Odvirování PC, zrychlení počítače, vzdálená pomoc prostřednictvím služby neslape.cz

au_.exe je to trojan?

Patříte mezi Vzorné návštěvníky? Pak je tato sekce pro vás.

Moderátor: Moderátoři

Pravidla fóra
Jednotlivé thready budou po vyřešení uzamčeny. Stejně tak ty, které budou nečinné déle než 14 dní. Vizte Pravidlo o zamykání témat. Děkujeme za pochopení.
Odpovědět
Zpráva
Autor
Sharp2448
Vzorný návštěvník
Vzorný návštěvník
Příspěvky: 77
Registrován: 25 říj 2007 21:16
Kontaktovat uživatele:
Kontaktovat uživatele Sharp2448

au_.exe je to trojan?

#1 Příspěvek od Sharp2448 »

Zdravím, když se snažím odinstalovat daemon tools lite, tak se nic nestane akorát se mi spustí ve správci úloh Au_.exe v popisu je daemon tools lite setup. Tento proces nejde ukončit(dělá i problémy při vypnutí pc). Googloval jsem jestli bych o ně něco nenašel a prý je to trojan, ale spustí se jen, když spustím odinstalaci daemona... Mám v tom trochu bordel :).
Nic méně tady je log RSIT:
Logfile of random's system information tool 1.06 (written by random/random)
Run by WTF at 2010-03-07 13:03:25
Microsoft Windows 7 Ultimate Service Pack 2
System drive C: has 6 GB (29%) free of 20 GB
Total RAM: 1534 MB (52% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 13:03:30, on 7.3.2010
Platform: Unknown Windows (WinNT 6.01.3504)
MSIE: Internet Explorer v8.00 (8.00.7600.16385)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
E:\Program Files\Comodo\COMODO Internet Security\cfp.exe
E:\Program Files\steam\Steam.exe
C:\Program Files\QIP Infium\infium.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\system32\taskhost.exe
C:\Windows\system32\wuauclt.exe
C:\Users\WTF\AppData\Local\Temp\~nsu.tmp\Au_.exe
C:\Windows\system32\taskhost.exe
E:\Program Files\firefox.exe
C:\Windows\explorer.exe
C:\Windows\system32\taskmgr.exe
C:\Windows\System32\msdt.exe
C:\Windows\System32\sdiagnhost.exe
C:\Windows\system32\conhost.exe
C:\Windows\system32\taskeng.exe
C:\Users\WTF\Downloads\RSIT.exe
C:\Program Files\trend micro\WTF.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O4 - HKLM\..\Run: [COMODO Internet Security] "E:\Program Files\Comodo\COMODO Internet Security\cfp.exe" -h
O4 - HKLM\..\Run: [QuickTime Task] "E:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKCU\..\Run: [Steam] "e:\program files\steam\steam.exe" -silent
O4 - HKCU\..\Run: [Infium] "C:\Program Files\QIP Infium\infium.exe" /autorun
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://E:\PROGRA~1\MICROS~1\Office12\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - E:\PROGRA~1\MICROS~1\Office12\REFIEBAR.DLL
O13 - Gopher Prefix:
O20 - AppInit_DLLs: C:\Windows\system32\guard32.dll
O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe
O23 - Service: COMODO Internet Security Helper Service (cmdAgent) - COMODO - E:\Program Files\Comodo\COMODO Internet Security\cmdagent.exe
O23 - Service: ServiceLayer - Nokia - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files\Common Files\Steam\SteamService.exe

--
End of file - 3449 bytes

======Registry dump======

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"COMODO Internet Security"=E:\Program Files\Comodo\COMODO Internet Security\cfp.exe [2010-01-31 1800464]
"QuickTime Task"=E:\Program Files\QuickTime\QTTask.exe [2010-02-15 417792]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Steam"=e:\program files\steam\steam.exe [2010-02-20 1217872]
"Infium"=C:\Program Files\QIP Infium\infium.exe [2009-11-19 5994496]
"Sidebar"=C:\Program Files\Windows Sidebar\sidebar.exe [2009-07-14 1173504]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
E:\Program Files\DAEMON Tools Lite\daemon.exe [2008-12-29 687560]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PWRISOVM.EXE]
E:\Program Files\PowerISO\PWRISOVM.EXE [2009-11-09 180224]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLS"=" C:\Windows\system32\guard32.dll"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\AppInfo]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\EFS]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\KeyIso]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\NTDS]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Power]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ProfSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\RpcEptMapper]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sacsvr]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SWPRV]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\TabletInputService]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\TBS]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\TrustedInstaller]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\vmms]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\volmgr.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\volmgrx.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfPf]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfRd]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{6BDD1FC1-810F-11D0-BEC7-08002BE2092F}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{D48179BE-EC20-11D1-B6B8-00C04FA372A7}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{D94EE5D8-D189-4994-83D2-F68D7D41B0E6}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AppInfo]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\BFE]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\bowser]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\dfsc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Dot3Svc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Eaphost]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\EFS]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\IKEEXT]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\KeyIso]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\MPSDrv]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\MPSSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\mrxsmb]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\mrxsmb10]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\mrxsmb20]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\NativeWifiP]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\ndiscap]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\netprofm]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\NlaSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Nsi]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\nsiproxy.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\NTDS]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\PolicyAgent]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Power]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\ProfSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\rdbss]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\rdpencdd.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\RpcEptMapper]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\sacsvr]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\SCardSvr]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\SWPRV]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\TabletInputService]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\TBS]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\TrustedInstaller]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\VaultSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\VDS]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\vmms]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\volmgr.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\volmgrx.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WinDefend]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Wlansvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfPf]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfRd]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfUsbccidDriver]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{50DD5230-BA8A-11D1-BF5D-0000F805F530}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{533C5B84-EC70-11D2-9505-00C04F79DEAF}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{6BDD1FC1-810F-11D0-BEC7-08002BE2092F}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{D48179BE-EC20-11D1-B6B8-00C04FA372A7}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{D94EE5D8-D189-4994-83D2-F68D7D41B0E6}]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=5
"ConsentPromptBehaviorUser"=3
"EnableUIADesktopToggle"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\G]
shell\AutoRun\command - G:\Autorun.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{8b3a96ec-2192-11df-82bf-001636215a64}]
shell\AutoRun\command - G:\Autorun.exe


======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*

======List of files/folders created in the last 1 months======

2010-03-07 12:48:08 ----D---- C:\Program Files\PragmaDigm
2010-03-07 12:41:30 ----D---- C:\ProgramData\CrystalIdea Software
2010-03-02 01:34:48 ----D---- C:\Program Files\OpenAL
2010-03-02 01:34:48 ----A---- C:\Windows\system32\wrap_oal.dll
2010-03-02 01:34:48 ----A---- C:\Windows\system32\OpenAL32.dll
2010-03-02 01:34:42 ----A---- C:\Windows\system32\d3dx9_36.dll
2010-03-02 00:05:57 ----D---- C:\Users\WTF\AppData\Roaming\WinRAR
2010-03-01 23:44:59 ----D---- C:\Program Files\Microsoft Works
2010-03-01 23:44:18 ----D---- C:\Program Files\Microsoft Visual Studio
2010-03-01 23:44:18 ----D---- C:\Program Files\Common Files\DESIGNER
2010-03-01 23:43:05 ----D---- C:\Windows\PCHEALTH
2010-03-01 23:43:05 ----D---- C:\Program Files\Microsoft.NET
2010-03-01 23:36:41 ----D---- C:\ProgramData\Microsoft Help
2010-03-01 11:10:21 ----D---- C:\Users\WTF\AppData\Roaming\GetRightToGo
2010-03-01 09:46:39 ----D---- C:\Users\WTF\AppData\Roaming\Nero
2010-03-01 09:44:30 ----D---- C:\ProgramData\Nero
2010-03-01 09:44:30 ----D---- C:\Program Files\Common Files\Nero
2010-02-28 18:49:45 ----D---- C:\ProgramData\Apple Computer
2010-02-28 18:48:37 ----D---- C:\Program Files\Common Files\Apple
2010-02-28 18:48:12 ----D---- C:\ProgramData\Apple
2010-02-28 18:48:12 ----D---- C:\Program Files\Apple Software Update
2010-02-28 02:07:33 ----D---- C:\Users\WTF\AppData\Roaming\uTorrent
2010-02-27 19:07:25 ----A---- C:\Windows\system32\tzres.dll
2010-02-27 19:07:12 ----A---- C:\Windows\system32\CPFilters.dll
2010-02-27 19:07:11 ----A---- C:\Windows\system32\msdri.dll
2010-02-27 19:07:10 ----A---- C:\Windows\system32\psisdecd.dll
2010-02-27 19:07:07 ----A---- C:\Windows\system32\jscript.dll
2010-02-25 00:12:32 ----A---- C:\Windows\system32\xactengine2_8.dll
2010-02-25 00:12:32 ----A---- C:\Windows\system32\x3daudio1_2.dll
2010-02-25 00:12:32 ----A---- C:\Windows\system32\d3dx10_34.dll
2010-02-25 00:12:32 ----A---- C:\Windows\system32\D3DCompiler_34.dll
2010-02-25 00:12:31 ----A---- C:\Windows\system32\xinput1_3.dll
2010-02-25 00:12:31 ----A---- C:\Windows\system32\d3dx9_34.dll
2010-02-25 00:12:30 ----A---- C:\Windows\system32\xactengine2_7.dll
2010-02-25 00:12:30 ----A---- C:\Windows\system32\d3dx10_33.dll
2010-02-25 00:12:30 ----A---- C:\Windows\system32\D3DCompiler_33.dll
2010-02-25 00:12:29 ----A---- C:\Windows\system32\xactengine2_6.dll
2010-02-25 00:12:29 ----A---- C:\Windows\system32\xactengine2_5.dll
2010-02-25 00:12:29 ----A---- C:\Windows\system32\d3dx9_33.dll
2010-02-25 00:12:28 ----A---- C:\Windows\system32\d3dx9_32.dll
2010-02-25 00:12:28 ----A---- C:\Windows\system32\d3dx10.dll
2010-02-25 00:12:27 ----A---- C:\Windows\system32\xactengine2_4.dll
2010-02-25 00:12:27 ----A---- C:\Windows\system32\x3daudio1_1.dll
2010-02-25 00:12:27 ----A---- C:\Windows\system32\d3dx9_31.dll
2010-02-25 00:12:26 ----A---- C:\Windows\system32\xactengine2_3.dll
2010-02-25 00:12:25 ----A---- C:\Windows\system32\xinput1_2.dll
2010-02-25 00:12:25 ----A---- C:\Windows\system32\xinput1_1.dll
2010-02-25 00:12:25 ----A---- C:\Windows\system32\xactengine2_2.dll
2010-02-25 00:12:24 ----A---- C:\Windows\system32\xactengine2_1.dll
2010-02-25 00:12:18 ----A---- C:\Windows\system32\xactengine2_0.dll
2010-02-25 00:12:18 ----A---- C:\Windows\system32\x3daudio1_0.dll
2010-02-25 00:12:18 ----A---- C:\Windows\system32\d3dx9_30.dll
2010-02-25 00:12:17 ----A---- C:\Windows\system32\d3dx9_29.dll
2010-02-25 00:12:17 ----A---- C:\Windows\system32\d3dx9_28.dll
2010-02-25 00:12:16 ----A---- C:\Windows\system32\d3dx9_27.dll
2010-02-25 00:12:16 ----A---- C:\Windows\system32\d3dx9_26.dll
2010-02-25 00:12:15 ----A---- C:\Windows\system32\d3dx9_25.dll
2010-02-25 00:12:15 ----A---- C:\Windows\system32\d3dx9_24.dll
2010-02-24 23:28:09 ----D---- C:\Users\WTF\AppData\Roaming\DAEMON Tools
2010-02-24 23:23:45 ----D---- C:\ProgramData\DAEMON Tools Lite
2010-02-24 23:23:36 ----D---- C:\Program Files\DAEMON Tools Toolbar
2010-02-24 23:20:37 ----D---- C:\ProgramData\DAEMON Tools Pro
2010-02-24 23:17:06 ----D---- C:\Users\WTF\AppData\Roaming\DAEMON Tools Pro
2010-02-24 23:07:47 ----D---- C:\Users\WTF\AppData\Roaming\DAEMON Tools Lite
2010-02-10 13:06:16 ----A---- C:\Windows\system32\kernel32.dll
2010-02-10 13:06:15 ----A---- C:\Windows\system32\ntoskrnl.exe
2010-02-10 13:06:15 ----A---- C:\Windows\system32\ntkrnlpa.exe
2010-02-10 13:06:15 ----A---- C:\Windows\system32\apphelp.dll
2010-02-10 13:06:06 ----A---- C:\Windows\system32\quartz.dll
2010-02-10 13:06:06 ----A---- C:\Windows\system32\msvidc32.dll
2010-02-10 13:06:06 ----A---- C:\Windows\system32\mciavi32.dll
2010-02-10 13:06:05 ----A---- C:\Windows\system32\tsbyuv.dll
2010-02-10 13:06:05 ----A---- C:\Windows\system32\msyuv.dll
2010-02-10 13:06:05 ----A---- C:\Windows\system32\msrle32.dll
2010-02-10 13:06:05 ----A---- C:\Windows\system32\iyuv_32.dll
2010-02-10 13:06:05 ----A---- C:\Windows\system32\avifil32.dll
2010-02-10 13:05:57 ----A---- C:\Windows\system32\secproc_isv.dll
2010-02-10 13:05:56 ----A---- C:\Windows\system32\secproc.dll
2010-02-10 13:05:55 ----A---- C:\Windows\system32\RMActivate_isv.exe
2010-02-10 13:05:55 ----A---- C:\Windows\system32\RMActivate.exe
2010-02-10 13:05:54 ----A---- C:\Windows\system32\secproc_ssp_isv.dll
2010-02-10 13:05:54 ----A---- C:\Windows\system32\secproc_ssp.dll
2010-02-10 13:05:54 ----A---- C:\Windows\system32\RMActivate_ssp_isv.exe
2010-02-10 13:05:53 ----A---- C:\Windows\system32\RMActivate_ssp.exe

======List of files/folders modified in the last 1 months======

2010-03-07 13:03:27 ----D---- C:\Windows\Temp
2010-03-07 13:03:27 ----D---- C:\Program Files\trend micro
2010-03-07 13:03:15 ----D---- C:\Windows\system32\Tasks
2010-03-07 12:54:59 ----D---- C:\Windows\Prefetch
2010-03-07 12:48:08 ----RD---- C:\Program Files
2010-03-07 12:41:30 ----HD---- C:\ProgramData
2010-03-07 11:52:14 ----D---- C:\Windows\system32\config
2010-03-07 11:29:16 ----D---- C:\Windows
2010-03-07 11:26:51 ----D---- C:\Windows\Minidump
2010-03-04 21:17:23 ----SD---- C:\Users\WTF\AppData\Roaming\Microsoft
2010-03-04 19:43:58 ----D---- C:\Windows\system32\NDF
2010-03-04 10:36:07 ----D---- C:\Program Files\Common Files\Steam
2010-03-03 09:34:55 ----D---- C:\Windows\System32
2010-03-03 09:34:55 ----A---- C:\Windows\system32\PerfStringBackup.INI
2010-03-03 09:34:54 ----D---- C:\Windows\inf
2010-03-02 02:13:56 ----SHD---- C:\System Volume Information
2010-03-02 00:00:43 ----SHD---- C:\Windows\Installer
2010-03-01 23:48:40 ----RSD---- C:\Windows\assembly
2010-03-01 23:48:21 ----D---- C:\Windows\winsxs
2010-03-01 23:44:56 ----D---- C:\Program Files\Common Files\microsoft shared
2010-03-01 23:44:18 ----D---- C:\Program Files\Common Files
2010-03-01 23:44:10 ----D---- C:\Windows\ShellNew
2010-03-01 23:43:25 ----RSD---- C:\Windows\Fonts
2010-03-01 23:43:05 ----SD---- C:\ProgramData\Microsoft
2010-03-01 19:33:15 ----D---- C:\Windows\system32\wfp
2010-03-01 19:33:15 ----D---- C:\Windows\system32\drivers
2010-03-01 19:33:15 ----D---- C:\Windows\system32\catroot2
2010-03-01 19:33:12 ----D---- C:\Windows\system32\wbem
2010-03-01 19:33:12 ----D---- C:\Windows\registration
2010-03-01 19:31:54 ----D---- C:\Windows\system32\LogFiles
2010-03-01 11:51:56 ----D---- C:\Windows\Logs
2010-03-01 09:09:49 ----D---- C:\Windows\rescache
2010-02-28 18:50:17 ----D---- C:\Program Files\Internet Explorer
2010-02-27 21:39:34 ----D---- C:\Windows\Microsoft.NET
2010-02-27 19:20:22 ----D---- C:\Windows\AppPatch
2010-02-27 19:19:09 ----D---- C:\Windows\system32\catroot
2010-02-27 19:09:58 ----D---- C:\Windows\system32\cs-CZ
2010-02-27 19:08:42 ----D---- C:\Windows\ehome
2010-02-27 19:08:17 ----D---- C:\Windows\system32\sk-SK
2010-02-27 19:08:16 ----D---- C:\Windows\system32\en-US
2010-02-24 09:16:06 ----N---- C:\Windows\system32\MpSigStub.exe
2010-02-20 15:29:24 ----D---- C:\Windows\system32\wdi
2010-02-15 14:33:23 ----D---- C:\Windows\debug
2010-02-08 11:40:40 ----A---- C:\Windows\system32\guard32.dll

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 blbdrive;blbdrive; C:\Windows\system32\DRIVERS\blbdrive.sys [2009-07-14 35328]
R1 cmdGuard;COMODO Internet Security Sandbox Driver; C:\Windows\System32\DRIVERS\cmdguard.sys [2010-02-08 130960]
R1 cmdHlp;COMODO Internet Security Helper Driver; C:\Windows\System32\DRIVERS\cmdhlp.sys [2010-01-31 29520]
R1 CSC;@%systemroot%\system32\cscsvc.dll,-202; C:\Windows\system32\drivers\csc.sys [2009-07-14 387584]
R1 DfsC;@%systemroot%\system32\drivers\dfsc.sys,-101; C:\Windows\System32\Drivers\dfsc.sys [2009-07-14 78336]
R1 discache;@%systemroot%\system32\drivers\discache.sys,-102; C:\Windows\System32\drivers\discache.sys [2009-07-14 32256]
R1 inspect;COMODO Internet Security Firewall Driver; C:\Windows\system32\DRIVERS\inspect.sys [2010-01-31 74328]
R1 nsiproxy;@%SystemRoot%\system32\drivers\nsiproxy.sys,-2; C:\Windows\system32\drivers\nsiproxy.sys [2009-07-14 16896]
R1 RDPENCDD;@%systemroot%\system32\drivers\RDPENCDD.sys,-101; C:\Windows\system32\drivers\rdpencdd.sys [2009-07-14 6656]
R1 RDPREFMP;@%systemroot%\system32\drivers\RdpRefMp.sys,-101; C:\Windows\system32\drivers\rdprefmp.sys [2009-07-14 7168]
R1 SCDEmu;SCDEmu; C:\Windows\system32\drivers\SCDEmu.sys [2009-11-09 59388]
R1 tdx;@%SystemRoot%\system32\tcpipcfg.dll,-50004; C:\Windows\system32\DRIVERS\tdx.sys [2009-07-14 74240]
R1 Wanarpv6;@%systemroot%\system32\rascfg.dll,-32012; C:\Windows\system32\DRIVERS\wanarp.sys [2009-07-14 63488]
R1 WfpLwf;WFP Lightweight Filter; C:\Windows\system32\DRIVERS\wfplwf.sys [2009-07-14 9728]
R2 lltdio;Link-Layer Topology Discovery Mapper I/O Driver; C:\Windows\system32\DRIVERS\lltdio.sys [2009-07-14 48128]
R2 luafv;@%systemroot%\system32\drivers\luafv.sys,-100; C:\Windows\system32\drivers\luafv.sys [2009-07-14 86528]
R2 PEAUTH;PEAUTH; C:\Windows\system32\drivers\peauth.sys [2009-07-14 586752]
R2 rspndr;Link-Layer Topology Discovery Responder; C:\Windows\system32\DRIVERS\rspndr.sys [2009-07-14 60928]
R2 tcpipreg;TCP/IP Registry Compatibility; C:\Windows\System32\drivers\tcpipreg.sys [2009-07-14 34816]
R3 atikmdag;atikmdag; C:\Windows\system32\DRIVERS\atikmdag.sys [2008-12-01 4179968]
R3 bcm4sbxp;Broadcom 440x 10/100 Integrated Controller XP Driver; C:\Windows\system32\DRIVERS\bcm4sbxp.sys [2009-07-13 46080]
R3 bowser;@%systemroot%\system32\browser.dll,-102; C:\Windows\system32\DRIVERS\bowser.sys [2009-07-14 69632]
R3 CAMCAUD;Conexant AMC Audio; C:\Windows\system32\drivers\camcaud.sys [2004-06-25 34048]
R3 CAMCHALA;CAMCHALA; C:\Windows\system32\drivers\camchal.sys [2004-06-25 276480]
R3 CmBatt;Ovladač Microsoft AC Adapter; C:\Windows\system32\DRIVERS\CmBatt.sys [2009-07-14 14080]
R3 CompositeBus;Ovladač rozpoznávacího modulu složené sběrnice; C:\Windows\system32\DRIVERS\CompositeBus.sys [2009-07-14 31232]
R3 DXGKrnl;LDDM Graphics Subsystem; C:\Windows\System32\drivers\dxgkrnl.sys [2009-10-02 728648]
R3 HidUsb;Ovladač třídy standardu HID Microsoft; C:\Windows\system32\DRIVERS\hidusb.sys [2009-07-14 24064]
R3 intelppm;Ovladač procesoru Intel; C:\Windows\system32\DRIVERS\intelppm.sys [2009-07-14 53760]
R3 monitor;Služba ovladače funkce třídy monitorů Microsoft; C:\Windows\system32\DRIVERS\monitor.sys [2009-07-14 23552]
R3 mouhid;Ovladač myši standardu HID; C:\Windows\system32\DRIVERS\mouhid.sys [2009-07-14 26112]
R3 mpsdrv;@%SystemRoot%\system32\FirewallAPI.dll,-23092; C:\Windows\System32\drivers\mpsdrv.sys [2009-07-14 60416]
R3 mrxsmb10;@%systemroot%\system32\wkssvc.dll,-1004; C:\Windows\system32\DRIVERS\mrxsmb10.sys [2010-01-08 221184]
R3 mrxsmb20;@%systemroot%\system32\wkssvc.dll,-1006; C:\Windows\system32\DRIVERS\mrxsmb20.sys [2009-07-14 95744]
R3 NativeWifiP;NativeWiFi Filter; C:\Windows\system32\DRIVERS\nwifi.sys [2009-07-14 267264]
R3 NETw2v32;Ovladač bezdrátové síťové karty pro operační systém Windows Vista Intel(R) PRO/Wireless 2200BG Network Connection Driver for Windows Vista; C:\Windows\system32\DRIVERS\NETw2v32.sys [2007-03-07 2595840]
R3 RasAgileVpn;WAN Miniport (IKEv2); C:\Windows\system32\DRIVERS\AgileVpn.sys [2009-07-14 49152]
R3 RasSstp;@%systemroot%\system32\sstpsvc.dll,-202; C:\Windows\system32\DRIVERS\rassstp.sys [2009-07-14 75264]
R3 rdpbus;Remote Desktop Device Redirector Bus Driver; C:\Windows\system32\DRIVERS\rdpbus.sys [2009-07-14 18944]
R3 srv2;@%systemroot%\system32\srvsvc.dll,-104; C:\Windows\System32\DRIVERS\srv2.sys [2009-07-14 306688]
R3 srvnet;srvnet; C:\Windows\System32\DRIVERS\srvnet.sys [2009-12-08 113664]
R3 tunnel;Microsoft Tunnel Miniport Adapter Driver; C:\Windows\system32\DRIVERS\tunnel.sys [2009-07-14 108544]
R3 umbus;Ovladač sběrnice UMBus Enumerator; C:\Windows\system32\DRIVERS\umbus.sys [2009-07-14 39936]
R3 usbehci;Ovladač miniportu vylepšeného hostitelského řadiče Microsoft USB 2.0; C:\Windows\system32\DRIVERS\usbehci.sys [2009-07-14 41472]
R3 usbhub;Ovladač standardního rozbočovače USB; C:\Windows\system32\DRIVERS\usbhub.sys [2009-07-14 258560]
R3 usbuhci;Ovladač miniportu univerzálního hostitelského řadiče Microsoft USB; C:\Windows\system32\DRIVERS\usbuhci.sys [2009-07-14 24064]
R3 VST_DPV;VST_DPV; C:\Windows\system32\DRIVERS\VSTDPV3.SYS [2009-07-13 980992]
R3 VSTHWICH;VSTHWICH; C:\Windows\system32\DRIVERS\VSTICH3.SYS [2009-07-13 242176]
R3 winachsf;winachsf; C:\Windows\system32\DRIVERS\VSTCNXT3.SYS [2009-07-13 661504]
R3 WudfPf;User Mode Driver Frameworks Platform Driver; C:\Windows\system32\drivers\WudfPf.sys [2009-07-14 92672]
S3 1394ohci;1394 OHCI Compliant Host Controller; C:\Windows\system32\DRIVERS\1394ohci.sys [2009-07-14 163328]
S3 AcpiPmi;ACPI Power Meter Driver; C:\Windows\system32\DRIVERS\acpipmi.sys [2009-07-14 9728]
S3 adp94xx;adp94xx; C:\Windows\system32\DRIVERS\adp94xx.sys [2009-07-14 422976]
S3 adpahci;adpahci; C:\Windows\system32\DRIVERS\adpahci.sys [2009-07-14 297552]
S3 adpu320;adpu320; C:\Windows\system32\DRIVERS\adpu320.sys [2009-07-14 146512]
S3 agp440;Intel AGP Bus Filter; C:\Windows\system32\DRIVERS\agp440.sys [2009-07-14 53312]
S3 amdagp;AMD AGP Bus Filter Driver; C:\Windows\system32\DRIVERS\amdagp.sys [2009-07-14 53312]
S3 amdide;amdide; C:\Windows\system32\DRIVERS\amdide.sys [2009-07-14 14912]
S3 AmdK8;AMD K8 Processor Driver; C:\Windows\system32\DRIVERS\amdk8.sys [2009-07-14 55296]
S3 AmdPPM;AMD Processor Driver; C:\Windows\system32\DRIVERS\amdppm.sys [2009-07-14 52736]
S3 amdsata;amdsata; C:\Windows\system32\DRIVERS\amdsata.sys [2009-07-14 79952]
S3 amdsbs;amdsbs; C:\Windows\system32\DRIVERS\amdsbs.sys [2009-07-14 159312]
S3 amsegiix;amsegiix; C:\Windows\system32\drivers\amsegiix.sys []
S3 AppID;@%systemroot%\system32\appidsvc.dll,-102; C:\Windows\system32\drivers\appid.sys [2009-07-14 50176]
S3 arc;arc; C:\Windows\system32\DRIVERS\arc.sys [2009-07-14 76368]
S3 arcsas;arcsas; C:\Windows\system32\DRIVERS\arcsas.sys [2009-07-14 86608]
S3 b06bdrv;Broadcom NetXtreme II VBD; C:\Windows\system32\DRIVERS\bxvbdx.sys [2009-07-13 430080]
S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0; C:\Windows\system32\DRIVERS\b57nd60x.sys [2009-07-13 229888]
S3 BrFiltLo;Brother USB Mass-Storage Lower Filter Driver; C:\Windows\system32\DRIVERS\BrFiltLo.sys [2009-07-13 13568]
S3 BrFiltUp;Brother USB Mass-Storage Upper Filter Driver; C:\Windows\system32\DRIVERS\BrFiltUp.sys [2009-07-13 5248]
S3 Brserid;Brother MFC Serial Port Interface Driver (WDM); C:\Windows\System32\Drivers\Brserid.sys [2009-07-14 272128]
S3 BrSerWdm;Brother WDM Serial driver; C:\Windows\System32\Drivers\BrSerWdm.sys [2009-07-13 62336]
S3 BrUsbMdm;Brother MFC USB Fax Only Modem; C:\Windows\System32\Drivers\BrUsbMdm.sys [2009-07-13 12160]
S3 BrUsbSer;Brother MFC USB Serial WDM Driver; C:\Windows\System32\Drivers\BrUsbSer.sys [2009-07-13 11904]
S3 BTHMODEM;Bluetooth Serial Communications Driver; C:\Windows\system32\DRIVERS\bthmodem.sys [2009-07-14 56320]
S3 circlass;Consumer IR Devices; C:\Windows\system32\DRIVERS\circlass.sys [2009-07-14 37888]
S3 ebdrv;Broadcom NetXtreme II 10 GigE VBD; C:\Windows\system32\DRIVERS\evbdx.sys [2009-07-13 3100160]
S3 elxstor;elxstor; C:\Windows\system32\DRIVERS\elxstor.sys [2009-07-14 453712]
S3 ErrDev;Microsoft Hardware Error Device Driver; C:\Windows\system32\DRIVERS\errdev.sys [2009-07-14 7168]
S3 exfat;exFAT File System Driver; C:\Windows\system32\drivers\exfat.sys [2009-07-14 142336]
S3 Filetrace;@%SystemRoot%\system32\drivers\filetrace.sys,-10001; C:\Windows\system32\drivers\filetrace.sys [2009-07-14 28160]
S3 FsDepends;@%SystemRoot%\system32\drivers\fsdepends.sys,-10001; C:\Windows\System32\drivers\FsDepends.sys [2009-07-14 46160]
S3 gagp30kx;Microsoft Generic AGPv3.0 Filter for K8 Processor Platforms; C:\Windows\system32\DRIVERS\gagp30kx.sys [2009-07-14 57936]
S3 hcw85cir;Hauppauge Consumer Infrared Receiver; C:\Windows\system32\drivers\hcw85cir.sys [2009-07-13 26624]
S3 HDAudBus;Microsoft UAA Bus Driver for High Definition Audio; C:\Windows\system32\DRIVERS\HDAudBus.sys [2009-07-14 108544]
S3 HidBatt;HID UPS Battery Driver; C:\Windows\system32\DRIVERS\HidBatt.sys [2009-07-14 21504]
S3 HidBth;Microsoft Bluetooth HID Miniport; C:\Windows\system32\DRIVERS\hidbth.sys [2009-07-14 91136]
S3 HidIr;Microsoft Infrared HID Driver; C:\Windows\system32\DRIVERS\hidir.sys [2009-07-14 37888]
S3 HpSAMD;HpSAMD; C:\Windows\system32\DRIVERS\HpSAMD.sys [2009-07-14 67152]
S3 iaStorV;iaStorV; C:\Windows\system32\DRIVERS\iaStorV.sys [2009-07-14 332352]
S3 iirsp;iirsp; C:\Windows\system32\DRIVERS\iirsp.sys [2009-07-14 41040]
S3 IPMIDRV;IPMIDRV; C:\Windows\system32\DRIVERS\IPMIDrv.sys [2009-07-14 65536]
S3 isapnp;isapnp; C:\Windows\system32\DRIVERS\isapnp.sys [2009-07-14 46656]
S3 iScsiPrt;iScsiPort Driver; C:\Windows\system32\DRIVERS\msiscsi.sys [2009-07-14 186960]
S3 kbdhid;Ovladač klávesnice standardu HID; C:\Windows\system32\DRIVERS\kbdhid.sys [2009-07-14 28160]
S3 LSI_FC;LSI_FC; C:\Windows\system32\DRIVERS\lsi_fc.sys [2009-07-14 95824]
S3 LSI_SAS;LSI_SAS; C:\Windows\system32\DRIVERS\lsi_sas.sys [2009-07-14 89168]
S3 LSI_SAS2;LSI_SAS2; C:\Windows\system32\DRIVERS\lsi_sas2.sys [2009-07-14 54864]
S3 LSI_SCSI;LSI_SCSI; C:\Windows\system32\DRIVERS\lsi_scsi.sys [2009-07-14 96848]
S3 megasas;megasas; C:\Windows\system32\DRIVERS\megasas.sys [2009-07-14 30800]
S3 MegaSR;MegaSR; C:\Windows\system32\DRIVERS\MegaSR.sys [2009-07-14 235584]
S3 mpio;mpio; C:\Windows\system32\DRIVERS\mpio.sys [2009-07-14 130624]
S3 msahci;msahci; C:\Windows\system32\DRIVERS\msahci.sys [2009-07-14 27712]
S3 msdsm;msdsm; C:\Windows\system32\DRIVERS\msdsm.sys [2009-07-14 115792]
S3 mshidkmdf;@%SystemRoot%\system32\drivers\mshidkmdf.sys,-100; C:\Windows\System32\drivers\mshidkmdf.sys [2009-07-14 4096]
S3 MsRPC;MsRPC; C:\Windows\system32\drivers\MsRPC.sys [2009-07-14 162896]
S3 MSTEE;Konvertor jímka-jímka typu T datových proudů Microsoft; C:\Windows\system32\drivers\MSTEE.sys [2009-07-14 6144]
S3 MTConfig;Microsoft Input Configuration Driver; C:\Windows\system32\DRIVERS\MTConfig.sys [2009-07-14 12288]
S3 NdisCap;NDIS Capture LightWeight Filter; C:\Windows\system32\DRIVERS\ndiscap.sys [2009-07-14 27136]
S3 nfrd960;nfrd960; C:\Windows\system32\DRIVERS\nfrd960.sys [2009-07-14 44624]
S3 nmwcd;Nokia USB Phone Parent; C:\Windows\system32\drivers\ccdcmb.sys [2009-10-06 17664]
S3 nmwcdc;Nokia USB Generic; C:\Windows\system32\drivers\ccdcmbo.sys [2009-10-06 22016]
S3 nv_agp;NVIDIA nForce AGP Bus Filter; C:\Windows\system32\DRIVERS\nv_agp.sys [2009-07-14 105024]
S3 nvraid;nvraid; C:\Windows\system32\DRIVERS\nvraid.sys [2009-07-14 117312]
S3 nvstor;nvstor; C:\Windows\system32\DRIVERS\nvstor.sys [2009-07-14 142416]
S3 ohci1394;1394 OHCI Compliant Host Controller (Legacy); C:\Windows\system32\DRIVERS\ohci1394.sys [2009-07-14 62464]
S3 pccsmcfd;PCCS Mode Change Filter Driver; C:\Windows\system32\DRIVERS\pccsmcfd.sys [2008-08-26 18816]
S3 ql2300;ql2300; C:\Windows\system32\DRIVERS\ql2300.sys [2009-07-14 1383488]
S3 ql40xx;ql40xx; C:\Windows\system32\DRIVERS\ql40xx.sys [2009-07-14 106064]
S3 QWAVEdrv;@%SystemRoot%\system32\drivers\qwavedrv.sys,-1; C:\Windows\system32\drivers\qwavedrv.sys [2009-07-14 31744]
S3 s3cap;s3cap; C:\Windows\system32\DRIVERS\vms3cap.sys [2009-07-14 5632]
S3 sbp2port;sbp2port; C:\Windows\system32\DRIVERS\sbp2port.sys [2009-07-14 85568]
S3 scfilter;@%SystemRoot%\System32\drivers\scfilter.sys,-11; C:\Windows\System32\DRIVERS\scfilter.sys [2009-07-14 26624]
S3 sermouse;Serial Mouse Driver; C:\Windows\system32\DRIVERS\sermouse.sys [2009-07-14 19968]
S3 sffdisk;SFF Storage Class Driver; C:\Windows\system32\DRIVERS\sffdisk.sys [2009-07-14 11264]
S3 sffp_mmc;SFF Storage Protocol Driver for MMC; C:\Windows\system32\DRIVERS\sffp_mmc.sys [2009-07-14 12288]
S3 sffp_sd;SFF Storage Protocol Driver for SDBus; C:\Windows\system32\DRIVERS\sffp_sd.sys [2009-07-14 12800]
S3 sisagp;SIS AGP Bus Filter; C:\Windows\system32\DRIVERS\sisagp.sys [2009-07-14 52304]
S3 SiSRaid2;SiSRaid2; C:\Windows\system32\DRIVERS\SiSRaid2.sys [2009-07-14 40016]
S3 SiSRaid4;SiSRaid4; C:\Windows\system32\DRIVERS\sisraid4.sys [2009-07-14 77888]
S3 Smb;@%SystemRoot%\system32\tcpipcfg.dll,-50005; C:\Windows\system32\DRIVERS\smb.sys [2009-07-14 71168]
S3 stexstor;stexstor; C:\Windows\system32\DRIVERS\stexstor.sys [2009-07-14 21072]
S3 storvsc;storvsc; C:\Windows\system32\DRIVERS\storvsc.sys [2009-07-14 28224]
S3 TCPIP6;Microsoft IPv6 Protocol Driver; C:\Windows\system32\DRIVERS\tcpip.sys [2009-07-14 1285712]
S3 tssecsrv;@%SystemRoot%\System32\DRIVERS\tssecsrv.sys,-101; C:\Windows\System32\DRIVERS\tssecsrv.sys [2009-07-14 30208]
S3 uagp35;Microsoft AGPv3.5 Filter; C:\Windows\system32\DRIVERS\uagp35.sys [2009-07-14 55888]
S3 uliagpkx;Uli AGP Bus Filter; C:\Windows\system32\DRIVERS\uliagpkx.sys [2009-07-14 57424]
S3 UmPass;Microsoft UMPass Driver; C:\Windows\system32\DRIVERS\umpass.sys [2009-07-14 8192]
S3 upperdev;upperdev; C:\Windows\system32\DRIVERS\usbser_lowerflt.sys [2009-10-06 7936]
S3 usbccgp;Obecný nadřazený ovladač Microsoft USB; C:\Windows\system32\DRIVERS\usbccgp.sys [2009-07-14 75264]
S3 usbcir;eHome Infrared Receiver (USBCIR); C:\Windows\system32\DRIVERS\usbcir.sys [2009-07-14 86016]
S3 usbohci;Microsoft USB Open Host Controller Miniport Driver; C:\Windows\system32\DRIVERS\usbohci.sys [2009-07-14 20480]
S3 usbprint;Microsoft USB PRINTER Class; C:\Windows\system32\DRIVERS\usbprint.sys [2009-07-14 19968]
S3 usbser;USB Modem Driver; C:\Windows\system32\drivers\usbser.sys [2009-07-14 27648]
S3 UsbserFilt;UsbserFilt; C:\Windows\system32\DRIVERS\usbser_lowerfltj.sys [2009-10-06 7936]
S3 USBSTOR;Ovladač velkokapacitního paměťového zařízení USB; C:\Windows\system32\DRIVERS\USBSTOR.SYS [2009-07-14 74752]
S3 vga;vga; C:\Windows\system32\DRIVERS\vgapnp.sys [2009-07-14 26112]
S3 vhdmp;vhdmp; C:\Windows\system32\DRIVERS\vhdmp.sys [2009-07-14 159824]
S3 viaagp;VIA AGP Bus Filter; C:\Windows\system32\DRIVERS\viaagp.sys [2009-07-14 53328]
S3 ViaC7;VIA C7 Processor Driver; C:\Windows\system32\DRIVERS\viac7.sys [2009-07-14 52736]
S3 vmbus;@%SystemRoot%\system32\vmbusres.dll,-1000; C:\Windows\system32\DRIVERS\vmbus.sys [2009-07-14 175824]
S3 VMBusHID;VMBusHID; C:\Windows\system32\DRIVERS\VMBusHID.sys [2009-07-14 17920]
S3 vsmraid;vsmraid; C:\Windows\system32\DRIVERS\vsmraid.sys [2009-07-14 141904]
S3 vwifibus;@%SystemRoot%\System32\drivers\vwifibus.sys,-257; C:\Windows\System32\drivers\vwifibus.sys [2009-07-14 19968]
S3 WacomPen;Wacom Serial Pen HID Driver; C:\Windows\system32\DRIVERS\wacompen.sys [2009-07-14 21632]
S3 Wd;Wd; C:\Windows\system32\DRIVERS\wd.sys [2009-07-14 19024]
S3 WIMMount;WIMMount; C:\Windows\system32\drivers\wimmount.sys [2009-07-14 19008]
S3 WinUsb;WinUsb; C:\Windows\system32\DRIVERS\WinUsb.sys [2009-07-14 34944]
S3 WmiAcpi;Microsoft Windows Management Interface for ACPI; C:\Windows\system32\DRIVERS\wmiacpi.sys [2009-07-14 11264]
S3 WUDFRd;WUDFRd; C:\Windows\system32\DRIVERS\WUDFRd.sys [2009-07-14 132224]
S4 crcdisk;Crcdisk Filter Driver; C:\Windows\system32\DRIVERS\crcdisk.sys [2009-07-14 22096]
S4 ws2ifsl;@%systemroot%\System32\drivers\ws2ifsl.sys,-1000; C:\Windows\system32\drivers\ws2ifsl.sys [2009-07-14 16384]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 Ati External Event Utility;Ati External Event Utility; C:\Windows\system32\Ati2evxx.exe [2008-12-01 720896]
R2 AudioEndpointBuilder;@%SystemRoot%\system32\audiosrv.dll,-204; C:\Windows\System32\svchost.exe [2009-07-14 20992]
R2 BFE;@%SystemRoot%\system32\bfe.dll,-1001; C:\Windows\system32\svchost.exe [2009-07-14 20992]
R2 cmdAgent;COMODO Internet Security Helper Service; E:\Program Files\Comodo\COMODO Internet Security\cmdagent.exe [2010-01-31 723632]
R2 CscService;@%systemroot%\system32\cscsvc.dll,-200; C:\Windows\System32\svchost.exe [2009-07-14 20992]
R2 DPS;@%systemroot%\system32\dps.dll,-500; C:\Windows\System32\svchost.exe [2009-07-14 20992]
R2 EFS;@%SystemRoot%\system32\efssvc.dll,-100; C:\Windows\System32\lsass.exe [2009-07-14 22528]
R2 FDResPub;@%systemroot%\system32\fdrespub.dll,-100; C:\Windows\system32\svchost.exe [2009-07-14 20992]
R2 gpsvc;@gpapi.dll,-112; C:\Windows\system32\svchost.exe [2009-07-14 20992]
R2 IKEEXT;@%SystemRoot%\system32\ikeext.dll,-501; C:\Windows\system32\svchost.exe [2009-07-14 20992]
R2 iphlpsvc;@%SystemRoot%\system32\iphlpsvc.dll,-500; C:\Windows\System32\svchost.exe [2009-07-14 20992]
R2 MMCSS;@%systemroot%\system32\mmcss.dll,-100; C:\Windows\system32\svchost.exe [2009-07-14 20992]
R2 MpsSvc;@%SystemRoot%\system32\FirewallAPI.dll,-23090; C:\Windows\system32\svchost.exe [2009-07-14 20992]
R2 NlaSvc;@%SystemRoot%\System32\nlasvc.dll,-1; C:\Windows\System32\svchost.exe [2009-07-14 20992]
R2 nsi;@%SystemRoot%\system32\nsisvc.dll,-200; C:\Windows\system32\svchost.exe [2009-07-14 20992]
R2 Power;@%SystemRoot%\system32\umpo.dll,-100; C:\Windows\system32\svchost.exe [2009-07-14 20992]
R2 ProfSvc;@%systemroot%\system32\profsvc.dll,-300; C:\Windows\system32\svchost.exe [2009-07-14 20992]
R2 RpcEptMapper;@%windir%\system32\RpcEpMap.dll,-1001; C:\Windows\system32\svchost.exe [2009-07-14 20992]
R2 SysMain;@%SystemRoot%\system32\sysmain.dll,-1000; C:\Windows\system32\svchost.exe [2009-07-14 20992]
R2 UxSms;@%SystemRoot%\system32\dwm.exe,-2000; C:\Windows\System32\svchost.exe [2009-07-14 20992]
R2 WinDefend;@%ProgramFiles%\Windows Defender\MsMpRes.dll,-103; C:\Windows\System32\svchost.exe [2009-07-14 20992]
R2 Wlansvc;@%SystemRoot%\System32\wlansvc.dll,-257; C:\Windows\system32\svchost.exe [2009-07-14 20992]
R2 WMPNetworkSvc;@%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101; C:\Program Files\Windows Media Player\wmpnetwk.exe [2009-07-14 1121280]
R2 WSearch;@%systemroot%\system32\SearchIndexer.exe,-103; C:\Windows\system32\SearchIndexer.exe [2009-07-14 428032]
R2 wudfsvc;@%SystemRoot%\system32\wudfsvc.dll,-1000; C:\Windows\system32\svchost.exe [2009-07-14 20992]
R3 AeLookupSvc;@%SystemRoot%\system32\aelupsvc.dll,-1; C:\Windows\system32\svchost.exe [2009-07-14 20992]
R3 Appinfo;@%systemroot%\system32\appinfo.dll,-100; C:\Windows\system32\svchost.exe [2009-07-14 20992]
R3 fdPHost;@%systemroot%\system32\fdPHost.dll,-100; C:\Windows\system32\svchost.exe [2009-07-14 20992]
R3 HomeGroupListener;@%SystemRoot%\System32\ListSvc.dll,-100; C:\Windows\System32\svchost.exe [2009-07-14 20992]
R3 HomeGroupProvider;@%SystemRoot%\System32\provsvc.dll,-100; C:\Windows\System32\svchost.exe [2009-07-14 20992]
R3 KeyIso;@keyiso.dll,-100; C:\Windows\system32\lsass.exe [2009-07-14 22528]
R3 netprofm;@%SystemRoot%\system32\netprofm.dll,-202; C:\Windows\System32\svchost.exe [2009-07-14 20992]
R3 p2pimsvc;@%SystemRoot%\system32\pnrpsvc.dll,-8004; C:\Windows\System32\svchost.exe [2009-07-14 20992]
R3 p2psvc;@%SystemRoot%\system32\p2psvc.dll,-8006; C:\Windows\System32\svchost.exe [2009-07-14 20992]
R3 PcaSvc;@%SystemRoot%\system32\pcasvc.dll,-1; C:\Windows\system32\svchost.exe [2009-07-14 20992]
R3 PNRPsvc;@%SystemRoot%\system32\pnrpsvc.dll,-8000; C:\Windows\System32\svchost.exe [2009-07-14 20992]
R3 SDRSVC;@%SystemRoot%\system32\sdrsvc.dll,-107; C:\Windows\system32\svchost.exe [2009-07-14 20992]
R3 Steam Client Service;Steam Client Service; C:\Program Files\Common Files\Steam\SteamService.exe [2010-03-04 332720]
R3 WdiServiceHost;@%systemroot%\system32\wdi.dll,-502; C:\Windows\System32\svchost.exe [2009-07-14 20992]
R3 WdiSystemHost;@%systemroot%\system32\wdi.dll,-500; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S2 sppsvc;@%SystemRoot%\system32\sppsvc.exe,-101; C:\Windows\system32\sppsvc.exe [2009-07-14 3179520]
S3 AppIDSvc;@%systemroot%\system32\appidsvc.dll,-100; C:\Windows\system32\svchost.exe [2009-07-14 20992]
S3 AxInstSV;@%SystemRoot%\system32\AxInstSV.dll,-103; C:\Windows\system32\svchost.exe [2009-07-14 20992]
S3 BDESVC;@%SystemRoot%\system32\bdesvc.dll,-100; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 bthserv;@%SystemRoot%\System32\bthserv.dll,-101; C:\Windows\system32\svchost.exe [2009-07-14 20992]
S3 CertPropSvc;@%SystemRoot%\System32\certprop.dll,-11; C:\Windows\system32\svchost.exe [2009-07-14 20992]
S3 clr_optimization_v2.0.50727_32;Microsoft .NET Framework NGEN v2.0.50727_X86; C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2009-06-10 66384]
S3 defragsvc;@%SystemRoot%\system32\defragsvc.dll,-101; C:\Windows\system32\svchost.exe [2009-07-14 20992]
S3 ehRecvr;@%SystemRoot%\ehome\ehrecvr.exe,-101; C:\Windows\ehome\ehRecvr.exe [2009-07-14 557056]
S3 ehSched;@%SystemRoot%\ehome\ehsched.exe,-101; C:\Windows\ehome\ehsched.exe [2009-07-14 94720]
S3 Fax;@%systemroot%\system32\fxsresm.dll,-118; C:\Windows\system32\fxssvc.exe [2009-07-14 522752]
S3 FontCache;@%systemroot%\system32\FntCache.dll,-100; C:\Windows\system32\svchost.exe [2009-07-14 20992]
S3 FontCache3.0.0.0;@%SystemRoot%\system32\PresentationHost.exe,-3309; C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe [2009-06-10 42856]
S3 idsvc;@%systemroot%\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\ServiceModelInstallRC.dll,-8193; C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2009-06-10 878416]
S3 IPBusEnum;@%systemroot%\system32\IPBusEnum.dll,-102; C:\Windows\system32\svchost.exe [2009-07-14 20992]
S3 KtmRm;@comres.dll,-2946; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 lltdsvc;@%SystemRoot%\system32\lltdres.dll,-1; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 MSiSCSI;@%SystemRoot%\system32\iscsidsc.dll,-5000; C:\Windows\system32\svchost.exe [2009-07-14 20992]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2006-10-26 441136]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 PeerDistSvc;@%SystemRoot%\system32\peerdistsvc.dll,-9000; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 pla;@%systemroot%\system32\pla.dll,-500; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 PNRPAutoReg;@%SystemRoot%\system32\pnrpauto.dll,-8002; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 QWAVE;@%SystemRoot%\system32\qwave.dll,-1; C:\Windows\system32\svchost.exe [2009-07-14 20992]
S3 SCPolicySvc;@%SystemRoot%\System32\certprop.dll,-13; C:\Windows\system32\svchost.exe [2009-07-14 20992]
S3 SensrSvc;@%SystemRoot%\System32\sensrsvc.dll,-1000; C:\Windows\system32\svchost.exe [2009-07-14 20992]
S3 ServiceLayer;ServiceLayer; C:\Program Files\PC Connectivity Solution\ServiceLayer.exe [2009-10-27 657408]
S3 SessionEnv;@%SystemRoot%\System32\SessEnv.dll,-1026; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 SNMPTRAP;@%SystemRoot%\system32\snmptrap.exe,-3; C:\Windows\System32\snmptrap.exe [2009-07-14 12800]
S3 sppuinotify;@%SystemRoot%\system32\sppuinotify.dll,-103; C:\Windows\system32\svchost.exe [2009-07-14 20992]
S3 SstpSvc;@%SystemRoot%\system32\sstpsvc.dll,-200; C:\Windows\system32\svchost.exe [2009-07-14 20992]
S3 TabletInputService;@%SystemRoot%\system32\TabSvc.dll,-100; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 TBS;@%SystemRoot%\system32\tbssvc.dll,-100; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 THREADORDER;@%systemroot%\system32\mmcss.dll,-102; C:\Windows\system32\svchost.exe [2009-07-14 20992]
S3 TrustedInstaller;@%SystemRoot%\servicing\TrustedInstaller.exe,-100; C:\Windows\servicing\TrustedInstaller.exe [2009-07-14 204800]
S3 UI0Detect;@%SystemRoot%\system32\ui0detect.exe,-101; C:\Windows\system32\UI0Detect.exe [2009-07-14 35840]
S3 UmRdpService;@%SystemRoot%\system32\umrdp.dll,-1000; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 VaultSvc;@%SystemRoot%\system32\vaultsvc.dll,-1003; C:\Windows\system32\lsass.exe [2009-07-14 22528]
S3 vds;@%SystemRoot%\system32\vds.exe,-100; C:\Windows\System32\vds.exe [2009-07-14 452608]
S3 wbengine;@%systemroot%\system32\wbengine.exe,-104; C:\Windows\system32\wbengine.exe [2009-07-14 1202688]
S3 WbioSrvc;@%systemroot%\system32\wbiosrvc.dll,-100; C:\Windows\system32\svchost.exe [2009-07-14 20992]
S3 wcncsvc;@%SystemRoot%\system32\wcncsvc.dll,-3; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 WcsPlugInService;@%SystemRoot%\system32\WcsPlugInService.dll,-200; C:\Windows\system32\svchost.exe [2009-07-14 20992]
S3 Wecsvc;@%SystemRoot%\system32\wecsvc.dll,-200; C:\Windows\system32\svchost.exe [2009-07-14 20992]
S3 wercplsupport;@%SystemRoot%\System32\wercplsupport.dll,-101; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 WerSvc;@%SystemRoot%\System32\wersvc.dll,-100; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 WinHttpAutoProxySvc;@%SystemRoot%\system32\winhttp.dll,-100; C:\Windows\system32\svchost.exe [2009-07-14 20992]
S3 WinRM;@%Systemroot%\system32\wsmsvc.dll,-101; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 WPCSvc;@%SystemRoot%\system32\wpcsvc.dll,-100; C:\Windows\system32\svchost.exe [2009-07-14 20992]
S3 WPDBusEnum;@%SystemRoot%\system32\wpdbusenum.dll,-100; C:\Windows\system32\svchost.exe [2009-07-14 20992]
S3 WwanSvc;@%SystemRoot%\System32\wwansvc.dll,-257; C:\Windows\system32\svchost.exe [2009-07-14 20992]
S4 Mcx2Svc;@%SystemRoot%\ehome\ehres.dll,-15501; C:\Windows\system32\svchost.exe [2009-07-14 20992]
S4 NetTcpPortSharing;@%systemroot%\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\ServiceModelInstallRC.dll,-8201; C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2009-06-10 128848]

-----------------EOF-----------------
Někteří lidé se velmi rádi podělí o to, co mají. Obyčejně se říká, že jsou štědří. V případě softwaru se jim ale říká zloději a warezáci :).
Nahoru
Uživatelský avatar
Unlimited_Killer
Přítel fóra
Přítel fóra
Příspěvky: 1969
Registrován: 24 srp 2009 16:18

Re: au_.exe je to trojan?

#2 Příspěvek od Unlimited_Killer »

Dobré odpoledne. :welcome:

1) ComboFix
  • Stáhněte a uložte na Plochu ComboFix.
  • Ještě před spuštěním vypněte rezidentní štít antiviru, či antispywaru.
  • Spusťte ho s administrátorským oprávněním.
  • Po spuštění se Vám zobrazí licenční podmínky, klikněte na 'Ano'.
  • Budete také dotázáni na instalaci konzole pro zotavení, taktéž klikněte na 'Ano'.
  • Celý sken bude trvat tak 5-10 minut, v závislosti na tom, kolika soubory se bude CF prodírat.
  • Váš PC bude pravděpodobně restartován, tak se toho nelekněte.
  • Než úplně skončí sken, nic nedělejte, hlavně neklikejte do spuštěného okna s ComboFixem.
  • Po skončení skenu (či následném restartu) na Vás 'vypadne' log, který vkopírujete ve formě textu sem.
  • Pokud žádný log 'nevypadne', naleznete jej v umístění C:\ComboFix.txt
inactive
Nahoru
Sharp2448
Vzorný návštěvník
Vzorný návštěvník
Příspěvky: 77
Registrován: 25 říj 2007 21:16
Kontaktovat uživatele:
Kontaktovat uživatele Sharp2448

Re: au_.exe je to trojan?

#3 Příspěvek od Sharp2448 »

No pokud CF pustím bez toho abych nejdřív spustil uninstall daemona, tak CF nic nenajde, protože se program Au_.exe spistí s jen s uninstalem daemona...TAkže mám pustit nejdřív uninstall daemona aby se spustil au_.exe nebo jen spustit CF??
Někteří lidé se velmi rádi podělí o to, co mají. Obyčejně se říká, že jsou štědří. V případě softwaru se jim ale říká zloději a warezáci :).
Nahoru
Uživatelský avatar
Unlimited_Killer
Přítel fóra
Přítel fóra
Příspěvky: 1969
Registrován: 24 srp 2009 16:18

Re: au_.exe je to trojan?

#4 Příspěvek od Unlimited_Killer »

Zkusím ho kdyžtak poté otestovat (ten soubor).
inactive
Nahoru
Sharp2448
Vzorný návštěvník
Vzorný návštěvník
Příspěvky: 77
Registrován: 25 říj 2007 21:16
Kontaktovat uživatele:
Kontaktovat uživatele Sharp2448

Re: au_.exe je to trojan?

#5 Příspěvek od Sharp2448 »

Tak tady je log: ComboFix 10-03-06.07 - WTF 07.03.2010 15:35:15.1.1 - x86
Microsoft Windows 7 Ultimate 6.1.7600.0.1250.420.1029.18.1534.1085 [GMT 1:00]
Spuštěný z: c:\users\WTF\Desktop\ComboFix.exe
.

((((((((((((((((((((((((( Soubory vytvořené od 2010-02-07 do 2010-03-07 )))))))))))))))))))))))))))))))
.

2010-03-07 11:48 . 2010-03-07 11:48 -------- d-----w- c:\program files\PragmaDigm
2010-03-07 11:41 . 2010-03-07 11:41 -------- d-----w- c:\programdata\CrystalIdea Software
2010-03-02 00:34 . 2010-03-02 00:34 -------- d-----w- c:\users\WTF\AppData\Local\Redlynx
2010-03-02 00:34 . 2010-03-02 01:13 413696 ----a-w- c:\windows\system32\wrap_oal.dll
2010-03-02 00:34 . 2010-03-02 01:13 110592 ----a-w- c:\windows\system32\OpenAL32.dll
2010-03-02 00:34 . 2010-03-02 00:34 -------- d-----w- c:\program files\OpenAL
2010-03-02 00:34 . 2007-10-12 14:14 3734536 ----a-w- c:\windows\system32\d3dx9_36.dll
2010-03-01 22:44 . 2010-03-01 22:45 -------- d-----w- c:\program files\Microsoft Works
2010-03-01 22:43 . 2010-03-01 22:43 -------- d-----w- c:\windows\PCHEALTH
2010-03-01 22:43 . 2010-03-01 22:43 -------- d-----w- c:\program files\Microsoft.NET
2010-03-01 22:37 . 2010-03-01 22:37 -------- d-----w- c:\users\WTF\AppData\Local\Microsoft Help
2010-03-01 22:36 . 2010-03-01 23:00 -------- d-----w- c:\programdata\Microsoft Help
2010-03-01 10:10 . 2010-03-01 22:10 -------- d-----w- c:\users\WTF\AppData\Roaming\GetRightToGo
2010-03-01 08:46 . 2010-03-01 09:06 -------- d-----w- c:\users\WTF\AppData\Roaming\Nero
2010-03-01 08:44 . 2010-03-01 18:33 -------- d-----w- c:\program files\Common Files\Nero
2010-03-01 08:44 . 2010-03-01 08:45 -------- d-----w- c:\programdata\Nero
2010-02-28 17:49 . 2010-02-28 17:49 -------- d-----w- c:\programdata\Apple Computer
2010-02-28 17:48 . 2010-02-28 17:48 -------- d-----w- c:\program files\Common Files\Apple
2010-02-28 17:48 . 2010-02-28 17:48 -------- d-----w- c:\users\WTF\AppData\Local\Apple
2010-02-28 17:48 . 2010-02-28 17:48 -------- d-----w- c:\program files\Apple Software Update
2010-02-28 17:48 . 2010-02-28 17:48 -------- d-----w- c:\programdata\Apple
2010-02-28 01:07 . 2010-02-28 01:07 -------- d-----w- c:\users\WTF\AppData\Roaming\uTorrent
2010-02-27 18:07 . 2010-02-02 07:45 2048 ----a-w- c:\windows\system32\tzres.dll
2010-02-27 18:07 . 2009-12-13 09:30 641536 ----a-w- c:\windows\system32\CPFilters.dll
2010-02-27 18:07 . 2009-12-13 09:29 417792 ----a-w- c:\windows\system32\msdri.dll
2010-02-27 18:07 . 2009-12-13 09:30 465408 ----a-w- c:\windows\system32\psisdecd.dll
2010-02-24 22:28 . 2010-02-24 22:28 -------- d-----w- c:\users\WTF\AppData\Roaming\DAEMON Tools
2010-02-24 22:23 . 2010-02-24 22:23 -------- d-----w- c:\programdata\DAEMON Tools Lite
2010-02-24 22:23 . 2010-03-07 10:13 -------- d-----w- c:\program files\DAEMON Tools Toolbar
2010-02-24 22:20 . 2010-02-24 22:20 -------- d-----w- c:\programdata\DAEMON Tools Pro
2010-02-24 22:17 . 2010-02-24 22:28 -------- d-----w- c:\users\WTF\AppData\Roaming\DAEMON Tools Pro
2010-02-24 22:08 . 2010-02-24 22:17 722416 ----a-w- c:\windows\system32\drivers\sptd.sys
2010-02-24 22:07 . 2010-02-24 22:28 -------- d-----w- c:\users\WTF\AppData\Roaming\DAEMON Tools Lite
2010-02-15 13:28 . 2010-02-23 00:03 -------- d-----w- c:\users\WTF\AppData\Local\Microsoft Games
2010-02-10 12:05 . 2010-01-18 23:29 365568 ----a-w- c:\windows\system32\secproc_isv.dll
2010-02-10 12:05 . 2010-01-18 23:29 369152 ----a-w- c:\windows\system32\secproc.dll
2010-02-10 12:05 . 2010-01-18 23:28 324608 ----a-w- c:\windows\system32\RMActivate_isv.exe
2010-02-10 12:05 . 2010-01-18 23:28 320512 ----a-w- c:\windows\system32\RMActivate.exe
2010-02-10 12:05 . 2010-01-18 23:29 85504 ----a-w- c:\windows\system32\secproc_ssp_isv.dll
2010-02-10 12:05 . 2010-01-18 23:29 85504 ----a-w- c:\windows\system32\secproc_ssp.dll
2010-02-10 12:05 . 2010-01-18 23:28 277504 ----a-w- c:\windows\system32\RMActivate_ssp_isv.exe
2010-02-10 12:05 . 2010-01-18 23:28 280064 ----a-w- c:\windows\system32\RMActivate_ssp.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-03-07 12:03 . 2010-01-31 21:23 -------- d-----w- c:\program files\trend micro
2010-03-04 09:36 . 2010-01-31 20:14 -------- d-----w- c:\program files\Common Files\Steam
2010-03-03 19:47 . 2010-01-31 19:03 108824 ----a-w- c:\users\WTF\AppData\Local\GDIPFONTCACHEV1.DAT
2010-03-03 08:34 . 2009-07-26 17:53 622660 ----a-w- c:\windows\system32\perfh005.dat
2010-03-03 08:34 . 2009-07-26 17:53 118810 ----a-w- c:\windows\system32\perfc005.dat
2010-02-24 08:16 . 2010-01-31 19:24 181632 ------w- c:\windows\system32\MpSigStub.exe
2010-02-08 22:38 . 2010-02-08 22:38 0 ---ha-w- c:\windows\system32\drivers\Msft_User_WpdMtpDr_01_09_00.Wdf
2010-02-08 10:40 . 2010-01-31 21:35 171552 ----a-w- c:\windows\system32\guard32.dll
2010-02-08 10:40 . 2010-01-31 21:35 130960 ----a-w- c:\windows\system32\drivers\cmdguard.sys
2010-02-01 23:31 . 2010-02-01 23:31 0 ---ha-w- c:\windows\system32\drivers\Msft_User_PCCSWpdDriver_01_07_00.Wdf
2010-02-01 23:30 . 2010-02-01 23:27 -------- d-----w- c:\users\WTF\AppData\Roaming\PC Suite
2010-02-01 23:29 . 2010-02-01 23:27 -------- d-----w- c:\users\WTF\AppData\Roaming\Nokia
2010-02-01 23:29 . 2010-02-01 23:27 -------- d-----w- c:\programdata\PC Suite
2010-02-01 23:29 . 2010-02-01 23:29 0 ---ha-w- c:\windows\system32\drivers\Msft_Kernel_ccdcmb_01007.Wdf
2010-02-01 23:28 . 2010-02-01 23:26 -------- d-----w- c:\program files\DIFX
2010-02-01 23:26 . 2010-02-01 23:26 -------- d-----w- c:\program files\Common Files\PCSuite
2010-02-01 23:26 . 2010-02-01 23:26 -------- d-----w- c:\program files\Common Files\Nokia
2010-02-01 23:25 . 2010-02-01 23:25 -------- d-----w- c:\program files\PC Connectivity Solution
2010-02-01 23:18 . 2010-02-01 23:18 95232 ----a-w- c:\programdata\Installations\{19DC9559-9C20-4A46-A67D-7ECBA52A2788}\Installer\CommonCustomActions\pcswpcsi.exe
2010-02-01 23:18 . 2010-02-01 23:18 8192 ----a-w- c:\programdata\Installations\{19DC9559-9C20-4A46-A67D-7ECBA52A2788}\Installer\CommonCustomActions\UninstCCD.exe
2010-02-01 23:18 . 2010-02-01 23:18 61440 ----a-w- c:\programdata\Installations\{19DC9559-9C20-4A46-A67D-7ECBA52A2788}\Installer\CommonCustomActions\UninstPCSFEMsi.exe
2010-02-01 23:18 . 2010-02-01 23:18 10240 ----a-w- c:\programdata\Installations\{19DC9559-9C20-4A46-A67D-7ECBA52A2788}\Installer\CommonCustomActions\UninstPCS.exe
2010-02-01 23:18 . 2010-02-01 23:18 -------- d-----w- c:\programdata\Installations
2010-02-01 23:17 . 2010-02-01 23:19 34701512 ----a-w- c:\programdata\Installations\{19DC9559-9C20-4A46-A67D-7ECBA52A2788}\Nokia_PC_Suite_cze_web.exe
2010-01-31 21:45 . 2010-01-31 21:35 -------- d-----w- c:\programdata\Comodo
2010-01-31 21:35 . 2010-01-31 21:35 74328 ----a-w- c:\windows\system32\drivers\inspect.sys
2010-01-31 21:35 . 2010-01-31 21:35 29520 ----a-w- c:\windows\system32\drivers\cmdhlp.sys
2010-01-31 21:29 . 2010-01-31 21:29 0 ----a-w- c:\windows\ativpsrm.bin
2010-01-31 21:28 . 2010-01-31 20:48 -------- d-----w- c:\program files\QIP Infium
2010-01-31 19:00 . 2010-01-31 19:00 -------- d-sh--we c:\programdata\Plocha
2010-01-31 19:00 . 2010-01-31 19:00 -------- d-sh--we c:\programdata\Oblíbené položky
2010-01-31 19:00 . 2010-01-31 19:00 -------- d-sh--we c:\programdata\Šablony
2010-01-31 19:00 . 2010-01-31 19:00 -------- d-sh--we c:\programdata\Nabídka Start
2010-01-31 19:00 . 2010-01-31 19:00 -------- d-sh--we c:\programdata\Dokumenty
2010-01-31 19:00 . 2010-01-31 19:00 -------- d-sh--we c:\programdata\Data aplikací
2010-01-08 03:18 . 2010-02-10 12:06 221184 ----a-w- c:\windows\system32\drivers\mrxsmb10.sys
2010-01-08 03:17 . 2010-02-10 12:06 123392 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
2009-12-19 09:02 . 2010-01-31 20:23 977920 ----a-w- c:\windows\system32\wininet.dll
2009-12-19 09:02 . 2010-02-10 12:06 12288 ----a-w- c:\windows\system32\tsbyuv.dll
2009-12-19 09:02 . 2010-02-10 12:06 1328640 ----a-w- c:\windows\system32\quartz.dll
2009-12-19 09:02 . 2010-02-10 12:06 22016 ----a-w- c:\windows\system32\msyuv.dll
2009-12-19 09:02 . 2010-02-10 12:06 31744 ----a-w- c:\windows\system32\msvidc32.dll
2009-12-19 09:02 . 2010-02-10 12:06 13312 ----a-w- c:\windows\system32\msrle32.dll
2009-12-19 09:02 . 2010-02-10 12:06 84480 ----a-w- c:\windows\system32\mciavi32.dll
2009-12-19 09:02 . 2010-02-10 12:06 50176 ----a-w- c:\windows\system32\iyuv_32.dll
2009-12-19 09:02 . 2010-02-10 12:06 91648 ----a-w- c:\windows\system32\avifil32.dll
2009-12-08 11:40 . 2010-02-10 12:06 3955288 ----a-w- c:\windows\system32\ntkrnlpa.exe
2009-12-08 11:40 . 2010-02-10 12:06 3899464 ----a-w- c:\windows\system32\ntoskrnl.exe
2009-12-08 11:32 . 2010-02-10 12:06 292864 ----a-w- c:\windows\system32\apphelp.dll
2009-12-08 08:05 . 2010-02-10 12:06 310784 ----a-w- c:\windows\system32\drivers\srv.sys
2009-12-08 08:05 . 2010-02-10 12:06 113664 ----a-w- c:\windows\system32\drivers\srvnet.sys
2009-06-10 21:26 . 2009-07-14 02:04 9633792 --sha-r- c:\windows\Fonts\StaticCache.dat
2009-07-14 01:14 . 2009-07-13 23:42 396800 --sha-w- c:\windows\winsxs\x86_microsoft-windows-mail-app_31bf3856ad364e35_6.1.7600.16385_none_f12e83abb108c86c\WinMail.exe
.

(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Steam"="e:\program files\steam\steam.exe" [2010-02-20 1217872]
"Infium"="c:\program files\QIP Infium\infium.exe" [2009-11-18 5994496]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-07-14 1173504]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"COMODO Internet Security"="e:\program files\Comodo\COMODO Internet Security\cfp.exe" [2010-01-31 1800464]
"QuickTime Task"="e:\program files\QuickTime\QTTask.exe" [2010-02-15 417792]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\windows\System32\guard32.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
2008-12-29 10:40 687560 ----a-w- e:\program files\DAEMON Tools Lite\daemon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PWRISOVM.EXE]
2009-11-09 03:17 180224 ----a-w- e:\program files\PowerISO\PWRISOVM.EXE

R0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [2010-02-24 722416]
S1 cmdGuard;COMODO Internet Security Sandbox Driver;c:\windows\system32\DRIVERS\cmdguard.sys [2010-02-08 130960]
S1 cmdHlp;COMODO Internet Security Helper Driver;c:\windows\system32\DRIVERS\cmdhlp.sys [2010-01-31 29520]
S3 NETw2v32;Ovladač bezdrátové síťové karty pro operační systém Windows Vista Intel(R) PRO/Wireless 2200BG Network Connection Driver for Windows Vista;c:\windows\system32\DRIVERS\NETw2v32.sys [2007-03-07 2595840]
S3 VST_DPV;VST_DPV;c:\windows\system32\DRIVERS\VSTDPV3.SYS [2009-07-13 980992]
S3 VSTHWICH;VSTHWICH;c:\windows\system32\DRIVERS\VSTICH3.SYS [2009-07-13 242176]

.
.
------- Doplňkový sken -------
.
IE: E&xportovat do aplikace Microsoft Excel - e:\progra~1\MICROS~1\Office12\EXCEL.EXE/3000
FF - ProfilePath - c:\users\WTF\AppData\Roaming\Mozilla\Firefox\Profiles\mpuu9mfc.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.seznam.cz
FF - plugin: e:\program files\QuickTime\Plugins\npqtplugin.dll
FF - plugin: e:\program files\QuickTime\Plugins\npqtplugin2.dll
FF - plugin: e:\program files\QuickTime\Plugins\npqtplugin3.dll
FF - plugin: e:\program files\QuickTime\Plugins\npqtplugin4.dll
FF - plugin: e:\program files\QuickTime\Plugins\npqtplugin5.dll
FF - plugin: e:\program files\QuickTime\Plugins\npqtplugin6.dll
FF - plugin: e:\program files\QuickTime\Plugins\npqtplugin7.dll

---- NASTAVENÍ FIREFOXU ----
e:\program files\greprefs\all.js - pref("ui.use_native_colors", true);
e:\program files\greprefs\all.js - pref("ui.use_native_popup_windows", false);
e:\program files\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
e:\program files\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
e:\program files\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
e:\program files\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
e:\program files\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
e:\program files\greprefs\all.js - pref("svg.smil.enabled", false);
e:\program files\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
e:\program files\greprefs\all.js - pref("browser.formfill.debug", false);
e:\program files\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
e:\program files\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
e:\program files\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
e:\program files\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
e:\program files\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
e:\program files\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
e:\program files\greprefs\all.js - pref("html5.enable", false);
e:\program files\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
e:\program files\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");
e:\program files\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
e:\program files\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".cz");
e:\program files\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
e:\program files\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
e:\program files\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
e:\program files\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
e:\program files\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
e:\program files\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
e:\program files\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
e:\program files\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
e:\program files\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
e:\program files\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
e:\program files\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
e:\program files\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);
.
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------

[HKEY_USERS\S-1-5-21-2655681490-2130990761-97366056-1000\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{F178EB2A-AFCA-35EE-6D45-BB8C877558FF}*]
"jajllhflpfacnidpahko"=hex:62,61,6a,66,00,00
"iajomgihakpjhpakjj"=hex:6b,61,67,66,62,62,6f,6d,67,66,6c,6a,6e,68,6f,63,6c,6b,
6f,6e,6a,6a,00,00

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'winlogon.exe'(600)
c:\windows\system32\guard32.dll

- - - - - - - > 'lsass.exe'(628)
c:\windows\system32\guard32.dll
.
Celkový čas: 2010-03-07 15:48:22
ComboFix-quarantined-files.txt 2010-03-07 14:48

Před spuštěním: 5 976 743 936
Po spuštění: 6 439 104 512

- - End Of File - - 8764B864F9719E82C9A469EC18710AC1
Někteří lidé se velmi rádi podělí o to, co mají. Obyčejně se říká, že jsou štědří. V případě softwaru se jim ale říká zloději a warezáci :).
Nahoru
Uživatelský avatar
Unlimited_Killer
Přítel fóra
Přítel fóra
Příspěvky: 1969
Registrován: 24 srp 2009 16:18

Re: au_.exe je to trojan?

#6 Příspěvek od Unlimited_Killer »

Pokračujeme.

1) Skript do ComboFix-u
  • Otevřete si Poznámkový blok [Start → Spustit → notepad → Enter].
  • Do něj vkopírujte následující text:

    Kód: Vybrat vše

    KillAll::

Folder::
c:\program files\DAEMON Tools Toolbar

Registry::
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"QuickTime Task"=-

Reboot::
  • Uložte tento soubor na Plochu pod jménem CFScript (koncovka .txt).
  • Přetáhněte tento soubor nad ComboFix a pusťte ho.
  • I tento soubor, i ComboFix musí být na Ploše!
    Obrázek
  • ComboFix se spustí a vykoná příkazy ze skriptu.
  • Počítač bude pravděpodobně restartován.
  • Po restartu na Vás vyskočí okno s logem, který mi vkopírujete sem ve formě textu.
2) Spusťte tu odinstalaci

3) VirusTotal
  • Otestujte na VirusTotal soubory:

    Kód: Vybrat vše

    C:\Users\WTF\AppData\Local\Temp\~nsu.tmp\Au_.exe
  • Jednoduše tam vkopírujete cesty, co jsem napsal do code.
  • Jestliže Vám to napíše, že soubor byl již testován, nechte ho otestovat znovu.
  • Poté sem vložíte linky (odkazy) na jednotlivé testy.
inactive
Nahoru
Sharp2448
Vzorný návštěvník
Vzorný návštěvník
Příspěvky: 77
Registrován: 25 říj 2007 21:16
Kontaktovat uživatele:
Kontaktovat uživatele Sharp2448

Re: au_.exe je to trojan?

#7 Příspěvek od Sharp2448 »

Abych jsem mohl otestovat C:\Users\WTF\AppData\Local\Temp\~nsu.tmp\Au_.exe musel jsem spustit uninstall daemon tools lite jinak se soubor Au_.exe neobjeví.
Soubor byl už testován:http://www.virustotal.com/cs/reanalisis ... 1268078244
Tak jsem ho otestoval znova : http://www.virustotal.com/cs/analisis/7 ... 1268078244
a tady je log:ComboFix 10-03-06.07 - WTF 08.03.2010 18:16:20.2.1 - x86
Microsoft Windows 7 Ultimate 6.1.7600.0.1250.420.1029.18.1534.982 [GMT 1:00]
Spuštěný z: c:\users\WTF\Desktop\ComboFix.exe
Použité ovládací přepínače :: c:\users\WTF\Desktop\CFScript.txt
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\program files\DAEMON Tools Toolbar
c:\program files\DAEMON Tools Toolbar\FirefoxDTT\components\DTToolbarFF.dll
c:\program files\DAEMON Tools Toolbar\FirefoxDTT\chrome\dttoolbar.jar

.
((((((((((((((((((((((((( Soubory vytvořené od 2010-02-08 do 2010-03-08 )))))))))))))))))))))))))))))))
.

2010-03-08 17:25 . 2010-03-08 17:26 -------- d-----w- c:\users\WTF\AppData\Local\temp
2010-03-08 17:25 . 2010-03-08 17:25 -------- d-----w- c:\users\Public\AppData\Local\temp
2010-03-07 11:48 . 2010-03-07 11:48 -------- d-----w- c:\program files\PragmaDigm
2010-03-07 11:41 . 2010-03-07 11:41 -------- d-----w- c:\programdata\CrystalIdea Software
2010-03-02 00:34 . 2010-03-02 00:34 -------- d-----w- c:\users\WTF\AppData\Local\Redlynx
2010-03-02 00:34 . 2010-03-02 01:13 413696 ----a-w- c:\windows\system32\wrap_oal.dll
2010-03-02 00:34 . 2010-03-02 01:13 110592 ----a-w- c:\windows\system32\OpenAL32.dll
2010-03-02 00:34 . 2010-03-02 00:34 -------- d-----w- c:\program files\OpenAL
2010-03-02 00:34 . 2007-10-12 14:14 3734536 ----a-w- c:\windows\system32\d3dx9_36.dll
2010-03-01 22:44 . 2010-03-01 22:45 -------- d-----w- c:\program files\Microsoft Works
2010-03-01 22:43 . 2010-03-01 22:43 -------- d-----w- c:\windows\PCHEALTH
2010-03-01 22:43 . 2010-03-01 22:43 -------- d-----w- c:\program files\Microsoft.NET
2010-03-01 22:37 . 2010-03-01 22:37 -------- d-----w- c:\users\WTF\AppData\Local\Microsoft Help
2010-03-01 22:36 . 2010-03-01 23:00 -------- d-----w- c:\programdata\Microsoft Help
2010-03-01 10:10 . 2010-03-01 22:10 -------- d-----w- c:\users\WTF\AppData\Roaming\GetRightToGo
2010-03-01 08:46 . 2010-03-01 09:06 -------- d-----w- c:\users\WTF\AppData\Roaming\Nero
2010-03-01 08:44 . 2010-03-01 18:33 -------- d-----w- c:\program files\Common Files\Nero
2010-03-01 08:44 . 2010-03-01 08:45 -------- d-----w- c:\programdata\Nero
2010-02-28 17:49 . 2010-02-28 17:49 -------- d-----w- c:\programdata\Apple Computer
2010-02-28 17:48 . 2010-02-28 17:48 -------- d-----w- c:\program files\Common Files\Apple
2010-02-28 17:48 . 2010-02-28 17:48 -------- d-----w- c:\users\WTF\AppData\Local\Apple
2010-02-28 17:48 . 2010-02-28 17:48 -------- d-----w- c:\program files\Apple Software Update
2010-02-28 17:48 . 2010-02-28 17:48 -------- d-----w- c:\programdata\Apple
2010-02-28 01:07 . 2010-02-28 01:07 -------- d-----w- c:\users\WTF\AppData\Roaming\uTorrent
2010-02-27 18:07 . 2010-02-02 07:45 2048 ----a-w- c:\windows\system32\tzres.dll
2010-02-27 18:07 . 2009-12-13 09:30 641536 ----a-w- c:\windows\system32\CPFilters.dll
2010-02-27 18:07 . 2009-12-13 09:29 417792 ----a-w- c:\windows\system32\msdri.dll
2010-02-27 18:07 . 2009-12-13 09:30 465408 ----a-w- c:\windows\system32\psisdecd.dll
2010-02-24 22:28 . 2010-02-24 22:28 -------- d-----w- c:\users\WTF\AppData\Roaming\DAEMON Tools
2010-02-24 22:23 . 2010-02-24 22:23 -------- d-----w- c:\programdata\DAEMON Tools Lite
2010-02-24 22:20 . 2010-02-24 22:20 -------- d-----w- c:\programdata\DAEMON Tools Pro
2010-02-24 22:17 . 2010-02-24 22:28 -------- d-----w- c:\users\WTF\AppData\Roaming\DAEMON Tools Pro
2010-02-24 22:08 . 2010-02-24 22:17 722416 ----a-w- c:\windows\system32\drivers\sptd.sys
2010-02-24 22:07 . 2010-02-24 22:28 -------- d-----w- c:\users\WTF\AppData\Roaming\DAEMON Tools Lite
2010-02-15 13:28 . 2010-02-23 00:03 -------- d-----w- c:\users\WTF\AppData\Local\Microsoft Games
2010-02-10 12:05 . 2010-01-18 23:29 365568 ----a-w- c:\windows\system32\secproc_isv.dll
2010-02-10 12:05 . 2010-01-18 23:29 369152 ----a-w- c:\windows\system32\secproc.dll
2010-02-10 12:05 . 2010-01-18 23:28 324608 ----a-w- c:\windows\system32\RMActivate_isv.exe
2010-02-10 12:05 . 2010-01-18 23:28 320512 ----a-w- c:\windows\system32\RMActivate.exe
2010-02-10 12:05 . 2010-01-18 23:29 85504 ----a-w- c:\windows\system32\secproc_ssp_isv.dll
2010-02-10 12:05 . 2010-01-18 23:29 85504 ----a-w- c:\windows\system32\secproc_ssp.dll
2010-02-10 12:05 . 2010-01-18 23:28 277504 ----a-w- c:\windows\system32\RMActivate_ssp_isv.exe
2010-02-10 12:05 . 2010-01-18 23:28 280064 ----a-w- c:\windows\system32\RMActivate_ssp.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-03-07 12:03 . 2010-01-31 21:23 -------- d-----w- c:\program files\trend micro
2010-03-04 09:36 . 2010-01-31 20:14 -------- d-----w- c:\program files\Common Files\Steam
2010-03-03 19:47 . 2010-01-31 19:03 108824 ----a-w- c:\users\WTF\AppData\Local\GDIPFONTCACHEV1.DAT
2010-03-03 08:34 . 2009-07-26 17:53 622660 ----a-w- c:\windows\system32\perfh005.dat
2010-03-03 08:34 . 2009-07-26 17:53 118810 ----a-w- c:\windows\system32\perfc005.dat
2010-02-24 08:16 . 2010-01-31 19:24 181632 ------w- c:\windows\system32\MpSigStub.exe
2010-02-08 22:38 . 2010-02-08 22:38 0 ---ha-w- c:\windows\system32\drivers\Msft_User_WpdMtpDr_01_09_00.Wdf
2010-02-08 10:40 . 2010-01-31 21:35 171552 ----a-w- c:\windows\system32\guard32.dll
2010-02-08 10:40 . 2010-01-31 21:35 130960 ----a-w- c:\windows\system32\drivers\cmdguard.sys
2010-02-01 23:31 . 2010-02-01 23:31 0 ---ha-w- c:\windows\system32\drivers\Msft_User_PCCSWpdDriver_01_07_00.Wdf
2010-02-01 23:30 . 2010-02-01 23:27 -------- d-----w- c:\users\WTF\AppData\Roaming\PC Suite
2010-02-01 23:29 . 2010-02-01 23:27 -------- d-----w- c:\users\WTF\AppData\Roaming\Nokia
2010-02-01 23:29 . 2010-02-01 23:27 -------- d-----w- c:\programdata\PC Suite
2010-02-01 23:29 . 2010-02-01 23:29 0 ---ha-w- c:\windows\system32\drivers\Msft_Kernel_ccdcmb_01007.Wdf
2010-02-01 23:28 . 2010-02-01 23:26 -------- d-----w- c:\program files\DIFX
2010-02-01 23:26 . 2010-02-01 23:26 -------- d-----w- c:\program files\Common Files\PCSuite
2010-02-01 23:26 . 2010-02-01 23:26 -------- d-----w- c:\program files\Common Files\Nokia
2010-02-01 23:25 . 2010-02-01 23:25 -------- d-----w- c:\program files\PC Connectivity Solution
2010-02-01 23:18 . 2010-02-01 23:18 95232 ----a-w- c:\programdata\Installations\{19DC9559-9C20-4A46-A67D-7ECBA52A2788}\Installer\CommonCustomActions\pcswpcsi.exe
2010-02-01 23:18 . 2010-02-01 23:18 8192 ----a-w- c:\programdata\Installations\{19DC9559-9C20-4A46-A67D-7ECBA52A2788}\Installer\CommonCustomActions\UninstCCD.exe
2010-02-01 23:18 . 2010-02-01 23:18 61440 ----a-w- c:\programdata\Installations\{19DC9559-9C20-4A46-A67D-7ECBA52A2788}\Installer\CommonCustomActions\UninstPCSFEMsi.exe
2010-02-01 23:18 . 2010-02-01 23:18 10240 ----a-w- c:\programdata\Installations\{19DC9559-9C20-4A46-A67D-7ECBA52A2788}\Installer\CommonCustomActions\UninstPCS.exe
2010-02-01 23:18 . 2010-02-01 23:18 -------- d-----w- c:\programdata\Installations
2010-02-01 23:17 . 2010-02-01 23:19 34701512 ----a-w- c:\programdata\Installations\{19DC9559-9C20-4A46-A67D-7ECBA52A2788}\Nokia_PC_Suite_cze_web.exe
2010-01-31 21:45 . 2010-01-31 21:35 -------- d-----w- c:\programdata\Comodo
2010-01-31 21:35 . 2010-01-31 21:35 74328 ----a-w- c:\windows\system32\drivers\inspect.sys
2010-01-31 21:35 . 2010-01-31 21:35 29520 ----a-w- c:\windows\system32\drivers\cmdhlp.sys
2010-01-31 21:29 . 2010-01-31 21:29 0 ----a-w- c:\windows\ativpsrm.bin
2010-01-31 21:28 . 2010-01-31 20:48 -------- d-----w- c:\program files\QIP Infium
2010-01-31 19:00 . 2010-01-31 19:00 -------- d-sh--we c:\programdata\Plocha
2010-01-31 19:00 . 2010-01-31 19:00 -------- d-sh--we c:\programdata\Oblíbené položky
2010-01-31 19:00 . 2010-01-31 19:00 -------- d-sh--we c:\programdata\Šablony
2010-01-31 19:00 . 2010-01-31 19:00 -------- d-sh--we c:\programdata\Nabídka Start
2010-01-31 19:00 . 2010-01-31 19:00 -------- d-sh--we c:\programdata\Dokumenty
2010-01-31 19:00 . 2010-01-31 19:00 -------- d-sh--we c:\programdata\Data aplikací
2010-01-08 03:18 . 2010-02-10 12:06 221184 ----a-w- c:\windows\system32\drivers\mrxsmb10.sys
2010-01-08 03:17 . 2010-02-10 12:06 123392 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
2009-12-19 09:02 . 2010-01-31 20:23 977920 ----a-w- c:\windows\system32\wininet.dll
2009-12-19 09:02 . 2010-02-10 12:06 12288 ----a-w- c:\windows\system32\tsbyuv.dll
2009-12-19 09:02 . 2010-02-10 12:06 1328640 ----a-w- c:\windows\system32\quartz.dll
2009-12-19 09:02 . 2010-02-10 12:06 22016 ----a-w- c:\windows\system32\msyuv.dll
2009-12-19 09:02 . 2010-02-10 12:06 31744 ----a-w- c:\windows\system32\msvidc32.dll
2009-12-19 09:02 . 2010-02-10 12:06 13312 ----a-w- c:\windows\system32\msrle32.dll
2009-12-19 09:02 . 2010-02-10 12:06 84480 ----a-w- c:\windows\system32\mciavi32.dll
2009-12-19 09:02 . 2010-02-10 12:06 50176 ----a-w- c:\windows\system32\iyuv_32.dll
2009-12-19 09:02 . 2010-02-10 12:06 91648 ----a-w- c:\windows\system32\avifil32.dll
2009-06-10 21:26 . 2009-07-14 02:04 9633792 --sha-r- c:\windows\Fonts\StaticCache.dat
2009-07-14 01:14 . 2009-07-13 23:42 396800 --sha-w- c:\windows\winsxs\x86_microsoft-windows-mail-app_31bf3856ad364e35_6.1.7600.16385_none_f12e83abb108c86c\WinMail.exe
.

(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Steam"="e:\program files\steam\steam.exe" [2010-02-20 1217872]
"Infium"="c:\program files\QIP Infium\infium.exe" [2009-11-18 5994496]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-07-14 1173504]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"COMODO Internet Security"="e:\program files\Comodo\COMODO Internet Security\cfp.exe" [2010-01-31 1800464]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\windows\System32\guard32.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
2008-12-29 10:40 687560 ----a-w- e:\program files\DAEMON Tools Lite\daemon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PWRISOVM.EXE]
2009-11-09 03:17 180224 ----a-w- e:\program files\PowerISO\PWRISOVM.EXE

S0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [2010-02-24 722416]
S1 cmdGuard;COMODO Internet Security Sandbox Driver;c:\windows\system32\DRIVERS\cmdguard.sys [2010-02-08 130960]
S1 cmdHlp;COMODO Internet Security Helper Driver;c:\windows\system32\DRIVERS\cmdhlp.sys [2010-01-31 29520]
S3 NETw2v32;Ovladač bezdrátové síťové karty pro operační systém Windows Vista Intel(R) PRO/Wireless 2200BG Network Connection Driver for Windows Vista;c:\windows\system32\DRIVERS\NETw2v32.sys [2007-03-07 2595840]
S3 VST_DPV;VST_DPV;c:\windows\system32\DRIVERS\VSTDPV3.SYS [2009-07-13 980992]
S3 VSTHWICH;VSTHWICH;c:\windows\system32\DRIVERS\VSTICH3.SYS [2009-07-13 242176]

.
.
------- Doplňkový sken -------
.
IE: E&xportovat do aplikace Microsoft Excel - e:\progra~1\MICROS~1\Office12\EXCEL.EXE/3000
FF - ProfilePath - c:\users\WTF\AppData\Roaming\Mozilla\Firefox\Profiles\mpuu9mfc.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.seznam.cz
FF - plugin: e:\program files\QuickTime\Plugins\npqtplugin.dll
FF - plugin: e:\program files\QuickTime\Plugins\npqtplugin2.dll
FF - plugin: e:\program files\QuickTime\Plugins\npqtplugin3.dll
FF - plugin: e:\program files\QuickTime\Plugins\npqtplugin4.dll
FF - plugin: e:\program files\QuickTime\Plugins\npqtplugin5.dll
FF - plugin: e:\program files\QuickTime\Plugins\npqtplugin6.dll
FF - plugin: e:\program files\QuickTime\Plugins\npqtplugin7.dll

---- NASTAVENÍ FIREFOXU ----
e:\program files\greprefs\all.js - pref("ui.use_native_colors", true);
e:\program files\greprefs\all.js - pref("ui.use_native_popup_windows", false);
e:\program files\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
e:\program files\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
e:\program files\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
e:\program files\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
e:\program files\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
e:\program files\greprefs\all.js - pref("svg.smil.enabled", false);
e:\program files\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
e:\program files\greprefs\all.js - pref("browser.formfill.debug", false);
e:\program files\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
e:\program files\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
e:\program files\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
e:\program files\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
e:\program files\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
e:\program files\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
e:\program files\greprefs\all.js - pref("html5.enable", false);
e:\program files\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
e:\program files\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");
e:\program files\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
e:\program files\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".cz");
e:\program files\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
e:\program files\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
e:\program files\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
e:\program files\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
e:\program files\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
e:\program files\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
e:\program files\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
e:\program files\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
e:\program files\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
e:\program files\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
e:\program files\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
e:\program files\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);
.

**************************************************************************

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys halmacpi.dll >>UNKNOWN [0x84EEC1F8]<<
kernel: MBR read successfully
detected MBR rootkit hooks:
IoDeviceObjectType -> DumpProcedure -> 0xd46a624f
SecurityProcedure -> 0x84f3acf8
QueryNameProcedure -> 0x84f3ae88
user & kernel MBR OK

**************************************************************************
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------

[HKEY_USERS\S-1-5-21-2655681490-2130990761-97366056-1000\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{F178EB2A-AFCA-35EE-6D45-BB8C877558FF}*]
"jajllhflpfacnidpahko"=hex:62,61,6a,66,00,00
"iajomgihakpjhpakjj"=hex:6b,61,67,66,62,62,6f,6d,67,66,6c,6a,6e,68,6f,63,6c,6b,
6f,6e,6a,6a,00,00

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'Explorer.exe'(3664)
e:\program files\Nokia\Nokia PC Suite 7\PhoneBrowser.dll
e:\program files\Nokia\Nokia PC Suite 7\NGSCM.DLL
e:\program files\Nokia\Nokia PC Suite 7\Lang\PhoneBrowser_cze.nlr
e:\program files\Nokia\Nokia PC Suite 7\Resource\PhoneBrowser_Nokia.ngr
.
------------------------ Jiné spuštené procesy ------------------------
.
e:\program files\Comodo\COMODO Internet Security\cmdagent.exe
c:\windows\system32\Ati2evxx.exe
c:\windows\system32\Ati2evxx.exe
c:\windows\system32\taskhost.exe
c:\windows\system32\conhost.exe
c:\program files\Windows Media Player\wmpnetwk.exe
.
**************************************************************************
.
Celkový čas: 2010-03-08 18:32:16 - počítač byl restartován
ComboFix-quarantined-files.txt 2010-03-08 17:32
ComboFix2.txt 2010-03-07 14:48

Před spuštěním: 6 067 863 552
Po spuštění: 6 043 738 112

- - End Of File - - 2D764F8225D65878C74F94B5468899F8
Někteří lidé se velmi rádi podělí o to, co mají. Obyčejně se říká, že jsou štědří. V případě softwaru se jim ale říká zloději a warezáci :).
Nahoru
Uživatelský avatar
Unlimited_Killer
Přítel fóra
Přítel fóra
Příspěvky: 1969
Registrován: 24 srp 2009 16:18

Re: au_.exe je to trojan?

#8 Příspěvek od Unlimited_Killer »

Au_.exe je čisté, ale ještě si něco potřebuji ověřit.

1) Odinstalace virtuálních mechanik
  • Odinstalujte všechny virtuální mechaniky - například Alcohol, DeamonTools atd.
2) Odinstalace SPTD
  • Přejděte na tento odkaz.
  • Zde si stáhněte verzi SPTD dle Vašeho operačního systému (XP/Vista/W7 - 32/64bit).
  • Stažený soubor dvojklikem spusťte.
  • Klikněte na prostřední tlačítko 'Uninstall'.
  • Restartujte PC.
3) MBR.exe
  • Stáhněte MBR.exe na Plochu.
  • Proklikejte se na Start → Spustit [Win+R] a zadejte či vkopírujte následující text:

    Kód: Vybrat vše

    "%userprofile%\plocha\mbr" -t
  • Nyní stiskněte 'Enter'.
  • Na Ploše by se měl vytvořit soubor MBR.log, jehož obsah mi sem vkopírujete ve formě textu.
4) GMER
  • Stáhněte GMER, rozbalte ho na Plochu a dvojklikem ho spusťte.
  • Několik sekund bude skenovat.
  • Až sken dokončí, klikněte na 'Save' - to vygeneruje první log, který mi vložíte ve formě textu sem.
  • Poté vytvořte druhý log, přičemž se budete řídit tímto návodem - tento log mi sem taktéž vložíte.
inactive
Nahoru
Sharp2448
Vzorný návštěvník
Vzorný návštěvník
Příspěvky: 77
Registrován: 25 říj 2007 21:16
Kontaktovat uživatele:
Kontaktovat uživatele Sharp2448

Re: au_.exe je to trojan?

#9 Příspěvek od Sharp2448 »

1) Odinstalace virtuálních mechanik
-Nejde to je můj hlavní problém, nainstaloval jsem daemon tools lite nejspíš nějakou starší verzi která není kompatibilní s WIN 7 a teď při odinstalaci se nic nestane a spustí se onen Au_.exe a když se snažím vypnout vyrtualní mechaniky daemon se zasekne prři jejich odpojování...
2) Odinstalace SPTD
-Hotovo
3)MBR.exe
-První log nějak nevyšel :Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: error reading MBR
kernel: error reading MBR
a tady je druhý:GMER 1.0.15.15281 - http://www.gmer.net
Rootkit scan 2010-03-08 23:21:20
Windows 6.1.7600
Running: gmer.exe; Driver: C:\Users\WTF\AppData\Local\Temp\uwldqpow.sys


---- System - GMER 1.0.15 ----

SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys (COMODO Internet Security Sandbox Driver/COMODO) ZwAdjustPrivilegesToken [0x8CC53F8E]
SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys (COMODO Internet Security Sandbox Driver/COMODO) ZwAlpcConnectPort [0x8CC54F5C]
SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys (COMODO Internet Security Sandbox Driver/COMODO) ZwAlpcCreatePort [0x8CC54174]
SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys (COMODO Internet Security Sandbox Driver/COMODO) ZwConnectPort [0x8CC533FA]
SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys (COMODO Internet Security Sandbox Driver/COMODO) ZwCreateFile [0x8CC53BF4]
SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys (COMODO Internet Security Sandbox Driver/COMODO) ZwCreatePort [0x8CC532DC]
SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys (COMODO Internet Security Sandbox Driver/COMODO) ZwCreateSection [0x8CC53A82]
SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys (COMODO Internet Security Sandbox Driver/COMODO) ZwCreateSymbolicLinkObject [0x8CC54C16]
SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys (COMODO Internet Security Sandbox Driver/COMODO) ZwCreateThread [0x8CC52EA2]
SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys (COMODO Internet Security Sandbox Driver/COMODO) ZwCreateThreadEx [0x8CC54280]
SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys (COMODO Internet Security Sandbox Driver/COMODO) ZwDuplicateObject [0x8CC52CD4]
SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys (COMODO Internet Security Sandbox Driver/COMODO) ZwLoadDriver [0x8CC54898]
SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys (COMODO Internet Security Sandbox Driver/COMODO) ZwMakeTemporaryObject [0x8CC5367E]
SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys (COMODO Internet Security Sandbox Driver/COMODO) ZwOpenFile [0x8CC53DD0]
SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys (COMODO Internet Security Sandbox Driver/COMODO) ZwOpenProcess [0x8CC52A04]
SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys (COMODO Internet Security Sandbox Driver/COMODO) ZwOpenSection [0x8CC5390E]
SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys (COMODO Internet Security Sandbox Driver/COMODO) ZwOpenThread [0x8CC52B7C]
SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys (COMODO Internet Security Sandbox Driver/COMODO) ZwRequestWaitReplyPort [0x8CC553C6]
SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys (COMODO Internet Security Sandbox Driver/COMODO) ZwSecureConnectPort [0x8CC54634]
SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys (COMODO Internet Security Sandbox Driver/COMODO) ZwSetSystemInformation [0x8CC54A46]
SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys (COMODO Internet Security Sandbox Driver/COMODO) ZwShutdownSystem [0x8CC53618]
SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys (COMODO Internet Security Sandbox Driver/COMODO) ZwSystemDebugControl [0x8CC53802]
SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys (COMODO Internet Security Sandbox Driver/COMODO) ZwTerminateProcess [0x8CC531A6]
SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys (COMODO Internet Security Sandbox Driver/COMODO) ZwTerminateThread [0x8CC53074]

INT 0x1F \SystemRoot\system32\halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation) 83439AF8
INT 0x37 \SystemRoot\system32\halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation) 83439104
INT 0xC1 \SystemRoot\system32\halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation) 834393F4
INT 0xD1 \SystemRoot\system32\halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation) 83421FB4
INT 0xDF \SystemRoot\system32\halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation) 834391DC
INT 0xE1 \SystemRoot\system32\halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation) 83439958
INT 0xE3 \SystemRoot\system32\halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation) 834396F8
INT 0xFD \SystemRoot\system32\halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation) 83439F2C
INT 0xFE \SystemRoot\system32\halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation) 8343A1A8

---- Kernel code sections - GMER 1.0.15 ----

.text ntkrnlpa.exe!ZwSaveKeyEx + 13BD 830525C9 1 Byte [06]
.text ntkrnlpa.exe!KiDispatchInterrupt + 5A2 83077052 19 Bytes [E0, 0F, BA, F0, 07, 73, 09, ...] {LOOPNZ 0x11; MOV EDX, 0x97307f0; MOV CR4, EAX; OR AL, 0x80; MOV CR4, EAX; RET ; MOV ECX, CR3}
.text ntkrnlpa.exe!RtlSidHashLookup + 250 8307E850 4 Bytes [8E, 3F, C5, 8C]
.text ntkrnlpa.exe!RtlSidHashLookup + 278 8307E878 8 Bytes [5C, 4F, C5, 8C, 74, 41, C5, ...]
.text ntkrnlpa.exe!RtlSidHashLookup + 30C 8307E90C 4 Bytes [FA, 33, C5, 8C]
.text ntkrnlpa.exe!RtlSidHashLookup + 328 8307E928 4 Bytes [F4, 3B, C5, 8C]
.text ntkrnlpa.exe!RtlSidHashLookup + 354 8307E954 4 Bytes [DC, 32, C5, 8C]
.text ...
.text C:\Windows\system32\DRIVERS\atikmdag.sys section is writeable [0x8D814000, 0x23097E, 0xE8000020]
.text peauth.sys 94B47C9D 28 Bytes [15, 4E, C2, 8D, 5A, B6, C9, ...]
.text peauth.sys 94B47CC1 28 Bytes [15, 4E, C2, 8D, 5A, B6, C9, ...]

---- User code sections - GMER 1.0.15 ----

.text E:\Program Files\firefox.exe[408] ntdll.dll!LdrLoadDll 770BF585 5 Bytes JMP 010213F0 E:\Program Files\firefox.exe (Firefox/Mozilla Corporation)
.text E:\Program Files\Comodo\COMODO Internet Security\cmdagent.exe[976] ntdll.dll!NtAllocateVirtualMemory 770A4720 5 Bytes JMP 0040FD50 E:\Program Files\Comodo\COMODO Internet Security\cmdagent.exe (COMODO Internet Security/COMODO)
.text E:\Program Files\Comodo\COMODO Internet Security\cfp.exe[1952] ntdll.dll!NtAllocateVirtualMemory 770A4720 5 Bytes JMP 0050E060 E:\Program Files\Comodo\COMODO Internet Security\cfp.exe (COMODO Internet Security/COMODO)

---- User IAT/EAT - GMER 1.0.15 ----

IAT C:\Program Files\QIP Infium\infium.exe[100] @ C:\Windows\system32\user32.dll [KERNEL32.dll!CreateThread] [0045171C] C:\Program Files\QIP Infium\infium.exe (QIP Infium/QIP)
IAT C:\Program Files\QIP Infium\infium.exe[100] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!CreateThread] [0045171C] C:\Program Files\QIP Infium\infium.exe (QIP Infium/QIP)
IAT C:\Program Files\QIP Infium\infium.exe[100] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!QueueUserWorkItem] [00451920] C:\Program Files\QIP Infium\infium.exe (QIP Infium/QIP)
IAT C:\Program Files\QIP Infium\infium.exe[100] @ C:\Windows\system32\shell32.dll [KERNEL32.dll!QueueUserWorkItem] [00451920] C:\Program Files\QIP Infium\infium.exe (QIP Infium/QIP)
IAT C:\Program Files\QIP Infium\infium.exe[100] @ C:\Windows\system32\wininet.dll [KERNEL32.dll!CreateThread] [0045171C] C:\Program Files\QIP Infium\infium.exe (QIP Infium/QIP)
IAT E:\Program Files\Comodo\COMODO Internet Security\cfp.exe[1952] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!LoadLibraryW] [006181D0] E:\Program Files\Comodo\COMODO Internet Security\cfp.exe (COMODO Internet Security/COMODO)
IAT E:\Program Files\Comodo\COMODO Internet Security\cfp.exe[1952] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!CreateThread] [00617B70] E:\Program Files\Comodo\COMODO Internet Security\cfp.exe (COMODO Internet Security/COMODO)
IAT E:\Program Files\Comodo\COMODO Internet Security\cfp.exe[1952] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!GetModuleHandleA] [006182B0] E:\Program Files\Comodo\COMODO Internet Security\cfp.exe (COMODO Internet Security/COMODO)
IAT E:\Program Files\Comodo\COMODO Internet Security\cfp.exe[1952] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!LoadLibraryA] [00618190] E:\Program Files\Comodo\COMODO Internet Security\cfp.exe (COMODO Internet Security/COMODO)
IAT E:\Program Files\Comodo\COMODO Internet Security\cfp.exe[1952] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!LoadLibraryExW] [00618260] E:\Program Files\Comodo\COMODO Internet Security\cfp.exe (COMODO Internet Security/COMODO)
IAT E:\Program Files\Comodo\COMODO Internet Security\cfp.exe[1952] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!GetProcAddress] [00618340] E:\Program Files\Comodo\COMODO Internet Security\cfp.exe (COMODO Internet Security/COMODO)
IAT E:\Program Files\Comodo\COMODO Internet Security\cfp.exe[1952] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!LoadLibraryExA] [00618210] E:\Program Files\Comodo\COMODO Internet Security\cfp.exe (COMODO Internet Security/COMODO)
IAT E:\Program Files\Comodo\COMODO Internet Security\cfp.exe[1952] @ C:\Windows\system32\SHLWAPI.dll [GDI32.dll!DeleteObject] [006172F0] E:\Program Files\Comodo\COMODO Internet Security\cfp.exe (COMODO Internet Security/COMODO)
IAT E:\Program Files\Comodo\COMODO Internet Security\cfp.exe[1952] @ C:\Windows\system32\SHLWAPI.dll [USER32.dll!RegisterClassA] [00617C00] E:\Program Files\Comodo\COMODO Internet Security\cfp.exe (COMODO Internet Security/COMODO)
IAT E:\Program Files\Comodo\COMODO Internet Security\cfp.exe[1952] @ C:\Windows\system32\SHLWAPI.dll [USER32.dll!RegisterClassW] [00617CC0] E:\Program Files\Comodo\COMODO Internet Security\cfp.exe (COMODO Internet Security/COMODO)
IAT E:\Program Files\Comodo\COMODO Internet Security\cfp.exe[1952] @ C:\Windows\system32\SHLWAPI.dll [USER32.dll!GetSysColor] [006172A0] E:\Program Files\Comodo\COMODO Internet Security\cfp.exe (COMODO Internet Security/COMODO)
IAT E:\Program Files\Comodo\COMODO Internet Security\cfp.exe[1952] @ C:\Windows\system32\SHLWAPI.dll [USER32.dll!DefWindowProcW] [00617760] E:\Program Files\Comodo\COMODO Internet Security\cfp.exe (COMODO Internet Security/COMODO)
IAT E:\Program Files\Comodo\COMODO Internet Security\cfp.exe[1952] @ C:\Windows\system32\SHLWAPI.dll [USER32.dll!DefWindowProcA] [006176D0] E:\Program Files\Comodo\COMODO Internet Security\cfp.exe (COMODO Internet Security/COMODO)
IAT E:\Program Files\Comodo\COMODO Internet Security\cfp.exe[1952] @ C:\Windows\system32\SHLWAPI.dll [USER32.dll!GetSystemMetrics] [00617D80] E:\Program Files\Comodo\COMODO Internet Security\cfp.exe (COMODO Internet Security/COMODO)
IAT E:\Program Files\Comodo\COMODO Internet Security\cfp.exe[1952] @ C:\Windows\system32\ADVAPI32.dll [KERNEL32.dll!LoadLibraryExW] [00618260] E:\Program Files\Comodo\COMODO Internet Security\cfp.exe (COMODO Internet Security/COMODO)
IAT E:\Program Files\Comodo\COMODO Internet Security\cfp.exe[1952] @ C:\Windows\system32\ADVAPI32.dll [KERNEL32.dll!GetProcAddress] [00618340] E:\Program Files\Comodo\COMODO Internet Security\cfp.exe (COMODO Internet Security/COMODO)
IAT E:\Program Files\Comodo\COMODO Internet Security\cfp.exe[1952] @ C:\Windows\system32\ADVAPI32.dll [KERNEL32.dll!LoadLibraryA] [00618190] E:\Program Files\Comodo\COMODO Internet Security\cfp.exe (COMODO Internet Security/COMODO)
IAT E:\Program Files\Comodo\COMODO Internet Security\cfp.exe[1952] @ C:\Windows\system32\ADVAPI32.dll [KERNEL32.dll!LoadLibraryW] [006181D0] E:\Program Files\Comodo\COMODO Internet Security\cfp.exe (COMODO Internet Security/COMODO)
IAT E:\Program Files\Comodo\COMODO Internet Security\cfp.exe[1952] @ C:\Windows\system32\ADVAPI32.dll [KERNEL32.dll!LoadLibraryExA] [00618210] E:\Program Files\Comodo\COMODO Internet Security\cfp.exe (COMODO Internet Security/COMODO)
IAT E:\Program Files\Comodo\COMODO Internet Security\cfp.exe[1952] @ C:\Windows\system32\SHELL32.dll [USER32.dll!GetSysColorBrush] [00617330] E:\Program Files\Comodo\COMODO Internet Security\cfp.exe (COMODO Internet Security/COMODO)
IAT E:\Program Files\Comodo\COMODO Internet Security\cfp.exe[1952] @ C:\Windows\system32\SHELL32.dll [USER32.dll!DrawFrameControl] [00618130] E:\Program Files\Comodo\COMODO Internet Security\cfp.exe (COMODO Internet Security/COMODO)
IAT E:\Program Files\Comodo\COMODO Internet Security\cfp.exe[1952] @ C:\Windows\system32\SHELL32.dll [USER32.dll!DrawEdge] [00618110] E:\Program Files\Comodo\COMODO Internet Security\cfp.exe (COMODO Internet Security/COMODO)
IAT E:\Program Files\Comodo\COMODO Internet Security\cfp.exe[1952] @ C:\Windows\system32\SHELL32.dll [USER32.dll!GetScrollInfo] [00617520] E:\Program Files\Comodo\COMODO Internet Security\cfp.exe (COMODO Internet Security/COMODO)
IAT E:\Program Files\Comodo\COMODO Internet Security\cfp.exe[1952] @ C:\Windows\system32\SHELL32.dll [USER32.dll!SystemParametersInfoW] [00617EA0] E:\Program Files\Comodo\COMODO Internet Security\cfp.exe (COMODO Internet Security/COMODO)
IAT E:\Program Files\Comodo\COMODO Internet Security\cfp.exe[1952] @ C:\Windows\system32\SHELL32.dll [USER32.dll!AdjustWindowRectEx] [00617FB0] E:\Program Files\Comodo\COMODO Internet Security\cfp.exe (COMODO Internet Security/COMODO)
IAT E:\Program Files\Comodo\COMODO Internet Security\cfp.exe[1952] @ C:\Windows\system32\SHELL32.dll [USER32.dll!SetScrollInfo] [00617410] E:\Program Files\Comodo\COMODO Internet Security\cfp.exe (COMODO Internet Security/COMODO)
IAT E:\Program Files\Comodo\COMODO Internet Security\cfp.exe[1952] @ C:\Windows\system32\SHELL32.dll [USER32.dll!CallWindowProcW] [00617590] E:\Program Files\Comodo\COMODO Internet Security\cfp.exe (COMODO Internet Security/COMODO)
IAT E:\Program Files\Comodo\COMODO Internet Security\cfp.exe[1952] @ C:\Windows\system32\SHELL32.dll [USER32.dll!SetScrollPos] [00617380] E:\Program Files\Comodo\COMODO Internet Security\cfp.exe (COMODO Internet Security/COMODO)
IAT E:\Program Files\Comodo\COMODO Internet Security\cfp.exe[1952] @ C:\Windows\system32\SHELL32.dll [USER32.dll!GetSysColor] [006172A0] E:\Program Files\Comodo\COMODO Internet Security\cfp.exe (COMODO Internet Security/COMODO)
IAT E:\Program Files\Comodo\COMODO Internet Security\cfp.exe[1952] @ C:\Windows\system32\SHELL32.dll [USER32.dll!RegisterClassW] [00617CC0] E:\Program Files\Comodo\COMODO Internet Security\cfp.exe (COMODO Internet Security/COMODO)
IAT E:\Program Files\Comodo\COMODO Internet Security\cfp.exe[1952] @ C:\Windows\system32\SHELL32.dll [USER32.dll!FillRect] [006180C0] E:\Program Files\Comodo\COMODO Internet Security\cfp.exe (COMODO Internet Security/COMODO)
IAT E:\Program Files\Comodo\COMODO Internet Security\cfp.exe[1952] @ C:\Windows\system32\SHELL32.dll [USER32.dll!DefWindowProcW] [00617760] E:\Program Files\Comodo\COMODO Internet Security\cfp.exe (COMODO Internet Security/COMODO)
IAT E:\Program Files\Comodo\COMODO Internet Security\cfp.exe[1952] @ C:\Windows\system32\SHELL32.dll [USER32.dll!GetSystemMetrics] [00617D80] E:\Program Files\Comodo\COMODO Internet Security\cfp.exe (COMODO Internet Security/COMODO)
IAT E:\Program Files\Comodo\COMODO Internet Security\cfp.exe[1952] @ C:\Windows\system32\SHELL32.dll [GDI32.dll!DeleteObject] [006172F0] E:\Program Files\Comodo\COMODO Internet Security\cfp.exe (COMODO Internet Security/COMODO)
IAT E:\Program Files\Comodo\COMODO Internet Security\cfp.exe[1952] @ C:\Windows\system32\SHELL32.dll [KERNEL32.dll!LoadLibraryA] [00618190] E:\Program Files\Comodo\COMODO Internet Security\cfp.exe (COMODO Internet Security/COMODO)
IAT E:\Program Files\Comodo\COMODO Internet Security\cfp.exe[1952] @ C:\Windows\system32\SHELL32.dll [KERNEL32.dll!LoadLibraryW] [006181D0] E:\Program Files\Comodo\COMODO Internet Security\cfp.exe (COMODO Internet Security/COMODO)
IAT E:\Program Files\Comodo\COMODO Internet Security\cfp.exe[1952] @ C:\Windows\system32\ole32.dll [GDI32.dll!DeleteObject] [006172F0] E:\Program Files\Comodo\COMODO Internet Security\cfp.exe (COMODO Internet Security/COMODO)
IAT E:\Program Files\Comodo\COMODO Internet Security\cfp.exe[1952] @ C:\Windows\system32\ole32.dll [USER32.dll!CallWindowProcW] [00617590] E:\Program Files\Comodo\COMODO Internet Security\cfp.exe (COMODO Internet Security/COMODO)
IAT E:\Program Files\Comodo\COMODO Internet Security\cfp.exe[1952] @ C:\Windows\system32\ole32.dll [USER32.dll!GetSysColor] [006172A0] E:\Program Files\Comodo\COMODO Internet Security\cfp.exe (COMODO Internet Security/COMODO)
IAT E:\Program Files\Comodo\COMODO Internet Security\cfp.exe[1952] @ C:\Windows\system32\ole32.dll [USER32.dll!GetSystemMetrics] [00617D80] E:\Program Files\Comodo\COMODO Internet Security\cfp.exe (COMODO Internet Security/COMODO)
IAT E:\Program Files\Comodo\COMODO Internet Security\cfp.exe[1952] @ C:\Windows\system32\ole32.dll [USER32.dll!SystemParametersInfoW] [00617EA0] E:\Program Files\Comodo\COMODO Internet Security\cfp.exe (COMODO Internet Security/COMODO)
IAT E:\Program Files\Comodo\COMODO Internet Security\cfp.exe[1952] @ C:\Windows\system32\ole32.dll [USER32.dll!RegisterClassW] [00617CC0] E:\Program Files\Comodo\COMODO Internet Security\cfp.exe (COMODO Internet Security/COMODO)
IAT E:\Program Files\Comodo\COMODO Internet Security\cfp.exe[1952] @ C:\Windows\system32\ole32.dll [USER32.dll!DefWindowProcW] [00617760] E:\Program Files\Comodo\COMODO Internet Security\cfp.exe (COMODO Internet Security/COMODO)
IAT E:\Program Files\Comodo\COMODO Internet Security\cfp.exe[1952] @ C:\Windows\system32\ole32.dll [KERNEL32.dll!LoadLibraryW] [006181D0] E:\Program Files\Comodo\COMODO Internet Security\cfp.exe (COMODO Internet Security/COMODO)
IAT E:\Program Files\Comodo\COMODO Internet Security\cfp.exe[1952] @ C:\Windows\system32\ole32.dll [KERNEL32.dll!LoadLibraryA] [00618190] E:\Program Files\Comodo\COMODO Internet Security\cfp.exe (COMODO Internet Security/COMODO)
IAT E:\Program Files\Comodo\COMODO Internet Security\cfp.exe[1952] @ C:\Windows\system32\CRYPT32.dll [KERNEL32.dll!LoadLibraryExW] [00618260] E:\Program Files\Comodo\COMODO Internet Security\cfp.exe (COMODO Internet Security/COMODO)
IAT E:\Program Files\Comodo\COMODO Internet Security\cfp.exe[1952] @ C:\Windows\system32\CRYPT32.dll [KERNEL32.dll!LoadLibraryExA] [00618210] E:\Program Files\Comodo\COMODO Internet Security\cfp.exe (COMODO Internet Security/COMODO)
IAT E:\Program Files\Comodo\COMODO Internet Security\cfp.exe[1952] @ C:\Windows\system32\CRYPT32.dll [KERNEL32.dll!LoadLibraryA] [00618190] E:\Program Files\Comodo\COMODO Internet Security\cfp.exe (COMODO Internet Security/COMODO)
IAT E:\Program Files\Comodo\COMODO Internet Security\cfp.exe[1952] @ C:\Windows\system32\CRYPT32.dll [KERNEL32.dll!GetProcAddress] [00618340] E:\Program Files\Comodo\COMODO Internet Security\cfp.exe (COMODO Internet Security/COMODO)

---- Devices - GMER 1.0.15 ----

AttachedDevice \Driver\tdx \Device\Tcp cmdhlp.sys (COMODO Internet Security Helper Driver/COMODO)
AttachedDevice \Driver\volmgr \Device\HarddiskVolume1 fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
AttachedDevice \Driver\volmgr \Device\HarddiskVolume2 fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
AttachedDevice \Driver\volmgr \Device\HarddiskVolume3 fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)

Device \Driver\ACPI_HAL \Device\0000004b halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation)

AttachedDevice \Driver\tdx \Device\Udp cmdhlp.sys (COMODO Internet Security Helper Driver/COMODO)
AttachedDevice \Driver\tdx \Device\RawIp cmdhlp.sys (COMODO Internet Security Helper Driver/COMODO)

---- Registry - GMER 1.0.15 ----

Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@p0 E:\Program Files\DAEMON Tools Lite\
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0x0D 0x64 0x2E 0xC2 ...
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@a0 0x20 0x01 0x00 0x00 ...
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@khjeh 0x2D 0x72 0x6C 0xB4 ...
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40@khjeh 0xDF 0x87 0x8A 0x6B ...
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41@khjeh 0x88 0x9E 0x2B 0xF6 ...
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@p0 E:\Program Files\DAEMON Tools Lite\
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0x0D 0x64 0x2E 0xC2 ...
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@a0 0x20 0x01 0x00 0x00 ...
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@khjeh 0x2D 0x72 0x6C 0xB4 ...
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40@khjeh 0xDF 0x87 0x8A 0x6B ...
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41@khjeh 0x88 0x9E 0x2B 0xF6 ...
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{F178EB2A-AFCA-35EE-6D45-BB8C877558FF}
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{F178EB2A-AFCA-35EE-6D45-BB8C877558FF}@jajllhflpfacnidpahko 0x62 0x61 0x6A 0x66 ...
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{F178EB2A-AFCA-35EE-6D45-BB8C877558FF}@iajomgihakpjhpakjj 0x6B 0x61 0x67 0x66 ...

---- EOF - GMER 1.0.15 ----
Někteří lidé se velmi rádi podělí o to, co mají. Obyčejně se říká, že jsou štědří. V případě softwaru se jim ale říká zloději a warezáci :).
Nahoru
Uživatelský avatar
Unlimited_Killer
Přítel fóra
Přítel fóra
Příspěvky: 1969
Registrován: 24 srp 2009 16:18

Re: au_.exe je to trojan?

#10 Příspěvek od Unlimited_Killer »

motji píše: :arrow: Stáhněte
http://rootrepeal.googlepages.com/RootRepeal.zip
-Stáhněte,rozbalte a spusťte
-vyberte záložku drivers, pak Files, klikněte na Scan,
-proběhne sken, po něm klikněte na Save Report , tím se uloží log, který zkopírujete sem
inactive
Nahoru
Sharp2448
Vzorný návštěvník
Vzorný návštěvník
Příspěvky: 77
Registrován: 25 říj 2007 21:16
Kontaktovat uživatele:
Kontaktovat uživatele Sharp2448

Re: au_.exe je to trojan?

#11 Příspěvek od Sharp2448 »

Když ho spustím vyskočí mi todle okno:
Obrázek
Režim kompatibility jsem už zkoušel a nic...
Někteří lidé se velmi rádi podělí o to, co mají. Obyčejně se říká, že jsou štědří. V případě softwaru se jim ale říká zloději a warezáci :).
Nahoru
Uživatelský avatar
Unlimited_Killer
Přítel fóra
Přítel fóra
Příspěvky: 1969
Registrován: 24 srp 2009 16:18

Re: au_.exe je to trojan?

#12 Příspěvek od Unlimited_Killer »

Zkuste Daemon odinstalovat přes Revo Uninstaller.
inactive
Nahoru
Odpovědět

Zpět na „Sekce pouze pro Vzorné návštěvníky“