Nemohu se zbavit viru - prosim o pomoc

[stell]

ok
nemas zaco.

[van]

at nedelat spousta prispevek napisu sem...
mam jeden pocitac a na tom pocitace nod obcas pise tohle
Column Name Value

Level Critical Warning
Scanner Startup scanner
Object boot sector
Name MBR sector of the 1. physical disk
Threat probably unknown TSR.BOOT virus
Action unable to clean

proskenoval combofixem a vidim tohle

ComboFix 10-05-17.01 - Administrator 19.05.2010 8:26.1.1 - x86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.420.1029.18.247.101 [GMT 2:00]
Spuštěný z: C:\ComboFix.exe
AV: ESET NOD32 Antivirus 4.0 *On-access scanning disabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\All Users\Data aplikací\Microsoft\Network\Downloader\qmgr0.dat
c:\documents and settings\All Users\Data aplikací\Microsoft\Network\Downloader\qmgr1.dat
c:\windows\system32\mcrh.tmp

----- BITS: Možné infikované stránky -----

hxxp://192.168.55.16:8530
.
((((((((((((((((((((((((( Soubory vytvořené od 2010-04-19 do 2010-05-19 )))))))))))))))))))))))))))))))
.

2010-05-19 06:31 . 2010-05-19 06:31 53248 ----a-w- c:\temp\catchme.dll
2010-05-19 06:26 . 2010-05-19 06:26 -------- d-----w- c:\temp\WPDNSE
2010-05-19 05:50 . 2010-05-19 05:50 3690854 ----a-r- C:\ComboFix.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-05-19 06:22 . 2004-08-18 12:00 441086 ----a-w- c:\windows\system32\perfh005.dat
2010-05-19 06:22 . 2004-08-18 12:00 83742 ----a-w- c:\windows\system32\perfc005.dat
.

(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WinVNC"="c:\program files\ORL\VNC\WinVNC.exe" [1999-10-07 200704]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2004-09-30 155648]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2004-09-30 126976]
"openvpn-gui"="c:\program files\OpenVPN\bin\openvpn-gui.exe" [2006-04-16 99328]
"egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2009-05-14 2029640]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"TSClientMSIUninstaller"="c:\windows\Installer\TSClientMsiTrans\tscuinst.vbs" [2007-10-30 13801]
"TSClientAXDisabler"="c:\windows\Installer\TSClientMsiTrans\tscdsbl.bat" [2008-01-18 2247]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\Program Files\\Docházka\\Docházka.exe"=
"c:\\Program Files\\Kvados\\Quaestus Client 4.0\\qclient.exe"=
"c:\\WINDOWS\\system32\\sessmgr.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"5900:TCP"= 5900:TCP:VNC
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009
"123:UDP"= 123:UDP:NTP
"2221:TCP"= 2221:TCP:NOD
"2222:TCP"= 2222:TCP:NOD
"2223:TCP"= 2223:TCP:NOD
"2224:TCP"= 2224:TCP:NOD
"5985:TCP"= 5985:TCP:*:Disabled:Vzdálená správa systému Windows

R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [14.5.2009 15:47 107256]
R1 epfwtdir;epfwtdir;c:\windows\system32\drivers\epfwtdir.sys [14.5.2009 15:49 94360]
R2 CA_LIC_CLNT;CA License Client;c:\program files\CA\SharedComponents\CA_LIC\lic98rmt.exe [12.10.2003 22:20 143360]
R2 ekrn;ESET Service;c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe [14.5.2009 15:47 731840]
R2 LogWatch;Event Log Watch;c:\program files\CA\SharedComponents\CA_LIC\LogWatNT.exe [20.9.2002 19:29 53248]
R3 tap0801;TAP-Win32 Adapter V8;c:\windows\system32\drivers\tap0801.sys [16.4.2006 12:45 23552]
S3 CA_LIC_SRVR;CA License Server;c:\program files\CA\SharedComponents\CA_LIC\lic98rmtd.exe [7.4.2003 18:45 151552]
S3 WinRM;Windows Remote Management (WS-Management);c:\windows\system32\svchost.exe -k WINRM [18.8.2004 14:00 14336]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
WINRM REG_MULTI_SZ WINRM
.
.
------- Doplňkový sken -------
.
uStart Page = about:blank
uInternet Settings,ProxyServer = 192.168.61.2:3128
uInternet Settings,ProxyOverride = <local>
IE: {{230D1201-7607-4CF6-A11F-9E4BF0A333E0} - {0DB13731-CEFD-43CF-A8FD-B61DCBC4D5B8} -
IE: {{2C73F784-D2DE-4422-B070-2E3332FE5744} - {0320AC26-52C8-4316-B2C4-24BB6FA73C9A} -
Trusted Zone: petra
TCP: {B48B23BA-8CE5-42B4-A07B-5557348EE70D} = 62.240.162.158,62.240.161.226
DPF: {5F509E42-537E-482B-B66C-145BC170054C} - hxxp://sberna.foto.cz/snadno-vlozit-fotografie/fs/FotoStarPhotoUploader.dll
FF - ProfilePath -
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- NASTAVENÍ FIREFOXU ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".cz");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-05-19 08:31
Windows 5.1.2600 Service Pack 3 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'winlogon.exe'(880)
c:\program files\ORL\VNC\VNCHooks.dll
.
Celkový čas: 2010-05-19 08:33:53
ComboFix-quarantined-files.txt 2010-05-19 06:33

Před spuštěním: Volných bajtů: 68 050 300 928
Po spuštění: Volných bajtů: 68 380 975 104

WindowsXP-KB310994-SP2-Pro-BootDisk-CSY.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

- - End Of File - - F533457ADBD69E40C3B74D72B16258D5

ja v tom logu nevidim kde je problem...nevidis neco v tom logu nahodou?
Predem dekuji moc...

[stell]

Ahoj
no problem je tu

Object boot sector
Name MBR sector of the 1. physical disk
Threat probably unknown TSR.BOOT virus
Action unable to clean

Na fyzickom disku -1-v bootsectore je neznamy rezidentny Boot vir,,tj ,,kolko mas v pc Diskov,,??event,,vloz sem screenshot z diskmanagment,-start-spustit napis diskmgmt.msc ok
a sprav scereenshot,