Prosím o kontrolu logu. Děkuji.

Zpráva

roman7 · #1 Příspěvek od **roman7** » 02 lis 2014 21:48

Logfile of random's system information tool 1.10 (written by random/random)
Run by Petra at 2014-11-02 21:45:24
Microsoft Windows 7 Home Premium Service Pack 1
System drive C: has 28 GB (42%) free of 67 GB
Total RAM: 1015 MB (41% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 21:45:28, on 2.11.2014
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v11.0 (11.00.9600.17344)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\System32\igfxtray.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\System32\igfxpers.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Microsoft Security Client\msseces.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Windows\system32\taskhost.exe
C:\Windows\system32\igfxsrvc.exe
C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\VolCtrl.exe
C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Users\Petra\Desktop\RSIT.exe
C:\Program Files\trend micro\Petra.exe
C:\Windows\system32\DllHost.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.seznam.cz/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/p/?LinkId=255141
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/p/?LinkId=255141
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: saveu on - {F34BC0D4-9BE1-56E2-2BE2-5B3285BAFE99} - C:\Program Files\saveu on\_.dll
O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [MSC] "c:\Program Files\Microsoft Security Client\msseces.exe" -hide -runkey
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [QlbCtrl.exe] C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
O4 - HKLM\..\Run: [MSStp] C:\Windows\inf\msstp.vbe
O4 - HKLM\..\Run: [mncplgulSrv] C:\Windows\system32\mncplgul.vbe
O4 - HKLM\..\Run: [msdbjmSrv] C:\Windows\inf\msdbjm.vbe
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Odeslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Od&eslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O20 - AppInit_DLLs:
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: Com4QLBEx - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe
O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe
O23 - Service: @C:\Program Files\Nero\Update\NASvc.exe,-200 (NAUpdate) - Nero AG - C:\Program Files\Nero\Update\NASvc.exe
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe

--
End of file - 4369 bytes

======Scheduled tasks folder======

C:\Windows\tasks\Adobe Flash Player Updater.job - C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe

=========Mozilla firefox=========

ProfilePath - C:\Users\Petra\AppData\Roaming\Mozilla\Firefox\Profiles\iordxknk.default-1412879335062

prefs.js - "browser.startup.homepage" - "http://www.seznam.cz/"

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 15.0.0.189 Plugin
"Path"=C:\Windows\system32\Macromed\Flash\NPSWF32_15_0_0_189.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/GENUINE]
"Description"=
"Path"=C:\Windows\system32\Wat\npWatWeb.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0]
"Description"=Ag Player Plugin
"Path"=c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\Adobe Reader]
"Description"=Handles PDFs in-place in Firefox
"Path"=C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll

C:\Program Files\Mozilla Firefox\components\
nsIQTScriptablePlugin.xpt

C:\Program Files\Mozilla Firefox\plugins\
np-mswmp.dll
NPOFF12.DLL
nppdf32.dll
npqtplugin.dll
npqtplugin2.dll
npqtplugin3.dll
npqtplugin4.dll
npqtplugin5.dll
QuickTimePlugin.class
WMP Firefox Plugin License.rtf
WMP Firefox Plugin RelNotes.txt

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}]
Groove GFS Browser Helper - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-26 2217832]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F34BC0D4-9BE1-56E2-2BE2-5B3285BAFE99}]
saveu on - C:\Program Files\saveu on\_.dll [2014-06-07 423936]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"=C:\Windows\system32\igfxtray.exe [2009-09-23 141848]
"HotKeysCmds"=C:\Windows\system32\hkcmd.exe [2009-09-23 173592]
"Persistence"=C:\Windows\system32\igfxpers.exe [2009-09-23 150552]
"SynTPEnh"=C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2008-03-28 1045800]
"MSC"=c:\Program Files\Microsoft Security Client\msseces.exe [2014-08-22 974432]
"GrooveMonitor"=C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe [2009-02-26 30040]
"QlbCtrl.exe"=C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe [2009-11-11 287800]
"MSStp"=C:\Windows\inf\msstp.vbe [2014-03-05 1584]
"mncplgulSrv"=C:\Windows\system32\mncplgul.vbe [2014-03-05 7670]
"msdbjmSrv"=C:\Windows\inf\msdbjm.vbe [2013-08-27 1558]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
C:\Program Files\DAEMON Tools Lite\DTLite.exe [2013-10-28 3675352]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NBAgent]
C:\Program Files\Nero\Nero 10\Nero BackItUp\NBAgent.exe [2010-03-26 1234216]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Enable Labtec NumPad.lnk]
C:\PROGRA~1\LABTEC~1\Magickey.exe [2005-03-14 110592]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Povolit bezdrátovou myš.lnk]
C:\PROGRA~1\WIRELE~1\MulMouse.exe [2004-12-15 249856]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Povolit bezdrátovou numerickou klávesnici.lnk]
C:\PROGRA~1\WIRELE~1\Magickey.exe [2007-03-19 114688]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=" "

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
C:\Windows\system32\igfxdev.dll [2009-09-23 218112]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-26 2217832]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\MsMpSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Wdf01000.sys]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=5
"ConsentPromptBehaviorUser"=3
"EnableUIADesktopToggle"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
"EnableLinkedConnections"=1

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.msadpcm"=msadp32.acm
"midimapper"=midimap.dll
"wavemapper"=msacm32.drv
"vidc.uyvy"=msyuv.dll
"vidc.yuy2"=msyuv.dll
"vidc.yvyu"=msyuv.dll
"vidc.iyuv"=iyuv_32.dll
"vidc.i420"=iyuv_32.dll
"vidc.yvu9"=tsbyuv.dll
"msacm.l3acm"=C:\Windows\System32\l3codeca.acm
"vidc.cvid"=iccvid.dll
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*

======List of files/folders created in the last 1 month======

2014-11-02 21:35:06 ----D---- C:\Program Files\trend micro
2014-11-02 21:35:05 ----D---- C:\rsit
2014-10-30 20:34:08 ----D---- C:\Program Files\Mozilla Firefox
2014-10-22 17:44:05 ----D---- C:\Users\Petra\AppData\Roaming\InstallShield
2014-10-15 20:59:09 ----A---- C:\Windows\system32\mscorier.dll
2014-10-15 20:59:09 ----A---- C:\Windows\system32\dfshim.dll
2014-10-15 20:59:08 ----A---- C:\Windows\system32\mscories.dll
2014-10-15 20:59:03 ----A---- C:\Windows\system32\generaltel.dll
2014-10-15 20:59:01 ----A---- C:\Windows\system32\aepdu.dll
2014-10-15 20:58:58 ----A---- C:\Windows\system32\aeinv.dll
2014-10-15 20:58:57 ----A---- C:\Windows\system32\win32k.sys
2014-10-15 20:58:54 ----A---- C:\Windows\system32\rastls.dll
2014-10-15 20:58:05 ----A---- C:\Windows\system32\mstscax.dll
2014-10-15 20:57:46 ----A---- C:\Windows\system32\rdpcorets.dll
2014-10-15 20:57:23 ----A---- C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-10-15 20:57:23 ----A---- C:\Windows\system32\ieetwproxystub.dll
2014-10-15 20:57:23 ----A---- C:\Windows\system32\ieetwcollector.exe
2014-10-15 20:57:22 ----A---- C:\Windows\system32\MsSpellCheckingFacility.exe
2014-10-15 20:57:22 ----A---- C:\Windows\system32\jsproxy.dll
2014-10-15 20:57:22 ----A---- C:\Windows\system32\ieUnatt.exe
2014-10-15 20:57:21 ----A---- C:\Windows\system32\wininet.dll
2014-10-15 20:57:21 ----A---- C:\Windows\system32\vbscript.dll
2014-10-15 20:57:21 ----A---- C:\Windows\system32\ieetwcollectorres.dll
2014-10-15 20:57:21 ----A---- C:\Windows\system32\dxtmsft.dll
2014-10-15 20:57:19 ----A---- C:\Windows\system32\dxtrans.dll
2014-10-15 20:57:18 ----A---- C:\Windows\system32\mshtmled.dll
2014-10-15 20:57:18 ----A---- C:\Windows\system32\ieui.dll
2014-10-15 20:57:17 ----A---- C:\Windows\system32\mshtmlmedia.dll
2014-10-15 20:57:16 ----A---- C:\Windows\system32\MshtmlDac.dll
2014-10-15 20:57:16 ----A---- C:\Windows\system32\iertutil.dll
2014-10-15 20:57:14 ----A---- C:\Windows\system32\jscript9diag.dll
2014-10-15 20:57:13 ----A---- C:\Windows\system32\jscript9.dll
2014-10-15 20:57:12 ----A---- C:\Windows\system32\mshtml.dll
2014-10-15 20:57:08 ----A---- C:\Windows\system32\urlmon.dll
2014-10-15 20:57:08 ----A---- C:\Windows\system32\iernonce.dll
2014-10-15 20:57:08 ----A---- C:\Windows\system32\ie4uinit.exe
2014-10-15 20:57:07 ----A---- C:\Windows\system32\iedkcs32.dll
2014-10-15 20:57:07 ----A---- C:\Windows\system32\ieapfltr.dll
2014-10-15 20:57:06 ----A---- C:\Windows\system32\msfeeds.dll
2014-10-15 20:57:02 ----A---- C:\Windows\system32\msrating.dll
2014-10-15 20:57:02 ----A---- C:\Windows\system32\iesetup.dll
2014-10-15 20:57:00 ----A---- C:\Windows\system32\ieframe.dll
2014-10-15 20:56:45 ----A---- C:\Windows\system32\winsta.dll
2014-10-15 20:56:45 ----A---- C:\Windows\system32\termsrv.dll
2014-10-15 20:56:44 ----A---- C:\Windows\system32\winlogon.exe
2014-10-15 20:56:44 ----A---- C:\Windows\system32\rdpcorekmts.dll
2014-10-15 20:56:44 ----A---- C:\Windows\system32\drivers\rdpwd.sys
2014-10-15 20:56:43 ----A---- C:\Windows\system32\TSpkg.dll
2014-10-15 20:56:43 ----A---- C:\Windows\system32\credssp.dll
2014-10-15 20:56:42 ----A---- C:\Windows\system32\drivers\tssecsrv.sys
2014-10-15 20:56:00 ----A---- C:\Windows\system32\msi.dll
2014-10-15 20:52:06 ----A---- C:\Windows\system32\packager.dll
2014-10-15 20:51:53 ----A---- C:\Windows\system32\blackbox.dll
2014-10-15 20:51:52 ----A---- C:\Windows\system32\drmv2clt.dll
2014-10-15 20:51:51 ----A---- C:\Windows\system32\wmdrmsdk.dll
2014-10-15 20:51:50 ----A---- C:\Windows\system32\wmp.dll
2014-10-15 20:51:47 ----A---- C:\Windows\system32\mf.dll
2014-10-15 20:51:46 ----A---- C:\Windows\system32\drmmgrtn.dll
2014-10-15 20:51:46 ----A---- C:\Windows\system32\drivers\PEAuth.sys
2014-10-15 20:51:46 ----A---- C:\Windows\system32\ci.dll
2014-10-15 20:51:46 ----A---- C:\Windows\system32\AUDIOKSE.dll
2014-10-15 20:51:45 ----A---- C:\Windows\system32\winresume.exe
2014-10-15 20:51:45 ----A---- C:\Windows\system32\winload.exe
2014-10-15 20:51:45 ----A---- C:\Windows\system32\ntkrnlpa.exe
2014-10-15 20:51:45 ----A---- C:\Windows\system32\AudioSes.dll
2014-10-15 20:51:44 ----A---- C:\Windows\system32\wintrust.dll
2014-10-15 20:51:44 ----A---- C:\Windows\system32\EncDump.dll
2014-10-15 20:51:44 ----A---- C:\Windows\system32\cryptsvc.dll
2014-10-15 20:51:43 ----A---- C:\Windows\system32\quartz.dll
2014-10-15 20:51:43 ----A---- C:\Windows\system32\ntoskrnl.exe
2014-10-15 20:51:43 ----A---- C:\Windows\system32\evr.dll
2014-10-15 20:51:42 ----A---- C:\Windows\system32\pcasvc.dll
2014-10-15 20:51:42 ----A---- C:\Windows\system32\mfplat.dll
2014-10-15 20:51:42 ----A---- C:\Windows\system32\cryptui.dll
2014-10-15 20:51:42 ----A---- C:\Windows\system32\crypt32.dll
2014-10-15 20:51:40 ----A---- C:\Windows\system32\cryptsp.dll
2014-10-15 20:51:40 ----A---- C:\Windows\system32\AudioEng.dll
2014-10-15 20:51:39 ----A---- C:\Windows\system32\msscp.dll
2014-10-15 20:51:39 ----A---- C:\Windows\system32\audiosrv.dll
2014-10-15 20:51:39 ----A---- C:\Windows\system32\audiodg.exe
2014-10-15 20:51:38 ----A---- C:\Windows\system32\rrinstaller.exe
2014-10-15 20:51:38 ----A---- C:\Windows\system32\msnetobj.dll
2014-10-15 20:51:38 ----A---- C:\Windows\system32\appidsvc.dll
2014-10-15 20:51:37 ----A---- C:\Windows\system32\mfps.dll
2014-10-15 20:51:37 ----A---- C:\Windows\system32\appidpolicyconverter.exe
2014-10-15 20:51:36 ----A---- C:\Windows\system32\appidapi.dll
2014-10-15 20:51:35 ----A---- C:\Windows\system32\setbcdlocale.dll
2014-10-15 20:51:34 ----A---- C:\Windows\system32\mfpmp.exe
2014-10-15 20:51:34 ----A---- C:\Windows\system32\drivers\appid.sys
2014-10-15 20:51:34 ----A---- C:\Windows\system32\appidcertstorecheck.exe
2014-10-15 20:51:32 ----A---- C:\Windows\system32\wmploc.DLL
2014-10-15 20:51:32 ----A---- C:\Windows\system32\spwmp.dll
2014-10-15 20:51:32 ----A---- C:\Windows\system32\mferror.dll
2014-10-15 20:51:32 ----A---- C:\Windows\system32\dxmasf.dll
2014-10-03 14:24:59 ----A---- C:\Windows\system32\qdvd.dll

======List of files/folders modified in the last 1 month======

2014-11-02 21:44:43 ----D---- C:\Windows\Prefetch
2014-11-02 21:36:00 ----D---- C:\Windows\system32\config
2014-11-02 21:35:06 ----RD---- C:\Program Files
2014-11-02 21:28:51 ----D---- C:\Windows\temp
2014-11-02 21:20:20 ----SHD---- C:\System Volume Information
2014-11-02 21:12:46 ----D---- C:\Windows\inf
2014-11-02 21:12:13 ----D---- C:\Windows
2014-10-31 16:07:34 ----D---- C:\Program Files\Mozilla Maintenance Service
2014-10-31 10:35:42 ----D---- C:\Windows\rescache
2014-10-30 19:29:21 ----D---- C:\Windows\System32
2014-10-30 19:29:21 ----A---- C:\Windows\system32\PerfStringBackup.INI
2014-10-30 12:24:45 ----N---- C:\Windows\system32\MpSigStub.exe
2014-10-25 19:52:52 ----A---- C:\Windows\system32\FlashPlayerApp.exe
2014-10-22 17:45:28 ----HD---- C:\Program Files\InstallShield Installation Information
2014-10-22 17:45:22 ----A---- C:\Windows\KA.ini
2014-10-22 17:44:37 ----D---- C:\Program Files\hry
2014-10-22 17:33:19 ----D---- C:\Windows\debug
2014-10-22 17:31:15 ----D---- C:\Program Files\CCleaner
2014-10-21 06:00:00 ----D---- C:\Windows\Microsoft.NET
2014-10-21 05:55:33 ----RSD---- C:\Windows\assembly
2014-10-18 18:31:06 ----D---- C:\Windows\system32\catroot2
2014-10-15 21:50:49 ----D---- C:\Windows\winsxs
2014-10-15 21:50:45 ----SHD---- C:\boot
2014-10-15 21:46:10 ----SD---- C:\Windows\system32\CompatTel
2014-10-15 21:46:10 ----D---- C:\Windows\system32\en-US
2014-10-15 21:46:09 ----D---- C:\Program Files\Internet Explorer
2014-10-15 21:46:08 ----D---- C:\Windows\system32\drivers
2014-10-15 21:46:06 ----D---- C:\Windows\system32\Dism
2014-10-15 21:46:06 ----D---- C:\Windows\system32\cs-CZ
2014-10-15 21:46:06 ----D---- C:\Program Files\Windows Media Player
2014-10-15 21:46:04 ----D---- C:\Windows\system32\CodeIntegrity
2014-10-15 21:46:04 ----D---- C:\Windows\system32\Boot
2014-10-15 21:40:46 ----SHD---- C:\Windows\Installer
2014-10-15 21:40:40 ----D---- C:\ProgramData\Microsoft Help
2014-10-15 21:28:33 ----D---- C:\Windows\system32\MRT
2014-10-15 21:22:57 ----A---- C:\Windows\system32\MRT.exe
2014-10-15 20:52:55 ----D---- C:\Windows\system32\catroot

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 MpFilter;Microsoft Malware Protection Driver; C:\Windows\system32\DRIVERS\MpFilter.sys [2014-07-17 231800]
R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2010-11-20 173440]
R1 dtsoftbus01;DAEMON Tools Virtual Bus Driver; C:\Windows\system32\DRIVERS\dtsoftbus01.sys [2013-12-14 243128]
R1 vwififlt;Virtual WiFi Filter Driver; C:\Windows\system32\DRIVERS\vwififlt.sys [2009-07-14 48128]
R2 mdmxsdk;mdmxsdk; C:\Windows\system32\DRIVERS\mdmxsdk.sys [2006-06-18 12672]
R2 NisDrv;Microsoft Network Inspection System; C:\Windows\system32\DRIVERS\NisDrvWFP.sys [2014-07-17 95920]
R2 XAudio;XAudio; C:\Windows\system32\DRIVERS\xaudio.sys [2007-07-10 8704]
R3 BCM43XX;Broadcom 802.11 Network Adapter Driver; C:\Windows\system32\DRIVERS\bcmwl6.sys [2009-07-08 2506232]
R3 E100B;Intel(R) PRO Adapter Driver; C:\Windows\system32\DRIVERS\e100b325.sys [2009-07-13 159232]
R3 HBtnKey;HP Hotkey Device; C:\Windows\system32\DRIVERS\cpqbttn.sys [2010-02-24 15544]
R3 HpqKbFiltr;HpqKbFilter Driver; C:\Windows\system32\DRIVERS\HpqKbFiltr.sys [2009-04-29 15872]
R3 HSF_DPV;HSF_DPV; C:\Windows\system32\DRIVERS\HSX_DPV.sys [2007-06-20 984064]
R3 HSXHWAZL;HSXHWAZL; C:\Windows\system32\DRIVERS\HSXHWAZL.sys [2007-06-20 208896]
R3 igfx;igfx; C:\Windows\system32\DRIVERS\igdkmd32.sys [2009-09-23 4808192]
R3 SynTP;Synaptics TouchPad Driver; C:\Windows\system32\DRIVERS\SynTP.sys [2008-03-28 199472]
R3 winachsf;winachsf; C:\Windows\system32\DRIVERS\HSX_CNXT.sys [2007-06-20 660480]
S2 Parvdm;Parvdm; C:\Windows\system32\DRIVERS\parvdm.sys [2009-07-14 8704]
S3 aic78xx;aic78xx; C:\Windows\system32\DRIVERS\djsvs.sys [2009-07-14 70720]
S3 amdagp;Ovladač filtru AMD portu AGP; C:\Windows\system32\drivers\amdagp.sys [2009-07-14 53312]
S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0; C:\Windows\system32\DRIVERS\b57nd60x.sys [2009-07-13 229888]
S3 BridgeMP;@%SystemRoot%\system32\bridgeres.dll,-1; C:\Windows\system32\DRIVERS\bridge.sys [2009-07-14 78336]
S3 catchme;catchme; \??\C:\Users\Petra\AppData\Local\Temp\catchme.sys []
S3 FTDIBUS;USB Serial Converter Driver; C:\Windows\system32\drivers\ftdibus.sys [2013-02-13 63464]
S3 FTSER2K;USB Serial Port Driver; C:\Windows\system32\drivers\ftser2k.sys [2013-02-13 73576]
S3 pciide;pciide; C:\Windows\system32\drivers\pciide.sys [2009-07-14 12368]
S3 RdpVideoMiniport;Remote Desktop Video Miniport Driver; C:\Windows\System32\drivers\rdpvideominiport.sys [2012-08-23 14848]
S3 Revoflt;Revoflt; C:\Windows\system32\DRIVERS\revoflt.sys [2009-12-30 27192]
S3 sisagp;Filtr SIS sběrnice AGP; C:\Windows\system32\drivers\sisagp.sys [2009-07-14 52304]
S3 SrvHsfHDA;SrvHsfHDA; C:\Windows\system32\DRIVERS\VSTAZL3.SYS [2009-07-13 207360]
S3 SrvHsfV92;SrvHsfV92; C:\Windows\system32\DRIVERS\VSTDPV3.SYS [2009-07-13 980992]
S3 SrvHsfWinac;SrvHsfWinac; C:\Windows\system32\DRIVERS\VSTCNXT3.SYS [2009-07-13 661504]
S3 TsUsbFlt;@%SystemRoot%\system32\drivers\tsusbflt.sys,-1; C:\Windows\System32\drivers\tsusbflt.sys [2013-10-02 49152]
S3 viaagp;Filtr VIA sběrnice AGP; C:\Windows\system32\drivers\viaagp.sys [2009-07-14 53328]
S3 ViaC7;VIA C7 Processor Driver; C:\Windows\system32\DRIVERS\viac7.sys [2009-07-14 52736]
S3 WinUsb;WinUsb; C:\Windows\system32\DRIVERS\WinUsb.sys [2010-11-20 35968]
S3 WLNumPad;Numberpad Wireless Keyboard; C:\Windows\System32\Drivers\WLNumPad.sys [2007-03-19 9600]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AdobeARMservice;Adobe Acrobat Update Service; C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe [2013-12-18 65432]
R2 MsMpSvc;Microsoft Antimalware Service; c:\Program Files\Microsoft Security Client\MsMpEng.exe [2014-08-22 22192]
R2 NAUpdate;@C:\Program Files\Nero\Update\NASvc.exe,-200; C:\Program Files\Nero\Update\NASvc.exe [2010-03-25 490280]
R2 XAudioService;XAudioService; C:\Windows\system32\DRIVERS\xaudio.exe [2007-07-10 386560]
R3 NisSrv;@c:\Program Files\Microsoft Security Client\MpAsDesc.dll,-243; c:\Program Files\Microsoft Security Client\NisSrv.exe [2014-08-22 288120]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2013-09-11 105144]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service; C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2014-10-25 267440]
S3 Com4QLBEx;Com4QLBEx; C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe [2010-01-12 227896]
S3 IEEtwCollectorService;@%SystemRoot%\system32\ieetwcollectorres.dll,-1000; C:\Windows\system32\IEEtwCollector.exe [2014-09-19 108032]
S3 Microsoft Office Groove Audit Service;Microsoft Office Groove Audit Service; C:\Program Files\Microsoft Office\Office12\GrooveAuditService.exe [2009-02-26 64856]
S3 MozillaMaintenance;Mozilla Maintenance Service; C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe [2014-10-30 114288]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2011-07-20 440696]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 WatAdminSvc;@%SystemRoot%\system32\Wat\WatUX.exe,-601; C:\Windows\system32\Wat\WatAdminSvc.exe [2010-04-05 1343400]
S4 aspnet_state;Stavová služba ASP.NET; C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe [2013-09-11 46688]
S4 NetMsmqActivator;@C:\Windows\Microsoft.NET\Framework\v4.0.30319\\ServiceModelInstallRC.dll,-8195; C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe [2013-09-11 139856]
S4 NetPipeActivator;@C:\Windows\Microsoft.NET\Framework\v4.0.30319\\ServiceModelInstallRC.dll,-8197; C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe [2013-09-11 139856]
S4 NetTcpActivator;@C:\Windows\Microsoft.NET\Framework\v4.0.30319\\ServiceModelInstallRC.dll,-8199; C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe [2013-09-11 139856]

-----------------EOF-----------------

#2 Příspěvek od **altrok** » 02 lis 2014 21:56

Prijemny nedelni vecer Vam preju

V ramci cisteni Vam budou vyprazdneny docasne adresare (vcetne Kose).

Ulozte na plochu AdwCleaner https://toolslib.net/downloads/viewdown ... dwcleaner/

ukoncete vsechny programy
kliknete pravym na ikonu AdwCleaneru a vyberte Spustit jako spravce (v pripade Win XP spustte obycejne dvojklikem)
kliknete na Scan, pote na Clean
po restartu na Vas vyskoci log (pripadne jej najdete v C:\AdwCleaner\AdwCleaner [Sx].txt), jehoz obsah mi zkopirujte do pristi odpovedi

roman7 · #3 Příspěvek od **roman7** » 03 lis 2014 20:27

Zdravím tady je log.

# AdwCleaner v3.311 - Report created 03/11/2014 at 20:20:41
# Updated 30/09/2014 by Xplode
# Operating System : Windows 7 Home Premium Service Pack 1 (32 bits)
# Username : Petra - PETRA-PC
# Running from : C:\Users\Petra\Desktop\adwcleaner_3.311.exe
# Option : Clean

***** [ Services ] *****

***** [ Files / Folders ] *****

Folder Deleted : C:\ProgramData\saveu on
Folder Deleted : C:\Program Files\GamesBar
Folder Deleted : C:\Program Files\saveu on
Folder Deleted : C:\Users\Administrator\AppData\Local\Chromatic Browser
Folder Deleted : C:\Users\Administrator\AppData\Local\torch
Folder Deleted : C:\Users\Guest\AppData\Local\Chromatic Browser
Folder Deleted : C:\Users\Guest\AppData\Local\torch
Folder Deleted : C:\Users\HomeGroupUser$\AppData\Local\Chromatic Browser
Folder Deleted : C:\Users\HomeGroupUser$\AppData\Local\torch
Folder Deleted : C:\Users\Petra\AppData\Local\Chromatic Browser
Folder Deleted : C:\Users\Petra\AppData\Local\torch
Folder Deleted : C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\bjbnkknjlhidhacbekjpdagfckgeofga
Folder Deleted : C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\bjbnkknjlhidhacbekjpdagfckgeofga
Folder Deleted : C:\Users\HomeGroupUser$\AppData\Local\Google\Chrome\User Data\Default\Extensions\bjbnkknjlhidhacbekjpdagfckgeofga
Folder Deleted : C:\Users\Petra\AppData\Local\Google\Chrome\User Data\Default\Extensions\bjbnkknjlhidhacbekjpdagfckgeofga
Folder Deleted : C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\eflhoinbnpakfmfjepblkbpbpacjkjpp
Folder Deleted : C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\eflhoinbnpakfmfjepblkbpbpacjkjpp
Folder Deleted : C:\Users\HomeGroupUser$\AppData\Local\Google\Chrome\User Data\Default\Extensions\eflhoinbnpakfmfjepblkbpbpacjkjpp
Folder Deleted : C:\Users\Petra\AppData\Local\Google\Chrome\User Data\Default\Extensions\eflhoinbnpakfmfjepblkbpbpacjkjpp
Folder Deleted : C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\oglegmfmlaidmccdkeenbkcngkmpcglb
Folder Deleted : C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\oglegmfmlaidmccdkeenbkcngkmpcglb
Folder Deleted : C:\Users\HomeGroupUser$\AppData\Local\Google\Chrome\User Data\Default\Extensions\oglegmfmlaidmccdkeenbkcngkmpcglb
Folder Deleted : C:\Users\Petra\AppData\Local\Google\Chrome\User Data\Default\Extensions\oglegmfmlaidmccdkeenbkcngkmpcglb
[!] Folder Deleted : C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\bjbnkknjlhidhacbekjpdagfckgeofga
[!] Folder Deleted : C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\bjbnkknjlhidhacbekjpdagfckgeofga
[!] Folder Deleted : C:\Users\HomeGroupUser$\AppData\Local\Google\Chrome\User Data\Default\Extensions\bjbnkknjlhidhacbekjpdagfckgeofga
[!] Folder Deleted : C:\Users\Petra\AppData\Local\Google\Chrome\User Data\Default\Extensions\bjbnkknjlhidhacbekjpdagfckgeofga
[!] Folder Deleted : C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\eflhoinbnpakfmfjepblkbpbpacjkjpp
[!] Folder Deleted : C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\eflhoinbnpakfmfjepblkbpbpacjkjpp
[!] Folder Deleted : C:\Users\HomeGroupUser$\AppData\Local\Google\Chrome\User Data\Default\Extensions\eflhoinbnpakfmfjepblkbpbpacjkjpp
[!] Folder Deleted : C:\Users\Petra\AppData\Local\Google\Chrome\User Data\Default\Extensions\eflhoinbnpakfmfjepblkbpbpacjkjpp
[!] Folder Deleted : C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\oglegmfmlaidmccdkeenbkcngkmpcglb
[!] Folder Deleted : C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\oglegmfmlaidmccdkeenbkcngkmpcglb
[!] Folder Deleted : C:\Users\HomeGroupUser$\AppData\Local\Google\Chrome\User Data\Default\Extensions\oglegmfmlaidmccdkeenbkcngkmpcglb
[!] Folder Deleted : C:\Users\Petra\AppData\Local\Google\Chrome\User Data\Default\Extensions\oglegmfmlaidmccdkeenbkcngkmpcglb
[!] Folder Deleted : C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\bjbnkknjlhidhacbekjpdagfckgeofga
[!] Folder Deleted : C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\bjbnkknjlhidhacbekjpdagfckgeofga
[!] Folder Deleted : C:\Users\HomeGroupUser$\AppData\Local\Google\Chrome\User Data\Default\Extensions\bjbnkknjlhidhacbekjpdagfckgeofga
[!] Folder Deleted : C:\Users\Petra\AppData\Local\Google\Chrome\User Data\Default\Extensions\bjbnkknjlhidhacbekjpdagfckgeofga
[!] Folder Deleted : C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\eflhoinbnpakfmfjepblkbpbpacjkjpp
[!] Folder Deleted : C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\eflhoinbnpakfmfjepblkbpbpacjkjpp
[!] Folder Deleted : C:\Users\HomeGroupUser$\AppData\Local\Google\Chrome\User Data\Default\Extensions\eflhoinbnpakfmfjepblkbpbpacjkjpp
[!] Folder Deleted : C:\Users\Petra\AppData\Local\Google\Chrome\User Data\Default\Extensions\eflhoinbnpakfmfjepblkbpbpacjkjpp
[!] Folder Deleted : C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\oglegmfmlaidmccdkeenbkcngkmpcglb
[!] Folder Deleted : C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\oglegmfmlaidmccdkeenbkcngkmpcglb
[!] Folder Deleted : C:\Users\HomeGroupUser$\AppData\Local\Google\Chrome\User Data\Default\Extensions\oglegmfmlaidmccdkeenbkcngkmpcglb
[!] Folder Deleted : C:\Users\Petra\AppData\Local\Google\Chrome\User Data\Default\Extensions\oglegmfmlaidmccdkeenbkcngkmpcglb
[!] Folder Deleted : C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\bjbnkknjlhidhacbekjpdagfckgeofga
[!] Folder Deleted : C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\bjbnkknjlhidhacbekjpdagfckgeofga
[!] Folder Deleted : C:\Users\HomeGroupUser$\AppData\Local\Google\Chrome\User Data\Default\Extensions\bjbnkknjlhidhacbekjpdagfckgeofga
[!] Folder Deleted : C:\Users\Petra\AppData\Local\Google\Chrome\User Data\Default\Extensions\bjbnkknjlhidhacbekjpdagfckgeofga
[!] Folder Deleted : C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\eflhoinbnpakfmfjepblkbpbpacjkjpp
[!] Folder Deleted : C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\eflhoinbnpakfmfjepblkbpbpacjkjpp
[!] Folder Deleted : C:\Users\HomeGroupUser$\AppData\Local\Google\Chrome\User Data\Default\Extensions\eflhoinbnpakfmfjepblkbpbpacjkjpp
[!] Folder Deleted : C:\Users\Petra\AppData\Local\Google\Chrome\User Data\Default\Extensions\eflhoinbnpakfmfjepblkbpbpacjkjpp
[!] Folder Deleted : C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\oglegmfmlaidmccdkeenbkcngkmpcglb
[!] Folder Deleted : C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\oglegmfmlaidmccdkeenbkcngkmpcglb
[!] Folder Deleted : C:\Users\HomeGroupUser$\AppData\Local\Google\Chrome\User Data\Default\Extensions\oglegmfmlaidmccdkeenbkcngkmpcglb
[!] Folder Deleted : C:\Users\Petra\AppData\Local\Google\Chrome\User Data\Default\Extensions\oglegmfmlaidmccdkeenbkcngkmpcglb

***** [ Scheduled Tasks ] *****

***** [ Shortcuts ] *****

***** [ Registry ] *****

Key Deleted : HKCU\Software\AppDataLow\{5F189DF5-2D05-472B-9091-84D9848AE48B}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{DE9028D0-5FFA-4E69-94E3-89EE8741F468}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{F34BC0D4-9BE1-56E2-2BE2-5B3285BAFE99}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{13ABD093-D46F-40DF-A608-47E162EC799D}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F34BC0D4-9BE1-56E2-2BE2-5B3285BAFE99}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{F34BC0D4-9BE1-56E2-2BE2-5B3285BAFE99}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{F34BC0D4-9BE1-56E2-2BE2-5B3285BAFE99}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{F34BC0D4-9BE1-56E2-2BE2-5B3285BAFE99}
Key Deleted : HKCU\Software\RegisteredApplicationsEx
Key Deleted : HKCU\Software\VIS
Key Deleted : HKLM\SOFTWARE\{3A7D3E19-1B79-4E4E-BD96-5467DA2C4EF0}
Key Deleted : HKLM\SOFTWARE\{77D46E27-0E41-4478-87A6-AABE6FBCF252}
Key Deleted : HKLM\SOFTWARE\GamesBarSetup
Key Deleted : HKLM\SOFTWARE\Trymedia Systems
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-00B2-0405-0000-0000000FF1CE}

***** [ Browsers ] *****

-\\ Internet Explorer v11.0.9600.17344

-\\ Mozilla Firefox v33.0.2 (x86 cs)

[ File : C:\Users\Petra\AppData\Roaming\Mozilla\Firefox\Profiles\iordxknk.default-1412879335062\prefs.js ]

[ File : C:\Users\Petra\AppData\Roaming\Mozilla\Firefox\Profiles\qlvipccb.default\prefs.js ]

-\\ Google Chrome v

*************************

AdwCleaner[R0].txt - [8852 octets] - [03/11/2014 20:11:24]
AdwCleaner[S0].txt - [8988 octets] - [03/11/2014 20:20:41]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [9048 octets] ##########

#4 Příspěvek od **altrok** » 03 lis 2014 20:28

Ulozte na plochu zoek.exe http://hijackthis.nl/smeenk/zoek.htm

spustte jako spravce
do velkeho okna zkopirujte script uvedeny nize
kliknete na Run script
po restartu na Vas vyskoci log (pripadne jej najdete v C:\zoek-results.log) - vlozte mi jej do pristi odpovedi
Kód: Vybrat vše
```
autoclean;
emptyclsid;
iedefaults;
FFdefaults;
CHRdefaults;
emptyalltemp;
resethosts;
```

roman7 · #5 Příspěvek od **roman7** » 03 lis 2014 21:37

Zoek.exe v5.0.0.0 Updated 03-November-2014
Tool run by Petra on po 03.11.2014 at 21:06:43,70.
Microsoft Windows 7 Home Premium 6.1.7601 Service Pack 1 x86
Running in: Normal Mode Internet Access Detected
Launched: C:\Users\Petra\Desktop\zoek.exe [Scan all users] [Script inserted]

==== System Restore Info ======================

3.11.2014 21:08:35 Zoek.exe System Restore Point Created Succesfully.

==== Reset Hosts File ======================

# Copyright (c) 1993-2006 Microsoft Corp.
#
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
#
# This file contains the mappings of IP addresses to host names. Each
# entry should be kept on an individual line. The IP address should
# be placed in the first column followed by the corresponding host name.
# The IP address and the host name should be separated by at least one
# space.
#
# Additionally, comments (such as these) may be inserted on individual
# lines or following the machine name denoted by a '#' symbol.
#
# For example:
#
# 102.54.94.97 rhino.acme.com # source server
# 38.25.63.10 x.acme.com # x client host

# localhost name resolution is handle within DNS itself.
127.0.0.1 localhost
::1 localhost

==== Deleting CLSID Registry Keys ======================

==== Deleting CLSID Registry Values ======================

==== Deleting Services ======================

==== FireFox Fix ======================

Deleted from C:\Users\Petra\AppData\Roaming\Mozilla\Firefox\Profiles\iordxknk.default-1412879335062\prefs.js:
user_pref("browser.startup.homepage", "http://www.seznam.cz/");

Added to C:\Users\Petra\AppData\Roaming\Mozilla\Firefox\Profiles\iordxknk.default-1412879335062\prefs.js:
user_pref("browser.startup.homepage", "http://www.google.com");
user_pref("browser.search.defaulturl", "http://www.google.com/search?btnG=Google+Search&q=");
user_pref("browser.newtab.url", "http://www.google.com/");
user_pref("browser.search.defaultengine", "Google");
user_pref("browser.search.defaultenginename", "Google");
user_pref("browser.search.selectedEngine", "Google");
user_pref("browser.search.order.1", "Google");
user_pref("keyword.URL", "http://www.google.com/search?btnG=Google+Search&q=");
user_pref("browser.search.suggest.enabled", true);
user_pref("browser.search.useDBForOrder", true);

Deleted from C:\Users\Petra\AppData\Roaming\Mozilla\Firefox\Profiles\qlvipccb.default\prefs.js:
user_pref("browser.startup.homepage", "http://www.seznam.cz/");
user_pref("browser.search.defaultenginename", "WebHledani");
user_pref("browser.search.selectedEngine", "WebHledani");
user_pref("keyword.URL", "http://www.webhledani.cz/results.aspx?i=39&tp=ab&q=");

Added to C:\Users\Petra\AppData\Roaming\Mozilla\Firefox\Profiles\qlvipccb.default\prefs.js:
user_pref("browser.startup.homepage", "http://www.google.com");
user_pref("browser.search.defaulturl", "http://www.google.com/search?btnG=Google+Search&q=");
user_pref("browser.newtab.url", "http://www.google.com/");
user_pref("browser.search.defaultengine", "Google");
user_pref("browser.search.defaultenginename", "Google");
user_pref("browser.search.selectedEngine", "Google");
user_pref("browser.search.order.1", "Google");
user_pref("keyword.URL", "http://www.google.com/search?btnG=Google+Search&q=");
user_pref("browser.search.suggest.enabled", true);
user_pref("browser.search.useDBForOrder", true);

Deleted from C:\Users\Petra\AppData\Roaming\Thunderbird\Profiles\dfylihug.default\prefs.js:

Added to C:\Users\Petra\AppData\Roaming\Thunderbird\Profiles\dfylihug.default\prefs.js:
user_pref("browser.startup.homepage", "http://www.google.com");
user_pref("browser.search.defaulturl", "http://www.google.com/search?btnG=Google+Search&q=");
user_pref("browser.newtab.url", "http://www.google.com/");
user_pref("browser.search.defaultengine", "Google");
user_pref("browser.search.defaultenginename", "Google");
user_pref("browser.search.selectedEngine", "Google");
user_pref("browser.search.order.1", "Google");
user_pref("keyword.URL", "http://www.google.com/search?btnG=Google+Search&q=");
user_pref("browser.search.suggest.enabled", true);
user_pref("browser.search.useDBForOrder", true);

Deleted from C:\Users\Petra\AppData\Roaming\Thunderbird\Profiles\g5m04a03.default\prefs.js:

Added to C:\Users\Petra\AppData\Roaming\Thunderbird\Profiles\g5m04a03.default\prefs.js:
user_pref("browser.startup.homepage", "http://www.google.com");
user_pref("browser.search.defaulturl", "http://www.google.com/search?btnG=Google+Search&q=");
user_pref("browser.newtab.url", "http://www.google.com/");
user_pref("browser.search.defaultengine", "Google");
user_pref("browser.search.defaultenginename", "Google");
user_pref("browser.search.selectedEngine", "Google");
user_pref("browser.search.order.1", "Google");
user_pref("keyword.URL", "http://www.google.com/search?btnG=Google+Search&q=");
user_pref("browser.search.suggest.enabled", true);
user_pref("browser.search.useDBForOrder", true);

==== Deleting Files \ Folders ======================

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Sada bezdrátového príslušenství Labtec pro prenosný pocítac not found
C:\Users\Petra\AppData\LocalLow\{F34BC0D4-9BE1-56E2-2BE2-5B3285BAFE99} deleted
C:\PROGRA~2\BrilliantInstaller deleted
C:\Program Files\YoutubeAdblocker deleted
C:\Windows\system32\config\systemprofile\AppData\Roaming\AVG Security Toolbar deleted
C:\PROGRA~2\InstallMate deleted
C:\Users\Petra\AppData\LocalLow\{CE0BCB45-8FC1-055C-7E68-6D1105B5339D} deleted
C:\Users\Petra\AppData\LocalLow\{DCEF034B-02A4-6B39-8FBD-DEEAEE9C78D1} deleted
C:\Windows\system32\config\systemprofile\AppData\LocalLow\AVG Secure Search deleted
C:\Windows\system32\config\systemprofile\Searches deleted
C:\Windows\system32\GroupPolicy\Machine deleted
C:\Windows\system32\GroupPolicy\User deleted
C:\Windows\system32\GroupPolicy\gpt.ini deleted
"C:\PROGRA~2\770a0475a9eae0dc\{4820778D-AB0D-6D18-C316-52A6A0E1D507}" deleted
"C:\PROGRA~2\770a0475a9eae0dc\{993EA8F6-6E55-7E4E-39DE-5796E3226DB9}" deleted
"C:\PROGRA~2\770a0475a9eae0dc\{AD11DADE-C597-45D9-D8C5-1D2EB0B89613}" deleted
"C:\PROGRA~2\770a0475a9eae0dc" deleted

==== Firefox Extensions ======================

ProfilePath: C:\Users\Petra\AppData\Roaming\Mozilla\Firefox\Profiles\qlvipccb.default
- Undetermined - C:\Program Files\AVG\AVG9\Firefox
- Undetermined - C:\Program Files\AVG\AVG9\Toolbar\Firefox\avg@igeared

AppDir: C:\Program Files\Mozilla Firefox
- Default - %AppDir%\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

==== Firefox Plugins ======================

Profilepath: C:\Users\Petra\AppData\Roaming\Mozilla\Firefox\Profiles\iordxknk.default-1412879335062
63F8C13F269B10BC9363B007DAAACAE6 - C:\Windows\system32\Macromed\Flash\NPSWF32_15_0_0_189.dll - Shockwave Flash
F51ECBBA611C75E47578295D5241630F - C:\Program Files\Adobe\Reader 10.0\Reader\browser\nppdf32.dll - Adobe Acrobat
D654525C0902C21118AD29217E4ECB49 - C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll - Adobe Acrobat
893BF7D2261C56C24F813405D9D018E0 - c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll - Silverlight Plug-In
87132527E2256CF6683A18C4EB34DD3B - C:\Windows\system32\Wat\npWatWeb.dll - Windows Activation Technologies
8DA2ED6B04EA33F2EAE8BA883F903729 - c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrlui.dll - Microsoft® Silverlight

==== Chromium Look ======================

save oen - Administrator\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\bjbnkknjlhidhacbekjpdagfckgeofga
YoutubeAdblocker - Administrator\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\eflhoinbnpakfmfjepblkbpbpacjkjpp
saavea eon - Administrator\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\oglegmfmlaidmccdkeenbkcngkmpcglb
Minimal Memory - Administrator\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\oipgklkggfaokcoipmecomffdpebimle
Minimal Memory - Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\oipgklkggfaokcoipmecomffdpebimle
save oen - Administrator\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\bjbnkknjlhidhacbekjpdagfckgeofga
YoutubeAdblocker - Administrator\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\eflhoinbnpakfmfjepblkbpbpacjkjpp
saavea eon - Administrator\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\oglegmfmlaidmccdkeenbkcngkmpcglb
Minimal Memory - Administrator\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\oipgklkggfaokcoipmecomffdpebimle
save oen - Guest\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\bjbnkknjlhidhacbekjpdagfckgeofga
YoutubeAdblocker - Guest\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\eflhoinbnpakfmfjepblkbpbpacjkjpp
saavea eon - Guest\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\oglegmfmlaidmccdkeenbkcngkmpcglb
Minimal Memory - Guest\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\oipgklkggfaokcoipmecomffdpebimle
Minimal Memory - Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\oipgklkggfaokcoipmecomffdpebimle
save oen - Guest\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\bjbnkknjlhidhacbekjpdagfckgeofga
YoutubeAdblocker - Guest\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\eflhoinbnpakfmfjepblkbpbpacjkjpp
saavea eon - Guest\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\oglegmfmlaidmccdkeenbkcngkmpcglb
Minimal Memory - Guest\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\oipgklkggfaokcoipmecomffdpebimle
save oen - HomeGroupUser$\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\bjbnkknjlhidhacbekjpdagfckgeofga
YoutubeAdblocker - HomeGroupUser$\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\eflhoinbnpakfmfjepblkbpbpacjkjpp
saavea eon - HomeGroupUser$\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\oglegmfmlaidmccdkeenbkcngkmpcglb
Minimal Memory - HomeGroupUser$\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\oipgklkggfaokcoipmecomffdpebimle
Minimal Memory - HomeGroupUser$\AppData\Local\Google\Chrome\User Data\Default\Extensions\oipgklkggfaokcoipmecomffdpebimle
save oen - HomeGroupUser$\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\bjbnkknjlhidhacbekjpdagfckgeofga
YoutubeAdblocker - HomeGroupUser$\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\eflhoinbnpakfmfjepblkbpbpacjkjpp
saavea eon - HomeGroupUser$\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\oglegmfmlaidmccdkeenbkcngkmpcglb
Minimal Memory - HomeGroupUser$\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\oipgklkggfaokcoipmecomffdpebimle
save oen - Petra\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\bjbnkknjlhidhacbekjpdagfckgeofga
YoutubeAdblocker - Petra\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\eflhoinbnpakfmfjepblkbpbpacjkjpp
saavea eon - Petra\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\oglegmfmlaidmccdkeenbkcngkmpcglb
Minimal Memory - Petra\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\oipgklkggfaokcoipmecomffdpebimle
Minimal Memory - Petra\AppData\Local\Google\Chrome\User Data\Default\Extensions\oipgklkggfaokcoipmecomffdpebimle
save oen - Petra\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\bjbnkknjlhidhacbekjpdagfckgeofga
YoutubeAdblocker - Petra\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\eflhoinbnpakfmfjepblkbpbpacjkjpp
saavea eon - Petra\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\oglegmfmlaidmccdkeenbkcngkmpcglb
Minimal Memory - Petra\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\oipgklkggfaokcoipmecomffdpebimle

==== Chromium Fix ======================

C:\Users\Administrator\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\eflhoinbnpakfmfjepblkbpbpacjkjpp deleted successfully
C:\Users\Administrator\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\eflhoinbnpakfmfjepblkbpbpacjkjpp deleted successfully
C:\Users\Guest\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\eflhoinbnpakfmfjepblkbpbpacjkjpp deleted successfully
C:\Users\Guest\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\eflhoinbnpakfmfjepblkbpbpacjkjpp deleted successfully
C:\Users\HomeGroupUser$\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\eflhoinbnpakfmfjepblkbpbpacjkjpp deleted successfully
C:\Users\HomeGroupUser$\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\eflhoinbnpakfmfjepblkbpbpacjkjpp deleted successfully
C:\Users\Petra\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\eflhoinbnpakfmfjepblkbpbpacjkjpp deleted successfully
C:\Users\Petra\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\eflhoinbnpakfmfjepblkbpbpacjkjpp deleted successfully
C:\Users\Administrator\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\bjbnkknjlhidhacbekjpdagfckgeofga deleted successfully
C:\Users\Administrator\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\bjbnkknjlhidhacbekjpdagfckgeofga deleted successfully
C:\Users\Guest\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\bjbnkknjlhidhacbekjpdagfckgeofga deleted successfully
C:\Users\Guest\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\bjbnkknjlhidhacbekjpdagfckgeofga deleted successfully
C:\Users\HomeGroupUser$\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\bjbnkknjlhidhacbekjpdagfckgeofga deleted successfully
C:\Users\HomeGroupUser$\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\bjbnkknjlhidhacbekjpdagfckgeofga deleted successfully
C:\Users\Petra\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\bjbnkknjlhidhacbekjpdagfckgeofga deleted successfully
C:\Users\Petra\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\bjbnkknjlhidhacbekjpdagfckgeofga deleted successfully
C:\Users\Administrator\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\oglegmfmlaidmccdkeenbkcngkmpcglb deleted successfully
C:\Users\Administrator\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\oglegmfmlaidmccdkeenbkcngkmpcglb deleted successfully
C:\Users\Guest\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\oglegmfmlaidmccdkeenbkcngkmpcglb deleted successfully
C:\Users\Guest\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\oglegmfmlaidmccdkeenbkcngkmpcglb deleted successfully
C:\Users\HomeGroupUser$\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\oglegmfmlaidmccdkeenbkcngkmpcglb deleted successfully
C:\Users\HomeGroupUser$\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\oglegmfmlaidmccdkeenbkcngkmpcglb deleted successfully
C:\Users\Petra\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\oglegmfmlaidmccdkeenbkcngkmpcglb deleted successfully
C:\Users\Petra\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\oglegmfmlaidmccdkeenbkcngkmpcglb deleted successfully
C:\Users\Administrator\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\oipgklkggfaokcoipmecomffdpebimle deleted successfully
C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\oipgklkggfaokcoipmecomffdpebimle deleted successfully
C:\Users\Administrator\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\oipgklkggfaokcoipmecomffdpebimle deleted successfully
C:\Users\Guest\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\oipgklkggfaokcoipmecomffdpebimle deleted successfully
C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\oipgklkggfaokcoipmecomffdpebimle deleted successfully
C:\Users\Guest\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\oipgklkggfaokcoipmecomffdpebimle deleted successfully
C:\Users\HomeGroupUser$\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\oipgklkggfaokcoipmecomffdpebimle deleted successfully
C:\Users\HomeGroupUser$\AppData\Local\Google\Chrome\User Data\Default\Extensions\oipgklkggfaokcoipmecomffdpebimle deleted successfully
C:\Users\HomeGroupUser$\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\oipgklkggfaokcoipmecomffdpebimle deleted successfully
C:\Users\Petra\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\oipgklkggfaokcoipmecomffdpebimle deleted successfully
C:\Users\Petra\AppData\Local\Google\Chrome\User Data\Default\Extensions\oipgklkggfaokcoipmecomffdpebimle deleted successfully
C:\Users\Petra\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\oipgklkggfaokcoipmecomffdpebimle deleted successfully

==== Set IE to Default ======================

Old Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"="http://www.seznam.cz/"
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes]
No DefaultScope Set For HKCU

New Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"="http://www.seznam.cz/"
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes]
"DefaultScope"="{012E1000-F331-11DB-8314-0800200C9A66}"

==== All HKCU SearchScopes ======================

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes
{012E1000-F331-11DB-8314-0800200C9A66} Google Url="http://www.google.com/search?q={searchTerms}"
{0633EE93-D776-472f-A0FF-E1416B8B2E3A} Bing Url="http://www.bing.com/search?q={searchTer ... ORM=IE8SRC"
{1819C136-CD15-4FE5-B5F3-61AB16ED4AA5} WebHledani Url="http://www.webhledani.cz/results.aspx?i ... earchTerms}"
{6A1806CD-94D4-4689-BA73-E35EA1EA9990} Bing Url="http://www.bing.com/search?q={searchTer ... ORM=IE11SR"

==== Reset Google Chrome ======================

Nothing found to reset

==== Deleting Registry Keys ======================

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\4d55b6ff-0064-4b13-b5ae-3056d6a55ba3 deleted successfully
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\557a9242-cd25-4d8c-8b9f-911b02a38926 deleted successfully
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\65886680-f83d-499d-98a7-6ed9bb068cc6 deleted successfully
HKEY_LOCAL_MACHINE\Software\Policies\Google deleted successfully

==== Empty IE Cache ======================

C:\Users\Petra\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\Petra\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5 emptied successfully
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\serviceprofiles\networkservice\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\serviceprofiles\Localservice\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\serviceprofiles\Localservice\AppData\Local\Temp\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully

==== Empty FireFox Cache ======================

C:\Users\Petra\AppData\Local\Mozilla\Firefox\Profiles\iordxknk.default-1412879335062\cache2 emptied successfully

==== Empty Chrome Cache ======================

No Chrome Cache found

==== Empty All Flash Cache ======================

Flash Cache Emptied Successfully

==== Empty All Java Cache ======================

No Java Cache Found

==== C:\zoek_backup content ======================

C:\zoek_backup (files=245 folders=93 6766716 bytes)

==== Empty Temp Folders ======================

C:\Users\Default\AppData\Local\temp emptied successfully
C:\Users\Default User\AppData\Local\temp emptied successfully
C:\Users\Petra\AppData\Local\temp will be emptied at reboot
C:\Users\Public\AppData\Local\temp emptied successfully
C:\Windows\serviceprofiles\networkservice\AppData\Local\Temp emptied successfully
C:\Windows\serviceprofiles\Localservice\AppData\Local\Temp emptied successfully
C:\Windows\Temp will be emptied at reboot

==== After Reboot ======================

==== Empty Temp Folders ======================

C:\Windows\Temp successfully emptied
C:\Users\Petra\AppData\Local\Temp successfully emptied

==== Empty Recycle Bin ======================

C:\$RECYCLE.BIN successfully emptied

==== EOF on po 03.11.2014 at 21:35:39,49 ======================

#6 Příspěvek od **altrok** » 03 lis 2014 21:38

Dejte novy log FRST, prilozte i Addition.txt - http://forum.viry.cz/viewtopic.php?f=30&t=133101

roman7 · #7 Příspěvek od **roman7** » 03 lis 2014 22:09

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 02-11-2014
Ran by Petra (administrator) on PETRA-PC on 03-11-2014 21:55:46
Running from C:\Users\Petra\Desktop
Loaded Profile: Petra (Available profiles: Petra)
Platform: Microsoft Windows 7 Home Premium Service Pack 1 (X86) OS Language: Čeština (Česká republika)
Internet Explorer Version 11
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/33 ... scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
(Conexant Systems, Inc.) C:\Windows\System32\drivers\XAudio.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Synaptics, Inc.) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
( Hewlett-Packard Development Company, L.P.) C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\VolCtrl.exe
(Synaptics, Inc.) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe
(Nero AG) C:\Program Files\Nero\Update\NASvc.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MpCmdRun.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MpCmdRun.exe
(forum.viry.cz) C:\Users\Petra\Desktop\FRSTLauncher.exe
(Microsoft Corporation) C:\Windows\System32\wuauclt.exe
(Microsoft Corporation) C:\Windows\SoftwareDistribution\Download\Install\AM_Delta_Patch_1.187.1150.0.exe
(Microsoft Corporation) C:\Windows\System32\MpSigStub.exe

==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1045800 2008-03-28] (Synaptics, Inc.)
HKLM\...\Run: [MSC] => c:\Program Files\Microsoft Security Client\msseces.exe [974432 2014-08-22] (Microsoft Corporation)
HKLM\...\Run: [GrooveMonitor] => C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe [30040 2009-02-26] (Microsoft Corporation)
HKLM\...\Run: [QlbCtrl.exe] => C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe [287800 2009-11-11] ( Hewlett-Packard Development Company, L.P.)
HKLM\...\Run: [MSStp] => C:\Windows\inf\msstp.vbe [1584 2014-03-05] ()
HKLM\...\Run: [mncplgulSrv] => C:\Windows\system32\mncplgul.vbe [7670 2014-03-05] ()
HKLM\...\Run: [msdbjmSrv] => C:\Windows\inf\msdbjm.vbe [1558 2013-08-27] ()
HKU\S-1-5-21-2139201608-127755447-2371499739-1000\...\MountPoints2: F - F:\autoplay.exe
HKU\S-1-5-21-2139201608-127755447-2371499739-1000\...\MountPoints2: {88828ebe-03ce-11e2-befb-001b388fc583} - F:\autoplay.exe
HKU\S-1-5-21-2139201608-127755447-2371499739-1000\...\MountPoints2: {b3d22bc0-64f4-11e3-b5ce-001b388fc583} - F:\UbiLaunch.exe
HKU\S-1-5-21-2139201608-127755447-2371499739-1000\...\MountPoints2: {ec8fee36-a91f-11e2-8bcf-001b388fc583} - F:\UbiLaunch.exe
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => No File

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.seznam.cz/
SearchScopes: HKCU - DefaultScope {012E1000-F331-11DB-8314-0800200C9A66} URL = http://www.google.com/search?q={searchTerms}
SearchScopes: HKCU - {012E1000-F331-11DB-8314-0800200C9A66} URL = http://www.google.com/search?q={searchTerms}
SearchScopes: HKCU - {1819C136-CD15-4FE5-B5F3-61AB16ED4AA5} URL = http://www.webhledani.cz/results.aspx?i ... earchTerms}
BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1

FireFox:
========
FF ProfilePath: C:\Users\Petra\AppData\Roaming\Mozilla\Firefox\Profiles\iordxknk.default-1412879335062
FF NewTab: hxxp://www.google.com/
FF DefaultSearchUrl: hxxp://www.google.com/search?btnG=Google+Search&q=
FF SearchEngineOrder.1: Google
FF SelectedSearchEngine: Google
FF Homepage: hxxp://www.google.com
FF Keyword.URL: hxxp://www.google.com/search?btnG=Google+Search&q=
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_15_0_0_189.dll ()
FF Plugin: @microsoft.com/GENUINE -> C:\Windows\system32\Wat\npWatWeb.dll (Microsoft Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\np-mswmp.dll (Microsoft Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\NPOFF12.DLL (Microsoft Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin2.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin3.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin4.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin5.dll (Apple Inc.)
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\heureka-cz.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\mapy-cz.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\seznam-cz.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\slunecnice-cz.xml

Chrome:
=======
CHR dev: Chrome dev build detected! <======= ATTENTION
CHR Profile: C:\Users\Petra\AppData\Local\Google\Chrome\User Data\Default

========================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [22192 2014-08-22] (Microsoft Corporation)
R2 NAUpdate; C:\Program Files\Nero\Update\NASvc.exe [490280 2010-03-25] (Nero AG)
R3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [288120 2014-08-22] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [243128 2013-12-14] (Disc Soft Ltd)
S3 FTDIBUS; C:\Windows\System32\drivers\ftdibus.sys [63464 2013-02-13] (FTDI Ltd.)
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [231800 2014-07-17] (Microsoft Corporation)
S3 WLNumPad; C:\Windows\System32\Drivers\WLNumPad.sys [9600 2007-03-19] (Waytech Development, Inc.) [File not signed]
U5 AppMgmt; C:\Windows\system32\svchost.exe [20992 2009-07-14] (Microsoft Corporation)
S3 catchme; \??\C:\Users\Petra\AppData\Local\Temp\catchme.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)

==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-11-03 21:55 - 2014-11-03 21:57 - 00008333 _____ () C:\Users\Petra\Desktop\FRST.txt
2014-11-03 21:53 - 2014-11-03 21:55 - 00000000 ____D () C:\FRST
2014-11-03 21:48 - 2014-11-03 21:49 - 00112640 _____ (forum.viry.cz) C:\Users\Petra\Desktop\FRSTLauncher.exe
2014-11-03 21:47 - 2014-11-03 21:49 - 01106432 _____ (Farbar) C:\Users\Petra\Desktop\FRST.exe
2014-11-03 21:33 - 2014-11-03 21:06 - 00024064 _____ () C:\Windows\zoek-delete.exe
2014-11-03 21:08 - 2014-11-03 21:35 - 00020635 _____ () C:\zoek-results.log
2014-11-03 21:06 - 2014-11-03 21:30 - 00000000 ____D () C:\zoek_backup
2014-11-03 21:03 - 2014-11-03 21:03 - 01292800 _____ () C:\Users\Petra\Desktop\zoek.exe
2014-11-03 20:23 - 2014-11-03 21:34 - 00022494 _____ () C:\Windows\PFRO.log
2014-11-03 20:15 - 2010-08-30 08:34 - 00536576 _____ (SQLite Development Team) C:\Windows\system32\sqlite3.dll
2014-11-03 20:11 - 2014-11-03 20:21 - 00000000 ____D () C:\AdwCleaner
2014-11-03 20:09 - 2014-11-03 20:09 - 01375089 _____ () C:\Users\Petra\Desktop\adwcleaner_3.311.exe
2014-11-03 20:05 - 2014-11-03 21:35 - 00000168 _____ () C:\Windows\setupact.log
2014-11-03 20:05 - 2014-11-03 20:05 - 00000000 _____ () C:\Windows\setuperr.log
2014-11-02 21:35 - 2014-11-02 21:45 - 00000000 ____D () C:\Program Files\trend micro
2014-11-02 21:35 - 2014-11-02 21:36 - 00000000 ____D () C:\rsit
2014-11-02 21:33 - 2014-11-02 21:33 - 01107968 _____ () C:\Users\Petra\Desktop\RSIT.exe
2014-10-30 20:34 - 2014-10-30 20:35 - 00000000 ____D () C:\Program Files\Mozilla Firefox
2014-10-22 17:44 - 2014-10-22 17:44 - 00000000 ____D () C:\Users\Petra\AppData\Roaming\InstallShield
2014-10-22 17:23 - 2014-10-22 17:24 - 04965896 _____ (Piriform Ltd) C:\Users\Petra\Downloads\ccsetup418.exe
2014-10-15 20:59 - 2014-10-10 02:44 - 00396288 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-10-15 20:59 - 2014-10-10 02:44 - 00230912 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll
2014-10-15 20:59 - 2014-06-18 23:23 - 01131664 _____ (Microsoft Corporation) C:\Windows\system32\dfshim.dll
2014-10-15 20:59 - 2014-06-18 23:23 - 00156824 _____ (Microsoft Corporation) C:\Windows\system32\mscorier.dll
2014-10-15 20:59 - 2014-06-18 23:23 - 00081560 _____ (Microsoft Corporation) C:\Windows\system32\mscories.dll
2014-10-15 20:58 - 2014-10-10 02:39 - 00302592 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-10-15 20:58 - 2014-09-29 01:41 - 02379264 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-10-15 20:58 - 2014-09-05 02:52 - 05703168 _____ (Microsoft Corporation) C:\Windows\system32\mstscax.dll
2014-10-15 20:58 - 2014-09-04 06:04 - 00372736 _____ (Microsoft Corporation) C:\Windows\system32\rastls.dll
2014-10-15 20:57 - 2014-10-07 03:04 - 00331448 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-10-15 20:57 - 2014-09-25 23:46 - 00365056 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-10-15 20:57 - 2014-09-25 23:46 - 00243200 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-10-15 20:57 - 2014-09-25 23:46 - 00069632 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-10-15 20:57 - 2014-09-25 23:43 - 11807232 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-10-15 20:57 - 2014-09-25 23:32 - 02017280 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-10-15 20:57 - 2014-09-19 02:44 - 17484800 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-10-15 20:57 - 2014-09-19 02:25 - 04201472 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-10-15 20:57 - 2014-09-19 02:14 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-10-15 20:57 - 2014-09-19 02:14 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-10-15 20:57 - 2014-09-19 02:02 - 00454656 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-10-15 20:57 - 2014-09-19 02:01 - 00061952 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-10-15 20:57 - 2014-09-19 02:01 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-10-15 20:57 - 2014-09-19 01:59 - 00061952 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2014-10-15 20:57 - 2014-09-19 01:55 - 02187264 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-10-15 20:57 - 2014-09-19 01:54 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-10-15 20:57 - 2014-09-19 01:53 - 00032768 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-10-15 20:57 - 2014-09-19 01:51 - 00440320 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-10-15 20:57 - 2014-09-19 01:50 - 00112128 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-10-15 20:57 - 2014-09-19 01:50 - 00108032 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-10-15 20:57 - 2014-09-19 01:49 - 00597504 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-10-15 20:57 - 2014-09-19 01:44 - 00646144 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-10-15 20:57 - 2014-09-19 01:36 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-10-15 20:57 - 2014-09-19 01:32 - 00164864 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-10-15 20:57 - 2014-09-19 01:20 - 00677888 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-10-15 20:57 - 2014-09-19 01:20 - 00607744 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-10-15 20:57 - 2014-09-19 01:18 - 01068032 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-10-15 20:57 - 2014-09-19 00:59 - 01810944 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-10-15 20:57 - 2014-09-19 00:53 - 01190400 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-10-15 20:57 - 2014-09-19 00:52 - 00678400 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-10-15 20:57 - 2014-08-29 02:44 - 02744320 _____ (Microsoft Corporation) C:\Windows\system32\rdpcorets.dll
2014-10-15 20:56 - 2014-09-18 02:32 - 02363904 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll
2014-10-15 20:56 - 2014-07-17 02:40 - 00157696 _____ (Microsoft Corporation) C:\Windows\system32\winsta.dll
2014-10-15 20:56 - 2014-07-17 02:39 - 00523264 _____ (Microsoft Corporation) C:\Windows\system32\termsrv.dll
2014-10-15 20:56 - 2014-07-17 02:39 - 00304128 _____ (Microsoft Corporation) C:\Windows\system32\winlogon.exe
2014-10-15 20:56 - 2014-07-17 02:39 - 00130048 _____ (Microsoft Corporation) C:\Windows\system32\rdpcorekmts.dll
2014-10-15 20:56 - 2014-07-17 02:39 - 00065536 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2014-10-15 20:56 - 2014-07-17 02:39 - 00017408 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2014-10-15 20:56 - 2014-07-17 02:03 - 00184320 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\rdpwd.sys
2014-10-15 20:56 - 2014-07-17 02:02 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tssecsrv.sys
2014-10-15 20:52 - 2014-09-13 02:40 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\packager.dll
2014-10-15 20:51 - 2014-08-19 03:41 - 00050688 _____ (Microsoft Corporation) C:\Windows\system32\appidapi.dll
2014-10-15 20:51 - 2014-08-19 03:41 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\setbcdlocale.dll
2014-10-15 20:51 - 2014-08-19 03:41 - 00027648 _____ (Microsoft Corporation) C:\Windows\system32\appidsvc.dll
2014-10-15 20:51 - 2014-08-19 03:40 - 00096768 _____ (Microsoft Corporation) C:\Windows\system32\appidpolicyconverter.exe
2014-10-15 20:51 - 2014-08-19 03:40 - 00016896 _____ (Microsoft Corporation) C:\Windows\system32\appidcertstorecheck.exe
2014-10-15 20:51 - 2014-08-19 02:48 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\appid.sys
2014-10-15 20:51 - 2014-07-07 02:40 - 11411456 _____ (Microsoft Corporation) C:\Windows\system32\wmp.dll
2014-10-15 20:51 - 2014-07-07 02:40 - 03208704 _____ (Microsoft Corporation) C:\Windows\system32\mf.dll
2014-10-15 20:51 - 2014-07-07 02:40 - 01329664 _____ (Microsoft Corporation) C:\Windows\system32\quartz.dll
2014-10-15 20:51 - 2014-07-07 02:40 - 01174528 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2014-10-15 20:51 - 2014-07-07 02:40 - 01005056 _____ (Microsoft Corporation) C:\Windows\system32\cryptui.dll
2014-10-15 20:51 - 2014-07-07 02:40 - 00988160 _____ (Microsoft Corporation) C:\Windows\system32\drmv2clt.dll
2014-10-15 20:51 - 2014-07-07 02:40 - 00744960 _____ (Microsoft Corporation) C:\Windows\system32\blackbox.dll
2014-10-15 20:51 - 2014-07-07 02:40 - 00617984 _____ (Microsoft Corporation) C:\Windows\system32\wmdrmsdk.dll
2014-10-15 20:51 - 2014-07-07 02:40 - 00504320 _____ (Microsoft Corporation) C:\Windows\system32\msscp.dll
2014-10-15 20:51 - 2014-07-07 02:40 - 00489984 _____ (Microsoft Corporation) C:\Windows\system32\evr.dll
2014-10-15 20:51 - 2014-07-07 02:40 - 00473600 _____ (Microsoft Corporation) C:\Windows\system32\audiosrv.dll
2014-10-15 20:51 - 2014-07-07 02:40 - 00442880 _____ (Microsoft Corporation) C:\Windows\system32\AUDIOKSE.dll
2014-10-15 20:51 - 2014-07-07 02:40 - 00406016 _____ (Microsoft Corporation) C:\Windows\system32\drmmgrtn.dll
2014-10-15 20:51 - 2014-07-07 02:40 - 00374784 _____ (Microsoft Corporation) C:\Windows\system32\AudioEng.dll
2014-10-15 20:51 - 2014-07-07 02:40 - 00354816 _____ (Microsoft Corporation) C:\Windows\system32\mfplat.dll
2014-10-15 20:51 - 2014-07-07 02:40 - 00275968 _____ (Microsoft Corporation) C:\Windows\system32\EncDump.dll
2014-10-15 20:51 - 2014-07-07 02:40 - 00265216 _____ (Microsoft Corporation) C:\Windows\system32\msnetobj.dll
2014-10-15 20:51 - 2014-07-07 02:40 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\AudioSes.dll
2014-10-15 20:51 - 2014-07-07 02:40 - 00179200 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll
2014-10-15 20:51 - 2014-07-07 02:40 - 00157184 _____ (Microsoft Corporation) C:\Windows\system32\pcasvc.dll
2014-10-15 20:51 - 2014-07-07 02:40 - 00143872 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll
2014-10-15 20:51 - 2014-07-07 02:40 - 00103424 _____ (Microsoft Corporation) C:\Windows\system32\mfps.dll
2014-10-15 20:51 - 2014-07-07 02:40 - 00081408 _____ (Microsoft Corporation) C:\Windows\system32\cryptsp.dll
2014-10-15 20:51 - 2014-07-07 02:40 - 00008192 _____ (Microsoft Corporation) C:\Windows\system32\spwmp.dll
2014-10-15 20:51 - 2014-07-07 02:40 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\msdxm.ocx
2014-10-15 20:51 - 2014-07-07 02:40 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\dxmasf.dll
2014-10-15 20:51 - 2014-07-07 02:39 - 12625408 _____ (Microsoft Corporation) C:\Windows\system32\wmploc.DLL
2014-10-15 20:51 - 2014-07-07 02:39 - 03970488 _____ (Microsoft Corporation) C:\Windows\system32\ntkrnlpa.exe
2014-10-15 20:51 - 2014-07-07 02:39 - 03914680 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2014-10-15 20:51 - 2014-07-07 02:39 - 00100864 _____ (Microsoft Corporation) C:\Windows\system32\audiodg.exe
2014-10-15 20:51 - 2014-07-07 02:39 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\rrinstaller.exe
2014-10-15 20:51 - 2014-07-07 02:39 - 00023040 _____ (Microsoft Corporation) C:\Windows\system32\mfpmp.exe
2014-10-15 20:51 - 2014-07-07 02:37 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\mferror.dll
2014-10-15 20:51 - 2014-07-07 02:28 - 00593920 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\PEAuth.sys
2014-10-15 20:51 - 2014-06-28 01:21 - 00521384 _____ (Microsoft Corporation) C:\Windows\system32\winload.exe
2014-10-15 20:51 - 2014-06-28 01:21 - 00455752 _____ (Microsoft Corporation) C:\Windows\system32\winresume.exe
2014-10-15 20:51 - 2014-06-28 01:21 - 00409272 _____ (Microsoft Corporation) C:\Windows\system32\ci.dll
2014-10-09 19:29 - 2014-10-09 19:29 - 00000000 ____D () C:\Users\Petra\Desktop\Původní data aplikace Firefox

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-11-03 21:53 - 2010-03-30 18:27 - 01828651 _____ () C:\Windows\WindowsUpdate.log
2014-11-03 21:42 - 2009-07-14 05:34 - 00022592 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-11-03 21:42 - 2009-07-14 05:34 - 00022592 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-11-03 21:37 - 2014-06-22 15:50 - 00000330 _____ () C:\Users\Petra\rgut
2014-11-03 21:35 - 2014-06-07 12:20 - 00000008 __RSH () C:\ProgramData\ntuser.pol
2014-11-03 21:35 - 2009-07-14 05:53 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-11-03 21:26 - 2009-07-14 03:37 - 00000000 ___HD () C:\Windows\system32\GroupPolicy
2014-11-03 20:23 - 2009-07-14 05:53 - 00032566 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-11-03 20:21 - 2012-07-03 20:53 - 00000914 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-10-31 16:07 - 2012-08-02 07:29 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service
2014-10-31 10:35 - 2009-07-14 03:37 - 00000000 ____D () C:\Windows\rescache
2014-10-30 19:29 - 2010-03-30 18:50 - 01584626 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-10-30 12:24 - 2013-03-27 17:05 - 00229000 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2014-10-29 17:18 - 2013-12-25 22:33 - 00000000 ____D () C:\Users\Petra\Downloads\holky
2014-10-25 19:53 - 2014-08-16 18:02 - 00000000 ____D () C:\Users\Petra\AppData\Local\Adobe
2014-10-25 19:52 - 2012-07-03 20:53 - 00701104 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2014-10-25 19:52 - 2012-07-03 20:53 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2014-10-22 17:45 - 2011-08-21 20:44 - 00000033 _____ () C:\Windows\KA.ini
2014-10-22 17:45 - 2011-08-21 20:43 - 00000000 ___HD () C:\Program Files\InstallShield Installation Information
2014-10-22 17:45 - 2011-08-21 20:43 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Barbie(TM)
2014-10-22 17:44 - 2011-02-27 18:39 - 00000000 ____D () C:\Program Files\hry
2014-10-22 17:31 - 2011-12-02 16:17 - 00000965 _____ () C:\Users\Public\Desktop\CCleaner.lnk
2014-10-22 17:31 - 2011-12-02 16:17 - 00000000 ____D () C:\Program Files\CCleaner
2014-10-21 06:00 - 2009-07-14 03:37 - 00000000 ____D () C:\Windows\Microsoft.NET
2014-10-15 21:50 - 2009-07-14 05:33 - 00406880 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-10-15 21:46 - 2014-05-07 10:21 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-10-15 21:40 - 2010-04-05 19:25 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-10-15 21:28 - 2013-07-26 18:52 - 00000000 ____D () C:\Windows\system32\MRT
2014-10-15 21:22 - 2010-04-01 19:19 - 100290944 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-10-09 19:25 - 2014-09-01 20:57 - 00311687 _____ () C:\Users\Petra\Desktop\avgremover.log
2014-10-04 19:51 - 2013-12-25 19:21 - 00000000 ____D () C:\Users\Petra\Documents\x box

==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed

===***===***===***=== Extract of Additional scan result of Farbar Recovery Scan Tool ===***===***===***===

==================== Drive and Memory info ===================

==================== MBR and Partition Table ==================

==================== Scheduled Tasks (whitelisted) ==================

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe

==================== Alternate Data Streams (whitelisted) ==================

==================== Security Center ==================

AV: Microsoft Security Essentials (Enabled - Up to date) {4F35CFC4-45A3-FC37-EF17-759A02E39AB1}
AS: Microsoft Security Essentials (Enabled - Up to date) {F4542E20-6399-F3B9-D5A7-4EE87964D00C}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

===***===***===***=== Supplementary Scan createdy by FRSTLauncher ===***===***===***===
Posledni aktualizace FRSTLauncheru: 25_11_2013 (01)
Posledni aktualizace Modifikacniho skriptu: 30_09_2013 (01)

***** Velikost "Plochy" *****

Velikost slozky "C:\Users\Petra\Desktop" je 51 MB.

***** Startup Programs *****

HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite
"C:\Program Files\DAEMON Tools Lite\DTLite.exe" -autorun [x]

HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NBAgent
"C:\Program Files\Nero\Nero 10\Nero BackItUp\NBAgent.exe" /WinStart [x]

HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Enable Labtec NumPad.lnk
C:\PROGRA~1\LABTEC~1\Magickey.exe

HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Povolit bezdr�tovou my�.lnk
C:\PROGRA~1\WIRELE~1\MulMouse.exe

HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Povolit bezdr�tovou numerickou kl�vesnici.lnk
C:\PROGRA~1\WIRELE~1\Magickey.exe

***** Firewall rules *****

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
DisableNotifications REG_DWORD 0x0
EnableFirewall REG_DWORD 0x1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
DisableNotifications REG_DWORD 0x0
EnableFirewall REG_DWORD 0x1

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]

***** System Restore *****

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR"=dword:00000000
"Generalize_DisableSR"=dword:00000000

==================== End Of Log ==============================

#8 Příspěvek od **altrok** » 03 lis 2014 22:38

Do Poznamkoveho bloku (Start -> spustit -> notepad) zkopirujte obsah bileho pole
ulozte na plochu jako fixlist (Typ souboru: Textovy dokument)
znovu spustte FRST a kliknete na Fix

po restartu na Vas vyskoci fixlog, jehoz obsah mi vlozte do pristi odpovedi

Kód: Vybrat vše

Start
CloseProcesses:
HKLM\...\Run: [GrooveMonitor] => C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe [30040 2009-02-26] (Microsoft Corporation)
HKLM\...\Run: [MSStp] => C:\Windows\inf\msstp.vbe [1584 2014-03-05] ()
HKLM\...\Run: [mncplgulSrv] => C:\Windows\system32\mncplgul.vbe [7670 2014-03-05] ()
HKLM\...\Run: [msdbjmSrv] => C:\Windows\inf\msdbjm.vbe [1558 2013-08-27] ()
HKU\S-1-5-21-2139201608-127755447-2371499739-1000\...\MountPoints2: F - F:\autoplay.exe
HKU\S-1-5-21-2139201608-127755447-2371499739-1000\...\MountPoints2: {88828ebe-03ce-11e2-befb-001b388fc583} - F:\autoplay.exe
HKU\S-1-5-21-2139201608-127755447-2371499739-1000\...\MountPoints2: {b3d22bc0-64f4-11e3-b5ce-001b388fc583} - F:\UbiLaunch.exe
HKU\S-1-5-21-2139201608-127755447-2371499739-1000\...\MountPoints2: {ec8fee36-a91f-11e2-8bcf-001b388fc583} - F:\UbiLaunch.exe
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => No File
C:\Windows\inf\msstp.vbe
C:\Windows\system32\mncplgul.vbe
C:\Windows\inf\msdbjm.vbe
CHR dev: Chrome dev build detected! <======= ATTENTION
2014-11-03 21:33 - 2014-11-03 21:06 - 00024064 _____ () C:\Windows\zoek-delete.exe
2014-11-03 21:08 - 2014-11-03 21:35 - 00020635 _____ () C:\zoek-results.log
2014-11-03 21:06 - 2014-11-03 21:30 - 00000000 ____D () C:\zoek_backup
2014-11-03 21:03 - 2014-11-03 21:03 - 01292800 _____ () C:\Users\Petra\Desktop\zoek.exe
2014-11-03 20:15 - 2010-08-30 08:34 - 00536576 _____ (SQLite Development Team) C:\Windows\system32\sqlite3.dll
2014-11-02 21:35 - 2014-11-02 21:45 - 00000000 ____D () C:\Program Files\trend micro
2014-10-22 17:23 - 2014-10-22 17:24 - 04965896 _____ (Piriform Ltd) C:\Users\Petra\Downloads\ccsetup418.exe
REG: reg delete "HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite" /f
REG: reg delete "HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NBAgent" /f
Hosts:
EmptyTemp:
End

roman7 · #9 Příspěvek od **roman7** » 04 lis 2014 21:16

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version: 02-11-2014
Ran by Petra at 2014-11-04 21:06:26 Run:1
Running from C:\Users\Petra\Desktop
Loaded Profile: Petra (Available profiles: Petra)
Boot Mode: Normal

==============================================

Content of fixlist:
*****************
Start
CloseProcesses:
HKLM\...\Run: [GrooveMonitor] => C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe [30040 2009-02-26] (Microsoft Corporation)
HKLM\...\Run: [MSStp] => C:\Windows\inf\msstp.vbe [1584 2014-03-05] ()
HKLM\...\Run: [mncplgulSrv] => C:\Windows\system32\mncplgul.vbe [7670 2014-03-05] ()
HKLM\...\Run: [msdbjmSrv] => C:\Windows\inf\msdbjm.vbe [1558 2013-08-27] ()
HKU\S-1-5-21-2139201608-127755447-2371499739-1000\...\MountPoints2: F - F:\autoplay.exe
HKU\S-1-5-21-2139201608-127755447-2371499739-1000\...\MountPoints2: {88828ebe-03ce-11e2-befb-001b388fc583} - F:\autoplay.exe
HKU\S-1-5-21-2139201608-127755447-2371499739-1000\...\MountPoints2: {b3d22bc0-64f4-11e3-b5ce-001b388fc583} - F:\UbiLaunch.exe
HKU\S-1-5-21-2139201608-127755447-2371499739-1000\...\MountPoints2: {ec8fee36-a91f-11e2-8bcf-001b388fc583} - F:\UbiLaunch.exe
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => No File
C:\Windows\inf\msstp.vbe
C:\Windows\system32\mncplgul.vbe
C:\Windows\inf\msdbjm.vbe
CHR dev: Chrome dev build detected! <======= ATTENTION
2014-11-03 21:33 - 2014-11-03 21:06 - 00024064 _____ () C:\Windows\zoek-delete.exe
2014-11-03 21:08 - 2014-11-03 21:35 - 00020635 _____ () C:\zoek-results.log
2014-11-03 21:06 - 2014-11-03 21:30 - 00000000 ____D () C:\zoek_backup
2014-11-03 21:03 - 2014-11-03 21:03 - 01292800 _____ () C:\Users\Petra\Desktop\zoek.exe
2014-11-03 20:15 - 2010-08-30 08:34 - 00536576 _____ (SQLite Development Team) C:\Windows\system32\sqlite3.dll
2014-11-02 21:35 - 2014-11-02 21:45 - 00000000 ____D () C:\Program Files\trend micro
2014-10-22 17:23 - 2014-10-22 17:24 - 04965896 _____ (Piriform Ltd) C:\Users\Petra\Downloads\ccsetup418.exe
REG: reg delete "HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite" /f
REG: reg delete "HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NBAgent" /f
Hosts:
EmptyTemp:
End
*****************

Processes closed successfully.
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\\GrooveMonitor => value deleted successfully.
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\\MSStp => value deleted successfully.
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\\mncplgulSrv => value deleted successfully.
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\\msdbjmSrv => value deleted successfully.
"HKU\S-1-5-21-2139201608-127755447-2371499739-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\S-1-5-21-2139201608-127755447-2371499739-1000" => Key not found.
"HKU\S-1-5-21-2139201608-127755447-2371499739-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{88828ebe-03ce-11e2-befb-001b388fc583}" => Key deleted successfully.
"HKCR\CLSID\{88828ebe-03ce-11e2-befb-001b388fc583}" => Key not found.
"HKU\S-1-5-21-2139201608-127755447-2371499739-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b3d22bc0-64f4-11e3-b5ce-001b388fc583}" => Key deleted successfully.
"HKCR\CLSID\{b3d22bc0-64f4-11e3-b5ce-001b388fc583}" => Key not found.
"HKU\S-1-5-21-2139201608-127755447-2371499739-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{ec8fee36-a91f-11e2-8bcf-001b388fc583}" => Key deleted successfully.
"HKCR\CLSID\{ec8fee36-a91f-11e2-8bcf-001b388fc583}" => Key not found.
"HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\00avast" => Key deleted successfully.
"HKCR\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}" => Key not found.
C:\Windows\inf\msstp.vbe => Moved successfully.
C:\Windows\system32\mncplgul.vbe => Moved successfully.
C:\Windows\inf\msdbjm.vbe => Moved successfully.
CHR dev: Chrome dev build detected! <======= ATTENTION => Error: No automatic fix found for this entry.
C:\Windows\zoek-delete.exe => Moved successfully.
C:\zoek-results.log => Moved successfully.
C:\zoek_backup => Moved successfully.
C:\Users\Petra\Desktop\zoek.exe => Moved successfully.
C:\Windows\system32\sqlite3.dll => Moved successfully.
C:\Program Files\trend micro => Moved successfully.
C:\Users\Petra\Downloads\ccsetup418.exe => Moved successfully.

========= reg delete "HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite" /f =========

Operace byla dokonźena ŁspŘçnŘ.

========= End of Reg: =========

========= reg delete "HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NBAgent" /f =========

Operace byla dokonźena ŁspŘçnŘ.

========= End of Reg: =========

C:\Windows\System32\Drivers\etc\hosts => Moved successfully.
Hosts was reset successfully.
EmptyTemp: => Removed 40.8 MB temporary data.

The system needed a reboot.

==== End of Fixlog ====

#10 Příspěvek od **altrok** » 04 lis 2014 21:45

Vyborne

Jak se pocitac chova ted?

roman7 · #11 Příspěvek od **roman7** » 04 lis 2014 21:58

Notebok se zrychlil a internet taky běží rychleji.

#12 Příspěvek od **altrok** » 04 lis 2014 22:46

Takze jeste uklidime.

Stahnete a spustte DelFix - https://toolslib.net/downloads/viewdownload/2-delfix/
Oznacte jen moznost "Remove disinfection tools"
kliknete na Run

A pokud nejsou dotazy ci jine problemy, je to ode mne vse.

VIRY.CZ

Prosím o kontrolu logu. Děkuji.

Prosím o kontrolu logu. Děkuji.

Re: Prosím o kontrolu logu. Děkuji.

Re: Prosím o kontrolu logu. Děkuji.

Re: Prosím o kontrolu logu. Děkuji.

Re: Prosím o kontrolu logu. Děkuji.

Re: Prosím o kontrolu logu. Děkuji.

Re: Prosím o kontrolu logu. Děkuji.

Re: Prosím o kontrolu logu. Děkuji.

Re: Prosím o kontrolu logu. Děkuji.

Re: Prosím o kontrolu logu. Děkuji.

Re: Prosím o kontrolu logu. Děkuji.

Re: Prosím o kontrolu logu. Děkuji.