Kontrola - pomalejší PC

[vyosek]

Zakladem ochrany je rozum, ten mate, a dale i kdyz je tam vse jak ma, tak autori mlwaru jsou neustale o krok napred, takze se tam havet dostat muze

Nalezy z RogueKilleru netreba mazat, jsou to jen zbytecnosti

s temi maily netusim, registracni mail mate na atlasu

Spustte znovu OTL

• Pokud pouzivate Win Vista ci W7, kliknete na OTL pravym a dejte Run As Administrator ci Spustit jako spravce
• Do spodniho okenka Vlastni skenovani/opravy vlozte skript nize

• Kód: Vybrat vše

  :otl
  IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
  IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
  IE - HKU\S-1-5-21-602162358-484763869-725345543-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://search.conduit.com?SearchSource= ... =CT2645238
  IE - HKU\S-1-5-21-602162358-484763869-725345543-1003\..\SearchScopes,DefaultScope = {afdbddaa-5d3f-42ee-b79c-185a7020515b}
  IE - HKU\S-1-5-21-602162358-484763869-725345543-1003\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
  IE - HKU\S-1-5-21-602162358-484763869-725345543-1003\..\SearchScopes\{70D46D94-BF1E-45ED-B567-48701376298E}: "URL" = http://127.0.0.1:4664/search&s=1B4vLubb ... VHXH9Zk?q={searchTerms}
  IE - HKU\S-1-5-21-602162358-484763869-725345543-1003\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2645238
  IE - HKU\S-1-5-21-602162358-484763869-725345543-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = fritz.fonata.box;local
  FF - prefs.js..browser.search.defaulturl: "http://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q="
  FF - prefs.js..keyword.URL: "http://www.google.com/search?ie=UTF-8&oe=UTF-8&sourceid=navclient&gfns=1&q="
  FF - prefs.js..network.proxy.type: 4
  O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
  O15 - HKU\S-1-5-21-602162358-484763869-725345543-1003\..Trusted Domains: localhost ([]http in Místní intranet)
  O15 - HKU\S-1-5-21-602162358-484763869-725345543-1003\..Trusted Ranges: GD ([http] in Místní intranet)
  O15 - HKU\S-1-5-21-602162358-484763869-725345543-1003\..Trusted Ranges: Range1979 ([http] in Trusted sites)
  O16 - DPF: {31435657-9980-0010-8000-00AA00389B71} http://download.microsoft.com/download/ ... vc1dmo.cab (Reg Error: Key error.)
  [3 C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\*.tmp files -> C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\*.tmp -> ]
  [1 C:\WINDOWS\system32\config\systemprofile\Local Settings\temp\*.tmp files -> C:\WINDOWS\system32\config\systemprofile\Local Settings\temp\*.tmp -> ]
  [10 C:\WINDOWS\Temp\*.tmp files -> C:\WINDOWS\Temp\*.tmp -> ]
  [2012.05.14 21:40:00 | 000,000,914 | ---- | M] () -- C:\WINDOWS\Tasks\Adobe Flash Player Updater.job
  [2012.05.14 12:38:00 | 000,000,930 | ---- | M] () -- C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job
  [2012.05.14 21:38:00 | 000,000,934 | ---- | M] () -- C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job
  @Alternate Data Stream - 124 bytes -> C:\Documents and Settings\All Users\Data aplikací\TEMP:87C79266
  
  :services
  gupdate
  gupdatem
  
  :reg
  [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
  "NeroFilterCheck"=-
  "SunJavaUpdateSched"=-
  [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce]
  "FlashPlayerUpdate"=-
  
  :files
  %windir%\system32\*.tmp.dll /s
  %windir%\system32\SET*.tmp /s
  %windir%\*.tmp
  
  :commands
  [RESETHOSTS]
  [EMPTYTEMP]
  [EMPTYFLASH]

• Nasledne kliknete na Opravit
• PC provede opravu, restartuje se a da Vam log, jeho obsah vlozte sem

[RichardB]

All processes killed
========== OTL ==========
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ not found.
HKU\S-1-5-21-602162358-484763869-725345543-1003\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page| /E : value set successfully!
HKEY_USERS\S-1-5-21-602162358-484763869-725345543-1003\Software\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!
Registry key HKEY_USERS\S-1-5-21-602162358-484763869-725345543-1003\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ not found.
Registry key HKEY_USERS\S-1-5-21-602162358-484763869-725345543-1003\Software\Microsoft\Internet Explorer\SearchScopes\{70D46D94-BF1E-45ED-B567-48701376298E}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{70D46D94-BF1E-45ED-B567-48701376298E}\ not found.
Registry key HKEY_USERS\S-1-5-21-602162358-484763869-725345543-1003\Software\Microsoft\Internet Explorer\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{afdbddaa-5d3f-42ee-b79c-185a7020515b}\ not found.
HKU\S-1-5-21-602162358-484763869-725345543-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyOverride| /E : value set successfully!
Prefs.js: "http://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=" removed from browser.search.defaulturl
Prefs.js: "http://www.google.com/search?ie=UTF-8&o ... &gfns=1&q=" removed from keyword.URL
Prefs.js: 4 removed from network.proxy.type
Registry key HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Internet Explorer\Restrictions\ deleted successfully.
Registry key HKEY_USERS\S-1-5-21-602162358-484763869-725345543-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\localhost\ deleted successfully.
Registry value HKEY_USERS\S-1-5-21-602162358-484763869-725345543-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\GD\\http deleted successfully.
Registry value HKEY_USERS\S-1-5-21-602162358-484763869-725345543-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\Range1979\\http deleted successfully.
Starting removal of ActiveX control {31435657-9980-0010-8000-00AA00389B71}
C:\WINDOWS\Downloaded Program Files\wvc1dmo.inf moved successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{31435657-9980-0010-8000-00AA00389B71}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{31435657-9980-0010-8000-00AA00389B71}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{31435657-9980-0010-8000-00AA00389B71}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{31435657-9980-0010-8000-00AA00389B71}\ not found.
C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP15D.tmp folder deleted successfully.
C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP250.tmp folder deleted successfully.
C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAPF67.tmp\UIAutomationClientsideProviders.dll deleted successfully.
C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAPF67.tmp folder deleted successfully.
C:\WINDOWS\system32\config\systemprofile\Local Settings\temp\CR_75565.tmp\SETUP_PATCH.PACKED.7Z deleted successfully.
C:\WINDOWS\system32\config\systemprofile\Local Settings\temp\CR_75565.tmp folder deleted successfully.
C:\WINDOWS\Temp\JETBE2.tmp deleted successfully.
C:\WINDOWS\Temp\ZLT00353.TMP deleted successfully.
C:\WINDOWS\Temp\ZLT00c96.TMP deleted successfully.
C:\WINDOWS\Temp\ZLT00fd1.TMP deleted successfully.
C:\WINDOWS\Temp\ZLT0288e.TMP deleted successfully.
File delete failed. C:\WINDOWS\Temp\ZLT04741.TMP scheduled to be deleted on reboot.
C:\WINDOWS\Temp\ZLT05d0b.TMP deleted successfully.
C:\WINDOWS\Temp\ZLT06110.TMP deleted successfully.
C:\WINDOWS\Temp\ZLT0749c.TMP deleted successfully.
C:\WINDOWS\Temp\ZLT07641.TMP deleted successfully.
C:\WINDOWS\Tasks\Adobe Flash Player Updater.job moved successfully.
C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job moved successfully.
C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job moved successfully.
ADS C:\Documents and Settings\All Users\Data aplikací\TEMP:87C79266 deleted successfully.
========== SERVICES/DRIVERS ==========
Service gupdate stopped successfully!
Service gupdate deleted successfully!
Service gupdatem stopped successfully!
Service gupdatem deleted successfully!
========== REGISTRY ==========
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\NeroFilterCheck not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\SunJavaUpdateSched not found.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce\\FlashPlayerUpdate not found.
========== FILES ==========
File/Folder C:\WINDOWS\system32\*.tmp.dll not found.
File/Folder C:\WINDOWS\system32\SET*.tmp not found.
File/Folder C:\WINDOWS\*.tmp not found.
========== COMMANDS ==========
C:\WINDOWS\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully

[EMPTYTEMP]

User: All Users

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->Flash cache emptied: 56475 bytes

User: LocalService
->Temp folder emptied: 2043288 bytes
->Temporary Internet Files folder emptied: 32902 bytes

User: NetworkService
->Temp folder emptied: 1977688 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: Richard Buček
->Temp folder emptied: 1366463 bytes
->Temporary Internet Files folder emptied: 152333 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 4870220 bytes
->Flash cache emptied: 562 bytes

User: Richard Buček.RICHARD-87F6F60

User: xxx
->Temp folder emptied: 347346473 bytes
->Temporary Internet Files folder emptied: 12130019 bytes
->Java cache emptied: 3476232 bytes
->FireFox cache emptied: 393487618 bytes
->Google Chrome cache emptied: 309955177 bytes
->Flash cache emptied: 58185 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 9292761 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 49643850 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 0 bytes
RecycleBin emptied: 5640462 bytes

Total Files Cleaned = 1 089,00 mb


[EMPTYFLASH]

User: All Users

User: Default User
->Flash cache emptied: 0 bytes

User: LocalService

User: NetworkService

User: Richard Buček
->Flash cache emptied: 0 bytes

User: Richard Buček.RICHARD-87F6F60

User: xxx
->Flash cache emptied: 0 bytes

Total Flash Files Cleaned = 0,00 mb


OTL by OldTimer - Version 3.2.43.0 log created on 05152012_110226

Files\Folders moved on Reboot...
File\Folder C:\WINDOWS\Temp\ZLT04741.TMP not found!
C:\Documents and Settings\xxx\Local Settings\Temp\~DF9870.tmp moved successfully.
File move failed. C:\WINDOWS\temp\_avast_\Webshlock.txt scheduled to be moved on reboot.

Registry entries deleted on Reboot...

[vyosek]

OTC http://oldtimer.geekstogo.com/OTC.exe

• Stahnete a spustte
• Kliknete na CleanUp a potvrdte YES
• Program uklidi a restartuje PC

TFC http://oldtimer.geekstogo.com/TFC.exe

• Stahnete a spustte
• Kliknete na Start a potvrdte OK
• Program uklidi a restartuje pc
• Po pouziti utilitu smazte

Stahnete Ccleaner http://forum.viry.cz/viewtopic.php?t=7478
Panel čistič

• Vse nechte jak je, jen dejte Analyzovat a pote Spustit CCleaner

Panel registry

• dejte Hledej problémy
• nasledne Opravit problémy - zalohu registru doporucuji udelat, opravte vsechny problemy
• postup opakujte dokud nebude bez problemu - vetsinou cca 3x

Panel nástroje

• Zde muzete odinstalovat nepotrebne programy

CCleaner doporucuji pouzivat cca jednou za tyden

Doporucuji provest defragmentaci disku

• Nejjednodussi (ale nejmene ucinny) zpusob je pomoci utility ve windowsech
  • Kliknete na Tento pocitac, dale na disk kliknete pravym tlacitkem, vyberte Vlastnosti
  • prepnete se do zalozky Nastroje
  • Nyni vidite pomucky Defragmentace - spustte ji kliknutim na Defragmentovat
  • Toto provedte se vsemi disky
• Dalsi moznosti (a mnou doporucenou) je pres programek Defraggler http://www.stahuj.centrum.cz/utility_a_ ... efraggler/
  • Program stahnete, nainstalujte (dejte fajfku pryc u yahoo toolbaru) a spustte
  • Kliknete na Analyzovat
  • Pokud je ve sloupci Fragmentováno vice jak 5%, doporucuji provest defragmentaci (klik na Defragmentovat)
  • Postup provedte se vsemi disky
• Posledni moznost je pres jednoduchy programek JKDefrag http://www.stahuj.centrum.cz/utility_a_ ... /jkdefrag/
  • Vyhodou programku je, ze se neinstaluje
  • Staci tedy jen stahnout dle verze vaseho OS a rozbalit
  • Nasledne spustit pomoci souboru JKDefrag pripadne JKDefrag64
  • Probehne analyza disku a nasledne i defragmentace

Napiste co PC

[RichardB]

Díky, zdá se to být v pořádku, bylo tam něco nebezpečného nebo to jen chtělo vyčistit. Mám změnit hesla mailů a internetbankingu?

Ještě jednou díky.

RB

[vyosek]

heslo do internetbankingu doporucuji menit pravidelne, ja jej menim cca co 14 dni. Nyni tam nebyla havet, ktera by je kradla...

Pokud tedy nejsou problemy ci dotazy, je to z me strany vse

[RichardB]

Jen se mi teď nespouští podepisovač k internetbankingu - Java Web Start, musím ho spouštět ručně, což ale není tak velký problém.

Díky

RB

[vyosek]

Nejsem si vedom ze bych jej zakazoval, kdyz mi date umisteni, muzem jej pridat do programu spoustenych po startu

[RichardB]

Ne, není to třeba. Spíše přemýšlím, jak si pamatovat tak často měněné heslo nebo spíše více hesel. Mít je v počítači samozřejmě nechci, to už spíše asi v telefonu v nějakém programu chráněném heslem, které si jediné pamatovat budu. Nebo zapsané v zašifrované podobě v běžném textovém souboru nebo na papíře. Jak to děláte vy?

[vyosek]

pouzivam me zname a lehce zapamtovatelne cisla a jmena - me jmeno, jmeno psa atd...a cisla - rok narozeni, cislo popisne, cislo mobilu...

[RichardB]

Tak takových hesel už jsem uhádl docela dost

Já používám počáteční písmena nějaké věty - např. nununsztz - Neber úplatky, neber úplatky, nebo se z toho zblázníš

[vyosek]

Taky dobra finta na hesla

[Mc_Murphy]

pouzivam me zname a lehce zapamtovatelne cisla a jmena - me jmeno, jmeno psa atd...a cisla - rok narozeni, cislo popisne, cislo mobilu...

Hlavně pozor na to, co si jako heslo, případně kontrolní otázku volíte!

<XXYYZZ> Kurňa! Já zapomněl heslo. Když chci heslo obnovit, chtěj jméno. Když chci zjistit jméno, chtěj mail. Když chci obnovit heslo na mail, chtěj dvě kontrolní otázky. A ZAJÍMALO BY MĚ, CO JSEM HULIL, KDYŽ JSEM JAKO KONTROLNÍ OTÁZKU ZADAL DÝLKU OCASU V CENTIMETRECH MÝHO 3 ROKY MRTVÝHO PSA?!

Omlouvám se kolegovi vyosek za vstup.