Policie - zablokovaný notebook

[jimi_martan]

Zdravím, po naběhnutí Windows se zobrazí Policie České Republiky - Váš počítač byl zablokován .... Našel jsem podobné téma, ale potřebuji radu jaké programy mám spustit a jak dále postupovat. Díky

[stell]

Zdravim.
Reštartuje počítač, pri reštartovaní počítača stlačte kláves F8 a podržte ho stlačený.Kláves F8 musíte stlačiť predtým, než sa zobrazí logo systému Windows.


Win7/Vista.
Pomocou klávesov so šípkami vyberte položku.

Núdzový režim s príkazovým riadkom.
Stlačte kláves ENTER.

Ak tam budes tak napis, a napis aj,aky system mas..

[jimi_martan]

Při pokusu o nastartovní nouzové režimu se notebook automaticky odhlásí a restartuje, systém Windows 7 Home premium 64 bit.

[stell]

Při pokusu o nastartovní nouzové režimu

Ja som nepisal Nudzovy rezim, ale
Núdzový režim s príkazovým riadkom.
Stlačte kláves ENTER.

Podrobny navod v mojom blogu, pozri aj obrazok,
a ak tam budes napis.
http://www.viruskasino.com/2012/12/vas- ... azany.html

[jimi_martan]

omlouvám se, nouzový režim s příkazovým řádkem nastartartován

[stell]

Ok, obnovime system, do prikazoveho riadku napis prikaz.
rstrui.exe
Enter
A OBNOV system, na skorsi datum.
A restartuj pocitac normalne do windows.
Ak by sa neobjavil nabidka Start, hlavny panel, alebo ikonky na ploche pouzi script
oprava.reg
tak ako je v blogu, potom restart a napis.
http://www.viruskasino.com/2012/12/vas- ... azany.html

[jimi_martan]

Systém po restartu nastartoval normálně.

[stell]

Ok, postupne pouzi tieto programy, co tu napisem, a logy vkladaj sem.
http://download.bleepingcomputer.com/grinler/rkill.com
ADWcleaner , moznost DELETE
http://www.viruskasino.com/2012/09/adwcleaner.html

Vyčistiť java cache.
http://www.viruskasino.com/2011/01/poma ... java-cache

Vypneme obnovu systému, reštart a zapnúť.

Pouzijes Malwarebytes, Najdene Odstran, log vloz sem.
potom Uvidime.
http://forum.viry.cz/viewtopic.php?f=29 ... 1#p1031821

[jimi_martan]

Rkill 2.4.7 by Lawrence Abrams (Grinler)
http://www.bleepingcomputer.com/
Copyright 2008-2013 BleepingComputer.com
More Information about Rkill can be found at this link:
http://www.bleepingcomputer.com/forums/topic308364.html

Program started at: 03/13/2013 11:57:32 AM in x64 mode.
Windows Version: Windows 7 Home Premium Service Pack 1

Checking for Windows services to stop:

* No malware services found to stop.

Checking for processes to terminate:

* C:\Windows\SysWOW64\ACEngSvr.exe (PID: 2352) [WD-HEUR]

1 proccess terminated!

Checking Registry for malware related settings:

* Explorer Policy Removed: NoActiveDesktopChanges [HKLM]

Backup Registry file created at:
C:\Users\Tibor\Desktop\rkill\rkill-03-13-2013-11-57-38.reg

Resetting .EXE, .COM, & .BAT associations in the Windows Registry.

Performing miscellaneous checks:

* No issues found.

Checking Windows Service Integrity:

* No issues found.

Searching for Missing Digital Signatures:

* No issues found.

Checking HOSTS File:

* No issues found.

Program finished at: 03/13/2013 11:57:52 AM
Execution time: 0 hours(s), 0 minute(s), and 19 seconds(s)

[jimi_martan]

# AdwCleaner v2.114 - Logfile created 03/13/2013 at 12:00:12
# Updated 05/03/2013 by Xplode
# Operating system : Windows 7 Home Premium Service Pack 1 (64 bits)
# User : Tibor - TIBOR-PC
# Boot Mode : Normal
# Running from : C:\Users\Tibor\Downloads\adwcleaner.exe
# Option [Delete]


***** [Services] *****


***** [Files / Folders] *****

Folder Deleted : C:\ProgramData\Ask

***** [Registry] *****

Key Deleted : HKCU\Software\APN PIP
Key Deleted : HKCU\Software\PIP
Key Deleted : HKLM\Software\PIP

***** [Internet Browsers] *****

-\\ Internet Explorer v9.0.8112.16464

[OK] Registry is clean.

-\\ Google Chrome v25.0.1364.152

File : C:\Users\Tibor\AppData\Local\Google\Chrome\User Data\Default\Preferences

[OK] File is clean.

*************************

AdwCleaner[S1].txt - [799 octets] - [13/03/2013 12:00:12]

########## EOF - C:\AdwCleaner[S1].txt - [858 octets] ##########

[jimi_martan]

Malwarebytes Anti-Malware (Zkušební verze Malwarebytes Anti-Malware.) 1.70.0.1100
www.malwarebytes.org

Verze: v2013.03.13.05

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 9.0.8112.16421
Tibor :: TIBOR-PC [administrátor]

Ochrana: Povolena

13.3.2013 12:10:30
mbam-log-2013-03-13 (12-10-30).txt

Typ: Rychlá kontrola
Nastavení kontroly povoleno: Paměť | Po spuštění | Registr | Systémové soubory | Heuristická analýza Extra | Heuristická analýza Shuriken | PUP | PUM
Nastavení kontroly zakázáno: P2P
Kontrolované objekty: 206335
Uplynulý čas: 5 minut, 22 sekund

Nalezené procesy v paměti: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené moduly v paměti: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené klíče v registru: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené hodnoty v registru: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené datové položky v registru: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené složky: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené soubory: 0
(Žádné škodlivé položky nebyly zjištěny)

(konec)

[stell]

Dobre,
Docistime to a odskusas pc a uvidime.
1:Mozes odinstalovat malwarebytes.
1:Stiahni na plochu OTL.exe
http://www.bleepingcomputer.com/download/otl/dl/93/
Pravy klik a spust ako admin, nastavenie nechaj tak ako je, akurat zafajkni PRO VSECHNY uzivatele.
Dole do okna skopiruj tento script:
A klikni na Knoflik OPRAVIT. log vloz sem

Kód: Vybrat vše

:Commands
[purity]
[emptytemp]

[jimi_martan]

All processes killed
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Public

User: Tibor
->Temp folder emptied: 909272633 bytes
->Temporary Internet Files folder emptied: 479774474 bytes
->Java cache emptied: 101856 bytes
->Google Chrome cache emptied: 5489211 bytes
->Flash cache emptied: 967 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 123534555 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 46424376 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 1,492.00 mb


OTL by OldTimer - Version 3.2.69.0 log created on 03132013_123452

Files\Folders moved on Reboot...
C:\Users\Tibor\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.
C:\Users\Tibor\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\IJ7AMU67\3328[1].htm moved successfully.
C:\Users\Tibor\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\HI1E49MG\afr[1].htm moved successfully.
C:\Users\Tibor\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\FYK4XARF\hub[1].htm moved successfully.
C:\Users\Tibor\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\FYK4XARF\hub[2].htm moved successfully.
C:\Users\Tibor\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\FSBEX1RJ\viewtopic[1].htm moved successfully.
C:\Users\Tibor\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\EJTO6ACL\93[1].htm moved successfully.
C:\Users\Tibor\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\EJTO6ACL\afr[1].htm moved successfully.
C:\Users\Tibor\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\EJTO6ACL\viewtopic[1].htm moved successfully.
C:\Users\Tibor\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\C10SH9JS\0c953ad0ef2ac4415027a275722f97e7[1].htm moved successfully.
C:\Users\Tibor\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\AMG5G074\PIE[1].htc moved successfully.
C:\Users\Tibor\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\9HCOIPLB\xd_arbiter[1].htm moved successfully.
C:\Users\Tibor\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\7UN1JR9P\2e710133bceb8eaebe9f96c1dede8f04[1].htm moved successfully.
C:\Users\Tibor\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\7UN1JR9P\50195490978b0466037aef5af0681265[1].htm moved successfully.
C:\Users\Tibor\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\7UN1JR9P\eec4b47b89ed52d7957c383ca9382bfc[1].htm moved successfully.
C:\Users\Tibor\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\7UN1JR9P\search[1].htm moved successfully.
C:\Users\Tibor\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\694NHTFM\xd_arbiter[1].htm moved successfully.
C:\Users\Tibor\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\AntiPhishing\ED8654D5-B9F0-4DD9-B3E8-F8F560086FDF.dat moved successfully.
C:\Users\Tibor\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\MSIMGSIZ.DAT moved successfully.

PendingFileRenameOperations files...

Registry entries deleted on Reboot...

[stell]

Ok, ak uz nemas problemy ,tak to je vsetko, odskusaj pc, a ak vsetko bude ok, tak napis, a temu ukoncim a zatvorim.

[jimi_martan]

Vyzkouším, zatím děkuji