PCTuning fórum

Tak tady to je a asi tam toho bude dost jestli to nepude spravit tak holt formát c


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:57:21, on 16.1.2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18241)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\WebMediaViewer\itunes.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\WINDOWS\system32\MSTMON_Y.EXE
C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.seznam.cz/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {6D794CB4-C7CD-4c6f-BFDC-9B77AFBDC02C} - C:\WINDOWS\system32\geBtQJAR.dll (file missing)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll
O2 - BHO: (no name) - {E03F87E0-A35D-47D7-8150-077214B8F6A8} - C:\WINDOWS\system32\awtqoNGY.dll (file missing)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [KONICA MINOLTA PagePro 1400W STD] C:\WINDOWS\system32\MSTMON_Y.EXE STARTUP
O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKLM\..\Policies\Explorer\Run: [iTunesHelper Module] C:\Program Files\WebMediaViewer\itunes.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Office Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Zdroje informací - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/s ... wflash.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: geBtQJAR - geBtQJAR.dll (file missing)
O22 - SharedTaskScheduler: forayer - {e0e6e3da-f3af-4fb4-9411-2cf92fdeefc2} - C:\WINDOWS\system32\gaaplp.dll (file missing)
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O24 - Desktop Component 0: (no name) - http://nd.blog.cz/d/david-daniel.blog.c ... 473382.jpg

--
End of file - 6005 bytes

Ahoj vlož ještě log z ComboFixu.

Stáhněte a uložte na plochu ComboFix.
Spusťte pod účtem s Administrátorským oprávněním, před spuštěním vypněte všechny aplikace včetně Antiviru a Firewallu.
Celá akce trvá okolo 10 minut, někdy i déle.
Nelekněte se, když Váš stroj bude restartován.
Po restartu aplikace vytvoří log, uložený na C:/Combofix.txt (Při opakovaném použití jsou logy označeny Combofix2.txt atd.), JEHO OBSAH SEM VLOŽTE.

ComboFix 09-01-16.02 - Servis 2009-01-17 8:05:05.1 - NTFSx86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.1.1029.18.238.106 [GMT 1:00]
Running from: c:\documents and settings\Servis\Plocha\ComboFix.exe
AV: AVG 7.5.552 *On-access scanning disabled* (Updated)

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Autorun.inf
c:\documents and settings\Servis\Plocha\DD267F984C23D7D4\DD267F984C23D7D4
c:\program files\AntiVirGear 3.8
c:\program files\AntiVirGear 3.8\avrg.dat
c:\program files\AntiVirGear 3.8\ignored.lst
c:\program files\AntiVirGear 3.8\vpp.ini
c:\program files\Video Add-on
c:\program files\Video Add-on\ot.ico
c:\program files\Video Add-on\ts.ico
c:\program files\webmediaviewer
c:\program files\webmediaviewer\itunes.exe
c:\program files\webmediaviewer\itunesu.exe
C:\resycled
c:\windows\IE4 Error Log.txt
c:\windows\system32\leqwufoq.ini
c:\windows\system32\qledukor.ini
c:\windows\system32\YGNoqtwa.ini
c:\windows\system32\YGNoqtwa.ini2

.
((((((((((((((((((((((((( Files Created from 2008-12-17 to 2009-01-17 )))))))))))))))))))))))))))))))
.

2009-01-16 18:54 . 2009-01-16 18:54 <DIR> d-------- c:\program files\Trend Micro
2009-01-16 18:02 . 2009-01-16 18:02 0 --a------ c:\windows\system32\mapisvc.inf
2009-01-12 20:29 . 2009-01-12 20:39 <DIR> d-------- c:\program files\PoselSmrti
2009-01-08 16:56 . 2009-01-08 16:56 <DIR> d--hs---- c:\documents and settings\radek\PrivacIE
2009-01-08 16:53 . 2009-01-16 16:52 <DIR> d-------- c:\documents and settings\radek\Data aplikací\AVG7
2009-01-08 16:52 . 2009-01-08 16:52 <DIR> d-------- c:\documents and settings\radek\Data aplikací\PC Suite
2009-01-08 16:51 . 2007-01-16 23:26 <DIR> d-------- c:\documents and settings\radek\Plocha
2009-01-08 16:51 . 2007-01-16 23:26 <DIR> d--h----- c:\documents and settings\radek\Okolní tiskárny
2009-01-08 16:51 . 2007-01-16 23:26 <DIR> d--h----- c:\documents and settings\radek\Okolní síť
2009-01-08 16:51 . 2009-01-08 16:53 <DIR> dr------- c:\documents and settings\radek\Oblíbené položky
2009-01-08 16:51 . 2007-01-16 22:32 <DIR> d--h----- c:\documents and settings\radek\Šablony
2009-01-08 16:51 . 2007-01-16 23:26 <DIR> dr------- c:\documents and settings\radek\Nabídka Start
2009-01-08 16:51 . 2009-01-08 16:53 <DIR> dr------- c:\documents and settings\radek\Dokumenty
2009-01-08 16:51 . 2009-01-08 16:52 <DIR> dr-h----- c:\documents and settings\radek\Data aplikací
2009-01-08 16:51 . 2009-01-08 16:56 <DIR> d-------- c:\documents and settings\radek
2009-01-04 22:00 . 2009-01-04 22:00 <DIR> d-------- c:\windows\ie8updates
2009-01-04 12:20 . 2009-01-04 12:20 <DIR> d--hs---- c:\documents and settings\Servis\PrivacIE
2009-01-04 11:57 . 2009-01-04 12:02 <DIR> d--h-c--- c:\windows\ie8
2009-01-03 21:37 . 2009-01-15 14:14 664 --a------ c:\windows\system32\d3d9caps.dat
2009-01-03 21:10 . 2009-01-03 21:10 89,600 --a------ c:\windows\system32\rokudelq.dll
2009-01-01 12:36 . 2009-01-01 12:36 28,672 --a------ C:\file.datastore
2008-12-30 23:12 . 2008-12-30 23:12 <DIR> d-------- c:\documents and settings\Servis\Data aplikací\Nokia Multimedia Player
2008-12-24 12:55 . 2008-12-31 22:20 <DIR> d-------- c:\documents and settings\Servis\Phone Browser
2008-12-24 12:51 . 2008-12-31 22:20 <DIR> d-------- c:\documents and settings\All Users\Data aplikací\PC Suite
2008-12-24 12:50 . 2008-12-31 22:30 <DIR> d-------- c:\documents and settings\Servis\Data aplikací\Nokia
2008-12-24 12:48 . 2008-12-24 12:50 <DIR> d-------- c:\program files\DIFX
2008-12-24 12:48 . 2008-12-24 12:48 <DIR> d-------- c:\program files\Common Files\PCSuite
2008-12-24 12:48 . 2008-12-24 12:48 <DIR> d-------- c:\program files\Common Files\Nokia
2008-12-24 12:47 . 2008-12-24 12:47 <DIR> d-------- c:\program files\PC Connectivity Solution
2008-12-24 12:47 . 2008-12-31 22:21 <DIR> d-------- c:\documents and settings\Servis\Data aplikací\PC Suite
2008-12-24 12:47 . 2007-02-22 10:15 12,288 --a------ c:\windows\system32\drivers\nmwcdcm.sys
2008-12-24 12:47 . 2007-02-22 10:15 12,288 --a------ c:\windows\system32\drivers\nmwcdcj.sys
2008-12-24 12:47 . 2007-02-22 10:15 8,320 --a------ c:\windows\system32\drivers\nmwcdc.sys
2008-12-24 12:46 . 2008-12-24 12:49 <DIR> d----c--- c:\windows\system32\DRVSTORE
2008-12-24 12:46 . 2008-12-24 12:48 <DIR> d-------- c:\program files\Nokia
2008-12-24 12:46 . 2007-02-22 10:15 137,216 --a------ c:\windows\system32\drivers\nmwcd.sys
2008-12-24 12:46 . 2007-02-22 10:15 90,624 --a------ c:\windows\system32\nmwcdcls.dll
2008-12-24 12:46 . 2007-02-22 10:15 65,536 --a------ c:\windows\system32\nmwcdcocls.dll
2008-12-24 12:45 . 2008-12-24 12:45 <DIR> d-------- c:\documents and settings\All Users\Data aplikací\Installations

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-01-17 07:00 --------- d-----w c:\documents and settings\Servis\Data aplikací\AVG7
2009-01-03 20:25 --------- d-----w c:\documents and settings\All Users\Data aplikací\avg7
2008-12-11 10:57 333,952 ----a-w c:\windows\system32\drivers\srv.sys
2008-08-23 18:57 32,768 --sha-w c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\MSHist012008082320080824\index.dat
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-14 1695232]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-05-31 68856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2003-10-02 155648]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2003-10-02 118784]
"AVG7_CC"="c:\progra~1\Grisoft\AVG7\avgcc.exe" [2008-10-16 590848]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"RemoteControl"="c:\program files\CyberLink\PowerDVD\PDVDServ.exe" [2003-10-31 32768]
"KONICA MINOLTA PagePro 1400W STD"="c:\windows\system32\MSTMON_Y.EXE" [2005-09-10 184320]
"PCSuiteTrayApplication"="c:\program files\Nokia\Nokia PC Suite 6\LaunchApplication.exe" [2007-03-23 227328]
"SoundMan"="SOUNDMAN.EXE" [2004-07-27 c:\windows\SOUNDMAN.EXE]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
"AVG7_Run"="c:\progra~1\Grisoft\AVG7\avgw.exe" [2007-10-24 219136]
"Nokia.PCSync"="c:\program files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2007-03-27 1744896]

c:\documents and settings\All Users\Nabˇdka Start\Programy\Po spuçtŘnˇ\
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2004-12-14 29696]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Grisoft\\AVG7\\avginet.exe"=
"c:\\Program Files\\Grisoft\\AVG7\\avgamsvr.exe"=
"c:\\Program Files\\Grisoft\\AVG7\\avgcc.exe"=
"c:\\Program Files\\Grisoft\\AVG7\\avgemc.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

R1 navigator;navigator; [x]
R2 244B6B70A571F660;244B6B70A571F660; [x]
S3 PSched;Plánovač paketů technologie QoS;c:\windows\system32\DRIVERS\psched.sys [2008-04-13 69120]


--- Other Services/Drivers In Memory ---

*Deregistered* - ALG
*Deregistered* - AudioSrv
*Deregistered* - Avg7Alrt
*Deregistered* - Avg7UpdSvc
*Deregistered* - AVGEMS
*Deregistered* - Browser
*Deregistered* - CryptSvc
*Deregistered* - DcomLaunch
*Deregistered* - Dhcp
*Deregistered* - dmserver
*Deregistered* - Dnscache
*Deregistered* - ERSvc
*Deregistered* - EventSystem
*Deregistered* - FastUserSwitchingCompatibility
*Deregistered* - helpsvc
*Deregistered* - ImapiService
*Deregistered* - KSecDD
*Deregistered* - lanmanserver
*Deregistered* - lanmanworkstation
*Deregistered* - LmHosts
*Deregistered* - MDM
*Deregistered* - mnmdd
*Deregistered* - MountMgr
*Deregistered* - MRxDAV
*Deregistered* - MRxSmb
*Deregistered* - Msfs
*Deregistered* - mssmbios
*Deregistered* - Mup
*Deregistered* - NDIS
*Deregistered* - NdisTapi
*Deregistered* - Ndisuio
*Deregistered* - NdisWan
*Deregistered* - NDProxy
*Deregistered* - NetBIOS
*Deregistered* - NetBT
*Deregistered* - Netman
*Deregistered* - Nla
*Deregistered* - Npfs
*Deregistered* - Ntfs
*Deregistered* - Null
*Deregistered* - PartMgr
*Deregistered* - ParVdm
*Deregistered* - PolicyAgent
*Deregistered* - PptpMiniport
*Deregistered* - ProtectedStorage
*Deregistered* - PSched
*Deregistered* - RasAcd
*Deregistered* - Rasl2tp
*Deregistered* - RasMan
*Deregistered* - RasPppoe
*Deregistered* - Raspti
*Deregistered* - Rdbss
*Deregistered* - RDPCDD
*Deregistered* - rdpdr
*Deregistered* - RemoteRegistry
*Deregistered* - RpcSs
*Deregistered* - SamSs
*Deregistered* - seclogon
*Deregistered* - SENS
*Deregistered* - ServiceLayer
*Deregistered* - SharedAccess
*Deregistered* - ShellHWDetection
*Deregistered* - Schedule
*Deregistered* - Spooler
*Deregistered* - sr
*Deregistered* - srservice
*Deregistered* - Srv
*Deregistered* - SSDPSRV
*Deregistered* - stisvc
*Deregistered* - swenum
*Deregistered* - TapiSrv
*Deregistered* - Tcpip
*Deregistered* - TermDD
*Deregistered* - TermService
*Deregistered* - Themes
*Deregistered* - TrkWks
*Deregistered* - Update
*Deregistered* - VgaSave
*Deregistered* - VolSnap
*Deregistered* - W32Time
*Deregistered* - Wanarp
*Deregistered* - WebClient
*Deregistered* - winmgmt
*Deregistered* - wscsvc
*Deregistered* - wuauserv
*Deregistered* - WudfPf
*Deregistered* - WudfSvc
*Deregistered* - WZCSVC
.
Contents of the 'Scheduled Tasks' folder

2009-01-17 c:\windows\Tasks\jjncjrgp.job
- c:\windows\system32\rundll32.exe [2008-04-14 04:22]

2009-01-17 c:\windows\Tasks\User_Feed_Synchronization-{10AB7CCE-89BA-4177-B50D-3DC098B314C1}.job
- c:\windows\system32\msfeedssync.exe [2008-08-22 03:05]
.
- - - - ORPHANS REMOVED - - - -

BHO-{6D794CB4-C7CD-4c6f-BFDC-9B77AFBDC02C} - c:\windows\system32\geBtQJAR.dll
BHO-{E03F87E0-A35D-47D7-8150-077214B8F6A8} - c:\windows\system32\awtqoNGY.dll
HKLM-Explorer_Run-iTunesHelper Module - c:\program files\WebMediaViewer\itunes.exe
Notify-geBtQJAR - geBtQJAR.dll


.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.seznam.cz/
uDefault_Search_URL = hxxp://www.google.com/ie
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&s ... f8&oe=utf8
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: E&xportovat do aplikace Microsoft Office Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
TCP: {E21D5824-8D48-4E83-97A3-B6152909247C} = 213.226.224.12
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-01-17 08:17:36
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\244B6B70A571F660]
"ImagePath"="\??\c:\documents and settings\Servis\Plocha\244B6B70A571F660\244B6B70A571F660"
.
------------------------ Other Running Processes ------------------------
.
c:\progra~1\Grisoft\AVG7\avgamsvr.exe
c:\progra~1\Grisoft\AVG7\avgupsvc.exe
c:\progra~1\Grisoft\AVG7\avgemc.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\windows\system32\wscntfy.exe
c:\program files\PC Connectivity Solution\ServiceLayer.exe
c:\program files\Internet Explorer\iexplore.exe
.
**************************************************************************
.
Completion time: 2009-01-17 8:23:12 - machine was rebooted [Servis]
ComboFix-quarantined-files.txt 2009-01-17 07:23:01

Pre-Run: Volných bajtů: 18,360,025,088
Post-Run: Volných bajtů: 19,819,278,336

254 --- E O F --- 2009-01-13 21:19:55

ComboFix nám téměř vše smazal, jsme na dobré cestě a neměj strach, ke formátu nedojde.

Tyto soubory:

c:\windows\system32\d3d9caps.dat
c:\windows\system32\rokudelq.dll
C:\file.datastore
c:\windows\system32\msfeedssync.exe

Otestujte na VIRUSTOTAL

Návod prostý: Po načtení stránky klikněte na tlačítko Procházet, zkopírujte cestu k výše zmíněnému souboru a klikněte na tlačítko Odeslat soubor; dejte skenerům nějakých deset minut; výsledek sem vložte (Až se to dotestuje tak zkopírujte odkaz nahoře v prohlížečí a ten sem vložte). Pokud se Vám výsledky objeví okamžitě, bez testování, tak klikněte na Reanalyse file now.

http://www.virustotal.com/cs/analisis/d ... b03a7e3303
http://www.virustotal.com/cs/analisis/2 ... e1179ca263
http://www.virustotal.com/cs/analisis/f ... ee22b10123
u souboru
c:\windows\system32\rokudelq.dll
to píše 0 bytes size received / Se ha recibido un archivo vacio

OK, takže ještě udělej toto:

Nyní stahněte a spusťte
Stáhněte Malwarebytes' Anti-Malware - http://viry.cz/forum/viewtopic.php?f=29&t=67229
Dejte úplný sken C systém
Log sem, nic nemazat až po posouzení logu

Malwarebytes' Anti-Malware 1.33
Verze databáze: 1668
Windows 5.1.2600 Service Pack 2

19.1.2009 20:47:04
mbam-log-2009-01-19 (20-47-03).txt

Typ skenu: Úplný sken (C:\|)
Objektu skenováno: 105132
Uplynulý cas: 40 minute(s), 21 second(s)

Infikované procesy pameti: 0
Infikované pametové moduly: 0
Infikované klíce registru: 0
Infikované hodnoty registru: 0
Infikované položky dat registru: 0
Infikované složky: 0
Infikované soubory: 0

Infikované procesy pameti:
(Žádné zákerné položky nebyly zjišteny)

Infikované pametové moduly:
(Žádné zákerné položky nebyly zjišteny)

Infikované klíce registru:
(Žádné zákerné položky nebyly zjišteny)

Infikované hodnoty registru:
(Žádné zákerné položky nebyly zjišteny)

Infikované položky dat registru:
(Žádné zákerné položky nebyly zjišteny)

Infikované složky:
(Žádné zákerné položky nebyly zjišteny)

Infikované soubory:
(Žádné zákerné položky nebyly zjišteny)


takže bych to viděl asi jako vyřešený problém díky moc jansv

Samozřejmě, vypadá to již dobře. Ještě sem můžeš vložit aktuální log s HijackThis. Není zač.