spomaleny ntb

[Rudy]

Ještě bychom mohli zkusit log ComboFix:

Stahnete a ulozte nejlepe na plochu ComboFix: http://download.bleepingcomputer.com/sUBs/ComboFix.exe

pote spustte aplikaci pod uctem s administratorskym opravnenim

hned po startu se zobrazi obrazovka s licencnimi podminkami, pokracujte kliknutim na tlacitko Ano.

v klidu si postavte na kafe (cela akce trva cca. 5-10 minut, nekdy i dele - dle toho, o jak rychly stroj se

jedna a kolika soubory se skener bude muset prodirat), behem skenu se nepokousejte spoustet zadne jine

aplikace ani nic jineho

behem skenovani nepropadejte panice, vas stroj muze byt restartovan (predevsim pri prvni aplikaci skeneru)

upozorneni: pokud pouzivate antispyware s rezidentnim stitem, prepnete jeho rezidentni stit do Install Mode,

pripadne jej po dobu skenu uplne deaktivujte, protoze dochazi pri skenu a vymazu pripadneho malware k

nezadoucim kolizim s rezidentem antispyware.

[plasko]

log z combofixu:
ComboFix 15-10-21.01 - Macudova . 10. 2015 8:01.1.2 - x86
Microsoft Windows 7 Home Premium 6.1.7601.1.1250.421.1029.18.1644.379 [GMT 2:00]
Running from: c:\users\Macudova\Desktop\ComboFix.exe
AV: avast! Antivirus *Disabled/Updated* {17AD7D40-BA12-9C46-7131-94903A54AD8B}
SP: avast! Antivirus *Disabled/Updated* {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((( Files Created from 2015-09-22 to 2015-10-22 )))))))))))))))))))))))))))))))
.
.
2015-10-22 06:16 . 2015-10-22 06:16 -------- d-----w- c:\users\Default\AppData\Local\temp
2015-10-22 05:55 . 2015-10-22 05:55 62576 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{42D2D794-DA60-484B-BEA1-0C43D2ADA802}\offreg.4000.dll
2015-10-21 19:46 . 2015-10-21 19:46 -------- d-----w- c:\users\Macudova\AppData\Local\VirtualStore
2015-10-21 19:39 . 2015-10-21 18:23 24064 ----a-w- c:\windows\zoek-delete.exe
2015-10-21 19:39 . 2015-10-22 06:16 -------- d-----w- c:\users\Macudova\AppData\Local\Temp
2015-10-21 16:35 . 2015-10-21 16:35 170200 ----a-w- c:\windows\system32\drivers\MBAMSwissArmy.sys
2015-10-21 16:32 . 2015-10-21 16:32 -------- d-----w- c:\program files\Malwarebytes Anti-Malware
2015-10-21 16:32 . 2015-10-05 07:50 51928 ----a-w- c:\windows\system32\drivers\mwac.sys
2015-10-21 16:32 . 2015-10-05 07:50 94936 ----a-w- c:\windows\system32\drivers\mbamchameleon.sys
2015-10-21 16:32 . 2015-10-05 07:50 23256 ----a-w- c:\windows\system32\drivers\mbam.sys
2015-10-21 16:14 . 2015-10-13 09:30 8985080 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{42D2D794-DA60-484B-BEA1-0C43D2ADA802}\mpengine.dll
2015-10-20 17:38 . 2014-05-14 16:23 45536 ----a-w- c:\windows\system32\wups2.dll
2015-10-20 17:38 . 2014-05-14 16:23 54240 ----a-w- c:\windows\system32\wuauclt.exe
2015-10-20 17:38 . 2014-05-14 16:17 2425856 ----a-w- c:\windows\system32\wucltux.dll
2015-10-20 17:38 . 2014-05-14 16:23 1973728 ----a-w- c:\windows\system32\wuaueng.dll
2015-10-20 17:37 . 2014-05-14 16:23 36320 ----a-w- c:\windows\system32\wups.dll
2015-10-20 17:37 . 2014-05-14 16:23 581600 ----a-w- c:\windows\system32\wuapi.dll
2015-10-20 17:37 . 2014-05-14 16:17 92672 ----a-w- c:\windows\system32\wudriver.dll
2015-10-20 17:37 . 2014-05-14 07:23 179656 ----a-w- c:\windows\system32\wuwebv.dll
2015-10-20 17:37 . 2014-05-14 07:17 33792 ----a-w- c:\windows\system32\wuapp.exe
2015-10-19 22:29 . 2015-10-19 23:57 -------- d-----w- C:\zoek_backup
2015-10-18 18:38 . 2015-10-19 17:42 -------- d-----w- C:\FRST
2015-10-18 18:22 . 2015-10-19 17:15 -------- d-----w- C:\AdwCleaner
2015-10-18 18:00 . 2015-10-18 18:00 -------- d-----w- c:\programdata\Malwarebytes
2015-10-18 18:00 . 2015-10-18 18:00 -------- d-----w- c:\users\Macudova\AppData\Local\Programs
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2015-10-17 16:19 . 2014-07-15 18:29 780488 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2015-10-17 16:19 . 2014-07-15 18:29 142536 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2015-07-01 19:03 645144 ----a-w- c:\program files\AVAST Software\Avast\ashShell.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2015-09-04 55357464]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2012-03-22 343168]
"AvastUI.exe"="c:\program files\AVAST Software\Avast\AvastUI.exe" [2015-07-05 5515496]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
R2 aswStm;aswStm;c:\windows\system32\drivers\aswStm.sys [2015-07-01 106912]
R2 MBAMService;MBAMService;c:\program files\Malwarebytes Anti-Malware\mbamservice.exe [2015-10-05 1135416]
R2 SkypeUpdate;Skype Updater;c:\program files\Skype\Updater\Updater.exe [2015-07-09 327296]
R3 MBAMWebAccessControl;MBAMWebAccessControl;c:\windows\system32\drivers\mwac.sys [2015-10-05 51928]
R3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files\McAfee Security Scan\3.11.163\McCHSvc.exe [2015-07-31 235696]
R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUStor.sys [2014-07-15 197224]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 52224]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [2010-11-20 27264]
S0 aswRvrt;avast! Revert; [x]
S0 aswVmm;avast! VM Monitor; [x]
S1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys [2015-07-01 787760]
S1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [2015-07-05 428120]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2014-07-15 163328]
S2 AMD FUEL Service;AMD FUEL Service;c:\program files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [2012-03-21 291840]
S2 aswHwid;avast! HardwareID;c:\windows\system32\drivers\aswHwid.sys [2015-07-01 24144]
S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [2015-07-01 74976]
S3 amdiox86;AMD IO Driver;c:\windows\system32\DRIVERS\amdiox86.sys [2010-02-18 37944]
S3 AtiHDAudioService;AMD Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW73.sys [2014-07-15 86544]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2015-10-05 23256]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt86win7.sys [2014-07-15 348776]
S3 usbfilter;AMD USB Filter Driver;c:\windows\system32\DRIVERS\usbfilter.sys [2014-07-15 35968]
.
.
--- Other Services/Drivers In Memory ---
.
*NewlyCreated* - MBAMPROTECTOR
.
Contents of the 'Scheduled Tasks' folder
.
2015-10-22 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2014-07-15 16:19]
.
.
------- Supplementary Scan -------
.
IE: E&xportovať do programu Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.1.1
FF - ProfilePath - c:\users\Macudova\AppData\Roaming\Mozilla\Firefox\Profiles\mqmt3v33.default\
FF - prefs.js: browser.startup.homepage - about:home
.
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil32_19_0_0_226_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil32_19_0_0_226_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}]
@Denied: (A 2) (Everyone)
@="IFlashBroker6"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Completion time: 2015-10-22 08:22:11
ComboFix-quarantined-files.txt 2015-10-22 06:22
.
Pre-Run: Volných bajtů: 472 310 595 584
Post-Run: Volných bajtů: 472 224 464 896
.
- - End Of File - - C94F5B2402A059BE60B310D39D5F07D7
A36C5E4F47E84449FF07ED3517B43A31

[Rudy]

Otevřte poznámkový blok a zkopírujte do něj:

RegLock::
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\Elevation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\LocalServer32]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\TypeLib]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\ProxyStubClsid32]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\TypeLib]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]

Reboot::

Uložte na plochu jako CFScript.txt. Pak jej myší přetáhněte nad ikonu ComboFix a pusťte. CF se spustí a vykoná příkazy ze skriptu.

[plasko]

combo fix:

ComboFix 15-10-21.01 - Macudova . 10. 2015 20:57:16.2.2 - x86
Microsoft Windows 7 Home Premium 6.1.7601.1.1250.421.1029.18.1644.899 [GMT 2:00]
Running from: c:\users\Macudova\Desktop\ComboFix.exe
Command switches used :: c:\users\Macudova\Desktop\CFScript.txt
AV: avast! Antivirus *Disabled/Updated* {17AD7D40-BA12-9C46-7131-94903A54AD8B}
SP: avast! Antivirus *Disabled/Updated* {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((( Files Created from 2015-09-22 to 2015-10-22 )))))))))))))))))))))))))))))))
.
.
2015-10-22 05:55 . 2015-10-22 05:55 62576 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{42D2D794-DA60-484B-BEA1-0C43D2ADA802}\offreg.4000.dll
2015-10-21 19:46 . 2015-10-21 19:46 -------- d-----w- c:\users\Macudova\AppData\Local\VirtualStore
2015-10-21 19:39 . 2015-10-21 18:23 24064 ----a-w- c:\windows\zoek-delete.exe
2015-10-21 19:39 . 2015-10-22 19:14 -------- d-----w- c:\users\Macudova\AppData\Local\Temp
2015-10-21 16:35 . 2015-10-21 16:35 170200 ----a-w- c:\windows\system32\drivers\MBAMSwissArmy.sys
2015-10-21 16:32 . 2015-10-21 16:32 -------- d-----w- c:\program files\Malwarebytes Anti-Malware
2015-10-21 16:32 . 2015-10-05 07:50 51928 ----a-w- c:\windows\system32\drivers\mwac.sys
2015-10-21 16:32 . 2015-10-05 07:50 94936 ----a-w- c:\windows\system32\drivers\mbamchameleon.sys
2015-10-21 16:32 . 2015-10-05 07:50 23256 ----a-w- c:\windows\system32\drivers\mbam.sys
2015-10-21 16:14 . 2015-10-13 09:30 8985080 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{42D2D794-DA60-484B-BEA1-0C43D2ADA802}\mpengine.dll
2015-10-20 17:38 . 2014-05-14 16:23 45536 ----a-w- c:\windows\system32\wups2.dll
2015-10-20 17:38 . 2014-05-14 16:23 54240 ----a-w- c:\windows\system32\wuauclt.exe
2015-10-20 17:38 . 2014-05-14 16:17 2425856 ----a-w- c:\windows\system32\wucltux.dll
2015-10-20 17:38 . 2014-05-14 16:23 1973728 ----a-w- c:\windows\system32\wuaueng.dll
2015-10-20 17:37 . 2014-05-14 16:23 36320 ----a-w- c:\windows\system32\wups.dll
2015-10-20 17:37 . 2014-05-14 16:23 581600 ----a-w- c:\windows\system32\wuapi.dll
2015-10-20 17:37 . 2014-05-14 16:17 92672 ----a-w- c:\windows\system32\wudriver.dll
2015-10-20 17:37 . 2014-05-14 07:23 179656 ----a-w- c:\windows\system32\wuwebv.dll
2015-10-20 17:37 . 2014-05-14 07:17 33792 ----a-w- c:\windows\system32\wuapp.exe
2015-10-19 22:29 . 2015-10-19 23:57 -------- d-----w- C:\zoek_backup
2015-10-18 18:38 . 2015-10-19 17:42 -------- d-----w- C:\FRST
2015-10-18 18:22 . 2015-10-19 17:15 -------- d-----w- C:\AdwCleaner
2015-10-18 18:00 . 2015-10-18 18:00 -------- d-----w- c:\programdata\Malwarebytes
2015-10-18 18:00 . 2015-10-18 18:00 -------- d-----w- c:\users\Macudova\AppData\Local\Programs
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2015-10-17 16:19 . 2014-07-15 18:29 780488 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2015-10-17 16:19 . 2014-07-15 18:29 142536 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2015-07-01 19:03 645144 ----a-w- c:\program files\AVAST Software\Avast\ashShell.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2015-09-04 55357464]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2012-03-22 343168]
"AvastUI.exe"="c:\program files\AVAST Software\Avast\AvastUI.exe" [2015-07-05 5515496]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
R2 MBAMService;MBAMService;c:\program files\Malwarebytes Anti-Malware\mbamservice.exe [2015-10-05 1135416]
R2 SkypeUpdate;Skype Updater;c:\program files\Skype\Updater\Updater.exe [2015-07-09 327296]
R3 MBAMWebAccessControl;MBAMWebAccessControl;c:\windows\system32\drivers\mwac.sys [2015-10-05 51928]
R3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files\McAfee Security Scan\3.11.163\McCHSvc.exe [2015-07-31 235696]
R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUStor.sys [2014-07-15 197224]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 52224]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [2010-11-20 27264]
S0 aswRvrt;avast! Revert; [x]
S0 aswVmm;avast! VM Monitor; [x]
S1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys [2015-07-01 787760]
S1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [2015-07-05 428120]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2014-07-15 163328]
S2 AMD FUEL Service;AMD FUEL Service;c:\program files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [2012-03-21 291840]
S2 aswHwid;avast! HardwareID;c:\windows\system32\drivers\aswHwid.sys [2015-07-01 24144]
S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [2015-07-01 74976]
S2 aswStm;aswStm;c:\windows\system32\drivers\aswStm.sys [2015-07-01 106912]
S3 amdiox86;AMD IO Driver;c:\windows\system32\DRIVERS\amdiox86.sys [2010-02-18 37944]
S3 AtiHDAudioService;AMD Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW73.sys [2014-07-15 86544]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2015-10-05 23256]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt86win7.sys [2014-07-15 348776]
S3 usbfilter;AMD USB Filter Driver;c:\windows\system32\DRIVERS\usbfilter.sys [2014-07-15 35968]
.
.
--- Other Services/Drivers In Memory ---
.
*NewlyCreated* - WS2IFSL
.
Contents of the 'Scheduled Tasks' folder
.
2015-10-22 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2014-07-15 16:19]
.
.
------- Supplementary Scan -------
.
IE: E&xportovať do programu Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.1.1
FF - ProfilePath - c:\users\Macudova\AppData\Roaming\Mozilla\Firefox\Profiles\mqmt3v33.default\
FF - prefs.js: browser.startup.homepage - about:home
.
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\atieclxx.exe
c:\windows\system32\WLANExt.exe
c:\program files\AVAST Software\Avast\AvastSvc.exe
c:\windows\system32\conhost.exe
c:\windows\system32\taskhost.exe
c:\program files\Common Files\Adobe\ARM\1.0\armsvc.exe
c:\windows\system32\conhost.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
c:\program files\Windows Media Player\wmpnetwk.exe
c:\windows\system32\sppsvc.exe
.
**************************************************************************
.
Completion time: 2015-10-22 21:20:43 - machine was rebooted
ComboFix-quarantined-files.txt 2015-10-22 19:20
ComboFix2.txt 2015-10-22 06:22
.
Pre-Run: Volných bajtů: 473 716 625 408
Post-Run: Volných bajtů: 473 425 412 096
.
- - End Of File - - E6271F45949C52EE9BB1AF81EA0EF80F
A36C5E4F47E84449FF07ED3517B43A31



vidite tam, nieco? nemoze to byt len proste starym systemom a malo ram na uz dnesne poziadavky prehliadacov?

[Rudy]

Klíče odemknuty a jinak je log čistý. V kterém prohlížeči ten problém máte?

[plasko]

aj firefox aj internet explorer, ovela pomalsie nacitava stranky hlavne s vacsim obsahom obrazkov, ak ich vobec nacita, cca 30-60 sekund na jednu random vyzobrazenu obrazovku s obrazkami pri vyhladavani v google.

[Rudy]

FF zazálohujte pomocí MozBackup: http://www.stahuj.centrum.cz/utility_a_ ... mozbackup/ . Pak FF odinstalujte vč. jeho profilu. Znovu nainstalujte a zpět ze zálohy nakopírujte pouze záložky a hesla.

[plasko]

asi to uz o daco rychlejsie je cakacia doma sa znizila asi na 10-15 sekund a to je uz pri 1gb ram a win 7 pochopitelne, mozno som este rozmyslal ci avast nemoze byt nejako zle nastaveny na nejaku prehnanu kontrolu webu

[Rudy]

Avast můžete zkusit přeinstalovat a ještě můžete defragmentovat disk.

[plasko]

ani avast ani defragmentacia nepomohli :\ skusim este rozsirit ram o dalsie 2gb tak snad to trochu uvolni zatazenie procesora a bude to plynulejsie, lebo som si vsimol ze pri tom vybieha zatazenie ram aj procesora na 100% kym nacita, tak dufam pomoze to ked tam uz nie je ziadna haved ktora by mohla ten notebook zatazovat, dakujem velmi pekne za pomoc a ochotu, ste super mozno este mala otazka na zaver: mate nejaky tip na prehliadac ktory najmenej zatazuje system alebo aspon procesor?

[Rudy]

Zvětšení RAM je samozřejmě řešení. Osobně používám FF a nemám se zátěží systému problém. Chrome je asi prohlížeč s nejmenší zátěží systému.

[plasko]

tak s čgb ram to uy ide sviznejsie len facebook je stale sekavy a pomaly ale to uz je asi iba inovaciami co popridavali a na to uz tento notebook asi nema, aspon ze ostatne surfovanie ide uz v poriadku dakujem pekne mozem este poprosit o kontrolu logu ci som vsetko spravne odinstaloval, vymazal?

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version:24-10-2015
Ran by Macudova (administrator) on MACUDOVA-PC (24-10-2015 18:19:45)
Running from C:\Users\Macudova\Downloads
Loaded Profiles: Macudova (Available Profiles: Macudova)
Platform: Microsoft Windows 7 Home Premium Service Pack 1 (X86) Language: Čeština (Česká republika)
Internet Explorer Version 8 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/33 ... scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Avast Software s.r.o.) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Avast Software s.r.o.) C:\Program Files\AVAST Software\Avast\avastui.exe
(Skype Technologies S.A.) C:\Program Files\Skype\Phone\Skype.exe
(Advanced Micro Devices Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(Advanced Micro Devices, Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe
(ATI Technologies Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe
(Microsoft Corporation) C:\Windows\System32\msiexec.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe


==================== Registry (Whitelisted) ===========================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [StartCCC] => C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [343168 2012-03-22] (Advanced Micro Devices, Inc.)
HKLM\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [5515496 2015-07-05] (Avast Software s.r.o.)
HKU\S-1-5-21-3330394515-2274666363-1482153923-1000\...\Run: [Skype] => C:\Program Files\Skype\Phone\Skype.exe [55357464 2015-09-04] (Skype Technologies S.A.)
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShell.dll [2015-07-01] (Avast Software s.r.o.)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
Tcpip\..\Interfaces\{FCD3F1A5-8532-4CA7-981B-128F431D158F}: [DhcpNameServer] 192.168.1.1

Internet Explorer:
==================
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
HKU\S-1-5-21-3330394515-2274666363-1482153923-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
HKU\S-1-5-21-3330394515-2274666363-1482153923-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\S-1-5-21-3330394515-2274666363-1482153923-1000\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://www.msn.com/?ocid=iehp
SearchScopes: HKU\S-1-5-21-3330394515-2274666363-1482153923-1000 -> {012E1000-F331-11DB-8314-0800200C9A66} URL = hxxp://www.google.com/search?q={searchTerms}
BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll [2015-07-01] (Avast Software s.r.o.)
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxps://fpdownload.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Handler: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll No File

FireFox:
========
FF ProfilePath: C:\Users\Macudova\AppData\Roaming\Mozilla\Firefox\Profiles\mqmt3v33.default
FF NewTab: about:newtab
FF Homepage: about:home
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_19_0_0_226.dll [2015-10-17] ()
FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2015-09-27] (Adobe Systems Inc.)
FF Extension: Skype Click to Call - C:\Program Files\Mozilla Firefox\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}.xpi [2015-10-08]
FF HKLM\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: Avast Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2015-07-01] [not signed]

Chrome:
=======
CHR HKLM\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2015-07-01]

==================== Services (Whitelisted) ========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [291840 2012-03-21] (Advanced Micro Devices, Inc.) [File not signed]
R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [343336 2015-07-01] (Avast Software s.r.o.)
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [680960 2009-07-14] (Microsoft Corporation)

===================== Drivers (Whitelisted) ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [24144 2015-07-01] ()
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [74976 2015-07-01] (Avast Software s.r.o.)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [81728 2015-07-01] (Avast Software s.r.o.)
R0 aswRvrt; C:\Windows\system32\Drivers\aswRvrt.sys [49904 2015-07-01] ()
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [787760 2015-07-01] (Avast Software s.r.o.)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [428120 2015-07-05] (Avast Software s.r.o.)
R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [106912 2015-07-01] (Avast Software s.r.o.)
R0 aswVmm; C:\Windows\system32\Drivers\aswVmm.sys [209048 2015-07-01] ()
U5 AppMgmt; C:\Windows\system32\svchost.exe [20992 2009-07-14] (Microsoft Corporation)
S3 catchme; \??\C:\Users\Macudova\AppData\Local\Temp\catchme.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-10-24 18:19 - 2015-10-24 18:19 - 00000000 ____D C:\Users\Macudova\Downloads\FRST-OlderVersion
2015-10-23 19:49 - 2015-10-24 18:16 - 00000000 ____D C:\Users\Macudova\AppData\Local\Google
2015-10-23 19:49 - 2015-10-24 18:16 - 00000000 ____D C:\Program Files\Google
2015-10-23 19:48 - 2015-10-23 19:48 - 00929872 _____ (Google Inc.) C:\Users\Macudova\Downloads\ChromeSetup.exe
2015-10-22 22:26 - 2015-10-22 22:26 - 00001121 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2015-10-22 22:26 - 2015-10-22 22:26 - 00001109 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk
2015-10-22 22:16 - 2015-10-24 18:16 - 00000000 ____D C:\Program Files\MozBackup
2015-10-22 22:15 - 2015-10-22 22:15 - 01035926 _____ C:\Users\Macudova\Downloads\MozBackup-1.5.1-EN.exe
2015-10-22 21:20 - 2015-10-22 21:20 - 00007701 _____ C:\ComboFix.txt
2015-10-22 07:57 - 2011-06-26 08:45 - 00256000 _____ C:\Windows\PEV.exe
2015-10-22 07:57 - 2010-11-07 19:20 - 00208896 _____ C:\Windows\MBR.exe
2015-10-22 07:57 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2015-10-22 07:57 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2015-10-22 07:57 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2015-10-22 07:57 - 2000-08-31 02:00 - 00098816 _____ C:\Windows\sed.exe
2015-10-22 07:57 - 2000-08-31 02:00 - 00080412 _____ C:\Windows\grep.exe
2015-10-22 07:57 - 2000-08-31 02:00 - 00068096 _____ C:\Windows\zip.exe
2015-10-22 07:56 - 2015-10-22 21:20 - 00000000 ____D C:\Qoobox
2015-10-22 07:56 - 2015-10-22 21:12 - 00000000 ____D C:\Windows\erdnt
2015-10-21 21:46 - 2015-10-21 21:46 - 00000000 ____D C:\Users\Macudova\AppData\Local\VirtualStore
2015-10-21 21:39 - 2015-10-21 20:23 - 00024064 _____ C:\Windows\zoek-delete.exe
2015-10-21 20:25 - 2015-10-20 02:09 - 00008693 _____ C:\zoek-results2015-10-20-000914.log
2015-10-21 18:26 - 2015-10-21 18:27 - 22908888 _____ (Malwarebytes ) C:\Users\Macudova\Downloads\mbam-setup-2.2.0.1024(1).exe
2015-10-20 19:38 - 2014-05-14 18:23 - 01973728 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll
2015-10-20 19:38 - 2014-05-14 18:23 - 00054240 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe
2015-10-20 19:38 - 2014-05-14 18:23 - 00045536 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll
2015-10-20 19:38 - 2014-05-14 18:17 - 02425856 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll
2015-10-20 19:37 - 2014-05-14 18:23 - 00581600 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll
2015-10-20 19:37 - 2014-05-14 18:23 - 00036320 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll
2015-10-20 19:37 - 2014-05-14 18:17 - 00092672 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll
2015-10-20 19:37 - 2014-05-14 09:23 - 00179656 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll
2015-10-20 19:37 - 2014-05-14 09:17 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe
2015-10-20 19:32 - 2015-10-20 19:32 - 00889416 _____ (Microsoft Corporation) C:\Users\Macudova\Downloads\dotNetFx40_Full_setup.exe
2015-10-20 00:32 - 2015-10-21 21:46 - 00006875 _____ C:\zoek-results.log
2015-10-20 00:29 - 2015-10-20 01:57 - 00000000 ____D C:\zoek_backup
2015-10-19 19:15 - 2015-10-19 19:15 - 01691648 _____ C:\Users\Macudova\Downloads\adwcleaner_5.014.exe
2015-10-18 20:40 - 2015-10-18 20:41 - 00014831 _____ C:\Users\Macudova\Downloads\Addition.txt
2015-10-18 20:38 - 2015-10-24 18:19 - 00006917 _____ C:\Users\Macudova\Downloads\FRST.txt
2015-10-18 20:38 - 2015-10-24 18:19 - 00000000 ____D C:\FRST
2015-10-18 20:24 - 2015-10-24 18:19 - 01700352 _____ (Farbar) C:\Users\Macudova\Downloads\FRST.exe
2015-10-18 20:22 - 2015-10-19 19:15 - 00000000 ____D C:\AdwCleaner
2015-10-18 20:20 - 2015-10-18 20:21 - 01682432 _____ C:\Users\Macudova\Downloads\adwcleaner_5.013.exe
2015-10-18 20:00 - 2015-10-18 20:00 - 00000000 ____D C:\ProgramData\Malwarebytes
2015-10-18 19:59 - 2015-10-18 20:00 - 22908888 _____ (Malwarebytes ) C:\Users\Macudova\Downloads\mbam-setup-2.2.0.1024.exe
2015-10-15 19:44 - 2015-10-22 22:26 - 00000000 ____D C:\Program Files\Mozilla Firefox

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-10-24 18:19 - 2014-07-15 20:29 - 00000914 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-10-24 18:18 - 2009-07-14 06:34 - 00021264 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-10-24 18:18 - 2009-07-14 06:34 - 00021264 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-10-24 18:17 - 2014-07-15 20:21 - 00000000 ____D C:\Users\Macudova\AppData\Roaming\Skype
2015-10-24 18:01 - 2009-07-14 06:53 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2015-10-24 18:01 - 2009-07-14 06:39 - 00035315 _____ C:\Windows\setupact.log
2015-10-24 03:05 - 2014-07-14 20:26 - 01535417 _____ C:\Windows\WindowsUpdate.log
2015-10-23 20:24 - 2010-11-20 23:48 - 00029002 _____ C:\Windows\PFRO.log
2015-10-22 22:23 - 2014-07-30 09:58 - 00000000 ____D C:\Program Files\Mozilla Maintenance Service
2015-10-22 21:14 - 2009-07-14 04:04 - 00000215 _____ C:\Windows\system.ini
2015-10-22 08:22 - 2009-07-14 04:37 - 00000000 __RHD C:\Users\Default
2015-10-22 08:22 - 2009-07-14 04:37 - 00000000 ___RD C:\Users\Public
2015-10-21 18:16 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\rescache
2015-10-20 20:37 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\Microsoft.NET
2015-10-20 19:48 - 2010-11-20 23:01 - 01546306 _____ C:\Windows\system32\PerfStringBackup.INI
2015-10-20 19:37 - 2014-07-14 20:50 - 00000000 ____D C:\Program Files\Microsoft.NET
2015-10-19 19:39 - 2014-10-30 20:25 - 00000000 ___RD C:\Program Files\Skype
2015-10-17 18:19 - 2014-07-15 20:29 - 00780488 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2015-10-17 18:19 - 2014-07-15 20:29 - 00142536 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2015-10-16 19:19 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\system32\NDF
2015-10-15 19:38 - 2014-07-15 20:42 - 00002441 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk
2015-10-14 11:11 - 2014-07-15 20:20 - 00000000 ____D C:\ProgramData\Skype

==================== Bamital & volsnap =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\dnsapi.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-10-21 18:12

==================== End of FRST.txt ============================

[Rudy]

Ještě přejmenujte CF na uninstall a spusťte CF se spustí a odinstaluje. Jinak OK.