Odvirování PC, zrychlení počítače, vzdálená pomoc prostřednictvím služby neslape.cz

hack

Máte problém s virem? Vložte sem log z FRST nebo RSIT.

Moderátor: Moderátoři

Pravidla fóra
Pokud chcete pomoc, vložte log z FRST [návod zde] nebo RSIT [návod zde]

Jednotlivé thready budou po vyřešení uzamčeny. Stejně tak ty, které budou nečinné déle než 14 dní. Vizte Pravidlo o zamykání témat. Děkujeme za pochopení.

!NOVINKA!
Nově lze využívat služby vzdálené pomoci, kdy se k vašemu počítači připojí odborník a bližší informace o problému si od vás získá telefonicky! Více na www.neslape.cz
Odpovědět
Zpráva
Autor
Lukas666
Návštěvník
Návštěvník
Příspěvky: 89
Registrován: 02 lis 2009 17:19

hack

#1 Příspěvek od Lukas666 »

zdravim, chcel by som Vas poprosit o kontrolu logu


Logfile of random's system information tool 1.09 (written by random/random)
Run by Kowe at 2012-02-22 17:58:19
Microsoft Windows 7 Professional Service Pack 1
System drive C: has 2 GB (10%) free of 20 GB
Total RAM: 2039 MB (49% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 5:58:32 PM, on 2/22/2012
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v8.00 (8.00.7601.17514)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskhost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\SoccerInferno\bar\1.bin\j2brmon.exe
C:\Program Files\ESET\ESET Smart Security\egui.exe
C:\Program Files\Windows Sidebar\sidebar.exe
D:\Advanced SystemCare 5\ASCTray.exe
C:\Program Files\DAEMON Tools Lite\DTLite.exe
C:\PROGRAM FILES\SPYBOT - SEARCH & DESTROY\TEATIMER.EXE
C:\PROGRAM FILES\YUNA SOFTWARE\MESSENGER PLUS!\PLUSSERVICE.EXE
C:\PROGRAM FILES\CYBERLINK\POWERDVD\PDVDSERV.EXE
C:\WINDOWS\SYSTEM32\IGFXPERS.EXE
C:\WINDOWS\SYSTEM32\HKCMD.EXE
C:\Windows\system32\igfxsrvc.exe
C:\Windows\CmUCReye.exe
C:\PROGRAM FILES\SYNAPTICS\SYNTP\SYNTPENH.EXE
C:\PROGRAM FILES\HEWLETT-PACKARD\HP QUICK LAUNCH BUTTONS\QLBCTRL.EXE
C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
C:\PROGRAM FILES\DIVX\DIVX UPDATE\DIVXUPDATE.EXE
C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\VolCtrl.exe
C:\Program Files\Real\RealPlayer\update\realsched.exe
D:\Advanced SystemCare 5\Asc.exe
D:\Googlechrome Downloads\RSIT.exe
C:\Program Files\trend micro\Kowe.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://search.babylon.com/?babsrc=HP_ss ... 247e99acb9
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: (no name) - {9b339f6e-ddcd-401b-8764-230adbd01761} - (no file)
R3 - URLSearchHook: (no name) - {d47a8d7d-f7b2-48a9-b8d6-b44484d51b89} - (no file)
R3 - URLSearchHook: (no name) - {a24f3f59-1021-4e02-856c-99d9b4a03d83} - C:\Program Files\SoccerInferno\bar\1.bin\j2SrcAs.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Toolbar BHO - {285028f8-201e-4f8f-827b-7381fc181c3e} - C:\PROGRA~1\SOCCER~2\bar\1.bin\j2bar.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll
O2 - BHO: Increase performance and video formats for your HTML5 <video> - {326E768D-4182-46FD-9C16-1449A49795F4} - (no file)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: (no name) - {9b339f6e-ddcd-401b-8764-230adbd01761} - (no file)
O2 - BHO: IEWebHook - {AD4DF010-E2FD-43CE-864A-6BD1EDC59AC2} - C:\Users\Kowe\AppData\Roaming\Media Finder\Extensions\IEPlugin32.dll
O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O2 - BHO: Help the General-Search Project - {CA4520F3-AE13-4FB1-A513-58E23991C86D} - C:\Users\Kowe\AppData\Roaming\MEDIAF~1\EXTENS~1\GENCRA~1.DLL
O2 - BHO: (no name) - {d47a8d7d-f7b2-48a9-b8d6-b44484d51b89} - (no file)
O3 - Toolbar: (no name) - {9b339f6e-ddcd-401b-8764-230adbd01761} - (no file)
O3 - Toolbar: (no name) - {d47a8d7d-f7b2-48a9-b8d6-b44484d51b89} - (no file)
O3 - Toolbar: SoccerInferno - {c5a318c1-d1d9-41f0-85fe-41cc9fb25e75} - C:\Program Files\SoccerInferno\bar\1.bin\j2bar.dll
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime Alternative\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [SoccerInferno Browser Plugin Loader] C:\PROGRA~1\SOCCER~2\bar\1.bin\j2brmon.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Real\RealPlayer\update\realsched.exe" -osboot
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET Smart Security\egui.exe" /hide /waitservice
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [Advanced SystemCare 5] "D:\Advanced SystemCare 5\ASCTray.exe" /AutoStart
O4 - HKCU\..\Run: [uTorrent] "C:\Program Files\uTorrent\uTorrent.exe" /MINIMIZED
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\DTLite.exe" -autorun
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background (User 'Default user')
O8 - Extra context menu item: Download with &Media Finder - C:\Program Files\Media Finder\hook.html
O9 - Extra button: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra 'Tools' menuitem: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra button: Zdroje informácií - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files\Microsoft Office\OFFICE11\REFIEBAR.DLL (file missing)
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: Advanced SystemCare Service 5 (AdvancedSystemCareService5) - IObit - D:\Advanced SystemCare 5\ASCService.exe
O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - LSI Corporation - C:\Program Files\LSI SoftModem\agrsmsvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Com4QLBEx - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe
O23 - Service: Device Error Recovery Service (dgdersvc) - Devguru Co., Ltd. - C:\Windows\system32\dgdersvc.exe
O23 - Service: ESET Service (ekrn) - ESET - C:\Program Files\ESET\ESET Smart Security\ekrn.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: FsUsbExService - Teruten - C:\Windows\system32\FsUsbExService.Exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared files\RichVideo.exe
O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: SoccerInferno Service (SoccerInfernoService) - SoccerInferno - C:\PROGRA~1\SOCCER~2\bar\1.bin\j2barsvc.exe
O23 - Service: TeamViewer 3 (TeamViewer) - TeamViewer GmbH - C:\Program Files\TeamViewer3\TeamViewer_Service.exe
O23 - Service: TeamViewer 6 (TeamViewer6) - TeamViewer GmbH - C:\Program Files\TeamViewer\Version6\TeamViewer_Service.exe
O23 - Service: webcamXP Service (wxpSvc) - Unknown owner - D:\webcam2\wLite\wService.exe (file missing)

--
End of file - 8972 bytes

======Scheduled tasks folder======

C:\Windows\tasks\Adobe Flash Player Updater.job
C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-1477834340-2647751965-1430524873-1000Core.job
C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-1477834340-2647751965-1430524873-1000UA.job
C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
C:\Windows\tasks\GoogleUpdateTaskMachineUA.job

=========Mozilla firefox=========

ProfilePath - C:\Users\Kowe\AppData\Roaming\Mozilla\Firefox\Profiles\q8ida096.default

prefs.js - "browser.startup.homepage" - "http://www.google.hu/"
prefs.js - "extensions.enabledItems" - "engine@conduit.com:3.3.3.2, DTToolbar@toolbarnet.com:1.1.4.0024, plugin2@gameplaylabs.com:2.0, j2ffxtbr@SoccerInferno.com:1.1, {7b13ec3e-999a-4b70-b9cb-2617b8323822}:2.7.1.3, {972ce4c6-7e08-4474-a285-3208198ce6fd}:3.5.19"
prefs.js - "keyword.URL" - "chrome://browser-region/locale/region.properties"

"j2ffxtbr@SoccerInferno.com"=C:\Program Files\SoccerInferno\bar\1.bin
"{ABDE892B-13A8-4d1b-88E6-365A6E755758}"=C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext
"{23fcfd51-4958-4f00-80a3-ae97e717ed8b}"=D:\DivX\DivX Plus Web Player\firefox\DivXHTML5


[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 11.2.202.183 Plugin
"Path"=C:\Windows\system32\Macromed\Flash\NPSWF32_11_2_202_183.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@adobe.com/ShockwavePlayer]
"Description"=Adobe Shockwave Player
"Path"=C:\Windows\system32\Adobe\Director\np32dsw.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0]
"Description"=DivX Plus Web Player
"Path"=D:\DivX\DivX Plus Web Player\npdivx32.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@divx.com/DivX Player Plugin,version=1.0.0]
"Description"=DivX® Player Plugin for VOD Content
"Path"=

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0]
"Description"=DivX VOD Helper Plug-in
"Path"=D:\DivX\DivX OVS Helper\npovshelper.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/GENUINE]
"Description"=
"Path"=disabled

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0]
"Description"=Ag Player Plugin
"Path"=C:\Program Files\Microsoft Silverlight\4.1.10111.0\npctrl.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922]
"Description"=WLPG Install MIME type
"Path"=

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@real.com/nppl3260;version=15.0.0.198]
"Description"=RealPlayer(tm) LiveConnect-Enabled Plug-In
"Path"=

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@real.com/nprjplug;version=15.0.0.198]
"Description"=RealJukebox Netscape Plugin
"Path"=

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@real.com/nprpchromebrowserrecordext;version=15.0.0.198]
"Description"=RealNetworks(tm) RealPlayer Chrome Background Extension Plug-In
"Path"=C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@real.com/nprphtml5videoshim;version=15.0.0.198]
"Description"=RealPlayer(tm) HTML5VideoShim Plug-In
"Path"=C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@real.com/nprpjplug;version=15.0.0.198]
"Description"=15.0.0.198
"Path"=

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=]
"Description"=
"Path"=

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@SoccerInferno.com/Plugin]
"Description"=SoccerInferno Plugin
"Path"=C:\Program Files\SoccerInferno\bar\1.bin\NPj2Stub.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@tools.google.com/Google Update;version=3]
"Description"=Google Update
"Path"=C:\Program Files\Google\Update\1.3.21.79\npGoogleUpdate3.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@tools.google.com/Google Update;version=9]
"Description"=Google Update
"Path"=C:\Program Files\Google\Update\1.3.21.79\npGoogleUpdate3.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@veetle.com/veetleCorePlugin,version=0.9.18]
"Description"=Veetle TV Core
"Path"=C:\Program Files\Veetle\plugins\npVeetle.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@veetle.com/veetlePlayerPlugin,version=0.9.18]
"Description"=Veetle TV Player
"Path"=C:\Program Files\Veetle\Player\npvlc.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\Adobe Reader]
"Description"=Handles PDFs in-place in Firefox
"Path"=

C:\Program Files\Mozilla Firefox\extensions\
{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
{972ce4c6-7e08-4474-a285-3208198ce6fd}

C:\Program Files\Mozilla Firefox\components\
binary.manifest
browsercomps.dll
nsIQTScriptablePlugin.xpt

C:\Program Files\Mozilla Firefox\plugins\
npdeployJava1.dll
npDivxPlayerPlugin.dll
NPOFFICE.DLL
nppdf32.dll
nppl3260.dll
nppl3260.xpt
npqtplugin.dll
npqtplugin2.dll
npqtplugin3.dll
npqtplugin4.dll
npqtplugin5.dll
nprjplug.dll
nprpjplug.dll
nsIDivxPlayerPlugin.xpt
nsjsrealplayerplugin.xpt
QuickTimePlugin.class

C:\Program Files\Mozilla Firefox\searchplugins\
amazondotcom.xml
answers.xml
babylon.xml
bing.xml
creativecommons.xml
eBay.xml
google.xml
twitter.xml
wikipedia.xml
yahoo.xml

C:\Users\Kowe\AppData\Roaming\Mozilla\Firefox\Profiles\q8ida096.default\extensions\
ffxtlbr@babylon.com
{7b13ec3e-999a-4b70-b9cb-2617b8323822}

C:\Users\Kowe\AppData\Roaming\Mozilla\Firefox\Profiles\q8ida096.default\searchplugins\
ask.uk.xml
conduit.xml

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2011-09-05 63912]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{285028f8-201e-4f8f-827b-7381fc181c3e}]
Toolbar BHO - C:\PROGRA~1\SOCCER~2\bar\1.bin\j2bar.dll [2010-09-21 643072]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3049C3E9-B461-4BC5-8870-4C09146192CA}]
RealPlayer Download and Record Plugin for Internet Explorer - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll [2011-12-08 425680]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{326E768D-4182-46FD-9C16-1449A49795F4}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{53707962-6F74-2D53-2644-206D7942484F}]
Spybot-S&D IE Protection - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll [2009-01-26 1879896]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9b339f6e-ddcd-401b-8764-230adbd01761}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AD4DF010-E2FD-43CE-864A-6BD1EDC59AC2}]
Plugin for Media Finder - C:\Users\Kowe\AppData\Roaming\Media Finder\Extensions\IEPlugin32.dll [2011-12-07 307200]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}]
Skype Browser Helper - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll [2011-05-16 1164680]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{CA4520F3-AE13-4FB1-A513-58E23991C86D}]
Help the General-Search Project - C:\Users\Kowe\AppData\Roaming\MEDIAF~1\EXTENS~1\GENCRA~1.DLL [2011-12-07 428544]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{d47a8d7d-f7b2-48a9-b8d6-b44484d51b89}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{9b339f6e-ddcd-401b-8764-230adbd01761}
{d47a8d7d-f7b2-48a9-b8d6-b44484d51b89}
{c5a318c1-d1d9-41f0-85fe-41cc9fb25e75} - SoccerInferno - C:\Program Files\SoccerInferno\bar\1.bin\j2bar.dll [2010-09-21 643072]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"QuickTime Task"=C:\Program Files\QuickTime Alternative\QTTask.exe [2010-03-18 421888]
"SoccerInferno Browser Plugin Loader"=C:\PROGRA~1\SOCCER~2\bar\1.bin\j2brmon.exe [2010-09-21 20480]
"TkBellExe"=C:\Program Files\Real\RealPlayer\update\realsched.exe [2011-12-08 296056]
"egui"=C:\Program Files\ESET\ESET Smart Security\egui.exe [2011-09-22 3080264]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"=C:\Program Files\Windows Sidebar\sidebar.exe [2010-11-20 1174016]
"Advanced SystemCare 5"=D:\Advanced SystemCare 5\ASCTray.exe [2011-12-19 619352]
"uTorrent"=C:\Program Files\uTorrent\uTorrent.exe [2012-02-22 740216]
"DAEMON Tools Lite"=C:\Program Files\DAEMON Tools Lite\DTLite.exe [2010-04-01 357696]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
c:\program files\common files\adobe\arm\1.0\adobearm.exe [2012-01-03 843712]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\art]
c:\temp2\art.exe []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Cmiboot]
c:\windows\cmiboot.exe [2007-02-12 65536]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
c:\program files\daemon tools lite\dtlite.exe [2010-04-01 357696]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DivXUpdate]
c:\program files\divx\divx update\divxupdate.exe [2011-07-29 1259376]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds]
c:\windows\system32\hkcmd.exe [2009-09-23 173592]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray]
c:\windows\system32\igfxtray.exe [2009-09-23 141848]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr]
c:\program files\windows live\messenger\msnmsgr.exe [2010-04-16 3872080]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Persistence]
c:\windows\system32\igfxpers.exe [2009-09-23 150552]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PlusService]
c:\program files\yuna software\messenger plus!\plusservice.exe [2011-05-26 800768]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QlbCtrl.exe]
c:\program files\hewlett-packard\hp quick launch buttons\qlbctrl.exe [2009-11-11 287800]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
c:\program files\cyberlink\powerdvd\pdvdserv.exe [2005-12-07 30208]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RESTART_STICKY_NOTES]
c:\windows\system32\stikynot.exe [2009-07-14 354304]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer]
c:\program files\spybot - search & destroy\teatimer.exe [2009-03-05 2260480]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SynTPEnh]
c:\program files\synaptics\syntp\syntpenh.exe [2008-03-28 1045800]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\uTorrent]
c:\program files\utorrent\utorrent.exe [2012-02-22 740216]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
C:\Windows\system32\igfxdev.dll [2009-09-23 218112]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED}

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Wdf01000.sys]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=0
"ConsentPromptBehaviorUser"=3
"EnableLUA"=0
"EnableUIADesktopToggle"=0
"PromptOnSecureDesktop"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.msadpcm"=msadp32.acm
"midimapper"=midimap.dll
"wavemapper"=msacm32.drv
"VIDC.UYVY"=msyuv.dll
"VIDC.YUY2"=msyuv.dll
"VIDC.YVYU"=msyuv.dll
"VIDC.IYUV"=iyuv_32.dll
"vidc.i420"=iyuv_32.dll
"VIDC.YVU9"=tsbyuv.dll
"msacm.l3acm"=C:\Windows\System32\l3codeca.acm
"vidc.cvid"=iccvid.dll
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv
"MSVideo8"=VfWWDM32.dll
"vidc.xvid"=xvidvfw.dll
"vidc.ffds"=ff_vfw.dll
"vidc.vp60"=vp6vfw.dll
"vidc.vp61"=vp6vfw.dll
"vidc.vp62"=vp6vfw.dll
"msacm.divxa32"=DivXa32.acm
"msacm.lameacm"=LameACM.acm
"wave1"=wdmaud.drv
"midi1"=wdmaud.drv
"mixer1"=wdmaud.drv
"aux1"=wdmaud.drv
"msacm.siren"=sirenacm.dll
"msacm.ac3filter"=ac3filter.acm
"vidc.DIVX"=DivX.dll
"vidc.yv12"=DivX.dll

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*
.scr - open - C:\Windows\system32\notepad.exe "%1"
.scr - install -
.scr - config -

======List of files/folders created in the last 1 month======

2012-02-22 17:52:03 ----D---- C:\Program Files\trend micro
2012-02-22 17:52:02 ----D---- C:\rsit
2012-02-20 15:52:55 ----D---- C:\ProgramData\Uninstall
2012-02-20 15:52:55 ----D---- C:\Program Files\Common Files\Roxio Shared
2012-02-20 15:51:53 ----D---- C:\Users\Kowe\AppData\Roaming\Roxio Log Files
2012-02-20 15:51:47 ----D---- C:\SWSETUP
2012-02-20 15:38:34 ----D---- C:\ProgramData\PY_Software
2012-02-20 15:32:05 ----D---- C:\ProgramData\webcamXP 5
2012-02-20 15:28:14 ----D---- C:\Windows\Album
2012-02-20 15:28:14 ----A---- C:\Windows\amcap.exe
2012-02-20 15:27:59 ----A---- C:\Windows\vsnpstd.exe
2012-02-20 15:27:57 ----A---- C:\Windows\system32\unicows.dll
2012-02-20 15:27:57 ----A---- C:\Windows\snpstd.src
2012-02-20 15:27:57 ----A---- C:\Windows\snpstd.ini
2012-02-20 15:27:56 ----A---- C:\Windows\system32\dsnpstd.dll
2012-02-20 15:27:50 ----A---- C:\Windows\system32\drivers\snpstd.sys
2012-02-20 15:27:47 ----A---- C:\Windows\system32\vsnpstd.dll
2012-02-20 15:27:47 ----A---- C:\Windows\system32\rsnpstd.dll
2012-02-20 15:27:47 ----A---- C:\Windows\system32\csnpstd.dll
2012-02-20 15:27:45 ----D---- C:\Program Files\Common Files\snpstd
2012-02-20 15:27:45 ----A---- C:\Windows\usnpstd.exe
2012-02-17 23:01:27 ----HD---- C:\temp2
2012-02-16 15:07:56 ----N---- C:\bootsqm.dat
2012-02-16 14:09:13 ----A---- C:\Windows\system32\shell32.dll
2012-02-16 14:09:12 ----A---- C:\Windows\system32\ntshrui.dll
2012-02-16 13:18:44 ----A---- C:\Windows\pcvcdvw.INI
2012-02-14 23:23:52 ----A---- C:\Windows\system32\win32k.sys
2012-02-14 23:23:25 ----A---- C:\Windows\system32\wininet.dll
2012-02-14 23:23:25 ----A---- C:\Windows\system32\urlmon.dll
2012-02-14 23:23:25 ----A---- C:\Windows\system32\url.dll
2012-02-14 23:23:25 ----A---- C:\Windows\system32\mshtmled.dll
2012-02-14 23:23:25 ----A---- C:\Windows\system32\mshtml.dll
2012-02-14 23:23:25 ----A---- C:\Windows\system32\msfeeds.dll
2012-02-14 23:23:25 ----A---- C:\Windows\system32\jsproxy.dll
2012-02-14 23:23:25 ----A---- C:\Windows\system32\ieui.dll
2012-02-14 23:23:25 ----A---- C:\Windows\system32\iertutil.dll
2012-02-14 23:23:25 ----A---- C:\Windows\system32\ieframe.dll
2012-02-14 23:21:59 ----A---- C:\Windows\system32\msvcrt.dll
2012-02-07 23:44:09 ----D---- C:\Program Files\DivX
2012-02-07 23:42:31 ----D---- C:\Program Files\Common Files\DivX Shared
2012-01-30 17:21:44 ----A---- C:\Windows\system32\FlashPlayerApp.exe
2012-01-30 15:19:01 ----D---- C:\ProgramData\ESET
2012-01-30 15:19:01 ----D---- C:\Program Files\ESET

======List of files/folders modified in the last 1 month======

2012-02-22 17:57:40 ----D---- C:\Users\Kowe\AppData\Roaming\uTorrent
2012-02-22 17:52:03 ----RD---- C:\Program Files
2012-02-22 13:51:56 ----D---- C:\Windows\system32\config
2012-02-22 13:37:26 ----SHD---- C:\Windows\Installer
2012-02-22 13:37:26 ----SHD---- C:\Config.Msi
2012-02-22 13:36:00 ----RSD---- C:\Windows\assembly
2012-02-22 13:34:42 ----SHD---- C:\System Volume Information
2012-02-22 13:34:16 ----D---- C:\Windows\System32
2012-02-22 13:34:16 ----A---- C:\Windows\system32\PerfStringBackup.INI
2012-02-22 13:34:15 ----D---- C:\Windows\inf
2012-02-22 13:27:04 ----D---- C:\Program Files\Hewlett-Packard
2012-02-22 12:34:20 ----SHD---- C:\Boot
2012-02-21 19:15:52 ----D---- C:\Windows\Temp
2012-02-21 16:12:03 ----D---- C:\Users\Kowe\AppData\Roaming\vlc
2012-02-20 15:52:55 ----HD---- C:\ProgramData
2012-02-20 15:52:55 ----D---- C:\Program Files\Common Files
2012-02-20 15:28:35 ----D---- C:\Windows\system32\catroot
2012-02-20 15:28:25 ----D---- C:\Windows\system32\DriverStore
2012-02-20 15:28:14 ----D---- C:\Windows
2012-02-20 15:27:57 ----D---- C:\Windows\twain_32
2012-02-20 15:27:52 ----D---- C:\Windows\system32\drivers
2012-02-20 15:27:37 ----HD---- C:\Program Files\InstallShield Installation Information
2012-02-20 12:28:39 ----D---- C:\Windows\Microsoft.NET
2012-02-16 15:09:53 ----D---- C:\Windows\winsxs
2012-02-16 15:08:44 ----D---- C:\Program Files\Microsoft Silverlight
2012-02-16 15:03:14 ----D---- C:\Windows\system32\migration
2012-02-16 15:03:14 ----D---- C:\Program Files\Internet Explorer
2012-02-16 14:18:47 ----D---- C:\Windows\debug
2012-02-16 14:18:46 ----A---- C:\Windows\system32\MRT.exe
2012-02-16 14:12:29 ----A---- C:\Windows\win.ini
2012-02-16 14:07:56 ----D---- C:\Windows\system32\catroot2
2012-02-16 13:42:33 ----D---- C:\Windows\Prefetch
2012-02-15 17:50:12 ----D---- C:\Windows\Minidump
2012-02-12 22:35:22 ----D---- C:\Program Files\Mozilla Firefox
2012-02-07 23:44:18 ----D---- C:\ProgramData\DivX
2012-01-30 17:21:49 ----D---- C:\Windows\system32\Tasks
2012-01-30 17:21:48 ----D---- C:\Windows\Tasks
2012-01-29 05:10:42 ----N---- C:\Windows\system32\MpSigStub.exe
2012-01-25 22:15:36 ----D---- C:\Windows\Downloaded Program Files
2012-01-25 22:15:36 ----D---- C:\Program Files\Common Files\Autodesk Shared
2012-01-25 22:15:12 ----D---- C:\Windows\Help
2012-01-25 22:12:14 ----RSD---- C:\Windows\Fonts

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 epfwwfp;epfwwfp; C:\Windows\system32\DRIVERS\epfwwfp.sys [2011-08-04 50624]
R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2010-11-20 173440]
R0 sptd;sptd; C:\Windows\System32\Drivers\sptd.sys [2011-03-26 691696]
R0 vmbus;@%SystemRoot%\system32\vmbusres.dll,-1000; C:\Windows\system32\drivers\vmbus.sys [2010-11-20 175360]
R1 CSC;@%systemroot%\system32\cscsvc.dll,-202; C:\Windows\system32\drivers\csc.sys [2010-11-20 388096]
R1 ehdrv;ehdrv; C:\Windows\system32\DRIVERS\ehdrv.sys [2011-08-04 118104]
R1 EpfwLWF;Epfw NDIS LightWeight Filter; C:\Windows\system32\DRIVERS\EpfwLWF.sys [2011-08-04 33656]
R1 SCDEmu;SCDEmu; C:\Windows\system32\drivers\SCDEmu.sys [2009-07-27 58908]
R1 StarOpen;StarOpen; C:\Windows\system32\drivers\StarOpen.sys [2006-07-24 5632]
R2 eamonm;eamonm; C:\Windows\system32\DRIVERS\eamonm.sys [2011-08-09 163424]
R2 epfw;epfw; C:\Windows\system32\DRIVERS\epfw.sys [2011-08-04 147480]
R3 AgereSoftModem;Agere Systems Soft Modem; C:\Windows\system32\DRIVERS\AGRSM.sys [2010-01-26 1163328]
R3 dgderdrv;dgderdrv; C:\Windows\System32\drivers\dgderdrv.sys [2010-05-13 18136]
R3 FsUsbExDisk;FsUsbExDisk; \??\C:\Windows\system32\FsUsbExDisk.SYS [2010-05-13 36640]
R3 HBtnKey;HP Hotkey Device; C:\Windows\system32\DRIVERS\cpqbttn.sys [2010-02-25 15544]
R3 HpqKbFiltr;HpqKbFilter Driver; C:\Windows\system32\DRIVERS\HpqKbFiltr.sys [2009-04-29 15872]
R3 igfx;igfx; C:\Windows\system32\DRIVERS\igdkmd32.sys [2009-09-23 4808192]
R3 netw5v32;Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 32 Bit; C:\Windows\system32\DRIVERS\netw5v32.sys [2009-07-13 4231168]
R3 SynTP;Synaptics TouchPad Driver; C:\Windows\system32\DRIVERS\SynTP.sys [2008-03-28 199472]
S2 Parvdm;Parvdm; C:\Windows\system32\DRIVERS\parvdm.sys [2009-07-14 8704]
S3 a3m08c8y;a3m08c8y; C:\Windows\system32\drivers\a3m08c8y.sys []
S3 aic78xx;aic78xx; C:\Windows\system32\DRIVERS\djsvs.sys [2009-07-14 70720]
S3 amdagp;AMD AGP Bus Filter Driver; C:\Windows\system32\drivers\amdagp.sys [2009-07-14 53312]
S3 audiobridge;Virtual Audio Bridge; C:\Windows\system32\DRIVERS\aubridge.sys [2007-07-23 22528]
S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0; C:\Windows\system32\DRIVERS\b57nd60x.sys [2009-07-13 229888]
S3 BthEnum;Bluetooth Request Block Driver; C:\Windows\system32\drivers\BthEnum.sys [2009-07-14 34816]
S3 BthPan;Bluetooth Device (Personal Area Network); C:\Windows\system32\DRIVERS\bthpan.sys [2009-07-14 93696]
S3 BTHPORT;Bluetooth Port Driver; C:\Windows\System32\Drivers\BTHport.sys [2011-04-28 393728]
S3 BTHUSB;Bluetooth Radio USB Driver; C:\Windows\System32\Drivers\BTHUSB.sys [2011-04-28 60416]
S3 CMISTOR;CMIUCR.SYS CM320/CM220 Card Reader Driver; C:\Windows\system32\DRIVERS\cmiucr.SYS [2007-09-10 95616]
S3 pccsmcfd;PCCS Mode Change Filter Driver; C:\Windows\system32\DRIVERS\pccsmcfd.sys [2008-08-26 18816]
S3 pciide;pciide; C:\Windows\system32\drivers\pciide.sys [2009-07-14 12368]
S3 RDPDR;Terminal Server Device Redirector Driver; C:\Windows\System32\drivers\rdpdr.sys [2010-11-20 133632]
S3 RFCOMM;Bluetooth Device (RFCOMM Protocol TDI); C:\Windows\system32\DRIVERS\rfcomm.sys [2009-07-14 129536]
S3 s3cap;s3cap; C:\Windows\system32\drivers\vms3cap.sys [2010-11-20 5632]
S3 sisagp;SIS AGP Bus Filter; C:\Windows\system32\drivers\sisagp.sys [2009-07-14 52304]
S3 ssadbus;SAMSUNG Android USB Composite Device driver (WDM); C:\Windows\system32\DRIVERS\ssadbus.sys [2010-05-06 96416]
S3 ssadmdfl;SAMSUNG Android USB Modem (Filter); C:\Windows\system32\DRIVERS\ssadmdfl.sys [2011-05-13 12776]
S3 ssadmdm;SAMSUNG Android USB Modem Drivers; C:\Windows\system32\DRIVERS\ssadmdm.sys [2011-05-13 136808]
S3 sscdbus;SAMSUNG USB Composite Device driver (WDM); C:\Windows\system32\DRIVERS\sscdbus.sys [2010-04-27 104648]
S3 sscdmdfl;SAMSUNG Mobile Modem Filter; C:\Windows\system32\DRIVERS\sscdmdfl.sys [2010-04-27 14920]
S3 sscdmdm;SAMSUNG Mobile Modem Drivers; C:\Windows\system32\DRIVERS\sscdmdm.sys [2010-04-27 132424]
S3 ssm_bus;SAMSUNG Mobile USB Device II 1.0 driver (WDM); C:\Windows\system32\DRIVERS\ssm_bus.sys [2010-04-27 104448]
S3 ssm_mdfl;SAMSUNG Mobile USB Modem II 1.0 Filter; C:\Windows\system32\DRIVERS\ssm_mdfl.sys [2010-04-27 14848]
S3 ssm_mdm;SAMSUNG Mobile USB Modem II 1.0 Drivers; C:\Windows\system32\DRIVERS\ssm_mdm.sys [2010-04-27 132608]
S3 storvsc;storvsc; C:\Windows\system32\drivers\storvsc.sys [2010-11-20 28032]
S3 TsUsbFlt;@%SystemRoot%\system32\drivers\tsusbflt.sys,-1; C:\Windows\System32\drivers\tsusbflt.sys [2010-11-20 52224]
S3 viaagp;VIA AGP Bus Filter; C:\Windows\system32\drivers\viaagp.sys [2009-07-14 53328]
S3 ViaC7;VIA C7 Processor Driver; C:\Windows\system32\DRIVERS\viac7.sys [2009-07-14 52736]
S3 VMBusHID;VMBusHID; C:\Windows\system32\drivers\VMBusHID.sys [2010-11-20 17920]
S3 WinUsb;WinUsb; C:\Windows\system32\DRIVERS\WinUsb.sys [2010-11-20 35968]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AdobeARMservice;Adobe Acrobat Update Service; C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe [2011-06-06 64952]
R2 AdvancedSystemCareService5;Advanced SystemCare Service 5; D:\Advanced SystemCare 5\ASCService.exe [2011-12-19 494424]
R2 AgereModemAudio;Agere Modem Call Progress Audio; C:\Program Files\LSI SoftModem\agrsmsvc.exe [2009-12-03 26112]
R2 Bonjour Service;Bonjour Service; C:\Program Files\Bonjour\mDNSResponder.exe [2010-05-18 345376]
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 dgdersvc;Device Error Recovery Service; C:\Windows\system32\dgdersvc.exe [2010-05-13 95568]
R2 ekrn;ESET Service; C:\Program Files\ESET\ESET Smart Security\ekrn.exe [2011-09-22 974944]
R2 FsUsbExService;FsUsbExService; C:\Windows\system32\FsUsbExService.Exe [2010-05-13 217088]
R2 MDM;Machine Debug Manager; C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE [2003-06-19 322120]
R2 SBSDWSCService;SBSD Security Center Service; C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe [2009-01-26 1153368]
R2 SoccerInfernoService;SoccerInferno Service; C:\PROGRA~1\SOCCER~2\bar\1.bin\j2barsvc.exe [2010-09-21 28766]
R2 TeamViewer;TeamViewer 3; C:\Program Files\TeamViewer3\TeamViewer_Service.exe [2008-08-29 181544]
R2 TeamViewer6;TeamViewer 6; C:\Program Files\TeamViewer\Version6\TeamViewer_Service.exe [2011-08-30 2358656]
R3 Com4QLBEx;Com4QLBEx; C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe [2010-01-12 227896]
R3 hpqwmiex;hpqwmiex; C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe [2009-04-30 229944]
S2 RichVideo;Cyberlink RichVideo Service(CRVS); C:\Program Files\CyberLink\Shared files\RichVideo.exe [2005-08-08 167936]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service; C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-01-30 253600]
S3 FLEXnet Licensing Service;FLEXnet Licensing Service; C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe [2011-02-17 651720]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2003-07-28 89136]
S3 ServiceLayer;ServiceLayer; C:\Program Files\PC Connectivity Solution\ServiceLayer.exe [2008-11-11 620544]
S3 StorSvc;@%SystemRoot%\System32\StorSvc.dll,-100; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 UmRdpService;@%SystemRoot%\system32\umrdp.dll,-1000; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 WatAdminSvc;@%SystemRoot%\system32\Wat\WatUX.exe,-601; C:\Windows\system32\Wat\WatAdminSvc.exe [2010-05-29 1343400]
S3 wxpSvc;webcamXP Service; D:\webcam2\wLite\wService.exe /startedbyscm:5053B757-40E35B3B-webcamSRV []
S4 AppMgmt;@appmgmts.dll,-3250; C:\Windows\system32\svchost.exe [2009-07-14 20992]
S4 CscService;@%systemroot%\system32\cscsvc.dll,-200; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S4 PeerDistSvc;@%SystemRoot%\system32\peerdistsvc.dll,-9000; C:\Windows\System32\svchost.exe [2009-07-14 20992]

-----------------EOF-----------------
Nahoru
Uživatelský avatar
vyosek
VIP
VIP
Příspěvky: 56373
Registrován: 07 lis 2006 15:24
Bydliště: Šalingrad - Brno

Re: hack

#2 Příspěvek od vyosek »

Zdravim a pekny den preji :)

:arrow: Poprosim i o druhy log z RSIT s nazvem info.txt, je ulozen v c:\rsit

:arrow: Jaky mate problem :???:
"Kdo víno má a nepije,kdo hrozny má a nejí je, kdo ženu má a nelíbá, kdo zábavě se vyhýbá, na toho vemte bič a hůl, to není člověk, to je vůl."
Člen Obrázek od 1. února 2011.
Nahoru
Lukas666
Návštěvník
Návštěvník
Příspěvky: 89
Registrován: 02 lis 2009 17:19

Re: hack

#3 Příspěvek od Lukas666 »

zda sa mi ze ide pocitac pomalsie ako kedysi islo

nech sa paci ten log


info.txt logfile of random's system information tool 1.09 2012-02-22 17:52:39

======Uninstall list======

µTorrent-->"C:\Program Files\uTorrent\uTorrent.exe" /UNINSTALL
AC3Filter 1.63b-->"C:\Program Files\AC3Filter\unins000.exe"
Adobe Flash Player 10 ActiveX-->C:\Windows\system32\Macromed\Flash\uninstall_activeX.exe
Adobe Flash Player 11 Plugin-->C:\Windows\system32\Macromed\Flash\FlashUtil32_11_2_202_183_Plugin.exe -maintain plugin
Adobe Reader X (10.1.2)-->MsiExec.exe /I{AC76BA86-7AD7-1033-7B44-AA1000000001}
Adobe Shockwave Player 11.6-->"C:\Windows\system32\Adobe\Shockwave 11\uninstaller.exe"
Advanced SystemCare 5-->"D:\Advanced SystemCare 5\unins000.exe"
Area 2008 DEMO-->MsiExec.exe /I{795B6483-0320-4FF1-9628-A0BAD879080D}
Ashampoo Burning Studio 8.04-->"C:\Program Files\Ashampoo\Ashampoo Burning Studio 8\unins000.exe"
Ask.com Search Assistant 1.0.2-->C:\Program Files\Ask Search Assistant\uninst.exe
Autodesk DWF Viewer-->C:\PROGRA~1\Autodesk\AUTODE~1\Setup.exe /remove /q0
Balík Compatibility Pack pre systém Office 2007-->MsiExec.exe /X{90120000-0020-041B-0000-0000000FF1CE}
Bonjour-->MsiExec.exe /X{0CB9668D-F979-4F31-B8B8-67FE90F929F8}
C-Media Card Reader Driver USB2.0-->C:\Windows\system32\CmUCRRm.exe
Counter-Strike Source-->MsiExec.exe /X{5A424256-B48A-48A6-827E-ADDB413D16A5}
DivX Setup-->C:\ProgramData\DivX\Setup\DivXSetup.exe /uninstall
Facebook Video Calling 1.0.0.8953-->MsiExec.exe /X{1D7CE340-70C3-4848-BCCF-215950328A4C}
Google Chrome-->"C:\Program Files\Google\Chrome\Application\16.0.912.63\Installer\setup.exe" --uninstall --multi-install --chrome --system-level
Google Update Helper-->MsiExec.exe /I{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}
HP Quick Launch Buttons-->"C:\Program Files\InstallShield Installation Information\{34D2AB40-150D-475D-AE32-BD23FB5EE355}\setup.exe" -runfromtemp -l0x0409 -removeonly uninst
HP Web Camera-->MsiExec.exe /I{C7AE4EC3-9C13-4213-8457-74D16B353F91}
HP Webcam-->C:\ProgramData\Uninstall\{1D61E881-43CD-447B-9E6B-D2C6138B2862}\setup.exe /x {1D61E881-43CD-447B-9E6B-D2C6138B2862}
IDA NEXIS 32 rel. 3.30-->C:\Windows\IsUninst.exe -fC:\NEXIS32\UNINST.ISU
IDA NEXIS 32 rel. 3.60-->C:\Windows\IsUn0405.exe -fC:\NEXIS32\UNINST.ISU
Intel(R) Graphics Media Accelerator Driver-->C:\Windows\system32\igxpun.exe -uninstall
Intel(R) TV Wizard-->C:\Windows\system32\TVWizudlg.exe -uninstall
J2SE Runtime Environment 5.0 Update 2-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0150020}
Kies-->"C:\Program Files\InstallShield Installation Information\{D6CD26FD-CD7F-4C86-96A3-EEBFABE5FE47}\setup.exe" -runfromtemp -l0x0409 -removeonly
Kies-->MsiExec.exe /X{D6CD26FD-CD7F-4C86-96A3-EEBFABE5FE47}
Macromedia Flash Player 8-->RunDll32 advpack.dll,LaunchINFSection C:\Windows\INF\swflash.inf,DefaultUninstall,5
Messenger Plus! 5-->"C:\Program Files\Yuna Software\Messenger Plus!\Uninstall.exe"
Microsoft .NET Framework 4 Client Profile-->C:\Windows\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\Setup.exe /repair /x86 /parameterfolder Client
Microsoft .NET Framework 4 Client Profile-->MsiExec.exe /X{3C3901C5-3455-3E0A-A214-0B093A5070A6}
Microsoft Office File Validation Add-In-->MsiExec.exe /I{90140000-2005-0000-0000-0000000FF1CE}
Microsoft Office Outlook Connector-->MsiExec.exe /X{95140000-007A-0409-0000-0000000FF1CE}
Microsoft Office Outlook Connector-->MsiExec.exe /X{95140000-007A-040E-0000-0000000FF1CE}
Microsoft Office Professional Edition 2003-->MsiExec.exe /I{9011041B-6000-11D3-8CFE-0150048383C9}
Microsoft Silverlight-->MsiExec.exe /I{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053-->MsiExec.exe /X{770657D0-A123-3C07-8E44-1C83EC895118}
Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}
Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148-->MsiExec.exe /X{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570-->MsiExec.exe /X{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17-->MsiExec.exe /X{9A25302D-30C0-39D9-BD6F-21E6EC160475}
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148-->MsiExec.exe /X{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161-->MsiExec.exe /X{9BE518E6-ECC6-35A9-88E4-87755C07200F}
Mozilla Firefox 8.0 (x86 en-US)-->C:\Program Files\Mozilla Firefox\uninstall\helper.exe
MSVC80_x86-->MsiExec.exe /I{212748BB-0DA5-46DE-82A1-403736DC9F27}
MSVCRT-->MsiExec.exe /I{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}
MSXML 4.0 SP2 (KB954430)-->MsiExec.exe /I{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}
MSXML 4.0 SP2 (KB973688)-->MsiExec.exe /I{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}
MSXML 4.0 SP2 Parser and SDK-->MsiExec.exe /I{716E0306-8318-4364-8B8F-0CC4E9376BAC}
MyFreeCodec-->C:\Program Files\MyFree Codec\1.0b beta\uninstall.exe
PC Connectivity Solution-->MsiExec.exe /I{34610DE0-3C13-42CA-8E32-01FFA38AB6E8}
PokerStars.net-->"D:\pokerstars\PokerStarsUninstall.exe" /u:PokerStars.net
PowerDVD-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}\Setup.exe" -uninstall
PowerISO-->"C:\Program Files\PowerISO\uninstall.exe"
QLBCASL-->MsiExec.exe /I{F1D7AC58-554A-4A58-B784-B61558B1449A}
QuickTime Alternative 1.95-->"C:\Program Files\QuickTime Alternative\unins000.exe"
QuickTime-->MsiExec.exe /I{3D9892BB-A751-4E48-ADC8-E4289956CE1D}
RealNetworks - Microsoft Visual C++ 2008 Runtime-->MsiExec.exe /X{7770E71B-2D43-4800-9CB3-5B6CAAEBEBEA}
RealUpgrade 1.1-->MsiExec.exe /I{28C2DED6-325B-4CC7-983A-1777C8F7FBAB}
Samsung Mobile phone USB driver Drive Software-->C:\Windows\system32\Samsung_USB_Drivers\5\SSSDUninstall.exe
Samsung Mobile phone USB driver Software-->C:\Windows\system32\Samsung_USB_Drivers\5\SSSDUninstall.exe
Samsung PC Studio 3 USB Driver Installer-->"C:\Program Files\InstallShield Installation Information\{EBA29752-DDD2-4B62-B2E3-9841F92A3E3A}\setup.exe" -runfromtemp -l0x0009 -removeonly
Samsung PC Studio 3-->"C:\Program Files\InstallShield Installation Information\{C4A4722E-79F9-417C-BD72-8D359A090C97}\setup.exe" -runfromtemp -l0x0009 -removeonly
Security Update for Microsoft .NET Framework 4 Client Profile (KB2446708)-->C:\Windows\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\setup.exe /uninstallpatch {3E0806DB-3085-378A-840A-F0D3AE3609D1} /parameterfolder Client
Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870)-->C:\Windows\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\setup.exe /uninstallpatch {2CE2EB39-45C8-32D4-8A99-5529C38F1B99} /parameterfolder Client
Security Update for Microsoft .NET Framework 4 Client Profile (KB2539636)-->C:\Windows\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\setup.exe /uninstallpatch {7E97AB83-C1FE-38DE-B848-877E0A4BD81E} /parameterfolder Client
Security Update for Microsoft .NET Framework 4 Client Profile (KB2572078)-->C:\Windows\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\setup.exe /uninstallpatch {DB31DEDD-BF95-31E7-A9B7-5480561CEFF3} /parameterfolder Client
Security Update for Microsoft .NET Framework 4 Client Profile (KB2633870)-->C:\Windows\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\setup.exe /uninstallpatch {8DDEFC7E-0C61-3D11-AFC6-5414F2DAFD01} /parameterfolder Client
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351)-->C:\Windows\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\setup.exe /uninstallpatch {4952F442-5C1A-38EB-8C23-B18EFE77E20C} /parameterfolder Client
Skype Toolbars-->MsiExec.exe /I{B6CF2967-C81E-40C0-9815-C05774FEF120}
Skype™ 5.3-->MsiExec.exe /X{D6F879CC-59D6-4D4B-AE9B-D761E48D25ED}
SoccerInferno-->rundll32 C:\PROGRA~1\SOCCER~2\bar\1.bin\j2Bar.dll,O
SopCast 3.2.9-->C:\Program Files\SopCast\uninst.exe
Spybot - Search & Destroy-->"C:\Program Files\Spybot - Search & Destroy\unins000.exe"
swMSM-->MsiExec.exe /I{612C34C7-5E90-47D8-9B5C-0F717DD82726}
Synaptics Pointing Device Driver-->rundll32.exe "C:\Program Files\Synaptics\SynTP\SynISDLL.dll",standAloneUninstall
TeamViewer 3-->C:\Program Files\TeamViewer3\uninstall.exe
TeamViewer 6-->C:\Program Files\TeamViewer\Version6\uninstall.exe
Update for Microsoft .NET Framework 4 Client Profile (KB2468871)-->C:\Windows\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\setup.exe /uninstallpatch {5E9CF3A4-ADB3-3080-A8BF-976A28340758} /parameterfolder Client
Update for Microsoft .NET Framework 4 Client Profile (KB2533523)-->C:\Windows\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\setup.exe /uninstallpatch {81EBB9D7-173C-32E3-B477-149C8DE075E4} /parameterfolder Client
Update for Microsoft .NET Framework 4 Client Profile (KB2600217)-->C:\Windows\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\setup.exe /uninstallpatch {5D9961AC-7C99-36A2-9EF0-34678AED5384} /parameterfolder Client
VC80CRTRedist - 8.0.50727.6195-->MsiExec.exe /I{933B4015-4618-4716-A828-5289FC03165F}
Veetle TV 0.9.18-->C:\Program Files\Veetle\UninstallVeetleTV.exe
VideoCAM Messenger-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{862546CA-19C6-4D42-A6EB-352820682FA3}\setup.exe" -l0x9
VLC media player 1.0.1-->C:\Program Files\VideoLAN\VLC\uninstall.exe
Vodei Multimedia Processor 2.10-->C:\Program Files\Vodei\uninst.exe
Windows 7 Codec Pack 2.3.0-->C:\Windows\system32\C2MP\Uninst.exe
Windows Driver Package - Nokia pccsmcfd (08/22/2008 7.0.0.0)-->C:\PROGRA~1\DIFX\270581355A767BF1\dpinst.exe /u C:\Windows\system32\DRVSTORE\pccsmcfd_A3B3916E5D8138F59EE218321B27B044D3B18294\pccsmcfd.inf
Windows Live Communications Platform-->MsiExec.exe /I{3175E049-F9A9-4A3D-8F19-AC9FB04514D1}
Windows Live Messenger-->MsiExec.exe /X{257A92C3-7E41-4678-9144-6920F4289D0F}
Windows Movie Maker 2.6-->MsiExec.exe /X{B3DAF54F-DB25-4586-9EF1-96D24BB14088}
WinRAR archiver-->C:\Program Files\WinRAR\uninstall.exe
World of Warcraft-->C:\Program Files\Common Files\Blizzard Entertainment\World of Warcraft\Uninstall.exe

======Hosts File======

127.0.0.1 www.007guard.com
127.0.0.1 007guard.com
127.0.0.1 008i.com
127.0.0.1 www.008k.com
127.0.0.1 008k.com
127.0.0.1 www.00hq.com
127.0.0.1 00hq.com
127.0.0.1 010402.com
127.0.0.1 www.032439.com
127.0.0.1 032439.com

======System event log======

Computer Name: Kowe-PC
Event Code: 102
Message: The Peer Name Resolution Protocol cloud did not start because the creation of the default identity failed with error code: 0x80630801.
Record Number: 461281
Source Name: Microsoft-Windows-PNRPSvc
Time Written: 20110901211518.000000-000
Event Type: Error
User:

Computer Name: Kowe-PC
Event Code: 102
Message: The Peer Name Resolution Protocol cloud did not start because the creation of the default identity failed with error code: 0x80630801.
Record Number: 461280
Source Name: Microsoft-Windows-PNRPSvc
Time Written: 20110901211518.000000-000
Event Type: Error
User:

Computer Name: Kowe-PC
Event Code: 7023
Message: The Peer Name Resolution Protocol service terminated with the following error:
%%-2140993535
Record Number: 461277
Source Name: Service Control Manager
Time Written: 20110901211509.699178-000
Event Type: Error
User:

Computer Name: Kowe-PC
Event Code: 7001
Message: The Peer Networking Grouping service depends on the Peer Name Resolution Protocol service which failed to start because of the following error:
%%-2140993535
Record Number: 461275
Source Name: Service Control Manager
Time Written: 20110901211509.699178-000
Event Type: Error
User:

Computer Name: Kowe-PC
Event Code: 102
Message: The Peer Name Resolution Protocol cloud did not start because the creation of the default identity failed with error code: 0x80630801.
Record Number: 461274
Source Name: Microsoft-Windows-PNRPSvc
Time Written: 20110901211509.000000-000
Event Type: Error
User:

=====Application event log=====

Computer Name: Kowe-PC
Event Code: 63
Message: Activation context generation failed for "c:\NRSR10OK\DelZip179.dll".Error in manifest or policy file "c:\NRSR10OK\DelZip179.dll" on line 8. The value "*" of attribute "language" in element "assemblyIdentity" is invalid.
Record Number: 15714
Source Name: SideBySide
Time Written: 20101119234130.000000-000
Event Type: Error
User:

Computer Name: Kowe-PC
Event Code: 1002
Message: The program msnmsgr.exe version 14.0.8117.416 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Action Center control panel.
Process ID: 8cc
Start Time: 01cb87bfc3b4cd82
Termination Time: 200
Application Path: C:\Program Files\Windows Live\Messenger\msnmsgr.exe
Report Id: d811dbab-f40b-11df-b058-00247e99acb9

Record Number: 15713
Source Name: Application Hang
Time Written: 20101119183601.000000-000
Event Type: Error
User:

Computer Name: Kowe-PC
Event Code: 507
Message: wlcomm (1328) C:\Users\Kowe\AppData\Local\Microsoft\Windows Live Contacts\{af1be9e7-a7c0-4391-97a2-34198e6cecba}\: A request to read from the file "C:\Users\Kowe\AppData\Local\Microsoft\Windows Live Contacts\{af1be9e7-a7c0-4391-97a2-34198e6cecba}\DBStore\contacts.edb" at offset 4538368 (0x0000000000454000) for 8192 (0x00002000) bytes succeeded, but took an abnormally long time (13660 seconds) to be serviced by the OS. This problem is likely due to faulty hardware. Please contact your hardware vendor for further assistance diagnosing the problem.
Record Number: 15709
Source Name: ESENT
Time Written: 20101119153846.000000-000
Event Type: Warning
User:

Computer Name: Kowe-PC
Event Code: 4103
Message: Windows license activation failed. Error 0x80070005.
Record Number: 15688
Source Name: Microsoft-Windows-Winlogon
Time Written: 20101119075949.000000-000
Event Type: Error
User:

Computer Name: Kowe-PC
Event Code: 4105
Message: Windows is in Notification period.
Record Number: 15687
Source Name: Microsoft-Windows-Winlogon
Time Written: 20101119075949.000000-000
Event Type: Warning
User:
Nahoru
Uživatelský avatar
vyosek
VIP
VIP
Příspěvky: 56373
Registrován: 07 lis 2006 15:24
Bydliště: Šalingrad - Brno

Re: hack

#4 Příspěvek od vyosek »

:arrow: Doporucuji odinstalovat (pokud nepouzivate) toolbary (listy prohlizecu) v Přidat nebo odebrat programy

:arrow: Doporucuji odinstalovat Spybot - Search & Destroy - program ma uz nejlepsi leta davno za sebou a posledni cca 3 roky neni schopen celit aktualnim hrozbam PROSIM CTETE DUKLADNE NAVOD - TATO UTILITA MA VELKOU SCHOPNOST MAZAT A JE NUTNE JI APLIKOVAT JEN NA DOPORUCENI, JINAK VAM MUZE JIT SYSTEM DO KYTEK
:arrow: Stahnete a ulozte na plochu Combofix http://download.bleepingcomputer.com/sUBs/ComboFix.exe
  • Vypnete vsechny rezidentni bezpecnostní programy - firewally, antiviry, antispywary apod.
  • Pokud mate Win XP spustte pod uctem Spravce\Administratora
  • Pokud mate Win Vista ci Win 7, kliknete na Combofix pravym a dejte Run As Administrator ci Spustit jako spravce
  • Ihned po startu se zobrazi stranka s licencnim ujednanim, pokracujte kliknutim na Ano
  • Pokud Vam CF nabidne instalaci Konzoly pro zotaveni, tak souhlaste
  • Dale postupujte dle pokynu, behem scanu nechte PC naprosto v klidu - nespoustejte zadne aplikace a neklikejte do zobrazujiciho se okna
  • Scan by mel trvat cca 10 min, ale pokud bude PC hodne zaneseno, muze se cas prodlouzit
  • Po dokonceni skenu a pripadnem restartu CF zobrazi log, pripadne jej najdete zde C:\ComboFix.txt, jeho obsah sem vlozte
  • Detailni postup vc. obrazku mate zde http://www.bleepingcomputer.com/combofi ... t-combofix
"Kdo víno má a nepije,kdo hrozny má a nejí je, kdo ženu má a nelíbá, kdo zábavě se vyhýbá, na toho vemte bič a hůl, to není člověk, to je vůl."
Člen Obrázek od 1. února 2011.
Nahoru
Lukas666
Návštěvník
Návštěvník
Příspěvky: 89
Registrován: 02 lis 2009 17:19

Re: hack

#5 Příspěvek od Lukas666 »

ComboFix 12-02-22.01 - Kowe 02/22/2012 20:11:11.1.2 - x86
Microsoft Windows 7 Professional 6.1.7601.1.1252.1.1033.18.2039.947 [GMT 1:00]
Running from: d:\googlechrome downloads\ComboFix.exe
AV: ESET Smart Security 5.0 *Disabled/Updated* {77DEAFED-8149-104B-25A1-21771CA47CD1}
FW: ESET Személyi tuzfal *Disabled* {4FE52EC8-CB26-1113-0EFE-8842E2773BAA}
SP: ESET Smart Security 5.0 *Disabled/Updated* {CCBF4E09-A773-1FC5-1F11-1A056723366C}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* Created a new restore point
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\progra~1\SOCCER~2\bar\1.bin\j2BAr.dll
c:\program files\SoccerInferno\bar
c:\program files\SoccerInferno\bar\1.bin\CHROME.MANIFEST
c:\program files\SoccerInferno\bar\1.bin\chrome\j2ffxtbr.jar
c:\program files\SoccerInferno\bar\1.bin\INSTALL.RDF
c:\program files\SoccerInferno\bar\1.bin\j2BAr.dll
c:\program files\SoccerInferno\bar\1.bin\j2barsvc.exe
c:\program files\SoccerInferno\bar\1.bin\j2brmon.exe
c:\program files\SoccerInferno\bar\1.bin\j2brstub.dll
c:\program files\SoccerInferno\bar\1.bin\j2datact.dll
c:\program files\SoccerInferno\bar\1.bin\j2dyn.dll
c:\program files\SoccerInferno\bar\1.bin\j2highin.exe
c:\program files\SoccerInferno\bar\1.bin\j2html.dll
c:\program files\SoccerInferno\bar\1.bin\j2httpct.dll
c:\program files\SoccerInferno\bar\1.bin\j2impipe.exe
c:\program files\SoccerInferno\bar\1.bin\j2medint.exe
c:\program files\SoccerInferno\bar\1.bin\j2msg.dll
c:\program files\SoccerInferno\bar\1.bin\j2regiet.dll
c:\program files\SoccerInferno\bar\1.bin\j2SrcAs.dll
c:\program files\SoccerInferno\bar\1.bin\LOGO.BMP
c:\program files\SoccerInferno\bar\1.bin\NPj2Stub.dll
c:\program files\SoccerInferno\bar\Settings\s_pid.dat
c:\users\Kowe\AppData\Roaming\Kowelog.dat
c:\users\Kowe\AppData\Roaming\logs.dat
c:\users\Kowe\AppData\Roaming\Media Finder\Extensions\IEPLugin32.dll
c:\windows\_win32_system.dll
c:\windows\_win32_system_data.dll
c:\windows\_win32_system_info.dll
c:\windows\IsUn0405.exe
c:\windows\system32\muzapp.exe
c:\windows\system32\spynet
d:\temp\catchme.dll
.
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Service_SoccerInfernoService
.
.
((((((((((((((((((((((((( Files Created from 2012-01-22 to 2012-02-22 )))))))))))))))))))))))))))))))
.
.
2012-02-22 19:19 . 2012-02-22 19:19 -------- d-----w- c:\users\Kowe\AppData\Local\temp
2012-02-22 19:19 . 2012-02-22 19:19 -------- d-----w- c:\users\Default\AppData\Local\temp
2012-02-22 19:05 . 2012-02-22 19:05 -------- d-----w- c:\users\Kowe\AppData\Roaming\SUPERAntiSpyware.com
2012-02-22 19:04 . 2012-02-22 19:05 -------- d-----w- c:\program files\SUPERAntiSpyware
2012-02-22 19:04 . 2012-02-22 19:04 -------- d-----w- c:\programdata\SUPERAntiSpyware.com
2012-02-22 16:52 . 2012-02-22 16:58 -------- d-----w- c:\program files\trend micro
2012-02-22 16:52 . 2012-02-22 16:52 -------- d-----w- C:\rsit
2012-02-22 11:30 . 2012-02-08 06:03 6552120 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{5B704A71-101C-4FD1-9CB3-83E5AC52C192}\mpengine.dll
2012-02-20 14:53 . 2012-02-20 14:53 -------- d-----w- c:\users\Kowe\AppData\Local\Roxio
2012-02-20 14:52 . 2012-02-20 14:52 -------- d-----w- c:\programdata\Uninstall
2012-02-20 14:52 . 2012-02-20 14:52 -------- d-----w- c:\program files\Common Files\Roxio Shared
2012-02-20 14:51 . 2012-02-20 14:51 -------- d-----w- c:\users\Kowe\AppData\Roaming\Roxio Log Files
2012-02-20 14:51 . 2012-02-20 14:51 -------- d-----w- C:\SWSETUP
2012-02-20 14:38 . 2012-02-20 14:38 -------- d-----w- c:\programdata\PY_Software
2012-02-20 14:32 . 2012-02-20 14:34 -------- d-----w- c:\programdata\webcamXP 5
2012-02-20 14:28 . 2012-02-20 14:29 -------- d-----w- c:\windows\Album
2012-02-20 14:28 . 2002-07-03 10:44 53248 ----a-w- c:\windows\amcap.exe
2012-02-17 22:01 . 2012-02-22 16:45 -------- d-----w- C:\temp2
2012-02-16 13:09 . 2012-01-04 08:58 442880 ----a-w- c:\windows\system32\ntshrui.dll
2012-02-16 13:09 . 2011-12-30 05:27 478720 ----a-w- c:\windows\system32\timedate.cpl
2012-02-14 22:21 . 2012-02-14 22:21 690688 ----a-w- c:\windows\system32\msvcrt.dll
2012-02-07 22:47 . 2012-02-07 22:47 -------- d-----w- c:\users\Kowe\AppData\Local\DDMSettings
2012-02-07 22:44 . 2012-02-07 22:44 -------- d-----w- c:\program files\DivX
2012-02-07 22:42 . 2012-02-07 22:43 -------- d-----w- c:\program files\Common Files\DivX Shared
2012-02-06 13:20 . 2012-02-06 13:20 -------- d-----w- c:\users\Kowe\AppData\Local\Apps
2012-02-04 11:45 . 2012-02-16 12:56 -------- d-----w- c:\users\Kowe\AppData\Local\PokerStars.NET
2012-01-30 16:21 . 2012-01-30 16:21 417440 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2012-01-30 14:19 . 2012-01-30 14:19 -------- d-----w- c:\program files\ESET
2012-01-25 21:10 . 2012-01-25 21:10 -------- d-----w- c:\users\Kowe\AppData\Local\Autodesk
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-01-30 16:21 . 2011-09-08 20:44 70304 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-01-29 04:10 . 2010-03-21 12:21 237072 ------w- c:\windows\system32\MpSigStub.exe
2012-01-19 15:52 . 2009-07-14 02:05 152576 ----a-w- c:\windows\system32\msclmd.dll
2012-01-10 20:01 . 2012-01-10 20:01 1288472 ----a-w- c:\windows\system32\ntdll.dll
2012-01-10 20:01 . 2012-01-10 20:01 67440 ----a-w- c:\windows\system32\drivers\ksecdd.sys
2012-01-10 20:01 . 2012-01-10 20:01 369352 ----a-w- c:\windows\system32\drivers\cng.sys
2012-01-10 20:01 . 2012-01-10 20:01 22528 ----a-w- c:\windows\system32\lsass.exe
2012-01-10 20:01 . 2012-01-10 20:01 224768 ----a-w- c:\windows\system32\schannel.dll
2012-01-10 20:01 . 2012-01-10 20:01 22016 ----a-w- c:\windows\system32\secur32.dll
2012-01-10 20:01 . 2012-01-10 20:01 15872 ----a-w- c:\windows\system32\sspisrv.dll
2012-01-10 20:01 . 2012-01-10 20:01 134000 ----a-w- c:\windows\system32\drivers\ksecpkg.sys
2012-01-10 20:01 . 2012-01-10 20:01 1038848 ----a-w- c:\windows\system32\lsasrv.dll
2012-01-10 20:01 . 2012-01-10 20:01 100352 ----a-w- c:\windows\system32\sspicli.dll
2012-01-10 20:01 . 2012-01-10 20:01 314880 ----a-w- c:\windows\system32\webio.dll
2012-01-10 19:59 . 2012-01-10 19:59 514560 ----a-w- c:\windows\system32\qdvd.dll
2012-01-10 19:59 . 2012-01-10 19:59 1328128 ----a-w- c:\windows\system32\quartz.dll
2012-01-10 19:58 . 2012-01-10 19:58 67072 ----a-w- c:\windows\system32\packager.dll
2012-01-04 00:48 . 2012-01-04 00:48 354176 ----a-w- c:\windows\system32\DivXControlPanelApplet.cpl
2011-12-18 10:15 . 2011-12-18 10:15 0 ----a-w- c:\windows\system32\REN781E.tmp
2011-12-18 10:15 . 2011-12-18 10:15 0 ----a-w- c:\windows\system32\REN780D.tmp
2011-12-18 10:15 . 2011-12-18 10:15 0 ----a-w- c:\windows\system32\REN780C.tmp
2011-12-12 22:17 . 2011-12-12 22:17 472808 ----a-w- c:\windows\system32\deployJava1.dll
2011-12-08 17:47 . 2005-07-02 12:14 348160 ----a-w- c:\windows\system32\msvcr71.dll
2011-12-08 17:47 . 2003-03-19 05:14 499712 ----a-w- c:\windows\system32\msvcp71.dll
2011-11-13 09:27 . 2011-05-08 17:45 134104 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-20 1174016]
"Advanced SystemCare 5"="d:\advanced systemcare 5\ASCTray.exe" [2011-12-19 619352]
"uTorrent"="c:\program files\uTorrent\uTorrent.exe" [2012-02-22 740216]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\DTLite.exe" [2010-04-01 357696]
"SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2012-01-20 4617600]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"QuickTime Task"="c:\program files\QuickTime Alternative\QTTask.exe" [2010-03-18 421888]
"TkBellExe"="c:\program files\Real\RealPlayer\update\realsched.exe" [2011-12-08 296056]
"egui"="c:\program files\ESET\ESET Smart Security\egui.exe" [2011-09-22 3080264]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2010-04-16 3872080]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2011-07-19 113024]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2011-05-04 17:54 551296 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.DLL
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux1"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\!SASCORE]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2012-01-03 07:37 843712 ----a-w- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Cmiboot]
2007-02-12 05:08 65536 ----a-w- c:\windows\cmiboot.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
2010-04-01 09:16 357696 ----a-w- c:\program files\DAEMON Tools Lite\DTLite.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DivXUpdate]
2011-07-28 23:08 1259376 ----a-w- c:\program files\DivX\DivX Update\DivXUpdate.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds]
2009-09-23 17:30 173592 ----a-w- c:\windows\System32\hkcmd.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray]
2009-09-23 17:30 141848 ----a-w- c:\windows\System32\igfxtray.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr]
2010-04-16 21:11 3872080 ----a-w- c:\program files\Windows Live\Messenger\msnmsgr.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Persistence]
2009-09-23 17:30 150552 ----a-w- c:\windows\System32\igfxpers.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PlusService]
2011-05-26 09:29 800768 ----a-w- c:\program files\Yuna Software\Messenger Plus!\PlusService.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QlbCtrl.exe]
2009-11-11 14:11 287800 ----a-r- c:\program files\Hewlett-Packard\HP Quick Launch Buttons\QLBCtrl.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
2005-12-07 21:57 30208 ------w- c:\program files\CyberLink\PowerDVD\PDVDServ.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RESTART_STICKY_NOTES]
2009-07-14 01:14 354304 ----a-w- c:\windows\System32\StikyNot.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer]
2009-03-05 15:07 2260480 ------w- c:\program files\Spybot - Search & Destroy\TeaTimer.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SynTPEnh]
2008-03-28 01:05 1045800 ----a-w- c:\program files\Synaptics\SynTP\SynTPEnh.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\uTorrent]
2012-02-22 13:16 740216 ----a-w- c:\program files\uTorrent\uTorrent.exe
.
R2 gupdate;Google frissítési szolgáltatás (gupdate); [x]
R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-01-30 253600]
R3 audiobridge;Virtual Audio Bridge;c:\windows\system32\DRIVERS\aubridge.sys [2007-07-23 22528]
R3 CMISTOR;CMIUCR.SYS CM320/CM220 Card Reader Driver;c:\windows\system32\DRIVERS\cmiucr.SYS [2007-09-10 95616]
R3 Com4QLBEx;Com4QLBEx;c:\program files\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe [2010-01-12 227896]
R3 gupdatem;Google Update Service (gupdatem); [x]
R3 KiesAllShare;SAMSUNG KiesAllShare Service; [x]
R3 ssadbus;SAMSUNG Android USB Composite Device driver (WDM);c:\windows\system32\DRIVERS\ssadbus.sys [2010-05-06 96416]
R3 ssadmdfl;SAMSUNG Android USB Modem (Filter);c:\windows\system32\DRIVERS\ssadmdfl.sys [2011-05-13 12776]
R3 ssadmdm;SAMSUNG Android USB Modem Drivers;c:\windows\system32\DRIVERS\ssadmdm.sys [2011-05-13 136808]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 52224]
R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2010-05-29 1343400]
R3 wxpSvc;webcamXP Service;d:\webcam2\wLite\wService.exe [x]
S0 epfwwfp;epfwwfp;c:\windows\system32\DRIVERS\epfwwfp.sys [2011-08-04 50624]
S0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [2011-03-26 691696]
S1 ehdrv;ehdrv;c:\windows\system32\DRIVERS\ehdrv.sys [2011-08-04 118104]
S1 EpfwLWF;Epfw NDIS LightWeight Filter;c:\windows\system32\DRIVERS\EpfwLWF.sys [2011-08-04 33656]
S1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV.SYS [2011-07-22 12880]
S1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [2011-07-12 67664]
S2 !SASCORE;SAS Core Service;c:\program files\SUPERAntiSpyware\SASCORE.EXE [2011-08-11 116608]
S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files\Common Files\Adobe\ARM\1.0\armsvc.exe [2011-06-06 64952]
S2 AdvancedSystemCareService5;Advanced SystemCare Service 5;d:\advanced systemcare 5\ASCService.exe [2011-12-19 494424]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
S2 dgdersvc;Device Error Recovery Service;c:\windows\system32\dgdersvc.exe [2010-05-13 95568]
S2 eamonm;eamonm;c:\windows\system32\DRIVERS\eamonm.sys [2011-08-09 163424]
S2 ekrn;ESET Service;c:\program files\ESET\ESET Smart Security\ekrn.exe [2011-09-22 974944]
S2 FsUsbExService;FsUsbExService;c:\windows\system32\FsUsbExService.Exe [2010-05-13 217088]
S2 TeamViewer6;TeamViewer 6;c:\program files\TeamViewer\Version6\TeamViewer_Service.exe [2011-08-30 2358656]
S3 dgderdrv;dgderdrv;c:\windows\system32\drivers\dgderdrv.sys [2010-05-13 18136]
S3 FsUsbExDisk;FsUsbExDisk;c:\windows\system32\FsUsbExDisk.SYS [2010-05-13 36640]
S3 netw5v32;Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 32 Bit;c:\windows\system32\DRIVERS\netw5v32.sys [2009-07-13 4231168]
S3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;c:\windows\system32\DRIVERS\yk62x86.sys [2009-09-28 315392]
.
.
--- Other Services/Drivers In Memory ---
.
*NewlyCreated* - WS2IFSL
.
Contents of the 'Scheduled Tasks' folder
.
2012-02-22 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-01-30 16:21]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://search.babylon.com/?babsrc=HP_ss&affID=101067&mntrId=a222196e00000000000000247e99acb9
uInternet Settings,ProxyOverride = *.local
IE: Download with &Media Finder - c:\program files\Media Finder\hook.html
IE: E&xportovat do programu Microsoft Excel
IE: E&xportovat do programu Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
TCP: DhcpNameServer = 147.175.167.251 147.175.189.200
FF - ProfilePath - c:\users\Kowe\AppData\Roaming\Mozilla\Firefox\Profiles\q8ida096.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2124320&SearchSource=3&q={searchTerms}
FF - prefs.js: browser.search.selectedEngine - DAEMON Search
FF - prefs.js: browser.startup.homepage - hxxp://www.google.hu/
FF - prefs.js: keyword.URL - chrome://browser-region/locale/region.properties
FF - user.js: browser.cache.memory.capacity - 65536
FF - user.js: browser.chrome.favicons - false
FF - user.js: browser.display.show_image_placeholders - true
FF - user.js: browser.turbo.enabled - true
FF - user.js: browser.urlbar.autocomplete.enabled - true
FF - user.js: browser.urlbar.autofill - true
FF - user.js: browser.xul.error_pages.enabled - true
FF - user.js: content.interrupt.parsing - true
FF - user.js: content.max.tokenizing.time - 3000000
FF - user.js: content.maxtextrun - 8191
FF - user.js: content.notify.backoffcount - 5
FF - user.js: content.notify.interval - 750000
FF - user.js: content.notify.ontimer - true
FF - user.js: content.switch.threshold - 750000
FF - user.js: extensions.BabylonToolbar_i.aflt - babsst
FF - user.js: extensions.BabylonToolbar_i.babExt -
FF - user.js: extensions.BabylonToolbar_i.babTrack - affID=101067
FF - user.js: extensions.BabylonToolbar_i.hardId - a222196e00000000000000247e99acb9
FF - user.js: extensions.BabylonToolbar_i.id - a222196e00000000000000247e99acb9
FF - user.js: extensions.BabylonToolbar_i.instlDay - 15322
FF - user.js: extensions.BabylonToolbar_i.instlRef - sst
FF - user.js: extensions.BabylonToolbar_i.newTab - false
FF - user.js: extensions.BabylonToolbar_i.prdct - BabylonToolbar
FF - user.js: extensions.BabylonToolbar_i.prtnrId - babylon
FF - user.js: extensions.BabylonToolbar_i.smplGrp - none
FF - user.js: extensions.BabylonToolbar_i.srcExt - ss
FF - user.js: extensions.BabylonToolbar_i.tlbrId - base
FF - user.js: extensions.BabylonToolbar_i.vrsn - 1.5.3.17
FF - user.js: extensions.BabylonToolbar_i.vrsni - 1.5.3.17
FF - user.js: extensions.BabylonToolbar_i.vrsnTs - 1.5.3.1713:38
FF - user.js: network.http.max-connections - 32
FF - user.js: network.http.max-connections-per-server - 8
FF - user.js: network.http.max-persistent-connections-per-proxy - 8
FF - user.js: network.http.max-persistent-connections-per-server - 4
FF - user.js: network.http.pipelining - true
FF - user.js: network.http.pipelining.maxrequests - 8
FF - user.js: network.http.proxy.pipelining - true
FF - user.js: network.http.request.max-start-delay - 0
FF - user.js: nglayout.initialpaint.delay - 0
FF - user.js: plugin.expose_full_path - true
FF - user.js: ui.submenuDelay - 0
.
.
------- File Associations -------
.
.scr=AutoCADScriptFile
.
- - - - ORPHANS REMOVED - - - -
.
URLSearchHooks-{9b339f6e-ddcd-401b-8764-230adbd01761} - (no file)
URLSearchHooks-{d47a8d7d-f7b2-48a9-b8d6-b44484d51b89} - (no file)
URLSearchHooks-{a24f3f59-1021-4e02-856c-99d9b4a03d83} - c:\program files\SoccerInferno\bar\1.bin\j2SrcAs.dll
BHO-{9b339f6e-ddcd-401b-8764-230adbd01761} - (no file)
BHO-{d47a8d7d-f7b2-48a9-b8d6-b44484d51b89} - (no file)
Toolbar-{9b339f6e-ddcd-401b-8764-230adbd01761} - (no file)
Toolbar-{d47a8d7d-f7b2-48a9-b8d6-b44484d51b89} - (no file)
WebBrowser-{9B339F6E-DDCD-401B-8764-230ADBD01761} - (no file)
WebBrowser-{D47A8D7D-F7B2-48A9-B8D6-B44484D51B89} - (no file)
MSConfigStartUp-art - c:\temp2\art.exe
AddRemove-NEXIS32 3.30.08 - c:\nexis32\UNINST.ISU
AddRemove-NEXIS32 3.60.15 - c:\windows\IsUn0405.exe
.
.
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\wxpSvc]
"ImagePath"="d:\webcam2\wLite\wService.exe /startedbyscm:5053B757-40E35B3B-webcamSRV"
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:000000b5
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0004\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Other Running Processes ------------------------
.
c:\program files\LSI SoftModem\agrsmsvc.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\program files\CyberLink\Shared files\RichVideo.exe
c:\program files\TeamViewer3\TeamViewer_Service.exe
c:\program files\TeamViewer\Version6\TeamViewer.exe
c:\windows\system32\conhost.exe
c:\windows\system32\taskhost.exe
c:\program files\Windows Media Player\wmpnetwk.exe
.
**************************************************************************
.
Completion time: 2012-02-22 20:27:41 - machine was rebooted
ComboFix-quarantined-files.txt 2012-02-22 19:27
.
Pre-Run: 1,429,143,552 bytes free
Post-Run: 1,126,940,672 bytes free
.
- - End Of File - - 342A28559BFBBDB9DD2C5AE12CFB6D70
Nahoru
Uživatelský avatar
vyosek
VIP
VIP
Příspěvky: 56373
Registrován: 07 lis 2006 15:24
Bydliště: Šalingrad - Brno

Re: hack

#6 Příspěvek od vyosek »

:arrow: Odinstalujte ten Spybot, je uz zcela na nic, mate SAS coz je dostatecne

:arrow: Odinstalujte Advanced SystemCare 5 a nasledne i vse od IOBit - jsou to cinske smejdy a spise jen skodi nez jsou uzitkem. Hledaji nesmyslne a neexistujici problemy, databazi haveti ukradli jine renomovane spolecnosti

:arrow: Pokud nemate, tak presunte Combofix na plochu
  • Spustte poznamkovy blok (Start-spustit-notepad)
  • Zkopirujte skript nize

  • Kód: Vybrat vše

    KillAll::

Folder::

Registry::
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Advanced SystemCare 5"=-
"uTorrent"=-
"DAEMON Tools Lite"=-
"SUPERAntiSpyware"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"QuickTime Task"=-
"TkBellExe"=-
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"=-
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DivXUpdate]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer]

Driver::
gupdate
gupdatem

File::
C:\Windows\tasks\Adobe Flash Player Updater.job
C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-1477834340-2647751965-1430524873-1000Core.job
C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-1477834340-2647751965-1430524873-1000UA.job
C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
C:\Windows\tasks\GoogleUpdateTaskMachineUA.job

DDS::
uStart Page = hxxp://search.babylon.com/?babsrc=HP_ss ... 247e99acb9

Firefox::
FF - ProfilePath - c:\users\Kowe\AppData\Roaming\Mozilla\Firefox\Profiles\q8ida096.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.as ... ource=3&q={searchTerms}
FF - prefs.js: browser.search.selectedEngine - DAEMON Search
FF - prefs.js: browser.startup.homepage - hxxp://www.google.hu/
FF - prefs.js: keyword.URL - chrome://browser-region/locale/region.properties
FF - user.js: browser.cache.memory.capacity - 65536
FF - user.js: browser.chrome.favicons - false
FF - user.js: browser.display.show_image_placeholders - true
FF - user.js: browser.turbo.enabled - true
FF - user.js: browser.urlbar.autocomplete.enabled - true
FF - user.js: browser.urlbar.autofill - true
FF - user.js: browser.xul.error_pages.enabled - true
FF - user.js: content.interrupt.parsing - true
FF - user.js: content.max.tokenizing.time - 3000000
FF - user.js: content.maxtextrun - 8191
FF - user.js: content.notify.backoffcount - 5
FF - user.js: content.notify.interval - 750000
FF - user.js: content.notify.ontimer - true
FF - user.js: content.switch.threshold - 750000
FF - user.js: extensions.BabylonToolbar_i.aflt - babsst
FF - user.js: extensions.BabylonToolbar_i.babExt -
FF - user.js: extensions.BabylonToolbar_i.babTrack - affID=101067
FF - user.js: extensions.BabylonToolbar_i.hardId - a222196e00000000000000247e99acb9
FF - user.js: extensions.BabylonToolbar_i.id - a222196e00000000000000247e99acb9
FF - user.js: extensions.BabylonToolbar_i.instlDay - 15322
FF - user.js: extensions.BabylonToolbar_i.instlRef - sst
FF - user.js: extensions.BabylonToolbar_i.newTab - false
FF - user.js: extensions.BabylonToolbar_i.prdct - BabylonToolbar
FF - user.js: extensions.BabylonToolbar_i.prtnrId - babylon
FF - user.js: extensions.BabylonToolbar_i.smplGrp - none
FF - user.js: extensions.BabylonToolbar_i.srcExt - ss
FF - user.js: extensions.BabylonToolbar_i.tlbrId - base
FF - user.js: extensions.BabylonToolbar_i.vrsn - 1.5.3.17
FF - user.js: extensions.BabylonToolbar_i.vrsni - 1.5.3.17
FF - user.js: extensions.BabylonToolbar_i.vrsnTs - 1.5.3.1713:38
FF - user.js: network.http.max-connections - 32
FF - user.js: network.http.max-connections-per-server - 8
FF - user.js: network.http.max-persistent-connections-per-proxy - 8
FF - user.js: network.http.max-persistent-connections-per-server - 4
FF - user.js: network.http.pipelining - true
FF - user.js: network.http.pipelining.maxrequests - 8
FF - user.js: network.http.proxy.pipelining - true
FF - user.js: network.http.request.max-start-delay - 0
FF - user.js: nglayout.initialpaint.delay - 0
FF - user.js: plugin.expose_full_path - true
FF - user.js: ui.submenuDelay - 0

RegLock::
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0004\AllUserSettings]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]

Reboot::
  • Ulozte vytvoreny TXT jako CFScript.txt
  • Pretahnete vytvoreny CFScript.txt nad Combofix a pustte (viz obrazek nize)
    Obrázek
  • Po aplikaci skriptu (a pripadnem restartu) na Vas vypadne log, jeho obsah sem vlozte
:arrow: Muze se stat, ze po aplikaci skriptu nenabehnou windows, v tomto pripade restartuje PC a mackejte F8 a zvolte Posledni znamou konfiguraci
"Kdo víno má a nepije,kdo hrozny má a nejí je, kdo ženu má a nelíbá, kdo zábavě se vyhýbá, na toho vemte bič a hůl, to není člověk, to je vůl."
Člen Obrázek od 1. února 2011.
Nahoru
Lukas666
Návštěvník
Návštěvník
Příspěvky: 89
Registrován: 02 lis 2009 17:19

Re: hack

#7 Příspěvek od Lukas666 »

robil som vsecko co ste pisali

tu mate loga


ComboFix 12-02-22.01 - Kowe 02/23/2012 16:49:38.2.2 - x86
Microsoft Windows 7 Professional 6.1.7601.1.1252.1.1033.18.2039.1167 [GMT 1:00]
Running from: c:\users\Kowe\Desktop\ComboFix.exe
Command switches used :: c:\users\Kowe\Desktop\CFScript.txt
AV: ESET Smart Security 5.0 *Disabled/Updated* {77DEAFED-8149-104B-25A1-21771CA47CD1}
FW: ESET Személyi tuzfal *Disabled* {4FE52EC8-CB26-1113-0EFE-8842E2773BAA}
SP: ESET Smart Security 5.0 *Disabled/Updated* {CCBF4E09-A773-1FC5-1F11-1A056723366C}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* Created a new restore point
.
FILE ::
"c:\windows\tasks\Adobe Flash Player Updater.job"
"c:\windows\tasks\FacebookUpdateTaskUserS-1-5-21-1477834340-2647751965-1430524873-1000Core.job"
"c:\windows\tasks\FacebookUpdateTaskUserS-1-5-21-1477834340-2647751965-1430524873-1000UA.job"
"c:\windows\tasks\GoogleUpdateTaskMachineCore.job"
"c:\windows\tasks\GoogleUpdateTaskMachineUA.job"
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\tasks\Adobe Flash Player Updater.job
d:\temp\catchme.dll
.
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Service_gupdate
-------\Service_gupdatem
.
.
((((((((((((((((((((((((( Files Created from 2012-01-23 to 2012-02-23 )))))))))))))))))))))))))))))))
.
.
2012-02-23 15:56 . 2012-02-23 15:56 -------- d-----w- c:\users\Kowe\AppData\Local\temp
2012-02-22 19:05 . 2012-02-22 19:05 -------- d-----w- c:\users\Kowe\AppData\Roaming\SUPERAntiSpyware.com
2012-02-22 19:04 . 2012-02-23 08:46 -------- d-----w- c:\program files\SUPERAntiSpyware
2012-02-22 19:04 . 2012-02-22 19:04 -------- d-----w- c:\programdata\SUPERAntiSpyware.com
2012-02-22 16:52 . 2012-02-22 16:58 -------- d-----w- c:\program files\trend micro
2012-02-22 16:52 . 2012-02-22 16:52 -------- d-----w- C:\rsit
2012-02-22 11:30 . 2012-02-08 06:03 6552120 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{5B704A71-101C-4FD1-9CB3-83E5AC52C192}\mpengine.dll
2012-02-20 14:53 . 2012-02-20 14:53 -------- d-----w- c:\users\Kowe\AppData\Local\Roxio
2012-02-20 14:52 . 2012-02-20 14:52 -------- d-----w- c:\programdata\Uninstall
2012-02-20 14:52 . 2012-02-20 14:52 -------- d-----w- c:\program files\Common Files\Roxio Shared
2012-02-20 14:51 . 2012-02-20 14:51 -------- d-----w- c:\users\Kowe\AppData\Roaming\Roxio Log Files
2012-02-20 14:51 . 2012-02-20 14:51 -------- d-----w- C:\SWSETUP
2012-02-20 14:38 . 2012-02-20 14:38 -------- d-----w- c:\programdata\PY_Software
2012-02-20 14:32 . 2012-02-20 14:34 -------- d-----w- c:\programdata\webcamXP 5
2012-02-20 14:28 . 2012-02-20 14:29 -------- d-----w- c:\windows\Album
2012-02-20 14:28 . 2002-07-03 10:44 53248 ----a-w- c:\windows\amcap.exe
2012-02-17 22:01 . 2012-02-22 16:45 -------- d-----w- C:\temp2
2012-02-16 13:09 . 2012-01-04 08:58 442880 ----a-w- c:\windows\system32\ntshrui.dll
2012-02-16 13:09 . 2011-12-30 05:27 478720 ----a-w- c:\windows\system32\timedate.cpl
2012-02-14 22:21 . 2012-02-14 22:21 690688 ----a-w- c:\windows\system32\msvcrt.dll
2012-02-07 22:47 . 2012-02-07 22:47 -------- d-----w- c:\users\Kowe\AppData\Local\DDMSettings
2012-02-07 22:44 . 2012-02-07 22:44 -------- d-----w- c:\program files\DivX
2012-02-07 22:42 . 2012-02-07 22:43 -------- d-----w- c:\program files\Common Files\DivX Shared
2012-02-06 13:20 . 2012-02-06 13:20 -------- d-----w- c:\users\Kowe\AppData\Local\Apps
2012-02-04 11:45 . 2012-02-16 12:56 -------- d-----w- c:\users\Kowe\AppData\Local\PokerStars.NET
2012-01-30 16:21 . 2012-01-30 16:21 417440 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2012-01-30 14:19 . 2012-01-30 14:19 -------- d-----w- c:\program files\ESET
2012-01-25 21:10 . 2012-01-25 21:10 -------- d-----w- c:\users\Kowe\AppData\Local\Autodesk
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-01-30 16:21 . 2011-09-08 20:44 70304 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-01-29 04:10 . 2010-03-21 12:21 237072 ------w- c:\windows\system32\MpSigStub.exe
2012-01-19 15:52 . 2009-07-14 02:05 152576 ----a-w- c:\windows\system32\msclmd.dll
2012-01-10 20:01 . 2012-01-10 20:01 1288472 ----a-w- c:\windows\system32\ntdll.dll
2012-01-10 20:01 . 2012-01-10 20:01 67440 ----a-w- c:\windows\system32\drivers\ksecdd.sys
2012-01-10 20:01 . 2012-01-10 20:01 369352 ----a-w- c:\windows\system32\drivers\cng.sys
2012-01-10 20:01 . 2012-01-10 20:01 22528 ----a-w- c:\windows\system32\lsass.exe
2012-01-10 20:01 . 2012-01-10 20:01 224768 ----a-w- c:\windows\system32\schannel.dll
2012-01-10 20:01 . 2012-01-10 20:01 22016 ----a-w- c:\windows\system32\secur32.dll
2012-01-10 20:01 . 2012-01-10 20:01 15872 ----a-w- c:\windows\system32\sspisrv.dll
2012-01-10 20:01 . 2012-01-10 20:01 134000 ----a-w- c:\windows\system32\drivers\ksecpkg.sys
2012-01-10 20:01 . 2012-01-10 20:01 1038848 ----a-w- c:\windows\system32\lsasrv.dll
2012-01-10 20:01 . 2012-01-10 20:01 100352 ----a-w- c:\windows\system32\sspicli.dll
2012-01-10 20:01 . 2012-01-10 20:01 314880 ----a-w- c:\windows\system32\webio.dll
2012-01-10 19:59 . 2012-01-10 19:59 514560 ----a-w- c:\windows\system32\qdvd.dll
2012-01-10 19:59 . 2012-01-10 19:59 1328128 ----a-w- c:\windows\system32\quartz.dll
2012-01-10 19:58 . 2012-01-10 19:58 67072 ----a-w- c:\windows\system32\packager.dll
2012-01-04 00:48 . 2012-01-04 00:48 354176 ----a-w- c:\windows\system32\DivXControlPanelApplet.cpl
2011-12-18 10:15 . 2011-12-18 10:15 0 ----a-w- c:\windows\system32\REN781E.tmp
2011-12-18 10:15 . 2011-12-18 10:15 0 ----a-w- c:\windows\system32\REN780D.tmp
2011-12-18 10:15 . 2011-12-18 10:15 0 ----a-w- c:\windows\system32\REN780C.tmp
2011-12-12 22:17 . 2011-12-12 22:17 472808 ----a-w- c:\windows\system32\deployJava1.dll
2011-12-08 17:47 . 2005-07-02 12:14 348160 ----a-w- c:\windows\system32\msvcr71.dll
2011-12-08 17:47 . 2003-03-19 05:14 499712 ----a-w- c:\windows\system32\msvcp71.dll
2011-11-13 09:27 . 2011-05-08 17:45 134104 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-20 1174016]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"egui"="c:\program files\ESET\ESET Smart Security\egui.exe" [2011-09-22 3080264]
"Adobe ARM"="c:\program files\common files\adobe\arm\1.0\adobearm.exe" [2012-01-03 843712]
"PlusService"="c:\program files\yuna software\messenger plus!\plusservice.exe" [2011-05-26 800768]
"RemoteControl"="c:\program files\cyberlink\powerdvd\pdvdserv.exe" [2005-12-07 30208]
"Cmiboot"="c:\windows\cmiboot.exe" [2007-02-12 65536]
"Persistence"="c:\windows\system32\igfxpers.exe" [2009-09-23 150552]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2009-09-23 173592]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2009-09-23 141848]
"SynTPEnh"="c:\program files\synaptics\syntp\syntpenh.exe" [2008-03-28 1045800]
"QlbCtrl.exe"="c:\program files\hewlett-packard\hp quick launch buttons\qlbctrl.exe" [2009-11-11 287800]
"DivXUpdate"="c:\program files\divx\divx update\divxupdate.exe" [2011-07-28 1259376]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2011-07-19 113024]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2011-05-04 17:54 551296 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.DLL
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux1"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\!SASCORE]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\art
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RESTART_STICKY_NOTES]
2009-07-14 01:14 354304 ----a-w- c:\windows\System32\StikyNot.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\uTorrent]
2012-02-22 13:16 740216 ----a-w- c:\program files\uTorrent\uTorrent.exe
.
R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-01-30 253600]
R3 audiobridge;Virtual Audio Bridge;c:\windows\system32\DRIVERS\aubridge.sys [2007-07-23 22528]
R3 CMISTOR;CMIUCR.SYS CM320/CM220 Card Reader Driver;c:\windows\system32\DRIVERS\cmiucr.SYS [2007-09-10 95616]
R3 KiesAllShare;SAMSUNG KiesAllShare Service; [x]
R3 ssadbus;SAMSUNG Android USB Composite Device driver (WDM);c:\windows\system32\DRIVERS\ssadbus.sys [2010-05-06 96416]
R3 ssadmdfl;SAMSUNG Android USB Modem (Filter);c:\windows\system32\DRIVERS\ssadmdfl.sys [2011-05-13 12776]
R3 ssadmdm;SAMSUNG Android USB Modem Drivers;c:\windows\system32\DRIVERS\ssadmdm.sys [2011-05-13 136808]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 52224]
R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2010-05-29 1343400]
R3 wxpSvc;webcamXP Service;d:\webcam2\wLite\wService.exe [x]
S0 epfwwfp;epfwwfp;c:\windows\system32\DRIVERS\epfwwfp.sys [2011-08-04 50624]
S0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [2011-03-26 691696]
S1 ehdrv;ehdrv;c:\windows\system32\DRIVERS\ehdrv.sys [2011-08-04 118104]
S1 EpfwLWF;Epfw NDIS LightWeight Filter;c:\windows\system32\DRIVERS\EpfwLWF.sys [2011-08-04 33656]
S1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV.SYS [2011-07-22 12880]
S1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [2011-07-12 67664]
S2 !SASCORE;SAS Core Service;c:\program files\SUPERAntiSpyware\SASCORE.EXE [2011-08-11 116608]
S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files\Common Files\Adobe\ARM\1.0\armsvc.exe [2011-06-06 64952]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
S2 dgdersvc;Device Error Recovery Service;c:\windows\system32\dgdersvc.exe [2010-05-13 95568]
S2 eamonm;eamonm;c:\windows\system32\DRIVERS\eamonm.sys [2011-08-09 163424]
S2 ekrn;ESET Service;c:\program files\ESET\ESET Smart Security\ekrn.exe [2011-09-22 974944]
S2 FsUsbExService;FsUsbExService;c:\windows\system32\FsUsbExService.Exe [2010-05-13 217088]
S2 TeamViewer6;TeamViewer 6;c:\program files\TeamViewer\Version6\TeamViewer_Service.exe [2011-08-30 2358656]
S3 Com4QLBEx;Com4QLBEx;c:\program files\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe [2010-01-12 227896]
S3 dgderdrv;dgderdrv;c:\windows\system32\drivers\dgderdrv.sys [2010-05-13 18136]
S3 FsUsbExDisk;FsUsbExDisk;c:\windows\system32\FsUsbExDisk.SYS [2010-05-13 36640]
S3 netw5v32;Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 32 Bit;c:\windows\system32\DRIVERS\netw5v32.sys [2009-07-13 4231168]
S3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;c:\windows\system32\DRIVERS\yk62x86.sys [2009-09-28 315392]
.
.
.
------- Supplementary Scan -------
.
uInternet Settings,ProxyOverride = *.local
IE: Download with &Media Finder - c:\program files\Media Finder\hook.html
IE: E&xportovat do programu Microsoft Excel
IE: E&xportovat do programu Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
TCP: DhcpNameServer = 212.108.204.28 192.168.0.1
FF - ProfilePath - c:\users\Kowe\AppData\Roaming\Mozilla\Firefox\Profiles\q8ida096.default\
.
- - - - ORPHANS REMOVED - - - -
.
HKCU-Run-SpybotSD TeaTimer - c:\program files\spybot - search & destroy\teatimer.exe
HKCU-Run-art - c:\temp2\art.exe
.
.
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\wxpSvc]
"ImagePath"="d:\webcam2\wLite\wService.exe /startedbyscm:5053B757-40E35B3B-webcamSRV"
.
------------------------ Other Running Processes ------------------------
.
c:\program files\LSI SoftModem\agrsmsvc.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\program files\CyberLink\Shared files\RichVideo.exe
c:\program files\TeamViewer3\TeamViewer_Service.exe
c:\program files\TeamViewer\Version6\TeamViewer.exe
c:\windows\system32\taskhost.exe
c:\windows\system32\conhost.exe
c:\windows\CmUCReye.exe
c:\windows\system32\igfxsrvc.exe
c:\program files\Synaptics\SynTP\SynTPHelper.exe
c:\program files\Windows Media Player\wmpnetwk.exe
c:\program files\Hewlett-Packard\HP Quick Launch Buttons\VolCtrl.exe
c:\program files\Hewlett-Packard\Shared\hpqwmiex.exe
c:\\?\c:\windows\system32\wbem\WMIADAP.EXE
.
**************************************************************************
.
Completion time: 2012-02-23 17:03:55 - machine was rebooted
ComboFix-quarantined-files.txt 2012-02-23 16:03
ComboFix2.txt 2012-02-22 19:27
.
Pre-Run: 1,418,502,144 bytes free
Post-Run: 1,348,734,976 bytes free
.
- - End Of File - - 7D71F102573FF44C6EC8DB8988F97BEF
Nahoru
Uživatelský avatar
vyosek
VIP
VIP
Příspěvky: 56373
Registrován: 07 lis 2006 15:24
Bydliště: Šalingrad - Brno

Re: hack

#8 Příspěvek od vyosek »

Fajn, jak se chova PC :???:
"Kdo víno má a nepije,kdo hrozny má a nejí je, kdo ženu má a nelíbá, kdo zábavě se vyhýbá, na toho vemte bič a hůl, to není člověk, to je vůl."
Člen Obrázek od 1. února 2011.
Nahoru
Lukas666
Návštěvník
Návštěvník
Příspěvky: 89
Registrován: 02 lis 2009 17:19

Re: hack

#9 Příspěvek od Lukas666 »

uz to vyzera lepsie :)

Diky moc sefe!!! :) :idea: :thumbsup:
Nahoru
Uživatelský avatar
vyosek
VIP
VIP
Příspěvky: 56373
Registrován: 07 lis 2006 15:24
Bydliště: Šalingrad - Brno

Re: hack

#10 Příspěvek od vyosek »

:arrow: Odinstalujte Combofix
  • Prejmenujte ComboFix na Uninstall
  • Spustte jej
  • Tohle smaze Combofix a jeho slozky
:arrow: T-Cleaner http://vyosek.ic.cz/pro_usery/T-Cleaner.exe
  • Stahnete a spustte
  • Pro potvrzeni volby mackejte A, Enter
  • Po pouziti utilitu smazte
  • Antiviry touhou utilitu chybne oznacit jako vir - jedna se o falesny poplach - takze v pohode stahnete (pripadne vypnete pri stahovani antivir)
:arrow: OTC http://oldtimer.geekstogo.com/OTC.exe
  • Stahnete a spustte
  • Kliknete na CleanUp a potvrdte YES
  • Program uklidi a restartuje PC

:arrow: TFC http://oldtimer.geekstogo.com/TFC.exe
  • Stahnete a spustte
  • Kliknete na Start a potvrdte OK
  • Program uklidi a restartuje pc
  • Po pouziti utilitu smazte
:arrow: Stahnete Ccleaner http://forum.viry.cz/viewtopic.php?t=7478
Panel čistič
  • Vse nechte jak je, jen dejte Analyzovat a pote Spustit CCleaner
Panel registry
  • dejte Hledej problémy
  • nasledne Opravit problémy - zalohu registru doporucuji udelat, opravte vsechny problemy
  • postup opakujte dokud nebude bez problemu - vetsinou cca 3x
Panel nástroje
  • Zde muzete odinstalovat nepotrebne programy
CCleaner doporucuji pouzivat cca jednou za tyden

:arrow: A je to :| Neni zac, rado se stalo :worship:
"Kdo víno má a nepije,kdo hrozny má a nejí je, kdo ženu má a nelíbá, kdo zábavě se vyhýbá, na toho vemte bič a hůl, to není člověk, to je vůl."
Člen Obrázek od 1. února 2011.
Nahoru
Odpovědět

Zpět na „Řešení problémů, logy“