Odvirování PC, zrychlení počítače, vzdálená pomoc prostřednictvím služby neslape.cz

Virus win coinminer

Patříte mezi Vzorné návštěvníky? Pak je tato sekce pro vás.

Moderátor: Moderátoři

Pravidla fóra
Jednotlivé thready budou po vyřešení uzamčeny. Stejně tak ty, které budou nečinné déle než 14 dní. Vizte Pravidlo o zamykání témat. Děkujeme za pochopení.
Zamčeno
Zpráva
Autor
Plazzer
Návštěvník
Návštěvník
Příspěvky: 136
Registrován: 08 říj 2008 16:53
Bydliště: Prievidza
Kontaktovat uživatele:
Kontaktovat uživatele Plazzer

Virus win coinminer

#1 Příspěvek od Plazzer »

dobry den, pise mi hlasku s virusom win coinminer.. a niekedy sa mi PC samovolne vypne.. kukal som trosku na log a nezda sa mi byt v poriadku, mohli by ste mi pomoct vyriesit tento problem? :). PC posiela spam do FB chatov s nejakym linkom.. (PS. PC neni moj, patri mojmu brachovi a preto aj stupen zabespecenia stoji za deravu ponozku)

Logfile of random's system information tool 1.09 (written by random/random)
Run by Thomas at 2011-10-28 15:32:17
Microsoft Windows 7 Ultimate
System drive C: has 2 GB (4%) free of 41 GB
Total RAM: 2043 MB (56% free)

HijackThis download failed

======Scheduled tasks folder======

C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
C:\Windows\tasks\GoogleUpdateTaskMachineUA.job

=========Mozilla firefox=========

ProfilePath - C:\Users\Thomas\AppData\Roaming\Mozilla\Firefox\Profiles\y8z096z3.default

prefs.js - "browser.startup.homepage" - "http://www.google.sk/"
prefs.js - "extensions.enabledItems" - "{CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA}:6.0.16, {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20, {872b5b88-9db5-4310-bdd0-ac189557e5f5}:2.7.0.14, {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21, {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23, webmaster@keep-tube.com:1.2, engine@conduit.com:3.3.3.2, {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}:3.3.3.2, {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24, {972ce4c6-7e08-4474-a285-3208198ce6fd}:3.6.23"

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 10.1 Plugin
"Path"=C:\Windows\system32\Macromed\Flash\NPSWF32.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@Google.com/GoogleEarthPlugin]
"Description"=Google Earth in your browser
"Path"=C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@java.com/JavaPlugin]
"Description"=Oracle® Next Generation Java™ Plug-In
"Path"=C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@tools.google.com/Google Update;version=3]
"Description"=Google Update
"Path"=C:\Program Files\Google\Update\1.3.21.79\npGoogleUpdate3.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@tools.google.com/Google Update;version=9]
"Description"=Google Update
"Path"=C:\Program Files\Google\Update\1.3.21.79\npGoogleUpdate3.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\Adobe Reader]
"Description"=Handles PDFs in-place in Firefox
"Path"=C:\Program Files\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll

C:\Program Files\Mozilla Firefox\extensions\
{972ce4c6-7e08-4474-a285-3208198ce6fd}
{CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA}
{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}
{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}
{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}

C:\Program Files\Mozilla Firefox\components\
browser.xpt
browserdirprovider.dll
brwsrcmp.dll
components.list
compreg.dat
FeedConverter.js
FeedProcessor.js
FeedWriter.js
fuelApplication.js
GPSDGeolocationProvider.js
jsconsole-clhandler.js
NetworkGeolocationProvider.js
nsAddonRepository.js
nsBadCertHandler.js
nsBlocklistService.js
nsBrowserContentHandler.js
nsBrowserGlue.js
nsContentDispatchChooser.js
nsContentPrefService.js
nsDefaultCLH.js
nsDownloadManagerUI.js
nsExtensionManager.js
nsFormAutoComplete.js
nsHandlerService.js
nsHelperAppDlg.js
nsINIProcessor.js
nsIQTScriptablePlugin.xpt
nsLivemarkService.js
nsLoginInfo.js
nsLoginManager.js
nsLoginManagerPrompter.js
nsMicrosummaryService.js
nsPlacesAutoComplete.js
nsPlacesDBFlush.js
nsPlacesTransactionsService.js
nsPrivateBrowsingService.js
nsProxyAutoConfig.js
nsSafebrowsingApplication.js
nsSearchService.js
nsSearchSuggestions.js
nsSessionStartup.js
nsSessionStore.js
nsSetDefaultBrowser.js
nsSidebar.js
nsTaggingService.js
nsTryToClose.js
nsUpdateService.js
nsUpdateServiceStub.js
nsUpdateTimerManager.js
nsUrlClassifierLib.js
nsUrlClassifierListManager.js
nsURLFormatter.js
nsWebHandlerApp.js
pluginGlue.js
storage-Legacy.js
storage-mozStorage.js
txEXSLTRegExFunctions.js
WebContentConverter.js
xpti.dat

C:\Program Files\Mozilla Firefox\plugins\
np-mswmp.dll
npdeployJava1.dll
npnul32.dll
nppdf32.dll
npqtplugin.dll
npqtplugin2.dll
npqtplugin3.dll
npqtplugin4.dll
npqtplugin5.dll
npqtplugin6.dll
npqtplugin7.dll
QuickTimePlugin.class
WMP Firefox Plugin License.rtf
WMP Firefox Plugin RelNotes.txt

C:\Program Files\Mozilla Firefox\searchplugins\
atlas-sk.xml
azet-sk.xml
dunaj-sk.xml
eBay.xml
google.xml
slovnik-sk.xml
wikipedia-sk.xml
zoznam-sk.xml

C:\Users\Thomas\AppData\Roaming\Mozilla\Firefox\Profiles\y8z096z3.default\extensions\
engine@conduit.com
webmaster@keep-tube.com
{872b5b88-9db5-4310-bdd0-ac189557e5f5}
{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}

C:\Users\Thomas\AppData\Roaming\Mozilla\Firefox\Profiles\y8z096z3.default\searchplugins\
conduit.xml
daemon-search.xml
icqplugin-1.xml
icqplugin-2.xml
icqplugin-3.xml
icqplugin.xml

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2010-09-22 75200]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{30F9B915-B755-4826-820B-08FBA6BD249D}]
Conduit Engine - C:\Program Files\ConduitEngine\ConduitEngine.dll [2010-12-09 3911776]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}]
uTorrentBar Toolbar - C:\Program Files\uTorrentBar\tbuTor.dll [2010-12-09 3911776]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2011-02-09 41760]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - uTorrentBar Toolbar - C:\Program Files\uTorrentBar\tbuTor.dll [2010-12-09 3911776]
{30F9B915-B755-4826-820B-08FBA6BD249D} - Conduit Engine - C:\Program Files\ConduitEngine\ConduitEngine.dll [2010-12-09 3911776]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"ArcSoft Connection Service"=C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe [2010-10-27 207424]
"StartCCC"=C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [2010-11-25 98304]
"ABBYY Screenshot Reader Retail"=C:\Program Files\ABBYY Screenshot Reader\ScreenShotReader.exe [2008-10-16 959776]
"Bonus.SSR.FR10"=C:\Program Files\ABBYY FineReader 10\Bonus.ScreenshotReader.exe [2010-10-15 941320]
"Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [2011-06-08 37296]
"Adobe ARM"=C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2011-03-30 937920]
"SunJavaUpdateSched"=C:\Program Files\Common Files\Java\Java Update\jusched.exe [2010-10-29 249064]
"LogMeIn Hamachi Ui"=E:\TOMAS SOBOTA\Programy\Hamachi\hamachi-2-ui.exe [2011-03-28 1910152]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"LaunchList"=C:\Program Files\Pinnacle\Studio 11\LaunchList2.exe [2007-03-21 145496]
"Sidebar"=C:\Program Files\Windows Sidebar\sidebar.exe [2009-07-14 1173504]
"ICQ"=C:\Program Files\ICQ7.2\ICQ.exe [2011-01-05 133432]
"ShowBatteryBar"=C:\Program Files\BatteryBar\ShowBatteryBar.exe [2009-05-28 90624]
"ABBYY Screenshot Reader Bonus"= []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2011-03-30 937920]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [2011-06-08 37296]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
C:\Program Files\DAEMON Tools Lite\DTLite.exe [2009-10-30 369200]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe [2008-06-24 1840424]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
C:\Program Files\iTunes\iTunesHelper.exe []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogMeIn Hamachi Ui]
E:\TOMAS SOBOTA\Programy\Hamachi\hamachi-2-ui.exe [2011-03-28 1910152]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NBKeyScan]
C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe [2008-06-08 2221352]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PDVD9LanguageShortcut]
C:\Program Files\CyberLink\PowerDVD9\Language\Language.exe []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
C:\Program Files\QuickTime\QTTask.exe -atboottime []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl9]
C:\Program Files\CyberLink\PowerDVD9\PDVD9Serv.exe [2009-02-16 87336]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\USBToolTip]
C:\PROGRA~1\Pinnacle\SHARED~1\Programs\USBTip\USBTip.exe [2007-02-20 199752]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\uTorrent]
C:\Program Files\uTorrent\uTorrent.exe [2011-05-10 399736]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]
C:\Program Files\Winamp\winampa.exe []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Microsoft Office.lnk]
C:\PROGRA~1\MICROS~2\Office10\OSA.EXE [2001-02-13 83360]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Users^Thomas^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^LimeWire On Startup.lnk]
C:\PROGRA~1\LimeWire\LimeWire.exe -startup []

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
PDFCreator.lnk - C:\Program Files\PDFCreator\PDFCreator.exe

C:\Users\Thomas\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
LaunchU3.exe.lnk - C:\Users\Thomas\AppData\Roaming\Microsoft\Installer\{D8E363A7-88B7-446D-B2C0-E26CE4DC8E54}\_294823.exe
MP3 Rocket (Minimized).lnk - C:\Program Files\MP3 Rocket\MP3Rocket.exe
stepx2.exe
WINLOGO.exe
WINLOGOS.exe
Xacti Screen Capture 1.1.lnk - C:\Users\Thomas\AppData\Roaming\Microsoft\Installer\{37327654-EBF7-410C-9161-C24D68E02753}\_E47B9B72500055712D025F.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED}

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Hamachi2Svc]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=0
"ConsentPromptBehaviorUser"=3
"EnableLUA"=0
"EnableUIADesktopToggle"=0
"PromptOnSecureDesktop"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.msadpcm"=msadp32.acm
"midimapper"=midimap.dll
"wavemapper"=msacm32.drv
"VIDC.UYVY"=msyuv.dll
"VIDC.YUY2"=msyuv.dll
"VIDC.YVYU"=msyuv.dll
"VIDC.IYUV"=iyuv_32.dll
"vidc.i420"=vdrcodec.dll
"VIDC.YVU9"=tsbyuv.dll
"msacm.l3acm"=C:\Windows\System32\l3codeca.acm
"vidc.cvid"=iccvid.dll
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv
"wave1"=wdmaud.drv
"midi1"=wdmaud.drv
"mixer1"=wdmaud.drv
"aux1"=wdmaud.drv
"MSVideo8"=VfWWDM32.dll
"VIDC.ACDV"=ACDV.dll
"msacm.vorbis"=vorbis.acm
"VIDC.MJPG"=pvmjpg30.dll
"vidc.mjpx"=Pvmjpg30.dll

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*
.reg - edit -
.reg - open - c:\Winnt\Regedit.exe %1
.scr - open - C:\Windows\system32\notepad.exe "%1"
.scr - install -
.scr - config -

======List of files/folders created in the last 1 month======

2011-10-28 15:31:35 ----A---- C:\Users\Thomas\AppData\Roaming\42AB.exe
2011-10-28 15:31:30 ----A---- C:\Users\Thomas\AppData\Roaming\3033.exe
2011-10-28 15:25:24 ----D---- C:\rsit
2011-10-28 15:25:24 ----D---- C:\Program Files\trend micro
2011-10-28 13:31:20 ----A---- C:\Users\Thomas\AppData\Roaming\557F.exe
2011-10-28 13:31:10 ----A---- C:\Users\Thomas\AppData\Roaming\318A.exe
2011-10-28 11:12:04 ----A---- C:\Users\Thomas\AppData\Roaming\2EAE.exe
2011-10-28 11:11:57 ----A---- C:\Users\Thomas\AppData\Roaming\141C.exe
2011-10-27 19:07:13 ----A---- C:\Users\Thomas\AppData\Roaming\402E.tmp
2011-10-27 18:58:06 ----A---- C:\Users\Thomas\AppData\Roaming\E300.exe
2011-10-27 18:26:54 ----A---- C:\Users\Thomas\AppData\Roaming\536D.exe
2011-10-27 18:26:46 ----A---- C:\Users\Thomas\AppData\Roaming\3513.exe
2011-10-27 12:26:45 ----A---- C:\Users\Thomas\AppData\Roaming\8594.exe
2011-10-27 12:26:40 ----A---- C:\Users\Thomas\AppData\Roaming\709D.exe
2011-10-26 21:55:24 ----A---- C:\Users\Thomas\AppData\Roaming\4DF1.exe
2011-10-26 21:55:19 ----A---- C:\Users\Thomas\AppData\Roaming\3B2B.exe
2011-10-26 16:47:32 ----A---- C:\Users\Thomas\AppData\Roaming\37E2.exe
2011-10-26 16:47:29 ----A---- C:\Users\Thomas\AppData\Roaming\2D08.exe
2011-10-26 13:49:22 ----A---- C:\Users\Thomas\AppData\Roaming\6692.exe
2011-10-26 13:49:07 ----A---- C:\Users\Thomas\AppData\Roaming\2A9A.exe
2011-10-25 21:28:19 ----A---- C:\Users\Thomas\AppData\Roaming\8121.exe
2011-10-25 21:28:13 ----A---- C:\Users\Thomas\AppData\Roaming\6B8E.exe
2011-10-25 17:27:18 ----A---- C:\Users\Thomas\AppData\Roaming\37A.exe
2011-10-25 17:27:10 ----A---- C:\Users\Thomas\AppData\Roaming\E4B3.exe
2011-10-25 16:36:08 ----A---- C:\Users\Thomas\AppData\Roaming\5E.exe
2011-10-25 16:36:04 ----A---- C:\Users\Thomas\AppData\Roaming\EDF6.exe
2011-10-25 15:31:54 ----A---- C:\Users\Thomas\AppData\Roaming\41D0.exe
2011-10-25 13:58:56 ----A---- C:\Users\Thomas\AppData\Roaming\12D5.exe
2011-10-25 13:58:51 ----A---- C:\Users\Thomas\AppData\Roaming\FED7.exe
2011-10-25 13:30:21 ----A---- C:\Users\Thomas\AppData\Roaming\4BCF.exe
2011-10-25 13:30:17 ----A---- C:\Users\Thomas\AppData\Roaming\39D4.exe
2011-10-24 21:02:49 ----A---- C:\Users\Thomas\AppData\Roaming\3929.exe
2011-10-24 21:02:41 ----A---- C:\Users\Thomas\AppData\Roaming\1AA1.exe
2011-10-24 15:59:28 ----A---- C:\Users\Thomas\AppData\Roaming\57FF.exe
2011-10-24 15:59:24 ----A---- C:\Users\Thomas\AppData\Roaming\4587.exe
2011-10-24 10:31:52 ----A---- C:\Users\Thomas\AppData\Roaming\366C.exe
2011-10-24 10:31:43 ----A---- C:\Users\Thomas\AppData\Roaming\116D.exe
2011-10-17 20:26:47 ----A---- C:\Users\Thomas\AppData\Roaming\A1DA.exe
2011-10-17 20:26:42 ----A---- C:\Users\Thomas\AppData\Roaming\8E4A.exe
2011-10-17 15:59:56 ----A---- C:\Users\Thomas\AppData\Roaming\3727.exe
2011-10-17 15:59:52 ----A---- C:\Users\Thomas\AppData\Roaming\2442.exe
2011-10-17 10:52:20 ----A---- C:\Users\Thomas\AppData\Roaming\AC46.exe
2011-10-17 10:52:15 ----A---- C:\Users\Thomas\AppData\Roaming\9980.exe
2011-10-16 15:38:18 ----A---- C:\Users\Thomas\AppData\Roaming\4C8A.exe
2011-10-16 15:38:13 ----A---- C:\Users\Thomas\AppData\Roaming\3783.exe
2011-10-16 10:34:24 ----A---- C:\Users\Thomas\AppData\Roaming\367B.exe
2011-10-16 10:34:20 ----A---- C:\Users\Thomas\AppData\Roaming\25E7.exe
2011-10-16 10:20:37 ----A---- C:\Users\Thomas\AppData\Roaming\61A.tmp
2011-10-16 10:20:34 ----A---- C:\Users\Thomas\AppData\Roaming\F7C7.exe
2011-10-16 10:20:24 ----A---- C:\Users\Thomas\AppData\Roaming\D039.exe
2011-10-13 00:10:23 ----A---- C:\Users\Thomas\AppData\Roaming\E752.exe
2011-10-13 00:10:19 ----A---- C:\Users\Thomas\AppData\Roaming\D4EA.exe
2011-10-12 21:27:12 ----A---- C:\Users\Thomas\AppData\Roaming\C072.exe
2011-10-12 21:27:08 ----A---- C:\Users\Thomas\AppData\Roaming\B06A.exe
2011-10-12 16:41:13 ----A---- C:\Users\Thomas\AppData\Roaming\79B2.exe
2011-10-12 16:41:09 ----A---- C:\Users\Thomas\AppData\Roaming\698B.exe
2011-10-12 16:07:45 ----A---- C:\Users\Thomas\AppData\Roaming\E2D0.exe
2011-10-12 16:07:40 ----A---- C:\Users\Thomas\AppData\Roaming\CC72.exe
2011-10-11 22:17:24 ----A---- C:\Users\Thomas\AppData\Roaming\8539.tmp
2011-10-11 22:17:18 ----A---- C:\Users\Thomas\AppData\Roaming\6D26.exe
2011-10-11 22:17:12 ----A---- C:\Users\Thomas\AppData\Roaming\56A9.exe
2011-10-07 21:53:21 ----A---- C:\Users\Thomas\AppData\Roaming\3B7.exe
2011-10-07 12:50:49 ----A---- C:\Users\Thomas\AppData\Roaming\250.exe
2011-10-07 10:56:54 ----A---- C:\Users\Thomas\AppData\Roaming\D96.exe
2011-10-06 23:12:14 ----A---- C:\Users\Thomas\AppData\Roaming\D7F6.exe
2011-10-06 18:54:34 ----A---- C:\Users\Thomas\AppData\Roaming\2664.exe
2011-10-06 18:08:23 ----A---- C:\Users\Thomas\AppData\Roaming\21A3.exe
2011-10-06 13:01:02 ----A---- C:\Users\Thomas\AppData\Roaming\B1B1.exe
2011-10-06 12:35:56 ----A---- C:\Users\Thomas\AppData\Roaming\E2EF.exe
2011-10-06 12:35:51 ----A---- C:\Users\Thomas\AppData\Roaming\CFAD.tmp
2011-10-05 22:02:45 ----A---- C:\Users\Thomas\AppData\Roaming\E81C.exe

======List of files/folders modified in the last 1 month======

2011-10-28 15:31:23 ----D---- C:\Windows\Temp
2011-10-28 15:25:24 ----RD---- C:\Program Files
2011-10-28 13:31:12 ----D---- C:\Windows\Prefetch
2011-10-28 11:17:09 ----SHD---- C:\System Volume Information
2011-10-28 11:15:22 ----D---- C:\Windows\system32\config
2011-10-26 18:07:48 ----D---- C:\Windows\System32
2011-10-26 18:07:48 ----D---- C:\Windows\inf
2011-10-26 18:07:48 ----A---- C:\Windows\system32\PerfStringBackup.INI
2011-10-25 17:24:42 ----D---- C:\Windows\system32\catroot2
2011-10-23 12:21:21 ----D---- C:\Users\Thomas\AppData\Roaming\vlc
2011-10-22 18:09:00 ----SHD---- C:\Windows\Installer
2011-10-20 22:32:22 ----SD---- C:\Users\Thomas\AppData\Roaming\Microsoft
2011-10-19 19:14:20 ----D---- C:\Program Files\VDownloader
2011-10-13 18:33:40 ----D---- C:\Windows\system32\NDF
2011-10-12 23:06:01 ----A---- C:\Windows\NeroDigital.ini
2011-10-08 13:47:57 ----D---- C:\Windows
2011-10-06 19:33:41 ----D---- C:\Program Files\ABBYY PDF Transformer 3.0
2011-10-06 19:33:41 ----D---- C:\Program Files\ABBYY FineReader 10
2011-09-30 12:52:40 ----D---- C:\Program Files\Mozilla Firefox

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2009-07-14 173648]
R0 sptd;sptd; C:\Windows\System32\Drivers\sptd.sys [2010-03-12 691696]
R1 CSC;@%systemroot%\system32\cscsvc.dll,-202; C:\Windows\system32\drivers\csc.sys [2009-07-14 387584]
R1 vwififlt;Virtual WiFi Filter Driver; C:\Windows\system32\DRIVERS\vwififlt.sys [2009-07-14 48128]
R2 atksgt;atksgt; C:\Windows\system32\DRIVERS\atksgt.sys [2010-05-18 281504]
R2 lirsgt;lirsgt; C:\Windows\system32\DRIVERS\lirsgt.sys [2010-05-18 25888]
R3 Afc;PPdus ASPI Shell; C:\Windows\system32\drivers\Afc.sys [2006-11-10 18688]
R3 AgereSoftModem;Agere Systems Soft Modem; C:\Windows\system32\DRIVERS\AGRSM.sys [2009-07-14 1035776]
R3 athr;Atheros Extensible Wireless LAN device driver; C:\Windows\system32\DRIVERS\athr.sys [2009-07-14 1096704]
R3 atikmdag;atikmdag; C:\Windows\system32\DRIVERS\atikmdag.sys [2009-08-18 4994560]
R3 hamachi;Hamachi Network Interface; C:\Windows\system32\DRIVERS\hamachi.sys [2009-09-23 26176]
R3 k57nd60x;Broadcom NetLink (TM) Gigabit Ethernet - NDIS 6.0; C:\Windows\system32\DRIVERS\k57nd60x.sys [2009-07-14 229888]
R3 MarvinBus;Pinnacle Marvin Bus; C:\Windows\system32\DRIVERS\MarvinBus.sys [2007-01-04 171520]
R3 pfc;Padus ASPI Shell; C:\Windows\system32\drivers\pfc.sys [2009-10-27 10368]
S2 Parvdm;Parvdm; C:\Windows\system32\DRIVERS\parvdm.sys [2009-07-14 8704]
S3 aic78xx;aic78xx; C:\Windows\system32\DRIVERS\djsvs.sys [2009-07-14 70720]
S3 amdagp;AMD AGP Bus Filter Driver; C:\Windows\system32\DRIVERS\amdagp.sys [2009-07-14 53312]
S3 an2jxv6m;an2jxv6m; C:\Windows\system32\drivers\an2jxv6m.sys []
S3 athrusb6;Atheros Wireless LAN USB device driver 6 Series; C:\Windows\system32\DRIVERS\athru6.sys [2007-07-05 873472]
S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0; C:\Windows\system32\DRIVERS\b57nd60x.sys [2009-07-14 229888]
S3 BthEnum;Bluetooth Enumerator Service; C:\Windows\system32\DRIVERS\BthEnum.sys [2009-07-14 34816]
S3 BthPan;Bluetooth Device (Personal Area Network); C:\Windows\system32\DRIVERS\bthpan.sys [2009-07-14 93696]
S3 BTHPORT;Bluetooth Port Driver; C:\Windows\System32\Drivers\BTHport.sys [2009-07-14 392704]
S3 BTHUSB;Bluetooth Radio USB Driver; C:\Windows\System32\Drivers\BTHUSB.sys [2009-07-14 58880]
S3 pciide;pciide; C:\Windows\system32\DRIVERS\pciide.sys [2009-07-14 12368]
S3 RDPDR;Terminal Server Device Redirector Driver; C:\Windows\System32\drivers\rdpdr.sys [2009-07-14 133120]
S3 RFCOMM;Bluetooth Device (RFCOMM Protocol TDI); C:\Windows\system32\DRIVERS\rfcomm.sys [2009-07-14 129536]
S3 s3cap;s3cap; C:\Windows\system32\DRIVERS\vms3cap.sys [2009-07-14 5632]
S3 sisagp;SIS AGP Bus Filter; C:\Windows\system32\DRIVERS\sisagp.sys [2009-07-14 52304]
S3 storvsc;storvsc; C:\Windows\system32\DRIVERS\storvsc.sys [2009-07-14 28224]
S3 viaagp;VIA AGP Bus Filter; C:\Windows\system32\DRIVERS\viaagp.sys [2009-07-14 53328]
S3 ViaC7;VIA C7 Processor Driver; C:\Windows\system32\DRIVERS\viac7.sys [2009-07-14 52736]
S3 vmbus;@%SystemRoot%\system32\vmbusres.dll,-1000; C:\Windows\system32\DRIVERS\vmbus.sys [2009-07-14 175824]
S3 VMBusHID;VMBusHID; C:\Windows\system32\DRIVERS\VMBusHID.sys [2009-07-14 17920]
S3 WinUsb;WinUsb; C:\Windows\system32\DRIVERS\WinUsb.sys [2009-07-14 34944]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 ABBYY.Licensing.FineReader.Professional.10.0;ABBYY FineReader 10 PE Licensing Service; C:\Program Files\Common Files\ABBYY\FineReader\10.00\Licensing\PE\NetworkLicenseServer.exe [2010-07-22 814344]
R2 ABBYY.Licensing.FineReader.ScreenshotReader.9.0;ABBYY.Licensing.FineReader.ScreenshotReader.9.0; C:\Program Files\ABBYY Screenshot Reader\NetworkLicenseServer.exe [2008-10-16 759072]
R2 ABBYY.Licensing.PDFTransformer.Classic.3.0;ABBYY PDF Transformer 3.0 – Licenčná služba; C:\Program Files\ABBYY PDF Transformer 3.0\NetworkLicenseServer.exe [2010-02-01 759048]
R2 ACDaemon;ArcSoft Connect Daemon; C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe [2010-03-18 113152]
R2 AMD External Events Utility;AMD External Events Utility; C:\Windows\system32\atiesrxx.exe [2009-08-18 176128]
R2 Apple Mobile Device;Apple Mobile Device; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [2010-06-10 144176]
R2 Autodesk Content Service;Autodesk Content Service; C:\Program Files\Autodesk\Content Service\Connect.Service.ContentService.exe [2011-02-02 18656]
R2 CscService;@%systemroot%\system32\cscsvc.dll,-200; C:\Windows\System32\svchost.exe [2009-07-14 20992]
R2 Nero BackItUp Scheduler 3;Nero BackItUp Scheduler 3; C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe [2008-06-08 877864]
R2 PLFlash DeviceIoControl Service;PLFlash DeviceIoControl Service; C:\Windows\system32\IoctlSvc.exe [2006-12-19 81920]
R2 SCPDFReadSpool;SolidConverterPDFReadSpool; C:\Windows\Installer\MSID4B4.tmp [2011-05-19 177784]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
S2 gupdate;Služba Google Update (gupdate); C:\Program Files\Google\Update\GoogleUpdate.exe [2010-08-20 136176]
S2 Hamachi2Svc;LogMeIn Hamachi 2.0 Tunneling Engine; E:\TOMAS SOBOTA\Programy\Hamachi\hamachi-2.exe -s []
S2 PCLEPCI;PCLEPCI; C:\Windows\system32\drivers\pclepci.sys [2005-02-09 14165]
S3 AppMgmt;@appmgmts.dll,-3250; C:\Windows\system32\svchost.exe [2009-07-14 20992]
S3 aspnet_state;ASP.NET State Service; C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe [2010-03-18 35160]
S3 FLEXnet Licensing Service;FLEXnet Licensing Service; C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe [2011-05-11 1044816]
S3 gupdatem;Služba Google Update (gupdatem); C:\Program Files\Google\Update\GoogleUpdate.exe [2010-08-20 136176]
S3 IDriverT;InstallDriver Table Manager; C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe [2005-11-14 69632]
S3 NMIndexingService;NMIndexingService; C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe [2008-06-24 537896]
S3 PeerDistSvc;@%SystemRoot%\system32\peerdistsvc.dll,-9000; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 UmRdpService;@%SystemRoot%\system32\umrdp.dll,-1000; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S4 NetMsmqActivator;@C:\Windows\Microsoft.NET\Framework\v4.0.30319\\ServiceModelInstallRC.dll,-8195; C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe [2010-03-18 124240]
S4 NetPipeActivator;@C:\Windows\Microsoft.NET\Framework\v4.0.30319\\ServiceModelInstallRC.dll,-8197; C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe [2010-03-18 124240]
S4 NetTcpActivator;@C:\Windows\Microsoft.NET\Framework\v4.0.30319\\ServiceModelInstallRC.dll,-8199; C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe [2010-03-18 124240]

-----------------EOF-----------------
Radsej budem nenavideny za to co som, ako milovany za to co niesom!

<script src="http://h2.flashvortex.com/display.php?i ... 84_10_2_13" type="text/javascript"></script>
Nahoru
Uživatelský avatar
vyosek
VIP
VIP
Příspěvky: 56373
Registrován: 07 lis 2006 15:24
Bydliště: Šalingrad - Brno

Re: Virus win coinminer

#2 Příspěvek od vyosek »

Zdravim a pekny podvecer preji :)

:arrow: To je dobre ze se ti neco nezda, vsak jsi byl u nas ve skole a snad i zaklady detekce jsi se naucil - tam je cela rodinka koniku trojskych :arcisit:

:arrow: Navody mam ve vykani, takze to budes muset nejak zkousnout :)

:arrow: Stahnete RogueKiller http://www.sur-la-toile.com/RogueKiller/RogueKiller.exe
  • Ukoncete vsechny programy
  • Pokud pouzivate Win Vista ci W7, kliknete na RogueKiller pravym a dejte Run As Administrator ci Spustit jako spravce
  • Zvolte moznost 2 a potvrte enterem
  • Utilita provede svou cinnost a da log - ten sem vlozte
  • Nyni znovu, ale zvolte moznost 3 a pote jeste 4 - logy opet vlozte
"Kdo víno má a nepije,kdo hrozny má a nejí je, kdo ženu má a nelíbá, kdo zábavě se vyhýbá, na toho vemte bič a hůl, to není člověk, to je vůl."
Člen Obrázek od 1. února 2011.
Nahoru
Plazzer
Návštěvník
Návštěvník
Příspěvky: 136
Registrován: 08 říj 2008 16:53
Bydliště: Prievidza
Kontaktovat uživatele:
Kontaktovat uživatele Plazzer

Re: Virus win coinminer

#3 Příspěvek od Plazzer »

log 1:

RogueKiller V6.1.4 [10/22/2011] by Tigzy
contact at http://www.sur-la-toile.com
mail: tigzyRK<at>gmail<dot>com
Feedback: http://www.sur-la-toile.com/discussion- ... ntees.html
Blog: http://tigzyrk.blogspot.com

Operating System: Windows 7 (6.1.7600 ) 32 bits version
Started in : Normal mode
User: Thomas [Admin rights]
Mode: Remove -- Date : 10/28/2011 19:46:42

Bad processes: 0

Registry Entries: 9
[SUSP PATH] LaunchU3.exe.lnk : C:\Users\Thomas\AppData\Roaming\Microsoft\Installer\{D8E363A7-88B7-446D-B2C0-E26CE4DC8E54}\_294823.exe -> DELETED
[SUSP PATH] Xacti Screen Capture 1.1.lnk : C:\Users\Thomas\AppData\Roaming\Microsoft\Installer\{37327654-EBF7-410C-9161-C24D68E02753}\_E47B9B72500055712D025F.exe -> DELETED
[SUSP PATH] stepx2.exe : C:\Users\Thomas\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\stepx2.exe -> DELETED
[SUSP PATH] WINLOGO.exe : C:\Users\Thomas\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WINLOGO.exe -> DELETED
[SUSP PATH] WINLOGOS.exe : C:\Users\Thomas\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WINLOGOS.exe -> DELETED
[HJ] HKLM\[...]\System : ConsentPromptBehaviorAdmin (0) -> REPLACED ()
[HJ] HKLM\[...]\System : EnableLUA (0) -> REPLACED ()
[HJ] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> REPLACED ()
[HJ] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> REPLACED ()

Particular Files / Folders:

Driver: [LOADED]

HOSTS File:
127.0.0.1 static3.cdn.ubi.com
127.0.0.1 ubisoft-orbit.s3.amazonaws.com
127.0.0.1 onlineconfigservice.ubi.com
127.0.0.1 orbitservice.ubi.com
127.0.0.1 ubisoft-orbit-savegames.s3.amazonaws.com


Finished : << RKreport[1].txt >>
RKreport[1].txt



log 2:

RogueKiller V6.1.4 [10/22/2011] by Tigzy
contact at http://www.sur-la-toile.com
mail: tigzyRK<at>gmail<dot>com
Feedback: http://www.sur-la-toile.com/discussion- ... ntees.html
Blog: http://tigzyrk.blogspot.com

Operating System: Windows 7 (6.1.7600 ) 32 bits version
Started in : Normal mode
User: Thomas [Admin rights]
Mode: HOSTSFix -- Date : 10/28/2011 19:49:48

Bad processes: 0

Driver: [LOADED]

HOSTS File:
127.0.0.1 static3.cdn.ubi.com
127.0.0.1 ubisoft-orbit.s3.amazonaws.com
127.0.0.1 onlineconfigservice.ubi.com
127.0.0.1 orbitservice.ubi.com
127.0.0.1 ubisoft-orbit-savegames.s3.amazonaws.com


Resetted HOSTS:
127.0.0.1 localhost

Finished : << RKreport[2].txt >>
RKreport[1].txt ; RKreport[2].txt


log 3:

RogueKiller V6.1.4 [10/22/2011] by Tigzy
contact at http://www.sur-la-toile.com
mail: tigzyRK<at>gmail<dot>com
Feedback: http://www.sur-la-toile.com/discussion- ... ntees.html
Blog: http://tigzyrk.blogspot.com

Operating System: Windows 7 (6.1.7600 ) 32 bits version
Started in : Normal mode
User: Thomas [Admin rights]
Mode: ProxyFix -- Date : 10/28/2011 19:50:00

Bad processes: 0

Driver: [LOADED]

Registry Entries: 0

Finished : << RKreport[3].txt >>
RKreport[1].txt ; RKreport[2].txt ; RKreport[3].txt
Naposledy upravil(a) vyosek dne 28 říj 2011 19:14, celkem upraveno 1 x.
Důvod: Log odstranen z code
Radsej budem nenavideny za to co som, ako milovany za to co niesom!

<script src="http://h2.flashvortex.com/display.php?i ... 84_10_2_13" type="text/javascript"></script>
Nahoru
Uživatelský avatar
vyosek
VIP
VIP
Příspěvky: 56373
Registrován: 07 lis 2006 15:24
Bydliště: Šalingrad - Brno

Re: Virus win coinminer

#4 Příspěvek od vyosek »

:arrow: NEdavej prosim logy do code, to se neda cist, natoz lustit - code slouzi jen radcum na opravne skripty - ty neni treba cist ani lustit

PROSIM CTETE DUKLADNE NAVOD - TATO UTILITA MA VELKOU SCHOPNOST MAZAT A JE NUTNE JI APLIKOVAT JEN NA DOPORUCENI, JINAK VAM MUZE JIT SYSTEM DO KYTEK
:arrow: Stahnete a ulozte na plochu Combofix http://download.bleepingcomputer.com/sUBs/ComboFix.exe
  • Vypnete vsechny rezidentni bezpecnostní programy - firewally, antiviry, antispywary apod.
  • Pokud mate Win XP spustte pod uctem Spravce\Administratora
  • Pokud mate Win Vista ci Win 7, kliknete na Combofix pravym a dejte Run As Administrator ci Spustit jako spravce
  • Ihned po startu se zobrazi stranka s licencnim ujednanim, pokracujte kliknutim na Ano
  • Pokud Vam CF nabidne instalaci Konzoly pro zotaveni, tak souhlaste
  • Dale postupujte dle pokynu, behem scanu nechte PC naprosto v klidu - nespoustejte zadne aplikace a neklikejte do zobrazujiciho se okna
  • Scan by mel trvat cca 10 min, ale pokud bude PC hodne zaneseno, muze se cas prodlouzit
  • Po dokonceni skenu a pripadnem restartu CF zobrazi log, pripadne jej najdete zde C:\ComboFix.txt, jeho obsah sem vlozte
  • Detailni postup vc. obrazku mate zde http://www.bleepingcomputer.com/combofi ... t-combofix
"Kdo víno má a nepije,kdo hrozny má a nejí je, kdo ženu má a nelíbá, kdo zábavě se vyhýbá, na toho vemte bič a hůl, to není člověk, to je vůl."
Člen Obrázek od 1. února 2011.
Nahoru
Plazzer
Návštěvník
Návštěvník
Příspěvky: 136
Registrován: 08 říj 2008 16:53
Bydliště: Prievidza
Kontaktovat uživatele:
Kontaktovat uživatele Plazzer

Re: Virus win coinminer

#5 Příspěvek od Plazzer »

ospravedlnujem sa, chcel som vam to len sprehladnit a asi sa tak nestalo :)

[ 5-12-2011 13:48:20:544]- LOG(FC4): PRODUCTInst--
[ 5-12-2011 13:48:20:544]- LOG(FC4): InitProperties - retrieve props from file 'C:\Users\Thomas\AppData\Local\Temp\7zS53F2\properties.ini'
[ 5-12-2011 13:48:20:544]- LOG(FC4): Installer version: 1.0.5.3
[ 5-12-2011 13:48:20:544]- LOG(FC4): --- Language IDs ---
[ 5-12-2011 13:48:20:544]- LOG(FC4): User Default UI Language = 1051, 0x41b
[ 5-12-2011 13:48:20:544]- LOG(FC4): System Default UI Language = 1033, 0x409
[ 5-12-2011 13:48:20:544]- LOG(FC4): User Default Language ID = 1051, 0x41b
[ 5-12-2011 13:48:20:544]- LOG(FC4): System Default Language ID = 1051, 0x41b
[ 5-12-2011 13:48:20:544]- LOG(FC4): Language ID To Be Used = 1051, 0x41b
[ 5-12-2011 13:48:20:544]- LOG(FC4): Is64BitWindows()
[ 5-12-2011 13:48:20:544]- LOG(FC4): getSystemWow64Directory() failed (gle=120)
[ 5-12-2011 13:48:20:544]- LOG(FC4): Is64BitWindows? NO
[ 5-12-2011 13:48:20:544]- LOG(FC4): OS is NOT 64 bit
[ 5-12-2011 13:48:20:544]- LOG(FC4): cmdline 'PRODUCTI'
[ 5-12-2011 13:48:20:544]- LOG(FC4): -\/\/\/- Properties -\/\/\/-
[ 5-12-2011 13:48:20:544]- LOG(FC4): PRINT_INFNAME = hpljp1005.INF
[ 5-12-2011 13:48:20:544]- LOG(FC4): PRINT_VERNAME = HP1005SU.VER
[ 5-12-2011 13:48:20:544]- LOG(FC4): PRINTER_SERIES_NAME = HP LaserJet P1000_P1500 Series
[ 5-12-2011 13:48:20:544]- LOG(FC4): PRODUCT_VIDPID = VID_03F0&PID_3D17, VID_03F0&PID_4817, VID_03F0&PID_4917, VID_03F0&PID_3E17, VID_03F0&PID_3F17, VID_03F0&PID_4017
[ 5-12-2011 13:48:20:544]- LOG(FC4): REG_INSTALLKEY = HP LaserJet P1000_P1500 Series
[ 5-12-2011 13:48:20:544]- LOG(FC4): ISRUNNING_MUTEX_NAME = HP1005Installexists
[ 5-12-2011 13:48:20:544]- LOG(FC4): INSTALL_DIRECTORY = HP LaserJet P1000_P1500 Series
[ 5-12-2011 13:48:20:544]- LOG(FC4): -/\/\/\- Properties -/\/\/\-
[ 5-12-2011 13:48:20:544]- LOG(FC4): PRODUCT Installer ---------------------------------------------------
[ 5-12-2011 13:48:20:544]- LOG(FC4): InstallSequencer()
[ 5-12-2011 13:48:20:544]- LOG(FC4): InstallSequencer() step = 0
[ 5-12-2011 13:48:20:544]- LOG(FC4): InstallSequencer() step = 1
[ 5-12-2011 13:48:20:544]- LOG(FC4): --- InitializeStep ---
[ 5-12-2011 13:48:20:559]- LOG(FC4): GetLandDir - Slovak
[ 5-12-2011 13:48:20:559]- LOG(FC4): print inf:C:\Users\Thomas\AppData\Local\Temp\7zS53F2\hpljp1005.INF
[ 5-12-2011 13:48:20:559]- LOG(FC4): printer verion file: C:\Users\Thomas\AppData\Local\Temp\7zS53F2\HP1005SU.VER
[ 5-12-2011 13:48:20:559]- LOG(FC4): printer series name: HP LaserJet P1000_P1500 Series
[ 5-12-2011 13:48:20:559]- LOG(FC4): GetPrinternamesFromINF()
[ 5-12-2011 13:48:20:575]- LOG(FC4): InstallSequencer() step = 3
[ 5-12-2011 13:48:20:575]- LOG(FC4): --- LicenseStep ---
[ 5-12-2011 13:48:20:575]- LOG(FC4): License file: 'C:\Users\Thomas\AppData\Local\Temp\7zS53F2\\license.txt'
[ 5-12-2011 13:48:20:606]- LOG(FC4): IDLCDialog::OnInitDialog() m_positionOnBottom=0, m_topmost=1, m_followPosition=0
[ 5-12-2011 13:48:20:622]- LOG(FC4): IDLCGenericTextDlg::OnInitDialog
[ 5-12-2011 13:48:20:622]- LOG(FC4): Strings(): stringsDllPath: C:\Users\Thomas\AppData\Local\Temp\7zS53F2\strings.dll
[ 5-12-2011 13:48:20:622]- LOG(FC4): IDLCGenericTextDlg::OnInitDialog -- load text from file 'C:\Users\Thomas\AppData\Local\Temp\7zS53F2\\license.txt'
[ 5-12-2011 13:48:20:622]- LOG(FC4): Text is plain
[ 5-12-2011 13:48:22:525]- LOG(FC4): -[ IDLCGenericTextDlg BUTTON 1 pressed ]-
[ 5-12-2011 13:48:22:540]- LOG(FC4): StartProgressDialog() g_progressDlgRunning = 0
[ 5-12-2011 13:48:22:540]- LOG(FC4): StartProgressDialog() Starting progress dialog thread ...
[ 5-12-2011 13:48:22:540]- LOG(FC4): Checking thread dialog handle 0
[ 5-12-2011 13:48:22:556]- LOG(C94): IDLCProgressDlg::OnInitDialog()
[ 5-12-2011 13:48:22:556]- LOG(C94): IDLCProgressDlg::DoDataExchange
[ 5-12-2011 13:48:22:556]- LOG(C94): IDLCDialog::OnInitDialog() m_positionOnBottom=0, m_topmost=1, m_followPosition=0
[ 5-12-2011 13:48:22:650]- LOG(FC4): Checking thread dialog handle 0x403a8
[ 5-12-2011 13:48:23:164]- LOG(FC4): InstallSequencer() step = 5
[ 5-12-2011 13:48:23:164]- LOG(FC4): --- MsiInstallStep ---
[ 5-12-2011 13:48:23:164]- LOG(FC4): Installing 1 Core MSIs --
[ 5-12-2011 13:48:23:164]- LOG(FC4): ==================== INSTALL MSI ========================
[ 5-12-2011 13:48:23:164]- LOG(FC4): CMsi::Install(C:\Users\Thomas\AppData\Local\Temp\7zS53F2\\, )
[ 5-12-2011 13:48:23:164]- LOG(FC4): CMsi::_Install(C:\Users\Thomas\AppData\Local\Temp\7zS53F2\\, REBOOT=ReallySuppress ADDCLID=1051 )
[ 5-12-2011 13:48:23:211]- LOG(FC4): ===>>> ERROR (gle=110, 0x6e): Msg: The system cannot open the device or file specified.

Context: CMsi::GetPropertyFromMsi MsiOpenDatabase
[ 5-12-2011 13:48:23:211]- LOG(FC4): CMsi::GetPropertyFromMsi failed. Setting to UNKNOWN
[ 5-12-2011 13:48:23:211]- LOG(FC4): ===>>> ERROR (gle=110, 0x6e): Msg: The system cannot open the device or file specified.

Context: CMsi::GetPropertyFromMsi MsiOpenDatabase
[ 5-12-2011 13:48:23:211]- LOG(FC4): CMsi::GetPropertyFromMsi failed. Setting to UNKNOWN
[ 5-12-2011 13:48:23:211]- LOG(FC4): ===>>> ERROR (gle=110, 0x6e): Msg: The system cannot open the device or file specified.

Context: CMsi::GetPropertyFromMsi MsiOpenDatabase
[ 5-12-2011 13:48:23:211]- LOG(FC4): CMsi::GetPropertyFromMsi failed. Setting to UNKNOWN
[ 5-12-2011 13:48:23:211]- LOG(FC4): Msi ProductCode = UNKNOWN
[ 5-12-2011 13:48:23:211]- LOG(FC4): Msi UpgradeCode = UNKNOWN
[ 5-12-2011 13:48:23:211]- LOG(FC4): Msi ProductVersion = UNKNOWN
[ 5-12-2011 13:48:23:586]- LOG(FC4): --- FAILED install C:\Users\Thomas\AppData\Local\Temp\7zS53F2\\
[ 5-12-2011 13:48:23:586]- LOG(FC4): ===>>> ERROR (gle=3, 0x3): Msg: The system cannot find the path specified.

Context: Failed Core msi Install
[ 5-12-2011 13:48:23:586]- LOG(FC4): InstallSequencer() step = 4
[ 5-12-2011 13:48:23:586]- LOG(FC4): --- PreInstallStep ---
[ 5-12-2011 13:48:23:586]- LOG(FC4): IsDriverInstalled(List)
[ 5-12-2011 13:48:23:586]- LOG(FC4): IsDriverInstalled(HP LaserJet P1005)
[ 5-12-2011 13:48:23:586]- LOG(FC4): FindInstalledDrivers()
[ 5-12-2011 13:48:23:586]- LOG(FC4): PrinterDriver? HP LaserJet P1005 ?= PDF-XChange 4.0 for ABBYY
[ 5-12-2011 13:48:23:586]- LOG(FC4): PrinterDriver? HP LaserJet P1005 ?= Microsoft XPS Document Writer
[ 5-12-2011 13:48:23:586]- LOG(FC4): PrinterDriver? HP LaserJet P1005 ?= Microsoft Shared Fax Driver
[ 5-12-2011 13:48:23:586]- LOG(FC4): IsDriverInstalled(HP LaserJet P1007)
[ 5-12-2011 13:48:23:586]- LOG(FC4): FindInstalledDrivers()
[ 5-12-2011 13:48:23:586]- LOG(FC4): PrinterDriver? HP LaserJet P1007 ?= PDF-XChange 4.0 for ABBYY
[ 5-12-2011 13:48:23:586]- LOG(FC4): PrinterDriver? HP LaserJet P1007 ?= Microsoft XPS Document Writer
[ 5-12-2011 13:48:23:586]- LOG(FC4): PrinterDriver? HP LaserJet P1007 ?= Microsoft Shared Fax Driver
[ 5-12-2011 13:48:23:586]- LOG(FC4): IsDriverInstalled(HP LaserJet P1006)
[ 5-12-2011 13:48:23:586]- LOG(FC4): FindInstalledDrivers()
[ 5-12-2011 13:48:23:586]- LOG(FC4): PrinterDriver? HP LaserJet P1006 ?= PDF-XChange 4.0 for ABBYY
[ 5-12-2011 13:48:23:586]- LOG(FC4): PrinterDriver? HP LaserJet P1006 ?= Microsoft XPS Document Writer
[ 5-12-2011 13:48:23:601]- LOG(FC4): PrinterDriver? HP LaserJet P1006 ?= Microsoft Shared Fax Driver
[ 5-12-2011 13:48:23:601]- LOG(FC4): IsDriverInstalled(HP LaserJet P1008)
[ 5-12-2011 13:48:23:601]- LOG(FC4): FindInstalledDrivers()
[ 5-12-2011 13:48:23:601]- LOG(FC4): PrinterDriver? HP LaserJet P1008 ?= PDF-XChange 4.0 for ABBYY
[ 5-12-2011 13:48:23:601]- LOG(FC4): PrinterDriver? HP LaserJet P1008 ?= Microsoft XPS Document Writer
[ 5-12-2011 13:48:23:601]- LOG(FC4): PrinterDriver? HP LaserJet P1008 ?= Microsoft Shared Fax Driver
[ 5-12-2011 13:48:23:601]- LOG(FC4): IsDriverInstalled(HP LaserJet P1505)
[ 5-12-2011 13:48:23:601]- LOG(FC4): FindInstalledDrivers()
[ 5-12-2011 13:48:23:601]- LOG(FC4): PrinterDriver? HP LaserJet P1505 ?= PDF-XChange 4.0 for ABBYY
[ 5-12-2011 13:48:23:601]- LOG(FC4): PrinterDriver? HP LaserJet P1505 ?= Microsoft XPS Document Writer
[ 5-12-2011 13:48:23:601]- LOG(FC4): PrinterDriver? HP LaserJet P1505 ?= Microsoft Shared Fax Driver
[ 5-12-2011 13:48:23:601]- LOG(FC4): IsDriverInstalled(HP LaserJet P1505n)
[ 5-12-2011 13:48:23:601]- LOG(FC4): FindInstalledDrivers()
[ 5-12-2011 13:48:23:601]- LOG(FC4): PrinterDriver? HP LaserJet P1505n ?= PDF-XChange 4.0 for ABBYY
[ 5-12-2011 13:48:23:601]- LOG(FC4): PrinterDriver? HP LaserJet P1505n ?= Microsoft XPS Document Writer
[ 5-12-2011 13:48:23:601]- LOG(FC4): PrinterDriver? HP LaserJet P1505n ?= Microsoft Shared Fax Driver
[ 5-12-2011 13:48:23:601]- LOG(FC4): _PostProgressMessage hWnd=0x403a8 msg=1125, param=17049
[ 5-12-2011 13:48:23:601]- LOG(FC4): InstallProgramFiles()
[ 5-12-2011 13:48:23:601]- LOG(C94): IDLCProgressDlg::OnCurrentProgressMsg()
[ 5-12-2011 13:48:23:601]- LOG(C94): msg=Kopírovanie súborov na pevný disk...
[ 5-12-2011 13:48:23:601]- LOG(FC4): programFilesDir:C:\Program Files\HP\HP LaserJet P1000_P1500 Series
[ 5-12-2011 13:48:23:601]- LOG(FC4): CopyEntireFolder(C:\Users\Thomas\AppData\Local\Temp\7zS53F2\,C:\Program Files\HP\HP LaserJet P1000_P1500 Series)
[ 5-12-2011 13:48:23:601]- LOG(FC4): CopyFilterFiles(*.*, C:\Users\Thomas\AppData\Local\Temp\7zS53F2\, C:\Program Files\HP\HP LaserJet P1000_P1500 Series)
[ 5-12-2011 13:48:23:601]- LOG(FC4): Copy file C:\Users\Thomas\AppData\Local\Temp\7zS53F2\\Autorun.inf to C:\Program Files\HP\HP LaserJet P1000_P1500 Series\Autorun.inf
[ 5-12-2011 13:48:23:617]- LOG(FC4): Copy file C:\Users\Thomas\AppData\Local\Temp\7zS53F2\\DIFxAPI.dll to C:\Program Files\HP\HP LaserJet P1000_P1500 Series\DIFxAPI.dll
[ 5-12-2011 13:48:23:632]- LOG(FC4): Copy file C:\Users\Thomas\AppData\Local\Temp\7zS53F2\\HP1005SU.VER to C:\Program Files\HP\HP LaserJet P1000_P1500 Series\HP1005SU.VER
[ 5-12-2011 13:48:23:632]- LOG(FC4): Copy file C:\Users\Thomas\AppData\Local\Temp\7zS53F2\\hp100632.cat to C:\Program Files\HP\HP LaserJet P1000_P1500 Series\hp100632.cat
[ 5-12-2011 13:48:23:632]- LOG(FC4): Copy file C:\Users\Thomas\AppData\Local\Temp\7zS53F2\\HP1006drv32.cab to C:\Program Files\HP\HP LaserJet P1000_P1500 Series\HP1006drv32.cab
[ 5-12-2011 13:48:23:632]- LOG(FC4): Copy file C:\Users\Thomas\AppData\Local\Temp\7zS53F2\\HP1006enww32.cab to C:\Program Files\HP\HP LaserJet P1000_P1500 Series\HP1006enww32.cab
[ 5-12-2011 13:48:23:648]- LOG(FC4): Copy file C:\Users\Thomas\AppData\Local\Temp\7zS53F2\\HP1006skww32.cab to C:\Program Files\HP\HP LaserJet P1000_P1500 Series\HP1006skww32.cab
[ 5-12-2011 13:48:23:648]- LOG(FC4): Copy file C:\Users\Thomas\AppData\Local\Temp\7zS53F2\\hpljp1005.inf to C:\Program Files\HP\HP LaserJet P1000_P1500 Series\hpljp1005.inf
[ 5-12-2011 13:48:23:648]- LOG(FC4): Copy file C:\Users\Thomas\AppData\Local\Temp\7zS53F2\\license.txt to C:\Program Files\HP\HP LaserJet P1000_P1500 Series\license.txt
[ 5-12-2011 13:48:23:648]- LOG(FC4): Copy file C:\Users\Thomas\AppData\Local\Temp\7zS53F2\\License7z.txt to C:\Program Files\HP\HP LaserJet P1000_P1500 Series\License7z.txt
[ 5-12-2011 13:48:23:648]- LOG(FC4): Copy file C:\Users\Thomas\AppData\Local\Temp\7zS53F2\\P1005.img to C:\Program Files\HP\HP LaserJet P1000_P1500 Series\P1005.img
[ 5-12-2011 13:48:23:648]- LOG(FC4): Copy file C:\Users\Thomas\AppData\Local\Temp\7zS53F2\\P1006.img to C:\Program Files\HP\HP LaserJet P1000_P1500 Series\P1006.img
[ 5-12-2011 13:48:23:648]- LOG(FC4): Copy file C:\Users\Thomas\AppData\Local\Temp\7zS53F2\\P1505.img to C:\Program Files\HP\HP LaserJet P1000_P1500 Series\P1505.img
[ 5-12-2011 13:48:23:664]- LOG(FC4): Copy file C:\Users\Thomas\AppData\Local\Temp\7zS53F2\\ProductInst.exe to C:\Program Files\HP\HP LaserJet P1000_P1500 Series\ProductInst.exe
[ 5-12-2011 13:48:23:679]- LOG(FC4): Copy file C:\Users\Thomas\AppData\Local\Temp\7zS53F2\\properties.ini to C:\Program Files\HP\HP LaserJet P1000_P1500 Series\properties.ini
[ 5-12-2011 13:48:23:679]- LOG(FC4): Copy file C:\Users\Thomas\AppData\Local\Temp\7zS53F2\\Setup.exe to C:\Program Files\HP\HP LaserJet P1000_P1500 Series\Setup.exe
[ 5-12-2011 13:48:23:679]- LOG(FC4): Copy file C:\Users\Thomas\AppData\Local\Temp\7zS53F2\\Strings.dll to C:\Program Files\HP\HP LaserJet P1000_P1500 Series\Strings.dll
[ 5-12-2011 13:48:23:679]- LOG(FC4): _PostProgressMessage hWnd=0x403a8 msg=1125, param=13074
[ 5-12-2011 13:48:23:679]- LOG(C94): IDLCProgressDlg::OnCurrentProgressMsg()
[ 5-12-2011 13:48:23:679]- LOG(FC4): Preinstalling inf C:\Users\Thomas\AppData\Local\Temp\7zS53F2\hpljp1005.INF
[ 5-12-2011 13:48:23:679]- LOG(C94): msg=Opätovná in?talácia súborov ovláda?a...
[ 5-12-2011 13:48:31:386]- LOG(FC4): InstallSequencer() step = 6
[ 5-12-2011 13:48:31:386]- LOG(FC4): --- InstallUsbStep --- PROP_PRINTER_NAME: HP LaserJet P1000_P1500 Series
[ 5-12-2011 13:48:31:386]- LOG(FC4): FindInstalledPrinters(driverList 6 elements)
[ 5-12-2011 13:48:31:386]- LOG(FC4): == Searching installed printers for our driver names...
[ 5-12-2011 13:48:31:386]- LOG(FC4): Driver name: HP LaserJet P1005
[ 5-12-2011 13:48:31:386]- LOG(FC4): Driver name: HP LaserJet P1007
[ 5-12-2011 13:48:31:386]- LOG(FC4): Driver name: HP LaserJet P1006
[ 5-12-2011 13:48:31:386]- LOG(FC4): Driver name: HP LaserJet P1008
[ 5-12-2011 13:48:31:386]- LOG(FC4): Driver name: HP LaserJet P1505
[ 5-12-2011 13:48:31:386]- LOG(FC4): Driver name: HP LaserJet P1505n
[ 5-12-2011 13:48:31:386]- LOG(FC4): -Installed Driver name: PDF-XChange 4.0 for ABBYY
[ 5-12-2011 13:48:31:386]- LOG(FC4): -Installed Driver name: Microsoft XPS Document Writer
[ 5-12-2011 13:48:31:386]- LOG(FC4): -Installed Driver name: Microsoft Shared Fax Driver
[ 5-12-2011 13:48:31:386]- LOG(FC4): Found NO printers with our drivername
[ 5-12-2011 13:48:31:386]- LOG(FC4): SetDriverPackageInfPath(C:\Users\Thomas\AppData\Local\Temp\7zS53F2\hpljp1005.INF)
[ 5-12-2011 13:48:31:386]- LOG(FC4): _PostProgressMessage hWnd=0x403a8 msg=1125, param=13071
[ 5-12-2011 13:48:31:386]- LOG(FC4): _PostProgressMessage hWnd=0x403a8 msg=1129, param=0
[ 5-12-2011 13:48:31:386]- LOG(FC4): _PostProgressMessage hWnd=0x403a8 msg=1133, param=0
[ 5-12-2011 13:48:31:386]- LOG(C94): IDLCProgressDlg::OnCurrentProgressMsg()
[ 5-12-2011 13:48:31:386]- LOG(C94): msg=?aká sa, kým pou?ívate? pripojí zariadenie.
[ 5-12-2011 13:48:31:386]- LOG(C94): IDLCProgressDlg::OnStopCurrentProgress()
[ 5-12-2011 13:48:31:386]- LOG(C94): IDLCProgressDlg::OnResetCurrentProgress()
[ 5-12-2011 13:48:31:401]- LOG(FC4): Inside CConnectDlg -- SetTime to Waiting for PnP...
[ 5-12-2011 13:48:32:103]- LOG(FC4): IsNewDeviceConnected(vidpidList with 6 elements)
[ 5-12-2011 13:48:32:103]- LOG(FC4): _GetUSBDevice(index=0, vidpid=VID_03F0&PID_3D17)
[ 5-12-2011 13:48:32:103]- LOG(FC4): _GetUSBDevice first time so GetClassDevs
[ 5-12-2011 13:48:32:103]- LOG(FC4): _GetUSBDevice(index=0, vidpid=VID_03F0&PID_4817)
[ 5-12-2011 13:48:32:103]- LOG(FC4): _GetUSBDevice first time so GetClassDevs
[ 5-12-2011 13:48:32:103]- LOG(FC4): _GetUSBDevice(index=0, vidpid=VID_03F0&PID_4917)
[ 5-12-2011 13:48:32:103]- LOG(FC4): _GetUSBDevice first time so GetClassDevs
[ 5-12-2011 13:48:32:103]- LOG(FC4): _GetUSBDevice(index=0, vidpid=VID_03F0&PID_3E17)
[ 5-12-2011 13:48:32:103]- LOG(FC4): _GetUSBDevice first time so GetClassDevs
[ 5-12-2011 13:48:32:103]- LOG(FC4): _GetUSBDevice(index=0, vidpid=VID_03F0&PID_3F17)
[ 5-12-2011 13:48:32:103]- LOG(FC4): _GetUSBDevice first time so GetClassDevs
[ 5-12-2011 13:48:32:103]- LOG(FC4): _GetUSBDevice(index=0, vidpid=VID_03F0&PID_4017)
[ 5-12-2011 13:48:32:103]- LOG(FC4): _GetUSBDevice first time so GetClassDevs
[ 5-12-2011 13:48:32:805]- LOG(FC4): IsNewDeviceConnected(vidpidList with 6 elements)
[ 5-12-2011 13:48:32:805]- LOG(FC4): _GetUSBDevice(index=0, vidpid=VID_03F0&PID_3D17)
[ 5-12-2011 13:48:32:805]- LOG(FC4): _GetUSBDevice first time so GetClassDevs
[ 5-12-2011 13:48:32:805]- LOG(FC4): _GetUSBDevice(index=0, vidpid=VID_03F0&PID_4817)
[ 5-12-2011 13:48:32:805]- LOG(FC4): _GetUSBDevice first time so GetClassDevs
[ 5-12-2011 13:48:32:805]- LOG(FC4): _GetUSBDevice(index=0, vidpid=VID_03F0&PID_4917)
[ 5-12-2011 13:48:32:805]- LOG(FC4): _GetUSBDevice first time so GetClassDevs
[ 5-12-2011 13:48:32:805]- LOG(FC4): _GetUSBDevice(index=0, vidpid=VID_03F0&PID_3E17)
[ 5-12-2011 13:48:32:805]- LOG(FC4): _GetUSBDevice first time so GetClassDevs
[ 5-12-2011 13:48:32:805]- LOG(FC4): _GetUSBDevice(index=0, vidpid=VID_03F0&PID_3F17)
[ 5-12-2011 13:48:32:805]- LOG(FC4): _GetUSBDevice first time so GetClassDevs
[ 5-12-2011 13:48:32:805]- LOG(FC4): _GetUSBDevice(index=0, vidpid=VID_03F0&PID_4017)
[ 5-12-2011 13:48:32:805]- LOG(FC4): _GetUSBDevice first time so GetClassDevs
[ 5-12-2011 13:48:33:507]- LOG(FC4): IsNewDeviceConnected(vidpidList with 6 elements)
[ 5-12-2011 13:48:33:507]- LOG(FC4): _GetUSBDevice(index=0, vidpid=VID_03F0&PID_3D17)
[ 5-12-2011 13:48:33:507]- LOG(FC4): _GetUSBDevice first time so GetClassDevs
[ 5-12-2011 13:48:33:507]- LOG(FC4): _GetUSBDevice(index=0, vidpid=VID_03F0&PID_4817)
[ 5-12-2011 13:48:33:507]- LOG(FC4): _GetUSBDevice first time so GetClassDevs
[ 5-12-2011 13:48:33:507]- LOG(FC4): _GetUSBDevice(index=0, vidpid=VID_03F0&PID_4917)
[ 5-12-2011 13:48:33:507]- LOG(FC4): _GetUSBDevice first time so GetClassDevs
[ 5-12-2011 13:48:33:507]- LOG(FC4): _GetUSBDevice(index=0, vidpid=VID_03F0&PID_3E17)
[ 5-12-2011 13:48:33:507]- LOG(FC4): _GetUSBDevice first time so GetClassDevs
[ 5-12-2011 13:48:33:507]- LOG(FC4): _GetUSBDevice(index=0, vidpid=VID_03F0&PID_3F17)
[ 5-12-2011 13:48:33:507]- LOG(FC4): _GetUSBDevice first time so GetClassDevs
[ 5-12-2011 13:48:33:507]- LOG(FC4): _GetUSBDevice(index=0, vidpid=VID_03F0&PID_4017)
[ 5-12-2011 13:48:33:507]- LOG(FC4): _GetUSBDevice first time so GetClassDevs
[ 5-12-2011 13:48:34:209]- LOG(FC4): IsNewDeviceConnected(vidpidList with 6 elements)
[ 5-12-2011 13:48:34:209]- LOG(FC4): _GetUSBDevice(index=0, vidpid=VID_03F0&PID_3D17)
[ 5-12-2011 13:48:34:209]- LOG(FC4): _GetUSBDevice first time so GetClassDevs
[ 5-12-2011 13:48:34:209]- LOG(FC4): _GetUSBDevice(index=0, vidpid=VID_03F0&PID_4817)
[ 5-12-2011 13:48:34:209]- LOG(FC4): _GetUSBDevice first time so GetClassDevs
[ 5-12-2011 13:48:34:209]- LOG(FC4): _GetUSBDevice(index=0, vidpid=VID_03F0&PID_4917)
[ 5-12-2011 13:48:34:209]- LOG(FC4): _GetUSBDevice first time so GetClassDevs
[ 5-12-2011 13:48:34:209]- LOG(FC4): _GetUSBDevice(index=0, vidpid=VID_03F0&PID_3E17)
[ 5-12-2011 13:48:34:209]- LOG(FC4): _GetUSBDevice first time so GetClassDevs
[ 5-12-2011 13:48:34:209]- LOG(FC4): _GetUSBDevice(index=0, vidpid=VID_03F0&PID_3F17)
[ 5-12-2011 13:48:34:209]- LOG(FC4): _GetUSBDevice first time so GetClassDevs
[ 5-12-2011 13:48:34:209]- LOG(FC4): _GetUSBDevice(index=0, vidpid=VID_03F0&PID_4017)
[ 5-12-2011 13:48:34:209]- LOG(FC4): _GetUSBDevice first time so GetClassDevs
[ 5-12-2011 13:48:34:911]- LOG(FC4): IsNewDeviceConnected(vidpidList with 6 elements)
[ 5-12-2011 13:48:34:911]- LOG(FC4): _GetUSBDevice(index=0, vidpid=VID_03F0&PID_3D17)
[ 5-12-2011 13:48:34:911]- LOG(FC4): _GetUSBDevice first time so GetClassDevs
[ 5-12-2011 13:48:34:911]- LOG(FC4): _GetUSBDevice(index=0, vidpid=VID_03F0&PID_4817)
[ 5-12-2011 13:48:34:911]- LOG(FC4): _GetUSBDevice first time so GetClassDevs
[ 5-12-2011 13:48:34:911]- LOG(FC4): _GetUSBDevice(index=0, vidpid=VID_03F0&PID_4917)
[ 5-12-2011 13:48:34:911]- LOG(FC4): _GetUSBDevice first time so GetClassDevs
[ 5-12-2011 13:48:34:911]- LOG(FC4): _GetUSBDevice(index=0, vidpid=VID_03F0&PID_3E17)
[ 5-12-2011 13:48:34:911]- LOG(FC4): _GetUSBDevice first time so GetClassDevs
[ 5-12-2011 13:48:34:911]- LOG(FC4): _GetUSBDevice(index=0, vidpid=VID_03F0&PID_3F17)
[ 5-12-2011 13:48:34:911]- LOG(FC4): _GetUSBDevice first time so GetClassDevs
[ 5-12-2011 13:48:34:911]- LOG(FC4): _GetUSBDevice(index=0, vidpid=VID_03F0&PID_4017)
[ 5-12-2011 13:48:34:911]- LOG(FC4): _GetUSBDevice first time so GetClassDevs
[ 5-12-2011 13:48:35:613]- LOG(FC4): IsNewDeviceConnected(vidpidList with 6 elements)
[ 5-12-2011 13:48:35:613]- LOG(FC4): _GetUSBDevice(index=0, vidpid=VID_03F0&PID_3D17)
[ 5-12-2011 13:48:35:613]- LOG(FC4): _GetUSBDevice first time so GetClassDevs
[ 5-12-2011 13:48:35:613]- LOG(FC4): _GetUSBDevice(index=0, vidpid=VID_03F0&PID_4817)
[ 5-12-2011 13:48:35:613]- LOG(FC4): _GetUSBDevice first time so GetClassDevs
[ 5-12-2011 13:48:35:613]- LOG(FC4): _GetUSBDevice(index=0, vidpid=VID_03F0&PID_4917)
[ 5-12-2011 13:48:35:613]- LOG(FC4): _GetUSBDevice first time so GetClassDevs
[ 5-12-2011 13:48:35:613]- LOG(FC4): _GetUSBDevice(index=0, vidpid=VID_03F0&PID_3E17)
[ 5-12-2011 13:48:35:613]- LOG(FC4): _GetUSBDevice first time so GetClassDevs
[ 5-12-2011 13:48:35:613]- LOG(FC4): _GetUSBDevice(index=0, vidpid=VID_03F0&PID_3F17)
[ 5-12-2011 13:48:35:613]- LOG(FC4): _GetUSBDevice first time so GetClassDevs
[ 5-12-2011 13:48:35:613]- LOG(FC4): _GetUSBDevice(index=0, vidpid=VID_03F0&PID_4017)
[ 5-12-2011 13:48:35:613]- LOG(FC4): _GetUSBDevice first time so GetClassDevs
[ 5-12-2011 13:48:36:308]- LOG(FC4): IsNewDeviceConnected(vidpidList with 6 elements)
[ 5-12-2011 13:48:36:308]- LOG(FC4): _GetUSBDevice(index=0, vidpid=VID_03F0&PID_3D17)
[ 5-12-2011 13:48:36:308]- LOG(FC4): _GetUSBDevice first time so GetClassDevs
[ 5-12-2011 13:48:36:308]- LOG(FC4): Device: USB\VID_03F0&PID_3D17\BC1BGDX
[ 5-12-2011 13:48:36:308]- LOG(FC4): IsDeviceInstalled(USB\VID_03F0&PID_3D17\BC1BGDX)
[ 5-12-2011 13:48:36:308]- LOG(FC4): USBdevInstID_to_USBPRINTdevInstID()
[ 5-12-2011 13:48:36:308]- LOG(FC4): GetStringFromHKLM SYSTEM\CurrentControlSet\Enum\USB\VID_03F0&PID_3D17\BC1BGDX ParentIdPrefix
[ 5-12-2011 13:48:36:308]- LOG(FC4): GetValueFromHKey SYSTEM\CurrentControlSet\Enum\USB\VID_03F0&PID_3D17\BC1BGDX ParentIdPrefix
[ 5-12-2011 13:48:36:308]- LOG(FC4): Found a device connected that is NOT installed: USB\VID_03F0&PID_3D17\BC1BGDX
[ 5-12-2011 13:48:36:308]- LOG(FC4): --!-- New devices connected. Starting animaton...
[ 5-12-2011 13:48:36:308]- LOG(FC4): _PostProgressMessage hWnd=0x403a8 msg=1130, param=0
[ 5-12-2011 13:48:36:308]- LOG(FC4): _PostProgressMessage hWnd=0x403a8 msg=1125, param=13072
[ 5-12-2011 13:48:36:308]- LOG(C94): IDLCProgressDlg::OnStartCurrentProgress(0)
[ 5-12-2011 13:48:36:318]- LOG(C94): IDLCProgressDlg -- setting current progress tic = 500
[ 5-12-2011 13:48:36:318]- LOG(C94): IDLCProgressDlg::OnCurrentProgressMsg()
[ 5-12-2011 13:48:36:318]- LOG(C94): msg=Zariadenie je pripojené. ?aká sa, kým sa dokon?í in?talácia ovláda?a metódou PnP...
[ 5-12-2011 13:48:37:008]- LOG(FC4): InstallingDriver inf before PnP C:\Users\Thomas\AppData\Local\Temp\7zS53F2\hpljp1005.INF
[ 5-12-2011 13:48:37:008]- LOG(FC4): DRIVER_PACKAGE_FORCE=0x4, DRIVER_PACKAGE_ONLY_IF_DEVICE_PRESENT=0x8, flags=0xc)
[ 5-12-2011 13:48:37:008]- LOG(FC4): InstallDriver(..., flags=0xc)
[ 5-12-2011 13:48:37:008]- LOG(FC4): inf:C:\Users\Thomas\AppData\Local\Temp\7zS53F2\hpljp1005.INF
[ 5-12-2011 13:48:43:123]- LOG(E94): PRODUCTInst--
[ 5-12-2011 13:48:43:123]- LOG(E94): InitProperties - retrieve props from file 'C:\USERS\THOMAS\APPDATA\LOCAL\TEMP\7ZS53F2\properties.ini'
[ 5-12-2011 13:48:43:123]- LOG(E94): Installer version: 1.0.5.3
[ 5-12-2011 13:48:43:123]- LOG(E94): --- Language IDs ---
[ 5-12-2011 13:48:43:123]- LOG(E94): User Default UI Language = 1051, 0x41b
[ 5-12-2011 13:48:43:123]- LOG(E94): System Default UI Language = 1033, 0x409
[ 5-12-2011 13:48:43:123]- LOG(E94): User Default Language ID = 1051, 0x41b
[ 5-12-2011 13:48:43:123]- LOG(E94): System Default Language ID = 1051, 0x41b
[ 5-12-2011 13:48:43:123]- LOG(E94): Language ID To Be Used = 1051, 0x41b
[ 5-12-2011 13:48:43:123]- LOG(E94): Is64BitWindows()
[ 5-12-2011 13:48:43:123]- LOG(E94): getSystemWow64Directory() failed (gle=120)
[ 5-12-2011 13:48:43:123]- LOG(E94): Is64BitWindows? NO
[ 5-12-2011 13:48:43:123]- LOG(E94): OS is NOT 64 bit
[ 5-12-2011 13:48:43:123]- LOG(E94): cmdline 'PRODUCTI'
[ 5-12-2011 13:48:43:123]- LOG(E94): -\/\/\/- Properties -\/\/\/-
[ 5-12-2011 13:48:43:123]- LOG(E94): PRINT_INFNAME = hpljp1005.INF
[ 5-12-2011 13:48:43:123]- LOG(E94): PRINT_VERNAME = HP1005SU.VER
[ 5-12-2011 13:48:43:123]- LOG(E94): PRINTER_SERIES_NAME = HP LaserJet P1000_P1500 Series
[ 5-12-2011 13:48:43:139]- LOG(E94): PRODUCT_VIDPID = VID_03F0&PID_3D17, VID_03F0&PID_4817, VID_03F0&PID_4917, VID_03F0&PID_3E17, VID_03F0&PID_3F17, VID_03F0&PID_4017
[ 5-12-2011 13:48:43:139]- LOG(E94): REG_INSTALLKEY = HP LaserJet P1000_P1500 Series
[ 5-12-2011 13:48:43:139]- LOG(E94): ISRUNNING_MUTEX_NAME = HP1005Installexists
[ 5-12-2011 13:48:43:139]- LOG(E94): INSTALL_DIRECTORY = HP LaserJet P1000_P1500 Series
[ 5-12-2011 13:48:43:139]- LOG(E94): -/\/\/\- Properties -/\/\/\-
[ 5-12-2011 13:48:43:139]- LOG(E94): PRODUCT Installer ---------------------------------------------------
[ 5-12-2011 13:48:43:139]- LOG(E94): InstallSequencer()
[ 5-12-2011 13:48:43:139]- LOG(E94): InstallSequencer() step = 0
[ 5-12-2011 13:48:43:139]- LOG(E94): InstallSequencer() step = 1
[ 5-12-2011 13:48:43:139]- LOG(E94): --- InitializeStep ---
[ 5-12-2011 13:48:43:139]- LOG(E94): GetLandDir - Slovak
[ 5-12-2011 13:48:43:139]- LOG(E94): print inf:C:\USERS\THOMAS\APPDATA\LOCAL\TEMP\7ZS53F2\hpljp1005.INF
[ 5-12-2011 13:48:43:139]- LOG(E94): printer verion file: C:\USERS\THOMAS\APPDATA\LOCAL\TEMP\7ZS53F2\HP1005SU.VER
[ 5-12-2011 13:48:43:139]- LOG(E94): printer series name: HP LaserJet P1000_P1500 Series
[ 5-12-2011 13:48:43:139]- LOG(E94): GetPrinternamesFromINF()
[ 5-12-2011 13:48:43:139]- LOG(E94): InstallSequencer() step = 3
[ 5-12-2011 13:48:43:139]- LOG(E94): --- LicenseStep ---
[ 5-12-2011 13:48:43:139]- LOG(E94): License file: 'C:\USERS\THOMAS\APPDATA\LOCAL\TEMP\7ZS53F2\\license.txt'
[ 5-12-2011 13:48:43:155]- LOG(E94): IDLCDialog::OnInitDialog() m_positionOnBottom=0, m_topmost=1, m_followPosition=0
[ 5-12-2011 13:48:43:155]- LOG(E94): IDLCGenericTextDlg::OnInitDialog
[ 5-12-2011 13:48:43:155]- LOG(E94): Strings(): stringsDllPath: C:\USERS\THOMAS\APPDATA\LOCAL\TEMP\7ZS53F2\strings.dll
[ 5-12-2011 13:48:43:155]- LOG(E94): IDLCGenericTextDlg::OnInitDialog -- load text from file 'C:\USERS\THOMAS\APPDATA\LOCAL\TEMP\7ZS53F2\\license.txt'
[ 5-12-2011 13:48:43:155]- LOG(E94): Text is plain
[ 5-12-2011 13:48:52:671]- LOG(FC4): DriverPackageInstall = 0, flags=0x1c
[ 5-12-2011 13:48:52:686]- LOG(FC4): InstallSequencer() step = 7
[ 5-12-2011 13:48:52:686]- LOG(FC4): TerminateProgressThrd(0x2ecd20)
[ 5-12-2011 13:48:52:686]- LOG(FC4): _PostProgressMessage hWnd=0x403a8 msg=1124, param=0
[ 5-12-2011 13:48:52:686]- LOG(C94): IDLCProgressDlg::OnTerminate()
[ 5-12-2011 13:48:53:201]- LOG(FC4): --- FinishStep ---
[ 5-12-2011 13:48:53:201]- LOG(FC4): IDLCDialog::OnInitDialog() m_positionOnBottom=0, m_topmost=1, m_followPosition=0
[ 5-12-2011 13:48:53:201]- LOG(FC4): IDLCGenericTextDlg::OnInitDialog
[ 5-12-2011 13:48:53:201]- LOG(FC4): Text is plain
[ 5-12-2011 13:48:57:631]- LOG(FC4): -[ IDLCGenericTextDlg BUTTON 0 pressed ]-
Radsej budem nenavideny za to co som, ako milovany za to co niesom!

<script src="http://h2.flashvortex.com/display.php?i ... 84_10_2_13" type="text/javascript"></script>
Nahoru
Uživatelský avatar
vyosek
VIP
VIP
Příspěvky: 56373
Registrován: 07 lis 2006 15:24
Bydliště: Šalingrad - Brno

Re: Virus win coinminer

#6 Příspěvek od vyosek »

Co to je sakris za log :shock: TO asi neni log z ComboFixu :?:
"Kdo víno má a nepije,kdo hrozny má a nejí je, kdo ženu má a nelíbá, kdo zábavě se vyhýbá, na toho vemte bič a hůl, to není člověk, to je vůl."
Člen Obrázek od 1. února 2011.
Nahoru
Plazzer
Návštěvník
Návštěvník
Příspěvky: 136
Registrován: 08 říj 2008 16:53
Bydliště: Prievidza
Kontaktovat uživatele:
Kontaktovat uživatele Plazzer

Re: Virus win coinminer

#7 Příspěvek od Plazzer »

Dobry den.. bracho dosiel z internatu a predal mi PC do ruk.. ten log som kukol a ozaj to bolo tak.. bol ulozeny na C:/ len ked som otvoril ten log, vyhodilo mi hentie hovadiny.. poziadal ma ze aby som mu preinstaloval win. lbo ze chce novy tak som to na jeho poziadanie urobil.. sice trosku radikalne riesenie ale tak ked si to prial tak som to urobil.. PC som zabespecil a vypada byt ok. .kazdopadne dakujem za cas ;). mozete lock :)
Radsej budem nenavideny za to co som, ako milovany za to co niesom!

<script src="http://h2.flashvortex.com/display.php?i ... 84_10_2_13" type="text/javascript"></script>
Nahoru
Plazzer
Návštěvník
Návštěvník
Příspěvky: 136
Registrován: 08 říj 2008 16:53
Bydliště: Prievidza
Kontaktovat uživatele:
Kontaktovat uživatele Plazzer

Re: Virus win coinminer

#8 Příspěvek od Plazzer »

Dobry den.. bracho dosiel z internatu a predal mi PC do ruk.. ten log som kukol a ozaj to bolo tak.. bol ulozeny na C:/ len ked som otvoril ten log, vyhodilo mi hentie hovadiny.. poziadal ma ze aby som mu preinstaloval win. lbo ze chce novy tak som to na jeho poziadanie urobil.. sice trosku radikalne riesenie ale tak ked si to prial tak som to urobil.. PC som zabespecil a vypada byt ok. .kazdopadne dakujem za cas ;). mozete lock :)
Radsej budem nenavideny za to co som, ako milovany za to co niesom!

<script src="http://h2.flashvortex.com/display.php?i ... 84_10_2_13" type="text/javascript"></script>
Nahoru
Uživatelský avatar
vyosek
VIP
VIP
Příspěvky: 56373
Registrován: 07 lis 2006 15:24
Bydliště: Šalingrad - Brno

Re: Virus win coinminer

#9 Příspěvek od vyosek »

Neni zac, zamykam...
"Kdo víno má a nepije,kdo hrozny má a nejí je, kdo ženu má a nelíbá, kdo zábavě se vyhýbá, na toho vemte bič a hůl, to není člověk, to je vůl."
Člen Obrázek od 1. února 2011.
Nahoru
Zamčeno

Zpět na „Sekce pouze pro Vzorné návštěvníky“