Problém při spouštění Windows xp

[earl]

Pouzijte T-Cleaner na vycisteni pc po utilitach pouzitych pri odvirovani.Postupujte dle instrukci na obrazovce.Pri detekci antivirem se jedna o falesny poplach.
-----------------------------------------------------------------------------------------------------------------

Vycistete pc Ccleanerem.

Vzdy nejprve Analyzovat a pak Spustit Cleaner.2x po sobe.

Windows-odskrtnout historii a historii automatickeho vyplnovani formularu - prisel byste o historii navstivenych stranek a o ulozena hesla ve formularich

(je to sice z pohledu zabezpeceni spatne,ale aspon pak uzivatel nenadava,kam ze mu to zmizelo )

Aplikace-u prohlizecu internetu odskrtnout Historii internetu.

Registry-nechat vse zaskrtle,Hledej problemy,Opravit vybrane problemy

(nechat ho udelat zalohu-ta je ulozena v Dokumentech-DULEZITE).

Taktez 2x-3x po sobe.

A nemate zac.

[DavidHron]

Vykonáno vše dle vašich pokynů.
Tak jsem to dnes ráno zkoušel a udělalo mi to znova to samé .Najede obrazovka Windows pak se to se sekne,restartuju to a potom to vše najede rychle jako by se nic nestalo.Já fakt nevím.

[earl]

CTETE POZORNE NAVOD,TENTO SOFT NETOLERUJE CHYBY V POSTUPU APLIKOVANI!

Klidne si nasledujici radky vytisknete,at vite,co se bude na obrazovce odehravat.

Budte prihlasen na pc s administratorskymi pravy.

stahnete a ulozte nejlepe na plochu ComboFix

v pripade,ze nepujde stranka nacist-stahnete odtud download , popr. nepujde ComboFix spustit - prejmenujte jej na grinder.com a postupujte dale dle instrukci.

hned po startu se zobrazi Zreknuti se prava zaruky na funkcnost software, pokracujte kliknutim na tlacitko Ano:



pote muze nasledovat upozorneni na nainstalovane emulatory CD mechanik,typicky Daemon Tools nebo Alcohol 120



odklepnout OK

Souhlasit s instalaci Recovery console(Konzola pro zotaveni)-nutno funkcni internet

v klidu si postavte na kafe (cela akce trva cca. 5-10 minut, nekdy i dele - dle toho, o jak rychly stroj se jedna a kolika soubory se skener bude muset prodirat), behem skenu se nepokousejte spoustet zadne jine aplikace ani nic jineho

behem skenovani nepropadejte panice, vas stroj muze byt restartovan (predevsim pri prvni aplikaci skeneru)

upozorneni: upozorneni: Vypnete rezidentni stit u antiviru a antispywaru a zakazte docasne firewall-ComboFix by nemusel fungovat korektne-pokud budete mit stity vypnute a Combofix zahlasi,ze nejsou,pokracujte dal a potvrdte.

po restartu aplikace vytvori log, ulozeny na C:/Combofix.txt (pri opakovanem pouziti jsou logy oznaceny Combofix2.txt atd.), jeho obsah vlozte sem

[DavidHron]

Dobrý den,zasílám log
ComboFix 10-01-01.02 - Administrator 02.01.2010 13:58:57.4.1 - x86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.420.1029.18.2046.1495 [GMT 1:00]
Spuštěný z: c:\documents and settings\Administrator\Plocha\grinder.com.exe
AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
FW: NVIDIA Firewall *enabled* {EDC10449-64D1-46c7-A59A-EC20D662F26D}
FW: Sunbelt Personal Firewall *disabled* {82B1150E-9B37-49FC-83EB-D52197D900D0}
.

((((((((((((((((((((((((( Soubory vytvořené od 2009-12-02 do 2010-01-02 )))))))))))))))))))))))))))))))
.

2009-12-27 15:33 . 2009-12-27 17:04 -------- d-----w- c:\program files\Crawler
2009-12-27 15:33 . 2009-12-27 15:33 142592 ----a-w- c:\windows\system32\drivers\sp_rsdrv2.sys
2009-12-27 15:33 . 2009-12-27 15:39 -------- d-----w- c:\program files\Spyware Terminator
2009-12-26 15:20 . 2009-12-26 17:04 -------- d-----w- c:\program files\HD Tune
2009-12-26 14:39 . 2006-09-29 12:26 176165 ----a-w- c:\windows\system32\drv23260.dll
2009-12-26 14:39 . 2006-09-29 12:25 208935 ----a-w- c:\windows\system32\drv33260.dll
2009-12-26 14:39 . 2006-09-29 12:24 217127 ----a-w- c:\windows\system32\drv43260.dll
2009-12-26 14:39 . 2002-12-10 02:20 102439 ----a-w- c:\windows\system32\sipr3260.dll
2009-12-26 14:39 . 2007-03-18 20:37 65602 ----a-w- c:\windows\system32\cook3260.dll
2009-12-26 14:39 . 2006-05-20 16:16 1184984 ----a-w- c:\windows\system32\wvc1dmod.dll
2009-12-26 14:39 . 2006-05-11 19:21 626688 ----a-w- c:\windows\system32\vp7vfw.dll
2009-12-26 14:39 . 2009-12-26 14:39 -------- d-----w- c:\program files\VSO
2009-12-20 12:14 . 2008-10-31 06:09 270888 ----a-r- c:\windows\system32\drivers\SbFw.sys
2009-12-20 12:14 . 2008-06-21 03:54 65576 ----a-w- c:\windows\system32\drivers\SbFwIm.sys
2009-12-20 12:14 . 2009-12-20 12:14 -------- d-----w- c:\program files\Sunbelt Software
2009-12-18 10:12 . 2009-12-18 10:13 -------- d-----w- c:\program files\QuickTime
2009-12-18 09:46 . 2009-12-18 09:46 -------- d-sh--w- c:\documents and settings\NetworkService\IETldCache
2009-12-16 21:55 . 2009-12-26 13:38 -------- d-----w- c:\program files\Common Files\Apple
2009-12-16 07:53 . 2009-12-16 07:53 -------- d-----w- c:\windows\system32\wbem\Repository
2009-12-14 20:25 . 2009-12-14 20:50 -------- d-----w- c:\program files\Dragon Age
2009-12-14 20:25 . 2009-12-14 20:47 -------- d-----w- c:\program files\Common Files\BioWare
2009-12-09 21:29 . 2009-12-09 21:29 -------- d--h--w- c:\windows\PIF
2009-12-09 12:31 . 2009-12-09 12:34 -------- d-----w- c:\program files\MP3Gain
2009-12-09 12:24 . 2009-12-09 12:25 -------- d-----w- c:\program files\mp3DirectCut

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-12-27 16:58 . 2009-09-20 19:25 -------- d-----w- c:\program files\Nero
2009-12-27 16:58 . 2009-09-20 19:24 -------- d-----w- c:\program files\Common Files\Nero
2009-12-27 16:40 . 2009-09-24 22:03 -------- d-----w- c:\program files\Ahead
2009-12-27 15:23 . 2009-10-17 13:13 -------- d-----w- c:\program files\Spybot - Search & Destroy
2009-12-26 14:39 . 2009-09-20 20:33 47360 ----a-w- c:\windows\system32\drivers\pcouffin.sys
2009-12-26 14:34 . 2009-10-23 14:01 -------- d-----w- c:\program files\Total Video Converter
2009-12-26 12:38 . 2009-09-24 22:29 -------- d-----w- c:\program files\XP Repair Pro 2007
2009-12-26 12:36 . 2009-11-10 17:04 -------- d-----w- c:\program files\Gabest
2009-12-26 12:34 . 2009-09-24 23:06 -------- d-----w- c:\program files\RegistryFix7
2009-12-26 12:32 . 2009-09-30 13:02 -------- d-----w- c:\program files\Lavalys
2009-12-26 12:32 . 2009-09-20 20:33 -------- d-----w- c:\program files\DVDFab 5
2009-12-26 12:31 . 2009-11-10 18:43 -------- d-----w- c:\program files\DVD Flick
2009-12-26 12:31 . 2009-09-19 23:41 -------- d-----w- c:\program files\Creative
2009-12-26 12:28 . 2009-11-10 17:03 -------- d-----w- c:\program files\AviSynth 2.5
2009-12-26 09:43 . 2009-09-18 20:15 -------- d-----w- c:\program files\Winamp
2009-12-24 13:18 . 2009-09-18 20:41 -------- d-----w- c:\program files\uTorrent
2009-12-20 08:04 . 2009-09-30 07:14 -------- d-----w- c:\program files\trend micro
2009-12-16 21:59 . 2009-09-22 22:02 411368 ----a-w- c:\windows\system32\deploytk.dll
2009-12-14 20:47 . 2009-09-29 20:25 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard
2009-12-14 20:07 . 2009-10-04 13:05 -------- d-----w- c:\program files\Bethesda Softworks
2009-12-14 19:58 . 2009-09-18 16:04 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-12-14 17:48 . 2009-10-04 18:43 -------- d-----w- c:\program files\Activision
2009-12-11 08:27 . 2003-04-16 12:00 77782 ----a-w- c:\windows\system32\perfc005.dat
2009-12-11 08:27 . 2003-04-16 12:00 429246 ----a-w- c:\windows\system32\perfh005.dat
2009-12-07 15:55 . 2009-09-18 19:21 56816 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2009-11-30 13:19 . 2009-11-28 17:13 -------- d-----w- c:\program files\Perfect Uninstaller
2009-11-28 17:11 . 2009-11-28 17:11 -------- d-----w- c:\program files\Godlike Developers
2009-11-28 07:32 . 2009-11-28 07:32 18 ----a-w- c:\program files\XP Repair Pro 2007ERR_Item5-11-28-2009_8-28-11_1813140.dnp
2009-11-28 07:31 . 2009-11-28 07:31 18 ----a-w- c:\program files\XP Repair Pro 2007ERR_Item5-11-28-2009_8-28-11_670033.dnp
2009-11-10 18:41 . 2009-11-10 17:03 -------- d-----w- c:\program files\Xvid
2009-11-09 19:02 . 2009-09-22 21:54 -------- d-----w- c:\program files\Common Files\Adobe
2009-11-05 11:09 . 2009-09-22 21:59 -------- d-----w- c:\program files\Common Files\Real
2009-11-05 11:09 . 2009-11-05 11:09 -------- d-----w- c:\program files\Common Files\xing shared
2009-11-05 11:09 . 2009-09-20 20:26 348160 ----a-w- c:\windows\system32\msvcr71.dll
2009-11-05 11:09 . 2009-09-20 20:26 499712 ----a-w- c:\windows\system32\msvcp71.dll
2009-11-05 11:09 . 2009-09-22 21:59 -------- d-----w- c:\program files\Real
2009-10-29 07:43 . 2003-04-16 12:00 916480 ----a-w- c:\windows\system32\wininet.dll
2009-10-23 14:39 . 2009-10-02 08:25 64760 ----a-w- c:\windows\system32\GDIPFONTCACHEV1.DAT
2009-10-21 05:40 . 2009-09-18 15:51 25088 ----a-w- c:\windows\system32\httpapi.dll
2009-10-21 05:40 . 2009-09-18 15:51 75776 ----a-w- c:\windows\system32\strmfilt.dll
2009-10-20 16:20 . 2009-09-18 15:51 265728 ------w- c:\windows\system32\drivers\http.sys
2009-10-13 10:34 . 2003-04-16 12:00 271360 ----a-w- c:\windows\system32\oakley.dll
2009-10-12 13:40 . 2003-04-16 12:00 79872 ----a-w- c:\windows\system32\raschap.dll
2009-10-12 13:40 . 2003-04-16 12:00 150016 ----a-w- c:\windows\system32\rastls.dll
2009-09-18 19:03 . 2009-09-18 19:03 5866152 ----a-w- c:\program files\FirefoxSetup2.0.0.20.exe
2009-09-18 19:00 . 2009-09-18 19:00 6679224 ----a-w- c:\program files\Thunderbird Setup 2.0.0.23.exe
.

(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SpywareTerminatorUpdate"="c:\program files\Spyware Terminator\SpywareTerminatorUpdate.exe" [2009-12-27 3037696]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2009-11-05 198160]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-10-03 35696]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2009-09-04 935288]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-12-16 149280]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-11-10 417792]
"SpywareTerminator"="c:\program files\Spyware Terminator\SpywareTerminatorShield.exe" [2009-12-27 2166784]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2008-04-14 15360]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"NoSecCpl"= 0 (0x0)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoStartMenuSubFolders"= 0 (0x0)
"NoCommonGroups"= 0 (0x0)
"NoPrinters"= 0 (0x0)
"NoRecentDocsNetHood"= 0 (0x0)
"NoChangeAnimation"= 0 (0x0)

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0sprecovr \SystemRoot\sprecovr.txt

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2009-10-03 03:08 35696 ----a-w- c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BDRegion]
2007-11-16 18:20 91432 ----a-w- c:\program files\CyberLink\Shared files\brs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LanguageShortcut]
2007-10-11 10:06 62760 ------w- c:\program files\CyberLink\PowerDVD\Language\Language.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2009-11-10 22:08 417792 ----a-w- c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
2007-10-28 07:35 72736 ------w- c:\program files\CyberLink\PowerDVD\PDVDServ.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]
2009-12-18 00:30 39424 ----a-w- c:\program files\Winamp\winampa.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Dragon Age\\bin_ship\\daorigins.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
"AllowInboundEchoRequest"= 1 (0x1)

R0 nvcchflt;NVIDIA Disk Cache Filter Driver;c:\windows\system32\drivers\nvcchflt.sys [11.2.2005 17:11 16640]
R0 Vax347b;Vax347b;c:\windows\system32\drivers\Vax347b.sys [19.11.2009 10:36 159616]
R0 Vax347s;Vax347s;c:\windows\system32\drivers\Vax347s.sys [19.11.2009 10:36 5248]
R1 SbFw;SbFw;c:\windows\system32\drivers\SbFw.sys [20.12.2009 13:14 270888]
R1 sbhips;Sunbelt HIPS Driver;c:\windows\system32\drivers\sbhips.sys [21.6.2008 4:54 66600]
R1 sp_rsdrv2;Spyware Terminator Driver 2;c:\windows\system32\drivers\sp_rsdrv2.sys [27.12.2009 16:33 142592]
R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [18.9.2009 20:21 108289]
R2 SbPF.Launcher;SbPF.Launcher;c:\program files\Sunbelt Software\Personal Firewall\SbPFLnch.exe [31.10.2008 7:24 95528]
R2 SPF4;Sunbelt Personal Firewall 4;c:\program files\Sunbelt Software\Personal Firewall\SbPFSvc.exe [31.10.2008 7:24 1365288]
R3 SBFWIMCL;Sunbelt Software Firewall NDIS IM Filter Miniport;c:\windows\system32\drivers\SbFwIm.sys [20.12.2009 13:14 65576]
S0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [20.9.2009 0:26 721904]
S3 DAUpdaterSvc;Dragon Age: Origins - Content Updater;c:\program files\Dragon Age\bin_ship\daupdatersvc.service.exe [14.12.2009 21:38 25832]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.seznam.cz/
mStart Page = about:blank
uInternet Connection Wizard,ShellNext = "c:\program files\Outlook Express\msimn.exe" //mailurl:mailto:?body=http%3A%2F%2Ffhg.dacash.com%2Fgals%2Fnewmol%2Fvideo%2F3%2F8%2Fgallery%2Fmovie1.wmv&subject=
IE: E&xportovat do aplikace Microsoft Office Excel - c:\progra~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
LSP: %SYSTEMROOT%\system32\nvappfilter.dll
FF - ProfilePath - c:\documents and settings\Administrator\Data aplikací\Mozilla\Firefox\Profiles\nc52e2xk.default\
FF - prefs.js: browser.startup.homepage - www.seznam.cz
FF - component: c:\program files\real\realplayer\browserrecord\firefox\ext\components\nprpffbrowserrecordext.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- NASTAVENÍ FIREFOXU ----
c:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".cz");
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -

MSConfigStartUp-iTunesHelper - c:\program files\iTunes\iTunesHelper.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-01-02 14:11
Windows 5.1.2600 Service Pack 3 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntkrnlpa.exe catchme.sys CLASSPNP.SYS disk.sys ACPI.sys hal.dll >>UNKNOWN [0x8A1C74C0]<<
kernel: MBR read successfully
detected MBR rootkit hooks:
\Driver\Disk -> CLASSPNP.SYS @ 0xba10cf28
\Driver\ACPI -> ACPI.sys @ 0xb9f58cb8
\Driver\atapi -> atapi.sys @ 0xb9eea852
IoDeviceObjectType -> DeleteProcedure -> ntkrnlpa.exe @ 0x80579022
ParseProcedure -> ntkrnlpa.exe @ 0x80577c84
\Device\Harddisk0\DR0 -> DeleteProcedure -> ntkrnlpa.exe @ 0x80579022
ParseProcedure -> ntkrnlpa.exe @ 0x80577c84
NDIS: NVIDIA nForce Networking Controller -> SendCompleteHandler -> NDIS.sys @ 0xb9dc8bb0
PacketIndicateHandler -> NDIS.sys @ 0xb9db7a0d
SendHandler -> NDIS.sys @ 0xb9dcbb40
user & kernel MBR OK

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet002\Services\{95808DC4-FA4A-4C74-92FE-5B863F82066B}]
"ImagePath"="\??\c:\program files\CyberLink\PowerDVD\000.fcl"
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------

[HKEY_USERS\S-1-5-21-796845957-1123561945-725345543-500\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (Administrator)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,5f,d8,be,bb,cd,12,84,46,89,b5,d2,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,5f,d8,be,bb,cd,12,84,46,89,b5,d2,\

[HKEY_USERS\S-1-5-21-796845957-1123561945-725345543-500\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:1c,bf,4c,77,ff,ba,78,c8,c3,e2,6d,e0,70,f3,40,43,88,17,3e,68,90,14,cd,
bf,45,30,22,17,c3,07,e3,ee,7b,c0,43,b8,c5,a7,ed,6b,b4,44,8b,82,13,55,7c,6e,\
"??"=hex:35,fc,c6,3d,c9,02,ad,db,37,1f,61,de,0f,33,8f,50

[HKEY_USERS\S-1-5-21-796845957-1123561945-725345543-500\Software\SecuROM\License information*]
"datasecu"=hex:2b,a0,11,7c,4e,2c,0d,ac,44,08,e7,c5,4a,64,1a,81,30,45,e5,90,10,
34,04,8a,66,82,15,9a,ef,fb,13,44,ad,d2,cd,d1,97,44,dd,ce,24,c7,0a,ba,f7,59,\
"rkeysecu"=hex:44,5e,dd,66,6d,63,8c,61,a6,7b,3f,98,4f,d4,7e,46
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'winlogon.exe'(1444)
c:\windows\system32\Ati2evxx.dll
.
Celkový čas: 2010-01-02 14:14:46
ComboFix-quarantined-files.txt 2010-01-02 13:14

Před spuštěním: Volných bajtů: 39 440 502 784
Po spuštění: Volných bajtů: 39 401 111 552

- - End Of File - - E599641AB483B03452D29B2CE210EA85

[earl]

pokud jste tak jeste neucinil(a), presunte Combofix na plochu

otevrete si Poznamkovy blok

do nej zkopirujte skript z nasledujiciho okna:

Kód: Vybrat vše

KILLALL::
RESTORE::
C:\WINDOWS\system32\drivers\atapi.sys
srpeek::
C:\WINDOWS\system32\drivers\atapi.sys
Reboot::

ulozte vami vytvoreny textovy soubor jako CFScript.txt na plochu

po ulozeni uchopte vami vytvoreny skript levym tlacitkem mysi a presunte jej nad ikonu Combofixu, nad niz skript upustte:



po aplikaci by na vas mel vyskocit dalsi log, vlozte jej sem

Upozorneni: je mozne, ze po aplikaci skriptu a restartu nenabehnou Windows, v takovem pripade znovu restartujte, po restartu mackejte F8 a zvolte Posledni znamou funkcni konfiguraci

[DavidHron]

Asi když sken byl kolem 50 pc se samo restartovalo ,nechal jsem udělat log a zasílám ho

ComboFix 10-01-01.05 - Administrator 02.01.2010 17:19:26.5.1 - x86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.420.1029.18.2046.1587 [GMT 1:00]
Spuštěný z: c:\documents and settings\Administrator\Plocha\ComboFix.exe
Použité ovládací přepínače :: c:\documents and settings\Administrator\Plocha\CFScript.txt.txt
AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
FW: NVIDIA Firewall *enabled* {EDC10449-64D1-46c7-A59A-EC20D662F26D}
FW: Sunbelt Personal Firewall *disabled* {82B1150E-9B37-49FC-83EB-D52197D900D0}
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

Nakažená kopie c:\windows\system32\drivers\atapi.sys byla nalezena a vyléčena.
Obnovena kopie z - c:\windows\ERDNT\cache\atapi.sys

.
((((((((((((((((((((((((( Soubory vytvořené od 2009-12-02 do 2010-01-02 )))))))))))))))))))))))))))))))
.

2009-12-27 15:33 . 2009-12-27 17:04 -------- d-----w- c:\program files\Crawler
2009-12-27 15:33 . 2009-12-27 15:33 142592 ----a-w- c:\windows\system32\drivers\sp_rsdrv2.sys
2009-12-27 15:33 . 2010-01-02 16:29 -------- d-----w- c:\program files\Spyware Terminator
2009-12-26 15:20 . 2009-12-26 17:04 -------- d-----w- c:\program files\HD Tune
2009-12-26 14:39 . 2006-09-29 12:26 176165 ----a-w- c:\windows\system32\drv23260.dll
2009-12-26 14:39 . 2006-09-29 12:25 208935 ----a-w- c:\windows\system32\drv33260.dll
2009-12-26 14:39 . 2006-09-29 12:24 217127 ----a-w- c:\windows\system32\drv43260.dll
2009-12-26 14:39 . 2002-12-10 02:20 102439 ----a-w- c:\windows\system32\sipr3260.dll
2009-12-26 14:39 . 2007-03-18 20:37 65602 ----a-w- c:\windows\system32\cook3260.dll
2009-12-26 14:39 . 2006-05-20 16:16 1184984 ----a-w- c:\windows\system32\wvc1dmod.dll
2009-12-26 14:39 . 2006-05-11 19:21 626688 ----a-w- c:\windows\system32\vp7vfw.dll
2009-12-26 14:39 . 2009-12-26 14:39 -------- d-----w- c:\program files\VSO
2009-12-20 12:14 . 2008-10-31 06:09 270888 ----a-r- c:\windows\system32\drivers\SbFw.sys
2009-12-20 12:14 . 2008-06-21 03:54 65576 ----a-w- c:\windows\system32\drivers\SbFwIm.sys
2009-12-20 12:14 . 2009-12-20 12:14 -------- d-----w- c:\program files\Sunbelt Software
2009-12-18 10:12 . 2009-12-18 10:13 -------- d-----w- c:\program files\QuickTime
2009-12-18 09:46 . 2009-12-18 09:46 -------- d-sh--w- c:\documents and settings\NetworkService\IETldCache
2009-12-16 21:55 . 2009-12-26 13:38 -------- d-----w- c:\program files\Common Files\Apple
2009-12-16 07:53 . 2009-12-16 07:53 -------- d-----w- c:\windows\system32\wbem\Repository
2009-12-14 20:25 . 2009-12-14 20:50 -------- d-----w- c:\program files\Dragon Age
2009-12-14 20:25 . 2009-12-14 20:47 -------- d-----w- c:\program files\Common Files\BioWare
2009-12-09 21:29 . 2009-12-09 21:29 -------- d--h--w- c:\windows\PIF
2009-12-09 12:31 . 2009-12-09 12:34 -------- d-----w- c:\program files\MP3Gain
2009-12-09 12:24 . 2009-12-09 12:25 -------- d-----w- c:\program files\mp3DirectCut

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-12-27 16:58 . 2009-09-20 19:25 -------- d-----w- c:\program files\Nero
2009-12-27 16:58 . 2009-09-20 19:24 -------- d-----w- c:\program files\Common Files\Nero
2009-12-27 16:40 . 2009-09-24 22:03 -------- d-----w- c:\program files\Ahead
2009-12-27 15:23 . 2009-10-17 13:13 -------- d-----w- c:\program files\Spybot - Search & Destroy
2009-12-26 14:39 . 2009-09-20 20:33 47360 ----a-w- c:\windows\system32\drivers\pcouffin.sys
2009-12-26 14:34 . 2009-10-23 14:01 -------- d-----w- c:\program files\Total Video Converter
2009-12-26 12:38 . 2009-09-24 22:29 -------- d-----w- c:\program files\XP Repair Pro 2007
2009-12-26 12:36 . 2009-11-10 17:04 -------- d-----w- c:\program files\Gabest
2009-12-26 12:34 . 2009-09-24 23:06 -------- d-----w- c:\program files\RegistryFix7
2009-12-26 12:32 . 2009-09-30 13:02 -------- d-----w- c:\program files\Lavalys
2009-12-26 12:32 . 2009-09-20 20:33 -------- d-----w- c:\program files\DVDFab 5
2009-12-26 12:31 . 2009-11-10 18:43 -------- d-----w- c:\program files\DVD Flick
2009-12-26 12:31 . 2009-09-19 23:41 -------- d-----w- c:\program files\Creative
2009-12-26 12:28 . 2009-11-10 17:03 -------- d-----w- c:\program files\AviSynth 2.5
2009-12-26 09:43 . 2009-09-18 20:15 -------- d-----w- c:\program files\Winamp
2009-12-24 13:18 . 2009-09-18 20:41 -------- d-----w- c:\program files\uTorrent
2009-12-20 08:04 . 2009-09-30 07:14 -------- d-----w- c:\program files\trend micro
2009-12-16 21:59 . 2009-09-22 22:02 411368 ----a-w- c:\windows\system32\deploytk.dll
2009-12-14 20:47 . 2009-09-29 20:25 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard
2009-12-14 20:07 . 2009-10-04 13:05 -------- d-----w- c:\program files\Bethesda Softworks
2009-12-14 19:58 . 2009-09-18 16:04 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-12-14 17:48 . 2009-10-04 18:43 -------- d-----w- c:\program files\Activision
2009-12-11 08:27 . 2003-04-16 12:00 77782 ----a-w- c:\windows\system32\perfc005.dat
2009-12-11 08:27 . 2003-04-16 12:00 429246 ----a-w- c:\windows\system32\perfh005.dat
2009-12-07 15:55 . 2009-09-18 19:21 56816 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2009-11-30 13:19 . 2009-11-28 17:13 -------- d-----w- c:\program files\Perfect Uninstaller
2009-11-28 17:11 . 2009-11-28 17:11 -------- d-----w- c:\program files\Godlike Developers
2009-11-28 07:32 . 2009-11-28 07:32 18 ----a-w- c:\program files\XP Repair Pro 2007ERR_Item5-11-28-2009_8-28-11_1813140.dnp
2009-11-28 07:31 . 2009-11-28 07:31 18 ----a-w- c:\program files\XP Repair Pro 2007ERR_Item5-11-28-2009_8-28-11_670033.dnp
2009-11-10 18:41 . 2009-11-10 17:03 -------- d-----w- c:\program files\Xvid
2009-11-09 19:02 . 2009-09-22 21:54 -------- d-----w- c:\program files\Common Files\Adobe
2009-11-05 11:09 . 2009-09-22 21:59 -------- d-----w- c:\program files\Common Files\Real
2009-11-05 11:09 . 2009-11-05 11:09 -------- d-----w- c:\program files\Common Files\xing shared
2009-11-05 11:09 . 2009-09-20 20:26 348160 ----a-w- c:\windows\system32\msvcr71.dll
2009-11-05 11:09 . 2009-09-20 20:26 499712 ----a-w- c:\windows\system32\msvcp71.dll
2009-11-05 11:09 . 2009-09-22 21:59 -------- d-----w- c:\program files\Real
2009-10-29 07:43 . 2003-04-16 12:00 916480 ------w- c:\windows\system32\wininet.dll
2009-10-23 14:39 . 2009-10-02 08:25 64760 ----a-w- c:\windows\system32\GDIPFONTCACHEV1.DAT
2009-10-21 05:40 . 2009-09-18 15:51 25088 ----a-w- c:\windows\system32\httpapi.dll
2009-10-21 05:40 . 2009-09-18 15:51 75776 ----a-w- c:\windows\system32\strmfilt.dll
2009-10-20 16:20 . 2009-09-18 15:51 265728 ------w- c:\windows\system32\drivers\http.sys
2009-10-13 10:34 . 2003-04-16 12:00 271360 ----a-w- c:\windows\system32\oakley.dll
2009-10-12 13:40 . 2003-04-16 12:00 79872 ----a-w- c:\windows\system32\raschap.dll
2009-10-12 13:40 . 2003-04-16 12:00 150016 ----a-w- c:\windows\system32\rastls.dll
2009-09-18 19:03 . 2009-09-18 19:03 5866152 ----a-w- c:\program files\FirefoxSetup2.0.0.20.exe
2009-09-18 19:00 . 2009-09-18 19:00 6679224 ----a-w- c:\program files\Thunderbird Setup 2.0.0.23.exe
.

(((((((((((((((((((((((((((((((((((((((((( SR_Search ))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
((((((((((((((((((((((((((((( SnapShot@2010-01-02_13.11.24 )))))))))))))))))))))))))))))))))))))))))
.
+ 2010-01-02 16:28 . 2010-01-02 16:28 16384 c:\windows\temp\Perflib_Perfdata_544.dat
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SpywareTerminatorUpdate"="c:\program files\Spyware Terminator\SpywareTerminatorUpdate.exe" [2009-12-27 3037696]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2009-11-05 198160]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-10-03 35696]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2009-09-04 935288]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-12-16 149280]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-11-10 417792]
"SpywareTerminator"="c:\program files\Spyware Terminator\SpywareTerminatorShield.exe" [2009-12-27 2166784]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2008-04-14 15360]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"NoSecCpl"= 0 (0x0)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoStartMenuSubFolders"= 0 (0x0)
"NoCommonGroups"= 0 (0x0)
"NoPrinters"= 0 (0x0)
"NoRecentDocsNetHood"= 0 (0x0)
"NoChangeAnimation"= 0 (0x0)

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0sprecovr \SystemRoot\sprecovr.txt

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2009-10-03 03:08 35696 ----a-w- c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BDRegion]
2007-11-16 18:20 91432 ----a-w- c:\program files\CyberLink\Shared files\brs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LanguageShortcut]
2007-10-11 10:06 62760 ------w- c:\program files\CyberLink\PowerDVD\Language\Language.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2009-11-10 22:08 417792 ----a-w- c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
2007-10-28 07:35 72736 ------w- c:\program files\CyberLink\PowerDVD\PDVDServ.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]
2009-12-18 00:30 39424 ----a-w- c:\program files\Winamp\winampa.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Dragon Age\\bin_ship\\daorigins.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
"AllowInboundEchoRequest"= 1 (0x1)

R0 nvcchflt;NVIDIA Disk Cache Filter Driver;c:\windows\system32\drivers\nvcchflt.sys [11.2.2005 17:11 16640]
R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [20.9.2009 0:26 721904]
R0 Vax347b;Vax347b;c:\windows\system32\drivers\Vax347b.sys [19.11.2009 10:36 159616]
R0 Vax347s;Vax347s;c:\windows\system32\drivers\Vax347s.sys [19.11.2009 10:36 5248]
R1 SbFw;SbFw;c:\windows\system32\drivers\SbFw.sys [20.12.2009 13:14 270888]
R1 sbhips;Sunbelt HIPS Driver;c:\windows\system32\drivers\sbhips.sys [21.6.2008 4:54 66600]
R1 sp_rsdrv2;Spyware Terminator Driver 2;c:\windows\system32\drivers\sp_rsdrv2.sys [27.12.2009 16:33 142592]
R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [18.9.2009 20:21 108289]
R2 SbPF.Launcher;SbPF.Launcher;c:\program files\Sunbelt Software\Personal Firewall\SbPFLnch.exe [31.10.2008 7:24 95528]
R2 SPF4;Sunbelt Personal Firewall 4;c:\program files\Sunbelt Software\Personal Firewall\SbPFSvc.exe [31.10.2008 7:24 1365288]
R3 SBFWIMCL;Sunbelt Software Firewall NDIS IM Filter Miniport;c:\windows\system32\drivers\SbFwIm.sys [20.12.2009 13:14 65576]
S3 DAUpdaterSvc;Dragon Age: Origins - Content Updater;c:\program files\Dragon Age\bin_ship\daupdatersvc.service.exe [14.12.2009 21:38 25832]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.seznam.cz/
mStart Page = about:blank
IE: E&xportovat do aplikace Microsoft Office Excel - c:\progra~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
LSP: %SYSTEMROOT%\system32\nvappfilter.dll
FF - ProfilePath - c:\documents and settings\Administrator\Data aplikací\Mozilla\Firefox\Profiles\nc52e2xk.default\
FF - prefs.js: browser.startup.homepage - www.seznam.cz
FF - component: c:\program files\real\realplayer\browserrecord\firefox\ext\components\nprpffbrowserrecordext.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- NASTAVENÍ FIREFOXU ----
c:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".cz");
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-01-02 17:29
Windows 5.1.2600 Service Pack 3 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll >>UNKNOWN [0x8A08B850]<<
kernel: MBR read successfully
detected MBR rootkit hooks:
\Driver\Disk -> CLASSPNP.SYS @ 0xba10cf28
\Driver\ACPI -> ACPI.sys @ 0xb9e3fcb8
\Driver\atapi -> atapi.sys @ 0xb9dd4b40
IoDeviceObjectType -> DeleteProcedure -> ntkrnlpa.exe @ 0x80579022
ParseProcedure -> ntkrnlpa.exe @ 0x80577c84
\Device\Harddisk0\DR0 -> DeleteProcedure -> ntkrnlpa.exe @ 0x80579022
ParseProcedure -> ntkrnlpa.exe @ 0x80577c84
NDIS: NVIDIA nForce Networking Controller -> SendCompleteHandler -> NDIS.sys @ 0xb9cc7bb0
PacketIndicateHandler -> NDIS.sys @ 0xb9cb6a0d
SendHandler -> NDIS.sys @ 0xb9ccab40
user & kernel MBR OK

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet002\Services\{95808DC4-FA4A-4C74-92FE-5B863F82066B}]
"ImagePath"="\??\c:\program files\CyberLink\PowerDVD\000.fcl"
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------

[HKEY_USERS\S-1-5-21-796845957-1123561945-725345543-500\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (Administrator)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,5f,d8,be,bb,cd,12,84,46,89,b5,d2,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,5f,d8,be,bb,cd,12,84,46,89,b5,d2,\

[HKEY_USERS\S-1-5-21-796845957-1123561945-725345543-500\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:1c,bf,4c,77,ff,ba,78,c8,c3,e2,6d,e0,70,f3,40,43,88,17,3e,68,90,14,cd,
bf,45,30,22,17,c3,07,e3,ee,7b,c0,43,b8,c5,a7,ed,6b,b4,44,8b,82,13,55,7c,6e,\
"??"=hex:35,fc,c6,3d,c9,02,ad,db,37,1f,61,de,0f,33,8f,50

[HKEY_USERS\S-1-5-21-796845957-1123561945-725345543-500\Software\SecuROM\License information*]
"datasecu"=hex:2b,a0,11,7c,4e,2c,0d,ac,44,08,e7,c5,4a,64,1a,81,30,45,e5,90,10,
34,04,8a,66,82,15,9a,ef,fb,13,44,ad,d2,cd,d1,97,44,dd,ce,24,c7,0a,ba,f7,59,\
"rkeysecu"=hex:44,5e,dd,66,6d,63,8c,61,a6,7b,3f,98,4f,d4,7e,46
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'winlogon.exe'(1476)
c:\windows\system32\Ati2evxx.dll

- - - - - - - > 'explorer.exe'(3024)
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\windows\system32\Ati2evxx.exe
c:\windows\system32\Ati2evxx.exe
c:\program files\Avira\AntiVir Desktop\avguard.exe
c:\program files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\program files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe
c:\program files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe
c:\program files\CyberLink\Shared files\RichVideo.exe
c:\program files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
c:\program files\Spyware Terminator\sp_rsser.exe
c:\windows\System32\vssvc.exe
c:\program files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe
c:\program files\Sunbelt Software\Personal Firewall\SbPFCl.exe
c:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Celkový čas: 2010-01-02 17:36:04 - počítač byl restartován
ComboFix-quarantined-files.txt 2010-01-02 16:35
ComboFix2.txt 2010-01-02 13:14

Před spuštěním: Volných bajtů: 38 965 932 032
Po spuštění: Volných bajtů: 38 926 082 048

- - End Of File - - 439CF8E50864F02BF2DDAF6EE5EDAB48

[earl]

Jak pc startuje ted?

[DavidHron]

Tak zatím to vypadá že je vše ok.Budu to testovat ,kdyby se to objevilo znova dám určitě vědět.Každopádně děkuji za vaše rady a váš čas.
Ještě jednou děkuji

[earl]

Start - spustit - napiste ComboFix /Uninstall - a klepnout na OK

ComboFix /Uninstall


-----------------------------------------------------------------------------------------------------------------

Pouzijte T-Cleaner na vycisteni pc po utilitach pouzitych pri odvirovani.Postupujte dle instrukci na obrazovce.Pri detekci antivirem se jedna o falesny poplach.
-----------------------------------------------------------------------------------------------------------------

Vycistete pc Ccleanerem.

Vzdy nejprve Analyzovat a pak Spustit Cleaner.2x po sobe.

Windows-odskrtnout historii a historii automatickeho vyplnovani formularu - prisel byste o historii navstivenych stranek a o ulozena hesla ve formularich

(je to sice z pohledu zabezpeceni spatne,ale aspon pak uzivatel nenadava,kam ze mu to zmizelo )

Aplikace-u prohlizecu internetu odskrtnout Historii internetu.

Registry-nechat vse zaskrtle,Hledej problemy,Opravit vybrane problemy

(nechat ho udelat zalohu-ta je ulozena v Dokumentech-DULEZITE).

Taktez 2x-3x po sobe.

A neni zac.