VIRY.CZ

Dobrý den. Zničeho nic při zapnuté Mozille vyskočí okno o zablokování pc a žádají zaplacení pokuty.Viz příloha. Mozilla se zablokuje. Obejdu to sice tím, že ve správci úloh ukončím Mozillu. Ale po čase se to opakuje. Dal jsem i Adwcleaner. Ten smazal nějaké havěti ale po čase se to v Mozille objeví opět. Nevíte prosím co to způsobuje? Děkuji vám.

Zdravím!
Dejte log FRST: https://forum.viry.cz/viewtopic.php?f=13&t=152707 .

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 10.02.2018 01
Ran by Oťáček (administrator) on OŤÁČEK-PC (10-02-2018 16:29:15)
Running from C:\Users\Oťáček\Desktop
Loaded Profiles: Oťáček (Available Profiles: Oťáček)
Platform: Windows 7 Home Premium Service Pack 1 (X64) Language: Čeština (Česká republika)
Internet Explorer Version 8 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/33 ... scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(Two Pilots) C:\Windows\VPDAgent_x64.exe
(Brio) C:\Program Files\FolderSize\FolderSizeSvc.exe
(Microsoft Corporation) C:\Program Files\Microsoft LifeCam\MSCamS64.exe
(DEVGURU Co., LTD.) C:\Program Files\Samsung\USB Drivers\27_ssconn\conn\ss_conn_service.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
(Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\x64\aswidsagenta.exe
(Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastUI.exe
(Microsoft Corporation) C:\Windows\vVX3000.exe
(eM Client s.r.o.) C:\Program Files (x86)\eM Client\MailClient.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
(Brio) C:\Program Files\FolderSize\FolderSize.exe
(Viber Media S.à r.l.) C:\Users\Oťáček\AppData\Local\Viber\Viber.exe
(Sand Studio) C:\Program Files (x86)\AirDroid\AirDroid.exe
(Piriform Ltd) C:\Program Files\CCleaner\CCleaner64.exe
(Samsung Electronics Co., Ltd.) C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe
(TechSmith Corporation) C:\Program Files (x86)\TechSmith\Snagit 11\Snagit32.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Wondershare) C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe
(TechSmith Corporation) C:\Program Files (x86)\TechSmith\Snagit 11\TscHelp.exe
(TechSmith Corporation) C:\Program Files (x86)\TechSmith\Snagit 11\SnagPriv.exe
(TechSmith Corporation) C:\Program Files (x86)\TechSmith\Snagit 11\SnagitEditor.exe
(Microsoft Corporation) C:\Windows\SysWOW64\dllhost.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Skype Technologies) C:\Program Files (x86)\Skype\Browser\SkypeBrowserHost.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(eM Client s.r.o.) C:\Program Files (x86)\eM Client\MailClient.exe

==================== Registry (Whitelisted) ===========================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvLaunch.exe [246120 2017-12-23] (AVAST Software)
HKLM\...\Run: [VX3000] => C:\Windows\vVX3000.exe [762736 2010-05-20] (Microsoft Corporation)
HKLM-x32\...\Run: [KiesTrayAgent] => C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe [318112 2017-11-15] (Samsung Electronics Co., Ltd.)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [587288 2017-12-19] (Oracle Corporation)
HKLM-x32\...\Run: [Wondershare Helper Compact.exe] => C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe [2072928 2014-10-31] (Wondershare)
HKLM-x32\...\Run: [DelaypluginInstall] => C:\ProgramData\Wondershare\Video Converter Ultimate\DelayPluginI.exe [1960336 2015-01-15] ()
HKLM\SOFTWARE\Policies\Microsoft\Windows Defender: Restriction <==== ATTENTION
HKU\S-1-5-21-51665161-4008308083-3026018605-1000\...\Run: [eM Client] => C:\Program Files (x86)\eM Client\MailClient.exe [23583560 2017-12-20] (eM Client s.r.o.)
HKU\S-1-5-21-51665161-4008308083-3026018605-1000\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [27832264 2017-10-06] (Skype Technologies S.A.)
HKU\S-1-5-21-51665161-4008308083-3026018605-1000\...\Run: [Folder Size] => C:\Program Files\FolderSize\FolderSize.exe [169472 2013-02-12] (Brio)
HKU\S-1-5-21-51665161-4008308083-3026018605-1000\...\Run: [Viber] => C:\Users\Oťáček\AppData\Local\Viber\Viber.exe [30797904 2017-09-13] (Viber Media S.à r.l.)
HKU\S-1-5-21-51665161-4008308083-3026018605-1000\...\Run: [AirDroid 3] => C:\Program Files (x86)\AirDroid\AirDroid.exe [15596200 2018-02-08] (Sand Studio)
HKU\S-1-5-21-51665161-4008308083-3026018605-1000\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [10257872 2018-01-09] (Piriform Ltd)
HKU\S-1-5-18\...\Run: [] => [X]
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Snagit 11.lnk [2017-04-10]
ShortcutTarget: Snagit 11.lnk -> C:\Program Files (x86)\TechSmith\Snagit 11\Snagit32.exe (TechSmith Corporation)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 213.46.172.36 213.46.172.37
Tcpip\..\Interfaces\{555B09F5-81C2-4DDA-83D1-5057F55A238F}: [DhcpNameServer] 213.46.172.36 213.46.172.37

Internet Explorer:
==================
BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll [2017-11-21] (AVAST Software)
BHO-x32: Wondershare Video Converter Ultimate 7.1.0 -> {451C804F-C205-4F03-B48E-537EC94937BF} -> C:\ProgramData\Wondershare\Video Converter Ultimate\WSBrowserAppMgr.dll [2015-01-15] (Wondershare)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_161\bin\ssv.dll [2018-01-31] (Oracle Corporation)
BHO-x32: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll [2017-11-21] (AVAST Software)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_161\bin\jp2ssv.dll [2018-01-31] (Oracle Corporation)
Handler: WSWSVCUchrome - {1CA93FF0-A218-44F1 - No File
Filter: deflate - {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\system32\urlmon.dll [2010-11-20] (Microsoft Corporation)
Filter-x32: deflate - {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\SysWOW64\urlmon.dll [2010-11-20] (Microsoft Corporation)
Filter: gzip - {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\system32\urlmon.dll [2010-11-20] (Microsoft Corporation)
Filter-x32: gzip - {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\SysWOW64\urlmon.dll [2010-11-20] (Microsoft Corporation)

FireFox:
========
FF DefaultProfile: a7ro4fo1.default-1516488594400
FF ProfilePath: C:\Users\Oťáček\AppData\Roaming\Mozilla\Firefox\Profiles\a7ro4fo1.default-1516488594400 [2018-02-10]
FF Homepage: Mozilla\Firefox\Profiles\a7ro4fo1.default-1516488594400 -> hxxps://www.seznam.cz/
FF Extension: (AdBlocker for YouTube™) - C:\Users\Oťáček\AppData\Roaming\Mozilla\Firefox\Profiles\a7ro4fo1.default-1516488594400\Extensions\jid1-q4sG8pYhq8KGHs@jetpack.xpi [2018-01-21]
FF Extension: (NetVideoHunter) - C:\Users\Oťáček\AppData\Roaming\Mozilla\Firefox\Profiles\a7ro4fo1.default-1516488594400\Extensions\netvideohunter@netvideohunter.com [2018-01-21] [Legacy]
FF Extension: (S3.Translator) - C:\Users\Oťáček\AppData\Roaming\Mozilla\Firefox\Profiles\a7ro4fo1.default-1516488594400\Extensions\s3google@translator.xpi [2018-01-21]
FF Extension: (Tab Session Manager) - C:\Users\Oťáček\AppData\Roaming\Mozilla\Firefox\Profiles\a7ro4fo1.default-1516488594400\Extensions\Tab-Session-Manager@sienori.xpi [2018-02-04]
FF Extension: (YesScript) - C:\Users\Oťáček\AppData\Roaming\Mozilla\Firefox\Profiles\a7ro4fo1.default-1516488594400\Extensions\yesscript@userstyles.org.xpi [2018-01-21] [Legacy]
FF Extension: (Block Site) - C:\Users\Oťáček\AppData\Roaming\Mozilla\Firefox\Profiles\a7ro4fo1.default-1516488594400\Extensions\{07046613-1993-4b66-9dd1-9dd1ce581cb7}.xpi [2018-01-21]
FF Extension: (Session Manager) - C:\Users\Oťáček\AppData\Roaming\Mozilla\Firefox\Profiles\a7ro4fo1.default-1516488594400\Extensions\{1280606b-2510-4fe0-97ef-9b5a22eafe30}.xpi [2018-01-21] [Legacy]
FF Extension: (CSFD Magnets) - C:\Users\Oťáček\AppData\Roaming\Mozilla\Firefox\Profiles\a7ro4fo1.default-1516488594400\Extensions\{5dcbc3c3-318a-4f86-9ae4-9bb4de536c7a}.xpi [2018-01-30]
FF Extension: (Video DownloadHelper) - C:\Users\Oťáček\AppData\Roaming\Mozilla\Firefox\Profiles\a7ro4fo1.default-1516488594400\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}.xpi [2018-01-21]
FF Extension: (Adblock Plus) - C:\Users\Oťáček\AppData\Roaming\Mozilla\Firefox\Profiles\a7ro4fo1.default-1516488594400\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2018-01-21]
FF Extension: (Greasemonkey) - C:\Users\Oťáček\AppData\Roaming\Mozilla\Firefox\Profiles\a7ro4fo1.default-1516488594400\Extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}.xpi [2018-01-21]
FF Extension: (Web2PDF converter) - C:\Users\Oťáček\AppData\Roaming\Mozilla\Firefox\Profiles\a7ro4fo1.default-1516488594400\Extensions\{e8f509f0-b677-11de-8a39-0800200c9a66}.xpi [2018-01-21] [Legacy]
FF HKLM-x32\...\Firefox\Extensions: [WSVCU@Wondershare.com] - C:\ProgramData\Wondershare\Video Converter Ultimate\WSVCU@Wondershare.com
FF Extension: (Wondershare Video Converter Ultimate) - C:\ProgramData\Wondershare\Video Converter Ultimate\WSVCU@Wondershare.com [2018-02-05] [Legacy] [not signed]
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_28_0_0_161.dll [2018-02-07] ()
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_28_0_0_161.dll [2018-02-07] ()
FF Plugin-x32: @java.com/DTPlugin,version=11.161.2 -> C:\Program Files (x86)\Java\jre1.8.0_161\bin\dtplugin\npDeployJava1.dll [2018-01-31] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.161.2 -> C:\Program Files (x86)\Java\jre1.8.0_161\bin\plugin2\npjp2.dll [2018-01-31] (Oracle Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3528.0331 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [No File]
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.33.5\npGoogleUpdate3.dll [2017-04-29] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.33.5\npGoogleUpdate3.dll [2017-04-29] (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.2.4 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2017-11-29] (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.2.6 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2017-11-29] (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.2.8 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2017-11-29] (VideoLAN)

Chrome:
=======
CHR HomePage: Default -> hxxp://www.seznam.cz/
CHR StartupUrls: Default -> "hxxp://www.seznam.cz/"
CHR Profile: C:\Users\Oťáček\AppData\Local\Google\Chrome\User Data\Default [2018-02-08]
CHR Extension: (Prezentace) - C:\Users\Oťáček\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2017-10-19]
CHR Extension: (Dokumenty) - C:\Users\Oťáček\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2017-11-10]
CHR Extension: (Disk Google) - C:\Users\Oťáček\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2017-04-11]
CHR Extension: (YouTube) - C:\Users\Oťáček\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2017-04-11]
CHR Extension: (Aliexpress SuperStar) - C:\Users\Oťáček\AppData\Local\Google\Chrome\User Data\Default\Extensions\ciclollkolafellcaolgccmfjldgpolo [2018-01-20]
CHR Extension: (Adblock na Youtube™) - C:\Users\Oťáček\AppData\Local\Google\Chrome\User Data\Default\Extensions\cmedhionkhpnakcndndgjdbohmhepckk [2017-12-12]
CHR Extension: (Avast SafePrice) - C:\Users\Oťáček\AppData\Local\Google\Chrome\User Data\Default\Extensions\eofcbnmajmjmplflapaojjnihcjkigck [2018-01-20]
CHR Extension: (Tabulky) - C:\Users\Oťáček\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2017-10-19]
CHR Extension: (Dokumenty Google offline) - C:\Users\Oťáček\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2017-04-11]
CHR Extension: (Avast Online Security) - C:\Users\Oťáček\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki [2017-10-19]
CHR Extension: (Platby Internetového obchodu Chrome) - C:\Users\Oťáček\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2017-08-29]
CHR Extension: (Gmail) - C:\Users\Oťáček\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2017-04-11]
CHR Extension: (Chrome Media Router) - C:\Users\Oťáček\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2017-10-13]
CHR HKLM-x32\...\Chrome\Extension: [eofcbnmajmjmplflapaojjnihcjkigck] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - hxxps://clients2.google.com/service/update2/crx

==================== Services (Whitelisted) ====================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 Agent; C:\Windows\VPDAgent_x64.exe [168960 2013-08-28] (Two Pilots) [File not signed]
R3 aswbIDSAgent; C:\Program Files\AVAST Software\Avast\x64\aswidsagenta.exe [7538536 2017-12-23] (AVAST Software)
R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [301168 2017-12-23] (AVAST Software)
R2 FolderSize; C:\Program Files\FolderSize\FolderSizeSvc.exe [163840 2013-02-12] (Brio) [File not signed]
R2 MBAMService; C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe [6234056 2017-11-01] (Malwarebytes)
R2 ss_conn_service; C:\Program Files\Samsung\USB Drivers\27_ssconn\conn\ss_conn_service.exe [752224 2017-01-16] (DEVGURU Co., LTD.)
S3 SwitchBoard; C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated) [File not signed]
R2 TeamViewer; C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe [10945776 2017-12-15] (TeamViewer GmbH)
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2009-07-14] (Microsoft Corporation)
S2 Abrosoft: Abrosoft FantaMorph update permissions manager. 12810.; C:\Program Files (x86)\Abrosoft\FantaMorph5\FantaUp.exe -PermissionManagerRun [X]
S2 FlexService; "C:\Program Files (x86)\RapidBIT\cisvc.exe" [X]

===================== Drivers (Whitelisted) ======================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

S3 Apowersoft_AudioDevice; C:\Windows\System32\drivers\Apowersoft_AudioDevice.sys [31920 2014-04-09] (Wondershare)
R1 aswArPot; C:\Windows\System32\drivers\aswArPot.sys [185096 2017-12-23] (AVAST Software)
R1 aswbidsdriver; C:\Windows\System32\drivers\aswbidsdrivera.sys [321512 2017-12-23] (AVAST Software)
R0 aswbidsh; C:\Windows\System32\drivers\aswbidsha.sys [199448 2017-12-23] (AVAST Software)
R0 aswblog; C:\Windows\System32\drivers\aswbloga.sys [343768 2017-12-23] (AVAST Software)
R0 aswbuniv; C:\Windows\System32\drivers\aswbuniva.sys [57696 2017-12-23] (AVAST Software)
R1 aswHdsKe; C:\Windows\System32\drivers\aswHdsKe.sys [149344 2017-12-23] (AVAST Software)
S3 aswHwid; C:\Windows\System32\drivers\aswHwid.sys [46976 2017-12-23] (AVAST Software)
R1 aswKbd; C:\Windows\system32\drivers\aswKbd.sys [41832 2017-09-11] (AVAST Software)
R2 aswMonFlt; C:\Windows\System32\drivers\aswMonFlt.sys [146648 2018-01-10] (AVAST Software)
R1 aswRdr; C:\Windows\System32\drivers\aswRdr2.sys [110336 2017-12-23] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\drivers\aswRvrt.sys [84384 2017-12-23] (AVAST Software)
R1 aswSnx; C:\Windows\System32\drivers\aswSnx.sys [1025176 2017-12-23] (AVAST Software)
R1 aswSP; C:\Windows\System32\drivers\aswSP.sys [457896 2018-01-10] (AVAST Software)
R2 aswStm; C:\Windows\System32\drivers\aswStm.sys [204456 2017-12-23] (AVAST Software)
R0 aswVmm; C:\Windows\System32\drivers\aswVmm.sys [358672 2017-12-23] (AVAST Software)
S2 DgiVecp; C:\Windows\system32\Drivers\DgiVecp.sys [53816 2009-06-09] (Samsung Electronics Co., Ltd.)
R3 MBAMSwissArmy; C:\Windows\System32\Drivers\mbamswissarmy.sys [253880 2018-02-09] (Malwarebytes)
S3 tenCapture; C:\Windows\System32\DRIVERS\tenCapture.sys [23736 2012-07-20] (Hajo Krabbenhöft)
R2 WiseFs; C:\Windows\WiseFs64.sys [14256 2017-04-11] (WiseCleaner.com) [File not signed]
S2 npf; \??\C:\Windows\system32\drivers\npf.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2018-02-10 16:29 - 2018-02-10 16:29 - 000018023 _____ C:\Users\Oťáček\Desktop\FRST.txt
2018-02-10 16:22 - 2018-02-10 16:22 - 002404352 _____ (Farbar) C:\Users\Oťáček\Desktop\FRST64.exe
2018-02-09 09:48 - 2018-02-09 09:48 - 000000000 ____D C:\ProgramData\SWCUTemp
2018-02-08 18:55 - 2018-02-08 18:55 - 008206624 _____ (Malwarebytes) C:\Users\Oťáček\Desktop\adwcleaner_7.0.7.0.exe
2018-02-08 14:18 - 2018-02-08 14:18 - 000000000 ____D C:\Users\Oťáček\Desktop\obrazy
2018-02-05 17:29 - 2018-02-05 17:29 - 000000191 _____ C:\Users\Oťáček\Desktop\Nový textový dokument.txt
2018-02-05 08:52 - 2018-02-05 08:58 - 000000000 ____D C:\Users\Oťáček\Documents\Wondershare Video Converter Ultimate
2018-02-05 08:52 - 2018-02-05 08:52 - 000000000 ____D C:\Users\Oťáček\AppData\Roaming\Wondershare Video Converter Ultimate
2018-02-05 08:52 - 2018-02-05 08:52 - 000000000 ____D C:\Users\Oťáček\AppData\Roaming\{950EB46C-6AC7-4ACC-AB36-9A6A77C08B6A}
2018-02-05 08:47 - 2018-02-08 19:10 - 000000000 ____D C:\ProgramData\Wondershare Video Converter Ultimate
2018-02-05 08:47 - 2018-02-05 08:51 - 000001515 _____ C:\Users\Public\Desktop\Wondershare Video Converter Ultimate.lnk
2018-02-05 08:47 - 2018-02-05 08:47 - 000000000 ____D C:\Users\Oťáček\Documents\Wondershare MediaServer
2018-02-05 08:47 - 2014-10-24 14:16 - 000721263 _____ () C:\Windows\SysWOW64\WSCM64.dll
2018-02-05 08:47 - 2014-10-24 14:16 - 000214528 _____ () C:\Windows\SysWOW64\WSCM32.dll
2018-02-04 18:05 - 2018-02-04 22:34 - 000000000 ____D C:\Program Files (x86)\Gabest
2018-02-04 17:48 - 2018-02-04 17:48 - 000003036 _____ C:\Windows\System32\Tasks\{56CF5291-C21E-434D-8502-2C5EE6D46455}
2018-02-04 17:47 - 2018-02-04 17:47 - 000003036 _____ C:\Windows\System32\Tasks\{5082774C-24D5-422B-9EBC-737A1DC5C5CA}
2018-02-04 17:43 - 2018-02-04 17:43 - 000000000 ____D C:\Users\Oťáček\Documents\Apowersoft
2018-02-02 18:22 - 2018-02-09 09:48 - 000253880 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbamswissarmy.sys
2018-01-31 10:06 - 2018-02-10 16:26 - 000000000 ____D C:\Users\Oťáček\AppData\Roaming\vlc
2018-01-30 11:07 - 2018-01-30 11:07 - 000000000 ____D C:\Program Files\Samsung
2018-01-28 14:37 - 2018-01-28 14:37 - 000439882 _____ C:\Users\Oťáček\Documents\Věnuji prvnímu zájemci zdarma.pdf
2018-01-22 20:46 - 2018-01-22 20:46 - 000003642 _____ C:\Users\Oťáček\Downloads\All-Is-Lost(0000229408).srt
2018-01-22 20:04 - 2018-01-22 20:04 - 000110621 _____ C:\Users\Oťáček\Downloads\A-Million-Ways-to-Die-in-the-West(0000238759).srt
2018-01-21 10:42 - 2018-01-21 10:42 - 010743016 _____ (1f0.de ) C:\Users\Oťáček\Downloads\LAVFilters-0.70.2-Installer.exe
2018-01-20 09:55 - 2018-01-20 09:55 - 000002188 _____ C:\Users\Oťáček\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\FormApps Signing Extension.lnk
2018-01-20 09:55 - 2018-01-20 09:55 - 000000000 ____D C:\Users\Oťáček\AppData\Local\Software602
2018-01-17 11:55 - 2018-01-17 11:55 - 000167836 _____ C:\Users\Oťáček\Documents\kalendář 2018b.pdf
2018-01-17 11:50 - 2018-01-17 11:50 - 000168357 _____ C:\Users\Oťáček\Documents\kalendář 2018 b.pdf
2018-01-17 11:48 - 2018-01-17 11:48 - 000089699 _____ C:\Users\Oťáček\Documents\Kalendář 2018.pdf
2018-01-17 11:27 - 2018-01-17 11:27 - 000000000 ____D C:\Users\Oťáček\AppData\Roaming\Picosmos
2018-01-16 11:28 - 2018-01-16 11:44 - 000569287 _____ C:\Users\Oťáček\Documents\Seznam souborů Toulky českou minulostí.pdf
2018-01-15 23:38 - 2018-01-15 23:38 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VSFilter
2018-01-15 23:38 - 2018-01-15 23:38 - 000000000 ____D C:\Program Files\VSFilter
2018-01-15 13:07 - 2018-01-15 13:07 - 000002172 _____ C:\Users\Oťáček\Desktop\Subtitle Workshop.lnk
2018-01-15 13:07 - 2018-01-15 13:07 - 000000000 ____D C:\Users\Oťáček\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\URUSoft
2018-01-12 16:10 - 2018-01-12 16:10 - 012274599 _____ C:\Users\Oťáček\Documents\TAILOR, RATH, NIEDZVIECKI,KOWALCYK - Nacistické kořeny Bruselské EU.pdf

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2018-02-10 16:29 - 2017-11-01 12:35 - 000000000 ____D C:\FRST
2018-02-10 16:25 - 2017-04-10 13:16 - 000003978 _____ C:\Windows\System32\Tasks\User_Feed_Synchronization-{F4B66E77-4023-4CA3-A918-E9DABCC6A041}
2018-02-10 16:22 - 2017-04-10 19:26 - 000000000 ____D C:\Users\Oťáček\AppData\Roaming\Skype
2018-02-10 16:03 - 2017-04-11 22:03 - 000000000 ____D C:\Windows\SysWOW64\Macromed
2018-02-10 10:35 - 2017-08-12 20:49 - 000000000 ____D C:\Users\Oťáček\Documents\ViberDownloads
2018-02-09 23:03 - 2017-04-10 16:41 - 000000000 ____D C:\Users\Oťáček\AppData\Roaming\uTorrent
2018-02-09 14:01 - 2017-08-11 16:21 - 000000349 _____ C:\Users\Public\Documents\PCLECHAL.INI
2018-02-09 11:38 - 2017-04-10 15:10 - 000000000 ____D C:\Users\Oťáček\AppData\LocalLow\Mozilla
2018-02-09 09:56 - 2009-07-14 05:45 - 000019312 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2018-02-09 09:56 - 2009-07-14 05:45 - 000019312 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2018-02-09 09:53 - 2017-04-10 15:21 - 000000000 ____D C:\Users\Oťáček\AppData\Roaming\eM Client
2018-02-09 09:50 - 2017-09-04 21:09 - 000001943 _____ C:\Users\Public\Desktop\AirDroid.lnk
2018-02-09 09:50 - 2017-08-15 18:36 - 000000000 ____D C:\Users\Oťáček\AppData\Roaming\ViberPC
2018-02-09 09:47 - 2009-07-14 06:08 - 000000006 ____H C:\Windows\Tasks\SA.DAT
2018-02-08 19:16 - 2009-07-14 04:20 - 000000000 ____D C:\Windows\inf
2018-02-08 19:13 - 2017-05-10 16:09 - 000000000 ____D C:\AdwCleaner
2018-02-08 19:10 - 2017-04-11 08:32 - 000000000 ____D C:\Users\Oťáček\AppData\Roaming\TeamViewer
2018-02-08 19:09 - 2017-04-11 10:35 - 000000000 ____D C:\Users\Oťáček\AppData\Local\CrashDumps
2018-02-08 19:07 - 2017-04-30 00:24 - 000000000 ____D C:\Program Files (x86)\AirDroid
2018-02-08 19:06 - 2017-09-04 21:09 - 000000000 ____D C:\Users\Oťáček\AppData\Roaming\AirDroid
2018-02-08 19:03 - 2017-04-10 15:19 - 000000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2018-02-08 17:28 - 2017-05-16 15:01 - 000000047 _____ C:\trl.cfg
2018-02-08 12:53 - 2017-04-17 16:51 - 000035328 _____ C:\Users\Oťáček\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2018-02-08 00:48 - 2017-06-24 18:46 - 000000000 ____D C:\Users\Oťáček\Documents\PPT to Video Log Files
2018-02-08 00:18 - 2017-04-10 19:52 - 000000000 ____D C:\Users\Oťáček\AppData\Roaming\Audacity
2018-02-07 23:56 - 2017-05-22 22:25 - 000000000 ____D C:\Program Files (x86)\Mozilla Firefox
2018-02-07 11:41 - 2017-04-29 19:01 - 000004544 _____ C:\Windows\System32\Tasks\Adobe Flash Player PPAPI Notifier
2018-02-07 11:41 - 2017-04-11 22:04 - 000803328 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2018-02-07 11:41 - 2017-04-11 22:04 - 000144896 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2018-02-07 11:41 - 2017-04-11 22:04 - 000004396 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2018-02-07 11:41 - 2017-04-11 22:04 - 000000000 ____D C:\Windows\system32\Macromed
2018-02-06 23:59 - 2009-07-14 16:18 - 000690914 _____ C:\Windows\system32\perfh005.dat
2018-02-06 23:59 - 2009-07-14 16:18 - 000148246 _____ C:\Windows\system32\perfc005.dat
2018-02-06 23:59 - 2009-07-14 06:13 - 001627598 _____ C:\Windows\system32\PerfStringBackup.INI
2018-02-05 18:07 - 2017-09-16 14:16 - 000000000 ____D C:\Users\Oťáček\AppData\Roaming\dvdcss
2018-02-05 08:51 - 2017-04-13 09:05 - 000000000 ____D C:\Users\Oťáček\AppData\Local\ElevatedDiagnostics
2018-02-05 08:51 - 2009-07-14 04:20 - 000000000 ____D C:\Windows\system32\NDF
2018-02-05 08:47 - 2017-08-26 07:43 - 000000000 ____D C:\ProgramData\Wondershare
2018-02-05 08:47 - 2017-06-24 18:46 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Wondershare
2018-02-05 08:47 - 2017-06-24 18:46 - 000000000 ____D C:\Program Files (x86)\Wondershare
2018-02-04 17:52 - 2017-04-16 19:11 - 000000000 ____D C:\Users\Oťáček\AppData\Roaming\Apowersoft
2018-02-04 17:50 - 2017-04-16 19:11 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Apowersoft
2018-02-04 17:50 - 2017-04-16 00:11 - 000000000 ____D C:\Program Files (x86)\Apowersoft
2018-02-02 23:33 - 2017-10-22 22:00 - 000000000 ____D C:\Users\Oťáček\Documents\Manuály návody
2018-02-02 19:02 - 2017-09-24 22:26 - 000000000 ____D C:\Users\Oťáček\AppData\Roaming\Subtitle Edit
2018-02-02 16:35 - 2017-04-13 17:15 - 000000000 ____D C:\Program Files (x86)\rajce
2018-02-02 15:55 - 2017-04-11 08:32 - 000000000 ____D C:\Program Files (x86)\TeamViewer
2018-01-31 09:14 - 2017-06-01 09:27 - 000097344 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2018-01-31 09:14 - 2017-06-01 09:27 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2018-01-31 09:13 - 2017-06-01 09:27 - 000000000 ____D C:\Program Files (x86)\Java
2018-01-31 09:13 - 2017-04-19 23:09 - 000001066 _____ C:\Users\Public\Desktop\VLC media player.lnk
2018-01-31 08:14 - 2017-12-26 23:03 - 000000000 ____D C:\Users\Oťáček\dwhelper
2018-01-30 15:28 - 2017-04-10 22:45 - 000000000 ____D C:\Program Files (x86)\Samsung
2018-01-30 15:28 - 2017-04-10 19:12 - 000000000 ___HD C:\Program Files (x86)\InstallShield Installation Information
2018-01-30 15:14 - 2017-10-11 09:00 - 000000000 ____D C:\Users\Oťáček\AppData\Roaming\Samsung
2018-01-30 15:14 - 2017-10-11 08:10 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Samsung
2018-01-30 13:19 - 2017-10-11 09:01 - 000002002 _____ C:\Users\Public\Desktop\Samsung Kies (Lite).lnk
2018-01-30 13:19 - 2017-10-11 09:01 - 000001992 _____ C:\Users\Public\Desktop\Samsung Kies.lnk
2018-01-30 13:19 - 2017-10-11 09:01 - 000000000 ____D C:\Users\Oťáček\AppData\Local\Samsung
2018-01-30 13:18 - 2017-10-11 08:09 - 000000000 ____D C:\ProgramData\Samsung
2018-01-30 13:07 - 2017-04-12 05:01 - 000000000 ____D C:\Users\Oťáček\AppData\Local\Downloaded Installations
2018-01-30 10:16 - 2017-07-03 19:28 - 000000000 ____D C:\ProgramData\VSO
2018-01-29 18:29 - 2017-05-16 06:43 - 000000000 ____D C:\Users\Oťáček\Documents\eM Client
2018-01-28 22:24 - 2017-07-03 19:28 - 000000000 ____D C:\Users\Oťáček\Documents\ConvertXToDVD
2018-01-28 12:53 - 2017-12-26 23:03 - 000000000 ____D C:\Program Files\net.downloadhelper.coapp
2018-01-22 10:34 - 2017-05-10 15:19 - 000000000 ____D C:\Users\Oťáček\Documents\Scaner
2018-01-22 09:21 - 2017-11-19 02:26 - 000000000 ____D C:\Users\Oťáček\Documents\Output
2018-01-20 23:27 - 2017-04-10 15:09 - 000001159 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Firefox.lnk
2018-01-20 23:27 - 2017-04-10 15:09 - 000001147 _____ C:\Users\Public\Desktop\Firefox.lnk
2018-01-18 09:17 - 2017-04-10 15:21 - 000000000 ____D C:\Program Files (x86)\eM Client
2018-01-17 21:02 - 2017-12-30 16:15 - 000003872 _____ C:\Windows\System32\Tasks\CCleaner Update
2018-01-17 21:02 - 2017-12-30 16:15 - 000000822 _____ C:\Users\Public\Desktop\CCleaner.lnk
2018-01-17 09:48 - 2017-04-10 15:21 - 000000966 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\eM Client.lnk
2018-01-17 09:32 - 2009-07-14 05:45 - 005076712 _____ C:\Windows\system32\FNTCACHE.DAT
2018-01-16 11:48 - 2017-04-25 19:04 - 000267776 ___SH C:\Users\Oťáček\Documents\Thumbs.db
2018-01-15 13:07 - 2017-04-17 19:29 - 000000000 ____D C:\Program Files (x86)\URUSoft
2018-01-14 15:52 - 2017-04-10 14:57 - 000131216 _____ C:\Users\Oťáček\AppData\Local\GDIPFONTCACHEV1.DAT

==================== Files in the root of some directories =======

2017-05-19 07:47 - 2017-05-19 07:47 - 000000132 _____ () C:\Users\Oťáček\AppData\Roaming\Adobe Formát PNG CS6 – předvolby
2017-09-11 18:10 - 2017-09-11 18:10 - 232769920 _____ ( ) C:\Users\Oťáček\AppData\Roaming\filmora_64bit_full846.exe
2017-07-03 19:29 - 2017-07-03 19:29 - 000099384 _____ () C:\Users\Oťáček\AppData\Roaming\inst.exe
2017-05-13 14:13 - 2017-09-23 11:52 - 000000643 _____ () C:\Users\Oťáček\AppData\Roaming\OŤÁČEK-PC.MTBF.txt
2017-07-03 19:29 - 2017-07-03 19:29 - 000007859 _____ () C:\Users\Oťáček\AppData\Roaming\pcouffin.cat
2017-07-03 19:29 - 2017-07-03 19:29 - 000001167 _____ () C:\Users\Oťáček\AppData\Roaming\pcouffin.inf
2017-07-03 19:29 - 2017-07-03 19:29 - 000000055 _____ () C:\Users\Oťáček\AppData\Roaming\pcouffin.log
2017-07-03 19:29 - 2017-07-03 19:29 - 000082816 _____ (VSO Software) C:\Users\Oťáček\AppData\Roaming\pcouffin.sys
2017-04-17 16:51 - 2018-02-08 12:53 - 000035328 _____ () C:\Users\Oťáček\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2017-09-27 11:09 - 2017-04-14 15:16 - 000000863 _____ () C:\Users\Oťáček\AppData\Local\recently-used.xbel

==================== Bamital & volsnap ======================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\dnsapi.dll => File is digitally signed
C:\Windows\SysWOW64\dnsapi.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed

LastRegBack: 2018-02-07 00:26

==================== End of FRST.txt ============================

Teď spusťte tuto utilitu:

Stáhněte AdwCleaner https://toolslib.net/downloads/viewdown ... dwcleaner/
Uložte na plochu
Ukončete všechny programy
Klikněte nejprve na >Scan<(hledání) a pak na >Clean< (mazání).
Proběhne skenováni a pak se objeví log, který sem vložte.

# AdwCleaner 7.0.8.0 - Logfile created on Sat Feb 10 16:12:49 2018
# Updated on 2018/08/02 by Malwarebytes
# Database: 02-08-2018.1
# Running on Windows 7 Home Premium (X64)
# Mode: scan
# Support: https://www.malwarebytes.com/support

***** [ Services ] *****

No malicious services found.

***** [ Folders ] *****

No malicious folders found.

***** [ Files ] *****

No malicious files found.

***** [ DLL ] *****

No malicious DLLs found.

***** [ WMI ] *****

No malicious WMI found.

***** [ Shortcuts ] *****

No malicious shortcuts found.

***** [ Tasks ] *****

No malicious tasks found.

***** [ Registry ] *****

No malicious registry entries found.

***** [ Firefox (and derivatives) ] *****

No malicious Firefox entries.

***** [ Chromium (and derivatives) ] *****

No malicious Chromium entries.

*************************

C:/AdwCleaner/AdwCleaner[C0].txt - [1099 B] - [2017/5/10 15:13:22]
C:/AdwCleaner/AdwCleaner[C2].txt - [3266 B] - [2017/7/17 9:19:39]
C:/AdwCleaner/AdwCleaner[S0].txt - [1386 B] - [2017/5/10 15:12:31]
C:/AdwCleaner/AdwCleaner[S10].txt - [1764 B] - [2017/11/2 11:48:54]
C:/AdwCleaner/AdwCleaner[S11].txt - [1833 B] - [2017/11/19 7:24:7]
C:/AdwCleaner/AdwCleaner[S12].txt - [1901 B] - [2017/11/24 9:16:27]
C:/AdwCleaner/AdwCleaner[S13].txt - [1970 B] - [2017/12/22 18:11:57]
C:/AdwCleaner/AdwCleaner[S14].txt - [2040 B] - [2018/1/17 1:27:9]
C:/AdwCleaner/AdwCleaner[S15].txt - [3175 B] - [2018/2/8 14:15:5]
C:/AdwCleaner/AdwCleaner[S16].txt - [3221 B] - [2018/2/8 17:52:46]
C:/AdwCleaner/AdwCleaner[S17].txt - [3243 B] - [2018/2/8 17:57:17]
C:/AdwCleaner/AdwCleaner[S18].txt - [3212 B] - [2018/2/8 18:13:6]
C:/AdwCleaner/AdwCleaner[S1].txt - [1577 B] - [2017/7/17 9:19:5]
C:/AdwCleaner/AdwCleaner[S2].txt - [1246 B] - [2017/8/13 13:25:15]
C:/AdwCleaner/AdwCleaner[S3].txt - [1640 B] - [2017/8/30 7:28:47]
C:/AdwCleaner/AdwCleaner[S4].txt - [1356 B] - [2017/8/30 23:13:10]
C:/AdwCleaner/AdwCleaner[S5].txt - [1424 B] - [2017/9/3 22:21:3]
C:/AdwCleaner/AdwCleaner[S6].txt - [1490 B] - [2017/9/11 15:36:50]
C:/AdwCleaner/AdwCleaner[S7].txt - [1558 B] - [2017/9/18 10:20:25]
C:/AdwCleaner/AdwCleaner[S8].txt - [1626 B] - [2017/9/26 11:19:43]
C:/AdwCleaner/AdwCleaner[S9].txt - [1694 B] - [2017/10/12 22:19:30]


########## EOF - C:\AdwCleaner\AdwCleaner[S19].txt ##########

Toto je OK. Otevřte poznámkový blok a zkopírujte do něj:

Start

CloseProcesses:
HKLM\SOFTWARE\Policies\Microsoft\Windows Defender: Restriction <==== ATTENTION
HKU\S-1-5-18\...\Run: [] => [X]
Handler: WSWSVCUchrome - {1CA93FF0-A218-44F1 - No File
C:\Users\Oťáček\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

EmptyTemp:
End

Uložte na plochu jako fixlist.txt. Spusťte znovu FRST a klikněte na >Fix<. Po skončení akce se objeví log, který sem zkopírujte.

Pak ještě vyčistěte prohlížeče postupným spuštěním těchto utilit:

1. Stahnete Zoek.exe http://download.bleepingcomputer.com/smeenk/zoek.exe a ulozte jej na plochu

Pokud pouzivate Win Vista ci W7, kliknete na Zoek pravym a dejte Run As Administrator ci Spustit jako spravce
Do okna vlozte skript nize

autoclean;
resethosts;
emptyclsid;
IEdefaults;
FFdefaults;
CHRdefaults;
emptyIEcache;
emptyFFcache;
emptyCHRcache;
emptyalltemp;
emptyflash;
emptyjava;
emptyrecycle.bin;

Nasledne kliknete na Run Script
PC provede opravu, restartuje se a da Vam log, jeho obsah vlozte sem.

a

2. Junkware removal tool: http://www.stahuj.centrum.cz/utility_a_ ... oval-tool/
•Ulozte nejlepe na plochu
•Po spusteni se zobrazi licencni podminky, stisknete libovolnou klavesu
•Probehne vytvoreni zalohy a nasledne prohledavani
•Probehne skenovani a pak se objevi log, pripadne bude ulozen v c:\JRT jako JRT.txt, ten sem vlozte.

Sice se mě žádný log po restartu neobjevil, ale na ploše byl fixlist a tak obsah posílám. Další kroky udělám následovně.
Fix result of Farbar Recovery Scan Tool (x64) Version: 10.02.2018 01
Ran by Oťáček (11-02-2018 09:45:23) Run:2
Running from C:\Users\Oťáček\Desktop
Loaded Profiles: Oťáček (Available Profiles: Oťáček)
Boot Mode: Normal
==============================================

fixlist content:
*****************
Start

CloseProcesses:
HKLM\SOFTWARE\Policies\Microsoft\Windows Defender: Restriction <==== ATTENTION
HKU\S-1-5-18\...\Run: [] => [X]
Handler: WSWSVCUchrome - {1CA93FF0-A218-44F1 - No File
C:\Users\O���ek\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

EmptyTemp:
End
*****************

Processes closed successfully.
"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" => removed successfully
"HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Run\\" => removed successfully
"HKLM\Software\Classes\PROTOCOLS\Handler\WSWSVCUchrome" => removed successfully
"C:\Users\O���ek\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini" => not found

=========== EmptyTemp: ==========

BITS transfer queue => 0 B
DOMStore, IE Recovery, AppCache, Feeds Cache, Thumbcache, IconCache => 30935537 B
Java, Flash, Steam htmlcache => 1226 B
Windows/system/drivers => 352250 B
Edge => 0 B
Chrome => 218085 B
Firefox => 139313487 B
Opera => 0 B

Temp, IE cache, history, cookies, recent:
Users => 0 B
Default => 0 B
Public => 0 B
ProgramData => 0 B
systemprofile => 83699 B
systemprofile32 => 692 B
LocalService => 132244 B
NetworkService => 66228 B
Oťáček => 53367883 B

RecycleBin => 16207982 B
EmptyTemp: => 229.5 MB temporary data Removed.

================================


The system needed a reboot.

==== End of Fixlog 09:45:48 ====

ZOEK mě Avast vyhodil do truhly. Tak jsem musel na chvílku Avast vypnout.

Zoek proběhl, ale comp se nerestartoval, a žádný log nevyhodil. Log jsem našel na disku C. a jeho obsah vkládám.
Zoek.exe v5.0.0.2 Updated 04-Februari-2018(online version)
Tool run by Oś źek on ne 11.02.2018 at 10:40:12,98.
Microsoft Windows 7 Home Premium 6.1.7601 Service Pack 1 x64
Running in: Normal Mode Internet Access Detected
Launched: C:\Users\OEK~1\Desktop\zoek.exe [Scan all users] [Script inserted]

==== System Restore Info ======================

11.2.2018 10:41:58 Zoek.exe System Restore Point Created Successfully.

==== Reset Hosts File ======================

# Copyright (c) 1993-2006 Microsoft Corp.
#
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
#
# This file contains the mappings of IP addresses to host names. Each
# entry should be kept on an individual line. The IP address should
# be placed in the first column followed by the corresponding host name.
# The IP address and the host name should be separated by at least one
# space.
#
# Additionally, comments (such as these) may be inserted on individual
# lines or following the machine name denoted by a '#' symbol.
#
# For example:
#
# 102.54.94.97 rhino.acme.com # source server
# 38.25.63.10 x.acme.com # x client host

# localhost name resolution is handled within DNS itself.
127.0.0.1 localhost
::1 localhost

==== FireFox Fix ======================

Deleted from C:\Users\OEK~1\AppData\Roaming\Mozilla\Firefox\Profiles\a7ro4fo1.default-1516488594400\prefs.js:
user_pref("browser.startup.homepage", "https://www.seznam.cz/");

Added to C:\Users\OEK~1\AppData\Roaming\Mozilla\Firefox\Profiles\a7ro4fo1.default-1516488594400\prefs.js:
user_pref("browser.startup.homepage", "about:home");
user_pref("browser.newtab.url", "about:newtab");

==== Firefox Start and Search pages ======================

ProfilePath: C:\Users\OEK~1\AppData\Roaming\Mozilla\Firefox\Profiles\a7ro4fo1.default-1516488594400
user_pref("browser.startup.homepage", "about:home");
user_pref("browser.newtab.url", "about:newtab");

==== Firefox Extensions Registry ======================

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Mozilla\Firefox\Extensions]
"WSVCU@Wondershare.com"="C:\ProgramData\Wondershare\Video Converter Ultimate\WSVCU@Wondershare.com" [05.02.2018 08:47]

==== Firefox Extensions ======================

ProfilePath: C:\Users\OEK~1\AppData\Roaming\Mozilla\Firefox\Profiles\a7ro4fo1.default-1516488594400
- NetVideoHunter - %ProfilePath%\extensions\netvideohunter@netvideohunter.com
- Undetermined - %ProfilePath%\extensions\jid1-q4sG8pYhq8KGHs@jetpack.xpi
- Undetermined - %ProfilePath%\extensions\s3google@translator.xpi
- Undetermined - %ProfilePath%\extensions\Tab-Session-Manager@sienori.xpi
- YesScript - %ProfilePath%\extensions\yesscript@userstyles.org.xpi
- Undetermined - %ProfilePath%\extensions\{07046613-1993-4b66-9dd1-9dd1ce581cb7}.xpi
- Re§im ECHO je vypnut. - %ProfilePath%\extensions\{1280606b-2510-4fe0-97ef-9b5a22eafe30}.xpi
- Undetermined - %ProfilePath%\extensions\{5dcbc3c3-318a-4f86-9ae4-9bb4de536c7a}.xpi
- Undetermined - %ProfilePath%\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}.xpi
- Undetermined - %ProfilePath%\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
- Undetermined - %ProfilePath%\extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}.xpi
- Web2PDF - %ProfilePath%\extensions\{e8f509f0-b677-11de-8a39-0800200c9a66}.xpi

AppDir: C:\Program Files (x86)\Mozilla Firefox
- Undetermined - %AppDir%\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}.xpi

==== Firefox Plugins ======================


==== Set IE to Default ======================

Old Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"="http://go.microsoft.com/fwlink/?LinkId=69157"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\AboutURLs]
"Tabs"="res://ieframe.dll/tabswelcome.htm"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\AboutURLs]
"Tabs"="res://ieframe.dll/tabswelcome.htm"
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes]
"DefaultScope"="{0633EE93-D776-472f-A0FF-E1416B8B2E3A}"

New Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"="http://go.microsoft.com/fwlink/?LinkId=69157"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\AboutURLs]
"Tabs"="about:newtab"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\AboutURLs]
"Tabs"="about:newtab"
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes]
"DefaultScope"="{0633EE93-D776-472f-A0FF-E1416B8B2E3A}"

==== All HKLM and HKCU SearchScopes ======================

HKLM\SearchScopes "DefaultScope"="{0633EE93-D776-472f-A0FF-E1416B8B2E3A}"
HKLM\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} - http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
HKLM\Wow6432Node\SearchScopes "DefaultScope"="{0633EE93-D776-472f-A0FF-E1416B8B2E3A}"
HKLM\Wow6432Node\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} - http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
HKCU\SearchScopes "DefaultScope"="{0633EE93-D776-472f-A0FF-E1416B8B2E3A}"
HKCU\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} - http://www.bing.com/search?q={searchTer ... ORM=IE8SRC

==== Reset Google Chrome ======================

C:\Users\OEK~1\AppData\Local\Google\Chrome\User Data\Default\Preferences was reset successfully
C:\Users\OEK~1\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences was reset successfully
C:\Users\OEK~1\AppData\Local\Google\Chrome\User Data\Default\Web Data was reset successfully

==== Empty IE Cache ======================

C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\serviceprofiles\Localservice\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\OEK~1\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat will be deleted at reboot
C:\Windows\sysWoW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat will be deleted at reboot
C:\Windows\sysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat will be deleted at reboot

==== Empty FireFox Cache ======================

C:\Users\OEK~1\AppData\Local\Mozilla\Firefox\Profiles\a7ro4fo1.default-1516488594400\cache2 emptied successfully
C:\Users\OEK~1\AppData\Roaming\Mozilla\Firefox\Profiles\a7ro4fo1.default-1516488594400\storage\default\https+++1xbet46.com\cache emptied successfully
C:\Users\OEK~1\AppData\Roaming\Mozilla\Firefox\Profiles\a7ro4fo1.default-1516488594400\storage\default\https+++twitter.com\cache emptied successfully
C:\Users\OEK~1\AppData\Roaming\Mozilla\Firefox\Profiles\a7ro4fo1.default-1516488594400\storage\default\https+++waudeesestew.com\cache emptied successfully
C:\Users\OEK~1\AppData\Roaming\Mozilla\Firefox\Profiles\a7ro4fo1.default-1516488594400\storage\default\https+++www.letgo.cz\cache emptied successfully
C:\Users\OEK~1\AppData\Roaming\Mozilla\Firefox\Profiles\a7ro4fo1.default-1516488594400\storage\default\https+++www.onlinevideoconverter.com\cache emptied successfully
C:\Users\OEK~1\AppData\Roaming\Mozilla\Firefox\Profiles\a7ro4fo1.default-1516488594400\storage\default\https+++www.youtube.com\cache emptied successfully

Když chci Zoek ukončit, tak to nejde. Ani ve zprávci úloh.

Ve vašem odkazu na Junkware žádný Junkware soft není ke stažení.

A co toto: http://www.stahuj.centrum.cz/utility_a_ ... [oz]=8.1.0 . Zoek něco smazal.

Zde log

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Malwarebytes
Version: 8.1.4 (07.09.2017)
Operating System: Windows 7 Home Premium x64
Ran by Oś źek (Administrator) on ne 11.02.2018 at 11:30:18,56
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




File System: 2

Successfully deleted: C:\Users\Oś źek\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\94DDL123 (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\94DDL123 (Temporary Internet Files Folder)



Registry: 0





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on ne 11.02.2018 at 11:33:03,33
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Jinak nevím jestli to má souvislost, ale po tom čištění mě neustále prohlížeš Mozilla po otevření jakékoliv stránk okamžitě a neustále háže na konec stránky. Popojedu nahoru a vzápětí jsem zas dole. Je to dost nepříjemné a když čtu třeba ve vašem foru co mě píšete, tak mě to pořád háže na konec stránky.takže se musím neustále posouvat nahoru.Mimoto nejde zavřít a ukončit Zoe. Ani ve správci úloh.
P.S. Restartoval jsem comp a v Mozille už vše ok.

Jj., to se může stát. Problém trvá i nadále?