Conficker.X

[Jiří Havel]

All processes killed
========== OTL ==========
No active process named explorer.exe was found!
HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\\Local Page| /E : value set successfully!
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks\\ deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks\\{855F3B16-6D32-4fe6-8A56-BBB695989046} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{855F3B16-6D32-4fe6-8A56-BBB695989046}\ not found.
HKU\S-1-5-21-4518198-3009120168-3986394858-1001\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page| /E : value set successfully!
HKU\S-1-5-21-4518198-3009120168-3986394858-1001\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page Redirect Cache| /E : value set successfully!
Prefs.js: "ICQ Search" removed from browser.search.defaultenginename
Prefs.js: "XfireXO Customized Web Search" removed from browser.search.defaultthis.engineName
Prefs.js: "http://search.conduit.com/ResultsExt.as ... earchTerms}" removed from browser.search.defaulturl
Prefs.js: true removed from browser.search.useDBForOrder
Prefs.js: "http://search.conduit.com/ResultsExt.as ... 2304157&q=" removed from keyword.URL
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FE063DB1-4EC0-403e-8DD8-394C54984B2C}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{FE063DB1-4EC0-403e-8DD8-394C54984B2C}\ not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{FE063DB9-4EC0-403e-8DD8-394C54984B2C} not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{FE063DB9-4EC0-403e-8DD8-394C54984B2C}\ not found.
Registry value HKEY_USERS\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\RunOnce\\mctadmin deleted successfully.
Registry value HKEY_USERS\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\RunOnce\\mctadmin deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\URL\Prefixes\\gopher|:gopher:// /E : value set successfully!
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\skype4com\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{FFC8B962-9B40-4DFF-9458-1830C7DD7F5D}\ deleted successfully.
File {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - Reg Error: Key error. File not found not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\\AppInit_Dlls:j曏痽 C:\Windows\SysWOW64\guard32.dll deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\VMApplet:/pagefile deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\\WebCheck deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\ not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\\WebCheck not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{e1d4b566-7959-11df-8ca7-6cf04905c3e7}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{e1d4b566-7959-11df-8ca7-6cf04905c3e7}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{e1d4b566-7959-11df-8ca7-6cf04905c3e7}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{e1d4b566-7959-11df-8ca7-6cf04905c3e7}\ not found.
File I:\autorun.exe not found.
========== FILES ==========
File\Folder C:\WINDOWS\system32\*.tmp.dll not found.
File\Folder C:\WINDOWS\system32\SET*.tmp not found.
C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP4E27.tmp folder moved successfully.
C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP9E41.tmp folder moved successfully.
C:\WINDOWS\assembly\NativeImages_v2.0.50727_64\Temp\ZAP447E.tmp folder moved successfully.
C:\WINDOWS\assembly\NativeImages_v2.0.50727_64\Temp\ZAPE291.tmp folder moved successfully.
C:\WINDOWS\assembly\NativeImages_v2.0.50727_64\Temp\ZAPE56E.tmp folder moved successfully.
C:\WINDOWS\Installer\MSI17.tmp moved successfully.
C:\WINDOWS\Installer\MSI2059.tmp moved successfully.
C:\WINDOWS\Installer\MSI216.tmp moved successfully.
C:\WINDOWS\Installer\MSI2192.tmp moved successfully.
C:\WINDOWS\Installer\MSI229A.tmp moved successfully.
C:\WINDOWS\Installer\MSI23C4.tmp moved successfully.
C:\WINDOWS\Installer\MSI2460.tmp moved successfully.
C:\WINDOWS\Installer\MSI2461.tmp moved successfully.
C:\WINDOWS\Installer\MSI2B3.tmp moved successfully.
C:\WINDOWS\Installer\MSI4521.tmp moved successfully.
C:\WINDOWS\Installer\MSI45FC.tmp moved successfully.
C:\WINDOWS\Installer\MSI54A4.tmp moved successfully.
C:\WINDOWS\Installer\MSI559F.tmp moved successfully.
C:\WINDOWS\Installer\MSI57A2.tmp moved successfully.
C:\WINDOWS\Installer\MSI583F.tmp moved successfully.
C:\WINDOWS\Installer\MSI7B7E.tmp moved successfully.
C:\WINDOWS\Installer\MSI7C69.tmp moved successfully.
C:\WINDOWS\Installer\MSI7DC1.tmp moved successfully.
C:\WINDOWS\Installer\MSI7E4F.tmp moved successfully.
C:\WINDOWS\Installer\MSIAB81.tmp moved successfully.
C:\WINDOWS\Installer\MSIAC95.tmp moved successfully.
C:\WINDOWS\Installer\MSIB222.tmp moved successfully.
C:\WINDOWS\Installer\MSIBE35.tmp moved successfully.
C:\WINDOWS\Installer\MSIC077.tmp moved successfully.
C:\WINDOWS\Installer\MSIC54C.tmp moved successfully.
C:\WINDOWS\Installer\MSICD87.tmp moved successfully.
C:\WINDOWS\Installer\MSID05D.tmp moved successfully.
C:\WINDOWS\Installer\MSIFD97.tmp moved successfully.
C:\WINDOWS\System32\is-VRJDE.tmp moved successfully.
C:\WINDOWS\System32\WPRO_40_1340woem.tmp moved successfully.
File\Folder c:\Autorun.inf not found.
File\Folder D:\Autorun.inf not found.
File\Folder E:\Autorun.inf not found.
File\Folder F:\Autorun.inf not found.
File\Folder G:\Autorun.inf not found.
File\Folder H:\Autorun.inf not found.
File\Folder I:\Autorun.inf not found.
File\Folder K:\Autorun.inf not found.
File\Folder L:\Autorun.inf not found.
File\Folder C:\recycler not found.
File\Folder D:\recycler not found.
File\Folder e:\recycler not found.
File\Folder f:\recycler not found.
File\Folder g:\recycler not found.
File\Folder h:\recycler not found.
File\Folder I:\recycler not found.
File\Folder C:\resycled not found.
File\Folder D:\resycled not found.
File\Folder e:\resycled not found.
File\Folder f:\resycled not found.
File\Folder g:\resycled not found.
File\Folder h:\resycled not found.
File\Folder I:\resycled not found.
c:\$Recycle.Bin\S-1-5-21-4518198-3009120168-3986394858-501 folder moved successfully.
c:\$Recycle.Bin\S-1-5-21-4518198-3009120168-3986394858-1003 folder moved successfully.
c:\$Recycle.Bin\S-1-5-21-4518198-3009120168-3986394858-1001 folder moved successfully.
c:\$Recycle.Bin folder moved successfully.
d:\$RECYCLE.BIN\S-1-5-21-4518198-3009120168-3986394858-501 folder moved successfully.
d:\$RECYCLE.BIN\S-1-5-21-4518198-3009120168-3986394858-1003 folder moved successfully.
d:\$RECYCLE.BIN\S-1-5-21-4518198-3009120168-3986394858-1001 folder moved successfully.
d:\$RECYCLE.BIN\S-1-5-21-4148371277-2117529603-1969584053-1001 folder moved successfully.
d:\$RECYCLE.BIN\S-1-5-21-3732995390-3839235142-1401659564-1001 folder moved successfully.
d:\$RECYCLE.BIN folder moved successfully.
File\Folder e:\$recycle.bin not found.
File\Folder f:\$recycle.bin not found.
g:\$RECYCLE.BIN\S-1-5-21-4518198-3009120168-3986394858-501 folder moved successfully.
g:\$RECYCLE.BIN\S-1-5-21-4518198-3009120168-3986394858-1003 folder moved successfully.
g:\$RECYCLE.BIN\S-1-5-21-4518198-3009120168-3986394858-1001 folder moved successfully.
g:\$RECYCLE.BIN\S-1-5-21-3732995390-3839235142-1401659564-1001 folder moved successfully.
g:\$RECYCLE.BIN\S-1-5-21-2884452907-3421478663-2955458443-1001 folder moved successfully.
g:\$RECYCLE.BIN\S-1-5-21-2884452907-3421478663-2955458443-1000 folder moved successfully.
g:\$RECYCLE.BIN\S-1-5-21-1183128742-1809632703-4120111583-1000 folder moved successfully.
g:\$RECYCLE.BIN folder moved successfully.
File\Folder h:\$recycle.bin not found.
File\Folder I:\$recycle.bin not found.
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: AppData

User: Daniel
->Temp folder emptied: 1890443 bytes
->Temporary Internet Files folder emptied: 805025 bytes
->Java cache emptied: 316788 bytes
->FireFox cache emptied: 86576084 bytes
->Google Chrome cache emptied: 52098057 bytes
->Opera cache emptied: 230652 bytes
->Flash cache emptied: 3244 bytes

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Guest
->Temp folder emptied: 361251 bytes
->Temporary Internet Files folder emptied: 59573 bytes
->Flash cache emptied: 456 bytes

User: Public

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 3322 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 50507 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 136,00 mb


[EMPTYFLASH]

User: All Users

User: AppData

User: Daniel
->Flash cache emptied: 0 bytes

User: Default

User: Default User

User: Guest
->Flash cache emptied: 0 bytes

User: Public

Total Flash Files Cleaned = 0,00 mb

Restore point Set: OTL Restore Point

OTL by OldTimer - Version 3.2.9.0 log created on 07152010_230247

Files\Folders moved on Reboot...
C:\Users\Daniel\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.

Registry entries deleted on Reboot...

[motji]

http://en.utrace.de/?query=213.46.172.37

[Jiří Havel]

Tam to neznám. Já bydlim v Praze. Možná jak hraju po netu...

[motji]

Prosím tu svoji IP radši smažte

Já bych řekla že to bude v pořádku

[Jiří Havel]

Tak Vám mockrát děkuju

Prosím Vás a když eset našel toho confickera v appdata byl v pc už "zakořeněnej" nebo se jen stahoval nebo něco takovýho?

[motji]

Asi zakořenoval , ale můžete sem pro jistotu dát za pár dní log ze rsitu znovu ke kontrole .

Stahněte OTC a použijte
http://oldtimer.geekstogo.com/OTC.exe
-počítač se restartuje