Dopoledne se mi objevil na PC virus System Security 2009 (pořád se spouštěl a tvářil se jako antivir, dal nějakou hlášku na plochu, sám od sebe se spouštěl IE, který jinak nepoužívám, s chybovou stránkou atd.). Ten jsem (doufám) odstranila pomocí programu System doctor. V ovládacích panelech u přidání a odebrání softwaru jsem to ale musela odstranit ručně. Stejně tak z nabídky Start. Při té příležitosti jsem si všimla, že ve složce "po spuštění" mám soubor rncsys32, což se mi příliš nelíbí. Navíc mi najednou začalo padat připojení (wifi) vždy tak po dvou minutách od restartu (nemyslím, že by to bylo anténou, byla by hodně velká náhoda kdyby to najednou v den napadení virem přestalo fungovat) a tu a tam mi od té doby najednou problikne obrazovka s tím, že se mi změní vzhled toho dolního panelu z XP na Windows 98.

Zde je log:
Logfile of random's system information tool 1.06 (written by random/random)
Run by Hanka at 2009-06-09 14:01:54
Systém Microsoft Windows XP Professional Service Pack 3
System drive C: has 53 GB (46%) free of 114 GB
Total RAM: 1014 MB (57% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14:02:11, on 9.6.2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16827)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgnsx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Documents and Settings\Hanka\Plocha\RSIT.exe
C:\Program Files\trend micro\Hanka.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.seznam.cz/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = proxy.mlp.cz:3128
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
O2 - BHO: Podpora odkazu pro Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SpywareBlock Class - {0A87E45F-537A-40B4-B812-E2544C21A09F} - (no file)
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O3 - Toolbar: (no name) - {F0D4B239-DA4B-4daf-81E4-DFEE4931A4AA} - (no file)
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [PMCLoader] C:\Program Files\Pinnacle\TVCenter Pro\PMCLoader.exe -checktasks
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe (User 'Default user')
O4 - Startup: rncsys32.exe
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Office Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra button: Zdroje informací - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} (OnlineScanner Control) - http://www.eset.eu/buxus/docs/OnlineScanner.cab
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - http://download.eset.com/special/eos-be ... canner.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/s ... wflash.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe

--
End of file - 5067 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\1-Click Maintenance.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
Podpora odkazu pro Adobe PDF Reader - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll [2006-10-23 62080]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0A87E45F-537A-40B4-B812-E2544C21A09F}]
SpywareBlock Class

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}]
AVG Safe Search - C:\Program Files\AVG\AVG8\avgssie.dll [2009-05-02 1107224]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
SSVHelper Class - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll [2006-10-12 434279]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{F0D4B239-DA4B-4daf-81E4-DFEE4931A4AA}

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"TkBellExe"=C:\Program Files\Common Files\Real\Update_OB\realsched.exe [2009-01-05 185872]
"AVG8_TRAY"=C:\PROGRA~1\AVG\AVG8\avgtray.exe [2009-05-02 1947928]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]
"PMCRemote"= []
"PMCLoader"=C:\Program Files\Pinnacle\TVCenter Pro\PMCLoader.exe [2008-03-27 644368]

C:\Documents and Settings\Hanka\Nabídka Start\Programy\Po spuštění
rncsys32.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\avgrsstarter]
C:\WINDOWS\system32\avgrsstx.dll [2009-05-02 11952]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
C:\WINDOWS\system32\igfxdev.dll [2006-03-23 139264]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdauxservice]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdcoreservice]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\aawservice]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\nm]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\nm.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\sdauxservice]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\sdcoreservice]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\vsmon]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"HonorAutoRunSetting"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\G6 FTP Server\G6FTPSrv.exe"="C:\Program Files\G6 FTP Server\G6FTPSrv.exe:*:Enabled:G6 FTP Server for Internet."
"C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe"="C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe:*:Enabled:hpqtra08.exe"
"C:\Program Files\HP\Digital Imaging\bin\hpqste08.exe"="C:\Program Files\HP\Digital Imaging\bin\hpqste08.exe:*:Enabled:hpqste08.exe"
"C:\Program Files\HP\Digital Imaging\bin\hpofxm08.exe"="C:\Program Files\HP\Digital Imaging\bin\hpofxm08.exe:*:Enabled:hpofxm08.exe"
"C:\Program Files\HP\Digital Imaging\bin\hposfx08.exe"="C:\Program Files\HP\Digital Imaging\bin\hposfx08.exe:*:Enabled:hposfx08.exe"
"C:\Program Files\HP\Digital Imaging\bin\hposid01.exe"="C:\Program Files\HP\Digital Imaging\bin\hposid01.exe:*:Enabled:hposid01.exe"
"C:\Program Files\HP\Digital Imaging\bin\hpqscnvw.exe"="C:\Program Files\HP\Digital Imaging\bin\hpqscnvw.exe:*:Enabled:hpqscnvw.exe"
"C:\Program Files\HP\Digital Imaging\bin\hpqkygrp.exe"="C:\Program Files\HP\Digital Imaging\bin\hpqkygrp.exe:*:Enabled:hpqkygrp.exe"
"C:\Program Files\HP\Digital Imaging\bin\hpqCopy.exe"="C:\Program Files\HP\Digital Imaging\bin\hpqCopy.exe:*:Enabled:hpqcopy.exe"
"C:\Program Files\HP\Digital Imaging\bin\hpfccopy.exe"="C:\Program Files\HP\Digital Imaging\bin\hpfccopy.exe:*:Enabled:hpfccopy.exe"
"C:\Program Files\HP\Digital Imaging\bin\hpzwiz01.exe"="C:\Program Files\HP\Digital Imaging\bin\hpzwiz01.exe:*:Enabled:hpzwiz01.exe"
"C:\Program Files\HP\Digital Imaging\Unload\HpqPhUnl.exe"="C:\Program Files\HP\Digital Imaging\Unload\HpqPhUnl.exe:*:Enabled:hpqphunl.exe"
"C:\Program Files\HP\Digital Imaging\Unload\HpqDIA.exe"="C:\Program Files\HP\Digital Imaging\Unload\HpqDIA.exe:*:Enabled:hpqdia.exe"
"C:\Program Files\HP\Digital Imaging\bin\hpoews01.exe"="C:\Program Files\HP\Digital Imaging\bin\hpoews01.exe:*:Enabled:hpoews01.exe"
"C:\Program Files\HP\Digital Imaging\bin\hpqnrs08.exe"="C:\Program Files\HP\Digital Imaging\bin\hpqnrs08.exe:*:Enabled:hpqnrs08.exe"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\BitLord\BitLord.exe"="C:\Program Files\BitLord\BitLord.exe:*:Enabled:BitLord"
"C:\Program Files\Skype\Phone\Skype.exe"="C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype. Take a deep breath "
"C:\Program Files\Real\RealPlayer\realplay.exe"="C:\Program Files\Real\RealPlayer\realplay.exe:*:Enabled:RealPlayer"
"C:\Program Files\Mozilla Firefox\firefox.exe"="C:\Program Files\Mozilla Firefox\firefox.exe:*:Enabled:Firefox"
"C:\Program Files\AVG\AVG8\avgupd.exe"="C:\Program Files\AVG\AVG8\avgupd.exe:*:Enabled:avgupd.exe"
"C:\Program Files\AVG\AVG8\avgnsx.exe"="C:\Program Files\AVG\AVG8\avgnsx.exe:*:Enabled:avgnsx.exe"
"C:\Program Files\Smart PC Solutions\1-2-3 Spyware Free\SpywareFree.exe"="C:\Program Files\Smart PC Solutions\1-2-3 Spyware Free\SpywareFree.exe:*:Enabled:Protecting from spyware and adware can be easy and effective!"
"C:\Documents and Settings\Hanka\temp\TeamViewer\Version4\TeamViewer.exe"="C:\Documents and Settings\Hanka\temp\TeamViewer\Version4\TeamViewer.exe:*:Enabled:TeamViewer Remote Control Application"
"C:\Program Files\WIP Miranda IM 1.7\miranda32.exe"="C:\Program Files\WIP Miranda IM 1.7\miranda32.exe:*:Enabled:Miranda IM"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{449f5450-5ee0-11dc-9696-001641fcaa73}]
shell\AutoRun\command - RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013\ise32.exe
shell\open\command - RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013\ise32.exe


======List of files/folders created in the last 1 months======

2009-06-09 14:01:56 ----D---- C:\Program Files\trend micro
2009-06-09 14:01:54 ----D---- C:\rsit
2009-06-09 13:05:05 ----D---- C:\Documents and Settings\Hanka\Data aplikací\PC Tools
2009-06-09 13:05:05 ----D---- C:\Documents and Settings\All Users\Data aplikací\PC Tools
2009-06-09 12:55:37 ----D---- C:\Program Files\Common Files\PC Tools
2009-06-09 12:55:32 ----D---- C:\Program Files\Spyware Doctor
2009-06-09 10:21:14 ----A---- C:\Documents and Settings\All Users\Data aplikací\96503276.ini
2009-06-09 10:21:12 ----D---- C:\Documents and Settings\All Users\Data aplikací\96503276
2009-06-09 10:21:12 ----D---- C:\Documents and Settings\All Users\Data aplikací\16493284
2009-06-09 10:21:02 ----D---- C:\Program Files\WinPcap
2009-06-09 10:10:50 ----D---- C:\WINDOWS\Minidump
2009-06-08 22:00:27 ----A---- C:\WINDOWS\system32\mfc70.dll
2009-06-08 22:00:26 ----D---- C:\Program Files\AML Products
2009-05-21 23:30:22 ----A---- C:\WINDOWS\system32\ieencode.dll

======List of files/folders modified in the last 1 months======

2009-06-09 14:02:01 ----D---- C:\WINDOWS\Prefetch
2009-06-09 14:01:56 ----RD---- C:\Program Files
2009-06-09 14:00:32 ----A---- C:\WINDOWS\SchedLgU.Txt
2009-06-09 14:00:07 ----D---- C:\Program Files\Mozilla Firefox
2009-06-09 14:00:06 ----D---- C:\WINDOWS\Temp
2009-06-09 13:15:49 ----AD---- C:\Documents and Settings\All Users\Data aplikací\TEMP
2009-06-09 13:12:57 ----D---- C:\WINDOWS\system32\drivers
2009-06-09 13:11:52 ----D---- C:\WINDOWS
2009-06-09 12:55:37 ----D---- C:\Program Files\Common Files
2009-06-09 12:27:41 ----HD---- C:\$AVG8.VAULT$
2009-06-09 10:21:03 ----D---- C:\WINDOWS\system32
2009-06-09 10:10:00 ----RSHDC---- C:\WINDOWS\system32\dllcache
2009-06-09 10:09:51 ----D---- C:\WINDOWS\system32\CatRoot2
2009-06-08 22:15:23 ----D---- C:\Program Files\Codec Pack - All In 1
2009-06-06 21:43:10 ----D---- C:\Program Files\AVIConverter
2009-05-31 11:34:58 ----A---- C:\WINDOWS\wincmd.ini
2009-05-30 18:08:30 ----D---- C:\WINDOWS\Help
2009-05-24 16:59:37 ----HD---- C:\WINDOWS\inf
2009-05-22 22:33:00 ----A---- C:\WINDOWS\wcx_ftp.ini
2009-05-22 21:24:43 ----D---- C:\WINDOWS\system32\cs-cz
2009-05-22 21:24:42 ----D---- C:\WINDOWS\Media
2009-05-22 21:24:42 ----D---- C:\Program Files\Internet Explorer
2009-05-21 23:31:04 ----A---- C:\WINDOWS\imsins.BAK
2009-05-21 12:47:30 ----D---- C:\Documents and Settings\Hanka\Data aplikací\gtk-2.0
2009-05-14 23:29:49 ----SHD---- C:\WINDOWS\Installer
2009-05-14 23:29:49 ----HD---- C:\Config.Msi
2009-05-14 23:19:29 ----SD---- C:\Documents and Settings\Hanka\Data aplikací\Microsoft

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 AvgLdx86;AVG Free AVI Loader Driver x86; C:\WINDOWS\System32\Drivers\avgldx86.sys [2009-05-02 325896]
R1 AvgMfx86;AVG Free On-access Scanner Minifilter Driver x86; C:\WINDOWS\System32\Drivers\avgmfx86.sys [2009-05-02 27784]
R1 AvgTdiX;AVG Free8 Network Redirector; C:\WINDOWS\System32\Drivers\avgtdix.sys [2009-05-02 108552]
R1 intelppm;Řadič procesoru Intel; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2008-04-14 40192]
R1 Tosrfcom;Bluetooth RFCOMM from TOSHIBA; C:\WINDOWS\System32\Drivers\tosrfcom.sys [2005-08-01 64896]
R2 npf;NetGroup Packet Filter Driver; C:\WINDOWS\system32\drivers\npf.sys [2007-11-15 34064]
R3 CmBatt;Microsoft AC Adapter Driver; C:\WINDOWS\system32\DRIVERS\CmBatt.sys [2008-04-13 13952]
R3 HDAudBus;Ovladač Microsoft UAA pro sběrnici High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2008-04-13 144384]
R3 ialm;ialm; C:\WINDOWS\system32\DRIVERS\ialmnt5.sys [2006-03-23 1166972]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\WINDOWS\system32\drivers\RtkHDAud.sys [2006-07-24 4353024]
R3 NETw3x32;Ovladač adaptéru Intel(R) PRO/Wireless 3945ABG pro Windows XP 32 Bit; C:\WINDOWS\system32\DRIVERS\NETw3x32.sys [2006-09-27 1709696]
R3 nm;Ovladač programu Sledování sítě; C:\WINDOWS\system32\DRIVERS\NMnt.sys [2008-04-13 40320]
R3 smserial;smserial; C:\WINDOWS\system32\DRIVERS\smserial.sys [2006-01-20 862340]
R3 tosporte;Bluetooth Port Driver from Toshiba; C:\WINDOWS\system32\DRIVERS\tosporte.sys [2006-02-10 47488]
R3 Tosrfbd;Bluetooth RFBUS from TOSHIBA; C:\WINDOWS\System32\Drivers\tosrfbd.sys [2006-04-13 108928]
R3 Tosrfbnp;Bluetooth RFBNEP from TOSHIBA; C:\WINDOWS\System32\Drivers\tosrfbnp.sys [2006-03-16 37632]
R3 Tosrfhid;Bluetooth RFHID from TOSHIBA; C:\WINDOWS\system32\DRIVERS\Tosrfhid.sys [2006-02-08 62848]
R3 Tosrfusb;Bluetooth USB Controller; C:\WINDOWS\System32\Drivers\tosrfusb.sys [2006-02-24 40192]
R3 usbehci;Ovladač miniportu rozšířeného radiče hostitele Microsoft USB 2.0; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2008-04-13 30208]
R3 usbhub;Rozbočovač umožnující USB2; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2008-04-13 59520]
R3 usbuhci;Ovladač Microsoft univerzálního hostitelského řadiče USB od společnosti Microsoft; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2008-04-13 20608]
S1 llt30ae;llt30ae; C:\WINDOWS\System32\drivers\llt30ae.sys [2009-06-08 33888]
S3 BthEnum;Služba Bluetooth Enumerator; C:\WINDOWS\system32\DRIVERS\BthEnum.sys [2008-04-13 17024]
S3 BthPan;Bluetooth Device (Personal Area Network); C:\WINDOWS\system32\DRIVERS\bthpan.sys [2008-04-13 101120]
S3 BTHPORT;Ovladač portu Bluetooth; C:\WINDOWS\System32\Drivers\BTHport.sys [2008-06-14 272128]
S3 BTHUSB;Ovladač rozhraní USB radiostanice Bluetooth; C:\WINDOWS\System32\Drivers\BTHUSB.sys [2008-04-13 18944]
S3 CCDECODE;Dekodér Closed Caption; C:\WINDOWS\system32\DRIVERS\CCDECODE.sys [2008-04-13 17024]
S3 HidUsb;Ovladač třídy standardu HID; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-13 10368]
S3 HPZid412;IEEE-1284.4 Driver HPZid412; C:\WINDOWS\system32\DRIVERS\HPZid412.sys [2006-04-13 49664]
S3 HPZipr12;Print Class Driver for IEEE-1284.4 HPZipr12; C:\WINDOWS\system32\DRIVERS\HPZipr12.sys [2006-04-13 16496]
S3 HPZius12;USB to IEEE-1284.4 Translation Driver HPZius12; C:\WINDOWS\system32\DRIVERS\HPZius12.sys [2006-04-13 21568]
S3 mod7700;DiBcom DIB7700 based TV tuner device; C:\WINDOWS\System32\Drivers\dvb7700all.sys [2008-03-25 444800]
S3 mouhid;Ovladač myši standardu HID; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-10-24 12160]
S3 MPE;Filtr MPE BDA; C:\WINDOWS\system32\DRIVERS\MPE.sys [2008-04-13 15232]
S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink Converter; C:\WINDOWS\system32\drivers\MSTEE.sys [2008-04-13 5504]
S3 NABTSFEC;NABTS/FEC VBI Codec; C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys [2008-04-13 85248]
S3 NdisIP;Microsoft TV/Video Connection; C:\WINDOWS\system32\DRIVERS\NdisIP.sys [2008-04-13 10880]
S3 RFCOMM;Zařízení Bluetooth (RFCOMM protokol TDI); C:\WINDOWS\system32\DRIVERS\rfcomm.sys [2008-04-13 59136]
S3 RTL8023xp;Realtek 10/100/1000 NIC Family all in one NDIS XP Driver; C:\WINDOWS\system32\DRIVERS\Rtnicxp.sys [2006-01-18 80512]
S3 rtl8139;Realtek RTL8139(A/B/C)-based PCI Fast Ethernet Adapter NT Driver; C:\WINDOWS\system32\DRIVERS\RTL8139.SYS [2004-08-04 20992]
S3 SLIP;BDA Slip De-Framer; C:\WINDOWS\system32\DRIVERS\SLIP.sys [2008-04-13 11136]
S3 streamip;BDA IPSink; C:\WINDOWS\system32\DRIVERS\StreamIP.sys [2008-04-13 15232]
S3 toshidpt;TOSHIBA Bluetooth HID port driver; C:\WINDOWS\system32\drivers\Toshidpt.sys [2005-07-11 3712]
S3 tosrfnds;Bluetooth Personal Area Network from TOSHIBA; C:\WINDOWS\system32\DRIVERS\tosrfnds.sys [2005-01-06 18612]
S3 TosRfSnd;Bluetooth Audio Device (WDM) from TOSHIBA; C:\WINDOWS\system32\drivers\TosRfSnd.sys [2006-03-15 52864]
S3 usbccgp;Obecný nadřazený ovladač Microsoft USB; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-13 32128]
S3 usbprint;Třída USB Printer; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2008-04-13 25856]
S3 usbscan;Ovladač skeneru USB; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2008-04-13 15104]
S3 USBSTOR;Ovladač velkokapacitního paměťového zařízení USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]
S3 VirtualFD;VirtualFD; \??\c:\utility\virtual A drive\vfd.sys []
S3 VNUSB;VN Series Device; C:\WINDOWS\system32\DRIVERS\VNUSB.sys [2003-12-15 38448]
S3 WSTCODEC;Dálnopisný kodek světového standardu; C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS [2008-04-13 19200]
S3 WudfPf;Windows Driver Foundation - User-mode Driver Framework Platform Driver; C:\WINDOWS\system32\DRIVERS\WudfPf.sys [2006-09-28 77568]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-28 82944]
S4 IntelIde;IntelIde; C:\WINDOWS\system32\drivers\IntelIde.sys []
S4 sr;Ovladač filtru Obnovy systému; C:\WINDOWS\system32\DRIVERS\sr.sys [2008-04-14 73344]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 aawservice;Lavasoft Ad-Aware Service; C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe [2008-07-28 611664]
R2 avg8wd;AVG Free8 WatchDog; C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe [2009-05-02 298776]
R2 BthServ;Bluetooth Support Service; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
R2 Pml Driver HPZ12;Pml Driver HPZ12; C:\WINDOWS\system32\HPZipm12.exe [2006-03-03 69632]
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2007-04-13 33632]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2007-04-13 68952]
S3 sdAuxService;PC Tools Auxiliary Service; C:\Program Files\Spyware Doctor\pctsAuxs.exe [2009-01-07 348752]
S3 sdCoreService;PC Tools Security Service; C:\Program Files\Spyware Doctor\pctsSvc.exe [2009-06-07 1096584]
S3 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]

-----------------EOF-----------------


Odstranila jsem ten vir, nebo neodstranila? Natahal mi toho do PC víc? Jestli to má relevanci, tak před tím, než jsem se zbavila toho System Security jsem absolvovala asi třikrát za sebou BSOD a restart.
Předem dík za radu...

zdravim
system doctor je ADWARE,takze asi si este zavarila.
stiahnes z mojho podpisu Malwarebytes -MBAM-sprav rychly skan log vloz sem,pozriem sa na log a az potom ked ti to napisem pokracujes combofixom,ok

_________________
Dôležité informácie.

Počas liečby dodržujte inštrukcie a nerobte nič naviac a ani menej,,nespúšťajte žiaden iný program z vlastnej iniciatívy,,
Opravy a poradenstva v tomto vlákne sú len pre tento stroj. Neprenášajte pokyny z tohto vlákna na váš počítač,môžete poškodiť systém



Thanks! Vďaka!

Díky moc.

Malwarebytes' Anti-Malware 1.37
Verze databáze: 2254
Windows 5.1.2600 Service Pack 3

9.6.2009 17:11:56
mbam-log-2009-06-09 (17-11-48).txt

Typ skenu: Rychlý sken
Objektu skenováno: 79113
Uplynulý cas: 6 minute(s), 42 second(s)

Infikované procesy pameti: 0
Infikované pametové moduly: 0
Infikované klíce registru: 0
Infikované hodnoty registru: 1
Infikované položky dat registru: 0
Infikované složky: 0
Infikované soubory: 9

Infikované procesy pameti:
(Žádné zákerné položky nebyly zjišteny)

Infikované pametové moduly:
(Žádné zákerné položky nebyly zjišteny)

Infikované klíce registru:
(Žádné zákerné položky nebyly zjišteny)

Infikované hodnoty registru:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\PromoReg (Trojan.Agent) -> No action taken.

Infikované položky dat registru:
(Žádné zákerné položky nebyly zjišteny)

Infikované složky:
(Žádné zákerné položky nebyly zjišteny)

Infikované soubory:
c:\RECYCLER\s-1-5-21-1214440339-1563985344-839522115-1003\Dc207.tmp (Trojan.Agent) -> No action taken.
c:\WINDOWS\Temp\TMP6.tmp (Trojan.Dropper) -> No action taken.
c:\documents and settings\Hanka\local settings\temporary internet files\Content.IE5\DV1VA0H7\load[1].exe (Trojan.Agent) -> No action taken.
c:\WINDOWS\Temp\wpv831243627542.exe (Trojan.Agent) -> No action taken.
C:\WINDOWS\rundll16.exe (Fake.Dropped.Malware) -> No action taken.
C:\WINDOWS\system32\vcmgcd32.dll (Trojan.Agent) -> No action taken.
C:\WINDOWS\system32\systems.txt (Trojan.Vundo) -> No action taken.
C:\WINDOWS\logo1_.exe (Worm.Viking) -> No action taken.
c:\documents and settings\Hanka\Data aplikací\wiaserva.log (Malware.Trace) -> No action taken.

dobre,zmaz vsetko co MBAM nasiel a spust podla navodu combofix,

_________________
Dôležité informácie.

Počas liečby dodržujte inštrukcie a nerobte nič naviac a ani menej,,nespúšťajte žiaden iný program z vlastnej iniciatívy,,
Opravy a poradenstva v tomto vlákne sú len pre tento stroj. Neprenášajte pokyny z tohto vlákna na váš počítač,môžete poškodiť systém



Thanks! Vďaka!

Smazala jsem to, ale řeklo mi to, že 4 soubory nebylo možné smazat a že se to smaže po restartu. Takže restart, ale po pár vteřinách BSOD a restart. Než naběhla přihlašovací obrazovka do Windows, zase BSOD a restart, to se neustále opakovalo, tak jsem to vzala přes nouzový režim, tam jsem to ještě jednou spustila, jestli se to fakt smazalo. Nesmazalo, takže se to dopromázlo v nouzovém režimu.
Po prvním spuštění Combofix opět BSOD. Druhý pokus vyšel. Ale hlásilo mi to, že AVG stále běží, i když jsem ho zavřela (vpravo u hodin), asi ho tedy neumím vypnout
Viditelné změny dvě - na ploše se mi zničehonic objevila ikona Internet Explorer a obrázek na ploše se sám od sebe roztáhl (byl na středu).

Log z Combofix:
ComboFix 09-06-09.01 - Hanka 09.06.2009 20:43.1 - NTFSx86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.420.1029.18.1014.655 [GMT 2:00]
Spuštěný z: c:\documents and settings\Hanka\Plocha\ComboFix.exe
AV: AVG Anti-Virus Free *On-access scanning enabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\program files\WinPCap
c:\program files\WinPCap\rpcapd.exe
c:\windows\regedit.com
c:\windows\system32\drivers\2785aad9.sys
c:\windows\system32\drivers\a53a6da7.sys
c:\windows\system32\drivers\beep.sys
c:\windows\system32\drivers\e55b926d.sys
c:\windows\system32\drivers\npf.sys
c:\windows\system32\Packet.dll
c:\windows\system32\pthreadVC.dll
c:\windows\system32\sysmwwod.dll
c:\windows\system32\taskmgr.com
c:\windows\system32\WanPacket.dll
c:\windows\system32\wpcap.dll

.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_NPF
-------\Service_npf


((((((((((((((((((((((((( Soubory vytvořené od 2009-05-09 do 2009-06-09 )))))))))))))))))))))))))))))))
.

2009-06-09 18:31 . 2001-10-25 12:00 4224 -c--a-w- c:\windows\system32\dllcache\beep.sys
2009-06-09 18:19 . 2009-06-09 18:19 -------- d--h--w- c:\documents and settings\Administrator\Šablony
2009-06-09 18:19 . 2009-06-09 18:19 -------- d--h--w- c:\documents and settings\Administrator\Data aplikací
2009-06-09 18:19 . 2009-06-09 18:19 -------- d-----w- c:\documents and settings\Administrator
2009-06-09 18:19 . 2009-06-09 18:19 -------- d-----w- c:\documents and settings\Administrator\Nabídka Start
2009-06-09 15:03 . 2009-05-26 11:20 40160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-06-09 15:03 . 2009-06-09 15:03 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-06-09 15:03 . 2009-05-26 11:19 19096 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-06-09 12:01 . 2009-06-09 12:02 -------- d-----w- c:\program files\trend micro
2009-06-09 12:01 . 2009-06-09 12:02 -------- d-----w- C:\rsit
2009-06-09 11:05 . 2009-04-03 09:18 130936 ----a-w- c:\windows\system32\drivers\PCTCore.sys
2009-06-09 11:05 . 2008-12-18 10:16 73840 ----a-w- c:\windows\system32\drivers\PCTAppEvent.sys
2009-06-09 11:05 . 2008-12-10 09:36 64392 ----a-w- c:\windows\system32\drivers\pctplsg.sys
2009-06-09 10:55 . 2009-06-09 11:08 -------- d-----w- c:\program files\Common Files\PC Tools
2009-06-09 10:55 . 2009-06-09 11:06 -------- d-----w- c:\program files\Spyware Doctor
2009-06-08 20:00 . 2002-01-05 04:48 974848 ----a-w- c:\windows\system32\mfc70.dll
2009-06-08 20:00 . 2009-06-08 20:00 -------- d-----w- c:\program files\AML Products
2009-06-08 19:55 . 2009-06-08 19:55 33888 ----a-w- c:\windows\system32\drivers\llt30ae.sys
2009-05-22 08:45 . 2009-05-22 08:45 -------- d-sh--w- c:\documents and settings\Hanka\PrivacIE
2009-05-22 07:42 . 2009-05-22 07:42 -------- d-sh--w- c:\documents and settings\Hanka\IETldCache
2009-05-21 21:30 . 2009-02-20 17:13 78336 ----a-w- c:\windows\system32\ieencode.dll
2009-05-21 21:30 . 2009-02-20 17:13 78336 ----a-w- c:\windows\system32\dllcache\ieencode.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-06-09 18:18 . 2007-09-09 13:14 90112 ----a-w- c:\windows\DUMP7407.tmp
2009-06-09 18:15 . 2007-09-09 13:14 90112 ----a-w- c:\windows\DUMP75bc.tmp
2009-06-09 18:15 . 2007-09-09 13:14 90112 ----a-w- c:\windows\DUMP7678.tmp
2009-06-08 20:15 . 2007-09-09 12:12 -------- d-----w- c:\program files\Codec Pack - All In 1
2009-06-06 19:43 . 2008-07-01 13:41 -------- d-----w- c:\program files\AVIConverter
2009-05-09 20:18 . 2007-10-14 14:34 -------- d-----w- c:\program files\SpeedFan
2009-05-02 07:59 . 2009-03-13 11:33 11952 ----a-w- c:\windows\system32\avgrsstx.dll
2009-05-02 07:59 . 2009-03-13 11:33 325896 ----a-w- c:\windows\system32\drivers\avgldx86.sys
2009-05-02 07:59 . 2009-03-13 11:33 27784 ----a-w- c:\windows\system32\drivers\avgmfx86.sys
2009-05-02 07:59 . 2009-03-13 11:33 108552 ----a-w- c:\windows\system32\drivers\avgtdix.sys
2009-04-30 21:13 . 2009-04-30 20:31 -------- d-----w- c:\program files\Mp3 File Editor
2009-04-15 16:33 . 2001-10-25 12:00 69114 ----a-w- c:\windows\system32\perfc005.dat
2009-04-15 16:33 . 2001-10-25 12:00 390176 ----a-w- c:\windows\system32\perfh005.dat
2009-04-12 20:22 . 2008-07-31 15:14 -------- d-----w- c:\program files\Burn4Free
2009-04-11 09:43 . 2007-09-22 17:02 -------- d-----w- c:\program files\audiograbber
.

(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"PMCLoader"="c:\program files\Pinnacle\TVCenter Pro\PMCLoader.exe" [2008-03-27 644368]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2009-01-04 185872]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-05-02 1947928]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-05-02 1947928]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

c:\documents and settings\Hanka\Nabˇdka Start\Programy\Po spuçtŘnˇ\
rncsys32.exe [2008-4-14 29184]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2009-05-02 07:59 11952 ----a-w- c:\windows\system32\avgrsstx.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdauxservice]
@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdcoreservice]
@=""

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"CTFMON.EXE"=c:\windows\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"SkyTel"=SkyTel.EXE
"Alcmtr"=ALCMTR.EXE
"RTHDCPL"=RTHDCPL.EXE
"igfxhkcmd"=c:\windows\system32\hkcmd.exe
"HP Software Update"=c:\program files\HP\HP Software Update\HPWuSchd2.exe
"igfxtray"=c:\windows\system32\igfxtray.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\G6 FTP Server\\G6FTPSrv.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\BitLord\\BitLord.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\Real\\RealPlayer\\realplay.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgupd.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgnsx.exe"=
"c:\\Program Files\\Smart PC Solutions\\1-2-3 Spyware Free\\SpywareFree.exe"=
"c:\\Documents and Settings\\Hanka\\temp\\TeamViewer\\Version4\\TeamViewer.exe"=
"c:\\Program Files\\WIP Miranda IM 1.7\\miranda32.exe"=

R0 PCTCore;PCTools KDS;c:\windows\system32\drivers\PCTCore.sys [9.6.2009 13:05 130936]
R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [13.3.2009 13:33 325896]
R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [13.3.2009 13:33 108552]
R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [13.3.2009 13:33 298776]
S0 cpzte;cpzte;c:\windows\system32\drivers\ckojz.sys --> c:\windows\system32\drivers\ckojz.sys [?]
S1 llt30ae;llt30ae;c:\windows\system32\drivers\llt30ae.sys [8.6.2009 21:55 33888]
S3 sdAuxService;PC Tools Auxiliary Service;c:\program files\Spyware Doctor\pctsAuxs.exe [9.6.2009 13:05 348752]
.
Obsah adresáře 'Naplánované úlohy'
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -

HKCU-Run-PMCRemote - (no file)
SafeBoot-procexp90.Sys


.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.seznam.cz/
uInternet Settings,ProxyServer = proxy.mlp.cz:3128
IE: E&xportovat do aplikace Microsoft Office Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - hxxp://download.eset.com/special/eos-be ... canner.cab
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-06-09 20:48
Windows 5.1.2600 Service Pack 3 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"PromoReg"="c:\\WINDOWS\\System32\\svchost.exe"
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"cd042efbbd7f7af1647644e76e06692b"=hex:2e,e8,e1,00,eb,16,2b,de,08,c0,4c,bd,97,
04,2b,14,e2,63,26,f1,3f,c8,ff,68,43,37,07,14,1b,d3,17,6b,e2,63,26,f1,3f,c8,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"bca643cdc5c2726b20d2ecedcc62c59b"=hex:46,47,15,b0,92,4b,c7,ef,b8,64,43,4d,c8,
0d,08,68,6a,9c,d6,61,af,45,84,18,88,04,e8,d3,8d,27,97,d4,6a,9c,d6,61,af,45,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"2c81e34222e8052573023a60d06dd016"=hex:25,da,ec,7e,55,20,c9,26,58,a7,88,8d,b4,
f5,24,d6,ff,7c,85,e0,43,d4,0e,fe,9b,42,69,37,57,78,ae,64,ff,7c,85,e0,43,d4,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"2582ae41fb52324423be06337561aa48"=hex:3e,1e,9e,e0,57,5a,93,61,42,4e,00,6b,8e,
9a,f1,bc,86,8c,21,01,be,91,eb,e7,d8,7f,15,19,24,85,bc,48,86,8c,21,01,be,91,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"caaeda5fd7a9ed7697d9686d4b818472"=hex:cd,44,cd,b9,a6,33,6c,cd,57,7d,d2,bb,56,
5a,88,88,f5,1d,4d,73,a8,13,5c,05,6c,c4,55,33,7f,6f,a4,ae,f5,1d,4d,73,a8,13,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"a4a1bcf2cc2b8bc3716b74b2b4522f5d"=hex:50,93,e5,ab,ec,6a,4e,ab,e7,b9,71,c0,fe,
b7,ef,70,df,20,58,62,78,6b,cf,c8,40,cb,c1,ee,f0,bd,fb,3f,df,20,58,62,78,6b,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"4d370831d2c43cd13623e232fed27b7b"=hex:97,20,4e,9a,c7,f1,35,ee,79,c8,79,28,ab,
0f,a0,42,fb,a7,78,e6,12,2f,9a,ea,95,9f,48,5c,40,d6,9f,6d,fb,a7,78,e6,12,2f,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"1d68fe701cdea33e477eb204b76f993d"=hex:01,3a,48,fc,e8,04,4a,f1,21,fd,0e,d1,a9,
bb,33,52,01,3a,48,fc,e8,04,4a,f1,a4,ad,6b,49,f7,d6,66,3f,01,3a,48,fc,e8,04,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"1fac81b91d8e3c5aa4b0a51804d844a3"=hex:51,fa,6e,91,28,9e,14,cc,89,79,a2,ed,42,
35,f3,99,f6,0f,4e,58,98,5b,89,c9,0a,4a,d0,54,ff,05,1b,24,f6,0f,4e,58,98,5b,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"f5f62a6129303efb32fbe080bb27835b"=hex:3d,ce,ea,26,2d,45,aa,78,ae,7c,b5,93,a6,
25,b7,fe,3d,ce,ea,26,2d,45,aa,78,bf,45,12,e2,05,c7,d3,a2,3d,ce,ea,26,2d,45,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"fd4e2e1a3940b94dceb5a6a021f2e3c6"=hex:e3,0e,66,d5,eb,bc,2f,6b,58,f2,90,3b,c6,
15,20,09,2a,b7,cc,b5,b9,7f,41,e7,f4,61,dc,b5,7e,b6,8b,e8,2a,b7,cc,b5,b9,7f,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"8a8aec57dd6508a385616fbc86791ec2"=hex:fa,ea,66,7f,d4,3b,6b,70,cb,e0,0f,99,5e,
9d,21,ae,6c,43,2d,1e,aa,22,2f,9c,d9,bd,ad,4c,0b,d3,ec,06,6c,43,2d,1e,aa,22,\
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'explorer.exe'(1664)
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\program files\Lavasoft\Ad-Aware\aawservice.exe
c:\windows\system32\HPZipm12.exe
c:\program files\AVG\AVG8\avgrsx.exe
c:\progra~1\AVG\AVG8\avgnsx.exe
c:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Celkový čas: 2009-06-09 20:51 - počítač byl restartován
ComboFix-quarantined-files.txt 2009-06-09 18:51

Před spuštěním: Volných bajtů: 55 278 108 672
Po spuštění: Volných bajtů: 55 308 058 624

WindowsXP-KB310994-SP2-Pro-BootDisk-CSY.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /FASTDETECT

254 --- E O F --- 2009-05-21 21:31

Pravy klik na ikonu AVG-vedla hodin>Moznosti-upresnit-a tu zatvor rezident,,AVG
Pri tejto akcii je nutné mať ComboFix na ploche.

Vypni>FIREWALL>Antivir>Antispyware>vsetko rezidentne.

Otvor Notepad (Poznámkový blok) a zkopíruj do neho celý zeleny tex:

Potom klik na Subor -> Uložiť ako.. .. -> Ako je Názov souboru tak do toho riadku napiš:CFScript.txt
Typ súboru tak tam vyberies *všetky súbory
A ulož ho na plochu.> Pozor CFScript.txt>Neotvarat a nemoze byt ani>CFScript.txt.txt A Urobis Toto :


Po skonceni skenu vlož log čo ComboFix vytvorí

_________________
Dôležité informácie.

Počas liečby dodržujte inštrukcie a nerobte nič naviac a ani menej,,nespúšťajte žiaden iný program z vlastnej iniciatívy,,
Opravy a poradenstva v tomto vlákne sú len pre tento stroj. Neprenášajte pokyny z tohto vlákna na váš počítač,môžete poškodiť systém



Thanks! Vďaka!

ComboFix 09-06-09.01 - Hanka 09.06.2009 21:50.2 - NTFSx86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.420.1029.18.1014.530 [GMT 2:00]
Spuštěný z: c:\documents and settings\Hanka\Plocha\ComboFix.exe
Použité ovládací přepínače :: c:\documents and settings\Hanka\Plocha\CFScript.txt
AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}

FILE ::
"c:\documents and settings\Hanka\Nabídka Start\Programy\Po spuštění\rncsys32.exe"
"c:\windows\DUMP7407.tmp"
"c:\windows\DUMP75bc.tmp"
"c:\windows\DUMP7678.tmp"
"c:\windows\system32\drivers\llt30ae.sys"
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\Hanka\Nabídka Start\Programy\Po spuštění\rncsys32.exe
c:\windows\DUMP7407.tmp
c:\windows\DUMP75bc.tmp
c:\windows\DUMP7678.tmp
c:\windows\system32\drivers\llt30ae.sys

.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Service_cpzte
-------\Service_llt30ae


((((((((((((((((((((((((( Soubory vytvořené od 2009-05-09 do 2009-06-09 )))))))))))))))))))))))))))))))
.

2009-06-09 18:31 . 2001-10-25 12:00 4224 -c--a-w- c:\windows\system32\dllcache\beep.sys
2009-06-09 18:19 . 2009-06-09 18:19 -------- d--h--w- c:\documents and settings\Administrator\Šablony
2009-06-09 18:19 . 2009-06-09 18:19 -------- d--h--w- c:\documents and settings\Administrator\Data aplikací
2009-06-09 18:19 . 2009-06-09 18:19 -------- d-----w- c:\documents and settings\Administrator
2009-06-09 18:19 . 2009-06-09 18:19 -------- d-----w- c:\documents and settings\Administrator\Nabídka Start
2009-06-09 15:03 . 2009-05-26 11:20 40160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-06-09 15:03 . 2009-06-09 15:03 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-06-09 15:03 . 2009-05-26 11:19 19096 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-06-09 12:01 . 2009-06-09 12:02 -------- d-----w- c:\program files\trend micro
2009-06-09 12:01 . 2009-06-09 12:02 -------- d-----w- C:\rsit
2009-06-09 11:05 . 2009-04-03 09:18 130936 ----a-w- c:\windows\system32\drivers\PCTCore.sys
2009-06-09 11:05 . 2008-12-18 10:16 73840 ----a-w- c:\windows\system32\drivers\PCTAppEvent.sys
2009-06-09 11:05 . 2008-12-10 09:36 64392 ----a-w- c:\windows\system32\drivers\pctplsg.sys
2009-06-09 10:55 . 2009-06-09 11:08 -------- d-----w- c:\program files\Common Files\PC Tools
2009-06-09 10:55 . 2009-06-09 11:06 -------- d-----w- c:\program files\Spyware Doctor
2009-06-08 20:00 . 2002-01-05 04:48 974848 ----a-w- c:\windows\system32\mfc70.dll
2009-06-08 20:00 . 2009-06-08 20:00 -------- d-----w- c:\program files\AML Products
2009-05-22 08:45 . 2009-05-22 08:45 -------- d-sh--w- c:\documents and settings\Hanka\PrivacIE
2009-05-22 07:42 . 2009-05-22 07:42 -------- d-sh--w- c:\documents and settings\Hanka\IETldCache
2009-05-21 21:30 . 2009-02-20 17:13 78336 ----a-w- c:\windows\system32\ieencode.dll
2009-05-21 21:30 . 2009-02-20 17:13 78336 ----a-w- c:\windows\system32\dllcache\ieencode.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-06-08 20:15 . 2007-09-09 12:12 -------- d-----w- c:\program files\Codec Pack - All In 1
2009-06-06 19:43 . 2008-07-01 13:41 -------- d-----w- c:\program files\AVIConverter
2009-05-09 20:18 . 2007-10-14 14:34 -------- d-----w- c:\program files\SpeedFan
2009-05-02 07:59 . 2009-03-13 11:33 11952 ----a-w- c:\windows\system32\avgrsstx.dll
2009-05-02 07:59 . 2009-03-13 11:33 325896 ----a-w- c:\windows\system32\drivers\avgldx86.sys
2009-05-02 07:59 . 2009-03-13 11:33 27784 ----a-w- c:\windows\system32\drivers\avgmfx86.sys
2009-05-02 07:59 . 2009-03-13 11:33 108552 ----a-w- c:\windows\system32\drivers\avgtdix.sys
2009-04-30 21:13 . 2009-04-30 20:31 -------- d-----w- c:\program files\Mp3 File Editor
2009-04-15 16:33 . 2001-10-25 12:00 69114 ----a-w- c:\windows\system32\perfc005.dat
2009-04-15 16:33 . 2001-10-25 12:00 390176 ----a-w- c:\windows\system32\perfh005.dat
2009-04-12 20:22 . 2008-07-31 15:14 -------- d-----w- c:\program files\Burn4Free
2009-04-11 09:43 . 2007-09-22 17:02 -------- d-----w- c:\program files\audiograbber
.

((((((((((((((((((((((((((((( SnapShot@2009-06-09_18.48.33 )))))))))))))))))))))))))))))))))))))))))
.
+ 2007-09-09 11:33 . 2009-06-09 18:48 65536 c:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"PMCLoader"="c:\program files\Pinnacle\TVCenter Pro\PMCLoader.exe" [2008-03-27 644368]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2009-01-04 185872]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-05-02 1947928]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2009-05-02 07:59 11952 ----a-w- c:\windows\system32\avgrsstx.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdauxservice]
@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdcoreservice]
@=""

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"CTFMON.EXE"=c:\windows\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"SkyTel"=SkyTel.EXE
"Alcmtr"=ALCMTR.EXE
"RTHDCPL"=RTHDCPL.EXE
"igfxhkcmd"=c:\windows\system32\hkcmd.exe
"HP Software Update"=c:\program files\HP\HP Software Update\HPWuSchd2.exe
"igfxtray"=c:\windows\system32\igfxtray.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\G6 FTP Server\\G6FTPSrv.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\BitLord\\BitLord.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\Real\\RealPlayer\\realplay.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgupd.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgnsx.exe"=
"c:\\Program Files\\Smart PC Solutions\\1-2-3 Spyware Free\\SpywareFree.exe"=
"c:\\Documents and Settings\\Hanka\\temp\\TeamViewer\\Version4\\TeamViewer.exe"=
"c:\\Program Files\\WIP Miranda IM 1.7\\miranda32.exe"=

R0 PCTCore;PCTools KDS;c:\windows\system32\drivers\PCTCore.sys [9.6.2009 13:05 130936]
R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [13.3.2009 13:33 325896]
R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [13.3.2009 13:33 108552]
R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [13.3.2009 13:33 298776]
S3 sdAuxService;PC Tools Auxiliary Service;c:\program files\Spyware Doctor\pctsAuxs.exe [9.6.2009 13:05 348752]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.seznam.cz/
uInternet Settings,ProxyServer = proxy.mlp.cz:3128
IE: E&xportovat do aplikace Microsoft Office Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - hxxp://download.eset.com/special/eos-be ... canner.cab
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-06-09 21:54
Windows 5.1.2600 Service Pack 3 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"cd042efbbd7f7af1647644e76e06692b"=hex:2e,e8,e1,00,eb,16,2b,de,f8,d9,0e,2b,a3,
ab,4e,24,e2,63,26,f1,3f,c8,ff,68,43,37,07,14,1b,d3,17,6b,e2,63,26,f1,3f,c8,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"bca643cdc5c2726b20d2ecedcc62c59b"=hex:71,3b,04,66,8b,46,0d,96,e8,e2,cd,1e,e6,
ad,65,c5,6a,9c,d6,61,af,45,84,18,88,04,e8,d3,8d,27,97,d4,6a,9c,d6,61,af,45,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"2c81e34222e8052573023a60d06dd016"=hex:ff,7c,85,e0,43,d4,0e,fe,d0,b2,72,85,16,
67,12,2e,ff,7c,85,e0,43,d4,0e,fe,9b,42,69,37,57,78,ae,64,ff,7c,85,e0,43,d4,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"2582ae41fb52324423be06337561aa48"=hex:86,8c,21,01,be,91,eb,e7,e9,d9,2d,63,ca,
f7,09,06,86,8c,21,01,be,91,eb,e7,d8,7f,15,19,24,85,bc,48,86,8c,21,01,be,91,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"caaeda5fd7a9ed7697d9686d4b818472"=hex:f5,1d,4d,73,a8,13,5c,05,e0,60,a9,7d,7e,
7c,e2,45,f5,1d,4d,73,a8,13,5c,05,6c,c4,55,33,7f,6f,a4,ae,f5,1d,4d,73,a8,13,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"a4a1bcf2cc2b8bc3716b74b2b4522f5d"=hex:df,20,58,62,78,6b,cf,c8,2f,81,ed,71,19,
55,2b,0a,df,20,58,62,78,6b,cf,c8,40,cb,c1,ee,f0,bd,fb,3f,df,20,58,62,78,6b,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"4d370831d2c43cd13623e232fed27b7b"=hex:31,77,e1,ba,b1,f8,68,02,4a,06,85,83,13,
78,8a,73,fb,a7,78,e6,12,2f,9a,ea,95,9f,48,5c,40,d6,9f,6d,fb,a7,78,e6,12,2f,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"1d68fe701cdea33e477eb204b76f993d"=hex:83,6c,56,8b,a0,85,96,ab,3d,42,3c,54,51,
ad,f8,64,01,3a,48,fc,e8,04,4a,f1,a4,ad,6b,49,f7,d6,66,3f,01,3a,48,fc,e8,04,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"1fac81b91d8e3c5aa4b0a51804d844a3"=hex:f6,0f,4e,58,98,5b,89,c9,29,df,6a,40,59,
e1,43,29,f6,0f,4e,58,98,5b,89,c9,0a,4a,d0,54,ff,05,1b,24,f6,0f,4e,58,98,5b,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"f5f62a6129303efb32fbe080bb27835b"=hex:b1,cd,45,5a,a8,c4,f8,b9,e5,b0,57,2e,3f,
cb,b3,c4,3d,ce,ea,26,2d,45,aa,78,bf,45,12,e2,05,c7,d3,a2,3d,ce,ea,26,2d,45,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"fd4e2e1a3940b94dceb5a6a021f2e3c6"=hex:e3,0e,66,d5,eb,bc,2f,6b,31,d8,c5,c5,da,
05,c4,31,2a,b7,cc,b5,b9,7f,41,e7,f4,61,dc,b5,7e,b6,8b,e8,2a,b7,cc,b5,b9,7f,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"8a8aec57dd6508a385616fbc86791ec2"=hex:6c,43,2d,1e,aa,22,2f,9c,5c,6a,a7,1a,38,
7b,bc,57,6c,43,2d,1e,aa,22,2f,9c,d9,bd,ad,4c,0b,d3,ec,06,6c,43,2d,1e,aa,22,\
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'explorer.exe'(3964)
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\program files\Lavasoft\Ad-Aware\aawservice.exe
c:\windows\system32\HPZipm12.exe
c:\program files\AVG\AVG8\avgrsx.exe
c:\progra~1\AVG\AVG8\avgnsx.exe
c:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Celkový čas: 2009-06-09 21:57 - počítač byl restartován
ComboFix-quarantined-files.txt 2009-06-09 19:57
ComboFix2.txt 2009-06-09 18:51

Před spuštěním: Volných bajtů: 55 322 005 504
Po spuštění: Volných bajtů: 55 308 832 768

234 --- E O F --- 2009-05-21 21:31

ako sa chova pc??

_________________
Dôležité informácie.

Počas liečby dodržujte inštrukcie a nerobte nič naviac a ani menej,,nespúšťajte žiaden iný program z vlastnej iniciatívy,,
Opravy a poradenstva v tomto vlákne sú len pre tento stroj. Neprenášajte pokyny z tohto vlákna na váš počítač,môžete poškodiť systém



Thanks! Vďaka!

Na první pohled teď už normálně. Kromě toho, že spuštění Combofixu asi mění to roztažení obrázku na ploše (teď při tom novém logu zase).
Vypadá to podle logu už ok?

akeho obrazku??

_________________
Dôležité informácie.

Počas liečby dodržujte inštrukcie a nerobte nič naviac a ani menej,,nespúšťajte žiaden iný program z vlastnej iniciatívy,,
Opravy a poradenstva v tomto vlákne sú len pre tento stroj. Neprenášajte pokyny z tohto vlákna na váš počítač,môžete poškodiť systém



Thanks! Vďaka!

Pozadí plochy.

to je ok,
Este stiahni Malwarebytes-MBAM z mojho podpisu a sprav rychly skan,log vloz sem,

_________________
Dôležité informácie.

Počas liečby dodržujte inštrukcie a nerobte nič naviac a ani menej,,nespúšťajte žiaden iný program z vlastnej iniciatívy,,
Opravy a poradenstva v tomto vlákne sú len pre tento stroj. Neprenášajte pokyny z tohto vlákna na váš počítač,môžete poškodiť systém



Thanks! Vďaka!

Tohle jsem tedy ještě teď odstranila pomocí přidat nebo odebrat programy pod ovládacími panely. Chtělo to poté restart, dostalo ho to. Počítač ani teď nevykazuje žádné abnormality nápadné laikovi.

Log:
Malwarebytes' Anti-Malware 1.37
Verze databáze: 2254
Windows 5.1.2600 Service Pack 3

9.6.2009 22:29:05
mbam-log-2009-06-09 (22-28-53).txt

Typ skenu: Rychlý sken
Objektu skenováno: 81984
Uplynulý cas: 5 minute(s), 0 second(s)

Infikované procesy pameti: 0
Infikované pametové moduly: 0
Infikované klíce registru: 0
Infikované hodnoty registru: 0
Infikované položky dat registru: 0
Infikované složky: 0
Infikované soubory: 1

Infikované procesy pameti:
(Žádné zákerné položky nebyly zjišteny)

Infikované pametové moduly:
(Žádné zákerné položky nebyly zjišteny)

Infikované klíce registru:
(Žádné zákerné položky nebyly zjišteny)

Infikované hodnoty registru:
(Žádné zákerné položky nebyly zjišteny)

Infikované položky dat registru:
(Žádné zákerné položky nebyly zjišteny)

Infikované složky:
(Žádné zákerné položky nebyly zjišteny)

Infikované soubory:
c:\documents and settings\Hanka\Data aplikací\wiaserva.log (Malware.Trace) -> No action taken.

ok,zmaz co MBAM nasiel,
klikni v mojom podpise na SVI-vypnut obnovu systemu-restart a zapnut spat


a ak vsetko bude ok,tot vse,

_________________
Dôležité informácie.

Počas liečby dodržujte inštrukcie a nerobte nič naviac a ani menej,,nespúšťajte žiaden iný program z vlastnej iniciatívy,,
Opravy a poradenstva v tomto vlákne sú len pre tento stroj. Neprenášajte pokyny z tohto vlákna na váš počítač,môžete poškodiť systém



Thanks! Vďaka!

Zdá se všechno ok, problémů tam bylo přes 600 a na konci se jen objevila hláška "Soubor: C:\WINDOWS\NIRCMD.exe nebyl nalezen. Toto je častý problém vznikající neúplnou odinstalací. Řešení: Vymazat hodnotu z registru."
Předpokládám, že to je nějaká prkotina, kterou můžu hodit za hlavu.

Ještě jednou mockrát děkuju za pomoc!