PC-HELP.CZ

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\System32\RunDLL32.exe
C:\WINDOWS\System32\rundll32.exe
C:\Program Files\WinFast\WFTVFM\WFWIZ.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\WINDOWS\system32\cssrss.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Programy\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Programy\Bluetooth Software\BTTray.exe
C:\Programy\Common\Bin\WinCinemaMgr.exe
C:\Programy\BLUETO~1\BTSTAC~1.EXE
C:\Programy\HijackThis\HijackThis.exe
C:\Programy\Bluetooth Software\bin\btwdins.exe
C:\WINDOWS\System32\CbEvtSvc.exe
C:\Program Files\ICQ6Toolbar\ICQ Service.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\PnkBstrA.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\rhc5nhj0e1cv\rhc5nhj0e1cv.exe
C:\WINDOWS\System32\pphc1nhj0e1cv.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.crawler.com/search/dispatche ... p=aus&qkw=%s&tbid=60207
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://google.icq.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.atlas.cz/?from=icqhp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://www.crawler.com/search/ie.aspx?tb_id=60207
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,CustomizeSearch = http://dnl.crawler.com/support/sa_custo ... TbId=60207
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.crawler.com/search/ie.aspx?tb_id=60207
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://dnl.crawler.com/support/sa_custo ... TbId=60207
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
R3 - URLSearchHook: ICQToolBar - {855F3B16-6D32-4FE6-8A56-BBB695989046} - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
R3 - URLSearchHook: (no name) - - (no file)
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: XTTBPos00 Class - {055FD26D-3A88-4e15-963D-DC8493744B1D} - C:\PROGRA~1\ICQTOO~1\toolbaru.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programy\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: Cole2k Media Toolbar Helper - {08825191-C3C7-44e9-8CA6-07AB521FA8F2} - C:\Program Files\Cole2k Media Toolbar\v2.0.0.2\Cole2k_Media_Toolbar.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Programy\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O3 - Toolbar: (no name) - {BFC32E1D-EE75-4A48-BC60-104E11EE2431} - (no file)
O3 - Toolbar: ICQToolBar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll
O3 - Toolbar: Cole2k Media Toolbar - {015407A9-D183-4379-8452-DFD7C2297902} - C:\Program Files\Cole2k Media Toolbar\v2.0.0.2\Cole2k_Media_Toolbar.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: &Rádio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [SW20] C:\WINDOWS\System32\sw20.exe
O4 - HKLM\..\Run: [SW24] C:\WINDOWS\System32\sw24.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [WinFast Schedule] C:\Program Files\WinFast\WFTVFM\WFWIZ.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Programy\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Bluetooth.lnk = ?
O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Programy\Common\Bin\WinCinemaMgr.exe
O8 - Extra context menu item: &ICQ Toolbar Search - res://C:\Programy\ICQToolbar\toolbaru.dll/SEARCH.HTML
O8 - Extra context menu item: &Search - ?p=ZKfox000
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Office Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Preview - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O8 - Extra context menu item: Easy-WebPrint Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O8 - Extra context menu item: Send to &Bluetooth Device... - C:\Programy\Bluetooth Software\btsendto_ie_ctx.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Zdroje informací - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {BFC32E1D-EE75-4A48-BC60-104E11EE2431} - (no file)
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programy\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programy\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Programy\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Programy\SPYBOT~1\SDHelper.dll
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe
O16 - DPF: {A20B1BB0-AC3D-4530-85F3-791B81303190} (ICQDevilImg Control) - http://xtraz.icq.com/xtraz/products/pho ... vilImg.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: msviiedk - C:\WINDOWS\System32\msviiedk.dll (file missing)
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Programy\Bluetooth Software\bin\btwdins.exe
O23 - Service: CbEvtSvc - Unknown owner - C:\WINDOWS\System32\CbEvtSvc.exe
O23 - Service: ICQ Service - Unknown owner - C:\Program Files\ICQ6Toolbar\ICQ Service.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: My Web Search Service (MyWebSearchService) - Unknown owner - C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwssvc.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\System32\PnkBstrA.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe

Log není celý...
Pokud máš OS 32 bitovou verzi win XP postupuj takto:
Před použitím ComboFix udělej následující kroky:
#Krok 1:
vypni rez. ochranu u SpyBota:
- spusť Spybot - Search & Destroy
Postupuj přesně podle fredika zde, abys vypnul rez. štít:
viewtopic.php?f=70&t=31077
Poté :
Stáhni si ComboFix (by sUBs)
http://download.bleepingcomputer.com/sUBs/ComboFix.exe

a ulož si ho na plochu.
Ukonči všechna aktivní okna a spusť ho.
- Po spuštění se zobrazí podmínky užití, potvrď je stiskem tlačítka Ano
- Dále postupuj dle pokynů, během aplikování ComboFixu neklikej do zobrazujícího se okna
- Po dokončení skenování by měl program vytvořit log - C:\ComboFix.txt - zkopíruj sem prosím celý jeho obsah

ComboFix 08-09-25.03 - Duck 2008-09-25 20:20:20.2 - NTFSx86
Systém Microsoft Windows XP Professional 5.1.2600.1.1250.1.1029.18.1707 [GMT 2:00]
Spuštěný z: C:\Documents and Settings\Duck\Plocha\ComboFix.exe

VAROVÁNÍ - NA TOMTO POČÍTAČI NENÍ NAINSTALOVÁNA KONZOLA PRO ZOTAVENÍ !!
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\Duck\Data aplikací\Microsoft\Internet Explorer\Quick Launch\Antivirus XP 2008.lnk
C:\Documents and Settings\LocalService\Data aplikací\555975823.exe
C:\Documents and Settings\LocalService\Data aplikací\638097440.exe

.
((((((((((((((((((((((((( Soubory vytvořené od 2008-08-25 do 2008-09-25 )))))))))))))))))))))))))))))))
.

2008-09-25 07:13 . 2008-09-25 07:13 29 --a------ C:\WINDOWS\system32\grrrtppp.tmp
2008-09-25 07:12 . <DIR> C:\Documents and Settings\Duck\Data aplikací\rhc5nhj0e1cv
2008-09-25 07:12 . 176,128 C:\Documents and Settings\LocalService\Data aplikací\555975823.exe
2008-09-25 07:12 . 176,128 C:\Documents and Settings\LocalService\Data aplikací\555975823.exe
2008-09-25 07:12 . 176,128 C:\Documents and Settings\LocalService\Data aplikací\555975823.exe
2008-09-25 07:12 . 34,816 C:\Documents and Settings\LocalService\Data aplikací\638097440.exe
2008-09-25 07:12 . 34,816 C:\Documents and Settings\LocalService\Data aplikací\638097440.exe
2008-09-25 07:12 . 34,816 C:\Documents and Settings\LocalService\Data aplikací\638097440.exe
2008-09-22 12:37 . 2008-09-22 12:37 271,360 --a------ C:\WINDOWS\system32\drivers\atksgt.sys
2008-09-22 12:37 . 2008-09-22 12:37 18,048 --a------ C:\WINDOWS\system32\drivers\lirsgt.sys
2008-09-21 17:28 . <DIR> C:\Documents and Settings\Duck\Data aplikací\skypePM
2008-09-14 13:09 . 2001-08-17 22:03 24,192 --a------ C:\WINDOWS\system32\drivers\usbser.sys
2008-09-14 13:09 . 2001-08-17 22:03 24,192 --a--c--- C:\WINDOWS\system32\dllcache\usbser.sys
2008-09-14 13:09 . 2006-10-08 21:51 23,856 --a------ C:\WINDOWS\system32\spupdsvc.exe
2008-09-14 13:09 . 2008-09-14 13:09 0 --ah----- C:\WINDOWS\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf
2008-09-14 13:09 . 2008-09-14 13:09 0 --ah----- C:\WINDOWS\system32\drivers\Msft_Kernel_ccdcmb_01005.Wdf
2008-09-13 09:13 . 2008-09-13 09:13 <DIR> d----c--- C:\WINDOWS\system32\DRVSTORE
2008-09-13 09:13 . 2008-09-13 09:13 <DIR> d-------- C:\Program Files\PC Connectivity Solution
2008-09-13 09:13 . 2008-09-13 09:13 <DIR> d-------- C:\Program Files\Nokia
2008-09-13 09:13 . 2008-09-13 09:13 <DIR> d-------- C:\Program Files\DIFX
2008-09-13 09:13 . 2008-05-07 07:39 1,419,232 --a------ C:\WINDOWS\system32\wdfcoinstaller01005.dll
2008-09-13 09:13 . 2008-05-07 07:38 659,968 --a------ C:\WINDOWS\system32\nmwcdcocls.dll
2008-09-13 09:13 . 2008-05-07 07:38 90,624 --a------ C:\WINDOWS\system32\nmwcdcls.dll
2008-09-13 09:13 . 2007-09-17 15:53 21,632 --a------ C:\WINDOWS\system32\drivers\pccsmcfd.sys
2008-09-13 09:13 . 2008-05-07 07:38 20,864 --a------ C:\WINDOWS\system32\drivers\ccdcmbo.sys
2008-09-13 09:13 . 2008-05-07 07:38 17,536 --a------ C:\WINDOWS\system32\drivers\ccdcmb.sys
2008-09-13 09:13 . 2008-05-07 07:38 8,064 --a------ C:\WINDOWS\system32\drivers\usbser_lowerfltj.sys
2008-09-13 09:13 . 2008-06-06 09:24 8,064 --a------ C:\WINDOWS\system32\drivers\usbser_lowerflt.sys
2008-09-12 17:19 . 2008-09-12 17:19 <DIR> d-------- C:\Program Files\ZAV1

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-09-25 05:24 --------- d-----w C:\Documents and Settings\Duck\Data aplikací\OpenOffice.org2
2008-09-25 05:13 --------- d-----w C:\Documents and Settings\Duck\Data aplikací\uTorrent
2008-09-23 04:40 --------- d-----w C:\Program Files\ICQ6
2008-09-22 10:39 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-09-09 00:43 --------- d-s---w C:\Documents and Settings\Duck\Data aplikací\Microsoft
2008-09-08 18:19 --------- d-----w C:\Documents and Settings\Duck\Data aplikací\dvdcss
2008-08-16 16:31 --------- d-----w C:\Documents and Settings\Duck\Data aplikací\ICQ
2008-08-05 20:45 --------- d-----w C:\Documents and Settings\Duck\Data aplikací\Zoner
2008-07-01 11:02 2,829 ----a-w C:\WINDOWS\War3Unin.pif
2008-07-01 11:02 139,264 ----a-w C:\WINDOWS\War3Unin.exe
2008-06-07 22:03 22,328 ----a-w C:\Documents and Settings\Duck\Data aplikací\PnkBstrK.sys
.

(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{08825191-C3C7-44e9-8CA6-07AB521FA8F2}]
2007-08-08 17:14 495616 --a------ C:\Program Files\Cole2k Media Toolbar\v2.0.0.2\Cole2k_Media_Toolbar.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{015407A9-D183-4379-8452-DFD7C2297902}"= "C:\Program Files\Cole2k Media Toolbar\v2.0.0.2\Cole2k_Media_Toolbar.dll" [2007-08-08 495616]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{015407A9-D183-4379-8452-DFD7C2297902}"= "C:\Program Files\Cole2k Media Toolbar\v2.0.0.2\Cole2k_Media_Toolbar.dll" [2007-08-08 495616]

[HKEY_CLASSES_ROOT\clsid\{015407a9-d183-4379-8452-dfd7c2297902}]
[HKEY_CLASSES_ROOT\ToolBar.ToolBarObj.1]
[HKEY_CLASSES_ROOT\TypeLib\{B3A98058-DE1F-413f-9921-FF3EEA6B716F}]
[HKEY_CLASSES_ROOT\ToolBar.ToolBarObj]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\ctfmon.exe" [2002-09-20 13312]
"SpybotSD TeaTimer"="C:\Programy\Spybot - Search & Destroy\TeaTimer.exe" [2008-01-28 2097488]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\System32\NvCpl.dll" [2006-06-01 7618560]
"SW20"="C:\WINDOWS\System32\sw20.exe" [2006-05-18 208896]
"SW24"="C:\WINDOWS\System32\sw24.exe" [2006-05-17 69632]
"WinFast Schedule"="C:\Program Files\WinFast\WFTVFM\WFWIZ.exe" [2005-03-02 278528]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]
"nwiz"="nwiz.exe" [2006-06-01 C:\WINDOWS\system32\nwiz.exe]
"SoundMan"="SOUNDMAN.EXE" [2004-01-08 C:\WINDOWS\SOUNDMAN.EXE]
"NvMediaCenter"="NvMCTray.dll" [2006-06-01 C:\WINDOWS\system32\nvmctray.dll]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2002-09-20 13312]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.X264"= x264vfw.dll
"vidc.hfyu"= huffyuv.dll
"msacm.divxa32"= DivXa32.acm

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CloneCDTray]
--a------ 2004-09-02 23:57 57344 C:\Programy\CloneCD\CloneCDTray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Easy-PrintToolBox]
--a------ 2004-01-14 04:10 409600 C:\Program Files\Canon\Easy-PrintToolBox\BJPSMAIN.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--a------ 2001-07-09 11:50 155648 C:\WINDOWS\system32\NeroCheck.exe

R2 ICQ Service;ICQ Service;C:\Program Files\ICQ6Toolbar\ICQ Service.exe [2008-06-10 222456]
R2 WF23880;WinFast TV2000/DV2000 WDM Video Capture.;C:\WINDOWS\System32\drivers\wf88vcap.sys [2004-10-18 208851]
R2 WF88XBAR;WinFast TV2000/DV2000 WDM Crossbar.;C:\WINDOWS\System32\drivers\WF88XBAR.sys [2004-10-18 10324]
R2 WFTUNE;WinFast TV2000/DV2000 WDM Tuner.;C:\WINDOWS\System32\drivers\WF88TUNE.sys [2004-10-18 34789]
R3 PSched;Plánovač paketů technologie QoS;C:\WINDOWS\System32\DRIVERS\psched.sys [2002-08-29 66048]
R3 usbhub;Ovladač standardního rozbočovače USB;C:\WINDOWS\System32\DRIVERS\usbhub.sys [2002-08-29 51968]
S3 SetupNTGLM7X;SetupNTGLM7X;F:\NTGLM7X.sys [ ]
S3 usbscan;Ovladač skeneru USB;C:\WINDOWS\System32\DRIVERS\usbscan.sys [2002-08-29 14208]
S3 USBSTOR;Ovladač velkokapacitního paměťového zařízení USB;C:\WINDOWS\System32\DRIVERS\USBSTOR.SYS [2002-08-29 21760]
S3 WFIOCTL;WFIOCTL;C:\Programy\WinFast\WFTVFM\WFIOCTL.SYS [ ]
.
.
------- Doplňkový sken -------
.
R0 -: HKCU-Main,Start Page = hxxp://www.atlas.cz/?from=icqhp
R1 -: HKCU-Internet Connection Wizard,ShellNext = iexplore
O8 -: &ICQ Toolbar Search - C:\Programy\ICQToolbar\toolbaru.dll/SEARCH.HTML
O8 -: &Search - ?p=ZKfox000
O8 -: E&xportovat do aplikace Microsoft Office Excel - C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 -: Easy-WebPrint Add To Print List - C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 -: Easy-WebPrint High Speed Print - C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 -: Easy-WebPrint Preview - C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O8 -: Easy-WebPrint Print - C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O8 -: Send to &Bluetooth Device... - C:\Programy\Bluetooth Software\btsendto_ie_ctx.htm

O16 -: DirectAnimation Java Classes - file://C:\WINDOWS\Java\classes\dajava.cab
C:\WINDOWS\Downloaded Program Files\DirectAnimation Java Classes.osd

O16 -: Microsoft XML Parser for Java - file://C:\WINDOWS\Java\classes\xmldso.cab
C:\WINDOWS\Downloaded Program Files\Microsoft XML Parser for Java.osd

O16 -: {A20B1BB0-AC3D-4530-85F3-791B81303190} - hxxp://xtraz.icq.com/xtraz/products/pho ... vilImg.cab
C:\WINDOWS\Downloaded Program Files\ICQDevilImg.inf
C:\WINDOWS\System32\msvcrt.dll
C:\WINDOWS\System32\mfc42.dll
C:\WINDOWS\System32\olepro32.dll
C:\WINDOWS\Downloaded Program Files\ICQDevilImg.ocx
.

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-09-25 20:21:32
Windows 5.1.2600 Service Pack 1 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************
.
Celkový čas: 2008-09-25 20:22:17
ComboFix-quarantined-files.txt 2008-09-25 18:22:15
ComboFix2.txt 2008-09-25 18:18:15

Před spuštěním: 6˙695˙096˙320
Po spuštění: 6,685,257,728

147

Otevři si Poznámkový blok (Start -> Spustit... a napiš do okna Notepad a dej Ok
Zkopíruj do něj následující celý text označený zeleně:
Poznámka: Nepoužij k označení skriptu funkci VYBRAT VŠE

Kód: Vybrat vše

File::
C:\WINDOWS\system32\grrrtppp.tmp
C:\Documents and Settings\LocalService\Data aplikací\555975823.exe
C:\Documents and Settings\LocalService\Data aplikací\555975823.exe
C:\Documents and Settings\LocalService\Data aplikací\555975823.exe
C:\Documents and Settings\LocalService\Data aplikací\638097440.exe
C:\Documents and Settings\LocalService\Data aplikací\638097440.exe
C:\Documents and Settings\LocalService\Data aplikací\638097440.exe

Folder::
C:\Documents and Settings\Duck\Data aplikací\rhc5nhj0e1cv

Zvol možnost Soubor -> Uložit jako... a nastav tyto parametry:
Název souboru: zde napiš: CFScript.txt
Uložit jako typ: tak tam vyber Všechny soubory
Ulož soubor na plochu.
Ukonči všechna aktivní okna.

Uchop myší vytvořený skript CFScript.txt, přemísti ho nad stažený přejmenovaný program ComboFix.exe a když se oba soubory překryjí, skript upusť
Automaticky se spustí ComboFix
- Vlož sem log, který vyběhne v závěru čistícího procesu + nový log z HJT

ComboFix 08-09-25.03 - Duck 2008-09-26 20:17:25.3 - NTFSx86
Systém Microsoft Windows XP Professional 5.1.2600.1.1250.1.1029.18.1602 [GMT 2:00]
Spuštěný z: C:\Documents and Settings\Duck\Plocha\ComboFix.exe
Použité ovládací přepínače :: C:\Documents and Settings\Duck\Plocha\CFScript.txt
* Vytvořen nový Bod Obnovení

VAROVÁNÍ - NA TOMTO POČÍTAČI NENÍ NAINSTALOVÁNA KONZOLA PRO ZOTAVENÍ !!

FILE ::
C:\Documents and Settings\LocalService\Data aplikací\555975823.exe
C:\Documents and Settings\LocalService\Data aplikací\638097440.exe
C:\WINDOWS\system32\grrrtppp.tmp
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\LocalService\Data aplikací\555975823.exe
C:\Documents and Settings\LocalService\Data aplikací\638097440.exe
C:\WINDOWS\system32\grrrtppp.tmp

.
((((((((((((((((((((((((( Soubory vytvořené od 2008-08-26 do 2008-09-26 )))))))))))))))))))))))))))))))
.

2008-09-25 21:33 . 2008-09-25 21:36 864 --a------ C:\WINDOWS\SOFPLAT.ini
2008-09-25 07:12 . <DIR> C:\Documents and Settings\Duck\Data aplikací\rhc5nhj0e1cv
2008-09-25 07:12 . 176,128 C:\Documents and Settings\LocalService\Data aplikací\555975823.exe
2008-09-25 07:12 . 176,128 C:\Documents and Settings\LocalService\Data aplikací\555975823.exe
2008-09-25 07:12 . 176,128 C:\Documents and Settings\LocalService\Data aplikací\555975823.exe
2008-09-25 07:12 . 34,816 C:\Documents and Settings\LocalService\Data aplikací\638097440.exe
2008-09-25 07:12 . 34,816 C:\Documents and Settings\LocalService\Data aplikací\638097440.exe
2008-09-25 07:12 . 34,816 C:\Documents and Settings\LocalService\Data aplikací\638097440.exe
2008-09-22 12:37 . 2008-09-22 12:37 271,360 --a------ C:\WINDOWS\system32\drivers\atksgt.sys
2008-09-22 12:37 . 2008-09-22 12:37 18,048 --a------ C:\WINDOWS\system32\drivers\lirsgt.sys
2008-09-21 17:28 . <DIR> C:\Documents and Settings\Duck\Data aplikací\skypePM
2008-09-14 13:09 . 2001-08-17 22:03 24,192 --a------ C:\WINDOWS\system32\drivers\usbser.sys
2008-09-14 13:09 . 2001-08-17 22:03 24,192 --a--c--- C:\WINDOWS\system32\dllcache\usbser.sys
2008-09-14 13:09 . 2006-10-08 21:51 23,856 --a------ C:\WINDOWS\system32\spupdsvc.exe
2008-09-14 13:09 . 2008-09-14 13:09 0 --ah----- C:\WINDOWS\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf
2008-09-14 13:09 . 2008-09-14 13:09 0 --ah----- C:\WINDOWS\system32\drivers\Msft_Kernel_ccdcmb_01005.Wdf
2008-09-13 09:13 . 2008-09-13 09:13 <DIR> d----c--- C:\WINDOWS\system32\DRVSTORE
2008-09-13 09:13 . 2008-09-13 09:13 <DIR> d-------- C:\Program Files\PC Connectivity Solution
2008-09-13 09:13 . 2008-09-13 09:13 <DIR> d-------- C:\Program Files\Nokia
2008-09-13 09:13 . 2008-09-13 09:13 <DIR> d-------- C:\Program Files\DIFX
2008-09-13 09:13 . 2008-05-07 07:39 1,419,232 --a------ C:\WINDOWS\system32\wdfcoinstaller01005.dll
2008-09-13 09:13 . 2008-05-07 07:38 659,968 --a------ C:\WINDOWS\system32\nmwcdcocls.dll
2008-09-13 09:13 . 2008-05-07 07:38 90,624 --a------ C:\WINDOWS\system32\nmwcdcls.dll
2008-09-13 09:13 . 2007-09-17 15:53 21,632 --a------ C:\WINDOWS\system32\drivers\pccsmcfd.sys
2008-09-13 09:13 . 2008-05-07 07:38 20,864 --a------ C:\WINDOWS\system32\drivers\ccdcmbo.sys
2008-09-13 09:13 . 2008-05-07 07:38 17,536 --a------ C:\WINDOWS\system32\drivers\ccdcmb.sys
2008-09-13 09:13 . 2008-05-07 07:38 8,064 --a------ C:\WINDOWS\system32\drivers\usbser_lowerfltj.sys
2008-09-13 09:13 . 2008-06-06 09:24 8,064 --a------ C:\WINDOWS\system32\drivers\usbser_lowerflt.sys
2008-09-12 17:19 . 2008-09-12 17:19 <DIR> d-------- C:\Program Files\ZAV1

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-09-26 15:14 --------- d-----w C:\Documents and Settings\Duck\Data aplikací\OpenOffice.org2
2008-09-25 20:31 --------- d-----w C:\Documents and Settings\Duck\Data aplikací\uTorrent
2008-09-23 04:40 --------- d-----w C:\Program Files\ICQ6
2008-09-22 10:39 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-09-09 00:43 --------- d-s---w C:\Documents and Settings\Duck\Data aplikací\Microsoft
2008-09-08 18:19 --------- d-----w C:\Documents and Settings\Duck\Data aplikací\dvdcss
2008-08-16 16:31 --------- d-----w C:\Documents and Settings\Duck\Data aplikací\ICQ
2008-08-05 20:45 --------- d-----w C:\Documents and Settings\Duck\Data aplikací\Zoner
2008-07-01 11:02 2,829 ----a-w C:\WINDOWS\War3Unin.pif
2008-07-01 11:02 139,264 ----a-w C:\WINDOWS\War3Unin.exe
2008-06-07 22:03 22,328 ----a-w C:\Documents and Settings\Duck\Data aplikací\PnkBstrK.sys
.

((((((((((((((((((((((((((((( snapshot@2008-09-25_20.17.28.06 )))))))))))))))))))))))))))))))))))))))))
.
- 1999-01-11 09:40:58 306,688 ----a-w C:\WINDOWS\IsUninst.exe
+ 1998-10-29 14:45:06 306,688 ----a-w C:\WINDOWS\IsUninst.exe
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{08825191-C3C7-44e9-8CA6-07AB521FA8F2}]
2007-08-08 17:14 495616 --a------ C:\Program Files\Cole2k Media Toolbar\v2.0.0.2\Cole2k_Media_Toolbar.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{015407A9-D183-4379-8452-DFD7C2297902}"= "C:\Program Files\Cole2k Media Toolbar\v2.0.0.2\Cole2k_Media_Toolbar.dll" [2007-08-08 495616]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{015407A9-D183-4379-8452-DFD7C2297902}"= "C:\Program Files\Cole2k Media Toolbar\v2.0.0.2\Cole2k_Media_Toolbar.dll" [2007-08-08 495616]

[HKEY_CLASSES_ROOT\clsid\{015407a9-d183-4379-8452-dfd7c2297902}]
[HKEY_CLASSES_ROOT\ToolBar.ToolBarObj.1]
[HKEY_CLASSES_ROOT\TypeLib\{B3A98058-DE1F-413f-9921-FF3EEA6B716F}]
[HKEY_CLASSES_ROOT\ToolBar.ToolBarObj]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\ctfmon.exe" [2002-09-20 13312]
"SpybotSD TeaTimer"="C:\Programy\Spybot - Search & Destroy\TeaTimer.exe" [2008-01-28 2097488]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\System32\NvCpl.dll" [2006-06-01 7618560]
"SW20"="C:\WINDOWS\System32\sw20.exe" [2006-05-18 208896]
"SW24"="C:\WINDOWS\System32\sw24.exe" [2006-05-17 69632]
"WinFast Schedule"="C:\Program Files\WinFast\WFTVFM\WFWIZ.exe" [2005-03-02 278528]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]
"nwiz"="nwiz.exe" [2006-06-01 C:\WINDOWS\system32\nwiz.exe]
"SoundMan"="SOUNDMAN.EXE" [2004-01-08 C:\WINDOWS\SOUNDMAN.EXE]
"NvMediaCenter"="NvMCTray.dll" [2006-06-01 C:\WINDOWS\system32\nvmctray.dll]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2002-09-20 13312]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.X264"= x264vfw.dll
"vidc.hfyu"= huffyuv.dll
"msacm.divxa32"= DivXa32.acm

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CloneCDTray]
--a------ 2004-09-02 23:57 57344 C:\Programy\CloneCD\CloneCDTray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Easy-PrintToolBox]
--a------ 2004-01-14 04:10 409600 C:\Program Files\Canon\Easy-PrintToolBox\BJPSMAIN.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--a------ 2001-07-09 11:50 155648 C:\WINDOWS\system32\NeroCheck.exe

R2 ICQ Service;ICQ Service;C:\Program Files\ICQ6Toolbar\ICQ Service.exe [2008-06-10 222456]
R2 WF23880;WinFast TV2000/DV2000 WDM Video Capture.;C:\WINDOWS\System32\drivers\wf88vcap.sys [2004-10-18 208851]
R2 WF88XBAR;WinFast TV2000/DV2000 WDM Crossbar.;C:\WINDOWS\System32\drivers\WF88XBAR.sys [2004-10-18 10324]
R2 WFTUNE;WinFast TV2000/DV2000 WDM Tuner.;C:\WINDOWS\System32\drivers\WF88TUNE.sys [2004-10-18 34789]
R3 PSched;Plánovač paketů technologie QoS;C:\WINDOWS\System32\DRIVERS\psched.sys [2002-08-29 66048]
R3 usbhub;Ovladač standardního rozbočovače USB;C:\WINDOWS\System32\DRIVERS\usbhub.sys [2002-08-29 51968]
S3 SetupNTGLM7X;SetupNTGLM7X;F:\NTGLM7X.sys [ ]
S3 usbscan;Ovladač skeneru USB;C:\WINDOWS\System32\DRIVERS\usbscan.sys [2002-08-29 14208]
S3 USBSTOR;Ovladač velkokapacitního paměťového zařízení USB;C:\WINDOWS\System32\DRIVERS\USBSTOR.SYS [2002-08-29 21760]
S3 WFIOCTL;WFIOCTL;C:\Programy\WinFast\WFTVFM\WFIOCTL.SYS [ ]
.

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-09-26 20:18:35
Windows 5.1.2600 Service Pack 1 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************
.
Celkový čas: 2008-09-26 20:19:20
ComboFix-quarantined-files.txt 2008-09-26 18:19:18
ComboFix2.txt 2008-09-25 18:22:18
ComboFix3.txt 2008-09-25 18:18:15

Před spuštěním: 9˙126˙948˙864
Po spuštění: 9,116,549,120

135

No nějak se to nevymazalo , nebo se to zase obnovilo, zkus najít a ručně smazat (nebo zkusit v nouzovém režimu):
C:\WINDOWS\system32\grrrtppp.tmp
C:\Documents and Settings\Duck\Data aplikací\rhc5nhj0e1cv
C:\Documents and Settings\LocalService\Data aplikací\555975823.exe
C:\Documents and Settings\LocalService\Data aplikací\638097440.exe
Napiš jak vypadá comp.

C:\WINDOWS\system32\grrrtppp.tmp tohle jsem nenasel
C:\Documents and Settings\Duck\Data aplikací\rhc5nhj0e1cv tohle jsem nasel a smazal
C:\Documents and Settings\LocalService\Data aplikací\555975823.exetohle jsem nenasel
C:\Documents and Settings\LocalService\Data aplikací\638097440.exetohle jsem nenasel

Pocitac uz se tvari normalne, na plose neni tabulka o varovaní, a nic to po me nechce...

Máš zaškrtnuto v možnostech složky zobrazovat skryté a systémové složky?
Pošli pro kontrolu ještě log z HJT.

Nemel jsem povoleno ukazovat skryte atd. povolil jsem tedy vse systemove,apod. A nasel zbyvajici (2 ze 3),
stale jsem nenasel C:\WINDOWS\system32\grrrtppp.tmp

Tady je noví log po smazani vseho ... krom výše uvedeného


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:24:50, on 27.9.2008
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\System32\rundll32.exe
C:\WINDOWS\System32\RunDLL32.exe
C:\Program Files\WinFast\WFTVFM\WFWIZ.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Programy\Spybot - Search & Destroy\TeaTimer.exe
C:\Programy\Bluetooth Software\BTTray.exe
C:\Programy\Common\Bin\WinCinemaMgr.exe
C:\Programy\BLUETO~1\BTSTAC~1.EXE
C:\Programy\Bluetooth Software\bin\btwdins.exe
C:\Program Files\ICQ6Toolbar\ICQ Service.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\PnkBstrA.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\explorer.exe
C:\Programy\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.atlas.cz/?from=icqhp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://www.crawler.com/search/ie.aspx?tb_id=60207
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,CustomizeSearch = http://dnl.crawler.com/support/sa_custo ... TbId=60207
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
R3 - URLSearchHook: ICQToolBar - {855F3B16-6D32-4FE6-8A56-BBB695989046} - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
R3 - URLSearchHook: (no name) - - (no file)
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: XTTBPos00 Class - {055FD26D-3A88-4e15-963D-DC8493744B1D} - C:\PROGRA~1\ICQTOO~1\toolbaru.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programy\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: Cole2k Media Toolbar Helper - {08825191-C3C7-44e9-8CA6-07AB521FA8F2} - C:\Program Files\Cole2k Media Toolbar\v2.0.0.2\Cole2k_Media_Toolbar.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Programy\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O3 - Toolbar: (no name) - {BFC32E1D-EE75-4A48-BC60-104E11EE2431} - (no file)
O3 - Toolbar: ICQToolBar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll
O3 - Toolbar: Cole2k Media Toolbar - {015407A9-D183-4379-8452-DFD7C2297902} - C:\Program Files\Cole2k Media Toolbar\v2.0.0.2\Cole2k_Media_Toolbar.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: &Rádio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [SW20] C:\WINDOWS\System32\sw20.exe
O4 - HKLM\..\Run: [SW24] C:\WINDOWS\System32\sw24.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [WinFast Schedule] C:\Program Files\WinFast\WFTVFM\WFWIZ.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [acjjrrbr] %systemroot%\acjjrrbr.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Programy\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Bluetooth.lnk = ?
O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Programy\Common\Bin\WinCinemaMgr.exe
O8 - Extra context menu item: &ICQ Toolbar Search - res://C:\Programy\ICQToolbar\toolbaru.dll/SEARCH.HTML
O8 - Extra context menu item: &Search - ?p=ZKfox000
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Office Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Preview - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O8 - Extra context menu item: Easy-WebPrint Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O8 - Extra context menu item: Send to &Bluetooth Device... - C:\Programy\Bluetooth Software\btsendto_ie_ctx.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Zdroje informací - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {BFC32E1D-EE75-4A48-BC60-104E11EE2431} - (no file)
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programy\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programy\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Programy\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Programy\SPYBOT~1\SDHelper.dll
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe
O16 - DPF: {A20B1BB0-AC3D-4530-85F3-791B81303190} (ICQDevilImg Control) - http://xtraz.icq.com/xtraz/products/pho ... vilImg.cab
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Programy\Bluetooth Software\bin\btwdins.exe
O23 - Service: ICQ Service - Unknown owner - C:\Program Files\ICQ6Toolbar\ICQ Service.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\System32\PnkBstrA.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe

--
End of file - 7839 bytes

Jo ten smazal ComboFix, jak vypadá comp?
Fix HJT:


tohle netuším , co je:
O4 - HKLM\..\Run: [acjjrrbr] %systemroot%\acjjrrbr.exe

ComboFix 08-09-25.03 - Duck 2008-09-27 17:25:18.4 - NTFSx86
Systém Microsoft Windows XP Professional 5.1.2600.1.1250.1.1029.18.1674 [GMT 2:00]
Spuštěný z: C:\Documents and Settings\Duck\Plocha\ComboFix.exe
Použité ovládací přepínače :: C:\Documents and Settings\Duck\Plocha\CFScript.txt
* Vytvořen nový Bod Obnovení

VAROVÁNÍ - NA TOMTO POČÍTAČI NENÍ NAINSTALOVÁNA KONZOLA PRO ZOTAVENÍ !!
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Program Files\Internet Explorer\setupapi.dll
C:\WINDOWS\system32\drivers\oulurvnu.sys
C:\WINDOWS\system32\drivers\ZZVVRRFF.sys

.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_OULURVNU
-------\Service_oulurvnu
-------\Service_ZZVVRRFF


((((((((((((((((((((((((( Soubory vytvořené od 2008-08-27 do 2008-09-27 )))))))))))))))))))))))))))))))
.

2008-09-27 15:08 . 2008-09-27 13:29 52,736 --a------ C:\61.tmp
2008-09-27 13:28 . 2008-09-25 07:16 52,736 --a------ C:\9E.tmp
2008-09-27 13:27 . 2008-09-27 13:27 29 --a------ C:\WINDOWS\system32\piqdrfau.tmp
2008-09-25 21:33 . 2008-09-25 21:36 864 --a------ C:\WINDOWS\SOFPLAT.ini
2008-09-22 12:37 . 2008-09-22 12:37 271,360 --a------ C:\WINDOWS\system32\drivers\atksgt.sys
2008-09-22 12:37 . 2008-09-22 12:37 18,048 --a------ C:\WINDOWS\system32\drivers\lirsgt.sys
2008-09-21 17:28 . <DIR> C:\Documents and Settings\Duck\Data aplikací\skypePM
2008-09-14 13:09 . 2001-08-17 22:03 24,192 --a------ C:\WINDOWS\system32\drivers\usbser.sys
2008-09-14 13:09 . 2001-08-17 22:03 24,192 --a--c--- C:\WINDOWS\system32\dllcache\usbser.sys
2008-09-14 13:09 . 2006-10-08 21:51 23,856 --a------ C:\WINDOWS\system32\spupdsvc.exe
2008-09-14 13:09 . 2008-09-14 13:09 0 --ah----- C:\WINDOWS\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf
2008-09-14 13:09 . 2008-09-14 13:09 0 --ah----- C:\WINDOWS\system32\drivers\Msft_Kernel_ccdcmb_01005.Wdf
2008-09-13 09:13 . 2008-09-13 09:13 <DIR> d----c--- C:\WINDOWS\system32\DRVSTORE
2008-09-13 09:13 . 2008-09-13 09:13 <DIR> d-------- C:\Program Files\PC Connectivity Solution
2008-09-13 09:13 . 2008-09-13 09:13 <DIR> d-------- C:\Program Files\Nokia
2008-09-13 09:13 . 2008-09-13 09:13 <DIR> d-------- C:\Program Files\DIFX
2008-09-13 09:13 . 2008-05-07 07:39 1,419,232 --a------ C:\WINDOWS\system32\wdfcoinstaller01005.dll
2008-09-13 09:13 . 2008-05-07 07:38 659,968 --a------ C:\WINDOWS\system32\nmwcdcocls.dll
2008-09-13 09:13 . 2008-05-07 07:38 90,624 --a------ C:\WINDOWS\system32\nmwcdcls.dll
2008-09-13 09:13 . 2007-09-17 15:53 21,632 --a------ C:\WINDOWS\system32\drivers\pccsmcfd.sys
2008-09-13 09:13 . 2008-05-07 07:38 20,864 --a------ C:\WINDOWS\system32\drivers\ccdcmbo.sys
2008-09-13 09:13 . 2008-05-07 07:38 17,536 --a------ C:\WINDOWS\system32\drivers\ccdcmb.sys
2008-09-13 09:13 . 2008-05-07 07:38 8,064 --a------ C:\WINDOWS\system32\drivers\usbser_lowerfltj.sys
2008-09-13 09:13 . 2008-06-06 09:24 8,064 --a------ C:\WINDOWS\system32\drivers\usbser_lowerflt.sys
2008-09-12 17:19 . 2008-09-12 17:19 <DIR> d-------- C:\Program Files\ZAV1

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-09-26 15:14 --------- d-----w C:\Documents and Settings\Duck\Data aplikací\OpenOffice.org2
2008-09-25 20:31 --------- d-----w C:\Documents and Settings\Duck\Data aplikací\uTorrent
2008-09-23 04:40 --------- d-----w C:\Program Files\ICQ6
2008-09-22 10:39 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-09-09 00:43 --------- d-s---w C:\Documents and Settings\Duck\Data aplikací\Microsoft
2008-09-08 18:19 --------- d-----w C:\Documents and Settings\Duck\Data aplikací\dvdcss
2008-08-16 16:31 --------- d-----w C:\Documents and Settings\Duck\Data aplikací\ICQ
2008-08-05 20:45 --------- d-----w C:\Documents and Settings\Duck\Data aplikací\Zoner
2008-07-01 11:02 2,829 ----a-w C:\WINDOWS\War3Unin.pif
2008-07-01 11:02 139,264 ----a-w C:\WINDOWS\War3Unin.exe
2008-06-07 22:03 22,328 ----a-w C:\Documents and Settings\Duck\Data aplikací\PnkBstrK.sys
.

((((((((((((((((((((((((((((( snapshot@2008-09-25_20.17.28.06 )))))))))))))))))))))))))))))))))))))))))
.
- 1999-01-11 09:40:58 306,688 ----a-w C:\WINDOWS\IsUninst.exe
+ 1998-10-29 14:45:06 306,688 ----a-w C:\WINDOWS\IsUninst.exe
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{08825191-C3C7-44e9-8CA6-07AB521FA8F2}]
2007-08-08 17:14 495616 --a------ C:\Program Files\Cole2k Media Toolbar\v2.0.0.2\Cole2k_Media_Toolbar.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{015407A9-D183-4379-8452-DFD7C2297902}"= "C:\Program Files\Cole2k Media Toolbar\v2.0.0.2\Cole2k_Media_Toolbar.dll" [2007-08-08 495616]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{015407A9-D183-4379-8452-DFD7C2297902}"= "C:\Program Files\Cole2k Media Toolbar\v2.0.0.2\Cole2k_Media_Toolbar.dll" [2007-08-08 495616]

[HKEY_CLASSES_ROOT\clsid\{015407a9-d183-4379-8452-dfd7c2297902}]
[HKEY_CLASSES_ROOT\ToolBar.ToolBarObj.1]
[HKEY_CLASSES_ROOT\TypeLib\{B3A98058-DE1F-413f-9921-FF3EEA6B716F}]
[HKEY_CLASSES_ROOT\ToolBar.ToolBarObj]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\ctfmon.exe" [2002-09-20 13312]
"SpybotSD TeaTimer"="C:\Programy\Spybot - Search & Destroy\TeaTimer.exe" [2008-01-28 2097488]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\System32\NvCpl.dll" [2006-06-01 7618560]
"SW20"="C:\WINDOWS\System32\sw20.exe" [2006-05-18 208896]
"SW24"="C:\WINDOWS\System32\sw24.exe" [2006-05-17 69632]
"WinFast Schedule"="C:\Program Files\WinFast\WFTVFM\WFWIZ.exe" [2005-03-02 278528]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]
"nwiz"="nwiz.exe" [2006-06-01 C:\WINDOWS\system32\nwiz.exe]
"SoundMan"="SOUNDMAN.EXE" [2004-01-08 C:\WINDOWS\SOUNDMAN.EXE]
"NvMediaCenter"="NvMCTray.dll" [2006-06-01 C:\WINDOWS\system32\nvmctray.dll]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2002-09-20 13312]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.X264"= x264vfw.dll
"vidc.hfyu"= huffyuv.dll
"msacm.divxa32"= DivXa32.acm

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CloneCDTray]
--a------ 2004-09-02 23:57 57344 C:\Programy\CloneCD\CloneCDTray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Easy-PrintToolBox]
--a------ 2004-01-14 04:10 409600 C:\Program Files\Canon\Easy-PrintToolBox\BJPSMAIN.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--a------ 2001-07-09 11:50 155648 C:\WINDOWS\system32\NeroCheck.exe

R2 ICQ Service;ICQ Service;C:\Program Files\ICQ6Toolbar\ICQ Service.exe [2008-06-10 222456]
R2 WF23880;WinFast TV2000/DV2000 WDM Video Capture.;C:\WINDOWS\System32\drivers\wf88vcap.sys [2004-10-18 208851]
R2 WF88XBAR;WinFast TV2000/DV2000 WDM Crossbar.;C:\WINDOWS\System32\drivers\WF88XBAR.sys [2004-10-18 10324]
R2 WFTUNE;WinFast TV2000/DV2000 WDM Tuner.;C:\WINDOWS\System32\drivers\WF88TUNE.sys [2004-10-18 34789]
R3 PSched;Plánovač paketů technologie QoS;C:\WINDOWS\System32\DRIVERS\psched.sys [2002-08-29 66048]
R3 usbhub;Ovladač standardního rozbočovače USB;C:\WINDOWS\System32\DRIVERS\usbhub.sys [2002-08-29 51968]
S3 SetupNTGLM7X;SetupNTGLM7X;F:\NTGLM7X.sys [ ]
S3 usbscan;Ovladač skeneru USB;C:\WINDOWS\System32\DRIVERS\usbscan.sys [2002-08-29 14208]
S3 USBSTOR;Ovladač velkokapacitního paměťového zařízení USB;C:\WINDOWS\System32\DRIVERS\USBSTOR.SYS [2002-08-29 21760]
S3 WFIOCTL;WFIOCTL;C:\Programy\WinFast\WFTVFM\WFIOCTL.SYS [ ]
.

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-09-27 17:28:10
Windows 5.1.2600 Service Pack 1 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************
.
------------------------ Jiné spuštené procesy ------------------------
.
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\rundll32.exe
C:\Programy\Bluetooth Software\BTTray.exe
C:\Programy\Common\Bin\WinCinemaMgr.exe
C:\Programy\Bluetooth Software\BTStackServer.exe
C:\Programy\Bluetooth Software\bin\btwdins.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\ComboFix\pv.cfexe
.
**************************************************************************
.
Celkový čas: 2008-09-27 17:29:58 - počítač byl restartován
ComboFix-quarantined-files.txt 2008-09-27 15:29:54
ComboFix2.txt 2008-09-26 18:19:22
ComboFix3.txt 2008-09-25 18:22:18
ComboFix4.txt 2008-09-25 18:18:15

Před spuštěním: 9˙177˙751˙552
Po spuštění: 9,170,071,552

147

Vse se zdá v poradku

Úplně v pořádku to není, když jsi na netu máš zapnutý rez. štít( Spybot)? Něco tam zase nalezlo..
Zase ho štít vypni , pak ho zase zapni-po aplikaci CF).V ComboFix zase jak je výše tak ještě toto:

Kód: Vybrat vše

File::
C:\61.tmp
C:\9E.tmp
C:\WINDOWS\system32\piqdrfau.tmp

Prozkoušej comp, kdyby něco napiš ,projedem to ještě SDFixem.