Kontrola logu

Zpráva

peto2232 · #1 Příspěvek od **peto2232** » 07 čer 2010 17:45

Vcera som stiahol nejaky keygen a ked som ho spustil tak mi ten exe subor asi pojednej sekunde zmizol a potom moj eset nod 32 vyhadzoval ze blokuje nejaku IP adresu. Skusil som obnovyt system dozadu asi o tyzden a uz nic take mi nod nevyhadzuje ale vzdy sa bojim ci tam nieje nejaky keylogger alebo backdoor aby som neprisiel o moje citline udaje, napr prihlasovacie udaje do internetbankingu, tak poprosim o kontrolu logu, alebo navrhnite nejake riesenie

Kód: Vybrat vše

Logfile of random's system information tool 1.07 (written by random/random)
Run by peter at 2010-06-07 18:40:19
Systém Microsoft Windows XP Professional Service Pack 3
System drive C: has 42 GB (28%) free of 153 GB
Total RAM: 2046 MB (57% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 18:40:34, on 7.6.2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
C:\Program Files\Gigabyte\EasySaver\ESSVR.EXE
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\TUProgSt.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\MSN Toolbar\Platform\5.0.1384.0\mswinext.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
C:\Documents and Settings\peter\Local Settings\Data aplikací\Google\Update\1.2.183.23\GoogleCrashHandler.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\Documents and Settings\peter\Local Settings\Data aplikací\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\peter\Local Settings\Data aplikací\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\peter\Local Settings\Data aplikací\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\peter\Local Settings\Data aplikací\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\peter\Local Settings\Data aplikací\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\peter\Local Settings\Data aplikací\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\peter\Local Settings\Data aplikací\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\peter\Local Settings\Data aplikací\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\peter\Local Settings\Data aplikací\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\peter\Local Settings\Data aplikací\Google\Chrome\Application\chrome.exe
C:\Program Files\Opera 10.20 Alpha\opera.exe
C:\Documents and Settings\peter\Plocha\RSIT.exe
C:\Program Files\trend micro\peter.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.www.daemon-search.com/default
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.bing.com/search?q=%s
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
R3 - URLSearchHook: DeviceVM Url Search Hook - {0063BF63-BFFF-4B8F-9D26-4267DF7F17DD} - C:\WINDOWS\system32\dvmurl.dll
R3 - URLSearchHook: Brothersoft Toolbar - {e8de9422-3b2c-4243-bf6f-235da84d8ef8} - C:\Program Files\Brothersoft\tbBro1.dll
O2 - BHO: Podpora odkazu pre aplikáciu Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.5.4723.1820\swg.dll
O2 - BHO: Bing Bar BHO - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files\MSN Toolbar\Platform\5.0.1384.0\npwinext.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: Brothersoft Toolbar - {e8de9422-3b2c-4243-bf6f-235da84d8ef8} - C:\Program Files\Brothersoft\tbBro1.dll
O3 - Toolbar: @C:\Program Files\MSN Toolbar\Platform\5.0.1384.0\npwinext.dll,-100 - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files\MSN Toolbar\Platform\5.0.1384.0\npwinext.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O3 - Toolbar: Brothersoft Toolbar - {e8de9422-3b2c-4243-bf6f-235da84d8ef8} - C:\Program Files\Brothersoft\tbBro1.dll
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [nwiz] C:\Program Files\NVIDIA Corporation\nView\nwiz.exe /install
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Bing Bar] "C:\Program Files\MSN Toolbar\Platform\5.0.1384.0\mswinext.exe"
O4 - HKLM\..\Run: [Microsoft Default Manager] "C:\Program Files\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" -resume
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [AdobeAAMUpdater-1.0] "C:\Program Files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe"
O4 - HKLM\..\Run: [SwitchBoard] C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
O4 - HKLM\..\Run: [AdobeCS5ServiceManager] "C:\Program Files\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe" -launchedbylogin
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\peter\Local Settings\Data aplikací\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\RunOnce: [WiseStubReboot] MSIEXEC /quiet SKIP_PPU_DRIVER_INSTALL=1 /I "C:\Program Files\Common Files\Wise Installation Wizard\WISC5C1C0F0D62F4DBF81D4D7EF397C228B_9_09_0814.MSI" TRANSFORMS="C:\Program Files\Common Files\Wise Installation Wizard\WISC5C1C0F0D62F4DBF81D4D7EF397C228B_9_09_0814.MST" WISE_SETUP_EXE_PATH="c:\documents and settings\peter\plocha\nv19045_winxp\display\PhysX_9.09.0814_SystemSoftware.exe"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O8 - Extra context menu item: E&xportovať do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll/cmsidewiki.html
O9 - Extra button: (no name) - {53F6FCCD-9E22-4d71-86EA-6E43136192AB} - (no file)
O9 - Extra button: (no name) - {925DAB62-F9AC-4221-806A-057BFB1014AA} - (no file)
O9 - Extra button: Zdroje informácií - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Proces mezipaměti kategorií součástí - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
O23 - Service: ES lite Service for program management. (ES lite Service) - Unknown owner - C:\Program Files\Gigabyte\EasySaver\ESSVR.EXE
O23 - Service: Služba Google Update (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: ServiceLayer - Nokia - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: SwitchBoard - Adobe Systems Incorporated - C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software - C:\WINDOWS\System32\TuneUpDefragService.exe
O23 - Service: TuneUp Program Statistics Service (TuneUp.ProgramStatisticsSvc) - TuneUp Software - C:\WINDOWS\System32\TUProgSt.exe

--
End of file - 11235 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\1-Click Maintenance.job
C:\WINDOWS\tasks\AdobeAAMUpdater-1.0-PETER-505BF0206-peter.job
C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1547161642-1614895754-839522115-1003Core.job
C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1547161642-1614895754-839522115-1003UA.job
C:\WINDOWS\tasks\RegPowerClean.job
C:\WINDOWS\tasks\RPCReminder.job
C:\WINDOWS\tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
Podpora odkazu pre aplikáciu Adobe PDF Reader - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll [2006-10-22 62080]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6EBF7485-159F-4bff-A14F-B9E3AAC4465B}]
Search Helper - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll [2010-01-14 138624]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Windows Live ID Sign-in Helper - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-08-18 403840]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AA58ED58-01DD-4d91-8333-CF10577473F7}]
Google Toolbar Helper - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll [2010-02-12 279664]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}]
Google Toolbar Notifier BHO - C:\Program Files\Google\GoogleToolbarNotifier\5.5.4723.1820\swg.dll [2010-03-01 812528]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{d2ce3e00-f94a-4740-988e-03dc2f38c34f}]
Bing Bar BHO - C:\Program Files\MSN Toolbar\Platform\5.0.1384.0\npwinext.dll [2010-02-17 548184]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2010-05-18 41760]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2010-05-18 79648]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{e8de9422-3b2c-4243-bf6f-235da84d8ef8}]
Brothersoft Toolbar - C:\Program Files\Brothersoft\tbBro1.dll [2010-05-18 2515552]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{8dcb7100-df86-4384-8842-8fa844297b3f} - @C:\Program Files\MSN Toolbar\Platform\5.0.1384.0\npwinext.dll,-100 - C:\Program Files\MSN Toolbar\Platform\5.0.1384.0\npwinext.dll [2010-02-17 548184]
{2318C2B1-4965-11d4-9B18-009027A5CD4F} - Google Toolbar - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll [2010-02-12 279664]
{e8de9422-3b2c-4243-bf6f-235da84d8ef8} - Brothersoft Toolbar - C:\Program Files\Brothersoft\tbBro1.dll [2010-05-18 2515552]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"RTHDCPL"=C:\WINDOWS\RTHDCPL.EXE [2009-01-13 18084864]
"Alcmtr"=C:\WINDOWS\ALCMTR.EXE [2008-06-19 57344]
"IgfxTray"=C:\WINDOWS\system32\igfxtray.exe [2009-03-25 134656]
"HotKeysCmds"=C:\WINDOWS\system32\hkcmd.exe [2009-03-25 166912]
"Persistence"=C:\WINDOWS\system32\igfxpers.exe [2009-03-25 136192]
"egui"=C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe [2007-12-21 1443072]
"nwiz"=C:\Program Files\NVIDIA Corporation\nView\nwiz.exe [2009-08-05 1657376]
"NvCplDaemon"=C:\WINDOWS\system32\NvCpl.dll [2009-08-06 13877248]
"NvMediaCenter"=C:\WINDOWS\system32\NvMcTray.dll [2009-08-06 86016]
"NeroFilterCheck"=C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe [2006-01-12 155648]
"Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe [2008-01-11 39792]
"Bing Bar"=C:\Program Files\MSN Toolbar\Platform\5.0.1384.0\mswinext.exe [2010-02-17 243032]
"Microsoft Default Manager"=C:\Program Files\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe [2009-11-11 288088]
"HP Software Update"=C:\Program Files\HP\HP Software Update\HPWuSchd2.exe [2006-02-19 49152]
"SunJavaUpdateSched"=C:\Program Files\Common Files\Java\Java Update\jusched.exe [2010-02-18 248040]
"AdobeAAMUpdater-1.0"=C:\Program Files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [2010-09-25 500208]
"SwitchBoard"=C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096]
"AdobeCS5ServiceManager"=C:\Program Files\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe [2010-02-22 406992]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"=C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"=C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe [2006-11-16 139264]
"swg"=C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [2009-10-02 39408]
"Skype"=C:\Program Files\Skype\Phone\Skype.exe [2007-12-07 21686568]
"Google Update"=C:\Documents and Settings\peter\Local Settings\Data aplikací\Google\Update\GoogleUpdate.exe [2010-04-19 136176]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"WiseStubReboot"=MSIEXEC /quiet SKIP_PPU_DRIVER_INSTALL=1 /I C:\Program Files\Common Files\Wise Installation Wizard\WISC5C1C0F0D62F4DBF81D4D7EF397C228B_9_09_0814.MSI TRANSFORMS=C:\Program Files\Common Files\Wise Installation Wizard\WISC5C1C0F0D62F4DBF81D4D7EF397C228B_9_09_0814.MST WISE_SETUP_EXE_PATH=c:\documents and settings\peter\plocha\nv19045_winxp\display\PhysX_9.09.0814_SystemSoftware.exe []

C:\Documents and Settings\All Users\Nabídka Start\Programy\Po spuštění
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
C:\WINDOWS\system32\igfxdev.dll [2009-03-25 206848]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon]
C:\WINDOWS\system32\WgaLogon.dll [2009-03-10 265096]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
UPnPMonitor - {e57ce738-33e8-4c51-8354-bb4de9d215d1} - C:\WINDOWS\system32\upnpui.dll [2008-04-14 239616]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Wdf01000.sys]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"HonorAutoRunSetting"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\totalcmd\TOTALCMD.EXE"="C:\totalcmd\TOTALCMD.EXE:*:Enabled:Total Commander 32 bit international version, file manager replacement for Windows"
"C:\Program Files\Skype\Plugin Manager\skypePM.exe"="C:\Program Files\Skype\Plugin Manager\skypePM.exe:*:Enabled:Skype Extras Manager"
"C:\Program Files\Opera 10.20 Alpha\opera.exe"="C:\Program Files\Opera 10.20 Alpha\opera.exe:*:Enabled:Opera Internet Browser"
"C:\Program Files\Internet Explorer\IEXPLORE.EXE"="C:\Program Files\Internet Explorer\IEXPLORE.EXE:*:Enabled:Internet Explorer"
"C:\Program Files\Mozilla Firefox\firefox.exe"="C:\Program Files\Mozilla Firefox\firefox.exe:*:Enabled:Mozilla Firefox"
"C:\Hry\Counter-Strike Source\hl2.exe"="C:\Hry\Counter-Strike Source\hl2.exe:*:Enabled:hl2"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Hry\Split Second\SplitSecond.exe"="C:\Hry\Split Second\SplitSecond.exe:*:Enabled:Split/Second"
"C:\Program Files\Skype\Phone\Skype.exe"="C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype. Take a deep breath "
"C:\Program Files\HP\Digital Imaging\bin\hpfccopy.exe"="C:\Program Files\HP\Digital Imaging\bin\hpfccopy.exe:*:Disabled:hpfccopy.exe"
"C:\Program Files\HP\Digital Imaging\bin\hpoews01.exe"="C:\Program Files\HP\Digital Imaging\bin\hpoews01.exe:*:Disabled:hpoews01.exe"
"C:\Program Files\HP\Digital Imaging\bin\hpofxm08.exe"="C:\Program Files\HP\Digital Imaging\bin\hpofxm08.exe:*:Disabled:hpofxm08.exe"
"C:\Program Files\HP\Digital Imaging\bin\hposfx08.exe"="C:\Program Files\HP\Digital Imaging\bin\hposfx08.exe:*:Disabled:hposfx08.exe"
"C:\Program Files\HP\Digital Imaging\bin\hposid01.exe"="C:\Program Files\HP\Digital Imaging\bin\hposid01.exe:*:Disabled:hposid01.exe"
"C:\Program Files\HP\Digital Imaging\bin\hpqCopy.exe"="C:\Program Files\HP\Digital Imaging\bin\hpqCopy.exe:*:Disabled:hpqcopy.exe"
"C:\Program Files\HP\Digital Imaging\Unload\HpqDIA.exe"="C:\Program Files\HP\Digital Imaging\Unload\HpqDIA.exe:*:Disabled:hpqdia.exe"
"C:\Program Files\HP\Digital Imaging\bin\hpqkygrp.exe"="C:\Program Files\HP\Digital Imaging\bin\hpqkygrp.exe:*:Disabled:hpqkygrp.exe"
"C:\Program Files\HP\Digital Imaging\bin\hpqnrs08.exe"="C:\Program Files\HP\Digital Imaging\bin\hpqnrs08.exe:*:Disabled:hpqnrs08.exe"
"C:\Program Files\HP\Digital Imaging\Unload\HpqPhUnl.exe"="C:\Program Files\HP\Digital Imaging\Unload\HpqPhUnl.exe:*:Disabled:hpqphunl.exe"
"C:\Program Files\HP\Digital Imaging\bin\hpqscnvw.exe"="C:\Program Files\HP\Digital Imaging\bin\hpqscnvw.exe:*:Disabled:hpqscnvw.exe"
"C:\Program Files\HP\Digital Imaging\bin\hpqste08.exe"="C:\Program Files\HP\Digital Imaging\bin\hpqste08.exe:*:Disabled:hpqste08.exe"
"C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe"="C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe:*:Disabled:hpqtra08.exe"
"C:\Program Files\HP\Digital Imaging\bin\hpzwiz01.exe"="C:\Program Files\HP\Digital Imaging\bin\hpzwiz01.exe:*:Disabled:hpzwiz01.exe"
"C:\Program Files\ODEON\JAF\JCOP.EXE"="C:\Program Files\ODEON\JAF\JCOP.EXE:*:Disabled:JCOP"
"C:\Program Files\Common Files\Nokia\Service Layer\A\nsl_host_process.exe"="C:\Program Files\Common Files\Nokia\Service Layer\A\nsl_host_process.exe:*:Disabled:Nokia Service Layer Host Process "

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{63f66cce-ed9c-11de-a037-00241d8d4eaa}]
shell\AutoRun\command - F:\USBAutoRun.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f14d4200-caad-11de-9fee-00241d8d4eaa}]
shell\AutoRun\command - Portable_FL.exe


======List of files/folders created in the last 1 months======

2010-09-28 14:33:44 ----A---- C:\WINDOWS\system32\XAudio2_6.dll
2010-09-28 14:33:44 ----A---- C:\WINDOWS\system32\XAPOFX1_4.dll
2010-09-28 14:33:43 ----A---- C:\WINDOWS\system32\xactengine3_6.dll
2010-09-28 14:33:42 ----A---- C:\WINDOWS\system32\X3DAudio1_7.dll
2010-09-26 06:19:42 ----D---- C:\Documents and Settings\peter\Data aplikací\Adobe Mini Bridge CS5
2010-09-26 06:19:41 ----D---- C:\Documents and Settings\peter\Data aplikací\StageManager.BD092818F67280F4B42B04877600987F0111B594.1
2010-09-25 18:28:10 ----D---- C:\Documents and Settings\All Users\Data aplikací\regid.1986-12.com.adobe
2010-09-25 18:19:56 ----D---- C:\Program Files\Adobe Media Player
2010-09-25 18:17:40 ----D---- C:\Program Files\Common Files\Adobe AIR
2010-09-22 16:09:06 ----A---- C:\Documents and Settings\peter\Data aplikací\RSBot Accounts.ini
2010-09-22 12:30:46 ----A---- C:\WINDOWS\system32\XAudio2_5.dll
2010-09-22 12:30:45 ----A---- C:\WINDOWS\system32\xactengine3_5.dll
2010-09-22 12:30:44 ----A---- C:\WINDOWS\system32\D3DCompiler_42.dll
2010-09-22 12:30:43 ----A---- C:\WINDOWS\system32\d3dcsx_42.dll
2010-09-22 12:30:42 ----A---- C:\WINDOWS\system32\d3dx11_42.dll
2010-09-22 12:30:41 ----A---- C:\WINDOWS\system32\d3dx10_42.dll
2010-09-22 12:30:40 ----A---- C:\WINDOWS\system32\D3DX9_42.dll
2010-09-22 12:30:39 ----A---- C:\WINDOWS\system32\d3dx10_41.dll
2010-09-22 12:30:39 ----A---- C:\WINDOWS\system32\D3DCompiler_41.dll
2010-09-22 12:30:38 ----A---- C:\WINDOWS\system32\D3DX9_41.dll
2010-09-22 12:30:37 ----A---- C:\WINDOWS\system32\XAudio2_4.dll
2010-09-22 12:30:37 ----A---- C:\WINDOWS\system32\XAPOFX1_3.dll
2010-09-22 12:30:36 ----A---- C:\WINDOWS\system32\xactengine3_4.dll
2010-09-22 12:30:35 ----A---- C:\WINDOWS\system32\X3DAudio1_6.dll
2010-09-22 12:30:34 ----A---- C:\WINDOWS\system32\d3dx10_40.dll
2010-09-22 12:30:34 ----A---- C:\WINDOWS\system32\D3DCompiler_40.dll
2010-09-22 12:30:33 ----A---- C:\WINDOWS\system32\D3DX9_40.dll
2010-09-22 12:30:31 ----A---- C:\WINDOWS\system32\XAudio2_3.dll
2010-09-22 12:30:31 ----A---- C:\WINDOWS\system32\XAPOFX1_2.dll
2010-09-22 12:30:30 ----A---- C:\WINDOWS\system32\xactengine3_3.dll
2010-09-22 12:30:29 ----A---- C:\WINDOWS\system32\X3DAudio1_5.dll
2010-09-22 12:30:28 ----A---- C:\WINDOWS\system32\XAudio2_2.dll
2010-09-22 12:30:28 ----A---- C:\WINDOWS\system32\XAPOFX1_1.dll
2010-09-22 12:30:27 ----A---- C:\WINDOWS\system32\xactengine3_2.dll
2010-09-22 12:30:26 ----A---- C:\WINDOWS\system32\d3dx10_39.dll
2010-09-22 12:30:26 ----A---- C:\WINDOWS\system32\D3DCompiler_39.dll
2010-09-21 14:31:59 ----D---- C:\Documents and Settings\peter\Data aplikací\Help
2010-06-07 18:40:19 ----D---- C:\rsit
2010-06-07 18:40:19 ----D---- C:\Program Files\trend micro
2010-06-06 20:54:07 ----A---- C:\WINDOWS\Kqitaa.exe
2010-06-06 20:53:59 ----A---- C:\WINDOWS\system32\sshnas21.dll
2010-06-01 22:30:36 ----HDC---- C:\WINDOWS\$NtUninstallKB981793$
2010-05-19 08:13:22 ----D---- C:\Documents and Settings\peter\Data aplikací\gtk-2.0
2010-05-18 09:08:16 ----A---- C:\WINDOWS\system32\javaws.exe
2010-05-18 09:08:16 ----A---- C:\WINDOWS\system32\javaw.exe
2010-05-18 09:08:16 ----A---- C:\WINDOWS\system32\java.exe
2010-05-18 08:46:46 ----D---- C:\Program Files\Sun
2010-05-17 16:06:23 ----A---- C:\WINDOWS\GMouse.ini
2010-05-17 16:04:27 ----A---- C:\WINDOWS\uninst.exe
2010-05-17 14:43:20 ----SHD---- C:\WINDOWS\system32\Sys
2010-05-12 22:14:59 ----HDC---- C:\WINDOWS\$NtUninstallKB978542$
2010-05-12 17:08:48 ----SHD---- C:\WINDOWS\system32\28463
2010-05-12 16:53:57 ----D---- C:\Documents and Settings\All Users\Data aplikací\Winferno
2010-05-12 16:52:30 ----D---- C:\Program Files\Common Files\Winferno
2010-05-12 16:51:36 ----A---- C:\WINDOWS\system32\WINUTIL5.DLL
2010-05-12 16:51:36 ----A---- C:\WINDOWS\system32\WINLCTL5.DLL
2010-05-12 16:51:31 ----A---- C:\WINDOWS\system32\CapiCom.dll
2010-05-12 16:51:29 ----D---- C:\Program Files\Winferno
2010-05-12 16:44:49 ----D---- C:\Program Files\botclient
2010-05-12 16:36:53 ----D---- C:\Program Files\Java
2010-05-12 14:42:58 ----D---- C:\.jagex_cache_32
2010-05-12 14:30:53 ----D---- C:\Program Files\RS2Botv2
2010-05-12 14:30:36 ----D---- C:\Program Files\Free Offers from Freeze.com
2010-05-10 15:55:50 ----D---- C:\Documents and Settings\peter\Data aplikací\Softativity
2010-05-10 14:58:38 ----A---- C:\WINDOWS\system32\deployJava1.dll

======List of files/folders modified in the last 1 months======

2010-10-01 17:32:32 ----SHD---- C:\WINDOWS\Installer
2010-09-28 14:33:46 ----D---- C:\WINDOWS\system32\DirectX
2010-09-28 14:32:49 ----RSD---- C:\WINDOWS\assembly
2010-09-28 14:22:43 ----HD---- C:\Program Files\InstallShield Installation Information
2010-09-28 09:00:16 ----D---- C:\Program Files\Common Files\Blizzard Entertainment
2010-09-27 14:08:38 ----RSD---- C:\WINDOWS\Fonts
2010-09-26 06:40:42 ----D---- C:\Documents and Settings\peter\Data aplikací\Adobe
2010-09-25 18:22:23 ----D---- C:\Program Files\Adobe
2010-09-25 18:21:27 ----D---- C:\Program Files\Common Files\Adobe
2010-09-25 18:17:40 ----D---- C:\Program Files\Common Files
2010-09-25 18:16:04 ----D---- C:\WINDOWS\WinSxS
2010-09-23 06:53:12 ----D---- C:\Screenshots
2010-06-07 18:40:27 ----D---- C:\WINDOWS\Prefetch
2010-06-07 18:40:20 ----D---- C:\WINDOWS\Temp
2010-06-07 18:40:19 ----RD---- C:\Program Files
2010-06-07 17:45:57 ----D---- C:\Documents and Settings\peter\Data aplikací\Skype
2010-06-07 16:09:17 ----D---- C:\WINDOWS\system32\CatRoot2
2010-06-07 15:48:46 ----SD---- C:\WINDOWS\Tasks
2010-06-07 15:44:04 ----D---- C:\WINDOWS\system32\config
2010-06-07 15:43:49 ----D---- C:\WINDOWS\system32\wbem
2010-06-07 15:43:48 ----D---- C:\WINDOWS\Registration
2010-06-07 15:43:31 ----A---- C:\WINDOWS\SchedLgU.Txt
2010-06-07 11:22:28 ----RD---- C:\Hry
2010-06-07 11:22:06 ----D---- C:\Temp
2010-06-07 08:40:14 ----D---- C:\Program Files\Cheat Engine
2010-06-07 08:16:27 ----D---- C:\WINDOWS\.jagex_cache_32
2010-06-06 20:54:07 ----D---- C:\WINDOWS
2010-06-06 20:53:59 ----D---- C:\WINDOWS\system32
2010-06-06 18:59:58 ----A---- C:\WINDOWS\NeroDigital.ini
2010-06-06 16:02:14 ----D---- C:\Documents and Settings\peter\Data aplikací\skypePM
2010-06-01 22:30:44 ----HD---- C:\WINDOWS\inf
2010-06-01 18:00:32 ----D---- C:\Documents and Settings\All Users\Data aplikací\Adobe
2010-05-18 09:03:36 ----D---- C:\Program Files\Brothersoft
2010-05-18 08:47:00 ----D---- C:\Documents and Settings\All Users\Data aplikací\Sun
2010-05-12 22:15:14 ----A---- C:\WINDOWS\imsins.BAK
2010-05-12 22:15:02 ----RSHDC---- C:\WINDOWS\system32\dllcache
2010-05-12 22:15:02 ----D---- C:\Program Files\Outlook Express
2010-05-12 16:30:59 ----D---- C:\Program Files\Nokia
2010-05-12 14:26:51 ----HD---- C:\WINDOWS\$hf_mig$
2010-05-10 16:32:30 ----D---- C:\Program Files\HyperCam 3

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 easdrv;easdrv; C:\WINDOWS\system32\DRIVERS\easdrv.sys [2007-12-21 30216]
R1 epfwtdir;epfwtdir; C:\WINDOWS\system32\DRIVERS\epfwtdir.sys [2007-12-21 33800]
R1 HMFAxCore46691b2fe72383a3b643d95081ef1d95;HMFAxCore46691b2fe72383a3b643d95081ef1d95; C:\WINDOWS\system32\drivers\HMFAxCore46691b2fe72383a3b643d95081ef1d95.sys [2009-10-24 24064]
R1 intelppm;Řadič procesoru Intel; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2008-04-14 40192]
R1 PQNTDrv;PQNTDrv; C:\WINDOWS\system32\drivers\PQNTDrv.sys [2003-04-16 4228]
R2 eamon;EAMON; C:\WINDOWS\system32\DRIVERS\eamon.sys [2007-12-21 39944]
R3 gdrv;gdrv; \??\C:\WINDOWS\gdrv.sys []
R3 HDAudBus;Ovladač Microsoft UAA pro sběrnici High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2008-04-13 144384]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\WINDOWS\system32\drivers\RtkHDAud.sys [2009-01-20 5027840]
R3 nv;nv; C:\WINDOWS\system32\DRIVERS\nv4_mini.sys [2009-08-06 7753888]
R3 RTL8023xp;Realtek 10/100/1000 PCI NIC Family NDIS XP Driver; C:\WINDOWS\system32\DRIVERS\Rtnicxp.sys [2008-08-29 111104]
R3 usbaudio;Ovladač zvukové karty USB (WDM); C:\WINDOWS\system32\drivers\usbaudio.sys [2008-04-14 60032]
R3 usbccgp;Obecný nadřazený ovladač Microsoft USB; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-14 32128]
R3 usbehci;Ovladač miniportu rozšířeného radiče hostitele Microsoft USB 2.0; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2008-04-14 30208]
R3 usbhub;Rozbočovač umožnující USB2; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2008-04-14 59520]
R3 usbuhci;Ovladač Microsoft univerzálního hostitelského řadiče USB od společnosti Microsoft; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2008-04-14 20608]
R3 usbvideo;Zobrazovací zařízení USB (WDM); C:\WINDOWS\System32\Drivers\usbvideo.sys [2008-04-14 121984]
R3 vsbus;Virtual Serial Bus Enumerator; C:\WINDOWS\system32\DRIVERS\vsb.sys [2008-07-24 15264]
S3 atsv0aw8;atsv0aw8; C:\WINDOWS\system32\drivers\atsv0aw8.sys []
S3 avvv2n2b;avvv2n2b; C:\WINDOWS\system32\drivers\avvv2n2b.sys []
S3 CCDECODE;Dekodér Closed Caption; C:\WINDOWS\system32\DRIVERS\CCDECODE.sys [2008-04-14 17024]
S3 HPZid412;IEEE-1284.4 Driver HPZid412; C:\WINDOWS\system32\DRIVERS\HPZid412.sys [2006-02-01 49664]
S3 HPZipr12;Print Class Driver for IEEE-1284.4 HPZipr12; C:\WINDOWS\system32\DRIVERS\HPZipr12.sys [2006-02-01 16496]
S3 HPZius12;USB to IEEE-1284.4 Translation Driver HPZius12; C:\WINDOWS\system32\DRIVERS\HPZius12.sys [2006-02-01 21568]
S3 ialm;ialm; C:\WINDOWS\system32\DRIVERS\igxpmp32.sys [2009-03-25 6313088]
S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink Converter; C:\WINDOWS\system32\drivers\MSTEE.sys [2008-04-14 5504]
S3 NABTSFEC;NABTS/FEC VBI Codec; C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys [2008-04-14 85248]
S3 NdisIP;Microsoft TV/Video Connection; C:\WINDOWS\system32\DRIVERS\NdisIP.sys [2008-04-14 10880]
S3 nmwcd;Nokia USB Phone Parent; C:\WINDOWS\system32\drivers\ccdcmb.sys [2010-02-26 18176]
S3 nmwcdc;Nokia USB Generic; C:\WINDOWS\system32\drivers\ccdcmbo.sys [2010-02-26 22528]
S3 nmwcdnsu;Nokia USB Flashing Phone Parent; C:\WINDOWS\system32\drivers\nmwcdnsu.sys [2010-02-26 137344]
S3 nmwcdnsuc;Nokia USB Flashing Generic; C:\WINDOWS\system32\drivers\nmwcdnsuc.sys [2010-02-26 8320]
S3 pccsmcfd;PCCS Mode Change Filter Driver; C:\WINDOWS\system32\DRIVERS\pccsmcfd.sys [2008-08-26 18816]
S3 SLIP;BDA Slip De-Framer; C:\WINDOWS\system32\DRIVERS\SLIP.sys [2008-04-14 11136]
S3 streamip;BDA IPSink; C:\WINDOWS\system32\DRIVERS\StreamIP.sys [2008-04-14 15232]
S3 upperdev;upperdev; C:\WINDOWS\system32\DRIVERS\usbser_lowerflt.sys [2010-02-26 8192]
S3 usbbus;LGE Mobile Composite USB Device; C:\WINDOWS\system32\DRIVERS\lgusbbus.sys [2008-11-19 13056]
S3 UsbDiag;LGE Mobile USB Serial Port; C:\WINDOWS\system32\DRIVERS\lgusbdiag.sys [2008-11-19 19968]
S3 USBModem;LGE Mobile USB Modem; C:\WINDOWS\system32\DRIVERS\lgusbmodem.sys [2008-11-19 24832]
S3 usbprint;Třída USB Printer; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2008-04-14 25856]
S3 usbscan;Ovladač skeneru USB; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2008-04-14 15104]
S3 usbser;USB Modem Driver; C:\WINDOWS\system32\drivers\usbser.sys [2008-04-14 26112]
S3 UsbserFilt;UsbserFilt; C:\WINDOWS\system32\DRIVERS\usbser_lowerfltj.sys [2010-02-26 8192]
S3 USBSTOR;Ovladač velkokapacitního paměťového zařízení USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-14 26368]
S3 vserial;ELTIMA Virtual Serial Ports Driver; C:\WINDOWS\System32\DRIVERS\vserial.sys [2008-07-24 47744]
S3 Wdf01000;Kernel Mode Driver Frameworks service; C:\WINDOWS\System32\Drivers\wdf01000.sys [2009-07-14 444136]
S3 WSTCODEC;Dálnopisný kodek světového standardu; C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS [2008-04-14 19200]
S4 IntelIde;IntelIde; C:\WINDOWS\system32\drivers\IntelIde.sys []

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 ekrn;Eset Service; C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe [2007-12-21 468224]
R2 ES lite Service;ES lite Service for program management.; C:\Program Files\Gigabyte\EasySaver\ESSVR.EXE [2009-03-02 68136]
R2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2010-05-18 153376]
R2 nvsvc;NVIDIA Display Driver Service; C:\WINDOWS\system32\nvsvc32.exe [2009-08-06 168004]
R2 SeaPort;SeaPort; C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe [2010-01-14 242048]
R2 TuneUp.ProgramStatisticsSvc;TuneUp Program Statistics Service; C:\WINDOWS\System32\TUProgSt.exe [2010-03-03 604488]
R2 UxTuneUp;TuneUp Theme Extension; C:\WINDOWS\System32\svchost.exe [2008-04-14 14336]
R2 wlidsvc;Windows Live ID Sign-in Assistant; C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE [2009-08-18 1529728]
S2 gupdate;Služba Google Update (gupdate); C:\Program Files\Google\Update\GoogleUpdate.exe [2010-03-01 135664]
S2 Pml Driver HPZ12;Pml Driver HPZ12; C:\WINDOWS\system32\HPZipm12.exe [2007-08-09 73728]
S3 aspnet_state;Stavová služba ASP.NET; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2008-07-25 34312]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632]
S3 EhttpSrv;Eset HTTP Server; C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe [2007-12-21 19200]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; c:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104]
S3 gusvc;Google Software Updater; C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-10-02 182768]
S3 idsvc;Windows CardSpace; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664]
S3 NBService;NBService; C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe [2006-11-10 774144]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2006-10-26 441136]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 ServiceLayer;ServiceLayer; C:\Program Files\PC Connectivity Solution\ServiceLayer.exe [2010-02-26 652800]
S3 SwitchBoard;SwitchBoard; C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096]
S3 TuneUp.Defrag;TuneUp Drive Defrag Service; C:\WINDOWS\System32\TuneUpDefragService.exe [2010-03-03 361288]
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2008-07-29 132096]

-----------------EOF-----------------

#2 Příspěvek od **Rudy** » 07 čer 2010 17:51

Promiňte mi přímost, ale spouštět crack, či keygen na PC s obsahem tak citlivých dat, jako jsou přístupová hesla k internetbankingu, dokáže jenom hlupák. Kromě toho, že se dopouští protiprávního jednání, vystavuje svá citlivá data nebezpečí zcizení.

Ale k věci. Dejte log z ComboFix.

Stahnete a ulozte nejlepe na plochu ComboFix: http://download.bleepingcomputer.com/sUBs/ComboFix.exe

pote spustte aplikaci pod uctem s administratorskym opravnenim

hned po startu se zobrazi obrazovka s licencnimi podminkami, pokracujte kliknutim na tlacitko Ano.

v klidu si postavte na kafe (cela akce trva cca. 5-10 minut, nekdy i dele - dle toho, o jak rychly stroj se jedna a kolika soubory se skener bude muset prodirat), behem skenu se nepokousejte spoustet zadne jine aplikace ani nic jineho

behem skenovani nepropadejte panice, vas stroj muze byt restartovan (predevsim pri prvni aplikaci skeneru)

upozorneni: pokud pouzivate antispyware s rezidentnim stitem, prepnete jeho rezidentni stit do Install Mode, pripadne jej po dobu skenu uplne deaktivujte, protoze dochazi pri skenu a vymazu pripadneho malware k nezadoucim kolizim s rezidentem antispyware

peto2232 · #3 Příspěvek od **peto2232** » 07 čer 2010 18:01

niety si ma nepochopil ale ked je v PC keylogger tak ked tukas tie udaje tak mu to posiela co pises a tak to zisty ja to nemam ako .txt subor ulozene v PC

#4 Příspěvek od **Rudy** » 07 čer 2010 19:12

peto2232 píše:niety si ma nepochopil ale ked je v PC keylogger tak ked tukas tie udaje tak mu to posiela co pises a tak to zisty ja to nemam ako .txt subor ulozene v PC

Ale pochopil. Spouštět na PC, v kterém máte takto citlivé údaje nějaký crack, nebo keygen, je holý nerozum. Tyto programy často mají v sobě "bonus" v podobě nějakého šmejda, pomocí něhož může útočník ovládat váš PC na dálku. Nehledě na porušování autorského zákona.

Prosil bych ten log z ComboFix.

peto2232 · #5 Příspěvek od **peto2232** » 07 čer 2010 19:21

dam to sem az zajtra pretoze som velmi unaveny a idem spat

#6 Příspěvek od **Rudy** » 07 čer 2010 19:23

peto2232 · #7 Příspěvek od **peto2232** » 08 čer 2010 06:52

tu to je

Kód: Vybrat vše

ComboFix 10-06-07.01 - peter 08.06.2010   7:34.1.2 - x86
Systém Microsoft Windows XP Professional  5.1.2600.3.1250.421.1029.18.2046.1670 [GMT 2:00]
Running from: c:\documents and settings\peter\Dokumenty\Downloads\ComboFix.exe
AV: ESET NOD32 Antivirus 3.0 *On-access scanning disabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
 * Resident AV is active


WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

(((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\program files\Cheat Engine\dbk32.sys
c:\windows\system32\28463
c:\windows\system32\28463\AKV.exe
c:\windows\system32\28463\JYSY.001
c:\windows\system32\28463\JYSY.002
c:\windows\system32\28463\JYSY.006
c:\windows\system32\28463\JYSY.007
c:\windows\system32\28463\JYSY.009
c:\windows\system32\28463\JYSY.exe
c:\windows\system32\28463\NRMF.001
c:\windows\system32\28463\NRMF.002
c:\windows\system32\28463\NRMF.003
c:\windows\system32\28463\NRMF.004
c:\windows\system32\28463\NRMF.005
c:\windows\system32\28463\NRMF.006
c:\windows\system32\28463\NRMF.007
c:\windows\system32\28463\NRMF.009
c:\windows\system32\28463\NRMF.exe
c:\windows\system32\28463\VQNY.001
c:\windows\system32\28463\VQNY.006
c:\windows\system32\28463\VQNY.007
c:\windows\system32\28463\VQNY.exe
c:\windows\system32\Sys
c:\windows\system32\Sys\AKV.exe
c:\windows\system32\Sys\YTSW.001
c:\windows\system32\Sys\YTSW.002
c:\windows\system32\Sys\YTSW.005
c:\windows\system32\Sys\YTSW.006
c:\windows\system32\Sys\YTSW.007
c:\windows\system32\Sys\YTSW.009
c:\windows\system32\Sys\YTSW.009.tmp
c:\windows\system32\Sys\YTSW.exe
c:\windows\Tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job

.
(((((((((((((((((((((((((   Files Created from 2010-05-08 to 2010-06-08  )))))))))))))))))))))))))))))))
.

2010-09-28 12:33 . 2010-02-04 08:01	74072	----a-w-	c:\windows\system32\XAPOFX1_4.dll
2010-09-28 12:33 . 2010-02-04 08:01	528216	----a-w-	c:\windows\system32\XAudio2_6.dll
2010-09-28 12:33 . 2010-02-04 08:01	238936	----a-w-	c:\windows\system32\xactengine3_6.dll
2010-09-28 12:33 . 2010-02-04 08:01	22360	----a-w-	c:\windows\system32\X3DAudio1_7.dll
2010-09-25 16:19 . 2010-09-25 16:19	--------	d-----w-	c:\program files\Adobe Media Player
2010-09-25 16:17 . 2010-09-25 16:17	--------	d-----w-	c:\program files\Common Files\Adobe AIR
2010-09-23 11:28 . 2010-09-23 11:28	--------	d-----w-	c:\documents and settings\peter\.kbotpro
2010-06-07 16:40 . 2010-06-07 16:40	--------	d-----w-	C:\rsit
2010-06-07 16:40 . 2010-06-07 16:40	--------	d-----w-	c:\program files\trend micro
2010-06-07 13:43 . 2010-06-07 13:43	--------	d-----w-	c:\windows\system32\wbem\Repository
2010-06-06 18:54 . 2010-06-06 18:54	125440	----a-w-	c:\windows\Kqitaa.exe
2010-05-19 06:14 . 2010-05-19 06:14	--------	d-----w-	c:\documents and settings\peter\.thumbnails
2010-05-19 05:37 . 2010-05-20 15:26	--------	d-----w-	c:\documents and settings\peter\.gimp-2.6
2010-05-18 06:46 . 2010-05-18 06:46	--------	d-----w-	c:\program files\Sun
2010-05-18 06:26 . 2010-05-18 06:30	--------	d-----w-	c:\documents and settings\peter\.SunDownloadManager
2010-05-17 14:04 . 1996-01-09 08:38	283648	----a-w-	c:\windows\uninst.exe
2010-05-17 14:04 . 2010-05-17 14:04	--------	d-----w-	c:\documents and settings\peter\WINDOWS
2010-05-12 14:52 . 2010-05-12 14:52	--------	d-----w-	c:\program files\Common Files\Winferno
2010-05-12 14:51 . 2006-10-09 11:06	495616	----a-w-	c:\windows\system32\WINUTIL5.DLL
2010-05-12 14:51 . 2006-05-17 06:40	393216	----a-w-	c:\windows\system32\WINLCTL5.DLL
2010-05-12 14:44 . 2010-05-12 14:45	--------	d-----w-	c:\program files\botclient
2010-05-12 14:36 . 2010-05-18 07:07	--------	d-----w-	c:\program files\Java
2010-05-12 12:42 . 2010-05-12 12:42	--------	d-----w-	C:\.jagex_cache_32
2010-05-12 12:30 . 2010-05-12 12:30	--------	d-----w-	c:\program files\Free Offers from Freeze.com
2010-05-10 12:58 . 2010-05-18 07:07	411368	----a-w-	c:\windows\system32\deployJava1.dll

.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-09-28 12:22 . 2009-09-26 23:51	--------	d--h--w-	c:\program files\InstallShield Installation Information
2010-09-28 07:00 . 2009-10-17 18:08	--------	d-----w-	c:\program files\Common Files\Blizzard Entertainment
2010-09-25 16:21 . 2009-09-27 18:00	--------	d-----w-	c:\program files\Common Files\Adobe
2010-06-08 05:38 . 2010-01-26 19:08	--------	d-----w-	c:\program files\Cheat Engine
2010-06-08 05:30 . 2009-09-27 17:33	17488	----a-w-	c:\windows\gdrv.sys
2010-06-07 06:18 . 2010-03-30 14:35	87	----a-w-	c:\documents and settings\peter\jagex_runescape_preferences2.dat
2010-06-07 06:16 . 2010-03-30 14:34	42	----a-w-	c:\documents and settings\peter\jagex_runescape_preferences.dat
2010-05-18 07:03 . 2010-04-16 11:04	--------	d-----w-	c:\program files\Brothersoft
2010-05-12 14:30 . 2010-03-19 06:27	--------	d-----w-	c:\program files\Nokia
2010-05-10 14:32 . 2010-04-16 11:07	--------	d-----w-	c:\program files\HyperCam 3
2010-04-20 12:28 . 2010-04-20 12:28	0	---ha-w-	c:\windows\system32\drivers\Msft_Kernel_ccdcmb_01009.Wdf
2010-04-20 12:28 . 2010-04-20 12:28	0	---ha-w-	c:\windows\system32\drivers\MsftWdf_Kernel_01009_Coinstaller_Critical.Wdf
2010-04-20 12:21 . 2010-03-19 06:31	--------	d-----w-	c:\program files\PC Connectivity Solution
2010-04-19 12:11 . 2010-04-19 12:11	--------	d-----w-	c:\program files\Quick Screenshot Maker
2010-04-18 19:56 . 2001-10-25 14:00	82750	----a-w-	c:\windows\system32\perfc005.dat
2010-04-18 19:56 . 2001-10-25 14:00	440984	----a-w-	c:\windows\system32\perfh005.dat
2010-04-17 22:51 . 2010-04-17 22:51	--------	d-----w-	c:\program files\MSXML 4.0
2010-04-16 11:07 . 2010-04-16 11:07	--------	d-----w-	c:\program files\Common Files\Solveig Multimedia
2010-04-16 11:04 . 2010-04-16 11:04	--------	d-----w-	c:\program files\Conduit
2010-04-15 04:28 . 2010-04-15 04:28	--------	d-----w-	c:\program files\ODEON
2010-04-13 05:38 . 2009-09-26 23:39	86327	----a-w-	c:\windows\pchealth\helpctr\OfflineCache\index.dat
2010-04-13 05:38 . 2009-09-26 23:39	2740	----a-w-	c:\windows\pchealth\helpctr\PackageStore\SkuStore.bin
2010-04-12 12:45 . 2009-10-25 05:00	848	--sha-w-	c:\windows\system32\KGyGaAvL.sys
2010-04-12 11:32 . 2010-04-11 16:03	107888	----a-w-	c:\windows\system32\CmdLineExt.dll
2010-04-11 19:43 . 2010-04-11 19:43	--------	d-----w-	c:\program files\TeamViewer
2010-04-11 15:18 . 2010-04-11 15:18	--------	d-----w-	c:\program files\DAEMON Tools Lite
2010-04-11 15:18 . 2009-09-27 17:37	691696	----a-w-	c:\windows\system32\drivers\sptd.sys
2010-03-31 06:00 . 2010-03-31 06:00	86016	----a-w-	c:\windows\system32\frapsvid.dll
2010-03-30 14:35 . 2010-03-30 14:35	0	----a-w-	c:\documents and settings\peter\jagex__preferences3.dat
2009-08-28 21:42 . 2009-08-28 21:42	1044480	----a-w-	c:\program files\mozilla firefox\plugins\libdivx.dll
2009-08-28 21:42 . 2009-08-28 21:42	200704	----a-w-	c:\program files\mozilla firefox\plugins\ssldivx.dll
.

(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown 
REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{e8de9422-3b2c-4243-bf6f-235da84d8ef8}"= "c:\program files\Brothersoft\tbBro1.dll" [2010-05-18 2515552]

[HKEY_CLASSES_ROOT\clsid\{e8de9422-3b2c-4243-bf6f-235da84d8ef8}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{e8de9422-3b2c-4243-bf6f-235da84d8ef8}]
2010-05-18 07:03	2515552	----a-w-	c:\program files\Brothersoft\tbBro1.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{e8de9422-3b2c-4243-bf6f-235da84d8ef8}"= "c:\program files\Brothersoft\tbBro1.dll" [2010-05-18 2515552]

[HKEY_CLASSES_ROOT\clsid\{e8de9422-3b2c-4243-bf6f-235da84d8ef8}]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{E8DE9422-3B2C-4243-BF6F-235DA84D8EF8}"= "c:\program files\Brothersoft\tbBro1.dll" [2010-05-18 2515552]

[HKEY_CLASSES_ROOT\clsid\{e8de9422-3b2c-4243-bf6f-235da84d8ef8}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2006-11-16 139264]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-10-02 39408]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2007-12-07 21686568]
"Google Update"="c:\documents and settings\peter\Local Settings\Data aplikací\Google\Update\GoogleUpdate.exe" [2010-04-19 136176]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"WiseStubReboot"="MSIEXEC" [X]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDCPL"="RTHDCPL.EXE" [2009-01-13 18084864]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2009-03-25 134656]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2009-03-25 166912]
"Persistence"="c:\windows\system32\igfxpers.exe" [2009-03-25 136192]
"egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2007-12-21 1443072]
"nwiz"="c:\program files\NVIDIA Corporation\nView\nwiz.exe" [2009-08-05 1657376]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-08-06 13877248]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2009-08-06 86016]
"NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 155648]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]
"Bing Bar"="c:\program files\MSN Toolbar\Platform\5.0.1384.0\mswinext.exe" [2010-02-17 243032]
"Microsoft Default Manager"="c:\program files\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" [2009-11-11 288088]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2006-02-19 49152]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-02-18 248040]
"AdobeAAMUpdater-1.0"="c:\program files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2010-09-25 500208]
"SwitchBoard"="c:\program files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe" [2010-02-19 517096]
"AdobeCS5ServiceManager"="c:\program files\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe" [2010-02-22 406992]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\All Users\Nabˇdka Start\Programy\Po spuçtŘnˇ\
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2006-2-19 288472]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\totalcmd\\TOTALCMD.EXE"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Program Files\\Opera 10.20 Alpha\\opera.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Hry\\Counter-Strike Source\\hl2.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\ODEON\\JAF\\JCOP.EXE"=
"c:\\Program Files\\Common Files\\Nokia\\Service Layer\\A\\nsl_host_process.exe"=
"c:\\Hry\\Split Second\\SplitSecond.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

R1 epfwtdir;epfwtdir;c:\windows\system32\drivers\epfwtdir.sys [21.12.2007 8:21 33800]
R1 HMFAxCore46691b2fe72383a3b643d95081ef1d95;HMFAxCore46691b2fe72383a3b643d95081ef1d95;c:\windows\system32\drivers\HMFAxCore46691b2fe72383a3b643d95081ef1d95.sys [24.10.2009 15:47 24064]
R2 ekrn;Eset Service;c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe [21.12.2007 8:21 468224]
R2 ES lite Service;ES lite Service for program management.;c:\program files\Gigabyte\EasySaver\essvr.exe [27.9.2009 1:51 68136]
S0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [27.9.2009 19:37 691696]
S2 gupdate;Služba Google Update (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [1.3.2010 16:15 135664]
S3 nmwcdnsu;Nokia USB Flashing Phone Parent;c:\windows\system32\drivers\nmwcdnsu.sys [20.4.2010 14:21 137344]
S3 nmwcdnsuc;Nokia USB Flashing Generic;c:\windows\system32\drivers\nmwcdnsuc.sys [20.4.2010 14:21 8320]
S3 SwitchBoard;SwitchBoard;c:\program files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [19.2.2010 13:37 517096]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost  - NetSvcs
UxTuneUp
.
Contents of the 'Scheduled Tasks' folder

2010-06-08 c:\windows\Tasks\1-Click Maintenance.job
- c:\program files\TuneUp Utilities 2009\OneClickStarter.exe [2009-11-16 15:54]

2010-09-26 c:\windows\Tasks\AdobeAAMUpdater-1.0-PETER-505BF0206-peter.job
- c:\program files\Common Files\Adobe\OOBE\PDApp\UWA\updaterstartuputility.exe [2010-09-25 16:05]

2010-06-08 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-03-01 14:15]

2010-06-07 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-03-01 14:15]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.www.daemon-search.com/default
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.bing.com/search?q=%s
IE: E&xportovať do programu Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll/cmsidewiki.html
FF - ProfilePath - c:\documents and settings\peter\Data aplikací\Mozilla\Firefox\Profiles\pxn5ncqo.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.bing.com/search?FORM=DCF2DF&PC=DCF2&q=
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: keyword.URL - hxxp://www.bing.com/search?FORM=DCF2DF&PC=DCF2&q=
FF - component: c:\program files\Microsoft\Search Enhancement Pack\Search Helper\firefoxextension\SearchHelperExtension\components\SEPsearchhelperff.dll
FF - component: c:\program files\MSN Toolbar\Platform\5.0.1384.0\Firefox\components\DomBridge.dll
FF - plugin: c:\program files\Java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: c:\program files\MSN Toolbar\Platform\5.0.1384.0\npwinext.dll
FF - plugin: c:\program files\Opera 10.20 Alpha\program\plugins\npdsplay.dll
FF - plugin: c:\program files\Opera 10.20 Alpha\program\plugins\NPSWF32.dll
FF - plugin: c:\program files\Opera 10.20 Alpha\program\plugins\npwmsdrm.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- FIREFOX POLICIES ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation",  false);
c:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".sk");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
.
- - - - ORPHANS REMOVED - - - -

AddRemove-GhostMouse 2.0 - c:\gmouse20\DeIsL1.isu



**************************************************************************
scanning hidden processes ...  

scanning hidden autostart entries ... 

scanning hidden files ...  

scan completed successfully
hidden files: 

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\S-1-5-21-1547161642-1614895754-839522115-1003\Software\SecuROM\License information*]
"datasecu"=hex:79,6d,2e,bb,92,2e,9b,e1,4b,35,72,a4,57,53,31,1f,79,c3,51,c2,02,
   a9,a7,56,e7,d3,1e,29,9b,8c,c7,4b,19,96,28,2e,89,eb,aa,09,74,85,42,ea,ce,dd,\
"rkeysecu"=hex:36,f3,d5,91,21,54,86,40,16,b7,dd,00,c7,11,c5,a0
.
Completion time: 2010-06-08  07:40:28
ComboFix-quarantined-files.txt  2010-06-08 05:40

Pre-Run: Volných bajtů: 44 776 833 024
Post-Run: Volných bajtů: 44 911 374 336

- - End Of File - - D748D3BDB0A33211961C97CF2CFA7DA3

peto2232 · #8 Příspěvek od **peto2232** » 08 čer 2010 14:38

poprosim o kontrolu logu z combofix

#9 Příspěvek od **Rudy** » 08 čer 2010 17:08

Několik položek bylo smazáno, zbytek logu vypadá čistý. Měl jste tam ArdamaxKeylogger. Doporučuji vám změnit si všechna důležitá hesla.

peto2232 · #10 Příspěvek od **peto2232** » 08 čer 2010 17:14

ja som to vedel (ono ho vymazalo?)

#11 Příspěvek od **Rudy** » 08 čer 2010 19:00

Ano, byl smazán. Jde o tento soubor:

c:\windows\system32\28463\AKV.exe

a celý tento adresář:

c:\windows\system32\28463

peto2232 · #12 Příspěvek od **peto2232** » 08 čer 2010 20:14

no tak velmi pekne dakujem

#13 Příspěvek od **Rudy** » 08 čer 2010 20:23

Rádo se stalo!

peto2232 · #14 Příspěvek od **peto2232** » 09 čer 2010 12:10

no tak super pocitac mam uplne v prdeli. nabehne plocha ale nezobrazi sa dolna lista a potom sa pc zase restartuje a tak dookola. pred tym mi comodo hlasil asi 150 prienikov ale zablokoval ich : (

#15 Příspěvek od **Rudy** » 09 čer 2010 17:38

V tom případě vir něco naboural. Dostanete se alespoň do nouz. režimu?

VIRY.CZ

Kontrola logu

Kontrola logu

Re: Kontrola logu

Re: Kontrola logu

Re: Kontrola logu

Re: Kontrola logu

Re: Kontrola logu

Re: Kontrola logu

Re: Kontrola logu

Re: Kontrola logu

Re: Kontrola logu

Re: Kontrola logu

Re: Kontrola logu

Re: Kontrola logu

Re: Kontrola logu

Re: Kontrola logu