nefunkční klávesnice, myš...

[marpan]

Zaškrtnout mám prosím to samé co předtím?

[Rudy]

Jistě.

[marpan]

All processes killed
========== OTL ==========
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{75b4241f-171e-44a3-bf44-23613b6e3e03}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{75b4241f-171e-44a3-bf44-23613b6e3e03}\ not found.
HKEY_USERS\S-1-5-21-1757981266-1682526488-682003330-1003\Software\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!
Registry key HKEY_USERS\S-1-5-21-1757981266-1682526488-682003330-1003\Software\Microsoft\Internet Explorer\SearchScopes\{75b4241f-171e-44a3-bf44-23613b6e3e03}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{75b4241f-171e-44a3-bf44-23613b6e3e03}\ not found.
Prefs.js: "http://search.conduit.com/ResultsExt.as ... earchTerms}" removed from browser.search.defaulturl
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{898EA8C8-E7FF-479B-8935-AEC46303B9E5}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{898EA8C8-E7FF-479B-8935-AEC46303B9E5}\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{76cbcd02-487b-11e2-ac7b-0016ce857d1b}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{76cbcd02-487b-11e2-ac7b-0016ce857d1b}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{76cbcd02-487b-11e2-ac7b-0016ce857d1b}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{76cbcd02-487b-11e2-ac7b-0016ce857d1b}\ not found.
File E:\AutoRun.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{e8c3d01f-7e92-11e3-aea8-0016ce857d1b}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{e8c3d01f-7e92-11e3-aea8-0016ce857d1b}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{e8c3d01f-7e92-11e3-aea8-0016ce857d1b}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{e8c3d01f-7e92-11e3-aea8-0016ce857d1b}\ not found.
File G:\LGAutoRun.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{fec829c6-9d8e-11e0-bb1f-0016ce857d1b}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{fec829c6-9d8e-11e0-bb1f-0016ce857d1b}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{fec829c6-9d8e-11e0-bb1f-0016ce857d1b}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{fec829c6-9d8e-11e0-bb1f-0016ce857d1b}\ not found.
File E:\AutoRun.exe not found.
ADS C:\Documents and Settings\All Users\Data aplikací\TEMP:D1B5B4F1 deleted successfully.
========== FILES ==========
File\Folder C:\Program Files\Skype\Toolbars not found.
File/Folder C:\WINDOWS\system32\*.tmp.dll not found.
File/Folder C:\WINDOWS\system32\SET*.tmp not found.
C:\WINDOWS\002957_.tmp moved successfully.
C:\WINDOWS\msdownld.tmp folder moved successfully.
C:\WINDOWS\SET3.tmp moved successfully.
C:\WINDOWS\SET4.tmp moved successfully.
C:\WINDOWS\SET8.tmp moved successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: Administrator
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 3384399 bytes
->FireFox cache emptied: 53519998 bytes
->Flash cache emptied: 578 bytes

User: All Users

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: Guest

User: HelpAssistant

User: LocalService
->Temp folder emptied: 65984 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->FireFox cache emptied: 67152 bytes

User: Majitel
->Temp folder emptied: 1290248 bytes
->Temporary Internet Files folder emptied: 1928397 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 429068989 bytes
->Google Chrome cache emptied: 0 bytes
->Opera cache emptied: 20527238 bytes
->Flash cache emptied: 34432 bytes

User: NetworkService
->Temp folder emptied: 31404 bytes
->Temporary Internet Files folder emptied: 50549 bytes

User: SUPPORT_388945a0

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 2504 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 271945 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 431138826 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 33170 bytes
RecycleBin emptied: 794678882 bytes

Total Files Cleaned = 1 656,00 mb


[EMPTYFLASH]

User: Administrator
->Flash cache emptied: 0 bytes

User: All Users

User: Default User

User: Guest

User: HelpAssistant

User: LocalService

User: Majitel
->Flash cache emptied: 0 bytes

User: NetworkService

User: SUPPORT_388945a0

Total Flash Files Cleaned = 0,00 mb

Restore point Set: OTL Restore Point

OTL by OldTimer - Version 3.2.69.0 log created on 02132014_191423

Files\Folders moved on Reboot...

PendingFileRenameOperations files...

Registry entries deleted on Reboot...

[Rudy]

Smazáno. Nastala nějaká změna?

[marpan]

Bohužel ani jedno stále nefunguje, stále stejné oznámení... "Ovladač (služba) pro toto zařízení byl zakázán. Tyto funkce pravděpodobně zajišťuje alternativní ovladač. (Kód 32)"

[Rudy]

Restartujte do nouz. režimu a tam zkuste spustit ComboFix. pokud se to ani tam nezdaří, udělejte tento sken:

Stáhněte Malwarebytes Anti-Rootkit http://www.malwarebytes.org/products/mbar/

Uložte nejlépe na Plochu a rozbalte
Spusťte kliknutím na mbar
Nyní postupně klikněte na Next a Update
Po dokončení update (aktualizace) databáze klikněte opět na Next
Nechte zaškrtnute všechny tři možnosti a kliněte na Scan čímž spustíte prohledavani PC
Po dokončeni skenu (cca 5 minutek) zkontrolujte, zda-li je u všech nalezů (samozrejme pokud budou) zatržítko
Tež zkontrolujte, jestli je zatržitko u Create Restore point
Nyní klikněte na CleanUp čímž nalezenou infekci odstraníme
PC bude restartován
Složka mbar by měla obsahovat log (a zřejmě se i sám otevře) mbar-log-rok-měsíc-den (hodina-minuta-sekunda).txt, ten mi sem dejte.

[marpan]

combo se nedostalo opět k těm fázím, přikládám tedy požaovanýlog z mbar. jinak u mě nic nového


Malwarebytes Anti-Rootkit BETA 1.07.0.1009
www.malwarebytes.org

Database version: v2014.02.13.11

Windows XP Service Pack 3 x86 NTFS
Internet Explorer 6.0.2900.5512
:: 7FFD7D2F3E4846E [administrator]

13.2.2014 21:33:11
mbar-log-2014-02-13 (21-33-11).txt

Scan type: Quick scan
Scan options enabled: Anti-Rootkit | Drivers | MBR | Physical Sectors | Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken
Scan options disabled:
Objects scanned: 254833
Time elapsed: 15 minute(s), 8 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 1
HKCU\SOFTWARE\XTREMERAT (Malware.Trace) -> Delete on reboot.

Registry Values Detected: 1
HKCU\SOFTWARE\XTREMERAT|Mutex (Malware.Trace) -> Data: PtjlyNHTo89Ppup8ew -> Delete on reboot.

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 2
C:\Documents and Settings\All Users\Data aplikací\InstallMate\{931AFCF8-6B06-4692-A479-232448F9DE0E}\Custom.dll (Adware.Agent) -> Delete on reboot.
C:\Documents and Settings\All Users\Data aplikací\InstallMate\{BD71A5D6-3C92-4613-A4F8-74B066928720}\Custom.dll (Adware.Agent) -> Delete on reboot.

Physical Sectors Detected: 0
(No malicious items detected)

(end)

[Rudy]

Smazáno. Nastala nějaká změna?

[marpan]

obě věci stále nefunkční

[Rudy]

Teď už zbývá pouze oprava buď z instal. média, nebo pomocí XPManageru: http://forum.viry.cz/viewtopic.php?f=46&t=17549 . Virový problém to zřejmě nebude.

[marpan]

Děkuju za váš čas a kouknu se tedy na toho managera. Zatím nashledanou

[Rudy]

Zatím nemáte zač!