Neudržovaný PC. Prosím o kontrolo logu. Vyřešeno

[Player1]

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 19:02:52, on 17.12.2015
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v11.0 (11.00.9600.18124)

FIREFOX: 42.0 (x86 cs)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskhost.exe
C:\Windows\system32\Dwm.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\AVAST Software\Avast\AvastUI.exe
C:\Windows\System32\igfxtray.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\System32\igfxpers.exe
C:\Windows\system32\igfxsrvc.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\GWX\GWX.exe
C:\Windows\Explorer.exe
C:\Windows\system32\taskhost.exe
C:\Users\kuba\Desktop\HijackThis.exe
C:\Windows\system32\SearchFilterHost.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/p/?LinkId=255141
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,Default_Search_URL = www.google.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.8.0_60\bin\ssv.dll
O2 - BHO: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: URLRedirectionBHO - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~1\MICROS~1\Office14\URLREDIR.DLL
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre1.8.0_60\bin\jp2ssv.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [AvastUI.exe] "C:\Program Files\AVAST Software\Avast\AvastUI.exe" /nogui
O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
O9 - Extra button: Skype Click to Call settings - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O18 - Protocol: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O18 - Filter hijack: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL
O23 - Service: AMD External Events Utility - AMD - C:\Windows\system32\atiesrxx.exe
O23 - Service: Avast Antivirus (avast! Antivirus) - AVAST Software - C:\Program Files\AVAST Software\Avast\AvastSvc.exe
O23 - Service: MBAMService - Malwarebytes - C:\Program Files\Malwarebytes Anti-Malware\mbamservice.exe
O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe
O23 - Service: Origin Client Service - Electronic Arts - C:\Program Files\Origin\OriginClientService.exe
O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files\Common Files\Steam\SteamService.exe
O23 - Service: TeamViewer 10 (TeamViewer) - TeamViewer GmbH - C:\Program Files\TeamViewer\TeamViewer_Service.exe

--
End of file - 3942 bytes

[Reklama]

[Player1]

aswMBR version 1.0.1.2290 Copyright(c) 2014 AVAST Software
Run date: 2015-12-17 19:06:36
-----------------------------
19:06:36.036 OS Version: Windows 6.1.7601 Service Pack 1
19:06:36.036 Number of processors: 2 586 0x1706
19:06:36.036 ComputerName: KUBA-PC UserName: kuba
19:06:41.161 Initialize success
19:06:41.208 VM: initialized successfully
19:06:41.208 VM: Intel CPU supported
19:06:47.226 VM: not used
19:06:48.929 AVAST engine defs: 15121700
19:07:16.429 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP2T0L0-2
19:07:16.429 Disk 0 Vendor: ST3320613AS CC2F Size: 305245MB BusType: 3
19:07:16.554 Disk 0 MBR read successfully
19:07:16.554 Disk 0 MBR scan
19:07:16.554 Disk 0 Windows 7 default MBR code
19:07:16.570 Disk 0 Partition 1 80 (A) 07 HPFS/NTFS NTFS 100294 MB offset 206848
19:07:16.570 Disk 0 Boot: NTFS code=2
19:07:16.601 Disk 0 Partition 2 00 07 HPFS/NTFS NTFS 204849 MB offset 205608960
19:07:16.617 Disk 0 scanning sectors +625139712
19:07:16.679 Disk 0 scanning C:\Windows\system32\drivers
19:07:25.289 Service scanning
19:07:42.195 Modules scanning
19:07:42.195 Disk 0 trace - called modules:
19:07:42.226 ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys halmacpi.dll ataport.SYS intelide.sys PCIIDEX.SYS atapi.sys
19:07:42.242 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x87a08370]
19:07:42.242 3 CLASSPNP.SYS[8de9859e] -> nt!IofCallDriver -> [0x8752d918]
19:07:42.242 5 ACPI.sys[84e0a3d4] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP2T0L0-2[0x8756a030]
19:07:42.539 AVAST engine scan C:\Windows
19:07:44.039 AVAST engine scan C:\Windows\system32
19:10:09.226 AVAST engine scan C:\Windows\system32\drivers
19:10:19.179 AVAST engine scan C:\Users\kuba
19:14:15.851 File: C:\Users\kuba\AppData\Roaming\Security Installer\Security Installer.exe **INFECTED** Win32:Dropper-gen [Drp]
19:15:47.710 Disk 0 MBR has been saved successfully to "C:\Users\kuba\Desktop\MBR.dat"
19:15:47.757 The log file has been saved successfully to "C:\Users\kuba\Desktop\aswMBR.txt"
19:16:43.983 AVAST engine scan C:\ProgramData
19:17:09.905 Disk 0 statistics 2947461/0/0 @ 3,58 MB/s
19:17:09.920 Scan finished successfully
19:18:22.593 Disk 0 MBR has been saved successfully to "C:\Users\kuba\Desktop\MBR.dat"
19:18:22.602 The log file has been saved successfully to "C:\Users\kuba\Desktop\aswMBR.txt"

[jerabina]

Najdi a vymaž tento soubor C:\Users\kuba\AppData\Roaming\Security Installer\Security Installer.exe

Zavři ostatní programy/prohlížeče, odpoj se od internetu a v HJT fixni:
NÁVOD

Kód: Vybrat vše

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"

Stáhni si zde DelFix
https://toolslib.net/downloads/viewdownload/2-delfix/

ulož si soubor na plochu.
Poklepáním na ikonu spusť nástroj Delfix.exe
( Ve Windows Vista, Windows 7 a 8, musíš spustit soubor pravým tlačítkem myši -> Spustit jako správce .
V hlavním menu, zkontroluj tyto možnosti - Odstranění dezinfekce nástrojů (Remove desinfection tools) – Vyčistit body obnovy (Purge System Restore) .
Poté klikněte na tlačítko Spustit (Run) a nech nástroj dělat svoji práci.

Poté se zpráva se otevře (DelFix.txt). Vlož celý obsah zprávy sem. Jinak je zpráva zde:
v C: \ DelFix.txt

Co problémy?

[Player1]

# DelFix v1.011 - Logfile created 17/12/2015 at 21:49:50
# Updated 18/08/2015 by Xplode
# Username : kuba - KUBA-PC
# Operating System : Windows 7 Professional Service Pack 1 (32 bits)

~ Removing disinfection tools ...

Deleted : C:\Qoobox
Deleted : C:\zoek_backup
Deleted : C:\AdwCleaner
Deleted : C:\ComboFix.txt
Deleted : C:\zoek-results.log
Deleted : C:\Users\kuba\Desktop\adwcleaner_5.025.exe
Deleted : C:\Users\kuba\Desktop\aswmbr.exe
Deleted : C:\Users\kuba\Desktop\aswMBR.txt
Deleted : C:\Users\kuba\Desktop\ComboFix.exe
Deleted : C:\Users\kuba\Desktop\JRT.exe
Deleted : C:\Users\kuba\Desktop\JRT.txt
Deleted : C:\Users\kuba\Desktop\hijackthis 11.17.txt
Deleted : C:\Users\kuba\Desktop\HijackThis.exe
Deleted : C:\Users\kuba\Desktop\hijackthis.log
Deleted : C:\Users\kuba\Desktop\MBR.dat
Deleted : C:\Users\kuba\Desktop\RogueKiller.exe
Deleted : C:\Users\kuba\Desktop\TFC.exe
Deleted : C:\Users\kuba\Desktop\zoek.exe
Deleted : C:\Windows\grep.exe
Deleted : C:\Windows\PEV.exe
Deleted : C:\Windows\NIRCMD.exe
Deleted : C:\Windows\MBR.exe
Deleted : C:\Windows\SED.exe
Deleted : C:\Windows\SWREG.exe
Deleted : C:\Windows\SWSC.exe
Deleted : C:\Windows\SWXCACLS.exe
Deleted : C:\Windows\Zip.exe
Deleted : HKLM\SOFTWARE\OldTimer Tools
Deleted : HKLM\SOFTWARE\AdwCleaner
Deleted : HKLM\SOFTWARE\Swearware
Deleted : HKLM\SOFTWARE\TrendMicro\Hijackthis
Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\combofix.exe
Deleted : HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_ASWMBR
Deleted : HKLM\SYSTEM\CurrentControlSet\Services\aswMBR

~ Cleaning system restore ...

Deleted : RP #96 [zoek.exe restore point | 12/17/2015 09:53:30]
Deleted : RP #98 [Revo Uninstaller's restore point - AMD Catalyst Install Manager | 12/17/2015 12:18:59]
Deleted : RP #99 [Windows Update | 12/17/2015 16:37:00]

New restore point created !

########## - EOF - ##########

Tak problémy zatím nejsou nebo jsem zatím žádný neregistroval až na jeden. Jak jsem již psal výše, mám problém s grafickou kartou (se systémem) viz. viewtopic.php?f=7&t=166686 . Hledal jsem na internetu příčiny a nenašel jsem nic, co by mi pomohlo. Obávám se, že se bude muset přeinstalovat celý operační systém. K tomuto kroku se mi moc nechce, jelikož jsme společně věnovali dost času k pročištěni PC za pomoci těch logů atd..

[jaro3]

Stáhni si a nainstaluj WhoCrashed
otevři ho a klikni na Analyze.
Program vytvoří zprávu , zkopíruj celou a vlož prosím sem.

Zkusil si odinstalovat tu grafiku ve správci zařízení , použít CCleaner a pak restartovat? V Biosu zakázat tu integrovanou.

[Player1]

Cením si Vaší ochoty a snahy mi pomoc, nicméně já už na to neměl nervy ani čas. Počítač jsem předal do rukou zkušenějším. Díky za rady

[jaro3]

Pokud nejsou problémy , je to vše a můžeš dát vyřešeno , zelenou fajfku.