sekaní počítače

Zpráva

#31 Příspěvek od **motji** » 15 Ún 2011 21:36

Ale já si opravdu nemyslím, že by jste měl vir v BIosu

. Podle toho autorunu to spíš bude vir na flešce, externím disku, vir na síti...

.
Ten starý disk se systémem máte v pc pořád, nebo jste ho zformátoval?

Pokud by jste měl podezdření, že i ostatní pc sjou zavirované, bylo by nejlepší nechat v síti pouze jeden, který budeme odvirovávat, a ostatní odpojit od sítě, ať se neinfikují dokola.

Z tohoto pc ted poprosím o log ze Rsitu, viz můj podpis.

Stahněte MBAM z mého podpisu
-Nainstalujte,dejte úplný sken

NIC NEMAZAT

-MBAM má občas falešné detekce,proto budeme mazat až po kontrole logu.
-Log zkopírujte sem.

matr · #32 Příspěvek od **matr** » 16 Ún 2011 16:53

Dobrý den
Tak první problem vyřešen koupí nového pc.Požádal bych vás o kontrolu mého pc než propojím oba počítače do sítěPro jistotu jsem resetoval i router.Přikládám log z z Rsitu

Logfile of random's system information tool 1.08 (written by random/random)
Run by m at 2011-02-16 16:45:43
Systém Microsoft Windows XP Professional Service Pack 3
System drive C: has 4 GB (4%) free of 100 GB
Total RAM: 2047 MB (79% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 16:45:54, on 16.2.2011
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast5\afwServ.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
C:\Program Files\Alwil Software\Avast5\avastUI.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\Documents and Settings\m\Plocha\RSIT.exe
C:\Program Files\trend micro\m.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
O4 - HKLM\..\Run: [avast5] "C:\Program Files\Alwil Software\Avast5\avastUI.exe" /nogui
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre6\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre6\bin\ssv.dll
O9 - Extra button: (no name) - {0F7195C2-6713-4d93-A1BC-DA5FA33F0A65} - C:\Program Files\kikin\ie_kikin.dll
O9 - Extra 'Tools' menuitem: My kikin - {0F7195C2-6713-4d93-A1BC-DA5FA33F0A65} - C:\Program Files\kikin\ie_kikin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{B0CD8A83-67EB-43C1-B3AC-C3934029AAA0}: NameServer = 10.255.255.10,10.255.255.20
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Proces mezipaměti kategorií součástí - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: avast! Firewall - AVAST Software - C:\Program Files\Alwil Software\Avast5\afwServ.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: StarWind AE Service (StarWindServiceAE) - StarWind Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe

--
End of file - 3843 bytes

======Registry dump======

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"avast5"=C:\Program Files\Alwil Software\Avast5\avastUI.exe [2011-01-13 3396624]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan]
C:\WINDOWS\SOUNDMAN.EXE [2005-02-02 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"ATI Smart"=2
"Ati HotKey Poller"=2

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent]
C:\WINDOWS\system32\Ati2evxx.dll [2005-08-04 46080]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=323
"NoRecentDocsNetHood"=1
"NoDriveAutoRun"=67108863
"NoDrives"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=323
"HonorAutoRunSetting"=1
"NoDriveAutoRun"=67108863
"NoDrives"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"C:\WINDOWS\system32\sessmgr.exe"="C:\WINDOWS\system32\sessmgr.exe:*:Disabled:@xpsp2res.dll,-22019"
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\WINDOWS\Network Diagnostic\xpnetdiag.exe"="C:\WINDOWS\Network Diagnostic\xpnetdiag.exe:*:Disabled:@xpsp3res.dll,-20000"
"C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE"="C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook"
"C:\Program Files\BitTorrent\BitTorrent.exe"="C:\Program Files\BitTorrent\BitTorrent.exe:*:Enabled:BitTorrent"
"C:\Program Files\THQ\S.T.A.L.K.E.R. - Shadow of Chernobyl\bin\XR_3DA.exe"="C:\Program Files\THQ\S.T.A.L.K.E.R. - Shadow of Chernobyl\bin\XR_3DA.exe:*:Disabled:S.T.A.L.K.E.R. - Shadow of Chernobyl (CLI)"
"C:\Program Files\THQ\S.T.A.L.K.E.R. - Shadow of Chernobyl\bin\dedicated\XR_3DA.exe"="C:\Program Files\THQ\S.T.A.L.K.E.R. - Shadow of Chernobyl\bin\dedicated\XR_3DA.exe:*:Disabled:S.T.A.L.K.E.R. - Shadow of Chernobyl (SRV)"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

======List of files/folders created in the last 1 months======

2011-02-16 16:45:43 ----D---- C:\rsit
2011-02-16 16:45:43 ----D---- C:\Program Files\trend micro
2011-02-15 18:08:13 ----A---- C:\install_flash_player_ax.exe
2011-02-11 17:46:36 ----D---- C:\Polemic-bestoff
2011-02-11 16:57:16 ----AD---- C:\Polemic - Gangster SKA
2011-02-11 16:41:51 ----SHD---- C:\RECYCLER
2011-02-11 15:22:42 ----A---- C:\WINDOWS\system32\drivers\aswSP.sys
2011-02-11 15:22:42 ----A---- C:\WINDOWS\system32\drivers\aswFsBlk.sys
2011-02-11 15:22:41 ----A---- C:\WINDOWS\system32\drivers\aswSnx.sys
2011-02-11 15:22:40 ----A---- C:\WINDOWS\system32\drivers\aswFW.sys
2011-02-11 15:22:25 ----A---- C:\WINDOWS\system32\drivers\aswRdr.sys
2011-02-11 15:22:25 ----A---- C:\WINDOWS\system32\drivers\aswNdis2.sys
2011-02-11 15:22:24 ----A---- C:\WINDOWS\system32\drivers\aswTdi.sys
2011-02-11 15:22:24 ----A---- C:\WINDOWS\system32\drivers\aswmon2.sys
2011-02-11 15:22:24 ----A---- C:\WINDOWS\system32\drivers\aswmon.sys
2011-02-11 15:22:23 ----A---- C:\WINDOWS\system32\drivers\aavmker4.sys
2011-02-11 15:22:06 ----A---- C:\WINDOWS\system32\drivers\aswNdis.sys
2011-02-11 15:22:05 ----A---- C:\WINDOWS\system32\aswBoot.exe
2011-02-11 15:22:01 ----D---- C:\Program Files\Alwil Software
2011-02-11 15:22:01 ----D---- C:\Documents and Settings\All Users\Data aplikací\Alwil Software
2011-02-11 15:21:06 ----A---- C:\setup_ais_cze.exe
2011-02-11 15:16:02 ----A---- C:\ComboFix.txt
2011-02-11 15:10:21 ----A---- C:\Boot.bak
2011-02-11 15:10:17 ----RASHD---- C:\cmdcons
2011-02-11 15:01:32 ----A---- C:\WINDOWS\zip.exe
2011-02-11 15:01:32 ----A---- C:\WINDOWS\SWXCACLS.exe
2011-02-11 15:01:32 ----A---- C:\WINDOWS\SWSC.exe
2011-02-11 15:01:32 ----A---- C:\WINDOWS\SWREG.exe
2011-02-11 15:01:32 ----A---- C:\WINDOWS\sed.exe
2011-02-11 15:01:32 ----A---- C:\WINDOWS\PEV.exe
2011-02-11 15:01:32 ----A---- C:\WINDOWS\NIRCMD.exe
2011-02-11 15:01:32 ----A---- C:\WINDOWS\MBR.exe
2011-02-11 15:01:32 ----A---- C:\WINDOWS\grep.exe
2011-02-11 15:01:28 ----D---- C:\WINDOWS\ERDNT
2011-02-11 14:58:34 ----D---- C:\Qoobox
2011-02-02 09:41:16 ----A---- C:\WindowsXP-KB936929-SP3-x86-CSY.exe
2011-02-01 11:36:01 ----D---- C:\SÍTOVKA
2011-01-21 20:32:29 ----D---- C:\IZER+uragan
2011-01-21 19:18:14 ----D---- C:\Night Of The Living Jews
2011-01-21 11:04:41 ----D---- C:\Dukla-dokument

======List of files/folders modified in the last 1 months======

2011-02-16 16:45:43 ----RD---- C:\Program Files
2011-02-16 16:45:39 ----D---- C:\WINDOWS\Prefetch
2011-02-16 16:34:26 ----D---- C:\WINDOWS\Temp
2011-02-16 15:18:09 ----A---- C:\WINDOWS\SchedLgU.Txt
2011-02-16 13:42:48 ----D---- C:\WINDOWS
2011-02-15 20:16:30 ----D---- C:\WINDOWS\system32\CatRoot2
2011-02-15 19:56:49 ----D---- C:\NOVÉ WP
2011-02-15 19:15:00 ----A---- C:\WINDOWS\NeroDigital.ini
2011-02-15 18:01:24 ----D---- C:\Program Files\JDownloader
2011-02-11 16:41:52 ----D---- C:\WINDOWS\Minidump
2011-02-11 15:22:42 ----D---- C:\WINDOWS\system32\drivers
2011-02-11 15:22:34 ----HD---- C:\WINDOWS\inf
2011-02-11 15:22:15 ----D---- C:\WINDOWS\WinSxS
2011-02-11 15:22:13 ----SHD---- C:\WINDOWS\Installer
2011-02-11 15:22:05 ----D---- C:\WINDOWS\system32
2011-02-11 15:14:30 ----A---- C:\WINDOWS\system.ini
2011-02-11 15:12:48 ----D---- C:\WINDOWS\AppPatch
2011-02-11 15:12:46 ----D---- C:\Program Files\Common Files
2011-02-11 15:10:21 ----RASH---- C:\boot.ini
2011-02-11 15:01:31 ----SHD---- C:\System Volume Information
2011-02-11 15:01:31 ----D---- C:\WINDOWS\system32\Restore
2011-02-11 14:59:21 ----AD---- C:\Documents and Settings\All Users\Data aplikací\TEMP
2011-02-11 14:54:33 ----D---- C:\Documents and Settings\All Users\Data aplikací\AVG10
2011-02-11 14:53:55 ----RSHDC---- C:\WINDOWS\system32\dllcache
2011-02-11 14:52:48 ----SHD---- C:\WINDOWS\CSC
2011-02-10 05:53:44 ----D---- C:\WINDOWS\Debug
2011-02-10 05:46:27 ----A---- C:\WINDOWS\system32\MRT.exe
2011-02-10 05:46:13 ----D---- C:\Program Files\Internet Explorer
2011-02-10 05:46:02 ----D---- C:\WINDOWS\ie8updates
2011-02-10 05:45:56 ----HD---- C:\WINDOWS\$hf_mig$
2011-02-09 16:56:00 ----D---- C:\WINDOWS\system32\config
2011-01-22 19:26:05 ----D---- C:\Documents and Settings\m\Data aplikací\Vso
2011-01-22 18:41:06 ----D---- C:\Program Files\The KMPlayer
2011-01-21 20:17:10 ----A---- C:\WINDOWS\system32\dxva_sig.txt
2011-01-21 15:44:07 ----A---- C:\WINDOWS\system32\shimgvw.dll
2011-01-21 15:44:07 ----A---- C:\WINDOWS\system32\shell32.dll

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 aswNdis;avast! Firewall NDIS Filter Service; C:\WINDOWS\system32\DRIVERS\aswNdis.sys [2011-01-13 12112]
R0 aswNdis2;avast! Firewall Core Firewall Service; C:\WINDOWS\system32\drivers\aswNdis2.sys [2011-01-13 189904]
R0 imagedrv;imagedrv; C:\WINDOWS\System32\Drivers\imagedrv.sys [2007-07-04 11304]
R0 imagesrv;imagesrv; C:\WINDOWS\system32\DRIVERS\imagesrv.sys [2007-07-04 132904]
R0 sfdrv01;StarForce Protection Environment Driver (version 1.x); C:\WINDOWS\System32\drivers\sfdrv01.sys [2005-03-03 48640]
R0 sfhlp02;StarForce Protection Helper Driver (version 2.x); C:\WINDOWS\System32\drivers\sfhlp02.sys [2005-02-23 6656]
R0 sptd;sptd; C:\WINDOWS\System32\Drivers\sptd.sys [2010-12-15 436792]
R1 Aavmker4;avast! Asynchronous Virus Monitor; C:\WINDOWS\system32\drivers\Aavmker4.sys [2011-01-13 29392]
R1 aswFW;avast! TDI Firewall driver; C:\WINDOWS\system32\drivers\aswFW.sys [2011-01-13 99792]
R1 aswRdr;aswRdr; C:\WINDOWS\system32\drivers\aswRdr.sys [2011-01-13 23632]
R1 aswSnx;aswSnx; C:\WINDOWS\system32\drivers\aswSnx.sys [2011-01-13 357968]
R1 aswSP;aswSP; C:\WINDOWS\system32\drivers\aswSP.sys [2011-01-13 294608]
R1 aswTdi;avast! Network Shield Support; C:\WINDOWS\system32\drivers\aswTdi.sys [2011-01-13 47440]
R1 BIOS;BIOS; \??\C:\WINDOWS\system32\drivers\BIOS.sys []
R1 intelppm;Řadič procesoru Intel; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2008-04-14 40192]
R1 SBRE;SBRE; \??\C:\WINDOWS\system32\drivers\SBREdrv.sys []
R2 aswFsBlk;aswFsBlk; C:\WINDOWS\system32\drivers\aswFsBlk.sys [2011-01-13 17744]
R2 aswMon2;aswMon2; C:\WINDOWS\system32\drivers\aswMon2.sys [2011-01-13 100176]
R2 atksgt;atksgt; C:\WINDOWS\system32\DRIVERS\atksgt.sys [2010-12-15 279712]
R2 lirsgt;lirsgt; C:\WINDOWS\system32\DRIVERS\lirsgt.sys [2010-12-15 25888]
R3 ALCXWDM;Service for Realtek AC97 Audio (WDM); C:\WINDOWS\system32\drivers\ALCXWDM.SYS [2005-02-02 2310720]
R3 ati2mtag;ati2mtag; C:\WINDOWS\system32\DRIVERS\ati2mtag.sys [2005-08-04 1273344]
R3 pcouffin;VSO Software pcouffin; C:\WINDOWS\System32\Drivers\pcouffin.sys [2010-03-06 47360]
R3 RTL8023xp;Realtek 10/100/1000 NIC Family all in one NDIS XP Driver; C:\WINDOWS\system32\DRIVERS\Rtlnicxp.sys [2005-03-04 74496]
R3 usbuhci;Ovladač Microsoft univerzálního hostitelského řadiče USB od společnosti Microsoft; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2008-04-13 20608]
S0 sfsync02;StarForce Protection Synchronization Driver (version 2.x); C:\WINDOWS\system32\drivers\sfsync02.sys []
S3 ayxmk2zn;ayxmk2zn; C:\WINDOWS\system32\drivers\ayxmk2zn.sys []
S3 catchme;catchme; \??\C:\DOCUME~1\m\LOCALS~1\Temp\catchme.sys []
S3 MEMSWEEP2;MEMSWEEP2; \??\C:\WINDOWS\system32\3A.tmp []
S3 rtl8139;Realtek RTL8139(A/B/C)-based PCI Fast Ethernet Adapter NT Driver; C:\WINDOWS\system32\DRIVERS\RTL8139.SYS [2004-08-03 20992]
S3 USBSTOR;Ovladač velkokapacitního paměťového zařízení USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 avast! Antivirus;avast! Antivirus; C:\Program Files\Alwil Software\Avast5\AvastSvc.exe [2011-01-13 40384]
R2 avast! Firewall;avast! Firewall; C:\Program Files\Alwil Software\Avast5\afwServ.exe [2011-01-13 119200]
R2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2009-10-11 153376]
R2 StarWindServiceAE;StarWind AE Service; C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe [2009-12-23 370688]
R2 UMWdf;Windows User Mode Driver Framework; C:\WINDOWS\system32\wdfmgr.exe [2004-08-11 38912]
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2008-07-25 34312]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; C:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104]
S3 idsvc;Windows CardSpace; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664]
S3 NBService;NBService; C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe [2007-06-29 800040]
S3 NMIndexingService;NMIndexingService; C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe [2007-06-27 279848]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2006-10-26 441136]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S4 Ati HotKey Poller;Ati HotKey Poller; C:\WINDOWS\system32\Ati2evxx.exe [2005-08-04 380928]
S4 ATI Smart;ATI Smart; C:\WINDOWS\system32\ati2sgag.exe [2005-08-05 516096]
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2008-07-29 132096]

-----------------EOF-----------------

#33 Příspěvek od **motji** » 16 Ún 2011 17:03

Máte v pc nějaký program, který využívá tento driver?
MEMSWEEP2

matr · #34 Příspěvek od **matr** » 16 Ún 2011 17:15

Jo to nevím.Používám rekl bych standartně používané programy.Tak jestli sa Vám to zdá podezřelé,prič stím.

#35 Příspěvek od **motji** » 16 Ún 2011 18:37

:arrow:Stáhněte OTM http://oldtimer.geekstogo.com/OTM.exe
Stáhněte na plochu Otm, 2krát klikněte na Otm,spustí se program,
Do levého okna "Paste Instructions for Items to be Moved" pod žlutou čáru zkopírujete skript

Kód: Vybrat vše

:processes
explorer.exe
 
:files
C:\WINDOWS\system32\*.tmp.dll /s
C:\WINDOWS\system32\SET*.tmp /s
C:\WINDOWS\*.tmp /s
C:\WINDOWS\system32\3A.tmp 

:Services
catchme
MEMSWEEP2

:commands
[resethosts]
[emptytemp]
[EMPTYFLASH]
[Reboot]

-klikněte na červené tlačítko Moveit!
-sem vložte obsah zeleného okénka
-Pokud se bude chtít restartovat pc, dejte YES,log pak najdete C:\_OTM\MovedFiles. Log vložte sem

matr · #36 Příspěvek od **matr** » 16 Ún 2011 18:53

All processes killed
========== PROCESSES ==========
No active process named explorer.exe was found!
========== FILES ==========
File/Folder C:\WINDOWS\system32\*.tmp.dll not found.
File/Folder C:\WINDOWS\system32\SET*.tmp not found.
C:\WINDOWS\002645_.tmp moved successfully.
C:\WINDOWS\SET3.tmp moved successfully.
C:\WINDOWS\SET4.tmp moved successfully.
C:\WINDOWS\SET8.tmp moved successfully.
C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP13.tmp folder moved successfully.
C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP139.tmp folder moved successfully.
C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP161.tmp folder moved successfully.
C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP163.tmp folder moved successfully.
C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP1E8.tmp folder moved successfully.
C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP241.tmp folder moved successfully.
C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP25A.tmp folder moved successfully.
C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP267.tmp folder moved successfully.
C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP2E2.tmp folder moved successfully.
C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP333.tmp folder moved successfully.
C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP47A.tmp folder moved successfully.
C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP498.tmp folder moved successfully.
C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP4A0.tmp folder moved successfully.
C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP54E.tmp folder moved successfully.
C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAPA3.tmp folder moved successfully.
C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAPEE.tmp folder moved successfully.
C:\WINDOWS\CSC\csc1.tmp moved successfully.
C:\WINDOWS\system32\CONFIG.TMP moved successfully.
File/Folder C:\WINDOWS\system32\3A.tmp not found.
========== SERVICES/DRIVERS ==========
Service catchme stopped successfully!
Service catchme deleted successfully!
Service MEMSWEEP2 stopped successfully!
Service MEMSWEEP2 deleted successfully!
========== COMMANDS ==========
C:\WINDOWS\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully

[EMPTYTEMP]

User: All Users

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes

User: LocalService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: m
->Temp folder emptied: 53264 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 39161380 bytes
->Flash cache emptied: 456 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 33170 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 38,00 mb

OTM by OldTimer - Version 3.1.17.2 log created on 02162011_184939

Files moved on Reboot...
File move failed. C:\WINDOWS\temp\_avast5_\Webshlock.txt scheduled to be moved on reboot.

Registry entries deleted on Reboot...

#37 Příspěvek od **motji** » 16 Ún 2011 19:17

Ještě znovu spustte OTL, klikněte na tlačítko vyčisti, uklidí po sobě

Pokud nejsou problémy, je to vše

VIRY.CZ

sekaní počítače

Re: sekaní počítače

Re: sekaní počítače

Re: sekaní počítače

Re: sekaní počítače

Re: sekaní počítače

Re: sekaní počítače

Re: sekaní počítače