Prosím o preventivní kontrolu logu, pomalý internet

[zdenek6041]

Děkuji, prchat tedy nebudu.

[Mc_Murphy]

Takže resumé:

Dohodl jsem se s kolegou, že Tvůj problém dořeším. Choval jsi se slušně a to se tu opravdu cení - alespoň tedy u mě hodně.
Každopádně ale máš systém nelegální a napříště je potřeba to náležitě ošetřit, čili zakoupit si systém legální. Pokud máš nějaký kontakt na člověka, který Ti PC prodal, rozhodně mu srdečně poděkuj, protože Tě obelhal.
Byla Ti napsána interní poznámka o nelegálnosti systému, takže věz, že pokud bys to zkusil příště, bude to znamenat odepření pomoci a následně pravděpodobně i BAN z fóra.

[Mc_Murphy]

Takže Body obnovy obnoveny, fixy fixnuty, nálezy smazány, MBAM odinstalován?

Jestli ano, pokračujeme s OTL.

Znovu spusť OTL.

• Pokud používáš Win Vista či Win7, klikni na OTL pravým myšítkem a dej Run As Administrator či Spustit jako správce.
• Pokud používáš 64bitový OS, zkontroluj, zda-li je zaškrtnutý čtvereček Pro 64 bitové OS. Pokud ne, zaškrtni jej.
• Do spodního okénka Vlastní skenování/opravy vlož tento script (pouze zelená písmenka v bílém poli!):

Kód: Vybrat vše

:Commands
[emptytemp]
[emptyflash]
[resethosts]
[purity]
[clearallrestorepoints]

:Services
Nero BackItUp Scheduler 3

:OTL
SRV - File not found [Auto | Stopped] -- -- (RelevantKnowledge)
FF - prefs.js..extensions.enabledItems: {c50ca3c4-5656-43c2-a061-13e717f73fc8}:4.0.1
FF - prefs.js..keyword.URL: "http://search.seznam.cz/?sourceid=FF_5&q="
File not found (No name found) -- C:\USERS\ZDENěK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0B9O5YSX.DEFAULT\EXTENSIONS\{C50CA3C4-5656-43C2-A061-13E717F73FC8}.XPI
File not found (No name found) -- C:\USERS\ZDENěK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0B9O5YSX.DEFAULT\EXTENSIONS\{D10D0BF8-F5B5-C8B4-A8B2-2B9879E08C5D}.XPI
File not found (No name found) -- C:\USERS\ZDENěK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0B9O5YSX.DEFAULT\EXTENSIONS\{EA614400-E918-4741-9A97-7A972FF7C30B}
O3 - HKU\S-1-5-21-1358791482-1641505188-3195120349-1001\..\Toolbar\WebBrowser: (no name) - {32099AAC-C132-4136-9E9A-4E364A424E17} - No CLSID value found.
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
[4 C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\*.tmp files -> C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\*.tmp -> ]
[18 C:\Windows\Installer\*.tmp files -> C:\Windows\Installer\*.tmp -> ]
[1 C:\Windows\Installer\{CC6B1BB4-4E06-4A5B-A166-B371B551324B}\*.tmp files -> C:\Windows\Installer\{CC6B1BB4-4E06-4A5B-A166-B371B551324B}\*.tmp -> ]
[1 C:\Windows\SoftwareDistribution\Download\4b9a452ad1f9a97fc5e95c43cd5e6201\*.tmp files -> C:\Windows\SoftwareDistribution\Download\4b9a452ad1f9a97fc5e95c43cd5e6201\*.tmp -> ]
@Alternate Data Stream - 6144 bytes -> C:\Windows\Cursors\arrow_n.cur:NEDTA.DAT
@Alternate Data Stream - 124 bytes -> C:\ProgramData\TEMP:8A5B0737

:Files
C:\Users\Zdeněk\AppData\Roaming\TuneUp Software
C:\Windows\Tasks\DLL-files.com Fixer_MONTHLY.job
C:\Windows\Tasks\DLL-files.com Fixer_UPDATES.job
C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
%windir%\system32\*.tmp.dll /s
%windir%\system32\SET*.tmp /s
%windir%\*.tmp /s

:Reg
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\OptionalComponents]
""=-
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\IMAIL]
""=-
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MAPI]
""=-
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MSFS]
""=-

• Klikni na tlačítko [Opravit].
• Po dokončení skenu se objeví log, ten mi sem vlož.
• Pokud se log nevejde do jednoho příspěvku, rozděl jej na více částí.

[zdenek6041]

Ahoj tady je log z OTL

All processes killed
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 41620 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Public

User: UpdatusUser
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Zdeněk
->Temp folder emptied: 26370820 bytes
->Temporary Internet Files folder emptied: 2700709 bytes
->Java cache emptied: 1207370 bytes
->FireFox cache emptied: 360479539 bytes
->Google Chrome cache emptied: 6408508 bytes
->Flash cache emptied: 7586 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 7451072 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 0 bytes
RecycleBin emptied: 238649218 bytes

Total Files Cleaned = 614,00 mb


[EMPTYFLASH]

User: All Users

User: Default
->Flash cache emptied: 0 bytes

User: Default User
->Flash cache emptied: 0 bytes

User: Public

User: UpdatusUser

User: Zdeněk
->Flash cache emptied: 0 bytes

Total Flash Files Cleaned = 0,00 mb

C:\Windows\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully

========== SERVICES/DRIVERS ==========
Service Nero BackItUp Scheduler 3 stopped successfully!
Service Nero BackItUp Scheduler 3 deleted successfully!
========== OTL ==========
Service RelevantKnowledge stopped successfully!
Service RelevantKnowledge deleted successfully!
Prefs.js: {c50ca3c4-5656-43c2-a061-13e717f73fc8}:4.0.1 removed from extensions.enabledItems
Prefs.js: "http://search.seznam.cz/?sourceid=FF_5&q=" removed from keyword.URL
Registry value HKEY_USERS\S-1-5-21-1358791482-1641505188-3195120349-1001\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{32099AAC-C132-4136-9E9A-4E364A424E17} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{32099AAC-C132-4136-9E9A-4E364A424E17}\ not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\VMApplet:/pagefile deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\\WebCheck deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\ not found.
C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\ZAP37C2.tmp folder deleted successfully.
C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\ZAP5E64.tmp folder deleted successfully.
C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\ZAP8545.tmp folder deleted successfully.
C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\ZAP9F1C.tmp folder deleted successfully.
C:\Windows\Installer\MSI3CA4.tmp deleted successfully.
C:\Windows\Installer\MSI44A1.tmp deleted successfully.
C:\Windows\Installer\MSI807.tmp deleted successfully.
C:\Windows\Installer\MSI834C.tmp deleted successfully.
C:\Windows\Installer\MSI84B4.tmp deleted successfully.
C:\Windows\Installer\MSI89B1.tmp deleted successfully.
C:\Windows\Installer\MSI8A6D.tmp deleted successfully.
C:\Windows\Installer\MSI8F2.tmp deleted successfully.
C:\Windows\Installer\MSI9B8.tmp deleted successfully.
C:\Windows\Installer\MSIAE6.tmp deleted successfully.
C:\Windows\Installer\MSIC10.tmp deleted successfully.
C:\Windows\Installer\MSICB08.tmp deleted successfully.
C:\Windows\Installer\MSICBC4.tmp deleted successfully.
C:\Windows\Installer\MSICD89.tmp deleted successfully.
C:\Windows\Installer\MSICE45.tmp deleted successfully.
C:\Windows\Installer\MSID340.tmp deleted successfully.
C:\Windows\Installer\MSID68B.tmp deleted successfully.
C:\Windows\Installer\MSIF35A.tmp deleted successfully.
C:\Windows\Installer\{CC6B1BB4-4E06-4A5B-A166-B371B551324B}\upd7F.tmp deleted successfully.
C:\Windows\SoftwareDistribution\Download\4b9a452ad1f9a97fc5e95c43cd5e6201\BIT8AF3.tmp deleted successfully.
ADS C:\Windows\Cursors\arrow_n.cur:NEDTA.DAT deleted successfully.
ADS C:\ProgramData\TEMP:8A5B0737 deleted successfully.
========== FILES ==========
C:\Users\Zdeněk\AppData\Roaming\TuneUp Software\TuneUp Utilities 2011\WinStyler\LogoAnimations folder moved successfully.
C:\Users\Zdeněk\AppData\Roaming\TuneUp Software\TuneUp Utilities 2011\WinStyler folder moved successfully.
C:\Users\Zdeněk\AppData\Roaming\TuneUp Software\TuneUp Utilities 2011 folder moved successfully.
C:\Users\Zdeněk\AppData\Roaming\TuneUp Software\TU2011\WinStyler\LogonScreens\Cache folder moved successfully.
C:\Users\Zdeněk\AppData\Roaming\TuneUp Software\TU2011\WinStyler\LogonScreens folder moved successfully.
C:\Users\Zdeněk\AppData\Roaming\TuneUp Software\TU2011\WinStyler\LogoAnimations\Cache folder moved successfully.
C:\Users\Zdeněk\AppData\Roaming\TuneUp Software\TU2011\WinStyler\LogoAnimations folder moved successfully.
C:\Users\Zdeněk\AppData\Roaming\TuneUp Software\TU2011\WinStyler\BootScreens\Cache folder moved successfully.
C:\Users\Zdeněk\AppData\Roaming\TuneUp Software\TU2011\WinStyler\BootScreens folder moved successfully.
C:\Users\Zdeněk\AppData\Roaming\TuneUp Software\TU2011\WinStyler folder moved successfully.
C:\Users\Zdeněk\AppData\Roaming\TuneUp Software\TU2011\TuningIndex folder moved successfully.
C:\Users\Zdeněk\AppData\Roaming\TuneUp Software\TU2011\TuneUp Registry Editor folder moved successfully.
C:\Users\Zdeněk\AppData\Roaming\TuneUp Software\TU2011\StartUp Manager folder moved successfully.
C:\Users\Zdeněk\AppData\Roaming\TuneUp Software\TU2011\Speed Optimizer folder moved successfully.
C:\Users\Zdeněk\AppData\Roaming\TuneUp Software\TU2011\Dashboard folder moved successfully.
C:\Users\Zdeněk\AppData\Roaming\TuneUp Software\TU2011\Backups folder moved successfully.
C:\Users\Zdeněk\AppData\Roaming\TuneUp Software\TU2011 folder moved successfully.
C:\Users\Zdeněk\AppData\Roaming\TuneUp Software folder moved successfully.
C:\Windows\Tasks\DLL-files.com Fixer_MONTHLY.job moved successfully.
C:\Windows\Tasks\DLL-files.com Fixer_UPDATES.job moved successfully.
C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job moved successfully.
C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job moved successfully.
File/Folder C:\Windows\system32\*.tmp.dll not found.
File/Folder C:\Windows\system32\SET*.tmp not found.
File/Folder C:\Windows\*.tmp not found.
========== REGISTRY ==========
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\\ deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\IMAIL\\ deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MAPI\\ deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MSFS\\ deleted successfully.

OTL by OldTimer - Version 3.2.31.0 log created on 01072012_204639

Files\Folders moved on Reboot...
File move failed. C:\Windows\temp\_avast_\Webshlock.txt scheduled to be moved on reboot.

Registry entries deleted on Reboot...

[Mc_Murphy]

OK, OTL provedlo, co mělo.

Ještě uděláme drobnost, protože jsem na to zapomněl.

Stáhni a ulož na Plochu http://jpshortstuff.247fixes.com/SystemLook.exe nebo http://images.malwareremoval.com/jpshor ... emLook.exe

• Dvojklikem na ikonu program spusť.
• Do bílého okénka zkopíruj zelený text z následujícího bílého pole.

Kód: Vybrat vše

:filefind
*RelevantKnowledge*

:folderfind
*RelevantKnowledge*

:regfind
RelevantKnowledge

• Klikni na Look, po dokončení skenu na Tebe vyskočí log, zkopíruj mi ho sem.
• Log se také bude nacházet na Ploše, v souboru SystemLook.txt

Možná to bude déle trvat, tak vydrž. Chci si jen ověřit, že v PC nemáš zbytky po této více méně havěti.

[zdenek6041]

SystemLook 30.07.11 by jpshortstuff
Log created at 09:31 on 08/01/2012 by Zdeněk
Administrator - Elevation successful

========== filefind ==========

Searching for "*RelevantKnowledge*"
No files found.

========== folderfind ==========

Searching for "*RelevantKnowledge*"
No folders found.

========== regfind ==========

Searching for "RelevantKnowledge"
No data found.

-= EOF =-

[Mc_Murphy]

OK, nikde nic, tak to dočistíme.

T-Cleaner http://vyosek.ic.cz/pro_usery/T-Cleaner.exe

• Stáhni a spusť.
• Pro potvrzení volby mačkej A, Enter.
• Po použití utilitu smaž.
• Antiviry mohou tuto utilitu chybně označit jako vir - jedná se o falešný poplach - takže v pohodě stáhni (případně vypni při stahování antivir).

Spusť znovu OTL a klikni na tlačítko [CleanUp!], čímž po sobě program uklidí.

TFC http://oldtimer.geekstogo.com/TFC.exe

• Stáhni a spusť.
• Klikni na Start a potvrď OK.
• Program uklidí a může (nemusí) restartovat PC.
• Po použití utilitu smaž.

Pokud nemáš, stáhni CCleaner z tohoto odkazu.

• Panel čistič
• Vše nech jak je, jen dej Analyzovat a poté Spustit CCleaner.

• Panel registry
• Klikni na Hledej problémy.
• Následně na Opravit problémy - zálohu registrů doporučuji udělat, oprav všechny problémy.
• Postup opakuj, dokud nebude bez problémů - většinou cca 3x.

• Panel nástroje
• Zde můžeš odinstalovat nepotřebné programy.

CCleaner doporučuji používat cca jednou za týden.

... a pokud nejsou žádné dotazy, bylo by to z mé strany vše.

[zdenek6041]

Ahoj, je to vše, děkuji moc za pomoc.
Přeji hezký den.

[Mc_Murphy]

A do příště si dej do pořádku ten systém.

Není tedy vůbec zač a rádo se stalo. Přeji pěkný den.