Zdravim Vas,
Pri zapnuti mojho PC mi ESET zobrazi okno v ktorom hlasi virus na pamati pocitaca: Win32/Olmarik.TLD3 - Trojsky kon, pokusam sa ho odstranit ale cez ESET neviem akosi na to prist. Viete mi poradit ako odstranit tuto haved s PC? Je na to nejaky program?
dakujem za pomoc
Odvirování PC, zrychlení počítače, vzdálená pomoc prostřednictvím služby neslape.cz
ESET mi hlasi virus, neviem ho odstranit
Moderátor: Moderátoři
Pravidla fóra
Pokud chcete pomoc, vložte log z FRST [návod zde] nebo RSIT [návod zde]
Jednotlivé thready budou po vyřešení uzamčeny. Stejně tak ty, které budou nečinné déle než 14 dní. Vizte Pravidlo o zamykání témat. Děkujeme za pochopení.
!NOVINKA!
Nově lze využívat služby vzdálené pomoci, kdy se k vašemu počítači připojí odborník a bližší informace o problému si od vás získá telefonicky! Více na www.neslape.cz
Pokud chcete pomoc, vložte log z FRST [návod zde] nebo RSIT [návod zde]
Jednotlivé thready budou po vyřešení uzamčeny. Stejně tak ty, které budou nečinné déle než 14 dní. Vizte Pravidlo o zamykání témat. Děkujeme za pochopení.
!NOVINKA!
Nově lze využívat služby vzdálené pomoci, kdy se k vašemu počítači připojí odborník a bližší informace o problému si od vás získá telefonicky! Více na www.neslape.cz
-
Rudy
- Site Admin
- Příspěvky: 119515
- Registrován: 30 říj 2003 13:42
- Bydliště: Plzeň
- Kontaktovat uživatele:
Re: ESET mi hlasi virus, neviem ho odstranit
Také zdravím!
Musíme provést komplexní kontrolu. To, co Eset označuje jako Olmarik, je MBR rootkit, se kterým bývají v kompu další šmejdy. Tak tedy od začátku. dejte log RSIT: http://www.viry.cz/forum/viewtopic.php?f=13&t=105895 .
Musíme provést komplexní kontrolu. To, co Eset označuje jako Olmarik, je MBR rootkit, se kterým bývají v kompu další šmejdy. Tak tedy od začátku. dejte log RSIT: http://www.viry.cz/forum/viewtopic.php?f=13&t=105895 .
Dotazy a logy vkládejte pouze do vašich threadů. Soukromé zprávy, icq a e-maily neslouží k řešení vašich problémů.
Podpořte, prosím, naše fórum : https://platba.viry.cz/payment/.
Navštivte:
e-mail: rudy(zavináč)forum.viry.cz
Varování: Před odvirováním PC si udělejte zálohy svých důležitých dat (pošta, kontakty, dokumenty, fotografie, videa, hudba apod.). Virus mimo svých "viditelných" aktivit může poškodit systém!
Po dořešení vašeho problému bude vlákno zamknuto. Stejně tak tehdy, pokud bude nečinné více než 14dnů. Pokud budete chtít vlákno aktivovat, napište mi na mail uvedený výše.
Podpořte, prosím, naše fórum : https://platba.viry.cz/payment/.
Navštivte:
e-mail: rudy(zavináč)forum.viry.cz
Varování: Před odvirováním PC si udělejte zálohy svých důležitých dat (pošta, kontakty, dokumenty, fotografie, videa, hudba apod.). Virus mimo svých "viditelných" aktivit může poškodit systém!
Po dořešení vašeho problému bude vlákno zamknuto. Stejně tak tehdy, pokud bude nečinné více než 14dnů. Pokud budete chtít vlákno aktivovat, napište mi na mail uvedený výše.
Re: ESET mi hlasi virus, neviem ho odstranit
Pripájam logy
Logfile of random's system information tool 1.09 (written by random/random)
Run by Vidko at 2011-12-11 20:57:42
Systém Microsoft Windows XP Professional Service Pack 3
System drive C: has 137 GB (90%) free of 153 GB
Total RAM: 1012 MB (46% free)
Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 20:58:33, on 11.12.2011
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\ESET\ESET Smart Security\ekrn.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\WINDOWS\RTHDCPL.EXE
C:\PROGRA~1\BEARSH~1\MediaBar\Datamngr\DATAMN~1.EXE
C:\WINDOWS\system32\igfxsrvc.exe
C:\Program Files\ESET\ESET Smart Security\egui.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATICEE.EXE
C:\Program Files\DAEMON Tools Lite\DTLite.exe
C:\Program Files\ESET\MiNODLogin\MiNODLogin.exe
C:\WINDOWS\system32\javaw.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\Program Files\Common Files\Java\Java Update\jucheck.exe
C:\Documents and Settings\Vidko\Dokumenty\Preberanie\RSIT.exe
C:\Program Files\trend micro\Vidko.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = astroburn-search.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
R3 - URLSearchHook: (no name) - {A3BC75A2-1F87-4686-AA43-5347D756017C} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: MediaBar - {0974BA1E-64EC-11DE-B2A5-E43756D89593} - C:\PROGRA~1\BEARSH~1\MediaBar\ToolBar\BearshareMediabarDx.dll
O2 - BHO: UrlHelper Class - {74322BF9-DF26-493f-B0DA-6D2FC5E6429E} - C:\PROGRA~1\BEARSH~1\MediaBar\Datamngr\IEBHO.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: MediaBar - {0974BA1E-64EC-11DE-B2A5-E43756D89593} - C:\PROGRA~1\BEARSH~1\MediaBar\ToolBar\BearshareMediabarDx.dll
O3 - Toolbar: (no name) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
O3 - Toolbar: DAEMON Tools Toolbar - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [DATAMNGR] C:\PROGRA~1\BEARSH~1\MediaBar\Datamngr\DATAMN~1.EXE
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET Smart Security\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [EPSON Stylus DX8400 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATICEE.EXE /FU "C:\WINDOWS\TEMP\E_S16D.tmp" /EF "HKCU"
O4 - HKCU\..\Run: [uTorrent] "C:\Program Files\uTorrent\uTorrent.exe" /MINIMIZED
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\DTLite.exe" -autorun
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [FlashPlayerUpdate] C:\WINDOWS\system32\Macromed\Flash\FlashUtil10s_ActiveX.exe -update activex (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [FlashPlayerUpdate] C:\WINDOWS\system32\Macromed\Flash\FlashUtil10s_ActiveX.exe -update activex (User 'Default user')
O4 - Global Startup: Aktualizovat ESET licenci.lnk = C:\Program Files\ESET\MiNODLogin\MiNODLogin.exe
O8 - Extra context menu item: E&xportovať do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O20 - AppInit_DLLs: C:\PROGRA~1\BEARSH~1\MediaBar\Datamngr\datamngr.dll C:\PROGRA~1\BEARSH~1\MediaBar\Datamngr\IEBHO.dll
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Proces mezipaměti kategorií součástí - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: ESET HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe
O23 - Service: ESET Service (ekrn) - ESET - C:\Program Files\ESET\ESET Smart Security\ekrn.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
--
End of file - 6543 bytes
=========Mozilla firefox=========
ProfilePath - C:\Documents and Settings\Vidko\Data aplikací\Mozilla\Firefox\Profiles\0ncv88o6.default
prefs.js - "browser.startup.homepage" - "http://search.bearshare.com/"
prefs.js - "extensions.enabledItems" - "{1FD91A9C-410C-4090-BBCC-55D3450EF433}:2.0, {E84D42CA-64EB-11DE-A65F-8C3656D89593}:3.1, {CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA}:6.0.25, jqs@sun.com:1.0, {972ce4c6-7e08-4474-a285-3208198ce6fd}:3.6.17"
prefs.js - "keyword.URL" - "http://search.bearshare.com/web?src=ffb&systemid=2&q="
"jqs@sun.com"=C:\Program Files\Java\jre6\lib\deploy\jqs\ff
[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 10.1 Plugin
"Path"=C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@adobe.com/ShockwavePlayer]
"Description"=Adobe Shockwave Player
"Path"=C:\WINDOWS\system32\Adobe\Director\np32dsw.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@java.com/JavaPlugin]
"Description"=Oracle® Next Generation Java™ Plug-In
"Path"=C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll
C:\Program Files\Mozilla Firefox\extensions\
{972ce4c6-7e08-4474-a285-3208198ce6fd}
C:\Program Files\Mozilla Firefox\components\
binary.manifest
browsercomps.dll
C:\Program Files\Mozilla Firefox\plugins\
npdeployJava1.dll
NPOFF12.DLL
C:\Program Files\Mozilla Firefox\searchplugins\
atlas-sk.xml
avg_igeared.xml
azet-sk.xml
BearShareWebSearch.xml
dunaj-sk.xml
eBay.xml
google.xml
slovnik-sk.xml
wikipedia-sk.xml
zoznam-sk.xml
C:\Documents and Settings\Vidko\Data aplikací\Mozilla\Firefox\Profiles\0ncv88o6.default\extensions\
DTToolbar@toolbarnet.com
{E84D42CA-64EB-11DE-A65F-8C3656D89593}
C:\Documents and Settings\Vidko\Data aplikací\Mozilla\Firefox\Profiles\0ncv88o6.default\searchplugins\
absearch-search.xml
BearShareWebSearch.xml
daemon-search.xml
======Registry dump======
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
AcroIEHlprObj Class - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx [2001-03-02 37808]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0974BA1E-64EC-11DE-B2A5-E43756D89593}]
MediaBar - C:\PROGRA~1\BEARSH~1\MediaBar\ToolBar\BearshareMediabarDx.dll [2009-12-20 87480]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{74322BF9-DF26-493f-B0DA-6D2FC5E6429E}]
UrlHelper Class - C:\PROGRA~1\BEARSH~1\MediaBar\Datamngr\IEBHO.dll [2010-10-19 585136]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2011-06-04 41760]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2011-06-04 79648]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{0974BA1E-64EC-11DE-B2A5-E43756D89593} - MediaBar - C:\PROGRA~1\BEARSH~1\MediaBar\ToolBar\BearshareMediabarDx.dll [2009-12-20 87480]
{CCC7A320-B3CA-4199-B1A6-9F516DD69829}
{32099AAC-C132-4136-9E9A-4E364A424E17} - DAEMON Tools Toolbar - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll [2011-04-21 1000768]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"=C:\WINDOWS\system32\igfxtray.exe [2008-01-16 141848]
"HotKeysCmds"=C:\WINDOWS\system32\hkcmd.exe [2008-01-16 166424]
"Persistence"=C:\WINDOWS\system32\igfxpers.exe [2008-01-16 137752]
"RTHDCPL"=C:\WINDOWS\RTHDCPL.EXE [2008-01-16 16384512]
"Alcmtr"=C:\WINDOWS\ALCMTR.EXE [2008-01-16 69632]
"NeroCheck"=C:\WINDOWS\system32\NeroCheck.exe [2001-07-09 155648]
"DATAMNGR"=C:\PROGRA~1\BEARSH~1\MediaBar\Datamngr\DATAMN~1.EXE [2010-10-19 983480]
"egui"=C:\Program Files\ESET\ESET Smart Security\egui.exe [2010-08-12 2215064]
"SunJavaUpdateSched"=C:\Program Files\Common Files\Java\Java Update\jusched.exe [2011-01-07 253672]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"=C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]
"EPSON Stylus DX8400 Series"=C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATICEE.EXE [2007-04-12 182272]
"uTorrent"=C:\Program Files\uTorrent\uTorrent.exe /MINIMIZED []
"DAEMON Tools Lite"=C:\Program Files\DAEMON Tools Lite\DTLite.exe [2011-08-02 4910912]
C:\Documents and Settings\All Users\Nabídka Start\Programy\Po spuštění
Aktualizovat ESET licenci.lnk - C:\Program Files\ESET\MiNODLogin\MiNODLogin.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"="C:\PROGRA~1\BEARSH~1\MediaBar\Datamngr\datamngr.dll C:\PROGRA~1\BEARSH~1\MediaBar\Datamngr\IEBHO.dll "
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
C:\WINDOWS\system32\igfxdev.dll [2008-01-16 208896]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"HonorAutoRunSetting"=1
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE"="C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook"
"C:\Documents and Settings\Vidko\Plocha\cerviky\Frontend.exe"="C:\Documents and Settings\Vidko\Plocha\cerviky\Frontend.exe:*:Enabled:Worms 2 Frontend"
"C:\Documents and Settings\Vidko\temp\TeamViewer\Version4\TeamViewer.exe"="C:\Documents and Settings\Vidko\temp\TeamViewer\Version4\TeamViewer.exe:*:Enabled:TeamViewer Remote Control Application"
"C:\Program Files\Team17\Worms 2\Frontend.exe"="C:\Program Files\Team17\Worms 2\Frontend.exe:*:Enabled:Worms 2 Frontend"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\BearShare Applications\BearShare\BearShare.exe"="C:\Program Files\BearShare Applications\BearShare\BearShare.exe:*:Enabled:BearShare"
"C:\Program Files\AVG\AVG10\avgmfapx.exe"="C:\Program Files\AVG\AVG10\avgmfapx.exe:*:Enabled:Instalátor AVG"
"C:\Program Files\Opera\opera.exe"="C:\Program Files\Opera\opera.exe:*:Enabled:Opera Internet Browser"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\BearShare Applications\BearShare\BearShare.exe"="C:\Program Files\BearShare Applications\BearShare\BearShare.exe:*:Enabled:BearShare"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"midimapper"=midimap.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msadpcm"=msadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.trspch"=tssoft32.acm
"vidc.cvid"=iccvid.dll
"vidc.I420"=msh263.drv
"vidc.iv31"=ir32_32.dll
"vidc.iv32"=ir32_32.dll
"vidc.iv41"=ir41_32.ax
"vidc.iyuv"=iyuv_32.dll
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"vidc.uyvy"=msyuv.dll
"vidc.yuy2"=msyuv.dll
"vidc.yvu9"=tsbyuv.dll
"vidc.yvyu"=msyuv.dll
"wavemapper"=msacm32.drv
"msacm.msg723"=msg723.acm
"vidc.M263"=msh263.drv
"vidc.M261"=msh261.drv
"msacm.msaudio1"=msaud32.acm
"msacm.sl_anet"=sl_anet.acm
"msacm.iac2"=C:\WINDOWS\system32\iac25_32.ax
"vidc.iv50"=ir50_32.dll
"msacm.l3acm"=C:\WINDOWS\system32\l3codeca.acm
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv
======List of files/folders created in the last 1 month======
2011-12-11 20:57:50 ----D---- C:\Program Files\trend micro
2011-12-11 20:57:41 ----D---- C:\rsit
2011-12-11 17:13:39 ----HDC---- C:\WINDOWS\$NtUninstallKB2544893-v2$
2011-12-07 22:19:35 ----D---- C:\dd2cb3252b151db9cf8daaa87cef
2011-11-29 21:12:53 ----HDC---- C:\WINDOWS\$NtUninstallKB2641690$
2011-11-13 16:13:04 ----HDC---- C:\WINDOWS\$NtUninstallKB2567053$
2011-11-13 16:12:55 ----HDC---- C:\WINDOWS\$NtUninstallKB2592799$
======List of files/folders modified in the last 1 month======
2011-12-11 20:58:24 ----D---- C:\WINDOWS\Temp
2011-12-11 20:57:50 ----RD---- C:\Program Files
2011-12-11 20:57:30 ----D---- C:\WINDOWS\Prefetch
2011-12-11 19:19:06 ----A---- C:\WINDOWS\SchedLgU.Txt
2011-12-11 19:05:41 ----D---- C:\Program Files\Mozilla Firefox
2011-12-11 18:57:27 ----D---- C:\Program Files\Opera
2011-12-11 18:36:15 ----D---- C:\Program Files\Google
2011-12-11 18:35:49 ----D---- C:\WINDOWS\system32
2011-12-11 18:29:12 ----D---- C:\WINDOWS
2011-12-11 18:10:36 ----D---- C:\Program Files\DAEMON Tools Toolbar
2011-12-11 17:51:58 ----SHD---- C:\WINDOWS\Installer
2011-12-11 17:41:07 ----D---- C:\WINDOWS\system32\drivers
2011-12-11 17:41:06 ----D---- C:\Documents and Settings\All Users\Data aplikací\Norton
2011-12-11 17:22:53 ----SD---- C:\WINDOWS\Tasks
2011-12-11 17:13:44 ----HD---- C:\WINDOWS\inf
2011-12-11 17:13:41 ----RSHDC---- C:\WINDOWS\system32\dllcache
2011-12-11 17:12:35 ----D---- C:\WINDOWS\system32\CatRoot2
2011-12-07 22:21:32 ----A---- C:\WINDOWS\system32\MRT.exe
2011-11-25 18:34:32 ----D---- C:\WINDOWS\system32\Adobe
2011-11-25 17:56:46 ----HD---- C:\WINDOWS\$hf_mig$
2011-11-13 16:13:08 ----A---- C:\WINDOWS\imsins.BAK
2011-11-13 16:12:42 ----D---- C:\Program Files\Internet Explorer
======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
R0 WudfPf;Windows Driver Foundation - User-mode Driver Framework Platform Driver; C:\WINDOWS\system32\DRIVERS\WudfPf.sys [2006-09-28 77568]
R1 dtsoftbus01;DAEMON Tools Virtual Bus Driver; C:\WINDOWS\system32\DRIVERS\dtsoftbus01.sys [2011-11-02 232512]
R1 ehdrv;ehdrv; C:\WINDOWS\system32\DRIVERS\ehdrv.sys [2010-07-29 115008]
R1 epfwtdi;epfwtdi; C:\WINDOWS\system32\DRIVERS\epfwtdi.sys [2010-08-03 55256]
R1 intelppm;Řadič procesoru Intel; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2008-04-14 40192]
R2 eamon;eamon; C:\WINDOWS\system32\DRIVERS\eamon.sys [2010-08-04 140752]
R2 epfw;epfw; C:\WINDOWS\system32\DRIVERS\epfw.sys [2010-07-29 134512]
R3 Epfwndis;Eset Personal Firewall; C:\WINDOWS\system32\DRIVERS\Epfwndis.sys [2010-07-29 32608]
R3 HDAudBus;Ovladač Microsoft UAA pro sběrnici High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2008-04-13 144384]
R3 hidusb;Ovladač třídy standardu HID; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-13 10368]
R3 ialm;ialm; C:\WINDOWS\system32\DRIVERS\igxpmp32.sys [2008-01-16 5851488]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\WINDOWS\system32\drivers\RtkHDAud.sys [2008-01-16 4609024]
R3 mouhid;Ovladač myši standardu HID; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-10-25 12160]
R3 RTLE8023xp;Realtek 10/100/1000 PCI-E NIC Family NDIS XP Driver; C:\WINDOWS\system32\DRIVERS\Rtenicxp.sys [2008-01-16 98944]
R3 usbstor;Ovladač velkokapacitního paměťového zařízení USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]
R3 usbuhci;Ovladač Microsoft univerzálního hostitelského řadiče USB od společnosti Microsoft; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2008-04-13 20608]
S3 usbccgp;Obecný nadřazený ovladač Microsoft USB; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-13 32128]
S3 usbprint;Třída USB Printer; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2008-04-13 25856]
S3 usbscan;Ovladač skeneru USB; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2008-04-13 15104]
S3 WpdUsb;WpdUsb; C:\WINDOWS\system32\DRIVERS\wpdusb.sys [2006-10-18 38528]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-28 82944]
======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
R2 ekrn;ESET Service; C:\Program Files\ESET\ESET Smart Security\ekrn.exe [2010-08-12 810144]
R2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2011-06-04 153376]
R2 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
S3 EhttpSrv;ESET HTTP Server; C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe [2010-08-12 33584]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2006-10-26 441136]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 WMPNetworkSvc;Služba Windows Media Player Network Sharing; C:\Program Files\Windows Media Player\WMPNetwk.exe [2007-01-05 913920]
-----------------EOF-----------------
Logfile of random's system information tool 1.09 (written by random/random)
Run by Vidko at 2011-12-11 20:57:42
Systém Microsoft Windows XP Professional Service Pack 3
System drive C: has 137 GB (90%) free of 153 GB
Total RAM: 1012 MB (46% free)
Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 20:58:33, on 11.12.2011
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\ESET\ESET Smart Security\ekrn.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\WINDOWS\RTHDCPL.EXE
C:\PROGRA~1\BEARSH~1\MediaBar\Datamngr\DATAMN~1.EXE
C:\WINDOWS\system32\igfxsrvc.exe
C:\Program Files\ESET\ESET Smart Security\egui.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATICEE.EXE
C:\Program Files\DAEMON Tools Lite\DTLite.exe
C:\Program Files\ESET\MiNODLogin\MiNODLogin.exe
C:\WINDOWS\system32\javaw.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\Program Files\Common Files\Java\Java Update\jucheck.exe
C:\Documents and Settings\Vidko\Dokumenty\Preberanie\RSIT.exe
C:\Program Files\trend micro\Vidko.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = astroburn-search.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
R3 - URLSearchHook: (no name) - {A3BC75A2-1F87-4686-AA43-5347D756017C} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: MediaBar - {0974BA1E-64EC-11DE-B2A5-E43756D89593} - C:\PROGRA~1\BEARSH~1\MediaBar\ToolBar\BearshareMediabarDx.dll
O2 - BHO: UrlHelper Class - {74322BF9-DF26-493f-B0DA-6D2FC5E6429E} - C:\PROGRA~1\BEARSH~1\MediaBar\Datamngr\IEBHO.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: MediaBar - {0974BA1E-64EC-11DE-B2A5-E43756D89593} - C:\PROGRA~1\BEARSH~1\MediaBar\ToolBar\BearshareMediabarDx.dll
O3 - Toolbar: (no name) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
O3 - Toolbar: DAEMON Tools Toolbar - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [DATAMNGR] C:\PROGRA~1\BEARSH~1\MediaBar\Datamngr\DATAMN~1.EXE
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET Smart Security\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [EPSON Stylus DX8400 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATICEE.EXE /FU "C:\WINDOWS\TEMP\E_S16D.tmp" /EF "HKCU"
O4 - HKCU\..\Run: [uTorrent] "C:\Program Files\uTorrent\uTorrent.exe" /MINIMIZED
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\DTLite.exe" -autorun
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [FlashPlayerUpdate] C:\WINDOWS\system32\Macromed\Flash\FlashUtil10s_ActiveX.exe -update activex (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [FlashPlayerUpdate] C:\WINDOWS\system32\Macromed\Flash\FlashUtil10s_ActiveX.exe -update activex (User 'Default user')
O4 - Global Startup: Aktualizovat ESET licenci.lnk = C:\Program Files\ESET\MiNODLogin\MiNODLogin.exe
O8 - Extra context menu item: E&xportovať do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O20 - AppInit_DLLs: C:\PROGRA~1\BEARSH~1\MediaBar\Datamngr\datamngr.dll C:\PROGRA~1\BEARSH~1\MediaBar\Datamngr\IEBHO.dll
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Proces mezipaměti kategorií součástí - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: ESET HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe
O23 - Service: ESET Service (ekrn) - ESET - C:\Program Files\ESET\ESET Smart Security\ekrn.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
--
End of file - 6543 bytes
=========Mozilla firefox=========
ProfilePath - C:\Documents and Settings\Vidko\Data aplikací\Mozilla\Firefox\Profiles\0ncv88o6.default
prefs.js - "browser.startup.homepage" - "http://search.bearshare.com/"
prefs.js - "extensions.enabledItems" - "{1FD91A9C-410C-4090-BBCC-55D3450EF433}:2.0, {E84D42CA-64EB-11DE-A65F-8C3656D89593}:3.1, {CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA}:6.0.25, jqs@sun.com:1.0, {972ce4c6-7e08-4474-a285-3208198ce6fd}:3.6.17"
prefs.js - "keyword.URL" - "http://search.bearshare.com/web?src=ffb&systemid=2&q="
"jqs@sun.com"=C:\Program Files\Java\jre6\lib\deploy\jqs\ff
[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 10.1 Plugin
"Path"=C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@adobe.com/ShockwavePlayer]
"Description"=Adobe Shockwave Player
"Path"=C:\WINDOWS\system32\Adobe\Director\np32dsw.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@java.com/JavaPlugin]
"Description"=Oracle® Next Generation Java™ Plug-In
"Path"=C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll
C:\Program Files\Mozilla Firefox\extensions\
{972ce4c6-7e08-4474-a285-3208198ce6fd}
C:\Program Files\Mozilla Firefox\components\
binary.manifest
browsercomps.dll
C:\Program Files\Mozilla Firefox\plugins\
npdeployJava1.dll
NPOFF12.DLL
C:\Program Files\Mozilla Firefox\searchplugins\
atlas-sk.xml
avg_igeared.xml
azet-sk.xml
BearShareWebSearch.xml
dunaj-sk.xml
eBay.xml
google.xml
slovnik-sk.xml
wikipedia-sk.xml
zoznam-sk.xml
C:\Documents and Settings\Vidko\Data aplikací\Mozilla\Firefox\Profiles\0ncv88o6.default\extensions\
DTToolbar@toolbarnet.com
{E84D42CA-64EB-11DE-A65F-8C3656D89593}
C:\Documents and Settings\Vidko\Data aplikací\Mozilla\Firefox\Profiles\0ncv88o6.default\searchplugins\
absearch-search.xml
BearShareWebSearch.xml
daemon-search.xml
======Registry dump======
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
AcroIEHlprObj Class - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx [2001-03-02 37808]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0974BA1E-64EC-11DE-B2A5-E43756D89593}]
MediaBar - C:\PROGRA~1\BEARSH~1\MediaBar\ToolBar\BearshareMediabarDx.dll [2009-12-20 87480]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{74322BF9-DF26-493f-B0DA-6D2FC5E6429E}]
UrlHelper Class - C:\PROGRA~1\BEARSH~1\MediaBar\Datamngr\IEBHO.dll [2010-10-19 585136]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2011-06-04 41760]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2011-06-04 79648]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{0974BA1E-64EC-11DE-B2A5-E43756D89593} - MediaBar - C:\PROGRA~1\BEARSH~1\MediaBar\ToolBar\BearshareMediabarDx.dll [2009-12-20 87480]
{CCC7A320-B3CA-4199-B1A6-9F516DD69829}
{32099AAC-C132-4136-9E9A-4E364A424E17} - DAEMON Tools Toolbar - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll [2011-04-21 1000768]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"=C:\WINDOWS\system32\igfxtray.exe [2008-01-16 141848]
"HotKeysCmds"=C:\WINDOWS\system32\hkcmd.exe [2008-01-16 166424]
"Persistence"=C:\WINDOWS\system32\igfxpers.exe [2008-01-16 137752]
"RTHDCPL"=C:\WINDOWS\RTHDCPL.EXE [2008-01-16 16384512]
"Alcmtr"=C:\WINDOWS\ALCMTR.EXE [2008-01-16 69632]
"NeroCheck"=C:\WINDOWS\system32\NeroCheck.exe [2001-07-09 155648]
"DATAMNGR"=C:\PROGRA~1\BEARSH~1\MediaBar\Datamngr\DATAMN~1.EXE [2010-10-19 983480]
"egui"=C:\Program Files\ESET\ESET Smart Security\egui.exe [2010-08-12 2215064]
"SunJavaUpdateSched"=C:\Program Files\Common Files\Java\Java Update\jusched.exe [2011-01-07 253672]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"=C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]
"EPSON Stylus DX8400 Series"=C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATICEE.EXE [2007-04-12 182272]
"uTorrent"=C:\Program Files\uTorrent\uTorrent.exe /MINIMIZED []
"DAEMON Tools Lite"=C:\Program Files\DAEMON Tools Lite\DTLite.exe [2011-08-02 4910912]
C:\Documents and Settings\All Users\Nabídka Start\Programy\Po spuštění
Aktualizovat ESET licenci.lnk - C:\Program Files\ESET\MiNODLogin\MiNODLogin.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"="C:\PROGRA~1\BEARSH~1\MediaBar\Datamngr\datamngr.dll C:\PROGRA~1\BEARSH~1\MediaBar\Datamngr\IEBHO.dll "
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
C:\WINDOWS\system32\igfxdev.dll [2008-01-16 208896]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"HonorAutoRunSetting"=1
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE"="C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook"
"C:\Documents and Settings\Vidko\Plocha\cerviky\Frontend.exe"="C:\Documents and Settings\Vidko\Plocha\cerviky\Frontend.exe:*:Enabled:Worms 2 Frontend"
"C:\Documents and Settings\Vidko\temp\TeamViewer\Version4\TeamViewer.exe"="C:\Documents and Settings\Vidko\temp\TeamViewer\Version4\TeamViewer.exe:*:Enabled:TeamViewer Remote Control Application"
"C:\Program Files\Team17\Worms 2\Frontend.exe"="C:\Program Files\Team17\Worms 2\Frontend.exe:*:Enabled:Worms 2 Frontend"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\BearShare Applications\BearShare\BearShare.exe"="C:\Program Files\BearShare Applications\BearShare\BearShare.exe:*:Enabled:BearShare"
"C:\Program Files\AVG\AVG10\avgmfapx.exe"="C:\Program Files\AVG\AVG10\avgmfapx.exe:*:Enabled:Instalátor AVG"
"C:\Program Files\Opera\opera.exe"="C:\Program Files\Opera\opera.exe:*:Enabled:Opera Internet Browser"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\BearShare Applications\BearShare\BearShare.exe"="C:\Program Files\BearShare Applications\BearShare\BearShare.exe:*:Enabled:BearShare"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"midimapper"=midimap.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msadpcm"=msadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.trspch"=tssoft32.acm
"vidc.cvid"=iccvid.dll
"vidc.I420"=msh263.drv
"vidc.iv31"=ir32_32.dll
"vidc.iv32"=ir32_32.dll
"vidc.iv41"=ir41_32.ax
"vidc.iyuv"=iyuv_32.dll
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"vidc.uyvy"=msyuv.dll
"vidc.yuy2"=msyuv.dll
"vidc.yvu9"=tsbyuv.dll
"vidc.yvyu"=msyuv.dll
"wavemapper"=msacm32.drv
"msacm.msg723"=msg723.acm
"vidc.M263"=msh263.drv
"vidc.M261"=msh261.drv
"msacm.msaudio1"=msaud32.acm
"msacm.sl_anet"=sl_anet.acm
"msacm.iac2"=C:\WINDOWS\system32\iac25_32.ax
"vidc.iv50"=ir50_32.dll
"msacm.l3acm"=C:\WINDOWS\system32\l3codeca.acm
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv
======List of files/folders created in the last 1 month======
2011-12-11 20:57:50 ----D---- C:\Program Files\trend micro
2011-12-11 20:57:41 ----D---- C:\rsit
2011-12-11 17:13:39 ----HDC---- C:\WINDOWS\$NtUninstallKB2544893-v2$
2011-12-07 22:19:35 ----D---- C:\dd2cb3252b151db9cf8daaa87cef
2011-11-29 21:12:53 ----HDC---- C:\WINDOWS\$NtUninstallKB2641690$
2011-11-13 16:13:04 ----HDC---- C:\WINDOWS\$NtUninstallKB2567053$
2011-11-13 16:12:55 ----HDC---- C:\WINDOWS\$NtUninstallKB2592799$
======List of files/folders modified in the last 1 month======
2011-12-11 20:58:24 ----D---- C:\WINDOWS\Temp
2011-12-11 20:57:50 ----RD---- C:\Program Files
2011-12-11 20:57:30 ----D---- C:\WINDOWS\Prefetch
2011-12-11 19:19:06 ----A---- C:\WINDOWS\SchedLgU.Txt
2011-12-11 19:05:41 ----D---- C:\Program Files\Mozilla Firefox
2011-12-11 18:57:27 ----D---- C:\Program Files\Opera
2011-12-11 18:36:15 ----D---- C:\Program Files\Google
2011-12-11 18:35:49 ----D---- C:\WINDOWS\system32
2011-12-11 18:29:12 ----D---- C:\WINDOWS
2011-12-11 18:10:36 ----D---- C:\Program Files\DAEMON Tools Toolbar
2011-12-11 17:51:58 ----SHD---- C:\WINDOWS\Installer
2011-12-11 17:41:07 ----D---- C:\WINDOWS\system32\drivers
2011-12-11 17:41:06 ----D---- C:\Documents and Settings\All Users\Data aplikací\Norton
2011-12-11 17:22:53 ----SD---- C:\WINDOWS\Tasks
2011-12-11 17:13:44 ----HD---- C:\WINDOWS\inf
2011-12-11 17:13:41 ----RSHDC---- C:\WINDOWS\system32\dllcache
2011-12-11 17:12:35 ----D---- C:\WINDOWS\system32\CatRoot2
2011-12-07 22:21:32 ----A---- C:\WINDOWS\system32\MRT.exe
2011-11-25 18:34:32 ----D---- C:\WINDOWS\system32\Adobe
2011-11-25 17:56:46 ----HD---- C:\WINDOWS\$hf_mig$
2011-11-13 16:13:08 ----A---- C:\WINDOWS\imsins.BAK
2011-11-13 16:12:42 ----D---- C:\Program Files\Internet Explorer
======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
R0 WudfPf;Windows Driver Foundation - User-mode Driver Framework Platform Driver; C:\WINDOWS\system32\DRIVERS\WudfPf.sys [2006-09-28 77568]
R1 dtsoftbus01;DAEMON Tools Virtual Bus Driver; C:\WINDOWS\system32\DRIVERS\dtsoftbus01.sys [2011-11-02 232512]
R1 ehdrv;ehdrv; C:\WINDOWS\system32\DRIVERS\ehdrv.sys [2010-07-29 115008]
R1 epfwtdi;epfwtdi; C:\WINDOWS\system32\DRIVERS\epfwtdi.sys [2010-08-03 55256]
R1 intelppm;Řadič procesoru Intel; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2008-04-14 40192]
R2 eamon;eamon; C:\WINDOWS\system32\DRIVERS\eamon.sys [2010-08-04 140752]
R2 epfw;epfw; C:\WINDOWS\system32\DRIVERS\epfw.sys [2010-07-29 134512]
R3 Epfwndis;Eset Personal Firewall; C:\WINDOWS\system32\DRIVERS\Epfwndis.sys [2010-07-29 32608]
R3 HDAudBus;Ovladač Microsoft UAA pro sběrnici High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2008-04-13 144384]
R3 hidusb;Ovladač třídy standardu HID; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-13 10368]
R3 ialm;ialm; C:\WINDOWS\system32\DRIVERS\igxpmp32.sys [2008-01-16 5851488]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\WINDOWS\system32\drivers\RtkHDAud.sys [2008-01-16 4609024]
R3 mouhid;Ovladač myši standardu HID; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-10-25 12160]
R3 RTLE8023xp;Realtek 10/100/1000 PCI-E NIC Family NDIS XP Driver; C:\WINDOWS\system32\DRIVERS\Rtenicxp.sys [2008-01-16 98944]
R3 usbstor;Ovladač velkokapacitního paměťového zařízení USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]
R3 usbuhci;Ovladač Microsoft univerzálního hostitelského řadiče USB od společnosti Microsoft; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2008-04-13 20608]
S3 usbccgp;Obecný nadřazený ovladač Microsoft USB; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-13 32128]
S3 usbprint;Třída USB Printer; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2008-04-13 25856]
S3 usbscan;Ovladač skeneru USB; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2008-04-13 15104]
S3 WpdUsb;WpdUsb; C:\WINDOWS\system32\DRIVERS\wpdusb.sys [2006-10-18 38528]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-28 82944]
======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
R2 ekrn;ESET Service; C:\Program Files\ESET\ESET Smart Security\ekrn.exe [2010-08-12 810144]
R2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2011-06-04 153376]
R2 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
S3 EhttpSrv;ESET HTTP Server; C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe [2010-08-12 33584]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2006-10-26 441136]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 WMPNetworkSvc;Služba Windows Media Player Network Sharing; C:\Program Files\Windows Media Player\WMPNetwk.exe [2007-01-05 913920]
-----------------EOF-----------------
-
Rudy
- Site Admin
- Příspěvky: 119515
- Registrován: 30 říj 2003 13:42
- Bydliště: Plzeň
- Kontaktovat uživatele:
Re: ESET mi hlasi virus, neviem ho odstranit
Nedivte se, že schytáte kdejaký šmejd. Cracklý NOD totiž nechrání vůbec. Odinstalujte a pak budeme pokračovat.
Dotazy a logy vkládejte pouze do vašich threadů. Soukromé zprávy, icq a e-maily neslouží k řešení vašich problémů.
Podpořte, prosím, naše fórum : https://platba.viry.cz/payment/.
Navštivte:
e-mail: rudy(zavináč)forum.viry.cz
Varování: Před odvirováním PC si udělejte zálohy svých důležitých dat (pošta, kontakty, dokumenty, fotografie, videa, hudba apod.). Virus mimo svých "viditelných" aktivit může poškodit systém!
Po dořešení vašeho problému bude vlákno zamknuto. Stejně tak tehdy, pokud bude nečinné více než 14dnů. Pokud budete chtít vlákno aktivovat, napište mi na mail uvedený výše.
Podpořte, prosím, naše fórum : https://platba.viry.cz/payment/.
Navštivte:
e-mail: rudy(zavináč)forum.viry.cz
Varování: Před odvirováním PC si udělejte zálohy svých důležitých dat (pošta, kontakty, dokumenty, fotografie, videa, hudba apod.). Virus mimo svých "viditelných" aktivit může poškodit systém!
Po dořešení vašeho problému bude vlákno zamknuto. Stejně tak tehdy, pokud bude nečinné více než 14dnů. Pokud budete chtít vlákno aktivovat, napište mi na mail uvedený výše.
Re: ESET mi hlasi virus, neviem ho odstranit
OK, odstranim ho a ozvem sa
Re: ESET mi hlasi virus, neviem ho odstranit
No mam ho odstraneny, ako mam teraz postupovat?
-
Rudy
- Site Admin
- Příspěvky: 119515
- Registrován: 30 říj 2003 13:42
- Bydliště: Plzeň
- Kontaktovat uživatele:
Re: ESET mi hlasi virus, neviem ho odstranit
Dejte log z ComboFix.
Stahnete a ulozte nejlepe na plochu ComboFix: http://download.bleepingcomputer.com/sUBs/ComboFix.exe
pote spustte aplikaci pod uctem s administratorskym opravnenim
hned po startu se zobrazi obrazovka s licencnimi podminkami, pokracujte kliknutim na tlacitko Ano.
v klidu si postavte na kafe (cela akce trva cca. 5-10 minut, nekdy i dele - dle toho, o jak rychly stroj se
jedna a kolika soubory se skener bude muset prodirat), behem skenu se nepokousejte spoustet zadne jine
aplikace ani nic jineho
behem skenovani nepropadejte panice, vas stroj muze byt restartovan (predevsim pri prvni aplikaci skeneru)
upozorneni: pokud pouzivate antispyware s rezidentnim stitem, prepnete jeho rezidentni stit do Install Mode,
pripadne jej po dobu skenu uplne deaktivujte, protoze dochazi pri skenu a vymazu pripadneho malware k
nezadoucim kolizim s rezidentem antispyware
Dotazy a logy vkládejte pouze do vašich threadů. Soukromé zprávy, icq a e-maily neslouží k řešení vašich problémů.
Podpořte, prosím, naše fórum : https://platba.viry.cz/payment/.
Navštivte:
e-mail: rudy(zavináč)forum.viry.cz
Varování: Před odvirováním PC si udělejte zálohy svých důležitých dat (pošta, kontakty, dokumenty, fotografie, videa, hudba apod.). Virus mimo svých "viditelných" aktivit může poškodit systém!
Po dořešení vašeho problému bude vlákno zamknuto. Stejně tak tehdy, pokud bude nečinné více než 14dnů. Pokud budete chtít vlákno aktivovat, napište mi na mail uvedený výše.
Podpořte, prosím, naše fórum : https://platba.viry.cz/payment/.
Navštivte:
e-mail: rudy(zavináč)forum.viry.cz
Varování: Před odvirováním PC si udělejte zálohy svých důležitých dat (pošta, kontakty, dokumenty, fotografie, videa, hudba apod.). Virus mimo svých "viditelných" aktivit může poškodit systém!
Po dořešení vašeho problému bude vlákno zamknuto. Stejně tak tehdy, pokud bude nečinné více než 14dnů. Pokud budete chtít vlákno aktivovat, napište mi na mail uvedený výše.
Re: ESET mi hlasi virus, neviem ho odstranit
Zdravim Vas,
pripajam vypis combofixu:
pripajam vypis combofixu:
Kód: Vybrat vše
ComboFix 12-02-27.02 - Vidko 28.02.2012 18:48:26.1.2 - x86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.420.1029.18.1012.542 [GMT 1:00]
Spuštěný z: c:\documents and settings\Vidko\Dokumenty\Preberanie\ComboFix.exe
AV: AVG Internet Security 2011 *Enabled/Updated* {17DDD097-36FF-435F-9E1B-52D74245D6BF}
FW: AVG Firewall *Disabled* {8decf618-9569-4340-b34a-d78d28969b66}
* Vytvořen nový Bod Obnovení
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\Vidko\WINDOWS
c:\windows\msmqinst.log
c:\windows\system32\SETD9.tmp
c:\windows\system32\SETDD.tmp
c:\windows\system32\SETDE.tmp
c:\windows\system32\SETE5.tmp
.
.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Legacy_SSHNAS
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2012-01-28 do 2012-02-28 )))))))))))))))))))))))))))))))
.
.
2012-02-23 19:47 . 2012-02-23 19:47 -------- d-----w- c:\documents and settings\LocalService\Local Settings\Data aplikací\Google
2012-02-20 16:53 . 2012-01-11 19:07 3072 -c----w- c:\windows\system32\dllcache\iacenc.dll
2012-02-20 16:53 . 2012-01-11 19:07 3072 ------w- c:\windows\system32\iacenc.dll
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-01-12 17:20 . 2004-08-17 13:44 1859968 ----a-w- c:\windows\system32\win32k.sys
2012-01-12 00:19 . 2012-01-12 00:19 4448256 ----a-w- c:\windows\system32\GPhotos.scr
2011-12-17 19:42 . 2004-08-17 13:49 1469440 ------w- c:\windows\system32\inetcpl.cpl
2011-12-17 19:42 . 2004-08-17 13:49 916992 ----a-w- c:\windows\system32\wininet.dll
2011-12-17 19:42 . 2004-08-17 13:49 43520 ----a-w- c:\windows\system32\licmgr10.dll
2011-12-16 12:23 . 2004-08-17 13:44 385024 ----a-w- c:\windows\system32\html.iec
2011-11-21 04:45 . 2011-12-11 18:05 134104 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{0974BA1E-64EC-11DE-B2A5-E43756D89593}]
2009-12-20 09:51 87480 ----a-w- c:\progra~1\BEARSH~1\MediaBar\ToolBar\BearshareMediabarDx.dll
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{74322BF9-DF26-493f-B0DA-6D2FC5E6429E}]
2010-10-19 12:53 585136 ----a-w- c:\progra~1\BEARSH~1\MediaBar\Datamngr\IEBHO.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{0974BA1E-64EC-11DE-B2A5-E43756D89593}"= "c:\progra~1\BEARSH~1\MediaBar\ToolBar\BearshareMediabarDx.dll" [2009-12-20 87480]
.
[HKEY_CLASSES_ROOT\clsid\{0974ba1e-64ec-11de-b2a5-e43756d89593}]
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\DTLite.exe" [2011-08-02 4910912]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2008-01-16 141848]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2008-01-16 166424]
"Persistence"="c:\windows\system32\igfxpers.exe" [2008-01-16 137752]
"RTHDCPL"="RTHDCPL.EXE" [2008-01-16 16384512]
"NeroCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-01-07 253672]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"FlashPlayerUpdate"="c:\windows\system32\Macromed\Flash\FlashUtil10s_ActiveX.exe" [2011-06-10 240288]
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Documents and Settings\\Vidko\\temp\\TeamViewer\\Version4\\TeamViewer.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
.
R1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\drivers\dtsoftbus01.sys [2.11.2011 18:39 232512]
.
--- Ostatní služby/ovladače v paměti ---
.
*NewlyCreated* - WS2IFSL
.
.
------- Doplňkový sken -------
.
uStart Page = astroburn-search.com
uDefault_Search_URL = hxxp://www.google.com/ie
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: E&xportovať do programu Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.100.252
FF - ProfilePath - c:\documents and settings\Vidko\Data aplikací\Mozilla\Firefox\Profiles\0ncv88o6.default\
FF - prefs.js: browser.search.selectedEngine - BearShare Web Search
FF - prefs.js: browser.startup.homepage - hxxp://search.bearshare.com/
FF - prefs.js: keyword.URL - hxxp://search.bearshare.com/web?src=ffb&systemid=2&q=
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
.
URLSearchHooks-{A3BC75A2-1F87-4686-AA43-5347D756017C} - (no file)
Toolbar-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
WebBrowser-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
HKCU-Run-uTorrent - c:\program files\uTorrent\uTorrent.exe
AddRemove-Astroburn Toolbar - c:\program files\Astroburn Toolbar\uninst.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2012-02-28 18:54
Windows 5.1.2600 Service Pack 3 NTFS
.
skenování skrytých procesů ...
.
skenování skrytých položek 'Po spuštění' ...
.
skenování skrytých souborů ...
.
sken byl úspešně dokončen
skryté soubory: 0
.
**************************************************************************
.
Stealth MBR rootkit/Mebroot/Sinowal/TDL4 detector 0.4.2 by Gmer, http://www.gmer.net
Windows 5.1.2600 Disk: MAXTOR_STM3160815AS rev.4.AAB -> Harddisk0\DR0 -> \Device\Ide\IdePort1 P1T1L0-5
.
device: opened successfully
user: MBR read successfully
.
Disk trace:
called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys >>UNKNOWN [0x863EEECC]<<
_asm { PUSH EBP; MOV EBP, ESP; SUB ESP, 0x1c; PUSH EBX; PUSH ESI; MOV DWORD [EBP-0x4], 0x8597c879; SUB DWORD [EBP-0x4], 0x8597c135; PUSH EDI; CALL 0xffffffffffffdf2c; }
1 ntkrnlpa!IofCallDriver[0x804EF1A6] -> \Device\Harddisk0\DR0[0x86578AB8]
3 CLASSPNP[0xF7696FD7] -> ntkrnlpa!IofCallDriver[0x804EF1A6] -> [0x864AE030]
[0x8649C030] -> IRP_MJ_CREATE -> 0x863EEECC
kernel: MBR read successfully
_asm { XOR AX, AX; MOV SS, AX; MOV SP, 0x7c00; STI ; PUSH AX; POP ES; PUSH AX; POP DS; CLD ; MOV SI, 0x7c1b; MOV DI, 0x61b; PUSH AX; PUSH DI; MOV CX, 0x1e5; REP MOVSB ; RETF ; MOV BP, 0x7be; MOV CL, 0x4; CMP [BP+0x0], CH; JL 0x2e; JNZ 0x3a; }
detected disk devices:
\Device\Ide\IdeDeviceP1T1L0-5 -> \??\IDE#DiskMAXTOR_STM3160815AS_____________________4.AAB___#5&2f9ef5d6&0&0.1.0#{53f56307-b6bf-11d0-94f2-00a0c91efb8b} device not found
detected hooks:
\Driver\atapi DriverStartIo -> 0x863EEAF1
user & kernel MBR OK
sectors 312581806 (+255): user != kernel
Warning: possible TDL3 rootkit infection !
.
**************************************************************************
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (LocalSystem)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,15,4c,bc,90,9a,88,8a,41,8f,3f,da,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,15,4c,bc,90,9a,88,8a,41,8f,3f,da,\
"6256FFB019F8FDFBD36745B06F4540E9AEAF222A25"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,15,4c,bc,90,9a,88,8a,41,8f,3f,da,\
.
--------------------- Knihovny navázané na běžící procesy ---------------------
.
- - - - - - - > 'explorer.exe'(876)
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\windows\RTHDCPL.EXE
c:\progra~1\BEARSH~1\MediaBar\Datamngr\DATAMN~1.EXE
c:\windows\system32\igfxsrvc.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\windows\system32\wbem\wmiapsrv.exe
.
**************************************************************************
.
Celkový čas: 2012-02-28 18:57:33 - počítač byl restartován
ComboFix-quarantined-files.txt 2012-02-28 17:57
.
Před spuštěním: Volných bajtů: 144 802 537 472
Po spuštění: Volných bajtů: 146 836 439 040
.
WindowsXP-KB310994-SP2-Pro-BootDisk-CSY.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect
.
- - End Of File - - 2EFF32457CB172AC6F97A917C99BC247-
Rudy
- Site Admin
- Příspěvky: 119515
- Registrován: 30 říj 2003 13:42
- Bydliště: Plzeň
- Kontaktovat uživatele:
Re: ESET mi hlasi virus, neviem ho odstranit
Také zdravím!
Přesuňte ComboFix na plochu. Otevřte poznámkový blok a zkopírujte do něj:
Přesuňte ComboFix na plochu. Otevřte poznámkový blok a zkopírujte do něj:
Uložte na plochu jako CFScript.txt. Pak jej myší přetáhněte nad ikonu ComboFix a pusťte. CF se spustí a vykoná příkazy ze skriptu.KillAll::
Folder::
c:\progra~1\BEARSH~1\MediaBar\ToolBar
Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{0974BA1E-64EC-11DE-B2A5-E43756D89593}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{74322BF9-DF26-493f-B0DA-6D2FC5E6429E}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{0974BA1E-64EC-11DE-B2A5-E43756D89593}"=-
[-HKEY_CLASSES_ROOT\clsid\{0974ba1e-64ec-11de-b2a5-e43756d89593}]
Firefox::
FF - ProfilePath - c:\documents and settings\Vidko\Data aplikací\Mozilla\Firefox\Profiles\0ncv88o6.default\
FF - prefs.js: browser.search.selectedEngine - BearShare Web Search
FF - prefs.js: browser.startup.homepage - hxxp://search.bearshare.com/
FF - prefs.js: keyword.URL - hxxp://search.bearshare.com/web?src=ffb&systemid=2&q=
RegLock::
[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\User Preferences]
Dotazy a logy vkládejte pouze do vašich threadů. Soukromé zprávy, icq a e-maily neslouží k řešení vašich problémů.
Podpořte, prosím, naše fórum : https://platba.viry.cz/payment/.
Navštivte:
e-mail: rudy(zavináč)forum.viry.cz
Varování: Před odvirováním PC si udělejte zálohy svých důležitých dat (pošta, kontakty, dokumenty, fotografie, videa, hudba apod.). Virus mimo svých "viditelných" aktivit může poškodit systém!
Po dořešení vašeho problému bude vlákno zamknuto. Stejně tak tehdy, pokud bude nečinné více než 14dnů. Pokud budete chtít vlákno aktivovat, napište mi na mail uvedený výše.
Podpořte, prosím, naše fórum : https://platba.viry.cz/payment/.
Navštivte:
e-mail: rudy(zavináč)forum.viry.cz
Varování: Před odvirováním PC si udělejte zálohy svých důležitých dat (pošta, kontakty, dokumenty, fotografie, videa, hudba apod.). Virus mimo svých "viditelných" aktivit může poškodit systém!
Po dořešení vašeho problému bude vlákno zamknuto. Stejně tak tehdy, pokud bude nečinné více než 14dnů. Pokud budete chtít vlákno aktivovat, napište mi na mail uvedený výše.
Re: ESET mi hlasi virus, neviem ho odstranit
teraz?
Kód: Vybrat vše
ComboFix 12-02-27.02 - Vidko 28.02.2012 19:58:11.2.2 - x86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.420.1029.18.1012.546 [GMT 1:00]
Spuštěný z: c:\documents and settings\Vidko\Plocha\ComboFix.exe
Použité ovládací přepínače :: c:\documents and settings\Vidko\Plocha\CFScript.txt
AV: AVG Internet Security 2011 *Enabled/Updated* {17DDD097-36FF-435F-9E1B-52D74245D6BF}
FW: AVG Firewall *Disabled* {8decf618-9569-4340-b34a-d78d28969b66}
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\progra~1\BEARSH~1\MediaBar\ToolBar
c:\progra~1\BEARSH~1\MediaBar\ToolBar\BearshareMediabarDx.dll
c:\progra~1\BEARSH~1\MediaBar\ToolBar\BearshareMediabarTb.dll
c:\progra~1\BEARSH~1\MediaBar\ToolBar\components\windowmediator.js
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\content\bearshare.js
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\content\data\search\engines.xml
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\content\data\search\search.xsl
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\content\lib\about.xml
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\content\lib\dtxpanelwin.xul
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\content\lib\dtxprefwin.xul
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\content\lib\dtxwin.xul
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\content\lib\emailnotifierproviders.xml
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\content\lib\external.js
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\content\lib\neterror.xhtml
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\content\lib\wmpstreamer.html
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\content\modules\datastore.jsm
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\content\preferences.xml
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\content\toolbar.htm
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\content\toolbar.xul
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\content\widgets\net.vmn.www.3.Twitter.1227\bg-scalable-mdl.gif
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\content\widgets\net.vmn.www.3.Twitter.1227\bg-scalable-tl.gif
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\content\widgets\net.vmn.www.3.Twitter.1227\bg-scalable-tr.gif
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\content\widgets\net.vmn.www.3.Twitter.1227\btn-dragresize.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\content\widgets\net.vmn.www.3.Twitter.1227\btn-wide-close-down.PNG
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\content\widgets\net.vmn.www.3.Twitter.1227\btn-wide-close-over.PNG
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\content\widgets\net.vmn.www.3.Twitter.1227\btn-wide-close.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\content\widgets\net.vmn.www.3.Twitter.1227\btn-wide-maximize-down.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\content\widgets\net.vmn.www.3.Twitter.1227\btn-wide-maximize-over.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\content\widgets\net.vmn.www.3.Twitter.1227\btn-wide-maximize.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\content\widgets\net.vmn.www.3.Twitter.1227\btn-wide-minimize-down.PNG
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\content\widgets\net.vmn.www.3.Twitter.1227\btn-wide-minimize-over.PNG
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\content\widgets\net.vmn.www.3.Twitter.1227\btn-wide-minimize.PNG
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\content\widgets\net.vmn.www.3.Twitter.1227\btnarrow-next-off.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\content\widgets\net.vmn.www.3.Twitter.1227\btnarrow-next.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\content\widgets\net.vmn.www.3.Twitter.1227\btnarrow-previous-off.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\content\widgets\net.vmn.www.3.Twitter.1227\btnarrow-previous.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\content\widgets\net.vmn.www.3.Twitter.1227\navico-home.gif
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\content\widgets\net.vmn.www.3.Twitter.1227\panel.html
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\content\widgets\net.vmn.www.3.Twitter.1227\powered-mystart.gif
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\content\widgets\net.vmn.www.3.Twitter.1227\tb_icon.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\content\widgets\net.vmn.www.3.Twitter.1227\widget.js
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\content\widgets\net.vmn.www.3.Twitter.1227\widget.xml
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\content\widgets\net.vmn.www.3.YouTube.1217\bg-scalable-mdl.gif
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\content\widgets\net.vmn.www.3.YouTube.1217\bg-scalable-tl.gif
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\content\widgets\net.vmn.www.3.YouTube.1217\bg-scalable-tr.gif
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\content\widgets\net.vmn.www.3.YouTube.1217\btn-dragresize.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\content\widgets\net.vmn.www.3.YouTube.1217\btn-wide-close-down.PNG
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\content\widgets\net.vmn.www.3.YouTube.1217\btn-wide-close-over.PNG
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\content\widgets\net.vmn.www.3.YouTube.1217\btn-wide-close.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\content\widgets\net.vmn.www.3.YouTube.1217\btn-wide-maximize-down.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\content\widgets\net.vmn.www.3.YouTube.1217\btn-wide-maximize-over.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\content\widgets\net.vmn.www.3.YouTube.1217\btn-wide-maximize.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\content\widgets\net.vmn.www.3.YouTube.1217\btn-wide-minimize-down.PNG
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\content\widgets\net.vmn.www.3.YouTube.1217\btn-wide-minimize-over.PNG
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\content\widgets\net.vmn.www.3.YouTube.1217\btn-wide-minimize.PNG
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\content\widgets\net.vmn.www.3.YouTube.1217\btnarrow-next-off.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\content\widgets\net.vmn.www.3.YouTube.1217\btnarrow-next.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\content\widgets\net.vmn.www.3.YouTube.1217\btnarrow-previous-off.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\content\widgets\net.vmn.www.3.YouTube.1217\btnarrow-previous.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\content\widgets\net.vmn.www.3.YouTube.1217\navico-home.gif
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\content\widgets\net.vmn.www.3.YouTube.1217\panel.html
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\content\widgets\net.vmn.www.3.YouTube.1217\powered-mystart.gif
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\content\widgets\net.vmn.www.3.YouTube.1217\tb_icon.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\content\widgets\net.vmn.www.3.YouTube.1217\widget.js
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\content\widgets\net.vmn.www.3.YouTube.1217\widget.xml
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\bearshare.css
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\bluelite.gif
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\bluesky.gif
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\btn-search-over.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\btn-search.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\btn-settings-over.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\btn-settings.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\btn-widgets-over.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\btn-widgets.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\btn_settings.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\button-down-back-ff.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\button-down-back.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\button-down-left.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\button-down-right.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\button-down-splitter.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\button-drop-back.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\button-drop-left.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\button-drop-right.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\button-drop-splitter.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\button-hover-back-ff.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\button-hover-back.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\button-hover-left.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\button-hover-right.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\button-hover-splitter.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\ca.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\dictionary.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\divider.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\downloadcom.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\dtxlogo.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\email.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\email_on.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\games.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\graphred0.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\graphred0_5.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\grey.gif
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\headsup.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\ico-shield.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\images.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\add.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\aol.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\arrow-dn.gif
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\arrow-right.gif
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\arrow-up.gif
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\bg-btn-end.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\bg-btn-mdl.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\bg-btn-mdl_ff.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\bg-btn-start.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\bg-btnover-end.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\bg-btnover-mdl.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\bg-btnover-mdl_ff.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\bg-btnover-start.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\blank.gif
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\btnback-down-vista.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\btnback-vista.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\btnleft-down-vista.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\btnleft-vista.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\btnright-down-vista.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\btnright-vista.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\button-splitter-down-vista.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\button-splitter-vista.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\collapse.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\comcast.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\dtx.css
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\edit-back-hot.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\edit-back.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\expand.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\found.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\gmail.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\highlight.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\highlight_blue.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\highlight_cyan.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\highlight_lime.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\highlight_magenta.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\highlight_yellow.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\hotmail.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\checkmark.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\chevron.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\imap.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\lastsearch-thumb-back.gif
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\loadingMid.gif
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\lock.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\mailcom.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\menu_bg-basic.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\menu_separator_bar.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\menu_separator_white.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\menuitem-splitter.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\menuitemback-down-vista.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\menuitemback-vista.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\menuitemleft-down-vista.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\menuitemleft-vista.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\menuitemright-down-vista.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\menuitemright-vista.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\modify.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\move.gif
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\movetarget.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\panels\css\popupAbout.css
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\panels\css\popupGames.css
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\panels\css\popupWidgets.css
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\panels\footer.htm
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\panels\gamecategory.xsl
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\panels\gameData.js
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\panels\gameList.xsl
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\panels\gametype.xsl
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\panels\images\arrow-sml-drop.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\panels\images\arrow-sml.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\panels\images\arrowr-bluew5.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\panels\images\bg-aboutbox.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\panels\images\bg-btnover.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\panels\images\bg-pnl520x390.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\panels\images\btn-close-grey.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\panels\images\btn-close-greyover.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\panels\images\btn-drag.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\panels\images\btn-next-over.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\panels\images\btn-next.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\panels\images\btn-previous-over.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\panels\images\btn-previous.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\panels\images\btn-search-pnlbtm-over.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\panels\images\btn-search-pnlbtm.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\panels\images\gamethumb-on.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\panels\images\gamethumb2-over.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\panels\images\ico-calendar.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\panels\images\ico-download.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\panels\images\ico-joystick24.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\panels\images\ico-play.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\panels\images\ico-tags.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\panels\images\icon-Add.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\panels\images\icon-download.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\panels\images\icon-Info.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\panels\images\icon-play.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\panels\images\icon-shop.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\panels\images\menul-bgon.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\panels\images\menul-bgover.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\panels\images\panel-botm-noscroll.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\panels\images\scroll-bg-206.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\panels\images\scroll-bg.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\panels\images\scroll-topwin.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\panels\images\scrollb-disable.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\panels\images\scrollb-down.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\panels\images\scrollb-over.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\panels\images\scrollb.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\panels\images\scrollt-disable.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\panels\images\scrollt-down.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\panels\images\scrollt-over.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\panels\images\scrollt.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\panels\images\searchbox-pnlbtm.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\panels\images\star_x_grey.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\panels\images\star_x_orange.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\panels\images\TRUSTe_about.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\panels\images\view-detailed-on.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\panels\images\view-detailed-over.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\panels\images\view-thumb-on.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\panels\images\view-thumb-over.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\panels\images\widgets-square-16px.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\panels\images\widgets-square-24px.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\panels\popupGames.html
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\panels\popupWidgets.html
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\pop.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\radio.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\radio\css\manager.css
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\radio\css\slider.css
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\radio\images\bg-pnl.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\radio\images\btn-close-grey.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\radio\images\btn-close-greyover.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\radio\images\collapsed_button.gif
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\radio\images\expanded_button.gif
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\radio\images\ico-playstation-down.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\radio\images\ico-playstation-over.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\radio\images\ico-playstation.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\radio\images\ico-radio.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\radio\images\music-note.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\radio\images\radio-btn-pause-on.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\radio\images\radio-btn-pause.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\radio\images\radio-btn-play-on.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\radio\images\radio-btn-play.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\radio\images\radio-eq-bg.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\radio\images\radio-eq-busy.gif
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\radio\images\radio-eq-off.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\radio\images\radio-eq-on.gif
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\radio\images\radio-eq-warning.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\radio\images\radio-options-design-on.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\radio\images\radio-options-design.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\radio\images\radio-options-on.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\radio\images\radio-options.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\radio\images\radio-volume-0.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\radio\images\radio-volume-1.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\radio\images\radio-volume-2.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\radio\images\radio-volume-3.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\radio\images\radio-volume-mute.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\radio\images\scrollbar-handle.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\radio\images\scrollbar-track.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\radio\images\slider.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\radio\images\slideron.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\radio\images\track.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\radio\managerpanel.html
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\radio\volumeslider.html
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\reload.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\remove.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\rename.gif
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\resize-box.gif
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\rss.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\rsschannelback.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\RSSLogo.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\rsstabdivider.gif
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\scroll-left.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\scroll-right.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\search-go.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\search.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\text-ellipsis.xml
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\toolbarsplitter.gif
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\transparent_1px.gif
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\uwa\border_02.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\uwa\border_03.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\uwa\border_04.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\uwa\border_06.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\uwa\border_07.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\uwa\border_08.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\uwa\border_09.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\uwa\border_10.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\uwa\border_11.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\uwa\border_12.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\uwa\border_13.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\uwa\border_14.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\uwa\border_15.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\uwa\border_16.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\uwa\border_18.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\uwa\border_19.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\uwa\border_20.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\uwa\border_21.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\uwa\btn-close-grey.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\uwa\btn-close-greyover.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\uwa\close-hot.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\uwa\close-normal.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\uwa\loadingMid.gif
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\uwa\proxy.html
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\uwa\template.html
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\uwa\template.xml
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\uwa\templateFF.html
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\uwa\throbber.gif
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\weatherbutton\icons\cond999.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\weatherbutton\icons\icons.xml
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\weatherbutton\icons\na-s.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\weatherbutton\icons\na.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\weatherbutton\icons\weather.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\weatherbutton\panels\images\add.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\weatherbutton\panels\images\arrowr-bluew5.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\weatherbutton\panels\images\bg-pnl.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\weatherbutton\panels\images\bg-pnl520x350blue-whitebg.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\weatherbutton\panels\images\bg-pnl520x350blue.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\weatherbutton\panels\images\box-check.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\weatherbutton\panels\images\box-uncheck.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\weatherbutton\panels\images\btn-close-grey.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\weatherbutton\panels\images\btn-close-greyover.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\weatherbutton\panels\images\btn-delete.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\weatherbutton\panels\images\btn-search-pnlbtm.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\weatherbutton\panels\images\btnarrow-next-off.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\weatherbutton\panels\images\btnarrow-next.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\weatherbutton\panels\images\btnarrow-previous-off.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\weatherbutton\panels\images\btnarrow-previous.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\weatherbutton\panels\images\ico-hotandhumid-s.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\weatherbutton\panels\images\ico-hotandhumid.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\weatherbutton\panels\images\ico-check.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\weatherbutton\panels\images\options-weather.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\weatherbutton\panels\images\over-blue.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\weatherbutton\panels\images\over-orange.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\weatherbutton\panels\images\powered-by-weatherbug.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\weatherbutton\panels\images\powered-by-weatherbug2.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\weatherbutton\panels\images\radio-checked.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\weatherbutton\panels\images\radio-unchecked.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\weatherbutton\panels\images\searchbox-pnlbtm.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\weatherbutton\panels\images\weather-contour.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\weatherbutton\panels\popupWeather.css
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\weatherbutton\panels\popupWeather.html
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lib\yahoo.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\lichen.gif
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\logo-about.jpg
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\logo-about.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\logo-over.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\logo.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\logo_old.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\maps.bmp
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\menuseparatorback.gif
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\modify-save.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\modify.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\modifyhot.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\music.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\news.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\options\options-main.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\options\options-search.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\options\options-weather.gif
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\options\options-widgets.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\orange.gif
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\pixsy.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\relatedlinks.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\rss-collapse.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\rss-delete.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\rss-expand.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\rss-feed.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\rss-folder-remove.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\rss-folder-rename.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\rss-folder.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\rss-found.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\rss-reload.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\rss-subscribe.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\rss.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\rssback.gif
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\rsstopback.gif
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\search-over.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\search.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\searchbar\searchbar-background-left.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\searchbar\searchbar-background-middle.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\searchbar\searchbar-background-right.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\settings.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\shopping.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\siteinfo.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\skin-bluelite.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\skin-bluesky.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\skin-grey.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\skin-lichen.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\skin-orange.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\skin-yellow.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\technorati.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\throbber.gif
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\toolbarsplitter.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\video.bmp
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\weather.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\web.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\widget_allocine.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\widget_bliptv.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\widget_calcal.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\widget_calculator.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\widget_gservices.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\widget_sudoku.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\widget_todo.jpg
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\widget_todo.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\widget_trio.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\widget_uconverter.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\widgets-square-16px.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\widgets.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\wikipedia.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\yahoosearch.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\yellow.gif
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\youtube.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\chrome\skin\zoom.png
c:\progra~1\BEARSH~1\MediaBar\ToolBar\manifest.xml
c:\progra~1\BEARSH~1\MediaBar\ToolBar\uninstall.exe
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2012-01-28 do 2012-02-28 )))))))))))))))))))))))))))))))
.
.
2012-02-23 19:47 . 2012-02-23 19:47 -------- d-----w- c:\documents and settings\LocalService\Local Settings\Data aplikací\Google
2012-02-20 16:53 . 2012-01-11 19:07 3072 -c----w- c:\windows\system32\dllcache\iacenc.dll
2012-02-20 16:53 . 2012-01-11 19:07 3072 ------w- c:\windows\system32\iacenc.dll
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-01-12 17:20 . 2004-08-17 13:44 1859968 ----a-w- c:\windows\system32\win32k.sys
2012-01-12 00:19 . 2012-01-12 00:19 4448256 ----a-w- c:\windows\system32\GPhotos.scr
2011-12-17 19:42 . 2004-08-17 13:49 1469440 ------w- c:\windows\system32\inetcpl.cpl
2011-12-17 19:42 . 2004-08-17 13:49 916992 ----a-w- c:\windows\system32\wininet.dll
2011-12-17 19:42 . 2004-08-17 13:49 43520 ----a-w- c:\windows\system32\licmgr10.dll
2011-12-16 12:23 . 2004-08-17 13:44 385024 ----a-w- c:\windows\system32\html.iec
2011-11-21 04:45 . 2011-12-11 18:05 134104 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((( SnapShot@2012-02-28_17.54.10 )))))))))))))))))))))))))))))))))))))))))
.
+ 2012-02-28 19:04 . 2012-02-28 19:04 16384 c:\windows\temp\Perflib_Perfdata_4f8.dat
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\DTLite.exe" [2011-08-02 4910912]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2008-01-16 141848]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2008-01-16 166424]
"Persistence"="c:\windows\system32\igfxpers.exe" [2008-01-16 137752]
"RTHDCPL"="RTHDCPL.EXE" [2008-01-16 16384512]
"NeroCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-01-07 253672]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"FlashPlayerUpdate"="c:\windows\system32\Macromed\Flash\FlashUtil10s_ActiveX.exe" [2011-06-10 240288]
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Documents and Settings\\Vidko\\temp\\TeamViewer\\Version4\\TeamViewer.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
.
R1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\drivers\dtsoftbus01.sys [2.11.2011 18:39 232512]
.
.
------- Doplňkový sken -------
.
uStart Page = astroburn-search.com
uDefault_Search_URL = hxxp://www.google.com/ie
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: E&xportovať do programu Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.100.252
FF - ProfilePath - c:\documents and settings\Vidko\Data aplikací\Mozilla\Firefox\Profiles\0ncv88o6.default\
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2012-02-28 20:04
Windows 5.1.2600 Service Pack 3 NTFS
.
skenování skrytých procesů ...
.
skenování skrytých položek 'Po spuštění' ...
.
skenování skrytých souborů ...
.
sken byl úspešně dokončen
skryté soubory: 0
.
**************************************************************************
.
Stealth MBR rootkit/Mebroot/Sinowal/TDL4 detector 0.4.2 by Gmer, http://www.gmer.net
Windows 5.1.2600 Disk: MAXTOR_STM3160815AS rev.4.AAB -> Harddisk0\DR0 -> \Device\Ide\IdePort1 P1T1L0-5
.
device: opened successfully
user: MBR read successfully
.
Disk trace:
called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys >>UNKNOWN [0x863DCECC]<<
_asm { PUSH EBP; MOV EBP, ESP; SUB ESP, 0x1c; PUSH EBX; PUSH ESI; MOV DWORD [EBP-0x4], 0x8597c879; SUB DWORD [EBP-0x4], 0x8597c135; PUSH EDI; CALL 0xffffffffffffdf2c; }
1 ntkrnlpa!IofCallDriver[0x804EF1A6] -> \Device\Harddisk0\DR0[0x865C9AB8]
3 CLASSPNP[0xF7696FD7] -> ntkrnlpa!IofCallDriver[0x804EF1A6] -> [0x860B3398]
[0x8649A430] -> IRP_MJ_CREATE -> 0x863DCECC
kernel: MBR read successfully
_asm { XOR AX, AX; MOV SS, AX; MOV SP, 0x7c00; STI ; PUSH AX; POP ES; PUSH AX; POP DS; CLD ; MOV SI, 0x7c1b; MOV DI, 0x61b; PUSH AX; PUSH DI; MOV CX, 0x1e5; REP MOVSB ; RETF ; MOV BP, 0x7be; MOV CL, 0x4; CMP [BP+0x0], CH; JL 0x2e; JNZ 0x3a; }
detected disk devices:
\Device\Ide\IdeDeviceP1T1L0-5 -> \??\IDE#DiskMAXTOR_STM3160815AS_____________________4.AAB___#5&2f9ef5d6&0&0.1.0#{53f56307-b6bf-11d0-94f2-00a0c91efb8b} device not found
detected hooks:
\Driver\atapi DriverStartIo -> 0x863DCAF1
user & kernel MBR OK
sectors 312581806 (+255): user != kernel
Warning: possible TDL3 rootkit infection !
.
**************************************************************************
.
--------------------- Knihovny navázané na běžící procesy ---------------------
.
- - - - - - - > 'explorer.exe'(3900)
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\windows\RTHDCPL.EXE
c:\progra~1\BEARSH~1\MediaBar\Datamngr\DATAMN~1.EXE
c:\windows\system32\igfxsrvc.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\windows\system32\wbem\wmiapsrv.exe
.
**************************************************************************
.
Celkový čas: 2012-02-28 20:07:37 - počítač byl restartován
ComboFix-quarantined-files.txt 2012-02-28 19:07
.
Před spuštěním: Volných bajtů: 146 914 951 168
Po spuštění: Volných bajtů: 146 908 758 016
.-
Rudy
- Site Admin
- Příspěvky: 119515
- Registrován: 30 říj 2003 13:42
- Bydliště: Plzeň
- Kontaktovat uživatele:
Re: ESET mi hlasi virus, neviem ho odstranit
Smazáno. Ještě porosím o sken TDSSKiller: http://support.kaspersky.com/downloads/ ... killer.zip . Utilitu rozbalte, spusťte a nechte pracovat. Po ukončení skenu sem dejte log.
Dotazy a logy vkládejte pouze do vašich threadů. Soukromé zprávy, icq a e-maily neslouží k řešení vašich problémů.
Podpořte, prosím, naše fórum : https://platba.viry.cz/payment/.
Navštivte:
e-mail: rudy(zavináč)forum.viry.cz
Varování: Před odvirováním PC si udělejte zálohy svých důležitých dat (pošta, kontakty, dokumenty, fotografie, videa, hudba apod.). Virus mimo svých "viditelných" aktivit může poškodit systém!
Po dořešení vašeho problému bude vlákno zamknuto. Stejně tak tehdy, pokud bude nečinné více než 14dnů. Pokud budete chtít vlákno aktivovat, napište mi na mail uvedený výše.
Podpořte, prosím, naše fórum : https://platba.viry.cz/payment/.
Navštivte:
e-mail: rudy(zavináč)forum.viry.cz
Varování: Před odvirováním PC si udělejte zálohy svých důležitých dat (pošta, kontakty, dokumenty, fotografie, videa, hudba apod.). Virus mimo svých "viditelných" aktivit může poškodit systém!
Po dořešení vašeho problému bude vlákno zamknuto. Stejně tak tehdy, pokud bude nečinné více než 14dnů. Pokud budete chtít vlákno aktivovat, napište mi na mail uvedený výše.
Přispějete na provoz fóra?