Odvirování PC, zrychlení počítače, vzdálená pomoc prostřednictvím služby neslape.cz

Garena.exe buffer overflow attack

Máte problém s virem? Vložte sem log z FRST nebo RSIT.

Moderátor: Moderátoři

Pravidla fóra
Pokud chcete pomoc, vložte log z FRST [návod zde] nebo RSIT [návod zde]

Jednotlivé thready budou po vyřešení uzamčeny. Stejně tak ty, které budou nečinné déle než 14 dní. Vizte Pravidlo o zamykání témat. Děkujeme za pochopení.

!NOVINKA!
Nově lze využívat služby vzdálené pomoci, kdy se k vašemu počítači připojí odborník a bližší informace o problému si od vás získá telefonicky! Více na www.neslape.cz
Odpovědět
Zpráva
Autor
Davefin
Návštěvník
Návštěvník
Příspěvky: 9
Registrován: 01 říj 2010 18:14

Garena.exe buffer overflow attack

#1 Příspěvek od Davefin »

Takže.
Ahojte, jsem tu poprvé, tak se omlouvám pokud budu chvíli nechápat nebo nedám napoprvý všechny informace, ale vynasnažím se...

Včera mi začal zlobit počítač. Spustil jsem Garena.exe (program na hraní WarcraftIII a dalších her přes net), jako normálně, a comodo mi to zablokovalo - Buffer overflow, shellcode injektáž, pozor pozor...
Tak jsem si řek dobrý, odinstaloval jsem to, projel systém antivirem, nic, tak jsem spustil rgc (ranked gaming client, další věcička na hraní doty, měla by bejt taky čistá) a ten mi furt hází nějakej error.
Po reinstalaci (download z oficiálních stránek, dost bych se divil, kdyby s takovým počtem uživatelů potřebovali dávat do programu viry a pak prodávat botnet nebo co...) Gareny mi to furt hlásí buffer overflow attack.

Mám Spyware Terminator(jen HIPS a imunizaci, ClamAV off) a ComodoIS (jen firewall a defence+, bez antiviru) (btw, to snad nevadí, jeden antivir a jeden rezident, to by se nemělo rušit?).

Ještě by mohl být problém v RGC, sice by to mělo bejt čistý, ale je to docela málo známej a používanej program, tak nevim... kamarádovi šlape v pohodě, ale ten má Avast a windows firewall, to mu nic nechytí...

A ještě, COMODO mi to zachytilo po updatu (nejen databáze, ale celej program se updatoval včera, po restartu počítače mi to chytil).

Ještě přikládám log HJT (teda RSIT) a předem díky všem kdo by mi pomohli... :)






Logfile of random's system information tool 1.08 (written by random/random)
Run by Davefin at 2010-10-01 19:12:42
Systém Microsoft Windows XP Professional Service Pack 3
System drive C: has 55 GB (72%) free of 76 GB
Total RAM: 3071 MB (76% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 19:12:53, on 1.10.2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe
E:\Program Files\CDBurnerXP\NMSAccessU.exe
E:\Program Files\Nero BackItUp\Nero BackItUp 4\IoctlSvc.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\Program Files\Spyware Terminator\sp_rsser.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Analog Devices\SoundMAX\Smax4.exe
C:\Program Files\COMODO\COMODO Internet Security\cfp.exe
C:\PROGRA~1\SPYWAR~1\SpywareTerminatorShield.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\RocketDock\RocketDock.exe
E:\Launchy\Launchy.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\Program Files\Skype\Toolbars\Shared\SkypeNames2.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files\CCleaner\CCleaner.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\PROGRA~1\Crawler\Toolbar\CToolbar.exe
E:\Dokumenty\Stažené soubory\RSIT.exe
C:\Program Files\trend micro\Davefin.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.crawler.com/search/dispatche ... tbid=60076
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.crawler.com/homepage.aspx?tbid=60076
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://www.crawler.com/search/ie.aspx?tb_id=60076
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,CustomizeSearch = http://dnl.crawler.com/support/sa_custo ... TbId=60076
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.crawler.com/search/ie.aspx?tb_id=60076
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://dnl.crawler.com/support/sa_custo ... TbId=60076
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
R3 - URLSearchHook: (no name) - {1CB20BF0-BBAE-40A7-93F4-6435FF3D0411} - C:\PROGRA~1\Crawler\Toolbar\ctbr.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: (no name) - {1CB20BF0-BBAE-40A7-93F4-6435FF3D0411} - C:\PROGRA~1\Crawler\Toolbar\ctbr.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: &Crawler lišta - {4B3803EA-5230-4DC3-A7FC-33638F3D3542} - C:\PROGRA~1\Crawler\Toolbar\ctbr.dll
O4 - HKLM\..\Run: [SoundMAX] "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray
O4 - HKLM\..\Run: [COMODO Internet Security] "C:\Program Files\COMODO\COMODO Internet Security\cfp.exe" -h
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [SpywareTerminator] "C:\PROGRA~1\SPYWAR~1\SpywareTerminatorShield.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [RocketDock] "C:\Program Files\RocketDock\RocketDock.exe"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: Zástupce - Launchy.lnk = E:\Launchy\Launchy.exe
O8 - Extra context menu item: Crawler Search - tbr:iemenu
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - E:\PROGRA~1\MICROS~1\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/s ... wflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{AC7F8645-FA01-480A-8C5C-C52E22A918F9}: NameServer = 156.154.70.22,156.154.71.22
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Protocol: tbr - {4D25FB7A-8902-4291-960E-9ADA051CFBBF} - C:\PROGRA~1\Crawler\Toolbar\ctbr.dll
O20 - AppInit_DLLs:
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Proces mezipaměti kategorií součástí - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Bonjour Service - Unknown owner - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: COMODO Internet Security Helper Service (cmdAgent) - COMODO - C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe
O23 - Service: Služba Google Update (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: LogMeIn Hamachi 2.0 Tunneling Engine (Hamachi2Svc) - Unknown owner - E:\Program Files\LogMeInHamachi\hamachi-2.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Nero BackItUp Scheduler 4.0 - Nero AG - C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe
O23 - Service: NMSAccess - Unknown owner - E:\Program Files\CDBurnerXP\NMSAccessU.exe
O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. - E:\Program Files\Nero BackItUp\Nero BackItUp 4\IoctlSvc.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - C:\Program Files\Spyware Terminator\sp_rsser.exe
O23 - Service: TuneUp Utilities Service (TuneUp.UtilitiesSvc) - Unknown owner - C:\Program Files\TuneUp Utilities 2010\TuneUpUtilitiesService32.exe

--
End of file - 8354 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\AppleSoftwareUpdate.job
C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
C:\WINDOWS\tasks\User_Feed_Synchronization-{E7576044-1EC5-4ACE-8D9F-DC787D6F4203}.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2010-06-19 75200]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1CB20BF0-BBAE-40A7-93F4-6435FF3D0411}]
C:\PROGRA~1\Crawler\Toolbar\ctbr.dll [2010-08-09 1241960]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2010-08-04 41760]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2010-08-04 79648]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{4B3803EA-5230-4DC3-A7FC-33638F3D3542} - &Crawler lišta - C:\PROGRA~1\Crawler\Toolbar\ctbr.dll [2010-08-09 1241960]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"SoundMAX"=C:\Program Files\Analog Devices\SoundMAX\Smax4.exe [2003-05-30 585728]
"COMODO Internet Security"=C:\Program Files\COMODO\COMODO Internet Security\cfp.exe [2010-09-30 2500552]
"StartCCC"=C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [2010-02-10 61440]
"SpywareTerminator"=C:\PROGRA~1\SPYWAR~1\SpywareTerminatorShield.exe [2010-08-19 2176512]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"=C:\WINDOWS\system32\ctfmon.exe [2008-04-14 40448]
"Skype"=C:\Program Files\Skype\Phone\Skype.exe [2010-05-13 26192168]
"RocketDock"=C:\Program Files\RocketDock\RocketDock.exe [2007-09-02 495616]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2010-06-09 976832]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [2010-06-20 35760]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BTE]
E:\Program Files\Emailer\bin\emailer.exe [2009-10-25 781312]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
C:\Program Files\DAEMON Tools Lite\DTLite.exe [2010-04-01 357696]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
E:\Program Files\iTunes\iTunesHelper.exe [2010-09-01 421160]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogMeIn Hamachi Ui]
E:\Program Files\LogMeInHamachi\hamachi-2-ui.exe [2010-03-30 1820040]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogonStudio]
C:\Program Files\WinCustomize\LogonStudio\logonstudio.exe [2002-09-03 987187]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NBKeyScan]
E:\Program Files\Nero BackItUp\Nero BackItUp 4\NBKeyScan.exe [2008-09-24 2254120]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Pando Media Booster]
C:\Program Files\Pando Networks\Media Booster\PMB.exe [2010-09-19 2969496]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PinnacleDriverCheck]
C:\WINDOWS\system32\\PSDrvCheck.exe [2004-03-11 406016]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
C:\Program Files\QuickTime\QTTask.exe [2010-09-08 421888]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
C:\Program Files\Skype\Phone\Skype.exe [2010-05-13 26192168]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMAXPnP]
C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe [2003-05-29 790528]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
C:\Program Files\Common Files\Java\Java Update\jusched.exe [2010-05-14 248552]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]
C:\Program Files\Winamp\winampa.exe [2010-07-12 74752]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^RocketDock.lnk]
C:\PROGRA~1\ROCKET~1\ROCKET~1.EXE [2007-09-02 495616]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Davefin^Nabídka Start^Programy^Po spuštění^Garena.lnk]
E:\PROGRA~1\Garena\Garena.exe []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Davefin^Nabídka Start^Programy^Po spuštění^OpenOffice.org 3.1.lnk]
C:\PROGRA~1\OPENOF~1.ORG\program\QUICKS~1.EXE [2009-09-16 384512]

C:\Documents and Settings\Davefin\Nabídka Start\Programy\Po spuštění
Zástupce - Launchy.lnk - E:\Launchy\Launchy.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=" "

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent]
C:\WINDOWS\system32\Ati2evxx.dll [2009-05-15 155648]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon]
C:\WINDOWS\system32\WgaLogon.dll [2009-03-10 265096]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa]
"notification packages"=
:\WINDOWS\system32\srr

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Hamachi2Svc]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"HonorAutoRunSetting"=1

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\Skype\Plugin Manager\skypePM.exe"="C:\Program Files\Skype\Plugin Manager\skypePM.exe:*:Enabled:Skype Extras Manager"
"E:\Program Files\Garena\Garena.exe"="E:\Program Files\Garena\Garena.exe:*:Enabled:Garena"
"C:\WINDOWS\system32\PnkBstrA.exe"="C:\WINDOWS\system32\PnkBstrA.exe:*:Enabled:PnkBstrA"
"C:\WINDOWS\system32\PnkBstrB.exe"="C:\WINDOWS\system32\PnkBstrB.exe:*:Enabled:PnkBstrB"
"C:\Program Files\Pinnacle\Studio 10\programs\RM.exe"="C:\Program Files\Pinnacle\Studio 10\programs\RM.exe:*:Enabled:Render Manager"
"C:\Program Files\Bonjour\mDNSResponder.exe"="C:\Program Files\Bonjour\mDNSResponder.exe:*:Enabled:Bonjour Service"
"C:\Program Files\Ventrilo\Ventrilo.exe"="C:\Program Files\Ventrilo\Ventrilo.exe:*:Enabled:Ventrilo.exe"
"E:\Program Files\iTunes\iTunes.exe"="E:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes"
"C:\Program Files\Pando Networks\Media Booster\PMB.exe"="C:\Program Files\Pando Networks\Media Booster\PMB.exe:*:Enabled:Pando Media Booster"
"E:\Program Files\League of Legends\Air\LolClient.exe"="E:\Program Files\League of Legends\Air\LolClient.exe:*:Enabled:League of Legends Lobby"
"E:\Program Files\League of Legends\Game\League of Legends.exe"="E:\Program Files\League of Legends\Game\League of Legends.exe:*:Enabled:League of Legends Game Client"
"C:\Program Files\Skype\Phone\Skype.exe"="C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\Pando Networks\Media Booster\PMB.exe"="C:\Program Files\Pando Networks\Media Booster\PMB.exe:*:Enabled:Pando Media Booster"

======List of files/folders created in the last 1 months======

2010-10-01 19:12:43 ----D---- C:\Program Files\trend micro
2010-10-01 19:12:42 ----D---- C:\rsit
2010-09-30 17:46:45 ----HD---- C:\WINDOWS\PIF
2010-09-30 17:39:26 ----D---- C:\Config.Msi
2010-09-30 16:42:49 ----HDC---- C:\WINDOWS\$NtUninstallKB2158563$
2010-09-25 13:19:14 ----D---- C:\Program Files\Microsoft Works
2010-09-25 13:18:56 ----D---- C:\Program Files\Microsoft Visual Studio
2010-09-25 13:18:55 ----D---- C:\Program Files\Common Files\DESIGNER
2010-09-25 13:18:13 ----D---- C:\Program Files\Microsoft.NET
2010-09-25 13:16:04 ----D---- C:\WINDOWS\SHELLNEW
2010-09-25 13:04:29 ----A---- C:\WINDOWS\system32\drivers\sptd.sys
2010-09-25 13:04:22 ----D---- C:\Program Files\DAEMON Tools Lite
2010-09-25 13:03:56 ----D---- C:\Documents and Settings\Davefin\Data aplikací\DAEMON Tools Lite
2010-09-25 13:03:50 ----D---- C:\Documents and Settings\All Users\Data aplikací\DAEMON Tools Lite
2010-09-21 19:39:33 ----A---- C:\WINDOWS\system32\uxtheme.dll.backup
2010-09-21 19:39:13 ----HD---- C:\WINDOWS\NiwradSoft Shell Pack
2010-09-20 18:36:37 ----A---- C:\WINDOWS\system32\drivers\usbohci.sys
2010-09-19 18:24:39 ----D---- C:\Documents and Settings\Davefin\Data aplikací\LolClient
2010-09-19 16:23:04 ----D---- C:\Program Files\Common Files\Java
2010-09-19 16:22:44 ----A---- C:\WINDOWS\system32\javaws.exe
2010-09-19 16:22:44 ----A---- C:\WINDOWS\system32\javaw.exe
2010-09-19 16:22:44 ----A---- C:\WINDOWS\system32\java.exe
2010-09-19 16:22:44 ----A---- C:\WINDOWS\system32\deployJava1.dll
2010-09-19 15:37:23 ----A---- C:\WINDOWS\system32\XAPOFX1_5.dll
2010-09-19 15:37:22 ----A---- C:\WINDOWS\system32\XAudio2_7.dll
2010-09-19 15:37:20 ----A---- C:\WINDOWS\system32\xactengine3_7.dll
2010-09-19 15:37:19 ----A---- C:\WINDOWS\system32\D3DCompiler_43.dll
2010-09-19 15:37:18 ----A---- C:\WINDOWS\system32\d3dx11_43.dll
2010-09-19 15:37:18 ----A---- C:\WINDOWS\system32\d3dcsx_43.dll
2010-09-19 15:37:17 ----A---- C:\WINDOWS\system32\d3dx10_43.dll
2010-09-19 15:37:16 ----A---- C:\WINDOWS\system32\D3DX9_43.dll
2010-09-19 15:37:15 ----A---- C:\WINDOWS\system32\XAudio2_6.dll
2010-09-19 15:37:15 ----A---- C:\WINDOWS\system32\XAPOFX1_4.dll
2010-09-19 15:37:15 ----A---- C:\WINDOWS\system32\xactengine3_6.dll
2010-09-19 15:37:12 ----A---- C:\WINDOWS\system32\X3DAudio1_7.dll
2010-09-19 15:37:11 ----A---- C:\WINDOWS\system32\XAudio2_5.dll
2010-09-19 15:37:10 ----A---- C:\WINDOWS\system32\xactengine3_5.dll
2010-09-19 15:37:09 ----A---- C:\WINDOWS\system32\D3DCompiler_42.dll
2010-09-19 15:37:08 ----A---- C:\WINDOWS\system32\d3dx11_42.dll
2010-09-19 15:37:08 ----A---- C:\WINDOWS\system32\d3dcsx_42.dll
2010-09-19 15:37:07 ----A---- C:\WINDOWS\system32\d3dx10_42.dll
2010-09-19 15:37:06 ----A---- C:\WINDOWS\system32\d3dx10_41.dll
2010-09-19 15:37:06 ----A---- C:\WINDOWS\system32\D3DCompiler_41.dll
2010-09-19 15:37:05 ----A---- C:\WINDOWS\system32\D3DX9_41.dll
2010-09-19 15:37:03 ----A---- C:\WINDOWS\system32\XAudio2_4.dll
2010-09-19 15:37:03 ----A---- C:\WINDOWS\system32\XAPOFX1_3.dll
2010-09-19 15:37:02 ----A---- C:\WINDOWS\system32\xactengine3_4.dll
2010-09-19 15:37:01 ----A---- C:\WINDOWS\system32\X3DAudio1_6.dll
2010-09-19 15:37:00 ----A---- C:\WINDOWS\system32\XAudio2_3.dll
2010-09-19 15:37:00 ----A---- C:\WINDOWS\system32\XAPOFX1_2.dll
2010-09-19 15:37:00 ----A---- C:\WINDOWS\system32\xactengine3_3.dll
2010-09-19 15:36:59 ----A---- C:\WINDOWS\system32\X3DAudio1_5.dll
2010-09-19 15:36:58 ----A---- C:\WINDOWS\system32\XAudio2_2.dll
2010-09-19 15:36:58 ----A---- C:\WINDOWS\system32\XAPOFX1_1.dll
2010-09-19 15:36:57 ----A---- C:\WINDOWS\system32\xactengine3_2.dll
2010-09-19 15:36:56 ----A---- C:\WINDOWS\system32\d3dx10_39.dll
2010-09-19 15:36:56 ----A---- C:\WINDOWS\system32\D3DCompiler_39.dll
2010-09-19 15:36:55 ----A---- C:\WINDOWS\system32\D3DX9_39.dll
2010-09-19 15:36:54 ----A---- C:\WINDOWS\system32\XAudio2_1.dll
2010-09-19 15:36:54 ----A---- C:\WINDOWS\system32\XAPOFX1_0.dll
2010-09-19 15:36:53 ----A---- C:\WINDOWS\system32\xactengine3_1.dll
2010-09-19 15:36:52 ----A---- C:\WINDOWS\system32\X3DAudio1_4.dll
2010-09-19 15:36:51 ----A---- C:\WINDOWS\system32\d3dx10_38.dll
2010-09-19 15:36:51 ----A---- C:\WINDOWS\system32\D3DCompiler_38.dll
2010-09-19 15:36:50 ----A---- C:\WINDOWS\system32\D3DX9_38.dll
2010-09-19 15:36:49 ----A---- C:\WINDOWS\system32\XAudio2_0.dll
2010-09-19 15:36:48 ----A---- C:\WINDOWS\system32\xactengine3_0.dll
2010-09-19 15:36:47 ----A---- C:\WINDOWS\system32\X3DAudio1_3.dll
2010-09-19 15:36:47 ----A---- C:\WINDOWS\system32\d3dx10_37.dll
2010-09-19 15:36:47 ----A---- C:\WINDOWS\system32\D3DCompiler_37.dll
2010-09-19 15:36:46 ----A---- C:\WINDOWS\system32\D3DX9_37.dll
2010-09-19 15:36:45 ----A---- C:\WINDOWS\system32\xactengine2_10.dll
2010-09-19 15:36:43 ----A---- C:\WINDOWS\system32\d3dx10_36.dll
2010-09-19 15:36:43 ----A---- C:\WINDOWS\system32\D3DCompiler_36.dll
2010-09-19 15:36:41 ----A---- C:\WINDOWS\system32\d3dx9_36.dll
2010-09-19 15:36:40 ----A---- C:\WINDOWS\system32\xactengine2_9.dll
2010-09-19 15:36:39 ----A---- C:\WINDOWS\system32\d3dx10_35.dll
2010-09-19 15:36:39 ----A---- C:\WINDOWS\system32\D3DCompiler_35.dll
2010-09-19 15:36:38 ----A---- C:\WINDOWS\system32\d3dx9_35.dll
2010-09-19 15:36:37 ----A---- C:\WINDOWS\system32\xactengine2_8.dll
2010-09-19 15:36:36 ----A---- C:\WINDOWS\system32\X3DAudio1_2.dll
2010-09-19 15:36:36 ----A---- C:\WINDOWS\system32\d3dx10_34.dll
2010-09-19 15:36:36 ----A---- C:\WINDOWS\system32\D3DCompiler_34.dll
2010-09-19 15:36:35 ----A---- C:\WINDOWS\system32\d3dx9_34.dll
2010-09-19 15:36:34 ----A---- C:\WINDOWS\system32\xactengine2_7.dll
2010-09-19 15:36:33 ----A---- C:\WINDOWS\system32\d3dx10_33.dll
2010-09-19 15:36:33 ----A---- C:\WINDOWS\system32\D3DCompiler_33.dll
2010-09-19 15:36:32 ----A---- C:\WINDOWS\system32\d3dx9_33.dll
2010-09-19 15:36:31 ----A---- C:\WINDOWS\system32\xactengine2_6.dll
2010-09-19 15:36:30 ----A---- C:\WINDOWS\system32\xactengine2_5.dll
2010-09-19 15:36:30 ----A---- C:\WINDOWS\system32\d3dx9_32.dll
2010-09-19 15:36:29 ----A---- C:\WINDOWS\system32\xactengine2_4.dll
2010-09-19 15:36:29 ----A---- C:\WINDOWS\system32\x3daudio1_1.dll
2010-09-19 15:36:28 ----A---- C:\WINDOWS\system32\xinput1_2.dll
2010-09-19 15:36:28 ----A---- C:\WINDOWS\system32\xactengine2_3.dll
2010-09-19 15:36:27 ----A---- C:\WINDOWS\system32\xactengine2_2.dll
2010-09-19 15:36:26 ----A---- C:\WINDOWS\system32\xinput1_1.dll
2010-09-19 15:36:26 ----A---- C:\WINDOWS\system32\xactengine2_1.dll
2010-09-19 15:36:21 ----A---- C:\WINDOWS\system32\xactengine2_0.dll
2010-09-19 15:36:21 ----A---- C:\WINDOWS\system32\d3dx9_30.dll
2010-09-19 15:36:20 ----A---- C:\WINDOWS\system32\x3daudio1_0.dll
2010-09-19 15:36:20 ----A---- C:\WINDOWS\system32\d3dx9_29.dll
2010-09-19 15:36:19 ----A---- C:\WINDOWS\system32\d3dx9_28.dll
2010-09-19 15:36:18 ----A---- C:\WINDOWS\system32\xinput9_1_0.dll
2010-09-19 15:36:17 ----A---- C:\WINDOWS\system32\d3dx9_27.dll
2010-09-19 15:36:16 ----A---- C:\WINDOWS\system32\d3dx9_26.dll
2010-09-19 15:36:16 ----A---- C:\WINDOWS\system32\d3dx9_25.dll
2010-09-19 15:36:15 ----A---- C:\WINDOWS\system32\d3dx9_24.dll
2010-09-19 13:31:07 ----D---- C:\Documents and Settings\All Users\Data aplikací\PMB Files
2010-09-19 13:29:51 ----D---- C:\Program Files\Pando Networks
2010-09-18 13:27:38 ----A---- C:\WINDOWS\BricoPackUninst.cmd
2010-09-18 13:25:14 ----A---- C:\WINDOWS\BricoPackUninst.txt
2010-09-18 13:25:14 ----A---- C:\WINDOWS\BricoPackFoldersDelete.cmd
2010-09-18 13:24:36 ----D---- C:\WINDOWS\BricoPacks
2010-09-18 13:05:50 ----D---- C:\Program Files\QuickTime
2010-09-18 13:00:19 ----D---- C:\Program Files\iPod
2010-09-18 12:14:31 ----D---- C:\Program Files\Defraggler
2010-09-15 19:16:10 ----HDC---- C:\WINDOWS\$NtUninstallKB2259922$
2010-09-15 19:15:51 ----HDC---- C:\WINDOWS\$NtUninstallKB975558_WM8$
2010-09-15 19:14:57 ----HDC---- C:\WINDOWS\$NtUninstallKB2347290$
2010-09-15 19:14:31 ----HDC---- C:\WINDOWS\$NtUninstallKB2121546$
2010-09-15 19:14:03 ----HDC---- C:\WINDOWS\$NtUninstallKB982802$
2010-09-15 19:12:31 ----HDC---- C:\WINDOWS\$NtUninstallKB981322$
2010-09-15 19:08:28 ----HDC---- C:\WINDOWS\$NtUninstallKB2141007$
2010-09-06 18:53:22 ----ASH---- C:\hiberfil.sys
2010-09-06 18:48:59 ----A---- C:\WINDOWS\ATICIM.INI
2010-09-06 18:47:48 ----A---- C:\WINDOWS\system32\drivers\AtiHdmi.sys
2010-09-06 18:47:47 ----A---- C:\WINDOWS\system32\ATIODE.exe
2010-09-06 18:47:47 ----A---- C:\WINDOWS\system32\ATIODCLI.exe
2010-09-06 18:47:47 ----A---- C:\WINDOWS\system32\atimpc32.dll
2010-09-06 18:47:47 ----A---- C:\WINDOWS\system32\atibtmon.exe

======List of files/folders modified in the last 1 months======

2010-10-01 19:12:43 ----RD---- C:\Program Files
2010-10-01 19:09:00 ----D---- C:\WINDOWS
2010-10-01 19:08:58 ----D---- C:\WINDOWS\Temp
2010-10-01 19:08:52 ----D---- C:\WINDOWS\Prefetch
2010-10-01 18:27:34 ----D---- C:\Documents and Settings\Davefin\Data aplikací\Skype
2010-10-01 18:26:58 ----D---- C:\Documents and Settings\Davefin\Data aplikací\skypePM
2010-10-01 18:15:21 ----D---- C:\WINDOWS\system32\CatRoot2
2010-09-30 21:07:45 ----N---- C:\WINDOWS\SchedLgU.Txt
2010-09-30 19:01:29 ----SHD---- C:\WINDOWS\Installer
2010-09-30 19:01:24 ----D---- C:\Documents and Settings\All Users\Data aplikací\Microsoft Help
2010-09-30 18:06:03 ----D---- C:\WINDOWS\system32
2010-09-30 17:59:19 ----RSD---- C:\WINDOWS\assembly
2010-09-30 17:56:59 ----D---- C:\Program Files\Common Files\Microsoft Shared
2010-09-30 17:56:44 ----A---- C:\WINDOWS\system32\guard32.dll
2010-09-30 17:50:10 ----HD---- C:\WINDOWS\inf
2010-09-30 17:49:58 ----D---- C:\WINDOWS\system32\CatRoot
2010-09-30 17:47:27 ----D---- C:\Documents and Settings\Davefin\Data aplikací\Spyware Terminator
2010-09-30 17:47:22 ----D---- C:\Program Files\Spyware Terminator
2010-09-30 17:41:18 ----D---- C:\WINDOWS\system32\config
2010-09-30 17:41:04 ----D---- C:\WINDOWS\system32\wbem
2010-09-30 17:41:04 ----D---- C:\WINDOWS\Registration
2010-09-30 17:38:48 ----D---- C:\WINDOWS\system32\Restore
2010-09-30 16:54:20 ----D---- C:\Documents and Settings\All Users\Data aplikací\COMODO
2010-09-27 21:49:15 ----D---- C:\Documents and Settings\All Users\Data aplikací\Spyware Terminator
2010-09-25 13:25:33 ----SD---- C:\Documents and Settings\Davefin\Data aplikací\Microsoft
2010-09-25 13:18:55 ----D---- C:\Program Files\Common Files
2010-09-25 13:18:21 ----RSD---- C:\WINDOWS\Fonts
2010-09-25 13:04:29 ----D---- C:\WINDOWS\system32\drivers
2010-09-25 12:09:05 ----D---- C:\Program Files\Common Files\System
2010-09-25 12:09:01 ----A---- C:\WINDOWS\win.ini
2010-09-21 19:48:06 ----D---- C:\Program Files\Windows Media Player
2010-09-21 19:48:06 ----D---- C:\Program Files\Outlook Express
2010-09-21 19:48:05 ----D---- C:\WINDOWS\system32\usmt
2010-09-21 19:48:05 ----D---- C:\Program Files\Windows NT
2010-09-21 19:48:05 ----D---- C:\Program Files\Internet Explorer
2010-09-21 19:48:04 ----D---- C:\WINDOWS\srchasst
2010-09-21 19:44:58 ----D---- C:\WINDOWS\Cursors
2010-09-21 19:39:33 ----A---- C:\WINDOWS\system32\uxtheme.dll
2010-09-21 08:20:18 ----D---- C:\Program Files\WinClamAVShield
2010-09-20 18:36:43 ----RSHDC---- C:\WINDOWS\system32\dllcache
2010-09-19 16:24:26 ----D---- C:\Program Files\TuneUp Utilities 2010
2010-09-19 16:22:28 ----D---- C:\Program Files\Java
2010-09-19 15:37:25 ----D---- C:\WINDOWS\system32\DirectX
2010-09-19 15:36:09 ----D---- C:\WINDOWS\Microsoft.NET
2010-09-19 15:30:23 ----D---- C:\Program Files\Adobe
2010-09-19 15:30:21 ----D---- C:\Program Files\Common Files\Adobe AIR
2010-09-19 15:28:09 ----D---- C:\Documents and Settings\Davefin\Data aplikací\Adobe
2010-09-18 13:00:18 ----D---- C:\Program Files\Common Files\Apple
2010-09-18 13:00:16 ----D---- C:\Documents and Settings\All Users\Data aplikací\Apple Computer
2010-09-18 12:55:25 ----DC---- C:\WINDOWS\system32\DRVSTORE
2010-09-18 11:50:41 ----D---- C:\WINDOWS\Minidump
2010-09-18 11:50:41 ----D---- C:\WINDOWS\Debug
2010-09-17 18:18:42 ----D---- C:\Program Files\Mozilla Firefox
2010-09-15 19:16:05 ----HD---- C:\WINDOWS\$hf_mig$
2010-09-15 19:08:43 ----A---- C:\WINDOWS\system32\MRT.exe
2010-09-06 18:51:45 ----HD---- C:\Program Files\InstallShield Installation Information
2010-09-06 18:34:06 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 agp440;Filtr Intel sběrnice AGP; C:\WINDOWS\system32\DRIVERS\agp440.sys [2008-04-13 42368]
R0 Inspect;COMODO Internet Security Firewall Driver; C:\WINDOWS\System32\DRIVERS\inspect.sys [2010-09-30 91560]
R0 PxHelp20;PxHelp20; C:\WINDOWS\System32\Drivers\PxHelp20.sys [2009-04-28 44944]
R0 sptd;sptd; C:\WINDOWS\System32\Drivers\sptd.sys [2010-09-25 691696]
R1 cmdGuard;COMODO Internet Security Sandbox Driver; C:\WINDOWS\System32\DRIVERS\cmdguard.sys [2010-09-30 239240]
R1 cmdHlp;COMODO Internet Security Helper Driver; C:\WINDOWS\System32\DRIVERS\cmdhlp.sys [2010-09-30 25240]
R1 intelppm;Řadič procesoru Intel; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2008-04-14 40192]
R1 kbdhid;Ovladač klávesnice standardu HID; C:\WINDOWS\system32\DRIVERS\kbdhid.sys [2008-04-14 14592]
R1 PCLEPCI;PCLEPCI; \??\C:\WINDOWS\system32\drivers\pclepci.sys []
R1 sp_rsdrv2;Spyware Terminator Driver 2; \??\C:\WINDOWS\system32\drivers\sp_rsdrv2.sys []
R3 aeaudio;aeaudio; C:\WINDOWS\system32\drivers\aeaudio.sys [2003-03-13 100224]
R3 ati2mtag;ati2mtag; C:\WINDOWS\system32\DRIVERS\ati2mtag.sys [2009-05-15 4069888]
R3 AtiHdmiService;ATI Function Driver for HDMI Service; C:\WINDOWS\system32\drivers\AtiHdmi.sys [2009-04-01 93184]
R3 E100B;Intel(R) PRO Network Connection Driver; C:\WINDOWS\system32\DRIVERS\e100b325.sys [2007-11-16 165496]
R3 HDAudBus;Ovladač Microsoft UAA pro sběrnici High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2008-04-13 144384]
R3 hidusb;Ovladač třídy standardu HID; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-13 10368]
R3 mouhid;Ovladač myši standardu HID; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-10-24 12160]
R3 smwdm;smwdm; C:\WINDOWS\system32\drivers\smwdm.sys [2003-06-02 578304]
R3 usbccgp;Obecný nadřazený ovladač Microsoft USB; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-13 32128]
R3 usbuhci;Ovladač Microsoft univerzálního hostitelského řadiče USB od společnosti Microsoft; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2008-04-13 20608]
S3 aqh0u5km;aqh0u5km; C:\WINDOWS\system32\drivers\aqh0u5km.sys []
S3 ASAPIW2K;ASAPIW2K; C:\WINDOWS\System32\Drivers\ASAPIW2K.sys [2005-01-10 11264]
S3 GarenaPEngine;GarenaPEngine; \??\C:\DOCUME~1\Davefin\LOCALS~1\Temp\VIT1F.tmp []
S3 GEARAspiWDM;GEAR ASPI Filter Driver; C:\WINDOWS\system32\DRIVERS\GEARAspiWDM.sys [2009-05-18 26600]
S3 GGSAFERDriver;GGSAFER Driver; \??\C:\Program Files\Garena\plugins\UI\safedrv.sys []
S3 hamachi;Hamachi Network Interface; C:\WINDOWS\system32\DRIVERS\hamachi.sys [2010-02-03 26176]
S3 MidiSyn;MidiSyn; C:\WINDOWS\system32\drivers\MidiSyn.sys [2002-09-20 235100]
S3 StarOpen;StarOpen; C:\WINDOWS\system32\drivers\StarOpen.sys [2009-11-12 7168]
S3 TuneUpUtilitiesDrv;TuneUpUtilitiesDrv; \??\C:\Program Files\TuneUp Utilities 2010\TuneUpUtilitiesDriver32.sys []
S3 usbprint;Třída USB Printer; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2008-04-13 25856]
S3 usbscan;Ovladač skeneru USB; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2008-04-13 15104]
S3 USBSTOR;Ovladač velkokapacitního paměťového zařízení USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]
S3 WudfPf;Windows Driver Foundation - User-mode Driver Framework Platform Driver; C:\WINDOWS\system32\DRIVERS\WudfPf.sys [2006-09-28 77568]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-28 82944]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 Apple Mobile Device;Apple Mobile Device; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [2010-08-13 144672]
R2 Ati HotKey Poller;Ati HotKey Poller; C:\WINDOWS\system32\Ati2evxx.exe [2009-05-15 602112]
R2 cmdAgent;COMODO Internet Security Helper Service; C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe [2010-09-30 1901056]
R2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2010-07-17 153376]
R2 Nero BackItUp Scheduler 4.0;Nero BackItUp Scheduler 4.0; C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe [2008-09-24 935208]
R2 NMSAccess;NMSAccess; E:\Program Files\CDBurnerXP\NMSAccessU.exe [2010-03-04 71096]
R2 PLFlash DeviceIoControl Service;PLFlash DeviceIoControl Service; E:\Program Files\Nero BackItUp\Nero BackItUp 4\IoctlSvc.exe [2008-09-24 81920]
R2 PnkBstrA;PnkBstrA; C:\WINDOWS\system32\PnkBstrA.exe [2010-04-21 75064]
R2 SoundMAX Agent Service (default);SoundMAX Agent Service; C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe [2002-09-20 45056]
R2 sp_rssrv;Spyware Terminator Realtime Shield Service; C:\Program Files\Spyware Terminator\sp_rsser.exe [2010-08-19 488960]
S2 ATI Smart;ATI Smart; C:\WINDOWS\system32\ati2sgag.exe [2010-02-10 593920]
S2 Bonjour Service;Bonjour Service; C:\Program Files\Bonjour\mDNSResponder.exe [2010-05-18 345376]
S2 gupdate;Služba Google Update (gupdate); C:\Program Files\Google\Update\GoogleUpdate.exe [2010-06-15 136176]
S2 Hamachi2Svc;LogMeIn Hamachi 2.0 Tunneling Engine; E:\Program Files\LogMeInHamachi\hamachi-2.exe [2010-03-30 1107336]
S2 TuneUp.UtilitiesSvc;TuneUp Utilities Service; C:\Program Files\TuneUp Utilities 2010\TuneUpUtilitiesService32.exe [2010-07-06 1051968]
S3 aspnet_state;Stavová služba ASP.NET; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2008-07-25 34312]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; C:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104]
S3 idsvc;Služba Windows CardSpace; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664]
S3 iPod Service;iPod Service; C:\Program Files\iPod\bin\iPodService.exe [2010-09-01 820008]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2008-11-04 441712]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 WMPNetworkSvc;Služba Windows Media Player Network Sharing; C:\Program Files\Windows Media Player\WMPNetwk.exe [2007-01-05 913920]
S3 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
S4 NetTcpPortSharing;Služba sdílení portů Net.Tcp; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2008-07-29 132096]

-----------------EOF-----------------

Uživatelský avatar
riffman
VIP
VIP
Příspěvky: 3203
Registrován: 20 říj 2004 07:00
Bydliště: České Budějovice
Kontaktovat uživatele:

Re: Garena.exe buffer overflow attack

#2 Příspěvek od riffman »

zdravim

log je OK, nejspis slo o falesny poplach Comoda (cemuz odpovida i to, ze to zacal hlasit bezprostredne po updatu)
Give us a chance to live
Give us a chance to die
Give us a chance to be free
Without fire from the sky
Give us a chance to love
Give us a chance to hate
Give us a chance, before you kill us all

Davefin
Návštěvník
Návštěvník
Příspěvky: 9
Registrován: 01 říj 2010 18:14

Re: Garena.exe buffer overflow attack

#3 Příspěvek od Davefin »

Uf, mě to napadlo, ale protože ten rgc taky padal (a ostatním fungoval), jsem si nebyl jistej.
Každopádně, díky moc!
Takže když teď mi comodo zas zahlásí buffer overflow, mám to ignorovat?
A ještě, comodo a terminator teda vedle sebe můžou praacovat správně?
Díky!

Uživatelský avatar
riffman
VIP
VIP
Příspěvky: 3203
Registrován: 20 říj 2004 07:00
Bydliště: České Budějovice
Kontaktovat uživatele:

Re: Garena.exe buffer overflow attack

#4 Příspěvek od riffman »

kdyz zahlasi buffer overflow, tak se hlavne kouknete, na cem to zavisi

ano, muzou spolu pracovat soubezne
Give us a chance to live
Give us a chance to die
Give us a chance to be free
Without fire from the sky
Give us a chance to love
Give us a chance to hate
Give us a chance, before you kill us all

Davefin
Návštěvník
Návštěvník
Příspěvky: 9
Registrován: 01 říj 2010 18:14

Re: Garena.exe buffer overflow attack

#5 Příspěvek od Davefin »

super. omlouvám se, že mám furt otázky, ale co znamená na čem to závisí? proces byl garena.exe, ale to asi není ono, co?

EDIT: teď mi garenu nahlásil i Terminator jako vir, to je asi blbý co?

Uživatelský avatar
riffman
VIP
VIP
Příspěvky: 3203
Registrován: 20 říj 2004 07:00
Bydliště: České Budějovice
Kontaktovat uživatele:

Re: Garena.exe buffer overflow attack

#6 Příspěvek od riffman »

kdyz zahlasi buffer overflow u gareny, tak je to OK, kdyz u neceho jineho, tak to ok neni

zkuste si jak u Comoda, tak u Spyware Terminatora pridat garenu do vyjimek
Give us a chance to live
Give us a chance to die
Give us a chance to be free
Without fire from the sky
Give us a chance to love
Give us a chance to hate
Give us a chance, before you kill us all

Davefin
Návštěvník
Návštěvník
Příspěvky: 9
Registrován: 01 říj 2010 18:14

Re: Garena.exe buffer overflow attack

#7 Příspěvek od Davefin »

Ok, to udělám. Je mi to trapný, ale dal jsem full scan terminátorem (teda ClamAV), zatím je někde v 80% a našel několikrát v různejch umístěních Heuristics.Broken.Executable a Heuristics.Encrypted.Zip.
V jejich online databázi o tom nic není, ale naše jsem fórum kde někomu s Heuristics.Broken.Executable hackli wow účet a e-mail...

Jsou Heuristics.Broken.Executable a Encrypted.Zip v pohodě? Mám to projet MBAMem?

Díky za trpělivost... :)

EDIT: No teď mi to detekovalo nějakej spyware Agent-119xxx (nepamatuju si čísla a už jsem to zavřel), přímo v Avengeru stáhnutým právě z viry.cz. Ten ClamAV je asi nějakej vadnej...
Každopádně, teď musím jít, budu tu až zítra odpoledne, tak předem díky za nějakou odezvu...

Uživatelský avatar
riffman
VIP
VIP
Příspěvky: 3203
Registrován: 20 říj 2004 07:00
Bydliště: České Budějovice
Kontaktovat uživatele:

Re: Garena.exe buffer overflow attack

#8 Příspěvek od riffman »

hele, na rovinu, ClamAV je spis omyl nez antivirus...a Spyware Terminator ma uz sva nejlepsi leta taky nejspis za sebou...paklize touzite po free, zvolte avast, ma AV i AS integrovany v sobe a pocet falesnych poplachu je vicemene minimalni :)
Give us a chance to live
Give us a chance to die
Give us a chance to be free
Without fire from the sky
Give us a chance to love
Give us a chance to hate
Give us a chance, before you kill us all

Davefin
Návštěvník
Návštěvník
Příspěvky: 9
Registrován: 01 říj 2010 18:14

Re: Garena.exe buffer overflow attack

#9 Příspěvek od Davefin »

ok... jen mi rezident avastu často jen tak z ničeho nic zabíral 98% bandwidth a měl jsem strašně pomalej net... nějakej tip?

Uživatelský avatar
riffman
VIP
VIP
Příspěvky: 3203
Registrován: 20 říj 2004 07:00
Bydliště: České Budějovice
Kontaktovat uživatele:

Re: Garena.exe buffer overflow attack

#10 Příspěvek od riffman »

pravdepodobne diky tomu, ze si prave stahoval updaty

pak muzete odzkouset MS Essentials, pro normalniho usera, co se na netu chova normalne, je to taky vhodna volba, pripadne Aviru Free (nekontroluje postu)

paklize mate volnou nejakou kacku, zkuste placeny produkt - sam pouzivam N360 a neresim :)
Give us a chance to live
Give us a chance to die
Give us a chance to be free
Without fire from the sky
Give us a chance to love
Give us a chance to hate
Give us a chance, before you kill us all

Davefin
Návštěvník
Návštěvník
Příspěvky: 9
Registrován: 01 říj 2010 18:14

Re: Garena.exe buffer overflow attack

#11 Příspěvek od Davefin »

Mezi normálního bfu bych se zas nezařadil, zkusim tu aviru, MS Essentials jsem už zkoušel a chvílema mi to žralo skoro celej CPU... no uvidim, každopádně tady už neni problém, díky a lock :)

Uživatelský avatar
riffman
VIP
VIP
Příspěvky: 3203
Registrován: 20 říj 2004 07:00
Bydliště: České Budějovice
Kontaktovat uživatele:

Re: Garena.exe buffer overflow attack

#12 Příspěvek od riffman »

nemate zac ;)
Give us a chance to live
Give us a chance to die
Give us a chance to be free
Without fire from the sky
Give us a chance to love
Give us a chance to hate
Give us a chance, before you kill us all

Odpovědět