mám problém s Windows Update Vyřešeno

[jakubskorepa]

tady je log z HJT je to ve vistách...
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 2:24:16, on 24.12.2008
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\Alwil Software\Avast4\ashDisp.exe
C:\Program Files\COMODO\SafeSurf\cssurf.exe
C:\Program Files\COMODO\Firewall\cfp.exe
C:\Program Files\Creative\SBLive 24-Bit External\Volume Panel\VolPanlu.exe
C:\Windows\explorer.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\Common Files\Microsoft Shared\Ink\InputPersonalization.exe
C:\Program Files\Creative\Shared Files\CTSkinLd.exe
C:\Windows\system32\conime.exe
C:\Program Files\Windows Media Player\wmplayer.exe
C:\Users\Skouřič\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Skouřič\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Skouřič\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Skouřič\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Skouřič\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Skouřič\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Skouřič\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Program Files\ICQ6\ICQ.exe
C:\Windows\system32\mmc.exe
C:\Windows\system32\Taskmgr.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.atlas.cz/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: Podpora odkazu pro Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {41F11DEA-024C-4CB8-B539-48B3C7C77238} - C:\Windows\system32\awtsRiff.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: Ask Toolbar BHO - {F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\AskSBar\bar\1.bin\ASKSBAR.DLL
O3 - Toolbar: Ask Toolbar - {F0D4B239-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\AskSBar\bar\1.bin\ASKSBAR.DLL
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [COMODO SafeSurf] "C:\Program Files\COMODO\SafeSurf\cssurf.exe" -s
O4 - HKLM\..\Run: [COMODO Firewall Pro] "C:\Program Files\COMODO\Firewall\cfp.exe" -h
O4 - HKLM\..\Run: [VolPanel] "C:\Program Files\Creative\SBLive 24-Bit External\Volume Panel\VolPanlu.exe" /r
O4 - HKLM\..\Run: [braviax] C:\Windows\system32\braviax.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Creative SB Monitoring Utility] RunDll32 sbavmon.dll,SBAVMonitor
O4 - HKLM\..\Run: [UnlockerAssistant] "C:\Program Files\Unlocker\UnlockerAssistant.exe"
O4 - HKLM\..\Run: [MSServer] rundll32.exe C:\Windows\system32\ssqQgDsT.dll,#1
O4 - HKLM\..\Run: [cc318971] rundll32.exe "C:\Windows\system32\lmrradgo.dll",b
O4 - HKCU\..\Run: [StartCCC] c:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JRE16~2.0_0\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JRE16~2.0_0\bin\ssv.dll
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe
O13 - Gopher Prefix:
O20 - AppInit_DLLs: C:\Windows\system32\guard32.dll C:\Windows\system32\cssdll32.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: COMODO Internet Security Helper Service (cmdAgent) - Unknown owner - C:\Program Files\COMODO\Firewall\cmdagent.exe
O23 - Service: Creative Audio Service (CTAudSvcService) - Creative Technology Ltd - C:\Program Files\Creative\Shared Files\CTAudSvc.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: TeamViewer 3 (TeamViewer) - TeamViewer GmbH - C:\Program Files\TeamViewer3\TeamViewer_Host.exe
O23 - Service: Fujitsu Siemens Computers Diagnostic Testhandler (TestHandler) - Fujitsu Siemens Computers - C:\firststeps\OnlineDiagnostic\TestManager\TestHandler.exe

--
End of file - 6417 bytes


děkuji za odpovědi

[Reklama]

[jaro3]

To řádně zavirovaný..Napiš zda máš 32bit. Vistu.

Stáhni si Malwarebytes' Anti-Malware
Nainstaluj a spusť ho
- na konci instalace se ujisti že máš zvoleny/zatrhnuty obě možnosti:
Update Malwarebytes' Anti-Malware (Aktualizace Malwarebytes' Anti-Malware) a Launch Malwarebytes' Anti-Malware (Spustit aplikaci Malwarebytes' Anti-Malware), pokud jo tak klikni na tlačítko Finish
- pokud bude nalezena aktualizace, tak se stáhne a nainstaluje
- program se po té spustí a nech vybranou možnost Perform Quick Scan (Provést rychlý sken) a klikni na tlačítko Scan (Skenovat)
- po proběhnutí programu se ti objeví hláška tak klikni na OK a pak na tlačítko Show Results
- pak zvol možnost Save Logfile a ulož si log na plochu
- po té klikni na tlačítko Exit, objeví se ti hláška tak zvol Ano
(zatím nic nemaž!).
Vlož sem pak obsah toho logu.

[jakubskorepa]

ano je to 32bit vista Home Premium

[jakubskorepa]

tady je ten log z Anti malware:

Malwarebytes' Anti-Malware 1.31

Verze databáze: 1540

Windows 6.0.6001 Service Pack 1



24.12.2008 11:02:36

mbam-log-2008-12-24 (11-02-13).txt



Typ skenu: Rychlý sken

Objektu skenováno: 44402

Uplynulý cas: 4 minute(s), 37 second(s)



Infikované procesy pameti: 0

Infikované pametové moduly: 1

Infikované klíce registru: 10

Infikované hodnoty registru: 4

Infikované položky dat registru: 2

Infikované složky: 1

Infikované soubory: 24



Infikované procesy pameti:

(Žádné zákerné položky nebyly zjišteny)



Infikované pametové moduly:

C:\Windows\System32\awtsRiff.dll (Trojan.Vundo.H) -> No action taken.



Infikované klíce registru:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{41f11dea-024c-4cb8-b539-48b3c7c77238} (Trojan.Vundo.H) -> No action taken.

HKEY_CLASSES_ROOT\CLSID\{41f11dea-024c-4cb8-b539-48b3c7c77238} (Trojan.Vundo.H) -> No action taken.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{41f11dea-024c-4cb8-b539-48b3c7c77238} (Trojan.Vundo.H) -> No action taken.

HKEY_CLASSES_ROOT\CLSID\{6d794cb4-c7cd-4c6f-bfdc-9b77afbdc02c} (Trojan.Vundo) -> No action taken.

HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\MSFox (Trojan.Agent) -> No action taken.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\contim (Trojan.Vundo) -> No action taken.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\instkey (Trojan.Vundo) -> No action taken.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\rdfa (Trojan.Vundo) -> No action taken.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\FCOVM (Trojan.Vundo) -> No action taken.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemoveRP (Trojan.Vundo) -> No action taken.



Infikované hodnoty registru:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cc318971 (Trojan.Vundo.H) -> No action taken.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{6d794cb4-c7cd-4c6f-bfdc-9b77afbdc02c} (Trojan.Vundo) -> No action taken.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MSServer (Trojan.Agent) -> No action taken.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\braviax (Trojan.Downloader) -> No action taken.



Infikované položky dat registru:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Notification Packages (Trojan.Vundo.H) -> Data: c:\windows\system32\awtsriff -> No action taken.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Authentication Packages (Trojan.Vundo.H) -> Data: c:\windows\system32\awtsriff# -> No action taken.



Infikované složky:

C:\resycled (Trojan.DNSChanger) -> No action taken.



Infikované soubory:

C:\Windows\System32\awtsRiff.dll (Trojan.Vundo.H) -> No action taken.

C:\Windows\System32\ffiRstwa.ini (Trojan.Vundo.H) -> No action taken.

C:\Windows\System32\ffiRstwa.ini2 (Trojan.Vundo.H) -> No action taken.

C:\Windows\System32\bdqisrtc.dll (Trojan.Vundo.H) -> No action taken.

C:\Windows\System32\ctrsiqdb.ini (Trojan.Vundo.H) -> No action taken.

C:\Windows\System32\jgcrjyku.dll (Trojan.Vundo.H) -> No action taken.

C:\Windows\System32\ukyjrcgj.ini (Trojan.Vundo.H) -> No action taken.

C:\Windows\System32\lmrradgo.dll (Trojan.Vundo.H) -> No action taken.

C:\Windows\System32\ogdarrml.ini (Trojan.Vundo.H) -> No action taken.

C:\Windows\System32\nnnkJyVp.dll (Trojan.Vundo.H) -> No action taken.

C:\Windows\System32\pVyJknnn.ini (Trojan.Vundo.H) -> No action taken.

C:\Windows\System32\pVyJknnn.ini2 (Trojan.Vundo.H) -> No action taken.

C:\Windows\System32\nuogwdoh.dll (Trojan.Vundo.H) -> No action taken.

C:\Windows\System32\hodwgoun.ini (Trojan.Vundo.H) -> No action taken.

C:\Windows\System32\tchphyud.dll (Trojan.Vundo.H) -> No action taken.

C:\Windows\System32\duyhphct.ini (Trojan.Vundo.H) -> No action taken.

C:\Windows\System32\tuvULDwV.dll (Trojan.Vundo.H) -> No action taken.

C:\Windows\System32\VwDLUvut.ini (Trojan.Vundo.H) -> No action taken.

C:\Windows\System32\VwDLUvut.ini2 (Trojan.Vundo.H) -> No action taken.

C:\Windows\System32\wvUlICSi.dll (Trojan.Vundo.H) -> No action taken.

C:\Windows\System32\iSCIlUvw.ini (Trojan.Vundo.H) -> No action taken.

C:\Windows\System32\iSCIlUvw.ini2 (Trojan.Vundo.H) -> No action taken.

C:\Windows\System32\ssqQgDsT.dll (Trojan.Vundo) -> No action taken.

C:\Windows\System32\fccyyVNF.dll (Trojan.Vundo) -> No action taken.


ta poslední hláška bylo že probíhá sken doufam že sem to nak blbe nezrusil ale ukazalo se to jako že skončil...

jinak diky za ochotu i o Vánocích

[jakubskorepa]

prosim o odpoved...

[jaro3]

. Takže spusť znovu MbAM a dej Scan
- po proběhnutí programu se ti objeví hláška tak klikni na OK a pak na tlačítko Show Results
- ujistit se že máš zatrhnuté všechny vypsané nálezy a klikni na tlačítko Remove Selected
- když skončí odstraňování tak se ti zobrazí log, tak ho sem dej.
- pak zvol v programu OK a pak program ukonči přes Exit

Můžeš sem pak vložit log + nový log z HJT.

[jakubskorepa]

jo udelal sem napsalo to ze neco nejde tak se to udela pri restartu..
vypis z Antimalware:

Malwarebytes' Anti-Malware 1.31

Verze databáze: 1540

Windows 6.0.6001 Service Pack 1



24.12.2008 12:56:42

mbam-log-2008-12-24 (12-56-42).txt



Typ skenu: Rychlý sken

Objektu skenováno: 44450

Uplynulý cas: 4 minute(s), 28 second(s)



Infikované procesy pameti: 0

Infikované pametové moduly: 1

Infikované klíce registru: 10

Infikované hodnoty registru: 4

Infikované položky dat registru: 2

Infikované složky: 1

Infikované soubory: 24



Infikované procesy pameti:

(Žádné zákerné položky nebyly zjišteny)



Infikované pametové moduly:

C:\Windows\System32\awtsRiff.dll (Trojan.Vundo.H) -> Delete on reboot.



Infikované klíce registru:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{41f11dea-024c-4cb8-b539-48b3c7c77238} (Trojan.Vundo.H) -> Delete on reboot.

HKEY_CLASSES_ROOT\CLSID\{41f11dea-024c-4cb8-b539-48b3c7c77238} (Trojan.Vundo.H) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{41f11dea-024c-4cb8-b539-48b3c7c77238} (Trojan.Vundo.H) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\CLSID\{6d794cb4-c7cd-4c6f-bfdc-9b77afbdc02c} (Trojan.Vundo) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\MSFox (Trojan.Agent) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\contim (Trojan.Vundo) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\instkey (Trojan.Vundo) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\rdfa (Trojan.Vundo) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\FCOVM (Trojan.Vundo) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemoveRP (Trojan.Vundo) -> Quarantined and deleted successfully.



Infikované hodnoty registru:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cc318971 (Trojan.Vundo.H) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{6d794cb4-c7cd-4c6f-bfdc-9b77afbdc02c} (Trojan.Vundo) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MSServer (Trojan.Agent) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\braviax (Trojan.Downloader) -> Quarantined and deleted successfully.



Infikované položky dat registru:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Notification Packages (Trojan.Vundo.H) -> Data: c:\windows\system32\awtsriff -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Authentication Packages (Trojan.Vundo.H) -> Data: c:\windows\system32\awtsriff# -> Delete on reboot.



Infikované složky:

C:\resycled (Trojan.DNSChanger) -> Quarantined and deleted successfully.



Infikované soubory:

C:\Windows\System32\awtsRiff.dll (Trojan.Vundo.H) -> Delete on reboot.

C:\Windows\System32\ffiRstwa.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully.

C:\Windows\System32\ffiRstwa.ini2 (Trojan.Vundo.H) -> Quarantined and deleted successfully.

C:\Windows\System32\bdqisrtc.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.

C:\Windows\System32\ctrsiqdb.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully.

C:\Windows\System32\jgcrjyku.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.

C:\Windows\System32\ukyjrcgj.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully.

C:\Windows\System32\lmrradgo.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.

C:\Windows\System32\ogdarrml.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully.

C:\Windows\System32\nnnkJyVp.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.

C:\Windows\System32\pVyJknnn.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully.

C:\Windows\System32\pVyJknnn.ini2 (Trojan.Vundo.H) -> Quarantined and deleted successfully.

C:\Windows\System32\nuogwdoh.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.

C:\Windows\System32\hodwgoun.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully.

C:\Windows\System32\tchphyud.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.

C:\Windows\System32\duyhphct.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully.

C:\Windows\System32\tuvULDwV.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.

C:\Windows\System32\VwDLUvut.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully.

C:\Windows\System32\VwDLUvut.ini2 (Trojan.Vundo.H) -> Quarantined and deleted successfully.

C:\Windows\System32\wvUlICSi.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.

C:\Windows\System32\iSCIlUvw.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully.

C:\Windows\System32\iSCIlUvw.ini2 (Trojan.Vundo.H) -> Quarantined and deleted successfully.

C:\Windows\System32\ssqQgDsT.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\Windows\System32\fccyyVNF.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

a vypis z HJT:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 2:24:16, on 24.12.2008
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\Alwil Software\Avast4\ashDisp.exe
C:\Program Files\COMODO\SafeSurf\cssurf.exe
C:\Program Files\COMODO\Firewall\cfp.exe
C:\Program Files\Creative\SBLive 24-Bit External\Volume Panel\VolPanlu.exe
C:\Windows\explorer.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\Common Files\Microsoft Shared\Ink\InputPersonalization.exe
C:\Program Files\Creative\Shared Files\CTSkinLd.exe
C:\Windows\system32\conime.exe
C:\Program Files\Windows Media Player\wmplayer.exe
C:\Users\Skouřič\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Skouřič\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Skouřič\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Skouřič\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Skouřič\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Skouřič\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Skouřič\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Program Files\ICQ6\ICQ.exe
C:\Windows\system32\mmc.exe
C:\Windows\system32\Taskmgr.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.atlas.cz/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: Podpora odkazu pro Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {41F11DEA-024C-4CB8-B539-48B3C7C77238} - C:\Windows\system32\awtsRiff.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: Ask Toolbar BHO - {F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\AskSBar\bar\1.bin\ASKSBAR.DLL
O3 - Toolbar: Ask Toolbar - {F0D4B239-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\AskSBar\bar\1.bin\ASKSBAR.DLL
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [COMODO SafeSurf] "C:\Program Files\COMODO\SafeSurf\cssurf.exe" -s
O4 - HKLM\..\Run: [COMODO Firewall Pro] "C:\Program Files\COMODO\Firewall\cfp.exe" -h
O4 - HKLM\..\Run: [VolPanel] "C:\Program Files\Creative\SBLive 24-Bit External\Volume Panel\VolPanlu.exe" /r
O4 - HKLM\..\Run: [braviax] C:\Windows\system32\braviax.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Creative SB Monitoring Utility] RunDll32 sbavmon.dll,SBAVMonitor
O4 - HKLM\..\Run: [UnlockerAssistant] "C:\Program Files\Unlocker\UnlockerAssistant.exe"
O4 - HKLM\..\Run: [MSServer] rundll32.exe C:\Windows\system32\ssqQgDsT.dll,#1
O4 - HKLM\..\Run: [cc318971] rundll32.exe "C:\Windows\system32\lmrradgo.dll",b
O4 - HKCU\..\Run: [StartCCC] c:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JRE16~2.0_0\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JRE16~2.0_0\bin\ssv.dll
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe
O13 - Gopher Prefix:
O20 - AppInit_DLLs: C:\Windows\system32\guard32.dll C:\Windows\system32\cssdll32.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: COMODO Internet Security Helper Service (cmdAgent) - Unknown owner - C:\Program Files\COMODO\Firewall\cmdagent.exe
O23 - Service: Creative Audio Service (CTAudSvcService) - Creative Technology Ltd - C:\Program Files\Creative\Shared Files\CTAudSvc.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: TeamViewer 3 (TeamViewer) - TeamViewer GmbH - C:\Program Files\TeamViewer3\TeamViewer_Host.exe
O23 - Service: Fujitsu Siemens Computers Diagnostic Testhandler (TestHandler) - Fujitsu Siemens Computers - C:\firststeps\OnlineDiagnostic\TestManager\TestHandler.exe

--
End of file - 6417 bytes

[jaro3]

Ještě je tam nákaza.
Odinstaluj: AskSBar
Vypni rez . ochranu u Avastu.
Stáhni si ComboFix (by sUBs)
a ulož si ho na plochu.
Ukonči všechna aktivní okna a spusť ho.
- Po spuštění se zobrazí podmínky užití, potvrď je stiskem tlačítka Ano
- Dále postupuj dle pokynů, během aplikování ComboFixu neklikej do zobrazujícího se okna
- Po dokončení skenování by měl program vytvořit log - C:\ComboFix.txt - zkopíruj sem prosím celý jeho obsah

[jakubskorepa]

Combofix pri spusteni pise: "C:\Users\Skouříč\Plocha\ComboFix.exe není platná aplikace typu Win32."

Edit: A ten Ask Toolbar sem odinstaloval standardni cestou...

[jaro3]

Klikni pravým tlačítkem myši na tento odkaz: http://download.bleepingcomputer.com/sUBs/ComboFix.exe

▪ Vyber možnost Uložit odkaz jako a v poli Název souboru smaž název: ComboFix a zadej do něj název: VirTerminator
▪ Po změnění názvu klikni na tlačítko Uložit a ulož takto přejmenovaný ComboFix na plochu
▪ Jdi přes Start - Spustit - do volného řádku zkopíruj cestu: "%userprofile%\Plocha\VirTerminator.exe" /killall a klikni na OK
▪ Spustí se ComboFix - potvrď podmínky užití stiskem tlačítka Ano
▪ Postupuj dle pokynů, během aplikování ComboFixu neklikej do zobrazujícího se okna
▪ Po dokončení skenování by měl program vytvořit log - C:\ComboFix.txt - zkopíruj sem celý jeho obsah

[jakubskorepa]

ta samá chyba akorád s VirTerminator.. napsal sem tam toto mezi pomlčkama (bez nich)
--"%userprofile%\Plocha\VirTerminator.exe" /killall-- zeptalo se me to jestli chci spustit od neznámýho vydavatele pak Comodo jestli to chc povolit tak sem dal jo a hodilo to chybu zkusil sem to znova Comodo nic a zase chyba není platná aplikace typu Win322

[jaro3]

Stáhni si GMER
Po stažení aplikaci rozbal a spusť, probehne rychlý sken a otevře se hlavní okno programu:
pokud klikneš na tlačítko Save vpravo dole, muzeš vyexportovat první log, ktery vloziš sem.
GMER

abychom se dostali k "hlavnimu" skenu a ziskani logu z nej, ponechame v pravem sloupci zafajfkovane vsechny polozky a klikneme na tlacitko Scan, pak to vypada v okne aplikace asi takhle:

Vyckame konce skenu (coz trva tak kolem peti deseti minut), pote opet klikneme na tlacitko Save a vyexportujeme log cislo 2, jeho vysledna podoba je zhruba takovahle:
i tento log vlozte na forum