Prosím o kontrolu - nefunkční antivirová ochrana Vyřešeno

Místo pro vaše HiJackThis logy a logy z dalších programů…

Moderátoři: Mods_senior, Security team

Morbys
nováček
Příspěvky: 21
Registrován: červenec 16
Pohlaví: Muž
Stav:
Offline

Prosím o kontrolu - nefunkční antivirová ochrana  Vyřešeno

Příspěvekod Morbys » 28 črc 2016 11:17

Zdravím,
Antivir Eset mi cca 3dny zpět začal hlásit (Antivirová ochrana není funkční), když spustím kontrolu souborů, proběhne rychle a antivir nevypisuje nic do protokolu. Předem díky za pomoc.

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 11:10:38, on 28.7.2016
Platform: Unknown Windows (WinNT 6.02.1008)
MSIE: Internet Explorer v11.0 (11.00.10586.0494)


Boot mode: Normal

Running processes:
C:\Program Files\WindowsApps\Microsoft.Messaging_2.15.20002.0_x86__8wekyb3d8bbwe\SkypeHost.exe
C:\Program Files (x86)\ASUS\EPU-4 Engine\FourEngine.exe
C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
C:\Program Files (x86)\RocketDock\RocketDock.exe
C:\Windows\SysWOW64\rundll32.exe
C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files (x86)\TP-LINK\TP-LINK Wireless Configuration Utility\TWCU.exe
C:\Windows\SysWOW64\rundll32.exe
C:\Program Files (x86)\ASUS\Turbo Key\TurboKey.exe
C:\Program Files (x86)\HP\HP Software Update\hpwuSchd2.exe
C:\Program Files (x86)\Genius\Manticore\MTHid.exe
C:\Program Files (x86)\Genius\Gila\mousehid.exe
C:\Program Files (x86)\Genius\Gila\trayicon.exe
C:\Program Files (x86)\Steam\Steam.exe
C:\Program Files (x86)\Steam\bin\steamwebhelper.exe
C:\Program Files (x86)\Steam\bin\steamwebhelper.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Users\Morby\Downloads\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = Preserve
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.seznam.cz/?clid=6826
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/p/?LinkId=255141
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/p/?LinkId=255141
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F2 - REG:system.ini: UserInit=
O2 - BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre1.8.0_31\bin\ssv.dll
O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: (no name) - {D5FEC983-01DB-414A-9456-AF95AC9ED7B5} - (no file)
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre1.8.0_31\bin\jp2ssv.dll
O2 - BHO: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
O4 - HKLM\..\Run: [P17RunE] RunDll32 P17RunE.dll,RunDLLEntry
O4 - HKLM\..\Run: [Turbo Key] "C:\Program Files (x86)\ASUS\Turbo Key\TurboKey.exe"
O4 - HKLM\..\Run: [DivXMediaServer] C:\Program Files (x86)\DivX\DivX Media Server\DivXMediaServer.exe
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [hpqSRMon] C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSRMon.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
O4 - HKLM\..\Run: [Manticore] C:\Program Files (x86)\Genius\Manticore\MThid.exe
O4 - HKLM\..\Run: [Gila] C:\Program Files (x86)\Genius\Gila\mousehid.exe
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [SRS Audio Sandbox] "C:\Program Files\SRS Labs\Audio Sandbox\SRSSSC.exe" /hideme
O4 - HKCU\..\Run: [RocketDock] "C:\Program Files (x86)\RocketDock\RocketDock.exe"
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe" -autorun
O4 - HKCU\..\Run: [Steam] "C:\Program Files (x86)\Steam\steam.exe" -silent
O4 - HKCU\..\Run: [NextLive] C:\Windows\SysWOW64\rundll32.exe "C:\Users\Morby\AppData\Roaming\newnext.me\nengine.dll",EntryPoint -m l
O4 - HKCU\..\Run: [Xvid] C:\Program Files (x86)\Xvid\CheckUpdate.exe
O4 - HKCU\..\Run: [OneDrive] "C:\Users\Morby\AppData\Local\Microsoft\OneDrive\OneDrive.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [OneDriveSetup] C:\Windows\SysWOW64\OneDriveSetup.exe /thfirstsetup (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [OneDriveSetup] C:\Windows\SysWOW64\OneDriveSetup.exe /thfirstsetup (User 'NETWORK SERVICE')
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: RocketDock.lnk = C:\Program Files\RocketDock\RocketDock.exe
O4 - Global Startup: TP-LINK Wireless Configuration Utility.lnk = C:\Program Files (x86)\TP-LINK\TP-LINK Wireless Configuration Utility\TWCU.exe
O9 - Extra button: Odeslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Od&eslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra button: Skype Click to Call settings - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~1\Office12\REFIEBAR.DLL
O9 - Extra button: Zobrazit nebo skrýt HP Smart Web Printing - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O15 - Trusted Zone: http://help.eset.com (HKLM)
O15 - ESC Trusted Zone: http://help.eset.com (HKLM)
O16 - DPF: {D4B68B83-8710-488B-A692-D74B50BA558E} (Creative Software AutoUpdate Support Package 2) - http://ccfiles.creative.com/Web/softwar ... PIDPDE.cab
O16 - DPF: {E705A591-DA3C-4228-B0D5-A356DBA42FBF} (Creative Software AutoUpdate 2) - http://ccfiles.creative.com/Web/softwar ... TSUEng.cab
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://ccfiles.creative.com/Web/softwar ... /CTPID.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveSystemServices.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Protocol: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O18 - Protocol: tbauth - {14654CA6-5711-491D-B89A-58E571679951} - C:\Windows\SysWOW64\tbauth.dll
O18 - Protocol: windows.tbauth - {14654CA6-5711-491D-B89A-58E571679951} - C:\Windows\SysWOW64\tbauth.dll
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: Adobe Genuine Software Integrity Service (AGSService) - Adobe Systems, Incorporated - C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGSService.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\WINDOWS\System32\alg.exe (file missing)
O23 - Service: ASUS System Control Service (AsSysCtrlService) - Unknown owner - C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.02\AsSysCtrlService.exe
O23 - Service: Creative ALchemy AL6 Licensing Service - Creative Labs - C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\AL6Licensing.exe
O23 - Service: Creative Audio Engine Licensing Service - Creative Labs - C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe
O23 - Service: Creative Audio Service (CTAudSvcService) - Creative Technology Ltd - C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe
O23 - Service: @%SystemRoot%\system32\DiagSvcs\DiagnosticsHub.StandardCollector.ServiceRes.dll,-1000 (diagnosticshub.standardcollector.service) - Unknown owner - C:\WINDOWS\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe (file missing)
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\WINDOWS\System32\lsass.exe (file missing)
O23 - Service: ESET Service (ekrn) - ESET - C:\Program Files\ESET\ESET Smart Security\ekrn.exe
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\WINDOWS\system32\fxssvc.exe (file missing)
O23 - Service: NVIDIA GeForce Experience Service (GfExperienceService) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe
O23 - Service: Služba Google Update (gupdate) (gupdate) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Služba Google Update (gupdatem) (gupdatem) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: @%SystemRoot%\system32\ieetwcollectorres.dll,-1000 (IEEtwCollectorService) - Unknown owner - C:\WINDOWS\system32\IEEtwCollector.exe (file missing)
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\WINDOWS\system32\lsass.exe (file missing)
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\WINDOWS\System32\msdtc.exe (file missing)
O23 - Service: @mqutil.dll,-6102 (MSMQ) - Unknown owner - C:\WINDOWS\system32\mqsvc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\WINDOWS\system32\lsass.exe (file missing)
O23 - Service: NVIDIA Network Service (NvNetworkService) - NVIDIA Corporation - C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
O23 - Service: NVIDIA Streamer Network Service (NvStreamNetworkSvc) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe
O23 - Service: NVIDIA Streamer Service (NvStreamSvc) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamService.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - Unknown owner - C:\Windows\system32\nvvsvc.exe (file missing)
O23 - Service: Overwolf Updater Windows SCM (OverwolfUpdater) - Overwolf LTD - C:\Program Files (x86)\Overwolf\OverwolfUpdater.exe
O23 - Service: Internet Pass-Through Service (PassThru Service) - Unknown owner - C:\Program Files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe
O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\WINDOWS\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\WINDOWS\system32\lsass.exe (file missing)
O23 - Service: SiSoftware Deployment Agent Service (SandraAgentSrv) - SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2014.SP2a\RpcAgentSrv.exe
O23 - Service: @%SystemRoot%\system32\SensorDataService.exe,-101 (SensorDataService) - Unknown owner - C:\WINDOWS\System32\SensorDataService.exe (file missing)
O23 - Service: Skype Updater (SkypeUpdate) - Skype Technologies - C:\Program Files (x86)\Skype\Updater\Updater.exe
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\WINDOWS\System32\snmptrap.exe (file missing)
O23 - Service: Sony PC Companion - Avanquest Software - C:\Program Files (x86)\Sony\Sony PC Companion\PCCService.exe
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\WINDOWS\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\WINDOWS\system32\sppsvc.exe (file missing)
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files (x86)\Common Files\Steam\SteamService.exe
O23 - Service: NVIDIA Stereoscopic 3D Driver Service (Stereo Service) - NVIDIA Corporation - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvscpapisvr.exe
O23 - Service: @%SystemRoot%\system32\TieringEngineService.exe,-702 (TieringEngineService) - Unknown owner - C:\WINDOWS\system32\TieringEngineService.exe (file missing)
O23 - Service: TunngleService - Tunngle.net GmbH - C:\Program Files (x86)\Tunngle\TnglCtrl.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\WINDOWS\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\WINDOWS\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\WINDOWS\System32\vds.exe (file missing)
O23 - Service: @oem132.inf,%ViaKaraokeSrv.SvcDesc%;VIA Karaoke digital mixer Service (VIAKaraokeService) - Unknown owner - C:\WINDOWS\system32\viakaraokesrv.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\WINDOWS\system32\vssvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\WINDOWS\system32\wbengine.exe (file missing)
O23 - Service: @%ProgramFiles%\Windows Defender\MpAsDesc.dll,-320 (WdNisSvc) - Unknown owner - C:\Program Files (x86)\Windows Defender\NisSrv.exe (file missing)
O23 - Service: @%ProgramFiles%\Windows Defender\MpAsDesc.dll,-310 (WinDefend) - Unknown owner - C:\Program Files (x86)\Windows Defender\MsMpEng.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\WINDOWS\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--
End of file - 14956 bytes

Reklama
Uživatelský avatar
Orcus
člen Security týmu
Elite Level 10.5
Elite Level 10.5
Příspěvky: 10645
Registrován: duben 10
Bydliště: Okolo rostou 3 růže =o)
Pohlaví: Muž
Stav:
Offline

Re: Prosím o kontrolu - nefunkční antivirová ochrana

Příspěvekod Orcus » 28 črc 2016 14:48

Stáhni si ATF Cleaner
Poklepej na ATF Cleaner.exe, klikni na select all found, poté:
-Když používáš Firefox (Mozzila), klikni na Firefox nahoře a vyber: Select All, poté klikni na Empty Selected.
-Když používáš Operu, klikni nahoře na Operu a vyber: Select All, poté klikni na Empty Selected. Poté klikni na Main (hlavní stránku ) a klikni na Empty Selected.
Po vyčištění klikni na Exit k zavření programu.
ATF-Cleaner je jednoduchý nástroj na odstranění historie z webového prohlížeče. Program dokáže odstranit cache, cookies, historii a další stopy po surfování na Internetu. Mezi podporované prohlížeče patří Internet Explorer, Firefox a Opera. Aplikace navíc umí odstranit dočasné soubory Windows, vysypat koš atd.

- Pokud používáš jen Google Chrome , tak ATF nemusíš použít.

===================================================

Stáhni si TFC
Otevři soubor a zavři všechny ostatní okna, Klikni na Start k zahájení procesu. Program by neměl trvat dlouho.
Poté by se měl PC restartovat, pokud ne , proveď sám.

===================================================

Stáhni AdwCleaner (by Xplode)

Ulož si ho na svojí plochu
Ukonči všechny programy , okna a prohlížeče
Spusť program poklepáním a klikni na „Prohledat-Scan“
Po skenu klikni na tlačítko "Logfile" načež se objeví log ( jinak je uložen systémovem disku jako AdwCleaner[R?].txt), jeho obsah sem celý vlož.

===================================================

Stáhni si Malwarebytes' Anti-Malware
- Při instalaci odeber zatržítko u „Povolit bezplatnou zkušební verzi Malwarebytes' Anti-Malware Premium“
- Nainstaluj a spusť ho
- na konci instalace se ujisti že máš zvoleny/zatrhnuty obě možnosti:

Aktualizace Malwarebytes' Anti-Malware
Spustit aplikaci Malwarebytes' Anti-Malware, pokud jo tak klikni na tlačítko konec

- pokud bude nalezena aktualizace, tak se stáhne a nainstaluje
- program se po té spustí a klikni na Skenovat nyní a
- po proběhnutí programu se ti objeví hláška vpravo dole tak klikni na Kopírovat do schránky a a vlož sem celý log.

- po té klikni na tlačítko Exit, objeví se ti hláška tak zvol Ano
(zatím nic nemaž!).

Pokud budou problémy , spusť v nouz. režimu.
Láska hřeje, ale uhlí je uhlí. :fire:



Log z HJT vkládejte do HJT sekce. Je-li moc dlouhý, rozděl jej do více zpráv.

Pár rad k bezpečnosti PC.

Po dobu mé nepřítomnosti mě zastupuje memphisto, jaro3 a Diallix

Pokud budete spokojeni , můžete podpořit naše fórum.

Morbys
nováček
Příspěvky: 21
Registrován: červenec 16
Pohlaví: Muž
Stav:
Offline

Re: Prosím o kontrolu - nefunkční antivirová ochrana

Příspěvekod Morbys » 28 črc 2016 17:33

# AdwCleaner v5.201 - Log vytvořen 28/07/2016 v 17:29:22
# Aktualizováno 30/06/2016 by ToolsLib
# Databáze : 2016-07-28.1 [Server]
# Operační system : Windows 10 Pro (X64)
# Uživatelské jméno : Morby - MORBY-PC
# Spuštěno z : C:\Users\Morby\Desktop\AdwCleaner.exe
# Nastavení : Sken
# Podpora : https://toolslib.net/forum

***** [ Služby ] *****


***** [ Složky ] *****

Složka Nalezeno : C:\ProgramData\apn
Složka Nalezeno : C:\ProgramData\ApplicationHosting
Složka Nalezeno : C:\ProgramData\Medlights
Složka Nalezeno : C:\ProgramData\Application Data\apn
Složka Nalezeno : C:\ProgramData\Application Data\ApplicationHosting
Složka Nalezeno : C:\ProgramData\Application Data\Medlights
Složka Nalezeno : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Genius
Složka Nalezeno : C:\Program Files (x86)\Genius
Složka Nalezeno : C:\Program Files (x86)\MyPC Backup
Složka Nalezeno : C:\Users\Morby\AppData\Local\Bundled software uninstaller
Složka Nalezeno : C:\Users\Morby\AppData\Local\genienext
Složka Nalezeno : C:\Users\Morby\AppData\Local\Mobogenie
Složka Nalezeno : C:\Users\Morby\AppData\Roaming\GrabPro
Složka Nalezeno : C:\Users\Morby\AppData\Roaming\newnext.me
Složka Nalezeno : C:\Users\Morby\AppData\Roaming\OpenCandy
Složka Nalezeno : C:\Users\Morby\AppData\Roaming\Systweak
Složka Nalezeno : C:\Users\Morby\AppData\Roaming\Mozilla\Firefox\Profiles\nahd6ha2.default\extensions\staged\vb@yandex.ru
Složka Nalezeno : C:\Users\Morby\AppData\Roaming\Mozilla\Firefox\Profiles\nahd6ha2.default\extensions\staged\yasearch@yandex.ru

***** [ Soubory ] *****

Soubor Nalezeno : C:\END
Soubor Nalezeno : C:\Users\Morby\daemonprocess.txt
Soubor Nalezeno : C:\Users\Morby\AppData\Roaming\Mozilla\Firefox\Profiles\nahd6ha2.default\extensions\staged\vb@yandex.ru.json
Soubor Nalezeno : C:\Users\Morby\AppData\Roaming\Mozilla\Firefox\Profiles\nahd6ha2.default\extensions\staged\yasearch@yandex.ru.json
Soubor Nalezeno : C:\Users\Morby\AppData\Roaming\Mozilla\Firefox\Profiles\nahd6ha2.default\searchplugins\findit.xml
Soubor Nalezeno : C:\WINDOWS\SysNative\roboot64.exe

***** [ DLL ] *****


***** [ WMI ] *****


***** [ Zástupci ] *****

Zástupce Infikováno : C:\Users\Morby\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\WarThunder.lnk ( --app=hxxp://mmotraffic.com/catalog/goplay/1000932/MTE3NjYvLy8xMDAwOTMy?click_id=6c67f6544b5dc1c3a31ec04f66b195c3d4d93104 --start-fullscreen )

***** [ Naplánované úlohy ] *****

Úloha Nalezeno : 54b401e8-a303-4041-98f8-5a2e48f84f3b-1
Úloha Nalezeno : 54b401e8-a303-4041-98f8-5a2e48f84f3b-2
Úloha Nalezeno : 54b401e8-a303-4041-98f8-5a2e48f84f3b-4
Úloha Nalezeno : 54b401e8-a303-4041-98f8-5a2e48f84f3b-5
Úloha Nalezeno : 54b401e8-a303-4041-98f8-5a2e48f84f3b-1
Úloha Nalezeno : 54b401e8-a303-4041-98f8-5a2e48f84f3b-2
Úloha Nalezeno : 54b401e8-a303-4041-98f8-5a2e48f84f3b-4
Úloha Nalezeno : 54b401e8-a303-4041-98f8-5a2e48f84f3b-5
Úloha Nalezeno : temp_54b401e8-a303-4041-98f8-5a2e48f84f3b-2

***** [ Registry ] *****

Klíč Nalezeno : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\MobogenieAdd
Klíč Nalezeno : HKLM\SOFTWARE\Classes\s
Hodnota Nalezeno : HKCU\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION [WeatherBug.exe]
Klíč Nalezeno : HKLM\SOFTWARE\Classes\CLSID\{02478D38-C3F9-4EFB-9B51-7695ECA05670}
Klíč Nalezeno : HKLM\SOFTWARE\Classes\CLSID\{3CCC052E-BDEE-408A-BEA7-90914EF2964B}
Klíč Nalezeno : HKLM\SOFTWARE\Classes\CLSID\{61F47056-E400-43D3-AF1E-AB7DFFD4C4AD}
Klíč Nalezeno : HKLM\SOFTWARE\Classes\CLSID\{E2B98EEA-EE55-4E9B-A8C1-6E5288DF785A}
Klíč Nalezeno : HKCU\Software\BI
Klíč Nalezeno : HKCU\Software\Conduit
Klíč Nalezeno : HKCU\Software\InstallCore
Klíč Nalezeno : HKCU\Software\InstalledBrowserExtensions
Klíč Nalezeno : HKCU\Software\PRODUCTSETUP
Klíč Nalezeno : HKCU\Software\Reg\Clean
Klíč Nalezeno : HKCU\Software\Softonic
Klíč Nalezeno : HKCU\Software\Yahoo\Companion
Klíč Nalezeno : HKCU\Software\Yahoo\YFriendsBar
Klíč Nalezeno : HKCU\Software\AppDataLow\Software\Crossrider
Klíč Nalezeno : HKLM\SOFTWARE\InstalledBrowserExtensions
Klíč Nalezeno : HKLM\SOFTWARE\Reg\Clean
Klíč Nalezeno : HKLM\SOFTWARE\Yahoo\Companion
Klíč Nalezeno : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\bi_uninstaller
Klíč Nalezeno : [x64] HKLM\SOFTWARE\DivX\Install\Setup\WizardLayout\ConduitToolbar
Klíč Nalezeno : [x64] HKLM\SOFTWARE\InstalledBrowserExtensions
Klíč Nalezeno : HKU\.DEFAULT\Software\AskPartnerNetwork
Klíč Nalezeno : HKU\S-1-5-21-1514291352-1774944380-498877344-1001\Software\BI
Klíč Nalezeno : HKU\S-1-5-21-1514291352-1774944380-498877344-1001\Software\Conduit
Klíč Nalezeno : HKU\S-1-5-21-1514291352-1774944380-498877344-1001\Software\InstallCore
Klíč Nalezeno : HKU\S-1-5-21-1514291352-1774944380-498877344-1001\Software\InstalledBrowserExtensions
Klíč Nalezeno : HKU\S-1-5-21-1514291352-1774944380-498877344-1001\Software\PRODUCTSETUP
Klíč Nalezeno : HKU\S-1-5-21-1514291352-1774944380-498877344-1001\Software\Reg\Clean
Klíč Nalezeno : HKU\S-1-5-21-1514291352-1774944380-498877344-1001\Software\Softonic
Klíč Nalezeno : HKU\S-1-5-21-1514291352-1774944380-498877344-1001\Software\Yahoo\Companion
Klíč Nalezeno : HKU\S-1-5-21-1514291352-1774944380-498877344-1001\Software\Yahoo\YFriendsBar
Klíč Nalezeno : HKU\S-1-5-21-1514291352-1774944380-498877344-1001\Software\AppDataLow\Software\Crossrider
Klíč Nalezeno : HKU\S-1-5-18\Software\AskPartnerNetwork
Hodnota Nalezeno : HKCU\Software\Microsoft\Windows\CurrentVersion\Run [NextLive]
Hodnota Nalezeno : HKU\S-1-5-21-1514291352-1774944380-498877344-1001\Software\Microsoft\Windows\CurrentVersion\Run [NextLive]
Hodnota Nalezeno : HKU\S-1-5-21-1514291352-1774944380-498877344-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run [NextLive]

***** [ Prohlížeče ] *****

[C:\Users\Morby\AppData\Local\Google\Chrome\User Data\Default\Web data] [Search Provider] Nalezeno : search.conduit.com
[C:\Users\Morby\AppData\Local\Google\Chrome\User Data\Default\Web data] [Search Provider] Nalezeno : ask.com
[C:\Users\Morby\AppData\Local\Google\Chrome\User Data\Default\Web data] [Search Provider] Nalezeno : websearch
[C:\Users\Morby\AppData\Local\Google\Chrome\User Data\Default\Web data] [Search Provider] Nalezeno : feed.sonic-search.com
[C:\Users\Morby\AppData\Local\Google\Chrome\User Data\Default\Web data] [Search Provider] Nalezeno : search.sweetim.com
[C:\Users\Morby\AppData\Local\Google\Chrome\User Data\Default\Web data] [Search Provider] Nalezeno : search.yahoo.com
[C:\Users\Morby\AppData\Local\Google\Chrome\User Data\Default\Web data] [Search Provider] Nalezeno : daemon-search.com
[C:\Users\Morby\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences] [Startup_URLs] Nalezeno : hxxp://search.babylon.com/?affID=112542 ... 1d7d516458
[C:\Users\Morby\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences] [Startup_URLs] Nalezeno : hxxp://mystart.incredibar.com/mb139?a=6R8AS2Wtr0&i=26
[C:\Users\Morby\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences] [Startup_URLs] Nalezeno : hxxp://search.certified-toolbar.com?si= ... e&tid=3231
[C:\Users\Morby\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences] [Startup_URLs] Nalezeno : hxxps://startpage-home.com/?s=lenovo&m=start
[C:\Users\Morby\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences] [Startup_URLs] Nalezeno : hxxp://websearch.pu-results.info/?pid=7 ... g=EN&cc=CZ
[C:\Users\Morby\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences] [Startup_URLs] Nalezeno : hxxp://mysearch.avg.com/?cid={C882F017-402A-4E3C-945A-F21856DEED21}&mid=65dfafdcc3a647d3b12bd16f5e479d3c-c882777ed4f546155b5b63e9bf8b679ad5df6b93&lang=cs&ds=bl011&pr=sa&d=2013-06-05 06:57:25&v=15.2.0.5&pid=safeguard&sg=3&sap=hp
[C:\Users\Morby\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences] [Extension] Nalezeno : aaaaaiabcopkplhgaedhbloeejhhankf
[C:\Users\Morby\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences] [Extension] Nalezeno : fcgnigmofekcllgbiejhmigggmgehkip

*************************

C:\AdwCleaner\AdwCleaner[S1].txt - [8352 bytů] - [28/07/2016 17:29:22]

########## EOF - C:\AdwCleaner\AdwCleaner[S1].txt - [8425 bytů] ##########

Morbys
nováček
Příspěvky: 21
Registrován: červenec 16
Pohlaví: Muž
Stav:
Offline

Re: Prosím o kontrolu - nefunkční antivirová ochrana

Příspěvekod Morbys » 28 črc 2016 17:58

Malwarebytes Anti-Malware
www.malwarebytes.org

Datum skenování: 28.7.2016
Čas skenování: 17:41
Protokol:
Správce: Ano

Verze: 2.2.1.1043
Databáze malwaru: v2016.07.28.03
Databáze rootkitů: v2016.05.27.01
Licence: Bezplatná verze
Ochrana proti malwaru: Vypnuto
Ochrana proti škodlivým webovým stránkám: Vypnuto
Ochrana programu: Vypnuto

OS: Windows 10
CPU: x64
Souborový systém: NTFS
Uživatel: Morby

Typ skenu: Sken hrozeb
Výsledek: Dokončeno
Prohledaných objektů: 361895
Uplynulý čas: 14 min, 12 sek

Paměť: Zapnuto
Po spuštění: Zapnuto
Souborový systém: Zapnuto
Archivy: Zapnuto
Rootkity: Vypnuto
Heuristika: Zapnuto
PUP: Zapnuto
PUM: Zapnuto

Procesy: 0
(Nenalezeny žádné škodlivé položky)

Moduly: 1
PUP.Optional.NextLive, C:\Users\Morby\AppData\Roaming\newnext.me\nengine.dll, , [e97a6abf0991e452bd0472baf1100ff1],

Klíče registru: 26
PUP.Optional.Conduit, HKLM\SOFTWARE\DIVX\INSTALL\SETUP\WIZARDLAYOUT\ConduitToolbar, , [dc8765c4c0da4fe7836502ca2ad89c64],
PUP.Optional.CrossRider, HKLM\SOFTWARE\INSTALLEDBROWSEREXTENSIONS\25286, , [7be8c9600c8e2e080c4fb7e83ac9bd43],
PUP.Optional.CrossRider, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\ELEVATIONPOLICY\{62555236-053B-4D38-AE92-5ED4E6E0E2D4}, , [0a591811217916205efee1be946fb64a],
PUP.Optional.CrossRider, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\ELEVATIONPOLICY\{BE620A9F-FD8C-40FB-A1C8-12ACF7F34E4D}, , [372cbf6a4258ae88f469a1fe34cfd62a],
PUP.Optional.CrossRider, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\ELEVATIONPOLICY\{E3F2125D-BC8B-42B1-A697-AA0FC2A23AB7}, , [a9ba14154e4c87af49159c03c142f20e],
PUP.Optional.CrossRider, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{31E98AF9-F214-422E-AC0B-1EB2E8E22BB1}, , [d98a74b56a30a690cd3c559f3ec5c53b],
PUP.Optional.CrossRider, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{4130732B-09C4-4BFF-ADD3-B7973DD2C97E}, , [d0930f1a28723bfb39d05e9611f2946c],
PUP.Optional.CrossRider, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{6125F07C-5F37-4D35-80FA-7DC2A1F1275A}, , [154e9f8a57438da97c8d1ed600036997],
PUP.Optional.CrossRider.Generic, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{83A79AE8-3430-40D0-BC5C-00487C3AB0BA}, , [441fd5541684d26494fc11e602017f81],
PUP.Optional.CrossRider, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{8FD2C65B-01E0-4D0F-9D4E-A4493EB70252}, , [5f04c960b4e671c5e42590647b88c13f],
PUP.Optional.CrossRider, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TREE\54b401e8-a303-4041-98f8-5a2e48f84f3b-1, , [065d81a8e8b287af8cd3ecb3ac574ab6],
PUP.Optional.CrossRider, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TREE\54b401e8-a303-4041-98f8-5a2e48f84f3b-2, , [8ad942e7f6a4ae88510e2b740ff416ea],
PUP.Optional.CrossRider, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TREE\54b401e8-a303-4041-98f8-5a2e48f84f3b-4, , [f271eb3ee3b78aac5609a4fb7e85738d],
PUP.Optional.CrossRider, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TREE\54b401e8-a303-4041-98f8-5a2e48f84f3b-5, , [3d2643e6a0fa84b2055ae1be44bf718f],
PUP.Optional.CrossRider.Generic, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TREE\temp_54b401e8-a303-4041-98f8-5a2e48f84f3b-2, , [7ce7a485f7a361d561317483b350ac54],
PUP.Optional.AppsHat, HKLM\SOFTWARE\WOW6432NODE\Apps Hat, , [9cc79a8f4852270ff7b713847291eb15],
PUP.Optional.CrossRider, HKLM\SOFTWARE\WOW6432NODE\INSTALLEDBROWSEREXTENSIONS\25286, , [1f4401283d5de84eea71346b5ea57789],
PUP.Optional.CrossRider, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\ELEVATIONPOLICY\{62555236-053B-4D38-AE92-5ED4E6E0E2D4}, , [9ec553d66d2d3afc3923356a9e651ae6],
PUP.Optional.CrossRider, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\ELEVATIONPOLICY\{BE620A9F-FD8C-40FB-A1C8-12ACF7F34E4D}, , [baa9a485c4d675c1015ce8b744bf6799],
PUP.Optional.CrossRider, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\ELEVATIONPOLICY\{E3F2125D-BC8B-42B1-A697-AA0FC2A23AB7}, , [0b58f6334f4b48ee2c3258473fc4cb35],
PUP.Optional.RegCleanPro, HKLM\SOFTWARE\WOW6432NODE\REG\CLEAN\pro, , [e47f1d0c8614e84e613821ca52b18b75],
PUP.Optional.APNToolBar.Gen, HKU\S-1-5-18\SOFTWARE\AskPartnerNetwork, , [3f24ee3bdbbf4cea5d467a5f42c02dd3],
PUP.Optional.InstallCore, HKU\S-1-5-21-1514291352-1774944380-498877344-1001\SOFTWARE\InstallCore, , [afb4f039c4d66ec85c0701a67b886c94],
PUP.Optional.CrossRider, HKU\S-1-5-21-1514291352-1774944380-498877344-1001\SOFTWARE\APPDATALOW\SOFTWARE\Crossrider, , [550ec6639ffb340222b03f5f13f04db3],
PUP.Optional.CrossRider, HKU\S-1-5-21-1514291352-1774944380-498877344-1001\SOFTWARE\INSTALLEDBROWSEREXTENSIONS\Nero, , [baa9f63306943afcb861e4bbf50e1be5],
PUP.Optional.RegCleanPro, HKU\S-1-5-21-1514291352-1774944380-498877344-1001\SOFTWARE\REG\CLEAN\pro, , [92d11c0d049667cf9008816a030029d7],

Hodnoty registru: 13
PUP.Optional.NextLive, HKU\S-1-5-21-1514291352-1774944380-498877344-1001\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN|NextLive, C:\Windows\SysWOW64\rundll32.exe "C:\Users\Morby\AppData\Roaming\newnext.me\nengine.dll",EntryPoint -m l, , [e97a6abf0991e452bd0472baf1100ff1]
PUP.Optional.CrossRider, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\ELEVATIONPOLICY\{62555236-053b-4d38-ae92-5ed4e6e0e2d4}|AppName, Apps Hat-bg.exe, , [0a591811217916205efee1be946fb64a]
PUP.Optional.CrossRider, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\ELEVATIONPOLICY\{be620a9f-fd8c-40fb-a1c8-12acf7f34e4d}|AppName, Apps Hat-buttonutil.exe, , [372cbf6a4258ae88f469a1fe34cfd62a]
PUP.Optional.CrossRider, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\ELEVATIONPOLICY\{e3f2125d-bc8b-42b1-a697-aa0fc2a23ab7}|AppName, Apps Hat-codedownloader.exe, , [a9ba14154e4c87af49159c03c142f20e]
PUP.Optional.CrossRider, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{31E98AF9-F214-422E-AC0B-1EB2E8E22BB1}|Path, \54b401e8-a303-4041-98f8-5a2e48f84f3b-5, , [d98a74b56a30a690cd3c559f3ec5c53b]
PUP.Optional.CrossRider, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{4130732B-09C4-4BFF-ADD3-B7973DD2C97E}|Path, \54b401e8-a303-4041-98f8-5a2e48f84f3b-4, , [d0930f1a28723bfb39d05e9611f2946c]
PUP.Optional.CrossRider, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{6125F07C-5F37-4D35-80FA-7DC2A1F1275A}|Path, \54b401e8-a303-4041-98f8-5a2e48f84f3b-1, , [154e9f8a57438da97c8d1ed600036997]
PUP.Optional.CrossRider.Generic, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{83A79AE8-3430-40D0-BC5C-00487C3AB0BA}|Path, \temp_54b401e8-a303-4041-98f8-5a2e48f84f3b-2, , [441fd5541684d26494fc11e602017f81]
PUP.Optional.CrossRider, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{8FD2C65B-01E0-4D0F-9D4E-A4493EB70252}|Path, \54b401e8-a303-4041-98f8-5a2e48f84f3b-2, , [5f04c960b4e671c5e42590647b88c13f]
PUP.Optional.CrossRider, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\ELEVATIONPOLICY\{62555236-053b-4d38-ae92-5ed4e6e0e2d4}|AppName, Apps Hat-bg.exe, , [9ec553d66d2d3afc3923356a9e651ae6]
PUP.Optional.CrossRider, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\ELEVATIONPOLICY\{be620a9f-fd8c-40fb-a1c8-12acf7f34e4d}|AppName, Apps Hat-buttonutil.exe, , [baa9a485c4d675c1015ce8b744bf6799]
PUP.Optional.CrossRider, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\ELEVATIONPOLICY\{e3f2125d-bc8b-42b1-a697-aa0fc2a23ab7}|AppName, Apps Hat-codedownloader.exe, , [0b58f6334f4b48ee2c3258473fc4cb35]
PUP.Optional.CrossRider.Generic, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\MAIN\FEATURECONTROL\FEATURE_BROWSER_EMULATION|Apps Hat-bg.exe, 8000, , [6ef557d2c5d5dd59474627d033d07c84]

Data registru: 0
(Nenalezeny žádné škodlivé položky)

Složky: 11
PUP.Optional.OpenCandy, C:\Users\Morby\AppData\Roaming\OpenCandy, , [b8ab46e34f4b82b4c593a5ff28da9070],
PUP.Optional.OpenCandy, C:\Users\Morby\AppData\Roaming\OpenCandy\AFCC6FB8B6684753B329C1BB0BF0CCEF, , [b8ab46e34f4b82b4c593a5ff28da9070],
PUP.Optional.APNToolBar.Gen, C:\ProgramData\APN\APN-Stub, , [f96af534bfdb1125504cc4e70101d32d],
PUP.Optional.MyPCBackup, C:\Program Files (x86)\MyPC Backup, , [342f74b5cfcbb77f79054574a062619f],
PUP.Optional.NextLive, C:\Users\Morby\AppData\Roaming\newnext.me, , [71f2ef3a8e0cee482d90e7d2f60c32ce],
PUP.Optional.NextLive, C:\Users\Morby\AppData\Roaming\newnext.me\cache, , [71f2ef3a8e0cee482d90e7d2f60c32ce],
PUP.Optional.CrossRider, C:\Users\Morby\AppData\Local\Google\Chrome\User Data\Default\Extensions\gegdfeiahlfolhcfioipjlkombmgbakh, , [de85bc6d3d5dc571b32a794afe042dd3],
PUP.Optional.CrossRider, C:\Users\Morby\AppData\Local\Google\Chrome\User Data\Default\Extensions\gegdfeiahlfolhcfioipjlkombmgbakh\0.1_0, , [de85bc6d3d5dc571b32a794afe042dd3],
PUP.Optional.CrossRider, C:\Users\Morby\AppData\Local\Google\Chrome\User Data\Default\Extensions\gegdfeiahlfolhcfioipjlkombmgbakh\0.1_0\_metadata, , [de85bc6d3d5dc571b32a794afe042dd3],
PUP.Optional.Linkury.ACMB1, C:\ProgramData\ApplicationHosting, , [392a39f07c1e78be68ee7a4de51d956b],
PUP.Optional.Linkury.ACMB1, C:\ProgramData\Medlights, , [99ca1514a9f1cd69d16cb0ed71939868],

Soubory: 35
PUP.Optional.NextLive, C:\Users\Morby\AppData\Roaming\newnext.me\nengine.dll, , [e97a6abf0991e452bd0472baf1100ff1],
PUP.Optional.InstallCore, C:\Users\Morby\Downloads\installer.exe, , [67fc56d3fd9d4de913e0df64f9076b95],
PUP.Optional.APNToolBar, C:\Users\Morby\Downloads\aTubeCatcher.exe, , [4b18bb6ec0da80b6755bd455ce33f808],
PUP.Optional.InstallBrain, C:\Users\Morby\Downloads\CodecPerformerSetup.exe, , [dd864bde47536fc7dac0c863af528878],
PUP.Optional.NextLive, C:\Users\Morby\AppData\Local\genienext\nengine.dll, , [d98afe2b4456ac8ab60b2efe55ac7090],
PUP.Optional.Somoto, C:\Users\Morby\AppData\Local\Bundled software uninstaller\bi_client (1).exe, , [c69d2ffae3b795a1ca0165c82ad732ce],
PUP.Optional.Somoto, C:\Users\Morby\AppData\Local\Bundled software uninstaller\bi_client.exe, , [b4af44e5eeac50e6903bbe6f5ba60bf5],
PUP.Optional.YesSearches, C:\Users\Morby\AppData\Roaming\Mozilla\Firefox\Profiles\nahd6ha2.default\searchplugins\findit.xml, , [a2c1d6533763c571065dffd05fa314ec],
PUP.Optional.CrossRider, C:\Windows\System32\Tasks\54b401e8-a303-4041-98f8-5a2e48f84f3b-1, , [c1a27dac9dfd3105ed280c8a788bbd43],
PUP.Optional.CrossRider, C:\Windows\System32\Tasks\54b401e8-a303-4041-98f8-5a2e48f84f3b-2, , [0261f336c9d1a294a273ade93dc6d42c],
PUP.Optional.CrossRider, C:\Windows\System32\Tasks\54b401e8-a303-4041-98f8-5a2e48f84f3b-4, , [1f44f8315a4081b5799ce9ad748fe719],
PUP.Optional.CrossRider, C:\Windows\System32\Tasks\54b401e8-a303-4041-98f8-5a2e48f84f3b-5, , [e380e9401a8010261bfa544204ff28d8],
PUP.Optional.CrossRider, C:\Windows\Tasks\54b401e8-a303-4041-98f8-5a2e48f84f3b-1.job, , [fd66c960b1e963d37d99bfd7976c08f8],
PUP.Optional.CrossRider, C:\Windows\Tasks\54b401e8-a303-4041-98f8-5a2e48f84f3b-2.job, , [6df63cedf4a62115ee280b8b34cff10f],
PUP.Optional.CrossRider, C:\Windows\Tasks\54b401e8-a303-4041-98f8-5a2e48f84f3b-4.job, , [2c3735f41783e0567a9cd2c4857edf21],
PUP.Optional.CrossRider, C:\Windows\Tasks\54b401e8-a303-4041-98f8-5a2e48f84f3b-5.job, , [580b63c6debc64d2ab6bf79fc63db64a],
PUP.Optional.CrossRider.Generic, C:\Windows\System32\Tasks\temp_54b401e8-a303-4041-98f8-5a2e48f84f3b-2, , [a8bb171266347eb80684c82f2dd63fc1],
PUP.Optional.OpenCandy, C:\Users\Morby\AppData\Roaming\OpenCandy\AFCC6FB8B6684753B329C1BB0BF0CCEF\avg_tuht_stf_cs_2014_206_CZ.exe, , [b8ab46e34f4b82b4c593a5ff28da9070],
PUP.Optional.MyPCBackup, C:\Program Files (x86)\MyPC Backup\DEL_UnRegisterExtensions.exe, , [342f74b5cfcbb77f79054574a062619f],
PUP.Optional.NextLive, C:\Users\Morby\AppData\Roaming\newnext.me\nengine.cookie, , [71f2ef3a8e0cee482d90e7d2f60c32ce],
PUP.Optional.NextLive, C:\Users\Morby\AppData\Roaming\newnext.me\cache\spark.bin, , [71f2ef3a8e0cee482d90e7d2f60c32ce],
PUP.Optional.CrossRider, C:\Users\Morby\AppData\Local\Google\Chrome\User Data\Default\Extensions\gegdfeiahlfolhcfioipjlkombmgbakh\0.1_0\extension.js, , [de85bc6d3d5dc571b32a794afe042dd3],
PUP.Optional.CrossRider, C:\Users\Morby\AppData\Local\Google\Chrome\User Data\Default\Extensions\gegdfeiahlfolhcfioipjlkombmgbakh\0.1_0\icon-128.png, , [de85bc6d3d5dc571b32a794afe042dd3],
PUP.Optional.CrossRider, C:\Users\Morby\AppData\Local\Google\Chrome\User Data\Default\Extensions\gegdfeiahlfolhcfioipjlkombmgbakh\0.1_0\icon-16.png, , [de85bc6d3d5dc571b32a794afe042dd3],
PUP.Optional.CrossRider, C:\Users\Morby\AppData\Local\Google\Chrome\User Data\Default\Extensions\gegdfeiahlfolhcfioipjlkombmgbakh\0.1_0\icon-48.png, , [de85bc6d3d5dc571b32a794afe042dd3],
PUP.Optional.CrossRider, C:\Users\Morby\AppData\Local\Google\Chrome\User Data\Default\Extensions\gegdfeiahlfolhcfioipjlkombmgbakh\0.1_0\jquery-1.11.0.min.js, , [de85bc6d3d5dc571b32a794afe042dd3],
PUP.Optional.CrossRider, C:\Users\Morby\AppData\Local\Google\Chrome\User Data\Default\Extensions\gegdfeiahlfolhcfioipjlkombmgbakh\0.1_0\manifest.json, , [de85bc6d3d5dc571b32a794afe042dd3],
PUP.Optional.CrossRider, C:\Users\Morby\AppData\Local\Google\Chrome\User Data\Default\Extensions\gegdfeiahlfolhcfioipjlkombmgbakh\0.1_0\style.css, , [de85bc6d3d5dc571b32a794afe042dd3],
PUP.Optional.CrossRider, C:\Users\Morby\AppData\Local\Google\Chrome\User Data\Default\Extensions\gegdfeiahlfolhcfioipjlkombmgbakh\0.1_0\_metadata\computed_hashes.json, , [de85bc6d3d5dc571b32a794afe042dd3],
PUP.Optional.CrossRider, C:\Users\Morby\AppData\Local\Google\Chrome\User Data\Default\Extensions\gegdfeiahlfolhcfioipjlkombmgbakh\0.1_0\_metadata\verified_contents.json, , [de85bc6d3d5dc571b32a794afe042dd3],
PUP.Optional.Linkury.ACMB1, C:\ProgramData\ApplicationHosting\ApplicationHosting.dat, , [392a39f07c1e78be68ee7a4de51d956b],
PUP.Optional.Linkury.ACMB1, C:\ProgramData\ApplicationHosting\Config.xml, , [392a39f07c1e78be68ee7a4de51d956b],
PUP.Optional.Linkury.ACMB1, C:\ProgramData\Medlights\ff.HP, , [99ca1514a9f1cd69d16cb0ed71939868],
PUP.Optional.Linkury.ACMB1, C:\ProgramData\Medlights\ff.NT, , [99ca1514a9f1cd69d16cb0ed71939868],
PUP.Optional.Linkury.ACMB1, C:\ProgramData\Medlights\snp.sc, , [99ca1514a9f1cd69d16cb0ed71939868],

Fyzické sektory: 0
(Nenalezeny žádné škodlivé položky)


(end)

Uživatelský avatar
Orcus
člen Security týmu
Elite Level 10.5
Elite Level 10.5
Příspěvky: 10645
Registrován: duben 10
Bydliště: Okolo rostou 3 růže =o)
Pohlaví: Muž
Stav:
Offline

Re: Prosím o kontrolu - nefunkční antivirová ochrana

Příspěvekod Orcus » 28 črc 2016 20:42

- Spusť znovu MbAM a dej Skenovat nyní
- Po proběhnutí programu, se ti objeví hláška, tak klikni na „Vše do karantény(smazat vybrané)“ a na „Exportovat záznam“ a vyber „textový soubor“ , soubor nějak pojmenuj a někam ho ulož. Zkopíruj se celý obsah toho logu.

====================================================

- Spusť znovu AdwCleaner (u Windows Vista či Windows7, klikni na AdwCleaner pravým a vyber „Spustit jako správce“
- Klikni na „ Smazat“
- Program provede opravu, po automatickém restartu neukáže log (C:\AdwCleaner [C?].txt) , jeho obsah sem celý vlož.

====================================================

Stáhni si Junkware Removal Tool by Thisisu
http://www.bleepingcomputer.com/downloa ... oval-tool/
na svojí plochu.

Deaktivuj si svůj antivirový program. Pravým tl. myši klikni na JRT.exe a vyber „spustit jako správce“. Pro pokračování budeš vyzván ke stisknutí jakékoliv klávesy. Na nějakou klikni.
Začne skenování programu. Skenování může trvat dloho , podle množství nákaz. Po ukončení skenu se objeví log (JRT.txt) , který se uloží na ploše.
Zkopíruj sem prosím celý jeho obsah.

====================================================

Stáhni si RogueKiller
32bit.:
http://www.sur-la-toile.com/RogueKiller/RogueKiller.exe
64bit.:
http://www.sur-la-toile.com/RogueKiller ... lerX64.exe
na svojí plochu.
- Zavři všechny ostatní programy a prohlížeče.
- Pro OS Vista a win7 spusť program RogueKiller.exe jako správce , u XP poklepáním.
- Počkej až skončí Prescan -vyhledávání škodlivých procesů.
- Potom klikni na „Prohledat“.
- Program skenuje procesy PC. Po proskenování klikni na „Zpráva“celý obsah logu sem zkopíruj.
Pokud je program blokován , zkus ho spustit několikrát. Pokud dále program nepůjde spustit a pracovat, přejmenuj ho na winlogon.exe.
Láska hřeje, ale uhlí je uhlí. :fire:



Log z HJT vkládejte do HJT sekce. Je-li moc dlouhý, rozděl jej do více zpráv.

Pár rad k bezpečnosti PC.

Po dobu mé nepřítomnosti mě zastupuje memphisto, jaro3 a Diallix

Pokud budete spokojeni , můžete podpořit naše fórum.

Morbys
nováček
Příspěvky: 21
Registrován: červenec 16
Pohlaví: Muž
Stav:
Offline

Re: Prosím o kontrolu - nefunkční antivirová ochrana

Příspěvekod Morbys » 29 črc 2016 09:06

Malwarebytes Anti-Malware
www.malwarebytes.org

Datum skenování: 29.7.2016
Čas skenování: 8:41
Protokol: MBaM Scan.txt
Správce: Ano

Verze: 2.2.1.1043
Databáze malwaru: v2016.07.29.03
Databáze rootkitů: v2016.05.27.01
Licence: Bezplatná verze
Ochrana proti malwaru: Vypnuto
Ochrana proti škodlivým webovým stránkám: Vypnuto
Ochrana programu: Vypnuto

OS: Windows 10
CPU: x64
Souborový systém: NTFS
Uživatel: Morby

Typ skenu: Sken hrozeb
Výsledek: Dokončeno
Prohledaných objektů: 361917
Uplynulý čas: 13 min, 22 sek

Paměť: Zapnuto
Po spuštění: Zapnuto
Souborový systém: Zapnuto
Archivy: Zapnuto
Rootkity: Vypnuto
Heuristika: Zapnuto
PUP: Zapnuto
PUM: Zapnuto

Procesy: 0
(Nenalezeny žádné škodlivé položky)

Moduly: 0
(Nenalezeny žádné škodlivé položky)

Klíče registru: 0
(Nenalezeny žádné škodlivé položky)

Hodnoty registru: 0
(Nenalezeny žádné škodlivé položky)

Data registru: 0
(Nenalezeny žádné škodlivé položky)

Složky: 0
(Nenalezeny žádné škodlivé položky)

Soubory: 0
(Nenalezeny žádné škodlivé položky)

Fyzické sektory: 0
(Nenalezeny žádné škodlivé položky)


(end)

Uživatelský avatar
jaro3
člen Security týmu
Guru Level 15
Guru Level 15
Příspěvky: 43054
Registrován: červen 07
Bydliště: Jižní Čechy
Pohlaví: Muž
Stav:
Offline

Re: Prosím o kontrolu - nefunkční antivirová ochrana

Příspěvekod jaro3 » 29 črc 2016 09:11

Spusť znovu AdwCleaner (u Windows Vista či Windows7, klikni na AdwCleaner pravým a vyber „Spustit jako správce
klikni na „Prohledat-Scan“, po prohledání klikni na „ Cleaning (Vymazat)

Program provede opravu, po automatickém restartu neukáže log (C:\AdwCleaner [C?].txt) , jeho obsah sem celý vlož.

Stáhni si Junkware Removal Tool by Thisisu
http://www.bleepingcomputer.com/downloa ... oval-tool/
na svojí plochu.

Deaktivuj si svůj antivirový program. Pravým tl. myši klikni na JRT.exe a vyber „spustit jako správce“. Pro pokračování budeš vyzván ke stisknutí jakékoliv klávesy. Na nějakou klikni.
Začne skenování programu. Skenování může trvat dloho , podle množství nákaz. Po ukončení skenu se objeví log (JRT.txt) , který se uloží na ploše.
Zkopíruj sem prosím celý jeho obsah.

Stáhni si RogueKiller by Adlice Software
32bit.:
http://www.sur-la-toile.com/RogueKiller/RogueKiller.exe
64bit.:
http://www.sur-la-toile.com/RogueKiller ... lerX64.exe
na svojí plochu.
- Zavři všechny ostatní programy a prohlížeče.
- Pro OS Vista a win7,8,10 spusť program RogueKiller.exe jako správce , u XP poklepáním.
- klikni na „Start Scan“. V novém okně nic neměň a klikni dole na „Start Scan“
- Program skenuje procesy PC. Po proskenování klikni na „Open Report “ , v okně pak na „Open TXT“ a celý obsah logu sem zkopíruj.
Pokud je program blokován , zkus ho spustit několikrát. Pokud dále program nepůjde spustit a pracovat, přejmenuj ho na winlogon.exe.
Při práci s programy HJT, ComboFix,MbAM, SDFix aj. zavřete všechny ostatní aplikace a prohlížeče!
Neposílejte logy do soukromých zpráv.Po dobu mé nepřítomnosti mě zastupuje memphisto , Žbeky a Orcus.
Pokud budete spokojeni , můžete podpořit naše forum:Podpora fóra

Morbys
nováček
Příspěvky: 21
Registrován: červenec 16
Pohlaví: Muž
Stav:
Offline

Re: Prosím o kontrolu - nefunkční antivirová ochrana

Příspěvekod Morbys » 29 črc 2016 09:21

# AdwCleaner v5.201 - Log vytvořen 29/07/2016 v 09:12:32
# Aktualizováno 30/06/2016 by ToolsLib
# Databáze : 2016-07-28.2 [Server]
# Operační system : Windows 10 Pro (X64)
# Uživatelské jméno : Morby - MORBY-PC
# Spuštěno z : C:\Users\Morby\Desktop\AdwCleaner.exe
# Nastavení : Čištění
# Podpora : https://toolslib.net/forum

***** [ Služby ] *****


***** [ Složky ] *****

[-] Složka Smazáno : C:\ProgramData\apn
[#] Složka Smazáno : C:\ProgramData\Application Data\apn
[-] Složka Smazáno : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Genius
[-] Složka Smazáno : C:\Program Files (x86)\Genius
[-] Složka Smazáno : C:\Users\Morby\AppData\Local\Bundled software uninstaller
[-] Složka Smazáno : C:\Users\Morby\AppData\Local\genienext
[-] Složka Smazáno : C:\Users\Morby\AppData\Local\Mobogenie
[-] Složka Smazáno : C:\Users\Morby\AppData\Roaming\GrabPro
[-] Složka Smazáno : C:\Users\Morby\AppData\Roaming\Systweak
[-] Složka Smazáno : C:\Users\Morby\AppData\Roaming\Mozilla\Firefox\Profiles\nahd6ha2.default\extensions\staged\vb@yandex.ru
[-] Složka Smazáno : C:\Users\Morby\AppData\Roaming\Mozilla\Firefox\Profiles\nahd6ha2.default\extensions\staged\yasearch@yandex.ru

***** [ Soubory ] *****

[-] Soubor Smazáno : C:\END
[-] Soubor Smazáno : C:\Users\Morby\daemonprocess.txt
[-] Soubor Smazáno : C:\Users\Morby\AppData\Roaming\Mozilla\Firefox\Profiles\nahd6ha2.default\extensions\staged\vb@yandex.ru.json
[-] Soubor Smazáno : C:\Users\Morby\AppData\Roaming\Mozilla\Firefox\Profiles\nahd6ha2.default\extensions\staged\yasearch@yandex.ru.json
[-] Soubor Smazáno : C:\WINDOWS\SysNative\roboot64.exe

***** [ DLLs ] *****


***** [ WMI ] *****


***** [ Zástupci ] *****


***** [ Naplánované úlohy ] *****


***** [ Registry ] *****

[-] Klíč Smazáno : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\MobogenieAdd
[-] Klíč Smazáno : HKLM\SOFTWARE\Classes\s
[-] Hodnota Smazáno : HKCU\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION [WeatherBug.exe]
[-] Klíč Smazáno : HKLM\SOFTWARE\Classes\CLSID\{02478D38-C3F9-4EFB-9B51-7695ECA05670}
[-] Klíč Smazáno : HKLM\SOFTWARE\Classes\CLSID\{3CCC052E-BDEE-408A-BEA7-90914EF2964B}
[-] Klíč Smazáno : HKLM\SOFTWARE\Classes\CLSID\{61F47056-E400-43D3-AF1E-AB7DFFD4C4AD}
[-] Klíč Smazáno : HKLM\SOFTWARE\Classes\CLSID\{E2B98EEA-EE55-4E9B-A8C1-6E5288DF785A}
[-] Klíč Smazáno : HKCU\Software\BI
[-] Klíč Smazáno : HKCU\Software\Conduit
[-] Klíč Smazáno : HKCU\Software\InstalledBrowserExtensions
[-] Klíč Smazáno : HKCU\Software\PRODUCTSETUP
[-] Klíč Smazáno : HKCU\Software\Reg\Clean
[-] Klíč Smazáno : HKCU\Software\Softonic
[-] Klíč Smazáno : HKCU\Software\Yahoo\Companion
[-] Klíč Smazáno : HKCU\Software\Yahoo\YFriendsBar
[-] Klíč Smazáno : HKLM\SOFTWARE\InstalledBrowserExtensions
[-] Klíč Smazáno : HKLM\SOFTWARE\Reg\Clean
[-] Klíč Smazáno : HKLM\SOFTWARE\Yahoo\Companion
[-] Klíč Smazáno : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\bi_uninstaller
[-] Klíč Smazáno : [x64] HKLM\SOFTWARE\InstalledBrowserExtensions
[-] Hodnota Smazáno : HKU\S-1-5-21-1514291352-1774944380-498877344-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run [NextLive]

***** [ Prohlížeče ] *****

[-] [C:\Users\Morby\AppData\Local\Google\Chrome\User Data\Default\Web Data] [Search Provider] Smazáno : search.conduit.com
[-] [C:\Users\Morby\AppData\Local\Google\Chrome\User Data\Default\Web Data] [Search Provider] Smazáno : ask.com
[-] [C:\Users\Morby\AppData\Local\Google\Chrome\User Data\Default\Web Data] [Search Provider] Smazáno : websearch
[-] [C:\Users\Morby\AppData\Local\Google\Chrome\User Data\Default\Web Data] [Search Provider] Smazáno : feed.sonic-search.com
[-] [C:\Users\Morby\AppData\Local\Google\Chrome\User Data\Default\Web Data] [Search Provider] Smazáno : search.sweetim.com
[-] [C:\Users\Morby\AppData\Local\Google\Chrome\User Data\Default\Web Data] [Search Provider] Smazáno : search.yahoo.com
[-] [C:\Users\Morby\AppData\Local\Google\Chrome\User Data\Default\Web Data] [Search Provider] Smazáno : daemon-search.com
[-] [C:\Users\Morby\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences] [Startup_URLs] Smazáno : hxxp://search.babylon.com/?affID=112542 ... 1d7d516458
[-] [C:\Users\Morby\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences] [Startup_URLs] Smazáno : hxxp://mystart.incredibar.com/mb139?a=6R8AS2Wtr0&i=26
[-] [C:\Users\Morby\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences] [Startup_URLs] Smazáno : hxxp://search.certified-toolbar.com?si= ... e&tid=3231
[-] [C:\Users\Morby\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences] [Startup_URLs] Smazáno : hxxps://startpage-home.com/?s=lenovo&m=start
[-] [C:\Users\Morby\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences] [Startup_URLs] Smazáno : hxxp://websearch.pu-results.info/?pid=7 ... g=EN&cc=CZ
[-] [C:\Users\Morby\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences] [Startup_URLs] Smazáno : hxxp://mysearch.avg.com/?cid={C882F017-402A-4E3C-945A-F21856DEED21}&mid=65dfafdcc3a647d3b12bd16f5e479d3c-c882777ed4f546155b5b63e9bf8b679ad5df6b93&lang=cs&ds=bl011&pr=sa&d=2013-06-05 06:57:25&v=15.2.0.5&pid=safeguard&sg=3&sap=hp
[-] [C:\Users\Morby\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences] [Extension] Smazáno : aaaaaiabcopkplhgaedhbloeejhhankf
[-] [C:\Users\Morby\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences] [Extension] Smazáno : fcgnigmofekcllgbiejhmigggmgehkip

*************************

:: "Tracing" klíče smazány
:: Nastavení Winsock vyčištěno

*************************

C:\AdwCleaner\AdwCleaner[C1].txt - [5910 bytů] - [29/07/2016 09:12:32]
C:\AdwCleaner\AdwCleaner[S1].txt - [8512 bytů] - [28/07/2016 17:29:22]
C:\AdwCleaner\AdwCleaner[S2].txt - [6553 bytů] - [29/07/2016 09:08:31]

########## EOF - C:\AdwCleaner\AdwCleaner[C1].txt - [6129 bytů] ##########

Morbys
nováček
Příspěvky: 21
Registrován: červenec 16
Pohlaví: Muž
Stav:
Offline

Re: Prosím o kontrolu - nefunkční antivirová ochrana

Příspěvekod Morbys » 29 črc 2016 09:28

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Malwarebytes
Version: 8.0.7 (07.03.2016)
Operating System: Windows 10 Pro x64
Ran by Morby (Administrator) on p  29.07.2016 at 9:23:29,83
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




File System: 3

Successfully deleted: C:\Users\Morby\AppData\Local\tempdir (Folder)
Successfully deleted: C:\Users\Morby\AppData\Roaming\Mozilla\Firefox\Profiles\nahd6ha2.default\extensions\staged (Folder)
Successfully deleted: C:\Users\Morby\AppData\Roaming\wyupdate au (Folder)

Deleted the following from C:\Users\Morby\AppData\Roaming\Mozilla\Firefox\Profiles\nahd6ha2.default\prefs.js
user_pref(extensions.yasearch@yandex.ru.getAddons.cache.enabled, false);
user_pref(extensions.vb@yandex.ru.getAddons.cache.enabled, false);
user_pref(extensions.yasearch@yandex.ru.defender. ... .protected, hxxp://www.seznam.cz/?clid=6826);



Registry: 2

Successfully deleted: HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{91397D20-1446-11D4-8AF4-0040CA1127B6} (Registry Value)
Successfully deleted: HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} (Registry Key)




~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on p  29.07.2016 at 9:26:42,85
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Morbys
nováček
Příspěvky: 21
Registrován: červenec 16
Pohlaví: Muž
Stav:
Offline

Re: Prosím o kontrolu - nefunkční antivirová ochrana

Příspěvekod Morbys » 29 črc 2016 10:07

RogueKiller V12.4.1.0 (x64) [Jul 28 2016] (Free) by Adlice Software
mail : http://www.adlice.com/contact/
Feedback : http://forum.adlice.com
Webová stránka : http://www.adlice.com/download/roguekiller/
Blog : http://www.adlice.com

Operační systém : Windows 10 (10.0.10586) 64 bits version
Spuštěno : Normální režim
Uživatel : Morby [Práva správce]
Started from : C:\Users\Morby\Desktop\RogueKillerX64.exe
Mód : Prohledat -- Datum : 07/29/2016 10:04:42

¤¤¤ Procesy : 0 ¤¤¤

¤¤¤ Registry : 10 ¤¤¤
[PUM.HomePage] (X64) HKEY_USERS\S-1-5-21-1514291352-1774944380-498877344-1001\Software\Microsoft\Internet Explorer\Main | Start Page : http://www.seznam.cz/?clid=6826 -> Nalezeno
[PUM.HomePage] (X86) HKEY_USERS\S-1-5-21-1514291352-1774944380-498877344-1001\Software\Microsoft\Internet Explorer\Main | Start Page : http://www.seznam.cz/?clid=6826 -> Nalezeno
[PUM.SearchPage] (X64) HKEY_USERS\S-1-5-21-1514291352-1774944380-498877344-1001\Software\Microsoft\Internet Explorer\Main | Search Bar : Preserve -> Nalezeno
[PUM.SearchPage] (X86) HKEY_USERS\S-1-5-21-1514291352-1774944380-498877344-1001\Software\Microsoft\Internet Explorer\Main | Search Bar : Preserve -> Nalezeno
[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters | DhcpNameServer : 10.0.0.1 10.0.0.10 ([][]) -> Nalezeno
[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\RK_System_ON_D_A5AE\ControlSet001\Services\Tcpip\Parameters | DhcpNameServer : 10.0.0.1 10.0.0.10 ([][]) -> Nalezeno
[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Tcpip\Parameters | DhcpNameServer : 10.0.0.1 10.0.0.10 ([][]) -> Nalezeno
[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{c10d01c0-9614-4695-b8de-fd22e5a4b6d0} | DhcpNameServer : 10.0.0.1 10.0.0.10 ([][]) -> Nalezeno
[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\RK_System_ON_D_A5AE\ControlSet001\Services\Tcpip\Parameters\Interfaces\{a1f8a713-00b5-4e49-baf4-d5ab12fa7baf} | DhcpNameServer : 10.0.0.1 10.0.0.10 ([][]) -> Nalezeno
[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Tcpip\Parameters\Interfaces\{c10d01c0-9614-4695-b8de-fd22e5a4b6d0} | DhcpNameServer : 10.0.0.1 10.0.0.10 ([][]) -> Nalezeno

¤¤¤ Úlohy : 0 ¤¤¤

¤¤¤ Soubory : 0 ¤¤¤

¤¤¤ Soubor HOSTS : 0 ¤¤¤

¤¤¤ Antirootkit : 0 (Driver: Nahrán) ¤¤¤

¤¤¤ Webové prohlížeče : 1 ¤¤¤
[PUM.HomePage][FIREFX:Config] nahd6ha2.default : user_pref("browser.startup.homepage", "http://www.seznam.cz/?clid=6826"); -> Nalezeno

¤¤¤ Kontrola MBR : ¤¤¤
+++++ PhysicalDrive0: SAMSUNG HD103SJ ATA Device +++++
--- User ---
[MBR] 8ef6f8c7bd7274b123226883b48e4eae
[BSP] 7ebc1ab519d18a58ef8b7de47c8c13f4 : Windows Vista/7/8|VT.Unknown MBR Code
Partition table:
0 - [ACTIVE] NTFS (0x7) [VISIBLE] Offset (sectors): 206848 | Size: 953317 MB [Windows Vista/7/8 Bootstrap | Windows Vista/7/8 Bootloader]
1 - [XXXXXX] ACER (0x27) [VISIBLE] Offset (sectors): 1952600064 | Size: 450 MB
User = LL1 ... OK
User = LL2 ... OK

+++++ PhysicalDrive1: ST3320620A ATA Device +++++
--- User ---
[MBR] d85ab5b39c048683cbef382de0b67634
[BSP] 4244c2e0826f2f5735cfe8b048f28c57 : Windows Vista/7/8|VT.Unknown MBR Code
Partition table:
0 - [ACTIVE] NTFS (0x7) [VISIBLE] Offset (sectors): 63 | Size: 49999 MB [Windows Vista/7/8 Bootstrap | Windows Vista/7/8 Bootloader]
1 - [XXXXXX] EXTEN-LBA (0xf) [VISIBLE] Offset (sectors): 102398310 | Size: 255235 MB
User = LL1 ... OK
User = LL2 ... OK

Uživatelský avatar
jerabina
člen Security týmu
Level 6
Level 6
Příspěvky: 3647
Registrován: březen 13
Bydliště: Litoměřice
Pohlaví: Muž
Stav:
Offline

Re: Prosím o kontrolu - nefunkční antivirová ochrana

Příspěvekod jerabina » 29 črc 2016 12:14

Zavři všechny programy a prohlížeče. Deaktivuj antivir a firewall.
Prosím, odpoj všechny USB (kromě myši s klávesnice) nebo externí disky z počítače před spuštěním tohoto programu.
Spusť znovu RogueKiller ( Pro Windows Vista nebo Windows 7, klepni pravým a vyber "Spustit jako správce", ve Windows XP poklepej ke spuštění).
- Počkej, až Prescan dokončí práci...
- Pak klikni na "Prohledat " ,po jeho skončení:
- V záložkách (Registry , Tasks , Web Browser apod.) vše zatrhni (dej zatržítka)
(musíš dát myší zatržítko do toho čtverečku vlevo od registru ap.)
- Klikni na "Smazat"
- Počkej, dokud Status box nezobrazí " Mazání dokončeno "
- Klikni na "Zpráva " a zkopíruj a vlož obsah té zprávy prosím sem. Log je možno nalézt v RKreport [číslo]. txt na ploše.
- Zavři RogueKiller

Vypni antivir
Stáhni
Zoek.exe

a uloz si ho na plochu.
Zavři všechny ostatní programy , okna i prohlížeče.
Spusť Zoek.exe ( u win vista , win7, 8 klikni na něj pravým a vyber : „Spustit jako správce“
- pozor , náběh programu může trvat déle.

Do okna programu vlož skript níže:

Kód: Vybrat vše

autoclean;
emptyclsid;
iedefaults;
FFdefaults;
CHRdefaults;
emptyalltemp;
resethosts;


klikni na Run Script
Program provede sken , opravu, sken i oprava může trvat i více minut ,je třeba posečkat do konce. Do okna neklikej!
Program nabídne restart , potvrď .

Po restartu se může nějaký čas ukázat pouze černá plocha , to je normální. Je třeba počkat až se vytvoří log. Ten si můžeš uložit třeba do dokumentů , jinak se sám ukládá do:
C:\zoek-results.log
Zkopíruj sem celý obsah toho logu.

Vlož nový log z HJT + informuj o problémech.
Když nevíš jak dál, přichází na řadu prostudovat manuál!
HJT návod

Pokud neodpovídám do vašich témat v sekci HJT když jsem online, tak je to jen proto, že jsem na mobilu kde je studování logů a psaní skriptů nemožné. Neberte to tedy prosím jako ignoraci.

Morbys
nováček
Příspěvky: 21
Registrován: červenec 16
Pohlaví: Muž
Stav:
Offline

Re: Prosím o kontrolu - nefunkční antivirová ochrana

Příspěvekod Morbys » 29 črc 2016 15:54

RogueKiller V12.4.1.0 (x64) [Jul 28 2016] (Free) by Adlice Software
mail : http://www.adlice.com/contact/
Feedback : http://forum.adlice.com
Webová stránka : http://www.adlice.com/download/roguekiller/
Blog : http://www.adlice.com

Operační systém : Windows 10 (10.0.10586) 64 bits version
Spuštěno : Normální režim
Uživatel : Morby [Práva správce]
Started from : C:\Users\Morby\Desktop\RogueKillerX64.exe
Mód : Smazat -- Datum : 07/29/2016 14:38:54

¤¤¤ Procesy : 0 ¤¤¤

¤¤¤ Registry : 6 ¤¤¤
[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters | DhcpNameServer : 10.0.0.1 10.0.0.10 ([][]) -> Nahrazeno ()
[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\RK_System_ON_D_F6C7\ControlSet001\Services\Tcpip\Parameters | DhcpNameServer : 10.0.0.1 10.0.0.10 ([][]) -> Nahrazeno ()
[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Tcpip\Parameters | DhcpNameServer : 10.0.0.1 10.0.0.10 ([][]) -> Nahrazeno ()
[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{c10d01c0-9614-4695-b8de-fd22e5a4b6d0} | DhcpNameServer : 10.0.0.1 10.0.0.10 ([][]) -> Nahrazeno ()
[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\RK_System_ON_D_F6C7\ControlSet001\Services\Tcpip\Parameters\Interfaces\{a1f8a713-00b5-4e49-baf4-d5ab12fa7baf} | DhcpNameServer : 10.0.0.1 10.0.0.10 ([][]) -> Nahrazeno ()
[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Tcpip\Parameters\Interfaces\{c10d01c0-9614-4695-b8de-fd22e5a4b6d0} | DhcpNameServer : 10.0.0.1 10.0.0.10 ([][]) -> Nahrazeno ()

¤¤¤ Úlohy : 0 ¤¤¤

¤¤¤ Soubory : 0 ¤¤¤

¤¤¤ Soubor HOSTS : 0 ¤¤¤

¤¤¤ Antirootkit : 0 (Driver: Nahrán) ¤¤¤

¤¤¤ Webové prohlížeče : 0 ¤¤¤

¤¤¤ Kontrola MBR : ¤¤¤
+++++ PhysicalDrive0: SAMSUNG HD103SJ ATA Device +++++
--- User ---
[MBR] 8ef6f8c7bd7274b123226883b48e4eae
[BSP] 7ebc1ab519d18a58ef8b7de47c8c13f4 : Windows Vista/7/8|VT.Unknown MBR Code
Partition table:
0 - [ACTIVE] NTFS (0x7) [VISIBLE] Offset (sectors): 206848 | Size: 953317 MB [Windows Vista/7/8 Bootstrap | Windows Vista/7/8 Bootloader]
1 - [XXXXXX] ACER (0x27) [VISIBLE] Offset (sectors): 1952600064 | Size: 450 MB
User = LL1 ... OK
User = LL2 ... OK

+++++ PhysicalDrive1: ST3320620A ATA Device +++++
--- User ---
[MBR] d85ab5b39c048683cbef382de0b67634
[BSP] 4244c2e0826f2f5735cfe8b048f28c57 : Windows Vista/7/8|VT.Unknown MBR Code
Partition table:
0 - [ACTIVE] NTFS (0x7) [VISIBLE] Offset (sectors): 63 | Size: 49999 MB [Windows Vista/7/8 Bootstrap | Windows Vista/7/8 Bootloader]
1 - [XXXXXX] EXTEN-LBA (0xf) [VISIBLE] Offset (sectors): 102398310 | Size: 255235 MB
User = LL1 ... OK
User = LL2 ... OK


Zoek.exe v5.0.0.1 Updated 31-December-2015
Tool run by Morby on p  29.07.2016 at 15:24:57,57.
Microsoft Windows 10 Pro 10.0.10586 x64
Running in: Normal Mode Internet Access Detected
Launched: C:\Users\Morby\Desktop\zoek.exe [Scan all users] [Script inserted]

==== System Restore Info ======================

29.7.2016 15:27:22 Zoek.exe System Restore Point Created Successfully.

==== Reset Hosts File ======================

# Copyright (c) 1993-2006 Microsoft Corp.
#
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
#
# This file contains the mappings of IP addresses to host names. Each
# entry should be kept on an individual line. The IP address should
# be placed in the first column followed by the corresponding host name.
# The IP address and the host name should be separated by at least one
# space.
#
# Additionally, comments (such as these) may be inserted on individual
# lines or following the machine name denoted by a '#' symbol.
#
# For example:
#
# 102.54.94.97 rhino.acme.com # source server
# 38.25.63.10 x.acme.com # x client host

127.0.0.1 localhost

==== Empty Folders Check ======================

C:\PROGRA~2\Acer Inc deleted successfully
C:\PROGRA~2\COMMON~1\Symantec Shared deleted successfully
C:\PROGRA~3\ASUS OC Profiles deleted successfully
C:\PROGRA~3\Comms deleted successfully
C:\PROGRA~3\Hi-Rez Studios deleted successfully
C:\PROGRA~3\HTC deleted successfully
C:\PROGRA~3\IDM deleted successfully
C:\PROGRA~3\Origin deleted successfully
C:\PROGRA~3\Real deleted successfully
C:\PROGRA~3\Symantec deleted successfully
C:\Users\DefaultAppPool\AppData\LocalLow deleted successfully
C:\Users\Morby\AppData\Local\ActiveSync deleted successfully
C:\Users\Morby\AppData\Local\BoL deleted successfully
C:\Users\Morby\AppData\Local\cache deleted successfully
C:\Users\Morby\AppData\Local\CrashDumps deleted successfully
C:\Users\Morby\AppData\Local\GHISLER deleted successfully
C:\Users\Morby\AppData\Local\NetworkTiles deleted successfully
C:\Users\Morby\AppData\Local\NokiaAccount deleted successfully
C:\Users\Morby\AppData\Local\PeerDistRepub deleted successfully
C:\Users\Morby\AppData\Local\Real deleted successfully
C:\Users\Morby\AppData\Local\Skype deleted successfully
C:\WINDOWS\serviceprofiles\networkservice\AppData\Local\CrashDumps deleted successfully
C:\WINDOWS\serviceprofiles\networkservice\AppData\Local\PeerDistPub deleted successfully
C:\WINDOWS\serviceprofiles\networkservice\AppData\Local\PeerDistRepub deleted successfully
C:\WINDOWS\serviceprofiles\Localservice\AppData\Local\NetworkTiles deleted successfully

==== Deleting CLSID Registry Keys ======================

HKEY_USERS\S-1-5-21-1514291352-1774944380-498877344-1001\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{2D243D8D-CED2-4506-B7E7-65906DCFBC7D} deleted successfully
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D5FEC983-01DB-414A-9456-AF95AC9ED7B5} deleted successfully

==== Deleting CLSID Registry Values ======================


==== Deleting Services ======================


==== FireFox Fix ======================

Deleted from C:\Users\Morby\AppData\Roaming\Mozilla\Firefox\Profiles\nahd6ha2.default\prefs.js:
user_pref("browser.startup.homepage", "about:home"about:home);

Added to C:\Users\Morby\AppData\Roaming\Mozilla\Firefox\Profiles\nahd6ha2.default\prefs.js:
user_pref("browser.startup.homepage", "about:home");
user_pref("browser.newtab.url", "about:newtab");

==== Deleting Files \ Folders ======================

C:\PROGRA~2\Acer Inc not found
C:\PROGRA~2\Internet Download Manager deleted
C:\Users\Morby\AppData\Roaming\Curse Client deleted
C:\Users\Morby\AppData\Roaming\InnkeeperUI deleted
C:\Users\Morby\AppData\Roaming\livestreamer deleted
C:\Users\Morby\.android deleted
C:\install.exe deleted
C:\PROGRA~3\{01BD4FC9-2F86-4706-A62E-774BB7E9D308} deleted
C:\PROGRA~3\{7D93B3B9-36B7-4383-9666-CFAD7F2AC87E} deleted
C:\PROGRA~3\Package Cache deleted
C:\Users\Morby\AppData\Local\Unity deleted
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Search.lnk deleted
C:\Users\Morby\AppData\LocalLow\Unity deleted
C:\windows\SysNative\GroupPolicy\Machine deleted
C:\windows\SysNative\GroupPolicy\User deleted
C:\windows\SysNative\GroupPolicy\GPT.INI deleted
C:\WINDOWS\Syswow64\GroupPolicy\gpt.ini deleted
C:\WINDOWS\SysWow64\AI_RecycleBin deleted

==== Firefox Start and Search pages ======================

ProfilePath: C:\Users\Morby\AppData\Roaming\Mozilla\Firefox\Profiles\nahd6ha2.default
user_pref("browser.startup.homepage", "about:home");
user_pref("browser.newtab.url", "about:newtab");

==== Firefox Extensions Registry ======================

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Mozilla\Firefox\Extensions]
"smartwebprinting@hp.com"="C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3" [27.01.2014 17:18]
[HKEY_CURRENT_USER\Software\Mozilla\Firefox\Extensions]
"smartwebprinting@hp.com"="C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3" [27.01.2014 17:18]

==== Firefox Extensions ======================

==== Firefox Plugins ======================


==== Chromium Look ======================

Google Chrome Version: 46.0.2490.86

HKEY_LOCAL_MACHINE\SOFTWARE\Google\Chrome\Extensions
lifbcibllhkdhoafpjfnlhfpfgnpldfl - C:\Program Files (x86)\Skype\Toolbars\ChromeExtension\skype_chrome_extension.crx[25.05.2016 10:31]

Video Downloader - Morby\AppData\Local\Google\Chrome\User Data\Default\Extensions\aiimdkdngfcipjohbjenkahhlhccpdbc
AdBlock - Morby\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom
Centrum.cz Email Notifikátor - Morby\AppData\Local\Google\Chrome\User Data\Default\Extensions\hmmnahgmbjnpgdoadbfoficgoamahklm
Arcane Legends - Morby\AppData\Local\Google\Chrome\User Data\Default\Extensions\ibmlkgieigeddcedpbijnpojheoddido
Tiberium Alliances - Morby\AppData\Local\Google\Chrome\User Data\Default\Extensions\jgaeopgjojikeoiidmfaejkifhgjoooe
SmallringFX DarkBlue Theme - Morby\AppData\Local\Google\Chrome\User Data\Default\Extensions\kbfijmgohofmpjlcgmjplbpmkpchdhpk
IDM Integration Module - Morby\AppData\Local\Google\Chrome\User Data\Default\Extensions\ngpampappnmepgilojfohadhhmbhlaek
AdBlock - Morby\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\gighmmpiobklfepjocnamgkkbiglidom
Centrum.cz Email Notifikátor - Morby\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\hmmnahgmbjnpgdoadbfoficgoamahklm
Fiery Horse chrome Theme - Morby\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\miipddolmnknmpiednnbijmeogpdgknp
Skype - Morby\AppData\Local\Google\Chrome\User Data\Profile 2\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl
Centrum.cz Email Notifikátor - Morby\AppData\Local\Google\Chrome\User Data\Profile 3\Extensions\hmmnahgmbjnpgdoadbfoficgoamahklm
Tiberium Alliances - Morby\AppData\Local\Google\Chrome\User Data\Profile 3\Extensions\jgaeopgjojikeoiidmfaejkifhgjoooe
Fiery Horse chrome Theme - Morby\AppData\Local\Google\Chrome\User Data\Profile 3\Extensions\miipddolmnknmpiednnbijmeogpdgknp
APK Downloader - Morby\AppData\Local\Yandex\YandexBrowser\User Data\Default\Extensions\cgihflhdpokeobcfimliamffejfnmfii
AdBlock - Morby\AppData\Local\Yandex\YandexBrowser\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom
Centrum.cz Email Notifikátor - Morby\AppData\Local\Yandex\YandexBrowser\User Data\Default\Extensions\hmmnahgmbjnpgdoadbfoficgoamahklm

==== Chromium Fix ======================

C:\Users\Morby\AppData\Local\Google\Chrome\User Data\Profile 3\Local Storage\https_static.olark.com_0.localstorage deleted successfully
C:\Users\Morby\AppData\Local\Google\Chrome\User Data\Profile 3\Local Storage\https_static.olark.com_0.localstorage-journal deleted successfully
C:\Users\Morby\AppData\Local\Google\Chrome\User Data\Profile 3\Local Storage\http_c.betrad.com_0.localstorage deleted successfully
C:\Users\Morby\AppData\Local\Google\Chrome\User Data\Profile 3\Local Storage\http_c.betrad.com_0.localstorage-journal deleted successfully
C:\Users\Morby\AppData\Local\Google\Chrome\User Data\Profile 3\Local Storage\https_d10lpsik1i8c69.cloudfront.net_0.localstorage deleted successfully
C:\Users\Morby\AppData\Local\Google\Chrome\User Data\Profile 3\Local Storage\https_d10lpsik1i8c69.cloudfront.net_0.localstorage-journal deleted successfully
C:\Users\Morby\AppData\Local\Google\Chrome\User Data\Default\Extensions\aiimdkdngfcipjohbjenkahhlhccpdbc deleted successfully

==== Set IE to Default ======================

Old Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"="http://go.microsoft.com/fwlink/p/?LinkId=255141"
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchUrl]
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchUrl\fi]
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchUrl\ma]
@="http://www.mapy.cz/?sourceid=quicksearch_6826&query=%s"
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchUrl\se]
@="http://search.seznam.cz/?sourceid=quicksearch_6826&q=%s"
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchUrl\vi]
@="http://videa.seznam.cz/?q=%s"
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchUrl\zb]
@="http://www.zbozi.cz/?sourceid=quicksearch_6826&q=%s"
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes]
"DefaultScope"="{0633EE93-D776-472f-A0FF-E1416B8B2E3A}"
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}] not found

New Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"="http://go.microsoft.com/fwlink/p/?LinkId=255141"
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchUrl]
"(Default)"="http://search.msn.com/results.asp?q=%s"
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes]
"DefaultScope"="{012E1000-F331-11DB-8314-0800200C9A66}"

==== All HKLM and HKCU SearchScopes ======================

HKLM\SearchScopes "DefaultScope"="{0633EE93-D776-472f-A0FF-E1416B8B2E3A}"
HKLM\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} - http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
HKLM\Wow6432Node\SearchScopes "DefaultScope"="{0633EE93-D776-472f-A0FF-E1416B8B2E3A}"
HKLM\Wow6432Node\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} - http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
HKCU\SearchScopes "DefaultScope"="{012E1000-F331-11DB-8314-0800200C9A66}"
HKCU\SearchScopes\109219F7C33B89504A7929B7F2F5C103 - http://www.firmy.cz/phr/{searchTerms}
HKCU\SearchScopes\3F974428B36447A5EF6C08E680F3B9A5 - http://videa.seznam.cz/?q={searchTerms}
HKCU\SearchScopes\AA7878E63CC8979B2999D770FA80D0E2 - http://www.zbozi.cz/?sourceid=quicksearch_6826&q={searchTerms}
HKCU\SearchScopes\F3E471B13D299A9503E45021DDE18C6C - http://www.mapy.cz/?sourceid=quicksearch_6826&query={searchTerms}
HKCU\SearchScopes\{012E1000-F331-11DB-8314-0800200C9A66} - http://www.google.com/search?q={searchTerms}
HKCU\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} - http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC

==== Reset Google Chrome ======================

C:\Users\Morby\AppData\Local\Chromium\User Data\Default\Preferences was reset successfully
C:\Users\Morby\AppData\Local\Chromium\User Data\Default\Preferences_20140823203804.backup was reset successfully
C:\Users\Morby\AppData\Local\Chromium\User Data\Default\Preferences_20160227070506.backup was reset successfully
C:\Users\Morby\AppData\Local\Google\Chrome\User Data\Default\Preferences was reset successfully
C:\Users\Morby\AppData\Local\Google\Chrome\User Data\Default\Preferences_20140823203804.backup was reset successfully
C:\Users\Morby\AppData\Local\Google\Chrome\User Data\Default\Preferences_20160227070506.backup was reset successfully
C:\Users\Morby\AppData\Local\Google\Chrome\User Data\Default\Preferences~RF3b7f855.TMP will be reset at reboot
C:\Users\Morby\AppData\Local\Google\Chrome\User Data\Default\Preferences~RFfdf37.TMP was reset successfully
C:\Users\Morby\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences was reset successfully
C:\Users\Morby\AppData\Local\Google\Chrome\User Data\Profile 1\Preferences was reset successfully
C:\Users\Morby\AppData\Local\Google\Chrome\User Data\Profile 1\Secure Preferences was reset successfully
C:\Users\Morby\AppData\Local\Google\Chrome\User Data\Profile 2\Preferences was reset successfully
C:\Users\Morby\AppData\Local\Google\Chrome\User Data\Profile 2\Secure Preferences was reset successfully
C:\Users\Morby\AppData\Local\Google\Chrome\User Data\Profile 3\Preferences was reset successfully
C:\Users\Morby\AppData\Local\Google\Chrome\User Data\Profile 3\Secure Preferences was reset successfully
C:\Users\Morby\AppData\Local\Yandex\YandexBrowser\User Data\Default\Preferences was reset successfully
C:\Users\Morby\AppData\Local\Yandex\YandexBrowser\User Data\Default\Secure Preferences was reset successfully
C:\Users\Morby\AppData\Local\Chromium\User Data\Default\Web Data was reset successfully
C:\Users\Morby\AppData\Local\Chromium\User Data\Default\Web Data_20160227070506.backup was reset successfully
C:\Users\Morby\AppData\Local\Google\Chrome\User Data\Default\Web Data was reset successfully
C:\Users\Morby\AppData\Local\Google\Chrome\User Data\Profile 1\Web Data was reset successfully
C:\Users\Morby\AppData\Local\Google\Chrome\User Data\Profile 1\Web Data-journal was reset successfully
C:\Users\Morby\AppData\Local\Google\Chrome\User Data\Profile 2\Web Data was reset successfully
C:\Users\Morby\AppData\Local\Google\Chrome\User Data\Profile 2\Web Data-journal was reset successfully
C:\Users\Morby\AppData\Local\Google\Chrome\User Data\Profile 3\Web Data was reset successfully
C:\Users\Morby\AppData\Local\Google\Chrome\User Data\Profile 3\Web Data-journal was reset successfully
C:\Users\Morby\AppData\Local\Yandex\YandexBrowser\User Data\Default\Web Data was reset successfully
C:\Users\Morby\AppData\Local\Yandex\YandexBrowser\User Data\Default\Web Data-journal was reset successfully

==== Deleting Registry Keys ======================

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\UnityWebPlayer deleted successfully
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BlueStacks Agent deleted successfully
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Facebook Update deleted successfully
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Launch LCore deleted successfully
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Sidebar deleted successfully

==== Empty IE Cache ======================

C:\WINDOWS\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\Default\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\DefaultAppPool\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\Morby\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 emptied successfully
C:\Users\Morby\AppData\Local\Microsoft\Windows\INetCache\Low\Content.IE5 emptied successfully
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 emptied successfully
C:\WINDOWS\sysWoW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 emptied successfully
C:\WINDOWS\sysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 emptied successfully
C:\Users\Morby\AppData\Local\Microsoft\Windows\INetCache\IE emptied successfully
C:\Users\Morby\AppData\Local\Microsoft\Windows\INetCache\Low\IE emptied successfully
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE emptied successfully
C:\WINDOWS\sysWoW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE emptied successfully

==== Empty FireFox Cache ======================

No FireFox Profiles found

==== Empty Chrome Cache ======================

C:\Users\Morby\AppData\Local\Opera Software\Opera Stable\Cache emptied successfully
C:\Users\Morby\AppData\Local\Chromium\User Data\Default\Cache emptied successfully
C:\Users\Morby\AppData\Local\Google\Chrome\User Data\Default\Cache emptied successfully
C:\Users\Morby\AppData\Local\Google\Chrome\User Data\Profile 1\Cache emptied successfully
C:\Users\Morby\AppData\Local\Google\Chrome\User Data\Profile 2\Cache emptied successfully
C:\Users\Morby\AppData\Local\Google\Chrome\User Data\Profile 3\Cache emptied successfully
C:\Users\Morby\AppData\Local\Yandex\YandexBrowser\User Data\Default\Cache emptied successfully

==== Empty All Flash Cache ======================

No Flash Cache Found

==== Empty All Java Cache ======================

Java Cache cleared successfully

==== C:\zoek_backup content ======================

C:\zoek_backup (files=659 folders=178 847823818 bytes)

==== Empty Temp Folders ======================

C:\WINDOWS\Temp will be emptied at reboot

==== After Reboot ======================

==== Empty Temp Folders ======================

C:\WINDOWS\Temp successfully emptied
C:\Users\Morby\AppData\Local\Temp successfully emptied

==== Empty Recycle Bin ======================

C:\$RECYCLE.BIN successfully emptied

==== Deleting Files / Folders ======================

"C:\Users\Morby\AppData\Local\Google\Chrome\User Data\Default\Preferences~RF3b7f855.TMP" not found

==== EOF on p  29.07.2016 at 15:43:42,96 ======================


Zpět na “HiJackThis”

Kdo je online

Uživatelé prohlížející si toto fórum: Žádní registrovaní uživatelé a 11 hostů