VIRY.CZ

dávám sem ten log znovu, páč nebyl celý:
All processes killed
========== OTL ==========
No active process named explorer.exe was found!
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks\\ deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks\\{855F3B16-6D32-4fe6-8A56-BBB695989046} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{855F3B16-6D32-4fe6-8A56-BBB695989046}\ not found.
Registry value HKEY_USERS\S-1-5-21-1100104945-3048821398-410265370-1001\Software\Microsoft\Internet Explorer\URLSearchHooks\\ deleted successfully.
Registry value HKEY_USERS\S-1-5-21-1100104945-3048821398-410265370-1001\Software\Microsoft\Windows\CurrentVersion\Run\\ deleted successfully.
Registry value HKEY_USERS\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\RunOnce\\mctadmin deleted successfully.
Registry value HKEY_USERS\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\RunOnce\\mctadmin deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\VMApplet:/pagefile deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\\WebCheck deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{9de182db-ccab-11de-9aff-001cc0a3841a}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9de182db-ccab-11de-9aff-001cc0a3841a}\ not found.
File K:\LaunchU3.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\E\ deleted successfully.
File E:\setup.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\I\ deleted successfully.
File I:\SETUP.EXE not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\I\ not found.
File I:\SETUP.EXE not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\I\ not found.
File I:\SETUP.EXE not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\J\ deleted successfully.
File J:\Setup\rsrc\autorun.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\J\ not found.
File J:\Directx\dxsetup.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\K\ deleted successfully.
File K:\setup.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\L\ deleted successfully.
File L:\Autorun.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\M\ deleted successfully.
File M:\Autorun.exe not found.
C:\Windows\SysNative\perfh00C.dat moved successfully.
C:\Windows\SysNative\perfh00A.dat moved successfully.
C:\Windows\SysNative\perfh013.dat moved successfully.
C:\Windows\SysNative\perfh015.dat moved successfully.
C:\Windows\SysNative\perfh010.dat moved successfully.
C:\Windows\SysNative\prfh0816.dat moved successfully.
C:\Windows\SysNative\perfh019.dat moved successfully.
C:\Windows\SysNative\prfh0416.dat moved successfully.
C:\Windows\SysNative\perfh007.dat moved successfully.
C:\Windows\SysNative\perfh00E.dat moved successfully.
C:\Windows\SysNative\perfh005.dat moved successfully.
C:\Windows\SysNative\perfh01D.dat moved successfully.
C:\Windows\SysNative\perfh009.dat moved successfully.
C:\Windows\SysNative\perfh01F.dat moved successfully.
C:\Windows\SysNative\perfh008.dat moved successfully.
C:\Windows\SysNative\perfh006.dat moved successfully.
C:\Windows\SysNative\perfh014.dat moved successfully.
C:\Windows\SysNative\perfh001.dat moved successfully.
C:\Windows\SysNative\perfh00B.dat moved successfully.
C:\Windows\SysNative\perfh012.dat moved successfully.
C:\Windows\SysNative\perfh011.dat moved successfully.
C:\Windows\SysNative\prfh0404.dat moved successfully.
C:\Windows\SysNative\prfh0804.dat moved successfully.
C:\Windows\SysNative\perfh00D.dat moved successfully.
C:\Windows\SysNative\perfc00E.dat moved successfully.
C:\Windows\SysNative\perfc00A.dat moved successfully.
C:\Windows\SysNative\perfc015.dat moved successfully.
C:\Windows\SysNative\prfc0816.dat moved successfully.
C:\Windows\SysNative\perfc013.dat moved successfully.
C:\Windows\SysNative\perfc019.dat moved successfully.
C:\Windows\SysNative\perfc00C.dat moved successfully.
C:\Windows\SysNative\perfc007.dat moved successfully.
C:\Windows\SysNative\prfc0416.dat moved successfully.
C:\Windows\SysNative\perfc010.dat moved successfully.
C:\Windows\SysNative\perfc01D.dat moved successfully.
C:\Windows\SysNative\perfc005.dat moved successfully.
C:\Windows\SysNative\perfc01F.dat moved successfully.
C:\Windows\SysNative\perfc011.dat moved successfully.
C:\Windows\SysNative\perfc009.dat moved successfully.
C:\Windows\SysNative\perfc012.dat moved successfully.
C:\Windows\SysNative\prfc0804.dat moved successfully.
C:\Windows\SysNative\prfc0404.dat moved successfully.
C:\Windows\SysNative\perfc008.dat moved successfully.
C:\Windows\SysNative\perfc00B.dat moved successfully.
C:\Windows\SysNative\perfc006.dat moved successfully.
C:\Windows\SysNative\perfc001.dat moved successfully.
C:\Windows\SysNative\perfc014.dat moved successfully.
C:\Windows\SysNative\perfc00D.dat moved successfully.
C:\Windows\SysNative\prfi0404.dat moved successfully.
C:\Windows\SysNative\prfd0404.dat moved successfully.
C:\Windows\SysNative\perfi00A.dat moved successfully.
C:\Windows\SysNative\perfd00A.dat moved successfully.
C:\Windows\SysNative\perfi00D.dat moved successfully.
C:\Windows\SysNative\perfd00D.dat moved successfully.
C:\Windows\SysNative\perfi01F.dat moved successfully.
C:\Windows\SysNative\perfd01F.dat moved successfully.
C:\Windows\SysNative\perfi012.dat moved successfully.
C:\Windows\SysNative\perfd012.dat moved successfully.
C:\Windows\SysNative\perfi006.dat moved successfully.
C:\Windows\SysNative\perfd006.dat moved successfully.
C:\Windows\SysNative\prfi0816.dat moved successfully.
C:\Windows\SysNative\prfd0816.dat moved successfully.
C:\Windows\SysNative\prfi0804.dat moved successfully.
C:\Windows\SysNative\prfd0804.dat moved successfully.
C:\Windows\SysNative\perfi013.dat moved successfully.
C:\Windows\SysNative\perfd013.dat moved successfully.
C:\Windows\SysNative\perfd01D.dat moved successfully.
C:\Windows\SysNative\perfi01D.dat moved successfully.
C:\Windows\SysNative\perfi007.dat moved successfully.
C:\Windows\SysNative\perfd007.dat moved successfully.
C:\Windows\SysNative\perfi019.dat moved successfully.
C:\Windows\SysNative\perfd019.dat moved successfully.
C:\Windows\SysNative\perfi010.dat moved successfully.
C:\Windows\SysNative\perfd010.dat moved successfully.
C:\Windows\SysNative\perfi011.dat moved successfully.
C:\Windows\SysNative\perfd011.dat moved successfully.
C:\Windows\SysNative\perfi014.dat moved successfully.
C:\Windows\SysNative\perfd014.dat moved successfully.
C:\Windows\SysNative\perfi008.dat moved successfully.
C:\Windows\SysNative\perfd008.dat moved successfully.
C:\Windows\SysNative\prfi0416.dat moved successfully.
C:\Windows\SysNative\prfd0416.dat moved successfully.
C:\Windows\SysNative\perfd015.dat moved successfully.
C:\Windows\SysNative\perfi015.dat moved successfully.
C:\Windows\SysNative\perfi00C.dat moved successfully.
C:\Windows\SysNative\perfi001.dat moved successfully.
C:\Windows\SysNative\perfd001.dat moved successfully.
C:\Windows\SysNative\perfd00C.dat moved successfully.
C:\Windows\SysNative\perfi00E.dat moved successfully.
C:\Windows\SysNative\perfd00E.dat moved successfully.
C:\Windows\SysNative\perfi00B.dat moved successfully.
C:\Windows\SysNative\perfd00B.dat moved successfully.
ADS C:\Windows:0DA04F8A67D8571A deleted successfully.
ADS C:\ProgramData\Temp:FB1B13D8 deleted successfully.
ADS C:\ProgramData\Temp:CF778051 deleted successfully.
ADS C:\ProgramData\Temp:CB0AACC9 deleted successfully.
========== FILES ==========
File\Folder C:\WINDOWS\system32\*.tmp.dll not found.
File\Folder C:\WINDOWS\system32\SET*.tmp not found.
C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP35A3.tmp folder moved successfully.
C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP3692.tmp folder moved successfully.
C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP4FAE.tmp folder moved successfully.
C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP6C0D.tmp folder moved successfully.
C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP9602.tmp folder moved successfully.
C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP9E41.tmp folder moved successfully.
C:\WINDOWS\assembly\NativeImages_v2.0.50727_64\Temp\ZAP1AE4.tmp folder moved successfully.
C:\WINDOWS\assembly\NativeImages_v2.0.50727_64\Temp\ZAP2205.tmp folder moved successfully.
C:\WINDOWS\assembly\NativeImages_v2.0.50727_64\Temp\ZAPE291.tmp folder moved successfully.
C:\WINDOWS\assembly\NativeImages_v2.0.50727_64\Temp\ZAPE56E.tmp folder moved successfully.
C:\WINDOWS\Temp\GUR879E.tmp moved successfully.
C:\Program Files (x86)\Trojan Remover folder moved successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: AppData

User: Bobek
->Temp folder emptied: 3806 bytes
->Temporary Internet Files folder emptied: 210146 bytes
->Java cache emptied: 63728785 bytes
->Google Chrome cache emptied: 7486017 bytes
->Apple Safari cache emptied: 0 bytes
->Opera cache emptied: 0 bytes
->Flash cache emptied: 1972886 bytes

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->Flash cache emptied: 41620 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Public

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 611406 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 85315 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 71,00 mb


[EMPTYFLASH]

User: All Users

User: AppData

User: Bobek
->Flash cache emptied: 0 bytes

User: Default
->Flash cache emptied: 0 bytes

User: Default User
->Flash cache emptied: 0 bytes

User: Public

Total Flash Files Cleaned = 0,00 mb


OTL by OldTimer - Version 3.2.14.1 log created on 09222010_071156

Files\Folders moved on Reboot...
C:\Users\Bobek\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{2CFC9DC6-3BFF-4E5E-AE2E-8C45D5BE6E31}.tmp moved successfully.
File\Folder C:\Users\Bobek\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{8658D673-E4D4-4AD5-B514-76132DFCFDE9}.tmp not found!
C:\Users\Bobek\AppData\Local\Google\Chrome\User Data\Default\Cache\data_0 moved successfully.
C:\Users\Bobek\AppData\Local\Google\Chrome\User Data\Default\Cache\data_1 moved successfully.
C:\Users\Bobek\AppData\Local\Google\Chrome\User Data\Default\Cache\data_2 moved successfully.
C:\Users\Bobek\AppData\Local\Google\Chrome\User Data\Default\Cache\data_3 moved successfully.
C:\Users\Bobek\AppData\Local\Google\Chrome\User Data\Default\Cache\index moved successfully.
File move failed. C:\Windows\temp\_avast5_\Webshlock.txt scheduled to be moved on reboot.

Registry entries deleted on Reboot...

a ten bluebird je program (orig) k LG vypalovačce

Fajn, start je stále pomalý?

je to o trochu rychlejjší, ale stále to není mých oblíbených 23 sec. (měřeno stopkama) je to 128sec, ale stále lepší než 8min

Udělejte ještě defragmentaci disku a kontrolu disku na chyby.

start - do řádku napište
chkdsk /f/r
-[enter]
souhlas - restartuje se pc a nechá se disk zkontrolovat

Provedeno, start je lepší, udělal jsem další sken mbam a našlo mi to potvoru. Podle mě je to z office 2010, které jsem dostal na odzkoušenou od známého. Ty jsem pak odinstaloval, vrátil se zpět na office 2007, ale toto mi tam zůstalo. Dal jsem to odstranit mbamem, a je to tam opět ! Co včíl ?
log:
Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Verze databáze: 4663

Windows 6.1.7600
Internet Explorer 9.0.7930.16406

22.9.2010 19:58:45
mbam-log-2010-09-22 (19-58-45).txt

Typ skenu: Úplný sken (C:\|)
Skenované objekty: 773052
Uplynulý čas: 5 hodina(y), 37 minuta(y), 14 sekunda(y)

Infikované procesy v paměti: 0
Infikované moduly v paměti: 0
Infikované klíče registru: 0
Infikované hodnoty registru: 0
Infikované datové položky registru: 0
Infikované složky: 0
Infikované soubory: 1

Infikované procesy v paměti:
(Žádné škodlivé položky nebyly zjištěny)

Infikované moduly v paměti:
(Žádné škodlivé položky nebyly zjištěny)

Infikované klíče registru:
(Žádné škodlivé položky nebyly zjištěny)

Infikované hodnoty registru:
(Žádné škodlivé položky nebyly zjištěny)

Infikované datové položky registru:
(Žádné škodlivé položky nebyly zjištěny)

Infikované složky:
(Žádné škodlivé položky nebyly zjištěny)

Infikované soubory:
C:\ProgramData\AutoKMS\Resources\KMSKG\Keygen.exe (RiskWare.Tool.CK) -> Quarantined and deleted successfully.

Zde je sken onoho souboru z total viru :

http://www.virustotal.com/file-scan/rep ... 1285274661

Zkoušel jste ten soubor smazat ručně?

Zkoušel jsem ho vymazat ručně i za pomoci tuneup schredderu - nejde!
Zkusil jsem černohousovu medicínu a ani to bohužel nepomohlo.
Zde je nový log:
Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Verze databáze: 4663

Windows 6.1.7600
Internet Explorer 9.0.7930.16406

24.9.2010 7:17:27
mbam-log-2010-09-24 (07-17-27).txt

Typ skenu: Úplný sken (C:\|)
Skenované objekty: 772728
Uplynulý čas: 2 hodina(y), 58 minuta(y), 41 sekunda(y)

Infikované procesy v paměti: 0
Infikované moduly v paměti: 0
Infikované klíče registru: 0
Infikované hodnoty registru: 0
Infikované datové položky registru: 0
Infikované složky: 0
Infikované soubory: 1

Infikované procesy v paměti:
(Žádné škodlivé položky nebyly zjištěny)

Infikované moduly v paměti:
(Žádné škodlivé položky nebyly zjištěny)

Infikované klíče registru:
(Žádné škodlivé položky nebyly zjištěny)

Infikované hodnoty registru:
(Žádné škodlivé položky nebyly zjištěny)

Infikované datové položky registru:
(Žádné škodlivé položky nebyly zjištěny)

Infikované složky:
(Žádné škodlivé položky nebyly zjištěny)

Infikované soubory:
C:\ProgramData\AutoKMS\Resources\KMSKG\Keygen.exe (RiskWare.Tool.CK) -> Quarantined and deleted successfully.

Zkoušel jsem odstranit celou složku v nouzáku - odstraněno, pročistil jsem to ccleanerem, registry boostrem, restartoval - a co by jste řekli ?!?
TA MŮRA JE TAM ZAS !!!!!!!!!

Zkoušel jste odinstalovat celý ten program C:\ProgramData\AutoKMS a smazat celou složku?

Zkoušel odinstalovat, i násilnou odinstalaci přes revo, odstranit normálně, všechno. Mimo nouzáku složka nejde odstranit. Ale po restartu se vždy objeví s celým obsahem. Zkoušel jsem i po vymazání vyčistit a přepsat volné místo a po restartu je vše zpět.
Aůůůůůůů

Fajn, tohle Vám můžu zkusit smazat celé?
C:\ProgramData\AutoKMS

Ne, to jsem také zkoušel i tou násilnou odinstalací přes revo i s avengerem. Dále jsem zkoušel vyjmour, přepsat jméno, změnit vlastnost, přitom jsem ve správci úloh (všechny procesy) toho prevíta stopl, už ani nevim co.

drixim píše:Ne, to jsem také zkoušel ...

motji se tě ptá, jestli se má pokusit to smazat (pomocí OTL)
snad se o odstranění pokoušíme už dva dny
a každý použitelný nápad na tvém Win7/64 je vítaný