Prosím o preventivní kontrolu logu (pomalý ntb, občas zamrzání)

Místo pro vaše HiJackThis logy a logy z dalších programů…

Moderátoři: Mods_senior, Security team

Odpovědět
Uživatelský avatar
simio.simsoft
Level 2
Level 2
Příspěvky: 224
Registrován: duben 13
Bydliště: Blovice, Plzeňský kraj, CZ, EU, Europa, Earth, Solar System, Milky Way, Space
Pohlaví: Muž
Stav:
Offline

Prosím o preventivní kontrolu logu (pomalý ntb, občas zamrzání)

Příspěvekod simio.simsoft » 12 zář 2015 11:42

Dobrý den.
Můj notebook na tom sice zdaleka není tak špatně (stále se ne něm dá dobře pracovat), ale myslím si, že jeho výkon by se dal alespoň trochu vylepšit. Jinak poslední dobou mi dost často zamrzal, ale to nejspíše způsobuje pouze prohlížeč Mozilla Firefox, takže se mu vyhýbám.

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 11:37:56, on 12.9.2015
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)

FIREFOX: 40.0.3 (x86 cs)
Boot mode: Normal

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\System32\svchost.exe
c:\Program Files\Fingerprint Sensor\AtService.exe
C:\WINNT\system32\svchost.exe
c:\Program Files\Hewlett-Packard\Drive Encryption\HpFkCrypt.exe
C:\WINNT\System32\svchost.exe
C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
C:\WINNT\system32\svchost.exe
C:\Program Files\CheckPoint\ZoneAlarm\vsmon.exe
c:\Program Files\Hewlett-Packard\IAM\Bin\AsGHost.exe
C:\WINNT\Explorer.EXE
C:\Program Files\AVAST Software\Avast\AvastSvc.exe
C:\WINNT\system32\spoolsv.exe
c:\Program Files\ActivIdentity\ActivClient\accoca.exe
C:\WINNT\system32\agrsmsvc.exe
C:\Program Files\Ashampoo\Ashampoo WinOptimizer 2013\DfsdkS.exe
C:\Program Files\Comodo\Dragon\dragon_updater.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINNT\system32\svchost.exe
C:\Program Files\TeamViewer\TeamViewer_Service.exe
C:\Program Files\CheckPoint\ZoneAlarm\ZAPrivacyService.exe
C:\WINNT\system32\SearchIndexer.exe
C:\Program Files\T-Mobile\Web'n'walk Manager\ameisvc.exe
C:\WINNT\System32\svchost.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\WINNT\system32\igfxtray.exe
C:\WINNT\system32\hkcmd.exe
C:\WINNT\system32\igfxpers.exe
C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe
C:\WINNT\system32\igfxsrvc.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
C:\Program Files\AVAST Software\Avast\AvastUI.exe
C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe
C:\Program Files\CheckPoint\ZoneAlarm\zatray.exe
c:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe
C:\Program Files\ActivIdentity\ActivClient\accrdsub.exe
C:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\PTHOSTTR.EXE
C:\WINNT\system32\wuauclt.exe
C:\WINNT\system32\wbem\unsecapp.exe
C:\WINNT\system32\ctfmon.exe
c:\Program Files\ActivIdentity\ActivClient\acevents.exe
C:\Program Files\Kalendar\kalendar.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\Program Files\Windows Desktop Search\WindowsSearch.exe
C:\WINNT\system32\SearchProtocolHost.exe
C:\Documents and Settings\Administrator\Plocha\HJT\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.seznam.cz/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
O2 - BHO: Zonealarm Helper Object - {2A841F7A-A014-4DA5-B6D9-8B913DFB7A8C} - C:\Program Files\Check Point Software Technologies LTD\zonealarm\1.8.29.17\bh\zonealarm.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.8.0_45\bin\ssv.dll
O2 - BHO: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre1.8.0_45\bin\jp2ssv.dll
O2 - BHO: Credential Manager for HP ProtectTools - {DF21F1DB-80C6-11D3-9483-B03D0EC10000} - c:\Program Files\Hewlett-Packard\IAM\Bin\ItIEAddIn.dll
O3 - Toolbar: ZoneAlarm Security Toolbar - {438FAE3E-BDEF-44D3-AB8B-0C7C8350DF59} - C:\Program Files\Check Point Software Technologies LTD\zonealarm\1.8.29.17\zonealarmTlbr.dll
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [SoundMAX] C:\Program Files\Analog Devices\SoundMAX\Smax4.exe /tray
O4 - HKLM\..\Run: [IgfxTray] C:\WINNT\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINNT\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\WINNT\system32\igfxpers.exe
O4 - HKLM\..\Run: [QlbCtrl.exe] C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
O4 - HKLM\..\Run: [SynTPEnh] %ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
O4 - HKLM\..\Run: [AvastUI.exe] "C:\Program Files\AVAST Software\Avast\AvastUI.exe" /nogui
O4 - HKLM\..\Run: [ZoneAlarm] "C:\Program Files\CheckPoint\ZoneAlarm\zatray.exe"
O4 - HKLM\..\Run: [accrdsub] "c:\Program Files\ActivIdentity\ActivClient\accrdsub.exe"
O4 - HKLM\..\Run: [PTHOSTTR] c:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\PTHOSTTR.EXE /Start
O4 - HKLM\..\Run: [CognizanceTS] rundll32.exe c:\PROGRA~1\HEWLET~1\IAM\Bin\ASTSVCC.dll,RegisterModule
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [APSDaemon] "C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINNT\system32\ctfmon.exe
O4 - HKCU\..\Run: [EPSON SX100 Series] C:\WINNT\System32\spool\DRIVERS\W32X86\3\E_FATIEDE.EXE /FU "C:\WINNT\TEMP\E_S65.tmp" /EF "HKCU"
O4 - HKCU\..\Run: [Kalendar] C:\Program Files\Kalendar\kalendar.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINNT\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINNT\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINNT\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINNT\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'Default user')
O4 - Global Startup: Bluetooth.lnk = ?
O4 - Global Startup: Windows Search.lnk = C:\Program Files\Windows Desktop Search\WindowsSearch.exe
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Office Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Send to &Bluetooth Device... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O8 - Extra context menu item: Send To Bluetooth - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: Zdroje informací - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINNT\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINNT\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{90B06D68-9F5C-4664-8114-2EC7C0907069}: NameServer = 8.26.56.26,156.154.70.22
O17 - HKLM\System\CCS\Services\Tcpip\..\{B91DF5FD-6FB7-452C-90CF-A48317B7E090}: NameServer = 8.26.56.26,156.154.70.22
O20 - AppInit_DLLs: APSHook.dll
O20 - Winlogon Notify: ackpbsc - c:\WINNT\system32\ackpbsc.dll
O20 - Winlogon Notify: acunlock - c:\Program Files\ActivIdentity\ActivClient\acunlock.dll
O20 - Winlogon Notify: OneCard - c:\Program Files\Hewlett-Packard\IAM\Bin\ASWLNPkg.dll
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINNT\system32\browseui.dll
O22 - SharedTaskScheduler: Proces mezipaměti kategorií součástí - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINNT\system32\browseui.dll
O23 - Service: ActivClient Middleware Service (accoca) - ActivIdentity - c:\Program Files\ActivIdentity\ActivClient\accoca.exe
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\WINNT\system32\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - Agere Systems - C:\WINNT\system32\agrsmsvc.exe
O23 - Service: Web'n'walk Manager mobile equipment installation service (ameisvc) - Gemfor s.r.o. - C:\Program Files\T-Mobile\Web'n'walk Manager\ameisvc.exe
O23 - Service: AuthenTec Fingerprint Service (ATService) - AuthenTec, Inc. - c:\Program Files\Fingerprint Sensor\AtService.exe
O23 - Service: Avast Antivirus (avast! Antivirus) - AVAST Software - C:\Program Files\AVAST Software\Avast\AvastSvc.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
O23 - Service: Com4QLBEx - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe
O23 - Service: Defragmentation-Service (DfSdkS) - mst software GmbH, Germany - C:\Program Files\Ashampoo\Ashampoo WinOptimizer 2013\DfsdkS.exe
O23 - Service: COMODO Dragon Update Service (DragonUpdater) - Comodo - C:\Program Files\Comodo\Dragon\dragon_updater.exe
O23 - Service: HP ProtectTools Service - Hewlett-Packard Development Company, L.P - c:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\PTChangeFilterService.exe
O23 - Service: Drive Encryption Service (HpFkCryptService) - SafeBoot International - c:\Program Files\Hewlett-Packard\Drive Encryption\HpFkCrypt.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: LiveUpdate (LiveUpdateSvc) - IObit - C:\Program Files\IObit\LiveUpdate\LiveUpdate.exe
O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe
O23 - Service: ServiceLayer - Nokia - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: TeamViewer 10 (TeamViewer) - TeamViewer GmbH - C:\Program Files\TeamViewer\TeamViewer_Service.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Check Point Software Technologies Ltd. - C:\Program Files\CheckPoint\ZoneAlarm\vsmon.exe
O23 - Service: ZoneAlarm Privacy Service (ZAPrivacyService) - Check Point Software Technologies, Ltd. - C:\Program Files\CheckPoint\ZoneAlarm\ZAPrivacyService.exe

--
End of file - 12026 bytes
Nahoru
Reklama
Top
Uživatelský avatar
Orcus
člen Security týmu
Elite Level 10.5
Elite Level 10.5
Příspěvky: 10645
Registrován: duben 10
Bydliště: Okolo rostou 3 růže =o)
Pohlaví: Muž
Stav:
Offline

Re: Prosím o preventivní kontrolu logu (pomalý ntb, občas zamrzání)

Příspěvekod Orcus » 12 zář 2015 22:58

Stáhni si ATF Cleaner
Poklepej na ATF Cleaner.exe, klikni na select all found, poté:
-Když používáš Firefox (Mozzila), klikni na Firefox nahoře a vyber: Select All, poté klikni na Empty Selected.
-Když používáš Operu, klikni nahoře na Operu a vyber: Select All, poté klikni na Empty Selected. Poté klikni na Main (hlavní stránku ) a klikni na Empty Selected.
Po vyčištění klikni na Exit k zavření programu.
ATF-Cleaner je jednoduchý nástroj na odstranění historie z webového prohlížeče. Program dokáže odstranit cache, cookies, historii a další stopy po surfování na Internetu. Mezi podporované prohlížeče patří Internet Explorer, Firefox a Opera. Aplikace navíc umí odstranit dočasné soubory Windows, vysypat koš atd.

- Pokud používáš jen Google Chrome , tak ATF nemusíš použít.

===================================================

Stáhni si TFC
Otevři soubor a zavři všechny ostatní okna, Klikni na Start k zahájení procesu. Program by neměl trvat dlouho.
Poté by se měl PC restartovat, pokud ne , proveď sám.

===================================================

Stáhni AdwCleaner (by Xplode)

Ulož si ho na svojí plochu
Ukonči všechny programy , okna a prohlížeče
Spusť program poklepáním a klikni na „Prohledat-Scan“
Po skenu se objeví log ( jinak je uložen systémovem disku jako AdwCleaner[R?].txt), jeho obsah sem celý vlož.

===================================================

Stáhni si Malwarebytes' Anti-Malware
- Při instalaci odeber zatržítko u „Povolit bezplatnou zkušební verzi Malwarebytes' Anti-Malware Premium“
Nainstaluj a spusť ho
- na konci instalace se ujisti že máš zvoleny/zatrhnuty obě možnosti:
Aktualizace Malwarebytes' Anti-Malware a Spustit aplikaci Malwarebytes' Anti-Malware, pokud jo tak klikni na tlačítko konec
- pokud bude nalezena aktualizace, tak se stáhne a nainstaluje
- program se po té spustí a klikni na Skenovat nyní a
- po proběhnutí programu se ti objeví hláška vpravo dole tak klikni na Kopírovat do schránky a a vlož sem celý log.

- po té klikni na tlačítko Exit, objeví se ti hláška tak zvol Ano
(zatím nic nemaž!).

Pokud budou problémy , spusť v nouz. režimu.
Láska hřeje, ale uhlí je uhlí. :fire:


Log z HJT vkládejte do HJT sekce. Je-li moc dlouhý, rozděl jej do více zpráv.

Pár rad k bezpečnosti PC.

Po dobu mé nepřítomnosti mě zastupuje memphisto, jaro3 a Diallix

Pokud budete spokojeni , můžete podpořit naše fórum.
Nahoru
Uživatelský avatar
simio.simsoft
Level 2
Level 2
Příspěvky: 224
Registrován: duben 13
Bydliště: Blovice, Plzeňský kraj, CZ, EU, Europa, Earth, Solar System, Milky Way, Space
Pohlaví: Muž
Stav:
Offline

Re: Prosím o preventivní kontrolu logu (pomalý ntb, občas zamrzání)

Příspěvekod simio.simsoft » 13 zář 2015 09:59

Zasílám pouze log z programu AdwCleaner. MBAM se mi nepovedlo ani nainstalovat. Už jsem se s tím setkal jednou, a někdo z místních expertů (možná, že zrovna ty) mi napsal, že MBAM má občas problém s Windows XP.

# AdwCleaner v5.007 - Logfile created 13/09/2015 at 09:51:58
# Updated 08/09/2015 by Xplode
# Database : 2015-09-10.1 [Server]
# Operating system : Microsoft Windows XP Service Pack 3 (x86)
# Username : Administrator - PAJA
# Running from : C:\Documents and Settings\Administrator\Plocha\AdwCleaner.exe
# Option : Scan
# Support : http://toolslib.net/forum

***** [ Services ] *****


***** [ Folders ] *****

Folder Found : C:\Documents and Settings\Administrator\Data aplikací\Check Point Software Technologies LTD
Folder Found : C:\Documents and Settings\Administrator\Data aplikací\tencent
Folder Found : C:\Documents and Settings\All Users\Data aplikací\{3C5CBD7B-3D1D-411E-96C2-513FFCA84D2D}
Folder Found : C:\Documents and Settings\All Users\Data aplikací\{BAF091CA-86C4-4627-ADA1-897E2621C1B0}
Folder Found : C:\Documents and Settings\All Users\Data aplikací\{CC71B1CB-A2E4-4CF7-8EDB-A0E290BA1604}
Folder Found : C:\Documents and Settings\All Users\Dokumenty\tencent
Folder Found : C:\Program Files\Check Point Software Technologies LTD
Folder Found : C:\Program Files\tencent
Folder Found : C:\Program Files\Common Files\tencent

***** [ Files ] *****

File Found : C:\Documents and Settings\Administrator\Data aplikací\Mozilla\Firefox\Profiles\5pg9b3uy.default\user.js
File Found : C:\Documents and Settings\Administrator\Local Settings\Data aplikací\Comodo\Dragon\User Data\Default\Local Storage\chrome-extension_lfmhcpmkbdkbgbmkjoiopeeegenkdikp_0.localstorage
File Found : C:\Documents and Settings\Administrator\Local Settings\Data aplikací\Comodo\Dragon\User Data\Default\Local Storage\chrome-extension_lfmhcpmkbdkbgbmkjoiopeeegenkdikp_0.localstorage-journal
File Found : C:\Documents and Settings\Administrator\Local Settings\Data aplikací\Comodo\Dragon\User Data\Default\Local Storage\hxxps_inst.shoppingate.info_0.localstorage
File Found : C:\Documents and Settings\Administrator\Local Settings\Data aplikací\Comodo\Dragon\User Data\Default\Local Storage\hxxps_inst.shoppingate.info_0.localstorage-journal
File Found : C:\Documents and Settings\Administrator\Local Settings\Data aplikací\Comodo\Dragon\User Data\Default\Local Storage\hxxps_inst.shoppingate.info_0.localstorage
File Found : C:\Documents and Settings\Administrator\Local Settings\Data aplikací\Comodo\Dragon\User Data\Default\Local Storage\hxxps_inst.shoppingate.info_0.localstorage-journal

***** [ Shortcuts ] *****


***** [ Scheduled tasks ] *****


***** [ Registry ] *****

Key Found : HKLM\SOFTWARE\Classes\AppID\NCTAudioCDGrabber2.DLL
Key Found : HKLM\SOFTWARE\Classes\ScriptHost.Tool
Key Found : HKLM\SOFTWARE\Classes\ScriptHost.Tool.1
Key Found : HKLM\SOFTWARE\MozillaPlugins\@qq.com/TXSSO
Key Found : HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\{7D2B3E1D-D096-4594-9D8F-A6667F12E0AC}
Key Found : HKLM\SOFTWARE\Classes\AppID\{06DEB529-DE09-43EC-B6E2-451AAB0FF000}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{19D2F415-D58B-46BC-9390-C03DCBC21EB2}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{2A841F7A-A014-4DA5-B6D9-8B913DFB7A8C}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{35B8892D-C3FB-4D88-990D-31DB2EBD72BD}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{438FAE3E-BDEF-44D3-AB8B-0C7C8350DF59}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{5EB0259D-AB79-4AE6-A6E6-24FFE21C3DA4}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{6E45F3E8-2683-4824-A6BE-08108022FB36}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{744E0E81-BC79-4719-A58B-C98F7E78EE5D}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{987D9269-F8A1-408F-BF62-4397D2F5363E}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{9F0F16DD-4E76-4049-A9B1-7A91E48F0323}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{A2DF06F9-A21A-44A8-8A99-8B9C84F29160}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{CADAF6BE-BF50-4669-8BFD-C27BD4E6181B}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{E0722BEB-FDA1-4AA1-A2A8-15A74A5B3F70}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{F1963E76-845B-474C-8C7F-D69A96D8AA34}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{F4288797-CB12-49CE-9DF8-7CDFA1143BEA}
Key Found : HKLM\SOFTWARE\Classes\Interface\{2BEF239C-752E-4001-8048-F256E0D8CD93}
Key Found : HKLM\SOFTWARE\Classes\Interface\{3F607E46-0D3C-4442-B1DE-DE7FA4768F5C}
Key Found : HKLM\SOFTWARE\Classes\Interface\{49C00A51-6E59-41FE-B3FA-2D2157FAD67B}
Key Found : HKLM\SOFTWARE\Classes\Interface\{6DFF5DBA-AE3A-46DB-B301-ECFFC6DB2982}
Key Found : HKLM\SOFTWARE\Classes\Interface\{744E0E81-BC79-4719-A58B-C98F7E78EE5D}
Key Found : HKLM\SOFTWARE\Classes\Interface\{813A22E0-3E2B-4188-9BDA-ECA9878B8D48}
Key Found : HKLM\SOFTWARE\Classes\Interface\{BCFF5F55-6F44-11D2-86F8-00104B265ED5}
Key Found : HKLM\SOFTWARE\Classes\Interface\{DE34CD67-F1C8-4001-9A23-B8A68F63F377}
Key Found : HKLM\SOFTWARE\Classes\Interface\{FE0273D1-99DF-4AC0-87D5-1371C6271785}
Key Found : HKLM\SOFTWARE\Classes\TypeLib\{06DEB529-DE09-43EC-B6E2-451AAB0FF000}
Key Found : HKLM\SOFTWARE\Classes\TypeLib\{212C2C4F-C845-4FBC-9561-C833A13D8DCE}
Key Found : HKLM\SOFTWARE\Classes\TypeLib\{3C5D1D57-16C8-473C-A552-37B8D88596FE}
Key Found : HKLM\SOFTWARE\Classes\TypeLib\{4A115D8A-6A7B-4C72-92B1-2E2D01F36979}
Key Found : HKLM\SOFTWARE\Classes\TypeLib\{93E3D79C-0786-48FF-9329-93BC9F6DC2B3}
Key Found : HKLM\SOFTWARE\Classes\TypeLib\{99DF8440-814E-497F-BDDD-FB93E9E9DF96}
Key Found : HKLM\SOFTWARE\Classes\TypeLib\{E00DE9B9-B128-4C39-B732-B5D85013FA48}
Key Found : HKLM\SOFTWARE\Classes\TypeLib\{81CA8FCD-1420-4A07-B47D-B30F3DDA79E1}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2A841F7A-A014-4DA5-B6D9-8B913DFB7A8C}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2A841F7A-A014-4DA5-B6D9-8B913DFB7A8C}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{438FAE3E-BDEF-44D3-AB8B-0C7C8350DF59}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{BA0C978D-D909-49B6-AFE2-8BDE245DC7E6}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{2A841F7A-A014-4DA5-B6D9-8B913DFB7A8C}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{438FAE3E-BDEF-44D3-AB8B-0C7C8350DF59}
Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{83CAD530-387D-40FD-82EA-B9E863D92A9B}
Value Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{438FAE3E-BDEF-44D3-AB8B-0C7C8350DF59}]
Value Found : HKCU\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser [{10921475-03CE-4E04-90CE-E2E7EF20C814}]
Key Found : HKCU\Software\Softonic
Key Found : HKCU\Software\UpdateStar
Data Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\AboutURls [Tabs] - hxxp://search.zonealarm.com/?src=nt&tbi ... sId=&ver=&

***** [ Web browsers ] *****

[C:\Documents and Settings\Administrator\Local Settings\Data aplikací\Comodo\Dragon\User Data\Default\Web data] [Search Provider] Found : isearch.avg.com
[C:\Documents and Settings\Administrator\Local Settings\Data aplikací\Comodo\Dragon\User Data\Default\Web data] [Search Provider] Found : isearch.avg.com__
[C:\Documents and Settings\Administrator\Local Settings\Data aplikací\Comodo\Dragon\User Data\Default\Web data] [Search Provider] Found : imeme.en.softonic.com
[C:\Documents and Settings\Administrator\Local Settings\Data aplikací\Comodo\Dragon\User Data\Default\Web data] [Search Provider] Found : websearch.ask.com

########## EOF - C:\AdwCleaner\AdwCleaner[S1].txt - [7418 bytes] ##########
Nahoru
Uživatelský avatar
jerabina
člen Security týmu
Level 6
Level 6
Příspěvky: 3647
Registrován: březen 13
Bydliště: Litoměřice
Pohlaví: Muž
Stav:
Offline

Re: Prosím o preventivní kontrolu logu (pomalý ntb, občas zamrzání)

Příspěvekod jerabina » 13 zář 2015 13:26

MBAM jsi zkoušel nainstalovat i v nouzovém režimu?

Spusť znovu AdwCleaner (u Windows Vista či Windows7, klikni na AdwCleaner pravým a vyber „Spustit jako správce“
klikni na „Prohledat-Scan“, po prohledání klikni na „ Vymazat-Clean“

Program provede opravu, po automatickém restartu neukáže log (C:\AdwCleaner [S?].txt) , jeho obsah sem celý vlož.

Stáhni si Junkware Removal Tool by Thisisu

na svojí plochu.

Deaktivuj si svůj antivirový program. Pravým tl. myši klikni na JRT.exe a vyber „spustit jako správce“. Pro pokračování budeš vyzván ke stisknutí jakékoliv klávesy. Na nějakou klikni.
Začne skenování programu. Skenování může trvat dloho , podle množství nákaz. Po ukončení skenu se objeví log (JRT.txt) , který se uloží na ploše.
Zkopíruj sem prosím celý jeho obsah.

Stáhni si RogueKiller
32bit.:
http://www.sur-la-toile.com/RogueKiller/RogueKiller.exe
64bit.:
http://www.sur-la-toile.com/RogueKiller ... lerX64.exe
na svojí plochu.
- Zavři všechny ostatní programy a prohlížeče.
- Pro OS Vista a win7 spusť program RogueKiller.exe jako správce , u XP poklepáním.
- počkej až skončí Prescan -vyhledávání škodlivých procesů.
-Potom klikni na „Prohledat“.
- Program skenuje procesy PC. Po proskenování klikni na „Zpráva“celý obsah logu sem zkopíruj.
Pokud je program blokován , zkus ho spustit několikrát. Pokud dále program nepůjde spustit a pracovat, přejmenuj ho na winlogon.exe.
Když nevíš jak dál, přichází na řadu prostudovat manuál!
HJT návod

Pokud neodpovídám do vašich témat v sekci HJT když jsem online, tak je to jen proto, že jsem na mobilu kde je studování logů a psaní skriptů nemožné. Neberte to tedy prosím jako ignoraci.
Nahoru
Uživatelský avatar
simio.simsoft
Level 2
Level 2
Příspěvky: 224
Registrován: duben 13
Bydliště: Blovice, Plzeňský kraj, CZ, EU, Europa, Earth, Solar System, Milky Way, Space
Pohlaví: Muž
Stav:
Offline

Re: Prosím o preventivní kontrolu logu (pomalý ntb, občas zamrzání)

Příspěvekod simio.simsoft » 13 zář 2015 15:08

Instalovat MBAM v nouz. režimu jsem nezkoušel, zkusím nyní. Jinak posílám hotové logy z programů JRT a RogueKiller

JRT log

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Malwarebytes
Version: 7.6.1 (09.08.2015:1)
OS: Microsoft Windows XP x86
Ran by Administrator on ne 13.09.2015 at 14:47:33,21
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Tasks

Successfully deleted: [Task] C:\WINNT\Tasks\Driver Booster Update.job
Successfully deleted: [Task] C:\WINNT\Tasks\SmartDefrag4_Startup.job



~~~ Registry Values

Successfully repaired: [Registry Value] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\\DisplayName
Successfully repaired: [Registry Value] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\\URL



~~~ Registry Keys



~~~ Files



~~~ Folders

Successfully deleted: [Folder] C:\Documents and Settings\Administrator\Data aplikacˇ\iobit\driver booster
Successfully deleted: [Folder] C:\Documents and Settings\Administrator\Data aplikacˇ\productdata
Successfully deleted: [Folder] C:\Program Files\iobit\driver booster
Successfully deleted: [Folder] C:\WINNT\System32\ai_recyclebin



~~~ FireFox

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\MozillaPlugins\@qq.com/npqscall
Emptied folder: C:\Documents and Settings\Administrator\Data aplikacˇ\mozilla\firefox\profiles\5pg9b3uy.default\minidumps [2 files]





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on ne 13.09.2015 at 14:49:29,82
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~


RogueKiller log

RogueKiller V10.10.4.0 [Sep 4 2015] by Adlice Software
mail : http://www.adlice.com/contact/
Feedback : http://forum.adlice.com
Webová stránka : http://www.adlice.com/software/roguekiller/
Blog : http://www.adlice.com

Operační systém : Windows XP (5.1.2600 Service Pack 3) 32 bits version
Spuštěno : Normální režim
Uživatel : Administrator [Práva správce]
Started from : C:\Documents and Settings\Administrator\Plocha\RogueKiller.exe
Mód : Prohledat -- Datum : 09/13/2015 15:05:03

¤¤¤ Procesy : 0 ¤¤¤

¤¤¤ Registry : 11 ¤¤¤
[Suspicious.Path] HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\ASFWHide (\??\C:\Temp\ASFWHide) -> Nalezeno
[Suspicious.Path] HKEY_LOCAL_MACHINE\System\ControlSet001\Services\ASFWHide (\??\C:\Temp\ASFWHide) -> Nalezeno
[Suspicious.Path] HKEY_LOCAL_MACHINE\System\ControlSet002\Services\ASFWHide (\??\C:\Temp\ASFWHide) -> Nalezeno
[PUM.HomePage] HKEY_USERS\S-1-5-21-4220318380-3817037010-209092702-500\Software\Microsoft\Internet Explorer\Main | Start Page : http://www.seznam.cz/ -> Nalezeno
[PUM.Dns] HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters | DhcpNameServer : 10.0.0.138 ([(Private Address) (XX)]) -> Nalezeno
[PUM.Dns] HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Tcpip\Parameters | DhcpNameServer : 10.0.0.138 ([(Private Address) (XX)]) -> Nalezeno
[PUM.Dns] HKEY_LOCAL_MACHINE\System\ControlSet002\Services\Tcpip\Parameters | DhcpNameServer : 10.0.0.138 ([(Private Address) (XX)]) -> Nalezeno
[PUM.Dns] HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{90B06D68-9F5C-4664-8114-2EC7C0907069} | DhcpNameServer : 10.0.0.138 ([(Private Address) (XX)]) -> Nalezeno
[PUM.Dns] HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Tcpip\Parameters\Interfaces\{90B06D68-9F5C-4664-8114-2EC7C0907069} | DhcpNameServer : 10.0.0.138 ([(Private Address) (XX)]) -> Nalezeno
[PUM.Dns] HKEY_LOCAL_MACHINE\System\ControlSet002\Services\Tcpip\Parameters\Interfaces\{90B06D68-9F5C-4664-8114-2EC7C0907069} | DhcpNameServer : 10.0.0.138 ([(Private Address) (XX)]) -> Nalezeno
[PUM.StartMenu] HKEY_USERS\S-1-5-21-4220318380-3817037010-209092702-500\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced | Start_ShowRecentDocs : 2 -> Nalezeno

¤¤¤ Úlohy : 0 ¤¤¤

¤¤¤ Soubory : 0 ¤¤¤

¤¤¤ Soubor HOSTS : 1 ¤¤¤
[C:\WINNT\system32\drivers\etc\hosts] 127.0.0.1 localhost

¤¤¤ Antirootkit : 0 (Driver: Nahrán) ¤¤¤

¤¤¤ Webové prohlížeče : 1 ¤¤¤
[PUM.HomePage][FIREFX:Config] 5pg9b3uy.default : user_pref("browser.startup.homepage", "https://www.seznam.cz/?logged=1#obsah"); -> Nalezeno

¤¤¤ Kontrola MBR : ¤¤¤
+++++ PhysicalDrive0: FUJITSU MJA2250BH G2 +++++
--- User ---
[MBR] 535236ba0d38de4b13a951a60a710a52
[BSP] ebd6ebd3ad67c74bb21e8653d11749f6 : Linux|VT.Unknown MBR Code
Partition table:
0 - [ACTIVE] NTFS (0x7) [VISIBLE] Offset (sectors): 63 | Size: 119097 MB [Windows XP Bootstrap | Windows XP Bootloader]
1 - [XXXXXX] EXTEN (0x5) [VISIBLE] Offset (sectors): 243912702 | Size: 119377 MB
User = LL1 ... OK
User = LL2 ... OK
Nahoru
Uživatelský avatar
memphisto
Guru Level 13
Guru Level 13
Příspěvky: 21113
Registrován: září 06
Bydliště: Zlín - České Budějovice
Pohlaví: Muž
Stav:
Offline

Re: Prosím o preventivní kontrolu logu (pomalý ntb, občas zamrzání)

Příspěvekod memphisto » 13 zář 2015 16:05

Zavři všechny programy a prohlížeče. Deaktivuj antivir a firewall.
Prosím, odpoj všechny USB nebo externí disky z počítače před spuštěním tohoto programu.
Spusť znovu RogueKiller ( Pro Windows Vista nebo Windows 7, klepni pravým a vyber "Spustit jako správce", ve Windows XP poklepej ke spuštění).
- Počkej, až Prescan dokončí práci...
- Pak klikni na "Prohledat " ,po jeho skončení:
- V záložkách (Registry , Tasks , Web Browser apod.) vše zatrhni (dej zatržítka)
- Klikni na "Smazat"
- Počkej, dokud Status box nezobrazí " Mazání dokončeno "
- Klikni na "Zpráva " a zkopíruj a vlož obsah té zprávy prosím sem. Log je možno nalézt v RKreport [číslo]. txt na ploše.
- Zavři RogueKiller

Stáhni
Zoek.exe

a uloz si ho na plochu.
Zavři všechny ostatní programy , okna i prohlížeče.
Spusť Zoek.exe ( u win vista , win7, 8 klikni na něj pravým a vyber : „Spustit jako správce“
- pozor , náběh programu může trvat déle.

Do okna programu vlož skript níže:

Kód: Vybrat vše

autoclean;
emptyclsid;
iedefaults;
FFdefaults;
CHRdefaults;
emptyalltemp;
resethosts;


klikni na Run Script
Program provede sken , opravu, sken i oprava může trvat i více minut ,je třeba posečkat do konce. Do okna neklikej!
Program nabídne restart , potvrď .

Po restartu se může nějaký čas ukázat pouze černá plocha , to je normální. Je třeba počkat až se vytvoří log. Ten si můžeš uložit třeba do dokumentů , jinak se sám ukládá do:
C:\zoek-results.log
Zkopíruj sem celý obsah toho logu.
PRAVIDLA PC-HELP.CZ, PRAVIDLA sekce HijackThis, HijackThis návod, Memtest, CCleaner
Logy z programu HijackThis neposílejte prosím přes SZ, ale vkládejte je do patřičné sekce. Děkuji
Nahoru
Uživatelský avatar
simio.simsoft
Level 2
Level 2
Příspěvky: 224
Registrován: duben 13
Bydliště: Blovice, Plzeňský kraj, CZ, EU, Europa, Earth, Solar System, Milky Way, Space
Pohlaví: Muž
Stav:
Offline

Re: Prosím o preventivní kontrolu logu (pomalý ntb, občas zamrzání)

Příspěvekod simio.simsoft » 14 zář 2015 17:17

RogueKiller log

RogueKiller V10.10.4.0 [Sep 4 2015] by Adlice Software
mail : http://www.adlice.com/contact/
Feedback : http://forum.adlice.com
Webová stránka : http://www.adlice.com/software/roguekiller/
Blog : http://www.adlice.com

Operační systém : Windows XP (5.1.2600 Service Pack 3) 32 bits version
Spuštěno : Normální režim
Uživatel : Administrator [Práva správce]
Started from : C:\Documents and Settings\Administrator\Plocha\RogueKiller.exe
Mód : Smazat -- Datum : 09/14/2015 16:48:21

¤¤¤ Procesy : 0 ¤¤¤

¤¤¤ Registry : 11 ¤¤¤
[Suspicious.Path] HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\ASFWHide (\??\C:\Temp\ASFWHide) -> Smazáno
[Suspicious.Path] HKEY_LOCAL_MACHINE\System\ControlSet001\Services\ASFWHide (\??\C:\Temp\ASFWHide) -> Smazáno
[Suspicious.Path] HKEY_LOCAL_MACHINE\System\ControlSet002\Services\ASFWHide (\??\C:\Temp\ASFWHide) -> Smazáno
[PUM.HomePage] HKEY_USERS\S-1-5-21-4220318380-3817037010-209092702-500\Software\Microsoft\Internet Explorer\Main | Start Page : http://www.seznam.cz/ -> Nahrazeno (http://go.microsoft.com/fwlink/p/?LinkId=255141)
[PUM.Dns] HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters | DhcpNameServer : 10.0.0.138 ([(Private Address) (XX)]) -> Nahrazeno ()
[PUM.Dns] HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Tcpip\Parameters | DhcpNameServer : 10.0.0.138 ([(Private Address) (XX)]) -> Nahrazeno ()
[PUM.Dns] HKEY_LOCAL_MACHINE\System\ControlSet002\Services\Tcpip\Parameters | DhcpNameServer : 10.0.0.138 ([(Private Address) (XX)]) -> Nahrazeno ()
[PUM.Dns] HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{90B06D68-9F5C-4664-8114-2EC7C0907069} | DhcpNameServer : 10.0.0.138 ([(Private Address) (XX)]) -> Nahrazeno ()
[PUM.Dns] HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Tcpip\Parameters\Interfaces\{90B06D68-9F5C-4664-8114-2EC7C0907069} | DhcpNameServer : 10.0.0.138 ([(Private Address) (XX)]) -> Nahrazeno ()
[PUM.Dns] HKEY_LOCAL_MACHINE\System\ControlSet002\Services\Tcpip\Parameters\Interfaces\{90B06D68-9F5C-4664-8114-2EC7C0907069} | DhcpNameServer : 10.0.0.138 ([(Private Address) (XX)]) -> Nahrazeno ()
[PUM.StartMenu] HKEY_USERS\S-1-5-21-4220318380-3817037010-209092702-500\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced | Start_ShowRecentDocs : 2 -> Nahrazeno (1)

¤¤¤ Úlohy : 0 ¤¤¤

¤¤¤ Soubory : 0 ¤¤¤

¤¤¤ Soubor HOSTS : 1 ¤¤¤
[C:\WINNT\system32\drivers\etc\hosts] 127.0.0.1 localhost

¤¤¤ Antirootkit : 0 (Driver: Nahrán) ¤¤¤

¤¤¤ Webové prohlížeče : 1 ¤¤¤
[PUM.HomePage][FIREFX:Config] 5pg9b3uy.default : user_pref("browser.startup.homepage", "https://www.seznam.cz/?logged=1#obsah"); -> Nevybráno

¤¤¤ Kontrola MBR : ¤¤¤
+++++ PhysicalDrive0: FUJITSU MJA2250BH G2 +++++
--- User ---
[MBR] 535236ba0d38de4b13a951a60a710a52
[BSP] ebd6ebd3ad67c74bb21e8653d11749f6 : Linux|VT.Unknown MBR Code
Partition table:
0 - [ACTIVE] NTFS (0x7) [VISIBLE] Offset (sectors): 63 | Size: 119097 MB [Windows XP Bootstrap | Windows XP Bootloader]
1 - [XXXXXX] EXTEN (0x5) [VISIBLE] Offset (sectors): 243912702 | Size: 119377 MB
User = LL1 ... OK
User = LL2 ... OK

ZOEK log


Zoek.exe v5.0.0.0 Updated 13-09-2015
Tool run by Administrator on po 14.09.2015 at 16:51:43,46.
Systém Microsoft Windows XP Professional 5.1.2600 Service Pack 3 x86
Running in: Normal Mode Internet Access Detected
Launched: C:\Documents and Settings\Administrator\Plocha\zoek.exe [Scan all users] [Script inserted]

==== System Restore Info ======================

14.9.2015 16:52:23 Zoek.exe System Restore Point Created Successfully.

==== Reset Hosts File ======================

# Copyright (c) 1993-2006 Microsoft Corp.
#
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
#
# This file contains the mappings of IP addresses to host names. Each
# entry should be kept on an individual line. The IP address should
# be placed in the first column followed by the corresponding host name.
# The IP address and the host name should be separated by at least one
# space.
#
# Additionally, comments (such as these) may be inserted on individual
# lines or following the machine name denoted by a '#' symbol.
#
# For example:
#
# 102.54.94.97 rhino.acme.com # source server
# 38.25.63.10 x.acme.com # x client host

127.0.0.1 localhost

==== Empty Folders Check ======================

C:\Program Files\Activision deleted successfully
C:\Program Files\MSXML 4.0 deleted successfully
C:\DOCUME~1\ALLUSE~1\DATAAP~1\Intel deleted successfully

==== Deleting CLSID Registry Keys ======================


==== Deleting CLSID Registry Values ======================


==== Deleting Services ======================


==== Deleting Files \ Folders ======================

C:\Program Files\Activision not found
C:\Program Files\ComPlus Applications deleted
C:\Program Files\WindowsUpdate deleted
C:\DOCUME~1\ALLUSE~1\DATAAP~1\ProductData deleted
C:\WINNT\system32\GroupPolicy\Adm deleted
C:\WINNT\system32\GroupPolicy\Machine deleted
C:\WINNT\system32\GroupPolicy\User deleted
C:\WINNT\system32\GroupPolicy\gpt.ini deleted

==== Firefox Extensions Registry ======================

[HKEY_LOCAL_MACHINE\Software\Mozilla\Firefox\Extensions]
"wrc@avast.com"="C:\Program Files\AVAST Software\Avast\WebRep\FF" [11.08.2015 15:33]

==== Chromium Look ======================

HKEY_LOCAL_MACHINE\SOFTWARE\Google\Chrome\Extensions
gomekmidlodglbbmalcneegieacbdmki - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx[18.03.2015 22:17]

==== Set IE to Default ======================

Old Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"="http://go.microsoft.com/fwlink/p/?LinkId=255141"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\AboutURLs]
"Tabs"="http://www.google.com"

New Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"="http://go.microsoft.com/fwlink/p/?LinkId=255141"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\AboutURLs]
"Tabs"="about:newtab"

==== All HKCU SearchScopes ======================

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes
"DefaultScope"="{0633EE93-D776-472f-A0FF-E1416B8B2E3A}"
{012E1000-F331-11DB-8314-0800200C9A66} Google Url="http://www.google.com/search?q={searchTerms}"
{0633EE93-D776-472f-A0FF-E1416B8B2E3A} Bing Url="http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC"

==== Reset Google Chrome ======================

Nothing found to reset

==== Deleting Registry Keys ======================

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\UnityWebPlayer deleted successfully

==== Empty IE Cache ======================

C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5 emptied successfully
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\index.dat will be deleted at reboot
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat will be deleted at reboot

==== Empty FireFox Cache ======================

No FireFox Profiles found

==== Empty Chrome Cache ======================

No Chrome User Data found

==== Empty All Flash Cache ======================

No Flash Cache Found

==== Empty All Java Cache ======================

No Java Cache Found

==== C:\zoek_backup content ======================

C:\zoek_backup (files=19 folders=6 3804116 bytes)

==== Empty Temp Folders ======================

C:\WINNT\Temp will be emptied at reboot

==== After Reboot ======================

==== Empty Temp Folders ======================

C:\WINNT\Temp successfully emptied
C:\Temp successfully emptied

==== Empty Recycle Bin ======================

C:\RECYCLER successfully emptied

==== Deleting Files / Folders ======================

"C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\index.dat" not deleted
"C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat" not deleted

==== EOF on po 14.09.2015 at 17:04:47,39 ======================
Nahoru
Uživatelský avatar
jaro3
člen Security týmu
Guru Level 15
Guru Level 15
Příspěvky: 43072
Registrován: červen 07
Bydliště: Jižní Čechy
Pohlaví: Muž
Stav:
Offline

Re: Prosím o preventivní kontrolu logu (pomalý ntb, občas zamrzání)

Příspěvekod jaro3 » 14 zář 2015 21:35

MbAM na XP už dávno nejde..

Vypni rez. ochranu u antiviru a antispywaru,příp. firewall..

Stáhni si ComboFix (by sUBs)
a ulož si ho na plochu.
Ukonči všechna aktivní okna a spusť ho.
- Po spuštění se zobrazí podmínky užití, potvrď je stiskem tlačítka Ano
- Dále postupuj dle pokynů, během aplikování ComboFixu neklikej do zobrazujícího se okna
- Po dokončení skenování by měl program vytvořit log - C:\ComboFix.txt - zkopíruj sem prosím celý jeho obsah
Pokud budou problémy , spusť ho v nouz. režimu.

Upozornění : Může se stát, že po aplikaci Combofixu a restartu počítače, Windows nenaběhnou , nebo nenajede plocha , budou problémy s připojením, pak znovu restartuj počítač, pokud to nepomůže , po restartu mačkej klávesu F8 a pak zvol poslední známou funkční konfiguraci. , či použij bod obnovy.
Při práci s programy HJT, ComboFix,MbAM, SDFix aj. zavřete všechny ostatní aplikace a prohlížeče!
Neposílejte logy do soukromých zpráv.Po dobu mé nepřítomnosti mě zastupuje memphisto , Žbeky a Orcus.
Pokud budete spokojeni , můžete podpořit naše forum:Podpora fóra
Nahoru
Uživatelský avatar
simio.simsoft
Level 2
Level 2
Příspěvky: 224
Registrován: duben 13
Bydliště: Blovice, Plzeňský kraj, CZ, EU, Europa, Earth, Solar System, Milky Way, Space
Pohlaví: Muž
Stav:
Offline

Re: Prosím o preventivní kontrolu logu (pomalý ntb, občas zamrzání)

Příspěvekod simio.simsoft » 16 zář 2015 16:47

ComboFix 15-09-07.01 - Administrator 16.09.2015 16:33:55.2.2 - x86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.420.1029.18.1976.1264 [GMT 2:00]
Spuštěný z: c:\documents and settings\Administrator\Plocha\ComboFix.exe
AV: avast! Antivirus *Disabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D}
FW: ZoneAlarm Free Firewall Firewall *Disabled* {829BDA32-94B3-44F4-8446-F8FCFF809F8B}
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
---- Předchozí spuštění -------
.
c:\documents and settings\All Users\ntuser.pol
c:\program files\EasyOn\Digital Microscope Suite\DetectUSBDevice.dll
c:\program files\EasyOn\Digital Microscope Suite\EasyOnMeasure.ax
c:\program files\EasyOn\Digital Microscope Suite\EZAudioGargle.ax
c:\program files\EasyOn\Digital Microscope Suite\EZCountDown.ax
c:\program files\EasyOn\Digital Microscope Suite\EZMediaTee2.ax
c:\program files\EasyOn\Digital Microscope Suite\EZVerify.dll
c:\program files\EasyOn\Digital Microscope Suite\EZVideoAdjust2.ax
c:\program files\EasyOn\Digital Microscope Suite\EZVideoGrabber2.ax
c:\program files\EasyOn\Digital Microscope Suite\FinalTrial.dll
c:\program files\EasyOn\Digital Microscope Suite\gdiplus.dll
c:\program files\EasyOn\Digital Microscope Suite\Language\English.ini
c:\program files\EasyOn\Digital Microscope Suite\MFC42.DLL
c:\program files\EasyOn\Digital Microscope Suite\MicroCam2.exe
c:\program files\EasyOn\Digital Microscope Suite\msvcp60.dll
c:\program files\EasyOn\Digital Microscope Suite\MSVCRT.DLL
c:\program files\EasyOn\Digital Microscope Suite\StillCapture.ax
c:\winnt\$msi31uninstall_kb893803v2$\msi.dll
c:\winnt\$msi31uninstall_kb893803v2$\msiexec.exe
c:\winnt\$msi31uninstall_kb893803v2$\msihnd.dll
c:\winnt\$msi31uninstall_kb893803v2$\msimsg.dll
c:\winnt\$msi31uninstall_kb893803v2$\msisip.dll
c:\winnt\$msi31uninstall_kb893803v2$\reg00013
c:\winnt\$msi31uninstall_kb893803v2$\reg00014
c:\winnt\$msi31uninstall_kb893803v2$\reg00015
c:\winnt\$msi31uninstall_kb893803v2$\reg00016
c:\winnt\$msi31uninstall_kb893803v2$\reg00017
c:\winnt\$msi31uninstall_kb893803v2$\reg00018
c:\winnt\$msi31uninstall_kb893803v2$\reg00019
c:\winnt\$msi31uninstall_kb893803v2$\reg00020
c:\winnt\$msi31uninstall_kb893803v2$\reg00021
c:\winnt\$msi31uninstall_kb893803v2$\reg00022
c:\winnt\$msi31uninstall_kb893803v2$\reg00023
c:\winnt\$msi31uninstall_kb893803v2$\reg00024
c:\winnt\$msi31uninstall_kb893803v2$\reg00025
c:\winnt\$msi31uninstall_kb893803v2$\reg00026
c:\winnt\$msi31uninstall_kb893803v2$\reg00027
c:\winnt\$msi31uninstall_kb893803v2$\reg00028
c:\winnt\$msi31uninstall_kb893803v2$\reg00029
c:\winnt\$msi31uninstall_kb893803v2$\reg00030
c:\winnt\$msi31uninstall_kb893803v2$\reg00031
c:\winnt\$msi31uninstall_kb893803v2$\reg00032
c:\winnt\$msi31uninstall_kb893803v2$\reg00033
c:\winnt\$msi31uninstall_kb893803v2$\reg00034
c:\winnt\$msi31uninstall_kb893803v2$\reg00035
c:\winnt\$msi31uninstall_kb893803v2$\reg00036
c:\winnt\$msi31uninstall_kb893803v2$\reg00037
c:\winnt\$msi31uninstall_kb893803v2$\reg00038
c:\winnt\$msi31uninstall_kb893803v2$\reg00039
c:\winnt\$msi31uninstall_kb893803v2$\reg00040
c:\winnt\$msi31uninstall_kb893803v2$\reg00041
c:\winnt\$msi31uninstall_kb893803v2$\reg00042
c:\winnt\$msi31uninstall_kb893803v2$\reg00043
c:\winnt\$msi31uninstall_kb893803v2$\reg00044
c:\winnt\$msi31uninstall_kb893803v2$\reg00045
c:\winnt\$msi31uninstall_kb893803v2$\reg00046
c:\winnt\$msi31uninstall_kb893803v2$\reg00047
c:\winnt\$msi31uninstall_kb893803v2$\reg00048
c:\winnt\$msi31uninstall_kb893803v2$\reg00051
c:\winnt\$msi31uninstall_kb893803v2$\reg00052
c:\winnt\$msi31uninstall_kb893803v2$\reg00053
c:\winnt\$msi31uninstall_kb893803v2$\reg00054
c:\winnt\$msi31uninstall_kb893803v2$\reg00055
c:\winnt\$msi31uninstall_kb893803v2$\reg00056
c:\winnt\$msi31uninstall_kb893803v2$\reg00057
c:\winnt\$msi31uninstall_kb893803v2$\reg00058
c:\winnt\$msi31uninstall_kb893803v2$\reg00059
c:\winnt\$msi31uninstall_kb893803v2$\reg00060
c:\winnt\$msi31uninstall_kb893803v2$\reg00061
c:\winnt\$msi31uninstall_kb893803v2$\reg00062
c:\winnt\$msi31uninstall_kb893803v2$\reg00063
c:\winnt\$msi31uninstall_kb893803v2$\reg00064
c:\winnt\$msi31uninstall_kb893803v2$\reg00065
c:\winnt\$msi31uninstall_kb893803v2$\reg00066
c:\winnt\$msi31uninstall_kb893803v2$\reg00067
c:\winnt\$msi31uninstall_kb893803v2$\reg00068
c:\winnt\$msi31uninstall_kb893803v2$\reg00069
c:\winnt\$msi31uninstall_kb893803v2$\reg00070
c:\winnt\$msi31uninstall_kb893803v2$\reg00071
c:\winnt\$msi31uninstall_kb893803v2$\reg00072
c:\winnt\$msi31uninstall_kb893803v2$\reg00073
c:\winnt\$msi31uninstall_kb893803v2$\reg00074
c:\winnt\$msi31uninstall_kb893803v2$\reg00075
c:\winnt\$msi31uninstall_kb893803v2$\reg00076
c:\winnt\$msi31uninstall_kb893803v2$\reg00077
c:\winnt\$msi31uninstall_kb893803v2$\reg00078
c:\winnt\$msi31uninstall_kb893803v2$\reg00079
c:\winnt\$msi31uninstall_kb893803v2$\reg00080
c:\winnt\$msi31uninstall_kb893803v2$\reg00081
c:\winnt\$msi31uninstall_kb893803v2$\reg00082
c:\winnt\$msi31uninstall_kb893803v2$\reg00083
c:\winnt\$msi31uninstall_kb893803v2$\reg00084
c:\winnt\$msi31uninstall_kb893803v2$\reg00085
c:\winnt\$msi31uninstall_kb893803v2$\reg00086
c:\winnt\$msi31uninstall_kb893803v2$\reg00087
c:\winnt\$msi31uninstall_kb893803v2$\reg00088
c:\winnt\$msi31uninstall_kb893803v2$\reg00089
c:\winnt\$msi31uninstall_kb893803v2$\reg00090
c:\winnt\$msi31uninstall_kb893803v2$\reg00091
c:\winnt\$msi31uninstall_kb893803v2$\reg00092
c:\winnt\$msi31uninstall_kb893803v2$\reg00093
c:\winnt\$msi31uninstall_kb893803v2$\reg00094
c:\winnt\$msi31uninstall_kb893803v2$\reg00095
c:\winnt\$msi31uninstall_kb893803v2$\reg00096
c:\winnt\$msi31uninstall_kb893803v2$\reg00097
c:\winnt\$msi31uninstall_kb893803v2$\reg00098
c:\winnt\$msi31uninstall_kb893803v2$\reg00099
c:\winnt\$msi31uninstall_kb893803v2$\reg00100
c:\winnt\$msi31uninstall_kb893803v2$\reg00101
c:\winnt\$msi31uninstall_kb893803v2$\reg00102
c:\winnt\$msi31uninstall_kb893803v2$\reg00103
c:\winnt\$msi31uninstall_kb893803v2$\reg00104
c:\winnt\$msi31uninstall_kb893803v2$\reg00105
c:\winnt\$msi31uninstall_kb893803v2$\reg00106
c:\winnt\$msi31uninstall_kb893803v2$\reg00107
c:\winnt\$msi31uninstall_kb893803v2$\reg00108
c:\winnt\$msi31uninstall_kb893803v2$\reg00109
c:\winnt\$msi31uninstall_kb893803v2$\reg00110
c:\winnt\$msi31uninstall_kb893803v2$\reg00111
c:\winnt\$msi31uninstall_kb893803v2$\reg00112
c:\winnt\$msi31uninstall_kb893803v2$\reg00113
c:\winnt\$msi31uninstall_kb893803v2$\reg00114
c:\winnt\$msi31uninstall_kb893803v2$\reg00115
c:\winnt\$msi31uninstall_kb893803v2$\reg00116
c:\winnt\$msi31uninstall_kb893803v2$\spuninst\spuninst.exe
c:\winnt\$msi31uninstall_kb893803v2$\spuninst\spuninst.inf
c:\winnt\$msi31uninstall_kb893803v2$\spuninst\spuninst.txt
c:\winnt\$msi31uninstall_kb893803v2$\spuninst\updspapi.dll
c:\winnt\IsUn0407.exe
c:\winnt\iun6002.exe
c:\winnt\pkunzip.pif
c:\winnt\pkzip.pif
.
-- Předchozí spuštění --
.
Nakažená kopie c:\winnt\system32\Version.dll byla nalezena a vyléčena.
Obnovena kopie z - c:\winnt\ServicePackFiles\i386\version.dll
.
--------
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2015-08-16 do 2015-09-16 )))))))))))))))))))))))))))))))
.
.
2015-09-14 14:59 . 2015-09-14 14:51 24064 ----a-w- c:\winnt\zoek-delete.exe
2015-09-14 14:59 . 2015-09-16 14:41 -------- d-----w- C:\Temp
2015-09-14 14:51 . 2015-09-14 14:58 -------- d-----w- C:\zoek_backup
2015-09-14 14:23 . 2015-09-14 14:23 -------- d-----w- c:\documents and settings\Administrator\Data aplikací\ProductData
2015-09-13 12:52 . 2015-09-14 14:35 35064 ----a-w- c:\winnt\system32\drivers\TrueSight.sys
2015-09-13 12:52 . 2015-09-13 13:09 -------- d-----w- c:\documents and settings\All Users\Data aplikací\RogueKiller
2015-09-13 07:56 . 2015-09-13 07:56 -------- d-----w- c:\documents and settings\All Users\Data aplikací\Malwarebytes
2015-09-13 07:56 . 2015-06-18 06:41 121560 ----a-w- c:\winnt\system32\drivers\mbamchameleon.sys
2015-09-13 07:56 . 2015-06-18 06:41 23256 ----a-w- c:\winnt\system32\drivers\mbam.sys
2015-09-13 07:51 . 2015-09-13 12:37 -------- d-----w- C:\AdwCleaner
2015-08-29 13:50 . 2004-10-22 00:17 274432 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\10\50\Intel32\iscript.dll
2015-08-29 13:50 . 2004-10-22 00:16 180224 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\10\50\Intel32\iuser.dll
2015-08-29 13:50 . 2004-10-22 00:18 749568 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\10\50\Intel32\iKernel.dll
2015-08-29 13:50 . 2004-10-22 00:17 69715 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\10\50\Intel32\ctor.dll
2015-08-29 13:50 . 2004-10-22 00:16 5632 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\10\50\Intel32\DotNetInstaller.exe
2015-08-29 13:50 . 2015-08-29 13:50 192644 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\10\50\Intel32\iGdi.dll
2015-08-29 13:50 . 2015-08-29 13:50 323716 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\10\50\Intel32\setup.dll
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2015-08-12 11:22 . 2014-05-02 12:39 778440 ----a-w- c:\winnt\system32\FlashPlayerApp.exe
2015-08-12 11:22 . 2014-05-02 12:39 142536 ----a-w- c:\winnt\system32\FlashPlayerCPLApp.cpl
2015-08-12 11:22 . 2015-08-12 10:22 9284296 ----a-w- c:\winnt\system32\FlashPlayerInstaller.exe
2015-08-11 13:33 . 2015-08-11 13:34 161472 ----a-w- c:\winnt\system32\drivers\aswStmXP.sys
2015-08-11 13:33 . 2014-04-29 18:14 57888 ----a-w- c:\winnt\system32\drivers\aswTdi.sys
2015-08-11 13:33 . 2014-04-29 18:14 76000 ----a-w- c:\winnt\system32\drivers\aswMonFlt.sys
2015-08-11 13:33 . 2014-04-29 18:14 55200 ----a-w- c:\winnt\system32\drivers\aswRdr.sys
2015-08-11 13:33 . 2014-04-29 18:14 49776 ----a-w- c:\winnt\system32\drivers\aswRvrt.sys
2015-08-11 13:33 . 2014-04-29 18:14 433264 ----a-w- c:\winnt\system32\drivers\aswSP.sys
2015-08-11 13:33 . 2014-04-29 18:14 24016 ----a-w- c:\winnt\system32\drivers\aswHwid.sys
2015-08-11 13:33 . 2014-04-29 18:14 208664 ----a-w- c:\winnt\system32\drivers\aswVmm.sys
2015-08-11 13:33 . 2015-08-11 13:33 313472 ----a-w- c:\winnt\system32\aswBoot.exe
2015-08-11 13:33 . 2015-08-11 13:33 43112 ----a-w- c:\winnt\avastSS.scr
2015-08-11 13:33 . 2014-04-29 18:14 788784 ----a-w- c:\winnt\system32\drivers\aswSnx.sys
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2015-08-11 13:33 695096 ----a-w- c:\program files\AVAST Software\Avast\ashShell.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Kalendar"="c:\program files\Kalendar\kalendar.exe" [2005-11-09 580608]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2008-04-04 1044480]
"IgfxTray"="c:\winnt\system32\igfxtray.exe" [2008-06-05 150040]
"HotKeysCmds"="c:\winnt\system32\hkcmd.exe" [2008-06-05 170520]
"Persistence"="c:\winnt\system32\igfxpers.exe" [2008-06-05 141848]
"QlbCtrl.exe"="c:\program files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2008-03-31 177456]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2010-06-04 1791272]
"hpWirelessAssistant"="c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2008-04-15 488752]
"AvastUI.exe"="c:\program files\AVAST Software\Avast\AvastUI.exe" [2015-08-28 6111824]
"ZoneAlarm"="c:\program files\CheckPoint\ZoneAlarm\zatray.exe" [2014-04-24 137352]
"accrdsub"="c:\program files\ActivIdentity\ActivClient\accrdsub.exe" [2007-05-15 293168]
"PTHOSTTR"="c:\program files\Hewlett-Packard\HP ProtectTools Security Manager\PTHOSTTR.EXE" [2008-05-07 238984]
"CognizanceTS"="c:\progra~1\HEWLET~1\IAM\Bin\ASTSVCC.dll" [2008-05-20 24848]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-11-21 959904]
"APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2013-09-13 59720]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2014-10-02 421888]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\winnt\system32\CTFMON.EXE" [2008-04-14 15360]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"nltide_3"="advpack.dll" [2009-03-08 128512]
.
c:\documents and settings\All Users\Nabídka Start\Programy\Po spuštění\
Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2008-3-31 576104]
Windows Search.lnk - c:\program files\Windows Desktop Search\WindowsSearch.exe /startup [2008-5-26 123904]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"SoftwareSASGeneration"= 1 (0x1)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"ToggleCommentPosition"= 1 (0x1)
"NoResolveTrack"= 0 (0x0)
"NoFileAssociate"= 0 (0x0)
.
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoSMConfigurePrograms"= 1 (0x1)
.
[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoSMConfigurePrograms"= 1 (0x1)
"ForceClassicControlPanel"= 1 (0x1)
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-24 304128]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ackpbsc]
2007-05-15 14:08 112640 ----a-w- c:\winnt\system32\ackpbsc.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\acunlock]
2007-05-15 14:08 281088 ----a-w- c:\program files\ActivIdentity\ActivClient\acunlock.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\OneCard]
2008-05-20 22:42 111888 ----a-w- c:\program files\Hewlett-Packard\IAM\Bin\ASWLNPkg.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\winnt\system32\APSHook.dll
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfSvc]
@="Service"
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"DisableUnicastResponsesToMulticastBroadcast"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\CheckPoint\\ZoneAlarm\\vsmon.exe"=
"c:\\Program Files\\Ubisoft\\THE SETTLERS - Vzestup říše\\base\\bin\\Settlers6.exe"=
"c:\\Program Files\\Common Files\\Apple\\Apple Application Support\\WebKit2WebProcess.exe"=
"c:\\Program Files\\Vivaldi\\Application\\vivaldi.exe"=
"c:\\Program Files\\TeamViewer\\TeamViewer.exe"=
"c:\\Program Files\\TeamViewer\\TeamViewer_Service.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\EA GAMES\\Battlefield 2 Demo\\BF2.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"5985:TCP"= 5985:TCP:*:Disabled:Vzdálená správa systému Windows
.
R0 aswRvrt;avast! Revert;c:\winnt\system32\drivers\aswRvrt.sys [29.4.2014 20:14 49776]
R0 aswVmm;avast! VM Monitor;c:\winnt\system32\drivers\aswVmm.sys [29.4.2014 20:14 208664]
R0 SafeBoot;SafeBoot;c:\winnt\system32\drivers\SafeBoot.sys [13.5.2008 17:36 108752]
R0 SbAlg;SbAlg;c:\winnt\system32\drivers\SbAlg.sys [13.5.2008 17:36 51376]
R0 SbFsLock;SbFsLock;c:\winnt\system32\drivers\SbFsLock.sys [13.5.2008 17:36 12928]
R0 SFAUDIO;Sonic Focus DSP Driver;c:\winnt\system32\drivers\sfaudio.sys [28.3.2008 10:14 24064]
R0 SmartDefragDriver;SmartDefragDriver;c:\winnt\system32\drivers\SmartDefragDriver.sys [26.5.2015 13:52 15808]
R1 aswSnx;aswSnx;c:\winnt\system32\drivers\aswSnx.sys [29.4.2014 20:14 788784]
R1 aswSP;aswSP;c:\winnt\system32\drivers\aswSP.sys [29.4.2014 20:14 433264]
R1 Ext2Fsd;Linux ext2 file system driver;c:\winnt\system32\drivers\ext2fsd.sys [16.6.2014 22:04 686360]
R1 HWiNFO32;HWiNFO32/64 Kernel Driver;c:\winnt\system32\drivers\HWiNFO32.SYS [14.1.2015 21:43 23840]
R1 RsvLock;RsvLock;c:\winnt\system32\drivers\rsvlock.sys [13.5.2008 17:36 12496]
R2 accoca;ActivClient Middleware Service;c:\program files\ActivIdentity\ActivClient\accoca.exe [15.5.2007 16:08 182576]
R2 ameisvc;Web'n'walk Manager mobile equipment installation service;c:\program files\T-Mobile\Web'n'walk Manager\ameisvc.exe [24.6.2011 21:17 123120]
R2 ASBroker;Logon Session Broker;c:\winnt\System32\svchost.exe -k Cognizance [17.8.2004 15:49 14336]
R2 ASChannel;Local Communication Channel;c:\winnt\System32\svchost.exe -k Cognizance [17.8.2004 15:49 14336]
R2 aswHwid;avast! HardwareID;c:\winnt\system32\drivers\aswHwid.sys [29.4.2014 20:14 24016]
R2 aswMonFlt;aswMonFlt;c:\winnt\system32\drivers\aswMonFlt.sys [29.4.2014 20:14 76000]
R2 ATService;AuthenTec Fingerprint Service;c:\program files\Fingerprint Sensor\AtService.exe [9.5.2008 16:09 1168632]
R2 DfSdkS;Defragmentation-Service;c:\program files\Ashampoo\Ashampoo WinOptimizer 2013\DfSdkS.exe [2.5.2014 15:13 406016]
R2 DragonUpdater;COMODO Dragon Update Service;c:\program files\Comodo\Dragon\dragon_updater.exe [26.6.2015 10:15 1994936]
R2 HP ProtectTools Service;HP ProtectTools Service;c:\program files\Hewlett-Packard\HP ProtectTools Security Manager\PTChangeFilterService.exe [14.5.2008 13:41 34184]
R2 HpFkCryptService;Drive Encryption Service;c:\program files\Hewlett-Packard\Drive Encryption\HpFkCrypt.exe [13.5.2008 17:35 256512]
R2 ZAPrivacyService;ZoneAlarm Privacy Service;c:\program files\CheckPoint\ZoneAlarm\ZAPrivacyService.exe [9.4.2014 17:26 92176]
R3 aswStmXP;Avast StreamFilter Driver;c:\winnt\system32\drivers\aswStmXP.sys [11.8.2015 15:34 161472]
R3 ATSwpWDF;AuthenTec TruePrint USB Driver;c:\winnt\system32\drivers\ATSwpWDF.sys [13.5.2008 8:30 677960]
R3 Com4QLBEx;Com4QLBEx;c:\program files\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe [16.9.2008 12:46 193840]
R3 huawei_enumerator;huawei_enumerator;c:\winnt\system32\drivers\ew_jubusenum.sys [4.6.2014 16:57 76544]
R3 IFXTPM;IFXTPM;c:\winnt\system32\drivers\ifxtpm.sys [4.4.2007 19:16 41216]
R3 NETwNx32;___ Ovladač adaptéru řady Intel(R) Wireless WiFi Link 5000 pro systém Windows XP 32 Bit;c:\winnt\system32\drivers\NETwNx32.sys [19.5.2014 13:00 7477760]
S2 LiveUpdateSvc;LiveUpdate;c:\program files\IObit\LiveUpdate\LiveUpdate.exe [9.9.2014 18:20 2909472]
S3 cpuz137;cpuz137;\??\c:\temp\cpuz137\cpuz137_x32.sys --> c:\temp\cpuz137\cpuz137_x32.sys [?]
S3 cpuz138;cpuz138;\??\c:\temp\cpuz138\cpuz138_x32.sys --> c:\temp\cpuz138\cpuz138_x32.sys [?]
S3 ew_hwusbdev;Huawei MobileBroadband USB PNP Device;c:\winnt\system32\drivers\ew_hwusbdev.sys [4.6.2014 16:57 102784]
S3 ew_usbenumfilter;huawei_CompositeFilter;c:\winnt\system32\drivers\ew_usbenumfilter.sys [4.6.2014 16:57 11136]
S3 FANTOM;LEGO MINDSTORMS NXT Driver;c:\winnt\system32\drivers\fantom.sys [29.7.2008 15:09 39424]
S3 huawei_cdcacm;huawei_cdcacm;c:\winnt\system32\drivers\ew_jucdcacm.sys [4.6.2014 16:57 95616]
S3 huawei_cdcecm;huawei_cdcecm;c:\winnt\system32\drivers\ew_jucdcecm.sys [4.6.2014 16:57 70016]
S3 huawei_ext_ctrl;huawei_ext_ctrl;c:\winnt\system32\drivers\ew_juextctrl.sys [4.6.2014 16:57 27520]
S3 SCR3XX2K;SCR3xx USB SmartCardReader;c:\winnt\system32\drivers\SCR3XX2K.sys [21.6.2007 4:40 56448]
S3 WDC_SAM;WD SCSI Pass Thru driver;c:\winnt\system32\drivers\wdcsam.sys [19.6.2014 17:09 11520]
S3 WinRing0_1_2_0;WinRing0_1_2_0;c:\program files\IObit\Game Booster 3\Driver\WinRing0.sys [9.9.2014 18:34 14416]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
Cognizance REG_MULTI_SZ ASBroker ASChannel
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
2008-03-17 15:56 451872 ----a-w- c:\program files\Common Files\LightScribe\LSRunOnce.exe
.
Obsah adresáře 'Naplánované úlohy'
.
2015-09-16 c:\winnt\Tasks\Adobe Flash Player Updater.job
- c:\winnt\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2014-05-02 11:22]
.
2015-09-01 c:\winnt\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2011-06-01 15:57]
.
2015-09-16 c:\winnt\Tasks\avast! Emergency Update.job
- c:\program files\AVAST Software\Avast\AvastEmUpdate.exe [2015-08-11 13:33]
.
2015-09-16 c:\winnt\Tasks\Game_Booster_AutoUpdate.job
- c:\program files\IObit\Game Booster 3\AutoUpdate.exe [2014-09-09 16:34]
.
2015-09-08 c:\winnt\Tasks\Měsíční oznamování konce poskytování služeb pro Microsoft Windows XP.job
- c:\winnt\system32\xp_eos.exe [2014-04-29 23:28]
.
2015-09-16 c:\winnt\Tasks\Přihlášení k oznamování konce poskytování služeb pro Microsoft Windows XP.job
- c:\winnt\system32\xp_eos.exe [2014-04-29 23:28]
.
2015-09-16 c:\winnt\Tasks\User_Feed_Synchronization-{7E97BC63-92FC-4FFC-AB26-4A3122E43961}.job
- c:\winnt\system32\msfeedssync.exe [2009-03-08 02:31]
.
.
------- Doplňkový sken -------
.
IE: E&xportovat do aplikace Microsoft Office Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Send to &Bluetooth Device... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: Send To Bluetooth - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
TCP: DhcpNameServer = 10.0.0.138
TCP: Interfaces\{90B06D68-9F5C-4664-8114-2EC7C0907069}: NameServer = 8.26.56.26,156.154.70.22
TCP: Interfaces\{B91DF5FD-6FB7-452C-90CF-A48317B7E090}: NameServer = 8.26.56.26,156.154.70.22
FF - ProfilePath - c:\documents and settings\Administrator\Data aplikací\Mozilla\Firefox\Profiles\5pg9b3uy.default\
FF - prefs.js: browser.startup.homepage - hxxps://www.seznam.cz/?logged=1#obsah
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
.
SafeBoot-WudfPf
SafeBoot-WudfRd
AddRemove-Driver Booster_is1 - c:\program files\IObit\Driver Booster\unins000.exe
AddRemove-Moorhuhn 2 V1.1 - c:\winnt\IsUn0407.exe
AddRemove-Slot_Machine_98_v5.2 - c:\winnt\iun6002.exe
AddRemove-zonealarm - c:\documents and settings\Administrator\Data aplikací\Check Point Software Technologies LTD\zonealarm\1.8.29.17\uninstall.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2015-09-16 16:41
Windows 5.1.2600 Service Pack 3 NTFS
.
skenování skrytých procesů ...
.
skenování skrytých položek 'Po spuštění' ...
.
skenování skrytých souborů ...
.
sken byl úspešně dokončen
skryté soubory: 0
.
**************************************************************************
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_USERS\S-1-5-21-4220318380-3817037010-209092702-500\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (Administrator)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,87,27,c8,7e,a0,64,f2,4e,ac,37,b6,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,87,27,c8,7e,a0,64,f2,4e,ac,37,b6,\
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINNT\\system32\\Macromed\\Flash\\FlashUtil32_18_0_0_232_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\LocalServer32]
@="c:\\WINNT\\system32\\Macromed\\Flash\\FlashUtil32_18_0_0_232_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}]
@Denied: (A 2) (Everyone)
@="IFlashBroker6"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
--------------------- Knihovny navázané na běžící procesy ---------------------
.
- - - - - - - > 'winlogon.exe'(1068)
c:\winnt\system32\ackpbsc.dll
c:\winnt\system32\aclog.dll
c:\winnt\system32\ACLIBEAY.dll
c:\winnt\system32\acevtsub.dll
c:\winnt\system32\asphat32.dll
c:\winnt\system32\acerrmes.dll
c:\winnt\system32\aspcom.dll
c:\program files\ActivIdentity\ActivClient\Resources\Merged\acerrmrc.dll
c:\program files\ActivIdentity\ActivClient\Resources\Merged\asphatrc.dll
c:\program files\Hewlett-Packard\IAM\Bin\ASWLNPkg.dll
c:\program files\Hewlett-Packard\IAM\bin\ItMsg.dll
c:\program files\ActivIdentity\ActivClient\acunlock.dll
c:\winnt\system32\aipingui.dll
c:\program files\ActivIdentity\ActivClient\Resources\Merged\aipinguirc.dll
c:\program files\ActivIdentity\ActivClient\resources\acCobAPIrc.dll
c:\program files\ActivIdentity\ActivClient\Resources\Merged\acunlockrc.dll
c:\program files\Hewlett-Packard\IAM\Bin\TrayIcon.dll
c:\program files\Hewlett-Packard\IAM\bin\brand.dll
c:\program files\Hewlett-Packard\IAM\Bin\AsChnl.dll
c:\program files\Hewlett-Packard\IAM\Bin\HPPlugIn.dll
c:\program files\Hewlett-Packard\HP ProtectTools Security Manager\PTHostServices.dll
c:\winnt\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_cs_b77a5c561934e089\mscorlib.resources.dll
c:\winnt\assembly\GAC_MSIL\System.Configuration.resources\2.0.0.0_cs_b03f5f7f11d50a3a\System.Configuration.resources.dll
.
- - - - - - - > 'explorer.exe'(2148)
c:\winnt\system32\btmmhook.dll
c:\program files\Windows Desktop Search\deskbar.dll
c:\program files\Windows Desktop Search\cs-cz\dbres.dll.mui
c:\program files\Windows Desktop Search\dbres.dll
c:\program files\Windows Desktop Search\wordwheel.dll
c:\program files\Windows Desktop Search\cs-cz\msnlExtRes.dll.mui
c:\program files\Windows Desktop Search\msnlExtRes.dll
c:\progra~1\WINDOW~2\wmpband.dll
c:\winnt\system32\webcheck.dll
c:\winnt\system32\WPDShServiceObj.dll
c:\winnt\system32\btncopy.dll
c:\winnt\system32\PortableDeviceTypes.dll
c:\winnt\system32\PortableDeviceApi.dll
.
Celkový čas: 2015-09-16 16:45:24
ComboFix-quarantined-files.txt 2015-09-16 14:45
.
Před spuštěním: Volných bajtů: 44 236 115 968
Po spuštění: Volných bajtů: 44 173 688 832
.
- - End Of File - - 89479A104E44503F39D960E85BD79991
2B7091CA91E2218C922AD5EFD64677B6
Nahoru
Uživatelský avatar
jerabina
člen Security týmu
Level 6
Level 6
Příspěvky: 3647
Registrován: březen 13
Bydliště: Litoměřice
Pohlaví: Muž
Stav:
Offline

Re: Prosím o preventivní kontrolu logu (pomalý ntb, občas zamrzání)

Příspěvekod jerabina » 16 zář 2015 21:21

Odinstaluj vše od IObitu!

Vypni rez. ochranu u antiviru a antispywaru,příp. firewall..

Otevři si Poznámkový blok (Start -> Spustit... a napiš do okna Notepad a dej Ok.
Zkopíruj do něj následující celý text označený zeleně:

Kód: Vybrat vše

ClearJavaCache::
KillAll::

Folder::
c:\documents and settings\All Users\Data aplikací\RogueKiller
c:\program files\IObit

File::
c:\winnt\Tasks\Adobe Flash Player Updater.job
c:\winnt\Tasks\AppleSoftwareUpdate.job
c:\winnt\Tasks\Game_Booster_AutoUpdate.job
c:\winnt\Tasks\User_Feed_Synchronization-{7E97BC63-92FC-4FFC-AB26-4A3122E43961}.job

Registry::
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Adobe ARM"=-

Driver::
LiveUpdateSvc

RegLock::
[HKEY_USERS\S-1-5-21-4220318380-3817037010-209092702-500\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (Administrator)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
 d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,87,27,c8,7e,a0,64,f2,4e,ac,37,b6,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
 d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,87,27,c8,7e,a0,64,f2,4e,ac,37,b6,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINNT\\system32\\Macromed\\Flash\\FlashUtil32_18_0_0_232_ActiveX.exe,-101"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\Elevation]
"Enabled"=dword:00000001

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\LocalServer32]
@="c:\\WINNT\\system32\\Macromed\\Flash\\FlashUtil32_18_0_0_232_ActiveX.exe"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}]
@Denied: (A 2) (Everyone)
@="IFlashBroker6"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"


Zvol možnost Soubor -> Uložit jako... a nastav tyto parametry:
Název souboru: zde napiš: CFScript.txt
Uložit jako typ: tak tam vyber Všechny soubory
Ulož soubor na plochu.
Ukonči všechna aktivní okna.

Uchop myší vytvořený skript CFScript.txt, přemísti ho nad stažený program ComboFix.exe a když se oba soubory překryjí, skript upusť:
Obrázek
- Automaticky se spustí ComboFix
- Vlož sem log, který vyběhne v závěru čistícího procesu
Když nevíš jak dál, přichází na řadu prostudovat manuál!
HJT návod

Pokud neodpovídám do vašich témat v sekci HJT když jsem online, tak je to jen proto, že jsem na mobilu kde je studování logů a psaní skriptů nemožné. Neberte to tedy prosím jako ignoraci.
Nahoru
Uživatelský avatar
simio.simsoft
Level 2
Level 2
Příspěvky: 224
Registrován: duben 13
Bydliště: Blovice, Plzeňský kraj, CZ, EU, Europa, Earth, Solar System, Milky Way, Space
Pohlaví: Muž
Stav:
Offline

Re: Prosím o preventivní kontrolu logu (pomalý ntb, občas zamrzání)

Příspěvekod simio.simsoft » 17 zář 2015 17:18

ComboFix 15-09-07.01 - Administrator 17.09.2015 16:12:55.3.2 - x86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.420.1029.18.1976.1226 [GMT 2:00]
Spuštěný z: c:\documents and settings\Administrator\Plocha\ComboFix.exe
Použité ovládací přepínače :: c:\documents and settings\Administrator\Plocha\CFScript.txt
AV: avast! Antivirus *Disabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D}
FW: ZoneAlarm Free Firewall Firewall *Disabled* {829BDA32-94B3-44F4-8446-F8FCFF809F8B}
.
FILE ::
"c:\winnt\Tasks\Adobe Flash Player Updater.job"
"c:\winnt\Tasks\AppleSoftwareUpdate.job"
"c:\winnt\Tasks\Game_Booster_AutoUpdate.job"
"c:\winnt\Tasks\User_Feed_Synchronization-{7E97BC63-92FC-4FFC-AB26-4A3122E43961}.job"
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\program files\IObit
c:\program files\IObit\Advanced SystemCare 7\ASCComputerMenu.tmp
c:\program files\IObit\Game Booster 3\GBV3ContextMenu.dll
c:\program files\IObit\IObit Uninstaller\BigUpgrade-iu.exe
c:\program files\IObit\IObit Uninstaller\Downloader.exe
c:\program files\IObit\IObit Uninstaller\UninstallMenuRight32_1.dll
c:\program files\IObit\IObit Uninstaller\UninstallRotetemp.dbd
c:\program files\IObit\LiveUpdate\Language\Arabic.lng
c:\program files\IObit\LiveUpdate\Language\Belarusian.lng
c:\program files\IObit\LiveUpdate\Language\Croatian.lng
c:\program files\IObit\LiveUpdate\Language\Czech.lng
c:\program files\IObit\LiveUpdate\Language\Danish.lng
c:\program files\IObit\LiveUpdate\Language\Dinka.lng
c:\program files\IObit\LiveUpdate\Language\Dutch.lng
c:\program files\IObit\LiveUpdate\Language\English.lng
c:\program files\IObit\LiveUpdate\Language\Finnish.lng
c:\program files\IObit\LiveUpdate\Language\Flemish.lng
c:\program files\IObit\LiveUpdate\Language\French.lng
c:\program files\IObit\LiveUpdate\Language\Georgian.lng
c:\program files\IObit\LiveUpdate\Language\German.lng
c:\program files\IObit\LiveUpdate\Language\Greek.lng
c:\program files\IObit\LiveUpdate\Language\Hebrew.lng
c:\program files\IObit\LiveUpdate\Language\Hungarian.lng
c:\program files\IObit\LiveUpdate\Language\ChineseSimp.lng
c:\program files\IObit\LiveUpdate\Language\ChineseTrad.lng
c:\program files\IObit\LiveUpdate\Language\Indonesia.lng
c:\program files\IObit\LiveUpdate\Language\Italian.lng
c:\program files\IObit\LiveUpdate\Language\Japanese.lng
c:\program files\IObit\LiveUpdate\Language\Korean.lng
c:\program files\IObit\LiveUpdate\Language\Latvian.lng
c:\program files\IObit\LiveUpdate\Language\Malayalam.lng
c:\program files\IObit\LiveUpdate\Language\Mongolian.lng
c:\program files\IObit\LiveUpdate\Language\Norwegian.lng
c:\program files\IObit\LiveUpdate\Language\Polish.lng
c:\program files\IObit\LiveUpdate\Language\Portuguese(PT-BR).lng
c:\program files\IObit\LiveUpdate\Language\Portuguese(PT-PT).lng
c:\program files\IObit\LiveUpdate\Language\Romanian.lng
c:\program files\IObit\LiveUpdate\Language\Russian.lng
c:\program files\IObit\LiveUpdate\Language\Serbian (cyrillic).lng
c:\program files\IObit\LiveUpdate\Language\Serbian (latin).lng
c:\program files\IObit\LiveUpdate\Language\Slovak.lng
c:\program files\IObit\LiveUpdate\Language\Slovenian.lng
c:\program files\IObit\LiveUpdate\Language\Spanish.lng
c:\program files\IObit\LiveUpdate\Language\Swedish.lng
c:\program files\IObit\LiveUpdate\Language\Turkish.lng
c:\program files\IObit\LiveUpdate\Language\Ukrainian.lng
c:\program files\IObit\LiveUpdate\Language\Vietnamese.lng
c:\program files\IObit\LiveUpdate\LiveUpdate.exe
c:\program files\IObit\LiveUpdate\LiveUpdate.log
c:\program files\IObit\LiveUpdate\LiveUpdateSrvUpt.log
c:\program files\IObit\LiveUpdate\ProductStatistics.dll
c:\program files\IObit\LiveUpdate\ProductStatistics.log
c:\program files\IObit\LiveUpdate\ProductUpt.log
c:\program files\IObit\LiveUpdate\system.ini
c:\program files\IObit\LiveUpdate\update\GameAssistant\game-assistant3.exe.dat
c:\program files\IObit\LiveUpdate\update\LiveUpdate.exe
c:\program files\IObit\LiveUpdate\update\LiveUpdate.exe.dat
c:\program files\IObit\LiveUpdate\update\LiveUpdate.log
c:\program files\IObit\LiveUpdate\update\update.spt
c:\winnt\Tasks\Adobe Flash Player Updater.job
c:\winnt\Tasks\AppleSoftwareUpdate.job
c:\winnt\Tasks\Game_Booster_AutoUpdate.job
c:\winnt\Tasks\User_Feed_Synchronization-{7E97BC63-92FC-4FFC-AB26-4A3122E43961}.job
.
.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Legacy_LIVEUPDATESVC
-------\Service_LiveUpdateSvc
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2015-08-17 do 2015-09-17 )))))))))))))))))))))))))))))))
.
.
2015-09-16 17:47 . 2015-09-16 17:48 -------- d-----w- c:\documents and settings\All Users\Data aplikací\ProductData
2015-09-14 14:59 . 2015-09-14 14:51 24064 ----a-w- c:\winnt\zoek-delete.exe
2015-09-14 14:59 . 2015-09-17 14:26 -------- d-----w- C:\Temp
2015-09-14 14:51 . 2015-09-14 14:58 -------- d-----w- C:\zoek_backup
2015-09-14 14:23 . 2015-09-14 14:23 -------- d-----w- c:\documents and settings\Administrator\Data aplikací\ProductData
2015-09-13 12:52 . 2015-09-14 14:35 35064 ----a-w- c:\winnt\system32\drivers\TrueSight.sys
2015-09-13 12:52 . 2015-09-13 13:09 -------- d-----w- c:\documents and settings\All Users\Data aplikací\RogueKiller
2015-09-13 07:56 . 2015-09-13 07:56 -------- d-----w- c:\documents and settings\All Users\Data aplikací\Malwarebytes
2015-09-13 07:56 . 2015-06-18 06:41 121560 ----a-w- c:\winnt\system32\drivers\mbamchameleon.sys
2015-09-13 07:56 . 2015-06-18 06:41 23256 ----a-w- c:\winnt\system32\drivers\mbam.sys
2015-09-13 07:51 . 2015-09-13 12:37 -------- d-----w- C:\AdwCleaner
2015-08-29 13:50 . 2004-10-22 00:17 274432 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\10\50\Intel32\iscript.dll
2015-08-29 13:50 . 2004-10-22 00:16 180224 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\10\50\Intel32\iuser.dll
2015-08-29 13:50 . 2004-10-22 00:18 749568 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\10\50\Intel32\iKernel.dll
2015-08-29 13:50 . 2004-10-22 00:17 69715 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\10\50\Intel32\ctor.dll
2015-08-29 13:50 . 2004-10-22 00:16 5632 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\10\50\Intel32\DotNetInstaller.exe
2015-08-29 13:50 . 2015-08-29 13:50 192644 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\10\50\Intel32\iGdi.dll
2015-08-29 13:50 . 2015-08-29 13:50 323716 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\10\50\Intel32\setup.dll
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2015-08-12 11:22 . 2014-05-02 12:39 778440 ----a-w- c:\winnt\system32\FlashPlayerApp.exe
2015-08-12 11:22 . 2014-05-02 12:39 142536 ----a-w- c:\winnt\system32\FlashPlayerCPLApp.cpl
2015-08-12 11:22 . 2015-08-12 10:22 9284296 ----a-w- c:\winnt\system32\FlashPlayerInstaller.exe
2015-08-11 13:33 . 2015-08-11 13:34 161472 ----a-w- c:\winnt\system32\drivers\aswStmXP.sys
2015-08-11 13:33 . 2014-04-29 18:14 57888 ----a-w- c:\winnt\system32\drivers\aswTdi.sys
2015-08-11 13:33 . 2014-04-29 18:14 76000 ----a-w- c:\winnt\system32\drivers\aswMonFlt.sys
2015-08-11 13:33 . 2014-04-29 18:14 55200 ----a-w- c:\winnt\system32\drivers\aswRdr.sys
2015-08-11 13:33 . 2014-04-29 18:14 49776 ----a-w- c:\winnt\system32\drivers\aswRvrt.sys
2015-08-11 13:33 . 2014-04-29 18:14 433264 ----a-w- c:\winnt\system32\drivers\aswSP.sys
2015-08-11 13:33 . 2014-04-29 18:14 24016 ----a-w- c:\winnt\system32\drivers\aswHwid.sys
2015-08-11 13:33 . 2014-04-29 18:14 208664 ----a-w- c:\winnt\system32\drivers\aswVmm.sys
2015-08-11 13:33 . 2015-08-11 13:33 313472 ----a-w- c:\winnt\system32\aswBoot.exe
2015-08-11 13:33 . 2015-08-11 13:33 43112 ----a-w- c:\winnt\avastSS.scr
2015-08-11 13:33 . 2014-04-29 18:14 788784 ----a-w- c:\winnt\system32\drivers\aswSnx.sys
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2015-08-11 13:33 695096 ----a-w- c:\program files\AVAST Software\Avast\ashShell.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Kalendar"="c:\program files\Kalendar\kalendar.exe" [2005-11-09 580608]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2008-04-04 1044480]
"IgfxTray"="c:\winnt\system32\igfxtray.exe" [2008-06-05 150040]
"HotKeysCmds"="c:\winnt\system32\hkcmd.exe" [2008-06-05 170520]
"Persistence"="c:\winnt\system32\igfxpers.exe" [2008-06-05 141848]
"QlbCtrl.exe"="c:\program files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2008-03-31 177456]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2010-06-04 1791272]
"hpWirelessAssistant"="c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2008-04-15 488752]
"AvastUI.exe"="c:\program files\AVAST Software\Avast\AvastUI.exe" [2015-08-28 6111824]
"ZoneAlarm"="c:\program files\CheckPoint\ZoneAlarm\zatray.exe" [2014-04-24 137352]
"accrdsub"="c:\program files\ActivIdentity\ActivClient\accrdsub.exe" [2007-05-15 293168]
"PTHOSTTR"="c:\program files\Hewlett-Packard\HP ProtectTools Security Manager\PTHOSTTR.EXE" [2008-05-07 238984]
"CognizanceTS"="c:\progra~1\HEWLET~1\IAM\Bin\ASTSVCC.dll" [2008-05-20 24848]
"APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2013-09-13 59720]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2014-10-02 421888]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\winnt\system32\CTFMON.EXE" [2008-04-14 15360]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"nltide_3"="advpack.dll" [2009-03-08 128512]
.
c:\documents and settings\All Users\Nabídka Start\Programy\Po spuštění\
Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2008-3-31 576104]
Windows Search.lnk - c:\program files\Windows Desktop Search\WindowsSearch.exe /startup [2008-5-26 123904]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"SoftwareSASGeneration"= 1 (0x1)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"ToggleCommentPosition"= 1 (0x1)
"NoResolveTrack"= 0 (0x0)
"NoFileAssociate"= 0 (0x0)
.
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoSMConfigurePrograms"= 1 (0x1)
.
[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoSMConfigurePrograms"= 1 (0x1)
"ForceClassicControlPanel"= 1 (0x1)
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-24 304128]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ackpbsc]
2007-05-15 14:08 112640 ----a-w- c:\winnt\system32\ackpbsc.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\acunlock]
2007-05-15 14:08 281088 ----a-w- c:\program files\ActivIdentity\ActivClient\acunlock.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\OneCard]
2008-05-20 22:42 111888 ----a-w- c:\program files\Hewlett-Packard\IAM\Bin\ASWLNPkg.dll
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfSvc]
@="Service"
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
"DisableUnicastResponsesToMulticastBroadcast"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\CheckPoint\\ZoneAlarm\\vsmon.exe"=
"c:\\Program Files\\Ubisoft\\THE SETTLERS - Vzestup říše\\base\\bin\\Settlers6.exe"=
"c:\\Program Files\\Common Files\\Apple\\Apple Application Support\\WebKit2WebProcess.exe"=
"c:\\Program Files\\Vivaldi\\Application\\vivaldi.exe"=
"c:\\Program Files\\TeamViewer\\TeamViewer.exe"=
"c:\\Program Files\\TeamViewer\\TeamViewer_Service.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\EA GAMES\\Battlefield 2 Demo\\BF2.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"5985:TCP"= 5985:TCP:*:Disabled:Vzdálená správa systému Windows
.
R0 aswRvrt;avast! Revert;c:\winnt\system32\drivers\aswRvrt.sys [29.4.2014 20:14 49776]
R0 aswVmm;avast! VM Monitor;c:\winnt\system32\drivers\aswVmm.sys [29.4.2014 20:14 208664]
R0 SafeBoot;SafeBoot;c:\winnt\system32\drivers\SafeBoot.sys [13.5.2008 17:36 108752]
R0 SbAlg;SbAlg;c:\winnt\system32\drivers\SbAlg.sys [13.5.2008 17:36 51376]
R0 SbFsLock;SbFsLock;c:\winnt\system32\drivers\SbFsLock.sys [13.5.2008 17:36 12928]
R0 SFAUDIO;Sonic Focus DSP Driver;c:\winnt\system32\drivers\sfaudio.sys [28.3.2008 10:14 24064]
R0 SmartDefragDriver;SmartDefragDriver;c:\winnt\system32\drivers\SmartDefragDriver.sys [26.5.2015 13:52 15808]
R1 aswSnx;aswSnx;c:\winnt\system32\drivers\aswSnx.sys [29.4.2014 20:14 788784]
R1 aswSP;aswSP;c:\winnt\system32\drivers\aswSP.sys [29.4.2014 20:14 433264]
R1 Ext2Fsd;Linux ext2 file system driver;c:\winnt\system32\drivers\ext2fsd.sys [16.6.2014 22:04 686360]
R1 HWiNFO32;HWiNFO32/64 Kernel Driver;c:\winnt\system32\drivers\HWiNFO32.SYS [14.1.2015 21:43 23840]
R1 RsvLock;RsvLock;c:\winnt\system32\drivers\rsvlock.sys [13.5.2008 17:36 12496]
R2 accoca;ActivClient Middleware Service;c:\program files\ActivIdentity\ActivClient\accoca.exe [15.5.2007 16:08 182576]
R2 ameisvc;Web'n'walk Manager mobile equipment installation service;c:\program files\T-Mobile\Web'n'walk Manager\ameisvc.exe [24.6.2011 21:17 123120]
R2 ASBroker;Logon Session Broker;c:\winnt\System32\svchost.exe -k Cognizance [17.8.2004 15:49 14336]
R2 ASChannel;Local Communication Channel;c:\winnt\System32\svchost.exe -k Cognizance [17.8.2004 15:49 14336]
R2 aswHwid;avast! HardwareID;c:\winnt\system32\drivers\aswHwid.sys [29.4.2014 20:14 24016]
R2 aswMonFlt;aswMonFlt;c:\winnt\system32\drivers\aswMonFlt.sys [29.4.2014 20:14 76000]
R2 ATService;AuthenTec Fingerprint Service;c:\program files\Fingerprint Sensor\AtService.exe [9.5.2008 16:09 1168632]
R2 DfSdkS;Defragmentation-Service;c:\program files\Ashampoo\Ashampoo WinOptimizer 2013\DfSdkS.exe [2.5.2014 15:13 406016]
R2 DragonUpdater;COMODO Dragon Update Service;c:\program files\Comodo\Dragon\dragon_updater.exe [26.6.2015 10:15 1994936]
R2 HP ProtectTools Service;HP ProtectTools Service;c:\program files\Hewlett-Packard\HP ProtectTools Security Manager\PTChangeFilterService.exe [14.5.2008 13:41 34184]
R2 HpFkCryptService;Drive Encryption Service;c:\program files\Hewlett-Packard\Drive Encryption\HpFkCrypt.exe [13.5.2008 17:35 256512]
R2 ZAPrivacyService;ZoneAlarm Privacy Service;c:\program files\CheckPoint\ZoneAlarm\ZAPrivacyService.exe [9.4.2014 17:26 92176]
R3 ATSwpWDF;AuthenTec TruePrint USB Driver;c:\winnt\system32\drivers\ATSwpWDF.sys [13.5.2008 8:30 677960]
R3 Com4QLBEx;Com4QLBEx;c:\program files\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe [16.9.2008 12:46 193840]
R3 huawei_enumerator;huawei_enumerator;c:\winnt\system32\drivers\ew_jubusenum.sys [4.6.2014 16:57 76544]
R3 IFXTPM;IFXTPM;c:\winnt\system32\drivers\ifxtpm.sys [4.4.2007 19:16 41216]
R3 NETwNx32;___ Ovladač adaptéru řady Intel(R) Wireless WiFi Link 5000 pro systém Windows XP 32 Bit;c:\winnt\system32\drivers\NETwNx32.sys [19.5.2014 13:00 7477760]
S3 aswStmXP;Avast StreamFilter Driver;c:\winnt\system32\drivers\aswStmXP.sys [11.8.2015 15:34 161472]
S3 cpuz137;cpuz137;\??\c:\temp\cpuz137\cpuz137_x32.sys --> c:\temp\cpuz137\cpuz137_x32.sys [?]
S3 cpuz138;cpuz138;\??\c:\temp\cpuz138\cpuz138_x32.sys --> c:\temp\cpuz138\cpuz138_x32.sys [?]
S3 ew_hwusbdev;Huawei MobileBroadband USB PNP Device;c:\winnt\system32\drivers\ew_hwusbdev.sys [4.6.2014 16:57 102784]
S3 ew_usbenumfilter;huawei_CompositeFilter;c:\winnt\system32\drivers\ew_usbenumfilter.sys [4.6.2014 16:57 11136]
S3 FANTOM;LEGO MINDSTORMS NXT Driver;c:\winnt\system32\drivers\fantom.sys [29.7.2008 15:09 39424]
S3 huawei_cdcacm;huawei_cdcacm;c:\winnt\system32\drivers\ew_jucdcacm.sys [4.6.2014 16:57 95616]
S3 huawei_cdcecm;huawei_cdcecm;c:\winnt\system32\drivers\ew_jucdcecm.sys [4.6.2014 16:57 70016]
S3 huawei_ext_ctrl;huawei_ext_ctrl;c:\winnt\system32\drivers\ew_juextctrl.sys [4.6.2014 16:57 27520]
S3 SCR3XX2K;SCR3xx USB SmartCardReader;c:\winnt\system32\drivers\SCR3XX2K.sys [21.6.2007 4:40 56448]
S3 WDC_SAM;WD SCSI Pass Thru driver;c:\winnt\system32\drivers\wdcsam.sys [19.6.2014 17:09 11520]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
Cognizance REG_MULTI_SZ ASBroker ASChannel
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
2008-03-17 15:56 451872 ----a-w- c:\program files\Common Files\LightScribe\LSRunOnce.exe
.
Obsah adresáře 'Naplánované úlohy'
.
2015-09-17 c:\winnt\Tasks\avast! Emergency Update.job
- c:\program files\AVAST Software\Avast\AvastEmUpdate.exe [2015-08-11 13:33]
.
2015-09-08 c:\winnt\Tasks\Měsíční oznamování konce poskytování služeb pro Microsoft Windows XP.job
- c:\winnt\system32\xp_eos.exe [2014-04-29 23:28]
.
2015-09-17 c:\winnt\Tasks\Přihlášení k oznamování konce poskytování služeb pro Microsoft Windows XP.job
- c:\winnt\system32\xp_eos.exe [2014-04-29 23:28]
.
.
------- Doplňkový sken -------
.
IE: E&xportovat do aplikace Microsoft Office Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Send to &Bluetooth Device... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: Send To Bluetooth - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
TCP: DhcpNameServer = 10.0.0.138
TCP: Interfaces\{90B06D68-9F5C-4664-8114-2EC7C0907069}: NameServer = 8.26.56.26,156.154.70.22
TCP: Interfaces\{B91DF5FD-6FB7-452C-90CF-A48317B7E090}: NameServer = 8.26.56.26,156.154.70.22
FF - ProfilePath - c:\documents and settings\Administrator\Data aplikací\Mozilla\Firefox\Profiles\5pg9b3uy.default\
FF - prefs.js: browser.startup.homepage - hxxps://www.seznam.cz/?logged=1#obsah
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2015-09-17 16:24
Windows 5.1.2600 Service Pack 3 NTFS
.
skenování skrytých procesů ...
.
skenování skrytých položek 'Po spuštění' ...
.
skenování skrytých souborů ...
.
sken byl úspešně dokončen
skryté soubory: 0
.
**************************************************************************
.
--------------------- Knihovny navázané na běžící procesy ---------------------
.
- - - - - - - > 'winlogon.exe'(1072)
c:\winnt\system32\ackpbsc.dll
c:\winnt\system32\aclog.dll
c:\winnt\system32\ACLIBEAY.dll
c:\winnt\system32\acevtsub.dll
c:\winnt\system32\asphat32.dll
c:\winnt\system32\acerrmes.dll
c:\winnt\system32\aspcom.dll
c:\program files\ActivIdentity\ActivClient\Resources\Merged\acerrmrc.dll
c:\program files\ActivIdentity\ActivClient\Resources\Merged\asphatrc.dll
c:\program files\Hewlett-Packard\IAM\Bin\ASWLNPkg.dll
c:\program files\Hewlett-Packard\IAM\bin\ItMsg.dll
c:\program files\ActivIdentity\ActivClient\acunlock.dll
c:\winnt\system32\aipingui.dll
c:\program files\ActivIdentity\ActivClient\Resources\Merged\aipinguirc.dll
c:\program files\ActivIdentity\ActivClient\resources\acCobAPIrc.dll
c:\program files\ActivIdentity\ActivClient\Resources\Merged\acunlockrc.dll
c:\program files\Hewlett-Packard\IAM\Bin\TrayIcon.dll
c:\program files\Hewlett-Packard\IAM\bin\brand.dll
c:\program files\Hewlett-Packard\IAM\Bin\AsChnl.dll
c:\program files\Hewlett-Packard\IAM\Bin\HPPlugIn.dll
c:\program files\Hewlett-Packard\HP ProtectTools Security Manager\PTHostServices.dll
c:\winnt\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_cs_b77a5c561934e089\mscorlib.resources.dll
c:\winnt\assembly\GAC_MSIL\System.Configuration.resources\2.0.0.0_cs_b03f5f7f11d50a3a\System.Configuration.resources.dll
.
- - - - - - - > 'explorer.exe'(4104)
c:\winnt\system32\APSHook.dll
c:\winnt\system32\btmmhook.dll
c:\program files\Windows Desktop Search\deskbar.dll
c:\program files\Windows Desktop Search\cs-cz\dbres.dll.mui
c:\program files\Windows Desktop Search\dbres.dll
c:\program files\Windows Desktop Search\wordwheel.dll
c:\program files\Windows Desktop Search\cs-cz\msnlExtRes.dll.mui
c:\program files\Windows Desktop Search\msnlExtRes.dll
c:\progra~1\WINDOW~2\wmpband.dll
c:\winnt\system32\webcheck.dll
c:\winnt\system32\WPDShServiceObj.dll
c:\winnt\system32\btncopy.dll
c:\winnt\system32\PortableDeviceTypes.dll
c:\winnt\system32\PortableDeviceApi.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\program files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
c:\program files\ActivIdentity\ActivClient\acevents.exe
c:\program files\Hewlett-Packard\IAM\Bin\AsGHost.exe
c:\program files\AVAST Software\Avast\AvastSvc.exe
c:\winnt\System32\SCardSvr.exe
c:\winnt\system32\agrsmsvc.exe
c:\program files\Common Files\LightScribe\LSSrvc.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\program files\TeamViewer\TeamViewer_Service.exe
c:\winnt\system32\SearchIndexer.exe
c:\winnt\system32\igfxsrvc.exe
c:\program files\Hewlett-Packard\Shared\hpqwmiex.exe
c:\program files\Hewlett-Packard\Shared\HpqToaster.exe
c:\program files\ActivIdentity\ActivClient\acevents.exe
c:\program files\Windows Desktop Search\WindowsSearch.exe
c:\winnt\system32\wbem\unsecapp.exe
c:\winnt\system32\SearchProtocolHost.exe
c:\winnt\system32\SearchFilterHost.exe
.
**************************************************************************
.
Celkový čas: 2015-09-17 17:14:14 - počítač byl restartován
ComboFix-quarantined-files.txt 2015-09-17 15:12
ComboFix2.txt 2015-09-16 14:45
.
Před spuštěním: Volných bajtů: 43 696 353 280
Po spuštění: Volných bajtů: 43 846 782 976
.
- - End Of File - - 16950E10B250D73783E2457E1FB14D9E
2B7091CA91E2218C922AD5EFD64677B6
Nahoru
Uživatelský avatar
jaro3
člen Security týmu
Guru Level 15
Guru Level 15
Příspěvky: 43072
Registrován: červen 07
Bydliště: Jižní Čechy
Pohlaví: Muž
Stav:
Offline

Re: Prosím o preventivní kontrolu logu (pomalý ntb, občas zamrzání)

Příspěvekod jaro3 » 17 zář 2015 19:41

Spusť znovu AdwCleaner (u Windows Vista či Windows7, klikni na AdwCleaner pravým a vyber „Spustit jako správce“
klikni na „Prohledat-Scan“, po prohledání klikni na „ Vymazat-Clean“

Program provede opravu, po automatickém restartu neukáže log (C:\AdwCleaner [S?].txt) , jeho obsah sem celý vlož.

neudělal si...


ComboFix se odinstaluje takto:
Start-Spustit a zadej ComboFix /Uninstall

Vyčisti systém CCleanerem

Stáhni si OTC

na plochu. Poklepej na něj. Potom klikni na Clean up!.
Restartuj PC , pokud Ti bude doporučeno.


Vlož nový log z HJT + informuj o problémech.
Při práci s programy HJT, ComboFix,MbAM, SDFix aj. zavřete všechny ostatní aplikace a prohlížeče!
Neposílejte logy do soukromých zpráv.Po dobu mé nepřítomnosti mě zastupuje memphisto , Žbeky a Orcus.
Pokud budete spokojeni , můžete podpořit naše forum:Podpora fóra
Nahoru
Odpovědět

Zpět na “HiJackThis”

Kdo je online

Uživatelé prohlížející si toto fórum: Žádní registrovaní uživatelé a 9 hostů