48-336966b8d777\plugins\3\plugin.exe"
"C:\ProgramData\87737dd0-ad90-4193-bd48-336966b8d777\plugins\2\plugin.exe" u
"C:\ProgramData\87737dd0-ad90-4193-bd48-336966b8d777\plugins\5\plugin.exe" u
"C:\Program Files (x86)\Mozilla Firefox\firefox.exe"
"C:\Users\Vojtak\AppData\Local\TNT2\2.0.0.1983\TNT2User.exe" -Embedding
"C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe" --channel="8040.2.152216203\1104914119" "C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_17_0_0_169.dll" -greomni "C:\Program Files (x86)\Mozilla Firefox\omni.ja" -appomni "C:\Program Files (x86)\Mozilla Firefox\browser\omni.ja" -appdir "C:\Program Files (x86)\Mozilla Firefox\browser" E7CF176E110C211B 8040 "\\.\pipe\gecko-crash-server-pipe.8040" plugin
"C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_17_0_0_169.exe" --proxy-stub-channel=Flash5632.67304398.26440 --host-broker-channel=Flash5632.67304398.24348 --host-pid=5632 --host-npapi-version=28 --plugin-path="C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_17_0_0_169.dll"
"C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_17_0_0_169.exe" --channel=5848.0032F8B0.1423592884 --proxy-stub-channel=Flash5632.67304398.26440 --plugin-path="C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_17_0_0_169.dll" --host-npapi-version=28 --type=renderer
"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe126_ Global\UsGthrCtrlFltPipeMssGthrPipe126 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
"C:\Windows\system32\SearchFilterHost.exe" 0 508 512 520 65536 516
"C:\Users\Vojtak\Downloads\RSITx64.exe"
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}

======Scheduled tasks folder======

C:\Windows\tasks\Adobe Flash Player Updater.job - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-3643688232-1350400347-446279456-1000Core.job - C:\Users\Vojtak\AppData\Local\Facebook\Update\FacebookUpdate.exe /c /nocrashserver
C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-3643688232-1350400347-446279456-1000UA.job - C:\Users\Vojtak\AppData\Local\Facebook\Update\FacebookUpdate.exe /ua /installsource scheduler
C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-3643688232-1350400347-446279456-1000Core.job - C:\Users\Vojtak\AppData\Local\Google\Update\GoogleUpdate.exe /c
C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-3643688232-1350400347-446279456-1000UA.job - C:\Users\Vojtak\AppData\Local\Google\Update\GoogleUpdate.exe /ua /installsource scheduler

=========Mozilla firefox=========

ProfilePath - C:\Users\Vojtak\AppData\Roaming\Mozilla\Firefox\Profiles\h5g1m7l7.default

prefs.js - "browser.search.useDBForOrder" - true
prefs.js - "keyword.URL" - "http://search.eshield.com/serp?guid={A0 ... D6BB2C}&k="

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 17.0.0.169 Plugin
"Path"=C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_17_0_0_169.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@Apple.com/iTunes,version=]
"Description"=iTunes Detector Plug-in
"Path"=

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@Apple.com/iTunes,version=1.0]
"Description"=
"Path"=C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@java.com/DTPlugin,version=10.45.2]
"Description"=Java™ Deployment Toolkit
"Path"=C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@java.com/JavaPlugin,version=10.45.2]
"Description"=Oracle® Next Generation Java™ Plug-In
"Path"=C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@microsoft.com/GENUINE]
"Description"=
"Path"=disabled

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0]
"Description"=Ag Player Plugin
"Path"=c:\Program Files (x86)\Microsoft Silverlight\5.1.40416.0\npctrl.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\Adobe Reader]
"Description"=Handles PDFs in-place in Firefox
"Path"=C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll


[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 17.0.0.169 Plugin
"Path"=C:\Windows\system32\Macromed\Flash\NPSWF64_17_0_0_169.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@java.com/DTPlugin,version=10.45.2]
"Description"=Java™ Deployment Toolkit
"Path"=C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@java.com/JavaPlugin,version=10.45.2]
"Description"=Oracle® Next Generation Java™ Plug-In
"Path"=C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/GENUINE]
"Description"=
"Path"=disabled

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0]
"Description"=Ag Player Plugin
"Path"=c:\Program Files\Microsoft Silverlight\5.1.40416.0\npctrl.dll


C:\Program Files (x86)\Mozilla Firefox\components\
nsIQTScriptablePlugin.xpt
nsIWDPlugin821.xpt

C:\Program Files (x86)\Mozilla Firefox\plugins\
np-mswmp.dll
NPOFF12.DLL
nppdf32.dll
npqtplugin.dll
npqtplugin2.dll
npqtplugin3.dll
npqtplugin4.dll
npqtplugin5.dll
npwdplugin821.dll
QuickTimePlugin.class
WMP Firefox Plugin License.rtf
WMP Firefox Plugin RelNotes.txt

C:\Users\Vojtak\AppData\Roaming\Mozilla\Firefox\Profiles\h5g1m7l7.default\searchplugins\
eshield-safe-web.xml
yahoo.xml

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
Java(tm) Plug-In SSV Helper - C:\Program Files\Java\jre7\bin\ssv.dll [2013-11-22 553384]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre7\bin\jp2ssv.dll [2013-11-22 210856]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{074C1DC5-9320-4A9A-947D-C042949C6216}]
ContributeBHO Class - C:\Program Files (x86)\Adobe\/Adobe Contribute CS4/contributeieplugin.dll [2008-09-10 136560]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0E8A89AD-95D7-40EB-8D9D-083EF7066A01}]
MSS+ Identifier - C:\Program Files\McAfee Security Scan\3.8.150\McAfeeMSS_IE.dll [2014-04-09 96128]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2335267c-dbba-4dd5-a9d0-c4db8e6a75a4}]
Record Page - C:\Program Files (x86)\Record Page\Extensions\2335267c-dbba-4dd5-a9d0-c4db8e6a75a4.dll [2015-05-28 145648]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}]
Groove GFS Browser Helper - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-26 2217832]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
Java(tm) Plug-In SSV Helper - C:\Program Files (x86)\Java\jre7\bin\ssv.dll [2013-10-08 462760]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE7CD045-E861-484f-8273-0445EE161910}]
Adobe PDF Conversion Toolbar Helper - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll [2008-06-11 345480]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll [2013-10-08 171944]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F4971EE7-DAA0-4053-9964-665D8EE6A077}]
SmartSelect Class - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll [2008-06-11 345480]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{B1261B83-C283-4F44-8D82-2594974CD988} - eShield - C:\Program Files (x86)\TNT2\2.0.0.1983\IEToolbar64.dll [2015-05-28 200400]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Internet Explorer\Toolbar]
{47833539-D0C5-4125-9FA8-0819E2EAAC93} - Adobe PDF - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll [2008-06-11 345480]
{517BDDE4-E3A7-4570-B21E-2B52B6139FC7} - Contribute Toolbar - C:\Program Files (x86)\Adobe\/Adobe Contribute CS4/contributeieplugin.dll [2008-09-10 136560]
{B1261B83-C283-4F44-8D82-2594974CD988} - eShield - C:\Program Files (x86)\TNT2\2.0.0.1983\ietoolbar.dll [2015-05-28 144592]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"MSC"=c:\Program Files\Microsoft Security Client\msseces.exe [2015-04-30 1337000]
"PrnStatusMX"=C:\Program Files\Hewlett-Packard\PrnStatusMX\PrnStatusMX.exe [2007-08-29 1238528]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Facebook Update"=C:\Users\Vojtak\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-07-12 138096]
"Google Update"=C:\Users\Vojtak\AppData\Local\Google\Update\GoogleUpdate.exe [2014-10-19 107912]
"DAEMON Tools Lite"=C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe [2012-04-11 3672384]
"AdobeBridge"= []
"Monotype SkyFonts System Extension"=C:\Program Files\Monotype\SkyFonts\SkyFonts.exe [2015-04-22 1152816]
"uTorrent"=C:\Users\Vojtak\AppData\Roaming\uTorrent\uTorrent.exe [2015-05-06 1694560]
"Skype"=C:\Program Files (x86)\Skype\Phone\Skype.exe [2015-04-17 31283328]
"Monotype SkyFonts Rack Up"=C:\Program Files\Monotype\SkyFonts\SFC.exe [2015-04-22 19760]

[HKEY_LOCAL_MACHINE\Software\wow6432node\Microsoft\Windows\CurrentVersion\Run]
"AdobeCS4ServiceManager"=C:\Program Files (x86)\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe [2008-08-14 611712]
"Adobe Acrobat Speed Launcher"=C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe [2008-06-12 37232]
""= []
"Acrobat Assistant 8.0"=C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe [2008-06-11 640376]
"Adobe_ID0ENQBO"=C:\PROGRA~2\COMMON~1\Adobe\ADOBEV~1\Server\bin\VERSIO~2.EXE [2008-08-15 378224]
"APSDaemon"=C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [2014-10-11 60712]
"GrooveMonitor"=C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe [2009-02-26 30040]
"SunJavaUpdateSched"=C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [2013-07-02 254336]
"iTunesHelper"=C:\Program Files (x86)\iTunes\iTunesHelper.exe [2014-10-15 157480]
"QuickTime Task"=C:\Program Files (x86)\QuickTime\QTTask.exe [2014-10-02 421888]
"Adobe ARM"=C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2014-12-19 1022152]

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
McAfee Security Scan Plus.lnk - C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-26 2217832]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\MsMpSvc]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=0
"ConsentPromptBehaviorUser"=3
"EnableLUA"=0
"EnableUIADesktopToggle"=0
"PromptOnSecureDesktop"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoActiveDesktop"=1
"NoActiveDesktopChanges"=1
"ForceActiveDesktopOn"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.msadpcm"=msadp32.acm
"midimapper"=midimap.dll
"wavemapper"=msacm32.drv
"VIDC.UYVY"=msyuv.dll
"VIDC.YUY2"=msyuv.dll
"VIDC.YVYU"=msyuv.dll
"VIDC.IYUV"=iyuv_32.dll
"vidc.i420"=iyuv_32.dll
"VIDC.YVU9"=tsbyuv.dll
"msacm.l3acm"=C:\Windows\System32\l3codeca.acm
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv
"MSVideo8"=VfWWDM32.dll

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*

======List of files/folders created in the last 1 month======

2015-05-28 22:18:22 ----D---- C:\rsit
2015-05-28 18:42:18 ----D---- C:\Users\Vojtak\AppData\Roaming\Opera Software
2015-05-28 18:41:13 ----D---- C:\Program Files (x86)\Opera
2015-05-28 18:40:49 ----D---- C:\ProgramData\87737dd0-ad90-4193-bd48-336966b8d777
2015-05-28 18:40:47 ----D---- C:\Program Files (x86)\Record Page
2015-05-28 18:40:28 ----D---- C:\Program Files (x86)\TNT2
2015-05-20 11:11:20 ----D---- C:\Program Files (x86)\Mozilla Thunderbird
2015-05-15 21:53:26 ----D---- C:\Program Files (x86)\Google
2015-05-15 08:50:23 ----D---- C:\Program Files (x86)\Mozilla Firefox
2015-05-13 22:48:05 ----A---- C:\Windows\SYSWOW64\PresentationCFFRasterizerNative_v0300.dll
2015-05-13 22:48:05 ----A---- C:\Windows\system32\PresentationCFFRasterizerNative_v0300.dll
2015-05-13 08:21:20 ----A---- C:\Windows\SYSWOW64\schannel.dll
2015-05-13 08:21:20 ----A---- C:\Windows\system32\schannel.dll
2015-05-13 08:21:20 ----A---- C:\Windows\system32\msv1_0.dll
2015-05-13 08:21:20 ----A---- C:\Windows\system32\lsasrv.dll
2015-05-13 08:21:20 ----A---- C:\Windows\system32\certcli.dll
2015-05-13 08:21:19 ----A---- C:\Windows\SYSWOW64\msv1_0.dll
2015-05-13 08:21:19 ----A---- C:\Windows\SYSWOW64\kerberos.dll
2015-05-13 08:21:19 ----A---- C:\Windows\SYSWOW64\certcli.dll
2015-05-13 08:21:19 ----A---- C:\Windows\system32\kerberos.dll
2015-05-13 08:21:18 ----A---- C:\Windows\SYSWOW64\wdigest.dll
2015-05-13 08:21:18 ----A---- C:\Windows\SYSWOW64\ncrypt.dll
2015-05-13 08:21:18 ----A---- C:\Windows\system32\wdigest.dll
2015-05-13 08:21:18 ----A---- C:\Windows\system32\TSpkg.dll
2015-05-13 08:21:18 ----A---- C:\Windows\system32\sspicli.dll
2015-05-13 08:21:18 ----A---- C:\Windows\system32\ncrypt.dll
2015-05-13 08:21:18 ----A---- C:\Windows\system32\drivers\ksecpkg.sys
2015-05-13 08:21:18 ----A---- C:\Windows\system32\drivers\ksecdd.sys
2015-05-13 08:21:17 ----A---- C:\Windows\SYSWOW64\TSpkg.dll
2015-05-13 08:21:17 ----A---- C:\Windows\SYSWOW64\sspicli.dll
2015-05-13 08:21:17 ----A---- C:\Windows\SYSWOW64\secur32.dll
2015-05-13 08:21:17 ----A---- C:\Windows\SYSWOW64\credssp.dll
2015-05-13 08:21:17 ----A---- C:\Windows\SYSWOW64\auditpol.exe
2015-05-13 08:21:17 ----A---- C:\Windows\system32\sspisrv.dll
2015-05-13 08:21:17 ----A---- C:\Windows\system32\secur32.dll
2015-05-13 08:21:17 ----A---- C:\Windows\system32\lsass.exe
2015-05-13 08:21:17 ----A---- C:\Windows\system32\credssp.dll
2015-05-13 08:21:17 ----A---- C:\Windows\system32\auditpol.exe
2015-05-13 08:21:16 ----A---- C:\Windows\SYSWOW64\msaudite.dll
2015-05-13 08:21:16 ----A---- C:\Windows\SYSWOW64\adtschema.dll
2015-05-13 08:21:16 ----A---- C:\Windows\system32\msaudite.dll
2015-05-13 08:21:16 ----A---- C:\Windows\system32\adtschema.dll
2015-05-13 08:21:15 ----A---- C:\Windows\SYSWOW64\msobjs.dll
2015-05-13 08:21:15 ----A---- C:\Windows\system32\msobjs.dll
2015-05-13 08:21:03 ----A---- C:\Windows\SYSWOW64\mshtmled.dll
2015-05-13 08:21:03 ----A---- C:\Windows\SYSWOW64\iernonce.dll
2015-05-13 08:21:03 ----A---- C:\Windows\SYSWOW64\ieetwproxystub.dll
2015-05-13 08:21:03 ----A---- C:\Windows\system32\ieetwproxystub.dll
2015-05-13 08:21:03 ----A---- C:\Windows\system32\ieetwcollector.exe
2015-05-13 08:21:02 ----A---- C:\Windows\SYSWOW64\MshtmlDac.dll
2015-05-13 08:21:01 ----A---- C:\Windows\SYSWOW64\vbscript.dll
2015-05-13 08:21:01 ----A---- C:\Windows\SYSWOW64\urlmon.dll
2015-05-13 08:21:01 ----A---- C:\Windows\SYSWOW64\msfeeds.dll
2015-05-13 08:21:01 ----A---- C:\Windows\SYSWOW64\JavaScriptCollectionAgent.dll
2015-05-13 08:21:01 ----A---- C:\Windows\SYSWOW64\iedkcs32.dll
2015-05-13 08:21:01 ----A---- C:\Windows\SYSWOW64\dxtrans.dll
2015-05-13 08:21:01 ----A---- C:\Windows\system32\JavaScriptCollectionAgent.dll
2015-05-13 08:21:01 ----A---- C:\Windows\system32\iernonce.dll
2015-05-13 08:21:01 ----A---- C:\Windows\system32\ie4uinit.exe
2015-05-13 08:21:00 ----A---- C:\Windows\SYSWOW64\mshtml.dll
2015-05-13 08:20:59 ----A---- C:\Windows\SYSWOW64\iesetup.dll
2015-05-13 08:20:59 ----A---- C:\Windows\SYSWOW64\ieapfltr.dll
2015-05-13 08:20:58 ----A---- C:\Windows\system32\urlmon.dll
2015-05-13 08:20:58 ----A---- C:\Windows\system32\iedkcs32.dll
2015-05-13 08:20:57 ----A---- C:\Windows\SYSWOW64\jsproxy.dll
2015-05-13 08:20:57 ----A---- C:\Windows\SYSWOW64\jscript9diag.dll
2015-05-13 08:20:57 ----A---- C:\Windows\SYSWOW64\jscript.dll
2015-05-13 08:20:57 ----A---- C:\Windows\SYSWOW64\ieUnatt.exe
2015-05-13 08:20:57 ----A---- C:\Windows\SYSWOW64\iertutil.dll
2015-05-13 08:20:57 ----A---- C:\Windows\system32\ieetwcollectorres.dll
2015-05-13 08:20:56 ----A---- C:\Windows\SYSWOW64\ieui.dll
2015-05-13 08:20:56 ----A---- C:\Windows\SYSWOW64\dxtmsft.dll
2015-05-13 08:20:56 ----A---- C:\Windows\system32\MsSpellCheckingFacility.exe
2015-05-13 08:20:56 ----A---- C:\Windows\system32\dxtrans.dll
2015-05-13 08:20:55 ----A---- C:\Windows\SYSWOW64\ieframe.dll
2015-05-13 08:20:55 ----A---- C:\Windows\system32\msfeeds.dll
2015-05-13 08:20:54 ----A---- C:\Windows\system32\iesetup.dll
2015-05-13 08:20:54 ----A---- C:\Windows\system32\ieapfltr.dll
2015-05-13 08:20:53 ----A---- C:\Windows\system32\iertutil.dll
2015-05-13 08:20:52 ----A---- C:\Windows\SYSWOW64\mshtmlmedia.dll
2015-05-13 08:20:52 ----A---- C:\Windows\SYSWOW64\jscript9.dll
2015-05-13 08:20:52 ----A---- C:\Windows\system32\vbscript.dll
2015-05-13 08:20:51 ----A---- C:\Windows\SYSWOW64\wininet.dll
2015-05-13 08:20:51 ----A---- C:\Windows\system32\jsproxy.dll
2015-05-13 08:20:51 ----A---- C:\Windows\system32\ieUnatt.exe
2015-05-13 08:20:49 ----A---- C:\Windows\SYSWOW64\msrating.dll
2015-05-13 08:20:48 ----A---- C:\Windows\system32\ieui.dll
2015-05-13 08:20:48 ----A---- C:\Windows\system32\ieframe.dll
2015-05-13 08:20:48 ----A---- C:\Windows\system32\dxtmsft.dll
2015-05-13 08:20:47 ----A---- C:\Windows\system32\mshtmlmedia.dll
2015-05-13 08:20:47 ----A---- C:\Windows\system32\mshtmled.dll
2015-05-13 08:20:47 ----A---- C:\Windows\system32\jscript.dll
2015-05-13 08:20:46 ----A---- C:\Windows\system32\wininet.dll
2015-05-13 08:20:46 ----A---- C:\Windows\system32\jscript9diag.dll
2015-05-13 08:20:46 ----A---- C:\Windows\system32\jscript9.dll
2015-05-13 08:20:45 ----A---- C:\Windows\system32\msrating.dll
2015-05-13 08:20:45 ----A---- C:\Windows\system32\MshtmlDac.dll
2015-05-13 08:20:44 ----A---- C:\Windows\system32\mshtml.dll
2015-05-13 08:19:56 ----A---- C:\Windows\system32\services.exe
2015-05-13 08:19:55 ----A---- C:\Windows\system32\FntCache.dll
2015-05-13 08:19:55 ----A---- C:\Windows\system32\DWrite.dll
2015-05-13 08:19:54 ----A---- C:\Windows\SYSWOW64\DWrite.dll
2015-05-13 08:19:54 ----A---- C:\Windows\system32\win32k.sys
2015-05-13 08:19:47 ----A---- C:\Windows\SYSWOW64\InkEd.dll
2015-05-13 08:19:47 ----A---- C:\Windows\system32\InkEd.dll
2015-05-13 08:19:45 ----A---- C:\Windows\system32\jnwmon.dll
2015-05-13 08:19:14 ----A---- C:\Windows\SYSWOW64\poqexec.exe
2015-05-13 08:19:14 ----A---- C:\Windows\system32\poqexec.exe

======List of files/folders modified in the last 1 month======

2015-05-28 22:18:28 ----D---- C:\Windows\Prefetch
2015-05-28 22:18:25 ----D---- C:\Program Files\trend micro
2015-05-28 22:15:16 ----D---- C:\Users\Vojtak\AppData\Roaming\uTorrent
2015-05-28 22:14:14 ----D---- C:\Users\Vojtak\AppData\Roaming\Skype
2015-05-28 21:08:34 ----D---- C:\Windows\Temp
2015-05-28 20:09:23 ----HD---- C:\ProgramData
2015-05-28 19:36:09 ----D---- C:\Windows\system32\config
2015-05-28 18:44:30 ----D---- C:\Program Files (x86)\The KMPlayer
2015-05-28 18:43:12 ----D---- C:\Windows\system32\GroupPolicy
2015-05-28 18:42:09 ----D---- C:\Windows\system32\Tasks
2015-05-28 18:41:13 ----RD---- C:\Program Files (x86)
2015-05-28 18:40:52 ----D---- C:\Program Files (x86)\Common Files
2015-05-28 18:39:27 ----D---- C:\Windows\Resources
2015-05-27 16:43:01 ----SHD---- C:\System Volume Information
2015-05-26 08:06:43 ----D---- C:\Windows\System32
2015-05-26 08:06:43 ----D---- C:\Windows\inf
2015-05-26 08:06:43 ----A---- C:\Windows\system32\PerfStringBackup.INI
2015-05-25 11:05:08 ----RHD---- C:\Users\Vojtak\AppData\Roaming\Monotype
2015-05-24 15:19:38 ----SHD---- C:\Windows\Installer
2015-05-24 15:19:38 ----D---- C:\ProgramData\Skype
2015-05-24 15:14:44 ----D---- C:\Program Files (x86)\Mozilla Maintenance Service
2015-05-16 00:21:18 ----D---- C:\Windows\Minidump
2015-05-16 00:21:09 ----D---- C:\Windows
2015-05-15 21:53:38 ----D---- C:\Windows\Tasks
2015-05-14 21:20:22 ----D---- C:\Windows\rescache
2015-05-14 17:26:09 ----D---- C:\Windows\SysWOW64
2015-05-14 12:27:12 ----RSD---- C:\Windows\assembly
2015-05-14 12:27:12 ----D---- C:\Windows\Microsoft.NET
2015-05-14 08:08:47 ----D---- C:\Windows\winsxs
2015-05-14 08:04:34 ----D---- C:\Windows\SYSWOW64\cs-CZ
2015-05-14 08:04:32 ----D---- C:\Windows\system32\cs-CZ
2015-05-14 08:04:29 ----D---- C:\Windows\system32\drivers
2015-05-14 08:04:28 ----D---- C:\Program Files\Internet Explorer
2015-05-14 08:04:26 ----D---- C:\Windows\SYSWOW64\en-US
2015-05-14 08:04:21 ----D---- C:\Windows\system32\en-US
2015-05-14 08:04:16 ----D---- C:\Program Files (x86)\Internet Explorer
2015-05-14 08:04:11 ----D---- C:\Program Files\Windows Journal
2015-05-13 23:05:21 ----D---- C:\Windows\system32\catroot
2015-05-13 22:53:36 ----D---- C:\Program Files\Microsoft Security Client
2015-05-13 22:53:35 ----D---- C:\Program Files (x86)\Microsoft Security Client
2015-05-13 22:52:53 ----D---- C:\ProgramData\Microsoft Help
2015-05-13 22:50:10 ----D---- C:\Windows\system32\catroot2
2015-05-13 22:46:46 ----D---- C:\Program Files\Microsoft Silverlight
2015-05-13 22:46:46 ----D---- C:\Program Files (x86)\Microsoft Silverlight
2015-05-05 15:24:53 ----D---- C:\Users\Vojtak\AppData\Roaming\Composer

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 MpFilter;Microsoft Malware Protection Driver; C:\Windows\system32\DRIVERS\MpFilter.sys [2015-03-04 280376]
R0 PxHlpa64;PxHlpa64; C:\Windows\System32\Drivers\PxHlpa64.sys [2008-02-06 54480]
R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2010-11-21 213888]
R1 CSC;@%systemroot%\system32\cscsvc.dll,-202; C:\Windows\system32\drivers\csc.sys [2010-11-21 514560]
R1 dtsoftbus01;DAEMON Tools Virtual Bus Driver; C:\Windows\system32\DRIVERS\dtsoftbus01.sys [2012-05-27 283200]
R2 adfs;adfs; C:\Windows\system32\drivers\adfs.sys [2008-06-27 88632]
R2 NisDrv;Microsoft Network Inspection System; C:\Windows\system32\DRIVERS\NisDrvWFP.sys [2015-03-04 124568]
R2 npf;NetGroup Packet Filter Driver; C:\Windows\system32\drivers\npf.sys [2010-01-27 47632]
R3 BthEnum;Ovladač pro Bluetooth Request Block; C:\Windows\system32\drivers\BthEnum.sys [2009-07-14 41984]
R3 BthPan;Zařízení Bluetooth (síť PAN); C:\Windows\system32\DRIVERS\bthpan.sys [2009-07-14 118784]
R3 BTHUSB;Ovladač rozhraní USB radiostanice Bluetooth; C:\Windows\System32\Drivers\BTHUSB.sys [2011-04-28 80384]
R3 GEARAspiWDM;GEAR ASPI Filter Driver; C:\Windows\system32\DRIVERS\GEARAspiWDM.sys [2012-08-21 33240]
R3 netw5v64;Intel(R) Wireless WiFi Link 5000 Series – ovladač adaptéru pro 64bitový systém Windows Vista; C:\Windows\system32\DRIVERS\netw5v64.sys [2009-06-10 5434368]
R3 R300;R300; C:\Windows\system32\DRIVERS\atikmdag.sys [2009-01-14 5082624]
R3 R5U870FLamd64;R5U870 UVC Lower Filter ; C:\Windows\System32\Drivers\R5U870FLamd64.sys [2008-01-30 78336]
R3 R5U870FUamd64;R5U870 UVC Upper Filter ; C:\Windows\System32\Drivers\R5U870FUamd64.sys [2008-01-30 45696]
R3 RFCOMM;Zařízení Bluetooth (RFCOMM protokol TDI); C:\Windows\system32\DRIVERS\rfcomm.sys [2009-07-14 158720]
R3 RTL8167;Ovladač Realtek 8167 NT; C:\Windows\system32\DRIVERS\Rt64win7.sys [2009-06-10 187392]
R3 SFEP;Sony Firmware Extension Parser; C:\Windows\system32\DRIVERS\SFEP.sys [2007-08-03 11392]
R3 SrvHsfHDA;SrvHsfHDA; C:\Windows\system32\DRIVERS\VSTAZL6.SYS [2009-06-10 292864]
R3 SrvHsfV92;SrvHsfV92; C:\Windows\system32\DRIVERS\VSTDPV6.SYS [2009-06-10 1485312]
R3 SrvHsfWinac;SrvHsfWinac; C:\Windows\system32\DRIVERS\VSTCNXT6.SYS [2009-06-10 740864]
S3 BTHPORT;Ovladač portu Bluetooth; C:\Windows\System32\Drivers\BTHport.sys [2011-04-28 552960]
S3 dmvsc;dmvsc; C:\Windows\system32\drivers\dmvsc.sys [2010-11-21 71168]
S3 HP1210FAX;HP1210MFP FAX; C:\Windows\System32\Drivers\HPM1210FAX.sys [2012-11-08 16896]
S3 mvusbews;USB EWS Device; C:\Windows\System32\Drivers\mvusbews.sys [2012-11-08 19968]
S3 pciide;pciide; C:\Windows\system32\drivers\pciide.sys [2009-07-14 12352]
S3 RDPDR;Terminal Server Device Redirector Driver; C:\Windows\System32\drivers\rdpdr.sys [2010-11-21 165888]
S3 s3cap;s3cap; C:\Windows\system32\drivers\vms3cap.sys [2010-11-21 6656]
S3 storvsc;storvsc; C:\Windows\system32\drivers\storvsc.sys [2010-11-21 34688]
S3 TsUsbFlt;TsUsbFlt; C:\Windows\system32\drivers\tsusbflt.sys [2010-11-21 59392]
S3 TsUsbGD;Remote Desktop Generic USB Device; C:\Windows\system32\drivers\TsUsbGD.sys [2010-11-21 31232]
S3 USBAAPL64;Apple Mobile USB Driver; C:\Windows\System32\Drivers\usbaapl64.sys [2014-08-16 54784]
S3 usbscan;Ovladač skeneru USB; C:\Windows\system32\DRIVERS\usbscan.sys [2013-07-03 42496]
S3 vmbus;vmbus; C:\Windows\system32\drivers\vmbus.sys [2010-11-21 199552]
S3 VMBusHID;VMBusHID; C:\Windows\system32\drivers\VMBusHID.sys [2010-11-21 21760]
S3 WinUsb;WinUsb; C:\Windows\system32\DRIVERS\WinUsb.sys [2010-11-21 41984]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AdobeARMservice;Adobe Acrobat Update Service; C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2014-12-19 81088]
R2 Apache2.4;Apache2.4; C:\xampp\apache\bin\httpd.exe [2014-03-16 22016]
R2 Apple Mobile Device;Apple Mobile Device; C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [2014-10-07 60744]
R2 Ati External Event Utility;Ati External Event Utility; C:\Windows\system32\Ati2evxx.exe [2009-01-14 944128]
R2 Bonjour Service;Bonjour Service; C:\Program Files\Bonjour\mDNSResponder.exe [2011-08-31 462184]
R2 CscService;@%systemroot%\system32\cscsvc.dll,-200; C:\Windows\System32\svchost.exe [2009-07-14 27136]
R2 HPM1210RcvFaxSrvc;HP LaserJet Professional M1210 MFP Series Receive Fax Service; C:\Program Files\HP\HP LaserJet M1210 MFP Series\ReceiveFaxUtility.exe [2012-07-25 361888]
R2 HPSIService;HP SI Service; C:\Windows\system32\HPSIsvc.exe [2012-11-08 126856]
R2 MsMpSvc;Microsoft Antimalware Service; C:\Program Files\Microsoft Security Client\MsMpEng.exe [2015-04-30 23816]
R2 mysql;mysql; C:\xampp\mysql\bin\mysqld.exe [2014-01-14 10966528]
R2 Service Mgr RecordPage;Service Mgr RecordPage; C:\ProgramData\87737dd0-ad90-4193-bd48-336966b8d777\plugincontainer.exe [2015-05-28 556296]
R2 SkyFontsService;SkyFontsService; C:\Program Files\Monotype\SkyFonts\Monotype.SkyFonts.Service.exe [2015-04-22 36144]
R2 Update Mgr RecordPage;Update Mgr RecordPage; C:\Program Files (x86)\Common Files\87737dd0-ad90-4193-bd48-336966b8d777\updater.exe [2015-05-28 478984]
R3 iPod Service;iPod Service; C:\Program Files\iPod\bin\iPodService.exe [2014-10-15 643880]
R3 NisSrv;@c:\Program Files\Microsoft Security Client\MpAsDesc.dll,-243; C:\Program Files\Microsoft Security Client\NisSrv.exe [2015-04-30 366544]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
S2 Net Driver HPZ12;Net Driver HPZ12; C:\Windows\System32\svchost.exe [2009-07-14 27136]
S2 Pml Driver HPZ12;Pml Driver HPZ12; C:\Windows\System32\svchost.exe [2009-07-14 27136]
S2 SkypeUpdate;Skype Updater; C:\Program Files (x86)\Skype\Updater\Updater.exe [2015-02-18 315488]
S3 Adobe Version Cue CS4;Adobe Version Cue CS4; C:\Program Files (x86)\Common Files\Adobe\Adobe Version Cue CS4\Server\bin\VersionCueCS4.exe [2008-08-15 284016]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service; C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-04-15 268464]
S3 AppMgmt;@appmgmts.dll,-3250; C:\Windows\system32\svchost.exe [2009-07-14 27136]
S3 aspnet_state;Stavová služba ASP.NET; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe [2010-03-18 44376]
S3 FLEXnet Licensing Service 64;FLEXnet Licensing Service 64; C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe [2011-08-23 1038088]
S3 FLEXnet Licensing Service;FLEXnet Licensing Service; C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe [2011-08-23 655624]
S3 IEEtwCollectorService;@%SystemRoot%\system32\ieetwcollectorres.dll,-1000; C:\Windows\system32\IEEtwCollector.exe [2015-04-21 114688]
S3 McComponentHostService;McAfee Security Scan Component Host Service; C:\Program Files\McAfee Security Scan\3.8.150\McCHSvc.exe [2014-04-09 289256]
S3 Microsoft Office Groove Audit Service;Microsoft Office Groove Audit Service; C:\Program Files (x86)\Microsoft Office\Office12\GrooveAuditService.exe [2009-02-26 64856]
S3 MozillaMaintenance;Mozilla Maintenance Service; C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2015-05-15 148080]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2011-07-20 440696]
S3 ose;Office Source Engine; C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 PeerDistSvc;@%SystemRoot%\system32\peerdistsvc.dll,-9000; C:\Windows\System32\svchost.exe [2009-07-14 27136]
S3 StorSvc;@%SystemRoot%\System32\StorSvc.dll,-100; C:\Windows\System32\svchost.exe [2009-07-14 27136]
S3 UmRdpService;@%SystemRoot%\system32\umrdp.dll,-1000; C:\Windows\System32\svchost.exe [2009-07-14 27136]
S3 WatAdminSvc;@%SystemRoot%\system32\Wat\WatUX.exe,-601; C:\Windows\system32\Wat\WatAdminSvc.exe [2012-06-26 1255736]
S4 NetMsmqActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8195; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2010-03-18 124240]
S4 NetPipeActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8197; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2010-03-18 124240]
S4 NetTcpActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8199; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2010-03-18 124240]

-----------------EOF-----------------

ahoj,
odinstaluj McAfee a vycisti PC s MBAM

Hotovo. problémy s malwarem ale přetrvávají.

mohol si vlozit log co nasiel
vycisti PC s ADWCleanerom - log vloz
popis blizsie problemy

Problémy nastali po aktualizace KMPlayeru, který natáhl do pc nějaké svinstvo. Při otevření nového okna v prohlížeči se mi vnucuje nějaký search.eshield a a vyskočí 4 reklamní bannery skoro přes celou zobrazovací plochu. Navíc samovolně vyskakují nové okna s reklamou.

po vyšištění pomocí AdwCleaner je vyhledávaš eshield pryč, ale reklamní bannery stále divoce vyskakujou.

# AdwCleaner v4.205 - Log vytvořen 30/05/2015 v 08:32:19
# Aktualizováno 21/05/2015 by Xplode
# Databáze : 2015-05-25.3 [Server]
# Operační system : Windows 7 Professional Service Pack 1 (x64)
# Uživatelské jméno : Vojtak - VOJTAK-PC
# Spuštěno z : C:\Users\Vojtak\Downloads\adwcleaner_4.205.exe
# Nastavení : Sken

***** [ Služby ] *****


***** [ Soubory / Složky ] *****

Soubor Nalezeno : C:\Users\Vojtak\AppData\Roaming\PLGComp.ini
Soubor Nalezeno : C:\Windows\System32\roboot64.exe

***** [ Naplánované úlohy ] *****


***** [ Zástupci ] *****


***** [ Registry ] *****

Data Nalezeno : HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings [ProxyOverride] - *.local
Klíč Nalezeno : HKCU\Software\Conduit
Klíč Nalezeno : HKCU\Software\Softonic
Klíč Nalezeno : [x64] HKCU\Software\Conduit
Klíč Nalezeno : [x64] HKCU\Software\Softonic
Klíč Nalezeno : HKLM\SOFTWARE\Classes\AppID\NCTAudioCDGrabber2.DLL
Klíč Nalezeno : HKLM\SOFTWARE\Classes\CLSID\{1AA60054-57D9-4F99-9A55-D0FBFBE7ECD3}
Klíč Nalezeno : HKLM\SOFTWARE\Classes\CLSID\{35B8892D-C3FB-4D88-990D-31DB2EBD72BD}
Klíč Nalezeno : HKLM\SOFTWARE\Classes\CLSID\{5EB0259D-AB79-4AE6-A6E6-24FFE21C3DA4}
Klíč Nalezeno : HKLM\SOFTWARE\Classes\CLSID\{B853E835-9F24-4F4B-B55C-E554D15CCCD2}
Klíč Nalezeno : HKLM\SOFTWARE\Classes\CLSID\{CADAF6BE-BF50-4669-8BFD-C27BD4E6181B}
Klíč Nalezeno : HKLM\SOFTWARE\Classes\CLSID\{F83D1872-D9FF-47F8-B5A0-49CC51E24EE8}
Klíč Nalezeno : HKLM\SOFTWARE\Classes\Interface\{2BEF239C-752E-4001-8048-F256E0D8CD93}
Klíč Nalezeno : HKLM\SOFTWARE\Classes\Interface\{3F607E46-0D3C-4442-B1DE-DE7FA4768F5C}
Klíč Nalezeno : HKLM\SOFTWARE\Classes\Interface\{49C00A51-6E59-41FE-B3FA-2D2157FAD67B}
Klíč Nalezeno : HKLM\SOFTWARE\Classes\Interface\{6DFF5DBA-AE3A-46DB-B301-ECFFC6DB2982}
Klíč Nalezeno : HKLM\SOFTWARE\Classes\Interface\{803F550E-BAAE-42BB-8917-64BA0006AB17}
Klíč Nalezeno : HKLM\SOFTWARE\Classes\Interface\{B0474212-0D9D-4361-90B3-B89D1A44275D}
Klíč Nalezeno : HKLM\SOFTWARE\Classes\Interface\{DD260902-9420-4055-A956-9152EB4F3E6A}
Klíč Nalezeno : HKLM\SOFTWARE\Classes\Interface\{DE34CD67-F1C8-4001-9A23-B8A68F63F377}
Klíč Nalezeno : HKLM\SOFTWARE\Classes\Interface\{FE0273D1-99DF-4AC0-87D5-1371C6271785}
Klíč Nalezeno : HKLM\SOFTWARE\Classes\TypeLib\{93E3D79C-0786-48FF-9329-93BC9F6DC2B3}
Klíč Nalezeno : HKLM\SOFTWARE\Conduit
Klíč Nalezeno : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{3D2C9DE6-9ADE-4252-A241-E43723B0CE02}
Klíč Nalezeno : [x64] HKLM\SOFTWARE\Classes\Interface\{02F878DF-E2BE-4B85-8CB4-A0D2D4E2ED7F}
Klíč Nalezeno : [x64] HKLM\SOFTWARE\Classes\Interface\{2AF343DD-3102-4F9D-AC95-DCA4C95382C7}
Klíč Nalezeno : [x64] HKLM\SOFTWARE\Classes\Interface\{2BEF239C-752E-4001-8048-F256E0D8CD93}
Klíč Nalezeno : [x64] HKLM\SOFTWARE\Classes\Interface\{3137BC14-D8D7-4B67-8FFA-2E0B2E9D541B}
Klíč Nalezeno : [x64] HKLM\SOFTWARE\Classes\Interface\{3F607E46-0D3C-4442-B1DE-DE7FA4768F5C}
Klíč Nalezeno : [x64] HKLM\SOFTWARE\Classes\Interface\{49C00A51-6E59-41FE-B3FA-2D2157FAD67B}
Klíč Nalezeno : [x64] HKLM\SOFTWARE\Classes\Interface\{4CA2AC92-971B-47B1-ACB6-357B552155AC}
Klíč Nalezeno : [x64] HKLM\SOFTWARE\Classes\Interface\{52C5395B-1FCD-47FA-A834-FD830701C2D5}
Klíč Nalezeno : [x64] HKLM\SOFTWARE\Classes\Interface\{5D3DCC39-9233-4330-94E9-DA92BE49CA1A}
Klíč Nalezeno : [x64] HKLM\SOFTWARE\Classes\Interface\{615FACDF-DADB-440D-AC91-8AAB0AE9E3AD}
Klíč Nalezeno : [x64] HKLM\SOFTWARE\Classes\Interface\{6DFF5DBA-AE3A-46DB-B301-ECFFC6DB2982}
Klíč Nalezeno : [x64] HKLM\SOFTWARE\Classes\Interface\{762D463B-C45A-456D-A80D-8689C297C91E}
Klíč Nalezeno : [x64] HKLM\SOFTWARE\Classes\Interface\{7A6BE473-7960-44D0-BD54-D23DA76353DF}
Klíč Nalezeno : [x64] HKLM\SOFTWARE\Classes\Interface\{803F550E-BAAE-42BB-8917-64BA0006AB17}
Klíč Nalezeno : [x64] HKLM\SOFTWARE\Classes\Interface\{8D5BC51D-C9D3-43B9-B728-B30677B7C7E8}
Klíč Nalezeno : [x64] HKLM\SOFTWARE\Classes\Interface\{991C9D8D-A789-4DB9-BDFC-5F33398B04BF}
Klíč Nalezeno : [x64] HKLM\SOFTWARE\Classes\Interface\{A5ACC874-D943-483F-A2D1-14598D51F872}
Klíč Nalezeno : [x64] HKLM\SOFTWARE\Classes\Interface\{B0474212-0D9D-4361-90B3-B89D1A44275D}
Klíč Nalezeno : [x64] HKLM\SOFTWARE\Classes\Interface\{BFDE183A-C6FE-41D2-80F9-586C29210AC2}
Klíč Nalezeno : [x64] HKLM\SOFTWARE\Classes\Interface\{D83C83BF-3EDD-4410-ADAB-5295116DD8C7}
Klíč Nalezeno : [x64] HKLM\SOFTWARE\Classes\Interface\{DD260902-9420-4055-A956-9152EB4F3E6A}
Klíč Nalezeno : [x64] HKLM\SOFTWARE\Classes\Interface\{DE34CD67-F1C8-4001-9A23-B8A68F63F377}
Klíč Nalezeno : [x64] HKLM\SOFTWARE\Classes\Interface\{EB1F9F3C-5526-4DAE-BD4B-3EAA7715DA9F}
Klíč Nalezeno : [x64] HKLM\SOFTWARE\Classes\Interface\{F1912128-469A-4138-AA26-9699C15BB13E}
Klíč Nalezeno : [x64] HKLM\SOFTWARE\Classes\Interface\{F68DC16C-9C2B-455B-8853-7E4D34BAA3F4}
Klíč Nalezeno : [x64] HKLM\SOFTWARE\Classes\Interface\{FBA8498F-B3A0-4942-A2BF-E0CB7BC7E000}
Klíč Nalezeno : [x64] HKLM\SOFTWARE\Classes\Interface\{FE0273D1-99DF-4AC0-87D5-1371C6271785}

***** [ Prohlížeče ] *****

-\\ Internet Explorer v11.0.9600.17801


-\\ Mozilla Firefox v38.0.1 (x86 cs)

[h5g1m7l7.default] - Řádek Nalezeno : user_pref("browser.newtab.url", "hxxp://services.eshield.com/general/newhometab.php?hometab=tab&partner=11433&guid={A0EF7C2D-1885-499B-A3E8-D24C1ED6BB2C}&i=");
[h5g1m7l7.default] - Řádek Nalezeno : user_pref("keyword.URL", "hxxp://search.eshield.com/serp?guid={A0EF7C2D-1885-499B-A3E8-D24C1ED6BB2C}&k=");
[h5g1m7l7.default] - Řádek Nalezeno : user_pref("plugin.state.npconduitfirefoxplugin", 0);

-\\ Google Chrome v


-\\ Opera v29.0.1795.60


*************************

AdwCleaner[R0].txt - [5543 bytů] - [30/05/2015 08:32:19]

########## EOF - C:\AdwCleaner\AdwCleaner[R0].txt - [5601 bytů] ##########

Vážený kolega promine
doporučuji:
spusť AdwCleaner -> klikni na Scan po dokončení na Clean
bude provedena oprava, restartuje se - (případně restartuj) a vypadne log C:\AdwCleaner\AdwCleaner[S?].txt , jeho obsah vložíš sem

jasne, postup který popisuješ jsem samozrejme udelal, akorát jsem zde vyvěsil ten log před restartem.

To nemění nic na tom, že ty popupy s reklamou stále vyskakují .

Po restartu je zde:

# AdwCleaner v4.205 - Log vytvořen 30/05/2015 v 08:45:19
# Aktualizováno 21/05/2015 by Xplode
# Databáze : 2015-05-25.3 [Server]
# Operační system : Windows 7 Professional Service Pack 1 (x64)
# Uživatelské jméno : Vojtak - VOJTAK-PC
# Spuštěno z : C:\Users\Vojtak\Downloads\adwcleaner_4.205.exe
# Nastavení : Čištění

***** [ Služby ] *****


***** [ Soubory / Složky ] *****

Soubor Smazáno : C:\Windows\System32\roboot64.exe
Soubor Smazáno : C:\Users\Vojtak\AppData\Roaming\PLGComp.ini

***** [ Naplánované úlohy ] *****


***** [ Zástupci ] *****


***** [ Registry ] *****

Klíč Smazáno : HKLM\SOFTWARE\Classes\AppID\NCTAudioCDGrabber2.DLL
Klíč Smazáno : HKLM\SOFTWARE\Classes\CLSID\{1AA60054-57D9-4F99-9A55-D0FBFBE7ECD3}
Klíč Smazáno : HKLM\SOFTWARE\Classes\CLSID\{35B8892D-C3FB-4D88-990D-31DB2EBD72BD}
Klíč Smazáno : HKLM\SOFTWARE\Classes\CLSID\{5EB0259D-AB79-4AE6-A6E6-24FFE21C3DA4}
Klíč Smazáno : HKLM\SOFTWARE\Classes\CLSID\{CADAF6BE-BF50-4669-8BFD-C27BD4E6181B}
Klíč Smazáno : HKLM\SOFTWARE\Classes\CLSID\{B853E835-9F24-4F4B-B55C-E554D15CCCD2}
Klíč Smazáno : HKLM\SOFTWARE\Classes\CLSID\{F83D1872-D9FF-47F8-B5A0-49CC51E24EE8}
Klíč Smazáno : HKLM\SOFTWARE\Classes\Interface\{2BEF239C-752E-4001-8048-F256E0D8CD93}
Klíč Smazáno : HKLM\SOFTWARE\Classes\Interface\{3F607E46-0D3C-4442-B1DE-DE7FA4768F5C}
Klíč Smazáno : HKLM\SOFTWARE\Classes\Interface\{49C00A51-6E59-41FE-B3FA-2D2157FAD67B}
Klíč Smazáno : HKLM\SOFTWARE\Classes\Interface\{6DFF5DBA-AE3A-46DB-B301-ECFFC6DB2982}
Klíč Smazáno : HKLM\SOFTWARE\Classes\Interface\{DE34CD67-F1C8-4001-9A23-B8A68F63F377}
Klíč Smazáno : HKLM\SOFTWARE\Classes\Interface\{FE0273D1-99DF-4AC0-87D5-1371C6271785}
Klíč Smazáno : HKLM\SOFTWARE\Classes\Interface\{803F550E-BAAE-42BB-8917-64BA0006AB17}
Klíč Smazáno : HKLM\SOFTWARE\Classes\Interface\{B0474212-0D9D-4361-90B3-B89D1A44275D}
Klíč Smazáno : HKLM\SOFTWARE\Classes\Interface\{DD260902-9420-4055-A956-9152EB4F3E6A}
Klíč Smazáno : HKLM\SOFTWARE\Classes\TypeLib\{93E3D79C-0786-48FF-9329-93BC9F6DC2B3}
Klíč Smazáno : [x64] HKLM\SOFTWARE\Classes\Interface\{2BEF239C-752E-4001-8048-F256E0D8CD93}
Klíč Smazáno : [x64] HKLM\SOFTWARE\Classes\Interface\{3F607E46-0D3C-4442-B1DE-DE7FA4768F5C}
Klíč Smazáno : [x64] HKLM\SOFTWARE\Classes\Interface\{49C00A51-6E59-41FE-B3FA-2D2157FAD67B}
Klíč Smazáno : [x64] HKLM\SOFTWARE\Classes\Interface\{6DFF5DBA-AE3A-46DB-B301-ECFFC6DB2982}
Klíč Smazáno : [x64] HKLM\SOFTWARE\Classes\Interface\{DE34CD67-F1C8-4001-9A23-B8A68F63F377}
Klíč Smazáno : [x64] HKLM\SOFTWARE\Classes\Interface\{FE0273D1-99DF-4AC0-87D5-1371C6271785}
Klíč Smazáno : [x64] HKLM\SOFTWARE\Classes\Interface\{02F878DF-E2BE-4B85-8CB4-A0D2D4E2ED7F}
Klíč Smazáno : [x64] HKLM\SOFTWARE\Classes\Interface\{2AF343DD-3102-4F9D-AC95-DCA4C95382C7}
Klíč Smazáno : [x64] HKLM\SOFTWARE\Classes\Interface\{3137BC14-D8D7-4B67-8FFA-2E0B2E9D541B}
Klíč Smazáno : [x64] HKLM\SOFTWARE\Classes\Interface\{4CA2AC92-971B-47B1-ACB6-357B552155AC}
Klíč Smazáno : [x64] HKLM\SOFTWARE\Classes\Interface\{52C5395B-1FCD-47FA-A834-FD830701C2D5}
Klíč Smazáno : [x64] HKLM\SOFTWARE\Classes\Interface\{5D3DCC39-9233-4330-94E9-DA92BE49CA1A}
Klíč Smazáno : [x64] HKLM\SOFTWARE\Classes\Interface\{615FACDF-DADB-440D-AC91-8AAB0AE9E3AD}
Klíč Smazáno : [x64] HKLM\SOFTWARE\Classes\Interface\{762D463B-C45A-456D-A80D-8689C297C91E}
Klíč Smazáno : [x64] HKLM\SOFTWARE\Classes\Interface\{7A6BE473-7960-44D0-BD54-D23DA76353DF}
Klíč Smazáno : [x64] HKLM\SOFTWARE\Classes\Interface\{803F550E-BAAE-42BB-8917-64BA0006AB17}
Klíč Smazáno : [x64] HKLM\SOFTWARE\Classes\Interface\{8D5BC51D-C9D3-43B9-B728-B30677B7C7E8}
Klíč Smazáno : [x64] HKLM\SOFTWARE\Classes\Interface\{991C9D8D-A789-4DB9-BDFC-5F33398B04BF}
Klíč Smazáno : [x64] HKLM\SOFTWARE\Classes\Interface\{A5ACC874-D943-483F-A2D1-14598D51F872}
Klíč Smazáno : [x64] HKLM\SOFTWARE\Classes\Interface\{B0474212-0D9D-4361-90B3-B89D1A44275D}
Klíč Smazáno : [x64] HKLM\SOFTWARE\Classes\Interface\{BFDE183A-C6FE-41D2-80F9-586C29210AC2}
Klíč Smazáno : [x64] HKLM\SOFTWARE\Classes\Interface\{D83C83BF-3EDD-4410-ADAB-5295116DD8C7}
Klíč Smazáno : [x64] HKLM\SOFTWARE\Classes\Interface\{DD260902-9420-4055-A956-9152EB4F3E6A}
Klíč Smazáno : [x64] HKLM\SOFTWARE\Classes\Interface\{EB1F9F3C-5526-4DAE-BD4B-3EAA7715DA9F}
Klíč Smazáno : [x64] HKLM\SOFTWARE\Classes\Interface\{F1912128-469A-4138-AA26-9699C15BB13E}
Klíč Smazáno : [x64] HKLM\SOFTWARE\Classes\Interface\{F68DC16C-9C2B-455B-8853-7E4D34BAA3F4}
Klíč Smazáno : [x64] HKLM\SOFTWARE\Classes\Interface\{FBA8498F-B3A0-4942-A2BF-E0CB7BC7E000}
Klíč Smazáno : HKCU\Software\Conduit
Klíč Smazáno : HKCU\Software\Softonic
Klíč Smazáno : HKLM\SOFTWARE\Conduit
Klíč Smazáno : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{3D2C9DE6-9ADE-4252-A241-E43723B0CE02}
Data Smazáno : HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings [ProxyOverride] - *.local

***** [ Prohlížeče ] *****

-\\ Internet Explorer v11.0.9600.17801


-\\ Mozilla Firefox v38.0.1 (x86 cs)

[h5g1m7l7.default\prefs.js] - Řádek Smazáno : user_pref("browser.newtab.url", "hxxp://services.eshield.com/general/newhometab.php?hometab=tab&partner=11433&guid={A0EF7C2D-1885-499B-A3E8-D24C1ED6BB2C}&i=");
[h5g1m7l7.default\prefs.js] - Řádek Smazáno : user_pref("keyword.URL", "hxxp://search.eshield.com/serp?guid={A0EF7C2D-1885-499B-A3E8-D24C1ED6BB2C}&k=");
[h5g1m7l7.default\prefs.js] - Řádek Smazáno : user_pref("plugin.state.npconduitfirefoxplugin", 0);

-\\ Google Chrome v


-\\ Opera v29.0.1795.60


*************************

AdwCleaner[R0].txt - [5795 bytů] - [30/05/2015 08:32:19]
AdwCleaner[S0].txt - [5494 bytů] - [30/05/2015 08:45:19]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [5552 bytů] ##########

pravděpodobně budeš nucen vypnout na tu chvíli antivir - je to čisté, prověřeno

vyosek píše: Stahnete Zoek.exe http://hijackthis.nl/smeenk/ a ulozte jej na plochu

• Pokud pouzivate Win Vista ci W7, kliknete na Zoek pravym a dejte Run As Administrator ci Spustit jako spravce
• Do okna vlozte skript nize

• Kód: Vybrat vše

  autoclean;
  resethosts;
  emptyclsid;
  IEdefaults;
  FFdefaults;
  CHRdefaults;
  emptyIEcache;
  emptyFFcache;
  emptyCHRcache;
  emptyalltemp;
  emptyflash;
  emptyjava;
  emptyrecycle.bin;
  

• Nasledne kliknete na Run Script
• PC provede opravu, restartuje se a da Vam log, jeho obsah vlozte sem

Log bude zde C:\zoek-results.log

reklamy stále vyskakují


Zoek.exe v5.0.0.0 Updated 04-May-2015
Tool run by Vojtak on ne 31.05.2015 at 22:12:24,15.
Microsoft Windows 7 Professional 6.1.7601 Service Pack 1 x64
Running in: Normal Mode Internet Access Detected
Launched: C:\Users\Vojtak\Desktop\zoek.exe [Scan all users] [Script inserted]

==== System Restore Info ======================

31.5.2015 22:13:45 Zoek.exe System Restore Point Created Successfully.

==== Reset Hosts File ======================

# Copyright (c) 1993-2006 Microsoft Corp.
#
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
#
# This file contains the mappings of IP addresses to host names. Each
# entry should be kept on an individual line. The IP address should
# be placed in the first column followed by the corresponding host name.
# The IP address and the host name should be separated by at least one
# space.
#
# Additionally, comments (such as these) may be inserted on individual
# lines or following the machine name denoted by a '#' symbol.
#
# For example:
#
# 102.54.94.97 rhino.acme.com # source server
# 38.25.63.10 x.acme.com # x client host

# localhost name resolution is handled within DNS itself.
127.0.0.1 localhost
::1 localhost

==== Empty Folders Check ======================

C:\Program Files\ATI Technologies deleted successfully
C:\PROGRA~3\ALM deleted successfully
C:\PROGRA~3\Oracle deleted successfully
C:\Users\Vojtak\AppData\Roaming\TortoiseSVN deleted successfully
C:\Users\Vojtak\AppData\Local\TSVNCache deleted successfully

==== Deleting CLSID Registry Keys ======================

HKEY_USERS\S-1-5-21-3643688232-1350400347-446279456-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{F4E39681-15F8-4fda-B8A3-B5C98378F2F3} deleted successfully
HKEY_CLASSES_ROOT\Wow6432Node\CLSID\{B1261B83-C283-4F44-8D82-2594974CD988} deleted successfully

==== Deleting CLSID Registry Values ======================

HKEY_USERS\S-1-5-21-3643688232-1350400347-446279456-1000\Software\Microsoft\Internet Explorer\Approved Extensions\{B1261B83-C283-4F44-8D82-2594974CD988} deleted successfully

==== Deleting Services ======================


==== FireFox Fix ======================

Deleted from C:\Users\Vojtak\AppData\Roaming\Mozilla\Firefox\Profiles\h5g1m7l7.default\prefs.js:
user_pref("browser.search.selectedEngine", "eShield Safe Web");
user_pref("keyword.URL", "http://search.eshield.com/serp?guid={A0 ... D6BB2C}&k=");
user_pref("browser.search.useDBForOrder", true);

Added to C:\Users\Vojtak\AppData\Roaming\Mozilla\Firefox\Profiles\h5g1m7l7.default\prefs.js:
user_pref("browser.startup.homepage", "about:home");
user_pref("browser.newtab.url", "about:newtab");

Deleted from C:\Users\Vojtak\AppData\Roaming\Thunderbird\Profiles\av572p8q.default\prefs.js:

Added to C:\Users\Vojtak\AppData\Roaming\Thunderbird\Profiles\av572p8q.default\prefs.js:
user_pref("browser.startup.homepage", "about:home");
user_pref("browser.newtab.url", "about:newtab");

ProfilePath: C:\Users\Vojtak\AppData\Roaming\Mozilla\Firefox\Profiles\h5g1m7l7.default

user.js not found
---- Lines neurowise removed from prefs.js ----
user_pref("extensions.neurowise.asul", "1418076528567");
user_pref("extensions.neurowise.aul", "1418075691199");
user_pref("extensions.neurowise.irl", true);
user_pref("extensions.neurowise.is", "cbslug10");
user_pref("extensions.neurowise.ug", "1578DFFB-7A05-41E9-8AFE-6E74055C7DDF");
---- Lines conduit removed from prefs.js ----
user_pref("plugin.state.npconduitfirefoxplugin", 0);
---- FireFox user.js and prefs.js backups ----

prefs_31.05.2015_2228_.backup

ProfilePath: C:\Users\Vojtak\AppData\Roaming\Thunderbird\Profiles\av572p8q.default

user.js not found
---- FireFox user.js and prefs.js backups ----

prefs_31.05.2015_2228_.backup

==== Deleting Files \ Folders ======================

C:\PROGRA~2\reaConverter 7 Standard deleted
C:\PROGRA~2\VDownloader deleted
C:\ProductInst.exe deleted
C:\WpInstall.exe deleted
C:\Users\Vojtak\AppData\Roaming\VDownloader deleted
C:\Users\Vojtak\AppData\Roaming\GetRightToGo deleted
C:\windows\SysNative\GroupPolicy\machine deleted
C:\windows\SysNative\GroupPolicy\gpt.ini deleted
C:\Users\Public\Desktop\VDownloader.lnk deleted

==== Firefox Start and Search pages ======================

ProfilePath: C:\Users\Vojtak\AppData\Roaming\Mozilla\Firefox\Profiles\h5g1m7l7.default
user_pref("browser.startup.homepage", "about:home");
user_pref("browser.newtab.url", "about:newtab");

ProfilePath: C:\Users\Vojtak\AppData\Roaming\Thunderbird\Profiles\av572p8q.default
user_pref("browser.startup.homepage", "about:home");
user_pref("browser.newtab.url", "about:newtab");

==== Firefox Extensions ======================

ProfilePath: C:\Users\Vojtak\AppData\Roaming\Mozilla\Firefox\Profiles\h5g1m7l7.default
- Firebug - %ProfilePath%\extensions\firebug@software.joehewitt.com.xpi
- Record Page - %ProfilePath%\extensions\{1e2b528d-3643-46e1-bb59-560c20fe1d2b}.xpi
- Web Developer - %ProfilePath%\extensions\{c45c406e-ab73-11d8-be73-000a95be3b12}.xpi

ProfilePath: C:\Users\Vojtak\AppData\Roaming\Thunderbird\Profiles\av572p8q.default
- esk slovnk pro kontrolu pravopisu - %ProfilePath%\extensions\cs@dictionaries.addons.mozilla.org
- United States English Spellchecker - %ProfilePath%\extensions\en-US@dictionaries.addons.mozilla.org

AppDir: C:\Program Files (x86)\Mozilla Firefox
- Default - %AppDir%\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

==== Firefox Plugins ======================

Profilepath: C:\Users\Vojtak\AppData\Roaming\Mozilla\Firefox\Profiles\h5g1m7l7.default
C25B91466D8C383299E9E2023F8F7A5A - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_3_300_257.dll - Shockwave Flash
08ACECEB47FAF053C468D8AFE44709AD - C:\Users\Vojtak\AppData\Local\Google\Update\1.3.27.5\npGoogleUpdate3.dll - Google Update
3CD19649B2C3023D65E67C056457A2BC - C:\Users\Vojtak\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll - Facebook Video Calling Plugin
49D429EBF5305FC9ADD7545B7C914333 - C:\Users\Vojtak\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll - Google Talk Plugin
6BEAD7859E8A087BE04556AB5A78855C - C:\Users\Vojtak\AppData\Roaming\Mozilla\plugins\npo1d.dll - Google Talk Plugin Video Renderer
9AE02005247DA91AB1743F5208DBEF76 - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_17_0_0_169.dll - Shockwave Flash


==== Chromium Look ======================


Bookmark Manager - Vojtak\AppData\Local\Google\Chrome\User Data\Default\Extensions\gmlllbghnfkpflemihljekbapjopfjik
{scripts [background.js]}content_scripts:[{js:[content.js]matches:[<all_urls>]run_at:document_end}]content_security_policy:script-src 'self' 'unsafe-eval' https://recordpage-a.akamaihd.net https://recordpage-a.akamaihd.net https://cdn.getrecordpage.com; object-src 'self'description:homepage_url:http://www.getrecordpage.comicons:{48:icon.png}key:MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEArHR+AXt7IPAy3hcvBPJAhnpEO97fc7aeuHsc3kn0BHQDo/pqZKvLZbBqqwNFykHqBUcVjCGuyJu07BX3wmHrD3eKbspXoDGv0D0fXEvC4C9SKX0z8d/l9dlnvXs8p8S6LYvTuNlQxSmWcxqdxqPvRCts5cuKWjzdy4fkSS+oJfoGM9lerVKMU9UGHQMnBNOyaoIK1PfrsnDe7aJ3o0jX/GOND6aFm649nGwerVarsTXScVRmL17AMjV6rAcZY9jf/fKfFVD8BtsU2hzLcVs/ZhPpdi2iPpzsJ9K3B6NoG+gLmOBrMNi7o6cXJk/ha33Y4gkfu/KLRZLrS0M1q4/xoQIDAQABmanifest_version:2name:Record Pagepermissions:[managementstoragetabswebRequestwebRequestBlocking<all_urls>]update_url:http://cdn.getrecordpage.com/updatevers ... 5624.28248} - Vojtak\AppData\Roaming\Opera Software\Opera Stable\Extensions\ipabidclbobagkpfhdoefbggacfjedae

==== Chromium Startpages ======================

C:\Users\Vojtak\AppData\Local\Google\Chrome\User Data\Default\Preferences
camera":{"https://www.justareflektor.com:443,*":{"setting":1}},"media_stream_mic":{},"metro_switch_to_desktop":{},"midi_sysex":{},"mixed_script":{},"mouselock":{},"notifications":{},"plugins":{"https://[*.]www.mojebanka.cz:443,*":{"setting":1}},"popups":{"https://[*.]my.vertabelo.com:443,*":{"setting":1}},"ppapi_broker":{},"protocol_handlers":{},"push_messaging":{},"ssl_cert_decisions":{}},"pattern_pairs":{"https://[*.]my.vertabelo.com:443,*":{"popups":1},"https://[*.]www.mojebanka.cz:443,*":{"plugins":1},"https://[*.]www.youtube.com:443,*":{"fullscreen":1},"https://www.justareflektor.com:443,*":{"media-stream-camera":1}},"pref_version":1},"exit_type":"Normal","exited_cleanly":true,"icon_version":3,"managed_user_id":"","migrated_content_settings_exceptions":true,"migrated_default_content_settings":true,"migrated_default_media_stream_content_settings":true,"name":"První uživatel","password_manager_groups_for_domains":[7,null,null,null,null,null,7],"per_host_zoom_levels":{}},"protection":{"macs":{}},"savefile":{"default_directory":"C:\\Users\\Vojtak\\Desktop"},"selectfile":{"last_directory":"C:\\Users\\Vojtak\\Desktop"},"session":{"restore_on_startup_migrated":true,"startup_urls_migration_time":"13034556119103086"},"sync_promo":{"startup_count":1,"user_skipped":true,"view_count":1},"translate_accepted_count":{"en":0},"translate_blocked_languages":["cs"],"translate_denied_count":{"en":23},"translate_last_denied_time":1420788609909.576,"translate_too_often_denied":true,"translate_whitelists":{}}
"homepage": "http://www.google.com/",
"startup_urls": [ "http://www.google.com/" ]


==== Chromium Fix ======================

C:\Users\Vojtak\AppData\Roaming\Opera Software\Opera Stable\Extensions\ipabidclbobagkpfhdoefbggacfjedae deleted successfully
C:\Users\Vojtak\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_ipabidclbobagkpfhdoefbggacfjedae_0.localstorage deleted successfully
C:\Users\Vojtak\AppData\Roaming\Opera Software\Opera Stable\Local Storage\chrome-extension_ipabidclbobagkpfhdoefbggacfjedae_0.localstorage deleted successfully

==== Set IE to Default ======================

Old Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]

New Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"="http://go.microsoft.com/fwlink/?LinkId=69157"

==== All HKCU SearchScopes ======================

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes
"DefaultScope"="{0633EE93-D776-472f-A0FF-E1416B8B2E3A}"
{012E1000-F331-11DB-8314-0800200C9A66} Google Url="http://www.google.com/search?q={searchTerms}"
{0633EE93-D776-472f-A0FF-E1416B8B2E3A} Bing Url="http://www.bing.com/search?q={searchTer ... ORM=IE8SRC"

==== Reset Google Chrome ======================

C:\Users\Vojtak\AppData\Local\Google\Chrome\User Data\Default\Preferences was reset successfully
C:\Users\Vojtak\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences was reset successfully
C:\Users\Vojtak\AppData\Roaming\Opera Software\Opera Stable\Preferences was reset successfully
C:\Users\Vojtak\AppData\Local\Google\Chrome\User Data\Default\Web Data was reset successfully
C:\Users\Vojtak\AppData\Local\Google\Chrome\User Data\Default\Web Data-journal was reset successfully
C:\Users\Vojtak\AppData\Roaming\Opera Software\Opera Stable\Web Data was reset successfully
C:\Users\Vojtak\AppData\Roaming\Opera Software\Opera Stable\Web Data-journal was reset successfully

==== Deleting Registry Keys ======================

HKEY_LOCAL_MACHINE\Software\wow6432node\Policies\Google deleted successfully

==== Empty IE Cache ======================

C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\Default\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\Vojtak\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\Vojtak\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5 emptied successfully
C:\Users\Vojtak\AppData\Local\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\Vojtak\AppData\Local\Temp\acro_rd_dir\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\Vojtak\AppData\Local\Temp\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\SysNative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\sysWoW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\serviceprofiles\Localservice\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\serviceprofiles\Localservice\AppData\Local\Temp\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\sysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully

==== Empty FireFox Cache ======================

C:\Users\Vojtak\AppData\Local\Mozilla\Firefox\Profiles\h5g1m7l7.default\cache2 emptied successfully

==== Empty Chrome Cache ======================

C:\Users\Vojtak\AppData\Local\Opera Software\Opera Stable\Cache emptied successfully
C:\Users\Vojtak\AppData\Local\Google\Chrome\User Data\Default\Cache emptied successfully

==== Empty All Flash Cache ======================

Flash Cache is not empty, a reboot is needed

==== Empty All Java Cache ======================

Java Cache cleared successfully

==== C:\zoek_backup content ======================

C:\zoek_backup (files=78 folders=28 41951352 bytes)

==== Empty Temp Folders ======================

C:\Users\Default\AppData\Local\Temp emptied successfully
C:\Users\Default User\AppData\Local\Temp emptied successfully
C:\Users\Vojtak\AppData\Local\Temp will be emptied at reboot
C:\Windows\serviceprofiles\networkservice\AppData\Local\Temp emptied successfully
C:\Windows\serviceprofiles\Localservice\AppData\Local\Temp emptied successfully
C:\Windows\Temp will be emptied at reboot

==== After Reboot ======================

==== Empty Temp Folders ======================

C:\Windows\Temp successfully emptied
C:\Users\Vojtak\AppData\Local\Temp successfully emptied

==== Empty Recycle Bin ======================

C:\$RECYCLE.BIN successfully emptied

==== Deleting Files / Folders ======================

"C:\Users\Vojtak\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\2XN9ERL9\www.performax.cz" not found

==== EOF on ne 31.05.2015 at 22:38:24,00 ======================

reklamy vyskakují ve všech prohlížečích na všech navštívených stránkách?

dej log z aktualizovaného MBAM

No tak možná jsem zbytečně plašil. Po dalším restartu mi to zatím na žádné stránce nevyskočilo.

tak to chvíli ještě testuj a pak se mi ozvi

Tak předčasná radost, dneska rano mi při otevření gmailu vyskocil samovolne nový tab s reklamou a tady u vás na fóru mi vyskakují zase nějaké ty record page ads 4...

update: Teď už to zase lítá všude jak čert:(

Tak znovu podle předchozích návodů:
ADWCleaner
Zoek
MBAM

logy sem dej

tady je prvni

# AdwCleaner v4.206 - Log vytvořen 02/06/2015 v 09:48:49


# Aktualizováno 01/06/2015 by Xplode
# Databáze : 2015-06-01.1 [Server]
# Operační system : Windows 7 Professional Service Pack 1 (x64)
# Uživatelské jméno : Vojtak - VOJTAK-PC
# Spuštěno z : C:\Users\Vojtak\Downloads\adwcleaner_4.206(1).exe
# Nastavení : Čištění

***** [ Služby ] *****


***** [ Soubory / Složky ] *****


***** [ Naplánované úlohy ] *****


***** [ Zástupci ] *****


***** [ Registry ] *****


***** [ Prohlížeče ] *****

-\\ Internet Explorer v11.0.9600.17801


-\\ Mozilla Firefox v38.0.1 (x86 cs)


-\\ Google Chrome v


-\\ Opera v29.0.1795.60


*************************

AdwCleaner[R0].txt - [5795 bytů] - [30/05/2015 08:32:19]
AdwCleaner[R1].txt - [942 bytů] - [02/06/2015 09:46:37]
AdwCleaner[S0].txt - [5739 bytů] - [30/05/2015 08:45:19]
AdwCleaner[S1].txt - [868 bytů] - [02/06/2015 09:48:49]

########## EOF - C:\AdwCleaner\AdwCleaner[S1].txt - [925 bytů] ##########