Ahoj,
prosil bych o kontrolu/o pomoc. Při startu po chvilce vyskočí takový okno, vypadá to jak příkazovej řádek, což pravděpodobně spustí okna prohlížeče, ze kterejch na mě řvou reklamy. Zkoušel jsem to nejdřív sám, pomocí programů, co tady používáte (říkal jsem si, že to vyřeší pravděpodobně jenom AdwCleaner). Projel jsem to Malwarebytes Antimalware - to nenašlo nic. AdwCleaner našel 10 položek, ty jsem už smazal. TFC jsem taky použil, Junkware removal tool nic nenašel jestli si správně pamatuji a Sophos taky nic. Reklamy ale vyskakujou stejně. Díky
Logfile of Trend Micro HijackThis v2.0.5
Scan saved at 16:01:24, on 02.10.2020
Platform: Unknown Windows (WinNT 6.02.1008)
MSIE: Internet Explorer v11.0 (11.00.18362.0001)
Boot mode: Normal
Running processes:
C:\Program Files (x86)\NVIDIA Corporation\NvNode\NVIDIA Web Helper.exe
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
C:\Users\miros\Desktop\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://lenovo17win10.msn.com/?pc=LCTE
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://lenovo17win10.msn.com/?pc=LCTE
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/p/?LinkId=255141
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/p/?LinkId=255141
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = %11%\blank.htm
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: Lync Click to Call BHO - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\OCHelper.dll
O4 - HKLM\..\Run: [TeamsMachineInstaller] %ProgramFiles%\Teams Installer\Teams.exe --checkInstall --source=PROPLUS
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
O4 - HKCU\..\Run: [Steam] "C:\Program Files (x86)\Steam\steam.exe" -silent
O4 - HKCU\..\Run: [EpicGamesLauncher] "C:\Program Files (x86)\Epic Games\Launcher\Portal\Binaries\Win64\EpicGamesLauncher.exe" -silent
O4 - HKUS\S-1-5-19\..\Run: [OneDriveSetup] C:\Windows\SysWOW64\OneDriveSetup.exe /thfirstsetup (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [OneDriveSetup] C:\Windows\SysWOW64\OneDriveSetup.exe /thfirstsetup (User 'NETWORK SERVICE')
O4 - Global Startup: update.bat
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE/3000
O8 - Extra context menu item: Se&nd to OneNote - res://C:\Program Files\Microsoft Office\Root\Office16\ONBttnIE.dll/105
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Se&nd to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\ONBttnIE.dll
O9 - Extra button: Lync Click to Call - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\OCHelper.dll
O9 - Extra 'Tools' menuitem: Lync Click to Call - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\OCHelper.dll
O9 - Extra button: OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\ONBttnIELinkedNotes.dll
O9 - Extra 'Tools' menuitem: OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\ONBttnIELinkedNotes.dll
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O18 - Protocol: mso-minsb-roaming.16 - {83C25742-A9F7-49FB-9138-434302C88D07} - C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\MSOSB.DLL
O18 - Protocol: mso-minsb.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\MSOSB.DLL
O18 - Protocol: osf-roaming.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\MSOSB.DLL
O18 - Protocol: osf.16 - {5504BE45-A83B-4808-900A-3A5C36E7F77A} - C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\MSOSB.DLL
O18 - Protocol: tbauth - {14654CA6-5711-491D-B89A-58E571679951} - C:\Windows\SysWOW64\tbauth.dll
O18 - Protocol: windows.tbauth - {14654CA6-5711-491D-B89A-58E571679951} - C:\Windows\SysWOW64\tbauth.dll
O18 - Filter hijack: text/xml - {807583E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\MSOXMLMF.DLL
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Inc. - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\WINDOWS\System32\alg.exe (file missing)
O23 - Service: aswbIDSAgent - AVAST Software - C:\Program Files\AVAST Software\Avast\aswidsagent.exe
O23 - Service: Avast Antivirus (avast! Antivirus) - AVAST Software - C:\Program Files\AVAST Software\Avast\AvastSvc.exe
O23 - Service: AvastWscReporter - AVAST Software - C:\Program Files\AVAST Software\Avast\wsc_proxy.exe
O23 - Service: Intel(R) Content Protection HECI Service (cphs) - Intel Corporation - C:\WINDOWS\System32\DriverStore\FileRepository\ki125133.inf_amd64_7a52044300619fc7\IntelCpHeciSvc.exe
O23 - Service: Intel(R) Content Protection HDCP Service (cplspcon) - Intel Corporation - C:\WINDOWS\System32\DriverStore\FileRepository\ki125133.inf_amd64_7a52044300619fc7\IntelCpHDCPSvc.exe
O23 - Service: @%SystemRoot%\system32\CredentialEnrollmentManager.exe,-100 (CredentialEnrollmentManagerUserSvc) - Unknown owner - C:\WINDOWS\system32\CredentialEnrollmentManager.exe (file missing)
O23 - Service: CredentialEnrollmentManagerUserSvc_2f371 - Unknown owner - C:\WINDOWS\system32\CredentialEnrollmentManager.exe (file missing)
O23 - Service: @%SystemRoot%\system32\DiagSvcs\DiagnosticsHub.StandardCollector.ServiceRes.dll,-1000 (diagnosticshub.standardcollector.service) - Unknown owner - C:\WINDOWS\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe (file missing)
O23 - Service: Dolby DAX2 API Service - Dolby Laboratories, Inc. - C:\Program Files\Dolby\Dolby DAX2\DAX2_API\DolbyDAX2API.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\WINDOWS\System32\lsass.exe (file missing)
O23 - Service: Elan Service (ETDService) - ELAN Microelectronics Corp. - C:\Program Files\Elantech\ETDService.exe
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\WINDOWS\system32\fxssvc.exe (file missing)
O23 - Service: GameRecorderSVC - Lenovo(beijing) Limited - C:\Program Files\Lenovo\Nerve Center\bin\x86\GameRecorderSVC.exe
O23 - Service: Google Chrome Elevation Service (GoogleChromeElevationService) - Google LLC - C:\Program Files (x86)\Google\Chrome\Application\85.0.4183.121\elevation_service.exe
O23 - Service: Služba Aktualizace Google (gupdate) (gupdate) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Služba Aktualizace Google (gupdatem) (gupdatem) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: HuaweiHiSuiteService64.exe - Unknown owner - C:\Program Files (x86)\HiSuite\HandSetService\HuaweiHiSuiteService64.exe (file missing)
O23 - Service: @oem16.inf,%iaStorAfsWindowsService.Name%;Intel(R) Optane(TM) Memory Service (iaStorAfsService) - Intel Corporation - C:\WINDOWS\IAStorAfsService\iaStorAfsService.exe
O23 - Service: @oem26.inf,%SERVICE_NAME%;Intel Bluetooth Service (ibtsiva) - Unknown owner - C:\WINDOWS\system32\ibtsiva (file missing)
O23 - Service: Intel(R) HD Graphics Control Panel Service (igfxCUIService2.0.0.0) - Intel Corporation - C:\WINDOWS\System32\DriverStore\FileRepository\ki125133.inf_amd64_7a52044300619fc7\igfxCUIService.exe
O23 - Service: Intel(R) Capability Licensing Service TCP IP Interface - Intel(R) Corporation - C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe
O23 - Service: Intel(R) Online Connect - Intel Corporation - C:\Program Files\Intel\Intel(R) Online Connect\ioc.exe
O23 - Service: Intel(R) Online Connect Helper - Intel Corporation - C:\Program Files\Intel\Intel(R) Online Connect\iocHelperService.exe
O23 - Service: Intel(R) Online Connect Software Asset Manager - Intel Corporation - C:\Program Files (x86)\Intel\Intel(R) Online Connect Access\Intel(R) Software Asset Manager\bin\IntelSoftwareAssetManagerService.exe
O23 - Service: Intel(R) Online Connect Access Legacy CS Loader (Intel(R) TechnologyAccessLegacyCSLoader) - Intel(R) Corporation - C:\Program Files\Intel\Intel(R) Online Connect Access\LegacyCsLoaderService.exe
O23 - Service: Intel(R) Online Connect Access (Intel(R) TechnologyAccessService) - Intel(R) Corporation - C:\Program Files\Intel\Intel(R) Online Connect Access\IntelTechnologyAccessService.exe
O23 - Service: Intel(R) Dynamic Application Loader Host Interface Service (jhi_service) - Intel Corporation - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\WINDOWS\system32\lsass.exe (file missing)
O23 - Service: Intel(R) Management and Security Application Local Management Service (LMS) - Intel Corporation - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
O23 - Service: Malwarebytes Service (MBAMService) - Malwarebytes - C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
O23 - Service: McSecDashboardService - Unknown owner - C:\Program Files\McAfeeDashboard\McSecDashboardService.exe (file missing)
O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\WINDOWS\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\WINDOWS\system32\lsass.exe (file missing)
O23 - Service: NVIDIA LocalSystem Container (NvContainerLocalSystem) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe
O23 - Service: NVIDIA Display Container LS (NVDisplay.ContainerLocalSystem) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\Display.NvContainer\NVDisplay.Container.exe
O23 - Service: Origin Client Service - Electronic Arts - C:\Program Files (x86)\Origin\OriginClientService.exe
O23 - Service: Origin Web Helper Service - Electronic Arts - C:\Program Files (x86)\Origin\OriginWebHelperService.exe
O23 - Service: @%systemroot%\system32\PerceptionSimulation\PerceptionSimulationService.exe,-101 (perceptionsimulation) - Unknown owner - C:\WINDOWS\system32\PerceptionSimulation\PerceptionSimulationService.exe (file missing)
O23 - Service: PluginLoaderSvc - Lenovo(beijing) Limited - C:\Program Files\Lenovo\Nerve Center\bin\x64\PluginLoaderSvc.exe
O23 - Service: Rockstar Game Library Service (Rockstar Service) - Rockstar Games - C:\Program Files\Rockstar Games\Launcher\RockstarService.exe
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\WINDOWS\system32\locator.exe (file missing)
O23 - Service: Realtek Audio Service (RtkAudioService) - Realtek Semiconductor - C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\WINDOWS\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\SecurityHealthAgent.dll,-1002 (SecurityHealthService) - Unknown owner - C:\WINDOWS\system32\SecurityHealthService.exe (file missing)
O23 - Service: @%SystemRoot%\system32\SensorDataService.exe,-101 (SensorDataService) - Unknown owner - C:\WINDOWS\System32\SensorDataService.exe (file missing)
O23 - Service: @%SystemRoot%\System32\SgrmBroker.exe,-100 (SgrmBroker) - Unknown owner - C:\WINDOWS\system32\SgrmBroker.exe (file missing)
O23 - Service: @firewallapi.dll,-50323 (SNMPTRAP) - Unknown owner - C:\WINDOWS\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spectrum.exe,-101 (spectrum) - Unknown owner - C:\WINDOWS\system32\spectrum.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\WINDOWS\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\WINDOWS\system32\sppsvc.exe (file missing)
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files (x86)\Common Files\Steam\SteamService.exe
O23 - Service: @%SystemRoot%\system32\TieringEngineService.exe,-702 (TieringEngineService) - Unknown owner - C:\WINDOWS\system32\TieringEngineService.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\WINDOWS\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\WINDOWS\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\WINDOWS\system32\vssvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\WINDOWS\system32\wbengine.exe (file missing)
O23 - Service: @%ProgramFiles%\Windows Defender\MpAsDesc.dll,-320 (WdNisSvc) - Unknown owner - C:\Program Files (x86)\Windows Defender\NisSrv.exe (file missing)
O23 - Service: @%ProgramFiles%\Windows Defender\MpAsDesc.dll,-310 (WinDefend) - Unknown owner - C:\Program Files (x86)\Windows Defender\MsMpEng.exe (file missing)
O23 - Service: Wireless Keyboard 850 Notification Service (WirelessKB850NotificationService) - Unknown owner - C:\WINDOWS\System32\WirelessKB850NotificationService.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\WINDOWS\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)
--
End of file - 14555 bytes
Adware při startu Windows Vyřešeno
Adware při startu Windows
Naposledy upravil(a) Babis dne 02 říj 2020 20:35, celkem upraveno 1 x.
Re: Adware při startu Windows
Tak ne, tak JRT našel tři klíče
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Malwarebytes
Version: 8.1.4 (07.09.2017)
Operating System: Windows 10 Home x64
Ran by miros (Administrator) on 02.10.2020 at 14:58:15,67
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
File System: 0
Registry: 3
Successfully deleted: HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0D693991-2D67-40CB-8EFA-89BB8A7457B4} (Registry Key)
Successfully deleted: HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C} (Registry Key)
Successfully deleted: HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C} (Registry Key)
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 02.10.2020 at 14:59:49,55
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Malwarebytes
Version: 8.1.4 (07.09.2017)
Operating System: Windows 10 Home x64
Ran by miros (Administrator) on 02.10.2020 at 14:58:15,67
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
File System: 0
Registry: 3
Successfully deleted: HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0D693991-2D67-40CB-8EFA-89BB8A7457B4} (Registry Key)
Successfully deleted: HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C} (Registry Key)
Successfully deleted: HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C} (Registry Key)
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 02.10.2020 at 14:59:49,55
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
- jaro3
- člen Security týmu
-
Guru Level 15
- Příspěvky: 43061
- Registrován: červen 07
- Bydliště: Jižní Čechy
- Pohlaví:
- Stav:
Offline
Re: Adware při startu Windows
Zavři ostatní aplikace a prohlížeče, odpoj se od netu a fixni v HJT:
Návod
TeamsMachineInstaller] %ProgramFiles%\Teams Installer\Teams.exe
https://answers.microsoft.com/en-us/win ... 919b8566b5
Kliknutím na odkaz níže si stáhnete malý bezplatný nástroj, který nevyžaduje instalaci
https: //docs.microsoft.com/en-us/sysinternals/d ...
Když se soubor stáhne, rozbalte jej.
V závislosti na vašem systému spusťte Autoruns nebo Autoruns64 jako správce
Vyberte kartu Přihlášení v Autoruns
Poté uvidíte položku „Program“, klikněte na ni pravým tlačítkem a zvolte Odstranit. . .
https://docs.microsoft.com/en-us/sysint ... s/autoruns
Stáhni si RogueKiller by Adlice Software
32bit.:
http://www.adlice.com/download/roguekil ... HlwZT14ODY
64bit.:
http://www.adlice.com/download/roguekil ... HlwZT14NjQ
na svojí plochu.
- Zavři všechny ostatní programy a prohlížeče.
- Pro OS Vista a win7,8,10 spusť program RogueKiller.exe jako správce , u XP poklepáním.
- klikni na „Start Scan“. V novém okně nic neměň a klikni dole na „Start Scan“
- Program skenuje procesy PC. Po proskenování klikni na „Open Report “ , v okně pak na „Open TXT“ a celý obsah logu sem zkopíruj.
Pokud je program blokován , zkus ho spustit několikrát. Pokud dále program nepůjde spustit a pracovat, přejmenuj ho na winlogon.exe.
-pokud bude mít log více než 60.000 znaků , rozděl ho a vlož do více příspěvků
další odkazy:
http://www.adlice.com/download/roguekiller/
http://www.bleepingcomputer.com/download/roguekiller/
Návod
Kód: Vybrat vše
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = %11%\blank.htm
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O4 - HKLM\..\Run: [TeamsMachineInstaller] %ProgramFiles%\Teams Installer\Teams.exe --checkInstall --source=PROPLUS
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
O4 - Global Startup: update.bat
TeamsMachineInstaller] %ProgramFiles%\Teams Installer\Teams.exe
https://answers.microsoft.com/en-us/win ... 919b8566b5
Kliknutím na odkaz níže si stáhnete malý bezplatný nástroj, který nevyžaduje instalaci
https: //docs.microsoft.com/en-us/sysinternals/d ...
Když se soubor stáhne, rozbalte jej.
V závislosti na vašem systému spusťte Autoruns nebo Autoruns64 jako správce
Vyberte kartu Přihlášení v Autoruns
Poté uvidíte položku „Program“, klikněte na ni pravým tlačítkem a zvolte Odstranit. . .
https://docs.microsoft.com/en-us/sysint ... s/autoruns
Stáhni si RogueKiller by Adlice Software
32bit.:
http://www.adlice.com/download/roguekil ... HlwZT14ODY
64bit.:
http://www.adlice.com/download/roguekil ... HlwZT14NjQ
na svojí plochu.
- Zavři všechny ostatní programy a prohlížeče.
- Pro OS Vista a win7,8,10 spusť program RogueKiller.exe jako správce , u XP poklepáním.
- klikni na „Start Scan“. V novém okně nic neměň a klikni dole na „Start Scan“
- Program skenuje procesy PC. Po proskenování klikni na „Open Report “ , v okně pak na „Open TXT“ a celý obsah logu sem zkopíruj.
Pokud je program blokován , zkus ho spustit několikrát. Pokud dále program nepůjde spustit a pracovat, přejmenuj ho na winlogon.exe.
-pokud bude mít log více než 60.000 znaků , rozděl ho a vlož do více příspěvků
další odkazy:
http://www.adlice.com/download/roguekiller/
http://www.bleepingcomputer.com/download/roguekiller/
Při práci s programy HJT, ComboFix,MbAM, SDFix aj. zavřete všechny ostatní aplikace a prohlížeče!
Neposílejte logy do soukromých zpráv.Po dobu mé nepřítomnosti mě zastupuje memphisto , Žbeky a Orcus.
Pokud budete spokojeni , můžete podpořit naše forum:Podpora fóra
Neposílejte logy do soukromých zpráv.Po dobu mé nepřítomnosti mě zastupuje memphisto , Žbeky a Orcus.
Pokud budete spokojeni , můžete podpořit naše forum:Podpora fóra
Re: Adware při startu Windows
Když otevřu ten link na RK, tak to hrozně trvá a pak se stáhne jenom .txt
Stáhnul jsem to teda jinak a nainstaloval jsem ho. Nic každopádně nenašel.
RogueKiller Anti-Malware V14.7.3.0 (x64) [Sep 15 2020] (Free) by Adlice Software
mail : https://adlice.com/contact/
Website : https://adlice.com/download/roguekiller/
Operating System : Windows 10 (10.0.18363) 64 bits
Started in : Normal mode
User : miros [Administrator]
Started from : C:\Program Files\RogueKiller\RogueKiller64.exe
Signatures : 20201001_073512, Driver : Loaded
Mode : Standard Scan, Scan -- Date : 2020/10/02 21:39:11 (Duration : 00:05:13)
Switches : -minimize
¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Processes ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤
¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Process Modules ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤
¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Services ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤
¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Tasks ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤
¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Registry ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤
¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ WMI ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤
¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Hosts File ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤
¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Files ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤
¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Web browsers ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤
¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Antirootkit : 0 (Driver: Loaded) ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤
"TeamsMachineInstaller] %ProgramFiles%\Teams Installer\Teams.exe" jsem odebral.
Stáhnul jsem to teda jinak a nainstaloval jsem ho. Nic každopádně nenašel.
RogueKiller Anti-Malware V14.7.3.0 (x64) [Sep 15 2020] (Free) by Adlice Software
mail : https://adlice.com/contact/
Website : https://adlice.com/download/roguekiller/
Operating System : Windows 10 (10.0.18363) 64 bits
Started in : Normal mode
User : miros [Administrator]
Started from : C:\Program Files\RogueKiller\RogueKiller64.exe
Signatures : 20201001_073512, Driver : Loaded
Mode : Standard Scan, Scan -- Date : 2020/10/02 21:39:11 (Duration : 00:05:13)
Switches : -minimize
¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Processes ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤
¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Process Modules ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤
¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Services ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤
¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Tasks ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤
¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Registry ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤
¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ WMI ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤
¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Hosts File ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤
¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Files ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤
¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Web browsers ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤
¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Antirootkit : 0 (Driver: Loaded) ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤
"TeamsMachineInstaller] %ProgramFiles%\Teams Installer\Teams.exe" jsem odebral.
Re: Adware při startu Windows
A je to pryč, při startu už nic nevyskakuje :) díky
Můžu zavřít?
Můžu zavřít?
- jaro3
- člen Security týmu
-
Guru Level 15
- Příspěvky: 43061
- Registrován: červen 07
- Bydliště: Jižní Čechy
- Pohlaví:
- Stav:
Offline
Re: Adware při startu Windows
Bohužel ne , to byl jen ten fix v HJT. Ono tam ještě něco bude.
Radím , abychom to vyčistili víc , než se to vrátí.
Vypni antivir i firewall.
Stáhni Zoek.exe
http://download.bleepingcomputer.com/smeenk/zoek.exe
Zavři všechny ostatní programy , okna i prohlížeče.
Spusť Zoek.exe ( u win vista , win7, 8 klikni na něj pravým a vyber : „Spustit jako správce“
-pozor , náběh programu může trvat déle.
Do okna programu vlož skript níže:
klikni na Run Script
Program provede sken , opravu, sken i oprava může trvat i více minut ,je třeba posečkat do konce. Do okna neklikej!
Program nabídne restart , potvrď .
Po restartu se může nějaký čas ukázat pouze černá plocha , to je normální. Je třeba počkat až se vytvoří log. Ten si můžeš uložit třeba do dokumentů , jinak se sám ukládá do:
C:\zoek-results.log Zkopíruj sem celý obsah toho logu.
Pokud budou problémy , spusť zoek v nouz. režimu.
Stáhni si Zemana AntiMalware Free z tohoto odkazu:
https://www.zemana.com/Download/AntiMal ... .Setup.exe
a ulož si ho na plochu.
Poklepej na tento soubor na ploše a postupuj podle pokynů k instalaci programu.
Přijmi licenci k používání programu EULA , pokud se nabídne.
Pokud je k dispozici aktualizace programu , klepni na tlačítko „Update now“ ( aktualizovat nyní).
Můžeš si zatrhnout i vytvoření bodu obnovy:
Klikni na ozubené kolečko , poté na „Skenování“ a zatrhni „vytvářet body obnovy“.
Vrať se zpět ( klikni na domeček).
Zavři všechny otevřené soubory, složky a prohlížeče
Neměň žádné nastavení. Klikni na „Skenovat“.
Po skenu lze vidět , zda jsou nějaké nákazy. Klikni na „Další“. Nákazy budou přemístěny do karantény.
Když je skenování dokončeno, objeví se tisková zpráva , zkopíruj sem celý obsah té zprávy.
Jinak můžeš zprávy vidět , když klikneš vpravo nahoře na „ zprávy“.
Pak nový HJT.
Radím , abychom to vyčistili víc , než se to vrátí.
Vypni antivir i firewall.
Stáhni Zoek.exe
http://download.bleepingcomputer.com/smeenk/zoek.exe
Zavři všechny ostatní programy , okna i prohlížeče.
Spusť Zoek.exe ( u win vista , win7, 8 klikni na něj pravým a vyber : „Spustit jako správce“
-pozor , náběh programu může trvat déle.
Do okna programu vlož skript níže:
Kód: Vybrat vše
autoclean;
resethosts;
emptyclsid;
IEdefaults;
FFdefaults;
CHRdefaults;
emptyIEcache;
emptyFFcache;
emptyCHRcache;
emptyalltemp;
emptyflash;
emptyjava;
emptyrecycle.bin;
klikni na Run Script
Program provede sken , opravu, sken i oprava může trvat i více minut ,je třeba posečkat do konce. Do okna neklikej!
Program nabídne restart , potvrď .
Po restartu se může nějaký čas ukázat pouze černá plocha , to je normální. Je třeba počkat až se vytvoří log. Ten si můžeš uložit třeba do dokumentů , jinak se sám ukládá do:
C:\zoek-results.log Zkopíruj sem celý obsah toho logu.
Pokud budou problémy , spusť zoek v nouz. režimu.
Stáhni si Zemana AntiMalware Free z tohoto odkazu:
https://www.zemana.com/Download/AntiMal ... .Setup.exe
a ulož si ho na plochu.
Poklepej na tento soubor na ploše a postupuj podle pokynů k instalaci programu.
Přijmi licenci k používání programu EULA , pokud se nabídne.
Pokud je k dispozici aktualizace programu , klepni na tlačítko „Update now“ ( aktualizovat nyní).
Můžeš si zatrhnout i vytvoření bodu obnovy:
Klikni na ozubené kolečko , poté na „Skenování“ a zatrhni „vytvářet body obnovy“.
Vrať se zpět ( klikni na domeček).
Zavři všechny otevřené soubory, složky a prohlížeče
Neměň žádné nastavení. Klikni na „Skenovat“.
Po skenu lze vidět , zda jsou nějaké nákazy. Klikni na „Další“. Nákazy budou přemístěny do karantény.
Když je skenování dokončeno, objeví se tisková zpráva , zkopíruj sem celý obsah té zprávy.
Jinak můžeš zprávy vidět , když klikneš vpravo nahoře na „ zprávy“.
Pak nový HJT.
Při práci s programy HJT, ComboFix,MbAM, SDFix aj. zavřete všechny ostatní aplikace a prohlížeče!
Neposílejte logy do soukromých zpráv.Po dobu mé nepřítomnosti mě zastupuje memphisto , Žbeky a Orcus.
Pokud budete spokojeni , můžete podpořit naše forum:Podpora fóra
Neposílejte logy do soukromých zpráv.Po dobu mé nepřítomnosti mě zastupuje memphisto , Žbeky a Orcus.
Pokud budete spokojeni , můžete podpořit naše forum:Podpora fóra
Re: Adware při startu Windows
Nedaří se mi stáhnout ani jedno. Ten první link na ZOEK redirectne na 404. A druhej link se automaticky zavírá.
U Zemany taky nefunguje stahování. Automaticky se to stahovat nezačne a když kliknu na "Your download should begin automatically, if not click here.", tak se nic neděje.
U Zemany taky nefunguje stahování. Automaticky se to stahovat nezačne a když kliknu na "Your download should begin automatically, if not click here.", tak se nic neděje.
Re: Adware při startu Windows
Tak Zemanu se mi podařilo stáhnout přes Edge, Chrome ji nestáhne.
Re: Adware při startu Windows
Informace o kontroly
Název produktu : Zemana AntiMalware
Stav kontroly : Dokončena
Datum kontroly : 03.10.2020 9:55:01
Typ kontroly : Inteligentní kontrola
Čas trvání : 00:00:09
Zkontrolované objekty : 2054
Zjištěné objekty : 1
Vyloučené objekty : 0
Automatické odesílání : Ano
Operační systém : Windows 10 x64
Procesor : 8X Intel(R) Core(TM) i7-7700HQ CPU @ 2.80GHz
Režim systému BIOS : UEFI
Informace o doméně : WORKGROUP,False,NetSetupWorkgroupName
CUID : 12016D81A37782AA2610F8
Odhalení
MD5 :
Stav : Zkontrolováno
Objekt : c:\users\miros\appdata\local\google\chrome\user data\default\extensions\ocdjppogihmiaookphgljdbcjemckmjl
Vydavatel :
Velikost : 0
Odhalení : HijackExt:ChromePlugin/Dark Theme for Youtube
Akce : Vymazat
-----------------------------------------------------------------------
Sakra, až teď koukám, že to byl můj Dark Theme pro Youtube
Název produktu : Zemana AntiMalware
Stav kontroly : Dokončena
Datum kontroly : 03.10.2020 9:55:01
Typ kontroly : Inteligentní kontrola
Čas trvání : 00:00:09
Zkontrolované objekty : 2054
Zjištěné objekty : 1
Vyloučené objekty : 0
Automatické odesílání : Ano
Operační systém : Windows 10 x64
Procesor : 8X Intel(R) Core(TM) i7-7700HQ CPU @ 2.80GHz
Režim systému BIOS : UEFI
Informace o doméně : WORKGROUP,False,NetSetupWorkgroupName
CUID : 12016D81A37782AA2610F8
Odhalení
MD5 :
Stav : Zkontrolováno
Objekt : c:\users\miros\appdata\local\google\chrome\user data\default\extensions\ocdjppogihmiaookphgljdbcjemckmjl
Vydavatel :
Velikost : 0
Odhalení : HijackExt:ChromePlugin/Dark Theme for Youtube
Akce : Vymazat
-----------------------------------------------------------------------
Sakra, až teď koukám, že to byl můj Dark Theme pro Youtube
Re: Adware při startu Windows
Tak ZOEK šel stáhnout taky přes Edge. Divný, že přes Chrome to nejde.
Zoek.exe v5.0.0.2 Updated 03-May-2018(Online Version)
Tool run by miros on 03.10.2020 at 9:57:30,07.
Microsoft Windows 10 Home 10.0.18363 x64
Running in: Normal Mode Internet Access Detected
Launched: C:\Users\miros\Desktop\zoek.exe [Scan all users] [Script inserted]
==== System Restore Info ======================
03.10.2020 9:58:41 Zoek.exe System Restore Point Created Successfully.
==== Reset Hosts File ======================
# Copyright (c) 1993-2006 Microsoft Corp.
#
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
#
# This file contains the mappings of IP addresses to host names. Each
# entry should be kept on an individual line. The IP address should
# be placed in the first column followed by the corresponding host name.
# The IP address and the host name should be separated by at least one
# space.
#
# Additionally, comments (such as these) may be inserted on individual
# lines or following the machine name denoted by a '#' symbol.
#
# For example:
#
# 102.54.94.97 rhino.acme.com # source server
# 38.25.63.10 x.acme.com # x client host
# localhost name resolution is handled within DNS itself.
127.0.0.1 localhost
::1 localhost
==== Empty Folders Check ======================
C:\PROGRA~3\SoftwareDistribution deleted successfully
C:\PROGRA~3\ssh deleted successfully
C:\Users\miros\AppData\Local\DBG deleted successfully
C:\WINDOWS\serviceprofiles\Localservice\AppData\Local\Packages deleted successfully
==== Deleting CLSID Registry Keys ======================
==== Deleting CLSID Registry Values ======================
==== Deleting Services ======================
==== FireFox Fix ======================
Deleted from C:\Users\miros\AppData\Roaming\Mozilla\Firefox\Profiles\uulv1rd7.default-release\prefs.js:
Added to C:\Users\miros\AppData\Roaming\Mozilla\Firefox\Profiles\uulv1rd7.default-release\prefs.js:
user_pref("browser.startup.homepage", "about:home");
user_pref("browser.newtab.url", "about:newtab");
ProfilePath: C:\Users\miros\AppData\Roaming\Mozilla\Firefox\Profiles\uulv1rd7.default-release
user.js not found
---- Lines searchengine removed from prefs.js ----
user_pref("browser.pageActions.persistedActions", "{\"version\":1,\"ids\":[\"bookmark\",\"pinTab\",\"bookmarkSeparator\",\"copyURL\",\"emailLink\",\"a
---- FireFox user.js and prefs.js backups ----
prefs__1033_.backup
==== Deleting Files \ Folders ======================
C:\Users\miros\.android deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Roaming\ETDCoInstaller.log deleted
C:\PROGRA~3\Package Cache deleted
C:\Users\miros\AppData\Local\cache deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\CM214FE.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\CM21530.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\CM21D17.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\CM22488.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\CM2268B.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\CM22A33.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\CM22B65.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\CM22BE8.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\CM22FCA.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\CM235B8.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\CM240EF.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\CM24523.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\CM2487A.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\CM2514A.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\CM25511.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\CM256BD.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\CM25883.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\CM26BEC.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\CM26CD2.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\CM27A64.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\CM27AFA.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\CM27F40.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\CM28433.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\CM285DE.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\CM286EE.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\CM28729.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\CM289BE.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\CM28B86.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\CM2927B.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\CM29F0D.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\CM2A7D4.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\CM2AE27.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\CM2B11D.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\CM2BC31.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\CM2BD58.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\CM2CC3.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\CM2D084.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\CM2D6E.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\CM2D8C7.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\CM2DA36.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\CM2DA78.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\CM2DB1F.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\CM2DD0A.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\CM2E6BF.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\CM2EA10.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\CM2EC6D.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\CM2EE19.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\CM2EF52.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\CM2F1A2.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\CM2F3D0.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\CM2F53E.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\CM2FB26.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\CM2FDC2.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tpm-29f0-2100-300399de.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tpm-323c-4230-bc3b634.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tpm-3c14-2e64-7cbfda8.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-108-bf4-355cad0c.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-108-bf4-355cad4e.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-108-bf4-355cad60.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-108-bf4-355cad62.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-108-bf4-355cad83.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-108-bf4-355caf3b.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-108-bf4-355cafaa.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-108-bf4-355caffa.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-108-bf4-355cb01c.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-108-bf4-355cb03d.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-108-bf4-355cb05e.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-108-bf4-355cb070.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-108-bf4-355cb0a1.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-108-bf4-355cb0b2.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-108-bf4-355cb0c4.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-108-bf4-355cb0d5.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-108-bf4-355cb0f7.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-108-bf4-355cb118.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-108-bf4-355cb11a.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-108-bf4-355cb12c.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-118c-55c-11b057d9.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-118c-55c-11b0581c.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-118c-55c-11b0581e.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-118c-55c-11b05820.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-118c-55c-11b05832.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-118c-55c-11b05834.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-118c-55c-11b05836.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-118c-55c-11b05838.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-118c-55c-11b05849.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-118c-55c-11b0584b.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-118c-55c-11b0584d.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-118c-55c-11b0584f.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-118c-55c-11b05851.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-118c-55c-11b05863.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-118c-55c-11b05865.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-118c-55c-11b05867.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-118c-55c-11b05869.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-118c-55c-11b0587a.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-118c-55c-11b0587c.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-118c-55c-11b0587e.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-11a8-21dc-f35081.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-11a8-21dc-f350c3.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-11a8-21dc-f350c5.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-11a8-21dc-f350c7.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-11a8-21dc-f350d9.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-11a8-21dc-f350db.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-11a8-21dc-f350dd.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-11a8-21dc-f350df.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-11a8-21dc-f350f1.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-11a8-21dc-f350f3.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-11a8-21dc-f350f5.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-11a8-21dc-f35106.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-11a8-21dc-f35108.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-11a8-21dc-f3510a.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-11a8-21dc-f3511c.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-11a8-21dc-f3511e.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-11a8-21dc-f35120.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-11a8-21dc-f35122.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-11a8-21dc-f35133.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-11a8-21dc-f35135.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-11ec-6ec-47871a53.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-11ec-6ec-47871a86.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-11ec-6ec-47871a88.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-11ec-6ec-47871a8a.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-11ec-6ec-47871a9b.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-11ec-6ec-47871a9d.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-11ec-6ec-47871a9f.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-11ec-6ec-47871ab1.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-11ec-6ec-47871ab3.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-11ec-6ec-47871ab5.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-11ec-6ec-47871ab7.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-11ec-6ec-47871ab9.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-11ec-6ec-47871acb.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-11ec-6ec-47871acd.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-11ec-6ec-47871acf.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-11ec-6ec-47871ad1.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-11ec-6ec-47871ae2.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-11ec-6ec-47871ae4.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-11ec-6ec-47871ae6.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-11ec-6ec-47871ae8.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-12ac-5e4c-78271455.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-12ac-5e4c-78271497.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-12ac-5e4c-78271499.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-12ac-5e4c-7827149b.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-12ac-5e4c-7827149d.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-12ac-5e4c-782714af.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-12ac-5e4c-782714b1.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-12ac-5e4c-782714b3.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-12ac-5e4c-782714c4.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-12ac-5e4c-782714c6.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-12ac-5e4c-782714c8.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-12ac-5e4c-782714ca.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-12ac-5e4c-782714dc.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-12ac-5e4c-782714de.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-12ac-5e4c-782714e0.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-12ac-5e4c-782714e2.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-12ac-5e4c-782714f4.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-12ac-5e4c-782714f6.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-12ac-5e4c-782714f8.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-12ac-5e4c-782714fa.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-131c-3960-2187eba2.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-131c-3960-2187ebe4.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-131c-3960-2187ec06.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-131c-3960-2187ec17.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-131c-3960-2187ec19.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-131c-3960-2187ec3b.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-131c-3960-2187ec4c.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-131c-3960-2187ec5e.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-131c-3960-2187ec6f.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-131c-3960-2187ec81.tmp deleted
Zoek.exe v5.0.0.2 Updated 03-May-2018(Online Version)
Tool run by miros on 03.10.2020 at 9:57:30,07.
Microsoft Windows 10 Home 10.0.18363 x64
Running in: Normal Mode Internet Access Detected
Launched: C:\Users\miros\Desktop\zoek.exe [Scan all users] [Script inserted]
==== System Restore Info ======================
03.10.2020 9:58:41 Zoek.exe System Restore Point Created Successfully.
==== Reset Hosts File ======================
# Copyright (c) 1993-2006 Microsoft Corp.
#
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
#
# This file contains the mappings of IP addresses to host names. Each
# entry should be kept on an individual line. The IP address should
# be placed in the first column followed by the corresponding host name.
# The IP address and the host name should be separated by at least one
# space.
#
# Additionally, comments (such as these) may be inserted on individual
# lines or following the machine name denoted by a '#' symbol.
#
# For example:
#
# 102.54.94.97 rhino.acme.com # source server
# 38.25.63.10 x.acme.com # x client host
# localhost name resolution is handled within DNS itself.
127.0.0.1 localhost
::1 localhost
==== Empty Folders Check ======================
C:\PROGRA~3\SoftwareDistribution deleted successfully
C:\PROGRA~3\ssh deleted successfully
C:\Users\miros\AppData\Local\DBG deleted successfully
C:\WINDOWS\serviceprofiles\Localservice\AppData\Local\Packages deleted successfully
==== Deleting CLSID Registry Keys ======================
==== Deleting CLSID Registry Values ======================
==== Deleting Services ======================
==== FireFox Fix ======================
Deleted from C:\Users\miros\AppData\Roaming\Mozilla\Firefox\Profiles\uulv1rd7.default-release\prefs.js:
Added to C:\Users\miros\AppData\Roaming\Mozilla\Firefox\Profiles\uulv1rd7.default-release\prefs.js:
user_pref("browser.startup.homepage", "about:home");
user_pref("browser.newtab.url", "about:newtab");
ProfilePath: C:\Users\miros\AppData\Roaming\Mozilla\Firefox\Profiles\uulv1rd7.default-release
user.js not found
---- Lines searchengine removed from prefs.js ----
user_pref("browser.pageActions.persistedActions", "{\"version\":1,\"ids\":[\"bookmark\",\"pinTab\",\"bookmarkSeparator\",\"copyURL\",\"emailLink\",\"a
---- FireFox user.js and prefs.js backups ----
prefs__1033_.backup
==== Deleting Files \ Folders ======================
C:\Users\miros\.android deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Roaming\ETDCoInstaller.log deleted
C:\PROGRA~3\Package Cache deleted
C:\Users\miros\AppData\Local\cache deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\CM214FE.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\CM21530.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\CM21D17.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\CM22488.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\CM2268B.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\CM22A33.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\CM22B65.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\CM22BE8.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\CM22FCA.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\CM235B8.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\CM240EF.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\CM24523.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\CM2487A.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\CM2514A.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\CM25511.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\CM256BD.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\CM25883.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\CM26BEC.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\CM26CD2.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\CM27A64.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\CM27AFA.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\CM27F40.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\CM28433.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\CM285DE.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\CM286EE.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\CM28729.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\CM289BE.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\CM28B86.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\CM2927B.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\CM29F0D.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\CM2A7D4.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\CM2AE27.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\CM2B11D.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\CM2BC31.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\CM2BD58.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\CM2CC3.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\CM2D084.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\CM2D6E.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\CM2D8C7.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\CM2DA36.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\CM2DA78.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\CM2DB1F.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\CM2DD0A.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\CM2E6BF.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\CM2EA10.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\CM2EC6D.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\CM2EE19.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\CM2EF52.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\CM2F1A2.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\CM2F3D0.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\CM2F53E.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\CM2FB26.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\CM2FDC2.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tpm-29f0-2100-300399de.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tpm-323c-4230-bc3b634.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tpm-3c14-2e64-7cbfda8.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-108-bf4-355cad0c.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-108-bf4-355cad4e.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-108-bf4-355cad60.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-108-bf4-355cad62.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-108-bf4-355cad83.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-108-bf4-355caf3b.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-108-bf4-355cafaa.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-108-bf4-355caffa.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-108-bf4-355cb01c.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-108-bf4-355cb03d.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-108-bf4-355cb05e.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-108-bf4-355cb070.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-108-bf4-355cb0a1.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-108-bf4-355cb0b2.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-108-bf4-355cb0c4.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-108-bf4-355cb0d5.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-108-bf4-355cb0f7.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-108-bf4-355cb118.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-108-bf4-355cb11a.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-108-bf4-355cb12c.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-118c-55c-11b057d9.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-118c-55c-11b0581c.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-118c-55c-11b0581e.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-118c-55c-11b05820.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-118c-55c-11b05832.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-118c-55c-11b05834.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-118c-55c-11b05836.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-118c-55c-11b05838.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-118c-55c-11b05849.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-118c-55c-11b0584b.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-118c-55c-11b0584d.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-118c-55c-11b0584f.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-118c-55c-11b05851.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-118c-55c-11b05863.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-118c-55c-11b05865.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-118c-55c-11b05867.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-118c-55c-11b05869.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-118c-55c-11b0587a.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-118c-55c-11b0587c.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-118c-55c-11b0587e.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-11a8-21dc-f35081.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-11a8-21dc-f350c3.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-11a8-21dc-f350c5.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-11a8-21dc-f350c7.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-11a8-21dc-f350d9.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-11a8-21dc-f350db.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-11a8-21dc-f350dd.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-11a8-21dc-f350df.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-11a8-21dc-f350f1.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-11a8-21dc-f350f3.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-11a8-21dc-f350f5.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-11a8-21dc-f35106.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-11a8-21dc-f35108.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-11a8-21dc-f3510a.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-11a8-21dc-f3511c.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-11a8-21dc-f3511e.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-11a8-21dc-f35120.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-11a8-21dc-f35122.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-11a8-21dc-f35133.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-11a8-21dc-f35135.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-11ec-6ec-47871a53.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-11ec-6ec-47871a86.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-11ec-6ec-47871a88.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-11ec-6ec-47871a8a.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-11ec-6ec-47871a9b.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-11ec-6ec-47871a9d.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-11ec-6ec-47871a9f.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-11ec-6ec-47871ab1.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-11ec-6ec-47871ab3.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-11ec-6ec-47871ab5.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-11ec-6ec-47871ab7.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-11ec-6ec-47871ab9.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-11ec-6ec-47871acb.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-11ec-6ec-47871acd.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-11ec-6ec-47871acf.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-11ec-6ec-47871ad1.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-11ec-6ec-47871ae2.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-11ec-6ec-47871ae4.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-11ec-6ec-47871ae6.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-11ec-6ec-47871ae8.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-12ac-5e4c-78271455.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-12ac-5e4c-78271497.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-12ac-5e4c-78271499.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-12ac-5e4c-7827149b.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-12ac-5e4c-7827149d.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-12ac-5e4c-782714af.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-12ac-5e4c-782714b1.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-12ac-5e4c-782714b3.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-12ac-5e4c-782714c4.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-12ac-5e4c-782714c6.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-12ac-5e4c-782714c8.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-12ac-5e4c-782714ca.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-12ac-5e4c-782714dc.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-12ac-5e4c-782714de.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-12ac-5e4c-782714e0.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-12ac-5e4c-782714e2.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-12ac-5e4c-782714f4.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-12ac-5e4c-782714f6.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-12ac-5e4c-782714f8.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-12ac-5e4c-782714fa.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-131c-3960-2187eba2.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-131c-3960-2187ebe4.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-131c-3960-2187ec06.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-131c-3960-2187ec17.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-131c-3960-2187ec19.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-131c-3960-2187ec3b.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-131c-3960-2187ec4c.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-131c-3960-2187ec5e.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-131c-3960-2187ec6f.tmp deleted
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\tw-131c-3960-2187ec81.tmp deleted
Re: Adware při startu Windows
Pak to pokračuje naprosto stejně na dalším milionu řádků.
a pak:
==== Orphaned Tasks deleted from Registry ======================
Lenovo\ImController\Plugins\LenovoSystemUpdatePlugin_TVSUUpdateTask_Once deleted
==== Firefox Start and Search pages ======================
ProfilePath: C:\Users\miros\AppData\Roaming\Mozilla\Firefox\Profiles\uulv1rd7.default-release
user_pref("browser.startup.homepage", "about:home");
user_pref("browser.newtab.url", "about:newtab");
==== Firefox Extensions ======================
==== Firefox Plugins ======================
Profilepath: C:\Users\miros\AppData\Roaming\Mozilla\Firefox\Profiles\uulv1rd7.default-release
22C00F56EB698A1A0AC49FBB47BB97B2 - C:\Program Files\Microsoft Office\root\Office16\NPSPWRAP.DLL - Microsoft Office
D5C25FABAB84753E78CAABF0DBDAECF1 - C:\Program Files\VideoLAN\VLC\npvlc.dll - VLC Web Plugin
- C:\Program Files\Java\jre1.8.0_251\bin\dtplugin\npdeployJava1.dll - [?]
- C:\Program Files\Java\jre1.8.0_251\bin\plugin2\npjp2.dll - [?]
==== Chromium Look ======================
Google Chrome Version: 85.0.4183.121
Chrome Media Router - miros\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm
undetermined - miros\AppData\Local\Google\Chrome\User Data\Default\Extensions\ocdjppogihmiaookphgljdbcjemckmjl
==== Set IE to Default ======================
Old Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"="http://lenovo17win10.msn.com/?pc=LCTE"
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes]
"DefaultScope"="{0D693991-2D67-40CB-8EFA-89BB8A7457B4}"
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0D693991-2D67-40CB-8EFA-89BB8A7457B4}] not found
New Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"="http://lenovo17win10.msn.com/?pc=LCTE"
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes]
"DefaultScope"="{012E1000-F331-11DB-8314-0800200C9A66}"
==== All HKLM and HKCU SearchScopes ======================
HKLM\SearchScopes "DefaultScope"="{0D693991-2D67-40CB-8EFA-89BB8A7457B4}"
HKLM\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} - http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
HKLM\SearchScopes\{0D693991-2D67-40CB-8EFA-89BB8A7457B4} - http://www.bing.com/search?q={searchTerms}&form=PRLNC1&src=IE11TR&pc=LCTE
HKLM\Wow6432Node\SearchScopes "DefaultScope"="{0D693991-2D67-40CB-8EFA-89BB8A7457B4}"
HKLM\Wow6432Node\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} - http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
HKLM\Wow6432Node\SearchScopes\{0D693991-2D67-40CB-8EFA-89BB8A7457B4} - http://www.bing.com/search?q={searchTerms}&form=PRLNC1&src=IE11TR&pc=LCTE
HKCU\SearchScopes "DefaultScope"="{012E1000-F331-11DB-8314-0800200C9A66}"
HKCU\SearchScopes\{012E1000-F331-11DB-8314-0800200C9A66} - http://www.google.com/search?q={searchTerms}
HKCU\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} - http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IESR02
==== Reset Google Chrome ======================
C:\Users\miros\AppData\Local\Google\Chrome\User Data\Default\Preferences was reset successfully
C:\Users\miros\AppData\Local\Google\Chrome\User Data\Default\Preferences.bak was reset successfully
C:\Users\miros\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences was reset successfully
C:\Users\miros\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences.bak was reset successfully
C:\Users\miros\AppData\Local\Microsoft\Edge\User Data\Default\Preferences was reset successfully
C:\Users\miros\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences was reset successfully
C:\Users\miros\AppData\Local\Google\Chrome\User Data\Default\Web Data was reset successfully
C:\Users\miros\AppData\Local\Google\Chrome\User Data\Default\Web Data-journal was reset successfully
C:\Users\miros\AppData\Local\Microsoft\Edge\User Data\Default\Web Data was reset successfully
C:\Users\miros\AppData\Local\Microsoft\Edge\User Data\Default\Web Data-journal was reset successfully
==== Deleting Registry Keys ======================
HKEY_LOCAL_MACHINE\Software\wow6432node\Policies\Google deleted successfully
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{DCB4DFB5-93CA-4BDD-9D08-CE880626B46E}_is1 deleted successfully
==== Empty IE Cache ======================
C:\WINDOWS\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\miros\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 emptied successfully
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 emptied successfully
C:\WINDOWS\sysWoW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 emptied successfully
C:\WINDOWS\serviceprofiles\Localservice\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 emptied successfully
C:\WINDOWS\sysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 emptied successfully
C:\Users\miros\AppData\Local\Microsoft\Windows\INetCache\IE emptied successfully
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE emptied successfully
C:\WINDOWS\sysWoW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE emptied successfully
C:\WINDOWS\serviceprofiles\Localservice\AppData\Local\Microsoft\Windows\INetCache\IE emptied successfully
==== Empty FireFox Cache ======================
No FireFox Cache found
==== Empty Edge Cache ======================
Edge Cache Emptied Successfully
==== Empty Chrome Cache ======================
C:\Users\miros\AppData\Local\Google\Chrome\User Data\Default\Cache emptied successfully
C:\Users\miros\AppData\Local\Microsoft\Edge\User Data\Default\Cache emptied successfully
==== Empty All Flash Cache ======================
No Flash Cache Found
==== Empty All Java Cache ======================
No Java Cache Found
==== C:\zoek_backup content ======================
C:\zoek_backup (files=61 folders=4980 68955093 bytes)
==== Empty Temp Folders ======================
C:\Users\Default\AppData\Local\Temp emptied successfully
C:\Users\Default User\AppData\Local\Temp emptied successfully
C:\Users\miros\AppData\Local\Temp will be emptied at reboot
C:\WINDOWS\serviceprofiles\networkservice\AppData\Local\Temp emptied successfully
C:\WINDOWS\serviceprofiles\Localservice\AppData\Local\Temp emptied successfully
C:\WINDOWS\Temp will be emptied at reboot
==== After Reboot ======================
==== Empty Temp Folders ======================
C:\WINDOWS\Temp successfully emptied
C:\Users\miros\AppData\Local\Temp successfully emptied
==== Empty Recycle Bin ======================
C:\$RECYCLE.BIN successfully emptied
==== EOF on 03.10.2020 at 12:36:22,57 ======================
a pak:
==== Orphaned Tasks deleted from Registry ======================
Lenovo\ImController\Plugins\LenovoSystemUpdatePlugin_TVSUUpdateTask_Once deleted
==== Firefox Start and Search pages ======================
ProfilePath: C:\Users\miros\AppData\Roaming\Mozilla\Firefox\Profiles\uulv1rd7.default-release
user_pref("browser.startup.homepage", "about:home");
user_pref("browser.newtab.url", "about:newtab");
==== Firefox Extensions ======================
==== Firefox Plugins ======================
Profilepath: C:\Users\miros\AppData\Roaming\Mozilla\Firefox\Profiles\uulv1rd7.default-release
22C00F56EB698A1A0AC49FBB47BB97B2 - C:\Program Files\Microsoft Office\root\Office16\NPSPWRAP.DLL - Microsoft Office
D5C25FABAB84753E78CAABF0DBDAECF1 - C:\Program Files\VideoLAN\VLC\npvlc.dll - VLC Web Plugin
- C:\Program Files\Java\jre1.8.0_251\bin\dtplugin\npdeployJava1.dll - [?]
- C:\Program Files\Java\jre1.8.0_251\bin\plugin2\npjp2.dll - [?]
==== Chromium Look ======================
Google Chrome Version: 85.0.4183.121
Chrome Media Router - miros\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm
undetermined - miros\AppData\Local\Google\Chrome\User Data\Default\Extensions\ocdjppogihmiaookphgljdbcjemckmjl
==== Set IE to Default ======================
Old Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"="http://lenovo17win10.msn.com/?pc=LCTE"
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes]
"DefaultScope"="{0D693991-2D67-40CB-8EFA-89BB8A7457B4}"
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0D693991-2D67-40CB-8EFA-89BB8A7457B4}] not found
New Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"="http://lenovo17win10.msn.com/?pc=LCTE"
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes]
"DefaultScope"="{012E1000-F331-11DB-8314-0800200C9A66}"
==== All HKLM and HKCU SearchScopes ======================
HKLM\SearchScopes "DefaultScope"="{0D693991-2D67-40CB-8EFA-89BB8A7457B4}"
HKLM\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} - http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
HKLM\SearchScopes\{0D693991-2D67-40CB-8EFA-89BB8A7457B4} - http://www.bing.com/search?q={searchTerms}&form=PRLNC1&src=IE11TR&pc=LCTE
HKLM\Wow6432Node\SearchScopes "DefaultScope"="{0D693991-2D67-40CB-8EFA-89BB8A7457B4}"
HKLM\Wow6432Node\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} - http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
HKLM\Wow6432Node\SearchScopes\{0D693991-2D67-40CB-8EFA-89BB8A7457B4} - http://www.bing.com/search?q={searchTerms}&form=PRLNC1&src=IE11TR&pc=LCTE
HKCU\SearchScopes "DefaultScope"="{012E1000-F331-11DB-8314-0800200C9A66}"
HKCU\SearchScopes\{012E1000-F331-11DB-8314-0800200C9A66} - http://www.google.com/search?q={searchTerms}
HKCU\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} - http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IESR02
==== Reset Google Chrome ======================
C:\Users\miros\AppData\Local\Google\Chrome\User Data\Default\Preferences was reset successfully
C:\Users\miros\AppData\Local\Google\Chrome\User Data\Default\Preferences.bak was reset successfully
C:\Users\miros\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences was reset successfully
C:\Users\miros\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences.bak was reset successfully
C:\Users\miros\AppData\Local\Microsoft\Edge\User Data\Default\Preferences was reset successfully
C:\Users\miros\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences was reset successfully
C:\Users\miros\AppData\Local\Google\Chrome\User Data\Default\Web Data was reset successfully
C:\Users\miros\AppData\Local\Google\Chrome\User Data\Default\Web Data-journal was reset successfully
C:\Users\miros\AppData\Local\Microsoft\Edge\User Data\Default\Web Data was reset successfully
C:\Users\miros\AppData\Local\Microsoft\Edge\User Data\Default\Web Data-journal was reset successfully
==== Deleting Registry Keys ======================
HKEY_LOCAL_MACHINE\Software\wow6432node\Policies\Google deleted successfully
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{DCB4DFB5-93CA-4BDD-9D08-CE880626B46E}_is1 deleted successfully
==== Empty IE Cache ======================
C:\WINDOWS\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\miros\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 emptied successfully
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 emptied successfully
C:\WINDOWS\sysWoW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 emptied successfully
C:\WINDOWS\serviceprofiles\Localservice\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 emptied successfully
C:\WINDOWS\sysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 emptied successfully
C:\Users\miros\AppData\Local\Microsoft\Windows\INetCache\IE emptied successfully
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE emptied successfully
C:\WINDOWS\sysWoW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE emptied successfully
C:\WINDOWS\serviceprofiles\Localservice\AppData\Local\Microsoft\Windows\INetCache\IE emptied successfully
==== Empty FireFox Cache ======================
No FireFox Cache found
==== Empty Edge Cache ======================
Edge Cache Emptied Successfully
==== Empty Chrome Cache ======================
C:\Users\miros\AppData\Local\Google\Chrome\User Data\Default\Cache emptied successfully
C:\Users\miros\AppData\Local\Microsoft\Edge\User Data\Default\Cache emptied successfully
==== Empty All Flash Cache ======================
No Flash Cache Found
==== Empty All Java Cache ======================
No Java Cache Found
==== C:\zoek_backup content ======================
C:\zoek_backup (files=61 folders=4980 68955093 bytes)
==== Empty Temp Folders ======================
C:\Users\Default\AppData\Local\Temp emptied successfully
C:\Users\Default User\AppData\Local\Temp emptied successfully
C:\Users\miros\AppData\Local\Temp will be emptied at reboot
C:\WINDOWS\serviceprofiles\networkservice\AppData\Local\Temp emptied successfully
C:\WINDOWS\serviceprofiles\Localservice\AppData\Local\Temp emptied successfully
C:\WINDOWS\Temp will be emptied at reboot
==== After Reboot ======================
==== Empty Temp Folders ======================
C:\WINDOWS\Temp successfully emptied
C:\Users\miros\AppData\Local\Temp successfully emptied
==== Empty Recycle Bin ======================
C:\$RECYCLE.BIN successfully emptied
==== EOF on 03.10.2020 at 12:36:22,57 ======================
- jaro3
- člen Security týmu
-
Guru Level 15
- Příspěvky: 43061
- Registrován: červen 07
- Bydliště: Jižní Čechy
- Pohlaví:
- Stav:
Offline
Re: Adware při startu Windows
Vlož nový log z HJT
Vypni antivir i firewall.
Prosím stáhni příslušnou verzi programu pro Tvůj systém 32-bit/64-bit FarbarRecovery Scan Tool (FrSt)
32bit.:
http://www.bleepingcomputer.com/downloa ... ool/dl/81/
64bit.:
http://www.bleepingcomputer.com/downloa ... ool/dl/82/
další odkaz:
http://www.bleepingcomputer.com/downloa ... scan-tool/
a ulož jej na plochu. ,pak spusť FrSt.
Potvrď způsob užití.
Neměň žádné z výchozích nastavení a klikni na položku „Scan“ („Skenovat“) .Když je skenování dokončeno, ukážou se dva logy = FRST.txt a Addition.txt a uloží se na ploše.Prosím zkopíruj sem celý jejich obsah.
Vypni antivir i firewall.
Prosím stáhni příslušnou verzi programu pro Tvůj systém 32-bit/64-bit FarbarRecovery Scan Tool (FrSt)
32bit.:
http://www.bleepingcomputer.com/downloa ... ool/dl/81/
64bit.:
http://www.bleepingcomputer.com/downloa ... ool/dl/82/
další odkaz:
http://www.bleepingcomputer.com/downloa ... scan-tool/
a ulož jej na plochu. ,pak spusť FrSt.
Potvrď způsob užití.
Neměň žádné z výchozích nastavení a klikni na položku „Scan“ („Skenovat“) .Když je skenování dokončeno, ukážou se dva logy = FRST.txt a Addition.txt a uloží se na ploše.Prosím zkopíruj sem celý jejich obsah.
Při práci s programy HJT, ComboFix,MbAM, SDFix aj. zavřete všechny ostatní aplikace a prohlížeče!
Neposílejte logy do soukromých zpráv.Po dobu mé nepřítomnosti mě zastupuje memphisto , Žbeky a Orcus.
Pokud budete spokojeni , můžete podpořit naše forum:Podpora fóra
Neposílejte logy do soukromých zpráv.Po dobu mé nepřítomnosti mě zastupuje memphisto , Žbeky a Orcus.
Pokud budete spokojeni , můžete podpořit naše forum:Podpora fóra
Kdo je online
Uživatelé prohlížející si toto fórum: Žádní registrovaní uživatelé a 10 hostů