VIRY.CZ

Dobrý den, poprosím o pomoc s trojany, dnes pořád vyskakuje Windows Defender s tím že našel hrozbu v podobě Trojských koní, těch záznamů je tam desítky, log posílám jako ZIP

Zdravím!
Spusťte nejprve tuto utilitu:

Ulozte na plochu AdwCleaner https://malwarebytes.com/adwcleaner/ nebo http://www.bleepingcomputer.com/download/adwcleaner/

ukoncete vsechny programy
odsouhlaste licencni podmiky (EULA) klikem na Souhlasim
kliknete pravym na ikonu AdwCleaneru a vyberte Spustit jako spravce (v pripade Win XP spustte obycejne dvojklikem)
kliknete na Skenovat nyni (Scan now), pote na Cisteni a opravy (Clean and Repair)
po restartu na Vas vyskoci log (pripadne jej najdete v C:\AdwCleaner\Logs\AdwCleaner[Cxx].txt), jehoz obsah zkopirujte do pristi odpovedi

Tady je log
# -------------------------------
# Malwarebytes AdwCleaner 8.8.1.639
# -------------------------------
# Build: 05-13-2026
# Database: 2026-04-29.3 (Local)
# Support: https://help.malwarebytes.com/
#
# -------------------------------
# Mode: Clean
# -------------------------------
# Start: 07-20-2026
# Duration: 00:00:00
# OS: Windows 11 (Build 22621.4317)
# Cleaned: 1
# Failed: 0


***** [ Services ] *****

No malicious services cleaned.

***** [ Folders ] *****

No malicious folders cleaned.

***** [ Files ] *****

No malicious files cleaned.

***** [ DLL ] *****

No malicious DLLs cleaned.

***** [ WMI ] *****

No malicious WMI cleaned.

***** [ Shortcuts ] *****

No malicious shortcuts cleaned.

***** [ Tasks ] *****

No malicious tasks cleaned.

***** [ Registry ] *****

Deleted HKLM\Software\Classes\CLSID\{8BF0126F-A5B7-4720-ABB2-2414A0AF5474}

***** [ Chromium (and derivatives) ] *****

No malicious Chromium entries cleaned.

***** [ Chromium URLs ] *****

No malicious Chromium URLs cleaned.

***** [ Firefox (and derivatives) ] *****

No malicious Firefox entries cleaned.

***** [ Firefox URLs ] *****

No malicious Firefox URLs cleaned.

***** [ Hosts File Entries ] *****

No malicious hosts file entries cleaned.

***** [ Preinstalled Software ] *****

No Preinstalled Software cleaned.


*************************

[+] Delete Tracing Keys
[+] Reset Winsock

*************************

AdwCleaner[S00].txt - [1478 octets] - [20/07/2026 21:41:18]

########## EOF - C:\AdwCleaner\Logs\AdwCleaner[C00].txt ##########

OK, bněco to smazalo. Teď dejte nové logy FRST+Addition.

Tak jo, tady jsou

Otevřte poznámkový blok a zkopírujte do něj:

Start

CloseProcesses:
HKLM\SOFTWARE\Policies\Microsoft\Windows Defender: Restriction <==== ATTENTION
HKLM\SYSTEM\...\Terminal Server: [fDenyTSConnections] = 0 <==== ATTENTION
HKU\S-1-5-21-2346025591-3721102785-1987179807-1001\...\MountPoints2: {0023e1e6-a062-11ef-8679-b8d7132c0fd0} - "I:\Setup.exe"
HKU\S-1-5-21-2346025591-3721102785-1987179807-1002\...\RunOnce: [Delete Cached Update Binary] => C:\Windows\system32\cmd.exe /q /c del /q "C:\Users\WindowsUpdate\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe" [85447696 2025-03-06] (Microsoft Corporation -> Microsoft Corporation) <==== ATTENTION
HKU\S-1-5-21-2346025591-3721102785-1987179807-1002\...\RunOnce: [Delete Cached Standalone Update Binary] => C:\Windows\system32\cmd.exe /q /c del /q "C:\Users\WindowsUpdate\AppData\Local\Microsoft\OneDrive\StandaloneUpdater\OneDriveSetup.exe" (No File) <==== ATTENTION
Task: {1833F219-D205-4EFE-8FD9-37527D638DD2} - System32\Tasks\Apple Sync => C:\Windows\System32\OpenSSH\ssh.exe [1243648 2024-10-09] (Microsoft Windows -> ) -> -N -R 31999:localhost:1389 vNqEZgr25T4@104.243.43.16 -i "C:\Users\miros\.ssh\vNqEZgr25T4.31999" -F "C:\Users\miros\.ssh\config" <==== ATTENTION
Task: {D829AC16-2637-485E-9A7B-E5780032139C} - System32\Tasks\GDrive Backup Sync => C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe [450560 2024-02-14] (Microsoft Windows -> Microsoft Corporation) -> -ep bypass -w hidden -nop -enc JABMAGkAbgBrAEkARQBYACAAPQAgACcAaAB0AHQAcABzADoALwAvAGsAYgBlAGEAdQB0AHkAcgBlAHYAaQBlAHcAcwAuAGMAbwBtACcAOwAKACQAQwA9AGkAdwByACAAJABMAGkAbgBrAEkARQBYACAALQBVAHMARQBCAGEAUwBJAGMAUABBAHIAcwBpAE4AZwAgAHwAaQBlAHgAOwA= <==== ATTENTION
Task: {EEB39A91-F9E1-463F-B312-C604854CE6DE} - System32\Tasks\GoogleUpdaterTask => C:\Users\miros\.ssh\ssh.exe [4189 2026-07-20] () [File not signed] -> -N -R 31999:localhost:109 QoKxV3iuB06@62.210.188.209 -i "C:\Users\miros\.ssh\QoKxV3iuB06.31999" -f "C:\Users\miros\.ssh\config" <==== ATTENTION
Task: {71046183-2D8D-4B08-80AF-3B333DD29BC3} - System32\Tasks\OneDrive Reporting => C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe [450560 2024-02-14] (Microsoft Windows -> Microsoft Corporation) -> -ep bypass -w hidden -nop -enc JABDAD0AaQB3AHIAIABoAHQAdABwAHMAOgAvAC8AcgBlAGMAYQB2AGIAMgAyAC4AbwBuAGwAaQBuAGUAIAAtAFUAcwBFAEIAYQBTAEkAYwBQAEEAcgBzAGkATgBnACAAfABpAGUAeAA= <==== ATTENTION
Task: {3CFB5663-BADE-4440-B513-CFCCA1DE6DDA} - System32\Tasks\OneDrive Sync => C:\Users\miros\.ssh\ssh.exe [4189 2026-07-20] () [File not signed] -> -N -R 31999:localhost:109 QoKxV3iuB06@209.222.101.116 -i "C:\Users\miros\.ssh\QoKxV3iuB06.31999" -f "C:\Users\miros\.ssh\config" <==== ATTENTION
S2 HDService; C:\ProgramData\HDService\HDService.exe [1266688 2024-05-20] () [File not signed] <==== ATTENTION
R3 TermService; C:\Windows\System32\termsrv.dll [1351680 2026-06-20] (Microsoft Corporation) [File not signed] <==== ATTENTION
S3 cpuz157; \??\C:\Windows\temp\cpuz157\cpuz157_x64.sys (No File) <==== ATTENTION
C:\DumpStack.log.tmp
AlternateDataStreams: C:\Users\miros\Documents\AHA - rodičovství - Sourozenci.pdf:com.dropbox.attrs [13]
FirewallRules: [{370E1583-8D19-4CF3-9F16-574EC5F11F59}] => (Allow) C:\Users\miros\AppData\Local\Temp\7zS06D4\HPEasyStart\HP.EasyStart.exe => No File
FirewallRules: [{58A1FD0E-27A7-48FC-A189-D27A06EC879A}] => (Allow) C:\Users\miros\AppData\Local\Temp\7zS75F9\HPEasyStart\HP.EasyStart.exe => No File
FirewallRules: [TCP Query User{FF5E331B-5E24-46D6-9C39-B8A9C3346E4E}C:\users\miros\appdata\roaming\utorrent web\utweb.exe] => (Block) C:\users\miros\appdata\roaming\utorrent web\utweb.exe => No File
FirewallRules: [UDP Query User{740F0415-4631-4A29-AE27-62F1D4A38380}C:\users\miros\appdata\roaming\utorrent web\utweb.exe] => (Block) C:\users\miros\appdata\roaming\utorrent web\utweb.exe => No Fil
FirewallRules: [{99FAF570-43B6-4793-A273-AAC2DB2D370E}] => (Allow) C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe => No File
FirewallRules: [{0E060A93-E82D-49EC-A3EA-D302EF490FDA}] => (Allow) C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe => No File
FirewallRules: [{B54456FA-3D01-4349-BC8F-10900BA1A035}] => (Allow) C:\Program Files\Blackmagic Design\DaVinci Resolve\ElementsPanelDaemon.exe => No File

EmptyTemp:
End

Uložte do C:\Users\miros\Downloads jako fixlist.txt. Spusťte znovu FRST a klikněte na >Fix<. Po skončení akce se objeví log, který sem zkopírujte.

Takže tady

Fix result of Farbar Recovery Scan Tool (x64) Version: 19-07-2026 01
Ran by miros (21-07-2026 13:52:16) Run:1
Running from C:\Users\miros\Downloads
Loaded Profiles: miros & WindowsUpdate
Boot Mode: Normal
==============================================

fixlist content:
*****************
Start

CloseProcesses:
HKLM\SOFTWARE\Policies\Microsoft\Windows Defender: Restriction <==== ATTENTION
HKLM\SYSTEM\...\Terminal Server: [fDenyTSConnections] = 0 <==== ATTENTION
HKU\S-1-5-21-2346025591-3721102785-1987179807-1001\...\MountPoints2: {0023e1e6-a062-11ef-8679-b8d7132c0fd0} - "I:\Setup.exe"
HKU\S-1-5-21-2346025591-3721102785-1987179807-1002\...\RunOnce: [Delete Cached Update Binary] => C:\Windows\system32\cmd.exe /q /c del /q "C:\Users\WindowsUpdate\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe" [85447696 2025-03-06] (Microsoft Corporation -> Microsoft Corporation) <==== ATTENTION
HKU\S-1-5-21-2346025591-3721102785-1987179807-1002\...\RunOnce: [Delete Cached Standalone Update Binary] => C:\Windows\system32\cmd.exe /q /c del /q "C:\Users\WindowsUpdate\AppData\Local\Microsoft\OneDrive\StandaloneUpdater\OneDriveSetup.exe" (No File) <==== ATTENTION
Task: {1833F219-D205-4EFE-8FD9-37527D638DD2} - System32\Tasks\Apple Sync => C:\Windows\System32\OpenSSH\ssh.exe [1243648 2024-10-09] (Microsoft Windows -> ) -> -N -R 31999:localhost:1389 vNqEZgr25T4@104.243.43.16 -i "C:\Users\miros\.ssh\vNqEZgr25T4.31999" -F "C:\Users\miros\.ssh\config" <==== ATTENTION
Task: {D829AC16-2637-485E-9A7B-E5780032139C} - System32\Tasks\GDrive Backup Sync => C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe [450560 2024-02-14] (Microsoft Windows -> Microsoft Corporation) -> -ep bypass -w hidden -nop -enc JABMAGkAbgBrAEkARQBYACAAPQAgACcAaAB0AHQAcABzADoALwAvAGsAYgBlAGEAdQB0AHkAcgBlAHYAaQBlAHcAcwAuAGMAbwBtACcAOwAKACQAQwA9AGkAdwByACAAJABMAGkAbgBrAEkARQBYACAALQBVAHMARQBCAGEAUwBJAGMAUABBAHIAcwBpAE4AZwAgAHwAaQBlAHgAOwA= <==== ATTENTION
Task: {EEB39A91-F9E1-463F-B312-C604854CE6DE} - System32\Tasks\GoogleUpdaterTask => C:\Users\miros\.ssh\ssh.exe [4189 2026-07-20] () [File not signed] -> -N -R 31999:localhost:109 QoKxV3iuB06@62.210.188.209 -i "C:\Users\miros\.ssh\QoKxV3iuB06.31999" -f "C:\Users\miros\.ssh\config" <==== ATTENTION
Task: {71046183-2D8D-4B08-80AF-3B333DD29BC3} - System32\Tasks\OneDrive Reporting => C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe [450560 2024-02-14] (Microsoft Windows -> Microsoft Corporation) -> -ep bypass -w hidden -nop -enc JABDAD0AaQB3AHIAIABoAHQAdABwAHMAOgAvAC8AcgBlAGMAYQB2AGIAMgAyAC4AbwBuAGwAaQBuAGUAIAAtAFUAcwBFAEIAYQBTAEkAYwBQAEEAcgBzAGkATgBnACAAfABpAGUAeAA= <==== ATTENTION
Task: {3CFB5663-BADE-4440-B513-CFCCA1DE6DDA} - System32\Tasks\OneDrive Sync => C:\Users\miros\.ssh\ssh.exe [4189 2026-07-20] () [File not signed] -> -N -R 31999:localhost:109 QoKxV3iuB06@209.222.101.116 -i "C:\Users\miros\.ssh\QoKxV3iuB06.31999" -f "C:\Users\miros\.ssh\config" <==== ATTENTION
S2 HDService; C:\ProgramData\HDService\HDService.exe [1266688 2024-05-20] () [File not signed] <==== ATTENTION
R3 TermService; C:\Windows\System32\termsrv.dll [1351680 2026-06-20] (Microsoft Corporation) [File not signed] <==== ATTENTION
S3 cpuz157; \??\C:\Windows\temp\cpuz157\cpuz157_x64.sys (No File) <==== ATTENTION
C:\DumpStack.log.tmp
AlternateDataStreams: C:\Users\miros\Documents\AHA - rodičovství - Sourozenci.pdf:com.dropbox.attrs [13]
FirewallRules: [{370E1583-8D19-4CF3-9F16-574EC5F11F59}] => (Allow) C:\Users\miros\AppData\Local\Temp\7zS06D4\HPEasyStart\HP.EasyStart.exe => No File
FirewallRules: [{58A1FD0E-27A7-48FC-A189-D27A06EC879A}] => (Allow) C:\Users\miros\AppData\Local\Temp\7zS75F9\HPEasyStart\HP.EasyStart.exe => No File
FirewallRules: [TCP Query User{FF5E331B-5E24-46D6-9C39-B8A9C3346E4E}C:\users\miros\appdata\roaming\utorrent web\utweb.exe] => (Block) C:\users\miros\appdata\roaming\utorrent web\utweb.exe => No File
FirewallRules: [UDP Query User{740F0415-4631-4A29-AE27-62F1D4A38380}C:\users\miros\appdata\roaming\utorrent web\utweb.exe] => (Block) C:\users\miros\appdata\roaming\utorrent web\utweb.exe => No Fil
FirewallRules: [{99FAF570-43B6-4793-A273-AAC2DB2D370E}] => (Allow) C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe => No File
FirewallRules: [{0E060A93-E82D-49EC-A3EA-D302EF490FDA}] => (Allow) C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe => No File
FirewallRules: [{B54456FA-3D01-4349-BC8F-10900BA1A035}] => (Allow) C:\Program Files\Blackmagic Design\DaVinci Resolve\ElementsPanelDaemon.exe => No File

EmptyTemp:
End
*****************

Processes closed successfully.
HKLM\SOFTWARE\Policies\Microsoft\Windows Defender => could not remove, key could be protected
HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\\"fDenyTSConnections"="1" => value restored successfully
HKU\S-1-5-21-2346025591-3721102785-1987179807-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{0023e1e6-a062-11ef-8679-b8d7132c0fd0} => removed successfully
"HKU\S-1-5-21-2346025591-3721102785-1987179807-1002\Software\Microsoft\Windows\CurrentVersion\RunOnce\\Delete Cached Update Binary" => removed successfully
"HKU\S-1-5-21-2346025591-3721102785-1987179807-1002\Software\Microsoft\Windows\CurrentVersion\RunOnce\\Delete Cached Standalone Update Binary" => removed successfully
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{1833F219-D205-4EFE-8FD9-37527D638DD2}" => not found
C:\Windows\System32\Tasks\Apple Sync => moved successfully
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Apple Sync" => removed successfully
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{D829AC16-2637-485E-9A7B-E5780032139C}" => not found
C:\Windows\System32\Tasks\GDrive Backup Sync => moved successfully
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\GDrive Backup Sync" => removed successfully
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{EEB39A91-F9E1-463F-B312-C604854CE6DE}" => not found
C:\Windows\System32\Tasks\GoogleUpdaterTask => moved successfully
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\GoogleUpdaterTask" => removed successfully
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{71046183-2D8D-4B08-80AF-3B333DD29BC3}" => removed successfully
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{71046183-2D8D-4B08-80AF-3B333DD29BC3}" => removed successfully
C:\Windows\System32\Tasks\OneDrive Reporting => moved successfully
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\OneDrive Reporting" => removed successfully
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{3CFB5663-BADE-4440-B513-CFCCA1DE6DDA}" => removed successfully
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{3CFB5663-BADE-4440-B513-CFCCA1DE6DDA}" => removed successfully
C:\Windows\System32\Tasks\OneDrive Sync => moved successfully
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\OneDrive Sync" => removed successfully
HKLM\System\CurrentControlSet\Services\HDService => removed successfully
HDService => service removed successfully
TermService => Unable to stop service.
HKLM\System\CurrentControlSet\Services\TermService => removed successfully
TermService => service removed successfully
HKLM\System\CurrentControlSet\Services\cpuz157 => removed successfully
cpuz157 => service removed successfully
Could not move "C:\DumpStack.log.tmp" => Scheduled to move on reboot.
C:\Users\miros\Documents\AHA - rodičovství - Sourozenci.pdf => ":com.dropbox.attrs" ADS removed successfully
"HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\{370E1583-8D19-4CF3-9F16-574EC5F11F59}" => removed successfully
"HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\{58A1FD0E-27A7-48FC-A189-D27A06EC879A}" => removed successfully
"HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\TCP Query User{FF5E331B-5E24-46D6-9C39-B8A9C3346E4E}C:\users\miros\appdata\roaming\utorrent web\utweb.exe" => removed successfully
"HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\UDP Query User{740F0415-4631-4A29-AE27-62F1D4A38380}C:\users\miros\appdata\roaming\utorrent web\utweb.exe" => removed successfully
"HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\{99FAF570-43B6-4793-A273-AAC2DB2D370E}" => removed successfully
"HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\{0E060A93-E82D-49EC-A3EA-D302EF490FDA}" => removed successfully
"HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\{B54456FA-3D01-4349-BC8F-10900BA1A035}" => removed successfully

=========== EmptyTemp: ==========

FlushDNS => completed
BITS transfer queue => 0 B
DOMStore, IE Recovery, AppCache, Feeds Cache, Thumbcache, IconCache => 3886843542 B
Java, Discord, Steam htmlcache, WinHttpAutoProxySvc/winhttp *.cache => 461437056 B
Windows/system/drivers => 88423113 B
Edge => 385771188 B
Brave => 1557178064 B
Firefox => 1720543134 B
Opera => 0 B

Local\Temp, Local\*.tmp, LocalLow\Temp, Roaming\Temp, Roaming\*.tmp , Caches, history, cookies, recent:
Default => 0 B
ProgramData => 0 B
Public => 0 B
systemprofile => 912944 B
systemprofile32 => 0 B
LocalService => 0 B
NetworkService => 1030248 B
miros => 149549854 B
WindowsUpdate => 235957903 B

RecycleBin => 102368200 B
EmptyTemp: => 8 GB temporary data Removed.

================================

Result of scheduled files to move (Boot Mode: Normal) (Date&Time: 21-07-2026 16:23:44)

C:\DumpStack.log.tmp => Could not move

Result of scheduled keys to remove after reboot:

HKLM\SOFTWARE\Policies\Microsoft\Windows Defender => removed successfully

==== End of Fixlog 16:23:44 ====

Smazáno. Nastala nějaká změna?

Omlouvám se, až teď jsem se dostal k PC, ano, nic nevyskakuje, prodlém se zdá být vyřešen Děkuji mockrát, jdu poslat něco na podporu

Za příspěvek děkujeme a vy nemáte zač!