Virus

[Quiller]

Zdravím potřebuju odstranit vir.
Prosím pomožte.
Tady je log z mbam:

Malwarebytes' Anti-Malware 1.31
Database version: 1600
Windows 5.1.2600 Service Pack 2

5.9.2011 16:01:37
mbam-log-2011-09-05 (16-01-32).txt

Scan type: Quick Scan
Objects scanned: 56464
Time elapsed: 4 minute(s), 13 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 1
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
HKEY_CLASSES_ROOT\regfile\shell\open\command\ (Broken.OpenCommand) -> Bad: ("regedit.exe" "%1") Good: (regedit.exe "%1") -> No action taken.

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

[vyosek]

Zdravim a pekny den preji

Nalez MBAMu smazte

Aplikujte exeHelper by Raktor

• Linky ke stazeni
  • COM soubor http://vyosek.ic.cz/BE/exeHelper.com
  • SCR soubor http://vyosek.ic.cz/BE/exeHelper.scr
• Utilitu staci spustit jako Spravce (klik pravym mysidlem), probehne oprava a vznikne log exehelperlog.txt

Dejte log z RSIT - viz muj podpis

[Quiller]

hmm nález mbamu jsem 1x zkoušel smazat a freezl se mi pc mám to teda zkusit znova jo?

[vyosek]

v tom pripade nemazat a pokracujte dale

[Quiller]

Log z "RSIT"?
To je nějaká další aplikace kterou potřebuju?

[vyosek]

Ano, navod a postup zde http://www.viry.cz/forum/viewtopic.php?f=24&t=81939

[Quiller]

Achjo... log se načítal bůh ví jak dlouho a pak se sekl celý PC co teď... znova?

+edit: Když kliknu na "spustit jako..." nedá mi to žádnou možnost (v postupu máte napsané "spustit jako správce proto to píšu) a aplikace se spustí normálně možná to je další problém?

[vyosek]

Spustte tedy normalne dvojklikem, pokud nepujde, tak napiste...

[Quiller]

RSIT jde spustit ale v načítání se vždy sekne i s celym počítačem.

[vyosek]

Zkuste tedy DDS dle tohoto navodu http://viry.cz/forum/viewtopic.php?f=24&t=81946

[Quiller]

Zapl jsem D.D.S počkal 2 minuty nic se nestalo vypl jsem D.D.S a po pár vteřínách se sekl PC.

[vyosek]

Ani v nouzovem rezimu to nejde

[Quiller]

A jak pak se na nouzový režim přepíná?

[vyosek]

Restart PC, mackat F8, zvolit Stav nouze s praci v siti

[Quiller]

DDS (Ver_2011-08-26.01) - NTFSx86 MINIMAL
Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_17
Run by trip at 19:55:18 on 2011-09-05
Systém Microsoft Windows XP Professional 5.1.2600.2.1250.420.1029.18.1022.789 [GMT 2:00]
.
.
============== Running Processes ===============
.
C:\WINDOWS\system32\svchost -k DcomLaunch
C:\WINDOWS\system32\svchost -k rpcss
C:\WINDOWS\system32\svchost.exe -k netsvcs
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wbem\wmiprvse.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = file://localhost/C:/www.google.com.htm
uSearch Page = hxxp://www.google.com
uSearch Bar = hxxp://www.google.com/ie
uInternet Connection Wizard,ShellNext = iexplore
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
uURLSearchHooks: UrlSearchHook Class: {00000000-6e41-4fd3-8538-502f5495e5fc} - c:\program files\ask.com\GenericAskToolbar.dll
uURLSearchHooks: H - No File
mURLSearchHooks: H - No File
mURLSearchHooks: H - No File
mURLSearchHooks: H - No File
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: SBCONVERT Class: {3017fb3e-9a77-4396-88c5-0ec9548fb42f} - c:\program files\speedbit video downloader\toolbar\tbcore3.dll
BHO: Conduit Engine: {30f9b915-b755-4826-820b-08fba6bd249d} - c:\program files\conduitengine\ConduitEngine.dll
BHO: SearchPredictObj Class: {389943b0-c3a2-4e69-82cb-8596a84cb3dc} - c:\progra~1\search~1\SEARCH~1.DLL
BHO: Softonic-Eng7 Toolbar: {414b6d9d-4a95-4e8d-b5b1-149dd2d93bb3} - c:\program files\softonic-eng7\tbSoft.dll
BHO: Webblog: {c3947f4e-8894-4c04-98e0-df182c706ddf} - c:\program files\wbtooltb\wbtoolDx.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
BHO: GrabberObj Class: {ff7c3cf0-4b15-11d1-abed-709549c10000} - c:\progra~1\speedb~1\toolbar\grabber.dll
TB: SpeedBit Video Downloader: {0329e7d6-6f54-462d-93f6-f5c3118badf2} - c:\program files\speedbit video downloader\toolbar\tbcore3.dll
TB: {855F3B16-6D32-4FE6-8A56-BBB695989046} - No File
TB: {EEE6C35B-6118-11DC-9C72-001320C79847} - No File
TB: {5617ECA9-488D-4BA2-8562-9710B9AB78D2} - No File
TB: Ask Toolbar: {d4027c7f-154a-4066-a1ad-4243d8127440} - c:\program files\ask.com\GenericAskToolbar.dll
TB: DAEMON Tools Toolbar: {32099aac-c132-4136-9e9a-4e364a424e17} - c:\program files\daemon tools toolbar\DTToolbar.dll
uRun: [CTFMON.EXE] c:\windows\system32\ctfmon.exe
uRun: [DAEMON Tools Lite] "c:\program files\daemon tools lite\daemon.exe" -autorun
uRun: [Advanced SystemCare 3] "c:\program files\iobit\advanced systemcare 3\AWC.exe" /startup
uRun: [Windows Boot Control] c:\documents and settings\trip\data aplikací\s-2535-6853-2745\winrsvn.exe
uRun: [MSNUpdMgr] c:\documents and settings\all users\wincdsvn.exe
uRun: [MicrosoftUpdateServices] \Documents and Settings\trip\winusbsmgr.exe
uRun: [WinCtrlSrvc] c:\documents and settings\trip\data aplikací\s-2535-6853-2745\winrcsnc.exe
uRun: [MicrosoftSrvMgr] c:\documents and settings\all users\winrcsns.exe
uRun: [MicrosoftMSDNService] c:\documents and settings\trip\msnsrvcn.exe
uRun: [MicrosoftDriverSetup] c:\documents and settings\trip\wincdsvn.exe
uRun: [MicrosoftMSDUpdateService] c:\documents and settings\trip\data aplikací\microsoft-5858-2574\winsvcrn.exe
uRun: [HKCU] c:\documents and settings\trip\data aplikací\main\explorer.exe
mRun: [SoundMAXPnP] c:\program files\analog devices\core\smax4pnp.exe
mRun: [SoundMAX] "c:\program files\analog devices\soundmax\Smax4.exe" /tray
mRun: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
mRun: [amd_dc_opt] c:\program files\amd\dual-core optimizer\amd_dc_opt.exe
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
mRun: [Malwarebytes' Anti-Malware] "c:\program files\malwarebytes' anti-malware\mbamgui.exe" /starttray
mRun: [Network Error Advisor] "c:\program files\wbtooltb\ExeRunner.exe" wbtooltb wbbtool1_0dn
mRun: [DivXUpdate] "c:\program files\divx\divx update\DivXUpdate.exe" /CHECKNOW
mRun: [SunJavaUpdateSched21] c:\program files\da6006\jusched.exe
mRun: [SunJavaUpdateSched,] c:\program files\java\jre-07\bin\jusched.exe
mRun: [HKLM] c:\documents and settings\trip\data aplikací\main\explorer.exe
dRun: [CTFMON.EXE] c:\windows\system32\CTFMON.EXE
uExplorerRun: [Policies] c:\documents and settings\trip\data aplikací\main\explorer.exe
mExplorerRun: [Policies] c:\documents and settings\trip\data aplikací\main\explorer.exe
StartupFolder: c:\docume~1\trip\nabdka~1\programy\posput~1\adobeg~1.lnk - c:\program files\common files\adobe\calibration\Adobe Gamma Loader.exe
StartupFolder: c:\documents and settings\trip\nabídka start\programy\po spuštění\CurseClientStartup.ccip
StartupFolder: c:\docume~1\trip\nabdka~1\programy\posput~1\hamachi.lnk - c:\program files\hamachi\hamachi.exe
StartupFolder: c:\docume~1\trip\nabdka~1\programy\posput~1\speedfan.lnk - c:\program files\speedfan\speedfan.exe
IE: E&xportovat do aplikace Microsoft Office Excel - c:\progra~1\micros~2\office11\EXCEL.EXE/3000
IE: Stáhnout odkaz s použitím BitCometu - c:\program files\bitcomet\BitComet.exe/AddLink.htm
IE: Stáhnout všechna videa s použitím BitCometu - c:\program files\bitcomet\BitComet.exe/AddVideo.htm
IE: Stáhnout všechny odkazy s použitím BitCometu - c:\program files\bitcomet\BitComet.exe/AddAllLink.htm
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL
DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
DPF: {CAFEEFAC-0015-0000-0012-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_12-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
TCP: DhcpNameServer = 10.0.0.138
TCP: Interfaces\{6DF6935B-1784-4A92-8083-85E413D8A7C4} : DhcpNameServer = 10.0.0.138
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL
Notify: AtiExtEvent - Ati2evxx.dll
Notify: cryptnet32 - cryptnet32.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
SSODL: fXmnrFbljhXzg - {00DA6007-AA70-CAAD-AAFC-D3BE4A0332D5} - c:\windows\system32\emv.dll
mASetup: {8AV55GF5-8W3Q-FA6U-QNU3-24G40SW0S41K} - c:\windows\main\explorer.exe\install\iexplorer.exe
mASetup: {MA3H288F-2K56-6YIU-1U82-8861R7BS01B2} - c:\documents and settings\trip\data aplikací\main\explorer.exe
Hosts: 127.0.0.1 www.virustotal.com
Hosts: 127.0.0.1 www.f-secure.com
Hosts: 127.0.0.1 www.symantec.com
Hosts: 127.0.0.1 www.eset.com
Hosts: 127.0.0.1 www.pandasecurity.com
.
================= FIREFOX ===================
.
FF - ProfilePath - c:\documents and settings\trip\data aplikací\mozilla\firefox\profiles\wdrtgg2k.default\
.
============= SERVICES / DRIVERS ===============
.
S1 oreans32;oreans32;c:\windows\system32\drivers\oreans32.sys [2010-5-1 33824]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S2 gupdate1ca50e03795450a;Služba Google Update (gupdate1ca50e03795450a);c:\program files\google\update\GoogleUpdate.exe [2009-10-19 133104]
S2 MBAMService;MBAMService;c:\program files\malwarebytes' anti-malware\mbamservice.exe [2009-1-3 170640]
S3 ADASPROT;SYSTWEAKASO;\??\c:\program files\advanced system optimizer 3\adasprot32.sys --> c:\program files\advanced system optimizer 3\adasprot32.sys [?]
S3 GarenaPEngine;GarenaPEngine;\??\c:\docume~1\trip\locals~1\temp\qjg112.tmp --> c:\docume~1\trip\locals~1\temp\QJG112.tmp [?]
S3 GGSAFERDriver;GGSAFER Driver;\??\c:\program files\garena\safedrv.sys --> c:\program files\garena\safedrv.sys [?]
S3 gupdatem;Služba Google Update (gupdatem);c:\program files\google\update\GoogleUpdate.exe [2009-10-19 133104]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2009-1-3 15504]
S3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [2009-1-3 38496]
S3 PSched;Plánovač paketů technologie QoS;c:\windows\system32\drivers\psched.sys [2004-8-3 69120]
S3 RenameMe;RenameMe;c:\windows\system32\RenameMe.sys [2007-11-4 8320]
S3 VCSVADHWSer;Avnex Virtual Audio Device (WDM);c:\windows\system32\drivers\vcsvad.sys [2010-11-25 17792]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\microsoft.net\framework\v4.0.30319\wpf\WPFFontCache_v0400.exe [2010-3-18 753504]
S3 XDva385;XDva385;\??\c:\windows\system32\xdva385.sys --> c:\windows\system32\XDva385.sys [?]
.
=============== File Associations ===============
.
regfile="regedit.exe" "%1"
.
=============== Created Last 30 ================
.
2072-04-03 12:13:14 607296 ------w- c:\program files\microsoft games\age of empires iii\deformerdllyD.dll
2011-09-05 15:23:03 -------- d-----w- c:\program files\wooowka
2011-09-05 14:48:27 -------- d-----w- c:\program files\trend micro
2011-09-04 13:36:08 -------- d-----w- c:\windows\main
2011-09-04 11:56:34 -------- d-----w- C:\ProgramData
2011-09-04 11:34:03 160649 ----a-w- c:\windows\Gibo - Stepmother's Sin Uninstaller.exe
2011-09-04 09:22:59 38160 ----a-w- c:\windows\system32\LMRTREND.dll
2011-09-04 09:22:58 140800 ----a-w- c:\windows\system32\tm20dec.ax
2011-09-04 09:22:56 182032 ----a-w- c:\windows\system32\dxtmsft3.dll
2011-09-04 09:22:50 63488 ----a-w- c:\windows\system32\unam4ie.exe
2011-09-04 09:22:48 5672 ----a-w- c:\windows\system32\quartz.vxd
2011-09-04 09:22:48 11776 ----a-w- c:\windows\system32\mciqtz.drv
2011-09-04 09:22:48 10240 ----a-w- c:\windows\system32\vidx16.dll
2011-09-04 09:22:47 4608 ----a-w- c:\windows\system32\w95inf32.dll
2011-09-04 09:22:47 2272 ----a-w- c:\windows\system32\w95inf16.dll
2011-09-04 09:22:47 194320 ----a-w- c:\windows\system32\qcut.dll
2011-09-03 16:35:26 -------- d-----w- c:\program files\UnH Solutions
2011-09-03 10:38:36 -------- d-----w- c:\program files\BBLACK
2011-09-02 15:00:25 -------- d-----w- c:\program files\Turok Evolution
2011-09-02 14:36:29 -------- d-----w- c:\program files\Mortal Kombat
2011-08-31 18:07:07 -------- d-----w- c:\program files\Duke Nukem Forever
2011-08-31 15:19:23 -------- d-----w- c:\program files\ƒZƒCƒo[ƒtƒBƒbƒVƒ…
2011-08-30 15:52:28 476904 ----a-w- c:\program files\mozilla firefox\plugins\npdeployJava1.dll
2011-08-30 15:52:28 472808 ----a-w- c:\windows\system32\deployJava1.dll
2011-08-30 14:23:14 -------- d-----w- c:\program files\ASIO4ALL v2
2011-08-30 14:23:02 225280 ----a-w- c:\windows\system32\rewire.dll
2011-08-30 14:22:45 1294336 ----a-w- c:\windows\system32\vorbis.acm
2011-08-30 14:22:00 -------- d-----w- c:\program files\Outsim
2011-08-30 14:20:32 -------- d-----w- c:\program files\Image-Line
2011-08-24 17:44:25 -------- d-----w- c:\windows\1C4551A64743409391E41477CD655043.TMP
2011-08-24 17:35:08 -------- d-----w- c:\program files\Deep Silver
2011-08-24 14:17:02 -------- d-----w- C:\RISEN
.
==================== Find3M ====================
.
2011-08-26 10:10:20 443448 ----a-w- c:\windows\system32\drivers\sptd.sys
2011-08-24 17:44:26 281760 ----a-w- c:\windows\system32\drivers\atksgt.sys
2011-08-24 17:44:26 25888 ----a-w- c:\windows\system32\drivers\lirsgt.sys
2011-08-18 08:06:42 297116 ----a-w- c:\windows\system32\shimg.dll
2011-08-16 07:03:02 404640 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-07-19 00:40:05 73728 ----a-w- c:\windows\system32\javacpl.cpl
2011-07-05 16:37:00 94208 ----a-w- c:\windows\system32\QuickTimeVR.qtx
2011-07-05 16:37:00 69632 ----a-w- c:\windows\system32\QuickTime.qts
2011-06-11 16:24:09 138160 ----a-w- c:\windows\system32\drivers\PnkBstrK.sys
2011-06-11 16:23:52 271200 ----a-w- c:\windows\system32\PnkBstrB.xtr
2011-06-11 16:23:52 271200 ----a-w- c:\windows\system32\PnkBstrB.exe
2011-06-11 15:57:53 271200 ----a-w- c:\windows\system32\PnkBstrB.ex0
2011-06-09 16:46:27 75136 ----a-w- c:\windows\system32\PnkBstrA.exe
2010-05-01 10:54:57 994042880 ----a-w- c:\program files\Combatarms_eu.exe
2010-02-04 08:21:34 525656 ----a-w- c:\program files\DXSETUP.exe
2010-02-04 08:21:32 94040 ----a-w- c:\program files\DSETUP.dll
2010-02-04 08:21:32 1691480 ----a-w- c:\program files\dsetup32.dll
2009-02-10 17:50:36 1336832 ----a-w- c:\program files\ventrilo-2.1.4-Windows-i386.exe
2005-11-13 18:28:13 1205760 --sh--r- c:\windows\main\explorer.exe\install\iexplorer.exe
.
============= FINISH: 19:56:31,96 ===============