Vírus pri spustení počítača

Zpráva

BruShEr · #1 Příspěvek od **BruShEr** » 02 bře 2010 19:43

Takže pred štyrmi dňami som ja s kamošom zháňal nejaký "hack" na jednu hru. Jeden sme našli, ale po spustení vo Winrare (bolo to zabalené) mi antivírus Avast vyhlásil, že je tam vírus, alebo niečo podobé. Najprv som váhal, ale potom som si povedal že to potom odstránil tak som to rozbalil do počítača a Avast som si vypol. Hack nefungoval tak som ho hneď odstránil. Nabudúci deň keď som skúšťal počítač tak po načítaní do windowsu mi Avast vyhodil hlášku že mám v počítači vírus. Dal som Odstrániť, ale toto mi vyskakuje odvtedy každé spustenie počítača a bojím sa že mi to celý počítač raz úplne zničí. Už som si všetky veci na počítači zálohoval a bol som odhodlaný si preinštalovať Windows, ale ešte chcem skúsiť nájsť nejaké iné riešenie ak existuje.

Tu je ešte screen toho čo mi Avast hlási:
Obrázek

A ešte log:

Logfile of random's system information tool 1.06 (written by random/random)
Run by Filip at 2010-03-02 19:16:33
Systém Microsoft Windows XP Professional Service Pack 3, v.3264
System drive C: has 54 GB (77%) free of 70 GB
Total RAM: 1535 MB (58% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:16:49, on 2. 3. 2010
Platform: Windows XP SP3, v.3264 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
D:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
D:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\SOUNDMAN.EXE
D:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Hewlett-Packard\Toolbox2.0\Apache Tomcat 4.0\webapps\Toolbox\StatusClient\StatusClient.exe
C:\Program Files\Vista Drive Icon\DrvIcon.exe
D:\Program Files\DAEMON Tools Lite\DTLite.exe
D:\Program Files\uTorrent\uTorrent.exe
C:\WINDOWS\system32\ctfmon.exe
D:\PROGRAM FILES\FRAPS\FRAPS.EXE
C:\Program Files\Hewlett-Packard\Toolbox2.0\Javasoft\JRE\1.3.1\bin\javaw.exe
D:\Program Files\LogMeIn Hamachi\hamachi-2.exe
C:\Program Files\Java\jre6\bin\jqs.exe
D:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\WINDOWS\system32\IoctlSvc.exe
C:\WINDOWS\system32\PnkBstrA.exe
D:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
C:\WINDOWS\System32\TUProgSt.exe
D:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
D:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Documents and Settings\Filip\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe
C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
C:\Documents and Settings\Filip\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Filip\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
D:\Program Files\Nero\Nero8\Nero ShowTime\ShowTime.exe
C:\Documents and Settings\Filip\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Filip\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Filip\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Filip\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Filip\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Filip\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Filip\Desktop\RSIT.exe
C:\Program Files\trend micro\Filip.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = ${URL_SEARCHPAGE}
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://search.conduit.com?SearchSource= ... =CT2086743
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R3 - URLSearchHook: PHPNukeEN Toolbar - {dd02a4eb-4afd-4d60-99d8-e67f964ca813} - C:\Program Files\PHPNukeEN\tbPHPN.dll
R3 - URLSearchHook: AstroburnBar Toolbar - {e802027b-1f2b-40bd-b307-0bd96d036835} - C:\Program Files\AstroburnBar\tbAstr.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: PHPNukeEN Toolbar - {dd02a4eb-4afd-4d60-99d8-e67f964ca813} - C:\Program Files\PHPNukeEN\tbPHPN.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: AstroburnBar Toolbar - {e802027b-1f2b-40bd-b307-0bd96d036835} - C:\Program Files\AstroburnBar\tbAstr.dll
O3 - Toolbar: DAEMON Tools Toolbar - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll
O3 - Toolbar: PHPNukeEN Toolbar - {dd02a4eb-4afd-4d60-99d8-e67f964ca813} - C:\Program Files\PHPNukeEN\tbPHPN.dll
O3 - Toolbar: AstroburnBar Toolbar - {e802027b-1f2b-40bd-b307-0bd96d036835} - C:\Program Files\AstroburnBar\tbAstr.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [avast!] D:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [StatusClient] C:\Program Files\Hewlett-Packard\Toolbox2.0\Apache Tomcat 4.0\webapps\Toolbox\StatusClient\StatusClient.exe /auto
O4 - HKLM\..\Run: [TomcatStartup] C:\Program Files\Hewlett-Packard\Toolbox2.0\hpbpsttp.exe
O4 - HKLM\..\Run: [DrvIcon] C:\Program Files\Vista Drive Icon\DrvIcon.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKCU\..\Run: [DAEMON Tools Lite] "D:\Program Files\DAEMON Tools Lite\DTLite.exe" -autorun
O4 - HKCU\..\Run: [uTorrent] "D:\Program Files\uTorrent\uTorrent.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Filip\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [AlcoholAutomount] "D:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe" /automount
O4 - HKCU\..\Run: [Fraps] D:\PROGRAM FILES\FRAPS\FRAPS.EXE
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [nltide2] cmd.exe /C rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,L,,4,N (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [nltide2] cmd.exe /C rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,L,,4,N (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: windows-kb890830-v2.13.exe
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Odeslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Od&eslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - D:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - D:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - D:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - D:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: LogMeIn Hamachi 2.0 Tunneling Engine (Hamachi2Svc) - LogMeIn Inc. - D:\Program Files\LogMeIn Hamachi\hamachi-2.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - D:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. - C:\WINDOWS\system32\IoctlSvc.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - D:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software - C:\WINDOWS\System32\TuneUpDefragService.exe
O23 - Service: TuneUp Program Statistics Service (TuneUp.ProgramStatisticsSvc) - TuneUp Software - C:\WINDOWS\System32\TUProgSt.exe

--
End of file - 9576 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\1-Click Maintenance.job
C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1614895754-1078145449-839522115-1003Core.job
C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1614895754-1078145449-839522115-1003UA.job
C:\WINDOWS\tasks\Úklid 1 kliknutím.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2009-12-21 75200]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}]
Groove GFS Browser Helper - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL [2006-10-27 2210608]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2010-01-14 41760]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{dd02a4eb-4afd-4d60-99d8-e67f964ca813}]
PHPNukeEN Toolbar - C:\Program Files\PHPNukeEN\tbPHPN.dll [2009-12-31 2349080]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2010-01-14 73728]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{e802027b-1f2b-40bd-b307-0bd96d036835}]
AstroburnBar Toolbar - C:\Program Files\AstroburnBar\tbAstr.dll [2010-02-22 2353176]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{32099AAC-C132-4136-9E9A-4E364A424E17} - DAEMON Tools Toolbar - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll [2009-11-24 953800]
{dd02a4eb-4afd-4d60-99d8-e67f964ca813} - PHPNukeEN Toolbar - C:\Program Files\PHPNukeEN\tbPHPN.dll [2009-12-31 2349080]
{e802027b-1f2b-40bd-b307-0bd96d036835} - AstroburnBar Toolbar - C:\Program Files\AstroburnBar\tbAstr.dll [2010-02-22 2353176]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"SoundMan"=C:\WINDOWS\SOUNDMAN.EXE [2005-06-20 77824]
"avast!"=D:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe [2009-11-25 81000]
"NvCplDaemon"=C:\WINDOWS\system32\NvCpl.dll [2009-11-20 12669544]
""= []
"StatusClient"=C:\Program Files\Hewlett-Packard\Toolbox2.0\Apache Tomcat 4.0\webapps\Toolbox\StatusClient\StatusClient.exe [2002-12-16 36864]
"TomcatStartup"=C:\Program Files\Hewlett-Packard\Toolbox2.0\hpbpsttp.exe [2003-03-31 155648]
"DrvIcon"=C:\Program Files\Vista Drive Icon\DrvIcon.exe [2008-04-13 49152]
"KernelFaultCheck"=C:\WINDOWS\system32\dumprep 0 -k []

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"DAEMON Tools Lite"=D:\Program Files\DAEMON Tools Lite\DTLite.exe [2009-10-30 369200]
"uTorrent"=D:\Program Files\uTorrent\uTorrent.exe [2010-01-07 289584]
"ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe [2007-12-01 15360]
"Google Update"=C:\Documents and Settings\Filip\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2010-01-04 135664]
"AlcoholAutomount"=D:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe [2009-04-24 203928]
"Fraps"=D:\PROGRAM FILES\FRAPS\FRAPS.EXE [2007-11-21 3182248]

C:\Documents and Settings\Filip\Start Menu\Programs\Startup
windows-kb890830-v2.13.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL [2006-10-27 2210608]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll, credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Hamachi2Svc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{1a3e09be-1e45-494b-9174-d7385b45bbf5}]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE"="C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook"
"C:\Program Files\Microsoft Office\Office12\GROOVE.EXE"="C:\Program Files\Microsoft Office\Office12\GROOVE.EXE:*:Enabled:Microsoft Office Groove"
"C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE"="C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:*:Enabled:Microsoft Office OneNote"
"D:\Program Files\GameSpy Arcade\Aphex.exe"="D:\Program Files\GameSpy Arcade\Aphex.exe:*:Enabled:GameSpy Arcade"
"C:\WINDOWS\system32\PnkBstrA.exe"="C:\WINDOWS\system32\PnkBstrA.exe:*:Enabled:PnkBstrA"
"C:\WINDOWS\system32\PnkBstrB.exe"="C:\WINDOWS\system32\PnkBstrB.exe:*:Enabled:PnkBstrB"
"D:\Program Files\Activision\Call of Duty 4 - Modern Warfare\iw3mp.exe"="D:\Program Files\Activision\Call of Duty 4 - Modern Warfare\iw3mp.exe:*:Enabled:Call of Duty(R) 4 - Modern Warfare(TM) "
"D:\Program Files\Activision\Modern Warfare 2\iw4mp.exe"="D:\Program Files\Activision\Modern Warfare 2\iw4mp.exe:*:Enabled:iw4mp"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"D:\Program Files\uTorrent\uTorrent.exe"="D:\Program Files\uTorrent\uTorrent.exe:*:Enabled:µTorrent"
"D:\Program Files\Ascaron Entertainment\Sacred Gold\gameserver.exe"="D:\Program Files\Ascaron Entertainment\Sacred Gold\gameserver.exe:*:Enabled:Sacred Gameserver"
"D:\Program Files\Ascaron Entertainment\Sacred Gold\sacred.exe"="D:\Program Files\Ascaron Entertainment\Sacred Gold\sacred.exe:*:Enabled:Sacred"
"C:\Program Files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe"="C:\Program Files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe:*:Enabled:Adobe CSI CS4"
"C:\Program Files\Java\jre6\bin\javaw.exe"="C:\Program Files\Java\jre6\bin\javaw.exe:*:Enabled:Java(TM) Platform SE binary"
"C:\Program Files\Hewlett-Packard\Toolbox2.0\Javasoft\JRE\1.3.1\bin\javaw.exe"="C:\Program Files\Hewlett-Packard\Toolbox2.0\Javasoft\JRE\1.3.1\bin\javaw.exe:*:Enabled:javaw"
"D:\Program Files\Mass Effect\Binaries\MassEffect.exe"="D:\Program Files\Mass Effect\Binaries\MassEffect.exe:*:Enabled:Mass Effect Game"
"D:\Program Files\Mass Effect\MassEffectLauncher.exe"="D:\Program Files\Mass Effect\MassEffectLauncher.exe:*:Enabled:Mass Effect Launcher"
"D:\Program Files\Electronic Arts\Battlefield Bad Company 2 - BETA\BFBC2BetaUpdater.exe"="D:\Program Files\Electronic Arts\Battlefield Bad Company 2 - BETA\BFBC2BetaUpdater.exe:*:Enabled:Battlefield Bad Company 2 - BETA"
"D:\Program Files\Eidos\Batman Arkham Asylum\Binaries\ShippingPC-BmGame.exe"="D:\Program Files\Eidos\Batman Arkham Asylum\Binaries\ShippingPC-BmGame.exe:*:Enabled:Batman: Arkham Asylum"
"D:\Program Files\Electronic Arts\Battlefield Bad Company 2 - BETA\BFBC2Game.exe"="D:\Program Files\Electronic Arts\Battlefield Bad Company 2 - BETA\BFBC2Game.exe:*:Enabled:EA Battlefield: Bad Company™ 2 - BETA"
"D:\Program Files\Steam\Steam.exe"="D:\Program Files\Steam\Steam.exe:*:Enabled:Steam"
"D:\Program Files\Steam\steamapps\common\aliens vs predator demo\AvP.exe"="D:\Program Files\Steam\steamapps\common\aliens vs predator demo\AvP.exe:*:Enabled:Aliens vs Predator Demo"
"D:\Program Files\Electronic Arts\Dead Space\Dead Space.exe"="D:\Program Files\Electronic Arts\Dead Space\Dead Space.exe:*:Enabled:Dead Space ™"
"D:\Program Files\EA GAMES\Battlefield 2\BF2.exe"="D:\Program Files\EA GAMES\Battlefield 2\BF2.exe:*:Enabled:Battlefield 2"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{8381a866-22ab-11df-a5b6-0011d8c084b1}]
shell\AutoRun\command - K:\Autorun.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{938e5bb4-f913-11de-9cbc-adad299431d3}]
shell\AutoRun\command - dhrhyje.bat
shell\open\command - dhrhyje.bat

======List of files/folders created in the last 1 months======

2010-03-02 19:16:33 ----D---- C:\rsit
2010-03-02 19:16:33 ----D---- C:\Program Files\trend micro
2010-02-26 13:18:16 ----A---- C:\WINDOWS\system32\d3dx9.dll
2010-02-26 13:18:16 ----A---- C:\WINDOWS\system32\D3DX81ab.dll
2010-02-26 12:58:56 ----D---- C:\Program Files\AstroburnBar
2010-02-26 12:58:30 ----D---- C:\Documents and Settings\Filip\Application Data\Astroburn Lite
2010-02-26 12:58:22 ----D---- C:\Documents and Settings\All Users\Application Data\Astroburn Lite
2010-02-24 14:29:52 ----A---- C:\WINDOWS\system32\TUKernel.exe
2010-02-24 12:21:19 ----A---- C:\WINDOWS\system32\TUProgSt.exe
2010-02-24 12:21:18 ----A---- C:\WINDOWS\system32\uxtuneup.dll
2010-02-24 12:21:18 ----A---- C:\WINDOWS\system32\TuneUpDefragService.exe
2010-02-24 12:09:50 ----D---- C:\Documents and Settings\Filip\Application Data\TuneUp Software
2010-02-24 12:09:29 ----D---- C:\Documents and Settings\All Users\Application Data\TuneUp Software
2010-02-24 12:09:28 ----D---- C:\Program Files\TuneUp Utilities 2009
2010-02-24 12:09:09 ----SHD---- C:\Documents and Settings\All Users\Application Data\{55A29068-F2CE-456C-9148-C869879E2357}
2010-02-24 11:29:03 ----D---- C:\Documents and Settings\All Users\Application Data\Fallout3
2010-02-21 10:29:23 ----D---- C:\Documents and Settings\Filip\Application Data\Mozilla
2010-02-20 17:22:20 ----D---- C:\WINDOWS\WBEM
2010-02-20 17:21:46 ----HDC---- C:\WINDOWS\ie8
2010-02-16 17:16:23 ----D---- C:\Documents and Settings\Filip\Application Data\AnvSoft
2010-02-12 13:42:34 ----D---- C:\Documents and Settings\Filip\Application Data\ICQ
2010-02-11 18:02:31 ----D---- C:\Documents and Settings\Filip\Application Data\OpenOffice.org
2010-02-08 17:10:39 ----D---- C:\Documents and Settings\Filip\Application Data\Media Player Classic
2010-02-08 17:10:00 ----A---- C:\WINDOWS\system32\unrar.dll
2010-02-08 17:09:59 ----A---- C:\WINDOWS\avisplitter.ini
2010-02-08 17:09:57 ----A---- C:\WINDOWS\system32\yv12vfw.dll
2010-02-08 17:09:57 ----A---- C:\WINDOWS\system32\xvidvfw.dll
2010-02-08 17:09:57 ----A---- C:\WINDOWS\system32\xvidcore.dll
2010-02-08 17:09:54 ----A---- C:\WINDOWS\system32\ff_vfw.dll.manifest
2010-02-08 17:09:54 ----A---- C:\WINDOWS\system32\ff_vfw.dll
2010-02-07 13:16:18 ----D---- C:\Documents and Settings\Filip\Application Data\Ubisoft
2010-02-07 13:08:33 ----D---- C:\Documents and Settings\All Users\Application Data\Ubisoft
2010-02-06 12:53:01 ----D---- C:\Program Files\Conduit
2010-02-06 12:53:00 ----D---- C:\Program Files\PHPNukeEN

======List of files/folders modified in the last 1 months======

2010-03-02 19:16:33 ----RD---- C:\Program Files
2010-03-02 19:16:14 ----D---- C:\WINDOWS\Prefetch
2010-03-02 19:14:21 ----A---- C:\WINDOWS\NeroDigital.ini
2010-03-02 19:08:25 ----D---- C:\Documents and Settings\Filip\Application Data\uTorrent
2010-03-02 17:08:55 ----D---- C:\WINDOWS\Temp
2010-03-02 17:08:40 ----D---- C:\WINDOWS
2010-03-02 17:08:29 ----AD---- C:\Documents and Settings\All Users\Application Data\TEMP
2010-03-02 17:07:04 ----A---- C:\WINDOWS\SchedLgU.Txt
2010-03-02 16:36:18 ----D---- C:\WINDOWS\Debug
2010-03-01 17:36:55 ----D---- C:\WINDOWS\system32\config
2010-03-01 17:22:58 ----D---- C:\WINDOWS\Minidump
2010-03-01 17:22:44 ----SHD---- C:\System Volume Information
2010-03-01 17:22:44 ----D---- C:\WINDOWS\system32\Restore
2010-02-26 21:09:43 ----D---- C:\WINDOWS\system32\CatRoot2
2010-02-26 14:24:34 ----D---- C:\WINDOWS\system32\DirectX
2010-02-26 14:24:33 ----RSD---- C:\WINDOWS\assembly
2010-02-26 14:24:24 ----HD---- C:\WINDOWS\inf
2010-02-26 14:14:36 ----HD---- C:\Program Files\InstallShield Installation Information
2010-02-26 13:18:16 ----D---- C:\WINDOWS\system32
2010-02-25 09:48:13 ----RSD---- C:\WINDOWS\Fonts
2010-02-25 08:23:51 ----SHD---- C:\WINDOWS\Installer
2010-02-24 15:01:59 ----D---- C:\WINDOWS\WinSxS
2010-02-24 14:29:53 ----RSH---- C:\boot.ini
2010-02-24 12:29:01 ----SD---- C:\WINDOWS\Tasks
2010-02-24 12:27:43 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2010-02-24 12:27:39 ----D---- C:\WINDOWS\system32\inetsrv
2010-02-21 07:14:18 ----D---- C:\Program Files\Common Files\InstallShield
2010-02-20 18:14:39 ----D---- C:\WINDOWS\network diagnostic
2010-02-20 17:50:10 ----RSHDC---- C:\WINDOWS\system32\dllcache
2010-02-20 17:50:10 ----D---- C:\WINDOWS\Media
2010-02-20 17:50:10 ----D---- C:\WINDOWS\Help
2010-02-20 17:50:10 ----D---- C:\Program Files\Internet Explorer
2010-02-20 17:22:20 ----D---- C:\WINDOWS\system32\en-us
2010-02-14 11:35:09 ----SD---- C:\Documents and Settings\Filip\Application Data\Microsoft
2010-02-08 15:56:38 ----A---- C:\WINDOWS\system32\MsiExec.exe.log
2010-02-06 08:27:22 ----D---- C:\Program Files\Google
2010-02-04 17:47:42 ----A---- C:\WINDOWS\system32\PnkBstrB.exe
2010-02-04 16:48:42 ----D---- C:\WINDOWS\Logs

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 Aavmker4;avast! Asynchronous Virus Monitor; C:\WINDOWS\system32\drivers\Aavmker4.sys [2009-11-25 27408]
R1 aswSP;avast! Self Protection; C:\WINDOWS\system32\drivers\aswSP.sys [2009-11-25 114768]
R1 aswTdi;avast! Network Shield Support; C:\WINDOWS\system32\drivers\aswTdi.sys [2009-11-25 48560]
R2 adfs;adfs; C:\WINDOWS\system32\drivers\adfs.sys [2008-08-14 74720]
R2 aswFsBlk;aswFsBlk; C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2009-11-25 20560]
R2 aswMon2;avast! Standard Shield Support; C:\WINDOWS\system32\drivers\aswMon2.sys [2009-11-25 94160]
R3 ALCXWDM;Service for Realtek AC97 Audio (WDM); C:\WINDOWS\system32\drivers\ALCXWDM.SYS [2005-06-20 2324480]
R3 Arp1394;1394 ARP Client Protocol; C:\WINDOWS\system32\DRIVERS\arp1394.sys [2007-11-30 60800]
R3 aswRdr;aswRdr; C:\WINDOWS\system32\drivers\aswRdr.sys [2009-11-25 23120]
R3 hamachi;Hamachi Network Interface; C:\WINDOWS\system32\DRIVERS\hamachi.sys [2009-09-23 26176]
R3 HidUsb;Microsoft HID Class Driver; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2007-11-30 10368]
R3 mouhid;Mouse HID Driver; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-08-17 12160]
R3 ms_mpu401;Microsoft MPU-401 MIDI UART Driver; C:\WINDOWS\system32\drivers\msmpu401.sys [2001-08-17 2944]
R3 NIC1394;1394 Net Driver; C:\WINDOWS\system32\DRIVERS\nic1394.sys [2007-11-30 61824]
R3 nv;nv; C:\WINDOWS\system32\DRIVERS\nv4_mini.sys [2009-11-21 10235968]
R3 NVENETFD;NVIDIA nForce Networking Controller Driver; C:\WINDOWS\system32\DRIVERS\NVENETFD.sys [2005-04-06 33536]
R3 nvnetbus;NVIDIA Network Bus Enumerator; C:\WINDOWS\system32\DRIVERS\nvnetbus.sys [2005-04-06 12928]
R3 usbehci;Microsoft USB 2.0 Enhanced Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2007-11-30 30208]
R3 usbhub;USB2 Enabled Hub; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2007-11-30 59520]
R3 usbohci;Microsoft USB Open Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbohci.sys [2007-11-30 17152]
R3 usbstor;USB Mass Storage Driver; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2007-11-30 26368]
S3 a7jzo29t;a7jzo29t; C:\WINDOWS\system32\drivers\a7jzo29t.sys []
S3 acckf8vm;acckf8vm; C:\WINDOWS\system32\drivers\acckf8vm.sys []
S3 Dot4;MS IEEE-1284.4 Driver; C:\WINDOWS\system32\DRIVERS\Dot4.sys [2007-11-30 206976]
S3 Dot4Print;Print Class Driver for IEEE-1284.4; C:\WINDOWS\system32\DRIVERS\Dot4Prt.sys [2001-08-17 12928]
S3 dot4usb;MS Dot4USB Filter Dot4USB Filter; C:\WINDOWS\system32\DRIVERS\dot4usb.sys [2001-08-17 23808]
S3 WudfPf;Windows Driver Foundation - User-mode Driver Framework Platform Driver; C:\WINDOWS\system32\DRIVERS\WudfPf.sys [2006-09-28 77568]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-28 82944]
S4 IntelIde;IntelIde; C:\WINDOWS\system32\drivers\IntelIde.sys []

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 aswUpdSv;avast! iAVS4 Control Service; D:\Program Files\Alwil Software\Avast4\aswUpdSv.exe [2009-11-25 18752]
R2 avast! Antivirus;avast! Antivirus; D:\Program Files\Alwil Software\Avast4\ashServ.exe [2009-11-25 138680]
R2 Hamachi2Svc;LogMeIn Hamachi 2.0 Tunneling Engine; D:\Program Files\LogMeIn Hamachi\hamachi-2.exe [2009-10-29 1074568]
R2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2010-01-14 153376]
R2 Nero BackItUp Scheduler 3;Nero BackItUp Scheduler 3; D:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe [2008-12-02 877864]
R2 NVSvc;NVIDIA Display Driver Service; C:\WINDOWS\system32\nvsvc32.exe [2009-11-20 154216]
R2 PLFlash DeviceIoControl Service;PLFlash DeviceIoControl Service; C:\WINDOWS\system32\IoctlSvc.exe [2006-12-19 81920]
R2 PnkBstrA;PnkBstrA; C:\WINDOWS\system32\PnkBstrA.exe [2010-01-04 75064]
R2 StarWindServiceAE;StarWind AE Service; D:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe [2007-05-28 275968]
R2 TuneUp.ProgramStatisticsSvc;TuneUp Program Statistics Service; C:\WINDOWS\System32\TUProgSt.exe [2010-02-24 603904]
R2 UxTuneUp;TuneUp Theme Extension; C:\WINDOWS\System32\svchost.exe [2007-12-01 14336]
R3 avast! Mail Scanner;avast! Mail Scanner; D:\Program Files\Alwil Software\Avast4\ashMaiSv.exe [2009-11-25 254040]
R3 avast! Web Scanner;avast! Web Scanner; D:\Program Files\Alwil Software\Avast4\ashWebSv.exe [2009-11-25 352920]
R3 NMIndexingService;NMIndexingService; C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe [2008-12-12 537896]
S2 gupdate;Google Update Service (gupdate); C:\Program Files\Google\Update\GoogleUpdate.exe [2010-01-16 135664]
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2008-07-25 34312]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632]
S3 FLEXnet Licensing Service;FLEXnet Licensing Service; C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe [2010-01-08 655624]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; C:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104]
S3 IDriverT;InstallDriver Table Manager; C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [2005-04-04 69632]
S3 idsvc;Windows CardSpace; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664]
S3 Microsoft Office Groove Audit Service;Microsoft Office Groove Audit Service; C:\Program Files\Microsoft Office\Office12\GrooveAuditService.exe [2006-10-27 65824]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2006-10-26 441136]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 Pml Driver HPZ12;Pml Driver HPZ12; C:\WINDOWS\system32\HPZipm12.exe [2002-08-01 65536]
S3 TuneUp.Defrag;TuneUp Drive Defrag Service; C:\WINDOWS\System32\TuneUpDefragService.exe [2010-02-24 360192]
S3 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2007-12-01 14336]
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2008-07-29 132096]

-----------------EOF-----------------

Ďakujem za všetky rady.

#2 Příspěvek od **Caroprd111** » 02 bře 2010 19:46

Zdravím

Na logu se pracuje, prosím o strpení.

Doufám, že jste se poučil a příště takové věci nebudete stahovat.

#3 Příspěvek od **Caroprd111** » 02 bře 2010 19:50

Stáhněte a uložte, nejlépe na plochu http://download.bleepingcomputer.com/sUBs/ComboFix.exe

Obrázek

Vypněte všechny rezidentní bezpečnostní programy - firewally, antiviry, antispywary

Obrázek

Vložte do PC všechny flash disky, které používáte.

Obrázek

Spusťte aplikaci pod účtem s oprávněním Administrátora (Správce), ihned po startu se zobrází stránka s licenčnímy podmínkami, pokračujte stisknutím tlačítka "Ano"

Obrázek

Dále postupujte dle pokynů, během scanu nespouštějte jiné aplikace a neklikejte do zobrazujícího se okna

Scan by měl trvat okolo 5 - 10 minut, po dokončení Combofix zobrazí log C:\ComboFix.txt , který sem vložte.

Obrázek

Během skenování může být počítač restartován.

BruShEr · #4 Příspěvek od **BruShEr** » 03 bře 2010 14:29

ComboFix

ComboFix 10-03-02.08 - Filip . 03. 2010 14:15:57.1.1 - x86
Systém Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1535.1133 [GMT 1:00]
Running from: c:\documents and settings\Filip\Desktop\ComboFix.exe
AV: avast! antivirus 4.8.1368 [VPS 100303-0] *On-access scanning enabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat
c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat

----- BITS: Possible infected sites -----

hxxp://armmf.adobe.com
.
((((((((((((((((((((((((( Files Created from 2010-02-03 to 2010-03-03 )))))))))))))))))))))))))))))))
.

2010-03-02 18:16 . 2010-03-02 18:16 -------- d-----w- C:\rsit
2010-03-02 18:16 . 2010-03-02 18:16 -------- d-----w- c:\program files\trend micro
2010-02-26 12:18 . 2009-11-03 12:07 679936 ----a-w- c:\windows\system32\D3DX81ab.dll
2010-02-26 12:18 . 2009-11-03 12:07 1970176 ----a-w- c:\windows\system32\d3dx9.dll
2010-02-26 11:58 . 2010-02-26 11:58 -------- d-sh--w- c:\documents and settings\Filip\IECompatCache
2010-02-26 11:58 . 2010-02-26 11:59 -------- d-----w- c:\documents and settings\Filip\Local Settings\Application Data\AstroburnBar
2010-02-26 11:58 . 2010-02-26 11:58 -------- d-----w- c:\program files\AstroburnBar
2010-02-26 11:58 . 2010-02-26 11:58 -------- d-----w- c:\documents and settings\Filip\Application Data\Astroburn Lite
2010-02-26 11:58 . 2010-02-26 12:08 -------- d-----w- c:\documents and settings\All Users\Application Data\Astroburn Lite
2010-02-24 14:20 . 2010-02-24 14:21 -------- d-----w- c:\documents and settings\Filip\Local Settings\Application Data\Fallout3
2010-02-24 14:07 . 2010-02-24 14:07 -------- d-----w- c:\documents and settings\Filip\Local Settings\Application Data\Electronic Arts
2010-02-24 13:31 . 2010-02-24 13:31 7407104 ----a-w- c:\documents and settings\All Users\Application Data\TuneUp Software\TuneUp Utilities\WinStyler\tu_logonui.exe
2010-02-24 13:29 . 2010-02-24 13:29 2344704 ----a-w- c:\windows\system32\TUKernel.exe
2010-02-24 11:21 . 2010-02-24 11:21 603904 ----a-w- c:\windows\system32\TUProgSt.exe
2010-02-24 11:21 . 2010-02-24 11:21 360192 ----a-w- c:\windows\system32\TuneUpDefragService.exe
2010-02-24 11:21 . 2008-12-11 12:31 27904 ----a-w- c:\windows\system32\uxtuneup.dll
2010-02-24 11:09 . 2010-02-24 11:09 -------- d-----w- c:\documents and settings\Filip\Application Data\TuneUp Software
2010-02-24 11:09 . 2010-02-24 11:09 -------- d-----w- c:\documents and settings\All Users\Application Data\TuneUp Software
2010-02-24 11:09 . 2010-02-24 11:21 -------- d-----w- c:\program files\TuneUp Utilities 2009
2010-02-24 11:09 . 2010-02-24 11:09 -------- d-sh--w- c:\documents and settings\All Users\Application Data\{55A29068-F2CE-456C-9148-C869879E2357}
2010-02-24 10:29 . 2005-11-14 07:24 121064 ------r- c:\documents and settings\All Users\Application Data\Fallout3\setup.exe
2010-02-24 10:29 . 2010-02-24 10:29 -------- d-----w- c:\documents and settings\All Users\Application Data\Fallout3
2010-02-21 09:29 . 2010-02-21 09:29 0 ----a-w- c:\windows\nsreg.dat
2010-02-21 09:29 . 2010-02-21 09:29 -------- d-----w- c:\documents and settings\Filip\Local Settings\Application Data\Mozilla
2010-02-20 16:52 . 2010-02-20 16:52 -------- d-sh--w- c:\documents and settings\Filip\PrivacIE
2010-02-20 16:50 . 2010-02-20 16:50 -------- d-sh--w- c:\documents and settings\Filip\IETldCache
2010-02-20 16:21 . 2010-02-20 16:22 -------- dc-h--w- c:\windows\ie8
2010-02-16 16:16 . 2010-02-16 16:16 -------- d-----w- c:\documents and settings\Filip\Application Data\AnvSoft
2010-02-12 12:42 . 2010-02-21 06:11 -------- d-----w- c:\documents and settings\Filip\Application Data\ICQ
2010-02-12 12:42 . 2010-02-12 12:42 -------- d-----w- c:\documents and settings\Filip\Local Settings\Application Data\AOL
2010-02-11 17:02 . 2010-02-24 10:05 1 ----a-w- c:\documents and settings\Filip\Application Data\OpenOffice.org\3\user\uno_packages\cache\stamp.sys
2010-02-11 17:02 . 2010-02-11 17:02 -------- d-----w- c:\documents and settings\Filip\Application Data\OpenOffice.org
2010-02-08 16:10 . 2010-02-08 16:11 -------- d-----w- c:\documents and settings\Filip\Application Data\Media Player Classic
2010-02-08 16:10 . 2009-12-12 14:15 178176 ----a-w- c:\windows\system32\unrar.dll
2010-02-08 16:09 . 2009-05-29 21:37 205824 ----a-w- c:\windows\system32\xvidvfw.dll
2010-02-08 16:09 . 2009-05-29 21:31 881664 ----a-w- c:\windows\system32\xvidcore.dll
2010-02-08 16:09 . 2004-01-25 16:18 217088 ----a-w- c:\windows\system32\yv12vfw.dll
2010-02-08 16:09 . 2010-01-05 18:00 85504 ----a-w- c:\windows\system32\ff_vfw.dll
2010-02-07 12:16 . 2010-02-07 12:16 -------- d-----w- c:\documents and settings\Filip\Application Data\Ubisoft
2010-02-07 12:08 . 2010-02-07 12:08 -------- d-----w- c:\documents and settings\All Users\Application Data\Ubisoft
2010-02-06 11:53 . 2010-02-20 16:33 -------- d-----w- c:\documents and settings\Filip\Local Settings\Application Data\PHPNukeEN
2010-02-06 11:53 . 2010-02-06 11:53 -------- d-----w- c:\program files\Conduit
2010-02-06 11:53 . 2010-02-06 11:53 -------- d-----w- c:\documents and settings\Filip\Local Settings\Application Data\Conduit
2010-02-06 11:53 . 2010-02-06 11:53 -------- d-----w- c:\program files\PHPNukeEN
2010-02-04 15:51 . 2010-02-04 15:51 -------- d-----w- c:\documents and settings\Filip\Local Settings\Application Data\AliensVsPredator
2010-02-02 08:30 . 2010-02-02 08:31 -------- d-----w- c:\program files\Microsoft Games for Windows - LIVE
2010-02-02 08:30 . 2010-02-02 08:30 -------- d-----w- c:\windows\system32\xlive

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-03-03 13:11 . 2010-01-04 09:37 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2010-03-03 13:08 . 2010-01-07 16:06 -------- d-----w- c:\documents and settings\Filip\Application Data\uTorrent
2010-02-26 13:14 . 2010-01-04 09:34 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-02-25 08:48 . 2010-01-04 09:29 93864 ----a-w- c:\documents and settings\Filip\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-02-21 06:14 . 2010-01-04 09:33 -------- d-----w- c:\program files\Common Files\InstallShield
2010-02-06 07:27 . 2010-01-15 14:26 -------- d-----w- c:\program files\Google
2010-02-04 16:47 . 2010-01-04 12:43 215128 ----a-w- c:\windows\system32\PnkBstrB.exe
2010-02-04 16:38 . 2010-01-04 12:44 139128 ----a-w- c:\windows\system32\drivers\PnkBstrK.sys
2010-01-31 17:43 . 2010-01-26 19:20 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard
2010-01-31 17:43 . 2010-01-26 19:20 -------- d-----w- c:\program files\AGEIA Technologies
2010-01-27 19:47 . 2010-01-05 08:31 756792 ----a-w- c:\documents and settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
2010-01-27 16:21 . 2010-01-08 12:07 -------- d-----w- c:\program files\Electronic Arts
2010-01-25 16:07 . 2010-01-08 14:24 -------- d-----w- c:\program files\Common Files\Adobe
2010-01-23 16:15 . 2010-01-23 16:15 -------- d-----w- c:\program files\Vista Drive Icon
2010-01-23 09:35 . 2010-01-23 09:35 -------- d-----w- c:\program files\Common Files\BioWare
2010-01-23 09:34 . 2010-01-04 09:36 -------- d-----w- c:\documents and settings\Filip\Application Data\DAEMON Tools Lite
2010-01-23 08:44 . 2010-01-23 08:44 -------- d-----w- c:\program files\Common Files\Adobe AIR
2010-01-23 08:43 . 2010-01-23 08:44 38784 ----a-w- c:\documents and settings\Filip\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe
2010-01-23 08:43 . 2010-01-23 08:44 38784 ----a-w- c:\documents and settings\Default User\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe
2010-01-14 16:00 . 2010-01-14 16:00 45056 ----a-w- c:\windows\NCUNINST.EXE
2010-01-14 15:59 . 2010-01-14 15:59 -------- d-----w- c:\program files\Hewlett-Packard
2010-01-14 15:57 . 2010-01-14 15:57 -------- d-----w- c:\program files\Common Files\SWF Studio
2010-01-14 13:33 . 2010-01-14 13:33 411368 ----a-w- c:\windows\system32\deploytk.dll
2010-01-14 13:33 . 2010-01-14 13:33 -------- d-----w- c:\program files\Java
2010-01-14 13:33 . 2010-01-14 13:33 152576 ----a-w- c:\documents and settings\Filip\Application Data\Sun\Java\jre1.6.0_15\lzma.dll
2010-01-11 14:46 . 2010-01-11 14:45 -------- d-----w- c:\program files\NVIDIA Corporation
2010-01-11 14:45 . 2010-01-11 14:45 -------- d-----w- c:\documents and settings\All Users\Application Data\NVIDIA Corporation
2010-01-08 14:42 . 2010-01-08 14:42 -------- d-----w- c:\documents and settings\All Users\Application Data\FLEXnet
2010-01-08 14:34 . 2010-01-08 14:34 -------- d-----w- c:\program files\Adobe Media Player
2010-01-08 14:27 . 2010-01-08 14:27 -------- d-----w- c:\program files\Common Files\Macrovision Shared
2010-01-08 11:25 . 2010-01-08 11:25 1470 ----a-w- c:\windows\system32\ealregsnapshot1.reg
2010-01-08 08:49 . 2010-01-08 08:49 -------- d-----w- c:\documents and settings\All Users\Application Data\Wideload
2010-01-08 08:49 . 2010-01-08 08:49 -------- d-----w- c:\program files\Common Files\DirectX
2010-01-06 18:31 . 2010-01-06 17:31 -------- d-----w- c:\documents and settings\All Users\Application Data\Norton
2010-01-06 17:31 . 2010-01-06 17:31 -------- d-----w- c:\documents and settings\All Users\Application Data\Symantec
2010-01-06 17:31 . 2010-01-06 17:31 -------- d-----w- c:\documents and settings\All Users\Application Data\NortonInstaller
2010-01-06 14:32 . 2010-01-06 14:31 -------- d-----w- c:\program files\DivX
2010-01-06 14:31 . 2010-01-06 14:31 -------- d-----w- c:\program files\Common Files\DivX Shared
2010-01-05 09:36 . 2010-01-05 09:36 1700352 ----a-w- c:\windows\system32\gdiplus.dll
2010-01-05 09:21 . 2010-01-05 09:21 -------- d--h--r- c:\documents and settings\Filip\Application Data\SecuROM
2010-01-05 08:31 . 2010-01-04 10:37 -------- d-----w- c:\program files\MSBuild
2010-01-05 08:28 . 2010-01-05 08:28 -------- d-----w- c:\program files\Reference Assemblies
2010-01-05 08:17 . 2010-01-04 09:23 166455 ----a-w- c:\windows\pchealth\helpctr\OfflineCache\index.dat
2010-01-05 08:17 . 2010-01-04 09:23 5938 ----a-w- c:\windows\pchealth\helpctr\PackageStore\SkuStore.bin
2010-01-04 13:42 . 2010-01-04 12:43 75064 ----a-w- c:\windows\system32\PnkBstrA.exe
2010-01-04 13:24 . 2010-01-04 12:44 22328 ----a-w- c:\documents and settings\Filip\Application Data\PnkBstrK.sys
2010-01-04 13:24 . 2010-01-04 12:44 22328 ----a-w- c:\documents and settings\Filip\Application Data\PnkBstrK.sys
2010-01-04 10:38 . 2010-01-04 10:33 -------- d-----w- c:\documents and settings\All Users\Application Data\Microsoft Help
2010-01-04 10:37 . 2010-01-04 10:37 -------- d-----w- c:\program files\Microsoft Works
2010-01-04 10:20 . 2010-01-04 10:20 -------- d-----w- c:\documents and settings\Filip\Application Data\Nero
2010-01-04 10:19 . 2010-01-04 10:18 -------- d-----w- c:\program files\Common Files\Nero
2010-01-04 10:18 . 2010-01-04 10:18 -------- d-----w- c:\documents and settings\All Users\Application Data\Nero
2010-01-04 09:43 . 2010-01-04 09:24 8972 ----a-w- c:\windows\pchealth\helpctr\Config\Cntstore.bin
2010-01-04 09:36 . 2010-01-04 09:36 -------- d-----w- c:\program files\DAEMON Tools Toolbar
2010-01-04 09:36 . 2010-01-04 09:36 691696 ----a-w- c:\windows\system32\drivers\sptd.sys
2010-01-04 09:36 . 2010-01-04 09:36 -------- d-----w- c:\documents and settings\All Users\Application Data\DAEMON Tools Lite
2010-01-04 09:34 . 2010-01-04 09:34 -------- d-----w- c:\program files\Realtek Sound Manager
2010-01-04 09:34 . 2010-01-04 09:34 -------- d-----w- c:\program files\AvRack
2010-01-04 09:34 . 2010-01-04 09:34 -------- d-----w- c:\program files\Realtek AC97
2010-01-04 09:24 . 2010-01-04 09:24 -------- d-----w- c:\program files\microsoft frontpage
2010-01-04 09:22 . 2010-01-04 09:22 21640 ----a-w- c:\windows\system32\emptyregdb.dat
.

------- Sigcheck -------

[7] 2007-11-30 . 13CFBF3DD054291AF3E9B040D0B5C8A7 . 2188928 . . [5.1.2600.3264] . . c:\windows\ServicePackFiles\i386\ntoskrnl.exe
[-] 2007-11-30 . 670836F9D2157358E9CF4DF9DFFCE693 . 2195584 . . [5.1.2600.3264] . . c:\windows\system32\ntoskrnl.exe
[7] 2007-11-30 . 13CFBF3DD054291AF3E9B040D0B5C8A7 . 2188928 . . [5.1.2600.3264] . . c:\windows\system32\VITrans\ntoskrnl.exe
[-] 2006-11-20 . 28187802B7C368C0D3AEF7D4C382AABB . 2179456 . . [5.1.2600.2622] . . c:\windows\$NtServicePackUninstall$\ntoskrnl.exe

[-] 2007-11-30 . 8834C481D4A06F0CF970AC4EAC2DEF12 . 1423872 . . [6.00.2900.3264] . . c:\windows\explorer.exe
[7] 2007-11-30 . E0EE428F4777A3CD8760BAD61F87ABED . 1033728 . . [6.00.2900.3264] . . c:\windows\ServicePackFiles\i386\explorer.exe
[7] 2007-11-30 . E0EE428F4777A3CD8760BAD61F87ABED . 1033728 . . [6.00.2900.3264] . . c:\windows\system32\VITrans\explorer.exe
[7] 2004-08-04 . A0732187050030AE399B241436565E64 . 1032192 . . [6.00.2900.2180] . . c:\windows\$NtServicePackUninstall$\explorer.exe

[7] 2007-11-30 . A809F109717BCC7DDD72E8715998ADD8 . 2065792 . . [5.1.2600.3264] . . c:\windows\ServicePackFiles\i386\ntkrnlpa.exe
[-] 2007-11-30 . 6089E53E8E9AC689C6B5DE4A78984D3A . 2072448 . . [5.1.2600.3264] . . c:\windows\system32\ntkrnlpa.exe
[7] 2007-11-30 . A809F109717BCC7DDD72E8715998ADD8 . 2065792 . . [5.1.2600.3264] . . c:\windows\system32\VITrans\ntkrnlpa.exe
[-] 2006-11-20 . D8ABA3EAB509627E707A3B14F00FBB6B . 2056832 . . [5.1.2600.2622] . . c:\windows\$NtServicePackUninstall$\ntkrnlpa.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{dd02a4eb-4afd-4d60-99d8-e67f964ca813}"= "c:\program files\PHPNukeEN\tbPHPN.dll" [2009-12-31 2349080]
"{e802027b-1f2b-40bd-b307-0bd96d036835}"= "c:\program files\AstroburnBar\tbAstr.dll" [2010-02-22 2353176]

[HKEY_CLASSES_ROOT\clsid\{dd02a4eb-4afd-4d60-99d8-e67f964ca813}]

[HKEY_CLASSES_ROOT\clsid\{e802027b-1f2b-40bd-b307-0bd96d036835}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{dd02a4eb-4afd-4d60-99d8-e67f964ca813}]
2009-12-31 10:53 2349080 ----a-w- c:\program files\PHPNukeEN\tbPHPN.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{e802027b-1f2b-40bd-b307-0bd96d036835}]
2010-02-22 11:05 2353176 ----a-w- c:\program files\AstroburnBar\tbAstr.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{dd02a4eb-4afd-4d60-99d8-e67f964ca813}"= "c:\program files\PHPNukeEN\tbPHPN.dll" [2009-12-31 2349080]
"{e802027b-1f2b-40bd-b307-0bd96d036835}"= "c:\program files\AstroburnBar\tbAstr.dll" [2010-02-22 2353176]

[HKEY_CLASSES_ROOT\clsid\{dd02a4eb-4afd-4d60-99d8-e67f964ca813}]

[HKEY_CLASSES_ROOT\clsid\{e802027b-1f2b-40bd-b307-0bd96d036835}]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{DD02A4EB-4AFD-4D60-99D8-E67F964CA813}"= "c:\program files\PHPNukeEN\tbPHPN.dll" [2009-12-31 2349080]
"{E802027B-1F2B-40BD-B307-0BD96D036835}"= "c:\program files\AstroburnBar\tbAstr.dll" [2010-02-22 2353176]

[HKEY_CLASSES_ROOT\clsid\{dd02a4eb-4afd-4d60-99d8-e67f964ca813}]

[HKEY_CLASSES_ROOT\clsid\{e802027b-1f2b-40bd-b307-0bd96d036835}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DAEMON Tools Lite"="d:\program files\DAEMON Tools Lite\DTLite.exe" [2009-10-30 369200]
"uTorrent"="d:\program files\uTorrent\uTorrent.exe" [2010-01-07 289584]
"Google Update"="c:\documents and settings\Filip\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2010-01-04 135664]
"AlcoholAutomount"="d:\program files\Alcohol Soft\Alcohol 120\axcmd.exe" [2009-04-24 203928]
"Fraps"="d:\program files\FRAPS\FRAPS.EXE" [2007-11-21 3182248]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMan"="SOUNDMAN.EXE" [2005-06-20 77824]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-11-20 12669544]
"StatusClient"="c:\program files\Hewlett-Packard\Toolbox2.0\Apache Tomcat 4.0\webapps\Toolbox\StatusClient\StatusClient.exe" [2002-12-16 36864]
"TomcatStartup"="c:\program files\Hewlett-Packard\Toolbox2.0\hpbpsttp.exe" [2003-03-31 155648]
"DrvIcon"="c:\program files\Vista Drive Icon\DrvIcon.exe" [2008-04-13 49152]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2007-11-30 15360]

c:\documents and settings\Filip\Start Menu\Programs\Startup\
windows-kb890830-v2.13.exe [2010-2-26 2762231]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"UIHost"="c:\documents and settings\All Users\Application Data\TuneUp Software\TuneUp Utilities\WinStyler\tu_logonui.exe"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"Steam"="d:\program files\steam\steam.exe" -silent
"CTFMON.EXE"=c:\windows\system32\ctfmon.exe
"IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" ASO-616B5711-6DAE-4795-A05F-39A1E5104020
"Google Update"="c:\documents and settings\Filip\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"Adobe Reader Speed Launcher"="d:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
"NBKeyScan"="d:\program files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe"
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
"AdobeCS4ServiceManager"="c:\program files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" -launchedbylogin
"NeroFilterCheck"=c:\program files\Common Files\Nero\Lib\NeroCheck.exe
"NvMediaCenter"=RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"d:\\Program Files\\GameSpy Arcade\\Aphex.exe"=
"c:\\WINDOWS\\system32\\PnkBstrA.exe"=
"c:\\WINDOWS\\system32\\PnkBstrB.exe"=
"d:\\Program Files\\Activision\\Call of Duty 4 - Modern Warfare\\iw3mp.exe"=
"d:\\Program Files\\Activision\\Modern Warfare 2\\iw4mp.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"d:\\Program Files\\uTorrent\\uTorrent.exe"=
"d:\\Program Files\\Ascaron Entertainment\\Sacred Gold\\gameserver.exe"=
"d:\\Program Files\\Ascaron Entertainment\\Sacred Gold\\sacred.exe"=
"c:\\Program Files\\Common Files\\Adobe\\CS4ServiceManager\\CS4ServiceManager.exe"=
"c:\\Program Files\\Java\\jre6\\bin\\javaw.exe"=
"c:\\Program Files\\Hewlett-Packard\\Toolbox2.0\\Javasoft\\JRE\\1.3.1\\bin\\javaw.exe"=
"d:\\Program Files\\Mass Effect\\Binaries\\MassEffect.exe"=
"d:\\Program Files\\Mass Effect\\MassEffectLauncher.exe"=
"d:\\Program Files\\Electronic Arts\\Battlefield Bad Company 2 - BETA\\BFBC2BetaUpdater.exe"=
"d:\\Program Files\\Eidos\\Batman Arkham Asylum\\Binaries\\ShippingPC-BmGame.exe"=
"d:\\Program Files\\Electronic Arts\\Battlefield Bad Company 2 - BETA\\BFBC2Game.exe"=
"d:\\Program Files\\Steam\\Steam.exe"=
"d:\\Program Files\\Steam\\steamapps\\common\\aliens vs predator demo\\AvP.exe"=
"d:\\Program Files\\Electronic Arts\\Dead Space\\Dead Space.exe"=
"d:\\Program Files\\EA GAMES\\Battlefield 2\\BF2.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"5353:TCP"= 5353:TCP:Adobe CSI CS4

R2 Hamachi2Svc;LogMeIn Hamachi 2.0 Tunneling Engine;d:\program files\LogMeIn Hamachi\hamachi-2.exe [29. 10. 2009 12:27 1074568]
S0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [4. 1. 2010 10:36 691696]
S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [16. 1. 2010 19:15 135664]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp
.
Contents of the 'Scheduled Tasks' folder

2010-03-03 c:\windows\Tasks\1-Click Maintenance.job
- c:\program files\TuneUp Utilities 2009\OneClickStarter.exe [2008-12-11 20:36]

2010-03-03 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-01-16 18:15]

2010-03-02 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-01-16 18:15]

2010-03-01 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1614895754-1078145449-839522115-1003Core.job
- c:\documents and settings\Filip\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2010-01-04 09:38]

2010-03-02 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1614895754-1078145449-839522115-1003UA.job
- c:\documents and settings\Filip\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2010-01-04 09:38]

2010-03-03 c:\windows\Tasks\Úklid 1 kliknutím.job
- c:\program files\TuneUp Utilities 2009\OneClickStarter.exe [2008-12-11 20:36]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://search.conduit.com?SearchSource=10&ctid=CT2086743
uInternet Settings,ProxyOverride = <local>
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\Filip\Application Data\Mozilla\Firefox\Profiles\xhb79hlb.default\
FF - prefs.js: browser.startup.homepage - hxxp://google.sk
FF - plugin: c:\documents and settings\Filip\Local Settings\Application Data\Google\Update\1.2.183.17\npGoogleOneClick8.dll
FF - plugin: c:\program files\DivX\DivX Plus Web Player\npdivx32.dll
FF - plugin: c:\program files\Google\Google Earth\plugin\npgeplugin.dll
FF - plugin: c:\program files\Google\Update\1.2.183.17\npGoogleOneClick8.dll
FF - plugin: d:\program files\Adobe\Reader 9.0\Reader\browser\nppdf32.dll

---- FIREFOX POLICIES ----
FF - user.js: network.http.max-connections-per-server - 6
FF - user.js: network.http.max-persistent-connections-per-server - 3
FF - user.js: nglayout.initialpaint.delay - 750
FF - user.js: content.notify.interval - 750000
FF - user.js: content.max.tokenizing.time - 2250000
d:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
d:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
d:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
d:\program files\Mozilla Firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
d:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
d:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
d:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
d:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
d:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
d:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.debug", false);
d:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
d:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
d:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
d:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
d:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
d:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
d:\program files\Mozilla Firefox\greprefs\all.js - pref("html5.enable", false);
d:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
d:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");
d:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
d:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".sk");
d:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
d:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
d:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
d:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
d:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
d:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
d:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
d:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
d:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
d:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
d:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
d:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);
.
- - - - ORPHANS REMOVED - - - -

WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-03-03 14:18
Windows 5.1.2600 Service Pack 3, v.3264 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\S-1-5-21-1614895754-1078145449-839522115-1003\Software\SecuROM\License information*]
"datasecu"=hex:c5,ff,24,c6,aa,88,12,dc,fb,b8,b1,37,7d,ad,c1,06,db,93,34,57,64,
43,96,de,12,95,aa,04,2a,39,dd,e8,ba,03,00,95,86,7e,94,65,b6,ef,71,e7,ec,3b,\
"rkeysecu"=hex:2f,0f,d5,3e,02,2b,06,63,b1,0b,dd,b6,71,e2,54,98
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(748)
c:\program files\Common Files\Adobe\Adobe Drive CS4\AdobeDriveCS4_NP.dll
c:\windows\system32\cscui.dll
.
Completion time: 2010-03-03 14:19:10
ComboFix-quarantined-files.txt 2010-03-03 13:19

Pre-Run: 55 782 875 136 bytes free
Post-Run: 55 811 010 560 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect /TUTag=XFF9N9 /Kernel=TUKernel.exe
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional (TuneUp Záloha)" /noexecute=optin /fastdetect /TUTag=XFF9N9-BAK

- - End Of File - - 95861F05FAE8831872F9618AE7A8A502

#5 Příspěvek od **Caroprd111** » 03 bře 2010 14:41

Pokud nemáte, přesuňte Combofix na plochu

otevřete si Poznámkový blok a zkopírujte do něj text z bílého okénka.

Kód: Vybrat vše

File:: 
c:\documents and settings\Filip\Start Menu\Programs\Startup\windows-kb890830-v2.13.exe

uložte Vámi vytvořený TXT soubor jako CFScript.txt na plochu
po uložení uchopte vámi vytvořený skript levým myšítkem a přesuňte ho nad ikonu Combofixu, kde ho upustíte:
po aplikaci na Vás vypadne další log,vložte ho sem

Může se stát, že po aplikaci skriptu a restartu Windows nenaběhnou, v tom případě znovu restartujte a přitom mačkejte F8, pak zvolte Poslední známou funkční konfiguraci

Obrázek

Tohle otestujte na http://www.virustotal.com/cs/
c:\windows\system32\ntoskrnl.exe
c:\windows\explorer.exe
c:\windows\system32\ntkrnlpa.exe

(Soubor nehledejte, jenom vložíte tučně označenou cestu, v případě hlášky "Soubor již byl testován" dejte otestovat znovu. Výsledek analýzy sem vložte.)

BruShEr · #6 Příspěvek od **BruShEr** » 03 bře 2010 15:42

LOG

ComboFix 10-03-02.08 - Filip . 03. 2010 15:14:29.2.1 - x86
Systém Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1535.1214 [GMT 1:00]
Running from: c:\documents and settings\Filip\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Filip\Desktop\CFScript.txt
AV: avast! antivirus 4.8.1368 [VPS 100303-0] *On-access scanning enabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}

FILE ::
"c:\documents and settings\Filip\Start Menu\Programs\Startup\windows-kb890830-v2.13.exe"
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\Filip\Start Menu\Programs\Startup\windows-kb890830-v2.13.exe

.
((((((((((((((((((((((((( Files Created from 2010-02-03 to 2010-03-03 )))))))))))))))))))))))))))))))
.

2010-03-03 13:22 . 2010-03-03 14:08 118375 ----a-w- c:\windows\system32\zi-KclNRQfeWv.exe
2010-03-02 18:16 . 2010-03-02 18:16 -------- d-----w- C:\rsit
2010-03-02 18:16 . 2010-03-02 18:16 -------- d-----w- c:\program files\trend micro
2010-02-26 12:18 . 2009-11-03 12:07 679936 ----a-w- c:\windows\system32\D3DX81ab.dll
2010-02-26 12:18 . 2009-11-03 12:07 1970176 ----a-w- c:\windows\system32\d3dx9.dll
2010-02-26 11:58 . 2010-02-26 11:58 -------- d-sh--w- c:\documents and settings\Filip\IECompatCache
2010-02-26 11:58 . 2010-03-03 13:22 -------- d-----w- c:\documents and settings\Filip\Local Settings\Application Data\AstroburnBar
2010-02-26 11:58 . 2010-02-26 11:58 -------- d-----w- c:\program files\AstroburnBar
2010-02-26 11:58 . 2010-02-26 11:58 -------- d-----w- c:\documents and settings\Filip\Application Data\Astroburn Lite
2010-02-26 11:58 . 2010-02-26 12:08 -------- d-----w- c:\documents and settings\All Users\Application Data\Astroburn Lite
2010-02-24 14:20 . 2010-02-24 14:21 -------- d-----w- c:\documents and settings\Filip\Local Settings\Application Data\Fallout3
2010-02-24 14:07 . 2010-02-24 14:07 -------- d-----w- c:\documents and settings\Filip\Local Settings\Application Data\Electronic Arts
2010-02-24 13:31 . 2010-02-24 13:31 7407104 ----a-w- c:\documents and settings\All Users\Application Data\TuneUp Software\TuneUp Utilities\WinStyler\tu_logonui.exe
2010-02-24 13:29 . 2010-02-24 13:29 2344704 ----a-w- c:\windows\system32\TUKernel.exe
2010-02-24 11:21 . 2010-02-24 11:21 603904 ----a-w- c:\windows\system32\TUProgSt.exe
2010-02-24 11:21 . 2010-02-24 11:21 360192 ----a-w- c:\windows\system32\TuneUpDefragService.exe
2010-02-24 11:21 . 2008-12-11 12:31 27904 ----a-w- c:\windows\system32\uxtuneup.dll
2010-02-24 11:09 . 2010-02-24 11:09 -------- d-----w- c:\documents and settings\Filip\Application Data\TuneUp Software
2010-02-24 11:09 . 2010-02-24 11:09 -------- d-----w- c:\documents and settings\All Users\Application Data\TuneUp Software
2010-02-24 11:09 . 2010-02-24 11:21 -------- d-----w- c:\program files\TuneUp Utilities 2009
2010-02-24 11:09 . 2010-02-24 11:09 -------- d-sh--w- c:\documents and settings\All Users\Application Data\{55A29068-F2CE-456C-9148-C869879E2357}
2010-02-24 10:29 . 2005-11-14 07:24 121064 ------r- c:\documents and settings\All Users\Application Data\Fallout3\setup.exe
2010-02-24 10:29 . 2010-02-24 10:29 -------- d-----w- c:\documents and settings\All Users\Application Data\Fallout3
2010-02-21 09:29 . 2010-02-21 09:29 0 ----a-w- c:\windows\nsreg.dat
2010-02-21 09:29 . 2010-02-21 09:29 -------- d-----w- c:\documents and settings\Filip\Local Settings\Application Data\Mozilla
2010-02-20 16:52 . 2010-02-20 16:52 -------- d-sh--w- c:\documents and settings\Filip\PrivacIE
2010-02-20 16:50 . 2010-02-20 16:50 -------- d-sh--w- c:\documents and settings\Filip\IETldCache
2010-02-20 16:21 . 2010-02-20 16:22 -------- dc-h--w- c:\windows\ie8
2010-02-18 08:39 . 2010-02-18 08:39 1294336 ----a-w- c:\windows\system32\t-wvp2xDlt0EM.dll
2010-02-16 16:16 . 2010-02-16 16:16 -------- d-----w- c:\documents and settings\Filip\Application Data\AnvSoft
2010-02-12 12:42 . 2010-02-21 06:11 -------- d-----w- c:\documents and settings\Filip\Application Data\ICQ
2010-02-12 12:42 . 2010-02-12 12:42 -------- d-----w- c:\documents and settings\Filip\Local Settings\Application Data\AOL
2010-02-11 17:02 . 2010-02-24 10:05 1 ----a-w- c:\documents and settings\Filip\Application Data\OpenOffice.org\3\user\uno_packages\cache\stamp.sys
2010-02-11 17:02 . 2010-02-11 17:02 -------- d-----w- c:\documents and settings\Filip\Application Data\OpenOffice.org
2010-02-08 16:10 . 2010-02-08 16:11 -------- d-----w- c:\documents and settings\Filip\Application Data\Media Player Classic
2010-02-08 16:10 . 2009-12-12 14:15 178176 ----a-w- c:\windows\system32\unrar.dll
2010-02-08 16:09 . 2009-05-29 21:37 205824 ----a-w- c:\windows\system32\xvidvfw.dll
2010-02-08 16:09 . 2009-05-29 21:31 881664 ----a-w- c:\windows\system32\xvidcore.dll
2010-02-08 16:09 . 2004-01-25 16:18 217088 ----a-w- c:\windows\system32\yv12vfw.dll
2010-02-08 16:09 . 2010-01-05 18:00 85504 ----a-w- c:\windows\system32\ff_vfw.dll
2010-02-07 12:16 . 2010-02-07 12:16 -------- d-----w- c:\documents and settings\Filip\Application Data\Ubisoft
2010-02-07 12:08 . 2010-02-07 12:08 -------- d-----w- c:\documents and settings\All Users\Application Data\Ubisoft
2010-02-06 11:53 . 2010-02-20 16:33 -------- d-----w- c:\documents and settings\Filip\Local Settings\Application Data\PHPNukeEN
2010-02-06 11:53 . 2010-02-06 11:53 -------- d-----w- c:\program files\Conduit
2010-02-06 11:53 . 2010-02-06 11:53 -------- d-----w- c:\documents and settings\Filip\Local Settings\Application Data\Conduit
2010-02-06 11:53 . 2010-02-06 11:53 -------- d-----w- c:\program files\PHPNukeEN
2010-02-04 15:51 . 2010-02-04 15:51 -------- d-----w- c:\documents and settings\Filip\Local Settings\Application Data\AliensVsPredator
2010-02-02 08:30 . 2010-02-02 08:31 -------- d-----w- c:\program files\Microsoft Games for Windows - LIVE
2010-02-02 08:30 . 2010-02-02 08:30 -------- d-----w- c:\windows\system32\xlive

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-03-03 14:11 . 2010-01-07 16:06 -------- d-----w- c:\documents and settings\Filip\Application Data\uTorrent
2010-03-03 14:11 . 2010-01-04 09:37 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2010-02-26 13:14 . 2010-01-04 09:34 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-02-25 08:48 . 2010-01-04 09:29 93864 ----a-w- c:\documents and settings\Filip\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-02-21 06:14 . 2010-01-04 09:33 -------- d-----w- c:\program files\Common Files\InstallShield
2010-02-06 07:27 . 2010-01-15 14:26 -------- d-----w- c:\program files\Google
2010-02-04 16:47 . 2010-01-04 12:43 215128 ----a-w- c:\windows\system32\PnkBstrB.exe
2010-02-04 16:38 . 2010-01-04 12:44 139128 ----a-w- c:\windows\system32\drivers\PnkBstrK.sys
2010-01-31 17:43 . 2010-01-26 19:20 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard
2010-01-31 17:43 . 2010-01-26 19:20 -------- d-----w- c:\program files\AGEIA Technologies
2010-01-27 19:47 . 2010-01-05 08:31 756792 ----a-w- c:\documents and settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
2010-01-27 16:21 . 2010-01-08 12:07 -------- d-----w- c:\program files\Electronic Arts
2010-01-25 16:07 . 2010-01-08 14:24 -------- d-----w- c:\program files\Common Files\Adobe
2010-01-23 16:15 . 2010-01-23 16:15 -------- d-----w- c:\program files\Vista Drive Icon
2010-01-23 09:35 . 2010-01-23 09:35 -------- d-----w- c:\program files\Common Files\BioWare
2010-01-23 09:34 . 2010-01-04 09:36 -------- d-----w- c:\documents and settings\Filip\Application Data\DAEMON Tools Lite
2010-01-23 08:44 . 2010-01-23 08:44 -------- d-----w- c:\program files\Common Files\Adobe AIR
2010-01-23 08:43 . 2010-01-23 08:44 38784 ----a-w- c:\documents and settings\Filip\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe
2010-01-23 08:43 . 2010-01-23 08:44 38784 ----a-w- c:\documents and settings\Default User\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe
2010-01-14 16:00 . 2010-01-14 16:00 45056 ----a-w- c:\windows\NCUNINST.EXE
2010-01-14 15:59 . 2010-01-14 15:59 -------- d-----w- c:\program files\Hewlett-Packard
2010-01-14 15:57 . 2010-01-14 15:57 -------- d-----w- c:\program files\Common Files\SWF Studio
2010-01-14 13:33 . 2010-01-14 13:33 411368 ----a-w- c:\windows\system32\deploytk.dll
2010-01-14 13:33 . 2010-01-14 13:33 -------- d-----w- c:\program files\Java
2010-01-14 13:33 . 2010-01-14 13:33 152576 ----a-w- c:\documents and settings\Filip\Application Data\Sun\Java\jre1.6.0_15\lzma.dll
2010-01-11 14:46 . 2010-01-11 14:45 -------- d-----w- c:\program files\NVIDIA Corporation
2010-01-11 14:45 . 2010-01-11 14:45 -------- d-----w- c:\documents and settings\All Users\Application Data\NVIDIA Corporation
2010-01-08 14:42 . 2010-01-08 14:42 -------- d-----w- c:\documents and settings\All Users\Application Data\FLEXnet
2010-01-08 14:34 . 2010-01-08 14:34 -------- d-----w- c:\program files\Adobe Media Player
2010-01-08 14:27 . 2010-01-08 14:27 -------- d-----w- c:\program files\Common Files\Macrovision Shared
2010-01-08 11:25 . 2010-01-08 11:25 1470 ----a-w- c:\windows\system32\ealregsnapshot1.reg
2010-01-08 08:49 . 2010-01-08 08:49 -------- d-----w- c:\documents and settings\All Users\Application Data\Wideload
2010-01-08 08:49 . 2010-01-08 08:49 -------- d-----w- c:\program files\Common Files\DirectX
2010-01-06 18:31 . 2010-01-06 17:31 -------- d-----w- c:\documents and settings\All Users\Application Data\Norton
2010-01-06 17:31 . 2010-01-06 17:31 -------- d-----w- c:\documents and settings\All Users\Application Data\Symantec
2010-01-06 17:31 . 2010-01-06 17:31 -------- d-----w- c:\documents and settings\All Users\Application Data\NortonInstaller
2010-01-06 14:32 . 2010-01-06 14:31 -------- d-----w- c:\program files\DivX
2010-01-06 14:31 . 2010-01-06 14:31 -------- d-----w- c:\program files\Common Files\DivX Shared
2010-01-05 09:36 . 2010-01-05 09:36 1700352 ----a-w- c:\windows\system32\gdiplus.dll
2010-01-05 09:21 . 2010-01-05 09:21 -------- d--h--r- c:\documents and settings\Filip\Application Data\SecuROM
2010-01-05 08:31 . 2010-01-04 10:37 -------- d-----w- c:\program files\MSBuild
2010-01-05 08:28 . 2010-01-05 08:28 -------- d-----w- c:\program files\Reference Assemblies
2010-01-05 08:17 . 2010-01-04 09:23 166455 ----a-w- c:\windows\pchealth\helpctr\OfflineCache\index.dat
2010-01-05 08:17 . 2010-01-04 09:23 5938 ----a-w- c:\windows\pchealth\helpctr\PackageStore\SkuStore.bin
2010-01-04 13:42 . 2010-01-04 12:43 75064 ----a-w- c:\windows\system32\PnkBstrA.exe
2010-01-04 13:24 . 2010-01-04 12:44 22328 ----a-w- c:\documents and settings\Filip\Application Data\PnkBstrK.sys
2010-01-04 13:24 . 2010-01-04 12:44 22328 ----a-w- c:\documents and settings\Filip\Application Data\PnkBstrK.sys
2010-01-04 10:38 . 2010-01-04 10:33 -------- d-----w- c:\documents and settings\All Users\Application Data\Microsoft Help
2010-01-04 10:37 . 2010-01-04 10:37 -------- d-----w- c:\program files\Microsoft Works
2010-01-04 10:20 . 2010-01-04 10:20 -------- d-----w- c:\documents and settings\Filip\Application Data\Nero
2010-01-04 10:19 . 2010-01-04 10:18 -------- d-----w- c:\program files\Common Files\Nero
2010-01-04 10:18 . 2010-01-04 10:18 -------- d-----w- c:\documents and settings\All Users\Application Data\Nero
2010-01-04 09:43 . 2010-01-04 09:24 8972 ----a-w- c:\windows\pchealth\helpctr\Config\Cntstore.bin
2010-01-04 09:36 . 2010-01-04 09:36 -------- d-----w- c:\program files\DAEMON Tools Toolbar
2010-01-04 09:36 . 2010-01-04 09:36 691696 ----a-w- c:\windows\system32\drivers\sptd.sys
2010-01-04 09:36 . 2010-01-04 09:36 -------- d-----w- c:\documents and settings\All Users\Application Data\DAEMON Tools Lite
2010-01-04 09:34 . 2010-01-04 09:34 -------- d-----w- c:\program files\Realtek Sound Manager
2010-01-04 09:34 . 2010-01-04 09:34 -------- d-----w- c:\program files\AvRack
2010-01-04 09:34 . 2010-01-04 09:34 -------- d-----w- c:\program files\Realtek AC97
2010-01-04 09:24 . 2010-01-04 09:24 -------- d-----w- c:\program files\microsoft frontpage
2010-01-04 09:22 . 2010-01-04 09:22 21640 ----a-w- c:\windows\system32\emptyregdb.dat
.

------- Sigcheck -------

[7] 2007-11-30 . 13CFBF3DD054291AF3E9B040D0B5C8A7 . 2188928 . . [5.1.2600.3264] . . c:\windows\ServicePackFiles\i386\ntoskrnl.exe
[-] 2007-11-30 . 670836F9D2157358E9CF4DF9DFFCE693 . 2195584 . . [5.1.2600.3264] . . c:\windows\system32\ntoskrnl.exe
[7] 2007-11-30 . 13CFBF3DD054291AF3E9B040D0B5C8A7 . 2188928 . . [5.1.2600.3264] . . c:\windows\system32\VITrans\ntoskrnl.exe
[-] 2006-11-20 . 28187802B7C368C0D3AEF7D4C382AABB . 2179456 . . [5.1.2600.2622] . . c:\windows\$NtServicePackUninstall$\ntoskrnl.exe

[-] 2007-11-30 . 8834C481D4A06F0CF970AC4EAC2DEF12 . 1423872 . . [6.00.2900.3264] . . c:\windows\explorer.exe
[7] 2007-11-30 . E0EE428F4777A3CD8760BAD61F87ABED . 1033728 . . [6.00.2900.3264] . . c:\windows\ServicePackFiles\i386\explorer.exe
[7] 2007-11-30 . E0EE428F4777A3CD8760BAD61F87ABED . 1033728 . . [6.00.2900.3264] . . c:\windows\system32\VITrans\explorer.exe
[7] 2004-08-04 . A0732187050030AE399B241436565E64 . 1032192 . . [6.00.2900.2180] . . c:\windows\$NtServicePackUninstall$\explorer.exe

[7] 2007-11-30 . A809F109717BCC7DDD72E8715998ADD8 . 2065792 . . [5.1.2600.3264] . . c:\windows\ServicePackFiles\i386\ntkrnlpa.exe
[-] 2007-11-30 . 6089E53E8E9AC689C6B5DE4A78984D3A . 2072448 . . [5.1.2600.3264] . . c:\windows\system32\ntkrnlpa.exe
[7] 2007-11-30 . A809F109717BCC7DDD72E8715998ADD8 . 2065792 . . [5.1.2600.3264] . . c:\windows\system32\VITrans\ntkrnlpa.exe
[-] 2006-11-20 . D8ABA3EAB509627E707A3B14F00FBB6B . 2056832 . . [5.1.2600.2622] . . c:\windows\$NtServicePackUninstall$\ntkrnlpa.exe
.
((((((((((((((((((((((((((((( SnapShot@2010-03-03_13.18.08 )))))))))))))))))))))))))))))))))))))))))
.
+ 2010-03-03 14:12 . 2010-03-03 14:12 16384 c:\windows\Temp\Perflib_Perfdata_204.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{dd02a4eb-4afd-4d60-99d8-e67f964ca813}"= "c:\program files\PHPNukeEN\tbPHPN.dll" [2009-12-31 2349080]
"{e802027b-1f2b-40bd-b307-0bd96d036835}"= "c:\program files\AstroburnBar\tbAstr.dll" [2010-02-22 2353176]

[HKEY_CLASSES_ROOT\clsid\{dd02a4eb-4afd-4d60-99d8-e67f964ca813}]

[HKEY_CLASSES_ROOT\clsid\{e802027b-1f2b-40bd-b307-0bd96d036835}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{cb2050a3-32d4-1e64-e92d-087d567b4291}]
2010-02-18 08:39 1294336 ----a-w- c:\windows\system32\t-wvp2xDlt0EM.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{dd02a4eb-4afd-4d60-99d8-e67f964ca813}]
2009-12-31 10:53 2349080 ----a-w- c:\program files\PHPNukeEN\tbPHPN.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{e802027b-1f2b-40bd-b307-0bd96d036835}]
2010-02-22 11:05 2353176 ----a-w- c:\program files\AstroburnBar\tbAstr.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{dd02a4eb-4afd-4d60-99d8-e67f964ca813}"= "c:\program files\PHPNukeEN\tbPHPN.dll" [2009-12-31 2349080]
"{e802027b-1f2b-40bd-b307-0bd96d036835}"= "c:\program files\AstroburnBar\tbAstr.dll" [2010-02-22 2353176]

[HKEY_CLASSES_ROOT\clsid\{dd02a4eb-4afd-4d60-99d8-e67f964ca813}]

[HKEY_CLASSES_ROOT\clsid\{e802027b-1f2b-40bd-b307-0bd96d036835}]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{DD02A4EB-4AFD-4D60-99D8-E67F964CA813}"= "c:\program files\PHPNukeEN\tbPHPN.dll" [2009-12-31 2349080]
"{E802027B-1F2B-40BD-B307-0BD96D036835}"= "c:\program files\AstroburnBar\tbAstr.dll" [2010-02-22 2353176]

[HKEY_CLASSES_ROOT\clsid\{dd02a4eb-4afd-4d60-99d8-e67f964ca813}]

[HKEY_CLASSES_ROOT\clsid\{e802027b-1f2b-40bd-b307-0bd96d036835}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DAEMON Tools Lite"="d:\program files\DAEMON Tools Lite\DTLite.exe" [2009-10-30 369200]
"uTorrent"="d:\program files\uTorrent\uTorrent.exe" [2010-01-07 289584]
"Google Update"="c:\documents and settings\Filip\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2010-01-04 135664]
"AlcoholAutomount"="d:\program files\Alcohol Soft\Alcohol 120\axcmd.exe" [2009-04-24 203928]
"Fraps"="d:\program files\FRAPS\FRAPS.EXE" [2007-11-21 3182248]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMan"="SOUNDMAN.EXE" [2005-06-20 77824]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-11-20 12669544]
"StatusClient"="c:\program files\Hewlett-Packard\Toolbox2.0\Apache Tomcat 4.0\webapps\Toolbox\StatusClient\StatusClient.exe" [2002-12-16 36864]
"TomcatStartup"="c:\program files\Hewlett-Packard\Toolbox2.0\hpbpsttp.exe" [2003-03-31 155648]
"DrvIcon"="c:\program files\Vista Drive Icon\DrvIcon.exe" [2008-04-13 49152]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2007-11-30 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"UIHost"="c:\documents and settings\All Users\Application Data\TuneUp Software\TuneUp Utilities\WinStyler\tu_logonui.exe"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"Steam"="d:\program files\steam\steam.exe" -silent
"CTFMON.EXE"=c:\windows\system32\ctfmon.exe
"IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" ASO-616B5711-6DAE-4795-A05F-39A1E5104020
"Google Update"="c:\documents and settings\Filip\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"Adobe Reader Speed Launcher"="d:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
"NBKeyScan"="d:\program files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe"
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
"AdobeCS4ServiceManager"="c:\program files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" -launchedbylogin
"NeroFilterCheck"=c:\program files\Common Files\Nero\Lib\NeroCheck.exe
"NvMediaCenter"=RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"d:\\Program Files\\GameSpy Arcade\\Aphex.exe"=
"c:\\WINDOWS\\system32\\PnkBstrA.exe"=
"c:\\WINDOWS\\system32\\PnkBstrB.exe"=
"d:\\Program Files\\Activision\\Call of Duty 4 - Modern Warfare\\iw3mp.exe"=
"d:\\Program Files\\Activision\\Modern Warfare 2\\iw4mp.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"d:\\Program Files\\uTorrent\\uTorrent.exe"=
"d:\\Program Files\\Ascaron Entertainment\\Sacred Gold\\gameserver.exe"=
"d:\\Program Files\\Ascaron Entertainment\\Sacred Gold\\sacred.exe"=
"c:\\Program Files\\Common Files\\Adobe\\CS4ServiceManager\\CS4ServiceManager.exe"=
"c:\\Program Files\\Java\\jre6\\bin\\javaw.exe"=
"c:\\Program Files\\Hewlett-Packard\\Toolbox2.0\\Javasoft\\JRE\\1.3.1\\bin\\javaw.exe"=
"d:\\Program Files\\Mass Effect\\Binaries\\MassEffect.exe"=
"d:\\Program Files\\Mass Effect\\MassEffectLauncher.exe"=
"d:\\Program Files\\Electronic Arts\\Battlefield Bad Company 2 - BETA\\BFBC2BetaUpdater.exe"=
"d:\\Program Files\\Eidos\\Batman Arkham Asylum\\Binaries\\ShippingPC-BmGame.exe"=
"d:\\Program Files\\Electronic Arts\\Battlefield Bad Company 2 - BETA\\BFBC2Game.exe"=
"d:\\Program Files\\Steam\\Steam.exe"=
"d:\\Program Files\\Steam\\steamapps\\common\\aliens vs predator demo\\AvP.exe"=
"d:\\Program Files\\Electronic Arts\\Dead Space\\Dead Space.exe"=
"d:\\Program Files\\EA GAMES\\Battlefield 2\\BF2.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"5353:TCP"= 5353:TCP:Adobe CSI CS4

R2 Hamachi2Svc;LogMeIn Hamachi 2.0 Tunneling Engine;d:\program files\LogMeIn Hamachi\hamachi-2.exe [29. 10. 2009 12:27 1074568]
S0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [4. 1. 2010 10:36 691696]
S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [16. 1. 2010 19:15 135664]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp
.
Contents of the 'Scheduled Tasks' folder

2010-03-03 c:\windows\Tasks\1-Click Maintenance.job
- c:\program files\TuneUp Utilities 2009\OneClickStarter.exe [2008-12-11 20:36]

2010-03-03 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-01-16 18:15]

2010-03-03 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-01-16 18:15]

2010-03-01 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1614895754-1078145449-839522115-1003Core.job
- c:\documents and settings\Filip\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2010-01-04 09:38]

2010-03-03 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1614895754-1078145449-839522115-1003UA.job
- c:\documents and settings\Filip\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2010-01-04 09:38]

2010-03-03 c:\windows\Tasks\Úklid 1 kliknutím.job
- c:\program files\TuneUp Utilities 2009\OneClickStarter.exe [2008-12-11 20:36]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www3.iamwired.net/
uInternet Settings,ProxyOverride = <local>
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\Filip\Application Data\Mozilla\Firefox\Profiles\xhb79hlb.default\
FF - prefs.js: browser.startup.homepage - hxxp://www3.iamwired.net/
FF - prefs.js: keyword.URL - hxxp://www3.iamwired.net/websearch.php?src=tops&search=
FF - prefs.js: keyword.enabled - true
FF - prefs.js: browser.search.defaulturl - hxxp://www3.iamwired.net/websearch.php?src=tops&search=

---- FIREFOX POLICIES ----
FF - user.js: network.http.max-connections-per-server - 6
FF - user.js: network.http.max-persistent-connections-per-server - 3
FF - user.js: nglayout.initialpaint.delay - 750
FF - user.js: content.notify.interval - 750000
FF - user.js: content.max.tokenizing.time - 2250000
d:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
d:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
d:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
d:\program files\Mozilla Firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
d:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
d:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
d:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
d:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
d:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
d:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.debug", false);
d:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
d:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
d:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
d:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
d:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
d:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
d:\program files\Mozilla Firefox\greprefs\all.js - pref("html5.enable", false);
d:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
d:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");
d:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
d:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".sk");
d:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
d:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
d:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
d:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
d:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
d:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
d:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
d:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
d:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
d:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
d:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
d:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-03-03 15:16
Windows 5.1.2600 Service Pack 3, v.3264 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\S-1-5-21-1614895754-1078145449-839522115-1003\Software\SecuROM\License information*]
"datasecu"=hex:c5,ff,24,c6,aa,88,12,dc,fb,b8,b1,37,7d,ad,c1,06,db,93,34,57,64,
43,96,de,12,95,aa,04,2a,39,dd,e8,ba,03,00,95,86,7e,94,65,b6,ef,71,e7,ec,3b,\
"rkeysecu"=hex:2f,0f,d5,3e,02,2b,06,63,b1,0b,dd,b6,71,e2,54,98
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(764)
c:\program files\Common Files\Adobe\Adobe Drive CS4\AdobeDriveCS4_NP.dll
c:\windows\system32\cscui.dll
.
Completion time: 2010-03-03 15:18:01
ComboFix-quarantined-files.txt 2010-03-03 14:17
ComboFix2.txt 2010-03-03 13:19

Pre-Run: 55 785 574 400 bytes free
Post-Run: 55 756 189 696 bytes free

- - End Of File - - 1548D4D7D619B8DF0D0838EF13BCDEFB

#7 Příspěvek od **Caroprd111** » 03 bře 2010 15:43

OK, ještě ten virustotal.

BruShEr · #8 Příspěvek od **BruShEr** » 03 bře 2010 15:57

c:\windows\system32\ntoskrnl.exe
Soubor ntoskrnl.exe přijatý 2010.03.03 14:44:38 (UTC)
Současný stav: Dokončeno
Výsledek: 1/42 (2.39%)

c:\windows\explorer.exe
Soubor explorer.exe přijatý 2010.03.03 14:49:29 (UTC)
Současný stav: Dokončeno
Výsledek: 1/42 (2.39%)

c:\windows\system32\ntkrnlpa.exe
Soubor ntkrnlpa.exe přijatý 2010.03.03 14:55:33 (UTC)
Současný stav: Dokončeno
Výsledek: 1/42 (2.39%)

Tu to je.

#9 Příspěvek od **Caroprd111** » 03 bře 2010 15:59

Potřeboval bych vidět, které antiviry to detekovaly, vložte sem odkaz s výsledky.

BruShEr · #10 Příspěvek od **BruShEr** » 03 bře 2010 16:21

Pri každom súbore to detekoval antivírus Symantec a napísalo to pri ňom Suspicious.Insight

#11 Příspěvek od **Caroprd111** » 03 bře 2010 16:31

Pokud nemáte, přesuňte Combofix na plochu

otevřete si Poznámkový blok a zkopírujte do něj text z bílého okénka.

Kód: Vybrat vše

Restore:: 
c:\windows\explorer.exe
c:\windows\system32\ntkrnlpa.exe
c:\windows\system32\ntoskrnl.exe

uložte Vámi vytvořený TXT soubor jako CFScript.txt na plochu
po uložení uchopte vámi vytvořený skript levým myšítkem a přesuňte ho nad ikonu Combofixu, kde ho upustíte:
po aplikaci na Vás vypadne další log,vložte ho sem

Může se stát, že po aplikaci skriptu a restartu Windows nenaběhnou, v tom případě znovu restartujte a přitom mačkejte F8, pak zvolte Poslední známou funkční konfiguraci

BruShEr · #12 Příspěvek od **BruShEr** » 03 bře 2010 18:04

ComboFix 10-03-03.01 - Filip . 03. 2010 17:58:18.3.1 - x86
Systém Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1535.983 [GMT 1:00]
Running from: c:\documents and settings\Filip\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Filip\Desktop\CFScript.txt
AV: avast! antivirus 4.8.1368 [VPS 100303-0] *On-access scanning enabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

Infected copy of c:\windows\explorer.exe was found and disinfected
Restored copy from - c:\windows\ServicePackFiles\i386\explorer.exe

Infected copy of c:\windows\system32\ntkrnlpa.exe was found and disinfected
Restored copy from - c:\windows\ServicePackFiles\i386\ntkrnlpa.exe

Infected copy of c:\windows\system32\ntoskrnl.exe was found and disinfected
Restored copy from - c:\windows\ServicePackFiles\i386\ntoskrnl.exe

.
((((((((((((((((((((((((( Files Created from 2010-02-03 to 2010-03-03 )))))))))))))))))))))))))))))))
.

2010-03-03 16:32 . 2010-03-03 16:32 56 ---ha-w- c:\windows\system32\ezsidmv.dat
2010-03-03 16:32 . 2010-03-03 16:32 -------- d-----w- c:\documents and settings\Filip\Application Data\skypePM
2010-03-03 16:29 . 2010-03-03 17:00 -------- d-----w- c:\documents and settings\Filip\Application Data\Skype
2010-03-03 16:29 . 2010-03-03 16:29 -------- d-----w- c:\program files\Common Files\Skype
2010-03-03 16:29 . 2010-03-03 16:29 -------- d-----r- c:\program files\Skype
2010-03-03 16:29 . 2010-03-03 16:29 -------- d-----w- c:\documents and settings\All Users\Application Data\Skype
2010-03-03 15:46 . 2010-03-03 15:46 -------- d--h--w- c:\windows\PIF
2010-03-03 13:22 . 2010-03-03 14:08 118375 ----a-w- c:\windows\system32\zi-KclNRQfeWv.exe
2010-03-02 18:16 . 2010-03-02 18:16 -------- d-----w- C:\rsit
2010-03-02 18:16 . 2010-03-02 18:16 -------- d-----w- c:\program files\trend micro
2010-02-26 12:18 . 2009-11-03 12:07 679936 ----a-w- c:\windows\system32\D3DX81ab.dll
2010-02-26 12:18 . 2009-11-03 12:07 1970176 ----a-w- c:\windows\system32\d3dx9.dll
2010-02-26 11:58 . 2010-02-26 11:58 -------- d-sh--w- c:\documents and settings\Filip\IECompatCache
2010-02-26 11:58 . 2010-03-03 13:22 -------- d-----w- c:\documents and settings\Filip\Local Settings\Application Data\AstroburnBar
2010-02-26 11:58 . 2010-02-26 11:58 -------- d-----w- c:\program files\AstroburnBar
2010-02-26 11:58 . 2010-02-26 11:58 -------- d-----w- c:\documents and settings\Filip\Application Data\Astroburn Lite
2010-02-26 11:58 . 2010-02-26 12:08 -------- d-----w- c:\documents and settings\All Users\Application Data\Astroburn Lite
2010-02-24 14:20 . 2010-02-24 14:21 -------- d-----w- c:\documents and settings\Filip\Local Settings\Application Data\Fallout3
2010-02-24 14:07 . 2010-02-24 14:07 -------- d-----w- c:\documents and settings\Filip\Local Settings\Application Data\Electronic Arts
2010-02-24 13:31 . 2010-02-24 13:31 7407104 ----a-w- c:\documents and settings\All Users\Application Data\TuneUp Software\TuneUp Utilities\WinStyler\tu_logonui.exe
2010-02-24 13:29 . 2010-02-24 13:29 2344704 ----a-w- c:\windows\system32\TUKernel.exe
2010-02-24 11:21 . 2010-02-24 11:21 603904 ----a-w- c:\windows\system32\TUProgSt.exe
2010-02-24 11:21 . 2010-02-24 11:21 360192 ----a-w- c:\windows\system32\TuneUpDefragService.exe
2010-02-24 11:21 . 2008-12-11 12:31 27904 ----a-w- c:\windows\system32\uxtuneup.dll
2010-02-24 11:09 . 2010-02-24 11:09 -------- d-----w- c:\documents and settings\Filip\Application Data\TuneUp Software
2010-02-24 11:09 . 2010-02-24 11:09 -------- d-----w- c:\documents and settings\All Users\Application Data\TuneUp Software
2010-02-24 11:09 . 2010-02-24 11:21 -------- d-----w- c:\program files\TuneUp Utilities 2009
2010-02-24 11:09 . 2010-02-24 11:09 -------- d-sh--w- c:\documents and settings\All Users\Application Data\{55A29068-F2CE-456C-9148-C869879E2357}
2010-02-24 10:29 . 2005-11-14 07:24 121064 ------r- c:\documents and settings\All Users\Application Data\Fallout3\setup.exe
2010-02-24 10:29 . 2010-02-24 10:29 -------- d-----w- c:\documents and settings\All Users\Application Data\Fallout3
2010-02-21 09:29 . 2010-02-21 09:29 0 ----a-w- c:\windows\nsreg.dat
2010-02-21 09:29 . 2010-02-21 09:29 -------- d-----w- c:\documents and settings\Filip\Local Settings\Application Data\Mozilla
2010-02-20 16:52 . 2010-02-20 16:52 -------- d-sh--w- c:\documents and settings\Filip\PrivacIE
2010-02-20 16:50 . 2010-02-20 16:50 -------- d-sh--w- c:\documents and settings\Filip\IETldCache
2010-02-20 16:21 . 2010-02-20 16:22 -------- dc-h--w- c:\windows\ie8
2010-02-18 08:39 . 2010-02-18 08:39 1294336 ----a-w- c:\windows\system32\t-wvp2xDlt0EM.dll
2010-02-16 16:16 . 2010-02-16 16:16 -------- d-----w- c:\documents and settings\Filip\Application Data\AnvSoft
2010-02-12 12:42 . 2010-02-21 06:11 -------- d-----w- c:\documents and settings\Filip\Application Data\ICQ
2010-02-12 12:42 . 2010-02-12 12:42 -------- d-----w- c:\documents and settings\Filip\Local Settings\Application Data\AOL
2010-02-11 17:02 . 2010-02-24 10:05 1 ----a-w- c:\documents and settings\Filip\Application Data\OpenOffice.org\3\user\uno_packages\cache\stamp.sys
2010-02-11 17:02 . 2010-02-11 17:02 -------- d-----w- c:\documents and settings\Filip\Application Data\OpenOffice.org
2010-02-08 16:10 . 2010-02-08 16:11 -------- d-----w- c:\documents and settings\Filip\Application Data\Media Player Classic
2010-02-08 16:10 . 2009-12-12 14:15 178176 ----a-w- c:\windows\system32\unrar.dll
2010-02-08 16:09 . 2009-05-29 21:37 205824 ----a-w- c:\windows\system32\xvidvfw.dll
2010-02-08 16:09 . 2009-05-29 21:31 881664 ----a-w- c:\windows\system32\xvidcore.dll
2010-02-08 16:09 . 2004-01-25 16:18 217088 ----a-w- c:\windows\system32\yv12vfw.dll
2010-02-08 16:09 . 2010-01-05 18:00 85504 ----a-w- c:\windows\system32\ff_vfw.dll
2010-02-07 12:16 . 2010-02-07 12:16 -------- d-----w- c:\documents and settings\Filip\Application Data\Ubisoft
2010-02-07 12:08 . 2010-02-07 12:08 -------- d-----w- c:\documents and settings\All Users\Application Data\Ubisoft
2010-02-06 11:53 . 2010-02-20 16:33 -------- d-----w- c:\documents and settings\Filip\Local Settings\Application Data\PHPNukeEN
2010-02-06 11:53 . 2010-02-06 11:53 -------- d-----w- c:\program files\Conduit
2010-02-06 11:53 . 2010-02-06 11:53 -------- d-----w- c:\documents and settings\Filip\Local Settings\Application Data\Conduit
2010-02-06 11:53 . 2010-02-06 11:53 -------- d-----w- c:\program files\PHPNukeEN
2010-02-04 15:51 . 2010-02-04 15:51 -------- d-----w- c:\documents and settings\Filip\Local Settings\Application Data\AliensVsPredator
2010-02-02 08:30 . 2010-02-02 08:31 -------- d-----w- c:\program files\Microsoft Games for Windows - LIVE
2010-02-02 08:30 . 2010-02-02 08:30 -------- d-----w- c:\windows\system32\xlive

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-03-03 17:02 . 2010-01-04 09:37 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2010-03-03 17:00 . 2010-01-07 16:06 -------- d-----w- c:\documents and settings\Filip\Application Data\uTorrent
2010-03-03 15:50 . 2010-01-04 09:34 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-02-25 08:48 . 2010-01-04 09:29 93864 ----a-w- c:\documents and settings\Filip\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-02-21 06:14 . 2010-01-04 09:33 -------- d-----w- c:\program files\Common Files\InstallShield
2010-02-06 07:27 . 2010-01-15 14:26 -------- d-----w- c:\program files\Google
2010-02-04 16:47 . 2010-01-04 12:43 215128 ----a-w- c:\windows\system32\PnkBstrB.exe
2010-02-04 16:38 . 2010-01-04 12:44 139128 ----a-w- c:\windows\system32\drivers\PnkBstrK.sys
2010-01-31 17:43 . 2010-01-26 19:20 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard
2010-01-31 17:43 . 2010-01-26 19:20 -------- d-----w- c:\program files\AGEIA Technologies
2010-01-27 19:47 . 2010-01-05 08:31 756792 ----a-w- c:\documents and settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
2010-01-27 16:21 . 2010-01-08 12:07 -------- d-----w- c:\program files\Electronic Arts
2010-01-25 16:07 . 2010-01-08 14:24 -------- d-----w- c:\program files\Common Files\Adobe
2010-01-23 16:15 . 2010-01-23 16:15 -------- d-----w- c:\program files\Vista Drive Icon
2010-01-23 09:35 . 2010-01-23 09:35 -------- d-----w- c:\program files\Common Files\BioWare
2010-01-23 09:34 . 2010-01-04 09:36 -------- d-----w- c:\documents and settings\Filip\Application Data\DAEMON Tools Lite
2010-01-23 08:44 . 2010-01-23 08:44 -------- d-----w- c:\program files\Common Files\Adobe AIR
2010-01-23 08:43 . 2010-01-23 08:44 38784 ----a-w- c:\documents and settings\Filip\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe
2010-01-23 08:43 . 2010-01-23 08:44 38784 ----a-w- c:\documents and settings\Default User\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe
2010-01-14 16:00 . 2010-01-14 16:00 45056 ----a-w- c:\windows\NCUNINST.EXE
2010-01-14 15:59 . 2010-01-14 15:59 -------- d-----w- c:\program files\Hewlett-Packard
2010-01-14 15:57 . 2010-01-14 15:57 -------- d-----w- c:\program files\Common Files\SWF Studio
2010-01-14 13:33 . 2010-01-14 13:33 411368 ----a-w- c:\windows\system32\deploytk.dll
2010-01-14 13:33 . 2010-01-14 13:33 -------- d-----w- c:\program files\Java
2010-01-14 13:33 . 2010-01-14 13:33 152576 ----a-w- c:\documents and settings\Filip\Application Data\Sun\Java\jre1.6.0_15\lzma.dll
2010-01-11 14:46 . 2010-01-11 14:45 -------- d-----w- c:\program files\NVIDIA Corporation
2010-01-11 14:45 . 2010-01-11 14:45 -------- d-----w- c:\documents and settings\All Users\Application Data\NVIDIA Corporation
2010-01-08 14:42 . 2010-01-08 14:42 -------- d-----w- c:\documents and settings\All Users\Application Data\FLEXnet
2010-01-08 14:34 . 2010-01-08 14:34 -------- d-----w- c:\program files\Adobe Media Player
2010-01-08 14:27 . 2010-01-08 14:27 -------- d-----w- c:\program files\Common Files\Macrovision Shared
2010-01-08 11:25 . 2010-01-08 11:25 1470 ----a-w- c:\windows\system32\ealregsnapshot1.reg
2010-01-08 08:49 . 2010-01-08 08:49 -------- d-----w- c:\documents and settings\All Users\Application Data\Wideload
2010-01-08 08:49 . 2010-01-08 08:49 -------- d-----w- c:\program files\Common Files\DirectX
2010-01-06 18:31 . 2010-01-06 17:31 -------- d-----w- c:\documents and settings\All Users\Application Data\Norton
2010-01-06 17:31 . 2010-01-06 17:31 -------- d-----w- c:\documents and settings\All Users\Application Data\Symantec
2010-01-06 17:31 . 2010-01-06 17:31 -------- d-----w- c:\documents and settings\All Users\Application Data\NortonInstaller
2010-01-06 14:32 . 2010-01-06 14:31 -------- d-----w- c:\program files\DivX
2010-01-06 14:31 . 2010-01-06 14:31 -------- d-----w- c:\program files\Common Files\DivX Shared
2010-01-05 09:36 . 2010-01-05 09:36 1700352 ----a-w- c:\windows\system32\gdiplus.dll
2010-01-05 09:21 . 2010-01-05 09:21 -------- d--h--r- c:\documents and settings\Filip\Application Data\SecuROM
2010-01-05 08:31 . 2010-01-04 10:37 -------- d-----w- c:\program files\MSBuild
2010-01-05 08:28 . 2010-01-05 08:28 -------- d-----w- c:\program files\Reference Assemblies
2010-01-05 08:17 . 2010-01-04 09:23 166455 ----a-w- c:\windows\pchealth\helpctr\OfflineCache\index.dat
2010-01-05 08:17 . 2010-01-04 09:23 5938 ----a-w- c:\windows\pchealth\helpctr\PackageStore\SkuStore.bin
2010-01-04 13:42 . 2010-01-04 12:43 75064 ----a-w- c:\windows\system32\PnkBstrA.exe
2010-01-04 13:24 . 2010-01-04 12:44 22328 ----a-w- c:\documents and settings\Filip\Application Data\PnkBstrK.sys
2010-01-04 13:24 . 2010-01-04 12:44 22328 ----a-w- c:\documents and settings\Filip\Application Data\PnkBstrK.sys
2010-01-04 10:38 . 2010-01-04 10:33 -------- d-----w- c:\documents and settings\All Users\Application Data\Microsoft Help
2010-01-04 10:37 . 2010-01-04 10:37 -------- d-----w- c:\program files\Microsoft Works
2010-01-04 10:20 . 2010-01-04 10:20 -------- d-----w- c:\documents and settings\Filip\Application Data\Nero
2010-01-04 10:19 . 2010-01-04 10:18 -------- d-----w- c:\program files\Common Files\Nero
2010-01-04 10:18 . 2010-01-04 10:18 -------- d-----w- c:\documents and settings\All Users\Application Data\Nero
2010-01-04 09:43 . 2010-01-04 09:24 8972 ----a-w- c:\windows\pchealth\helpctr\Config\Cntstore.bin
2010-01-04 09:36 . 2010-01-04 09:36 -------- d-----w- c:\program files\DAEMON Tools Toolbar
2010-01-04 09:36 . 2010-01-04 09:36 691696 ----a-w- c:\windows\system32\drivers\sptd.sys
2010-01-04 09:36 . 2010-01-04 09:36 -------- d-----w- c:\documents and settings\All Users\Application Data\DAEMON Tools Lite
2010-01-04 09:34 . 2010-01-04 09:34 -------- d-----w- c:\program files\Realtek Sound Manager
2010-01-04 09:34 . 2010-01-04 09:34 -------- d-----w- c:\program files\AvRack
2010-01-04 09:34 . 2010-01-04 09:34 -------- d-----w- c:\program files\Realtek AC97
2010-01-04 09:24 . 2010-01-04 09:24 -------- d-----w- c:\program files\microsoft frontpage
2010-01-04 09:22 . 2010-01-04 09:22 21640 ----a-w- c:\windows\system32\emptyregdb.dat
.

((((((((((((((((((((((((((((( SnapShot@2010-03-03_13.18.08 )))))))))))))))))))))))))))))))))))))))))
.
+ 2010-03-03 17:02 . 2010-03-03 17:02 16384 c:\windows\Temp\Perflib_Perfdata_c50.dat
+ 2010-03-03 17:02 . 2010-03-03 17:02 16384 c:\windows\Temp\Perflib_Perfdata_1b8.dat
- 2010-02-26 13:24 . 2010-02-26 13:24 12800 c:\windows\assembly\GAC\Microsoft.DirectX.Diagnostics\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.Diagnostics.dll
+ 2010-03-03 15:56 . 2010-03-03 15:56 12800 c:\windows\assembly\GAC\Microsoft.DirectX.Diagnostics\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.Diagnostics.dll
+ 2010-03-03 15:56 . 2010-03-03 15:56 53248 c:\windows\assembly\GAC\Microsoft.DirectX.AudioVideoPlayback\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.AudioVideoPlayback.dll
- 2010-02-26 13:24 . 2010-02-26 13:24 53248 c:\windows\assembly\GAC\Microsoft.DirectX.AudioVideoPlayback\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.AudioVideoPlayback.dll
+ 2010-03-03 16:29 . 2010-03-03 16:29 371272 c:\windows\Installer\{D103C4BA-F905-437A-8049-DB24763BBE36}\SkypeIcon.exe
+ 2010-03-03 15:56 . 2010-03-03 15:56 223232 c:\windows\assembly\GAC\Microsoft.DirectX\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.dll
- 2010-02-26 13:24 . 2010-02-26 13:24 223232 c:\windows\assembly\GAC\Microsoft.DirectX\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.dll
+ 2010-03-03 15:57 . 2010-03-03 15:57 178176 c:\windows\assembly\GAC\Microsoft.DirectX.DirectSound\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.DirectSound.dll
- 2010-02-26 13:24 . 2010-02-26 13:24 178176 c:\windows\assembly\GAC\Microsoft.DirectX.DirectSound\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.DirectSound.dll
- 2010-02-26 13:24 . 2010-02-26 13:24 364544 c:\windows\assembly\GAC\Microsoft.DirectX.DirectPlay\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.DirectPlay.dll
+ 2010-03-03 15:56 . 2010-03-03 15:56 364544 c:\windows\assembly\GAC\Microsoft.DirectX.DirectPlay\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.DirectPlay.dll
- 2010-02-26 13:24 . 2010-02-26 13:24 159232 c:\windows\assembly\GAC\Microsoft.DirectX.DirectInput\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.DirectInput.dll
+ 2010-03-03 15:56 . 2010-03-03 15:56 159232 c:\windows\assembly\GAC\Microsoft.DirectX.DirectInput\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.DirectInput.dll
+ 2010-03-03 15:56 . 2010-03-03 15:56 145920 c:\windows\assembly\GAC\Microsoft.DirectX.DirectDraw\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.DirectDraw.dll
- 2010-02-26 13:24 . 2010-02-26 13:24 145920 c:\windows\assembly\GAC\Microsoft.DirectX.DirectDraw\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.DirectDraw.dll
- 2010-02-26 13:24 . 2010-02-26 13:24 567296 c:\windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2905.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
+ 2010-03-03 15:56 . 2010-03-03 15:56 567296 c:\windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2905.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
- 2010-02-26 13:24 . 2010-02-26 13:24 473600 c:\windows\assembly\GAC\Microsoft.DirectX.Direct3D\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.Direct3D.dll
+ 2010-03-03 15:56 . 2010-03-03 15:56 473600 c:\windows\assembly\GAC\Microsoft.DirectX.Direct3D\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.Direct3D.dll
+ 2006-11-20 12:24 . 2007-11-30 17:25 2188928 c:\windows\system32\ntoskrnl.exe
+ 2005-03-01 16:36 . 2007-11-30 16:25 2065792 c:\windows\system32\ntkrnlpa.exe
+ 2010-03-03 16:29 . 2010-03-03 16:29 1575936 c:\windows\Installer\199e9d.msi
+ 2004-08-04 12:00 . 2007-11-30 23:26 1033728 c:\windows\explorer.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{dd02a4eb-4afd-4d60-99d8-e67f964ca813}"= "c:\program files\PHPNukeEN\tbPHPN.dll" [2009-12-31 2349080]
"{e802027b-1f2b-40bd-b307-0bd96d036835}"= "c:\program files\AstroburnBar\tbAstr.dll" [2010-02-22 2353176]

[HKEY_CLASSES_ROOT\clsid\{dd02a4eb-4afd-4d60-99d8-e67f964ca813}]

[HKEY_CLASSES_ROOT\clsid\{e802027b-1f2b-40bd-b307-0bd96d036835}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{cb2050a3-32d4-1e64-e92d-087d567b4291}]
2010-02-18 08:39 1294336 ----a-w- c:\windows\system32\t-wvp2xDlt0EM.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{dd02a4eb-4afd-4d60-99d8-e67f964ca813}]
2009-12-31 10:53 2349080 ----a-w- c:\program files\PHPNukeEN\tbPHPN.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{e802027b-1f2b-40bd-b307-0bd96d036835}]
2010-02-22 11:05 2353176 ----a-w- c:\program files\AstroburnBar\tbAstr.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{dd02a4eb-4afd-4d60-99d8-e67f964ca813}"= "c:\program files\PHPNukeEN\tbPHPN.dll" [2009-12-31 2349080]
"{e802027b-1f2b-40bd-b307-0bd96d036835}"= "c:\program files\AstroburnBar\tbAstr.dll" [2010-02-22 2353176]

[HKEY_CLASSES_ROOT\clsid\{dd02a4eb-4afd-4d60-99d8-e67f964ca813}]

[HKEY_CLASSES_ROOT\clsid\{e802027b-1f2b-40bd-b307-0bd96d036835}]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{DD02A4EB-4AFD-4D60-99D8-E67F964CA813}"= "c:\program files\PHPNukeEN\tbPHPN.dll" [2009-12-31 2349080]
"{E802027B-1F2B-40BD-B307-0BD96D036835}"= "c:\program files\AstroburnBar\tbAstr.dll" [2010-02-22 2353176]

[HKEY_CLASSES_ROOT\clsid\{dd02a4eb-4afd-4d60-99d8-e67f964ca813}]

[HKEY_CLASSES_ROOT\clsid\{e802027b-1f2b-40bd-b307-0bd96d036835}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DAEMON Tools Lite"="d:\program files\DAEMON Tools Lite\DTLite.exe" [2009-10-30 369200]
"uTorrent"="d:\program files\uTorrent\uTorrent.exe" [2010-01-07 289584]
"Google Update"="c:\documents and settings\Filip\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2010-01-04 135664]
"AlcoholAutomount"="d:\program files\Alcohol Soft\Alcohol 120\axcmd.exe" [2009-04-24 203928]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2010-02-22 26101032]
"Fraps"="d:\program files\FRAPS\FRAPS.EXE" [2007-11-21 3182248]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMan"="SOUNDMAN.EXE" [2005-06-20 77824]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-11-20 12669544]
"StatusClient"="c:\program files\Hewlett-Packard\Toolbox2.0\Apache Tomcat 4.0\webapps\Toolbox\StatusClient\StatusClient.exe" [2002-12-16 36864]
"TomcatStartup"="c:\program files\Hewlett-Packard\Toolbox2.0\hpbpsttp.exe" [2003-03-31 155648]
"DrvIcon"="c:\program files\Vista Drive Icon\DrvIcon.exe" [2008-04-13 49152]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2007-11-30 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"UIHost"="c:\documents and settings\All Users\Application Data\TuneUp Software\TuneUp Utilities\WinStyler\tu_logonui.exe"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"Steam"="d:\program files\steam\steam.exe" -silent
"CTFMON.EXE"=c:\windows\system32\ctfmon.exe
"IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" ASO-616B5711-6DAE-4795-A05F-39A1E5104020
"Google Update"="c:\documents and settings\Filip\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"Adobe Reader Speed Launcher"="d:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
"NBKeyScan"="d:\program files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe"
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
"AdobeCS4ServiceManager"="c:\program files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" -launchedbylogin
"NeroFilterCheck"=c:\program files\Common Files\Nero\Lib\NeroCheck.exe
"NvMediaCenter"=RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"d:\\Program Files\\GameSpy Arcade\\Aphex.exe"=
"c:\\WINDOWS\\system32\\PnkBstrA.exe"=
"c:\\WINDOWS\\system32\\PnkBstrB.exe"=
"d:\\Program Files\\Activision\\Call of Duty 4 - Modern Warfare\\iw3mp.exe"=
"d:\\Program Files\\Activision\\Modern Warfare 2\\iw4mp.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"d:\\Program Files\\uTorrent\\uTorrent.exe"=
"d:\\Program Files\\Ascaron Entertainment\\Sacred Gold\\gameserver.exe"=
"d:\\Program Files\\Ascaron Entertainment\\Sacred Gold\\sacred.exe"=
"c:\\Program Files\\Common Files\\Adobe\\CS4ServiceManager\\CS4ServiceManager.exe"=
"c:\\Program Files\\Java\\jre6\\bin\\javaw.exe"=
"c:\\Program Files\\Hewlett-Packard\\Toolbox2.0\\Javasoft\\JRE\\1.3.1\\bin\\javaw.exe"=
"d:\\Program Files\\Mass Effect\\Binaries\\MassEffect.exe"=
"d:\\Program Files\\Mass Effect\\MassEffectLauncher.exe"=
"d:\\Program Files\\Electronic Arts\\Battlefield Bad Company 2 - BETA\\BFBC2BetaUpdater.exe"=
"d:\\Program Files\\Eidos\\Batman Arkham Asylum\\Binaries\\ShippingPC-BmGame.exe"=
"d:\\Program Files\\Electronic Arts\\Battlefield Bad Company 2 - BETA\\BFBC2Game.exe"=
"d:\\Program Files\\Steam\\Steam.exe"=
"d:\\Program Files\\Steam\\steamapps\\common\\aliens vs predator demo\\AvP.exe"=
"d:\\Program Files\\Electronic Arts\\Dead Space\\Dead Space.exe"=
"d:\\Program Files\\EA GAMES\\Battlefield 2\\BF2.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"5353:TCP"= 5353:TCP:Adobe CSI CS4

R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [4. 1. 2010 10:36 691696]
R2 Hamachi2Svc;LogMeIn Hamachi 2.0 Tunneling Engine;d:\program files\LogMeIn Hamachi\hamachi-2.exe [29. 10. 2009 12:27 1074568]
S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [16. 1. 2010 19:15 135664]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{8381a866-22ab-11df-a5b6-0011d8c084b1}]
\Shell\AutoRun\command - K:\Autorun.exe
.
Contents of the 'Scheduled Tasks' folder

2010-03-03 c:\windows\Tasks\1-Click Maintenance.job
- c:\program files\TuneUp Utilities 2009\OneClickStarter.exe [2008-12-11 20:36]

2010-03-03 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-01-16 18:15]

2010-03-03 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-01-16 18:15]

2010-03-01 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1614895754-1078145449-839522115-1003Core.job
- c:\documents and settings\Filip\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2010-01-04 09:38]

2010-03-03 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1614895754-1078145449-839522115-1003UA.job
- c:\documents and settings\Filip\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2010-01-04 09:38]

2010-03-03 c:\windows\Tasks\Úklid 1 kliknutím.job
- c:\program files\TuneUp Utilities 2009\OneClickStarter.exe [2008-12-11 20:36]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www3.iamwired.net/
uInternet Settings,ProxyOverride = <local>
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\Filip\Application Data\Mozilla\Firefox\Profiles\xhb79hlb.default\
FF - prefs.js: browser.startup.homepage - hxxp://www3.iamwired.net/
FF - prefs.js: keyword.URL - hxxp://www3.iamwired.net/websearch.php?src=tops&search=
FF - prefs.js: keyword.enabled - true
FF - prefs.js: browser.search.defaulturl - hxxp://www3.iamwired.net/websearch.php?src=tops&search=

---- FIREFOX POLICIES ----
FF - user.js: network.http.max-connections-per-server - 6
FF - user.js: network.http.max-persistent-connections-per-server - 3
FF - user.js: nglayout.initialpaint.delay - 750
FF - user.js: content.notify.interval - 750000
FF - user.js: content.max.tokenizing.time - 2250000
d:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
d:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
d:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
d:\program files\Mozilla Firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
d:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
d:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
d:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
d:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
d:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
d:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.debug", false);
d:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
d:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
d:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
d:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
d:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
d:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
d:\program files\Mozilla Firefox\greprefs\all.js - pref("html5.enable", false);
d:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
d:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");
d:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
d:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".sk");
d:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
d:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
d:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
d:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
d:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
d:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
d:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
d:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
d:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
d:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
d:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
d:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-03-03 18:02
Windows 5.1.2600 Service Pack 3, v.3264 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: TUKERNEL.EXE CLASSPNP.SYS disk.sys ACPI.sys hal.dll >>UNKNOWN [0x899171F8]<<
kernel: MBR read successfully
detected MBR rootkit hooks:
\Driver\Disk -> CLASSPNP.SYS @ 0xf765bf28
\Driver\ACPI -> ACPI.sys @ 0xf74a3cb8
\Driver\atapi -> atapi.sys @ 0xf7978b40
IoDeviceObjectType -> DeleteProcedure -> TUKERNEL.EXE @ 0x805a05b1
ParseProcedure -> TUKERNEL.EXE @ 0x8056ea25
\Device\Harddisk0\DR0 -> DeleteProcedure -> TUKERNEL.EXE @ 0x805a05b1
ParseProcedure -> TUKERNEL.EXE @ 0x8056ea25
NDIS: NVIDIA nForce Networking Controller -> SendCompleteHandler -> NDIS.sys @ 0xf7b23bb0
PacketIndicateHandler -> NDIS.sys @ 0xf7b30a21
SendHandler -> NDIS.sys @ 0xf7b0e87b
user & kernel MBR OK

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\S-1-5-21-1614895754-1078145449-839522115-1003\Software\SecuROM\License information*]
"datasecu"=hex:c5,ff,24,c6,aa,88,12,dc,fb,b8,b1,37,7d,ad,c1,06,db,93,34,57,64,
43,96,de,12,95,aa,04,2a,39,dd,e8,ba,03,00,95,86,7e,94,65,b6,ef,71,e7,ec,3b,\
"rkeysecu"=hex:2f,0f,d5,3e,02,2b,06,63,b1,0b,dd,b6,71,e2,54,98
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(760)
c:\program files\Common Files\Adobe\Adobe Drive CS4\AdobeDriveCS4_NP.dll
c:\windows\system32\cscui.dll

- - - - - - - > 'explorer.exe'(3860)
c:\windows\system32\msi.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\SETUPAPI.dll
c:\windows\system32\NETSHELL.dll
c:\windows\system32\dot3dlg.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\nvsvc32.exe
c:\windows\SOUNDMAN.EXE
c:\program files\Hewlett-Packard\Toolbox2.0\Javasoft\JRE\1.3.1\bin\javaw.exe
c:\program files\Java\jre6\bin\jqs.exe
d:\program files\Nero\Nero8\Nero BackItUp\NBService.exe
c:\windows\system32\IoctlSvc.exe
c:\windows\system32\PnkBstrA.exe
d:\program files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
c:\windows\System32\TUProgSt.exe
c:\program files\Skype\Plugin Manager\skypePM.exe
c:\windows\system32\HPBPRO.EXE
.
**************************************************************************
.
Completion time: 2010-03-03 18:04:03 - machine was rebooted
ComboFix-quarantined-files.txt 2010-03-03 17:04
ComboFix2.txt 2010-03-03 14:18
ComboFix3.txt 2010-03-03 13:19

Pre-Run: 55 233 765 376 bytes free
Post-Run: 55 249 657 856 bytes free

- - End Of File - - B6AC74BF92E3DCBD42BDE4E79597148E

#13 Příspěvek od **Caroprd111** » 03 bře 2010 18:11

Odinstalujte všechny emulátory virtuálních mechanik.

Obrázek

Stáhněte SPTD http://www.duplexsecure.com/en/downloads

Vyberte verzi podle svého operačního systému (64 & 32b). Uložte na plochu a spusťte.
zvolte možnost Uninstall a restartujte PC.

Stáhněte MBR na plochu http://www2.gmer.net/mbr/mbr.exe

Obrázek

Start > Spustit (Win + R)

Vyskočí okénko, zkopírujte do něj:

Kód: Vybrat vše

"%userprofile%\plocha\mbr" -t

Klikněte na OK

Vytvoří se log s názvem mbr.log, vložte ho sem.

Dejte log z Gmer http://www.viry.cz/forum/viewtopic.php?f=29&t=62878

BruShEr · #14 Příspěvek od **BruShEr** » 04 bře 2010 16:16

Keď som tam volžil toto

Kód: Vybrat vše

"%userprofile%\plocha\mbr" -t

tak to napísalo že je to nesprávne.

A ten log z Gmer je tu:

GMER 1.0.15.15281 - http://www.gmer.net
Rootkit scan 2010-03-04 16:12:30
Windows 5.1.2600 Service Pack 3, v.3264
Running: gmer.exe; Driver: C:\DOCUME~1\Filip\LOCALS~1\Temp\afedypob.sys

---- Kernel code sections - GMER 1.0.15 ----

.text C:\WINDOWS\system32\DRIVERS\nv4_mini.sys section is writeable [0xB57AF380, 0x5414D5, 0xE8000020]

---- Registry - GMER 1.0.15 ----

Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@h0 1
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@ujdew 0x7E 0x90 0x05 0xF4 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0 0xD4 0xC3 0x97 0x02 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0 0
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12 0x41 0xCC 0x73 0xD6 ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0 D:\Program Files\DAEMON Tools Lite\
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0 0xD4 0xC3 0x97 0x02 ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0 0
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12 0x35 0x16 0x1D 0xC9 ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@a0 0x20 0x01 0x00 0x00 ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12 0x21 0x22 0x95 0x4B ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12 0xEE 0xA0 0xC8 0x8F ...
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@h0 1
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@ujdew 0x7E 0x90 0x05 0xF4 ...
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0 0xD4 0xC3 0x97 0x02 ...
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0 0
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12 0x41 0xCC 0x73 0xD6 ...

---- EOF - GMER 1.0.15 ----

#15 Příspěvek od **Caroprd111** » 04 bře 2010 16:18

Jak to vypadá s PC

VIRY.CZ

Vírus pri spustení počítača

Vírus pri spustení počítača

Re: Vírus pri spustení počítača

Re: Vírus pri spustení počítača

Re: Vírus pri spustení počítača

Re: Vírus pri spustení počítača

Re: Vírus pri spustení počítača

Re: Vírus pri spustení počítača

Re: Vírus pri spustení počítača

Re: Vírus pri spustení počítača

Re: Vírus pri spustení počítača

Re: Vírus pri spustení počítača

Re: Vírus pri spustení počítača

Re: Vírus pri spustení počítača

Re: Vírus pri spustení počítača

Re: Vírus pri spustení počítača