Falešný profil uživatele ve Win Vista

[martivan]

Moc děkuju za rychlou odpověď. Trochu jsem se s tím prala (dostat kód z webu do nouzového režimu, v NR vypnout ochranu...), nakonec se podařilo, falešný profil smazán, OTL spuštěno, restartován počítač, chvilka hledání logu ...


All processes killed
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Dětičky
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Java cache emptied: 0 bytes
->Google Chrome cache emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: GM
->Temp folder emptied: 225872 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->Java cache emptied: 0 bytes
->Google Chrome cache emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Jan
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Google Chrome cache emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Magdalena
->Temp folder emptied: 332860 bytes
->Temporary Internet Files folder emptied: 37294 bytes
->Java cache emptied: 0 bytes
->Google Chrome cache emptied: 6153425 bytes
->Flash cache emptied: 0 bytes

User: Public

User: Zuzka
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Java cache emptied: 0 bytes
->Google Chrome cache emptied: 87989220 bytes
->Flash cache emptied: 951 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 4482080686 bytes
RecycleBin emptied: 162312 bytes

Total Files Cleaned = 4 365,00 mb


[EMPTYFLASH]

User: All Users

User: Default

User: Default User

User: Dětičky
->Flash cache emptied: 0 bytes

User: GM
->Flash cache emptied: 0 bytes

User: Jan
->Flash cache emptied: 0 bytes

User: Magdalena
->Flash cache emptied: 0 bytes

User: Public

User: Zuzka
->Flash cache emptied: 0 bytes

Total Flash Files Cleaned = 0,00 mb

C:\Windows\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully
Unable to stop System Restore Service. Error code 1084. Restore points not cleared.
Unable to start System Restore Service. Error code 1084. Restore point not created.
========== SERVICES/DRIVERS ==========
Service gupdate stopped successfully!
Service gupdate deleted successfully!
Service SkypeUpdate stopped successfully!
Service SkypeUpdate deleted successfully!
Service gupdatem stopped successfully!
Service gupdatem deleted successfully!
Service gusvc stopped successfully!
Service gusvc deleted successfully!
========== FILES ==========
File/Folder C:\Windows\system32\*.tmp.dll not found.
File/Folder C:\Windows\system32\SET*.tmp not found.
File/Folder C:\Windows\*.tmp not found.
C:\Windows\tasks\GoogleUpdateTaskMachineCore.job moved successfully.
C:\Windows\tasks\GoogleUpdateTaskMachineUA.job moved successfully.
C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1464193139-767828990-2745750160-1000Core1ce81294d8ec796.job moved successfully.
C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1464193139-767828990-2745750160-1000UA1ce8129508cec66.job moved successfully.
C:\Windows\tasks\Malwarebytes Anti-Exploit.job moved successfully.
========== OTL ==========
HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\\Default_Page_URL| /E : value set successfully!
HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page| /E : value set successfully!
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ not found.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4EFB-9B51-7695ECA05670}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{02478D38-C3F9-4EFB-9B51-7695ECA05670}\ not found.
C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\ZAP25F7.tmp folder deleted successfully.
C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\ZAP2BC1.tmp\MIGUIControls.dll deleted successfully.
C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\ZAP2BC1.tmp folder deleted successfully.
C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\ZAP2DF2.tmp folder deleted successfully.
C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\ZAP3227.tmp\Microsoft.PowerShell.Editor.dll deleted successfully.
C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\ZAP3227.tmp folder deleted successfully.
C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\ZAP3ABE.tmp\System.DirectoryServices.AccountManagement.dll deleted successfully.
C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\ZAP3ABE.tmp folder deleted successfully.
C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\ZAP41A1.tmp\System.Web.Abstractions.dll deleted successfully.
C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\ZAP41A1.tmp folder deleted successfully.
C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\ZAP4DD1.tmp folder deleted successfully.
C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\ZAP6B6F.tmp folder deleted successfully.
C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\ZAP81A.tmp folder deleted successfully.
C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\ZAP9C8D.tmp folder deleted successfully.
C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\ZAPA757.tmp folder deleted successfully.
C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\ZAPB4B0.tmp folder deleted successfully.
C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\ZAPC81E.tmp folder deleted successfully.
C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\ZAPE752.tmp folder deleted successfully.
C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\ZAPEEF0.tmp folder deleted successfully.
C:\Windows\Installer\MSI24DB.tmp deleted successfully.
C:\Windows\Installer\MSI72BB.tmp deleted successfully.
C:\Windows\Installer\MSI9088.tmp deleted successfully.
C:\Windows\Installer\MSI9D84.tmp deleted successfully.
C:\Windows\Installer\MSI9E9B.tmp deleted successfully.
C:\Windows\Installer\MSI9FC6.tmp deleted successfully.
C:\Windows\Installer\MSIA515.tmp deleted successfully.
C:\Windows\Installer\MSIA738.tmp deleted successfully.
C:\Windows\Installer\MSIA823.tmp deleted successfully.
C:\Windows\Installer\MSIA8CA.tmp deleted successfully.
C:\Windows\Installer\MSIAB5A.tmp deleted successfully.
C:\Windows\Installer\MSIADAC.tmp deleted successfully.
C:\Windows\Installer\MSIB01F.tmp deleted successfully.
C:\Windows\Installer\MSIB149.tmp deleted successfully.
C:\Windows\Installer\MSIB24E.tmp deleted successfully.
C:\Windows\Installer\MSIB3D9.tmp deleted successfully.
C:\Windows\Installer\MSIB521.tmp deleted successfully.
C:\Windows\Installer\MSIB918.tmp deleted successfully.
C:\Windows\Installer\MSIBA32.tmp deleted successfully.
C:\Windows\Installer\MSIBCE2.tmp deleted successfully.
C:\Windows\Installer\MSIC03D.tmp deleted successfully.
C:\Windows\Installer\MSIC2EC.tmp deleted successfully.
C:\Windows\Installer\MSIC79E.tmp deleted successfully.
C:\Windows\Installer\MSICAF9.tmp deleted successfully.
C:\Windows\Installer\MSICBF4.tmp deleted successfully.
C:\Windows\Installer\MSICFEB.tmp deleted successfully.
C:\Windows\Installer\MSID172.tmp deleted successfully.
C:\Windows\Installer\MSID53A.tmp deleted successfully.
C:\Windows\Installer\MSID692.tmp deleted successfully.
C:\Windows\Installer\MSID886.tmp deleted successfully.
C:\Windows\Installer\MSIDB55.tmp deleted successfully.
C:\Windows\SoftwareDistribution\Download\d466afb6be5767b9d088613852f47744\BIT231.tmp deleted successfully.
ADS C:\ProgramData\TEMP:A95A95AC deleted successfully.
ADS C:\ProgramData\TEMP:0A73A758 deleted successfully.
ADS C:\ProgramData\TEMP:B203B914 deleted successfully.
ADS C:\ProgramData\TEMP:AA9519A6 deleted successfully.
ADS C:\ProgramData\TEMP:94188BC6 deleted successfully.
ADS C:\ProgramData\TEMP:9F683177 deleted successfully.
========== REGISTRY ==========
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4EFB-9B51-7695ECA05670}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{02478D38-C3F9-4EFB-9B51-7695ECA05670}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{83A2F9B1-01A2-4AA5-87D1-45B6B8505E96}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{83A2F9B1-01A2-4AA5-87D1-45B6B8505E96}\ deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\Windows Defender deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\SunJavaUpdateSched deleted successfully.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\WindowsWelcomeCenter deleted successfully.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\Skype deleted successfully.
Registry key HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Update\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LManager\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NokiaSuite.exe\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Search Protection\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SetPanel\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Symantec PIF AlertEng\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WMPNSCFG\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\YSearchProtection\ deleted successfully.

OTL by OldTimer - Version 3.2.69.0 log created on 02062014_132432

Files\Folders moved on Reboot...

PendingFileRenameOperations files...

Registry entries deleted on Reboot...

[Márty84]

Sikulka


Vsechny tyto programy - vcetne pripadne instalace - spoustejte jako spravce (kliknete na ne pravym mysidlem a zvolte - Spustit jako spravce)

T-Cleaner http://tharifas.sweb.cz/T-Cleaner.exe

• Stahnete a spustte
• Pro potvrzeni volby mackejte A, Enter
• Po pouziti utilitu smazte
• Antiviry mohou utilitu chybne oznacit jako vir - jedna se o falesny poplach - takze v pohode stahnete (pripadne vypnete pri stahovani antivir)

Stahnete OTC http://oldtimer.geekstogo.com/OTC.exe , ulozte a spustte.
Kliknete na napis CleanUp a pote OK - Po uklidu dojde k restartu pc.

Stahnete TFC http://oldtimer.geekstogo.com/TFC.exe , ulozte a spustte
Kliknete na START a pote OK - Po uklidu dojde k restartu pc.
Po pouziti muzete programek smazat

Stahnete Ccleaner http://www.piriform.com/ccleaner/download/slim a spustte.
Pri instalaci pozor na toolbar (ci jine doplnky), jestli vam nabidne jeho instalaci, tak zruste zatrzitko.
Po spusteni se ocitnete ve funkci Cistic. Vlevo je spousta zatrzitek. Pozor dejte hlavne na kos, pokud nechate zatrzene, vzdy ho vysype.
Dale, podle toho jak je nastaven, smaze vsechna hesla ulozena na netu!!! Takze jestli mate nastavene, at si pocitac hesla pamatuje (coz neni pro bezpecnost dobre), budete je muset pak napsat znova rucne (napr mail, facebook, ruzna fora atd.)
Kliknete na Analyzovat a az dokonci analyzu, kliknete na Spustit Cleaner.
Potom kliknete vlevo na funkci Registry
Kliknete na Hledej problemy, kdyz najde, kliknete na Opravit problemy. Nabidne Vam zalohu, tu udelejte a ulozte ji tak, at ji v pripade potreby najdete.
Funkce Nastroje umoznuje odinstalovani programu. Je dukladnejsi nez samotny windows!

Defragmentujte disk(y)
Stahnete program Defraggler http://www.stahuj.centrum.cz/utility_a_ ... efraggler/
Pri instalaci opet pozor na toolbar
Po nainstalovani program spustte a kliknete na Analyzovat, po analyze kliknete na Defragmentovat a programek odvede svou praci.




Pak zkuste znovu stahnout a spustit ComboFix, nejlepe v nouzovem rezimu s praci v siti

[martivan]

T-cleaner nevypadá, že by něco dělal. Klepnu A, klepnu Enter, kurzor odskočí o řádku níž a tím to končí. (v případě N a Enter program normálně skončí). Mám pokračovat dalšími utilitkami?

edit: aha, tak dělá, akorát uživatel nemá zpětnou vazbu, že něco dělá, dokud to nedokončí Možná pro nás méně bystré je lepší předem upozornit

[Márty84]

Mám pokračovat dalšími utilitkami?

Jasan

[martivan]

Uch... Po použití TFC nejdou spustit položky ze startupu (ovládací panely, výchozí programy, dokumenty, tento počítač...)

edit: po restartu ano

[Márty84]

tak jen smele dale

[martivan]

Pořád je tam

[Márty84]

Pak zkuste znovu stahnout a spustit ComboFix, nejlepe v nouzovem rezimu s praci v siti

[martivan]

i tak se tam pořád dál objevuje

v noci nechám proskenovat vymontovaný disk jiným počítačem, tak uvidíme, jestli to pomůže

[Márty84]

No ale ja chtel jeho log na docisteni Nevadi, to co zkousite je taky moznost

[martivan]

Tak bohužel se kontrola disku z jiného počítače odkládá, nebyl k dispozici. A teď mám zásadní a akutní problém, protože jsem spustila combofix v nouzovém režimu se sítí, jenže jsem předem nevypnula ESET, mám tím pádem spuštěné rezidentní štíty, a combofix mě nepustí dál, dokud je nevypnu. Což netuším, jak v nouzovém režimu udělat

[Márty84]

Nemusite je vypinat. Normalne dejte OK, CF napise, ze jsou zapnuty, ale i tak se spusti, nebo by aspon mel

[martivan]

a já si tu už hodinu přepaluju mozkové závity a zbytek času rvu vlasy z hlavy při představě toho, co všechno mi combofix provede s počítačem, ledničkou a prababičkou...

edit: hm, ale combofix se zasekl zase po hlášce Dokončena fáze_3 a nic dál
a tím pádem nevím, jestli se dá získat log aspoň z toho, co provedl.

[Márty84]

Postupujte podle navodu kolegy

Stahnete RKill http://download.bleepingcomputer.com/grinler/rkill.com

• Pokud ho havet blokuje, pouzijte jeden z nasledujicich - i ty prejmenovane

  Rkill EXE:
  http://download.bleepingcomputer.com/grinler/rkill.exe
  
  Rkill iExplore.exe:
  http://download.bleepingcomputer.com/gr ... xplore.exe
  
  Rkill uSeRiNiT.exe:
  http://download.bleepingcomputer.com/gr ... eRiNiT.exe
  
  Rkill WiNlOgOn.exe:
  http://download.bleepingcomputer.com/gr ... NlOgOn.exe

• Ulozte nejlepena plochu a ukoncete vsechny aplikace (jinak to udela RKill za Vas)
• Spustte tradicne dvojklikem - program probehne do par sekund a ukonci i svou cinnost
• RKill ukonci vsechny ne-systemove procesy - tedy i procesy, pod kterymi bezi havet
• Na plose vznikne log Rkill.txt ten mi sem vlozte
• Ted nerestartujte PC - prisli byste o ucinek RKillu

Znovu spustte ComboFix

[martivan]

Záhada (Blair Witch) vysvětlena!!

Vysvětlení s falešným, tedy správně fantomovým účtem nakonec nalezeno zde.

Po aktivaci funkce Anti-Theft v programu ESET Smart Security může v některých v případech dojít k tomu, že se kromě Fantom účtu standardně pojmenovaného Jan, vytvoří také uživatelský účet s náhodně vygenerovaným názvem (uegfrtsv atp). I přesto, že tento uživatelský účet odstraníte ze systému, při příštím startu počítače se znovu zobrazí.

Pro vyřešení tohoto problému pokračujte podle následujících kroků:

• Přihlaste se ke svému ESET účtu na portálu my.eset.com.
• Odeberte své zařízení z portálu my.eset.com.
• Deaktivujte Anti-Theft v programu ESET Smart Security.
• Klikněte na Start > Ovládací panely > Uživatelské účty a odstraňte všechny Fantom uživatelské účty.
• Restartujte počítač. Poznámka: Doporučujeme provést aktualizaci na nejnovější verzi ESET Smart Security.
• Znovu aktivujte funkci Anti-Theft.

Následně by již nemělo docházet k samovolnému vytváření uživatelských účtů.

Moc vám děkuji za pomoc a trpělivost, počítač mám vyčištěný jako nikdy předtím a téma můžeme konečně prohlásit za