VIRY.CZ

Zdravím, mohl bych poprosit o kontrolu jednoho vetránka?
Díky.

Logfile of random's system information tool 1.10 (written by random/random)
Run by Administrator at 2016-04-24 17:42:44
Systém Microsoft Windows XP Professional Service Pack 3
System drive C: has 59 GB (77%) free of 76 GB
Total RAM: 1527 MB (71% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 17:43:17, on 24.4.2016
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\AVAST Software\Avast\AvastSvc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\AVAST Software\Avast\AvastUI.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\wbem\unsecapp.exe
C:\Documents and Settings\Administrator\Plocha\RSIT.exe
C:\Program Files\trend micro\Administrator.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://www.seznam.cz/?clid=22668
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://search.seznam.cz/?sourceid=quick ... earchTerms}
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.seznam.cz/?clid=22668
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = https://www.seznam.cz/?clid=22668
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://search.seznam.cz/?sourceid=quick ... earchTerms}
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.seznam.cz/?clid=22668
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
O2 - BHO: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [Zástupce stránky vlastností sběrnice High Definition Audio] HDAShCut.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [PTHOSTTR] C:\Program Files\HPQ\HP ProtectTools Security Manager\PTHOSTTR.EXE /Start
O4 - HKLM\..\Run: [SetRefresh] C:\Program Files\Compaq\SetRefresh\SetRefresh.exe
O4 - HKLM\..\Run: [LayoutM] KLayMgr.exe
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [AvastUI.exe] "C:\Program Files\AVAST Software\Avast\AvastUI.exe" /nogui
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microso ... 2453731750
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Proces mezipaměti kategorií součástí - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: Avast Antivirus (avast! Antivirus) - AVAST Software - C:\Program Files\AVAST Software\Avast\AvastSvc.exe
O23 - Service: Služba Google Update (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Služba Google Update (gupdatem) (gupdatem) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: HP WMI Interface (hpqwmi) - Hewlett-Packard Development Company, L.P. - C:\Program Files\HPQ\Shared\hpqwmi.exe
O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe
O23 - Service: Skype Updater (SkypeUpdate) - Skype Technologies - C:\Program Files\Skype\Updater\Updater.exe

--
End of file - 4857 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\Adobe Flash Player PPAPI Notifier.job - C:\WINDOWS\system32\Macromed\Flash\FlashUtil32_21_0_0_213_pepper.exe -check pepperplugin
C:\WINDOWS\tasks\Adobe Flash Player Updater.job - C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe
C:\WINDOWS\tasks\avast! Emergency Update.job - C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe
C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job - C:\Program Files\Google\Update\GoogleUpdate.exe /c
C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job - C:\Program Files\Google\Update\GoogleUpdate.exe /ua /installsource scheduler
C:\WINDOWS\tasks\IQA.job - C:\WINDOWS\system32\cmd.exe /c start chrome.exe
C:\WINDOWS\tasks\Měsíční oznamování konce poskytování služeb pro Microsoft Windows XP.job - C:\WINDOWS\system32\xp_eos.exe
C:\WINDOWS\tasks\Přihlášení k oznamování konce poskytování služeb pro Microsoft Windows XP.job - C:\WINDOWS\system32\xp_eos.exe -c

=========Mozilla firefox=========

ProfilePath - C:\Documents and Settings\Administrator\Data aplikací\Mozilla\Firefox\Profiles\b24rb83c.default

prefs.js - "browser.search.useDBForOrder" - true
prefs.js - "browser.startup.homepage" - "https://www.seznam.cz/"

"{20a82645-c095-46ed-80e3-08825760534b}"=c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
"deskCutv2@gmail.com"=C:\Documents and Settings\Administrator\Data aplikací\Mozilla\Firefox\Profiles\b24rb83c.default\extensions\deskCutv2@gmail.com
"wrc@avast.com"=C:\Program Files\AVAST Software\Avast\WebRep\FF


[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 21.0.0.213 Plugin
"Path"=C:\WINDOWS\system32\Macromed\Flash\NPSWF32_21_0_0_213.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/WPF,version=3.5]
"Description"=Windows Presentation Foundation plug-in for Mozilla browsers
"Path"=c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@tools.google.com/Google Update;version=3]
"Description"=Google Update
"Path"=C:\Program Files\Google\Update\1.3.29.5\npGoogleUpdate3.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@tools.google.com/Google Update;version=9]
"Description"=Google Update
"Path"=C:\Program Files\Google\Update\1.3.29.5\npGoogleUpdate3.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@videolan.org/vlc,version=2.0.2]
"Description"=VLC Multimedia Plugin
"Path"=C:\Program Files\VideoLAN\VLC\npvlc.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@videolan.org/vlc,version=2.2.1]
"Description"=VLC Multimedia Plugin
"Path"=C:\Program Files\VideoLAN\VLC\npvlc.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@videolan.org/vlc,version=2.2.2]
"Description"=VLC Multimedia Plugin
"Path"=C:\Program Files\VideoLAN\VLC\npvlc.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\Adobe Reader]
"Description"=Handles PDFs in-place in Firefox
"Path"=C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll


C:\Documents and Settings\Administrator\Data aplikací\Mozilla\Firefox\Profiles\b24rb83c.default\extensions\
deskCutv2@gmail.com

C:\Documents and Settings\Administrator\Data aplikací\Mozilla\Firefox\Profiles\b24rb83c.default\searchplugins\
bing-.xml
default.xml

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8E5E2654-AD2D-48bf-AC2D-D17F00898D06}]
avast! Online Security - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll [2016-04-24 679680]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"=C:\WINDOWS\system32\igfxtray.exe [2005-04-05 94208]
"HotKeysCmds"=C:\WINDOWS\system32\hkcmd.exe [2005-04-05 77824]
"Persistence"=C:\WINDOWS\system32\igfxpers.exe [2005-04-05 114688]
"Zástupce stránky vlastností sběrnice High Definition Audio"=C:\WINDOWS\system32\HDAShCut.exe [2005-01-07 61952]
"RTHDCPL"=C:\WINDOWS\RTHDCPL.EXE [2005-03-08 13924864]
"PTHOSTTR"=C:\Program Files\HPQ\HP ProtectTools Security Manager\PTHOSTTR.EXE [2005-10-04 86016]
"SetRefresh"=C:\Program Files\Compaq\SetRefresh\SetRefresh.exe [2003-11-20 525824]
"LayoutM"=C:\WINDOWS\KLayMgr.exe [2004-08-16 45056]
"Adobe ARM"=C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2015-06-12 998088]
"AvastUI.exe"=C:\Program Files\AVAST Software\Avast\AvastUI.exe [2016-04-24 7390608]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"=C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
C:\WINDOWS\system32\igfxdev.dll [2005-04-05 131072]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon]
C:\WINDOWS\system32\WgaLogon.dll [2009-03-10 265096]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Wdf01000.sys]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
"SoftwareSASGeneration"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\Cross Racing Championship\crc.exe"="C:\Program Files\Cross Racing Championship\crc.exe:*:Enabled:Cross Racing Championship 2005"
"C:\Program Files\TrackMania Sunrise\TmSunrise.exe"="C:\Program Files\TrackMania Sunrise\TmSunrise.exe:*:Enabled:TmSunrise"
"C:\Program Files\Java\jre1.5.0\bin\javaw.exe"="C:\Program Files\Java\jre1.5.0\bin\javaw.exe:*:Enabled:Java(TM) 2 Platform Standard Edition binary"
"C:\Program Files\Mozilla Firefox\firefox.exe"="C:\Program Files\Mozilla Firefox\firefox.exe:*:Enabled:Firefox (C:\Program Files\Mozilla Firefox)"
"C:\Program Files\Skype\Phone\Skype.exe"="C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype"
"C:\Program Files\Valve\hl.exe"="C:\Program Files\Valve\hl.exe:*:Disabled:Half-Life Launcher"
"C:\WarThunder\win64\aces.exe"="C:\WarThunder\win64\aces.exe:*:Enabled:War Thunder Game Client"
"C:\WarThunder\bpreport.exe"="C:\WarThunder\bpreport.exe:*:Enabled:War Thunder Crash Reporter"
"C:\Documents and Settings\Administrator\Local Settings\Data aplikací\Chromium\Application\chrome.exe"="C:\Documents and Settings\Administrator\Local Settings\Data aplikací\Chromium\Application\chrome.exe:*:Enabled:Internet Quick Access"
"C:\Program Files\LuckyBrowse\app\LuckyBrowse.exe"="C:\Program Files\LuckyBrowse\app\LuckyBrowse.exe:*:Enabled:LuckyBrowse"
"C:\Program Files\SpringFiles\SprgFiles.exe"="C:\Program Files\SpringFiles\SprgFiles.exe:*:Enabled:SpringFiles"
"C:\Program Files\SpringFiles\downloader.exe"="C:\Program Files\SpringFiles\downloader.exe:*:Enabled:SpringFiles"
"C:\Program Files\Google\Chrome\Application\chrome.exe"="C:\Program Files\Google\Chrome\Application\chrome.exe:*:Enabled:Google Chrome"
"C:\Documents and Settings\Administrator\Data aplikací\Server.exe"="C:\Documents and Settings\Administrator\Data aplikací\Server.exe:*:Enabled:Server.exe"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"midimapper"=midimap.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msadpcm"=msadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.trspch"=tssoft32.acm
"vidc.cvid"=iccvid.dll
"VIDC.I420"=msh263.drv
"vidc.iv31"=ir32_32.dll
"vidc.iv32"=ir32_32.dll
"vidc.iv41"=ir41_32.ax
"VIDC.IYUV"=iyuv_32.dll
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"VIDC.UYVY"=msyuv.dll
"VIDC.YUY2"=msyuv.dll
"VIDC.YVU9"=tsbyuv.dll
"VIDC.YVYU"=msyuv.dll
"wavemapper"=msacm32.drv
"msacm.msg723"=msg723.acm
"vidc.M263"=msh263.drv
"vidc.M261"=msh261.drv
"msacm.msaudio1"=msaud32.acm
"msacm.sl_anet"=sl_anet.acm
"msacm.iac2"=C:\WINDOWS\system32\iac25_32.ax
"vidc.iv50"=ir50_32.dll
"msacm.l3acm"=C:\WINDOWS\system32\l3codeca.acm
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv
"MSVideo8"=VfWWDM32.dll
"wave1"=wdmaud.drv
"midi1"=wdmaud.drv
"mixer1"=wdmaud.drv
"aux1"=wdmaud.drv

======List of files/folders created in the last 1 month======

2016-04-24 17:42:44 ----D---- C:\rsit
2016-04-24 17:42:44 ----D---- C:\Program Files\trend micro
2016-04-24 17:31:00 ----A---- C:\WINDOWS\system32\drivers\aswKbd.sys
2016-04-24 17:28:47 ----D---- C:\Documents and Settings\Administrator\Data aplikací\AVAST Software
2016-04-24 17:27:35 ----A---- C:\WINDOWS\system32\drivers\aswvmm.sys
2016-04-24 17:27:35 ----A---- C:\WINDOWS\system32\drivers\aswTdi.sys
2016-04-24 17:27:35 ----A---- C:\WINDOWS\system32\drivers\aswStmXP.sys
2016-04-24 17:27:34 ----A---- C:\WINDOWS\system32\drivers\aswSP.sys
2016-04-24 17:27:34 ----A---- C:\WINDOWS\system32\drivers\aswRvrt.sys
2016-04-24 17:27:33 ----A---- C:\WINDOWS\system32\drivers\aswMonFlt.sys
2016-04-24 17:27:33 ----A---- C:\WINDOWS\system32\drivers\aswHwid.sys
2016-04-24 17:27:32 ----A---- C:\WINDOWS\system32\drivers\aswRdr.sys
2016-04-24 17:27:31 ----A---- C:\WINDOWS\system32\drivers\aswSnx.sys
2016-04-24 17:27:20 ----A---- C:\WINDOWS\system32\aswBoot.exe
2016-04-24 17:27:12 ----A---- C:\WINDOWS\avastSS.scr
2016-04-24 17:26:18 ----D---- C:\Program Files\AVAST Software
2016-04-24 17:26:02 ----D---- C:\Documents and Settings\All Users\Data aplikací\AVAST Software
2016-04-24 17:13:49 ----D---- C:\Program Files\CCleaner
2016-04-24 16:49:01 ----SHD---- C:\Config.Msi
2016-04-22 18:56:25 ----A---- C:\WINDOWS\system32\FlashPlayerInstaller.exe
2016-03-25 14:15:17 ----A---- C:\Documents and Settings\All Users\Data aplikací\{262E20B8-6E20-4CEF-B1FD-D022AB1085F5}.dat
2016-03-25 14:14:24 ----D---- C:\Program Files\TData
2016-03-25 14:12:28 ----D---- C:\WINDOWS\system32\_tWm

======List of files/folders modified in the last 1 month======

2016-04-24 17:42:44 ----RD---- C:\Program Files
2016-04-24 17:41:55 ----D---- C:\WINDOWS\system32\CatRoot2
2016-04-24 17:40:51 ----D---- C:\WINDOWS
2016-04-24 17:40:21 ----D---- C:\WINDOWS\system32\drivers
2016-04-24 17:39:53 ----A---- C:\WINDOWS\SchedLgU.Txt
2016-04-24 17:34:27 ----D---- C:\WINDOWS\Temp
2016-04-24 17:31:14 ----D---- C:\WINDOWS\system32
2016-04-24 17:29:51 ----D---- C:\WINDOWS\system32\CatRoot
2016-04-24 17:28:31 ----HD---- C:\WINDOWS\inf
2016-04-24 17:27:40 ----SD---- C:\WINDOWS\Tasks
2016-04-24 17:27:24 ----D---- C:\WINDOWS\WinSxS
2016-04-24 17:26:12 ----D---- C:\WINDOWS\Prefetch
2016-04-24 17:15:02 ----D---- C:\WINDOWS\Debug
2016-04-24 16:58:15 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2016-04-24 16:57:06 ----D---- C:\Documents and Settings\Administrator\Data aplikací\Skype
2016-04-24 16:49:07 ----SHD---- C:\WINDOWS\Installer
2016-04-24 16:46:40 ----D---- C:\Program Files\Common Files
2016-04-23 09:44:45 ----D---- C:\WINDOWS\system32\MRT
2016-04-23 09:38:28 ----A---- C:\WINDOWS\system32\MRT.exe
2016-04-22 18:56:29 ----A---- C:\WINDOWS\system32\FlashPlayerApp.exe
2016-03-25 14:08:04 ----A---- C:\Documents and Settings\Administrator\Data aplikací\Server.exe.tmp

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 aswRvrt;avast! Revert; C:\WINDOWS\system32\drivers\aswRvrt.sys [2016-04-24 58776]
R0 aswVmm;avast! VM Monitor; C:\WINDOWS\system32\drivers\aswVmm.sys [2016-04-24 221368]
R0 sfdrv01a;StarForce Protection Environment Driver (version 1.x.a); C:\WINDOWS\System32\drivers\sfdrv01a.sys [2006-07-05 63352]
R0 sfhlp02;StarForce Protection Helper Driver (version 2.x); C:\WINDOWS\System32\drivers\sfhlp02.sys [2006-06-14 13680]
R0 sfsync02;StarForce Protection Synchronization Driver (version 2.x); C:\WINDOWS\System32\drivers\sfsync02.sys [2006-07-10 27032]
R0 sfvfs02;StarForce Protection VFS Driver (version 2.x); C:\WINDOWS\System32\drivers\sfvfs02.sys [2007-01-12 82296]
R1 aswKbd;aswKbd; C:\WINDOWS\system32\drivers\aswKbd.sys [2016-04-24 35096]
R1 aswRdr;aswRdr; C:\WINDOWS\system32\drivers\aswRdr.sys [2016-04-24 64272]
R1 aswSnx;aswSnx; C:\WINDOWS\system32\drivers\aswSnx.sys [2016-04-24 815792]
R1 aswSP;aswSP; C:\WINDOWS\system32\drivers\aswSP.sys [2016-04-24 449640]
R1 intelppm;Řadič procesoru Intel; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2008-04-14 40192]
R1 kbdhid;Ovladač klávesnice standardu HID; C:\WINDOWS\system32\DRIVERS\kbdhid.sys [2008-04-14 14592]
R1 WmiAcpi;Microsoft Windows Management Interface for ACPI; C:\WINDOWS\system32\DRIVERS\wmiacpi.sys [2008-04-14 8832]
R2 aswHwid;avast! HardwareID; C:\WINDOWS\system32\drivers\aswHwid.sys [2016-04-24 32792]
R2 aswMonFlt;aswMonFlt; C:\WINDOWS\system32\drivers\aswMonFlt.sys [2016-04-24 91168]
R3 AR9271;Wireless Network Adapter Service; C:\WINDOWS\system32\DRIVERS\athuw.sys [2010-01-04 1714176]
R3 aswStmXP;Avast StreamFilter Driver; C:\WINDOWS\system32\drivers\aswStmXP.sys [2016-04-24 187208]
R3 b57w2k;Broadcom NetXtreme Gigabit Ethernet; C:\WINDOWS\system32\DRIVERS\b57xp32.sys [2005-04-08 132352]
R3 HDAudBus;Ovladač Microsoft UAA pro sběrnici High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2008-04-13 144384]
R3 HidUsb;Ovladač třídy standardu HID; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-14 10368]
R3 ialm;ialm; C:\WINDOWS\system32\DRIVERS\ialmnt5.sys [2005-04-05 830684]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\WINDOWS\system32\drivers\RtkHDAud.sys [2005-03-05 2538624]
R3 mouhid;Ovladač myši standardu HID; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-10-24 12160]
R3 usbccgp;Obecný nadřazený ovladač Microsoft USB; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2013-08-09 32384]
R3 usbuhci;Ovladač Microsoft univerzálního hostitelského řadiče USB od společnosti Microsoft; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2008-04-14 20608]
R3 Wdf01000;Kernel Mode Driver Frameworks service; C:\WINDOWS\System32\Drivers\wdf01000.sys [2009-07-14 444136]
S1 P3;Ovladač procesoru Intel PentiumIII; C:\WINDOWS\system32\DRIVERS\p3.sys [2008-04-14 46592]
S3 aswTdi;aswTdi; C:\WINDOWS\system32\drivers\aswTdi.sys [2016-04-24 67216]
S3 CCDECODE;Dekodér Closed Caption; C:\WINDOWS\system32\DRIVERS\CCDECODE.sys [2008-04-14 17024]
S3 E100B;Intel(R) PRO Adapter Driver; C:\WINDOWS\system32\DRIVERS\e100b325.sys [2001-10-24 117760]
S3 HdAudAddService;Ovladač funkcí Microsoft UAA pro služby sběrnice High Definition Audio; C:\WINDOWS\system32\drivers\HdAudio.sys [2005-01-07 145920]
S3 HPKBCCID;HP Keyboard Smart Card Driver; C:\WINDOWS\system32\DRIVERS\HPKBCCID.sys [2005-08-04 48512]
S3 i81x;i81x; C:\WINDOWS\system32\DRIVERS\i81xnt5.sys [2004-08-04 161020]
S3 iAimFP0;iAimFP0; C:\WINDOWS\system32\DRIVERS\wADV01nt.sys [2004-08-04 12415]
S3 iAimFP1;iAimFP1; C:\WINDOWS\system32\DRIVERS\wADV02NT.sys [2004-08-04 12127]
S3 iAimFP2;iAimFP2; C:\WINDOWS\system32\DRIVERS\wADV05NT.sys [2004-08-04 11775]
S3 iAimFP3;iAimFP3; C:\WINDOWS\system32\DRIVERS\wSiINTxx.sys [2004-08-04 12063]
S3 iAimFP4;iAimFP4; C:\WINDOWS\system32\DRIVERS\wVchNTxx.sys [2004-08-04 19455]
S3 iAimFP5;iAimFP5; C:\WINDOWS\system32\DRIVERS\wADV07nt.sys [2004-08-04 11807]
S3 iAimFP6;iAimFP6; C:\WINDOWS\system32\DRIVERS\wADV08nt.sys [2004-08-04 11295]
S3 iAimFP7;iAimFP7; C:\WINDOWS\system32\DRIVERS\wADV09nt.sys [2004-08-04 11871]
S3 iAimTV0;iAimTV0; C:\WINDOWS\system32\DRIVERS\wATV01nt.sys [2004-08-04 29311]
S3 iAimTV1;iAimTV1; C:\WINDOWS\system32\DRIVERS\wATV02NT.sys [2004-08-04 19551]
S3 iAimTV3;iAimTV3; C:\WINDOWS\system32\DRIVERS\wATV04nt.sys [2004-08-04 33599]
S3 iAimTV4;iAimTV4; C:\WINDOWS\system32\DRIVERS\wCh7xxNT.sys [2004-08-04 23615]
S3 iAimTV5;iAimTV5; C:\WINDOWS\system32\DRIVERS\wATV10nt.sys [2004-08-04 25471]
S3 iAimTV6;iAimTV6; C:\WINDOWS\system32\DRIVERS\wATV06nt.sys [2004-08-04 22271]
S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink Converter; C:\WINDOWS\system32\drivers\MSTEE.sys [2008-04-14 5504]
S3 NABTSFEC;NABTS/FEC VBI Codec; C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys [2008-04-14 85248]
S3 NdisIP;Microsoft TV/Video Connection; C:\WINDOWS\system32\DRIVERS\NdisIP.sys [2008-04-14 10880]
S3 nmwcd;Nokia USB Phone Parent Driver; C:\WINDOWS\system32\drivers\ccdcmb.sys [2011-08-17 18176]
S3 nmwcdc;Nokia USB Communication Driver; C:\WINDOWS\system32\drivers\ccdcmbo.sys [2011-08-17 23168]
S3 SLIP;BDA Slip De-Framer; C:\WINDOWS\system32\DRIVERS\SLIP.sys [2008-04-14 11136]
S3 streamip;BDA IPSink; C:\WINDOWS\system32\DRIVERS\StreamIP.sys [2008-04-14 15232]
S3 usbaudio;Ovladač zvukové karty USB (WDM); C:\WINDOWS\system32\drivers\usbaudio.sys [2013-07-17 60160]
S3 usbscan;Ovladač skeneru USB; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2013-07-03 14976]
S3 USBSTOR;Ovladač velkokapacitního paměťového zařízení USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-14 26368]
S3 usbvideo;Zobrazovací zařízení USB (WDM); C:\WINDOWS\System32\Drivers\usbvideo.sys [2013-07-17 123008]
S3 WSTCODEC;Dálnopisný kodek světového standardu; C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS [2008-04-14 19200]
S4 adpu320;adpu320; C:\WINDOWS\system32\DRIVERS\adpu320.sys [2002-05-09 105472]
S4 Symmpi;Symmpi; C:\WINDOWS\system32\DRIVERS\symmpi.sys [2002-04-04 28416]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 avast! Antivirus;Avast Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [2016-04-24 243296]
S2 gupdate;Služba Google Update (gupdate); C:\Program Files\Google\Update\GoogleUpdate.exe [2016-02-26 154440]
S2 SkypeUpdate;Skype Updater; C:\Program Files\Skype\Updater\Updater.exe [2015-07-09 327296]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service; C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2016-04-22 269504]
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2008-07-25 34312]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; c:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; c:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104]
S3 gupdatem;Služba Google Update (gupdatem); C:\Program Files\Google\Update\GoogleUpdate.exe [2016-02-26 154440]
S3 hpqwmi;HP WMI Interface; C:\Program Files\HPQ\Shared\hpqwmi.exe [2005-10-04 94208]
S3 idsvc;Windows CardSpace; c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664]
S3 MozillaMaintenance;Mozilla Maintenance Service; C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe [2016-02-13 146888]
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2008-07-29 132096]

-----------------EOF-----------------

Zdravím, vypadá v kondici - jen trochu zkontrolujeme

Stáhni AdwCleaner http://general-changelog-team.fr/fr/dow ... adwcleaner
Ulož nejlépe na plochu -> ukonči všechny programy -> spusť AdwCleaner -> klikni na Scan po dokončení na Cleaning
bude provedena oprava, restartuje se - (případně restartuj) a vypadne log C:\AdwCleaner\AdwCleaner[C?].txt , jeho obsah vložíš sem

Stáhni a nainstaluj MBAM zde http://www.bleepingcomputer.com/downloa ... re/dl/241/ verzi 1.75
Při instalaci ti jako první nabídne instalaci nové verze (případně i při spuštění) - dáš Storno - bude aktualizována jen databáze
Po instalaci Spustit -> na 1.záložce "Kontrolor" -> Úplná kontrola -> Prohledat
po dokončení scanu vyskočí okno Notepad s výsledkem - obsah zkopíruj do své odpovědi
zatím nic nemazat - počkej na posouzení a program nezavírej, jen minimalizuj

takže nejdřív ten ADW:

# AdwCleaner v5.113 - Log soubor vytvořen 25/04/2016 o 15:09:10
# Aktualizováno 24/04/2016 by Xplode
# Databáze : 2016-04-24.3 [Server]
# Operační systém : Microsoft Windows XP Service Pack 3 (X86)
# Jméno uživatele : Administrator - HP66811255121
# Spuštěno z : C:\Documents and Settings\Administrator\Dokumenty\Downloads\adwcleaner_5.113.exe
# Volba : Čištění
# Podpora : http://toolslib.net/forum

***** [ Služby ] *****


***** [ Složky ] *****

[-] Složka smazáno : C:\Documents and Settings\All Users\Data aplikací\LuckyBrowse
[-] Složka smazáno : C:\Program Files\TData

***** [ Soubory ] *****

[-] Soubor smazáno : C:\Documents and Settings\All Users\Data aplikací\{262E20B8-6E20-4CEF-B1FD-D022AB1085F5}.dat

***** [ DLLs ] *****


***** [ Zástupci ] *****

[-] Zástupce odvirováno : C:\Documents and Settings\All Users\Nabídka Start\Programy\Mozilla Firefox.lnk

***** [ Naplánované úkoly ] *****

[-] Úkol smazáno : IQA

***** [ Registr ] *****

[-] Hodnota smazáno : HKLM\SOFTWARE\Mozilla\Firefox\Extensions [deskCutv2@gmail.com]
[-] Klávesa smazáno : HKCU\Software\Google\Chrome\Extensions\fcfenmboojpjinhpgggodefccipikbpd
[-] Klávesa smazáno : HKLM\SOFTWARE\Classes\CLSID\{F83D1872-D9FF-47F8-B5A0-49CC51E24EE8}
[-] Klávesa smazáno : HKCU\Software\Mozilla\Extends
[-] Klávesa smazáno : HKLM\SOFTWARE\hdcode
[-] Klávesa smazáno : HKLM\SOFTWARE\LuckyBrowse
[-] Klávesa smazáno : HKLM\SOFTWARE\TData
[-] Klávesa smazáno : HKLM\SOFTWARE\TSv
[-] Klávesa smazáno : HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\InternetQuickAccess
[-] Klávesa smazáno : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\InternetQuickAccess
[-] Hodnota smazáno : HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List [C:\Program Files\LuckyBrowse\app\LuckyBrowse.exe]
[-] Hodnota smazáno : HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List [C:\Program Files\SpringFiles\SprgFiles.exe]
[-] Data Obnoveno : HKLM\SOFTWARE\Clients\StartMenuInternet\IEXPLORE.EXE\shell\open\command []
[-] Data Obnoveno : HKLM\SOFTWARE\Clients\StartMenuInternet\FIREFOX.EXE\shell\open\command []

***** [ Webové prohlížeče ] *****


*************************

:: "Tracing" odstraněných kláves
:: Nastavení Winsock odstraněno

*************************

C:\AdwCleaner\AdwCleaner[C1].txt - [2513 bytes] - [25/04/2016 15:09:10]
C:\AdwCleaner\AdwCleaner[S1].txt - [3404 bytes] - [25/04/2016 15:06:49]

########## EOF - C:\AdwCleaner\AdwCleaner[C1].txt - [2659 bytes] ##########

a ještě MBAM:

Malwarebytes Anti-Malware (Zkušební verze Malwarebytes Anti-Malware.) 1.75.0.1300
www.malwarebytes.org

Verze: v2016.04.25.02

Windows XP Service Pack 3 x86 NTFS
Internet Explorer 8.0.6001.18702
Administrator :: HP66811255121 [administrátor]

Ochrana: Povolena

25.4.2016 15:18:55
MBAM-log-2016-04-25 (16-22-00).txt

Typ: Kompletní kontrola (C:\|)
Nastavení kontroly povoleno: Paměť | Po spuštění | Registr | Systémové soubory | Heuristická analýza Extra | Heuristická analýza Shuriken | PUP | PUM
Nastavení kontroly zakázáno: P2P
Kontrolované objekty: 328219
Uplynulý čas: 1 hodin, 1 minut, 51 sekund

Nalezené procesy v paměti: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené moduly v paměti: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené klíče v registru: 3
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SETUP.EXE (PUP.Optional.Imali) -> Nebyla provedena žádná instrukce.
HKLM\SOFTWARE\Clients\StartMenuInternet\Internet Quick Access.RYDKJI4XNSDISXC65JW64A4K6U (PUP.Optional.InternetQuickAccess) -> Nebyla provedena žádná instrukce.
HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Application\WdMan (PUP.Optional.Elex) -> Nebyla provedena žádná instrukce.

Nalezené hodnoty v registru: 2
HKLM\SOFTWARE\Policies\Chromium\ExtensionInstallSources|1 (PUP.Optional.InternetQuickAccess) -> Data: http://ext.internetquickaccess.com/* -> Nebyla provedena žádná instrukce.
HKLM\SOFTWARE\RegisteredApplications|Internet Quick Access.RYDKJI4XNSDISXC65JW64A4K6U (PUP.Optional.InternetQuickAccess) -> Data: Software\Clients\StartMenuInternet\Internet Quick Access.RYDKJI4XNSDISXC65JW64A4K6U\Capabilities -> Nebyla provedena žádná instrukce.

Nalezené datové položky v registru: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené složky: 2
C:\Documents and Settings\Administrator\Nabídka Start\Programy\Internet Quick Access (PUP.Optional.InternetQuickAccess) -> Nebyla provedena žádná instrukce.
C:\Documents and Settings\Administrator\Data aplikací\SpringFiles (PUP.Optional.SpringFiles) -> Nebyla provedena žádná instrukce.

Nalezené soubory: 93
c:\documents and settings\administrator\data aplikací\server.exe (Backdoor.Agent.FR1Gen) -> Nebyla provedena žádná instrukce.
C:\Documents and Settings\Administrator\Local Settings\Data aplikací\Chromium\Application\chrome.exe (PUP.Optional.InternetQuickAccess) -> Nebyla provedena žádná instrukce.
C:\Documents and Settings\Administrator\Local Settings\Data aplikací\Chromium\Application\45.0.2433.0\Installer\setup.exe (PUP.Optional.Imali) -> Nebyla provedena žádná instrukce.
C:\Documents and Settings\Administrator\Plocha\Stažené soubory\winzip16-32.exe (PUP.Optional.Conduit) -> Nebyla provedena žádná instrukce.
C:\AdwCleaner\FileQuarantine\C\Program Files\TData\Raydld.exe.vir (PUP.Optional.Elex) -> Nebyla provedena žádná instrukce.
c:\system volume information\_restore{eae0b337-6eff-4e83-916b-17b10367ccd1}\rp522\a0078179.exe (Backdoor.Agent.FR1Gen) -> Nebyla provedena žádná instrukce.
c:\system volume information\_restore{eae0b337-6eff-4e83-916b-17b10367ccd1}\rp529\a0081346.exe (PUP.Optional.Yontoo) -> Nebyla provedena žádná instrukce.
c:\system volume information\_restore{eae0b337-6eff-4e83-916b-17b10367ccd1}\rp529\a0081343.exe (PUP.Optional.Yontoo) -> Nebyla provedena žádná instrukce.
c:\system volume information\_restore{eae0b337-6eff-4e83-916b-17b10367ccd1}\rp529\a0081344.dll (PUP.Optional.Yontoo) -> Nebyla provedena žádná instrukce.
c:\system volume information\_restore{eae0b337-6eff-4e83-916b-17b10367ccd1}\rp529\a0081345.exe (PUP.Optional.Yontoo) -> Nebyla provedena žádná instrukce.
c:\system volume information\_restore{eae0b337-6eff-4e83-916b-17b10367ccd1}\rp529\a0081371.exe (PUP.Optional.BrowseFox) -> Nebyla provedena žádná instrukce.
c:\system volume information\_restore{eae0b337-6eff-4e83-916b-17b10367ccd1}\rp529\a0081372.dll (PUP.Optional.Yontoo) -> Nebyla provedena žádná instrukce.
c:\system volume information\_restore{eae0b337-6eff-4e83-916b-17b10367ccd1}\rp530\a0081374.exe (PUP.Optional.Yontoo) -> Nebyla provedena žádná instrukce.
c:\system volume information\_restore{eae0b337-6eff-4e83-916b-17b10367ccd1}\rp530\a0081375.exe (PUP.Optional.Yontoo) -> Nebyla provedena žádná instrukce.
c:\system volume information\_restore{eae0b337-6eff-4e83-916b-17b10367ccd1}\rp530\a0081376.exe (PUP.Optional.Yontoo) -> Nebyla provedena žádná instrukce.
c:\system volume information\_restore{eae0b337-6eff-4e83-916b-17b10367ccd1}\rp530\a0081377.exe (PUP.Optional.Yontoo) -> Nebyla provedena žádná instrukce.
c:\system volume information\_restore{eae0b337-6eff-4e83-916b-17b10367ccd1}\rp530\a0081378.exe (PUP.Optional.Yontoo) -> Nebyla provedena žádná instrukce.
c:\system volume information\_restore{eae0b337-6eff-4e83-916b-17b10367ccd1}\rp530\a0081379.exe (PUP.Optional.Yontoo) -> Nebyla provedena žádná instrukce.
C:\System Volume Information\_restore{EAE0B337-6EFF-4E83-916B-17B10367CCD1}\RP530\A0081380.exe (PUP.Optional.BrowseFox) -> Nebyla provedena žádná instrukce.
c:\system volume information\_restore{eae0b337-6eff-4e83-916b-17b10367ccd1}\rp530\a0081381.exe (PUP.Optional.Yontoo) -> Nebyla provedena žádná instrukce.
c:\system volume information\_restore{eae0b337-6eff-4e83-916b-17b10367ccd1}\rp530\a0081382.dll (PUP.Optional.Yontoo) -> Nebyla provedena žádná instrukce.
c:\system volume information\_restore{eae0b337-6eff-4e83-916b-17b10367ccd1}\rp530\a0081383.dll (PUP.Optional.Yontoo) -> Nebyla provedena žádná instrukce.
c:\system volume information\_restore{eae0b337-6eff-4e83-916b-17b10367ccd1}\rp530\a0081385.exe (PUP.Optional.Yontoo) -> Nebyla provedena žádná instrukce.
c:\system volume information\_restore{eae0b337-6eff-4e83-916b-17b10367ccd1}\rp530\a0082212.exe (PUP.Optional.BrowseFox) -> Nebyla provedena žádná instrukce.
c:\system volume information\_restore{eae0b337-6eff-4e83-916b-17b10367ccd1}\rp530\a0082213.dll (PUP.Optional.Yontoo) -> Nebyla provedena žádná instrukce.
C:\System Volume Information\_restore{EAE0B337-6EFF-4E83-916B-17B10367CCD1}\RP530\A0082218.exe (PUP.Optional.Yontoo) -> Nebyla provedena žádná instrukce.
c:\system volume information\_restore{eae0b337-6eff-4e83-916b-17b10367ccd1}\rp530\a0082219.exe (PUP.Optional.Yontoo) -> Nebyla provedena žádná instrukce.
c:\system volume information\_restore{eae0b337-6eff-4e83-916b-17b10367ccd1}\rp530\a0082220.exe (PUP.Optional.Yontoo) -> Nebyla provedena žádná instrukce.
c:\system volume information\_restore{eae0b337-6eff-4e83-916b-17b10367ccd1}\rp530\a0082221.exe (PUP.Optional.Yontoo) -> Nebyla provedena žádná instrukce.
C:\System Volume Information\_restore{EAE0B337-6EFF-4E83-916B-17B10367CCD1}\RP530\A0082222.exe (PUP.Optional.BrowseFox) -> Nebyla provedena žádná instrukce.
c:\system volume information\_restore{eae0b337-6eff-4e83-916b-17b10367ccd1}\rp530\a0082223.dll (PUP.Optional.Yontoo) -> Nebyla provedena žádná instrukce.
C:\System Volume Information\_restore{EAE0B337-6EFF-4E83-916B-17B10367CCD1}\RP530\A0082225.exe (PUP.Optional.Yontoo) -> Nebyla provedena žádná instrukce.
c:\system volume information\_restore{eae0b337-6eff-4e83-916b-17b10367ccd1}\rp530\a0082226.exe (PUP.Optional.Yontoo) -> Nebyla provedena žádná instrukce.
c:\system volume information\_restore{eae0b337-6eff-4e83-916b-17b10367ccd1}\rp530\a0082227.exe (PUP.Optional.Yontoo) -> Nebyla provedena žádná instrukce.
C:\System Volume Information\_restore{EAE0B337-6EFF-4E83-916B-17B10367CCD1}\RP530\A0082228.dll (PUP.Optional.Yontoo) -> Nebyla provedena žádná instrukce.
c:\system volume information\_restore{eae0b337-6eff-4e83-916b-17b10367ccd1}\rp530\a0082229.exe (PUP.Optional.Yontoo) -> Nebyla provedena žádná instrukce.
c:\system volume information\_restore{eae0b337-6eff-4e83-916b-17b10367ccd1}\rp531\a0082230.exe (PUP.Optional.Yontoo) -> Nebyla provedena žádná instrukce.
c:\system volume information\_restore{eae0b337-6eff-4e83-916b-17b10367ccd1}\rp531\a0082231.exe (PUP.Optional.Yontoo) -> Nebyla provedena žádná instrukce.
c:\system volume information\_restore{eae0b337-6eff-4e83-916b-17b10367ccd1}\rp531\a0082232.exe (PUP.Optional.Yontoo) -> Nebyla provedena žádná instrukce.
c:\system volume information\_restore{eae0b337-6eff-4e83-916b-17b10367ccd1}\rp531\a0082234.exe (PUP.Optional.Yontoo) -> Nebyla provedena žádná instrukce.
c:\system volume information\_restore{eae0b337-6eff-4e83-916b-17b10367ccd1}\rp531\a0083207.exe (PUP.Optional.Yontoo) -> Nebyla provedena žádná instrukce.
C:\System Volume Information\_restore{EAE0B337-6EFF-4E83-916B-17B10367CCD1}\RP531\A0083209.exe (PUP.Optional.Yontoo) -> Nebyla provedena žádná instrukce.
c:\system volume information\_restore{eae0b337-6eff-4e83-916b-17b10367ccd1}\rp531\a0083210.exe (PUP.Optional.Yontoo) -> Nebyla provedena žádná instrukce.
c:\system volume information\_restore{eae0b337-6eff-4e83-916b-17b10367ccd1}\rp531\a0083211.exe (PUP.Optional.Yontoo) -> Nebyla provedena žádná instrukce.
c:\system volume information\_restore{eae0b337-6eff-4e83-916b-17b10367ccd1}\rp531\a0083212.exe (PUP.Optional.Yontoo) -> Nebyla provedena žádná instrukce.
c:\system volume information\_restore{eae0b337-6eff-4e83-916b-17b10367ccd1}\rp531\a0083213.dll (PUP.Optional.Yontoo) -> Nebyla provedena žádná instrukce.
c:\system volume information\_restore{eae0b337-6eff-4e83-916b-17b10367ccd1}\rp531\a0083215.dll (PUP.Optional.Yontoo) -> Nebyla provedena žádná instrukce.
c:\system volume information\_restore{eae0b337-6eff-4e83-916b-17b10367ccd1}\rp531\a0083216.exe (PUP.Optional.Yontoo) -> Nebyla provedena žádná instrukce.
c:\system volume information\_restore{eae0b337-6eff-4e83-916b-17b10367ccd1}\rp531\a0083217.exe (PUP.Optional.Yontoo) -> Nebyla provedena žádná instrukce.
c:\system volume information\_restore{eae0b337-6eff-4e83-916b-17b10367ccd1}\rp531\a0083218.exe (PUP.Optional.Yontoo) -> Nebyla provedena žádná instrukce.
c:\system volume information\_restore{eae0b337-6eff-4e83-916b-17b10367ccd1}\rp531\a0083224.exe (PUP.Optional.Yontoo) -> Nebyla provedena žádná instrukce.
c:\system volume information\_restore{eae0b337-6eff-4e83-916b-17b10367ccd1}\rp531\a0083225.exe (PUP.Optional.Yontoo) -> Nebyla provedena žádná instrukce.
c:\system volume information\_restore{eae0b337-6eff-4e83-916b-17b10367ccd1}\rp531\a0083227.exe (PUP.Optional.Yontoo) -> Nebyla provedena žádná instrukce.
c:\system volume information\_restore{eae0b337-6eff-4e83-916b-17b10367ccd1}\rp531\a0083228.dll (PUP.Optional.Yontoo) -> Nebyla provedena žádná instrukce.
c:\system volume information\_restore{eae0b337-6eff-4e83-916b-17b10367ccd1}\rp531\a0083229.exe (PUP.Optional.Yontoo) -> Nebyla provedena žádná instrukce.
c:\system volume information\_restore{eae0b337-6eff-4e83-916b-17b10367ccd1}\rp531\a0083230.exe (PUP.Optional.Yontoo) -> Nebyla provedena žádná instrukce.
c:\system volume information\_restore{eae0b337-6eff-4e83-916b-17b10367ccd1}\rp531\a0084259.exe (PUP.Optional.Yontoo) -> Nebyla provedena žádná instrukce.
c:\system volume information\_restore{eae0b337-6eff-4e83-916b-17b10367ccd1}\rp531\a0084260.exe (PUP.Optional.Yontoo) -> Nebyla provedena žádná instrukce.
c:\system volume information\_restore{eae0b337-6eff-4e83-916b-17b10367ccd1}\rp531\a0084261.exe (PUP.Optional.Yontoo) -> Nebyla provedena žádná instrukce.
c:\system volume information\_restore{eae0b337-6eff-4e83-916b-17b10367ccd1}\rp531\a0084262.exe (PUP.Optional.Yontoo) -> Nebyla provedena žádná instrukce.
c:\system volume information\_restore{eae0b337-6eff-4e83-916b-17b10367ccd1}\rp531\a0084263.exe (PUP.Optional.Yontoo) -> Nebyla provedena žádná instrukce.
c:\system volume information\_restore{eae0b337-6eff-4e83-916b-17b10367ccd1}\rp531\a0084264.exe (PUP.Optional.BrowseFox) -> Nebyla provedena žádná instrukce.
c:\system volume information\_restore{eae0b337-6eff-4e83-916b-17b10367ccd1}\rp531\a0084265.dll (PUP.Optional.Yontoo) -> Nebyla provedena žádná instrukce.
c:\system volume information\_restore{eae0b337-6eff-4e83-916b-17b10367ccd1}\rp531\a0083208.exe (PUP.Optional.BrowseFox) -> Nebyla provedena žádná instrukce.
C:\System Volume Information\_restore{EAE0B337-6EFF-4E83-916B-17B10367CCD1}\RP531\A0083226.exe (PUP.Optional.Yontoo) -> Nebyla provedena žádná instrukce.
c:\system volume information\_restore{eae0b337-6eff-4e83-916b-17b10367ccd1}\rp531\a0084266.exe (PUP.Optional.Yontoo) -> Nebyla provedena žádná instrukce.
c:\system volume information\_restore{eae0b337-6eff-4e83-916b-17b10367ccd1}\rp531\a0084267.exe (PUP.Optional.Yontoo) -> Nebyla provedena žádná instrukce.
c:\system volume information\_restore{eae0b337-6eff-4e83-916b-17b10367ccd1}\rp531\a0084268.dll (PUP.Optional.Yontoo) -> Nebyla provedena žádná instrukce.
c:\system volume information\_restore{eae0b337-6eff-4e83-916b-17b10367ccd1}\rp531\a0084300.exe (PUP.Optional.Yontoo) -> Nebyla provedena žádná instrukce.
C:\System Volume Information\_restore{EAE0B337-6EFF-4E83-916B-17B10367CCD1}\RP531\A0084325.exe (PUP.Optional.Yontoo) -> Nebyla provedena žádná instrukce.
c:\system volume information\_restore{eae0b337-6eff-4e83-916b-17b10367ccd1}\rp531\a0084326.exe (PUP.Optional.Yontoo) -> Nebyla provedena žádná instrukce.
c:\system volume information\_restore{eae0b337-6eff-4e83-916b-17b10367ccd1}\rp531\a0084327.dll (PUP.Optional.Yontoo) -> Nebyla provedena žádná instrukce.
c:\system volume information\_restore{eae0b337-6eff-4e83-916b-17b10367ccd1}\rp531\a0084328.exe (PUP.Optional.Yontoo) -> Nebyla provedena žádná instrukce.
C:\System Volume Information\_restore{EAE0B337-6EFF-4E83-916B-17B10367CCD1}\RP534\A0084711.exe (PUP.Optional.BrowseFox) -> Nebyla provedena žádná instrukce.
c:\system volume information\_restore{eae0b337-6eff-4e83-916b-17b10367ccd1}\rp534\a0084701.exe (PUP.Optional.Yontoo) -> Nebyla provedena žádná instrukce.
C:\System Volume Information\_restore{EAE0B337-6EFF-4E83-916B-17B10367CCD1}\RP534\A0084702.exe (PUP.Optional.Yontoo) -> Nebyla provedena žádná instrukce.
c:\system volume information\_restore{eae0b337-6eff-4e83-916b-17b10367ccd1}\rp534\a0084703.dll (PUP.Optional.Yontoo) -> Nebyla provedena žádná instrukce.
c:\system volume information\_restore{eae0b337-6eff-4e83-916b-17b10367ccd1}\rp534\a0084704.exe (PUP.Optional.Yontoo) -> Nebyla provedena žádná instrukce.
C:\System Volume Information\_restore{EAE0B337-6EFF-4E83-916B-17B10367CCD1}\RP534\A0084705.exe (PUP.Optional.Yontoo) -> Nebyla provedena žádná instrukce.
C:\System Volume Information\_restore{EAE0B337-6EFF-4E83-916B-17B10367CCD1}\RP534\A0084706.exe (PUP.Optional.Yontoo) -> Nebyla provedena žádná instrukce.
c:\system volume information\_restore{eae0b337-6eff-4e83-916b-17b10367ccd1}\rp534\a0084707.dll (PUP.Optional.Yontoo) -> Nebyla provedena žádná instrukce.
c:\system volume information\_restore{eae0b337-6eff-4e83-916b-17b10367ccd1}\rp534\a0084709.exe (PUP.Optional.Yontoo) -> Nebyla provedena žádná instrukce.
c:\system volume information\_restore{eae0b337-6eff-4e83-916b-17b10367ccd1}\rp534\a0084710.exe (PUP.Optional.Yontoo) -> Nebyla provedena žádná instrukce.
c:\system volume information\_restore{eae0b337-6eff-4e83-916b-17b10367ccd1}\rp534\a0084712.exe (PUP.Optional.Yontoo) -> Nebyla provedena žádná instrukce.
C:\System Volume Information\_restore{EAE0B337-6EFF-4E83-916B-17B10367CCD1}\RP540\A0092163.exe (PUP.Optional.Elex) -> Nebyla provedena žádná instrukce.
C:\System Volume Information\_restore{EAE0B337-6EFF-4E83-916B-17B10367CCD1}\RP540\A0092167.exe (PUP.Optional.Elex) -> Nebyla provedena žádná instrukce.
C:\System Volume Information\_restore{EAE0B337-6EFF-4E83-916B-17B10367CCD1}\RP541\A0093090.exe (PUP.Optional.Elex) -> Nebyla provedena žádná instrukce.
c:\system volume information\_restore{eae0b337-6eff-4e83-916b-17b10367ccd1}\rp541\a0093140.exe (Backdoor.Agent.FR1Gen) -> Nebyla provedena žádná instrukce.
C:\WINDOWS\system32\_tWm\ray.exe (PUP.Optional.Elex) -> Nebyla provedena žádná instrukce.
C:\Documents and Settings\Administrator\Data aplikací\Server.exe.tmp (Trojan.Agent.Gen) -> Nebyla provedena žádná instrukce.
C:\Documents and Settings\Administrator\Local Settings\Data aplikací\Google\Chrome\User Data\Default\Local Storage\chrome-extension_jiblfdgfgcnpigdkdincmfamoknecagc_0.localstorage (PUP.Optional.MindSpark) -> Nebyla provedena žádná instrukce.
C:\Documents and Settings\Administrator\Nabídka Start\Programy\Internet Quick Access\Internet Quick Access.lnk (PUP.Optional.InternetQuickAccess) -> Nebyla provedena žádná instrukce.
C:\Documents and Settings\Administrator\Data aplikací\Microsoft\Internet Explorer\Quick Launch\Internet Quick Access.lnk (PUP.Optional.InternetQuickAccess) -> Nebyla provedena žádná instrukce.

(konec)

v MBAM vše smazat/odstranit
pak nová kotrola - stačí rychlá

Spusť znovu ADWCleaner a dej "Odinstaovat"

ještě nějaký problém?

dej mi aktuální RSIT

Tak problém vysloveně nebyl. A ani snad není.. jen při tom čekání na odpověď jsem tedy nechal PC běžet s otevřeným MBAMem a on mezitím zamrzl celý PC. Po restartu mi našel "jen" 38 šmejdů, předtím kolem devadesátky (viz log ).. tak jsem mu i přesto dal tedy vše odstranit...

Takže tedy ten RSIT:

Logfile of random's system information tool 1.10 (written by random/random)
Run by Administrator at 2016-04-26 16:13:24
Systém Microsoft Windows XP Professional Service Pack 3
System drive C: has 59 GB (78%) free of 76 GB
Total RAM: 1527 MB (50% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 16:13:26, on 26.4.2016
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\AVAST Software\Avast\AvastSvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\AVAST Software\Avast\AvastUI.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\wbem\unsecapp.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Administrator\Plocha\RSIT.exe
C:\Program Files\trend micro\Administrator.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://www.seznam.cz/?clid=22668
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://search.seznam.cz/?sourceid=quick ... earchTerms}
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.seznam.cz/?clid=22668
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = https://www.seznam.cz/?clid=22668
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://search.seznam.cz/?sourceid=quick ... earchTerms}
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.seznam.cz/?clid=22668
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
O2 - BHO: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [Zástupce stránky vlastností sběrnice High Definition Audio] HDAShCut.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [PTHOSTTR] C:\Program Files\HPQ\HP ProtectTools Security Manager\PTHOSTTR.EXE /Start
O4 - HKLM\..\Run: [SetRefresh] C:\Program Files\Compaq\SetRefresh\SetRefresh.exe
O4 - HKLM\..\Run: [LayoutM] KLayMgr.exe
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [AvastUI.exe] "C:\Program Files\AVAST Software\Avast\AvastUI.exe" /nogui
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microso ... 2453731750
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Proces mezipaměti kategorií součástí - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: Avast Antivirus (avast! Antivirus) - AVAST Software - C:\Program Files\AVAST Software\Avast\AvastSvc.exe
O23 - Service: Služba Google Update (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Služba Google Update (gupdatem) (gupdatem) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: HP WMI Interface (hpqwmi) - Hewlett-Packard Development Company, L.P. - C:\Program Files\HPQ\Shared\hpqwmi.exe
O23 - Service: MBAMScheduler - Malwarebytes Corporation - C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe
O23 - Service: MBAMService - Malwarebytes Corporation - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe
O23 - Service: Skype Updater (SkypeUpdate) - Skype Technologies - C:\Program Files\Skype\Updater\Updater.exe

--
End of file - 5447 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\Adobe Flash Player PPAPI Notifier.job - C:\WINDOWS\system32\Macromed\Flash\FlashUtil32_21_0_0_213_pepper.exe -check pepperplugin
C:\WINDOWS\tasks\Adobe Flash Player Updater.job - C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe
C:\WINDOWS\tasks\avast! Emergency Update.job - C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe
C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job - C:\Program Files\Google\Update\GoogleUpdate.exe /c
C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job - C:\Program Files\Google\Update\GoogleUpdate.exe /ua /installsource scheduler
C:\WINDOWS\tasks\Měsíční oznamování konce poskytování služeb pro Microsoft Windows XP.job - C:\WINDOWS\system32\xp_eos.exe
C:\WINDOWS\tasks\Přihlášení k oznamování konce poskytování služeb pro Microsoft Windows XP.job - C:\WINDOWS\system32\xp_eos.exe -c

=========Mozilla firefox=========

ProfilePath - C:\Documents and Settings\Administrator\Data aplikací\Mozilla\Firefox\Profiles\b24rb83c.default

prefs.js - "browser.search.useDBForOrder" - true
prefs.js - "browser.startup.homepage" - "https://www.seznam.cz/"

"{20a82645-c095-46ed-80e3-08825760534b}"=c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
"wrc@avast.com"=C:\Program Files\AVAST Software\Avast\WebRep\FF


[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 21.0.0.213 Plugin
"Path"=C:\WINDOWS\system32\Macromed\Flash\NPSWF32_21_0_0_213.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/WPF,version=3.5]
"Description"=Windows Presentation Foundation plug-in for Mozilla browsers
"Path"=c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@tools.google.com/Google Update;version=3]
"Description"=Google Update
"Path"=C:\Program Files\Google\Update\1.3.29.5\npGoogleUpdate3.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@tools.google.com/Google Update;version=9]
"Description"=Google Update
"Path"=C:\Program Files\Google\Update\1.3.29.5\npGoogleUpdate3.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@videolan.org/vlc,version=2.0.2]
"Description"=VLC Multimedia Plugin
"Path"=C:\Program Files\VideoLAN\VLC\npvlc.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@videolan.org/vlc,version=2.2.1]
"Description"=VLC Multimedia Plugin
"Path"=C:\Program Files\VideoLAN\VLC\npvlc.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@videolan.org/vlc,version=2.2.2]
"Description"=VLC Multimedia Plugin
"Path"=C:\Program Files\VideoLAN\VLC\npvlc.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\Adobe Reader]
"Description"=Handles PDFs in-place in Firefox
"Path"=C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll


C:\Documents and Settings\Administrator\Data aplikací\Mozilla\Firefox\Profiles\b24rb83c.default\searchplugins\
bing-.xml
default.xml

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8E5E2654-AD2D-48bf-AC2D-D17F00898D06}]
avast! Online Security - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll [2016-04-24 679680]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"=C:\WINDOWS\system32\igfxtray.exe [2005-04-05 94208]
"HotKeysCmds"=C:\WINDOWS\system32\hkcmd.exe [2005-04-05 77824]
"Persistence"=C:\WINDOWS\system32\igfxpers.exe [2005-04-05 114688]
"Zástupce stránky vlastností sběrnice High Definition Audio"=C:\WINDOWS\system32\HDAShCut.exe [2005-01-07 61952]
"RTHDCPL"=C:\WINDOWS\RTHDCPL.EXE [2005-03-08 13924864]
"PTHOSTTR"=C:\Program Files\HPQ\HP ProtectTools Security Manager\PTHOSTTR.EXE [2005-10-04 86016]
"SetRefresh"=C:\Program Files\Compaq\SetRefresh\SetRefresh.exe [2003-11-20 525824]
"LayoutM"=C:\WINDOWS\KLayMgr.exe [2004-08-16 45056]
"Adobe ARM"=C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2015-06-12 998088]
"AvastUI.exe"=C:\Program Files\AVAST Software\Avast\AvastUI.exe [2016-04-24 7390608]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"=C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
C:\WINDOWS\system32\igfxdev.dll [2005-04-05 131072]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon]
C:\WINDOWS\system32\WgaLogon.dll [2009-03-10 265096]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Wdf01000.sys]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
"SoftwareSASGeneration"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\Cross Racing Championship\crc.exe"="C:\Program Files\Cross Racing Championship\crc.exe:*:Enabled:Cross Racing Championship 2005"
"C:\Program Files\TrackMania Sunrise\TmSunrise.exe"="C:\Program Files\TrackMania Sunrise\TmSunrise.exe:*:Enabled:TmSunrise"
"C:\Program Files\Java\jre1.5.0\bin\javaw.exe"="C:\Program Files\Java\jre1.5.0\bin\javaw.exe:*:Enabled:Java(TM) 2 Platform Standard Edition binary"
"C:\Program Files\Mozilla Firefox\firefox.exe"="C:\Program Files\Mozilla Firefox\firefox.exe:*:Enabled:Firefox (C:\Program Files\Mozilla Firefox)"
"C:\Program Files\Skype\Phone\Skype.exe"="C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype"
"C:\Program Files\Valve\hl.exe"="C:\Program Files\Valve\hl.exe:*:Disabled:Half-Life Launcher"
"C:\WarThunder\win64\aces.exe"="C:\WarThunder\win64\aces.exe:*:Enabled:War Thunder Game Client"
"C:\WarThunder\bpreport.exe"="C:\WarThunder\bpreport.exe:*:Enabled:War Thunder Crash Reporter"
"C:\Documents and Settings\Administrator\Local Settings\Data aplikací\Chromium\Application\chrome.exe"="C:\Documents and Settings\Administrator\Local Settings\Data aplikací\Chromium\Application\chrome.exe:*:Enabled:Internet Quick Access"
"C:\Program Files\SpringFiles\downloader.exe"="C:\Program Files\SpringFiles\downloader.exe:*:Enabled:SpringFiles"
"C:\Program Files\Google\Chrome\Application\chrome.exe"="C:\Program Files\Google\Chrome\Application\chrome.exe:*:Enabled:Google Chrome"
"C:\Documents and Settings\Administrator\Data aplikací\Server.exe"="C:\Documents and Settings\Administrator\Data aplikací\Server.exe:*:Enabled:Server.exe"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"midimapper"=midimap.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msadpcm"=msadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.trspch"=tssoft32.acm
"vidc.cvid"=iccvid.dll
"VIDC.I420"=msh263.drv
"vidc.iv31"=ir32_32.dll
"vidc.iv32"=ir32_32.dll
"vidc.iv41"=ir41_32.ax
"VIDC.IYUV"=iyuv_32.dll
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"VIDC.UYVY"=msyuv.dll
"VIDC.YUY2"=msyuv.dll
"VIDC.YVU9"=tsbyuv.dll
"VIDC.YVYU"=msyuv.dll
"wavemapper"=msacm32.drv
"msacm.msg723"=msg723.acm
"vidc.M263"=msh263.drv
"vidc.M261"=msh261.drv
"msacm.msaudio1"=msaud32.acm
"msacm.sl_anet"=sl_anet.acm
"msacm.iac2"=C:\WINDOWS\system32\iac25_32.ax
"vidc.iv50"=ir50_32.dll
"msacm.l3acm"=C:\WINDOWS\system32\l3codeca.acm
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv
"MSVideo8"=VfWWDM32.dll
"wave1"=wdmaud.drv
"midi1"=wdmaud.drv
"mixer1"=wdmaud.drv
"aux1"=wdmaud.drv

======List of files/folders created in the last 1 month======

2016-04-25 15:15:10 ----D---- C:\Documents and Settings\Administrator\Data aplikací\Malwarebytes
2016-04-25 15:15:02 ----D---- C:\Documents and Settings\All Users\Data aplikací\Malwarebytes
2016-04-25 15:15:01 ----D---- C:\Program Files\Malwarebytes' Anti-Malware
2016-04-25 15:15:01 ----A---- C:\WINDOWS\system32\drivers\mbam.sys
2016-04-24 17:42:44 ----D---- C:\rsit
2016-04-24 17:42:44 ----D---- C:\Program Files\trend micro
2016-04-24 17:31:00 ----A---- C:\WINDOWS\system32\drivers\aswKbd.sys
2016-04-24 17:28:47 ----D---- C:\Documents and Settings\Administrator\Data aplikací\AVAST Software
2016-04-24 17:27:35 ----A---- C:\WINDOWS\system32\drivers\aswvmm.sys
2016-04-24 17:27:35 ----A---- C:\WINDOWS\system32\drivers\aswTdi.sys
2016-04-24 17:27:35 ----A---- C:\WINDOWS\system32\drivers\aswStmXP.sys
2016-04-24 17:27:34 ----A---- C:\WINDOWS\system32\drivers\aswSP.sys
2016-04-24 17:27:34 ----A---- C:\WINDOWS\system32\drivers\aswRvrt.sys
2016-04-24 17:27:33 ----A---- C:\WINDOWS\system32\drivers\aswMonFlt.sys
2016-04-24 17:27:33 ----A---- C:\WINDOWS\system32\drivers\aswHwid.sys
2016-04-24 17:27:32 ----A---- C:\WINDOWS\system32\drivers\aswRdr.sys
2016-04-24 17:27:31 ----A---- C:\WINDOWS\system32\drivers\aswSnx.sys
2016-04-24 17:27:20 ----A---- C:\WINDOWS\system32\aswBoot.exe
2016-04-24 17:27:12 ----A---- C:\WINDOWS\avastSS.scr
2016-04-24 17:26:18 ----D---- C:\Program Files\AVAST Software
2016-04-24 17:26:02 ----D---- C:\Documents and Settings\All Users\Data aplikací\AVAST Software
2016-04-24 17:13:49 ----D---- C:\Program Files\CCleaner
2016-04-24 16:49:01 ----SHD---- C:\Config.Msi
2016-04-22 18:56:25 ----A---- C:\WINDOWS\system32\FlashPlayerInstaller.exe

======List of files/folders modified in the last 1 month======

2016-04-26 16:13:05 ----D---- C:\WINDOWS\Prefetch
2016-04-26 16:12:12 ----D---- C:\WINDOWS\system32\drivers
2016-04-26 16:03:04 ----D---- C:\WINDOWS\system32
2016-04-26 16:03:03 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2016-04-26 15:47:47 ----A---- C:\WINDOWS\SchedLgU.Txt
2016-04-26 15:47:18 ----HDC---- C:\WINDOWS\$NtUninstallKB2820197$
2016-04-26 14:43:47 ----D---- C:\WINDOWS\Temp
2016-04-25 16:08:17 ----D---- C:\WINDOWS\system32\_tWm
2016-04-25 15:15:01 ----RD---- C:\Program Files
2016-04-25 15:09:12 ----SD---- C:\WINDOWS\Tasks
2016-04-24 17:41:55 ----D---- C:\WINDOWS\system32\CatRoot2
2016-04-24 17:40:51 ----D---- C:\WINDOWS
2016-04-24 17:29:51 ----D---- C:\WINDOWS\system32\CatRoot
2016-04-24 17:28:31 ----HD---- C:\WINDOWS\inf
2016-04-24 17:27:24 ----D---- C:\WINDOWS\WinSxS
2016-04-24 17:15:02 ----D---- C:\WINDOWS\Debug
2016-04-24 16:57:06 ----D---- C:\Documents and Settings\Administrator\Data aplikací\Skype
2016-04-24 16:49:07 ----SHD---- C:\WINDOWS\Installer
2016-04-24 16:46:40 ----D---- C:\Program Files\Common Files
2016-04-23 09:44:45 ----D---- C:\WINDOWS\system32\MRT
2016-04-23 09:38:28 ----A---- C:\WINDOWS\system32\MRT.exe
2016-04-22 18:56:29 ----A---- C:\WINDOWS\system32\FlashPlayerApp.exe

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 aswRvrt;avast! Revert; C:\WINDOWS\system32\drivers\aswRvrt.sys [2016-04-24 58776]
R0 aswVmm;avast! VM Monitor; C:\WINDOWS\system32\drivers\aswVmm.sys [2016-04-24 221368]
R0 sfdrv01a;StarForce Protection Environment Driver (version 1.x.a); C:\WINDOWS\System32\drivers\sfdrv01a.sys [2006-07-05 63352]
R0 sfhlp02;StarForce Protection Helper Driver (version 2.x); C:\WINDOWS\System32\drivers\sfhlp02.sys [2006-06-14 13680]
R0 sfsync02;StarForce Protection Synchronization Driver (version 2.x); C:\WINDOWS\System32\drivers\sfsync02.sys [2006-07-10 27032]
R0 sfvfs02;StarForce Protection VFS Driver (version 2.x); C:\WINDOWS\System32\drivers\sfvfs02.sys [2007-01-12 82296]
R1 aswKbd;aswKbd; C:\WINDOWS\system32\drivers\aswKbd.sys [2016-04-24 35096]
R1 aswRdr;aswRdr; C:\WINDOWS\system32\drivers\aswRdr.sys [2016-04-24 64272]
R1 aswSnx;aswSnx; C:\WINDOWS\system32\drivers\aswSnx.sys [2016-04-24 815792]
R1 aswSP;aswSP; C:\WINDOWS\system32\drivers\aswSP.sys [2016-04-24 449640]
R1 intelppm;Řadič procesoru Intel; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2008-04-14 40192]
R1 kbdhid;Ovladač klávesnice standardu HID; C:\WINDOWS\system32\DRIVERS\kbdhid.sys [2008-04-14 14592]
R1 WmiAcpi;Microsoft Windows Management Interface for ACPI; C:\WINDOWS\system32\DRIVERS\wmiacpi.sys [2008-04-14 8832]
R2 aswHwid;avast! HardwareID; C:\WINDOWS\system32\drivers\aswHwid.sys [2016-04-24 32792]
R2 aswMonFlt;aswMonFlt; C:\WINDOWS\system32\drivers\aswMonFlt.sys [2016-04-24 91168]
R3 AR9271;Wireless Network Adapter Service; C:\WINDOWS\system32\DRIVERS\athuw.sys [2010-01-04 1714176]
R3 aswStmXP;Avast StreamFilter Driver; C:\WINDOWS\system32\drivers\aswStmXP.sys [2016-04-24 187208]
R3 b57w2k;Broadcom NetXtreme Gigabit Ethernet; C:\WINDOWS\system32\DRIVERS\b57xp32.sys [2005-04-08 132352]
R3 HDAudBus;Ovladač Microsoft UAA pro sběrnici High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2008-04-13 144384]
R3 HidUsb;Ovladač třídy standardu HID; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-14 10368]
R3 ialm;ialm; C:\WINDOWS\system32\DRIVERS\ialmnt5.sys [2005-04-05 830684]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\WINDOWS\system32\drivers\RtkHDAud.sys [2005-03-05 2538624]
R3 mouhid;Ovladač myši standardu HID; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-10-24 12160]
R3 usbccgp;Obecný nadřazený ovladač Microsoft USB; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2013-08-09 32384]
R3 usbuhci;Ovladač Microsoft univerzálního hostitelského řadiče USB od společnosti Microsoft; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2008-04-14 20608]
R3 Wdf01000;Kernel Mode Driver Frameworks service; C:\WINDOWS\System32\Drivers\wdf01000.sys [2009-07-14 444136]
S1 P3;Ovladač procesoru Intel PentiumIII; C:\WINDOWS\system32\DRIVERS\p3.sys [2008-04-14 46592]
S3 aswTdi;aswTdi; C:\WINDOWS\system32\drivers\aswTdi.sys [2016-04-24 67216]
S3 CCDECODE;Dekodér Closed Caption; C:\WINDOWS\system32\DRIVERS\CCDECODE.sys [2008-04-14 17024]
S3 E100B;Intel(R) PRO Adapter Driver; C:\WINDOWS\system32\DRIVERS\e100b325.sys [2001-10-24 117760]
S3 HdAudAddService;Ovladač funkcí Microsoft UAA pro služby sběrnice High Definition Audio; C:\WINDOWS\system32\drivers\HdAudio.sys [2005-01-07 145920]
S3 HPKBCCID;HP Keyboard Smart Card Driver; C:\WINDOWS\system32\DRIVERS\HPKBCCID.sys [2005-08-04 48512]
S3 i81x;i81x; C:\WINDOWS\system32\DRIVERS\i81xnt5.sys [2004-08-04 161020]
S3 iAimFP0;iAimFP0; C:\WINDOWS\system32\DRIVERS\wADV01nt.sys [2004-08-04 12415]
S3 iAimFP1;iAimFP1; C:\WINDOWS\system32\DRIVERS\wADV02NT.sys [2004-08-04 12127]
S3 iAimFP2;iAimFP2; C:\WINDOWS\system32\DRIVERS\wADV05NT.sys [2004-08-04 11775]
S3 iAimFP3;iAimFP3; C:\WINDOWS\system32\DRIVERS\wSiINTxx.sys [2004-08-04 12063]
S3 iAimFP4;iAimFP4; C:\WINDOWS\system32\DRIVERS\wVchNTxx.sys [2004-08-04 19455]
S3 iAimFP5;iAimFP5; C:\WINDOWS\system32\DRIVERS\wADV07nt.sys [2004-08-04 11807]
S3 iAimFP6;iAimFP6; C:\WINDOWS\system32\DRIVERS\wADV08nt.sys [2004-08-04 11295]
S3 iAimFP7;iAimFP7; C:\WINDOWS\system32\DRIVERS\wADV09nt.sys [2004-08-04 11871]
S3 iAimTV0;iAimTV0; C:\WINDOWS\system32\DRIVERS\wATV01nt.sys [2004-08-04 29311]
S3 iAimTV1;iAimTV1; C:\WINDOWS\system32\DRIVERS\wATV02NT.sys [2004-08-04 19551]
S3 iAimTV3;iAimTV3; C:\WINDOWS\system32\DRIVERS\wATV04nt.sys [2004-08-04 33599]
S3 iAimTV4;iAimTV4; C:\WINDOWS\system32\DRIVERS\wCh7xxNT.sys [2004-08-04 23615]
S3 iAimTV5;iAimTV5; C:\WINDOWS\system32\DRIVERS\wATV10nt.sys [2004-08-04 25471]
S3 iAimTV6;iAimTV6; C:\WINDOWS\system32\DRIVERS\wATV06nt.sys [2004-08-04 22271]
S3 MBAMProtector;MBAMProtector; \??\C:\WINDOWS\system32\drivers\mbam.sys []
S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink Converter; C:\WINDOWS\system32\drivers\MSTEE.sys [2008-04-14 5504]
S3 NABTSFEC;NABTS/FEC VBI Codec; C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys [2008-04-14 85248]
S3 NdisIP;Microsoft TV/Video Connection; C:\WINDOWS\system32\DRIVERS\NdisIP.sys [2008-04-14 10880]
S3 nmwcd;Nokia USB Phone Parent Driver; C:\WINDOWS\system32\drivers\ccdcmb.sys [2011-08-17 18176]
S3 nmwcdc;Nokia USB Communication Driver; C:\WINDOWS\system32\drivers\ccdcmbo.sys [2011-08-17 23168]
S3 SLIP;BDA Slip De-Framer; C:\WINDOWS\system32\DRIVERS\SLIP.sys [2008-04-14 11136]
S3 streamip;BDA IPSink; C:\WINDOWS\system32\DRIVERS\StreamIP.sys [2008-04-14 15232]
S3 usbaudio;Ovladač zvukové karty USB (WDM); C:\WINDOWS\system32\drivers\usbaudio.sys [2013-07-17 60160]
S3 usbscan;Ovladač skeneru USB; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2013-07-03 14976]
S3 USBSTOR;Ovladač velkokapacitního paměťového zařízení USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-14 26368]
S3 usbvideo;Zobrazovací zařízení USB (WDM); C:\WINDOWS\System32\Drivers\usbvideo.sys [2013-07-17 123008]
S3 WSTCODEC;Dálnopisný kodek světového standardu; C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS [2008-04-14 19200]
S4 adpu320;adpu320; C:\WINDOWS\system32\DRIVERS\adpu320.sys [2002-05-09 105472]
S4 Symmpi;Symmpi; C:\WINDOWS\system32\DRIVERS\symmpi.sys [2002-04-04 28416]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 avast! Antivirus;Avast Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [2016-04-24 243296]
S2 gupdate;Služba Google Update (gupdate); C:\Program Files\Google\Update\GoogleUpdate.exe [2016-02-26 154440]
S2 MBAMService;MBAMService; C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe [2013-04-04 701512]
S2 MBAMScheduler;MBAMScheduler; C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe [2013-04-04 418376]
S2 SkypeUpdate;Skype Updater; C:\Program Files\Skype\Updater\Updater.exe [2015-07-09 327296]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service; C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2016-04-22 269504]
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2008-07-25 34312]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; c:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; c:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104]
S3 gupdatem;Služba Google Update (gupdatem); C:\Program Files\Google\Update\GoogleUpdate.exe [2016-02-26 154440]
S3 hpqwmi;HP WMI Interface; C:\Program Files\HPQ\Shared\hpqwmi.exe [2005-10-04 94208]
S3 idsvc;Windows CardSpace; c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664]
S3 MozillaMaintenance;Mozilla Maintenance Service; C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe [2016-02-13 146888]
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2008-07-29 132096]

-----------------EOF-----------------

Většina těch nálezů MBAM byla v bodech obnovení (stejně se pokusíme je smazat)
můžeš ho odinstalovat http://www.malwarebytes.org/mbam-clean.exe nebo nechat na občasnou kontrolu

Stáhni OTM z jednoho odkazu a rozbal nejlépe na plochu.
http://oldtimer.geekstogo.com/OTM.exe
http://www.itxassociates.com/OT-Tools/OTM.exe

Spusť program „OTM.exe“
Do okna pod žlutou čáru vlož celý text zeleným písmem ze „Scriptu“

Klikni na červené „MoveIt!“

Při nabídce restartu „YES“
a log potom najdeš v C:\_OTM\MovedFiles\ - dej mi ho sem na kontrolu

Script OTM Máš tam Ccleaner - nastartuj ho
zavřít Internetový prohlížeč a
spustit "Čistič" > "Spustit Ccleaner" - odstraní nepotřebné
spustit "Registry" > "Hledej problémy" > "Opravit vybrané problémy"
souhlas se zálohou registrů - opakovat dokud nebudou registry čisté.
Návod:http://jnp.zive.cz/Clanky/Prirucka-do-k ... fault.aspx

ok, tu je log z otm:

All processes killed
========== COMMANDS ==========
C:\WINDOWS\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully

[EMPTYTEMP]

User: Administrator
->Temp folder emptied: 6187150 bytes
->Temporary Internet Files folder emptied: 3468507 bytes
->FireFox cache emptied: 82398449 bytes
->Google Chrome cache emptied: 38820474 bytes
->Flash cache emptied: 673 bytes

User: All Users

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 32902 bytes

User: LocalService
->Temp folder emptied: 65748 bytes
->Temporary Internet Files folder emptied: 61855029 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 2504 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 77938079 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 320688664 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 33170 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 564,00 mb


[EMPTYFLASH]

User: Administrator
->Flash cache emptied: 0 bytes

User: All Users

User: Default User

User: LocalService

User: NetworkService

Total Flash Files Cleaned = 0,00 mb


[EMPTYJAVA]

User: Administrator

User: All Users

User: Default User

User: LocalService

User: NetworkService

Total Java Files Cleaned = 0,00 mb


Restore point Set: OTM Restore Point
========== FILES ==========
File/Folder C:\WINDOWS\system32\*.tmp.dll not found.
File/Folder C:\WINDOWS\system32\SET*.tmp not found.
C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP192.tmp folder moved successfully.
C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP1E0.tmp folder moved successfully.
C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP26E.tmp folder moved successfully.
C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP27F.tmp folder moved successfully.
C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP295.tmp folder moved successfully.
C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP2AB.tmp folder moved successfully.
C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP38A.tmp folder moved successfully.
C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP3AD.tmp folder moved successfully.
C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP48C.tmp folder moved successfully.
C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP4AB.tmp folder moved successfully.
C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP5C5.tmp folder moved successfully.
C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP62.tmp folder moved successfully.
C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP7F.tmp folder moved successfully.
C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP8E6.tmp folder moved successfully.
C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP9C6.tmp folder moved successfully.
C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP9D8.tmp folder moved successfully.
C:\WINDOWS\tasks\Měsíční oznamování konce poskytování služeb pro Microsoft Windows XP.job moved successfully.
C:\WINDOWS\tasks\Přihlášení k oznamování konce poskytování služeb pro Microsoft Windows XP.job moved successfully.
C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job moved successfully.
C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job moved successfully.
C:\WINDOWS\tasks\Adobe Flash Player PPAPI Notifier.job moved successfully.
File/Folder C:\Documents and Settings\Administrator\Data aplikací\Server.exe not found.
========== REGISTRY ==========
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\Adobe ARM deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\Documents and Settings\Administrator\Data aplikací\Server.exe deleted successfully.
========== SERVICES/DRIVERS ==========
Service AdobeFlashPlayerUpdateSvc stopped successfully!
Service AdobeFlashPlayerUpdateSvc deleted successfully!
Service gupdatem stopped successfully!
Service gupdatem deleted successfully!

OTM by OldTimer - Version 3.1.21.0 log created on 04262016_180604

Files moved on Reboot...
File move failed. C:\WINDOWS\temp\_avast_\AvastLock.txt scheduled to be moved on reboot.
File move failed. C:\WINDOWS\temp\SafeZone Installer\safezone_installer_20160424173112.log scheduled to be moved on reboot.
File move failed. C:\WINDOWS\temp\SafeZone Installer\safezone_installer_20160424173116.log scheduled to be moved on reboot.

Registry entries deleted on Reboot...

Tak chybička se vloudila... PC po čase nečinosti usnul a po probuzení mi hodil BSOD.
Po restartu mi teď píše, že systém nelze spustit, neboť "Uvedený soubor je poškozen nebo nebyl nalezen: System32\Drivers\Ntfs.sys"
Takže se jdu teď pokusit o opravu pomocí CD..

Edit: tak oprava souboru se zadařila..

Šikula

Spusť opět OTM -> CleanUp! - odinstaluje a vyčistí po sobě.

Ještě se podíváme jak je na tom HDD

Sáhni http://www.stahuj.centrum.cz/utility_a_ ... ldiskinfo/
rozbal do nové složky a spusť DiskInfo.exe
pak Úpravy -> Kopírovat a do své odpovědi zde Ctrl+V

takže tedy po CleanUpu si to řeklo o restart a opět to nemohlo načíst ten "ntfs.sys" a kupodivu ani CD (zamrzlo při načítání souborů kernelu), tak jsem ho vrazil do druhého PC, že si zkusím vyrobit USB instalačku a mezitím jsem tento restartoval a on naběhl...

Takže tedy zde je ten CrystalDisk:

----------------------------------------------------------------------------
CrystalDiskInfo 6.8.0 (C) 2008-2016 hiyohiyo
Crystal Dew World : http://crystalmark.info/
----------------------------------------------------------------------------

OS : Windows XP Professional SP3 [5.1 Build 2600] (x86)
Date : 2016/04/27 15:47:58

-- Controller Map ----------------------------------------------------------
+ Intel(R) 82801GB Ultra ATA Storage Controllers - 27DF [ATA]
+ Primární kanál IDE (0)
- HL-DT-ST DVD-ROM GDR8164B
- Sekundární kanál IDE (1)
+ Intel(R) 82801GB Serial ATA Storage Controllers - 27C0 [ATA]
+ Primární kanál IDE (0)
- SAMSUNG HD080HJ
- Sekundární kanál IDE (1)

-- Disk List ---------------------------------------------------------------
(1) SAMSUNG HD080HJ : 80,0 GB [0/1/0, pd1]

----------------------------------------------------------------------------
(1) SAMSUNG HD080HJ
----------------------------------------------------------------------------
Model : SAMSUNG HD080HJ
Firmware : WT100-33
Serial Number : S08EJ1LYB00918
Disk Size : 80,0 GB (8,4/80,0/80,0/80,0)
Buffer Size : 8192 KB
Queue Depth : 32
# of Sectors : 156301488
Rotation Rate : Neznámy údaj
Interface : Serial ATA
Major Version : ATA/ATAPI-7
Minor Version : ATA/ATAPI-7 T13 1532D version 4a
Transfer Mode : ---- | SATA/300
Power On Hours : 18907 hod.
Power On Count : 4329 krát
Temperature : 41 C (105 F)
Health Status : Dobrý
Features : S.M.A.R.T., 48bit LBA
APM Level : ----
AAM Level : ----

-- S.M.A.R.T. --------------------------------------------------------------
ID Cur Wor Thr RawValues(6) Attribute Name
01 100 100 _51 000000000000 Počet chyb čtení
03 100 100 _25 000000000F80 Čas na roztočení ploten
04 _92 _92 __0 000000002171 Počet spuštění/zastavení
05 253 253 _10 000000000000 Počet přemapovaných sektorů
07 253 253 _51 000000000000 Počet chybných hledání
08 253 253 _15 000000000000 Čas potřebný na vyhledání
09 100 100 __0 0000000049DB Hodin v činnosti
0A 253 253 _51 000000000000 Počet opakovaných pokusů o roztočení ploten
0B 253 100 __0 000000000000 Počet pokusů o překalibrování
0C _96 _96 __0 0000000010E9 Počet cyklů zapnutí zařízení
BE _59 _42 __0 000000000029 Teplota toku vzduchu
C2 _59 _42 __0 000000000029 Teplota
C3 100 100 __0 00000003B47C Počet oprav chybného čtení
C4 253 253 __0 000000000000 Počet udalostí s číslem realokování sektorů
C5 253 253 __0 000000000000 Počet podezřelých sektorů
C6 253 253 __0 000000000000 Počet neopravitelných sektorů
C7 200 200 __0 000000000000 Počet chyb v kontrolním součtu UltraDMA
C8 100 100 __0 000000000000 Počet chyb při zápisu sektorů
C9 253 100 __0 000000000000 Počet chyb při čtení programů z disku
CA 253 253 __0 000000000000 Počet chyb při směrování údajů

-- IDENTIFY_DEVICE ---------------------------------------------------------
0 1 2 3 4 5 6 7 8 9
000: 0040 3FFF C837 0010 8856 022A 003F 0000 0000 0000
010: 5330 3845 4A31 4C59 4230 3039 3138 2020 2020 2020
020: 0003 4000 0004 5754 3130 302D 3333 5341 4D53 554E
030: 4720 4844 3038 3048 4A20 2020 2020 2020 2020 2020
040: 2020 2020 2020 2020 2020 2020 2020 8010 0000 2F00
050: 4000 0200 0200 0007 3FFF 0010 003F FC10 00FB 0110
060: F8B0 0950 0000 0007 0003 0078 0078 0078 0078 0000
070: 0000 0000 0000 0000 0000 001F 0606 0000 0048 0048
080: 00FE 0021 7069 7C01 4023 7069 3C01 4023 203F 001E
090: 001E 0000 FFFE 0000 0000 0000 0000 0000 0000 0000
100: F8B0 0950 0000 0000 0000 0000 0000 0000 5000 0F00
110: 15B0 0918 0000 0000 0000 0000 0000 0000 0000 0000
120: 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000
130: 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000
140: FFFF 0400 1700 0000 0000 9A00 0300 2400 0000 0000
150: 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000
160: 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000
170: 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000
180: 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000
190: 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000
200: 0000 0000 0000 0000 0000 0000 003F 0000 0000 0000
210: 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000
220: 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000
230: 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000
240: 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000
250: 0000 0000 0000 0000 0000 9AA5

-- SMART_READ_DATA ---------------------------------------------------------
+0 +1 +2 +3 +4 +5 +6 +7 +8 +9 +A +B +C +D +E +F
000: 10 00 01 0F 00 64 64 00 00 00 00 00 00 00 03 07
010: 00 64 64 80 0F 00 00 00 00 00 04 32 00 5C 5C 71
020: 21 00 00 00 00 00 05 33 00 FD FD 00 00 00 00 00
030: 00 00 07 0F 00 FD FD 00 00 00 00 00 00 00 08 25
040: 00 FD FD 00 00 00 00 00 00 00 09 32 00 64 64 DB
050: 49 00 00 00 00 00 0A 33 00 FD FD 00 00 00 00 00
060: 00 00 0B 12 00 FD 64 00 00 00 00 00 00 00 0C 32
070: 00 60 60 E9 10 00 00 00 00 00 BE 22 00 3B 2A 29
080: 00 00 00 00 00 00 C2 22 00 3B 2A 29 00 00 00 00
090: 00 00 C3 1A 00 64 64 7C B4 03 00 00 00 00 C4 32
0A0: 00 FD FD 00 00 00 00 00 00 00 C5 12 00 FD FD 00
0B0: 00 00 00 00 00 00 C6 30 00 FD FD 00 00 00 00 00
0C0: 00 00 C7 3E 00 C8 C8 00 00 00 00 00 00 00 C8 0A
0D0: 00 64 64 00 00 00 00 00 00 00 C9 0A 00 FD 64 00
0E0: 00 00 00 00 00 00 CA 32 00 FD FD 00 00 00 00 00
0F0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
110: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
120: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
130: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
140: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
150: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
160: 00 00 00 00 00 00 00 00 00 00 82 15 6D 07 00 5B
170: 03 00 01 00 01 1F 00 00 00 00 00 00 00 00 00 00
180: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
190: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
1A0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
1B0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
1C0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
1D0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
1E0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
1F0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 AF

-- SMART_READ_THRESHOLD ----------------------------------------------------
+0 +1 +2 +3 +4 +5 +6 +7 +8 +9 +A +B +C +D +E +F
000: 10 00 01 33 00 00 00 00 00 00 00 00 00 00 03 19
010: 00 00 00 00 00 00 00 00 00 00 04 00 00 00 00 00
020: 00 00 00 00 00 00 05 0A 00 00 00 00 00 00 00 00
030: 00 00 07 33 00 00 00 00 00 00 00 00 00 00 08 0F
040: 00 00 00 00 00 00 00 00 00 00 09 00 00 00 00 00
050: 00 00 00 00 00 00 0A 33 00 00 00 00 00 00 00 00
060: 00 00 0B 00 00 00 00 00 00 00 00 00 00 00 0C 00
070: 00 00 00 00 00 00 00 00 00 00 BE 00 00 00 00 00
080: 00 00 00 00 00 00 C2 00 00 00 00 00 00 00 00 00
090: 00 00 C3 00 00 00 00 00 00 00 00 00 00 00 C4 00
0A0: 00 00 00 00 00 00 00 00 00 00 C5 00 00 00 00 00
0B0: 00 00 00 00 00 00 C6 00 00 00 00 00 00 00 00 00
0C0: 00 00 C7 00 00 00 00 00 00 00 00 00 00 00 C8 00
0D0: 00 00 00 00 00 00 00 00 00 00 C9 00 00 00 00 00
0E0: 00 00 00 00 00 00 CA 00 00 00 00 00 00 00 00 00
0F0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
110: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
120: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
130: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
140: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
150: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
160: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
170: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
180: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
190: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
1A0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
1B0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
1C0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
1D0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
1E0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
1F0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2B

HDD je na tom taky skvěle

Pokud jsi provedl mnou navrhované procedury v předchozích návodech
tak ještě jeden domácí úkol

Po vyčištění by se hodila defragmentace
https://www.piriform.com/defraggler

ty barevné kostičky mě fascinují

Tak zajisté, že jsem prováděl všechny rady, když už jsem o ně žádal
Tudíž se již defragmentuje.

Díky.

Nemáš zač, byla s tebou příjemná spolupráce
a jsme tady i příště

Nápodobně.