VIRY.CZ

• Ulozte nejlepe na plochu FRST.exe/FRST64.exe - https://www.bleepingcomputer.com/downlo ... scan-tool/
• kliknete pravym mysitkem na stazeny FRST a vyberte Spustit jako spravce
• zkontrolujte, ze je zatrzena polozka Addition.txt v pravem dolnim rohu
• kliknete na Scan
• do pristich odpovedi (pravdepodobne se nevlezou do jedne) vlozte obsah vygenerovanych logu FRST.txt i Addition.txt

• http://download.bleepingcomputer.com/grinler/rkill.exe
• http://download.bleepingcomputer.com/grinler/rkill.com
• obsah logu vytvoreneho take na plose (rkill.txt) zaslete v pristi odpovedi
• nerestartujte ted pocitac jinak prijdete o ucinek rkillu

• Vypnete antiviry a vsechny real-time ochrany
• spustte ComboFix jako spravce (lepe pod uctem s administratorskym opravnenim)
• s licencnimi podminkami souhlaste - Ano
• pokud je nabidnuta instalace konzoly pro zotaveni, souhlaste
• v prubehu skenovani nechte PC v klidu - nic nespoustejte a do okna ComboFixu neklikejte
• vysledek skenu naleznete v C:\ComboFix.txt, jehoz obsah mi zkopirujte do pristi odpovedi.

• Ulozte nejlepe na plochu FRST.exe/FRST64.exe - https://www.bleepingcomputer.com/downlo ... scan-tool/
• kliknete pravym mysitkem na stazeny FRST a vyberte Spustit jako spravce
• zkontrolujte, ze je zatrzena polozka Addition.txt v pravem dolnim rohu
• kliknete na Scan
• do pristich odpovedi (pravdepodobne se nevlezou do jedne) vlozte obsah vygenerovanych logu FRST.txt i Addition.txt

Error: (07/09/2018 10:45:44 AM) (Source: Microsoft-Windows-Kernel-Processor-Power) (EventID: 34) (User: NT AUTHORITY)
Description: Funkce řízení spotřeby při nečinnosti jsou u procesoru 1 skupiny 0 zakázány z důvodu potíží s firmwarem. Požádejte výrobce počítače o aktualizovaný firmware.

• Znovu spustte FRST.exe/FRST64.exe
• stisknete Ctrl + y (obe klavesy zaroven)
• otevre se fixlist.txt, do nejz vlozte obsah bileho pole nize
• stisknete Ctrl + s (ulozite zmeny), pote fixlist zavrete
• kliknete na tlacitko Fix
• po restartu bude vedle FRST vytvoren fixlog, jehoz obsah vlozte do pristi odpovedi

  Kód: Vybrat vše

  Start
  CreateRestorePoint:
  CloseProcesses:
  File: C:\Windows\SysWOW64\IoctlSvc.exe
  File: c:\windows\SYSNATIVE\drivers\cfidsk.sys
  File: c:\program files (x86)\Setup Files\Ms7529v470\NTIOLib_X64.sys
  File: C:\Windows\DIIUnin.exe
  Folder: C:/ProgramData/Quoteexs
  File: C:/ProgramData/Quoteexs/ff.NT
  File: C:\Users\Tepan\AppData\Local\installer.dat
  Folder: C:\Program Files (x86)\Free
  File: C:\Windows\system32\Drivers\sfi.dat
  Folder: C:\Users\Tepan\AppData\Roaming\Browsers
  File: C:\Program Files (x86)\GGjPoYTUJQygOywtoRR\zHeQkNH.dll
  CMD: type C:\ProgramData\Quoteexs\ff.NT
  CMD: type C:\Users\Tepan\AppData\Local\installer.dat
  Task: {040684E2-746B-4AC4-9B31-F3FA271305A8} - System32\Tasks\{A5924B5D-8DB4-4C60-BCB5-A5EADE420759} => C:\Windows\system32\pcalua.exe -a H:\SETUP.EXE -d H:\
  Task: {30769E10-E67C-485F-A31D-721A1775331C} - System32\Tasks\{702AD2F2-E751-4E1C-845F-44FD9612CE84} => C:\Diablo II\Diablo II.exe
  Task: {5EFDFD78-0EF9-4E96-A8F0-0E31C159C6D0} - System32\Tasks\XQfFOORvlssePLX2 => rundll32 "C:\Program Files (x86)\TULAmsjgU\vahtwL.dll",#1
  C:\Program Files (x86)\TULAmsjgU
  Task: {6ECDFA05-FB6D-496D-B6D5-A89FFB99765A} - System32\Tasks\{66698E77-C66E-40C4-8C7C-3A397B7787CB} => C:\Windows\system32\pcalua.exe -a H:\SETUP.EXE -d H:\
  Task: {7F9A61E8-7477-4450-B418-8D8C19849C89} - System32\Tasks\tYTxWQNiqUDrpykdz2 => rundll32 "C:\Program Files (x86)\GGjPoYTUJQygOywtoRR\zHeQkNH.dll",#1
  Folder: C:\Program Files (x86)\GGjPoYTUJQygOywtoRR
  C:\Program Files (x86)\GGjPoYTUJQygOywtoRR
  Task: {96073FA8-FFE0-4116-9778-58C141C7CFDC} - System32\Tasks\{FAD530BE-DABB-4A35-898F-C241A00668FC} => C:\Diablo II\Diablo II.exe
  Task: {AEA0DEA5-F29F-4B4B-ACB4-B97BD347AD40} - System32\Tasks\{FF156A7F-B168-47A5-9FFC-2ACD88E0EF68} => C:\Windows\system32\pcalua.exe -a D:\Programy\Torrenty\uTorrent\lista_centrum.exe -d d:\Programy\Torrenty\uTorrent
  Task: {B3A34195-55ED-4040-8FBA-DF5AC34B69AB} - System32\Tasks\gsoWYTWjTmmaYK => rundll32 "C:\Program Files (x86)\GMaJHPIyAFmU2\EvoajhBtUwkLf.dll",#1
  C:\Program Files (x86)\GMaJHPIyAFmU2
  Task: {B7DEE81D-5D66-49BA-84B5-7C89319C2B0A} - \Tepan -> No File <==== ATTENTION
  Task: {BD3D0611-1455-4171-A87C-7386CD2DFAF3} - System32\Tasks\{25C6D153-DFD3-4C33-B3B0-4161153DFAAC} => C:\Windows\system32\pcalua.exe -a C:\Windows\DIIUnin.exe -c C:\Windows\DIIUnin.dat
  Task: {BE599165-223F-4809-9E9C-A712556793CA} - System32\Tasks\{C0DF86F4-0923-4C31-B17E-898DF0E55CE3} => C:\Diablo II\Diablo II.exe
  Task: {F38ADF1F-FF55-4786-9411-B757136AA54B} - System32\Tasks\{3559EB80-0C68-40A4-98DF-A26E945BC2B7} => C:\Program Files (x86)\L.A. Noire\LANLauncher.exe [2012-11-16] (Rockstar Games)
  Task: {FC8FD362-B9DF-427B-8BD4-15C1E091F9E6} - System32\Tasks\{DF2A06B5-02CE-43BA-9124-365E2BDF7438} => C:\Program Files (x86)\L.A. Noire\LANLauncher.exe [2012-11-16] (Rockstar Games)
  Task: {FEC1C32C-9F24-4811-A16B-E02101FCB4A3} - System32\Tasks\{05B2A4A4-A4BB-4C53-96E1-786E630B5985} => C:\Diablo II\Diablo II.exe
  Shortcut: C:\Users\Tepan\Desktop\firеfох – zástuрсе.lnk -> C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation) <==== Cyrillic
  Shortcut: C:\Users\Tepan\Desktop\Ochrana pocitace\Spoustece\DАEМОN Tооls Lite.lnk -> C:\Users\Tepan\AppData\Roaming\Browsers\exe.rehcnualtd.bat (No File) <==== Cyrillic
  Shortcut: C:\Users\Tepan\Desktop\Hry\LАNLaunсhеr – zástuрcе.lnk -> C:\Users\Tepan\AppData\Roaming\Browsers\exe.rehcnualnal.bat (No File) <==== Cyrillic
  Shortcut: C:\Users\Tepan\Desktop\Hry\Тhe Sаboteur.lnk -> C:\Users\Tepan\AppData\Roaming\Browsers\exe.rehcnualruetobas.bat (No File) <==== Cyrillic
  Shortcut: C:\Users\Tepan\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Gоoglе Сhrоmе.lnk -> C:\Users\Tepan\AppData\Roaming\Browsers\exe.emorhc.bat (No File) <==== Cyrillic
  Shortcut: C:\Users\Tepan\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\firеfох – zástuрсе.lnk -> C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation) <==== Cyrillic
  FirewallRules: [{907BDFE9-1492-405C-A0D3-C8881BFE879C}] => (Allow) 㩃啜敳獲呜灥湡䅜灰慄慴剜慯業杮湜瑯灥摡欳湜瑯灥摡欳攮數
  FirewallRules: [{AE1ADF2D-E091-4DCE-8775-7577F9AD849F}] => (Allow) 㩃啜敳獲呜灥湡䅜灰慄慴剜慯業杮湜瑯灥摡欳湜瑯略摰攮數
  HKLM-x32\...\Run: [GrooveMonitor] => C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe [30040 2017-07-16] (Microsoft Corporation)
  GroupPolicy: Restriction - Chrome <==== ATTENTION
  CHR HKLM\SOFTWARE\Policies\Google: Restriction <==== ATTENTION
  SearchScopes: HKLM-x32 -> DefaultScope value is missing
  SearchScopes: HKLM-x32 -> {15C4DF55-4B67-495A-A3D3-A497C4A49EE0} URL = hxxp://search.seznam.cz/?sourceid=quicksearch_22668&q={searchTerms}
  SearchScopes: HKU\S-1-5-21-1029120089-3632672932-3177029402-1001 -> DefaultScope {15C4DF55-4B67-495A-A3D3-A497C4A49EE0} URL = hxxp://search.seznam.cz/?sourceid=quicksearch_22668&q={searchTerms}
  SearchScopes: HKU\S-1-5-21-1029120089-3632672932-3177029402-1001 -> {012E1000-F331-11DB-8314-0800200C9A66} URL = hxxp://www.google.com/search?q={searchTerms}
  SearchScopes: HKU\S-1-5-21-1029120089-3632672932-3177029402-1001 -> {15C4DF55-4B67-495A-A3D3-A497C4A49EE0} URL = hxxp://search.seznam.cz/?sourceid=quicksearch_22668&q={searchTerms}
  FF NewTab: Mozilla\Firefox\Profiles\cj0rqt4a.default-1499283777627 -> file:///C:/ProgramData/Quoteexs/ff.NT
  CHR Extension: (No Name) - C:\Users\Tepan\AppData\Local\Google\Chrome\User Data\Default\Extensions\bgjpfhpjcgdppjbgnpnjllokbmcdllig [2018-07-09]
  CHR Extension: (No Name) - C:\Users\Tepan\AppData\Local\Google\Chrome\User Data\Default\Extensions\blmojkbhnkkphngknkmgccmlenfaelkd [2018-07-09]
  CHR Extension: (No Name) - C:\Users\Tepan\AppData\Local\Google\Chrome\User Data\Default\Extensions\cjmammaianfcnbbchgeeajdcifiihglj [2015-12-08]
  CHR Extension: (Google Search) - C:\Users\Tepan\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2016-01-12]
  OPR Extension: (No Name) - C:\Users\Tepan\AppData\Roaming\Opera Software\Opera Stable\Extensions\pbdpajcdgknpendpmecafmopknefafha [2017-07-05]
  S2 wsaudio; %SystemRoot%\System32\wsaudio.dll [X]
  U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation) <==== ATTENTION (no ServiceDLL)
  S3 catchme; \??\C:\ComboFix\catchme.sys [X]
  S1 cfidsk; system32\drivers\cfidsk.sys [X]
  S3 cpuz136; \??\C:\Windows\TEMP\cpuz136\cpuz136_x64.sys [X]
  2018-07-01 16:30 - 2018-07-02 16:11 - 000000000 ____D C:\Users\Tepan\AppData\Roaming\pzkpt4sd32a
  2018-07-01 16:30 - 2018-07-02 16:11 - 000000000 ____D C:\Users\Tepan\AppData\Roaming\gelbno2eyyh
  2018-07-01 16:09 - 2018-07-02 16:11 - 000000000 ____D C:\Users\Tepan\AppData\Roaming\miwbdard0wp
  2018-07-01 16:09 - 2018-07-02 16:11 - 000000000 ____D C:\Users\Tepan\AppData\Roaming\avsqbot05rz
  2018-07-01 16:07 - 2018-07-01 16:07 - 000262144 ____N C:\Windows\Minidump\070118-20826-01.dmp
  2018-07-01 14:58 - 2018-07-02 16:11 - 000000000 ____D C:\Users\Tepan\AppData\Roaming\mk0gul1noyn
  2018-07-01 14:58 - 2018-07-02 16:11 - 000000000 ____D C:\Users\Tepan\AppData\Roaming\2gnybw34dwz
  2018-07-01 14:50 - 2018-07-01 14:50 - 000000000 ____D C:\Program Files\T5LJV3ID65
  2018-07-01 14:49 - 2018-07-01 14:50 - 000000000 ____D C:\Users\Tepan\AppData\Roaming\vwyyylm1u0b
  2018-07-01 14:49 - 2018-07-01 14:50 - 000000000 ____D C:\Users\Tepan\AppData\Roaming\iuhdbmzomqu
  2018-07-01 14:49 - 2018-07-01 14:50 - 000000000 ____D C:\Program Files\HTN5PNVEAM
  2018-07-01 14:23 - 2018-07-02 16:11 - 000000000 ____D C:\Users\Tepan\AppData\Roaming\vrxaumt5ddw
  2018-07-01 14:23 - 2018-07-02 16:11 - 000000000 ____D C:\Users\Tepan\AppData\Roaming\fsfdhszy4sp
  2018-07-01 13:43 - 2018-07-02 16:11 - 000000000 ____D C:\Users\Tepan\AppData\Roaming\x4hj3lqo2ls
  2018-07-01 13:43 - 2018-07-02 10:29 - 000000000 ____D C:\Users\Tepan\AppData\Roaming\ecwkntjpfhf
  CMD: dir "C:\PROGRA~1"
  CMD: dir "C:\PROGRA~2"
  CMD: dir "C:\PROGRA~3"
  CMD: dir "%localappdata%"
  CMD: dir "%appdata%"
  Hosts:
  EmptyTemp:
  End

• Znovu spustte FRST.exe/FRST64.exe
• stisknete Ctrl + y (obe klavesy zaroven)
• otevre se fixlist.txt, do nejz vlozte obsah bileho pole nize
• stisknete Ctrl + s (ulozite zmeny), pote fixlist zavrete
• kliknete na tlacitko Fix
• po restartu bude vedle FRST vytvoren fixlog, jehoz obsah vlozte do pristi odpovedi

  Kód: Vybrat vše

  Start
  CreateRestorePoint:
  CloseProcesses:
  U5 BFE; <==== ATTENTION: Locked Service
  2018-07-11 10:41 - 2016-11-13 23:23 - 000726704 _____ C:\Windows\system32\Drivers\fvstore.dat
  2018-07-01 13:31 - 2018-07-01 13:31 - 000140800 _____ () C:\Users\Tepan\AppData\Local\installer.dat
  Task: {0703CF5A-8013-468F-A5F4-5D44C9DA8935} - no filepath
  Task: {306EF145-F9B4-4D95-9812-303C88101FB3} - no filepath
  Task: {49FDC536-31F5-4541-9C90-755A4946B5AB} - no filepath
  Task: {4AEB0177-A5EC-4638-B078-D75B00E04265} - no filepath
  Task: {81A1FA8A-9850-4FBA-AE76-A2325FA8AC84} - no filepath
  Task: {AEA0DEA5-F29F-4B4B-ACB4-B97BD347AD40} - no filepath
  Task: {B7DEE81D-5D66-49BA-84B5-7C89319C2B0A} - no filepath
  Task: {BD3D0611-1455-4171-A87C-7386CD2DFAF3} - no filepath
  C:\Users\Tepan\AppData\Local\Google\Chrome\User Data\System Profile\Extensions\coiagddgpmoccinljjidkpgonimejcnk
  C:\Users\Tepan\AppData\Local\Google\Chrome\User Data\Default\Extensions\coiagddgpmoccinljjidkpgonimejcnk
  StartMenuInternet: Google Chrome.XFTHEVSGWAYNGGKTIHVB3OUHNE - C:\Users\Tepan\AppData\Local\Google\Chrome\Application\chrome.exe
  C:\Users\Tepan\AppData\Roaming\Opera Software\Opera Stable\Extensions\bgafbmpmdmlbbpbaipgpbkdlfgnepgao
  End

Znovu spustte FRST.exe/FRST64.exe