Počítač rozesílá spam

[sivle]

Dobrý den,
přišla mi zpráva z spamhaus.org, že moje IP adresa byla přidána na blocklist z důvodu rozesílání SPAMU. Prosím o radu, jak dále postupovat. Nyní mám v plánu provést test programem CCleaner. Přikládám log z HJT:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 8:12:47, on 8.1.2016
Platform: Windows 2003 (WinNT 5.02.3790)
MSIE: Internet Explorer v6.00 (6.00.3790.0000)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
D:\Tomcat 5.5\bin\tomcat5.exe
C:\Program Files\Apache Group\Apache2\bin\Apache.exe
C:\Program Files\SGS\CarNet\CarNetMaps.exe
C:\Program Files\SGS\CarNet\CarNetService.exe
C:\Program Files\CesarFTP\server.exe
D:\Teplomer\srvany.exe
C:\Program Files\EmForge\Jetty-Service.exe
C:\Program Files\Firebird\Firebird_1_5\bin\fbguard.exe
C:\Program Files\Gene6 FTP Server\G6FTPSERVER.EXE
D:\Teplomer\Barometr.exe
C:\Program Files\Symantec\Norton Ghost 2003\GhostStartService.exe
C:\WINDOWS\system32\inetsrv\inetinfo.exe
C:\Program Files\Java\jre6\bin\jqs.exe
D:\mysql\bin\mysqld-nt.exe
C:\Program Files\Apache Group\Apache2\bin\Apache.exe
C:\WINDOWS\system32\ntfrs.exe
C:\Program Files\Subversion\bin\SVNService.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Subversion\bin\svnserve.exe
C:\Program Files\VMware\VMware vCenter Converter Standalone Agent\vmware-converter-a.exe
C:\WINDOWS\System32\wins.exe
C:\WINDOWS\system32\Dfssvc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\cmd.exe
C:\WINDOWS\system32\cmd.exe
C:\WINDOWS\system32\java.exe
C:\Program Files\Firebird\Firebird_1_5\bin\fbserver.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Symantec\Norton Ghost 2003\GhostStartTrayApp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Kerio\MailServer\MailCtrl.exe
C:\WINDOWS\system32\choice.exe
C:\Program Files\Unlocker\UnlockerAssistant.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\taskmgr.exe
C:\Documents and Settings\rohrich\Desktop\odvirovani\HijackThis.exe
C:\WINDOWS\system32\choice.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = res://shdoclc.dll/hardUser.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = res://shdoclc.dll/hardUser.htm
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://sbs.elvi.cz/
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\system32\msdxm.ocx
O4 - HKLM\..\Run: [GhostStartTrayApp] C:\Program Files\Symantec\Norton Ghost 2003\GhostStartTrayApp.exe
O4 - HKLM\..\Run: [ApacheTomcatMonitor] "D:\Tomcat 5.5\bin\tomcat5w.exe" //MS//Tomcat5
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [UnlockerAssistant] "C:\Program Files\Unlocker\UnlockerAssistant.exe"
O4 - HKLM\..\RunServices: [DataboxFFServer] C:\Program Files\DATABOX\Contact 4.0\Server\FFSrv95.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'Default user')
O4 - Global Startup: Engine Monitor.lnk = ?
O4 - Global Startup: Monitor Apache Servers.lnk = C:\Program Files\Apache Group\Apache2\bin\ApacheMonitor.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O15 - ESC Trusted Zone: http://www.bing.com
O15 - ESC Trusted Zone: http://www.ammyy.com.edu
O15 - ESC Trusted Zone: http://sbs.elvi.cz
O15 - ESC Trusted Zone: http://www.elvi.cz
O15 - ESC Trusted Zone: http://www.google.cz
O15 - ESC Trusted Zone: http://www.piriform.com
O15 - ESC Trusted Zone: http://www.slunecnice.cz
O15 - ESC Trusted Zone: http://forum.viry.cz
O15 - ESC Trusted Zone: http://reklama2.viry.cz
O15 - ESC Trusted Zone: http://www.viry.cz
O15 - ESC Trusted Zone: http://*.windowsupdate.com
O15 - ESC Trusted Zone: http://*.windowsupdate.com (HKLM)
O15 - ESC Trusted IP range: http://10.0.0.28
O16 - DPF: ServerPushBox - http://10.0.0.210/servp14.cab
O16 - DPF: {CAFEEFAC-0014-0001-0002-ABCDEFFEDCBA} (Java Runtime Environment 1.4.1) -
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = elvi.cz
O17 - HKLM\Software\..\Telephony: DomainName = elvi.cz
O17 - HKLM\System\CCS\Services\Tcpip\..\{741265B8-E5BA-42CE-B41F-49E085A26E11}: NameServer = 10.0.0.3,212.158.128.2
O17 - HKLM\System\CCS\Services\Tcpip\..\{8D4554BC-D876-4591-91EA-B2537F47E08C}: NameServer = 10.0.0.3
O17 - HKLM\System\CCS\Services\Tcpip\..\{FB3D3E37-6636-4753-8EBA-28AE7B5BB78B}: NameServer = 212.158.128.2,212.158.128.3
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = elvi.cz
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = elvi.cz
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Adobe Flash Players - Unknown owner - C:\windows\media\xiao.wav (file missing)
O23 - Service: Apache Tomcat EKD (Apache) - Apache Software Foundation - D:\Tomcat 5.5\bin\tomcat5.exe
O23 - Service: Apache2 - Apache Software Foundation - C:\Program Files\Apache Group\Apache2\bin\Apache.exe
O23 - Service: CarNet Maps (CarNet_Maps) - SGS a.s. - C:\Program Files\SGS\CarNet\CarNetMaps.exe
O23 - Service: CarNet Service (CarNet_Service) - Unknown owner - C:\Program Files\SGS\CarNet\CarNetService.exe
O23 - Service: CesarFTP FTP Server (CesarFTP) - Unknown owner - C:\Program Files\CesarFTP\server.exe
O23 - Service: ElvisBarometr - Unknown owner - D:\Teplomer\srvany.exe
O23 - Service: EmForge Server (EmForge) - Unknown owner - C:\Program Files\EmForge\Jetty-Service.exe
O23 - Service: Firebird Guardian - DefaultInstance (FirebirdGuardianDefaultInstance) - The Firebird Project - C:\Program Files\Firebird\Firebird_1_5\bin\fbguard.exe
O23 - Service: Firebird Server - DefaultInstance (FirebirdServerDefaultInstance) - The Firebird Project - C:\Program Files\Firebird\Firebird_1_5\bin\fbserver.exe
O23 - Service: Gene6 FTP Server (G6FTPServer) - Gene6 - C:\Program Files\Gene6 FTP Server\G6FTPSERVER.EXE
O23 - Service: GhostStartService - Symantec Corporation - C:\Program Files\Symantec\Norton Ghost 2003\GhostStartService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Kerio MailServer (KerioMailServer) - Kerio Technologies - C:\Program Files\Kerio\MailServer\mailserver.exe
O23 - Service: MySQL - Unknown owner - D:\mysql\bin\mysqld-nt (file missing)
O23 - Service: Ndobe Flash Players - Unknown owner - C:\windows\media\xiao.wav (file missing)
O23 - Service: OpenVPN Service (OpenVPNService) - Unknown owner - C:\Program Files\OpenVPN\bin\openvpnserv.exe
O23 - Service: Remote Storage managements - Unknown owner - C:\WINDOWS\system32\oobe\images\images\oobe\mages\a64.tbl (file missing)
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - C:\Program Files\WinPcap\rpcapd.exe
O23 - Service: S4WScheduler - Unknown owner - C:\Program Files\Smart4Web\wrapper\bin\Wrapper.exe (file missing)
O23 - Service: Serv-U FTP Server (Serv-U) - Unknown owner - C:\Program Files\Serv-U\ServUDaemon.exe
O23 - Service: SVNService - Clansoft - C:\Program Files\Subversion\bin\SVNService.exe
O23 - Service: System Event Log (system) - Unknown owner - C:\WINDOWS\system32\System.exe (file missing)
O23 - Service: Apache Tomcat Smart4web (Tomcat5) - Apache Software Foundation - D:\Tomcat 5.0\bin\tomcat5.exe
O23 - Service: VMware vCenter Converter Standalone Agent (vmware-converter-agent) - VMware, Inc. - C:\Program Files\VMware\VMware vCenter Converter Standalone Agent\vmware-converter-a.exe

--
End of file - 8910 bytes

[Rudy]

Zdravím!
Dejte log FRST: http://forum.viry.cz/viewtopic.php?f=13&t=133100 . HJT je již minulostí.