PC-HELP.CZ

tady je log z HJT je to ve vistách...
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 2:24:16, on 24.12.2008
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\Alwil Software\Avast4\ashDisp.exe
C:\Program Files\COMODO\SafeSurf\cssurf.exe
C:\Program Files\COMODO\Firewall\cfp.exe
C:\Program Files\Creative\SBLive 24-Bit External\Volume Panel\VolPanlu.exe
C:\Windows\explorer.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\Common Files\Microsoft Shared\Ink\InputPersonalization.exe
C:\Program Files\Creative\Shared Files\CTSkinLd.exe
C:\Windows\system32\conime.exe
C:\Program Files\Windows Media Player\wmplayer.exe
C:\Users\Skouřič\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Skouřič\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Skouřič\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Skouřič\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Skouřič\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Skouřič\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Skouřič\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Program Files\ICQ6\ICQ.exe
C:\Windows\system32\mmc.exe
C:\Windows\system32\Taskmgr.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.atlas.cz/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: Podpora odkazu pro Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {41F11DEA-024C-4CB8-B539-48B3C7C77238} - C:\Windows\system32\awtsRiff.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: Ask Toolbar BHO - {F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\AskSBar\bar\1.bin\ASKSBAR.DLL
O3 - Toolbar: Ask Toolbar - {F0D4B239-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\AskSBar\bar\1.bin\ASKSBAR.DLL
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [COMODO SafeSurf] "C:\Program Files\COMODO\SafeSurf\cssurf.exe" -s
O4 - HKLM\..\Run: [COMODO Firewall Pro] "C:\Program Files\COMODO\Firewall\cfp.exe" -h
O4 - HKLM\..\Run: [VolPanel] "C:\Program Files\Creative\SBLive 24-Bit External\Volume Panel\VolPanlu.exe" /r
O4 - HKLM\..\Run: [braviax] C:\Windows\system32\braviax.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Creative SB Monitoring Utility] RunDll32 sbavmon.dll,SBAVMonitor
O4 - HKLM\..\Run: [UnlockerAssistant] "C:\Program Files\Unlocker\UnlockerAssistant.exe"
O4 - HKLM\..\Run: [MSServer] rundll32.exe C:\Windows\system32\ssqQgDsT.dll,#1
O4 - HKLM\..\Run: [cc318971] rundll32.exe "C:\Windows\system32\lmrradgo.dll",b
O4 - HKCU\..\Run: [StartCCC] c:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JRE16~2.0_0\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JRE16~2.0_0\bin\ssv.dll
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe
O13 - Gopher Prefix:
O20 - AppInit_DLLs: C:\Windows\system32\guard32.dll C:\Windows\system32\cssdll32.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: COMODO Internet Security Helper Service (cmdAgent) - Unknown owner - C:\Program Files\COMODO\Firewall\cmdagent.exe
O23 - Service: Creative Audio Service (CTAudSvcService) - Creative Technology Ltd - C:\Program Files\Creative\Shared Files\CTAudSvc.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: TeamViewer 3 (TeamViewer) - TeamViewer GmbH - C:\Program Files\TeamViewer3\TeamViewer_Host.exe
O23 - Service: Fujitsu Siemens Computers Diagnostic Testhandler (TestHandler) - Fujitsu Siemens Computers - C:\firststeps\OnlineDiagnostic\TestManager\TestHandler.exe

--
End of file - 6417 bytes


děkuji za odpovědi

To řádně zavirovaný..Napiš zda máš 32bit. Vistu.

Stáhni si Malwarebytes' Anti-Malware
Nainstaluj a spusť ho
- na konci instalace se ujisti že máš zvoleny/zatrhnuty obě možnosti:
Update Malwarebytes' Anti-Malware (Aktualizace Malwarebytes' Anti-Malware) a Launch Malwarebytes' Anti-Malware (Spustit aplikaci Malwarebytes' Anti-Malware), pokud jo tak klikni na tlačítko Finish
- pokud bude nalezena aktualizace, tak se stáhne a nainstaluje
- program se po té spustí a nech vybranou možnost Perform Quick Scan (Provést rychlý sken) a klikni na tlačítko Scan (Skenovat)
- po proběhnutí programu se ti objeví hláška tak klikni na OK a pak na tlačítko Show Results
- pak zvol možnost Save Logfile a ulož si log na plochu
- po té klikni na tlačítko Exit, objeví se ti hláška tak zvol Ano
(zatím nic nemaž!).
Vlož sem pak obsah toho logu.

ano je to 32bit vista Home Premium

tady je ten log z Anti malware:

Malwarebytes' Anti-Malware 1.31

Verze databáze: 1540

Windows 6.0.6001 Service Pack 1



24.12.2008 11:02:36

mbam-log-2008-12-24 (11-02-13).txt



Typ skenu: Rychlý sken

Objektu skenováno: 44402

Uplynulý cas: 4 minute(s), 37 second(s)



Infikované procesy pameti: 0

Infikované pametové moduly: 1

Infikované klíce registru: 10

Infikované hodnoty registru: 4

Infikované položky dat registru: 2

Infikované složky: 1

Infikované soubory: 24



Infikované procesy pameti:

(Žádné zákerné položky nebyly zjišteny)



Infikované pametové moduly:

C:\Windows\System32\awtsRiff.dll (Trojan.Vundo.H) -> No action taken.



Infikované klíce registru:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{41f11dea-024c-4cb8-b539-48b3c7c77238} (Trojan.Vundo.H) -> No action taken.

HKEY_CLASSES_ROOT\CLSID\{41f11dea-024c-4cb8-b539-48b3c7c77238} (Trojan.Vundo.H) -> No action taken.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{41f11dea-024c-4cb8-b539-48b3c7c77238} (Trojan.Vundo.H) -> No action taken.

HKEY_CLASSES_ROOT\CLSID\{6d794cb4-c7cd-4c6f-bfdc-9b77afbdc02c} (Trojan.Vundo) -> No action taken.

HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\MSFox (Trojan.Agent) -> No action taken.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\contim (Trojan.Vundo) -> No action taken.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\instkey (Trojan.Vundo) -> No action taken.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\rdfa (Trojan.Vundo) -> No action taken.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\FCOVM (Trojan.Vundo) -> No action taken.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemoveRP (Trojan.Vundo) -> No action taken.



Infikované hodnoty registru:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cc318971 (Trojan.Vundo.H) -> No action taken.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{6d794cb4-c7cd-4c6f-bfdc-9b77afbdc02c} (Trojan.Vundo) -> No action taken.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MSServer (Trojan.Agent) -> No action taken.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\braviax (Trojan.Downloader) -> No action taken.



Infikované položky dat registru:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Notification Packages (Trojan.Vundo.H) -> Data: c:\windows\system32\awtsriff -> No action taken.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Authentication Packages (Trojan.Vundo.H) -> Data: c:\windows\system32\awtsriff# -> No action taken.



Infikované složky:

C:\resycled (Trojan.DNSChanger) -> No action taken.



Infikované soubory:

C:\Windows\System32\awtsRiff.dll (Trojan.Vundo.H) -> No action taken.

C:\Windows\System32\ffiRstwa.ini (Trojan.Vundo.H) -> No action taken.

C:\Windows\System32\ffiRstwa.ini2 (Trojan.Vundo.H) -> No action taken.

C:\Windows\System32\bdqisrtc.dll (Trojan.Vundo.H) -> No action taken.

C:\Windows\System32\ctrsiqdb.ini (Trojan.Vundo.H) -> No action taken.

C:\Windows\System32\jgcrjyku.dll (Trojan.Vundo.H) -> No action taken.

C:\Windows\System32\ukyjrcgj.ini (Trojan.Vundo.H) -> No action taken.

C:\Windows\System32\lmrradgo.dll (Trojan.Vundo.H) -> No action taken.

C:\Windows\System32\ogdarrml.ini (Trojan.Vundo.H) -> No action taken.

C:\Windows\System32\nnnkJyVp.dll (Trojan.Vundo.H) -> No action taken.

C:\Windows\System32\pVyJknnn.ini (Trojan.Vundo.H) -> No action taken.

C:\Windows\System32\pVyJknnn.ini2 (Trojan.Vundo.H) -> No action taken.

C:\Windows\System32\nuogwdoh.dll (Trojan.Vundo.H) -> No action taken.

C:\Windows\System32\hodwgoun.ini (Trojan.Vundo.H) -> No action taken.

C:\Windows\System32\tchphyud.dll (Trojan.Vundo.H) -> No action taken.

C:\Windows\System32\duyhphct.ini (Trojan.Vundo.H) -> No action taken.

C:\Windows\System32\tuvULDwV.dll (Trojan.Vundo.H) -> No action taken.

C:\Windows\System32\VwDLUvut.ini (Trojan.Vundo.H) -> No action taken.

C:\Windows\System32\VwDLUvut.ini2 (Trojan.Vundo.H) -> No action taken.

C:\Windows\System32\wvUlICSi.dll (Trojan.Vundo.H) -> No action taken.

C:\Windows\System32\iSCIlUvw.ini (Trojan.Vundo.H) -> No action taken.

C:\Windows\System32\iSCIlUvw.ini2 (Trojan.Vundo.H) -> No action taken.

C:\Windows\System32\ssqQgDsT.dll (Trojan.Vundo) -> No action taken.

C:\Windows\System32\fccyyVNF.dll (Trojan.Vundo) -> No action taken.


ta poslední hláška bylo že probíhá sken doufam že sem to nak blbe nezrusil ale ukazalo se to jako že skončil...

jinak diky za ochotu i o Vánocích

prosim o odpoved...

. Takže spusť znovu MbAM a dej Scan
- po proběhnutí programu se ti objeví hláška tak klikni na OK a pak na tlačítko Show Results
- ujistit se že máš zatrhnuté všechny vypsané nálezy a klikni na tlačítko Remove Selected
- když skončí odstraňování tak se ti zobrazí log, tak ho sem dej.
- pak zvol v programu OK a pak program ukonči přes Exit

Můžeš sem pak vložit log + nový log z HJT.

jo udelal sem napsalo to ze neco nejde tak se to udela pri restartu..
vypis z Antimalware:

Malwarebytes' Anti-Malware 1.31

Verze databáze: 1540

Windows 6.0.6001 Service Pack 1



24.12.2008 12:56:42

mbam-log-2008-12-24 (12-56-42).txt



Typ skenu: Rychlý sken

Objektu skenováno: 44450

Uplynulý cas: 4 minute(s), 28 second(s)



Infikované procesy pameti: 0

Infikované pametové moduly: 1

Infikované klíce registru: 10

Infikované hodnoty registru: 4

Infikované položky dat registru: 2

Infikované složky: 1

Infikované soubory: 24



Infikované procesy pameti:

(Žádné zákerné položky nebyly zjišteny)



Infikované pametové moduly:

C:\Windows\System32\awtsRiff.dll (Trojan.Vundo.H) -> Delete on reboot.



Infikované klíce registru:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{41f11dea-024c-4cb8-b539-48b3c7c77238} (Trojan.Vundo.H) -> Delete on reboot.

HKEY_CLASSES_ROOT\CLSID\{41f11dea-024c-4cb8-b539-48b3c7c77238} (Trojan.Vundo.H) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{41f11dea-024c-4cb8-b539-48b3c7c77238} (Trojan.Vundo.H) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\CLSID\{6d794cb4-c7cd-4c6f-bfdc-9b77afbdc02c} (Trojan.Vundo) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\MSFox (Trojan.Agent) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\contim (Trojan.Vundo) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\instkey (Trojan.Vundo) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\rdfa (Trojan.Vundo) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\FCOVM (Trojan.Vundo) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemoveRP (Trojan.Vundo) -> Quarantined and deleted successfully.



Infikované hodnoty registru:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cc318971 (Trojan.Vundo.H) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{6d794cb4-c7cd-4c6f-bfdc-9b77afbdc02c} (Trojan.Vundo) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MSServer (Trojan.Agent) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\braviax (Trojan.Downloader) -> Quarantined and deleted successfully.



Infikované položky dat registru:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Notification Packages (Trojan.Vundo.H) -> Data: c:\windows\system32\awtsriff -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Authentication Packages (Trojan.Vundo.H) -> Data: c:\windows\system32\awtsriff# -> Delete on reboot.



Infikované složky:

C:\resycled (Trojan.DNSChanger) -> Quarantined and deleted successfully.



Infikované soubory:

C:\Windows\System32\awtsRiff.dll (Trojan.Vundo.H) -> Delete on reboot.

C:\Windows\System32\ffiRstwa.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully.

C:\Windows\System32\ffiRstwa.ini2 (Trojan.Vundo.H) -> Quarantined and deleted successfully.

C:\Windows\System32\bdqisrtc.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.

C:\Windows\System32\ctrsiqdb.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully.

C:\Windows\System32\jgcrjyku.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.

C:\Windows\System32\ukyjrcgj.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully.

C:\Windows\System32\lmrradgo.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.

C:\Windows\System32\ogdarrml.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully.

C:\Windows\System32\nnnkJyVp.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.

C:\Windows\System32\pVyJknnn.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully.

C:\Windows\System32\pVyJknnn.ini2 (Trojan.Vundo.H) -> Quarantined and deleted successfully.

C:\Windows\System32\nuogwdoh.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.

C:\Windows\System32\hodwgoun.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully.

C:\Windows\System32\tchphyud.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.

C:\Windows\System32\duyhphct.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully.

C:\Windows\System32\tuvULDwV.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.

C:\Windows\System32\VwDLUvut.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully.

C:\Windows\System32\VwDLUvut.ini2 (Trojan.Vundo.H) -> Quarantined and deleted successfully.

C:\Windows\System32\wvUlICSi.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.

C:\Windows\System32\iSCIlUvw.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully.

C:\Windows\System32\iSCIlUvw.ini2 (Trojan.Vundo.H) -> Quarantined and deleted successfully.

C:\Windows\System32\ssqQgDsT.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\Windows\System32\fccyyVNF.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

a vypis z HJT:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 2:24:16, on 24.12.2008
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\Alwil Software\Avast4\ashDisp.exe
C:\Program Files\COMODO\SafeSurf\cssurf.exe
C:\Program Files\COMODO\Firewall\cfp.exe
C:\Program Files\Creative\SBLive 24-Bit External\Volume Panel\VolPanlu.exe
C:\Windows\explorer.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\Common Files\Microsoft Shared\Ink\InputPersonalization.exe
C:\Program Files\Creative\Shared Files\CTSkinLd.exe
C:\Windows\system32\conime.exe
C:\Program Files\Windows Media Player\wmplayer.exe
C:\Users\Skouřič\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Skouřič\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Skouřič\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Skouřič\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Skouřič\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Skouřič\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Skouřič\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Program Files\ICQ6\ICQ.exe
C:\Windows\system32\mmc.exe
C:\Windows\system32\Taskmgr.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.atlas.cz/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: Podpora odkazu pro Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {41F11DEA-024C-4CB8-B539-48B3C7C77238} - C:\Windows\system32\awtsRiff.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: Ask Toolbar BHO - {F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\AskSBar\bar\1.bin\ASKSBAR.DLL
O3 - Toolbar: Ask Toolbar - {F0D4B239-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\AskSBar\bar\1.bin\ASKSBAR.DLL
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [COMODO SafeSurf] "C:\Program Files\COMODO\SafeSurf\cssurf.exe" -s
O4 - HKLM\..\Run: [COMODO Firewall Pro] "C:\Program Files\COMODO\Firewall\cfp.exe" -h
O4 - HKLM\..\Run: [VolPanel] "C:\Program Files\Creative\SBLive 24-Bit External\Volume Panel\VolPanlu.exe" /r
O4 - HKLM\..\Run: [braviax] C:\Windows\system32\braviax.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Creative SB Monitoring Utility] RunDll32 sbavmon.dll,SBAVMonitor
O4 - HKLM\..\Run: [UnlockerAssistant] "C:\Program Files\Unlocker\UnlockerAssistant.exe"
O4 - HKLM\..\Run: [MSServer] rundll32.exe C:\Windows\system32\ssqQgDsT.dll,#1
O4 - HKLM\..\Run: [cc318971] rundll32.exe "C:\Windows\system32\lmrradgo.dll",b
O4 - HKCU\..\Run: [StartCCC] c:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JRE16~2.0_0\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JRE16~2.0_0\bin\ssv.dll
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe
O13 - Gopher Prefix:
O20 - AppInit_DLLs: C:\Windows\system32\guard32.dll C:\Windows\system32\cssdll32.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: COMODO Internet Security Helper Service (cmdAgent) - Unknown owner - C:\Program Files\COMODO\Firewall\cmdagent.exe
O23 - Service: Creative Audio Service (CTAudSvcService) - Creative Technology Ltd - C:\Program Files\Creative\Shared Files\CTAudSvc.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: TeamViewer 3 (TeamViewer) - TeamViewer GmbH - C:\Program Files\TeamViewer3\TeamViewer_Host.exe
O23 - Service: Fujitsu Siemens Computers Diagnostic Testhandler (TestHandler) - Fujitsu Siemens Computers - C:\firststeps\OnlineDiagnostic\TestManager\TestHandler.exe

--
End of file - 6417 bytes

Ještě je tam nákaza.
Odinstaluj: AskSBar
Vypni rez . ochranu u Avastu.
Stáhni si ComboFix (by sUBs)
a ulož si ho na plochu.
Ukonči všechna aktivní okna a spusť ho.
- Po spuštění se zobrazí podmínky užití, potvrď je stiskem tlačítka Ano
- Dále postupuj dle pokynů, během aplikování ComboFixu neklikej do zobrazujícího se okna
- Po dokončení skenování by měl program vytvořit log - C:\ComboFix.txt - zkopíruj sem prosím celý jeho obsah

Combofix pri spusteni pise: "C:\Users\Skouříč\Plocha\ComboFix.exe není platná aplikace typu Win32."

Edit: A ten Ask Toolbar sem odinstaloval standardni cestou...

Klikni pravým tlačítkem myši na tento odkaz: http://download.bleepingcomputer.com/sUBs/ComboFix.exe

▪ Vyber možnost Uložit odkaz jako a v poli Název souboru smaž název: ComboFix a zadej do něj název: VirTerminator
▪ Po změnění názvu klikni na tlačítko Uložit a ulož takto přejmenovaný ComboFix na plochu
▪ Jdi přes Start - Spustit - do volného řádku zkopíruj cestu: "%userprofile%\Plocha\VirTerminator.exe" /killall a klikni na OK
▪ Spustí se ComboFix - potvrď podmínky užití stiskem tlačítka Ano
▪ Postupuj dle pokynů, během aplikování ComboFixu neklikej do zobrazujícího se okna
▪ Po dokončení skenování by měl program vytvořit log - C:\ComboFix.txt - zkopíruj sem celý jeho obsah

ta samá chyba akorád s VirTerminator.. napsal sem tam toto mezi pomlčkama (bez nich)
--"%userprofile%\Plocha\VirTerminator.exe" /killall-- zeptalo se me to jestli chci spustit od neznámýho vydavatele pak Comodo jestli to chc povolit tak sem dal jo a hodilo to chybu zkusil sem to znova Comodo nic a zase chyba není platná aplikace typu Win322

Stáhni si GMER
Po stažení aplikaci rozbal a spusť, probehne rychlý sken a otevře se hlavní okno programu:
pokud klikneš na tlačítko Save vpravo dole, muzeš vyexportovat první log, ktery vloziš sem.
GMER

abychom se dostali k "hlavnimu" skenu a ziskani logu z nej, ponechame v pravem sloupci zafajfkovane vsechny polozky a klikneme na tlacitko Scan, pak to vypada v okne aplikace asi takhle:

Vyckame konce skenu (coz trva tak kolem peti deseti minut), pote opet klikneme na tlacitko Save a vyexportujeme log cislo 2, jeho vysledna podoba je zhruba takovahle:
i tento log vlozte na forum