VIRY.CZ

Zdravím, poslední dobou mám problém s PC, tak divně se zasekává a například v Chromu se špatně vykreslují stránky. Navíc v posledním týdnu mi přišel mail o blokaci twitteru pro podezřelou aktivitu. Rád bych tedy věděl jestli nemám v PC nějakou tu havěť. Bohužel jsem nemohl přiložit log do topicu, pre je prý moc dlouhý, proto jsou oba logy v přiložením archivu. Děkuji za Váš čas.

Krasny den Vam preju



Doporucuji vymenit Windows Defender za napr. avast! Free. Duvodem je cca 50% detekce oproti konkurenci viz srovnavaci testy antiviru http://forum.viry.cz/viewtopic.php?p=1377913#p1377913

V ramci cisteni Vam budou vyprazdneny docasne adresare (vcetne Kose).

Ulozte na plochu AdwCleaner https://toolslib.net/downloads/viewdown ... dwcleaner/ (nebo http://www.bleepingcomputer.com/download/adwcleaner/ )

• ukoncete vsechny programy
• kliknete pravym na ikonu AdwCleaneru a vyberte Spustit jako spravce (v pripade Win XP spustte obycejne dvojklikem)
• kliknete na Scan, pote na Cleaning
• po restartu na Vas vyskoci log (pripadne jej najdete v C:\AdwCleaner\AdwCleaner[Cx].txt), jehoz obsah mi zkopirujte do pristi odpovedi

# AdwCleaner v5.003 - Logfile created 21/08/2015 at 23:10:37
# Updated 20/08/2015 by Xplode
# Database : 2015-08-20.1 [Server]
# Operating system : Windows 10 Pro (x64)
# Username : pogas - DESKTOP-G3OIBRR
# Running from : C:\Users\pogas\Desktop\adwcleaner_5.003.exe
# Option : Cleaning

***** [ Services ] *****


***** [ Folders ] *****

[-] Folder Deleted : C:\Users\pogas\AppData\Local\MalwareProtectionLive
[-] Folder Deleted : C:\Users\pogas\AppData\Local\Google\Chrome\User Data\Default\Extensions\obdejhodejngcbmkiddfjkieejekbfil

***** [ Files ] *****

[-] File Deleted : C:\Users\pogas\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_obdejhodejngcbmkiddfjkieejekbfil_0.localstorage
[-] File Deleted : C:\Users\pogas\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_obdejhodejngcbmkiddfjkieejekbfil_0.localstorage-journal

***** [ Shortcuts ] *****


***** [ Scheduled tasks ] *****


***** [ Registry ] *****

[-] Key Deleted : HKCU\Software\Conduit
[-] Key Deleted : HKLM\SOFTWARE\Conduit
[!] Key Not Deleted : [x64] HKCU\Software\Conduit

***** [ Web browsers ] *****

[-] [C:\Users\pogas\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences] [Homepage] Deleted : hxxp://www.ask.com/?l=dis&o=15383cr

*************************

:: Proxy settings cleared
:: Winsock settings cleared

########## EOF - C:\AdwCleaner\AdwCleaner[C1].txt - [1401 bytes] ##########

Nainstalujte MBAM a udelejte vlastni sken vsech disku - http://forum.viry.cz/viewtopic.php?f=29&t=144868

• Upozorneni: tento sken zabere od 30 minut po nekolik hodin

Malwarebytes Anti-Malware
www.malwarebytes.org

Datum skenování: 22.08.2015
Čas skenování: 10:56
Protokol: results.txt
Správce: Ano

Verze: 2.1.8.1057
Databáze malwaru: v2015.08.22.01
Databáze rootkitů: v2015.08.16.01
Licence: Zkušební verze
Ochrana proti malwaru: Zapnuto
Ochrana proti škodlivým webovým stránkám: Zapnuto
Ochrana programu: Vypnuto

OS: Windows 10
CPU: x64
Souborový systém: NTFS
Uživatel: pogas

Typ skenu: Vlastní sken
Výsledek: Dokončeno
Prohledaných objektů: 536596
Uplynulý čas: 1 hod, 22 min, 8 sek

Paměť: Zapnuto
Po spuštění: Zapnuto
Souborový systém: Zapnuto
Archivy: Zapnuto
Rootkity: Zapnuto
Heuristika: Zapnuto
PUP: Zapnuto
PUM: Zapnuto

Procesy: 0
(Nenalezeny žádné škodlivé položky)

Moduly: 0
(Nenalezeny žádné škodlivé položky)

Klíče registru: 0
(Nenalezeny žádné škodlivé položky)

Hodnoty registru: 0
(Nenalezeny žádné škodlivé položky)

Data registru: 0
(Nenalezeny žádné škodlivé položky)

Složky: 0
(Nenalezeny žádné škodlivé položky)

Soubory: 0
(Nenalezeny žádné škodlivé položky)

Fyzické sektory: 0
(Nenalezeny žádné škodlivé položky)


(end)

Dejte log FRST.txt, prilozte i Addition.txt - http://forum.viry.cz/viewtopic.php?f=30&t=133101

Dávám znovu do přílohy, protože je to moc dlouhé pro tento post.

Fix result of Farbar Recovery Scan Tool (x64) Version:24-08-2015
Ran by pogas (2015-08-25 11:21:11) Run:1
Running from C:\Users\pogas\Desktop
Loaded Profiles: pogas (Available Profiles: pogas)
Boot Mode: Normal
==============================================

fixlist content:
*****************
Start
CloseProcesses:
File: C:\Windows\SysWOW64\usermgr.dll
File: C:\WINDOWS\system32\{A6D608F0-0BDE-491A-97AE-5C4B05D86E01}.bat
File: C:\WINDOWS\system32\{F33C3B9B-72AF-418A-B3FD-560646F7CDA2}.bat
HKU\S-1-5-21-1446878920-724358766-291748155-1002\...\Run: [Zoner Photo Studio Autoupdate] => C:\PROGRAM FILES\ZONER\PHOTO STUDIO 17\Program32\ZPSTRAY.EXE [563416 2015-07-12] (ZONER software)
2015-08-22 15:56 - 2015-08-22 15:56 - 00029696 _____ C:\Users\pogas\AppData\Local\MSGBOX.EXE
2015-08-22 15:52 - 2015-08-22 15:56 - 00026372 _____ C:\Users\pogas\Desktop\FRST.txt
2015-08-22 15:51 - 2015-08-22 15:56 - 00015327 _____ C:\Users\pogas\Desktop\LM.bat
2015-08-21 23:08 - 2015-08-21 23:08 - 01605632 _____ C:\Users\pogas\Desktop\adwcleaner_5.003.exe
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job => 0x000A01009B7D1BFEB1E4234D96C224369005C1FA46007003000000003C000A0020000000FEFFFFFF000000000013040000008021DF07080006001600090002002C0086000000360043003A005C00500072006F006700720061006D002000460069006C00650073002000280078003800360029005C0047006F006F0067006C0065005C005500700064006100740065005C0047006F006F0067006C0065005500700064006100740065002E00650078006500000003002F0063000000000016004400450053004B0054004F0050002D00470033004F0049004200520052005C0070006F0067006100730000003B015500640072007E0175006A006500200073006F00660074007700610072006500200047006F006F0067006C006500200061006B007400750061006C0069007A006F00760061006E00FD002E0020004A0065002D006C00690020007400610074006F002000FA006C006F006800610020007A0061006B00E1007A00E1006E00610020006E00650062006F0020007A006100730074006100760065006E0061002C0020006E006500620075006400650020007600E1006101200073006F00660074007700610072006500200047006F006F0067006C00650020007500640072007E016F007600E1006E0020007600200061006B007400750061006C0069007A006F00760061006E00E9006D002000730074006100760075002E00200054006F0020007A006E0061006D0065006E00E1002C0020007E01650020006E0065006D0075007300ED0020006200FD00740020006F00700072006100760065006E00610020007A006A006900610174001B016E00E100200073006C0061006200E10020006D00ED007300740061002000760020007A006100620065007A00700065000D0165006E00ED00200061002000750072000D0169007400E9002000660075006E006B006300650020006E0065006D0075007300ED002000660075006E0067006F007600610074002E00200050006F006B007500640020007400750074006F002000FA006C006F006800750020007E01E10064006E00FD00200073006F00660074007700610072006500200047006F006F0067006C00650020006E00650070006F0075007E01ED007600E1002C002000730061006D00610020007300650020006F00640069006E007300740061006C0075006A0065002E000000000008000000000000000000020030000000CF0701000100000000000000000000000000000000000000000000000700000001000000000000000000000030000100DF0707001E0000000000000012001C0000000000000000000000000001000000010000000000000000000000
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job
EmptyTemp:
End
*****************

Processes closed successfully.

========================= File: C:\Windows\SysWOW64\usermgr.dll ========================

"C:\Windows\SysWOW64\usermgr.dll" not found.
====== End of File: ======


========================= File: C:\WINDOWS\system32\{A6D608F0-0BDE-491A-97AE-5C4B05D86E01}.bat ========================

File not signed
MD5: CB136B267569A62EF63D798BC90ABD5A
Creation and modification date: 2015-07-30 15:49 - 2015-07-30 15:49
Size: 0000144
Attributes: ----A
Company Name:
Internal Name:
Original Name:
Product Name:
Description:
File Version:
Product Version:
Copyright:

====== End of File: ======


========================= File: C:\WINDOWS\system32\{F33C3B9B-72AF-418A-B3FD-560646F7CDA2}.bat ========================

File not signed
MD5: 9F45771914360A925252A1B7226EC7EC
Creation and modification date: 2015-07-30 15:46 - 2015-07-30 15:46
Size: 0000451
Attributes: ----A
Company Name:
Internal Name:
Original Name:
Product Name:
Description:
File Version:
Product Version:
Copyright:

====== End of File: ======

HKU\S-1-5-21-1446878920-724358766-291748155-1002\Software\Microsoft\Windows\CurrentVersion\Run\\Zoner Photo Studio Autoupdate => value removed successfully
C:\Users\pogas\AppData\Local\MSGBOX.EXE => moved successfully
C:\Users\pogas\Desktop\FRST.txt => moved successfully
C:\Users\pogas\Desktop\LM.bat => moved successfully
C:\Users\pogas\Desktop\adwcleaner_5.003.exe => moved successfully
C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job => moved successfully
C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job => moved successfully
"C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job" => File/Folder not found.
EmptyTemp: => 1.3 GB temporary data Removed.


The system needed a reboot..

==== End of Fixlog 11:21:45 ====

Jake problemy na PC momentalne pozorujete?

• Stahnete Crystal Disk Info (CDI) http://sourceforge.jp/frs/redir.php?m=j ... o6_2_2.zip
• archiv extrahujte a spustte vyextrahovany soubor DiskInfo.exe
• ve spustenem programu kliknete nahore na Upravy -> Kopirovat (log mate nyni zkopirovany ve schrance)
• log vlozte do dalsi odpovedi (Ctrl + V)

Jinak momentalne se potykam uz asi jen s tim zasekavanim chromu (napriklad kdyz pisu adresu, tak se to co jsem napsal zobrazi asi tak za 5s) a pomalejsim startem systemu, ikdyz system je po ciste instalaci pred par tydny. Nic jineho momentalne nepozoruji.

----------------------------------------------------------------------------
CrystalDiskInfo 6.2.2 (C) 2008-2014 hiyohiyo
Crystal Dew World : http://crystalmark.info/
----------------------------------------------------------------------------

OS : Windows 10 Professional [10.0 Build 10240] (x64)
Date : 2015/08/25 22:02:35

-- Controller Map ----------------------------------------------------------
- Standardní řadič SATA AHCI [ATA]
+ Standardní řadič SATA AHCI [ATA]
- WDC WD5001AALS-00L3B2
- HL-DT-ST DVDRAM GH20NS15
- Řadič prostorů úložišť [SCSI]

-- Disk List ---------------------------------------------------------------
(1) WDC WD5001AALS-00L3B2 : 500,1 GB [0/1/0, pd1] - wd

----------------------------------------------------------------------------
(1) WDC WD5001AALS-00L3B2
----------------------------------------------------------------------------
Model : WDC WD5001AALS-00L3B2
Firmware : 01.03B01
Serial Number : WD-WMASY4602030
Disk Size : 500,1 GB (8,4/137,4/500,1/500,1)
Buffer Size : 32767 KB
Queue Depth : 32
# of Sectors : 976773168
Rotation Rate : Neznámy údaj
Interface : Serial ATA
Major Version : ATA8-ACS
Minor Version : ----
Transfer Mode : ---- | SATA/300
Power On Hours : 24078 hod.
Power On Count : 4717 krát
Temperature : 45 C (113 F)
Health Status : Dobrý
Features : S.M.A.R.T., AAM, 48bit LBA, NCQ
APM Level : ----
AAM Level : 80FEh [OFF]

-- S.M.A.R.T. --------------------------------------------------------------
ID Cur Wor Thr RawValues(6) Attribute Name
01 200 200 _51 000000000000 Počet chyb čtení
03 162 160 _21 000000001324 Čas na roztočení ploten
04 _96 _96 __0 000000001293 Počet spuštění/zastavení
05 200 200 140 000000000000 Počet přemapovaných sektorů
07 100 253 __0 000000000000 Počet chybných hledání
09 _68 _68 __0 000000005E0E Hodin v činnosti
0A 100 100 __0 000000000000 Počet opakovaných pokusů o roztočení ploten
0B 100 100 __0 000000000000 Počet pokusů o překalibrování
0C _96 _96 __0 00000000126D Počet cyklů zapnutí zařízení
C0 199 199 __0 000000000306 Počet vypnutí disku
C1 199 199 __0 000000001292 Počet cyklů načítání/vymazání
C2 102 _93 __0 00000000002D Teplota
C4 200 200 __0 000000000000 Počet udalostí s číslem realokování sektorů
C5 200 200 __0 000000000000 Počet podezřelých sektorů
C6 200 200 __0 000000000000 Počet neopravitelných sektorů
C7 200 200 __0 000000000000 Počet chyb v kontrolním součtu UltraDMA
C8 200 200 __0 000000000000 Počet chyb při zápisu sektorů

-- IDENTIFY_DEVICE ---------------------------------------------------------
0 1 2 3 4 5 6 7 8 9
000: 427A 3FFF C837 0010 0000 0000 003F 0000 0000 0000
010: 2020 2020 2057 442D 574D 4153 5934 3630 3230 3330
020: 0000 FFFF 0032 3031 2E30 3342 3031 5744 4320 5744
030: 3530 3031 4141 4C53 2D30 304C 3342 3220 2020 2020
040: 2020 2020 2020 2020 2020 2020 2020 8010 0000 2F00
050: 4001 0000 0000 0007 3FFF 0010 003F FC10 00FB 0110
060: FFFF 0FFF 0000 0007 0003 0078 0078 0078 0078 0000
070: 0000 0000 0000 0000 0000 001F 0706 0000 0044 0040
080: 01FE 0000 746B 7F61 4123 7469 BC41 4123 207F 0039
090: 0039 0000 FFFE 0000 80FE 0000 0000 0000 0000 0000
100: 6030 3A38 0000 0000 0000 0000 0000 0000 5001 4EE0
110: 00EE 6B7F 0000 0000 0000 0000 0000 0000 0000 4010
120: 4010 0000 0000 0000 0000 0000 0000 0000 0029 0000
130: 0000 0000 0000 169D 0000 0000 0000 0000 0000 0000
140: 0000 0000 0004 0000 0000 0000 0000 0000 0000 0000
150: 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000
160: 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000
170: 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000
180: 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000
190: 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000
200: 0000 0000 0000 0000 0000 0000 303F 0000 0000 0000
210: 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000
220: 0000 0000 100E 0000 0000 0000 0000 0000 0000 0000
230: 0000 0000 0000 0000 0001 1000 0000 0000 0000 0000
240: 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000
250: 0000 0000 0000 0000 0000 E1A5

-- SMART_READ_DATA ---------------------------------------------------------
+0 +1 +2 +3 +4 +5 +6 +7 +8 +9 +A +B +C +D +E +F
000: 10 00 01 2F 00 C8 C8 00 00 00 00 00 00 00 03 27
010: 00 A2 A0 24 13 00 00 00 00 00 04 32 00 60 60 93
020: 12 00 00 00 00 00 05 33 00 C8 C8 00 00 00 00 00
030: 00 00 07 2E 00 64 FD 00 00 00 00 00 00 00 09 32
040: 00 44 44 0E 5E 00 00 00 00 00 0A 32 00 64 64 00
050: 00 00 00 00 00 00 0B 32 00 64 64 00 00 00 00 00
060: 00 00 0C 32 00 60 60 6D 12 00 00 00 00 00 C0 32
070: 00 C7 C7 06 03 00 00 00 00 00 C1 32 00 C7 C7 92
080: 12 00 00 00 00 00 C2 22 00 66 5D 2D 00 00 00 00
090: 00 00 C4 32 00 C8 C8 00 00 00 00 00 00 00 C5 32
0A0: 00 C8 C8 00 00 00 00 00 00 00 C6 30 00 C8 C8 00
0B0: 00 00 00 00 00 00 C7 32 00 C8 C8 00 00 00 00 00
0C0: 00 00 C8 08 00 C8 C8 00 00 00 00 00 00 00 00 00
0D0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0E0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0F0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
110: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
120: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
130: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
140: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
150: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
160: 00 00 00 00 00 00 00 00 00 00 84 00 98 2B 01 7B
170: 03 00 01 00 02 83 05 00 00 00 00 00 00 00 00 00
180: 00 00 01 04 00 00 00 00 00 00 00 00 00 00 00 00
190: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
1A0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
1B0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
1C0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
1D0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
1E0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
1F0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 8B

-- SMART_READ_THRESHOLD ----------------------------------------------------
+0 +1 +2 +3 +4 +5 +6 +7 +8 +9 +A +B +C +D +E +F
000: 10 00 01 33 C8 C8 C8 C8 00 00 00 00 00 00 03 15
010: 00 00 00 00 00 00 00 00 00 00 04 00 00 00 00 00
020: 00 00 00 00 00 00 05 8C 00 00 00 00 00 00 00 00
030: 00 00 07 00 64 64 64 64 00 00 00 00 00 00 09 00
040: 00 00 00 00 00 00 00 00 00 00 0A 00 00 00 00 00
050: 00 00 00 00 00 00 0B 00 00 00 00 00 00 00 00 00
060: 00 00 0C 00 00 00 00 00 00 00 00 00 00 00 C0 00
070: 00 00 00 00 00 00 00 00 00 00 C1 00 00 00 00 00
080: 00 00 00 00 00 00 C2 00 00 00 00 00 00 00 00 00
090: 00 00 C4 00 00 00 00 00 00 00 00 00 00 00 C5 00
0A0: 00 00 00 00 00 00 00 00 00 00 C6 00 00 00 00 00
0B0: 00 00 00 00 00 00 C7 00 00 00 00 00 00 00 00 00
0C0: 00 00 C8 00 C8 C8 C8 C8 00 00 00 00 00 00 00 00
0D0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0E0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0F0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
110: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
120: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
130: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
140: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
150: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
160: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
170: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
180: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
190: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
1A0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
1B0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
1C0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
1D0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
1E0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
1F0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ED

HDD je v poradku, malware nevidim, takze zkuste povypinat nektera rozsireni chromu. Pripadne zazalohovat zalozky a hesla napr. pomoci Google Chrome Backup a chrome kompletne preinstalovat. Pri startu systemu je mozne jeste vypnout start nasledujicich aplikaci, ktere muzete pozdeji spustit rucne

• OneDriveSetup
• OneDrive
• Spotify Web Helper
• Steam
• GoogleChromeAutoLaunch_3A1CB5B1D9762C46A968601A880A56E2
• C:\Users\pogas\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CurseClientStartup.ccip