PC-HELP.CZ

Od včera az do dnešního brzkého rana JSME řešili problém.Velice pomalu sel internet PC. Internet SE pomalu nenačetl av PC velice dlouho dobu Trvalo nez SE otevřela složka, dokument atd.. . Problém byl pravděpodobně vyřešen. Nyní Reali jsem sel Na PC, Tak 2 Krat spadl windows XP profesional, Ze nastala Chyba. Reali SE konečně načetl, Tak i složky Dokumenty otevřu poměrně rychleji, ALE internet SE načítá nehybné pomalu. Na Internetu Na http://www.update.microsoft.com mi nejdou provést aktualizace. S tímto SE poprvé setkávám úplně. PIS mi na:
Soubory, které systém potřebuje MicrosoftUpdate, Jiz nejsou v počítači nainstalovány Nebo zaregistrované. Reali přehrady zaregistrovat, Tak SE objeví 100% ... dale Na webu došlo k potížím požadovanou stránku nelze Zobrazit.

Prosim, prosim o Pomoc.

Logfile of HijackThis v1.99.1
Scan saved at 9:46:11, on 21.3.2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)

Running processes:
E:\WINDOWS\System32\smss.exe
E:\WINDOWS\system32\winlogon.exe
E:\WINDOWS\system32\services.exe
E:\WINDOWS\system32\lsass.exe
E:\WINDOWS\system32\Ati2evxx.exe
E:\WINDOWS\system32\svchost.exe
E:\WINDOWS\System32\svchost.exe
E:\WINDOWS\system32\svchost.exe
E:\WINDOWS\system32\spoolsv.exe
E:\WINDOWS\system32\Ati2evxx.exe
E:\WINDOWS\system32\WgaTray.exe
E:\WINDOWS\Explorer.EXE
E:\WINDOWS\system32\ati2sgag.exe
E:\WINDOWS\ATKKBService.exe
E:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
E:\Program Files\F-Secure\Anti-Virus\FSGK32.EXE
E:\Program Files\F-Secure\FWES\Program\fsdfwd.exe
E:\Program Files\F-Secure\Common\FSMA32.EXE
E:\Program Files\F-Secure\Common\FSMB32.EXE
E:\Program Files\Java\jre6\bin\jqs.exe
E:\Program Files\F-Secure\Common\FCH32.EXE
E:\Program Files\SimpleCenter\bin\win\sclauncher.exe
E:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
E:\Program Files\F-Secure\Common\FAMEH32.EXE
E:\Program Files\F-Secure\Anti-Virus\fsqh.exe
E:\Program Files\ATI Technologies\ATI.ACE\cli.exe
E:\Program Files\Pinnacle\MediaServer\Microsoft SQL Server\MSSQL$PINNACLESYS\Binn\sqlservr.exe
E:\WINDOWS\V0330Mon.exe
E:\Program Files\VIAudioi\SBADeck\ADeck.exe
E:\WINDOWS\System32\svchost.exe
E:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe
E:\WINDOWS\system32\ctfmon.exe
E:\WINDOWS\system32\wuauclt.exe
e:\program files\pinnacle\shared files\programs\mediaserver\pmshost.exe
E:\Program Files\ATI Technologies\ATI.ACE\cli.exe
E:\Program Files\ATI Technologies\ATI.ACE\cli.exe
E:\Documents and Settings\Jarda\Plocha\Programy a pomoc\prográmky na VIRY\HijackThis - program který dělá LOG\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.centrum.cz/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
O1 - Hosts: ˙ţ127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - e:\program files\google\googletoolbar1.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - E:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - E:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - e:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [sclauncher] E:\Program Files\SimpleCenter\bin\win\sclauncher.exe
O4 - HKLM\..\Run: [ATICCC] "E:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKLM\..\Run: [V0330Mon.exe] E:\WINDOWS\V0330Mon.exe
O4 - HKLM\..\Run: [AudioDeck] E:\Program Files\VIAudioi\SBADeck\ADeck.exe 1
O4 - HKCU\..\Run: [PC Suite Tray] "E:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe" -onlytray
O4 - HKCU\..\Run: [ctfmon.exe] E:\WINDOWS\system32\ctfmon.exe
O8 - Extra context menu item: &Google Search - res://E:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://E:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://E:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Office Excel - res://E:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://E:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://E:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - E:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Zdroje informací - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - E:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - E:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - E:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: e:\program files\f-secure\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: e:\program files\f-secure\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: e:\program files\f-secure\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: e:\program files\f-secure\fsps\program\fslsp.dll
O11 - Options group: [INTERNATIONAL] International
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microso ... 6262874953
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - E:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: dimsntfy - %SystemRoot%\System32\dimsntfy.dll (file missing)
O20 - Winlogon Notify: WgaLogon - E:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - E:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - E:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - E:\WINDOWS\system32\ati2sgag.exe
O23 - Service: ATK Keyboard Service (ATKKeyboardService) - ASUSTeK COMPUTER INC. - E:\WINDOWS\ATKKBService.exe
O23 - Service: Autodesk Licensing Service - Autodesk - E:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corporation - E:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
O23 - Service: F-Secure Automatic Update Agent (FSAUA) - F-Secure Corporation - E:\Program Files\F-Secure\FSAUA\program\fsaua.exe
O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - E:\Program Files\F-Secure\FWES\Program\fsdfwd.exe
O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - E:\Program Files\F-Secure\Common\FSMA32.EXE
O23 - Service: F-Secure ORSP Client (FSORSPClient) - F-Secure Corporation - E:\Program Files\F-Secure\ORSP Client\fsorsp.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - E:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Unknown owner - E:\Program Files\Java\jre6\bin\jqs.exe" -service -config "E:\Program Files\Java\jre6\lib\deploy\jqs\jqs.conf (file missing)
O23 - Service: Pinnacle Systems Media Service (PinnacleSys.MediaServer) - Pinnacle Systems - e:\program files\pinnacle\shared files\programs\mediaserver\pmshost.exe
O23 - Service: ServiceLayer - Nokia - E:\Program Files\PC Connectivity Solution\ServiceLayer.exe





Malwarebytes' Anti-Malware 1.44
Verze databáze: 3890
Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

21.3.2010 10:01:26
mbam-log-2010-03-21 (10-01-26).txt

Typ kontroly: Rychlá kontrola
Zkontrolované objekty: 126523
Uplynulý čas: 12 minute(s), 34 second(s)

Infikované procesy v paměti: 0
Infikované moduly v paměti: 0
Infikované klíče registru: 0
Infikované hodnoty registru: 0
Infikované datové položky registru: 0
Infikované adresáře: 0
Infikované soubory: 0

Infikované procesy v paměti:
(Nebyly nalezeny žádné škodlivé položky)

Infikované moduly v paměti:
(Nebyly nalezeny žádné škodlivé položky)

Infikované klíče registru:
(Nebyly nalezeny žádné škodlivé položky)

Infikované hodnoty registru:
(Nebyly nalezeny žádné škodlivé položky)

Infikované datové položky registru:
(Nebyly nalezeny žádné škodlivé položky)

Infikované adresáře:
(Nebyly nalezeny žádné škodlivé položky)

Infikované soubory:
(Nebyly nalezeny žádné škodlivé položky)

Zavři ostatní aplikace a prohlížeče, odpoj se od netu a fixni v HJT:
Návod



Stáhni si FixIEDef by ShadowPuterDude
na plochu.
Poklepej na FixIEDef
Až se objeví Copyright and Disclaimer notice, klikni na OK a poté na Scan.
Když se objeví zpráva , klikni na OK. Když program skončí , klikni na Exit.
Log se objeví na ploše. Vlož celý obsah toho logu sem.

Vypni rez. ochrany a firewall u F-Secure.

Stáhni si ComboFix (by sUBs)
a ulož si ho na plochu.
Ukonči všechna aktivní okna a spusť ho.
- Po spuštění se zobrazí podmínky užití, potvrď je stiskem tlačítka Ano
- Dále postupuj dle pokynů, během aplikování ComboFixu neklikej do zobrazujícího se okna
- Po dokončení skenování by měl program vytvořit log - C:\ComboFix.txt - zkopíruj sem prosím celý jeho obsah

Udělal jsem vše dle pokynů.
Při spuštění Combo fix nastal ale problém. Vypnul jsem ochrany, internet a když se spustil ComboFix, tak se po chvíli restartoval PC a poté naskočila modrá obrazovka s upozorněním, že může dojít k poškození PC, windows atd. dále jsem to nestihl. PC se opět restartoval a zde jsou výsledky.

Logfile of HijackThis v1.99.1
Scan saved at 10:29:18, on 21.3.2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)

Running processes:
E:\WINDOWS\System32\smss.exe
E:\WINDOWS\system32\winlogon.exe
E:\WINDOWS\system32\services.exe
E:\WINDOWS\system32\lsass.exe
E:\WINDOWS\system32\Ati2evxx.exe
E:\WINDOWS\system32\svchost.exe
E:\WINDOWS\System32\svchost.exe
E:\WINDOWS\system32\svchost.exe
E:\WINDOWS\system32\spoolsv.exe
E:\WINDOWS\system32\Ati2evxx.exe
E:\WINDOWS\Explorer.EXE
E:\WINDOWS\ATKKBService.exe
E:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
E:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
E:\Program Files\F-Secure\Anti-Virus\FSGK32.EXE
E:\Program Files\F-Secure\Common\FSMA32.EXE
E:\Program Files\F-Secure\Common\FSMB32.EXE
E:\Program Files\Java\jre6\bin\jqs.exe
E:\Program Files\F-Secure\Common\FCH32.EXE
E:\Program Files\SimpleCenter\bin\win\sclauncher.exe
E:\Program Files\ATI Technologies\ATI.ACE\cli.exe
E:\Program Files\F-Secure\Common\FAMEH32.EXE
E:\Program Files\F-Secure\Anti-Virus\fsqh.exe
E:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
E:\WINDOWS\V0330Mon.exe
E:\Program Files\VIAudioi\SBADeck\ADeck.exe
E:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe
E:\Program Files\Pinnacle\MediaServer\Microsoft SQL Server\MSSQL$PINNACLESYS\Binn\sqlservr.exe
E:\WINDOWS\system32\ctfmon.exe
E:\WINDOWS\System32\svchost.exe
e:\program files\pinnacle\shared files\programs\mediaserver\pmshost.exe
E:\Program Files\ATI Technologies\ATI.ACE\cli.exe
E:\Program Files\ATI Technologies\ATI.ACE\cli.exe
E:\Program Files\F-Secure\FSAUA\program\fsaua.exe
E:\Program Files\F-Secure\Anti-Virus\fssm32.exe
E:\Program Files\PC Connectivity Solution\ServiceLayer.exe
E:\WINDOWS\System32\wbem\wmiapsrv.exe
E:\Program Files\F-Secure\FSAUA\program\fsus.exe
E:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe
E:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe
E:\Program Files\F-Secure\Anti-Virus\fsav32.exe
E:\Program Files\Skype\Phone\Skype.exe
E:\Program Files\Skype\Plugin Manager\SkypePM.exe
E:\Documents and Settings\Jarda\Plocha\Programy a pomoc\prográmky na VIRY\HijackThis - program který dělá LOG\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.centrum.cz/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - e:\program files\google\googletoolbar1.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - E:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - E:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - e:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [sclauncher] E:\Program Files\SimpleCenter\bin\win\sclauncher.exe
O4 - HKLM\..\Run: [ATICCC] "E:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKLM\..\Run: [V0330Mon.exe] E:\WINDOWS\V0330Mon.exe
O4 - HKLM\..\Run: [AudioDeck] E:\Program Files\VIAudioi\SBADeck\ADeck.exe 1
O4 - HKCU\..\Run: [PC Suite Tray] "E:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe" -onlytray
O4 - HKCU\..\Run: [ctfmon.exe] E:\WINDOWS\system32\ctfmon.exe
O8 - Extra context menu item: &Google Search - res://E:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://E:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://E:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Office Excel - res://E:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://E:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://E:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - E:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Zdroje informací - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - E:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - E:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - E:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: e:\program files\f-secure\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: e:\program files\f-secure\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: e:\program files\f-secure\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: e:\program files\f-secure\fsps\program\fslsp.dll
O11 - Options group: [INTERNATIONAL] International
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microso ... 6262874953
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - E:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: dimsntfy - %SystemRoot%\System32\dimsntfy.dll (file missing)
O20 - Winlogon Notify: WgaLogon - E:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - E:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - E:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - E:\WINDOWS\system32\ati2sgag.exe
O23 - Service: ATK Keyboard Service (ATKKeyboardService) - ASUSTeK COMPUTER INC. - E:\WINDOWS\ATKKBService.exe
O23 - Service: Autodesk Licensing Service - Autodesk - E:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corporation - E:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
O23 - Service: F-Secure Automatic Update Agent (FSAUA) - F-Secure Corporation - E:\Program Files\F-Secure\FSAUA\program\fsaua.exe
O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - E:\Program Files\F-Secure\FWES\Program\fsdfwd.exe
O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - E:\Program Files\F-Secure\Common\FSMA32.EXE
O23 - Service: F-Secure ORSP Client (FSORSPClient) - F-Secure Corporation - E:\Program Files\F-Secure\ORSP Client\fsorsp.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - E:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Unknown owner - E:\Program Files\Java\jre6\bin\jqs.exe" -service -config "E:\Program Files\Java\jre6\lib\deploy\jqs\jqs.conf (file missing)
O23 - Service: Pinnacle Systems Media Service (PinnacleSys.MediaServer) - Pinnacle Systems - e:\program files\pinnacle\shared files\programs\mediaserver\pmshost.exe
O23 - Service: ServiceLayer - Nokia - E:\Program Files\PC Connectivity Solution\ServiceLayer.exe



********************************************************************************
* *
* FixIEDef Log *
* Version 1.7.22.7514 *
* *
********************************************************************************

Created at 10:31:36 on Sunday, March 21, 2010

Time Zone :

Logged On User : Jarda

Operating System : Systém Microsoft Windows XP Professional Service Pack 3
OS Architecture : X86
System Langauge : Czech
Keyboard Layout : Czech
Processor : X64 AMD Athlon(tm) 64 Processor 3000+

System Drive : E:\
Windows Directory : E:\WINDOWS
System Directory : E:\WINDOWS\system32

System Drive Type : Fixed
System Drive Status : READY
System Drive Label : Místní disk
System Drive Size : 238.46 GB
System Drive Free : 79.27 GB

Total Physical Memory: 1023 MB
Free Physical Memory : 392 MB
Total Page File : 1023 MB
Free Page File : 995 MB
Total Virtual Memory : 2048 MB
Free Virtual Memory : 1961 MB

Boot State : Normal boot

--------------------------------------------------------------------------------

!!! userinit.exe is Clean !!!

--------------------------------------------------------------------------------

!!! Files that have been deleted !!!

No malicious files found

--------------------------------------------------------------------------------

!!! Directories that have been removed !!!

No malicious directories to be removed

--------------------------------------------------------------------------------

!!! Registry entries that have been removed !!!

No malicious Registry entries found

================================================================================

All Done :)

ShadowPuterDude

Safe Surfing!!!

výsledek z Combofix



ComboFix 10-03-20.01 - Jarda 21.03.2010 10:41:42.7.1 - x86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.420.1029.18.1023.622 [GMT 1:00]
Spuštěný z: e:\documents and settings\Jarda\Plocha\ComboFix.exe
AV: F-Secure Profi Antivirus 8.01 *On-access scanning disabled* (Updated) {E7512ED5-4245-4B4D-AF3A-382D3F313F15}
FW: F-Secure Profi Antivirus 8.01 *enabled* {D4747503-0346-49EB-9262-997542F79BF4}
.

((((((((((((((((((((((((( Soubory vytvořené od 2010-02-21 do 2010-03-21 )))))))))))))))))))))))))))))))
.

2010-03-21 09:30 . 2010-03-21 09:30 -------- d-----w- e:\windows\ERUNT
2010-03-21 09:30 . 2010-03-21 09:30 -------- d-----w- E:\!FixIEDef
2010-03-21 08:18 . 2009-09-04 16:44 69464 ----a-w- e:\windows\system32\XAPOFX1_3.dll
2010-03-21 08:16 . 2010-03-21 08:40 -------- d--h--w- e:\windows\msdownld.tmp
2010-03-21 08:16 . 2010-03-21 08:16 -------- d-----w- e:\windows\Logs
2010-03-20 14:57 . 2010-02-12 10:03 293376 ------w- e:\windows\system32\browserchoice.exe
2010-03-10 05:47 . 2009-10-23 15:28 3558912 -c----w- e:\windows\system32\dllcache\moviemk.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-03-21 06:12 . 2009-02-24 17:45 -------- d-----w- e:\program files\F-Secure
2010-03-21 00:39 . 2008-10-25 20:57 -------- d-----w- e:\program files\Trend Micro
2010-03-21 00:10 . 2003-04-16 12:00 970720 ----a-w- e:\windows\system32\perfh005.dat
2010-03-21 00:10 . 2003-04-16 12:00 347646 ----a-w- e:\windows\system32\perfc005.dat
2010-03-20 14:03 . 2009-07-14 17:04 -------- d-----w- e:\program files\CCleaner
2010-03-05 19:44 . 2008-10-25 19:38 -------- d-----w- e:\program files\Malwarebytes' Anti-Malware
2010-02-04 09:01 . 2010-03-21 08:19 74072 ----a-w- e:\windows\system32\XAPOFX1_4.dll
2010-02-04 09:01 . 2010-03-21 08:19 528216 ----a-w- e:\windows\system32\XAudio2_6.dll
2010-02-04 09:01 . 2010-03-21 08:19 238936 ----a-w- e:\windows\system32\xactengine3_6.dll
2010-02-04 09:01 . 2010-03-21 08:19 22360 ----a-w- e:\windows\system32\X3DAudio1_7.dll
2010-01-30 12:08 . 2010-01-30 12:08 0 ---ha-w- e:\windows\system32\drivers\Msft_User_WpdMtpDr_01_00_00.Wdf
2010-01-23 13:15 . 2008-08-12 18:44 -------- d-----w- e:\program files\VSO
2010-01-23 08:42 . 2010-01-23 08:42 -------- d-----w- e:\program files\FreeTime
2010-01-23 08:13 . 2010-01-23 08:12 -------- d-----w- e:\program files\DVDFab 6
2010-01-20 10:49 . 2009-07-12 09:20 -------- d-----w- e:\program files\Microsoft Silverlight
2010-01-07 15:07 . 2008-10-25 19:38 38224 ----a-w- e:\windows\system32\drivers\mbamswissarmy.sys
2010-01-07 15:07 . 2008-10-25 19:38 19160 ----a-w- e:\windows\system32\drivers\mbam.sys
2009-12-31 16:50 . 2003-04-16 12:00 353792 ----a-w- e:\windows\system32\drivers\srv.sys
2009-12-21 19:08 . 2006-06-23 12:27 916480 ------w- e:\windows\system32\wininet.dll
.

(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"PC Suite Tray"="e:\program files\Nokia\Nokia PC Suite 7\PCSuite.exe" [2009-11-11 1451520]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"sclauncher"="e:\program files\SimpleCenter\bin\win\sclauncher.exe" [2007-10-11 94208]
"ATICCC"="e:\program files\ATI Technologies\ATI.ACE\cli.exe" [2006-01-02 45056]
"V0330Mon.exe"="e:\windows\V0330Mon.exe" [2007-04-30 32768]
"AudioDeck"="e:\program files\VIAudioi\SBADeck\ADeck.exe" [2004-04-19 7916032]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="e:\windows\System32\CTFMON.EXE" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"e:\\Programy\\Macromedia studio MX\\Dreamweaver MX\\Dreamweaver.exe"=
"e:\\Programy\\Macromedia studio MX\\Fireworks MX\\Fireworks.exe"=
"e:\\Programy\\Macromedia studio MX\\Flash MX\\Flash.exe"=
"e:\\Programy\\Macromedia studio MX\\FreeHand 10\\FreeHand 10.exe"=
"e:\\Programy\\Pinnacle\\programs\\RM.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"e:\\Program Files\\Pinnacle\\Shared Files\\Programs\\MediaManager\\PMSManager.exe"=
"e:\\Programy\\Pinnacle\\programs\\Studio.exe"=
"e:\\HRY\\mohaa\\MOHAA.exe"=
"e:\\HRY\\Farcry\\Bin32\\FarCry.exe"=
"e:\\HRY\\pán prstenů-bitva o středozem\\game.dat"=
"e:\\Program Files\\Nokia\\Nokia Software Updater\\nsu_ui_client.exe"=
"e:\\Program Files\\Common Files\\Nokia\\Service Layer\\A\\nsl_host_process.exe"=
"e:\\HRY\\Metin 2\\metin2client.bin"=
"e:\\Program Files\\Skype\\Phone\\Skype.exe"=

R0 fsbts;fsbts;e:\windows\system32\drivers\fsbts.sys [24.2.2009 18:47 33920]
R0 FSFW;F-Secure Firewall Driver;e:\windows\system32\drivers\fsdfw.sys [24.2.2009 18:47 79872]
R1 F-Secure HIPS;F-Secure HIPS Driver;e:\program files\F-Secure\HIPS\drivers\fshs.sys [24.2.2009 18:46 67808]
R2 FSORSPClient;F-Secure ORSP Client;e:\program files\F-Secure\ORSP Client\fsorsp.exe [24.2.2009 18:46 55904]
R3 F-Secure Gatekeeper;F-Secure Gatekeeper;e:\program files\F-Secure\Anti-Virus\minifilter\fsgk.sys [24.2.2009 18:46 107104]
R3 V0330VID;WebCam Vista/Live! Cam Chat;e:\windows\system32\drivers\V0330Vid.sys [24.1.2009 12:32 157696]
S0 sptd;sptd;e:\windows\system32\drivers\sptd.sys [27.2.2008 15:27 639224]
S3 magpsc;magpsc;e:\windows\system32\drivers\magpsc.sys [17.4.2009 14:55 53463]
S3 nmwcdnsu;Nokia USB Flashing Phone Parent;e:\windows\system32\drivers\nmwcdnsu.sys [25.11.2009 17:37 136704]
S3 nmwcdnsuc;Nokia USB Flashing Generic;e:\windows\system32\drivers\nmwcdnsuc.sys [25.11.2009 17:37 8320]
S3 s115bus;Sony Ericsson Device 115 driver (WDM);e:\windows\system32\drivers\s115bus.sys [1.10.2008 17:21 83208]
S3 s115mdfl;Sony Ericsson Device 115 USB WMC Modem Filter;e:\windows\system32\drivers\s115mdfl.sys [1.10.2008 17:22 15112]
S3 s115mdm;Sony Ericsson Device 115 USB WMC Modem Driver;e:\windows\system32\drivers\s115mdm.sys [1.10.2008 17:22 108680]
S3 s115mgmt;Sony Ericsson Device 115 USB WMC Device Management Drivers (WDM);e:\windows\system32\drivers\s115mgmt.sys [1.10.2008 17:22 100488]
S3 s115obex;Sony Ericsson Device 115 USB WMC OBEX Interface;e:\windows\system32\drivers\s115obex.sys [1.10.2008 17:22 98568]
S3 TVICHW32;TVICHW32;e:\windows\system32\drivers\TVICHW32.SYS [9.1.2009 19:09 23600]
S4 F-Secure Filter;F-Secure File System Filter;e:\program files\F-Secure\Anti-Virus\win2k\fsfilter.sys [24.2.2009 18:46 39776]
S4 F-Secure Recognizer;F-Secure File System Recognizer;e:\program files\F-Secure\Anti-Virus\win2k\fsrec.sys [24.2.2009 18:46 25184]
.
Obsah adresáře 'Naplánované úlohy'

2010-03-21 e:\windows\Tasks\Scheduled scanning task.job
- e:\progra~1\F-Secure\ANTI-V~1\fsav.exe [2009-02-24 13:57]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.centrum.cz/
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: &Google Search - e:\program files\Google\GoogleToolbar1.dll/cmsearch.html
IE: Backward Links - e:\program files\Google\GoogleToolbar1.dll/cmbacklinks.html
IE: Cached Snapshot of Page - e:\program files\Google\GoogleToolbar1.dll/cmcache.html
IE: E&xportovat do aplikace Microsoft Office Excel - e:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Similar Pages - e:\program files\Google\GoogleToolbar1.dll/cmsimilar.html
IE: Translate into English - e:\program files\Google\GoogleToolbar1.dll/cmtrans.html
LSP: e:\program files\F-Secure\FSPS\program\FSLSP.DLL
.
.
------- Asociace souborů -------
.
.scr=AutoCADScriptFile
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -

AddRemove-HijackThis - e:\documents and settings\Jarda\Plocha\HijackThis.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-03-21 10:48
Windows 5.1.2600 Service Pack 3 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------

[HKEY_USERS\S-1-5-21-1757981266-838170752-839522115-1003\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'winlogon.exe'(616)
e:\windows\system32\Ati2evxx.dll

- - - - - - - > 'lsass.exe'(672)
e:\program files\F-Secure\FSPS\program\FSLSP.DLL
.
Celkový čas: 2010-03-21 10:51:47
ComboFix-quarantined-files.txt 2010-03-21 09:51

Před spuštěním: Volných bajtů: 83 037 315 072
Po spuštění: Volných bajtů: 82 977 923 072

- - End Of File - - 88221D5C6D417661570067807A4C6A29

Otevři si Poznámkový blok (Start -> Spustit... a napiš do okna Notepad a dej Ok.
Zkopíruj do něj následující celý text označený zeleně:
Poznámka: Nepoužij k označení skriptu funkci VYBRAT VŠE


Zvol možnost Soubor -> Uložit jako... a nastav tyto parametry:
Název souboru: zde napiš: CFScript.txt
Uložit jako typ: tak tam vyber Všechny soubory
Ulož soubor na plochu.
Ukonči všechna aktivní okna.

Uchop myší vytvořený skript CFScript.txt, přemísti ho nad stažený program ComboFix.exe a když se oba soubory překryjí, skript upusť.
- Automaticky se spustí ComboFix
- Vlož sem log, který vyběhne v závěru čistícího procesu + nový log z HJT

Vypni si rez.ochrany i firewall.
Stáhni si Dr. Web CureIt
dej update , po aktualizaci dej start.
Tlacitky dole muzeš soubor léčit, smazat, přesunout nebo přejmenovat

Při tom přemístěni CFSCript na Combo Fix mám vypnou ochrany a internet?

Určitě , je to lepší.

ComboFix 10-03-20.01 - Jarda 21.03.2010 10:41:42.7.1 - x86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.420.1029.18.1023.622 [GMT 1:00]
Spuštěný z: e:\documents and settings\Jarda\Plocha\ComboFix.exe
AV: F-Secure Profi Antivirus 8.01 *On-access scanning disabled* (Updated) {E7512ED5-4245-4B4D-AF3A-382D3F313F15}
FW: F-Secure Profi Antivirus 8.01 *enabled* {D4747503-0346-49EB-9262-997542F79BF4}
.

((((((((((((((((((((((((( Soubory vytvořené od 2010-02-21 do 2010-03-21 )))))))))))))))))))))))))))))))
.

2010-03-21 09:30 . 2010-03-21 09:30 -------- d-----w- e:\windows\ERUNT
2010-03-21 09:30 . 2010-03-21 09:30 -------- d-----w- E:\!FixIEDef
2010-03-21 08:18 . 2009-09-04 16:44 69464 ----a-w- e:\windows\system32\XAPOFX1_3.dll
2010-03-21 08:16 . 2010-03-21 08:40 -------- d--h--w- e:\windows\msdownld.tmp
2010-03-21 08:16 . 2010-03-21 08:16 -------- d-----w- e:\windows\Logs
2010-03-20 14:57 . 2010-02-12 10:03 293376 ------w- e:\windows\system32\browserchoice.exe
2010-03-10 05:47 . 2009-10-23 15:28 3558912 -c----w- e:\windows\system32\dllcache\moviemk.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-03-21 06:12 . 2009-02-24 17:45 -------- d-----w- e:\program files\F-Secure
2010-03-21 00:39 . 2008-10-25 20:57 -------- d-----w- e:\program files\Trend Micro
2010-03-21 00:10 . 2003-04-16 12:00 970720 ----a-w- e:\windows\system32\perfh005.dat
2010-03-21 00:10 . 2003-04-16 12:00 347646 ----a-w- e:\windows\system32\perfc005.dat
2010-03-20 14:03 . 2009-07-14 17:04 -------- d-----w- e:\program files\CCleaner
2010-03-05 19:44 . 2008-10-25 19:38 -------- d-----w- e:\program files\Malwarebytes' Anti-Malware
2010-02-04 09:01 . 2010-03-21 08:19 74072 ----a-w- e:\windows\system32\XAPOFX1_4.dll
2010-02-04 09:01 . 2010-03-21 08:19 528216 ----a-w- e:\windows\system32\XAudio2_6.dll
2010-02-04 09:01 . 2010-03-21 08:19 238936 ----a-w- e:\windows\system32\xactengine3_6.dll
2010-02-04 09:01 . 2010-03-21 08:19 22360 ----a-w- e:\windows\system32\X3DAudio1_7.dll
2010-01-30 12:08 . 2010-01-30 12:08 0 ---ha-w- e:\windows\system32\drivers\Msft_User_WpdMtpDr_01_00_00.Wdf
2010-01-23 13:15 . 2008-08-12 18:44 -------- d-----w- e:\program files\VSO
2010-01-23 08:42 . 2010-01-23 08:42 -------- d-----w- e:\program files\FreeTime
2010-01-23 08:13 . 2010-01-23 08:12 -------- d-----w- e:\program files\DVDFab 6
2010-01-20 10:49 . 2009-07-12 09:20 -------- d-----w- e:\program files\Microsoft Silverlight
2010-01-07 15:07 . 2008-10-25 19:38 38224 ----a-w- e:\windows\system32\drivers\mbamswissarmy.sys
2010-01-07 15:07 . 2008-10-25 19:38 19160 ----a-w- e:\windows\system32\drivers\mbam.sys
2009-12-31 16:50 . 2003-04-16 12:00 353792 ----a-w- e:\windows\system32\drivers\srv.sys
2009-12-21 19:08 . 2006-06-23 12:27 916480 ------w- e:\windows\system32\wininet.dll
.

(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"PC Suite Tray"="e:\program files\Nokia\Nokia PC Suite 7\PCSuite.exe" [2009-11-11 1451520]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"sclauncher"="e:\program files\SimpleCenter\bin\win\sclauncher.exe" [2007-10-11 94208]
"ATICCC"="e:\program files\ATI Technologies\ATI.ACE\cli.exe" [2006-01-02 45056]
"V0330Mon.exe"="e:\windows\V0330Mon.exe" [2007-04-30 32768]
"AudioDeck"="e:\program files\VIAudioi\SBADeck\ADeck.exe" [2004-04-19 7916032]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="e:\windows\System32\CTFMON.EXE" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"e:\\Programy\\Macromedia studio MX\\Dreamweaver MX\\Dreamweaver.exe"=
"e:\\Programy\\Macromedia studio MX\\Fireworks MX\\Fireworks.exe"=
"e:\\Programy\\Macromedia studio MX\\Flash MX\\Flash.exe"=
"e:\\Programy\\Macromedia studio MX\\FreeHand 10\\FreeHand 10.exe"=
"e:\\Programy\\Pinnacle\\programs\\RM.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"e:\\Program Files\\Pinnacle\\Shared Files\\Programs\\MediaManager\\PMSManager.exe"=
"e:\\Programy\\Pinnacle\\programs\\Studio.exe"=
"e:\\HRY\\mohaa\\MOHAA.exe"=
"e:\\HRY\\Farcry\\Bin32\\FarCry.exe"=
"e:\\HRY\\pán prstenů-bitva o středozem\\game.dat"=
"e:\\Program Files\\Nokia\\Nokia Software Updater\\nsu_ui_client.exe"=
"e:\\Program Files\\Common Files\\Nokia\\Service Layer\\A\\nsl_host_process.exe"=
"e:\\HRY\\Metin 2\\metin2client.bin"=
"e:\\Program Files\\Skype\\Phone\\Skype.exe"=

R0 fsbts;fsbts;e:\windows\system32\drivers\fsbts.sys [24.2.2009 18:47 33920]
R0 FSFW;F-Secure Firewall Driver;e:\windows\system32\drivers\fsdfw.sys [24.2.2009 18:47 79872]
R1 F-Secure HIPS;F-Secure HIPS Driver;e:\program files\F-Secure\HIPS\drivers\fshs.sys [24.2.2009 18:46 67808]
R2 FSORSPClient;F-Secure ORSP Client;e:\program files\F-Secure\ORSP Client\fsorsp.exe [24.2.2009 18:46 55904]
R3 F-Secure Gatekeeper;F-Secure Gatekeeper;e:\program files\F-Secure\Anti-Virus\minifilter\fsgk.sys [24.2.2009 18:46 107104]
R3 V0330VID;WebCam Vista/Live! Cam Chat;e:\windows\system32\drivers\V0330Vid.sys [24.1.2009 12:32 157696]
S0 sptd;sptd;e:\windows\system32\drivers\sptd.sys [27.2.2008 15:27 639224]
S3 magpsc;magpsc;e:\windows\system32\drivers\magpsc.sys [17.4.2009 14:55 53463]
S3 nmwcdnsu;Nokia USB Flashing Phone Parent;e:\windows\system32\drivers\nmwcdnsu.sys [25.11.2009 17:37 136704]
S3 nmwcdnsuc;Nokia USB Flashing Generic;e:\windows\system32\drivers\nmwcdnsuc.sys [25.11.2009 17:37 8320]
S3 s115bus;Sony Ericsson Device 115 driver (WDM);e:\windows\system32\drivers\s115bus.sys [1.10.2008 17:21 83208]
S3 s115mdfl;Sony Ericsson Device 115 USB WMC Modem Filter;e:\windows\system32\drivers\s115mdfl.sys [1.10.2008 17:22 15112]
S3 s115mdm;Sony Ericsson Device 115 USB WMC Modem Driver;e:\windows\system32\drivers\s115mdm.sys [1.10.2008 17:22 108680]
S3 s115mgmt;Sony Ericsson Device 115 USB WMC Device Management Drivers (WDM);e:\windows\system32\drivers\s115mgmt.sys [1.10.2008 17:22 100488]
S3 s115obex;Sony Ericsson Device 115 USB WMC OBEX Interface;e:\windows\system32\drivers\s115obex.sys [1.10.2008 17:22 98568]
S3 TVICHW32;TVICHW32;e:\windows\system32\drivers\TVICHW32.SYS [9.1.2009 19:09 23600]
S4 F-Secure Filter;F-Secure File System Filter;e:\program files\F-Secure\Anti-Virus\win2k\fsfilter.sys [24.2.2009 18:46 39776]
S4 F-Secure Recognizer;F-Secure File System Recognizer;e:\program files\F-Secure\Anti-Virus\win2k\fsrec.sys [24.2.2009 18:46 25184]
.
Obsah adresáře 'Naplánované úlohy'

2010-03-21 e:\windows\Tasks\Scheduled scanning task.job
- e:\progra~1\F-Secure\ANTI-V~1\fsav.exe [2009-02-24 13:57]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.centrum.cz/
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: &Google Search - e:\program files\Google\GoogleToolbar1.dll/cmsearch.html
IE: Backward Links - e:\program files\Google\GoogleToolbar1.dll/cmbacklinks.html
IE: Cached Snapshot of Page - e:\program files\Google\GoogleToolbar1.dll/cmcache.html
IE: E&xportovat do aplikace Microsoft Office Excel - e:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Similar Pages - e:\program files\Google\GoogleToolbar1.dll/cmsimilar.html
IE: Translate into English - e:\program files\Google\GoogleToolbar1.dll/cmtrans.html
LSP: e:\program files\F-Secure\FSPS\program\FSLSP.DLL
.
.
------- Asociace souborů -------
.
.scr=AutoCADScriptFile
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -

AddRemove-HijackThis - e:\documents and settings\Jarda\Plocha\HijackThis.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-03-21 10:48
Windows 5.1.2600 Service Pack 3 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------

[HKEY_USERS\S-1-5-21-1757981266-838170752-839522115-1003\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'winlogon.exe'(616)
e:\windows\system32\Ati2evxx.dll

- - - - - - - > 'lsass.exe'(672)
e:\program files\F-Secure\FSPS\program\FSLSP.DLL
.
Celkový čas: 2010-03-21 10:51:47
ComboFix-quarantined-files.txt 2010-03-21 09:51

Před spuštěním: Volných bajtů: 83 037 315 072
Po spuštění: Volných bajtů: 82 977 923 072

- - End Of File - - 88221D5C6D417661570067807A4C6A29



ComboFix 10-03-20.01 - Jarda 21.03.2010 11:38:26.8.1 - x86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.420.1029.18.1023.609 [GMT 1:00]
Spuštěný z: e:\documents and settings\Jarda\Plocha\ComboFix.exe
Použité ovládací přepínače :: e:\documents and settings\Jarda\Plocha\CFScript.txt
AV: F-Secure Profi Antivirus 8.01 *On-access scanning disabled* (Updated) {E7512ED5-4245-4B4D-AF3A-382D3F313F15}
FW: F-Secure Profi Antivirus 8.01 *enabled* {D4747503-0346-49EB-9262-997542F79BF4}
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

e:\windows\msdownld.tmp

.
((((((((((((((((((((((((( Soubory vytvořené od 2010-02-21 do 2010-03-21 )))))))))))))))))))))))))))))))
.

2010-03-21 09:30 . 2010-03-21 09:30 -------- d-----w- E:\ERDNT
2010-03-21 09:30 . 2010-03-21 09:30 -------- d-----w- e:\windows\ERUNT
2010-03-21 09:30 . 2010-03-21 09:30 -------- d-----w- E:\!FixIEDef
2010-03-21 08:18 . 2009-09-04 16:44 69464 ----a-w- e:\windows\system32\XAPOFX1_3.dll
2010-03-21 08:16 . 2010-03-21 08:16 -------- d-----w- e:\windows\Logs
2010-03-20 14:57 . 2010-02-12 10:03 293376 ------w- e:\windows\system32\browserchoice.exe
2010-03-10 05:47 . 2009-10-23 15:28 3558912 -c----w- e:\windows\system32\dllcache\moviemk.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-03-21 06:12 . 2009-02-24 17:45 -------- d-----w- e:\program files\F-Secure
2010-03-21 00:39 . 2008-10-25 20:57 -------- d-----w- e:\program files\Trend Micro
2010-03-21 00:10 . 2003-04-16 12:00 970720 ----a-w- e:\windows\system32\perfh005.dat
2010-03-21 00:10 . 2003-04-16 12:00 347646 ----a-w- e:\windows\system32\perfc005.dat
2010-03-20 14:03 . 2009-07-14 17:04 -------- d-----w- e:\program files\CCleaner
2010-03-05 19:44 . 2008-10-25 19:38 -------- d-----w- e:\program files\Malwarebytes' Anti-Malware
2010-02-04 09:01 . 2010-03-21 08:19 74072 ----a-w- e:\windows\system32\XAPOFX1_4.dll
2010-02-04 09:01 . 2010-03-21 08:19 528216 ----a-w- e:\windows\system32\XAudio2_6.dll
2010-02-04 09:01 . 2010-03-21 08:19 238936 ----a-w- e:\windows\system32\xactengine3_6.dll
2010-02-04 09:01 . 2010-03-21 08:19 22360 ----a-w- e:\windows\system32\X3DAudio1_7.dll
2010-01-30 12:08 . 2010-01-30 12:08 0 ---ha-w- e:\windows\system32\drivers\Msft_User_WpdMtpDr_01_00_00.Wdf
2010-01-23 13:15 . 2008-08-12 18:44 -------- d-----w- e:\program files\VSO
2010-01-23 08:42 . 2010-01-23 08:42 -------- d-----w- e:\program files\FreeTime
2010-01-23 08:13 . 2010-01-23 08:12 -------- d-----w- e:\program files\DVDFab 6
2010-01-20 10:49 . 2009-07-12 09:20 -------- d-----w- e:\program files\Microsoft Silverlight
2010-01-07 15:07 . 2008-10-25 19:38 38224 ----a-w- e:\windows\system32\drivers\mbamswissarmy.sys
2010-01-07 15:07 . 2008-10-25 19:38 19160 ----a-w- e:\windows\system32\drivers\mbam.sys
2009-12-31 16:50 . 2003-04-16 12:00 353792 ----a-w- e:\windows\system32\drivers\srv.sys
2009-12-21 19:08 . 2006-06-23 12:27 916480 ------w- e:\windows\system32\wininet.dll
.

((((((((((((((((((((((((((((( SnapShot@2010-03-21_09.48.56 )))))))))))))))))))))))))))))))))))))))))
.
+ 2010-03-21 10:11 . 2010-03-21 10:11 547328 e:\windows\assembly\NativeImages_v2.0.50727_32\System.Web.DynamicD#\fe3945589abd92b5413a22e402f1aec9\System.Web.DynamicData.ni.dll
+ 2010-03-21 10:11 . 2010-03-21 10:11 1356288 e:\windows\assembly\NativeImages_v2.0.50727_32\System.WorkflowServ#\63b6a3a6fccf7cffe55a5f1bb727e0f4\System.WorkflowServices.ni.dll
+ 2010-03-21 10:11 . 2010-03-21 10:11 2403328 e:\windows\assembly\NativeImages_v2.0.50727_32\System.Web.Extensio#\f51a14761a519568c38e479e4f425990\System.Web.Extensions.ni.dll
+ 2010-03-21 09:51 . 2010-03-21 09:51 1706496 e:\windows\assembly\NativeImages_v2.0.50727_32\System.ServiceModel#\3c63be95d03af4254baa90465494eed6\System.ServiceModel.Web.ni.dll
+ 2010-03-21 09:50 . 2010-03-21 09:50 1328128 e:\windows\assembly\NativeImages_v2.0.50727_32\System.Data.Services\398a45abf58fcb2373f68b8fa3546033\System.Data.Services.ni.dll
+ 2010-03-21 09:49 . 2010-03-21 09:49 9924096 e:\windows\assembly\NativeImages_v2.0.50727_32\System.Data.Entity\466c42e26f3a5cb739dbcfc58152199c\System.Data.Entity.ni.dll
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"PC Suite Tray"="e:\program files\Nokia\Nokia PC Suite 7\PCSuite.exe" [2009-11-11 1451520]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"sclauncher"="e:\program files\SimpleCenter\bin\win\sclauncher.exe" [2007-10-11 94208]
"ATICCC"="e:\program files\ATI Technologies\ATI.ACE\cli.exe" [2006-01-02 45056]
"V0330Mon.exe"="e:\windows\V0330Mon.exe" [2007-04-30 32768]
"AudioDeck"="e:\program files\VIAudioi\SBADeck\ADeck.exe" [2004-04-19 7916032]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="e:\windows\System32\CTFMON.EXE" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"e:\\Programy\\Macromedia studio MX\\Dreamweaver MX\\Dreamweaver.exe"=
"e:\\Programy\\Macromedia studio MX\\Fireworks MX\\Fireworks.exe"=
"e:\\Programy\\Macromedia studio MX\\Flash MX\\Flash.exe"=
"e:\\Programy\\Macromedia studio MX\\FreeHand 10\\FreeHand 10.exe"=
"e:\\Programy\\Pinnacle\\programs\\RM.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"e:\\Program Files\\Pinnacle\\Shared Files\\Programs\\MediaManager\\PMSManager.exe"=
"e:\\Programy\\Pinnacle\\programs\\Studio.exe"=
"e:\\HRY\\mohaa\\MOHAA.exe"=
"e:\\HRY\\Farcry\\Bin32\\FarCry.exe"=
"e:\\HRY\\pán prstenů-bitva o středozem\\game.dat"=
"e:\\Program Files\\Nokia\\Nokia Software Updater\\nsu_ui_client.exe"=
"e:\\Program Files\\Common Files\\Nokia\\Service Layer\\A\\nsl_host_process.exe"=
"e:\\HRY\\Metin 2\\metin2client.bin"=
"e:\\Program Files\\Skype\\Phone\\Skype.exe"=

R0 fsbts;fsbts;e:\windows\system32\drivers\fsbts.sys [24.2.2009 18:47 33920]
R0 FSFW;F-Secure Firewall Driver;e:\windows\system32\drivers\fsdfw.sys [24.2.2009 18:47 79872]
R1 F-Secure HIPS;F-Secure HIPS Driver;e:\program files\F-Secure\HIPS\drivers\fshs.sys [24.2.2009 18:46 67808]
R2 FSORSPClient;F-Secure ORSP Client;e:\program files\F-Secure\ORSP Client\fsorsp.exe [24.2.2009 18:46 55904]
R3 F-Secure Gatekeeper;F-Secure Gatekeeper;e:\program files\F-Secure\Anti-Virus\minifilter\fsgk.sys [24.2.2009 18:46 107104]
R3 V0330VID;WebCam Vista/Live! Cam Chat;e:\windows\system32\drivers\V0330Vid.sys [24.1.2009 12:32 157696]
S0 sptd;sptd;e:\windows\system32\drivers\sptd.sys [27.2.2008 15:27 639224]
S3 magpsc;magpsc;e:\windows\system32\drivers\magpsc.sys [17.4.2009 14:55 53463]
S3 nmwcdnsu;Nokia USB Flashing Phone Parent;e:\windows\system32\drivers\nmwcdnsu.sys [25.11.2009 17:37 136704]
S3 nmwcdnsuc;Nokia USB Flashing Generic;e:\windows\system32\drivers\nmwcdnsuc.sys [25.11.2009 17:37 8320]
S3 s115bus;Sony Ericsson Device 115 driver (WDM);e:\windows\system32\drivers\s115bus.sys [1.10.2008 17:21 83208]
S3 s115mdfl;Sony Ericsson Device 115 USB WMC Modem Filter;e:\windows\system32\drivers\s115mdfl.sys [1.10.2008 17:22 15112]
S3 s115mdm;Sony Ericsson Device 115 USB WMC Modem Driver;e:\windows\system32\drivers\s115mdm.sys [1.10.2008 17:22 108680]
S3 s115mgmt;Sony Ericsson Device 115 USB WMC Device Management Drivers (WDM);e:\windows\system32\drivers\s115mgmt.sys [1.10.2008 17:22 100488]
S3 s115obex;Sony Ericsson Device 115 USB WMC OBEX Interface;e:\windows\system32\drivers\s115obex.sys [1.10.2008 17:22 98568]
S3 TVICHW32;TVICHW32;e:\windows\system32\drivers\TVICHW32.SYS [9.1.2009 19:09 23600]
S4 F-Secure Filter;F-Secure File System Filter;e:\program files\F-Secure\Anti-Virus\win2k\fsfilter.sys [24.2.2009 18:46 39776]
S4 F-Secure Recognizer;F-Secure File System Recognizer;e:\program files\F-Secure\Anti-Virus\win2k\fsrec.sys [24.2.2009 18:46 25184]
.
Obsah adresáře 'Naplánované úlohy'

2010-03-21 e:\windows\Tasks\Scheduled scanning task.job
- e:\progra~1\F-Secure\ANTI-V~1\fsav.exe [2009-02-24 13:57]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.centrum.cz/
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: &Google Search - e:\program files\Google\GoogleToolbar1.dll/cmsearch.html
IE: Backward Links - e:\program files\Google\GoogleToolbar1.dll/cmbacklinks.html
IE: Cached Snapshot of Page - e:\program files\Google\GoogleToolbar1.dll/cmcache.html
IE: E&xportovat do aplikace Microsoft Office Excel - e:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Similar Pages - e:\program files\Google\GoogleToolbar1.dll/cmsimilar.html
IE: Translate into English - e:\program files\Google\GoogleToolbar1.dll/cmtrans.html
LSP: e:\program files\F-Secure\FSPS\program\FSLSP.DLL
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-03-21 11:44
Windows 5.1.2600 Service Pack 3 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------

[HKEY_USERS\S-1-5-21-1757981266-838170752-839522115-1003\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'winlogon.exe'(616)
e:\windows\system32\Ati2evxx.dll

- - - - - - - > 'lsass.exe'(672)
e:\program files\F-Secure\FSPS\program\FSLSP.DLL

- - - - - - - > 'explorer.exe'(3560)
e:\windows\system32\webcheck.dll
e:\windows\system32\WPDShServiceObj.dll
e:\windows\system32\PortableDeviceTypes.dll
e:\windows\system32\PortableDeviceApi.dll
e:\program files\F-Secure\FSPS\program\FSLSP.DLL
e:\program files\f-secure\scanner-interface\fsgkiapi.dll
.
Celkový čas: 2010-03-21 11:46:44
ComboFix-quarantined-files.txt 2010-03-21 10:46
ComboFix2.txt 2010-03-21 09:51

Před spuštěním: Volných bajtů: 82 955 862 016
Po spuštění: Volných bajtů: 82 932 424 704

- - End Of File - - 29E071E3F8F7A2D87A7CE2CA4FDE40F2




Stáhnul jsem Dr.Web Curelt , stáhnul se program Launch a dále si nevím rady. Dal jsem aktualizovat a zapnul se internet a odkaz na stránky www.freedrweb.com/cureit/ - a tady jsem bezradnej

nevím co mám lečit, co mám smazat .

Systémový soubory léčit, vše ostatní smaž.

Snad jsem to zvládl v pořádku. Stáhnul jsem dle tvého návodu aktualizace, poté start a po delším skenování mi byl sdělen tento výsledek. Hotovo . nebyl nalezen žádný vir. Co má udělati nyní.

Spusť F-Secure Online Scanner

Tento skener je možno použít jen v prohlížeči Internet Explorer! Postupuj podle instrukcí na stránce F-Secure pro správnou instalaci.
Akceptuj licenci.
Po instalaci ActiveX, klikni na Full System Scan. Když je stahování skončeno, automaticky začne sken.
Vyčkej konce skenu, po jeho dobu neprováděj jiné operace ani neklikej myší. Když skončí sken, klikni na tlačítko Automatic clearing (recommended).
Poté klikni na tlačítko Show Report a zkopíruj a vlož sem .