prosim o kontrol logu HJT

[jitus]

Tak snad je to takhle spravne :-)

[Reklama]

[jaro3]

jj.

ComboFix se odinstaluje takto:
Start-Spustit a zadej ComboFix /Uninstall

vyčisti systém CCleanerem

a použij i T-Cleaner
http://www.edisk.cz/stahni/29485/T-Clea ... 8.5KB.html
smaže vše po Combu,MWAVu atd.-stáhneš>spustíš

pozn. před stažením T-Cleaneru a po dobu čištění deaktivuj antivir a antispyware ,následně T-Cleaner smaž a zapni si znovu antivir a antispyware.

***********************************************************************************************************************************

Poklepej na ikonu OTL na ploše.Ujisti se , že máš všechny ostatní aplikace a prohlížeče zavřeny.
Pod Vlastní skenování/opravy do okénka vlož následující text, zobrazený zeleně:

Kód: Vybrat vše

:OTL
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
SRV - File not found [On_Demand | Stopped] -- -- (AppMgmt)
[2009.12.30 14:15:43 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\MILAN ŠÁNA\Data aplikací\Mozilla\Extensions
O4 - HKLM..\Run: [BMISR] File not found
O4 - HKCU..\Run: [EA Core] File not found
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macromedia.com/pub/shoc ... tor/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {233C1507-6A77-46A4-9443-F871F945D258} http://download.macromedia.com/pub/shoc ... tor/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {5F509E42-537E-482B-B66C-145BC170054C} http://sberna.fotostar.cz/snadno-vlozit ... loader.dll (PhotoUploader Control)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/fl ... rashim.cab (Reg Error: Key error.)
O16 - DPF: {AE2B937E-EA7D-4A8D-888C-B68D7F72A3C4} http://asp.photoprintit.de/microsite/11 ... oader4.cab (IPSUploader4 Control)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload.macromedia.com/pub/sh ... wflash.cab (Shockwave Flash Object)
O33 - MountPoints2\{6c0152c4-f53c-11de-905d-0019db7c0b72}\Shell\AutoRun\command - "" = F:\InstallTomTomHOME.exe
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
[2011.05.17 16:08:43 | 000,432,492 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2011.05.17 16:08:43 | 000,429,024 | ---- | M] () -- C:\WINDOWS\System32\perfh005.dat
[2011.05.17 16:08:43 | 000,078,052 | ---- | M] () -- C:\WINDOWS\System32\perfc005.dat
[2011.05.17 16:08:43 | 000,067,448 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2006.03.02 14:00:00 | 000,432,492 | ---- | C] () -- C:\WINDOWS\System32\perfh009.dat
[2006.03.02 14:00:00 | 000,429,024 | ---- | C] () -- C:\WINDOWS\System32\perfh005.dat
[2006.03.02 14:00:00 | 000,272,128 | ---- | C] () -- C:\WINDOWS\System32\perfi009.dat
[2006.03.02 14:00:00 | 000,269,162 | ---- | C] () -- C:\WINDOWS\System32\perfi005.dat
[2006.03.02 14:00:00 | 000,078,052 | ---- | C] () -- C:\WINDOWS\System32\perfc005.dat
[2006.03.02 14:00:00 | 000,067,448 | ---- | C] () -- C:\WINDOWS\System32\perfc009.dat
[2006.03.02 14:00:00 | 000,032,072 | ---- | C] () -- C:\WINDOWS\System32\perfd005.dat
[2006.03.02 14:00:00 | 000,028,626 | ---- | C] () -- C:\WINDOWS\System32\perfd009.dat

:Files
C:\WINDOWS\System32\*.tmp
C:\WINDOWS\*.tmp
C:\WINDOWS\system32\*.tmp.dll
C:\WINDOWS\System32\dllcache\*.tmp
C:\WINDOWS\system32\SET*.tmp
c:\windows\Tasks\*.job
C:\*.tmp
C:\Documents and Settings\All Users\Data aplikací\*.tmp
C:\WINDOWS\KA.ini
C:\WINDOWS\CT4CET.bin
C:\WINDOWS\System32\ezsidmv.dat
C:\WINDOWS\d3dx.dat
C:\Documents and Settings\MILAN ŠÁNA\Data aplikací\ICQ Toolbar

:Reg
:Commands
[purity]
[emptytemp]
[start explorer]
[Reboot]


Poté klikni nahoře na Opravit. Nech program nerušeně běžet, na konci se provede restart PC.
Po restartu se objeví log , prosím zkopíruj sem celý jeho obsah.

***************************************************************************************************************************************
Nainstaluj javu:
Java SE Runtime Environment 6u25

Klikni na Accept License Agreement
Vyber OS (Windows nebo Windows x64, Offline Installation)
jre-6u25-windows-i586-p.exe nebo
jre-6u25-windows-x64.exe
Ostatní javy odeber v přidat/odebrat programy.

C:\Program Files\Nová složka---sis vytvořila sama??

C:\Documents and Settings\All Users\Data aplikací\Temp
C:\Documents and Settings\All Users\Data aplikací\tmp
Koukni do těchto složek , co tam je.

V možnostech složky si povol zobrazování skrytých souborů a složek+ odškrtni zatržítko skrýt chráněné soubory operačního systému

Toto otestuj na Virustotal
C:\fpxjpeg.dll
C:\safpx.dll
C:\SAFPXLB.dll
C:\XMPFiles.dll

Klikni vpravo od okénka na Vybrat a v Exploreru najdi požadovaný soubor v Tvém PC. Označ ho myší a klikni na Otevřít , poté klikni na Send File. Pokud už byl soubor testován , objeví se okno ve kterém klikni na Reanalyze. Soubor se začne postupně testovat více antivirovými programy. Až skončí test posledního antiviru , objeví se nahoře result a červeně počet nákaz , např. 0/40 , nebo 1/40. Pak zkopíruj myší odkaz na tuto stránku a vlož ji do svého příspěvku.

[jitus]

Ahoj tak jsem to projel. ale ty javy mi to v programech žádné nenašlo. tu je odkaz z virustotal všechny 4 složky mi vyjelo 0/40 tu je ten poslední

http://www.virustotal.com/file-scan/rep ... 1308043532

[jitus]

All processes killed
========== OTL ==========
No active process named explorer.exe was found!
No active process named firefox.exe was found!
Service AppMgmt stopped successfully!
Service AppMgmt deleted successfully!
C:\Documents and Settings\MILAN ŠÁNA\Data aplikací\Mozilla\Extensions\home2@tomtom.com folder moved successfully.
C:\Documents and Settings\MILAN ŠÁNA\Data aplikací\Mozilla\Extensions folder moved successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\BMISR not found.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\EA Core not found.
Starting removal of ActiveX control {166B1BCA-3F9C-11CF-8075-444553540000}
C:\WINDOWS\Downloaded Program Files\setup.inf moved successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{166B1BCA-3F9C-11CF-8075-444553540000}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{166B1BCA-3F9C-11CF-8075-444553540000}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{166B1BCA-3F9C-11CF-8075-444553540000}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{166B1BCA-3F9C-11CF-8075-444553540000}\ not found.
Starting removal of ActiveX control {233C1507-6A77-46A4-9443-F871F945D258}
C:\WINDOWS\Downloaded Program Files\swdir.inf moved successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{233C1507-6A77-46A4-9443-F871F945D258}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{233C1507-6A77-46A4-9443-F871F945D258}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{233C1507-6A77-46A4-9443-F871F945D258}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{233C1507-6A77-46A4-9443-F871F945D258}\ not found.
Starting removal of ActiveX control {5F509E42-537E-482B-B66C-145BC170054C}
Registry error reading value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{5F509E42-537E-482B-B66C-145BC170054C}\DownloadInformation\\INF .
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{5F509E42-537E-482B-B66C-145BC170054C}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5F509E42-537E-482B-B66C-145BC170054C}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{5F509E42-537E-482B-B66C-145BC170054C}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5F509E42-537E-482B-B66C-145BC170054C}\ not found.
Starting removal of ActiveX control {8FFBE65D-2C9C-4669-84BD-5829DC0B603C}
C:\WINDOWS\Downloaded Program Files\erma.inf moved successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ not found.
Starting removal of ActiveX control {AE2B937E-EA7D-4A8D-888C-B68D7F72A3C4}
C:\WINDOWS\Downloaded Program Files\IPSUploader.inf moved successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{AE2B937E-EA7D-4A8D-888C-B68D7F72A3C4}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{AE2B937E-EA7D-4A8D-888C-B68D7F72A3C4}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{AE2B937E-EA7D-4A8D-888C-B68D7F72A3C4}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{AE2B937E-EA7D-4A8D-888C-B68D7F72A3C4}\ not found.
Starting removal of ActiveX control {D27CDB6E-AE6D-11CF-96B8-444553540000}
C:\WINDOWS\Downloaded Program Files\swflash.inf moved successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{D27CDB6E-AE6D-11CF-96B8-444553540000}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D27CDB6E-AE6D-11CF-96B8-444553540000}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{D27CDB6E-AE6D-11CF-96B8-444553540000}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D27CDB6E-AE6D-11CF-96B8-444553540000}\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{6c0152c4-f53c-11de-905d-0019db7c0b72}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6c0152c4-f53c-11de-905d-0019db7c0b72}\ not found.
File F:\InstallTomTomHOME.exe not found.
Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session manager\\BootExecute:autocheck autochk * deleted successfully.
C:\WINDOWS\system32\perfh009.dat moved successfully.
C:\WINDOWS\system32\perfh005.dat moved successfully.
C:\WINDOWS\system32\perfc005.dat moved successfully.
C:\WINDOWS\system32\perfc009.dat moved successfully.
File C:\WINDOWS\System32\perfh009.dat not found.
File C:\WINDOWS\System32\perfh005.dat not found.
C:\WINDOWS\system32\perfi009.dat moved successfully.
C:\WINDOWS\system32\perfi005.dat moved successfully.
File C:\WINDOWS\System32\perfc005.dat not found.
File C:\WINDOWS\System32\perfc009.dat not found.
C:\WINDOWS\system32\perfd005.dat moved successfully.
C:\WINDOWS\system32\perfd009.dat moved successfully.
========== FILES ==========
C:\WINDOWS\System32\ConduitEngine.tmp moved successfully.
C:\WINDOWS\System32\CONFIG.TMP moved successfully.
C:\WINDOWS\System32\SET3C.tmp moved successfully.
C:\WINDOWS\System32\SET40.tmp moved successfully.
C:\WINDOWS\System32\SET48.tmp moved successfully.
C:\WINDOWS\002942_.tmp moved successfully.
C:\WINDOWS\SET21.tmp moved successfully.
C:\WINDOWS\SET3.tmp moved successfully.
C:\WINDOWS\SET4.tmp moved successfully.
C:\WINDOWS\SET8.tmp moved successfully.
File\Folder C:\WINDOWS\system32\*.tmp.dll not found.
File\Folder C:\WINDOWS\System32\dllcache\*.tmp not found.
File\Folder C:\WINDOWS\system32\SET*.tmp not found.
c:\windows\Tasks\AppleSoftwareUpdate.job moved successfully.
c:\windows\Tasks\GoogleUpdateTaskMachineCore.job moved successfully.
c:\windows\Tasks\GoogleUpdateTaskMachineUA.job moved successfully.
File\Folder C:\*.tmp not found.
File\Folder C:\Documents and Settings\All Users\Data aplikací\*.tmp not found.
C:\WINDOWS\KA.ini moved successfully.
C:\WINDOWS\CT4CET.bin moved successfully.
C:\WINDOWS\System32\ezsidmv.dat moved successfully.
C:\WINDOWS\d3dx.dat moved successfully.
C:\Documents and Settings\MILAN ŠÁNA\Data aplikací\ICQ Toolbar folder moved successfully.
========== REGISTRY ==========
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes

User: LocalService
->Temp folder emptied: 66016 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: MILAN ŠÁNA
->Temp folder emptied: 96897 bytes
->Temporary Internet Files folder emptied: 8259400 bytes
->Opera cache emptied: 1786836 bytes
->Flash cache emptied: 594 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 21293 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 134051851 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 33170 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 138,00 mb


OTL by OldTimer - Version 3.2.24.0 log created on 06142011_105717

Files\Folders moved on Reboot...
File\Folder C:\Documents and Settings\MILAN ŠÁNA\Local Settings\Temp\Temporary Internet Files\Content.IE5\UDY5MTQN\5PO.com%2Fgames%2Fchallenge-churchill%2Fen%2F&lmt=1192725471&dt=1192725471531&cc=100&u_h=768&u_w=1024&u_ah=738&u_aw=1024&u_cd=32&u_tz=120&u_his=7&u_java=true&u_nplug=0&u_nmime=0 not found!
File\Folder C:\Documents and Settings\MILAN ŠÁNA\Local Settings\Temp\Temporary Internet Files\Content.IE5\UDY5MTQN\CAWZS923.com%2Fgames%2Fshow-jumping%2Fen%2F&lmt=1192725505&dt=1192725505921&cc=100&u_h=768&u_w=1024&u_ah=738&u_aw=1024&u_cd=32&u_tz=120&u_his=8&u_java=true&u_nplug=0&u_nmime=0 not found!
File\Folder C:\Documents and Settings\MILAN ŠÁNA\Local Settings\Temp\Temporary Internet Files\Content.IE5\CJ4HQZ0L\CAXTXF0E.com%2Fgames%2Fshow-jumping%2Fen%2F&lmt=1192725457&dt=1192725457234&cc=100&u_h=768&u_w=1024&u_ah=738&u_aw=1024&u_cd=32&u_tz=120&u_his=6&u_java=true&u_nplug=0&u_nmime=0 not found!

Registry entries deleted on Reboot...

[jitus]

Třeba Combo fix jsem vubec nemohl odinstalovat. Hned mi vyskoci hlaska od avg ze je to vir. Avg pritom lze vypnout vzdy max na 15 min coz taky neni zrovna stastne reseni. Díky za ochotu :-) Ten T-cleaner jsem moc nepochopil vyjede okno a máš potvrdit klávesou A start a nic se nedělo. Tak nevim zda to fungovalo ci ne. Zatim ahoj :-)

[jitus]

v těch složkách C:\Documents and Settings\All Users\Data aplikací\Temp
C:\Documents and Settings\All Users\Data aplikací\tmp jsem našel vše od AVG

[jaro3]

AVG a Combofix se nemají rádi....

Spusť OTL a klikni na Vyčisti.
Pak můžeš OTL smazat , C:\_OTL

Stáhni si TFC
Otevři soubor a zavři všechny ostatní okna, Klikni na Start k zahájení procesu. Program by neměl trvat dlouho.
Poté by se měl PC restartovat, pokud ne , proveď sám.

Stáhni si ToolsCleaner2( by de A.Rothstein & Dj Quiou )

na plochu a spusť ho.
Klikni na Pt. Restauration (obnova) a poté na OK.
Klikni na Corbeille (koš) a poté na OK.
Klikni na Fichiers temp (temp složky) a poté na OK.
Klikni na Recherche (hledání) a nech Cleaner pracovat. Může se během čištění zastavit , ale nech ho pokračovat.
Když program skončí , klikni na Suppression (odstranění)a odstraň nalezené.
Zavři program.
Program maže i všechny nástroje na odvirování a vytváření logů , které se zde používají (HJT, Combofix, OTM, OTL, OTS atd.)


Jak to vypadá?

[jitus]

Ahoj, tak jsem to konecne udelal :-) vypada to dobre, opera jede pekne ale ten explorer ta pomalost je silena :-) Nemel bych jeste neco umaznout?

[jitus]

Jedine co mi ještě neštimuje, že pc strašně dlouho nabíhá po startu. Nejsou tam nějaké zbytečné programy co to zpomalují, jestli to nedělá to icq ap.

[jaro3]

Stáhni si TFC
Otevři soubor a zavři všechny ostatní okna, Klikni na Start k zahájení procesu. Program by neměl trvat dlouho.
Poté by se měl PC restartovat, pokud ne , proveď sám.

Stáhni si na svojí plochu StartupLite .exe by MalwareBytes

Tento program identifikuje a dává volbu k odstranění nepotřebných položek k vyprázdnění paměti.
Poklepej na ikonu StartupLite.exe (by MalwareBytes ) ke spuštění programu. Ve vistě a windows 7 spusť jako správce (pravým klik na ikonu a vyber-spustit jako správce).Vytvoří se list nepotřebných vstupů po spuštění. Nech všechny položky jako deaktivované a klikni na Continue . Restartuj PC.

Pak napiš , jak to vypadá.