V aplikaci Explorer.EXE došlo k problému a je třeba ji zavří

[myrti]

Hello and thanks for the welcome!
In that case, why not create a CD? I'm sorry I have been unable to follow the topic completely.. gTranslate is not at its best here.

regards myrti

[kristy]

my virus infected computer does not have a CD rom. But I try to do it a "naughty" way today. jsut a loads of experiments and meeting with the boss.
thanks to both for GREAT help I feel I am getting there somehow.

[kristy]

Bohuzel nemam CD drive u meho zavirovaneho pocitace, pouze USB..

[kristy]

zkousim pripravu USB v me praci, takze nemohu zvolit "RUN as administrator"... musim premluvit nase skvele IT's aby mi to povolili

[kristy]

je to dost zoufaly, ale bohuzel se mi nikde nedari pripravit flashku podle tvyho navodu. Jediny v cem jsem byla uspesna je pripravit flashku Kaspersky Rescue Disk 10-.... muzu zkusit pouzit tohle? (http://support.kaspersky.com/de/viruses ... sk?level=2)
Pokud ano, tak bych potrebovala radu co delat pote co se v nakazenem pocitaci zapne Kaspersky Rescue Disk (Graphic mode, text mode nebo boot from hard disk)
Dekuji,
Kristy

[kristy]

a jeste jeden dotaz: pokud nemam aktualni antivirovej program (mela jsem tam McAfee, ale od nekoho uz davno stazenej-.....)- ted si nejsem jista zda se aktualizuje, je mozny tam behem prcesu s Kaspersky Rescue USB naistalovat novej popr. AVAST....
dekuji,
Kristy

[kristy]

Tak podstrcit OTPLE nejde, dojde k hlasene chybe...
Tak dnes vecer zkusim kasperskeho. GMER mam spustit az budu v grafickem modu Kasperskeho? Mam tedy byt pripojena k intenetu? Otazkou je, jestli se muj pocitac k internetu pripoji.
Skoro tu flintu hazim, musim rict...

[kristy]

po spusteni- F2 - do BIOS - reboot TAB - reboot from USB- save and exit -- restartovano- press F12 - boot from USB - hlaseni " operating system missing_"
????

[kristy]

sjela jsem kasperskyho, poprve jsem nic nemazala, ale zablokovalo se to. pote jsem smazala jeden soubor (pardon) a doslo to, a sel spustit i Combo fix, originalni zprava ze subjektu tet konverzace se jiz neobjevuje.
preposilan log z combofixu. co dal?
dekuji mnohokrate,
kristy

ComboFix 11-11-27.02 - Administrator 27.11.2011 23:06:28.2.2 - x86 NETWORK
Microsoft Windows XP Home Edition 5.1.2600.3.1250.420.1029.18.1014.700 [GMT 1:00]
Spuštěný z: c:\documents and settings\Administrator\Plocha\turbina.com.exe
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
C:\install.exe
c:\windows\system32\AcroIEHelpe.dll
c:\windows\system32\AcroIEHelpe051.dll
c:\windows\system32\kock
c:\windows\system32\UAs
c:\windows\system32\UAs\iexplore.exe_UAs001.dat
c:\windows\system32\UAs\iexplore.exe_UAs002.dat
c:\windows\system32\xmldm
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2011-10-27 do 2011-11-27 )))))))))))))))))))))))))))))))
.
.
2011-11-27 21:35 . 2011-11-27 21:35 -------- d-----w- c:\windows\system32\5050
2011-11-20 19:28 . 2011-11-20 19:28 -------- d-----w- c:\windows\system32\5044
2011-11-19 22:00 . 2011-11-19 22:00 -------- d-----w- c:\program files\trend micro
2011-11-19 21:59 . 2011-11-19 22:00 -------- d-----w- C:\rsit
2011-11-19 21:22 . 2011-11-19 21:22 -------- d-----w- c:\documents and settings\Administrator
2011-11-19 16:48 . 2011-11-19 16:48 -------- d-----w- c:\windows\system32\wbem\Repository
2011-11-19 12:56 . 2011-11-19 12:56 -------- d-----w- c:\program files\Common Files\Java
2011-11-19 10:37 . 2011-11-19 10:37 -------- d-----w- c:\windows\system32\5043
2011-11-19 10:37 . 2011-11-19 10:37 136 ----a-w- c:\windows\system32\srvblck2.tmp
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-10-10 14:22 . 2008-05-09 00:24 692736 ----a-w- c:\windows\system32\inetcomm.dll
2011-10-03 04:06 . 2010-07-06 06:55 472808 ----a-w- c:\windows\system32\deployJava1.dll
2011-10-03 01:37 . 2009-04-10 18:02 73728 ----a-w- c:\windows\system32\javacpl.cpl
2011-09-28 07:06 . 2008-05-08 19:12 602112 ----a-w- c:\windows\system32\crypt32.dll
2011-09-26 09:41 . 2008-07-29 17:59 613376 ----a-w- c:\windows\system32\uiautomationcore.dll
2011-09-26 09:41 . 2008-05-08 19:13 22528 ----a-w- c:\windows\system32\oleaccrc.dll
2011-09-26 09:41 . 2008-05-08 19:13 220160 ----a-w- c:\windows\system32\oleacc.dll
2011-09-06 14:08 . 2008-05-08 19:13 1867904 ----a-w- c:\windows\system32\win32k.sys
2009-06-03 16:56 . 2009-06-03 16:56 1614456 ----a-w- c:\program files\CuteWriter.exe
2009-05-22 17:19 . 2009-05-22 17:19 421346 ----a-w- c:\program files\Lame_v3.98.2_for_Audacity_on_Windows.exe
2009-05-22 17:09 . 2009-05-22 17:09 2228534 ----a-w- c:\program files\audacity-win-1.2.6.exe
2009-05-21 11:45 . 2009-05-21 11:45 1878888 ----a-w- c:\program files\install_flash_player.exe
2009-05-21 11:21 . 2009-05-21 11:20 20617000 ----a-w- c:\program files\SkypeSetupFull.exe
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ETDWare"="c:\program files\Elantech\ETDCtrl.exe" [2009-02-11 416768]
"RTHDCPL"="RTHDCPL.EXE" [2008-12-23 18063872]
"PersistenceThread"="c:\windows\system32\PersistenceThread.exe" [2008-12-24 92696]
"BTMeter"="c:\program files\Battery Meter\BTMeter.exe" [2008-11-05 623912]
"WSED"="c:\program files\WSED\WSED.exe" [2008-12-12 238888]
"Broadcom Wireless Manager UI"="c:\windows\system32\WLTRAY.exe" [2009-02-18 2441216]
"Dell Webcam Central"="c:\program files\Dell Webcam\Dell Webcam Central\WebcamDell.exe" [2008-11-11 442536]
"ShStatEXE"="c:\program files\Network Associates\VirusScan\SHSTAT.EXE" [2004-08-18 94208]
"McAfeeUpdaterUI"="c:\program files\Network Associates\Common Framework\UpdaterUI.exe" [2004-08-06 139320]
"Network Associates Error Reporting Service"="c:\program files\Common Files\Network Associates\TalkBack\TBMon.exe" [2003-10-07 147514]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-05-26 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-07-13 292128]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2011-09-07 37296]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-03-30 937920]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-06-09 254696]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
.
c:\documents and settings\Jakub\Nabídka Start\Programy\Po spuštění\
OpenOffice.org 3.1.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2009-5-14 384512]
.
c:\documents and settings\Administrator\Nabídka Start\Programy\Po spuštění\
_uninst_.lnk - c:\documents and settings\Administrator\Local Settings\Temp\_uninst_.bat [N/A]
.
c:\documents and settings\All Users\Nabídka Start\Programy\Po spuštění\
Identd.exe [1999-5-26 239104]
Windows Search.lnk - c:\program files\Windows Desktop Search\WindowsSearch.exe [2008-5-27 123904]
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-24 304128]
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\BitLord\\BitLord.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Documents and Settings\\All Users\\Nabídka Start\\Programy\\Po spuštění\\Identd.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
.
R0 EMSC;COMPAL Embedded System Control;c:\windows\system32\drivers\EMSC.sys [10.4.2009 19:03 14248]
R1 NaiAvTdi1;NaiAvTdi1;c:\windows\system32\drivers\mvstdi5x.sys [21.5.2009 10:53 58016]
R3 RSUSBSTOR;RTS5121.Sys Realtek USB Card Reader;c:\windows\system32\drivers\RTS5121.sys [10.4.2009 21:43 157696]
S3 CtClsFlt;Creative Camera Class Upper Filter Driver;c:\windows\system32\drivers\CtClsFlt.sys [10.4.2009 19:07 135936]
S3 igd;igd;c:\windows\system32\drivers\igxpmp32.sys [10.4.2009 21:43 5088416]
S3 IntcHdmiAddService;Intel(R) High Definition Audio HDMI Service;c:\windows\system32\drivers\IntcHdmi.sys [10.4.2009 21:43 110080]
S3 OA012Afx;Provides a software interface to control audio effects of OA012 camera.;c:\windows\system32\drivers\OA012Afx.sys [10.4.2009 21:44 148056]
S3 OA012Ufd;Creative Camera OA012 Upper Filter Driver;c:\windows\system32\drivers\OA012Ufd.sys [10.4.2009 21:44 133472]
S3 OA012Vid;Creative Camera OA012 Function Driver;c:\windows\system32\drivers\OA012Vid.sys [10.4.2009 21:44 271328]
S3 PDNMp50;PDNMp50 NDIS Protocol Driver;c:\windows\system32\drivers\PDNMp50.sys [28.11.2006 21:46 28224]
S3 PDNSp50;PDNSp50 NDIS Protocol Driver;c:\windows\system32\drivers\PDNSp50.sys [28.11.2006 21:46 27072]
.
Obsah adresáře 'Naplánované úlohy'
.
2009-05-28 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 10:34]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www1.euro.dell.com/content/default.aspx?c=cz&l=cs&s=bsd
TCP: DhcpNameServer = 192.168.1.1
FF - ProfilePath - c:\documents and settings\Administrator\Data aplikací\Mozilla\Firefox\Profiles\t2lui9uh.default\
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA}
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF - Ext: Java Quick Starter: jqs@sun.com - c:\program files\Java\jre6\lib\deploy\jqs\ff
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}
FF - Ext: JavaString Helper: {184AA5E6-741D-464a-820E-94B3ABC2F3B4} - c:\windows\system32\5050
FF - Ext: JavaString Helper: {184AA5E6-741D-464a-820E-94B3ABC2F3B4} - c:\windows\system32\5050
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
.
BHO-{184AA5E6-741D-464a-820E-94B3ABC2F3B4} - (no file)
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-11-27 23:16
Windows 5.1.2600 Service Pack 3 NTFS
.
skenování skrytých procesů ...
.
skenování skrytých položek 'Po spuštění' ...
.
skenování skrytých souborů ...
.
sken byl úspešně dokončen
skryté soubory: 0
.
**************************************************************************
.
--------------------- Knihovny navázané na běžící procesy ---------------------
.
- - - - - - - > 'winlogon.exe'(560)
c:\windows\System32\BCMLogon.dll
.
Celkový čas: 2011-11-27 23:18:42
ComboFix-quarantined-files.txt 2011-11-27 22:18
.
Před spuštěním: Volných bajtů: 98 420 273 152
Po spuštění: Volných bajtů: 100 573 847 552
.
- - End Of File - - 8B3DD81DC38A3BB1F4E68476A4C0C612

[kristy]

NE !!! rozhodne ne:)...pokusim se najit,poslu

[kristy]

jestli se mohu zeptat, jak mohu zmenit typ antiviroveho programu? z McAfee na Avast? Jednoduse jeden nainstaluju a druhej nainstaluju, nebo je potreba neco inaktivovat?
Diky moc,
k

[kristy]

no... ja nevim jestli se tim neco neposralo ze jsem to smazala. musela jsem vymazat nejakou knihovnu : .dll a hlasilo to Trojan virus, no... to asi moc nepomuze. Kazdopadne se mi trosicku ulevilo, mas pravdu, uz jsem premejsella nad kupovanim novyho pocitace, Mac nebo PC, nesnasim kupovat novy veci. je to trochu voser.
s chybama jsem na tom docela podobne takze v pho

[kristy]

doufam ze ten virus nespustim znovu

[kristy]

pomohl avptools, yes!! qaurantine jsem nenasla nebot jsem v praci a pocitac mam doma, kde bduu az vecer. hned jak bduu doma juknu na to.

[kristy]

to by mi totiz jeblo