VIRY.CZ

Dobrý den, dostal se mi pod ruku jeden zavirovaný počítač a vůbec si sním nevím rady - prostě nejsem zas tak velký odborník ... po spuštění PC se hned objeví tabulka s názvem "Antimalware Doctor". poradí mi někdo jak se toho zbavit?

Logfile of random's system information tool 1.08 (written by random/random)
Run by David at 2010-08-02 17:17:56
Microsoft Windows XP Home Edition Service Pack 3
System drive C: has 44 GB (57%) free of 76 GB
Total RAM: 895 MB (52% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 17:18:41, on 2.8.2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\crypserv.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Google\Update\1.2.183.29\GoogleCrashHandler.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\ATRIS_~1\ORGANI~1.EXE
C:\Program Files\ATRis_Technik\jre\bin\java.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\OpenOffice.org 2.0\program\soffice.exe
C:\Program Files\OpenOffice.org 2.0\program\soffice.BIN
C:\Documents and Settings\David\Data aplikací\61D32724E0E35A4CD7DB4EDDDFC3233E\0015modulesetup.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\David\Plocha\RSIT.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\Program Files\trend micro\David.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.seznam.cz/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
O2 - BHO: Podpora odkazu pro Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG9\avgssie.dll (file missing)
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [0015modulesetup.exe] C:\Documents and Settings\David\Data aplikací\61D32724E0E35A4CD7DB4EDDDFC3233E\0015modulesetup.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: Antimalware Doctor.lnk = ?
O4 - Startup: monech32.exe
O4 - Startup: OpenOffice.org 2.0.lnk = C:\Program Files\OpenOffice.org 2.0\program\quickstart.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Proces mezipaměti kategorií součástí - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Microsoft ASPI Manager (aspimgr) - Unknown owner - C:\WINDOWS\system32\aspimgr.exe (file missing)
O23 - Service: Crypkey License - CrypKey (Canada) Ltd. - C:\WINDOWS\SYSTEM32\crypserv.exe
O23 - Service: ESET HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
O23 - Service: ESET Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: WorkshopDBService - Acresso - C:\PROGRA~1\ATRIS_~1\ORGANI~1.EXE

--
End of file - 5430 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\FRU Task #Hewlett-Packard#hp psc 1200 series#1251790299.job
C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
Podpora odkazu pro Adobe PDF Reader - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll [2006-10-22 62080]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}]
AVG Safe Search - C:\Program Files\AVG\AVG9\avgssie.dll []

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"=C:\WINDOWS\system32\NvCpl.dll [2006-10-31 7634944]
"NvMediaCenter"=C:\WINDOWS\system32\NvMcTray.dll [2006-10-31 86016]
"RTHDCPL"=C:\WINDOWS\RTHDCPL.EXE [2007-07-05 16380416]
"Alcmtr"=C:\WINDOWS\ALCMTR.EXE [2005-05-03 69632]
"BluetoothAuthenticationAgent"=bthprops.cpl,,BluetoothAuthenticationAgent []
"egui"=C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe [2009-11-16 2054360]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"=C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]
"0015modulesetup.exe"=C:\Documents and Settings\David\Data aplikací\61D32724E0E35A4CD7DB4EDDDFC3233E\0015modulesetup.exe [2010-08-02 1051136]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\d2fjscuwewk5]
C:\WINDOWS\Temp\m.270.tmp.exe []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Desktop Security]
C:\WINDOWS\system32\config\system [2010-08-02 5767168]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OperatingWindowsTM]
c:\program files\common files\microsoft shared\speech\1029\systemmicrosoft.exe []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SecurityCenter]
C:\WINDOWS\system32\config\system [2010-08-02 5767168]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WindowsOperating6.00.2900.2180]
C:\WINDOWS\TEMP\~TM42.tmp []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WindowsTMOperating]
c:\program files\common files\microsoft shared\speech\1029\systemmicrosoft.exe []

C:\Documents and Settings\David\Nabídka Start\Programy\Po spuštění
Antimalware Doctor.lnk - C:\Documents and Settings\David\Data aplikací\61D32724E0E35A4CD7DB4EDDDFC3233E\0015modulesetup.exe
monech32.exe
OpenOffice.org 2.0.lnk - C:\Program Files\OpenOffice.org 2.0\program\quickstart.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{1a3e09be-1e45-494b-9174-d7385b45bbf5}]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"HonorAutoRunSetting"=1

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"D:\Installation\Setupx.exe"="D:\Installation\Setupx.exe:*:Enabled:Nero ProductSetup"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\AVG\AVG9\avgemc.exe"="C:\Program Files\AVG\AVG9\avgemc.exe:*:Enabled:avgemc.exe"
"C:\Program Files\AVG\AVG9\avgupd.exe"="C:\Program Files\AVG\AVG9\avgupd.exe:*:Enabled:avgupd.exe"
"C:\Program Files\AVG\AVG9\avgnsx.exe"="C:\Program Files\AVG\AVG9\avgnsx.exe:*:Enabled:avgnsx.exe"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

======List of files/folders created in the last 1 months======

2010-08-02 17:17:56 ----D---- C:\rsit
2010-08-02 17:17:56 ----D---- C:\Program Files\trend micro
2010-08-02 16:36:31 ----D---- C:\Documents and Settings\David\Data aplikací\61D32724E0E35A4CD7DB4EDDDFC3233E
2010-08-02 14:17:51 ----D---- C:\Program Files\ESET
2010-08-02 14:17:51 ----D---- C:\Documents and Settings\All Users\Data aplikací\ESET
2010-08-02 13:55:22 ----D---- C:\Program Files\AVG
2010-08-02 13:50:04 ----D---- C:\WINDOWS\system32\1033
2010-08-02 13:50:04 ----D---- C:\WINDOWS\system32\1029
2010-08-02 12:56:30 ----D---- C:\WINDOWS\pss
2010-08-02 12:42:48 ----A---- C:\WINDOWS\gs32.txt
2010-08-02 11:58:55 ----D---- C:\Documents and Settings\All Users\Data aplikací\Spybot - Search & Destroy
2010-08-02 11:56:49 ----A---- C:\WINDOWS\ntbtlog.txt
2010-08-02 11:30:08 ----A---- C:\WINDOWS\system32\drivers\mouhid.sys
2010-08-02 11:30:06 ----A---- C:\WINDOWS\system32\drivers\hidusb.sys
2010-08-02 08:44:33 ----A---- C:\WINDOWS\system32\wpcap.dll
2010-08-02 08:44:33 ----A---- C:\WINDOWS\system32\Packet.dll
2010-08-02 08:44:33 ----A---- C:\WINDOWS\system32\drivers\npf.sys
2010-07-14 17:17:43 ----HDC---- C:\WINDOWS\$NtUninstallKB2229593$

======List of files/folders modified in the last 1 months======

2010-08-02 17:18:30 ----D---- C:\WINDOWS\Temp
2010-08-02 17:17:56 ----RD---- C:\Program Files
2010-08-02 17:17:39 ----D---- C:\WINDOWS\Prefetch
2010-08-02 17:12:34 ----D---- C:\Program Files\Mozilla Firefox
2010-08-02 16:36:26 ----D---- C:\Documents and Settings\David\Data aplikací\OpenOffice.org2
2010-08-02 16:36:20 ----D---- C:\Documents and Settings\All Users\Data aplikací\organiser
2010-08-02 16:28:06 ----A---- C:\WINDOWS\SchedLgU.Txt
2010-08-02 15:34:36 ----D---- C:\WINDOWS
2010-08-02 15:34:21 ----D---- C:\WINDOWS\system32
2010-08-02 14:18:23 ----SHD---- C:\WINDOWS\Installer
2010-08-02 14:18:15 ----HD---- C:\WINDOWS\inf
2010-08-02 14:18:15 ----D---- C:\WINDOWS\system32\drivers
2010-08-02 14:17:32 ----A---- C:\WINDOWS\wincmd.ini
2010-08-02 14:16:33 ----D---- C:\WINDOWS\system32\CatRoot2
2010-08-02 14:16:06 ----SD---- C:\Documents and Settings\David\Data aplikací\Microsoft
2010-08-02 14:06:41 ----RASH---- C:\boot.ini
2010-08-02 14:06:41 ----A---- C:\WINDOWS\win.ini
2010-08-02 14:06:41 ----A---- C:\WINDOWS\system.ini
2010-08-02 14:06:04 ----RSHDC---- C:\WINDOWS\system32\dllcache
2010-08-02 14:01:26 ----D---- C:\Program Files\Common Files\System
2010-08-02 14:01:06 ----D---- C:\Program Files\Movie Maker
2010-08-02 14:00:53 ----D---- C:\Program Files\Common Files\STORMWARE Shared
2010-08-02 13:55:18 ----D---- C:\WINDOWS\WinSxS
2010-08-02 13:55:18 ----D---- C:\Program Files\Common Files\Microsoft Shared
2010-08-02 13:38:25 ----SHD---- C:\System Volume Information
2010-08-02 13:38:23 ----D---- C:\Documents and Settings\All Users\Data aplikací\Avira
2010-07-20 14:41:55 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2010-07-14 17:17:35 ----HD---- C:\WINDOWS\$hf_mig$

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 nvata;nvata; C:\WINDOWS\system32\DRIVERS\nvata.sys [2006-10-18 105472]
R1 AFS2K;AFS2k; C:\WINDOWS\system32\drivers\AFS2K.sys [2009-09-01 82380]
R1 AmdK8;Ovladač procesoru AMD; C:\WINDOWS\system32\DRIVERS\AmdK8.sys [2006-07-01 43008]
R1 ehdrv;ehdrv; C:\WINDOWS\system32\DRIVERS\ehdrv.sys [2009-11-16 108792]
R1 epfwtdir;epfwtdir; C:\WINDOWS\system32\DRIVERS\epfwtdir.sys [2009-11-16 96408]
R1 NetworkX;NetworkX; C:\WINDOWS\system32\ckldrv.sys [2008-08-22 21638]
R2 eamon;eamon; C:\WINDOWS\system32\DRIVERS\eamon.sys [2009-11-16 116520]
R2 Hardlock;Hardlock; \??\C:\WINDOWS\system32\drivers\hardlock.sys []
R3 HDAudBus;Ovladač Microsoft UAA pro sběrnici High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2008-04-13 144384]
R3 HidUsb;Ovladač třídy standardu HID; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-13 10368]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\WINDOWS\system32\drivers\RtkHDAud.sys [2007-07-18 4547584]
R3 mouhid;Ovladač myši standardu HID; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-10-24 12160]
R3 nv;nv; C:\WINDOWS\system32\DRIVERS\nv4_mini.sys [2006-10-31 3964256]
R3 NVENETFD;NVIDIA nForce Networking Controller Driver; C:\WINDOWS\system32\DRIVERS\NVENETFD.sys [2006-11-27 58368]
R3 nvnetbus;NVIDIA Network Bus Enumerator; C:\WINDOWS\system32\DRIVERS\nvnetbus.sys [2006-11-27 19968]
S3 BthEnum;Služba Bluetooth Enumerator; C:\WINDOWS\system32\DRIVERS\BthEnum.sys [2008-04-13 17024]
S3 BTHMODEM;Ovladač komunikace modemu Bluetooth; C:\WINDOWS\system32\DRIVERS\bthmodem.sys [2008-04-13 37888]
S3 BthPan;Bluetooth Device (Personal Area Network); C:\WINDOWS\system32\DRIVERS\bthpan.sys [2008-04-13 101120]
S3 BTHPORT;Ovladač portu Bluetooth; C:\WINDOWS\System32\Drivers\BTHport.sys [2008-06-14 272128]
S3 BTHUSB;Ovladač rozhraní USB radiostanice Bluetooth; C:\WINDOWS\System32\Drivers\BTHUSB.sys [2008-04-13 18944]
S3 GMSIPCI;GMSIPCI; \??\D:\INSTALL\GMSIPCI.SYS []
S3 HPZid412;IEEE-1284.4 Driver HPZid412; C:\WINDOWS\system32\DRIVERS\HPZid412.sys [2003-04-07 51024]
S3 HPZipr12;Print Class Driver for IEEE-1284.4 HPZipr12; C:\WINDOWS\system32\DRIVERS\HPZipr12.sys [2003-04-07 16080]
S3 HPZius12;USB to IEEE-1284.4 Translation Driver HPZius12; C:\WINDOWS\system32\DRIVERS\HPZius12.sys [2003-04-07 21456]
S3 NPF;WinPcap Packet Driver (NPF); C:\WINDOWS\system32\drivers\NPF.sys [2010-08-02 50704]
S3 RFCOMM;Zařízení Bluetooth (RFCOMM protokol TDI); C:\WINDOWS\system32\DRIVERS\rfcomm.sys [2008-04-13 59136]
S3 usbccgp;Obecný nadřazený ovladač Microsoft USB; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-13 32128]
S3 usbprint;Třída USB Printer; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2008-04-13 25856]
S3 usbscan;Ovladač skeneru USB; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2008-04-13 15104]
S3 USBSTOR;Ovladač velkokapacitního paměťového zařízení USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]
S3 WudfPf;Windows Driver Foundation - User-mode Driver Framework Platform Driver; C:\WINDOWS\system32\DRIVERS\WudfPf.sys [2006-09-28 77568]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-28 82944]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 BthServ;Bluetooth Support Service; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
R2 Crypkey License;Crypkey License; C:\WINDOWS\system32\crypserv.exe [2008-05-08 122880]
R2 ekrn;ESET Service; C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe [2009-11-16 735960]
R2 NVSvc;NVIDIA Display Driver Service; C:\WINDOWS\system32\nvsvc32.exe [2006-10-31 155715]
R2 WorkshopDBService;WorkshopDBService; C:\PROGRA~1\ATRIS_~1\ORGANI~1.EXE [2009-12-15 114688]
S2 aspimgr;Microsoft ASPI Manager; C:\WINDOWS\system32\aspimgr.exe []
S2 gupdate;Google Update Service (gupdate); C:\Program Files\Google\Update\GoogleUpdate.exe [2009-10-20 133104]
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2008-07-25 34312]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632]
S3 EhttpSrv;ESET HTTP Server; C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe [2009-11-16 20680]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; c:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104]
S3 idsvc;Windows CardSpace; c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664]
S3 NBService;NBService; C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe [2007-11-28 800040]
S3 NMIndexingService;NMIndexingService; C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe [2007-06-27 279848]
S3 Pml Driver HPZ12;Pml Driver HPZ12; C:\WINDOWS\system32\HPZipm12.exe [2003-04-07 65795]
S3 WMPNetworkSvc;Služba Windows Media Player Network Sharing; C:\Program Files\Windows Media Player\WMPNetwk.exe [2007-01-05 913920]
S3 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2008-07-29 132096]

-----------------EOF-----------------

Zdravim
Restart do nudzoveho rezimu s pracou v sieti.
stiahnes na plochu RKILL a spustis-od tohto momentu pocitac nesmies restartovat.
http://download.bleepingcomputer.com/grinler/rkill.com
Stiahnes>>Malwarebytes' Anti-Malware stiahnut-nainstalovat -aktualizovat-
sprav komplet skan,co najde zmazat.,log vloz sem,

takže,
-jsem v nouzovém režimu s prací v síti
-RKILL spuště (bílé okno necháno zapnuté)
-stáhnut a nainstalován Malwarebytes' Anti-Malware, který se i sám aktualizoval
-teď probíhá rychlý sken

Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Verze databáze: 4384

Windows 5.1.2600 Service Pack 3 (Safe Mode)
Internet Explorer 8.0.6001.18702

3.8.2010 10:13:55
mbam-log-2010-08-03 (10-13-55).txt

Typ skenu: Rychlý sken
Skenované objekty: 131350
Uplynulý čas: 3 minuta(y), 31 sekunda(y)

Infikované procesy v paměti: 0
Infikované moduly v paměti: 0
Infikované klíče registru: 2
Infikované hodnoty registru: 0
Infikované datové položky registru: 0
Infikované složky: 0
Infikované soubory: 14

Infikované procesy v paměti:
(Žádné škodlivé položky nebyly zjištěny)

Infikované moduly v paměti:
(Žádné škodlivé položky nebyly zjištěny)

Infikované klíče registru:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Sft (Backdoor.Agent) -> No action taken.
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\aspimgr (Trojan.Asprox) -> No action taken.

Infikované hodnoty registru:
(Žádné škodlivé položky nebyly zjištěny)

Infikované datové položky registru:
(Žádné škodlivé položky nebyly zjištěny)

Infikované složky:
(Žádné škodlivé položky nebyly zjištěny)

Infikované soubory:
C:\Program Files\Common Files\System\WindowsSystem.exe (Trojan.Agent) -> No action taken.
C:\Program Files\Common Files\System\ado\msADOXMicrosoft.exe (Trojan.Agent) -> No action taken.
C:\Documents and Settings\David\Nabídka Start\Programy\Po spuštění\monech32.exe (Malware.Packer.Gen) -> No action taken.
C:\Documents and Settings\David\Local Settings\Temporary Internet Files\Content.IE5\4RQUNWT6\0015modulesetup[1].exe (Trojan.Agent.Gen) -> No action taken.
C:\WINDOWS\system\LEXHDL5.DLL (Trojan.Agent) -> No action taken.
C:\Documents and Settings\David\Data aplikací\avdrn.dat (Malware.Trace) -> No action taken.
C:\Documents and Settings\David\Plocha\Antimalware Doctor.lnk (Rogue.AntimalwareDoctor) -> No action taken.
C:\Documents and Settings\David\Nabídka Start\Programy\Security Tool.LNK (Rogue.SecurityTool) -> No action taken.
C:\WINDOWS\system32\config\systemprofile\Nabídka Start\Programy\Security Tool.LNK (Rogue.SecurityTool) -> No action taken.
C:\Documents and Settings\David\Data aplikací\Microsoft\Internet Explorer\Quick Launch\Antimalware Doctor.lnk (Rogue.AntimalwareDoctor) -> No action taken.
C:\Documents and Settings\David\Nabídka Start\Antimalware Doctor.lnk (Rogue.AntimalwareDoctor) -> No action taken.
C:\Documents and Settings\David\Nabídka Start\Programy\Po spuštění\Antimalware Doctor.lnk (Rogue.AntiMalwareDoctor) -> No action taken.
C:\WINDOWS\s32.txt (Malware.Trace) -> No action taken.
C:\WINDOWS\ws386.ini (Malware.Trace) -> No action taken.

Zmazat vsetko,,programom Malwarebytes,,
Spust znova Malwarebytes a nastav na uplny skan,co najde daj-ZMAZAT-log tiez vloz sem.

Zatím vše nechávám, tak jak je a čekám na svolení
... jsou tu na tom počítači ceklkem důležitá data, tak bych nerad něco pokazil

o.k. jdu na to ...

Na ake svoleni??,precitaj co som napisal,pred tvojim prispevkom,

Tohle mi vyskočilo po smazání:
Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Verze databáze: 4384

Windows 5.1.2600 Service Pack 3 (Safe Mode)
Internet Explorer 8.0.6001.18702

3.8.2010 10:20:54
mbam-log-2010-08-03 (10-20-54).txt

Typ skenu: Rychlý sken
Skenované objekty: 131350
Uplynulý čas: 3 minuta(y), 31 sekunda(y)

Infikované procesy v paměti: 0
Infikované moduly v paměti: 0
Infikované klíče registru: 2
Infikované hodnoty registru: 0
Infikované datové položky registru: 0
Infikované složky: 0
Infikované soubory: 14

Infikované procesy v paměti:
(Žádné škodlivé položky nebyly zjištěny)

Infikované moduly v paměti:
(Žádné škodlivé položky nebyly zjištěny)

Infikované klíče registru:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Sft (Backdoor.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\aspimgr (Trojan.Asprox) -> Quarantined and deleted successfully.

Infikované hodnoty registru:
(Žádné škodlivé položky nebyly zjištěny)

Infikované datové položky registru:
(Žádné škodlivé položky nebyly zjištěny)

Infikované složky:
(Žádné škodlivé položky nebyly zjištěny)

Infikované soubory:
C:\Program Files\Common Files\System\WindowsSystem.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Program Files\Common Files\System\ado\msADOXMicrosoft.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\David\Nabídka Start\Programy\Po spuštění\monech32.exe (Malware.Packer.Gen) -> Quarantined and deleted successfully.
C:\Documents and Settings\David\Local Settings\Temporary Internet Files\Content.IE5\4RQUNWT6\0015modulesetup[1].exe (Trojan.Agent.Gen) -> Quarantined and deleted successfully.
C:\WINDOWS\system\LEXHDL5.DLL (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\David\Data aplikací\avdrn.dat (Malware.Trace) -> Quarantined and deleted successfully.
C:\Documents and Settings\David\Plocha\Antimalware Doctor.lnk (Rogue.AntimalwareDoctor) -> Quarantined and deleted successfully.
C:\Documents and Settings\David\Nabídka Start\Programy\Security Tool.LNK (Rogue.SecurityTool) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\config\systemprofile\Nabídka Start\Programy\Security Tool.LNK (Rogue.SecurityTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\David\Data aplikací\Microsoft\Internet Explorer\Quick Launch\Antimalware Doctor.lnk (Rogue.AntimalwareDoctor) -> Quarantined and deleted successfully.
C:\Documents and Settings\David\Nabídka Start\Antimalware Doctor.lnk (Rogue.AntimalwareDoctor) -> Quarantined and deleted successfully.
C:\Documents and Settings\David\Nabídka Start\Programy\Po spuštění\Antimalware Doctor.lnk (Rogue.AntiMalwareDoctor) -> Quarantined and deleted successfully.
C:\WINDOWS\s32.txt (Malware.Trace) -> Quarantined and deleted successfully.
C:\WINDOWS\ws386.ini (Malware.Trace) -> Quarantined and deleted successfully.

napsalo to, že vše bylo odstraněno, ale že musím restartovat PC.
Mám ho restartovat, ikdyž je spuštěný ten RKILL ???

Ano,teraz uz mozes,a spust win do normalneho rezimu.

po restartu při spuštění do normáního režimu se furt ještě ten prevít "Antimalware Doctor" objevuje
... teď běží úplný sken, dám sem výsledek

ano,toto nie je obycajny smejd,takze uplny sken-zmazat-log vloz sem,,a potom budeme pokracovat,,

Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Database version: 4384

Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

3.8.2010 11:25:13
mbam-log-2010-08-03 (11-25-13).txt

Scan type: Full scan (C:\|)
Objects scanned: 245855
Time elapsed: 35 minute(s), 13 second(s)

Memory Processes Infected: 1
Memory Modules Infected: 0
Registry Keys Infected: 2
Registry Values Infected: 1
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 63

Memory Processes Infected:
C:\Documents and Settings\David\Data aplikací\61D32724E0E35A4CD7DB4EDDDFC3233E\0015modulesetup.exe (Trojan.Agent.Gen) -> No action taken.

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CURRENT_USER\Software\Antimalware Doctor Inc (Rogue.AntimalwareDoctor) -> No action taken.
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\Antimalware Doctor (Rogue.AntimalwareDoctor) -> No action taken.

Registry Values Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\0015modulesetup.exe (Trojan.Agent.Gen) -> No action taken.

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
C:\Documents and Settings\David\Data aplikací\61D32724E0E35A4CD7DB4EDDDFC3233E\0015modulesetup.exe (Trojan.Agent.Gen) -> No action taken.
C:\etka\prog\Lexhdl5.dll (Trojan.Agent) -> No action taken.
C:\Program Files\Adobe\Reader 8.0\Reader\plug_ins\ImageViewer\cs_CZ\AdobeViewer.exe (Trojan.Agent) -> No action taken.
C:\Program Files\Adobe\Reader 8.0\Reader\plug_ins\AcroForm\PMP\pdf417pmpqrcodepmp.exe (Trojan.Agent) -> No action taken.
C:\Program Files\Adobe\Reader 8.0\Reader\AIR\AdobeNPPDF32.exe (Trojan.Agent) -> No action taken.
C:\Program Files\ATRis_Technik\static_html\static_html_images\extrai\elc40\sensorHall.exe (Trojan.Agent) -> No action taken.
C:\Program Files\ATRis_Technik\Uninstall_ATRis_Technik\resource\IntelWin32.exe (Trojan.Agent) -> No action taken.
C:\Program Files\ATRis_Technik\jre\bin\client\EditionJavaTM.exe (Trojan.Agent) -> No action taken.
C:\Program Files\Common Files\Ahead\AudioPlugins\mp3PROplugin.exe (Trojan.Agent) -> No action taken.
C:\Program Files\Common Files\InstallShield\Professional\RunTime\objectpsObject.exe (Trojan.Agent) -> No action taken.
C:\Program Files\Common Files\InstallShield\Professional\RunTime\10\00\Intel32\dotnetinstallerKernel.exe (Trojan.Agent) -> No action taken.
C:\Program Files\Common Files\Microsoft Shared\DW\1031\DWIntl20Application.exe (Trojan.Agent) -> No action taken.
C:\Program Files\Common Files\Microsoft Shared\DW\1036\ReportingMicrosoft11.0.5510.exe (Trojan.Agent) -> No action taken.
C:\Program Files\Common Files\Microsoft Shared\Replication Manager 4.0\MicrosoftMSRPFS40.exe (Trojan.Agent) -> No action taken.
C:\Program Files\Common Files\Microsoft Shared\TextConv\msconv97msconv97.exe (Trojan.Agent) -> No action taken.
C:\Program Files\Common Files\Microsoft Shared\VGX\ExplorerWindows8.00.6001.187028.0903080339.exe (Trojan.Agent) -> No action taken.
C:\Program Files\Common Files\Microsoft Shared\web server extensions\40\bin\fp4AwecMicrosoft.exe (Trojan.Agent) -> No action taken.
C:\Program Files\Common Files\STORMWARE Shared\TBarSTORMWARE.exe (Trojan.Agent) -> No action taken.
C:\Program Files\Common Files\System\Ole DB\Soustimsdaenum.exe (Trojan.Agent) -> No action taken.
C:\Program Files\Google\Google Earth\plugin\EarthMicrosoft.exe (Trojan.Agent) -> No action taken.
C:\Program Files\Hewlett-Packard\Digital Imaging\Album\Help\VersionVersion.exe (Trojan.Agent) -> No action taken.
C:\Program Files\Hewlett-Packard\Digital Imaging\bbfe\common\img\RepositoryVersion.exe (Trojan.Agent) -> No action taken.
C:\Program Files\Hewlett-Packard\Digital Imaging\bbfe\director\hpq08series4.2.0.013.exe (Trojan.Agent) -> No action taken.
C:\Program Files\Hewlett-Packard\Digital Imaging\bbfe\instantshare\RepositoryVersion.exe (Trojan.Agent) -> No action taken.
C:\Program Files\Hewlett-Packard\Digital Imaging\bbfe\phunload\css\RepositoryVersion.exe (Trojan.Agent) -> No action taken.
C:\Program Files\Hewlett-Packard\Digital Imaging\bbfe\phunload\img\VersionRepository.exe (Trojan.Agent) -> No action taken.
C:\Program Files\Hewlett-Packard\Digital Imaging\bbfe\scan\css\VersionRepository.exe (Trojan.Agent) -> No action taken.
C:\Program Files\Hewlett-Packard\Digital Imaging\bbfe\scan\loc\RepositoryVersion.exe (Trojan.Agent) -> No action taken.
C:\Program Files\Hewlett-Packard\Digital Imaging\data\VersionVersion.exe (Trojan.Agent) -> No action taken.
C:\Program Files\Hewlett-Packard\Digital Imaging\data\bmp\VersionRepository.exe (Trojan.Agent) -> No action taken.
C:\Program Files\Hewlett-Packard\Digital Imaging\DocProc\ReadirisCardirisIRISPenLTIMG11N.exe (Trojan.Agent) -> No action taken.
C:\Program Files\Hewlett-Packard\Digital Imaging\hp psc 1200 series\help\ProductWebsite.exe (Trojan.Agent) -> No action taken.
C:\Program Files\Hewlett-Packard\Digital Imaging\Migrate\hpgtpusdhpgwiamd.exe (Trojan.Agent) -> No action taken.
C:\Program Files\Hewlett-Packard\Digital Imaging\Unload\VersionHpqUnSet2.0.0.133.exe (Trojan.Agent) -> No action taken.
C:\Program Files\Hewlett-Packard\Digital Imaging\{7C8BB31C-E09E-4c7d-BBF1-45E33B467FE1}\csy\drivers\com_lang\OfficeJetHPOFAX070000.exe (Trojan.Agent) -> No action taken.
C:\Program Files\Hewlett-Packard\Digital Imaging\{7C8BB31C-E09E-4c7d-BBF1-45E33B467FE1}\csy\drivers\win9x_me\usbmonusbmon.exe (Trojan.Agent) -> No action taken.
C:\Program Files\Hewlett-Packard\Digital Imaging\{7C8BB31C-E09E-4c7d-BBF1-45E33B467FE1}\Drivers\Scanner\hpotsclhpotscl4.2.0.008.exe (Trojan.Agent) -> No action taken.
C:\Program Files\Hewlett-Packard\Digital Imaging\{7C8BB31C-E09E-4c7d-BBF1-45E33B467FE1}\setup\HPZscr01Uninstaller.exe (Trojan.Agent) -> No action taken.
C:\Program Files\Hewlett-Packard\Memories Disc\hpodcorenuSoftware1.0.4.exe (Trojan.Agent) -> No action taken.
C:\Program Files\Hewlett-Packard\Memories Disc\audio\FolkAmerican.exe (Trojan.Agent) -> No action taken.
C:\Program Files\Internet Explorer\MUI\0409\mscoriermscorier.exe (Trojan.Agent) -> No action taken.
C:\Program Files\Movie Maker\MovieWMM2EXTRES.exe (Trojan.Agent) -> No action taken.
C:\Program Files\MSN Gaming Zone\Windows\ZoneZone.exe (Trojan.Agent) -> No action taken.
C:\Program Files\Nero\Nero 7\Nero\Uninstall\UninstallNeroInstaller.exe (Trojan.Agent) -> No action taken.
C:\Program Files\Nero\Nero 7\Nero BackItUp\LibraryNero7.10.3052.4.exe (Trojan.Agent) -> No action taken.
C:\Program Files\Nero\Nero 7\Nero BackItUp\NeroFiles\VisualBurning.exe (Trojan.Agent) -> No action taken.
C:\Program Files\Nero\Nero 7\Nero CoverDesigner\VisualVisual7.10.3077.0.exe (Trojan.Agent) -> No action taken.
C:\Program Files\Nero\Nero 7\Nero MediaHome\MediaHomeNMMediaServer.exe (Trojan.Agent) -> No action taken.
C:\Program Files\Nero\Nero 7\Nero ShowTime\StudioStudio.exe (Trojan.Agent) -> No action taken.
C:\Program Files\Nero\Nero 7\Nero StartSmart\StartSmartMFC71.exe (Trojan.Agent) -> No action taken.
C:\Program Files\Nero\Nero 7\Nero Toolkit\NeroBurnRightsMSVCP71.exe (Trojan.Agent) -> No action taken.
C:\Program Files\OpenOffice.org 2.0\program\components\xpconnecti18n.exe (Trojan.Agent) -> No action taken.
C:\Program Files\STORMWARE\POHODA\Hardware\Axis\ApplicationInicFM128.exe (Trojan.Agent) -> No action taken.
C:\Program Files\STORMWARE\POHODA\Hardware\Euro2000\libraryComm32.exe (Trojan.Agent) -> No action taken.
C:\Program Files\Windows NT\Pinball\PINBALLPinball.exe (Trojan.Agent) -> No action taken.
C:\System Volume Information\_restore{6D14DB09-AE5E-4224-BA63-EC4E67D9B62A}\RP527\A0043987.exe (Rogue.SecurityTool) -> No action taken.
C:\System Volume Information\_restore{6D14DB09-AE5E-4224-BA63-EC4E67D9B62A}\RP527\A0045157.exe (Rogue.SecurityTool) -> No action taken.
C:\System Volume Information\_restore{6D14DB09-AE5E-4224-BA63-EC4E67D9B62A}\RP528\A0045187.exe (Trojan.Agent) -> No action taken.
C:\System Volume Information\_restore{6D14DB09-AE5E-4224-BA63-EC4E67D9B62A}\RP528\A0045188.exe (Trojan.Agent) -> No action taken.
C:\System Volume Information\_restore{6D14DB09-AE5E-4224-BA63-EC4E67D9B62A}\RP531\A0046439.exe (Trojan.Agent) -> No action taken.
C:\System Volume Information\_restore{6D14DB09-AE5E-4224-BA63-EC4E67D9B62A}\RP531\A0046440.exe (Trojan.Agent) -> No action taken.
C:\System Volume Information\_restore{6D14DB09-AE5E-4224-BA63-EC4E67D9B62A}\RP531\A0046441.exe (Malware.Packer.Gen) -> No action taken.
C:\System Volume Information\_restore{6D14DB09-AE5E-4224-BA63-EC4E67D9B62A}\RP531\A0046442.DLL (Trojan.Agent) -> No action taken.