PC-HELP.CZ

Logfile of HijackThis v1.99.1
Scan saved at 19:28:45, on 5.3.2007
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
F:\WINDOWS\System32\smss.exe
F:\WINDOWS\system32\winlogon.exe
F:\WINDOWS\system32\services.exe
F:\WINDOWS\system32\lsass.exe
F:\WINDOWS\system32\svchost.exe
F:\WINDOWS\System32\svchost.exe
F:\WINDOWS\system32\spoolsv.exe
F:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
F:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
F:\WINDOWS\System32\svchost.exe
F:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe
F:\WINDOWS\utorrent.exe
F:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe
F:\WINDOWS\Explorer.EXE
F:\WINDOWS\System32\nvsvc32.exe
F:\WINDOWS\System32\svchost.exe
F:\PROGRA~1\Grisoft\AVG7\avgcc.exe
F:\WINDOWS\SOUNDMAN.EXE
F:\PROGRA~1\Grisoft\AVG7\avgemc.exe
F:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb03.exe
F:\WINDOWS\System32\cxmdxcs.exe
F:\WINDOWS\System32\smcrsmm.exe
F:\WINDOWS\System32\gdmvstat.exe
F:\WINDOWS\System32\acsbvcc.exe
F:\WINDOWS\System32\cmdupdlms.exe
F:\WINDOWS\System32\fxsosgbt.exe
F:\Program Files\Messenger\MSMSGS.EXE
f:\windows\system32\system5.exe
F:\Program Files\ASUS\WLAN Card Utilities\Center.exe
F:\WINDOWS\twain_32\PUSH650C.EXE
F:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe
F:\Program Files\ICQLite\ICQLite.exe
F:\Documents and Settings\Kamill\Dokumenty\ICQ Lite\317560181\Black01_213658546\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://google.icq.com/search/search_frame.php
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://google.icq.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
R3 - URLSearchHook: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - F:\Program Files\ICQToolbar\toolbaru.dll
R3 - URLSearchHook: (no name) - {00A6FAF6-072E-44cf-8957-5838F569A31D} - (no file)
O2 - BHO: MyWebSearch Search Assistant BHO - {00A6FAF1-072E-44cf-8957-5838F569A31D} - (no file)
O2 - BHO: mwsBar BHO - {07B18EA1-A523-4961-B6BB-170DE4475CCA} - (no file)
O2 - BHO: (no name) - {36DBC179-A19F-48F2-B16A-6A3E19B42A87} - F:\WINDOWS\System32\ipv6monl.dll (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - F:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O3 - Toolbar: &Rádio - {8E718888-423F-11D2-876E-00A0C9082467} - F:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: (no name) - {07B18EA9-A523-4961-B6BB-170DE4475CCA} - (no file)
O3 - Toolbar: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - F:\Program Files\ICQToolbar\toolbaru.dll
O4 - HKLM\..\Run: [AVG7_CC] F:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [AVG7_EMC] F:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] F:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb03.exe
O4 - HKLM\..\Run: [csmhtop] F:\WINDOWS\System32\cxmdxcs.exe
O4 - HKLM\..\Run: [ddsysmns] F:\WINDOWS\System32\smcrsmm.exe
O4 - HKLM\..\Run: [kdmmcvs] F:\WINDOWS\System32\gdmvstat.exe
O4 - HKLM\..\Run: [ncsmmlg] F:\WINDOWS\System32\acsbvcc.exe
O4 - HKLM\..\Run: [mvcupdate] F:\WINDOWS\System32\cmdupdlms.exe
O4 - HKLM\..\Run: [vbmmiosp] fxsosgbt.exe
O4 - HKLM\..\Run: [SvcManager] system5.exe
O4 - HKCU\..\Run: [ddsysmns] F:\WINDOWS\System32\smcrsmm.exe
O4 - HKCU\..\Run: [csmhtop] F:\WINDOWS\System32\cxmdxcs.exe
O4 - HKCU\..\Run: [kdmmcvs] F:\WINDOWS\System32\gdmvstat.exe
O4 - HKCU\..\Run: [ncsmmlg] F:\WINDOWS\System32\acsbvcc.exe
O4 - HKCU\..\Run: [mvcupdate] F:\WINDOWS\System32\cmdupdlms.exe
O4 - HKCU\..\Run: [MSMSGS] "F:\Program Files\Messenger\MSMSGS.EXE" /background
O4 - HKCU\..\RunOnce: [ICQ Lite] F:\Program Files\ICQLite\ICQLite.exe -trayboot
O4 - Global Startup: ASUS WLAN Control Center.lnk = ?
O4 - Global Startup: PUSH650C.lnk = F:\WINDOWS\twain_32\PUSH650C.EXE
O8 - Extra context menu item: &ICQ Toolbar Search - res://F:\Program Files\ICQToolbar\toolbaru.dll/SEARCH.HTML
O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbaredi ... xdm610YYCZ
O8 - Extra context menu item: Otevřít obrázek v aplikaci &Microsoft PhotoDraw - res://F:\PROGRA~1\MICROS~2\Office\1029\phdintl.dll/phdContext.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - F:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - F:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - F:\Program Files\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - F:\Program Files\ICQLite\ICQLite.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - F:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - F:\Program Files\Messenger\MSMSGS.EXE
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.exe.imgfarm.com/images/nocach ... 0.0.15.cab
O16 - DPF: {1F831FA2-42FC-11D4-95A6-0080AD30DCE1} (InstaFred) - file://F:\Program Files\AutoCAD 2002 Cz\InstFred.ocx
O16 - DPF: {47CEF84E-92D8-4C4A-86D7-CB982889DCC0} (Oberon Media Network Optimizer) - http://mp1.mplay.oberon-media.com/client/flashnet.cab
O16 - DPF: {78AF2F24-A9C3-11D3-BF8C-0060B0FCC122} (Ovládací prvek AcDcToday) - file://F:\Program Files\AutoCAD 2002 Cz\AcDcToday.ocx
O16 - DPF: {AE563723-B4F5-11D4-A415-00108302FDFD} (NOXLATE-BANR) - file://F:\Program Files\AutoCAD 2002 Cz\InstBanr.ocx
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMe ... loader.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} - http://www.popcap.com/games/popcaploader_v6.cab
O16 - DPF: {F281A59C-7B65-11D3-8617-0010830243BD} (Prvek AcPreview) - file://F:\Program Files\AutoCAD 2002 Cz\AcPreview.ocx
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "F:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - F:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: rpcc - F:\WINDOWS\System32\rpcc.dll
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - F:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - F:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: Kerio Personal Firewall 4 (KPF4) - Kerio Technologies - F:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe
O23 - Service: Microsoft Corporation - Unknown owner - F:\WINDOWS\utorrent.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - F:\WINDOWS\System32\nvsvc32.exe

stáhni si Killbox a spusť ho.
Do volného řádku zkopíruj ten tučně označený text:
F:\WINDOWS\System32\rpcc.dll

Zaškrtni volbu Delete on Reboot a Unregister .dll Before Deleting.
A stiskni bílý křížek v červeném kolečku.
PC se restartuje.

Porestartu spusť HJT a v něm fixni:
R3 - URLSearchHook: (no name) - {00A6FAF6-072E-44cf-8957-5838F569A31D} - (no file)
O2 - BHO: MyWebSearch Search Assistant BHO - {00A6FAF1-072E-44cf-8957-5838F569A31D} - (no file)
O2 - BHO: mwsBar BHO - {07B18EA1-A523-4961-B6BB-170DE4475CCA} - (no file)
O2 - BHO: (no name) - {36DBC179-A19F-48F2-B16A-6A3E19B42A87} - F:\WINDOWS\System32\ipv6monl.dll (file missing)
O3 - Toolbar: (no name) - {07B18EA9-A523-4961-B6BB-170DE4475CCA} - (no file)
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbaredi ... xdm610YYCZ
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.exe.imgfarm.com/images/nocach ... 0.0.15.cab

Poté nech všechny tyto soubory otestovat na Virustotalu:
F:\WINDOWS\utorrent.exe
F:\WINDOWS\System32\cxmdxcs.exe
F:\WINDOWS\System32\smcrsmm.exe
F:\WINDOWS\System32\gdmvstat.exe
F:\WINDOWS\System32\acsbvcc.exe
F:\WINDOWS\System32\cmdupdlms.exe
F:\WINDOWS\System32\fxsosgbt.exe
f:\windows\system32\system5.exe
F:\WINDOWS\twain_32\PUSH650C.EXE

A zkopíruj sem výsledky.
Pro lepší nalezení si zapni zobrazovat skryté a systémové soubory.

Pak prosím ty výsledky + nový log z HJT.

+ prosím smaž to druhý téma.

Ve taskmgr (CTRL+Alt+Del) na záložce procesy zastav toto:

F:\WINDOWS\System32\cxmdxcs.exe
F:\WINDOWS\System32\smcrsmm.exe
F:\WINDOWS\System32\gdmvstat.exe
F:\WINDOWS\System32\acsbvcc.exe
F:\WINDOWS\System32\cmdupdlms.exe
F:\WINDOWS\System32\fxsosgbt.exe

červeně označené procesy pak najdi ve složce a smaž

Pak fixni v HJT tyto políčka:
R3 - URLSearchHook: (no name) - {00A6FAF6-072E-44cf-8957-5838F569A31D} - (no file)
O2 - BHO: MyWebSearch Search Assistant BHO - {00A6FAF1-072E-44cf-8957-5838F569A31D} - (no file)
O2 - BHO: mwsBar BHO - {07B18EA1-A523-4961-B6BB-170DE4475CCA} - (no file)
O2 - BHO: (no name) - {36DBC179-A19F-48F2-B16A-6A3E19B42A87} - F:\WINDOWS\System32\ipv6monl.dll (file missing)
O3 - Toolbar: (no name) - {07B18EA9-A523-4961-B6BB-170DE4475CCA} - (no file)
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [csmhtop] F:\WINDOWS\System32\cxmdxcs.exe
O4 - HKLM\..\Run: [ddsysmns] F:\WINDOWS\System32\smcrsmm.exe
O4 - HKLM\..\Run: [kdmmcvs] F:\WINDOWS\System32\gdmvstat.exe
O4 - HKLM\..\Run: [ncsmmlg] F:\WINDOWS\System32\acsbvcc.exe
O4 - HKLM\..\Run: [mvcupdate] F:\WINDOWS\System32\cmdupdlms.exe
O4 - HKLM\..\Run: [vbmmiosp] fxsosgbt.exe
O4 - HKLM\..\Run: [SvcManager] system5.exe
O4 - HKCU\..\Run: [ddsysmns] F:\WINDOWS\System32\smcrsmm.exe
O4 - HKCU\..\Run: [csmhtop] F:\WINDOWS\System32\cxmdxcs.exe
O4 - HKCU\..\Run: [kdmmcvs] F:\WINDOWS\System32\gdmvstat.exe
O4 - HKCU\..\Run: [ncsmmlg] F:\WINDOWS\System32\acsbvcc.exe
O4 - HKCU\..\Run: [mvcupdate] F:\WINDOWS\System32\cmdupdlms.exe
O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbaredi ... xdm610YYCZ
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.exe.imgfarm.com/images/nocach ... enSaversFW BInitialSetup1.0.0.15.cab
O20 - Winlogon Notify: rpcc - F:\WINDOWS\System32\rpcc.dll

Pak restartuj a dej sem nový log.
Každopádně bych doporučil instalaci SP2!!!

Ten Killbox taky proveď!