VIRY.CZ

Dobrý den,

prosím o preventivní kontrolu, kdy se mi už týden po aktualizaci win ze začátku minulého týdne seká NTB, Outlook byl zcela rozhozen. Děkuji mockrát.
Přeji hezký den, Spikl.

Zdravím!

Otevřte poznámkový blok a zkopírujte do něj:

Start

CloseProcesses:
HKLM\SOFTWARE\Microsoft\Windows Defender: [DisableAntiSpyware] Restriction <==== ATTENTION
HKLM\SOFTWARE\Microsoft\Windows Defender: [DisableAntiVirus] Restriction <==== ATTENTION
HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate: Restriction <==== ATTENTION
HKU\S-1-5-21-1550777172-1064289030-2755600149-1002\...\MountPoints2: {1fdfe16d-75e0-11e7-a818-8878730a2976} - "H:\WD Drive Unlock.exe" autoplay=true
HKU\S-1-5-21-1550777172-1064289030-2755600149-1002\...\MountPoints2: {45266e2d-7906-11e7-a819-8878730a2972} - "G:\autorun.exe"
HKLM\SOFTWARE\Policies\Google: Restriction <==== ATTENTION
Task: {4563664A-D6B0-4F0E-9197-7FC34000AE61} - System32\Tasks\HP\HP Hotkey Support\Start QLBController Process => C:\Program Files (x86)\HP\HP Hotkey Support\QLBController.exe (No File)
Task: {301DA274-4810-4630-A6F4-22E284E7DE5A} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [154920 2019-05-27] (Google Inc -> Google LLC)
Task: {C7E6E805-F2E6-44C9-B47E-95C6F23EAA13} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [154920 2019-05-27] (Google Inc -> Google LLC)
Edge Extension: (No Name) -> AutoFormFill_5ED10D46BD7E47DEB1F3685D2C0FCE08 => C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\Assets\HostExtensions\AutoFormFill [not found]
Edge Extension: (No Name) -> BookReader_B171F20233094AC88D05A8EF7B9763E8 => C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\Assets\BookViewer [not found]
Edge Extension: (No Name) -> LearningTools_7706F933-971C-41D1-9899-8A026EB5D824 => C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\Assets\HostExtensions\LearningTools [not found]
Edge Extension: (No Name) -> PinJSAPI_EC01B57063BE468FAB6DB7EBFC3BF368 => C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\Assets\HostExtensions\PinJSAPI [not found]
FF HKLM-x32\...\Firefox\Extensions: [dpmaxz_ng@jetpack] - c:\Program Files (x86)\HP\HP ProtectTools Security Manager\Bin\BrowserExt\dpchrome => not found
FF ExtraCheck: C:\Program Files (x86)\mozilla firefox\defaults\pref\kl_prefs_62fbb8f7_c917_4cf7_957a_aad2b8fa768c.js [2019-05-23] <==== ATTENTION (Points to *.cfg file)
FF ExtraCheck: C:\Program Files (x86)\mozilla firefox\kl_config_62fbb8f7_c917_4cf7_957a_aad2b8fa768c.cfg [2019-05-23] <==== ATTENTION
C:\DumpStack.log.tmp
CustomCLSID: HKU\S-1-5-21-1550777172-1064289030-2755600149-1002_Classes\CLSID\{4AC6DFE1-607B-45B2-B289-D7FBCD44169C}\localserver32 -> F:\Program Files\Autodesk\AutoCAD 2019\acad.exe /Automation => No File
CustomCLSID: HKU\S-1-5-21-1550777172-1064289030-2755600149-1002_Classes\CLSID\{74D0CE91-F931-4FAC-BEA9-EE32E43EAD37}\localserver32 -> F:\Program Files\Autodesk\AutoCAD 2019\acad.exe => No File
ContextMenuHandlers1: [7-Zip] -> {23170F69-40C1-278A-1000-000100020000} => -> No File
ContextMenuHandlers1: [ANotepad++64] -> {B298D29A-A6ED-11DE-BA8C-A68E55D89593} => -> No File
ContextMenuHandlers1: [BriefcaseMenu] -> {85BBD920-42A0-1069-A2E4-08002B30309D} => -> No File
ContextMenuHandlers1: [CLVDShellExt] -> {3E2A0A32-6E14-4BAD-AA87-BBB6A75EBFF2} => -> No File
ContextMenuHandlers2: [CLVDShellExt] -> {3E2A0A32-6E14-4BAD-AA87-BBB6A75EBFF2} => -> No File
ContextMenuHandlers3: [{4A7C4306-57E0-4C0C-83A9-78C1528F618C}] -> {4A7C4306-57E0-4C0C-83A9-78C1528F618C} => -> No File
ContextMenuHandlers4: [7-Zip] -> {23170F69-40C1-278A-1000-000100020000} => -> No File
ContextMenuHandlers5: [igfxcui] -> {3AB1675A-CCFF-11D2-8B20-00A0C93CB1F4} => -> No File
ContextMenuHandlers6: [BriefcaseMenu] -> {85BBD920-42A0-1069-A2E4-08002B30309D} => -> No File
AlternateDataStreams: C:\Users\Public\Shared Files:VersionCache [474]
FirewallRules: [{3DEC3873-EC4D-49C4-A0A3-B81F9FEC5038}] => (Allow) C:\Users\winti\AppData\Roaming\Zoom\bin\airhost.exe => No File
FirewallRules: [{F7D54957-3686-4A23-A225-C83D1B6ADE58}] => (Allow) C:\Users\winti\AppData\Roaming\Zoom\bin\Zoom.exe => No File
FirewallRules: [{A939E1AA-CF6E-4C55-A466-6F38C8ED6A5F}] => (Allow) C:\HP_LaserJet_400_MFP_M425\Installer\hpbcsiInstaller.exe => No File
FirewallRules: [{0D027D51-6F77-4FC8-8C04-8D796996346A}] => (Allow) C:\HP_LaserJet_400_MFP_M425\Installer\hpbcsiInstaller.exe => No File
FirewallRules: [{E3882E6D-7BF2-436C-B262-5A8A0E2B1672}] => (Allow) F:\uTorrent\utorrent.exe => No File
FirewallRules: [{824E36F6-7B30-4C1F-BDEE-038C108CEA45}] => (Allow) F:\uTorrent\utorrent.exe => No File
FirewallRules: [{D076C56C-7D45-4A35-8289-70D2A202D0B9}] => (Allow) C:\Program Files (x86)\HP\csiInstaller\568705AA-DD8A-4134-B8B9-9609721FBBCE\Installer\hpbcsiInstaller.exe => No File
FirewallRules: [{74D655CF-901E-4BED-9DCE-798DDC0DFC1C}] => (Allow) C:\Program Files (x86)\HP\csiInstaller\568705AA-DD8A-4134-B8B9-9609721FBBCE\Installer\hpbcsiInstaller.exe => No File

Hosts:
EmptyTemp:
End

Uložte do F:\uTorrent\Stažené soubory jako fixlist.txt. Spusťte znovu FRST a klikněte na >Fix<. Po skončení akce se objeví log, který sem zkopírujte.

Dobrý den,

děkuji za reakci a zasílám fixlog:

Fix result of Farbar Recovery Scan Tool (x64) Version: 26-01-2023
Ran by winti (26-01-2023 15:36:31) Run:1
Running from F:\uTorrent\Stažené soubory
Loaded Profiles: winti & Jantar & natyn
Boot Mode: Normal
==============================================

fixlist content:
*****************
Start

CloseProcesses:
HKLM\SOFTWARE\Microsoft\Windows Defender: [DisableAntiSpyware] Restriction <==== ATTENTION
HKLM\SOFTWARE\Microsoft\Windows Defender: [DisableAntiVirus] Restriction <==== ATTENTION
HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate: Restriction <==== ATTENTION
HKU\S-1-5-21-1550777172-1064289030-2755600149-1002\...\MountPoints2: {1fdfe16d-75e0-11e7-a818-8878730a2976} - "H:\WD Drive Unlock.exe" autoplay=true
HKU\S-1-5-21-1550777172-1064289030-2755600149-1002\...\MountPoints2: {45266e2d-7906-11e7-a819-8878730a2972} - "G:\autorun.exe"
HKLM\SOFTWARE\Policies\Google: Restriction <==== ATTENTION
Task: {4563664A-D6B0-4F0E-9197-7FC34000AE61} - System32\Tasks\HP\HP Hotkey Support\Start QLBController Process => C:\Program Files (x86)\HP\HP Hotkey Support\QLBController.exe (No File)
Task: {301DA274-4810-4630-A6F4-22E284E7DE5A} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [154920 2019-05-27] (Google Inc -> Google LLC)
Task: {C7E6E805-F2E6-44C9-B47E-95C6F23EAA13} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [154920 2019-05-27] (Google Inc -> Google LLC)
Edge Extension: (No Name) -> AutoFormFill_5ED10D46BD7E47DEB1F3685D2C0FCE08 => C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\Assets\HostExtensions\AutoFormFill [not found]
Edge Extension: (No Name) -> BookReader_B171F20233094AC88D05A8EF7B9763E8 => C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\Assets\BookViewer [not found]
Edge Extension: (No Name) -> LearningTools_7706F933-971C-41D1-9899-8A026EB5D824 => C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\Assets\HostExtensions\LearningTools [not found]
Edge Extension: (No Name) -> PinJSAPI_EC01B57063BE468FAB6DB7EBFC3BF368 => C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\Assets\HostExtensions\PinJSAPI [not found]
FF HKLM-x32\...\Firefox\Extensions: [dpmaxz_ng@jetpack] - c:\Program Files (x86)\HP\HP ProtectTools Security Manager\Bin\BrowserExt\dpchrome => not found
FF ExtraCheck: C:\Program Files (x86)\mozilla firefox\defaults\pref\kl_prefs_62fbb8f7_c917_4cf7_957a_aad2b8fa768c.js [2019-05-23] <==== ATTENTION (Points to *.cfg file)
FF ExtraCheck: C:\Program Files (x86)\mozilla firefox\kl_config_62fbb8f7_c917_4cf7_957a_aad2b8fa768c.cfg [2019-05-23] <==== ATTENTION
C:\DumpStack.log.tmp
CustomCLSID: HKU\S-1-5-21-1550777172-1064289030-2755600149-1002_Classes\CLSID\{4AC6DFE1-607B-45B2-B289-D7FBCD44169C}\localserver32 -> F:\Program Files\Autodesk\AutoCAD 2019\acad.exe /Automation => No File
CustomCLSID: HKU\S-1-5-21-1550777172-1064289030-2755600149-1002_Classes\CLSID\{74D0CE91-F931-4FAC-BEA9-EE32E43EAD37}\localserver32 -> F:\Program Files\Autodesk\AutoCAD 2019\acad.exe => No File
ContextMenuHandlers1: [7-Zip] -> {23170F69-40C1-278A-1000-000100020000} => -> No File
ContextMenuHandlers1: [ANotepad++64] -> {B298D29A-A6ED-11DE-BA8C-A68E55D89593} => -> No File
ContextMenuHandlers1: [BriefcaseMenu] -> {85BBD920-42A0-1069-A2E4-08002B30309D} => -> No File
ContextMenuHandlers1: [CLVDShellExt] -> {3E2A0A32-6E14-4BAD-AA87-BBB6A75EBFF2} => -> No File
ContextMenuHandlers2: [CLVDShellExt] -> {3E2A0A32-6E14-4BAD-AA87-BBB6A75EBFF2} => -> No File
ContextMenuHandlers3: [{4A7C4306-57E0-4C0C-83A9-78C1528F618C}] -> {4A7C4306-57E0-4C0C-83A9-78C1528F618C} => -> No File
ContextMenuHandlers4: [7-Zip] -> {23170F69-40C1-278A-1000-000100020000} => -> No File
ContextMenuHandlers5: [igfxcui] -> {3AB1675A-CCFF-11D2-8B20-00A0C93CB1F4} => -> No File
ContextMenuHandlers6: [BriefcaseMenu] -> {85BBD920-42A0-1069-A2E4-08002B30309D} => -> No File
AlternateDataStreams: C:\Users\Public\Shared Files:VersionCache [474]
FirewallRules: [{3DEC3873-EC4D-49C4-A0A3-B81F9FEC5038}] => (Allow) C:\Users\winti\AppData\Roaming\Zoom\bin\airhost.exe => No File
FirewallRules: [{F7D54957-3686-4A23-A225-C83D1B6ADE58}] => (Allow) C:\Users\winti\AppData\Roaming\Zoom\bin\Zoom.exe => No File
FirewallRules: [{A939E1AA-CF6E-4C55-A466-6F38C8ED6A5F}] => (Allow) C:\HP_LaserJet_400_MFP_M425\Installer\hpbcsiInstaller.exe => No File
FirewallRules: [{0D027D51-6F77-4FC8-8C04-8D796996346A}] => (Allow) C:\HP_LaserJet_400_MFP_M425\Installer\hpbcsiInstaller.exe => No File
FirewallRules: [{E3882E6D-7BF2-436C-B262-5A8A0E2B1672}] => (Allow) F:\uTorrent\utorrent.exe => No File
FirewallRules: [{824E36F6-7B30-4C1F-BDEE-038C108CEA45}] => (Allow) F:\uTorrent\utorrent.exe => No File
FirewallRules: [{D076C56C-7D45-4A35-8289-70D2A202D0B9}] => (Allow) C:\Program Files (x86)\HP\csiInstaller\568705AA-DD8A-4134-B8B9-9609721FBBCE\Installer\hpbcsiInstaller.exe => No File
FirewallRules: [{74D655CF-901E-4BED-9DCE-798DDC0DFC1C}] => (Allow) C:\Program Files (x86)\HP\csiInstaller\568705AA-DD8A-4134-B8B9-9609721FBBCE\Installer\hpbcsiInstaller.exe => No File

Hosts:
EmptyTemp:
End
*****************

Processes closed successfully.
HKLM\SOFTWARE\Microsoft\Windows Defender\\"DisableAntiSpyware"="0" => value restored successfully
HKLM\SOFTWARE\Microsoft\Windows Defender\\"DisableAntiVirus"="0" => value restored successfully
HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate => removed successfully
HKU\S-1-5-21-1550777172-1064289030-2755600149-1002\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{1fdfe16d-75e0-11e7-a818-8878730a2976} => removed successfully
HKU\S-1-5-21-1550777172-1064289030-2755600149-1002\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{45266e2d-7906-11e7-a819-8878730a2972} => removed successfully
HKLM\SOFTWARE\Policies\Google => removed successfully
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{4563664A-D6B0-4F0E-9197-7FC34000AE61}" => removed successfully
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{4563664A-D6B0-4F0E-9197-7FC34000AE61}" => removed successfully
C:\WINDOWS\System32\Tasks\HP\HP Hotkey Support\Start QLBController Process => moved successfully
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\HP\HP Hotkey Support\Start QLBController Process" => removed successfully
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{301DA274-4810-4630-A6F4-22E284E7DE5A}" => removed successfully
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{301DA274-4810-4630-A6F4-22E284E7DE5A}" => removed successfully
C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineCore => moved successfully
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\GoogleUpdateTaskMachineCore" => removed successfully
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{C7E6E805-F2E6-44C9-B47E-95C6F23EAA13}" => removed successfully
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{C7E6E805-F2E6-44C9-B47E-95C6F23EAA13}" => removed successfully
C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineUA => moved successfully
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\GoogleUpdateTaskMachineUA" => removed successfully
HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\Config\AutoFormFill_5ED10D46BD7E47DEB1F3685D2C0FCE08 => removed successfully
HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\Config\BookReader_B171F20233094AC88D05A8EF7B9763E8 => removed successfully
HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\Config\LearningTools_7706F933-971C-41D1-9899-8A026EB5D824 => removed successfully
HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\Config\PinJSAPI_EC01B57063BE468FAB6DB7EBFC3BF368 => removed successfully
"HKLM\Software\Wow6432Node\Mozilla\Firefox\Extensions\\dpmaxz_ng@jetpack" => removed successfully
C:\Program Files (x86)\mozilla firefox\defaults\pref\kl_prefs_62fbb8f7_c917_4cf7_957a_aad2b8fa768c.js => moved successfully
C:\Program Files (x86)\mozilla firefox\kl_config_62fbb8f7_c917_4cf7_957a_aad2b8fa768c.cfg => moved successfully
Could not move "C:\DumpStack.log.tmp" => Scheduled to move on reboot.
HKU\S-1-5-21-1550777172-1064289030-2755600149-1002_Classes\CLSID\{4AC6DFE1-607B-45B2-B289-D7FBCD44169C} => removed successfully
HKU\S-1-5-21-1550777172-1064289030-2755600149-1002_Classes\CLSID\{74D0CE91-F931-4FAC-BEA9-EE32E43EAD37} => removed successfully
HKLM\Software\Classes\*\ShellEx\ContextMenuHandlers\7-Zip => removed successfully
HKLM\Software\Classes\*\ShellEx\ContextMenuHandlers\ANotepad++64 => removed successfully
HKLM\Software\Classes\*\ShellEx\ContextMenuHandlers\BriefcaseMenu => removed successfully
"HKLM\Software\Classes\CLSID\{85BBD920-42A0-1069-A2E4-08002B30309D}" => removed successfully
HKLM\Software\Classes\*\ShellEx\ContextMenuHandlers\CLVDShellExt => removed successfully
HKLM\Software\Classes\Drive\ShellEx\ContextMenuHandlers\CLVDShellExt => removed successfully
HKLM\Software\Classes\AllFileSystemObjects\ShellEx\ContextMenuHandlers\{4A7C4306-57E0-4C0C-83A9-78C1528F618C} => removed successfully
HKLM\Software\Classes\Directory\ShellEx\ContextMenuHandlers\7-Zip => removed successfully
HKLM\Software\Classes\Directory\Background\ShellEx\ContextMenuHandlers\igfxcui => removed successfully
HKLM\Software\Classes\Folder\ShellEx\ContextMenuHandlers\BriefcaseMenu => removed successfully
C:\Users\Public\Shared Files => ":VersionCache" ADS removed successfully
"HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\{3DEC3873-EC4D-49C4-A0A3-B81F9FEC5038}" => removed successfully
"HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\{F7D54957-3686-4A23-A225-C83D1B6ADE58}" => removed successfully
"HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\{A939E1AA-CF6E-4C55-A466-6F38C8ED6A5F}" => removed successfully
"HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\{0D027D51-6F77-4FC8-8C04-8D796996346A}" => removed successfully
"HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\{E3882E6D-7BF2-436C-B262-5A8A0E2B1672}" => removed successfully
"HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\{824E36F6-7B30-4C1F-BDEE-038C108CEA45}" => removed successfully
"HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\{D076C56C-7D45-4A35-8289-70D2A202D0B9}" => removed successfully
"HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\{74D655CF-901E-4BED-9DCE-798DDC0DFC1C}" => removed successfully
C:\Windows\System32\Drivers\etc\hosts => moved successfully
Hosts restored successfully.

=========== EmptyTemp: ==========

FlushDNS => completed
BITS transfer queue => 1572864 B
DOMStore, IE Recovery, AppCache, Feeds Cache, Thumbcache, IconCache => 331871909 B
Java, Discord, Steam htmlcache, WinHttpAutoProxySvc/winhttp *.cache => 0 B
Windows/system/drivers => 163856229 B
Edge => 1079510 B
Chrome => 64391686 B
Firefox => 70320799 B
Opera => 423490600 B

Temp, IE cache, history, cookies, recent:
Default => 6656 B
ProgramData => 6656 B
Public => 6656 B
systemprofile => 392718 B
systemprofile32 => 433331 B
LocalService => 1591421 B
NetworkService => 1592543 B
winti => 627679256 B
Jantar => 627691952 B
natyn => 627724939 B

RecycleBin => 0 B
EmptyTemp: => 2.7 GB temporary data Removed.

================================

Result of scheduled files to move (Boot Mode: Normal) (Date&Time: 26-01-2023 18:47:09)

C:\DumpStack.log.tmp => Could not move

==== End of Fixlog 18:47:09 ====

Smazáno, log by již měl být OK.

Mockrát děkuji.

Rádo se stalo!