problém s pripojením USB kľúčov

[stell]

Pripoj USB-Kluce,
Spust OTL>do okna skopiruj text a teraz klikni na gombik OPRAVIT
log po restarte vloz sem, a nedavaj do code.

Kód: Vybrat vše

:OTL
FF - prefs.js..browser.search.selectedEngine: "My Web Search"
FF - prefs.js..extensions.enabledItems: toolbar@ask.com:3.11.3.15590
FF - prefs.js..keyword.URL: "http://search.mywebsearch.com/mywebsearch/GGmain.jhtml?id=ZNfox000&ptb=oGFPKVxHpUJK91e0OxS_zw&psa=&ind=2010090910&ptnrS=ZNfox000&si=&st=kwd&n=77cf8d9e&searchfor="
[2011.03.20 18:14:42 | 000,000,000 | ---D | M] (Nero Toolbar) -- C:\Documents and Settings\Jakub Kříž\Data aplikací\Mozilla\Firefox\Profiles\qd84jgz2.default\extensions\toolbar@ask.com
[2010.09.09 16:53:22 | 000,010,017 | ---- | M] () -- C:\Documents and Settings\Jakub Kříž\Data aplikací\Mozilla\Firefox\Profiles\qd84jgz2.default\searchplugins\mywebsearch.xml
File not found (No name found) -- C:\DOCUMENTS AND SETTINGS\JAKUB Kříż\DATA APLIKACí\MOZILLA\FIREFOX\PROFILES\QD84JGZ2.DEFAULT\EXTENSIONS\TOOLBAR@ASK.COM
O3 - HKU\S-1-5-21-220523388-492894223-839522115-1004\..\Toolbar\ShellBrowser: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - No CLSID value found.
O32 - AutoRun File - [2011.03.27 18:38:18 | 000,000,000 | ---D | M] - C:\autorun.inf -- [ NTFS ]
O32 - AutoRun File - [2011.03.27 18:37:08 | 000,000,000 | ---D | M] - L:\autorun.inf -- [ FAT32 ]
[3 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[10 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
:Files 
ipconfig /flushdns /c 
:Commands 
[purity] 
[resethosts] 
[CreateRestorePoint] 
[emptytemp] 
[start explorer]
[Reboot]

[BINGMAN]

ll processes killed
========== OTL ==========
Prefs.js: "My Web Search" removed from browser.search.selectedEngine
Prefs.js: toolbar@ask.com:3.11.3.15590 removed from extensions.enabledItems
Prefs.js: "http://search.mywebsearch.com/mywebsear ... searchfor=" removed from keyword.URL
C:\Documents and Settings\Jakub Kříž\Data aplikací\Mozilla\Firefox\Profiles\qd84jgz2.default\extensions\toolbar@ask.com\searchplugins folder moved successfully.
C:\Documents and Settings\Jakub Kříž\Data aplikací\Mozilla\Firefox\Profiles\qd84jgz2.default\extensions\toolbar@ask.com\logs folder moved successfully.
C:\Documents and Settings\Jakub Kříž\Data aplikací\Mozilla\Firefox\Profiles\qd84jgz2.default\extensions\toolbar@ask.com\defaults\preferences folder moved successfully.
C:\Documents and Settings\Jakub Kříž\Data aplikací\Mozilla\Firefox\Profiles\qd84jgz2.default\extensions\toolbar@ask.com\defaults folder moved successfully.
C:\Documents and Settings\Jakub Kříž\Data aplikací\Mozilla\Firefox\Profiles\qd84jgz2.default\extensions\toolbar@ask.com\datastore folder moved successfully.
C:\Documents and Settings\Jakub Kříž\Data aplikací\Mozilla\Firefox\Profiles\qd84jgz2.default\extensions\toolbar@ask.com\chrome\temp\ff-config.Sun-20-Mar-2011-19-16-36-GMT folder moved successfully.
C:\Documents and Settings\Jakub Kříž\Data aplikací\Mozilla\Firefox\Profiles\qd84jgz2.default\extensions\toolbar@ask.com\chrome\temp\ff-config.Sun-02-Jan-2011-17-13-08-GMT folder moved successfully.
C:\Documents and Settings\Jakub Kříž\Data aplikací\Mozilla\Firefox\Profiles\qd84jgz2.default\extensions\toolbar@ask.com\chrome\temp\ff-config.Fri-31-Dec-2010-14-06-47-GMT folder moved successfully.
C:\Documents and Settings\Jakub Kříž\Data aplikací\Mozilla\Firefox\Profiles\qd84jgz2.default\extensions\toolbar@ask.com\chrome\temp folder moved successfully.
C:\Documents and Settings\Jakub Kříž\Data aplikací\Mozilla\Firefox\Profiles\qd84jgz2.default\extensions\toolbar@ask.com\chrome\skin folder moved successfully.
C:\Documents and Settings\Jakub Kříž\Data aplikací\Mozilla\Firefox\Profiles\qd84jgz2.default\extensions\toolbar@ask.com\chrome\content folder moved successfully.
C:\Documents and Settings\Jakub Kříž\Data aplikací\Mozilla\Firefox\Profiles\qd84jgz2.default\extensions\toolbar@ask.com\chrome folder moved successfully.
C:\Documents and Settings\Jakub Kříž\Data aplikací\Mozilla\Firefox\Profiles\qd84jgz2.default\extensions\toolbar@ask.com folder moved successfully.
C:\Documents and Settings\Jakub Kříž\Data aplikací\Mozilla\Firefox\Profiles\qd84jgz2.default\searchplugins\mywebsearch.xml moved successfully.
Registry value HKEY_USERS\S-1-5-21-220523388-492894223-839522115-1004\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\\{D4027C7F-154A-4066-A1AD-4243D8127440} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}\ not found.
File not found.
File not found.
C:\WINDOWS\System32\CONFIG.TMP deleted successfully.
C:\WINDOWS\System32\SET11A.tmp deleted successfully.
C:\WINDOWS\System32\SET159F.tmp deleted successfully.
C:\WINDOWS\000001_.tmp deleted successfully.
C:\WINDOWS\1C4551A64743409391E41477CD655043.TMP\WiseCustomCalla.dll deleted successfully.
C:\WINDOWS\1C4551A64743409391E41477CD655043.TMP folder deleted successfully.
C:\WINDOWS\6833245EDD86479A882A8360D62C8194.TMP\WiseCustomCalla.dll deleted successfully.
C:\WINDOWS\6833245EDD86479A882A8360D62C8194.TMP folder deleted successfully.
C:\WINDOWS\8AAB4176A747493AA42CB63CFADFD8E3.TMP\WiseCustomCalla.dll deleted successfully.
C:\WINDOWS\8AAB4176A747493AA42CB63CFADFD8E3.TMP folder deleted successfully.
C:\WINDOWS\C5C1C0F0D62F4DBF81D4D7EF397C228B.TMP\WiseCustomCalla.dll deleted successfully.
C:\WINDOWS\C5C1C0F0D62F4DBF81D4D7EF397C228B.TMP folder deleted successfully.
C:\WINDOWS\D56B0E274A3E46C9B5C1D93D580C099C.TMP\WiseCustomCalla.dll deleted successfully.
C:\WINDOWS\D56B0E274A3E46C9B5C1D93D580C099C.TMP folder deleted successfully.
C:\WINDOWS\E4D153288C89484BB9AAF5BE9EA6D01C.TMP\WiseCustomCalla.dll deleted successfully.
C:\WINDOWS\E4D153288C89484BB9AAF5BE9EA6D01C.TMP folder deleted successfully.
C:\WINDOWS\SET3.tmp deleted successfully.
C:\WINDOWS\SET4.tmp deleted successfully.
C:\WINDOWS\SET8.tmp deleted successfully.
========== FILES ==========
< ipconfig /flushdns /c >
Konfigurace protokolu IP systému Windows
Mezipaměť překládání DNS byla úspěšně vyprázdněna.
C:\Documents and Settings\Jakub Kříž\Plocha\cmd.bat deleted successfully.
C:\Documents and Settings\Jakub Kříž\Plocha\cmd.txt deleted successfully.
========== COMMANDS ==========
C:\WINDOWS\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully
Restore point Set: OTL Restore Point (0)

[EMPTYTEMP]

User: All Users.WINDOWS

User: Builds

User: Content

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes
->Flash cache emptied: 41620 bytes

User: Default User.WINDOWS
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes

User: Jakub KYí~

User: Jakub Kříž
->Temp folder emptied: 3757 bytes
->Temporary Internet Files folder emptied: 1494694 bytes
->FireFox cache emptied: 85255445 bytes
->Flash cache emptied: 137175 bytes

User: LocalService
->Temp folder emptied: 65984 bytes
->Temporary Internet Files folder emptied: 67 bytes

User: LocalService.NT AUTHORITY
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 32835 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: NetworkService.NT AUTHORITY
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes

User: TEMP
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->FireFox cache emptied: 33561755 bytes
->Flash cache emptied: 540 bytes

User: xx
->Temp folder emptied: 316732272 bytes
->Temporary Internet Files folder emptied: 9710769 bytes
->Java cache emptied: 1911496 bytes
->FireFox cache emptied: 94091367 bytes
->Flash cache emptied: 74108 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 33170 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 518,00 mb


OTL by OldTimer - Version 3.2.22.3 log created on 03282011_232840

Files\Folders moved on Reboot...

Registry entries deleted on Reboot...



Jo a na hardisku se mi ty složky obnovily.

[stell]

Ok, odinstaluj combofix, premenuj ikonu combofixu na uninstall
a spust.
treba nainstalovat Antivirak a Firewall, a ak vsetko bude ok,
to je vsetko.

[BINGMAN]

Opravdu moc ti děkuji za všechny rady. Vše funguje jak má. Dobrá práce a ještě jednou děkuju.

[stell]

Nemas zaco.

[pk92]

zdravím

mám podobný probém s USB ako užívatelia predomnou

a to ten že siel som do internetovej kaviarne vytlačiť zopár veci. To sa aj stalo. všetko fungovalo ale ked som už prišiel domov tak som vložil USB do počítača a namiesto klasických priečinkov čo som tam mal tak mi ukazovalo iba odkazy.

cestou po internete som sa dopátral až tu že to je vraj nejaký vírus vedeli by ste mi s touto vecou pomôcť sám si neviem rady.

Na USB som mal zálohovanú školu resp. veci do školy ale tie isté veci mam aj notebooku no bohužial som ten USB použil aj na tom resp. zatial iba na tomto PC. S čítanim súborov v PC nemám zatial problém.

Postupoval som podľa príspevku používateľa "stell" tuším to je tretí príspevok od začiatku

pekne mi to išlo až po bod. 8 sa mi darilo všetko takto robiť

následne som potreboval podľa tohto návodu nainštalovať mbam-setup stiahnuť mi ho stiahlo a dal som inštalovať ale stále mi to vyhadzovalo nejaké chyby resp. mi to nenaištalovalo a tak som tu aj skončil čiže nevedel som spraviť ten sken úplny na odstranenie toho

bol by som vďačný keby ste mi vedeli s týmto pomôct.

Samotnú záchranu súborov na USB kľúči nepotrebujem mám ich zatiaľ v PC ale potrebujem sa toho vírusu zbaviť aby som zase mohol využívať USB a aj PC aby mi nespadol resp. fungoval.

[stell]

Zdravim.
Tato tema je stara, ak mas problem, tak treba otvorit novu temu.
Ak si samo liecitel, tak ak Mbam vyhadzuje chybu, tak treba pouzit Malwarebytes verziu 1.75
http://www.viruskasino.com/2011/03/navo ... bytes.html
Nemas zaco.