Facebook vir

Zpráva

Paolo312 · #1 Příspěvek od **Paolo312** » 31 Črc 2011 12:15

Dobrý den, problém s facebookovým virem

předem děkuju za jakoukoliv pomoc

log z rsitu

Logfile of random's system information tool 1.09 (written by random/random)
Run by admin at 2011-07-31 13:00:11
Systém Microsoft Windows XP Professional Service Pack 3
System drive C: has 159 GB (52%) free of 305 GB
Total RAM: 2030 MB (66% free)

HijackThis download failed

======Scheduled tasks folder======

C:\WINDOWS\tasks\AppleSoftwareUpdate.job
C:\WINDOWS\tasks\Dr.Web Daily scan.job
C:\WINDOWS\tasks\Dr.Web Update.job

=========Mozilla firefox=========

ProfilePath - C:\Documents and Settings\admin\Data aplikací\Mozilla\Firefox\Profiles\f0zs9nkw.default

prefs.js - "browser.search.suggest.enabled" - false
prefs.js - "browser.search.useDBForOrder" - true
prefs.js - "browser.startup.homepage" - "http://www.seznam.cz/"
prefs.js - "extensions.enabledItems" - "{19503e42-ca3c-4c27-b1e2-9cdb2170ee34}:1.2.1.26, {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}:6.0.13, {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}:6.0.15, {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}:6.0.17, jqs@sun.com:1.0, {20a82645-c095-46ed-80e3-08825760534b}:1.2.1, {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20, engine@conduit.com:3.2.1.3, {414b6d9d-4a95-4e8d-b5b1-149dd2d93bb3}:3.2.1.3, {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23, {972ce4c6-7e08-4474-a285-3208198ce6fd}:3.6.17"

"{20a82645-c095-46ed-80e3-08825760534b}"=C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
"jqs@sun.com"=C:\Program Files\Java\jre6\lib\deploy\jqs\ff

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 10.1 Plugin
"Path"=C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@Apple.com/iTunes,version=]
"Description"=iTunes Detector Plug-in
"Path"=

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@Apple.com/iTunes,version=1.0]
"Description"=
"Path"=C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0]
"Description"=DivX Plus Web Player
"Path"=C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@divx.com/DivX Player Plugin,version=1.0.0]
"Description"=DivX® Player Plugin for VOD Content
"Path"=C:\Program Files\DivX\DivX Player\npDivxPlayerPlugin.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@java.com/JavaPlugin]
"Description"=Oracle® Next Generation Java™ Plug-In
"Path"=C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0]
"Description"=Ag Player Plugin
"Path"=c:\Program Files\Microsoft Silverlight\4.0.60531.0\npctrl.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/WPF,version=3.5]
"Description"=Windows Presentation Foundation plug-in for Mozilla browsers
"Path"=C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@pandonetworks.com/PandoWebPlugin]
"Description"=This plugin detects and launches Pando Media Booster
"Path"=C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@tools.google.com/Google Update;version=3]
"Description"=Google Update
"Path"=C:\Program Files\Google\Update\1.3.21.57\npGoogleUpdate3.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@tools.google.com/Google Update;version=9]
"Description"=Google Update
"Path"=C:\Program Files\Google\Update\1.3.21.57\npGoogleUpdate3.dll

C:\Program Files\Mozilla Firefox\extensions\
{972ce4c6-7e08-4474-a285-3208198ce6fd}
{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}
{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}
{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}
{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}

C:\Program Files\Mozilla Firefox\components\
binary.manifest
browsercomps.dll
nsIQTScriptablePlugin.xpt

C:\Program Files\Mozilla Firefox\plugins\
np32dsw.dll
npdeployJava1.dll
npDivxPlayerPlugin.dll
NPOFF12.DLL
nppdf32.dll
npqtplugin.dll
npqtplugin2.dll
npqtplugin3.dll
npqtplugin4.dll
npqtplugin5.dll
npqtplugin6.dll
npqtplugin7.dll
nsIDivxPlayerPlugin.xpt
QuickTimePlugin.class
ShockwavePlugin.class

C:\Program Files\Mozilla Firefox\searchplugins\
google.xml
heureka-cz.xml
jyxo-cz.xml
mall-cz.xml
seznam-cz.xml
slunecnice-cz.xml
wikipedia-cz.xml

C:\Documents and Settings\admin\Data aplikací\Mozilla\Firefox\Profiles\f0zs9nkw.default\extensions\
engine@conduit.com
{20a82645-c095-46ed-80e3-08825760534b}
{414b6d9d-4a95-4e8d-b5b1-149dd2d93bb3}

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
Podpora odkazu pro Adobe PDF Reader - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll [2006-10-22 62080]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{39F7E362-828A-4B5A-BCAF-5B79BFDFEA60}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}]
Groove GFS Browser Helper - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-12 2217848]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2010-11-24 41760]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2010-11-24 79648]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"GrooveMonitor"=C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe [2008-10-25 31072]
"SigmatelSysTrayApp"=C:\WINDOWS\sttray.exe [2007-05-06 405504]
"NeroFilterCheck"=C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe [2006-01-12 155648]
"ISTray"=C:\Program Files\Spyware Doctor\pctsTray.exe [2008-12-08 1173384]
"snpstd3"=C:\WINDOWS\vsnpstd3.exe [2007-05-10 835584]
"tsnpstd3"=C:\WINDOWS\tsnpstd3.exe [2009-04-24 360448]
"LogMeIn GUI"=C:\Program Files\LogMeIn\x86\LogMeInSystray.exe [2008-08-11 63048]
"StartCCC"=C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [2009-09-29 61440]
"QuickTime Task"=C:\Program Files\QuickTime\qttask.exe [2010-11-29 421888]
"iTunesHelper"=C:\Program Files\iTunes\iTunesHelper.exe [2011-04-14 421160]
"LogMeIn Hamachi Ui"=C:\Program Files\LogMeIn Hamachi\hamachi-2-ui.exe [2011-05-25 1951112]
"sysdriver32.exe"=C:\WINDOWS\sysdriver32.exe rezerv []
"sysdriver32_.exe"=C:\WINDOWS\sysdriver32_.exe rezerv []
"systemup"=C:\WINDOWS\systemup.exe stand []
"tray_ico"= []
"tray_ico0"= []
"tray_ico1"= []
"tray_ico2"= []
"tray_ico3"= []
"tray_ico4"= []
"SpIDerMail"=C:\Program Files\DrWeb\spiderml.exe [2011-06-08 1572592]
"Dr.Web Firewall"=C:\Program Files\DrWeb\frwl_notify.exe [2011-06-08 2583304]
"SpIDerAgent"=C:\Program Files\DrWeb\SpIDerAgent.exe [2011-06-08 1473264]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"=C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe [2006-11-16 139264]
"Pando Media Booster"=C:\Program Files\Pando Networks\Media Booster\PMB.exe [2011-03-10 3046808]
"Skype"=C:\Program Files\Skype\Phone\Skype.exe [2011-06-15 15141768]
"SpywareTerminatorUpdate"=C:\Program Files\Spyware Terminator\SpywareTerminatorUpdate.exe [2011-07-22 3318784]
"ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe [2008-01-11 39792]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AlcoholAutomount]
C:\Program Files\Alcohol Soft\Alcohol 120\AxAutoMntSrv.exe [2009-11-15 33120]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AppleSyncNotifier]
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe [2009-08-13 177440]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DivXUpdate]
C:\Program Files\DivX\DivX Update\DivXUpdate.exe [2010-09-01 1164584]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\FixCamera]
C:\WINDOWS\FixCamera.exe [2007-07-11 20480]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
C:\Program Files\iTunes\iTunesHelper.exe [2011-04-14 421160]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogMeIn Hamachi Ui]
C:\Program Files\LogMeIn Hamachi\hamachi-2-ui.exe [2011-05-25 1951112]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PWRISOVM.EXE]
C:\Program Files\PowerISO\PWRISOVM.EXE [2009-11-09 180224]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
C:\Program Files\QuickTime\qttask.exe [2010-11-29 421888]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoftAuto.exe]
C:\Program Files\Creative\Software Update 3\SoftAuto.exe [2008-08-13 405504]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]
c:\games\steam\steam.exe [2010-11-28 1242448]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
C:\Program Files\Common Files\Java\Java Update\jusched.exe [2010-05-14 248552]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent]
C:\WINDOWS\system32\Ati2evxx.dll [2009-09-30 155648]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\LMIinit]
C:\WINDOWS\system32\LMIinit.dll [2009-09-28 87352]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon]
C:\WINDOWS\system32\WgaLogon.dll [2009-03-10 265096]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-12 2217848]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdauxservice]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdcoreservice]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\aawservice]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Hamachi2Svc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\sdauxservice]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\sdcoreservice]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
"EnableSecureUIAPaths"=0

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=323
"NoDriveAutoRun"=67108863
"NoDrives"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"HonorAutoRunSetting"=1
"NoDriveAutoRun"=67108863
"NoDriveTypeAutoRun"=323
"NoDrives"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE"="C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook"
"C:\Program Files\Microsoft Office\Office12\GROOVE.EXE"="C:\Program Files\Microsoft Office\Office12\GROOVE.EXE:*:Enabled:Microsoft Office Groove"
"C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE"="C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:*:Enabled:Microsoft Office OneNote"
"C:\Program Files\uTorrent\utorrent.exe"="C:\Program Files\uTorrent\utorrent.exe:*:Enabled:µTorrent"
"C:\Games\The Battle for Middle-earth (tm) II\game.dat"="C:\Games\The Battle for Middle-earth (tm) II\game.dat:*:Enabled:The Battle for Middle-earth(tm) II"
"C:\Games\Steam\SteamApps\paolo312\source sdk base\hl2.exe"="C:\Games\Steam\SteamApps\paolo312\source sdk base\hl2.exe:*:Enabled:hl2"
"C:\Games\Command & Conquer Generals Zero Hour\game.dat"="C:\Games\Command & Conquer Generals Zero Hour\game.dat:*:Enabled:game"
"C:\Program Files\Nero\Nero 7\Nero ShowTime\ShowTime.exe"="C:\Program Files\Nero\Nero 7\Nero ShowTime\ShowTime.exe:*:Enabled:Nero ShowTime"
"C:\Games\Command and Conquer Generals\game.dat"="C:\Games\Command and Conquer Generals\game.dat:*:Enabled:game"
"C:\WINDOWS\system32\dpnsvr.exe"="C:\WINDOWS\system32\dpnsvr.exe:*:Enabled:Microsoft DirectPlay8 Server"
"C:\Games\Steam\SteamApps\paolo312\half-life 2 deathmatch\hl2.exe"="C:\Games\Steam\SteamApps\paolo312\half-life 2 deathmatch\hl2.exe:*:Enabled:hl2"
"C:\Games\Grid\GRID.exe"="C:\Games\Grid\GRID.exe:*:Enabled:GRID Executable"
"C:\Program Files\GameSpy Arcade\Aphex.exe"="C:\Program Files\GameSpy Arcade\Aphex.exe:*:Enabled:GameSpy Arcade"
"C:\Program Files\Creative\Creative Centrale\CTUPnPFn.exe"="C:\Program Files\Creative\Creative Centrale\CTUPnPFn.exe:LocalSubNet:Enabled:Creative Centrale Media Server Component"
"C:\Games\Rockstar Games\Rockstar Games Social Club\RGSCLauncher.exe"="C:\Games\Rockstar Games\Rockstar Games Social Club\RGSCLauncher.exe:*:Enabled:Rockstar Games Social Club"
"C:\Games\Rockstar Games\Grand Theft Auto IV\LaunchGTAIV.exe"="C:\Games\Rockstar Games\Grand Theft Auto IV\LaunchGTAIV.exe:*:Enabled:Grand Theft Auto IV"
"C:\Games\Rockstar Games\Grand Theft Auto IV\GTAIV.exe"="C:\Games\Rockstar Games\Grand Theft Auto IV\GTAIV.exe:*:Enabled:Grand Theft Auto IV"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Games\Supreme Commander - Forged Alliance\bin\ForgedAlliance.exe"="C:\Games\Supreme Commander - Forged Alliance\bin\ForgedAlliance.exe:*:Enabled:Supreme Commander - Forged Alliance"
"C:\Games\GPGNet\GPG.Multiplayer.Client.exe"="C:\Games\GPGNet\GPG.Multiplayer.Client.exe:*:Enabled:GPGNet - Supreme Commander - Forged Alliance"
"C:\Games\Steam\steam.exe"="C:\Games\Steam\steam.exe:*:Enabled:Steam"
"C:\Games\Battlefield 2\BF2.exe"="C:\Games\Battlefield 2\BF2.exe:*:Enabled:Battlefield 2"
"%windir%\system32\drivers\svchost.exe"="%windir%\system32\drivers\svchost.exe:*:Enabled:svchost"
"C:\Program Files\ICQ6.5\ICQ.exe"="C:\Program Files\ICQ6.5\ICQ.exe:*:Enabled:ICQ6"
"C:\Games\Steam\SteamApps\common\left 4 dead 2 demo\left4dead2.exe"="C:\Games\Steam\SteamApps\common\left 4 dead 2 demo\left4dead2.exe:*:Enabled:left4dead2"
"C:\WINDOWS\system32\dplaysvr.exe"="C:\WINDOWS\system32\dplaysvr.exe:*:Enabled:Microsoft DirectPlay Helper"
"C:\Games\Supreme Commander 2\bin\SupremeCommander2.exe"="C:\Games\Supreme Commander 2\bin\SupremeCommander2.exe:*:Enabled:SupremeCommander2"
"C:\Program Files\Activision\Call of Duty 2\CoD2MP_s.exe"="C:\Program Files\Activision\Call of Duty 2\CoD2MP_s.exe:*:Enabled:CoD2MP_s"
"C:\WINDOWS\system32\dpvsetup.exe"="C:\WINDOWS\system32\dpvsetup.exe:*:Enabled:Microsoft DirectPlay Voice Test"
"C:\Games\World_of_Tanks_closed_Beta\WorldOfTanks.exe"="C:\Games\World_of_Tanks_closed_Beta\WorldOfTanks.exe:*:Enabled:World of Tanks"
"C:\Games\Steam\SteamApps\common\left 4 dead 2\left4dead2.exe"="C:\Games\Steam\SteamApps\common\left 4 dead 2\left4dead2.exe:*:Enabled:Left 4 Dead 2"
"C:\Games\The Lord of the Rings Online\lotroclient.exe"="C:\Games\The Lord of the Rings Online\lotroclient.exe:*:Enabled:lotroclient"
"C:\Games\The Lord of the Rings Online\TurbineInvoker.exe"="C:\Games\The Lord of the Rings Online\TurbineInvoker.exe:*:Enabled:The Lord of the Rings Online"
"C:\Program Files\Pando Networks\Media Booster\PMB.exe"="C:\Program Files\Pando Networks\Media Booster\PMB.exe:*:Enabled:Pando Media Booster"
"C:\Program Files\Bonjour\mDNSResponder.exe"="C:\Program Files\Bonjour\mDNSResponder.exe:*:Enabled:Bonjour Service"
"C:\Program Files\iTunes\iTunes.exe"="C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes"
"C:\Program Files\Skype\Phone\Skype.exe"="C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype. Take a deep breath "

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\system32\drivers\svchost.exe"="%windir%\system32\drivers\svchost.exe:*:Enabled:svchost"
"C:\Program Files\Pando Networks\Media Booster\PMB.exe"="C:\Program Files\Pando Networks\Media Booster\PMB.exe:*:Enabled:Pando Media Booster"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"midimapper"=midimap.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msadpcm"=msadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.trspch"=tssoft32.acm
"vidc.cvid"=iccvid.dll
"vidc.iv31"=ir32_32.dll
"vidc.iv32"=ir32_32.dll
"vidc.iv41"=ir41_32.ax
"VIDC.IYUV"=iyuv_32.dll
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"VIDC.UYVY"=msyuv.dll
"VIDC.YUY2"=msyuv.dll
"VIDC.YVU9"=tsbyuv.dll
"VIDC.YVYU"=msyuv.dll
"wavemapper"=msacm32.drv
"msacm.msg723"=msg723.acm
"vidc.M263"=msh263.drv
"vidc.M261"=msh261.drv
"msacm.msaudio1"=msaud32.acm
"msacm.sl_anet"=sl_anet.acm
"msacm.iac2"=C:\WINDOWS\system32\iac25_32.ax
"vidc.iv50"=ir50_32.dll
"msacm.l3acm"=C:\WINDOWS\system32\l3codeca.acm
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"wave1"=wdmaud.drv
"midi1"=wdmaud.drv
"mixer1"=wdmaud.drv
"VIDC.XVID"=xvidvfw.dll
"VIDC.YV12"=DivX.dll
"msacm.ac3acm"=ac3acm.acm
"msacm.lameacm"=lameACM.acm
"VIDC.FFDS"=ff_vfw.dll
"vidc.VP60"=C:\WINDOWS\system32\vp6vfw.dll
"vidc.VP61"=C:\WINDOWS\system32\vp6vfw.dll
"vidc.VP62"=vp6vfw.dll
"MSVideo8"=VfWWDM32.dll
"vidc.DIVX"=DivX.dll

======File associations======

.ini - open - C:\WINDOWS\SYSTEM32\NOTEPAD.EXE %1
.txt - open - C:\WINDOWS\SYSTEM32\NOTEPAD.EXE %1

======List of files/folders created in the last 1 month======

2011-07-31 13:00:11 ----D---- C:\rsit
2011-07-31 13:00:11 ----D---- C:\Program Files\trend micro
2011-07-22 16:00:10 ----A---- C:\WINDOWS\system32\drivers\spiderg3.sys
2011-07-22 15:59:58 ----A---- C:\WINDOWS\system32\drivers\DrWebPF.sys
2011-07-22 15:59:56 ----A---- C:\WINDOWS\system32\drivers\drwebaf.sys
2011-07-22 15:59:40 ----D---- C:\Program Files\DrWeb
2011-07-22 15:59:40 ----D---- C:\Program Files\Common Files\Doctor Web
2011-07-22 15:59:40 ----D---- C:\Documents and Settings\All Users\Data aplikací\Doctor Web
2011-07-22 15:30:54 ----A---- C:\WINDOWS\SchedLgU.Txt
2011-07-22 14:08:48 ----D---- C:\Program Files\NoAdware5.0
2011-07-22 13:50:50 ----A---- C:\WINDOWS\ntbtlog.txt
2011-07-22 13:25:03 ----SHD---- C:\WINDOWS\CSC
2011-07-22 12:17:48 ----SHD---- C:\RECYCLER
2011-07-22 12:08:16 ----A---- C:\ComboFix.txt
2011-07-22 10:38:20 ----D---- C:\ComboFix
2011-07-21 20:13:12 ----A---- C:\WINDOWS\system32\drivers\sp_rsdrv2.sys
2011-07-21 20:13:11 ----D---- C:\Documents and Settings\admin\Data aplikací\Spyware Terminator
2011-07-21 20:13:09 ----D---- C:\Documents and Settings\All Users\Data aplikací\Spyware Terminator
2011-07-21 20:13:08 ----D---- C:\Program Files\Spyware Terminator
2011-07-21 18:52:15 ----A---- C:\Boot.bak
2011-07-21 18:52:10 ----RASHD---- C:\cmdcons
2011-07-21 18:50:12 ----A---- C:\WINDOWS\zip.exe
2011-07-21 18:50:12 ----A---- C:\WINDOWS\SWXCACLS.exe
2011-07-21 18:50:12 ----A---- C:\WINDOWS\SWSC.exe
2011-07-21 18:50:12 ----A---- C:\WINDOWS\SWREG.exe
2011-07-21 18:50:12 ----A---- C:\WINDOWS\sed.exe
2011-07-21 18:50:12 ----A---- C:\WINDOWS\PEV.exe
2011-07-21 18:50:12 ----A---- C:\WINDOWS\NIRCMD.exe
2011-07-21 18:50:12 ----A---- C:\WINDOWS\MBR.exe
2011-07-21 18:50:12 ----A---- C:\WINDOWS\grep.exe
2011-07-21 18:49:44 ----D---- C:\WINDOWS\ERDNT
2011-07-21 18:49:38 ----D---- C:\Qoobox
2011-07-21 18:35:00 ----HD---- C:\WINDOWS\update.tray-2-0-lnk
2011-07-21 18:35:00 ----HD---- C:\WINDOWS\update.tray-2-0
2011-07-21 17:40:22 ----D---- C:\WINDOWS\ufa
2011-07-21 17:33:37 ----D---- C:\Documents and Settings\admin\Data aplikací\My The Lord of the Rings, The Rise of the Witch-king Files
2011-07-21 17:31:00 ----D---- C:\Program Files\Any Video Converter
2011-07-21 17:31:00 ----D---- C:\Program Files\AGEIA Technologies
2011-07-21 17:30:59 ----D---- C:\Program Files\AVI ReComp
2011-07-19 22:28:22 ----D---- C:\Config.Msi
2011-07-18 23:21:24 ----D---- C:\WINDOWS\rpcminer
2011-07-18 23:21:24 ----D---- C:\WINDOWS\phoenix
2011-07-18 22:41:58 ----A---- C:\WINDOWS\unrar.exe
2011-07-18 22:36:10 ----D---- C:\WINDOWS\av_ico
2011-07-18 22:34:28 ----HD---- C:\WINDOWS\update.tray-3-0-lnk
2011-07-18 22:34:28 ----HD---- C:\WINDOWS\update.tray-3-0
2011-07-14 11:02:56 ----HDC---- C:\WINDOWS\$NtUninstallKB2507938$
2011-07-14 10:59:25 ----HDC---- C:\WINDOWS\$NtUninstallKB2555917$
2011-07-13 11:42:36 ----D---- C:\Documents and Settings\admin\Data aplikací\Vso
2011-07-13 11:42:36 ----A---- C:\WINDOWS\system32\drivers\pcouffin.sys
2011-07-13 11:42:36 ----A---- C:\Documents and Settings\admin\Data aplikací\inst.exe
2011-07-01 10:20:15 ----D---- C:\Program Files\Microsoft Silverlight

======List of files/folders modified in the last 1 month======

2011-07-31 13:00:11 ----RD---- C:\Program Files
2011-07-31 12:58:53 ----D---- C:\WINDOWS\Temp
2011-07-31 12:57:14 ----D---- C:\Documents and Settings\admin\Data aplikací\Skype
2011-07-23 02:09:23 ----D---- C:\WINDOWS\system32\CatRoot2
2011-07-23 01:26:49 ----D---- C:\WINDOWS\system32\drivers
2011-07-23 01:19:09 ----D---- C:\WINDOWS
2011-07-23 01:04:55 ----D---- C:\Program Files\uTorrent
2011-07-22 19:48:57 ----D---- C:\Documents and Settings\admin\Data aplikací\Google
2011-07-22 16:31:05 ----HD---- C:\WINDOWS\inf
2011-07-22 16:02:30 ----SHD---- C:\WINDOWS\Installer
2011-07-22 16:00:11 ----SD---- C:\WINDOWS\Tasks
2011-07-22 15:59:52 ----D---- C:\WINDOWS\system32\config
2011-07-22 15:59:40 ----D---- C:\Program Files\Common Files
2011-07-22 14:33:04 ----D---- C:\Documents and Settings
2011-07-22 13:01:31 ----D---- C:\WINDOWS\system32
2011-07-22 12:44:15 ----D---- C:\Program Files\Bonjour
2011-07-22 12:44:14 ----D---- C:\Program Files\Spyware Doctor
2011-07-22 12:44:14 ----D---- C:\Program Files\LogMeIn Hamachi
2011-07-22 12:35:24 ----A---- C:\WINDOWS\system32\ati2evxx.exe
2011-07-22 12:26:47 ----SHD---- C:\System Volume Information
2011-07-22 12:02:33 ----A---- C:\WINDOWS\system.ini
2011-07-22 12:02:17 ----D---- C:\WINDOWS\system32\drivers\etc
2011-07-22 10:49:29 ----D---- C:\WINDOWS\AppPatch
2011-07-22 00:20:45 ----D---- C:\Program Files\LogMeIn
2011-07-21 19:47:38 ----AD---- C:\Documents and Settings\All Users\Data aplikací\TEMP
2011-07-21 19:39:04 ----A---- C:\boot.ini
2011-07-21 19:19:23 ----D---- C:\WINDOWS\system32\Restore
2011-07-21 18:49:37 ----D---- C:\WINDOWS\Prefetch
2011-07-21 17:34:17 ----D---- C:\WINDOWS\system32\wbem
2011-07-21 17:34:17 ----D---- C:\WINDOWS\Registration
2011-07-21 17:33:33 ----D---- C:\Games
2011-07-21 17:33:26 ----D---- C:\Documents and Settings\All Users\Data aplikací\Media Center Programs
2011-07-21 17:33:22 ----HD---- C:\Program Files\InstallShield Installation Information
2011-07-21 17:30:51 ----D---- C:\l
2011-07-21 00:40:25 ----D---- C:\Documents and Settings\All Users\Data aplikací\PMB Files
2011-07-19 22:02:41 ----D---- C:\WINDOWS\Debug
2011-07-18 22:32:12 ----D---- C:\Documents and Settings\admin\Data aplikací\uTorrent
2011-07-16 21:30:40 ----D---- C:\Documents and Settings\admin\Data aplikací\vlc
2011-07-16 21:28:43 ----A---- C:\WINDOWS\NeroDigital.ini
2011-07-14 11:02:58 ----RSHDC---- C:\WINDOWS\system32\dllcache
2011-07-14 11:00:24 ----A---- C:\WINDOWS\system32\MRT.exe
2011-07-14 11:00:19 ----D---- C:\Documents and Settings\All Users\Data aplikací\Microsoft Help
2011-07-13 19:39:47 ----HD---- C:\WINDOWS\$hf_mig$
2011-07-05 21:03:21 ----D---- C:\Program Files\Microsoft Office
2011-07-01 10:20:24 ----SD---- C:\Documents and Settings\All Users\Data aplikací\Microsoft

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 ohci1394;Hostitelský řadič IEEE 1394 dle standardu OHCI Texas Instruments; C:\WINDOWS\system32\DRIVERS\ohci1394.sys [2008-04-14 61696]
R0 PCTCore;PCTools KDS; C:\WINDOWS\system32\drivers\PCTCore.sys [2009-04-03 130936]
R0 PxHelp20;PxHelp20; C:\WINDOWS\System32\Drivers\PxHelp20.sys [2010-08-12 45648]
R0 sfdrv01;StarForce Protection Environment Driver (version 1.x); C:\WINDOWS\System32\drivers\sfdrv01.sys [2006-05-10 51200]
R0 sfhlp02;StarForce Protection Helper Driver (version 2.x); C:\WINDOWS\System32\drivers\sfhlp02.sys [2006-06-14 13680]
R0 sfvfs02;StarForce Protection VFS Driver (version 2.x); C:\WINDOWS\System32\drivers\sfvfs02.sys [2005-11-03 63488]
R0 SpiderG3;DrWeb file system scanner; C:\WINDOWS\system32\drivers\spiderg3.sys [2011-06-30 93944]
R0 sptd;sptd; C:\WINDOWS\System32\Drivers\sptd.sys [2010-05-26 691696]
R0 WudfPf;Windows Driver Foundation - User-mode Driver Framework Platform Driver; C:\WINDOWS\system32\DRIVERS\WudfPf.sys [2006-09-28 77568]
R1 DRWEBAF;DrWEB Firewall Application Filter; \??\C:\WINDOWS\system32\drivers\drwebaf.sys []
R1 ehdrv;ehdrv; C:\WINDOWS\system32\DRIVERS\ehdrv.sys [2010-12-21 115008]
R1 intelppm;Řadič procesoru Intel; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2008-04-14 40192]
R1 nod32drv;nod32drv; C:\WINDOWS\system32\drivers\nod32drv.sys [2007-09-20 15424]
R1 PCLEPCI;PCLEPCI; \??\C:\WINDOWS\system32\drivers\pclepci.sys []
R1 SCDEmu;SCDEmu; C:\WINDOWS\system32\drivers\SCDEmu.sys [2009-11-09 59388]
R1 sp_rsdrv2;Spyware Terminator Driver 2; \??\C:\WINDOWS\system32\drivers\sp_rsdrv2.sys []
R1 WS2IFSL;Podpůrné prostředí zprostředkovatele služeb Windows Socket 2.0 bez podpory IFS; C:\WINDOWS\System32\drivers\ws2ifsl.sys [2001-10-25 12032]
R2 atksgt;atksgt; C:\WINDOWS\system32\DRIVERS\atksgt.sys [2007-10-26 278728]
R2 lirsgt;lirsgt; C:\WINDOWS\system32\DRIVERS\lirsgt.sys [2007-10-26 25416]
R2 LMIInfo;LogMeIn Kernel Information Provider; \??\C:\Program Files\LogMeIn\x86\RaInfo.sys []
R2 LMIRfsDriver;LogMeIn Remote File System Driver; \??\C:\WINDOWS\system32\drivers\LMIRfsDriver.sys []
R3 Arp1394;Protokol 1394 ARP Client; C:\WINDOWS\system32\DRIVERS\arp1394.sys [2008-04-14 60800]
R3 ati2mtag;ati2mtag; C:\WINDOWS\system32\DRIVERS\ati2mtag.sys [2009-09-30 3565056]
R3 DrWebPF;DrWeb Packet Filter Driver; C:\WINDOWS\system32\DRIVERS\DrWebPF.sys [2011-07-22 72568]
R3 e1express;Intel(R) PRO/1000 PCI Express Network Connection Driver; C:\WINDOWS\system32\DRIVERS\e1e5132.sys [2007-04-13 254872]
R3 GEARAspiWDM;GEAR ASPI Filter Driver; C:\WINDOWS\System32\Drivers\GEARAspiWDM.sys [2009-05-18 26600]
R3 hamachi;Hamachi Network Interface; C:\WINDOWS\system32\DRIVERS\hamachi.sys [2009-09-23 26176]
R3 HDAudBus;Ovladač Microsoft UAA pro sběrnici High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2008-04-13 144384]
R3 HECI;Intel(R) Management Engine Interface; C:\WINDOWS\system32\DRIVERS\HECI.sys [2006-10-23 44416]
R3 HidUsb;Ovladač třídy standardu HID; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-14 10368]
R3 lmimirr;lmimirr; C:\WINDOWS\system32\DRIVERS\lmimirr.sys [2008-08-11 10144]
R3 MarvinBus;Pinnacle Marvin Bus; C:\WINDOWS\system32\DRIVERS\MarvinBus.sys [2005-06-02 171008]
R3 mouhid;Ovladač myši standardu HID; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-10-24 12160]
R3 NIC1394;1394 Net Driver; C:\WINDOWS\system32\DRIVERS\nic1394.sys [2008-04-14 61824]
R3 sfng32;Sonic Focus Plugin for Sigmatel HDA; C:\WINDOWS\system32\drivers\sfng32.sys [2007-03-16 54272]
R3 STHDA;SigmaTel High Definition Audio CODEC; C:\WINDOWS\system32\drivers\sthda.sys [2007-05-06 1222840]
R3 USBSTOR;Ovladač velkokapacitního paměťového zařízení USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-14 26368]
R3 usbuhci;Ovladač Microsoft univerzálního hostitelského řadiče USB od společnosti Microsoft; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2008-04-14 20608]
S0 05397166;05397166; C:\WINDOWS\system32\DRIVERS\05397166.sys []
S1 epfwtdir;epfwtdir; C:\WINDOWS\system32\DRIVERS\epfwtdir.sys [2010-12-21 94872]
S2 adfs;adfs; C:\WINDOWS\system32\drivers\adfs.sys []
S2 AMON;AMON; C:\WINDOWS\system32\drivers\amon.sys [2007-09-20 512096]
S3 ahkpsjp7;ahkpsjp7; C:\WINDOWS\system32\drivers\ahkpsjp7.sys []
S3 am2c881w;am2c881w; C:\WINDOWS\system32\drivers\am2c881w.sys []
S3 ASAPIW2K;ASAPIW2K; \??\C:\WINDOWS\system32\Drivers\asapiW2k.sys []
S3 catchme;catchme; \??\C:\ComboFix\catchme.sys []
S3 CCDECODE;Dekodér Closed Caption; C:\WINDOWS\system32\DRIVERS\CCDECODE.sys [2004-07-09 16384]
S3 eamon;eamon; C:\WINDOWS\system32\DRIVERS\eamon.sys [2010-12-21 141264]
S3 k750bus;Sony Ericsson 750 driver (WDM); C:\WINDOWS\system32\DRIVERS\k750bus.sys [2009-05-05 55216]
S3 k750mdfl;Sony Ericsson 750 USB WMC Modem Filter; C:\WINDOWS\system32\DRIVERS\k750mdfl.sys [2009-05-05 6576]
S3 k750mdm;Sony Ericsson 750 USB WMC Modem Drivers; C:\WINDOWS\system32\DRIVERS\k750mdm.sys [2009-05-05 89872]
S3 k750mgmt;Sony Ericsson 750 USB WMC Device Management Drivers; C:\WINDOWS\system32\DRIVERS\k750mgmt.sys [2009-05-05 81728]
S3 k750obex;Sony Ericsson 750 USB WMC OBEX Interface Drivers; C:\WINDOWS\system32\DRIVERS\k750obex.sys [2009-05-05 79488]
S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink Converter; C:\WINDOWS\system32\drivers\MSTEE.sys [2002-12-12 5504]
S3 NABTSFEC;NABTS/FEC VBI Codec; C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys [2004-07-09 83968]
S3 NdisIP;Microsoft TV/Video Connection; C:\WINDOWS\system32\DRIVERS\NdisIP.sys [2004-07-09 10112]
S3 Netaapl;Apple Mobile Device Ethernet Service; C:\WINDOWS\system32\DRIVERS\netaapl.sys [2009-06-05 17408]
S3 pcouffin;VSO Software pcouffin; C:\WINDOWS\System32\Drivers\pcouffin.sys [2011-07-13 47360]
S3 SLIP;BDA Slip De-Framer; C:\WINDOWS\system32\DRIVERS\SLIP.sys [2004-07-09 10880]
S3 SNPSTD3;USB PC Camera (SNPSTD3); C:\WINDOWS\system32\DRIVERS\snpstd3.sys [2009-06-22 10498688]
S3 streamip;BDA IPSink; C:\WINDOWS\system32\DRIVERS\StreamIP.sys [2004-07-09 14976]
S3 tap0801;TAP-Win32 Adapter V8; C:\WINDOWS\system32\DRIVERS\tap0801.sys [2006-10-01 26624]
S3 UnlockerDriver4;UnlockerDriver4 Driver; \??\C:\Program Files\Unlocker\UnlockerDriver4.sys []
S3 USBAAPL;Apple Mobile USB Driver; C:\WINDOWS\System32\Drivers\usbaapl.sys [2011-02-18 41984]
S3 usbccgp;Obecný nadřazený ovladač Microsoft USB; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-14 32128]
S3 usbscan;Ovladač skeneru USB; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2008-04-14 15104]
S3 vaxscsi;vaxscsi; C:\WINDOWS\System32\Drivers\vaxscsi.sys [2007-09-24 223128]
S3 w810bus;Sony Ericsson W810 Driver driver (WDM); C:\WINDOWS\system32\DRIVERS\w810bus.sys []
S3 w810mdfl;Sony Ericsson W810 USB WMC Modem Filter; C:\WINDOWS\system32\DRIVERS\w810mdfl.sys []
S3 w810mdm;Sony Ericsson W810 USB WMC Modem Driver; C:\WINDOWS\system32\DRIVERS\w810mdm.sys []
S3 w810mgmt;Sony Ericsson W810 USB WMC Device Management Drivers (WDM); C:\WINDOWS\system32\DRIVERS\w810mgmt.sys []
S3 w810obex;Sony Ericsson W810 USB WMC OBEX Interface; C:\WINDOWS\system32\DRIVERS\w810obex.sys []
S3 Wdf01000;Wdf01000; C:\WINDOWS\system32\DRIVERS\Wdf01000.sys [2006-11-02 492000]
S3 WpdUsb;WpdUsb; C:\WINDOWS\System32\Drivers\wpdusb.sys [2006-10-18 38528]
S3 WSTCODEC;World Standard Teletext Codec; C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS [2004-07-09 18688]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-28 82944]
S4 dwshd;dwshd; C:\WINDOWS\System32\drivers\dwshd.sys []
S4 LMIRfsClientNP;LMIRfsClientNP; C:\WINDOWS\system32\drivers\LMIRfsClientNP.sys []

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 DrWebEngine;Dr.Web Scanning Engine (DrWebEngine); C:\Program Files\Common Files\Doctor Web\Scanning Engine\dwengine.exe [2011-06-30 1667416]
R2 DrWebFwSvc;Dr.Web Firewall Service; C:\Program Files\DrWeb\frwl_svc.exe [2011-07-22 2267120]
R2 StarWindServiceAE;StarWind AE Service; C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe [2011-07-22 370688]
R2 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
R3 iPod Service;iPod Service; C:\Program Files\iPod\bin\iPodService.exe [2011-07-22 815104]
S2 Ati HotKey Poller;Ati HotKey Poller; C:\WINDOWS\system32\Ati2evxx.exe [2011-07-22 602112]
S2 ATI Smart;ATI Smart; C:\WINDOWS\system32\ati2sgag.exe [2009-09-29 593920]
S2 Bonjour Service;Bonjour Service; C:\Program Files\Bonjour\mDNSResponder.exe [2011-07-22 344064]
S2 CTDevice_Srv;CT Device Query service; C:\Program Files\Creative\Shared Files\CTDevSrv.exe [2011-07-22 61440]
S2 Hamachi2Svc;LogMeIn Hamachi 2.0 Tunneling Engine; C:\Program Files\LogMeIn Hamachi\hamachi-2.exe [2011-07-22 1331200]
S2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2010-11-12 153376]
S2 NOD32krn;NOD32 Kernel Service; C:\Program Files\Eset\nod32krn.exe []
S2 sdAuxService;PC Tools Auxiliary Service; C:\Program Files\Spyware Doctor\pctsAuxs.exe [2011-07-22 339968]
S2 sdCoreService;PC Tools Security Service; C:\Program Files\Spyware Doctor\pctsSvc.exe [2009-01-21 1095560]
S2 sp_rssrv;Spyware Terminator Realtime Shield Service; C:\Program Files\Spyware Terminator\sp_rsser.exe []
S3 aawservice;Lavasoft Ad-Aware Service; C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe [2008-07-07 611664]
S3 aspnet_state;Stavová služba ASP.NET; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2008-07-25 34312]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; C:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104]
S3 IDriverT;InstallDriver Table Manager; C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [2005-04-04 69632]
S3 idsvc;Služba Windows CardSpace; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664]
S3 Microsoft Office Groove Audit Service;Microsoft Office Groove Audit Service; C:\Program Files\Microsoft Office\Office12\GrooveAuditService.exe [2008-10-25 65888]
S3 NBService;NBService; C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe [2006-11-10 774144]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2008-11-04 441712]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 WMPNetworkSvc;Služba Windows Media Player Network Sharing; C:\Program Files\Windows Media Player\WMPNetwk.exe [2007-01-05 913920]
S4 NetTcpPortSharing;Služba sdílení portů Net.Tcp; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2008-07-29 132096]

-----------------EOF-----------------

Danstahr · #2 Příspěvek od **Danstahr** » 31 Črc 2011 12:32

Dobré odpoledne

,

Stáhněte MBAM a vložte sem jeho log podle návodu zde, při výběru skenu zvolte Úplný sken.

Zatím nic nemažte, MBAM může mít falešné detekce!

Paolo312 · #3 Příspěvek od **Paolo312** » 31 Črc 2011 13:57

log z mbamu
Malwarebytes' Anti-Malware 1.50
www.malwarebytes.org

Verze databáze: 5214

Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

31.7.2011 14:54:45
mbam-log-2011-07-31 (14-54-39).txt

Typ kontroly: Úplný test (C:\|)
Testované objekty: 369242
Uplynulý čas: 1 hodin, 14 minut, 55 sekund

Infikované procesy v paměti: 0
Infikované moduly v paměti: 0
Infikované klíče v registru: 0
Infikované hodnoty v registru: 0
Infikované datové položky v registru: 0
Infikované složky: 0
Infikované soubory: 3

Infikované procesy v paměti:
(Žádné škodlivé položky nebyly zjištěny)

Infikované moduly v paměti:
(Žádné škodlivé položky nebyly zjištěny)

Infikované klíče v registru:
(Žádné škodlivé položky nebyly zjištěny)

Infikované hodnoty v registru:
(Žádné škodlivé položky nebyly zjištěny)

Infikované datové položky v registru:
(Žádné škodlivé položky nebyly zjištěny)

Infikované složky:
(Žádné škodlivé položky nebyly zjištěny)

Infikované soubory:
c:\documents and settings\admin\data aplikací\desktopicon\ebayshortcuts.exe (Adware.ADON) -> No action taken.
c:\IMG\Games\cracky + keygeny\gta.iv.crack.only.readnfo-0x0008\launchgtaiv.exe (Risktool.Crack) -> No action taken.
c:\documents and settings\admin\data aplikací\wiaserva.log (Malware.Trace) -> No action taken.

Danstahr · #4 Příspěvek od **Danstahr** » 31 Črc 2011 14:01

Infekci nalezenou MBAMem smažte.

Pozor! Tato utilita má velkou schopnost mazat a její použití je určeno výhradně členům týmu tohoto fóra. Svévolné použití může vést ke zboření a reinstalaci systému

Stáhněte ComboFix a uložte jej na Plochu.

Vypněte všechny rezidentní štíty antivirů a všechny programy běžící na pozadí.

Spusťte ComboFix s administrátorským oprávněním.

Potvrďte licenční podmínky a případně i instalaci konzoly pro zotavení

Během skenu nechte počítač naprosto v klidu.

Sken trvá zhruba 15 minut, ale doba se může lišit v závislosti na stavu systému

Po dokončení skenu se zobrazí log (pokud by se neotevřel, lze jej nalézt na systémovém disku jako ComboFix.txt), obsah logu vložte sem

ComboFixu si do dalšího pokynu nevšímejte

Paolo312 · #5 Příspěvek od **Paolo312** » 31 Črc 2011 14:32

log z combofixu

ComboFix 11-07-31.02 - admin 31.07.2011 15:12:55.3.2 - x86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.420.1029.18.2030.1137 [GMT 2:00]
Spuštěný z: c:\documents and settings\admin\Plocha\ComboFix.exe
AV: ESET NOD32 Antivirus 4.2 *Disabled/Updated* {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
FW: Dr.Web Firewall *Disabled* {3454C8F1-ECBC-4181-A7F4-04632FBA762B}
* Vytvořen nový Bod Obnovení
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\$NtUninstallKB35474$
c:\windows\$NtUninstallKB35474$\214399402\{1B372133-BFFA-4dba-9CCF-5474BED6A9F6}
c:\windows\$NtUninstallKB35474$\214399402\L\wuaojlmu
c:\windows\$NtUninstallKB35474$\214399402\loader.tlb
c:\windows\$NtUninstallKB35474$\214399402\U\@00000001
c:\windows\$NtUninstallKB35474$\214399402\U\@000000c0
c:\windows\$NtUninstallKB35474$\214399402\U\@000000cb
c:\windows\$NtUninstallKB35474$\214399402\U\@000000cf
c:\windows\$NtUninstallKB35474$\214399402\U\@80000000
c:\windows\$NtUninstallKB35474$\214399402\U\@800000c0
c:\windows\$NtUninstallKB35474$\214399402\U\@800000cb
c:\windows\$NtUninstallKB35474$\214399402\U\@800000cf
c:\windows\$NtUninstallKB35474$\937116113
c:\windows\geoiplist
c:\windows\geoiplist.rar
c:\windows\iun6002.exe
c:\windows\phoenix
c:\windows\phoenix\kernels\phatk\__init__.py
c:\windows\phoenix\kernels\phatk\__init__.pyc
c:\windows\phoenix\kernels\phatk\BFIPatcher.py
c:\windows\phoenix\kernels\phatk\kernel.cl
c:\windows\phoenix\kernels\poclbm\__init__.py
c:\windows\phoenix\kernels\poclbm\__init__.pyc
c:\windows\phoenix\kernels\poclbm\BFIPatcher.py
c:\windows\phoenix\kernels\poclbm\kernel.cl
c:\windows\phoenix\phoenix.exe
c:\windows\rpcminer
c:\windows\rpcminer\bitcoinminercuda_10.cubin
c:\windows\rpcminer\bitcoinminercuda_11.cubin
c:\windows\rpcminer\bitcoinminercuda_20.cubin
c:\windows\rpcminer\bitcoinmineropencl.cl
c:\windows\rpcminer\cudart32_32_16.dll
c:\windows\rpcminer\curllib.dll
c:\windows\rpcminer\libeay32.dll
c:\windows\rpcminer\libsasl.dll
c:\windows\rpcminer\openldap.dll
c:\windows\rpcminer\rpcminer-4way.exe
c:\windows\rpcminer\rpcminer-cpu.exe
c:\windows\rpcminer\rpcminer-cuda.exe
c:\windows\rpcminer\rpcminer-opencl.exe
c:\windows\rpcminer\ssleay32.dll
.
Nakažená kopie c:\windows\system32\wuauclt.exe byla nalezena a vyléčena.
Obnovena kopie z - c:\windows\system32\dllcache\wuauclt.exe
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2011-06-28 do 2011-07-31 )))))))))))))))))))))))))))))))
.
.
2011-07-31 11:37 . 2011-07-31 11:37 -------- d-----w- c:\documents and settings\admin\Data aplikací\Malwarebytes
2011-07-31 11:37 . 2010-11-29 15:42 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-07-31 11:37 . 2011-07-31 11:37 -------- d-----w- c:\documents and settings\All Users\Data aplikací\Malwarebytes
2011-07-31 11:37 . 2011-07-31 11:37 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2011-07-31 11:37 . 2010-11-29 15:42 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-07-31 11:00 . 2011-07-31 11:00 -------- d-----w- C:\rsit
2011-07-31 11:00 . 2011-07-31 11:00 -------- d-----w- c:\program files\trend micro
2011-07-22 14:00 . 2011-06-30 12:22 93944 ----a-w- c:\windows\system32\drivers\spiderg3.sys
2011-07-22 13:59 . 2011-07-22 13:58 72568 ----a-w- c:\windows\system32\drivers\DrWebPF.sys
2011-07-22 13:59 . 2011-07-22 13:58 84728 ----a-w- c:\windows\system32\drivers\drwebaf.sys
2011-07-22 13:59 . 2011-07-22 14:47 -------- d-----w- c:\program files\DrWeb
2011-07-22 13:59 . 2011-07-22 13:59 -------- d-----w- c:\program files\Common Files\Doctor Web
2011-07-22 13:59 . 2011-07-22 13:59 -------- d-----w- c:\documents and settings\All Users\Data aplikací\Doctor Web
2011-07-22 13:43 . 2011-07-22 16:43 -------- d-----w- c:\documents and settings\admin\DoctorWeb
2011-07-22 12:08 . 2011-07-22 21:14 -------- d-----w- c:\program files\NoAdware5.0
2011-07-21 18:13 . 2011-07-21 18:13 142592 ----a-w- c:\windows\system32\drivers\sp_rsdrv2.sys
2011-07-21 18:13 . 2011-07-22 10:13 -------- d-----w- c:\documents and settings\admin\Data aplikací\Spyware Terminator
2011-07-21 18:13 . 2011-07-22 10:13 -------- d-----w- c:\documents and settings\All Users\Data aplikací\Spyware Terminator
2011-07-21 18:13 . 2011-07-22 13:57 -------- d-----w- c:\program files\Spyware Terminator
2011-07-21 16:35 . 2011-07-22 11:01 -------- d--h--w- c:\windows\update.tray-2-0-lnk
2011-07-21 16:35 . 2011-07-21 17:01 -------- d--h--w- c:\windows\update.tray-2-0
2011-07-21 15:40 . 2011-07-22 23:05 -------- d-----w- c:\windows\ufa
2011-07-21 15:34 . 2011-07-21 15:34 -------- d-----w- c:\windows\system32\wbem\Repository
2011-07-21 15:33 . 2011-07-21 15:33 -------- d-----w- c:\documents and settings\admin\Data aplikací\My The Lord of the Rings, The Rise of the Witch-king Files
2011-07-21 15:31 . 2011-07-21 15:31 -------- d-----w- c:\program files\Any Video Converter
2011-07-21 15:31 . 2011-07-21 15:31 -------- d-----w- c:\program files\AGEIA Technologies
2011-07-21 15:30 . 2011-07-21 15:31 -------- d-----w- c:\program files\AVI ReComp
2011-07-21 15:25 . 2011-07-21 15:30 -------- d-s---w- c:\documents and settings\Administrator
2011-07-18 20:41 . 2011-07-21 15:40 246272 ----a-w- c:\windows\unrar.exe
2011-07-18 20:36 . 2011-07-21 16:37 -------- d-----w- c:\windows\av_ico
2011-07-18 20:34 . 2011-07-22 11:01 -------- d--h--w- c:\windows\update.tray-3-0-lnk
2011-07-18 20:34 . 2011-07-21 17:01 -------- d--h--w- c:\windows\update.tray-3-0
2011-07-18 20:21 . 2011-07-18 20:21 -------- d-----w- c:\documents and settings\LocalService\Nabídka Start
2011-07-13 09:42 . 2011-07-14 10:02 -------- d-----w- c:\documents and settings\admin\Data aplikací\Vso
2011-07-13 09:42 . 2011-07-14 10:02 87608 ----a-w- c:\documents and settings\admin\Data aplikací\inst.exe
2011-07-13 09:42 . 2011-07-13 09:42 47360 ----a-w- c:\windows\system32\drivers\pcouffin.sys
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-07-22 10:35 . 2007-08-22 01:57 602112 ----a-w- c:\windows\system32\ati2evxx.exe
2011-07-20 23:45 . 2009-06-09 13:01 214520 ----a-w- c:\windows\system32\PnkBstrB.xtr
2011-06-06 11:35 . 2004-08-17 13:44 1858944 ----a-w- c:\windows\system32\win32k.sys
2011-05-02 15:32 . 2007-09-19 23:13 692736 ----a-w- c:\windows\system32\inetcomm.dll
2011-06-28 22:37 . 2011-05-06 17:33 142296 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((( SnapShot@2011-07-21_17.05.56 )))))))))))))))))))))))))))))))))))))))))
.
+ 2011-07-22 14:00 . 2011-07-22 14:00 335872 c:\windows\Installer\{D68B6F53-200B-4899-B005-D264F0083AA6}\ARPPRODUCTICON.exe
+ 2011-07-22 14:00 . 2011-07-22 14:00 8232960 c:\windows\Installer\f1ef1.msi
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2006-11-16 139264]
"Pando Media Booster"="c:\program files\Pando Networks\Media Booster\PMB.exe" [2011-03-10 3046808]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2011-06-15 15141768]
"SpywareTerminatorUpdate"="c:\program files\Spyware Terminator\SpywareTerminatorUpdate.exe" [2011-07-22 3318784]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072]
"SigmatelSysTrayApp"="sttray.exe" [2007-05-06 405504]
"NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 155648]
"ISTray"="c:\program files\Spyware Doctor\pctsTray.exe" [2008-12-08 1173384]
"snpstd3"="c:\windows\vsnpstd3.exe" [2007-05-10 835584]
"tsnpstd3"="c:\windows\tsnpstd3.exe" [2009-04-24 360448]
"LogMeIn GUI"="c:\program files\LogMeIn\x86\LogMeInSystray.exe" [2008-08-11 63048]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2009-09-29 61440]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2010-11-29 421888]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2011-04-14 421160]
"LogMeIn Hamachi Ui"="c:\program files\LogMeIn Hamachi\hamachi-2-ui.exe" [2011-05-25 1951112]
"systemup"="c:\windows\systemup.exe" [BU]
"tray_ico"="" [BU]
"tray_ico0"="" [BU]
"tray_ico1"="" [BU]
"tray_ico2"="" [BU]
"tray_ico3"="" [BU]
"tray_ico4"="" [BU]
"SpIDerMail"="c:\program files\DrWeb\spiderml.exe" [2011-06-08 1572592]
"Dr.Web Firewall"="c:\program files\DrWeb\frwl_notify.exe" [2011-06-08 2583304]
"SpIDerAgent"="c:\program files\DrWeb\SpIDerAgent.exe" [2011-06-08 1473264]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableSecureUIAPaths"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"Taskman"=""
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LMIinit]
2009-09-28 18:34 87352 ----a-w- c:\windows\system32\LMIinit.dll
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
@="Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdauxservice]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdcoreservice]
@=""
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2008-01-11 20:16 39792 ----a-w- c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AlcoholAutomount]
2009-11-15 09:42 33120 ----a-w- c:\program files\Alcohol Soft\Alcohol 120\AxAutoMntSrv.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AppleSyncNotifier]
2009-08-13 13:51 177440 ----a-w- c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DivXUpdate]
2010-09-01 06:39 1164584 ----a-w- c:\program files\DivX\DivX Update\DivXUpdate.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\FixCamera]
2007-07-11 15:09 20480 ----a-w- c:\windows\FixCamera.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2011-04-14 09:32 421160 ----a-w- c:\program files\iTunes\iTunesHelper.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogMeIn Hamachi Ui]
2011-05-25 15:29 1951112 ----a-w- c:\program files\LogMeIn Hamachi\hamachi-2-ui.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PWRISOVM.EXE]
2009-11-09 03:17 180224 ----a-w- c:\program files\PowerISO\PWRISOVM.EXE
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2010-11-29 16:38 421888 ----a-w- c:\program files\QuickTime\QTTask.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoftAuto.exe]
2008-08-13 03:49 405504 ----a-w- c:\program files\Creative\Software Update 3\SoftAuto.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]
2010-11-28 09:51 1242448 ----a-w- c:\games\Steam\steam.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2010-05-14 10:44 248552 ----a-w- c:\program files\Common Files\Java\Java Update\jusched.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"FirewallOverride"=dword:00000001
"DisableThumbnailCache"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\uTorrent\\utorrent.exe"=
"c:\\Games\\The Battle for Middle-earth (tm) II\\game.dat"=
"c:\\Games\\Steam\\SteamApps\\paolo312\\source sdk base\\hl2.exe"=
"c:\\Games\\Command & Conquer Generals Zero Hour\\game.dat"=
"c:\\Program Files\\Nero\\Nero 7\\Nero ShowTime\\ShowTime.exe"=
"c:\\Games\\Command and Conquer Generals\\game.dat"=
"c:\\WINDOWS\\system32\\dpnsvr.exe"=
"c:\\Games\\Steam\\SteamApps\\paolo312\\half-life 2 deathmatch\\hl2.exe"=
"c:\\Games\\Grid\\GRID.exe"=
"c:\\Program Files\\GameSpy Arcade\\Aphex.exe"=
"c:\\Games\\Rockstar Games\\Rockstar Games Social Club\\RGSCLauncher.exe"=
"c:\\Games\\Rockstar Games\\Grand Theft Auto IV\\LaunchGTAIV.exe"=
"c:\\Games\\Rockstar Games\\Grand Theft Auto IV\\GTAIV.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Games\\Supreme Commander - Forged Alliance\\bin\\ForgedAlliance.exe"=
"c:\\Games\\GPGNet\\GPG.Multiplayer.Client.exe"=
"c:\\Games\\Steam\\steam.exe"=
"c:\\Games\\Battlefield 2\\BF2.exe"=
"%windir%\\system32\\drivers\\svchost.exe"=
"c:\\Program Files\\ICQ6.5\\ICQ.exe"=
"c:\\Games\\Steam\\SteamApps\\common\\left 4 dead 2 demo\\left4dead2.exe"=
"c:\\WINDOWS\\system32\\dplaysvr.exe"=
"c:\\Games\\Supreme Commander 2\\bin\\SupremeCommander2.exe"=
"c:\\Program Files\\Activision\\Call of Duty 2\\CoD2MP_s.exe"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
"c:\\Games\\World_of_Tanks_closed_Beta\\WorldOfTanks.exe"=
"c:\\Games\\Steam\\SteamApps\\common\\left 4 dead 2\\left4dead2.exe"=
"c:\\Games\\The Lord of the Rings Online\\lotroclient.exe"=
"c:\\Games\\The Lord of the Rings Online\\TurbineInvoker.exe"=
"c:\\Program Files\\Pando Networks\\Media Booster\\PMB.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"19631:TCP"= 19631:TCP:BitComet 19631 TCP
"19631:UDP"= 19631:UDP:BitComet 19631 UDP
"9339:TCP"= 9339:TCP:pokker
"443:TCP"= 443:TCP:1
"28910:TCP"= 28910:TCP:Zero Hour2
"29900:TCP"= 29900:TCP:Zero Hour3
"29920:TCP"= 29920:TCP:Zero Hour4
"4321:UDP"= 4321:UDP:Zero Hour5
"27900:UDP"= 27900:UDP:Zero Hour6
"8377:TCP"= 8377:TCP:League of Legends Launcher
"8377:UDP"= 8377:UDP:League of Legends Launcher
"8378:TCP"= 8378:TCP:League of Legends Launcher
"8378:UDP"= 8378:UDP:League of Legends Launcher
"8379:TCP"= 8379:TCP:League of Legends Launcher
"8379:UDP"= 8379:UDP:League of Legends Launcher
"57226:TCP"= 57226:TCP:Pando Media Booster
"57226:UDP"= 57226:UDP:Pando Media Booster
"8394:TCP"= 8394:TCP:League of Legends Launcher
"8394:UDP"= 8394:UDP:League of Legends Launcher
"8380:TCP"= 8380:TCP:League of Legends Launcher
"8380:UDP"= 8380:UDP:League of Legends Launcher
"8395:TCP"= 8395:TCP:League of Legends Launcher
"8395:UDP"= 8395:UDP:League of Legends Launcher
"6964:TCP"= 6964:TCP:League of Legends Launcher
"6964:UDP"= 6964:UDP:League of Legends Launcher
"8396:TCP"= 8396:TCP:League of Legends Launcher
"8396:UDP"= 8396:UDP:League of Legends Launcher
"26000:TCP"= 26000:TCP:Call of Duty 2
"29999:TCP"= 29999:TCP:Call of Duty 2(2)
"6912:TCP"= 6912:TCP:League of Legends Launcher
"6912:UDP"= 6912:UDP:League of Legends Launcher
"6944:TCP"= 6944:TCP:League of Legends Launcher
"6944:UDP"= 6944:UDP:League of Legends Launcher
"8381:TCP"= 8381:TCP:League of Legends Launcher
"8381:UDP"= 8381:UDP:League of Legends Launcher
"9000:UDP"= 9000:UDP:LOTRO
"2900:UDP"= 2900:UDP:Lotro2
"58977:TCP"= 58977:TCP:Pando Media Booster
"58977:UDP"= 58977:UDP:Pando Media Booster
"6950:TCP"= 6950:TCP:League of Legends Launcher
"6950:UDP"= 6950:UDP:League of Legends Launcher
"6916:TCP"= 6916:TCP:League of Legends Launcher
"6916:UDP"= 6916:UDP:League of Legends Launcher
"8397:TCP"= 8397:TCP:League of Legends Launcher
"8397:UDP"= 8397:UDP:League of Legends Launcher
"6968:TCP"= 6968:TCP:League of Legends Launcher
"6968:UDP"= 6968:UDP:League of Legends Launcher
"6979:TCP"= 6979:TCP:League of Legends Launcher
"6979:UDP"= 6979:UDP:League of Legends Launcher
"6960:TCP"= 6960:TCP:League of Legends Launcher
"6960:UDP"= 6960:UDP:League of Legends Launcher
"8398:TCP"= 8398:TCP:League of Legends Launcher
"8398:UDP"= 8398:UDP:League of Legends Launcher
"8382:TCP"= 8382:TCP:League of Legends Launcher
"8382:UDP"= 8382:UDP:League of Legends Launcher
"8383:TCP"= 8383:TCP:League of Legends Launcher
"8383:UDP"= 8383:UDP:League of Legends Launcher
.
R0 PCTCore;PCTools KDS;c:\windows\system32\drivers\PCTCore.sys [23.7.2009 22:27 130936]
R0 SpiderG3;DrWeb file system scanner;c:\windows\system32\drivers\spiderg3.sys [22.7.2011 16:00 93944]
R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [20.9.2007 19:30 691696]
R1 DRWEBAF;DrWEB Firewall Application Filter;c:\windows\system32\drivers\drwebaf.sys [22.7.2011 15:59 84728]
R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [21.12.2010 15:04 115008]
R1 nod32drv;nod32drv;c:\windows\system32\drivers\nod32drv.sys [20.9.2007 15:14 15424]
R1 sp_rsdrv2;Spyware Terminator Driver 2;c:\windows\system32\drivers\sp_rsdrv2.sys [21.7.2011 20:13 142592]
R2 DrWebEngine;Dr.Web Scanning Engine (DrWebEngine);c:\program files\Common Files\Doctor Web\Scanning Engine\dwengine.exe [30.6.2011 14:28 1667416]
R2 DrWebFwSvc;Dr.Web Firewall Service;c:\program files\DrWeb\frwl_svc.exe [22.7.2011 16:00 2267120]
R2 LMIInfo;LogMeIn Kernel Information Provider;c:\program files\LogMeIn\x86\rainfo.sys [11.8.2008 13:41 12856]
R3 DrWebPF;DrWeb Packet Filter Driver;c:\windows\system32\drivers\DrWebPF.sys [22.7.2011 15:59 72568]
S0 05397166;05397166;c:\windows\system32\DRIVERS\05397166.sys --> c:\windows\system32\DRIVERS\05397166.sys [?]
S1 epfwtdir;epfwtdir;c:\windows\system32\drivers\epfwtdir.sys [21.12.2010 13:47 94872]
S2 Hamachi2Svc;LogMeIn Hamachi 2.0 Tunneling Engine;c:\program files\LogMeIn Hamachi\hamachi-2.exe [25.5.2011 17:29 1331200]
S2 sdAuxService;PC Tools Auxiliary Service;c:\program files\Spyware Doctor\pctsAuxs.exe [23.7.2009 22:27 339968]
S3 Netaapl;Apple Mobile Device Ethernet Service;c:\windows\system32\drivers\netaapl.sys [1.7.2009 23:07 17408]
S3 tap0801;TAP-Win32 Adapter V8;c:\windows\system32\drivers\tap0801.sys [1.10.2006 14:37 26624]
S3 UnlockerDriver4;UnlockerDriver4 Driver;\??\c:\program files\Unlocker\UnlockerDriver4.sys --> c:\program files\Unlocker\UnlockerDriver4.sys [?]
S3 vaxscsi;vaxscsi;c:\windows\system32\drivers\vaxscsi.sys [24.9.2007 19:36 223128]
.
Obsah adresáře 'Naplánované úlohy'
.
2009-09-24 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 10:34]
.
2011-07-22 c:\windows\Tasks\Dr.Web Daily scan.job
- c:\program files\DrWeb\drweb32w.exe [2011-06-08 09:30]
.
2011-07-31 c:\windows\Tasks\Dr.Web Update.job
- c:\program files\DrWeb\DrWebUpW.exe [2011-06-27 16:39]
.
.
------- Doplňkový sken -------
.
uLocal Page = \blank.htm
uStart Page = hxxp://seznam.cz/
uInternet Settings,ProxyOverride = *.local
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: Stáhnout odkaz s použitím BitCometu - c:\program files\BitComet\BitComet.exe/AddLink.htm
IE: Stáhnout všechna videa s použitím BitCometu - c:\program files\BitComet\BitComet.exe/AddVideo.htm
IE: Stáhnout všechny odkazy s použitím BitCometu - c:\program files\BitComet\BitComet.exe/AddAllLink.htm
LSP: c:\program files\DrWeb\drwebsp.dll
LSP: c:\windows\system32\imon.dll
TCP: Interfaces\{8CBB9E27-955C-4240-90F8-DDD7EBCCC354}: NameServer = 194.228.2.1,194.228.41.113
FF - ProfilePath - c:\documents and settings\admin\Data aplikací\Mozilla\Firefox\Profiles\f0zs9nkw.default\
FF - prefs.js: browser.search.selectedEngine - ICQ Search
FF - prefs.js: browser.startup.homepage - hxxp://www.seznam.cz/
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-07-31 15:25
Windows 5.1.2600 Service Pack 3 NTFS
.
skenování skrytých procesů ...
.
skenování skrytých položek 'Po spuštění' ...
.
skenování skrytých souborů ...
.
sken byl úspešně dokončen
skryté soubory: 0
.
**************************************************************************
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_USERS\S-1-5-21-3162161101-2018322775-2885428501-1003\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:56,cc,49,8b,21,68,72,20,a6,53,f7,d6,08,c6,6c,b6,92,25,87,f6,1e,fc,15,
a9,cc,e3,56,eb,ca,4f,c1,25,08,fd,04,92,e8,f3,ea,f8,ed,12,d0,f3,db,21,a6,3f,\
"??"=hex:5c,f1,83,89,34,2e,c3,29,75,49,0f,ac,fc,c3,b8,aa
.
[HKEY_USERS\S-1-5-21-3162161101-2018322775-2885428501-1003\Software\SecuROM\License information*]
"datasecu"=hex:8d,df,9d,e6,73,7e,46,cf,06,bc,1d,d0,bc,d7,4e,03,6b,e4,83,a5,59,
79,9f,22,cd,48,c6,5a,fe,96,7f,05,61,bd,f9,75,fa,9d,53,db,7a,b5,ce,3f,27,5e,\
"rkeysecu"=hex:29,23,be,84,e1,6c,d6,ae,52,90,49,f1,f1,bb,e9,eb
.
[HKEY_LOCAL_MACHINE\software\Swearware\backup\winsock2]
@DACL=(02 0000)
@SACL=
.
--------------------- Knihovny navázané na běžící procesy ---------------------
.
- - - - - - - > 'winlogon.exe'(1336)
c:\windows\system32\Ati2evxx.dll
c:\windows\system32\LMIinit.dll
c:\windows\system32\LMIRfsClientNP.dll
.
- - - - - - - > 'lsass.exe'(1392)
c:\program files\DrWeb\drwebsp.dll
.
- - - - - - - > 'explorer.exe'(2884)
c:\progra~1\WINDOW~2\wmpband.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
c:\program files\Microsoft Office\Office12\1029\GrooveIntlResource.dll
c:\windows\system32\LMIRfsClientNP.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\windows\sttray.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
c:\program files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
c:\program files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
c:\program files\iPod\bin\iPodService.exe
c:\windows\system32\wscntfy.exe
c:\windows\system32\wbem\wmiapsrv.exe
.
**************************************************************************
.
Celkový čas: 2011-07-31 15:29:10 - počítač byl restartován
ComboFix-quarantined-files.txt 2011-07-31 13:28
ComboFix2.txt 2011-07-22 10:08
ComboFix3.txt 2011-07-21 17:12
.
Před spuštěním: Volných bajtů: 166 957 031 424
Po spuštění: Volných bajtů: 167 659 634 688
.
- - End Of File - - 87854E49F16806B71DC840607CD19C62

Danstahr · #6 Příspěvek od **Danstahr** » 31 Črc 2011 15:43

Otevřete Poznámkový blok, vložte do něj následující text a uložte soubor na Plochu jako CFScript.txt. Pak soubor přetáhněte na ikonu ComboFixu (viz obrázek). Po restartu se otevře log, ten sem vložte.

Kód: Vybrat vše

killall::

files::
c:\windows\unrar.exe
c:\documents and settings\admin\Data aplikací\inst.exe
c:\windows\Installer\f1ef1.msi
c:\windows\Installer\{D68B6F53-200B-4899-B005-D264F0083AA6}\ARPPRODUCTICON.exe
c:\windows\systemup.exe
c:\windows\system32\DRIVERS\05397166.sys
c:\windows\Tasks\AppleSoftwareUpdate.job
c:\windows\Tasks\Dr.Web Daily scan.job
c:\windows\Tasks\Dr.Web Update.job

folder::
c:\windows\update.tray-2-0-lnk
c:\windows\update.tray-2-0
c:\windows\ufa
c:\windows\av_ico
c:\windows\update.tray-3-0-lnk
c:\windows\update.tray-3-0

registry::
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"=-
"Pando Media Booster"=-

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"GrooveMonitor"=-
"NeroFilterCheck"=-
"StartCCC"=-
"QuickTime Task"=-
"iTunesHelper"=-
"systemup"=-
"tray_ico"=-
"tray_ico0"=-
"tray_ico1"=-
"tray_ico2"=-
"tray_ico3"=-
"tray_ico4"=-

[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AlcoholAutomount]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DivXUpdate]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoftAuto.exe]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]


[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\Program Files\\uTorrent\\utorrent.exe"=-
"c:\\Program Files\\Pando Networks\\Media Booster\\PMB.exe"=-

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"19631:TCP"=-
"19631:UDP"=-
"9339:TCP"=-
"443:TCP"=-
"28910:TCP"=-
"29900:TCP"=-
"29920:TCP"=-
"4321:UDP"=-
"27900:UDP"=-
"57226:TCP"=-
"57226:UDP"=-
"58977:TCP"=-
"58977:UDP"=-

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000000
"FirewallOverride"=dword:00000000
"DisableThumbnailCache"=dword:00000000

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableSecureUIAPaths"=dword:00000001

Firefox::
FF - ProfilePath - c:\documents and settings\admin\Data aplikací\Mozilla\Firefox\Profiles\f0zs9nkw.default\
FF - prefs.js: browser.search.selectedEngine - ICQ Search

RegLock::
[HKEY_USERS\S-1-5-21-3162161101-2018322775-2885428501-1003\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
[HKEY_USERS\S-1-5-21-3162161101-2018322775-2885428501-1003\Software\SecuROM\License information*]
[HKEY_LOCAL_MACHINE\software\Swearware\backup\winsock2]

Driver::
05397166

reboot::

Paolo312 · #7 Příspěvek od **Paolo312** » 31 Črc 2011 16:16

tady je ten log

ComboFix 11-07-31.02 - admin 31.07.2011 16:48:31.4.2 - x86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.420.1029.18.2030.1177 [GMT 2:00]
Spuštěný z: c:\documents and settings\admin\Plocha\ComboFix.exe
Použité ovládací přepínače :: c:\documents and settings\admin\Plocha\CFScript.txt
AV: ESET NOD32 Antivirus 4.2 *Disabled/Updated* {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
FW: Dr.Web Firewall *Disabled* {3454C8F1-ECBC-4181-A7F4-04632FBA762B}
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\av_ico
c:\windows\av_ico\ico_NOD_AV_START.ico
c:\windows\av_ico\ico_NOD_SS_START.ico
c:\windows\av_ico\ico_NOD_SYSINSP.ico
c:\windows\av_ico\ico_NOD_SYSRESC.ico
c:\windows\av_ico\ico_NOD_TXT.ico
c:\windows\av_ico\ico_NOD_UNINSTALL.ico
c:\windows\ufa
c:\windows\update.tray-2-0-lnk
c:\windows\update.tray-2-0
c:\windows\update.tray-3-0-lnk
c:\windows\update.tray-3-0
.
.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Legacy_05397166
-------\Service_05397166
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2011-06-28 do 2011-07-31 )))))))))))))))))))))))))))))))
.
.
2011-07-31 11:37 . 2011-07-31 11:37 -------- d-----w- c:\documents and settings\admin\Data aplikací\Malwarebytes
2011-07-31 11:37 . 2010-11-29 15:42 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-07-31 11:37 . 2011-07-31 11:37 -------- d-----w- c:\documents and settings\All Users\Data aplikací\Malwarebytes
2011-07-31 11:37 . 2011-07-31 11:37 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2011-07-31 11:37 . 2010-11-29 15:42 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-07-31 11:00 . 2011-07-31 11:00 -------- d-----w- C:\rsit
2011-07-31 11:00 . 2011-07-31 11:00 -------- d-----w- c:\program files\trend micro
2011-07-22 14:00 . 2011-06-30 12:22 93944 ----a-w- c:\windows\system32\drivers\spiderg3.sys
2011-07-22 13:59 . 2011-07-22 13:58 72568 ----a-w- c:\windows\system32\drivers\DrWebPF.sys
2011-07-22 13:59 . 2011-07-22 13:58 84728 ----a-w- c:\windows\system32\drivers\drwebaf.sys
2011-07-22 13:59 . 2011-07-22 14:47 -------- d-----w- c:\program files\DrWeb
2011-07-22 13:59 . 2011-07-22 13:59 -------- d-----w- c:\program files\Common Files\Doctor Web
2011-07-22 13:59 . 2011-07-22 13:59 -------- d-----w- c:\documents and settings\All Users\Data aplikací\Doctor Web
2011-07-22 13:43 . 2011-07-22 16:43 -------- d-----w- c:\documents and settings\admin\DoctorWeb
2011-07-22 12:08 . 2011-07-22 21:14 -------- d-----w- c:\program files\NoAdware5.0
2011-07-21 18:13 . 2011-07-21 18:13 142592 ----a-w- c:\windows\system32\drivers\sp_rsdrv2.sys
2011-07-21 18:13 . 2011-07-22 10:13 -------- d-----w- c:\documents and settings\admin\Data aplikací\Spyware Terminator
2011-07-21 18:13 . 2011-07-22 10:13 -------- d-----w- c:\documents and settings\All Users\Data aplikací\Spyware Terminator
2011-07-21 18:13 . 2011-07-22 13:57 -------- d-----w- c:\program files\Spyware Terminator
2011-07-21 15:34 . 2011-07-21 15:34 -------- d-----w- c:\windows\system32\wbem\Repository
2011-07-21 15:33 . 2011-07-21 15:33 -------- d-----w- c:\documents and settings\admin\Data aplikací\My The Lord of the Rings, The Rise of the Witch-king Files
2011-07-21 15:31 . 2011-07-21 15:31 -------- d-----w- c:\program files\Any Video Converter
2011-07-21 15:31 . 2011-07-21 15:31 -------- d-----w- c:\program files\AGEIA Technologies
2011-07-21 15:30 . 2011-07-21 15:31 -------- d-----w- c:\program files\AVI ReComp
2011-07-21 15:25 . 2011-07-21 15:30 -------- d-s---w- c:\documents and settings\Administrator
2011-07-18 20:41 . 2011-07-21 15:40 246272 ----a-w- c:\windows\unrar.exe
2011-07-18 20:21 . 2011-07-18 20:21 -------- d-----w- c:\documents and settings\LocalService\Nabídka Start
2011-07-13 09:42 . 2011-07-14 10:02 -------- d-----w- c:\documents and settings\admin\Data aplikací\Vso
2011-07-13 09:42 . 2011-07-14 10:02 87608 ----a-w- c:\documents and settings\admin\Data aplikací\inst.exe
2011-07-13 09:42 . 2011-07-13 09:42 47360 ----a-w- c:\windows\system32\drivers\pcouffin.sys
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-07-22 10:35 . 2007-08-22 01:57 602112 ----a-w- c:\windows\system32\ati2evxx.exe
2011-07-20 23:45 . 2009-06-09 13:01 214520 ----a-w- c:\windows\system32\PnkBstrB.xtr
2011-06-06 11:35 . 2004-08-17 13:44 1858944 ----a-w- c:\windows\system32\win32k.sys
2011-05-02 15:32 . 2007-09-19 23:13 692736 ----a-w- c:\windows\system32\inetcomm.dll
2011-06-28 22:37 . 2011-05-06 17:33 142296 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((( SnapShot@2011-07-21_17.05.56 )))))))))))))))))))))))))))))))))))))))))
.
+ 2011-07-22 14:00 . 2011-07-22 14:00 335872 c:\windows\Installer\{D68B6F53-200B-4899-B005-D264F0083AA6}\ARPPRODUCTICON.exe
+ 2011-07-22 14:00 . 2011-07-22 14:00 8232960 c:\windows\Installer\f1ef1.msi
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2011-06-15 15141768]
"SpywareTerminatorUpdate"="c:\program files\Spyware Terminator\SpywareTerminatorUpdate.exe" [2011-07-22 3318784]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SigmatelSysTrayApp"="sttray.exe" [2007-05-06 405504]
"ISTray"="c:\program files\Spyware Doctor\pctsTray.exe" [2008-12-08 1173384]
"snpstd3"="c:\windows\vsnpstd3.exe" [2007-05-10 835584]
"tsnpstd3"="c:\windows\tsnpstd3.exe" [2009-04-24 360448]
"LogMeIn GUI"="c:\program files\LogMeIn\x86\LogMeInSystray.exe" [2008-08-11 63048]
"LogMeIn Hamachi Ui"="c:\program files\LogMeIn Hamachi\hamachi-2-ui.exe" [2011-05-25 1951112]
"SpIDerMail"="c:\program files\DrWeb\spiderml.exe" [2011-06-08 1572592]
"Dr.Web Firewall"="c:\program files\DrWeb\frwl_notify.exe" [2011-06-08 2583304]
"SpIDerAgent"="c:\program files\DrWeb\SpIDerAgent.exe" [2011-06-08 1473264]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LMIinit]
2009-09-28 18:34 87352 ----a-w- c:\windows\system32\LMIinit.dll
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
@="Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdauxservice]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdcoreservice]
@=""
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AppleSyncNotifier]
2009-08-13 13:51 177440 ----a-w- c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\FixCamera]
2007-07-11 15:09 20480 ----a-w- c:\windows\FixCamera.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2011-04-14 09:32 421160 ----a-w- c:\program files\iTunes\iTunesHelper.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogMeIn Hamachi Ui]
2011-05-25 15:29 1951112 ----a-w- c:\program files\LogMeIn Hamachi\hamachi-2-ui.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PWRISOVM.EXE]
2009-11-09 03:17 180224 ----a-w- c:\program files\PowerISO\PWRISOVM.EXE
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]
2010-11-28 09:51 1242448 ----a-w- c:\games\Steam\steam.exe
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Games\\The Battle for Middle-earth (tm) II\\game.dat"=
"c:\\Games\\Steam\\SteamApps\\paolo312\\source sdk base\\hl2.exe"=
"c:\\Games\\Command & Conquer Generals Zero Hour\\game.dat"=
"c:\\Program Files\\Nero\\Nero 7\\Nero ShowTime\\ShowTime.exe"=
"c:\\Games\\Command and Conquer Generals\\game.dat"=
"c:\\WINDOWS\\system32\\dpnsvr.exe"=
"c:\\Games\\Steam\\SteamApps\\paolo312\\half-life 2 deathmatch\\hl2.exe"=
"c:\\Games\\Grid\\GRID.exe"=
"c:\\Program Files\\GameSpy Arcade\\Aphex.exe"=
"c:\\Games\\Rockstar Games\\Rockstar Games Social Club\\RGSCLauncher.exe"=
"c:\\Games\\Rockstar Games\\Grand Theft Auto IV\\LaunchGTAIV.exe"=
"c:\\Games\\Rockstar Games\\Grand Theft Auto IV\\GTAIV.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Games\\Supreme Commander - Forged Alliance\\bin\\ForgedAlliance.exe"=
"c:\\Games\\GPGNet\\GPG.Multiplayer.Client.exe"=
"c:\\Games\\Steam\\steam.exe"=
"c:\\Games\\Battlefield 2\\BF2.exe"=
"%windir%\\system32\\drivers\\svchost.exe"=
"c:\\Program Files\\ICQ6.5\\ICQ.exe"=
"c:\\Games\\Steam\\SteamApps\\common\\left 4 dead 2 demo\\left4dead2.exe"=
"c:\\WINDOWS\\system32\\dplaysvr.exe"=
"c:\\Games\\Supreme Commander 2\\bin\\SupremeCommander2.exe"=
"c:\\Program Files\\Activision\\Call of Duty 2\\CoD2MP_s.exe"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
"c:\\Games\\World_of_Tanks_closed_Beta\\WorldOfTanks.exe"=
"c:\\Games\\Steam\\SteamApps\\common\\left 4 dead 2\\left4dead2.exe"=
"c:\\Games\\The Lord of the Rings Online\\lotroclient.exe"=
"c:\\Games\\The Lord of the Rings Online\\TurbineInvoker.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"8377:TCP"= 8377:TCP:League of Legends Launcher
"8377:UDP"= 8377:UDP:League of Legends Launcher
"8378:TCP"= 8378:TCP:League of Legends Launcher
"8378:UDP"= 8378:UDP:League of Legends Launcher
"8379:TCP"= 8379:TCP:League of Legends Launcher
"8379:UDP"= 8379:UDP:League of Legends Launcher
"8394:TCP"= 8394:TCP:League of Legends Launcher
"8394:UDP"= 8394:UDP:League of Legends Launcher
"8380:TCP"= 8380:TCP:League of Legends Launcher
"8380:UDP"= 8380:UDP:League of Legends Launcher
"8395:TCP"= 8395:TCP:League of Legends Launcher
"8395:UDP"= 8395:UDP:League of Legends Launcher
"6964:TCP"= 6964:TCP:League of Legends Launcher
"6964:UDP"= 6964:UDP:League of Legends Launcher
"8396:TCP"= 8396:TCP:League of Legends Launcher
"8396:UDP"= 8396:UDP:League of Legends Launcher
"26000:TCP"= 26000:TCP:Call of Duty 2
"29999:TCP"= 29999:TCP:Call of Duty 2(2)
"6912:TCP"= 6912:TCP:League of Legends Launcher
"6912:UDP"= 6912:UDP:League of Legends Launcher
"6944:TCP"= 6944:TCP:League of Legends Launcher
"6944:UDP"= 6944:UDP:League of Legends Launcher
"8381:TCP"= 8381:TCP:League of Legends Launcher
"8381:UDP"= 8381:UDP:League of Legends Launcher
"9000:UDP"= 9000:UDP:LOTRO
"2900:UDP"= 2900:UDP:Lotro2
"6950:TCP"= 6950:TCP:League of Legends Launcher
"6950:UDP"= 6950:UDP:League of Legends Launcher
"6916:TCP"= 6916:TCP:League of Legends Launcher
"6916:UDP"= 6916:UDP:League of Legends Launcher
"8397:TCP"= 8397:TCP:League of Legends Launcher
"8397:UDP"= 8397:UDP:League of Legends Launcher
"6968:TCP"= 6968:TCP:League of Legends Launcher
"6968:UDP"= 6968:UDP:League of Legends Launcher
"6979:TCP"= 6979:TCP:League of Legends Launcher
"6979:UDP"= 6979:UDP:League of Legends Launcher
"6960:TCP"= 6960:TCP:League of Legends Launcher
"6960:UDP"= 6960:UDP:League of Legends Launcher
"8398:TCP"= 8398:TCP:League of Legends Launcher
"8398:UDP"= 8398:UDP:League of Legends Launcher
"8382:TCP"= 8382:TCP:League of Legends Launcher
"8382:UDP"= 8382:UDP:League of Legends Launcher
"8383:TCP"= 8383:TCP:League of Legends Launcher
"8383:UDP"= 8383:UDP:League of Legends Launcher
.
R0 PCTCore;PCTools KDS;c:\windows\system32\drivers\PCTCore.sys [23.7.2009 22:27 130936]
R0 SpiderG3;DrWeb file system scanner;c:\windows\system32\drivers\spiderg3.sys [22.7.2011 16:00 93944]
R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [20.9.2007 19:30 691696]
R1 DRWEBAF;DrWEB Firewall Application Filter;c:\windows\system32\drivers\drwebaf.sys [22.7.2011 15:59 84728]
R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [21.12.2010 15:04 115008]
R1 nod32drv;nod32drv;c:\windows\system32\drivers\nod32drv.sys [20.9.2007 15:14 15424]
R1 sp_rsdrv2;Spyware Terminator Driver 2;c:\windows\system32\drivers\sp_rsdrv2.sys [21.7.2011 20:13 142592]
R2 DrWebEngine;Dr.Web Scanning Engine (DrWebEngine);c:\program files\Common Files\Doctor Web\Scanning Engine\dwengine.exe [30.6.2011 14:28 1667416]
R2 DrWebFwSvc;Dr.Web Firewall Service;c:\program files\DrWeb\frwl_svc.exe [22.7.2011 16:00 2267120]
R2 LMIInfo;LogMeIn Kernel Information Provider;c:\program files\LogMeIn\x86\rainfo.sys [11.8.2008 13:41 12856]
R3 DrWebPF;DrWeb Packet Filter Driver;c:\windows\system32\drivers\DrWebPF.sys [22.7.2011 15:59 72568]
S1 epfwtdir;epfwtdir;c:\windows\system32\drivers\epfwtdir.sys [21.12.2010 13:47 94872]
S2 Hamachi2Svc;LogMeIn Hamachi 2.0 Tunneling Engine;c:\program files\LogMeIn Hamachi\hamachi-2.exe [25.5.2011 17:29 1331200]
S2 sdAuxService;PC Tools Auxiliary Service;c:\program files\Spyware Doctor\pctsAuxs.exe [23.7.2009 22:27 339968]
S3 Netaapl;Apple Mobile Device Ethernet Service;c:\windows\system32\drivers\netaapl.sys [1.7.2009 23:07 17408]
S3 tap0801;TAP-Win32 Adapter V8;c:\windows\system32\drivers\tap0801.sys [1.10.2006 14:37 26624]
S3 UnlockerDriver4;UnlockerDriver4 Driver;\??\c:\program files\Unlocker\UnlockerDriver4.sys --> c:\program files\Unlocker\UnlockerDriver4.sys [?]
S3 vaxscsi;vaxscsi;c:\windows\system32\drivers\vaxscsi.sys [24.9.2007 19:36 223128]
.
Obsah adresáře 'Naplánované úlohy'
.
2009-09-24 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 10:34]
.
2011-07-22 c:\windows\Tasks\Dr.Web Daily scan.job
- c:\program files\DrWeb\drweb32w.exe [2011-06-08 09:30]
.
2011-07-31 c:\windows\Tasks\Dr.Web Update.job
- c:\program files\DrWeb\DrWebUpW.exe [2011-06-27 16:39]
.
.
------- Doplňkový sken -------
.
uLocal Page = \blank.htm
uStart Page = hxxp://seznam.cz/
uInternet Settings,ProxyOverride = *.local
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: Stáhnout odkaz s použitím BitCometu - c:\program files\BitComet\BitComet.exe/AddLink.htm
IE: Stáhnout všechna videa s použitím BitCometu - c:\program files\BitComet\BitComet.exe/AddVideo.htm
IE: Stáhnout všechny odkazy s použitím BitCometu - c:\program files\BitComet\BitComet.exe/AddAllLink.htm
LSP: c:\program files\DrWeb\drwebsp.dll
LSP: c:\windows\system32\imon.dll
TCP: Interfaces\{8CBB9E27-955C-4240-90F8-DDD7EBCCC354}: NameServer = 194.228.2.1,194.228.41.113
FF - ProfilePath - c:\documents and settings\admin\Data aplikací\Mozilla\Firefox\Profiles\f0zs9nkw.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.seznam.cz/
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-07-31 17:01
Windows 5.1.2600 Service Pack 3 NTFS
.
skenování skrytých procesů ...
.
skenování skrytých položek 'Po spuštění' ...
.
skenování skrytých souborů ...
.
sken byl úspešně dokončen
skryté soubory: 0
.
**************************************************************************
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_USERS\S-1-5-21-3162161101-2018322775-2885428501-1003\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:56,cc,49,8b,21,68,72,20,a6,53,f7,d6,08,c6,6c,b6,92,25,87,f6,1e,fc,15,
a9,cc,e3,56,eb,ca,4f,c1,25,08,fd,04,92,e8,f3,ea,f8,ed,12,d0,f3,db,21,a6,3f,\
"??"=hex:5c,f1,83,89,34,2e,c3,29,75,49,0f,ac,fc,c3,b8,aa
.
[HKEY_USERS\S-1-5-21-3162161101-2018322775-2885428501-1003\Software\SecuROM\License information*]
"datasecu"=hex:8d,df,9d,e6,73,7e,46,cf,06,bc,1d,d0,bc,d7,4e,03,6b,e4,83,a5,59,
79,9f,22,cd,48,c6,5a,fe,96,7f,05,61,bd,f9,75,fa,9d,53,db,7a,b5,ce,3f,27,5e,\
"rkeysecu"=hex:29,23,be,84,e1,6c,d6,ae,52,90,49,f1,f1,bb,e9,eb
.
--------------------- Knihovny navázané na běžící procesy ---------------------
.
- - - - - - - > 'winlogon.exe'(1324)
c:\windows\system32\Ati2evxx.dll
c:\windows\system32\LMIinit.dll
c:\windows\system32\LMIRfsClientNP.dll
.
- - - - - - - > 'lsass.exe'(1380)
c:\program files\DrWeb\drwebsp.dll
.
- - - - - - - > 'explorer.exe'(4008)
c:\progra~1\WINDOW~2\wmpband.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\windows\sttray.exe
c:\program files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
c:\windows\system32\wscntfy.exe
c:\windows\system32\wbem\wmiapsrv.exe
.
**************************************************************************
.
Celkový čas: 2011-07-31 17:05:11 - počítač byl restartován
ComboFix-quarantined-files.txt 2011-07-31 15:05
ComboFix2.txt 2011-07-31 13:29
ComboFix3.txt 2011-07-22 10:08
ComboFix4.txt 2011-07-21 17:12
.
Před spuštěním: Volných bajtů: 167 746 052 096
Po spuštění: Volných bajtů: 167 772 864 512
.
- - End Of File - - CADB35DFA92A409A1E0B1E436C2B10FD

Danstahr · #8 Příspěvek od **Danstahr** » 31 Črc 2011 16:51

Vypadá to lépe, jak je na tom PC?

V nouzovém režimu použijte Eset Uninstaller. Podrobný návod jak na to je zde v bodě 2. Poté (už v normálním režimu) antivir znovu nainstalujte.

Paolo312 · #9 Příspěvek od **Paolo312** » 31 Črc 2011 17:08

Teď jsem ho restartoval a rozběhl se i internet, dokonce i ten "blbej facebook", znamená to že je už pryč?

Danstahr · #10 Příspěvek od **Danstahr** » 31 Črc 2011 17:42

Infekce by měla být pryč, ještě je potřeba reinstalovat antivir a uklidit po používaných utilitách. Až budete hotov s tím antivirem, dejte vědět.

Paolo312 · #11 Příspěvek od **Paolo312** » 31 Črc 2011 17:55

Tak Nod32 je nainstalován....to je dobré znamení

Danstahr · #12 Příspěvek od **Danstahr** » 31 Črc 2011 17:57

Do předchozího CF skriptu se mi vloudila chybka, opakujte prosím použití CF s tímto skriptem (nezapomeňte vypnout rezidentní ochranu Noda, když už zase funguje) :

Kód: Vybrat vše

killall::

file::
c:\windows\unrar.exe
c:\documents and settings\admin\Data aplikací\inst.exe
c:\windows\Installer\f1ef1.msi
c:\windows\Installer\{D68B6F53-200B-4899-B005-D264F0083AA6}\ARPPRODUCTICON.exe
c:\windows\systemup.exe
c:\windows\system32\DRIVERS\05397166.sys
c:\windows\Tasks\AppleSoftwareUpdate.job
c:\windows\Tasks\Dr.Web Daily scan.job
c:\windows\Tasks\Dr.Web Update.job

reboot::

Paolo312 · #13 Příspěvek od **Paolo312** » 31 Črc 2011 18:26

Tak tohle je první příspěvek z napadeného počítače, log z combofixu...

ComboFix 11-07-31.02 - admin 31.07.2011 19:04:54.5.2 - x86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.420.1029.18.2030.1266 [GMT 2:00]
Spuštěný z: c:\documents and settings\admin\Plocha\ComboFix.exe
Použité ovládací přepínače :: c:\documents and settings\admin\Plocha\CFScript.txt
AV: ESET NOD32 Antivirus 4.2 *Disabled/Updated* {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
.
FILE ::
"c:\documents and settings\admin\Data aplikací\inst.exe"
"c:\windows\Installer\{D68B6F53-200B-4899-B005-D264F0083AA6}\ARPPRODUCTICON.exe"
"c:\windows\Installer\f1ef1.msi"
"c:\windows\system32\DRIVERS\05397166.sys"
"c:\windows\systemup.exe"
"c:\windows\Tasks\AppleSoftwareUpdate.job"
"c:\windows\Tasks\Dr.Web Daily scan.job"
"c:\windows\Tasks\Dr.Web Update.job"
"c:\windows\unrar.exe"
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\Tasks\AppleSoftwareUpdate.job
c:\windows\unrar.exe
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2011-06-28 do 2011-07-31 )))))))))))))))))))))))))))))))
.
.
2011-07-31 16:50 . 2011-07-31 16:50 -------- d-----w- c:\program files\ESET
2011-07-31 16:50 . 2011-07-31 16:50 -------- d-----w- c:\documents and settings\All Users\Data aplikací\ESET
2011-07-31 11:37 . 2011-07-31 11:37 -------- d-----w- c:\documents and settings\admin\Data aplikací\Malwarebytes
2011-07-31 11:37 . 2010-11-29 15:42 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-07-31 11:37 . 2011-07-31 11:37 -------- d-----w- c:\documents and settings\All Users\Data aplikací\Malwarebytes
2011-07-31 11:37 . 2011-07-31 11:37 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2011-07-31 11:37 . 2010-11-29 15:42 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-07-31 11:00 . 2011-07-31 11:00 -------- d-----w- C:\rsit
2011-07-31 11:00 . 2011-07-31 11:00 -------- d-----w- c:\program files\trend micro
2011-07-22 13:59 . 2011-07-31 16:02 -------- d-----w- c:\program files\DrWeb
2011-07-22 13:43 . 2011-07-22 16:43 -------- d-----w- c:\documents and settings\admin\DoctorWeb
2011-07-22 12:08 . 2011-07-22 21:14 -------- d-----w- c:\program files\NoAdware5.0
2011-07-21 18:13 . 2011-07-21 18:13 142592 ----a-w- c:\windows\system32\drivers\sp_rsdrv2.sys
2011-07-21 18:13 . 2011-07-22 10:13 -------- d-----w- c:\documents and settings\admin\Data aplikací\Spyware Terminator
2011-07-21 18:13 . 2011-07-22 10:13 -------- d-----w- c:\documents and settings\All Users\Data aplikací\Spyware Terminator
2011-07-21 18:13 . 2011-07-22 13:57 -------- d-----w- c:\program files\Spyware Terminator
2011-07-21 15:34 . 2011-07-21 15:34 -------- d-----w- c:\windows\system32\wbem\Repository
2011-07-21 15:33 . 2011-07-21 15:33 -------- d-----w- c:\documents and settings\admin\Data aplikací\My The Lord of the Rings, The Rise of the Witch-king Files
2011-07-21 15:31 . 2011-07-21 15:31 -------- d-----w- c:\program files\Any Video Converter
2011-07-21 15:31 . 2011-07-21 15:31 -------- d-----w- c:\program files\AGEIA Technologies
2011-07-21 15:30 . 2011-07-21 15:31 -------- d-----w- c:\program files\AVI ReComp
2011-07-21 15:25 . 2011-07-21 15:30 -------- d-s---w- c:\documents and settings\Administrator
2011-07-18 20:21 . 2011-07-18 20:21 -------- d-----w- c:\documents and settings\LocalService\Nabídka Start
2011-07-13 09:42 . 2011-07-14 10:02 -------- d-----w- c:\documents and settings\admin\Data aplikací\Vso
2011-07-13 09:42 . 2011-07-14 10:02 87608 ----a-w- c:\documents and settings\admin\Data aplikací\inst.exe
2011-07-13 09:42 . 2011-07-13 09:42 47360 ----a-w- c:\windows\system32\drivers\pcouffin.sys
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-07-22 10:35 . 2007-08-22 01:57 602112 ----a-w- c:\windows\system32\ati2evxx.exe
2011-07-20 23:45 . 2009-06-09 13:01 214520 ----a-w- c:\windows\system32\PnkBstrB.xtr
2011-06-06 11:35 . 2004-08-17 13:44 1858944 ----a-w- c:\windows\system32\win32k.sys
2011-06-28 22:37 . 2011-05-06 17:33 142296 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((( SnapShot@2011-07-21_17.05.56 )))))))))))))))))))))))))))))))))))))))))
.
+ 2011-07-31 16:54 . 2011-07-31 16:54 10134 c:\windows\Installer\{204BB4EF-68AC-454B-857E-431336B4188A}\callmsi.exe
+ 2011-07-31 16:54 . 2011-07-31 16:54 975360 c:\windows\Installer\1a594.msi
+ 2011-07-31 16:54 . 2011-07-31 16:54 101504 c:\windows\Installer\{204BB4EF-68AC-454B-857E-431336B4188A}\egui.exe
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2011-06-15 15141768]
"SpywareTerminatorUpdate"="c:\program files\Spyware Terminator\SpywareTerminatorUpdate.exe" [2011-07-22 3318784]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SigmatelSysTrayApp"="sttray.exe" [2007-05-06 405504]
"ISTray"="c:\program files\Spyware Doctor\pctsTray.exe" [2008-12-08 1173384]
"snpstd3"="c:\windows\vsnpstd3.exe" [2007-05-10 835584]
"tsnpstd3"="c:\windows\tsnpstd3.exe" [2009-04-24 360448]
"LogMeIn GUI"="c:\program files\LogMeIn\x86\LogMeInSystray.exe" [2008-08-11 63048]
"LogMeIn Hamachi Ui"="c:\program files\LogMeIn Hamachi\hamachi-2-ui.exe" [2011-05-25 1951112]
"egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2011-01-12 2219184]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LMIinit]
2009-09-28 18:34 87352 ----a-w- c:\windows\system32\LMIinit.dll
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
@="Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdauxservice]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdcoreservice]
@=""
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AppleSyncNotifier]
2009-08-13 13:51 177440 ----a-w- c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\FixCamera]
2007-07-11 15:09 20480 ----a-w- c:\windows\FixCamera.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2011-04-14 09:32 421160 ----a-w- c:\program files\iTunes\iTunesHelper.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogMeIn Hamachi Ui]
2011-05-25 15:29 1951112 ----a-w- c:\program files\LogMeIn Hamachi\hamachi-2-ui.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PWRISOVM.EXE]
2009-11-09 03:17 180224 ----a-w- c:\program files\PowerISO\PWRISOVM.EXE
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]
2010-11-28 09:51 1242448 ----a-w- c:\games\Steam\steam.exe
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Games\\The Battle for Middle-earth (tm) II\\game.dat"=
"c:\\Games\\Steam\\SteamApps\\paolo312\\source sdk base\\hl2.exe"=
"c:\\Games\\Command & Conquer Generals Zero Hour\\game.dat"=
"c:\\Program Files\\Nero\\Nero 7\\Nero ShowTime\\ShowTime.exe"=
"c:\\Games\\Command and Conquer Generals\\game.dat"=
"c:\\WINDOWS\\system32\\dpnsvr.exe"=
"c:\\Games\\Steam\\SteamApps\\paolo312\\half-life 2 deathmatch\\hl2.exe"=
"c:\\Games\\Grid\\GRID.exe"=
"c:\\Program Files\\GameSpy Arcade\\Aphex.exe"=
"c:\\Games\\Rockstar Games\\Rockstar Games Social Club\\RGSCLauncher.exe"=
"c:\\Games\\Rockstar Games\\Grand Theft Auto IV\\LaunchGTAIV.exe"=
"c:\\Games\\Rockstar Games\\Grand Theft Auto IV\\GTAIV.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Games\\Supreme Commander - Forged Alliance\\bin\\ForgedAlliance.exe"=
"c:\\Games\\GPGNet\\GPG.Multiplayer.Client.exe"=
"c:\\Games\\Steam\\steam.exe"=
"c:\\Games\\Battlefield 2\\BF2.exe"=
"%windir%\\system32\\drivers\\svchost.exe"=
"c:\\Program Files\\ICQ6.5\\ICQ.exe"=
"c:\\Games\\Steam\\SteamApps\\common\\left 4 dead 2 demo\\left4dead2.exe"=
"c:\\WINDOWS\\system32\\dplaysvr.exe"=
"c:\\Games\\Supreme Commander 2\\bin\\SupremeCommander2.exe"=
"c:\\Program Files\\Activision\\Call of Duty 2\\CoD2MP_s.exe"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
"c:\\Games\\World_of_Tanks_closed_Beta\\WorldOfTanks.exe"=
"c:\\Games\\Steam\\SteamApps\\common\\left 4 dead 2\\left4dead2.exe"=
"c:\\Games\\The Lord of the Rings Online\\lotroclient.exe"=
"c:\\Games\\The Lord of the Rings Online\\TurbineInvoker.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"8377:TCP"= 8377:TCP:League of Legends Launcher
"8377:UDP"= 8377:UDP:League of Legends Launcher
"8378:TCP"= 8378:TCP:League of Legends Launcher
"8378:UDP"= 8378:UDP:League of Legends Launcher
"8379:TCP"= 8379:TCP:League of Legends Launcher
"8379:UDP"= 8379:UDP:League of Legends Launcher
"8394:TCP"= 8394:TCP:League of Legends Launcher
"8394:UDP"= 8394:UDP:League of Legends Launcher
"8380:TCP"= 8380:TCP:League of Legends Launcher
"8380:UDP"= 8380:UDP:League of Legends Launcher
"8395:TCP"= 8395:TCP:League of Legends Launcher
"8395:UDP"= 8395:UDP:League of Legends Launcher
"6964:TCP"= 6964:TCP:League of Legends Launcher
"6964:UDP"= 6964:UDP:League of Legends Launcher
"8396:TCP"= 8396:TCP:League of Legends Launcher
"8396:UDP"= 8396:UDP:League of Legends Launcher
"26000:TCP"= 26000:TCP:Call of Duty 2
"29999:TCP"= 29999:TCP:Call of Duty 2(2)
"6912:TCP"= 6912:TCP:League of Legends Launcher
"6912:UDP"= 6912:UDP:League of Legends Launcher
"6944:TCP"= 6944:TCP:League of Legends Launcher
"6944:UDP"= 6944:UDP:League of Legends Launcher
"8381:TCP"= 8381:TCP:League of Legends Launcher
"8381:UDP"= 8381:UDP:League of Legends Launcher
"9000:UDP"= 9000:UDP:LOTRO
"2900:UDP"= 2900:UDP:Lotro2
"6950:TCP"= 6950:TCP:League of Legends Launcher
"6950:UDP"= 6950:UDP:League of Legends Launcher
"6916:TCP"= 6916:TCP:League of Legends Launcher
"6916:UDP"= 6916:UDP:League of Legends Launcher
"8397:TCP"= 8397:TCP:League of Legends Launcher
"8397:UDP"= 8397:UDP:League of Legends Launcher
"6968:TCP"= 6968:TCP:League of Legends Launcher
"6968:UDP"= 6968:UDP:League of Legends Launcher
"6979:TCP"= 6979:TCP:League of Legends Launcher
"6979:UDP"= 6979:UDP:League of Legends Launcher
"6960:TCP"= 6960:TCP:League of Legends Launcher
"6960:UDP"= 6960:UDP:League of Legends Launcher
"8398:TCP"= 8398:TCP:League of Legends Launcher
"8398:UDP"= 8398:UDP:League of Legends Launcher
"8382:TCP"= 8382:TCP:League of Legends Launcher
"8382:UDP"= 8382:UDP:League of Legends Launcher
"8383:TCP"= 8383:TCP:League of Legends Launcher
"8383:UDP"= 8383:UDP:League of Legends Launcher
.
R0 PCTCore;PCTools KDS;c:\windows\system32\drivers\PCTCore.sys [23.7.2009 22:27 130936]
R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [20.9.2007 19:30 691696]
R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [21.12.2010 15:04 115008]
R1 epfwtdir;epfwtdir;c:\windows\system32\drivers\epfwtdir.sys [21.12.2010 13:47 94872]
R1 sp_rsdrv2;Spyware Terminator Driver 2;c:\windows\system32\drivers\sp_rsdrv2.sys [21.7.2011 20:13 142592]
R2 ekrn;ESET Service;c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe [12.1.2011 16:41 810144]
R2 LMIInfo;LogMeIn Kernel Information Provider;c:\program files\LogMeIn\x86\rainfo.sys [11.8.2008 13:41 12856]
S2 Hamachi2Svc;LogMeIn Hamachi 2.0 Tunneling Engine;c:\program files\LogMeIn Hamachi\hamachi-2.exe [25.5.2011 17:29 1331200]
S2 sdAuxService;PC Tools Auxiliary Service;c:\program files\Spyware Doctor\pctsAuxs.exe [23.7.2009 22:27 339968]
S3 Netaapl;Apple Mobile Device Ethernet Service;c:\windows\system32\drivers\netaapl.sys [1.7.2009 23:07 17408]
S3 tap0801;TAP-Win32 Adapter V8;c:\windows\system32\drivers\tap0801.sys [1.10.2006 14:37 26624]
S3 UnlockerDriver4;UnlockerDriver4 Driver;\??\c:\program files\Unlocker\UnlockerDriver4.sys --> c:\program files\Unlocker\UnlockerDriver4.sys [?]
S3 vaxscsi;vaxscsi;c:\windows\system32\drivers\vaxscsi.sys [24.9.2007 19:36 223128]
.
.
------- Doplňkový sken -------
.
uLocal Page = \blank.htm
uStart Page = hxxp://seznam.cz/
uInternet Settings,ProxyOverride = *.local
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: Stáhnout odkaz s použitím BitCometu - c:\program files\BitComet\BitComet.exe/AddLink.htm
IE: Stáhnout všechna videa s použitím BitCometu - c:\program files\BitComet\BitComet.exe/AddVideo.htm
IE: Stáhnout všechny odkazy s použitím BitCometu - c:\program files\BitComet\BitComet.exe/AddAllLink.htm
TCP: Interfaces\{8CBB9E27-955C-4240-90F8-DDD7EBCCC354}: NameServer = 194.228.2.1,194.228.41.113
FF - ProfilePath - c:\documents and settings\admin\Data aplikací\Mozilla\Firefox\Profiles\f0zs9nkw.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.seznam.cz/
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-07-31 19:16
Windows 5.1.2600 Service Pack 3 NTFS
.
skenování skrytých procesů ...
.
skenování skrytých položek 'Po spuštění' ...
.
skenování skrytých souborů ...
.
sken byl úspešně dokončen
skryté soubory: 0
.
**************************************************************************
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_USERS\S-1-5-21-3162161101-2018322775-2885428501-1003\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:56,cc,49,8b,21,68,72,20,a6,53,f7,d6,08,c6,6c,b6,92,25,87,f6,1e,fc,15,
a9,cc,e3,56,eb,ca,4f,c1,25,08,fd,04,92,e8,f3,ea,f8,ed,12,d0,f3,db,21,a6,3f,\
"??"=hex:5c,f1,83,89,34,2e,c3,29,75,49,0f,ac,fc,c3,b8,aa
.
[HKEY_USERS\S-1-5-21-3162161101-2018322775-2885428501-1003\Software\SecuROM\License information*]
"datasecu"=hex:8d,df,9d,e6,73,7e,46,cf,06,bc,1d,d0,bc,d7,4e,03,6b,e4,83,a5,59,
79,9f,22,cd,48,c6,5a,fe,96,7f,05,61,bd,f9,75,fa,9d,53,db,7a,b5,ce,3f,27,5e,\
"rkeysecu"=hex:29,23,be,84,e1,6c,d6,ae,52,90,49,f1,f1,bb,e9,eb
.
--------------------- Knihovny navázané na běžící procesy ---------------------
.
- - - - - - - > 'winlogon.exe'(964)
c:\windows\system32\Ati2evxx.dll
c:\windows\system32\LMIinit.dll
c:\windows\system32\LMIRfsClientNP.dll
.
- - - - - - - > 'explorer.exe'(3624)
c:\progra~1\WINDOW~2\wmpband.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
c:\windows\sttray.exe
c:\windows\system32\wbem\wmiapsrv.exe
.
**************************************************************************
.
Celkový čas: 2011-07-31 19:21:16 - počítač byl restartován
ComboFix-quarantined-files.txt 2011-07-31 17:21
ComboFix2.txt 2011-07-31 15:05
ComboFix3.txt 2011-07-31 13:29
ComboFix4.txt 2011-07-22 10:08
ComboFix5.txt 2011-07-31 17:03
.
Před spuštěním: Volných bajtů: 167 074 951 168
Po spuštění: Volných bajtů: 167 055 634 432
.
- - End Of File - - F8E6F96EB9D3964CA6FCE5CDE3EBF73C

Danstahr · #14 Příspěvek od **Danstahr** » 31 Črc 2011 18:29

Myslím, že už není třeba jej nazývat napadeným, vypadá to dobře

. Jak se PC chová?

Odinstalujte NODa, restartujte PC a poté jej znovu nainstalujte.

Dejte kontrolní log z RSIT.

Paolo312 · #15 Příspěvek od **Paolo312** » 31 Črc 2011 18:45

log z rsitu, počítač vypadá v pořádku (snad)

Logfile of random's system information tool 1.09 (written by random/random)
Run by admin at 2011-07-31 19:43:16
Systém Microsoft Windows XP Professional Service Pack 3
System drive C: has 159 GB (52%) free of 305 GB
Total RAM: 2030 MB (67% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 19:43:23, on 31.7.2011
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\sttray.exe
C:\WINDOWS\vsnpstd3.exe
C:\WINDOWS\tsnpstd3.exe
C:\Program Files\LogMeIn\x86\LogMeInSystray.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Spyware Terminator\SpywareTerminatorUpdate.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\msiexec.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\admin\Plocha\RSIT.exe
C:\Program Files\trend micro\admin.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://seznam.cz/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = \blank.htm
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
O2 - BHO: Podpora odkazu pro Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - (no file)
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [SigmatelSysTrayApp] sttray.exe
O4 - HKLM\..\Run: [ISTray] "C:\Program Files\Spyware Doctor\pctsTray.exe"
O4 - HKLM\..\Run: [snpstd3] C:\WINDOWS\vsnpstd3.exe
O4 - HKLM\..\Run: [tsnpstd3] C:\WINDOWS\tsnpstd3.exe
O4 - HKLM\..\Run: [LogMeIn GUI] "C:\Program Files\LogMeIn\x86\LogMeInSystray.exe"
O4 - HKLM\..\Run: [LogMeIn Hamachi Ui] "C:\Program Files\LogMeIn Hamachi\hamachi-2-ui.exe" --auto-start
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [SpywareTerminatorUpdate] "C:\Program Files\Spyware Terminator\SpywareTerminatorUpdate.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Stáhnout odkaz s použitím BitCometu - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: Stáhnout všechna videa s použitím BitCometu - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: Stáhnout všechny odkazy s použitím BitCometu - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O9 - Extra button: Odeslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Od&eslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: BitComet Search - {461CC20B-FB6E-4f16-8FE8-C29359DB100E} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe (file missing)
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe (file missing)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{8CBB9E27-955C-4240-90F8-DDD7EBCCC354}: NameServer = 194.228.2.1,194.228.41.113
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Proces mezipaměti kategorií součástí - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: CT Device Query service (CTDevice_Srv) - Unknown owner - C:\Program Files\Creative\Shared Files\CTDevSrv.exe
O23 - Service: ESET HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
O23 - Service: ESET Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
O23 - Service: LogMeIn Hamachi 2.0 Tunneling Engine (Hamachi2Svc) - Unknown owner - C:\Program Files\LogMeIn Hamachi\hamachi-2.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Unknown owner - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - Unknown owner - C:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - Unknown owner - C:\Program Files\Spyware Doctor\pctsSvc.exe
O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Unknown owner - C:\Program Files\Spyware Terminator\sp_rsser.exe (file missing)
O23 - Service: StarWind AE Service (StarWindServiceAE) - StarWind Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe

--
End of file - 8120 bytes

=========Mozilla firefox=========

ProfilePath - C:\Documents and Settings\admin\Data aplikací\Mozilla\Firefox\Profiles\f0zs9nkw.default

prefs.js - "browser.search.suggest.enabled" - false
prefs.js - "browser.search.useDBForOrder" - true
prefs.js - "browser.startup.homepage" - "http://www.seznam.cz/"
prefs.js - "extensions.enabledItems" - "{19503e42-ca3c-4c27-b1e2-9cdb2170ee34}:1.2.1.26, {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}:6.0.13, {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}:6.0.15, {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}:6.0.17, jqs@sun.com:1.0, {20a82645-c095-46ed-80e3-08825760534b}:1.2.1, {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20, engine@conduit.com:3.2.1.3, {414b6d9d-4a95-4e8d-b5b1-149dd2d93bb3}:3.2.1.3, {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23, {972ce4c6-7e08-4474-a285-3208198ce6fd}:3.6.17"

"{20a82645-c095-46ed-80e3-08825760534b}"=C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
"jqs@sun.com"=C:\Program Files\Java\jre6\lib\deploy\jqs\ff

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 10.1 Plugin
"Path"=C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@Apple.com/iTunes,version=]
"Description"=iTunes Detector Plug-in
"Path"=

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@Apple.com/iTunes,version=1.0]
"Description"=
"Path"=C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0]
"Description"=DivX Plus Web Player
"Path"=C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@divx.com/DivX Player Plugin,version=1.0.0]
"Description"=DivX® Player Plugin for VOD Content
"Path"=C:\Program Files\DivX\DivX Player\npDivxPlayerPlugin.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@java.com/JavaPlugin]
"Description"=Oracle® Next Generation Java™ Plug-In
"Path"=C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0]
"Description"=Ag Player Plugin
"Path"=c:\Program Files\Microsoft Silverlight\4.0.60531.0\npctrl.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/WPF,version=3.5]
"Description"=Windows Presentation Foundation plug-in for Mozilla browsers
"Path"=C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@pandonetworks.com/PandoWebPlugin]
"Description"=This plugin detects and launches Pando Media Booster
"Path"=C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@tools.google.com/Google Update;version=3]
"Description"=Google Update
"Path"=C:\Program Files\Google\Update\1.3.21.57\npGoogleUpdate3.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@tools.google.com/Google Update;version=9]
"Description"=Google Update
"Path"=C:\Program Files\Google\Update\1.3.21.57\npGoogleUpdate3.dll

C:\Program Files\Mozilla Firefox\extensions\
{972ce4c6-7e08-4474-a285-3208198ce6fd}
{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}
{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}
{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}
{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}

C:\Program Files\Mozilla Firefox\components\
binary.manifest
browsercomps.dll
nsIQTScriptablePlugin.xpt

C:\Program Files\Mozilla Firefox\plugins\
np32dsw.dll
npdeployJava1.dll
npDivxPlayerPlugin.dll
NPOFF12.DLL
nppdf32.dll
npqtplugin.dll
npqtplugin2.dll
npqtplugin3.dll
npqtplugin4.dll
npqtplugin5.dll
npqtplugin6.dll
npqtplugin7.dll
nsIDivxPlayerPlugin.xpt
QuickTimePlugin.class
ShockwavePlugin.class

C:\Program Files\Mozilla Firefox\searchplugins\
google.xml
heureka-cz.xml
jyxo-cz.xml
mall-cz.xml
seznam-cz.xml
slunecnice-cz.xml
wikipedia-cz.xml

C:\Documents and Settings\admin\Data aplikací\Mozilla\Firefox\Profiles\f0zs9nkw.default\extensions\
engine@conduit.com
{20a82645-c095-46ed-80e3-08825760534b}
{414b6d9d-4a95-4e8d-b5b1-149dd2d93bb3}

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
Podpora odkazu pro Adobe PDF Reader - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll [2006-10-22 62080]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{39F7E362-828A-4B5A-BCAF-5B79BFDFEA60}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}]
Groove GFS Browser Helper - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-12 2217848]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2010-11-24 41760]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2010-11-24 79648]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"SigmatelSysTrayApp"=C:\WINDOWS\sttray.exe [2007-05-06 405504]
"ISTray"=C:\Program Files\Spyware Doctor\pctsTray.exe [2008-12-08 1173384]
"snpstd3"=C:\WINDOWS\vsnpstd3.exe [2007-05-10 835584]
"tsnpstd3"=C:\WINDOWS\tsnpstd3.exe [2009-04-24 360448]
"LogMeIn GUI"=C:\Program Files\LogMeIn\x86\LogMeInSystray.exe [2008-08-11 63048]
"LogMeIn Hamachi Ui"=C:\Program Files\LogMeIn Hamachi\hamachi-2-ui.exe [2011-05-25 1951112]
"egui"=C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe [2011-01-12 2219184]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Skype"=C:\Program Files\Skype\Phone\Skype.exe [2011-06-15 15141768]
"SpywareTerminatorUpdate"=C:\Program Files\Spyware Terminator\SpywareTerminatorUpdate.exe [2011-07-22 3318784]
"ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AppleSyncNotifier]
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe [2009-08-13 177440]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\FixCamera]
C:\WINDOWS\FixCamera.exe [2007-07-11 20480]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
C:\Program Files\iTunes\iTunesHelper.exe [2011-04-14 421160]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogMeIn Hamachi Ui]
C:\Program Files\LogMeIn Hamachi\hamachi-2-ui.exe [2011-05-25 1951112]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PWRISOVM.EXE]
C:\Program Files\PowerISO\PWRISOVM.EXE [2009-11-09 180224]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]
c:\games\steam\steam.exe [2010-11-28 1242448]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent]
C:\WINDOWS\system32\Ati2evxx.dll [2009-09-30 155648]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\LMIinit]
C:\WINDOWS\system32\LMIinit.dll [2009-09-28 87352]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon]
C:\WINDOWS\system32\WgaLogon.dll [2009-03-10 265096]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-12 2217848]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdauxservice]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdcoreservice]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\aawservice]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Hamachi2Svc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\sdauxservice]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\sdcoreservice]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=323
"NoDriveAutoRun"=67108863
"NoDrives"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"HonorAutoRunSetting"=1
"NoDriveAutoRun"=67108863
"NoDriveTypeAutoRun"=323
"NoDrives"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE"="C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook"
"C:\Program Files\Microsoft Office\Office12\GROOVE.EXE"="C:\Program Files\Microsoft Office\Office12\GROOVE.EXE:*:Enabled:Microsoft Office Groove"
"C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE"="C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:*:Enabled:Microsoft Office OneNote"
"C:\Games\The Battle for Middle-earth (tm) II\game.dat"="C:\Games\The Battle for Middle-earth (tm) II\game.dat:*:Enabled:The Battle for Middle-earth(tm) II"
"C:\Games\Steam\SteamApps\paolo312\source sdk base\hl2.exe"="C:\Games\Steam\SteamApps\paolo312\source sdk base\hl2.exe:*:Enabled:hl2"
"C:\Games\Command & Conquer Generals Zero Hour\game.dat"="C:\Games\Command & Conquer Generals Zero Hour\game.dat:*:Enabled:game"
"C:\Program Files\Nero\Nero 7\Nero ShowTime\ShowTime.exe"="C:\Program Files\Nero\Nero 7\Nero ShowTime\ShowTime.exe:*:Enabled:Nero ShowTime"
"C:\Games\Command and Conquer Generals\game.dat"="C:\Games\Command and Conquer Generals\game.dat:*:Enabled:game"
"C:\WINDOWS\system32\dpnsvr.exe"="C:\WINDOWS\system32\dpnsvr.exe:*:Enabled:Microsoft DirectPlay8 Server"
"C:\Games\Steam\SteamApps\paolo312\half-life 2 deathmatch\hl2.exe"="C:\Games\Steam\SteamApps\paolo312\half-life 2 deathmatch\hl2.exe:*:Enabled:hl2"
"C:\Games\Grid\GRID.exe"="C:\Games\Grid\GRID.exe:*:Enabled:GRID Executable"
"C:\Program Files\GameSpy Arcade\Aphex.exe"="C:\Program Files\GameSpy Arcade\Aphex.exe:*:Enabled:GameSpy Arcade"
"C:\Program Files\Creative\Creative Centrale\CTUPnPFn.exe"="C:\Program Files\Creative\Creative Centrale\CTUPnPFn.exe:LocalSubNet:Enabled:Creative Centrale Media Server Component"
"C:\Games\Rockstar Games\Rockstar Games Social Club\RGSCLauncher.exe"="C:\Games\Rockstar Games\Rockstar Games Social Club\RGSCLauncher.exe:*:Enabled:Rockstar Games Social Club"
"C:\Games\Rockstar Games\Grand Theft Auto IV\LaunchGTAIV.exe"="C:\Games\Rockstar Games\Grand Theft Auto IV\LaunchGTAIV.exe:*:Enabled:Grand Theft Auto IV"
"C:\Games\Rockstar Games\Grand Theft Auto IV\GTAIV.exe"="C:\Games\Rockstar Games\Grand Theft Auto IV\GTAIV.exe:*:Enabled:Grand Theft Auto IV"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Games\Supreme Commander - Forged Alliance\bin\ForgedAlliance.exe"="C:\Games\Supreme Commander - Forged Alliance\bin\ForgedAlliance.exe:*:Enabled:Supreme Commander - Forged Alliance"
"C:\Games\GPGNet\GPG.Multiplayer.Client.exe"="C:\Games\GPGNet\GPG.Multiplayer.Client.exe:*:Enabled:GPGNet - Supreme Commander - Forged Alliance"
"C:\Games\Steam\steam.exe"="C:\Games\Steam\steam.exe:*:Enabled:Steam"
"C:\Games\Battlefield 2\BF2.exe"="C:\Games\Battlefield 2\BF2.exe:*:Enabled:Battlefield 2"
"%windir%\system32\drivers\svchost.exe"="%windir%\system32\drivers\svchost.exe:*:Enabled:svchost"
"C:\Program Files\ICQ6.5\ICQ.exe"="C:\Program Files\ICQ6.5\ICQ.exe:*:Enabled:ICQ6"
"C:\Games\Steam\SteamApps\common\left 4 dead 2 demo\left4dead2.exe"="C:\Games\Steam\SteamApps\common\left 4 dead 2 demo\left4dead2.exe:*:Enabled:left4dead2"
"C:\WINDOWS\system32\dplaysvr.exe"="C:\WINDOWS\system32\dplaysvr.exe:*:Enabled:Microsoft DirectPlay Helper"
"C:\Games\Supreme Commander 2\bin\SupremeCommander2.exe"="C:\Games\Supreme Commander 2\bin\SupremeCommander2.exe:*:Enabled:SupremeCommander2"
"C:\Program Files\Activision\Call of Duty 2\CoD2MP_s.exe"="C:\Program Files\Activision\Call of Duty 2\CoD2MP_s.exe:*:Enabled:CoD2MP_s"
"C:\WINDOWS\system32\dpvsetup.exe"="C:\WINDOWS\system32\dpvsetup.exe:*:Enabled:Microsoft DirectPlay Voice Test"
"C:\Games\World_of_Tanks_closed_Beta\WorldOfTanks.exe"="C:\Games\World_of_Tanks_closed_Beta\WorldOfTanks.exe:*:Enabled:World of Tanks"
"C:\Games\Steam\SteamApps\common\left 4 dead 2\left4dead2.exe"="C:\Games\Steam\SteamApps\common\left 4 dead 2\left4dead2.exe:*:Enabled:Left 4 Dead 2"
"C:\Games\The Lord of the Rings Online\lotroclient.exe"="C:\Games\The Lord of the Rings Online\lotroclient.exe:*:Enabled:lotroclient"
"C:\Games\The Lord of the Rings Online\TurbineInvoker.exe"="C:\Games\The Lord of the Rings Online\TurbineInvoker.exe:*:Enabled:The Lord of the Rings Online"
"C:\Program Files\Bonjour\mDNSResponder.exe"="C:\Program Files\Bonjour\mDNSResponder.exe:*:Enabled:Bonjour Service"
"C:\Program Files\iTunes\iTunes.exe"="C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes"
"C:\Program Files\Skype\Phone\Skype.exe"="C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype. Take a deep breath "

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\system32\drivers\svchost.exe"="%windir%\system32\drivers\svchost.exe:*:Enabled:svchost"
"C:\Program Files\Pando Networks\Media Booster\PMB.exe"="C:\Program Files\Pando Networks\Media Booster\PMB.exe:*:Enabled:Pando Media Booster"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"midimapper"=midimap.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msadpcm"=msadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.trspch"=tssoft32.acm
"vidc.cvid"=iccvid.dll
"vidc.iv31"=ir32_32.dll
"vidc.iv32"=ir32_32.dll
"vidc.iv41"=ir41_32.ax
"VIDC.IYUV"=iyuv_32.dll
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"VIDC.UYVY"=msyuv.dll
"VIDC.YUY2"=msyuv.dll
"VIDC.YVU9"=tsbyuv.dll
"VIDC.YVYU"=msyuv.dll
"wavemapper"=msacm32.drv
"msacm.msg723"=msg723.acm
"vidc.M263"=msh263.drv
"vidc.M261"=msh261.drv
"msacm.msaudio1"=msaud32.acm
"msacm.sl_anet"=sl_anet.acm
"msacm.iac2"=C:\WINDOWS\system32\iac25_32.ax
"vidc.iv50"=ir50_32.dll
"msacm.l3acm"=C:\WINDOWS\system32\l3codeca.acm
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"wave1"=wdmaud.drv
"midi1"=wdmaud.drv
"mixer1"=wdmaud.drv
"VIDC.XVID"=xvidvfw.dll
"VIDC.YV12"=DivX.dll
"msacm.ac3acm"=ac3acm.acm
"msacm.lameacm"=lameACM.acm
"VIDC.FFDS"=ff_vfw.dll
"vidc.VP60"=C:\WINDOWS\system32\vp6vfw.dll
"vidc.VP61"=C:\WINDOWS\system32\vp6vfw.dll
"vidc.VP62"=vp6vfw.dll
"MSVideo8"=VfWWDM32.dll
"vidc.DIVX"=DivX.dll

======File associations======

.ini - open - C:\WINDOWS\SYSTEM32\NOTEPAD.EXE %1
.txt - open - C:\WINDOWS\SYSTEM32\NOTEPAD.EXE %1

======List of files/folders created in the last 1 month======

2011-07-31 19:37:27 ----D---- C:\WINDOWS\LastGood
2011-07-31 19:37:01 ----D---- C:\Program Files\ESET
2011-07-31 19:37:01 ----D---- C:\Documents and Settings\All Users\Data aplikací\ESET
2011-07-31 19:21:19 ----D---- C:\WINDOWS\temp
2011-07-31 19:21:17 ----A---- C:\ComboFix.txt
2011-07-31 13:37:25 ----D---- C:\Documents and Settings\admin\Data aplikací\Malwarebytes
2011-07-31 13:37:20 ----A---- C:\WINDOWS\system32\drivers\mbamswissarmy.sys
2011-07-31 13:37:19 ----D---- C:\Documents and Settings\All Users\Data aplikací\Malwarebytes
2011-07-31 13:37:16 ----D---- C:\Program Files\Malwarebytes' Anti-Malware
2011-07-31 13:37:16 ----A---- C:\WINDOWS\system32\drivers\mbam.sys
2011-07-31 13:00:11 ----D---- C:\rsit
2011-07-31 13:00:11 ----D---- C:\Program Files\trend micro
2011-07-22 15:59:40 ----D---- C:\Program Files\DrWeb
2011-07-22 15:30:54 ----A---- C:\WINDOWS\SchedLgU.Txt
2011-07-22 14:08:48 ----D---- C:\Program Files\NoAdware5.0
2011-07-22 13:50:50 ----A---- C:\WINDOWS\ntbtlog.txt
2011-07-22 13:25:03 ----SHD---- C:\WINDOWS\CSC
2011-07-21 20:13:12 ----A---- C:\WINDOWS\system32\drivers\sp_rsdrv2.sys
2011-07-21 20:13:11 ----D---- C:\Documents and Settings\admin\Data aplikací\Spyware Terminator
2011-07-21 20:13:09 ----D---- C:\Documents and Settings\All Users\Data aplikací\Spyware Terminator
2011-07-21 20:13:08 ----D---- C:\Program Files\Spyware Terminator
2011-07-21 18:52:15 ----A---- C:\Boot.bak
2011-07-21 18:52:10 ----RASHD---- C:\cmdcons
2011-07-21 18:50:12 ----A---- C:\WINDOWS\zip.exe
2011-07-21 18:50:12 ----A---- C:\WINDOWS\SWXCACLS.exe
2011-07-21 18:50:12 ----A---- C:\WINDOWS\SWSC.exe
2011-07-21 18:50:12 ----A---- C:\WINDOWS\SWREG.exe
2011-07-21 18:50:12 ----A---- C:\WINDOWS\sed.exe
2011-07-21 18:50:12 ----A---- C:\WINDOWS\PEV.exe
2011-07-21 18:50:12 ----A---- C:\WINDOWS\NIRCMD.exe
2011-07-21 18:50:12 ----A---- C:\WINDOWS\MBR.exe
2011-07-21 18:50:12 ----A---- C:\WINDOWS\grep.exe
2011-07-21 18:49:44 ----D---- C:\WINDOWS\ERDNT
2011-07-21 18:49:38 ----D---- C:\Qoobox
2011-07-21 17:33:37 ----D---- C:\Documents and Settings\admin\Data aplikací\My The Lord of the Rings, The Rise of the Witch-king Files
2011-07-21 17:31:00 ----D---- C:\Program Files\Any Video Converter
2011-07-21 17:31:00 ----D---- C:\Program Files\AGEIA Technologies
2011-07-21 17:30:59 ----D---- C:\Program Files\AVI ReComp
2011-07-19 22:28:22 ----D---- C:\Config.Msi
2011-07-14 11:02:56 ----HDC---- C:\WINDOWS\$NtUninstallKB2507938$
2011-07-14 10:59:25 ----HDC---- C:\WINDOWS\$NtUninstallKB2555917$
2011-07-13 11:42:36 ----D---- C:\Documents and Settings\admin\Data aplikací\Vso
2011-07-13 11:42:36 ----A---- C:\WINDOWS\system32\drivers\pcouffin.sys
2011-07-13 11:42:36 ----A---- C:\Documents and Settings\admin\Data aplikací\inst.exe
2011-07-01 10:20:15 ----D---- C:\Program Files\Microsoft Silverlight

======List of files/folders modified in the last 1 month======

2011-07-31 19:43:23 ----D---- C:\WINDOWS\Prefetch
2011-07-31 19:40:14 ----D---- C:\Documents and Settings\admin\Data aplikací\Skype
2011-07-31 19:37:36 ----SHD---- C:\WINDOWS\Installer
2011-07-31 19:37:29 ----HD---- C:\WINDOWS\inf
2011-07-31 19:37:29 ----D---- C:\WINDOWS\system32\drivers
2011-07-31 19:37:27 ----D---- C:\WINDOWS
2011-07-31 19:37:25 ----D---- C:\WINDOWS\system32\CatRoot2
2011-07-31 19:37:01 ----RD---- C:\Program Files
2011-07-31 19:16:39 ----A---- C:\WINDOWS\system.ini
2011-07-31 19:16:23 ----D---- C:\WINDOWS\system32\drivers\etc
2011-07-31 19:12:24 ----SD---- C:\WINDOWS\Tasks
2011-07-31 19:10:31 ----D---- C:\WINDOWS\system32
2011-07-31 19:10:31 ----D---- C:\WINDOWS\AppPatch
2011-07-31 19:10:27 ----D---- C:\Program Files\Common Files
2011-07-31 16:57:05 ----D---- C:\WINDOWS\system32\config
2011-07-31 15:21:56 ----HDC---- C:\WINDOWS\$NtUninstallKB955759$
2011-07-31 15:05:59 ----D---- C:\Documents and Settings\admin\Data aplikací\Desktopicon
2011-07-23 01:04:55 ----D---- C:\Program Files\uTorrent
2011-07-22 19:48:57 ----D---- C:\Documents and Settings\admin\Data aplikací\Google
2011-07-22 14:33:04 ----D---- C:\Documents and Settings
2011-07-22 12:44:15 ----D---- C:\Program Files\Bonjour
2011-07-22 12:44:14 ----D---- C:\Program Files\Spyware Doctor
2011-07-22 12:44:14 ----D---- C:\Program Files\LogMeIn Hamachi
2011-07-22 12:35:24 ----A---- C:\WINDOWS\system32\ati2evxx.exe
2011-07-22 12:26:47 ----SHD---- C:\System Volume Information
2011-07-22 00:20:45 ----D---- C:\Program Files\LogMeIn
2011-07-21 19:47:38 ----AD---- C:\Documents and Settings\All Users\Data aplikací\TEMP
2011-07-21 19:39:04 ----A---- C:\boot.ini
2011-07-21 19:19:23 ----D---- C:\WINDOWS\system32\Restore
2011-07-21 17:34:17 ----D---- C:\WINDOWS\system32\wbem
2011-07-21 17:34:17 ----D---- C:\WINDOWS\Registration
2011-07-21 17:33:33 ----D---- C:\Games
2011-07-21 17:33:26 ----D---- C:\Documents and Settings\All Users\Data aplikací\Media Center Programs
2011-07-21 17:33:22 ----HD---- C:\Program Files\InstallShield Installation Information
2011-07-21 17:30:51 ----D---- C:\l
2011-07-21 00:40:25 ----D---- C:\Documents and Settings\All Users\Data aplikací\PMB Files
2011-07-19 22:02:41 ----D---- C:\WINDOWS\Debug
2011-07-18 22:32:12 ----D---- C:\Documents and Settings\admin\Data aplikací\uTorrent
2011-07-16 21:30:40 ----D---- C:\Documents and Settings\admin\Data aplikací\vlc
2011-07-16 21:28:43 ----A---- C:\WINDOWS\NeroDigital.ini
2011-07-14 11:02:58 ----RSHDC---- C:\WINDOWS\system32\dllcache
2011-07-14 11:00:24 ----A---- C:\WINDOWS\system32\MRT.exe
2011-07-14 11:00:19 ----D---- C:\Documents and Settings\All Users\Data aplikací\Microsoft Help
2011-07-13 19:39:47 ----HD---- C:\WINDOWS\$hf_mig$
2011-07-05 21:03:21 ----D---- C:\Program Files\Microsoft Office
2011-07-01 10:20:24 ----SD---- C:\Documents and Settings\All Users\Data aplikací\Microsoft

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 ohci1394;Hostitelský řadič IEEE 1394 dle standardu OHCI Texas Instruments; C:\WINDOWS\system32\DRIVERS\ohci1394.sys [2008-04-14 61696]
R0 PCTCore;PCTools KDS; C:\WINDOWS\system32\drivers\PCTCore.sys [2009-04-03 130936]
R0 PxHelp20;PxHelp20; C:\WINDOWS\System32\Drivers\PxHelp20.sys [2010-08-12 45648]
R0 sfdrv01;StarForce Protection Environment Driver (version 1.x); C:\WINDOWS\System32\drivers\sfdrv01.sys [2006-05-10 51200]
R0 sfhlp02;StarForce Protection Helper Driver (version 2.x); C:\WINDOWS\System32\drivers\sfhlp02.sys [2006-06-14 13680]
R0 sfvfs02;StarForce Protection VFS Driver (version 2.x); C:\WINDOWS\System32\drivers\sfvfs02.sys [2005-11-03 63488]
R0 sptd;sptd; C:\WINDOWS\System32\Drivers\sptd.sys [2010-05-26 691696]
R0 WudfPf;Windows Driver Foundation - User-mode Driver Framework Platform Driver; C:\WINDOWS\system32\DRIVERS\WudfPf.sys [2006-09-28 77568]
R1 ehdrv;ehdrv; C:\WINDOWS\system32\DRIVERS\ehdrv.sys [2010-12-21 115008]
R1 epfwtdir;epfwtdir; C:\WINDOWS\system32\DRIVERS\epfwtdir.sys [2010-12-21 94872]
R1 intelppm;Řadič procesoru Intel; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2008-04-14 40192]
R1 PCLEPCI;PCLEPCI; \??\C:\WINDOWS\system32\drivers\pclepci.sys []
R1 SCDEmu;SCDEmu; C:\WINDOWS\system32\drivers\SCDEmu.sys [2009-11-09 59388]
R1 sp_rsdrv2;Spyware Terminator Driver 2; \??\C:\WINDOWS\system32\drivers\sp_rsdrv2.sys []
R1 WS2IFSL;Podpůrné prostředí zprostředkovatele služeb Windows Socket 2.0 bez podpory IFS; C:\WINDOWS\System32\drivers\ws2ifsl.sys [2001-10-25 12032]
R2 atksgt;atksgt; C:\WINDOWS\system32\DRIVERS\atksgt.sys [2007-10-26 278728]
R2 eamon;eamon; C:\WINDOWS\system32\DRIVERS\eamon.sys [2010-12-21 141264]
R2 lirsgt;lirsgt; C:\WINDOWS\system32\DRIVERS\lirsgt.sys [2007-10-26 25416]
R2 LMIInfo;LogMeIn Kernel Information Provider; \??\C:\Program Files\LogMeIn\x86\RaInfo.sys []
R2 LMIRfsDriver;LogMeIn Remote File System Driver; \??\C:\WINDOWS\system32\drivers\LMIRfsDriver.sys []
R3 Arp1394;Protokol 1394 ARP Client; C:\WINDOWS\system32\DRIVERS\arp1394.sys [2008-04-14 60800]
R3 ati2mtag;ati2mtag; C:\WINDOWS\system32\DRIVERS\ati2mtag.sys [2009-09-30 3565056]
R3 e1express;Intel(R) PRO/1000 PCI Express Network Connection Driver; C:\WINDOWS\system32\DRIVERS\e1e5132.sys [2007-04-13 254872]
R3 GEARAspiWDM;GEAR ASPI Filter Driver; C:\WINDOWS\System32\Drivers\GEARAspiWDM.sys [2009-05-18 26600]
R3 hamachi;Hamachi Network Interface; C:\WINDOWS\system32\DRIVERS\hamachi.sys [2009-09-23 26176]
R3 HDAudBus;Ovladač Microsoft UAA pro sběrnici High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2008-04-13 144384]
R3 HECI;Intel(R) Management Engine Interface; C:\WINDOWS\system32\DRIVERS\HECI.sys [2006-10-23 44416]
R3 HidUsb;Ovladač třídy standardu HID; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-14 10368]
R3 lmimirr;lmimirr; C:\WINDOWS\system32\DRIVERS\lmimirr.sys [2008-08-11 10144]
R3 MarvinBus;Pinnacle Marvin Bus; C:\WINDOWS\system32\DRIVERS\MarvinBus.sys [2005-06-02 171008]
R3 mouhid;Ovladač myši standardu HID; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-10-24 12160]
R3 NIC1394;1394 Net Driver; C:\WINDOWS\system32\DRIVERS\nic1394.sys [2008-04-14 61824]
R3 sfng32;Sonic Focus Plugin for Sigmatel HDA; C:\WINDOWS\system32\drivers\sfng32.sys [2007-03-16 54272]
R3 STHDA;SigmaTel High Definition Audio CODEC; C:\WINDOWS\system32\drivers\sthda.sys [2007-05-06 1222840]
R3 USBSTOR;Ovladač velkokapacitního paměťového zařízení USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-14 26368]
R3 usbuhci;Ovladač Microsoft univerzálního hostitelského řadiče USB od společnosti Microsoft; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2008-04-14 20608]
S2 adfs;adfs; C:\WINDOWS\system32\drivers\adfs.sys []
S3 a3vsco5y;a3vsco5y; C:\WINDOWS\system32\drivers\a3vsco5y.sys []
S3 ahqw0j4b;ahqw0j4b; C:\WINDOWS\system32\drivers\ahqw0j4b.sys []
S3 ASAPIW2K;ASAPIW2K; \??\C:\WINDOWS\system32\Drivers\asapiW2k.sys []
S3 catchme;catchme; \??\C:\ComboFix\catchme.sys []
S3 CCDECODE;Dekodér Closed Caption; C:\WINDOWS\system32\DRIVERS\CCDECODE.sys [2004-07-09 16384]
S3 k750bus;Sony Ericsson 750 driver (WDM); C:\WINDOWS\system32\DRIVERS\k750bus.sys [2009-05-05 55216]
S3 k750mdfl;Sony Ericsson 750 USB WMC Modem Filter; C:\WINDOWS\system32\DRIVERS\k750mdfl.sys [2009-05-05 6576]
S3 k750mdm;Sony Ericsson 750 USB WMC Modem Drivers; C:\WINDOWS\system32\DRIVERS\k750mdm.sys [2009-05-05 89872]
S3 k750mgmt;Sony Ericsson 750 USB WMC Device Management Drivers; C:\WINDOWS\system32\DRIVERS\k750mgmt.sys [2009-05-05 81728]
S3 k750obex;Sony Ericsson 750 USB WMC OBEX Interface Drivers; C:\WINDOWS\system32\DRIVERS\k750obex.sys [2009-05-05 79488]
S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink Converter; C:\WINDOWS\system32\drivers\MSTEE.sys [2002-12-12 5504]
S3 NABTSFEC;NABTS/FEC VBI Codec; C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys [2004-07-09 83968]
S3 NdisIP;Microsoft TV/Video Connection; C:\WINDOWS\system32\DRIVERS\NdisIP.sys [2004-07-09 10112]
S3 Netaapl;Apple Mobile Device Ethernet Service; C:\WINDOWS\system32\DRIVERS\netaapl.sys [2009-06-05 17408]
S3 pcouffin;VSO Software pcouffin; C:\WINDOWS\System32\Drivers\pcouffin.sys [2011-07-13 47360]
S3 SLIP;BDA Slip De-Framer; C:\WINDOWS\system32\DRIVERS\SLIP.sys [2004-07-09 10880]
S3 SNPSTD3;USB PC Camera (SNPSTD3); C:\WINDOWS\system32\DRIVERS\snpstd3.sys [2009-06-22 10498688]
S3 streamip;BDA IPSink; C:\WINDOWS\system32\DRIVERS\StreamIP.sys [2004-07-09 14976]
S3 tap0801;TAP-Win32 Adapter V8; C:\WINDOWS\system32\DRIVERS\tap0801.sys [2006-10-01 26624]
S3 UnlockerDriver4;UnlockerDriver4 Driver; \??\C:\Program Files\Unlocker\UnlockerDriver4.sys []
S3 USBAAPL;Apple Mobile USB Driver; C:\WINDOWS\System32\Drivers\usbaapl.sys [2011-02-18 41984]
S3 usbccgp;Obecný nadřazený ovladač Microsoft USB; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-14 32128]
S3 usbscan;Ovladač skeneru USB; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2008-04-14 15104]
S3 vaxscsi;vaxscsi; C:\WINDOWS\System32\Drivers\vaxscsi.sys [2007-09-24 223128]
S3 w810bus;Sony Ericsson W810 Driver driver (WDM); C:\WINDOWS\system32\DRIVERS\w810bus.sys []
S3 w810mdfl;Sony Ericsson W810 USB WMC Modem Filter; C:\WINDOWS\system32\DRIVERS\w810mdfl.sys []
S3 w810mdm;Sony Ericsson W810 USB WMC Modem Driver; C:\WINDOWS\system32\DRIVERS\w810mdm.sys []
S3 w810mgmt;Sony Ericsson W810 USB WMC Device Management Drivers (WDM); C:\WINDOWS\system32\DRIVERS\w810mgmt.sys []
S3 w810obex;Sony Ericsson W810 USB WMC OBEX Interface; C:\WINDOWS\system32\DRIVERS\w810obex.sys []
S3 Wdf01000;Wdf01000; C:\WINDOWS\system32\DRIVERS\Wdf01000.sys [2006-11-02 492000]
S3 WpdUsb;WpdUsb; C:\WINDOWS\System32\Drivers\wpdusb.sys [2006-10-18 38528]
S3 WSTCODEC;World Standard Teletext Codec; C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS [2004-07-09 18688]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-28 82944]
S4 dwshd;dwshd; C:\WINDOWS\System32\drivers\dwshd.sys []
S4 LMIRfsClientNP;LMIRfsClientNP; C:\WINDOWS\system32\drivers\LMIRfsClientNP.sys []

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 Bonjour Service;Bonjour Service; C:\Program Files\Bonjour\mDNSResponder.exe [2011-07-22 344064]
R2 ekrn;ESET Service; C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe [2011-01-12 810144]
R2 StarWindServiceAE;StarWind AE Service; C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe [2011-07-22 370688]
R2 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
S2 Ati HotKey Poller;Ati HotKey Poller; C:\WINDOWS\system32\Ati2evxx.exe [2011-07-22 602112]
S2 ATI Smart;ATI Smart; C:\WINDOWS\system32\ati2sgag.exe [2009-09-29 593920]
S2 CTDevice_Srv;CT Device Query service; C:\Program Files\Creative\Shared Files\CTDevSrv.exe [2011-07-22 61440]
S2 Hamachi2Svc;LogMeIn Hamachi 2.0 Tunneling Engine; C:\Program Files\LogMeIn Hamachi\hamachi-2.exe [2011-07-22 1331200]
S2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2010-11-12 153376]
S2 sdAuxService;PC Tools Auxiliary Service; C:\Program Files\Spyware Doctor\pctsAuxs.exe [2011-07-22 339968]
S2 sdCoreService;PC Tools Security Service; C:\Program Files\Spyware Doctor\pctsSvc.exe [2009-01-21 1095560]
S2 sp_rssrv;Spyware Terminator Realtime Shield Service; C:\Program Files\Spyware Terminator\sp_rsser.exe []
S3 aawservice;Lavasoft Ad-Aware Service; C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe [2008-07-07 611664]
S3 aspnet_state;Stavová služba ASP.NET; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2008-07-25 34312]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632]
S3 EhttpSrv;ESET HTTP Server; C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe [2011-01-12 33584]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; C:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104]
S3 IDriverT;InstallDriver Table Manager; C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [2005-04-04 69632]
S3 idsvc;Služba Windows CardSpace; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664]
S3 iPod Service;iPod Service; C:\Program Files\iPod\bin\iPodService.exe [2011-07-22 815104]
S3 Microsoft Office Groove Audit Service;Microsoft Office Groove Audit Service; C:\Program Files\Microsoft Office\Office12\GrooveAuditService.exe [2008-10-25 65888]
S3 NBService;NBService; C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe [2006-11-10 774144]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2008-11-04 441712]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 WMPNetworkSvc;Služba Windows Media Player Network Sharing; C:\Program Files\Windows Media Player\WMPNetwk.exe [2007-01-05 913920]
S4 NetTcpPortSharing;Služba sdílení portů Net.Tcp; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2008-07-29 132096]

-----------------EOF-----------------

VIRY.CZ

Facebook vir

Facebook vir

Re: Facebook vir

Re: Facebook vir

Re: Facebook vir

Re: Facebook vir

Re: Facebook vir

Re: Facebook vir

Re: Facebook vir

Re: Facebook vir

Re: Facebook vir

Re: Facebook vir

Re: Facebook vir

Re: Facebook vir

Re: Facebook vir

Re: Facebook vir