Zdravim. Vzdy po urcitom case mi na PC spadne zvuk a musim restart. Myslim ze na 90% to bude softwarova chyba, resp. chyba v driveroch, ale tak do istoty, ci tu nemam nejaku haved. MBAM cisty. Dakujem.
Logfile of random's system information tool 1.08 (written by random/random)
Run by Blizz at 2011-03-08 17:23:33
Microsoft Windows XP Professional Service Pack 3
System drive C: has 5 GB (32%) free of 15 GB
Total RAM: 3070 MB (82% free)
Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 17:23:40, on 8. 3. 2011
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Gigabyte\EasySaver\ESSVR.EXE
C:\Program Files\Spyware Terminator\sp_rsser.exe
C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\Program Files\COMODO\COMODO Internet Security\cfp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Webteh\BSplayer\bsplayer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\QIP Infium\infium.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\Documents and Settings\Blizz\Desktop\RSIT.exe
C:\Program Files\trend micro\Blizz.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://qip.ru
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://search.qip.ru
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://search.qip.ru/ie
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://search.qip.ru
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://qip.ru
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://search.qip.ru/ie
R3 - URLSearchHook: QIPBHO Class - {95289393-33EA-4F8D-B952-483415B9C955} - C:\Documents and Settings\Blizz\Application Data\Microsoft\Internet Explorer\qipsearchbar.dll
R3 - URLSearchHook: (no name) - - (no file)
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: QIPBHO - {95289393-33EA-4F8D-B952-483415B9C955} - C:\Documents and Settings\Blizz\Application Data\Microsoft\Internet Explorer\qipsearchbar.dll
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKLM\..\Run: [ATICustomerCare] "C:\Program Files\ATI\ATICustomerCare\ATICustomerCare.exe"
O4 - HKLM\..\Run: [COMODO Internet Security] "C:\Program Files\COMODO\COMODO Internet Security\cfp.exe" -h
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 10.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: QIP Infium - {1EF681F7-A04B-4D6D-9012-A307CCA55610} - C:\Program Files\QIP Infium\infium.exe (HKCU)
O17 - HKLM\System\CCS\Services\Tcpip\..\{4B42AF88-2D47-429C-868C-44AA57D9A44A}: NameServer = 156.154.70.25,156.154.71.25
O20 - AppInit_DLLs: C:\WINDOWS\system32\guard32.dll
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Avira AntiVir Scheduler (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: COMODO Internet Security Helper Service (cmdAgent) - COMODO - C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe
O23 - Service: ES lite Service for program management. (ES lite Service) - Unknown owner - C:\Program Files\Gigabyte\EasySaver\ESSVR.EXE
O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - C:\Program Files\Spyware Terminator\sp_rsser.exe
--
End of file - 5679 bytes
======Registry dump======
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2011-01-30 62376]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{95289393-33EA-4F8D-B952-483415B9C955}]
QIPBHO Class - C:\Documents and Settings\Blizz\Application Data\Microsoft\Internet Explorer\qipsearchbar.dll [2011-02-03 141184]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"RTHDCPL"=C:\WINDOWS\RTHDCPL.EXE [2009-01-13 18084864]
"Alcmtr"=C:\WINDOWS\ALCMTR.EXE [2008-06-19 57344]
"avgnt"=C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [2010-12-13 281768]
"ATICustomerCare"=C:\Program Files\ATI\ATICustomerCare\ATICustomerCare.exe [2010-05-04 311296]
"COMODO Internet Security"=C:\Program Files\COMODO\COMODO Internet Security\cfp.exe [2011-01-17 2548552]
"Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 10.0\Reader\Reader_sl.exe [2011-01-30 35736]
"Adobe ARM"=C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2010-11-15 932288]
"StartCCC"=C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [2011-01-26 98304]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"=C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpywareTerminator]
C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe [2011-02-14 2216960]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=" C:\WINDOWS\system32\guard32.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent]
C:\WINDOWS\system32\Ati2evxx.dll [2011-01-26 188416]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\Spyware Terminator\SpywareTerminatorUpdate.exe"="C:\Program Files\Spyware Terminator\SpywareTerminatorUpdate.exe:*:Enabled:Spyware Terminator Update Support"
"C:\Program Files\QIP Infium\infium.exe"="C:\Program Files\QIP Infium\infium.exe:*:Enabled:QIP Infium"
"C:\Program Files\VideoLAN\VLC\vlc.exe"="C:\Program Files\VideoLAN\VLC\vlc.exe:*:Enabled:VLC media player"
"D:\Hry\F1 2010\F1_2010_game.exe"="D:\Hry\F1 2010\F1_2010_game.exe:*:Enabled:F1 2010"
"C:\Program Files\Full Tilt Poker\FullTiltPoker.exe"="C:\Program Files\Full Tilt Poker\FullTiltPoker.exe:*:Enabled:FullTiltPoker"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
======List of files/folders created in the last 1 months======
2011-03-08 17:23:33 ----D---- C:\rsit
2011-03-08 17:23:33 ----D---- C:\Program Files\trend micro
2011-02-23 11:15:11 ----A---- C:\WINDOWS\system32\pdfcmnnt.dll
2011-02-23 11:15:10 ----D---- C:\Program Files\PDFCreator
2011-02-22 17:39:03 ----D---- C:\Documents and Settings\All Users\Application Data\ATI
2011-02-22 17:26:51 ----A---- C:\WINDOWS\system32\MSMPIDE.DLL
2011-02-21 16:19:54 ----D---- C:\Program Files\Common Files\Blizzard Entertainment
2011-02-21 16:19:54 ----D---- C:\Documents and Settings\All Users\Application Data\Blizzard Entertainment
2011-02-16 17:20:44 ----D---- C:\Documents and Settings\Blizz\Application Data\Malwarebytes
2011-02-16 17:20:36 ----A---- C:\WINDOWS\system32\drivers\mbamswissarmy.sys
2011-02-16 17:20:35 ----D---- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2011-02-16 17:20:32 ----D---- C:\Program Files\Malwarebytes' Anti-Malware
2011-02-16 17:20:32 ----A---- C:\WINDOWS\system32\drivers\mbam.sys
2011-02-16 13:30:15 ----HD---- C:\VritualRoot
2011-02-15 14:46:39 ----A---- C:\WINDOWS\winamp.ini
2011-02-15 14:46:36 ----D---- C:\Program Files\Winamp
2011-02-15 07:13:15 ----D---- C:\Program Files\Common Files\Adobe
2011-02-15 07:13:15 ----D---- C:\Program Files\Adobe
2011-02-15 07:13:00 ----D---- C:\Documents and Settings\All Users\Application Data\Adobe
2011-02-15 01:00:29 ----D---- C:\Documents and Settings\Blizz\Application Data\BSplayer Pro
2011-02-15 01:00:29 ----D---- C:\Documents and Settings\Blizz\Application Data\BSplayer
2011-02-15 01:00:28 ----D---- C:\Program Files\Webteh
2011-02-15 00:58:29 ----D---- C:\Program Files\Matroska Pack
2011-02-14 14:44:49 ----D---- C:\Documents and Settings\All Users\Application Data\Codemasters
2011-02-14 14:40:37 ----A---- C:\WINDOWS\system32\rapture3d_oal.dll
2011-02-14 14:40:37 ----A---- C:\WINDOWS\system32\mkl_blueripple.dll
2011-02-14 14:40:36 ----RA---- C:\WINDOWS\system32\tmp414.tmp
2011-02-14 14:40:36 ----RA---- C:\WINDOWS\system32\tmp412.tmp
2011-02-14 14:40:36 ----D---- C:\Program Files\OpenAL
2011-02-14 14:40:36 ----D---- C:\Program Files\BRS
2011-02-14 14:40:36 ----A---- C:\WINDOWS\system32\wrap_oal.dll
2011-02-14 14:40:36 ----A---- C:\WINDOWS\system32\OpenAL32.dll
2011-02-14 14:40:33 ----A---- C:\WINDOWS\system32\XAudio2_7.dll
2011-02-14 14:40:33 ----A---- C:\WINDOWS\system32\XAPOFX1_5.dll
2011-02-14 14:40:32 ----A---- C:\WINDOWS\system32\xactengine3_7.dll
2011-02-14 14:40:32 ----A---- C:\WINDOWS\system32\d3dx11_43.dll
2011-02-14 14:40:32 ----A---- C:\WINDOWS\system32\d3dx10_43.dll
2011-02-14 14:40:32 ----A---- C:\WINDOWS\system32\d3dcsx_43.dll
2011-02-14 14:40:32 ----A---- C:\WINDOWS\system32\D3DCompiler_43.dll
2011-02-14 14:40:31 ----A---- C:\WINDOWS\system32\XAudio2_6.dll
2011-02-14 14:40:31 ----A---- C:\WINDOWS\system32\XAPOFX1_4.dll
2011-02-14 14:40:31 ----A---- C:\WINDOWS\system32\D3DX9_43.dll
2011-02-14 14:40:30 ----A---- C:\WINDOWS\system32\xactengine3_6.dll
2011-02-14 14:40:30 ----A---- C:\WINDOWS\system32\X3DAudio1_7.dll
2011-02-14 14:40:29 ----A---- C:\WINDOWS\system32\XAudio2_5.dll
2011-02-14 14:40:29 ----A---- C:\WINDOWS\system32\xactengine3_5.dll
2011-02-14 14:40:29 ----A---- C:\WINDOWS\system32\D3DCompiler_42.dll
2011-02-14 14:40:28 ----A---- C:\WINDOWS\system32\d3dx11_42.dll
2011-02-14 14:40:28 ----A---- C:\WINDOWS\system32\d3dx10_41.dll
2011-02-14 14:40:28 ----A---- C:\WINDOWS\system32\d3dcsx_42.dll
2011-02-14 14:40:28 ----A---- C:\WINDOWS\system32\D3DCompiler_41.dll
2011-02-14 14:40:27 ----A---- C:\WINDOWS\system32\XAudio2_4.dll
2011-02-14 14:40:27 ----A---- C:\WINDOWS\system32\XAPOFX1_3.dll
2011-02-14 14:40:27 ----A---- C:\WINDOWS\system32\xactengine3_4.dll
2011-02-14 14:40:27 ----A---- C:\WINDOWS\system32\X3DAudio1_6.dll
2011-02-14 14:40:27 ----A---- C:\WINDOWS\system32\D3DX9_41.dll
2011-02-14 14:40:26 ----A---- C:\WINDOWS\system32\XAudio2_3.dll
2011-02-14 14:40:26 ----A---- C:\WINDOWS\system32\XAPOFX1_2.dll
2011-02-14 14:40:26 ----A---- C:\WINDOWS\system32\D3DX9_40.dll
2011-02-14 14:40:26 ----A---- C:\WINDOWS\system32\d3dx10_40.dll
2011-02-14 14:40:26 ----A---- C:\WINDOWS\system32\D3DCompiler_40.dll
2011-02-14 14:40:25 ----A---- C:\WINDOWS\system32\XAudio2_2.dll
2011-02-14 14:40:25 ----A---- C:\WINDOWS\system32\XAPOFX1_1.dll
2011-02-14 14:40:25 ----A---- C:\WINDOWS\system32\xactengine3_3.dll
2011-02-14 14:40:25 ----A---- C:\WINDOWS\system32\xactengine3_2.dll
2011-02-14 14:40:25 ----A---- C:\WINDOWS\system32\X3DAudio1_5.dll
2011-02-14 14:40:24 ----A---- C:\WINDOWS\system32\XAudio2_1.dll
2011-02-14 14:40:24 ----A---- C:\WINDOWS\system32\XAPOFX1_0.dll
2011-02-14 14:40:24 ----A---- C:\WINDOWS\system32\xactengine3_1.dll
2011-02-14 14:40:24 ----A---- C:\WINDOWS\system32\D3DX9_39.dll
2011-02-14 14:40:24 ----A---- C:\WINDOWS\system32\d3dx10_39.dll
2011-02-14 14:40:24 ----A---- C:\WINDOWS\system32\D3DCompiler_39.dll
2011-02-14 14:40:23 ----A---- C:\WINDOWS\system32\X3DAudio1_4.dll
2011-02-14 14:40:23 ----A---- C:\WINDOWS\system32\D3DX9_38.dll
2011-02-14 14:40:23 ----A---- C:\WINDOWS\system32\d3dx10_38.dll
2011-02-14 14:40:23 ----A---- C:\WINDOWS\system32\D3DCompiler_38.dll
2011-02-14 14:40:22 ----A---- C:\WINDOWS\system32\XAudio2_0.dll
2011-02-14 14:40:22 ----A---- C:\WINDOWS\system32\xactengine3_0.dll
2011-02-14 14:40:22 ----A---- C:\WINDOWS\system32\X3DAudio1_3.dll
2011-02-14 14:40:21 ----A---- C:\WINDOWS\system32\xactengine2_10.dll
2011-02-14 14:40:21 ----A---- C:\WINDOWS\system32\D3DX9_37.dll
2011-02-14 14:40:21 ----A---- C:\WINDOWS\system32\d3dx10_37.dll
2011-02-14 14:40:21 ----A---- C:\WINDOWS\system32\D3DCompiler_37.dll
2011-02-14 14:40:20 ----A---- C:\WINDOWS\system32\d3dx9_36.dll
2011-02-14 14:40:20 ----A---- C:\WINDOWS\system32\d3dx10_36.dll
2011-02-14 14:40:20 ----A---- C:\WINDOWS\system32\D3DCompiler_36.dll
2011-02-14 14:40:18 ----A---- C:\WINDOWS\system32\xactengine2_9.dll
2011-02-14 14:40:18 ----A---- C:\WINDOWS\system32\d3dx9_35.dll
2011-02-14 14:40:18 ----A---- C:\WINDOWS\system32\d3dx10_35.dll
2011-02-14 14:40:18 ----A---- C:\WINDOWS\system32\D3DCompiler_35.dll
2011-02-14 14:40:17 ----A---- C:\WINDOWS\system32\xactengine2_8.dll
2011-02-14 14:40:17 ----A---- C:\WINDOWS\system32\X3DAudio1_2.dll
2011-02-14 14:40:17 ----A---- C:\WINDOWS\system32\d3dx10_34.dll
2011-02-14 14:40:17 ----A---- C:\WINDOWS\system32\D3DCompiler_34.dll
2011-02-14 14:40:16 ----A---- C:\WINDOWS\system32\xactengine2_7.dll
2011-02-14 14:40:16 ----A---- C:\WINDOWS\system32\d3dx9_34.dll
2011-02-14 14:40:16 ----A---- C:\WINDOWS\system32\d3dx10_33.dll
2011-02-14 14:40:16 ----A---- C:\WINDOWS\system32\D3DCompiler_33.dll
2011-02-14 14:40:15 ----A---- C:\WINDOWS\system32\xactengine2_6.dll
2011-02-14 14:40:15 ----A---- C:\WINDOWS\system32\xactengine2_5.dll
2011-02-14 14:40:15 ----A---- C:\WINDOWS\system32\xactengine2_4.dll
2011-02-14 14:40:15 ----A---- C:\WINDOWS\system32\x3daudio1_1.dll
2011-02-14 14:40:15 ----A---- C:\WINDOWS\system32\d3dx9_33.dll
2011-02-14 14:40:15 ----A---- C:\WINDOWS\system32\d3dx9_32.dll
2011-02-14 14:40:14 ----A---- C:\WINDOWS\system32\xinput1_2.dll
2011-02-14 14:40:14 ----A---- C:\WINDOWS\system32\xinput1_1.dll
2011-02-14 14:40:14 ----A---- C:\WINDOWS\system32\xactengine2_3.dll
2011-02-14 14:40:14 ----A---- C:\WINDOWS\system32\xactengine2_2.dll
2011-02-14 14:40:14 ----A---- C:\WINDOWS\system32\xactengine2_1.dll
2011-02-14 14:40:14 ----A---- C:\WINDOWS\system32\d3dx9_31.dll
2011-02-14 14:40:09 ----A---- C:\WINDOWS\system32\xactengine2_0.dll
2011-02-14 14:40:09 ----A---- C:\WINDOWS\system32\x3daudio1_0.dll
2011-02-14 14:40:09 ----A---- C:\WINDOWS\system32\d3dx9_30.dll
2011-02-14 14:40:09 ----A---- C:\WINDOWS\system32\d3dx9_29.dll
2011-02-14 14:40:08 ----A---- C:\WINDOWS\system32\xinput9_1_0.dll
2011-02-14 14:40:08 ----A---- C:\WINDOWS\system32\d3dx9_28.dll
2011-02-14 14:40:08 ----A---- C:\WINDOWS\system32\d3dx9_27.dll
2011-02-14 14:40:08 ----A---- C:\WINDOWS\system32\d3dx9_26.dll
2011-02-14 14:40:07 ----A---- C:\WINDOWS\system32\d3dx9_25.dll
2011-02-14 14:40:07 ----A---- C:\WINDOWS\system32\d3dx9_24.dll
2011-02-14 14:38:42 ----D---- C:\WINDOWS\system32\XPSViewer
2011-02-14 14:38:40 ----D---- C:\Program Files\MSBuild
2011-02-14 14:38:36 ----D---- C:\Program Files\Reference Assemblies
2011-02-14 14:38:14 ----N---- C:\WINDOWS\system32\xpssvcs.dll
2011-02-14 14:38:14 ----N---- C:\WINDOWS\system32\xpsshhdr.dll
2011-02-14 14:38:14 ----N---- C:\WINDOWS\system32\prntvpt.dll
2011-02-14 14:35:51 ----A---- C:\WINDOWS\system32\d3dx10_42.dll
2011-02-14 14:35:50 ----A---- C:\WINDOWS\system32\xinput1_3.dll
2011-02-14 14:35:50 ----A---- C:\WINDOWS\system32\D3DX9_42.dll
2011-02-14 14:35:47 ----D---- C:\WINDOWS\Logs
2011-02-14 14:35:46 ----D---- C:\WINDOWS\system32\xlive
2011-02-14 14:35:46 ----D---- C:\Program Files\Microsoft Games for Windows - LIVE
2011-02-14 14:07:59 ----D---- C:\Program Files\Recuva
2011-02-14 13:53:16 ----AD---- C:\Documents and Settings\All Users\Application Data\TEMP
2011-02-14 13:47:35 ----D---- C:\Program Files\SoftLogica
2011-02-14 13:45:34 ----A---- C:\WINDOWS\War3Unin.pif
2011-02-14 13:45:34 ----A---- C:\WINDOWS\War3Unin.exe
2011-02-14 13:25:42 ----D---- C:\Program Files\Full Tilt Poker
2011-02-14 13:12:39 ----D---- C:\Program Files\Defraggler
2011-02-14 13:07:32 ----D---- C:\Program Files\StrongDC++
2011-02-14 12:56:37 ----D---- C:\WINDOWS\system32\NtmsData
2011-02-14 12:04:49 ----A---- C:\WINDOWS\ODBC.INI
2011-02-14 12:04:46 ----A---- C:\WINDOWS\system32\mdimon.dll
2011-02-14 12:04:20 ----D---- C:\Program Files\Microsoft ActiveSync
2011-02-14 12:04:08 ----D---- C:\Program Files\Common Files\DESIGNER
2011-02-14 12:03:58 ----D---- C:\WINDOWS\SHELLNEW
2011-02-14 12:03:49 ----D---- C:\Program Files\Microsoft.NET
2011-02-14 12:03:49 ----D---- C:\Program Files\Microsoft Office
2011-02-14 12:00:35 ----A---- C:\WINDOWS\system32\drivers\a347scsi.sys
2011-02-14 12:00:35 ----A---- C:\WINDOWS\system32\drivers\a347bus.sys
2011-02-14 12:00:34 ----D---- C:\Program Files\Alcohol Soft
2011-02-14 11:56:03 ----D---- C:\Documents and Settings\Blizz\Application Data\Macromedia
2011-02-14 11:56:03 ----D---- C:\Documents and Settings\Blizz\Application Data\Adobe
2011-02-14 11:53:56 ----D---- C:\Documents and Settings\Blizz\Application Data\ATI
2011-02-14 11:52:25 ----A---- C:\WINDOWS\system32\h323log.txt
2011-02-14 11:52:06 ----D---- C:\Program Files\COMODO
2011-02-14 11:51:52 ----D---- C:\Documents and Settings\All Users\Application Data\Comodo
2011-02-14 11:50:52 ----A---- C:\WINDOWS\system32\drivers\audstub.sys
2011-02-14 11:50:08 ----A---- C:\WINDOWS\system32\drivers\redbook.sys
2011-02-14 11:49:49 ----A---- C:\WINDOWS\system32\drivers\enum1394.sys
2011-02-14 11:49:34 ----A---- C:\WINDOWS\system32\usbui.dll
2011-02-14 11:49:11 ----A---- C:\WINDOWS\system32\drivers\wmiacpi.sys
2011-02-14 11:48:29 ----SHD---- C:\WINDOWS\Installer
2011-02-14 11:48:29 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2011-02-14 11:48:28 ----D---- C:\Program Files\Common Files\ODBC
2011-02-14 11:48:28 ----A---- C:\WINDOWS\ODBCINST.INI
2011-02-14 11:48:25 ----RD---- C:\Program Files
2011-02-14 11:48:25 ----D---- C:\Program Files\Common Files\SpeechEngines
2011-02-14 11:48:25 ----D---- C:\Program Files\Common Files\Microsoft Shared
2011-02-14 11:48:25 ----D---- C:\Program Files\Common Files
2011-02-14 11:48:23 ----RA---- C:\WINDOWS\system32\kbdtuq.dll
2011-02-14 11:48:23 ----RA---- C:\WINDOWS\system32\kbdtuf.dll
2011-02-14 11:48:23 ----RA---- C:\WINDOWS\system32\kbdazel.dll
2011-02-14 11:48:22 ----RA---- C:\WINDOWS\system32\kbdmon.dll
2011-02-14 11:48:22 ----RA---- C:\WINDOWS\system32\kbdkyr.dll
2011-02-14 11:48:21 ----RA---- C:\WINDOWS\system32\kbdycc.dll
2011-02-14 11:48:21 ----RA---- C:\WINDOWS\system32\kbduzb.dll
2011-02-14 11:48:21 ----RA---- C:\WINDOWS\system32\kbdur.dll
2011-02-14 11:48:21 ----RA---- C:\WINDOWS\system32\kbdtat.dll
2011-02-14 11:48:21 ----RA---- C:\WINDOWS\system32\kbdru1.dll
2011-02-14 11:48:21 ----RA---- C:\WINDOWS\system32\kbdru.dll
2011-02-14 11:48:21 ----RA---- C:\WINDOWS\system32\kbdkaz.dll
2011-02-14 11:48:21 ----RA---- C:\WINDOWS\system32\kbdbu.dll
2011-02-14 11:48:21 ----RA---- C:\WINDOWS\system32\kbdblr.dll
2011-02-14 11:48:21 ----RA---- C:\WINDOWS\system32\kbdaze.dll
2011-02-14 11:48:20 ----RA---- C:\WINDOWS\system32\kbdhept.dll
2011-02-14 11:48:20 ----RA---- C:\WINDOWS\system32\kbdhela3.dll
2011-02-14 11:48:20 ----RA---- C:\WINDOWS\system32\kbdhela2.dll
2011-02-14 11:48:20 ----RA---- C:\WINDOWS\system32\kbdhe319.dll
2011-02-14 11:48:20 ----RA---- C:\WINDOWS\system32\kbdhe220.dll
2011-02-14 11:48:20 ----RA---- C:\WINDOWS\system32\kbdgkl.dll
2011-02-14 11:48:19 ----RA---- C:\WINDOWS\system32\kbdhe.dll
2011-02-14 11:48:18 ----RA---- C:\WINDOWS\system32\kbdlv1.dll
2011-02-14 11:48:18 ----RA---- C:\WINDOWS\system32\kbdlv.dll
2011-02-14 11:48:18 ----RA---- C:\WINDOWS\system32\kbdlt1.dll
2011-02-14 11:48:18 ----RA---- C:\WINDOWS\system32\kbdlt.dll
2011-02-14 11:48:18 ----RA---- C:\WINDOWS\system32\kbdest.dll
2011-02-14 11:48:17 ----RA---- C:\WINDOWS\system32\kbdycl.dll
2011-02-14 11:48:17 ----RA---- C:\WINDOWS\system32\kbdsl1.dll
2011-02-14 11:48:17 ----RA---- C:\WINDOWS\system32\kbdsl.dll
2011-02-14 11:48:17 ----RA---- C:\WINDOWS\system32\kbdro.dll
2011-02-14 11:48:17 ----RA---- C:\WINDOWS\system32\kbdpl1.dll
2011-02-14 11:48:17 ----RA---- C:\WINDOWS\system32\kbdpl.dll
2011-02-14 11:48:17 ----RA---- C:\WINDOWS\system32\kbdhu1.dll
2011-02-14 11:48:17 ----RA---- C:\WINDOWS\system32\kbdhu.dll
2011-02-14 11:48:17 ----RA---- C:\WINDOWS\system32\kbdcz2.dll
2011-02-14 11:48:17 ----RA---- C:\WINDOWS\system32\kbdcz1.dll
2011-02-14 11:48:17 ----RA---- C:\WINDOWS\system32\kbdcz.dll
2011-02-14 11:48:17 ----RA---- C:\WINDOWS\system32\kbdcr.dll
2011-02-14 11:48:17 ----RA---- C:\WINDOWS\system32\KBDAL.DLL
2011-02-14 11:48:15 ----A---- C:\WINDOWS\system32\spxcoins.dll
2011-02-14 11:48:15 ----A---- C:\WINDOWS\system32\irclass.dll
2011-02-14 11:48:15 ----A---- C:\WINDOWS\system32\EqnClass.Dll
2011-02-14 11:48:15 ----A---- C:\WINDOWS\system32\dgsetup.dll
2011-02-14 11:48:15 ----A---- C:\WINDOWS\system32\dgrpsetu.dll
2011-02-14 11:48:14 ----A---- C:\WINDOWS\TASKMAN.EXE
2011-02-14 11:48:13 ----N---- C:\WINDOWS\system32\CONFIG.TMP
2011-02-14 11:48:13 ----A---- C:\WINDOWS\system32\drivers\irenum.sys
2011-02-14 11:48:13 ----A---- C:\WINDOWS\system32\batt.dll
2011-02-14 11:48:13 ----A---- C:\WINDOWS\notepad.exe
2011-02-14 11:48:10 ----A---- C:\WINDOWS\system32\storprop.dll
2011-02-14 11:48:04 ----ASH---- C:\Documents and Settings\All Users\Application Data\desktop.ini
2011-02-14 11:46:24 ----RA---- C:\WINDOWS\SET8.tmp
2011-02-14 11:46:22 ----RA---- C:\WINDOWS\SET4.tmp
2011-02-14 11:46:20 ----RA---- C:\WINDOWS\SET3.tmp
2011-02-14 11:46:16 ----D---- C:\WINDOWS\system32\CatRoot2
2011-02-14 11:46:16 ----D---- C:\WINDOWS\system32\CatRoot
2011-02-14 11:46:11 ----SD---- C:\Documents and Settings\All Users\Application Data\Microsoft
2011-02-14 11:45:51 ----SHD---- C:\System Volume Information
2011-02-14 11:45:51 ----D---- C:\Documents and Settings
2011-02-14 11:45:12 ----RSH---- C:\boot.ini
2011-02-14 11:45:07 ----D---- C:\Documents and Settings\Blizz\Application Data\vlc
2011-02-14 11:44:06 ----D---- C:\Program Files\VideoLAN
2011-02-14 11:42:37 ----D---- C:\Documents and Settings\Blizz\Application Data\QIP
2011-02-14 11:42:31 ----D---- C:\Documents and Settings\Blizz\Application Data\QipGuard
2011-02-14 11:42:16 ----D---- C:\Program Files\QIP Infium
2011-02-14 11:39:31 ----A---- C:\WINDOWS\system32\drivers\sp_rsdrv2.sys
2011-02-14 11:39:30 ----D---- C:\Documents and Settings\Blizz\Application Data\Spyware Terminator
2011-02-14 11:39:29 ----D---- C:\Program Files\Spyware Terminator
2011-02-14 11:39:29 ----D---- C:\Documents and Settings\All Users\Application Data\Spyware Terminator
2011-02-14 11:39:21 ----RSHDC---- C:\WINDOWS\system32\dllcache
2011-02-14 11:39:21 ----RSD---- C:\WINDOWS\Fonts
2011-02-14 11:39:21 ----RD---- C:\WINDOWS\Web
2011-02-14 11:39:21 ----HD---- C:\WINDOWS\inf
2011-02-14 11:39:21 ----D---- C:\WINDOWS\WinSxS
2011-02-14 11:39:21 ----D---- C:\WINDOWS\twain_32
2011-02-14 11:39:21 ----D---- C:\WINDOWS\Temp
2011-02-14 11:39:21 ----D---- C:\WINDOWS\system32\wins
2011-02-14 11:39:21 ----D---- C:\WINDOWS\system32\wbem
2011-02-14 11:39:21 ----D---- C:\WINDOWS\system32\usmt
2011-02-14 11:39:21 ----D---- C:\WINDOWS\system32\spool
2011-02-14 11:39:21 ----D---- C:\WINDOWS\system32\ShellExt
2011-02-14 11:39:21 ----D---- C:\WINDOWS\system32\Setup
2011-02-14 11:39:21 ----D---- C:\WINDOWS\system32\ras
2011-02-14 11:39:21 ----D---- C:\WINDOWS\system32\oobe
2011-02-14 11:39:21 ----D---- C:\WINDOWS\system32\npp
2011-02-14 11:39:21 ----D---- C:\WINDOWS\system32\mui
2011-02-14 11:39:21 ----D---- C:\WINDOWS\system32\inetsrv
2011-02-14 11:39:21 ----D---- C:\WINDOWS\system32\IME
2011-02-14 11:39:21 ----D---- C:\WINDOWS\system32\icsxml
2011-02-14 11:39:21 ----D---- C:\WINDOWS\system32\ias
2011-02-14 11:39:21 ----D---- C:\WINDOWS\system32\export
2011-02-14 11:39:21 ----D---- C:\WINDOWS\system32\drivers\etc
2011-02-14 11:39:21 ----D---- C:\WINDOWS\system32\drivers\disdn
2011-02-14 11:39:21 ----D---- C:\WINDOWS\system32\drivers
2011-02-14 11:39:21 ----D---- C:\WINDOWS\system32\dhcp
2011-02-14 11:39:21 ----D---- C:\WINDOWS\system32\config
2011-02-14 11:39:21 ----D---- C:\WINDOWS\system32\3com_dmi
2011-02-14 11:39:21 ----D---- C:\WINDOWS\system32\3076
2011-02-14 11:39:21 ----D---- C:\WINDOWS\system32\2052
2011-02-14 11:39:21 ----D---- C:\WINDOWS\system32\1054
2011-02-14 11:39:21 ----D---- C:\WINDOWS\system32\1042
2011-02-14 11:39:21 ----D---- C:\WINDOWS\system32\1041
2011-02-14 11:39:21 ----D---- C:\WINDOWS\system32\1037
2011-02-14 11:39:21 ----D---- C:\WINDOWS\system32\1033
2011-02-14 11:39:21 ----D---- C:\WINDOWS\system32\1031
2011-02-14 11:39:21 ----D---- C:\WINDOWS\system32\1028
2011-02-14 11:39:21 ----D---- C:\WINDOWS\system32\1025
2011-02-14 11:39:21 ----D---- C:\WINDOWS\system32
2011-02-14 11:39:21 ----D---- C:\WINDOWS\system
2011-02-14 11:39:21 ----D---- C:\WINDOWS\security
2011-02-14 11:39:21 ----D---- C:\WINDOWS\Resources
2011-02-14 11:39:21 ----D---- C:\WINDOWS\repair
2011-02-14 11:39:21 ----D---- C:\WINDOWS\Provisioning
2011-02-14 11:39:21 ----D---- C:\WINDOWS\pchealth
2011-02-14 11:39:21 ----D---- C:\WINDOWS\PeerNet
2011-02-14 11:39:21 ----D---- C:\WINDOWS\mui
2011-02-14 11:39:21 ----D---- C:\WINDOWS\msapps
2011-02-14 11:39:21 ----D---- C:\WINDOWS\msagent
2011-02-14 11:39:21 ----D---- C:\WINDOWS\Media
2011-02-14 11:39:21 ----D---- C:\WINDOWS\java
2011-02-14 11:39:21 ----D---- C:\WINDOWS\ime
2011-02-14 11:39:21 ----D---- C:\WINDOWS\Help
2011-02-14 11:39:21 ----D---- C:\WINDOWS\ehome
2011-02-14 11:39:21 ----D---- C:\WINDOWS\Driver Cache
2011-02-14 11:39:21 ----D---- C:\WINDOWS\Debug
2011-02-14 11:39:21 ----D---- C:\WINDOWS\Cursors
2011-02-14 11:39:21 ----D---- C:\WINDOWS\Connection Wizard
2011-02-14 11:39:21 ----D---- C:\WINDOWS\Config
2011-02-14 11:39:21 ----D---- C:\WINDOWS\AppPatch
2011-02-14 11:39:21 ----D---- C:\WINDOWS\addins
2011-02-14 11:39:21 ----D---- C:\WINDOWS
2011-02-14 11:39:21 ----ASH---- C:\pagefile.sys
2011-02-14 11:36:51 ----D---- C:\Program Files\CCleaner
2011-02-14 11:34:52 ----D---- C:\Documents and Settings\Blizz\Application Data\Avira
2011-02-14 11:31:22 ----RSD---- C:\WINDOWS\assembly
2011-02-14 11:31:07 ----D---- C:\WINDOWS\Microsoft.NET
2011-02-14 11:29:00 ----D---- C:\Program Files\ATI Stream
2011-02-14 11:28:38 ----A---- C:\WINDOWS\system32\Oemdspif.dll
2011-02-14 11:28:38 ----A---- C:\WINDOWS\system32\drivers\ati2erec.dll
2011-02-14 11:28:38 ----A---- C:\WINDOWS\system32\ativvamv.dll
2011-02-14 11:28:38 ----A---- C:\WINDOWS\system32\ativcoxx.dll
2011-02-14 11:28:38 ----A---- C:\WINDOWS\system32\atitvo32.dll
2011-02-14 11:28:38 ----A---- C:\WINDOWS\system32\atipdlxx.dll
2011-02-14 11:28:38 ----A---- C:\WINDOWS\system32\atiok3x2.dll
2011-02-14 11:28:38 ----A---- C:\WINDOWS\system32\atioglxx.dll
2011-02-14 11:28:38 ----A---- C:\WINDOWS\system32\ATIODE.exe
2011-02-14 11:28:38 ----A---- C:\WINDOWS\system32\ATIODCLI.exe
2011-02-14 11:28:38 ----A---- C:\WINDOWS\system32\atimpc32.dll
2011-02-14 11:28:38 ----A---- C:\WINDOWS\system32\atikvmag.dll
2011-02-14 11:28:38 ----A---- C:\WINDOWS\system32\atiiiexx.dll
2011-02-14 11:28:38 ----A---- C:\WINDOWS\system32\ATIDEMGX.dll
2011-02-14 11:28:38 ----A---- C:\WINDOWS\system32\ATIDDC.DLL
2011-02-14 11:28:38 ----A---- C:\WINDOWS\system32\aticalrt.dll
2011-02-14 11:28:38 ----A---- C:\WINDOWS\system32\aticaldd.dll
2011-02-14 11:28:38 ----A---- C:\WINDOWS\system32\aticalcl.dll
2011-02-14 11:28:38 ----A---- C:\WINDOWS\system32\atibtmon.exe
2011-02-14 11:28:38 ----A---- C:\WINDOWS\system32\atiapfxx.exe
2011-02-14 11:28:38 ----A---- C:\WINDOWS\system32\atiadlxx.dll
2011-02-14 11:28:38 ----A---- C:\WINDOWS\system32\Ati2mdxx.exe
2011-02-14 11:28:38 ----A---- C:\WINDOWS\system32\ati2evxx.exe
2011-02-14 11:28:38 ----A---- C:\WINDOWS\system32\ati2evxx.dll
2011-02-14 11:28:38 ----A---- C:\WINDOWS\system32\ati2edxx.dll
2011-02-14 11:28:38 ----A---- C:\WINDOWS\system32\amdpcom32.dll
2011-02-14 11:28:15 ----D---- C:\Program Files\ATI Technologies
2011-02-14 11:28:13 ----D---- C:\Program Files\ATI
2011-02-14 11:25:57 ----D---- C:\Documents and Settings\Blizz\Application Data\Mozilla
2011-02-14 11:25:52 ----D---- C:\Program Files\Mozilla Firefox
2011-02-14 11:20:10 ----A---- C:\WINDOWS\system32\drivers\ssmdrv.sys
2011-02-14 11:20:09 ----D---- C:\Program Files\Avira
2011-02-14 11:20:09 ----D---- C:\Documents and Settings\All Users\Application Data\Avira
2011-02-14 11:20:09 ----A---- C:\WINDOWS\system32\drivers\avipbb.sys
2011-02-14 11:20:09 ----A---- C:\WINDOWS\system32\drivers\avgntmgr.sys
2011-02-14 11:20:09 ----A---- C:\WINDOWS\system32\drivers\avgntflt.sys
2011-02-14 11:20:09 ----A---- C:\WINDOWS\system32\drivers\avgntdd.sys
2011-02-14 11:18:59 ----D---- C:\WINDOWS\Prefetch
2011-02-14 11:16:17 ----N---- C:\WINDOWS\system32\msxml6r.dll
2011-02-14 11:16:17 ----N---- C:\WINDOWS\system32\msxml6.dll
2011-02-14 11:16:09 ----N---- C:\WINDOWS\system32\smtpapi.dll
2011-02-14 11:16:09 ----N---- C:\WINDOWS\system32\rwnh.dll
2011-02-14 11:16:09 ----N---- C:\WINDOWS\system32\drivers\irbus.sys
2011-02-14 11:16:09 ----N---- C:\WINDOWS\system32\comsdupd.exe
2011-02-14 11:16:08 ----N---- C:\WINDOWS\system32\hsfcisp2.dll
2011-02-14 11:16:08 ----N---- C:\WINDOWS\system32\eapsvc.dll
2011-02-14 11:16:08 ----N---- C:\WINDOWS\system32\eapqec.dll
2011-02-14 11:16:08 ----N---- C:\WINDOWS\system32\eappprxy.dll
2011-02-14 11:16:08 ----N---- C:\WINDOWS\system32\eapphost.dll
2011-02-14 11:16:08 ----N---- C:\WINDOWS\system32\eappgnui.dll
2011-02-14 11:16:08 ----N---- C:\WINDOWS\system32\eappcfg.dll
2011-02-14 11:16:08 ----N---- C:\WINDOWS\system32\eapp3hst.dll
2011-02-14 11:16:08 ----N---- C:\WINDOWS\system32\eapolqec.dll
2011-02-14 11:16:08 ----N---- C:\WINDOWS\system32\dot3ui.dll
2011-02-14 11:16:08 ----N---- C:\WINDOWS\system32\dot3svc.dll
2011-02-14 11:16:08 ----N---- C:\WINDOWS\system32\dot3msm.dll
2011-02-14 11:16:08 ----N---- C:\WINDOWS\system32\dot3gpclnt.dll
2011-02-14 11:16:08 ----N---- C:\WINDOWS\system32\dot3dlg.dll
2011-02-14 11:16:08 ----N---- C:\WINDOWS\system32\dot3cfg.dll
2011-02-14 11:16:08 ----N---- C:\WINDOWS\system32\dot3api.dll
2011-02-14 11:16:08 ----N---- C:\WINDOWS\system32\dimsroam.dll
2011-02-14 11:16:08 ----N---- C:\WINDOWS\system32\dimsntfy.dll
2011-02-14 11:16:08 ----N---- C:\WINDOWS\system32\dhcpqec.dll
2011-02-14 11:16:08 ----N---- C:\WINDOWS\system32\credssp.dll
2011-02-14 11:16:08 ----N---- C:\WINDOWS\system32\bitsprx4.dll
2011-02-14 11:16:08 ----N---- C:\WINDOWS\system32\azroles.dll
2011-02-14 11:16:08 ----N---- C:\WINDOWS\system32\ativtmxx.dll
2011-02-14 11:16:08 ----N---- C:\WINDOWS\system32\ati3d1ag.dll
2011-02-14 11:16:08 ----N---- C:\WINDOWS\system32\ati2dvaa.dll
2011-02-14 11:16:08 ----N---- C:\WINDOWS\system32\aaclient.dll
2011-02-14 11:16:08 ----A---- C:\WINDOWS\system32\ativvaxx.dll
2011-02-14 11:16:08 ----A---- C:\WINDOWS\system32\ati3duag.dll
2011-02-14 11:16:08 ----A---- C:\WINDOWS\system32\ati2dvag.dll
2011-02-14 11:16:08 ----A---- C:\WINDOWS\system32\ati2cqag.dll
2011-02-14 11:16:07 ----N---- C:\WINDOWS\system32\nv4_disp.dll
2011-02-14 11:16:07 ----N---- C:\WINDOWS\system32\napstat.exe
2011-02-14 11:16:07 ----N---- C:\WINDOWS\system32\napmontr.dll
2011-02-14 11:16:07 ----N---- C:\WINDOWS\system32\napipsec.dll
2011-02-14 11:16:07 ----N---- C:\WINDOWS\system32\mtxparhd.dll
2011-02-14 11:16:07 ----N---- C:\WINDOWS\system32\msshavmsg.dll
2011-02-14 11:16:07 ----N---- C:\WINDOWS\system32\mssha.dll
2011-02-14 11:16:07 ----N---- C:\WINDOWS\system32\mmcperf.exe
2011-02-14 11:16:07 ----N---- C:\WINDOWS\system32\mmcfxcommon.dll
2011-02-14 11:16:07 ----N---- C:\WINDOWS\system32\mmcex.dll
2011-02-14 11:16:07 ----N---- C:\WINDOWS\system32\microsoft.managementconsole.dll
2011-02-14 11:16:07 ----N---- C:\WINDOWS\system32\mdmxsdk.dll
2011-02-14 11:16:07 ----N---- C:\WINDOWS\system32\l2gpstore.dll
2011-02-14 11:16:07 ----N---- C:\WINDOWS\system32\kmsvc.dll
2011-02-14 11:16:07 ----N---- C:\WINDOWS\system32\kbdpash.dll
2011-02-14 11:16:07 ----N---- C:\WINDOWS\system32\kbdnepr.dll
2011-02-14 11:16:07 ----N---- C:\WINDOWS\system32\kbdiultn.dll
2011-02-14 11:16:07 ----N---- C:\WINDOWS\system32\kbdbhc.dll
2011-02-14 11:16:06 ----N---- C:\WINDOWS\system32\wmphoto.dll
2011-02-14 11:16:06 ----N---- C:\WINDOWS\system32\wlanapi.dll
2011-02-14 11:16:06 ----N---- C:\WINDOWS\system32\windowscodecsext.dll
2011-02-14 11:16:06 ----N---- C:\WINDOWS\system32\windowscodecs.dll
2011-02-14 11:16:06 ----N---- C:\WINDOWS\system32\verclsid.exe
2011-02-14 11:16:06 ----N---- C:\WINDOWS\system32\tzchange.exe
2011-02-14 11:16:06 ----N---- C:\WINDOWS\system32\tspkg.dll
2011-02-14 11:16:06 ----N---- C:\WINDOWS\system32\tsgqec.dll
2011-02-14 11:16:06 ----N---- C:\WINDOWS\system32\slserv.exe
2011-02-14 11:16:06 ----N---- C:\WINDOWS\system32\slrundll.exe
2011-02-14 11:16:06 ----N---- C:\WINDOWS\system32\slgen.dll
2011-02-14 11:16:06 ----N---- C:\WINDOWS\system32\slextspk.dll
2011-02-14 11:16:06 ----N---- C:\WINDOWS\system32\slcoinst.dll
2011-02-14 11:16:06 ----N---- C:\WINDOWS\system32\setupn.exe
2011-02-14 11:16:06 ----N---- C:\WINDOWS\system32\s3gnb.dll
2011-02-14 11:16:06 ----N---- C:\WINDOWS\system32\rhttpaa.dll
2011-02-14 11:16:06 ----N---- C:\WINDOWS\system32\rasqec.dll
2011-02-14 11:16:06 ----N---- C:\WINDOWS\system32\qutil.dll
2011-02-14 11:16:06 ----N---- C:\WINDOWS\system32\qcliprov.dll
2011-02-14 11:16:06 ----N---- C:\WINDOWS\system32\qagentrt.dll
2011-02-14 11:16:06 ----N---- C:\WINDOWS\system32\qagent.dll
2011-02-14 11:16:06 ----N---- C:\WINDOWS\system32\photometadatahandler.dll
2011-02-14 11:16:06 ----N---- C:\WINDOWS\system32\onex.dll
2011-02-14 11:16:05 ----N---- C:\WINDOWS\system32\xpsp3res.dll
2011-02-14 11:16:05 ----N---- C:\WINDOWS\system32\xmllite.dll
2011-02-14 11:16:05 ----N---- C:\WINDOWS\slrundll.exe
2011-02-14 11:16:05 ----D---- C:\WINDOWS\system32\scripting
2011-02-14 11:16:05 ----D---- C:\WINDOWS\system32\en-us
2011-02-14 11:16:05 ----D---- C:\WINDOWS\l2schemas
2011-02-14 11:16:04 ----D---- C:\WINDOWS\system32\en
2011-02-14 11:16:04 ----D---- C:\WINDOWS\system32\bits
2011-02-14 11:15:18 ----D---- C:\WINDOWS\ServicePackFiles
2011-02-14 11:14:10 ----N---- C:\WINDOWS\system32\drivers\amdagp.sys
2011-02-14 11:14:10 ----N---- C:\WINDOWS\system32\drivers\alim1541.sys
2011-02-14 11:14:10 ----N---- C:\WINDOWS\system32\drivers\agpcpq.sys
2011-02-14 11:14:10 ----N---- C:\WINDOWS\system32\drivers\agp440.sys
2011-02-14 11:14:10 ----N---- C:\WINDOWS\system32\drivers\adv11nt5.dll
2011-02-14 11:14:10 ----N---- C:\WINDOWS\system32\drivers\adv09nt5.dll
2011-02-14 11:14:10 ----N---- C:\WINDOWS\system32\drivers\adv08nt5.dll
2011-02-14 11:14:10 ----N---- C:\WINDOWS\system32\drivers\adv07nt5.dll
2011-02-14 11:14:10 ----N---- C:\WINDOWS\system32\drivers\adv05nt5.dll
2011-02-14 11:14:10 ----N---- C:\WINDOWS\system32\drivers\adv02nt5.dll
2011-02-14 11:14:10 ----N---- C:\WINDOWS\system32\drivers\adv01nt5.dll
2011-02-14 11:14:10 ----D---- C:\WINDOWS\network diagnostic
2011-02-14 11:14:09 ----N---- C:\WINDOWS\system32\drivers\mtxparhm.sys
2011-02-14 11:14:09 ----N---- C:\WINDOWS\system32\drivers\mtlstrm.sys
2011-02-14 11:14:09 ----N---- C:\WINDOWS\system32\drivers\mtlmnt5.sys
2011-02-14 11:14:09 ----N---- C:\WINDOWS\system32\drivers\mdmxsdk.sys
2011-02-14 11:14:09 ----N---- C:\WINDOWS\system32\drivers\ch7xxnt5.dll
2011-02-14 11:14:09 ----N---- C:\WINDOWS\system32\drivers\hsfdpsp2.sys
2011-02-14 11:14:09 ----N---- C:\WINDOWS\system32\drivers\hsfcxts2.sys
2011-02-14 11:14:09 ----N---- C:\WINDOWS\system32\drivers\hsfbs2s2.sys
2011-02-14 11:14:09 ----N---- C:\WINDOWS\system32\drivers\hidir.sys
2011-02-14 11:14:09 ----N---- C:\WINDOWS\system32\drivers\hidbth.sys
2011-02-14 11:14:09 ----N---- C:\WINDOWS\system32\drivers\gagp30kx.sys
2011-02-14 11:14:09 ----N---- C:\WINDOWS\system32\drivers\bthusb.sys
2011-02-14 11:14:09 ----N---- C:\WINDOWS\system32\drivers\bthprint.sys
2011-02-14 11:14:09 ----N---- C:\WINDOWS\system32\drivers\bthport.sys
2011-02-14 11:14:09 ----N---- C:\WINDOWS\system32\drivers\bthpan.sys
2011-02-14 11:14:09 ----N---- C:\WINDOWS\system32\drivers\bthmodem.sys
2011-02-14 11:14:09 ----N---- C:\WINDOWS\system32\drivers\bthenum.sys
2011-02-14 11:14:09 ----N---- C:\WINDOWS\system32\drivers\atv10nt5.dll
2011-02-14 11:14:09 ----N---- C:\WINDOWS\system32\drivers\atv06nt5.dll
2011-02-14 11:14:09 ----N---- C:\WINDOWS\system32\drivers\atv04nt5.dll
2011-02-14 11:14:09 ----N---- C:\WINDOWS\system32\drivers\atv02nt5.dll
2011-02-14 11:14:09 ----N---- C:\WINDOWS\system32\drivers\atv01nt5.dll
2011-02-14 11:14:09 ----N---- C:\WINDOWS\system32\drivers\atinxsxx.sys
2011-02-14 11:14:09 ----N---- C:\WINDOWS\system32\drivers\atinxbxx.sys
2011-02-14 11:14:09 ----N---- C:\WINDOWS\system32\drivers\atintuxx.sys
2011-02-14 11:14:09 ----N---- C:\WINDOWS\system32\drivers\atinttxx.sys
2011-02-14 11:14:09 ----N---- C:\WINDOWS\system32\drivers\atinsnxx.sys
2011-02-14 11:14:09 ----N---- C:\WINDOWS\system32\drivers\atinrvxx.sys
2011-02-14 11:14:09 ----N---- C:\WINDOWS\system32\drivers\atinraxx.sys
2011-02-14 11:14:09 ----N---- C:\WINDOWS\system32\drivers\atinpdxx.sys
2011-02-14 11:14:09 ----N---- C:\WINDOWS\system32\drivers\atinmdxx.sys
2011-02-14 11:14:09 ----N---- C:\WINDOWS\system32\drivers\atinbtxx.sys
2011-02-14 11:14:09 ----N---- C:\WINDOWS\system32\drivers\ati2mtaa.sys
2011-02-14 11:14:09 ----N---- C:\WINDOWS\system32\drivers\ati1xsxx.sys
2011-02-14 11:14:09 ----N---- C:\WINDOWS\system32\drivers\ati1xbxx.sys
2011-02-14 11:14:09 ----N---- C:\WINDOWS\system32\drivers\ati1tuxx.sys
2011-02-14 11:14:09 ----N---- C:\WINDOWS\system32\drivers\ati1ttxx.sys
2011-02-14 11:14:09 ----N---- C:\WINDOWS\system32\drivers\ati1snxx.sys
2011-02-14 11:14:09 ----N---- C:\WINDOWS\system32\drivers\ati1rvxx.sys
2011-02-14 11:14:09 ----N---- C:\WINDOWS\system32\drivers\ati1raxx.sys
2011-02-14 11:14:09 ----N---- C:\WINDOWS\system32\drivers\ati1pdxx.sys
2011-02-14 11:14:09 ----N---- C:\WINDOWS\system32\drivers\ati1mdxx.sys
2011-02-14 11:14:09 ----N---- C:\WINDOWS\system32\drivers\ati1btxx.sys
2011-02-14 11:14:09 ----A---- C:\WINDOWS\system32\drivers\ati2mtag.sys
2011-02-14 11:14:08 ----N---- C:\WINDOWS\system32\drivers\watv10nt.sys
2011-02-14 11:14:08 ----N---- C:\WINDOWS\system32\drivers\watv06nt.sys
2011-02-14 11:14:08 ----N---- C:\WINDOWS\system32\drivers\wadv11nt.sys
2011-02-14 11:14:08 ----N---- C:\WINDOWS\system32\drivers\wadv09nt.sys
2011-02-14 11:14:08 ----N---- C:\WINDOWS\system32\drivers\wadv08nt.sys
2011-02-14 11:14:08 ----N---- C:\WINDOWS\system32\drivers\wadv07nt.sys
2011-02-14 11:14:08 ----N---- C:\WINDOWS\system32\drivers\wacompen.sys
2011-02-14 11:14:08 ----N---- C:\WINDOWS\system32\drivers\viaagp.sys
2011-02-14 11:14:08 ----N---- C:\WINDOWS\system32\drivers\vchnt5.dll
2011-02-14 11:14:08 ----N---- C:\WINDOWS\system32\drivers\usbvideo.sys
2011-02-14 11:14:08 ----N---- C:\WINDOWS\system32\drivers\usb8023x.sys
2011-02-14 11:14:08 ----N---- C:\WINDOWS\system32\drivers\uagp35.sys
2011-02-14 11:14:08 ----N---- C:\WINDOWS\system32\drivers\smbali.sys
2011-02-14 11:14:08 ----N---- C:\WINDOWS\system32\drivers\slwdmsup.sys
2011-02-14 11:14:08 ----N---- C:\WINDOWS\system32\drivers\slnthal.sys
2011-02-14 11:14:08 ----N---- C:\WINDOWS\system32\drivers\slntamr.sys
2011-02-14 11:14:08 ----N---- C:\WINDOWS\system32\drivers\slnt7554.sys
2011-02-14 11:14:08 ----N---- C:\WINDOWS\system32\drivers\sisagp.sys
2011-02-14 11:14:08 ----N---- C:\WINDOWS\system32\drivers\siint5.dll
2011-02-14 11:14:08 ----N---- C:\WINDOWS\system32\drivers\sffp_mmc.sys
2011-02-14 11:14:08 ----N---- C:\WINDOWS\system32\drivers\s3gnbm.sys
2011-02-14 11:14:08 ----N---- C:\WINDOWS\system32\drivers\rndismpx.sys
2011-02-14 11:14:08 ----N---- C:\WINDOWS\system32\drivers\rfcomm.sys
2011-02-14 11:14:08 ----N---- C:\WINDOWS\system32\drivers\recagent.sys
2011-02-14 11:14:08 ----N---- C:\WINDOWS\system32\drivers\nv4_mini.sys
2011-02-14 11:14:08 ----N---- C:\WINDOWS\system32\drivers\ntmtlfax.sys
2011-02-14 11:14:08 ----N---- C:\WINDOWS\system32\drivers\mutohpen.sys
2011-02-14 11:13:14 ----N---- C:\WINDOWS\system32\spmsg.dll
2011-02-14 11:13:13 ----A---- C:\WINDOWS\002875_.tmp
2011-02-14 11:11:52 ----HDC---- C:\WINDOWS\$NtServicePackUninstall$
2011-02-14 11:08:38 ----A---- C:\WINDOWS\system32\drivers\usbstor.sys
2011-02-14 11:07:59 ----D---- C:\Program Files\totalcmd
2011-02-14 11:07:59 ----A---- C:\WINDOWS\wincmd.ini
2011-02-14 11:07:59 ----A---- C:\WINDOWS\UC.PIF
2011-02-14 11:07:59 ----A---- C:\WINDOWS\RAR.PIF
2011-02-14 11:07:59 ----A---- C:\WINDOWS\PKZIP.PIF
2011-02-14 11:07:59 ----A---- C:\WINDOWS\PKUNZIP.PIF
2011-02-14 11:07:59 ----A---- C:\WINDOWS\NOCLOSE.PIF
2011-02-14 11:07:59 ----A---- C:\WINDOWS\LHA.PIF
2011-02-14 11:07:59 ----A---- C:\WINDOWS\ARJ.PIF
2011-02-14 11:05:22 ----RA---- C:\WINDOWS\system32\RtNicProp32.dll
2011-02-14 11:05:22 ----RA---- C:\WINDOWS\system32\drivers\Rtenicxp.sys
2011-02-14 11:05:08 ----D---- C:\WINDOWS\OPTIONS
2011-02-14 11:05:00 ----D---- C:\WINDOWS\system32\Lang
2011-02-14 11:05:00 ----A---- C:\WINDOWS\system32\drivers\drmkaud.sys
2011-02-14 11:04:59 ----A---- C:\WINDOWS\system32\drivers\wdmaud.sys
2011-02-14 11:04:58 ----A---- C:\WINDOWS\system32\drivers\kmixer.sys
2011-02-14 11:04:57 ----A---- C:\WINDOWS\system32\drivers\dmusic.sys
2011-02-14 11:04:54 ----A---- C:\WINDOWS\system32\drivers\swmidi.sys
2011-02-14 11:04:52 ----A---- C:\WINDOWS\system32\drivers\aec.sys
2011-02-14 11:04:50 ----A---- C:\WINDOWS\system32\drivers\splitter.sys
2011-02-14 11:04:00 ----A---- C:\WINDOWS\system32\drivers\sysaudio.sys
2011-02-14 11:03:59 ----A---- C:\WINDOWS\system32\drivers\mspqm.sys
2011-02-14 11:03:59 ----A---- C:\WINDOWS\system32\drivers\mskssrv.sys
2011-02-14 11:03:58 ----A---- C:\WINDOWS\system32\drivers\mspclock.sys
2011-02-14 11:03:31 ----D---- C:\WINDOWS\system32\RTCOM
2011-02-14 11:03:30 ----A---- C:\WINDOWS\system32\ksuser.dll
2011-02-14 11:03:30 ----A---- C:\WINDOWS\system32\drivers\drmk.sys
2011-02-14 11:03:06 ----A---- C:\WINDOWS\system32\spupdsvc.exe
2011-02-14 11:03:05 ----HDC---- C:\WINDOWS\$NtUninstallKB888111WXPSP2$
2011-02-14 11:03:03 ----A---- C:\WINDOWS\RtkUpd.exe
2011-02-14 11:03:02 ----A---- C:\WINDOWS\system32\drivers\RtKHDMI.sys
2011-02-14 11:03:01 ----RA---- C:\WINDOWS\vncutil.exe
2011-02-14 11:03:01 ----RA---- C:\WINDOWS\SOUNDMAN.EXE
2011-02-14 11:03:00 ----RA---- C:\WINDOWS\SkyTel.exe
2011-02-14 11:02:59 ----RA---- C:\WINDOWS\system32\RtkCoInstXP.dll
2011-02-14 11:02:59 ----RA---- C:\WINDOWS\RtlUpd.exe
2011-02-14 11:02:59 ----RA---- C:\WINDOWS\RtkAudioService.exe
2011-02-14 11:02:56 ----RA---- C:\WINDOWS\RTLCPL.EXE
2011-02-14 11:02:55 ----RA---- C:\WINDOWS\system32\drivers\RtkHDAud.sys
2011-02-14 11:02:49 ----RA---- C:\WINDOWS\RTHDCPL.EXE
2011-02-14 11:02:48 ----RA---- C:\WINDOWS\system32\drivers\Monfilt.sys
2011-02-14 11:02:47 ----RA---- C:\WINDOWS\MicCal.exe
2011-02-14 11:02:43 ----RA---- C:\WINDOWS\ALCMTR.EXE
2011-02-14 11:02:42 ----RA---- C:\WINDOWS\ALCWZRD.EXE
2011-02-14 11:02:41 ----RA---- C:\WINDOWS\system32\drivers\Ambfilt.sys
2011-02-14 11:02:41 ----D---- C:\Program Files\Realtek
2011-02-14 11:02:38 ----R---- C:\WINDOWS\RtlExUpd.dll
2011-02-14 11:02:30 ----D---- C:\WINDOWS\system32\ReinstallBackups
2011-02-14 11:02:29 ----A---- C:\WINDOWS\system32\drivers\AmdPPM.sys
2011-02-14 11:02:28 ----DC---- C:\WINDOWS\system32\DRVSTORE
2011-02-14 11:02:27 ----D---- C:\Program Files\AMD
2011-02-14 11:02:24 ----D---- C:\Documents and Settings\Blizz\Application Data\InstallShield
2011-02-14 11:02:10 ----HD---- C:\Program Files\InstallShield Installation Information
2011-02-14 11:02:10 ----D---- C:\Program Files\Gigabyte
2011-02-14 11:02:08 ----D---- C:\Program Files\Common Files\InstallShield
2011-02-14 11:01:31 ----A---- C:\WINDOWS\gdrv.sys
2011-02-14 11:01:28 ----SHD---- C:\RECYCLER
2011-02-14 11:00:35 ----D---- C:\Documents and Settings\Blizz\Application Data\Identities
2011-02-14 11:00:34 ----HD---- C:\Program Files\Uninstall Information
2011-02-14 11:00:20 ----ASH---- C:\Documents and Settings\Blizz\Application Data\desktop.ini
2011-02-14 11:00:19 ----SD---- C:\Documents and Settings\Blizz\Application Data\Microsoft
2011-02-14 10:59:57 ----D---- C:\WINDOWS\SoftwareDistribution
2011-02-14 10:59:55 ----SD---- C:\WINDOWS\system32\Microsoft
2011-02-14 10:59:55 ----A---- C:\WINDOWS\SchedLgU.Txt
2011-02-14 10:57:41 ----D---- C:\WINDOWS\system32\xircom
2011-02-14 10:57:41 ----D---- C:\Program Files\xerox
2011-02-14 10:57:41 ----D---- C:\Program Files\microsoft frontpage
2011-02-14 10:57:21 ----RASH---- C:\MSDOS.SYS
2011-02-14 10:57:21 ----RASH---- C:\IO.SYS
2011-02-14 10:57:21 ----A---- C:\WINDOWS\control.ini
2011-02-14 10:57:21 ----A---- C:\CONFIG.SYS
2011-02-14 10:57:21 ----A---- C:\AUTOEXEC.BAT
2011-02-14 10:57:11 ----A---- C:\WINDOWS\system32\mapi32.dll
2011-02-14 10:56:35 ----SD---- C:\WINDOWS\Downloaded Program Files
2011-02-14 10:56:35 ----RD---- C:\WINDOWS\Offline Web Pages
2011-02-14 10:56:35 ----RAH---- C:\WINDOWS\system32\logonui.exe.manifest
2011-02-14 10:56:32 ----RAH---- C:\WINDOWS\system32\cdplayer.exe.manifest
2011-02-14 10:56:28 ----HD---- C:\Program Files\WindowsUpdate
2011-02-14 10:56:12 ----D---- C:\WINDOWS\system32\DirectX
2011-02-14 10:55:55 ----A---- C:\WINDOWS\system32\atrace.dll
2011-02-14 10:55:52 ----A---- C:\WINDOWS\system32\desktop.ini
2011-02-14 10:55:52 ----A---- C:\WINDOWS\desktop.ini
2011-02-14 10:55:47 ----A---- C:\WINDOWS\system32\nmevtmsg.dll
2011-02-14 10:55:46 ----A---- C:\WINDOWS\system32\acctres.dll
2011-02-14 10:55:45 ----D---- C:\Program Files\Common Files\Services
2011-02-14 10:55:43 ----SD---- C:\WINDOWS\Tasks
2011-02-14 10:55:43 ----D---- C:\Program Files\Common Files\MSSoap
2011-02-14 10:55:43 ----A---- C:\WINDOWS\system32\icfgnt5.dll
2011-02-14 10:55:39 ----D---- C:\WINDOWS\srchasst
2011-02-14 10:55:38 ----D---- C:\WINDOWS\system32\Macromed
2011-02-14 10:55:36 ----A---- C:\WINDOWS\system32\wuweb.dll
2011-02-14 10:55:36 ----A---- C:\WINDOWS\system32\wucltui.dll
2011-02-14 10:55:36 ----A---- C:\WINDOWS\system32\wuauserv.dll
2011-02-14 10:55:36 ----A---- C:\WINDOWS\system32\wuaueng1.dll
2011-02-14 10:55:35 ----A---- C:\WINDOWS\system32\wups.dll
2011-02-14 10:55:35 ----A---- C:\WINDOWS\system32\wuaueng.dll
2011-02-14 10:55:35 ----A---- C:\WINDOWS\system32\wuauclt1.exe
2011-02-14 10:55:35 ----A---- C:\WINDOWS\system32\wuauclt.exe
2011-02-14 10:55:35 ----A---- C:\WINDOWS\system32\wuapi.dll
2011-02-14 10:55:35 ----A---- C:\WINDOWS\system32\qmgrprxy.dll
2011-02-14 10:55:35 ----A---- C:\WINDOWS\system32\qmgr.dll
2011-02-14 10:55:35 ----A---- C:\WINDOWS\system32\bitsprx3.dll
2011-02-14 10:55:35 ----A---- C:\WINDOWS\system32\bitsprx2.dll
2011-02-14 10:55:31 ----D---- C:\Program Files\Movie Maker
2011-02-14 10:55:28 ----A---- C:\WINDOWS\system32\safrslv.dll
2011-02-14 10:55:28 ----A---- C:\WINDOWS\system32\safrdm.dll
2011-02-14 10:55:28 ----A---- C:\WINDOWS\system32\safrcdlg.dll
2011-02-14 10:55:28 ----A---- C:\WINDOWS\system32\racpldlg.dll
2011-02-14 10:55:24 ----D---- C:\WINDOWS\system32\Restore
2011-02-14 10:55:24 ----A---- C:\WINDOWS\system32\srrstr.dll
2011-02-14 10:55:24 ----A---- C:\WINDOWS\system32\fltmc.exe
2011-02-14 10:55:24 ----A---- C:\WINDOWS\system32\fltlib.dll
2011-02-14 10:55:24 ----A---- C:\WINDOWS\system32\drivers\fltmgr.sys
2011-02-14 10:55:23 ----A---- C:\WINDOWS\system32\srsvc.dll
2011-02-14 10:55:23 ----A---- C:\WINDOWS\system32\srclient.dll
2011-02-14 10:55:23 ----A---- C:\WINDOWS\system32\nmmkcert.dll
2011-02-14 10:55:23 ----A---- C:\WINDOWS\system32\mnmsrvc.exe
2011-02-14 10:55:23 ----A---- C:\WINDOWS\system32\mnmdd.dll
2011-02-14 10:55:23 ----A---- C:\WINDOWS\system32\isrdbg32.dll
2011-02-14 10:55:23 ----A---- C:\WINDOWS\system32\ils.dll
2011-02-14 10:55:23 ----A---- C:\WINDOWS\system32\drivers\sr.sys
2011-02-14 10:55:22 ----A---- C:\WINDOWS\system32\msconf.dll
2011-02-14 10:55:19 ----D---- C:\Program Files\NetMeeting
2011-02-14 10:55:19 ----A---- C:\WINDOWS\system32\msoert2.dll
2011-02-14 10:55:19 ----A---- C:\WINDOWS\system32\msoeacct.dll
2011-02-14 10:55:18 ----A---- C:\WINDOWS\system32\inetres.dll
2011-02-14 10:55:18 ----A---- C:\WINDOWS\system32\inetcomm.dll
2011-02-14 10:55:16 ----D---- C:\Program Files\Outlook Express
2011-02-14 10:55:16 ----A---- C:\WINDOWS\system32\schedsvc.dll
2011-02-14 10:55:16 ----A---- C:\WINDOWS\system32\mstinit.exe
2011-02-14 10:55:16 ----A---- C:\WINDOWS\system32\mstask.dll
2011-02-14 10:55:16 ----A---- C:\WINDOWS\system32\isign32.dll
2011-02-14 10:55:16 ----A---- C:\WINDOWS\system32\inetcfg.dll
2011-02-14 10:55:16 ----A---- C:\WINDOWS\system32\icwphbk.dll
2011-02-14 10:55:16 ----A---- C:\WINDOWS\system32\icwdial.dll
2011-02-14 10:55:11 ----D---- C:\Program Files\Common Files\System
2011-02-14 10:55:09 ----D---- C:\Program Files\Internet Explorer
2011-02-14 10:54:46 ----D---- C:\Program Files\ComPlus Applications
2011-02-14 10:54:43 ----A---- C:\WINDOWS\vbaddin.ini
2011-02-14 10:54:43 ----A---- C:\WINDOWS\vb.ini
2011-02-14 10:54:40 ----D---- C:\WINDOWS\Registration
2011-02-14 10:54:33 ----D---- C:\Program Files\Windows Media Player
2011-02-14 10:54:33 ----D---- C:\Program Files\Online Services
2011-02-14 10:54:27 ----D---- C:\Program Files\Messenger
2011-02-14 10:54:24 ----D---- C:\Program Files\MSN Gaming Zone
2011-02-14 10:54:24 ----A---- C:\WINDOWS\system32\write.exe
2011-02-14 10:54:18 ----A---- C:\WINDOWS\system32\sndvol32.exe
2011-02-14 10:54:18 ----A---- C:\WINDOWS\system32\hticons.dll
2011-02-14 10:54:18 ----A---- C:\WINDOWS\system32\avwav.dll
2011-02-14 10:54:18 ----A---- C:\WINDOWS\system32\avtapi.dll
2011-02-14 10:54:18 ----A---- C:\WINDOWS\system32\avmeter.dll
2011-02-14 10:54:17 ----A---- C:\WINDOWS\system32\winchat.exe
2011-02-14 10:54:12 ----A---- C:\WINDOWS\system32\getuname.dll
2011-02-14 10:54:11 ----A---- C:\WINDOWS\system32\winmine.exe
2011-02-14 10:54:11 ----A---- C:\WINDOWS\system32\sol.exe
2011-02-14 10:54:11 ----A---- C:\WINDOWS\system32\mshearts.exe
2011-02-14 10:54:11 ----A---- C:\WINDOWS\system32\charmap.exe
2011-02-14 10:54:11 ----A---- C:\WINDOWS\system32\freecell.exe
2011-02-14 10:54:11 ----A---- C:\WINDOWS\system32\calc.exe
2011-02-14 10:54:10 ----A---- C:\WINDOWS\system32\usrlogon.cmd
2011-02-14 10:54:10 ----A---- C:\WINDOWS\system32\tsshutdn.exe
2011-02-14 10:54:10 ----A---- C:\WINDOWS\system32\tslabels.ini
2011-02-14 10:54:10 ----A---- C:\WINDOWS\system32\tskill.exe
2011-02-14 10:54:10 ----A---- C:\WINDOWS\system32\tsdiscon.exe
2011-02-14 10:54:10 ----A---- C:\WINDOWS\system32\tscon.exe
2011-02-14 10:54:10 ----A---- C:\WINDOWS\system32\shadow.exe
2011-02-14 10:54:10 ----A---- C:\WINDOWS\system32\rwinsta.exe
2011-02-14 10:54:10 ----A---- C:\WINDOWS\system32\reset.exe
2011-02-14 10:54:10 ----A---- C:\WINDOWS\system32\regini.exe
2011-02-14 10:54:10 ----A---- C:\WINDOWS\system32\rdpcfgex.dll
2011-02-14 10:54:10 ----A---- C:\WINDOWS\system32\qwinsta.exe
2011-02-14 10:54:10 ----A---- C:\WINDOWS\system32\qappsrv.exe
2011-02-14 10:54:10 ----A---- C:\WINDOWS\system32\msg.exe
2011-02-14 10:54:10 ----A---- C:\WINDOWS\system32\msdtcprf.ini
2011-02-14 10:54:10 ----A---- C:\WINDOWS\system32\logoff.exe
2011-02-14 10:54:10 ----A---- C:\WINDOWS\system32\cdmodem.dll
2011-02-14 10:54:09 ----A---- C:\WINDOWS\system32\stclient.dll
2011-02-14 10:54:09 ----A---- C:\WINDOWS\system32\mtxlegih.dll
2011-02-14 10:54:09 ----A---- C:\WINDOWS\system32\mtxex.dll
2011-02-14 10:54:09 ----A---- C:\WINDOWS\system32\mtxdm.dll
2011-02-14 10:54:09 ----A---- C:\WINDOWS\system32\dcomcnfg.exe
2011-02-14 10:54:09 ----A---- C:\WINDOWS\system32\comsnap.dll
2011-02-14 10:54:09 ----A---- C:\WINDOWS\system32\comrepl.dll
2011-02-14 10:54:09 ----A---- C:\WINDOWS\system32\comaddin.dll
2011-02-14 10:54:05 ----A---- C:\WINDOWS\system32\wmimgmt.msc
2011-02-14 10:53:51 ----D---- C:\Program Files\MSN
2011-02-14 10:53:51 ----A---- C:\WINDOWS\system32\accwiz.exe
2011-02-14 10:53:50 ----D---- C:\Program Files\Windows NT
2011-02-14 10:53:50 ----A---- C:\WINDOWS\system32\sndrec32.exe
2011-02-14 10:53:50 ----A---- C:\WINDOWS\system32\mspaint.exe
2011-02-14 10:53:50 ----A---- C:\WINDOWS\system32\mplay32.exe
2011-02-14 10:53:50 ----A---- C:\WINDOWS\system32\hypertrm.dll
2011-02-14 10:53:49 ----A---- C:\WINDOWS\system32\tscfgwmi.dll
2011-02-14 10:53:49 ----A---- C:\WINDOWS\system32\spider.exe
2011-02-14 10:53:49 ----A---- C:\WINDOWS\system32\drivers\tdtcp.sys
2011-02-14 10:53:49 ----A---- C:\WINDOWS\system32\drivers\tdpipe.sys
2011-02-14 10:53:49 ----A---- C:\WINDOWS\system32\drivers\rdpwd.sys
2011-02-14 10:53:49 ----A---- C:\WINDOWS\system32\clipbrd.exe
2011-02-14 10:53:48 ----A---- C:\WINDOWS\system32\tscupgrd.exe
2011-02-14 10:53:48 ----A---- C:\WINDOWS\system32\termsrv.dll
2011-02-14 10:53:48 ----A---- C:\WINDOWS\system32\sessmgr.exe
2011-02-14 10:53:48 ----A---- C:\WINDOWS\system32\remotepg.dll
2011-02-14 10:53:48 ----A---- C:\WINDOWS\system32\rdshost.exe
2011-02-14 10:53:48 ----A---- C:\WINDOWS\system32\rdsaddin.exe
2011-02-14 10:53:48 ----A---- C:\WINDOWS\system32\rdpwsx.dll
2011-02-14 10:53:48 ----A---- C:\WINDOWS\system32\rdchost.dll
2011-02-14 10:53:48 ----A---- C:\WINDOWS\system32\mstscax.dll
2011-02-14 10:53:48 ----A---- C:\WINDOWS\system32\mstsc.exe
2011-02-14 10:53:47 ----D---- C:\WINDOWS\system32\MsDtc
2011-02-14 10:53:47 ----A---- C:\WINDOWS\system32\rdpsnd.dll
2011-02-14 10:53:47 ----A---- C:\WINDOWS\system32\rdpclip.exe
2011-02-14 10:53:47 ----A---- C:\WINDOWS\system32\qprocess.exe
2011-02-14 10:53:47 ----A---- C:\WINDOWS\system32\mtxoci.dll
2011-02-14 10:53:47 ----A---- C:\WINDOWS\system32\msdtcuiu.dll
2011-02-14 10:53:47 ----A---- C:\WINDOWS\system32\msdtcprx.dll
2011-02-14 10:53:47 ----A---- C:\WINDOWS\system32\icaapi.dll
2011-02-14 10:53:47 ----A---- C:\WINDOWS\system32\cfgbkend.dll
2011-02-14 10:53:46 ----D---- C:\WINDOWS\system32\Com
2011-02-14 10:53:46 ----A---- C:\WINDOWS\system32\xolehlp.dll
2011-02-14 10:53:46 ----A---- C:\WINDOWS\system32\msdtctm.dll
2011-02-14 10:53:46 ----A---- C:\WINDOWS\system32\msdtclog.dll
2011-02-14 10:53:46 ----A---- C:\WINDOWS\system32\msdtc.exe
2011-02-14 10:53:46 ----A---- C:\WINDOWS\system32\colbact.dll
2011-02-14 10:53:46 ----A---- C:\WINDOWS\system32\catsrvps.dll
2011-02-14 10:53:45 ----A---- C:\WINDOWS\system32\comuid.dll
2011-02-14 10:53:45 ----A---- C:\WINDOWS\system32\comsvcs.dll
2011-02-14 10:53:45 ----A---- C:\WINDOWS\system32\clbcatex.dll
2011-02-14 10:53:45 ----A---- C:\WINDOWS\system32\catsrvut.dll
2011-02-14 10:53:45 ----A---- C:\WINDOWS\system32\catsrv.dll
2011-02-14 10:53:44 ----A---- C:\WINDOWS\system32\clbcatq.dll
2011-02-14 10:53:39 ----A---- C:\WINDOWS\system32\servdeps.dll
2011-02-14 10:53:39 ----A---- C:\WINDOWS\system32\mmfutil.dll
2011-02-14 10:53:39 ----A---- C:\WINDOWS\system32\licwmi.dll
2011-02-14 10:53:39 ----A---- C:\WINDOWS\system32\cmprops.dll
2011-02-14 10:53:36 ----A---- C:\WINDOWS\system32\drivers\termdd.sys
2011-02-14 10:53:36 ----A---- C:\WINDOWS\system32\drivers\rdpdr.sys
======List of files/folders modified in the last 1 months======
2011-02-14 12:04:36 ----A---- C:\WINDOWS\win.ini
2011-02-14 11:51:33 ----A---- C:\WINDOWS\system.ini
2011-02-14 10:57:03 ----ASH---- C:\WINDOWS\fonts\desktop.ini
======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
R0 a347bus;a347bus; C:\WINDOWS\system32\DRIVERS\a347bus.sys [2004-04-30 160640]
R0 a347scsi;a347scsi; C:\WINDOWS\System32\Drivers\a347scsi.sys [2004-04-30 5248]
R0 Inspect;COMODO Internet Security Firewall Driver; C:\WINDOWS\System32\DRIVERS\inspect.sys [2011-01-06 94784]
R0 ohci1394;Texas Instruments OHCI Compliant IEEE 1394 Host Controller; C:\WINDOWS\system32\DRIVERS\ohci1394.sys [2008-04-14 61696]
R1 AmdPPM;AMD HwPState Processor Driver; C:\WINDOWS\system32\DRIVERS\AmdPPM.sys [2007-04-16 33792]
R1 avgio;avgio; \??\C:\Program Files\Avira\AntiVir Desktop\avgio.sys []
R1 avipbb;avipbb; C:\WINDOWS\system32\DRIVERS\avipbb.sys [2010-12-13 135096]
R1 cmdGuard;COMODO Internet Security Sandbox Driver; C:\WINDOWS\System32\DRIVERS\cmdguard.sys [2011-01-06 239368]
R1 cmdHlp;COMODO Internet Security Helper Driver; C:\WINDOWS\System32\DRIVERS\cmdhlp.sys [2011-01-06 27576]
R1 sp_rsdrv2;Spyware Terminator Driver 2; \??\C:\WINDOWS\system32\drivers\sp_rsdrv2.sys []
R1 ssmdrv;ssmdrv; C:\WINDOWS\system32\DRIVERS\ssmdrv.sys [2010-06-17 28520]
R1 WmiAcpi;Microsoft Windows Management Interface for ACPI; C:\WINDOWS\system32\DRIVERS\wmiacpi.sys [2008-04-14 8832]
R2 avgntflt;avgntflt; C:\WINDOWS\system32\DRIVERS\avgntflt.sys [2010-12-13 61960]
R3 Arp1394;1394 ARP Client Protocol; C:\WINDOWS\system32\DRIVERS\arp1394.sys [2008-04-14 60800]
R3 ati2mtag;ati2mtag; C:\WINDOWS\system32\DRIVERS\ati2mtag.sys [2011-01-27 6406656]
R3 gdrv;gdrv; \??\C:\WINDOWS\gdrv.sys []
R3 HDAudBus;Microsoft UAA Bus Driver for High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2008-04-13 144384]
R3 hidusb;Microsoft HID Class Driver; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-14 10368]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\WINDOWS\system32\drivers\RtkHDAud.sys [2009-01-20 5027840]
R3 mouhid;Mouse HID Driver; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2004-08-04 12160]
R3 NIC1394;1394 Net Driver; C:\WINDOWS\system32\DRIVERS\nic1394.sys [2008-04-14 61824]
R3 RTHDMIAzAudService;Service for HDMI; C:\WINDOWS\system32\drivers\RtKHDMI.sys [2008-12-25 3721664]
R3 RTLE8023xp;Realtek 10/100/1000 PCI-E NIC Family NDIS XP Driver; C:\WINDOWS\system32\DRIVERS\Rtenicxp.sys [2008-10-30 117888]
S3 USBSTOR;USB Mass Storage Driver; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-14 26368]
======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
R2 AntiVirService;Avira AntiVir Guard; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [2010-12-13 267944]
R2 AntiVirSchedulerService;Avira AntiVir Scheduler; C:\Program Files\Avira\AntiVir Desktop\sched.exe [2010-12-13 135336]
R2 Ati HotKey Poller;Ati HotKey Poller; C:\WINDOWS\system32\Ati2evxx.exe [2011-01-26 638976]
R2 cmdAgent;COMODO Internet Security Helper Service; C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe [2011-01-17 1803224]
R2 ES lite Service;ES lite Service for program management.; C:\Program Files\Gigabyte\EasySaver\ESSVR.EXE [2009-02-05 68136]
R2 sp_rssrv;Spyware Terminator Realtime Shield Service; C:\Program Files\Spyware Terminator\sp_rsser.exe [2011-02-14 496128]
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2008-07-25 34312]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; C:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104]
S3 idsvc;Windows CardSpace; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2003-07-28 89136]
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2008-07-29 132096]
-----------------EOF-----------------
Odvirování PC, zrychlení počítače, vzdálená pomoc prostřednictvím služby neslape.cz
Preventivka
Moderátor: Moderátoři
Pravidla fóra
Pokud chcete pomoc, vložte log z FRST [návod zde] nebo RSIT [návod zde]
Jednotlivé thready budou po vyřešení uzamčeny. Stejně tak ty, které budou nečinné déle než 14 dní. Vizte Pravidlo o zamykání témat. Děkujeme za pochopení.
!NOVINKA!
Nově lze využívat služby vzdálené pomoci, kdy se k vašemu počítači připojí odborník a bližší informace o problému si od vás získá telefonicky! Více na www.neslape.cz
Pokud chcete pomoc, vložte log z FRST [návod zde] nebo RSIT [návod zde]
Jednotlivé thready budou po vyřešení uzamčeny. Stejně tak ty, které budou nečinné déle než 14 dní. Vizte Pravidlo o zamykání témat. Děkujeme za pochopení.
!NOVINKA!
Nově lze využívat služby vzdálené pomoci, kdy se k vašemu počítači připojí odborník a bližší informace o problému si od vás získá telefonicky! Více na www.neslape.cz
-
Rudy
- Site Admin
- Příspěvky: 119426
- Registrován: 30 říj 2003 13:42
- Bydliště: Plzeň
- Kontaktovat uživatele:
Re: Preventivka
Jelikož jste momentálně připojen z Košic, jak je možné, že DNS server máte v USA? Pokud o tom nevíte, Dejte log z ComboFix.
Stahnete a ulozte nejlepe na plochu ComboFix: http://download.bleepingcomputer.com/sUBs/ComboFix.exe
pote spustte aplikaci pod uctem s administratorskym opravnenim
hned po startu se zobrazi obrazovka s licencnimi podminkami, pokracujte kliknutim na tlacitko Ano.
v klidu si postavte na kafe (cela akce trva cca. 5-10 minut, nekdy i dele - dle toho, o jak rychly stroj se jedna a kolika soubory se skener bude muset prodirat), behem skenu se nepokousejte spoustet zadne jine aplikace ani nic jineho
behem skenovani nepropadejte panice, vas stroj muze byt restartovan (predevsim pri prvni aplikaci skeneru)
upozorneni: pokud pouzivate antispyware s rezidentnim stitem, prepnete jeho rezidentni stit do Install Mode, pripadne jej po dobu skenu uplne deaktivujte, protoze dochazi pri skenu a vymazu pripadneho malware k nezadoucim kolizim s rezidentem antispyware
Dotazy a logy vkládejte pouze do vašich threadů. Soukromé zprávy, icq a e-maily neslouží k řešení vašich problémů.
Podpořte, prosím, naše fórum : https://platba.viry.cz/payment/.
Navštivte:
e-mail: rudy(zavináč)forum.viry.cz
Varování: Před odvirováním PC si udělejte zálohy svých důležitých dat (pošta, kontakty, dokumenty, fotografie, videa, hudba apod.). Virus mimo svých "viditelných" aktivit může poškodit systém!
Po dořešení vašeho problému bude vlákno zamknuto. Stejně tak tehdy, pokud bude nečinné více než 14dnů. Pokud budete chtít vlákno aktivovat, napište mi na mail uvedený výše.
Podpořte, prosím, naše fórum : https://platba.viry.cz/payment/.
Navštivte:
e-mail: rudy(zavináč)forum.viry.cz
Varování: Před odvirováním PC si udělejte zálohy svých důležitých dat (pošta, kontakty, dokumenty, fotografie, videa, hudba apod.). Virus mimo svých "viditelných" aktivit může poškodit systém!
Po dořešení vašeho problému bude vlákno zamknuto. Stejně tak tehdy, pokud bude nečinné více než 14dnů. Pokud budete chtít vlákno aktivovat, napište mi na mail uvedený výše.
Re: Preventivka
Fuu, nemyslel som ze bude nutne pouzit az ComboFix. O tom DNS nic neviem. Som v Kosiciach na internate. Kazdopadne, teraz budem zaneprazdneny, takze log (ak sa podari 
) z Comba dam az v pondeok 
zatial dakujem...
) z Comba dam az v pondeok zatial dakujem...-
Rudy
- Site Admin
- Příspěvky: 119426
- Registrován: 30 říj 2003 13:42
- Bydliště: Plzeň
- Kontaktovat uživatele:
Re: Preventivka
Je možné, že vám byl virem přesměrován DNS. IP z logu (156.154.70.25) patří: http://whois.domaintools.com/156.154.70.25 , což je podivné.Muraddin píše:Fuu, nemyslel som ze bude nutne pouzit az ComboFix. O tom DNS nic neviem. Som v Kosiciach na internate. Kazdopadne, teraz budem zaneprazdneny, takze log (ak sa podari
Dotazy a logy vkládejte pouze do vašich threadů. Soukromé zprávy, icq a e-maily neslouží k řešení vašich problémů.
Podpořte, prosím, naše fórum : https://platba.viry.cz/payment/.
Navštivte:
e-mail: rudy(zavináč)forum.viry.cz
Varování: Před odvirováním PC si udělejte zálohy svých důležitých dat (pošta, kontakty, dokumenty, fotografie, videa, hudba apod.). Virus mimo svých "viditelných" aktivit může poškodit systém!
Po dořešení vašeho problému bude vlákno zamknuto. Stejně tak tehdy, pokud bude nečinné více než 14dnů. Pokud budete chtít vlákno aktivovat, napište mi na mail uvedený výše.
Podpořte, prosím, naše fórum : https://platba.viry.cz/payment/.
Navštivte:
e-mail: rudy(zavináč)forum.viry.cz
Varování: Před odvirováním PC si udělejte zálohy svých důležitých dat (pošta, kontakty, dokumenty, fotografie, videa, hudba apod.). Virus mimo svých "viditelných" aktivit může poškodit systém!
Po dořešení vašeho problému bude vlákno zamknuto. Stejně tak tehdy, pokud bude nečinné více než 14dnů. Pokud budete chtít vlákno aktivovat, napište mi na mail uvedený výše.
Re: Preventivka
Tak nokoniec som stihol ComboFix dnes. Spustal som ho v safe mode.
ComboFix 11-03-09.03 - Administrator . 03. 2011 11:00:27.1.2 - x86 NETWORK
Microsoft Windows XP Professional 5.1.2600.3.1250.421.1033.18.3070.2827 [GMT 1:00]
Running from: c:\documents and settings\Administrator\Desktop\ComboFix.exe
AV: AntiVir Desktop *Enabled/Updated* {AD166499-45F9-482A-A743-FDD3350758C7}
FW: COMODO Firewall *Enabled* {043803A3-4F86-4ef6-AFC5-F6E02A79969B}
.
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
.
((((((((((((((((((((((((( Files Created from 2011-02-10 to 2011-03-10 )))))))))))))))))))))))))))))))
.
.
2011-03-08 16:23 . 2011-03-08 16:23 -------- d-----w- C:\rsit
2011-02-16 12:30 . 2011-02-16 12:30 -------- d-----w- C:\VritualRoot
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-01-06 16:37 . 2011-01-06 16:37 94784 ----a-w- c:\windows\system32\drivers\inspect.sys
2011-01-06 16:37 . 2011-01-06 16:37 27576 ----a-w- c:\windows\system32\drivers\cmdhlp.sys
2011-01-06 16:37 . 2011-01-06 16:37 239368 ----a-w- c:\windows\system32\drivers\cmdGuard.sys
2011-01-06 16:37 . 2011-01-06 16:37 15592 ----a-w- c:\windows\system32\drivers\cmderd.sys
2010-12-29 00:42 . 2010-12-29 00:42 285480 ----a-w- c:\windows\system32\guard32.dll
.
.
------- Sigcheck -------
.
[7] 2008-04-13 . 9F3A2F5AA6875C72BF062C712CFA2674 . 96512 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\atapi.sys
[-] 2008-04-13 23:10 . !HASH: COULD NOT OPEN FILE !!!!! . 96512 . . [------] . . c:\windows\system32\drivers\atapi.sys
[7] 2004-08-04 . CDFE4411A69C224BD1D11B2DA92DAC51 . 95360 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\atapi.sys
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDCPL"="RTHDCPL.EXE" [2009-01-13 18084864]
"ATICustomerCare"="c:\program files\ATI\ATICustomerCare\ATICustomerCare.exe" [2010-05-04 311296]
"COMODO Internet Security"="c:\program files\COMODO\COMODO Internet Security\cfp.exe" [2011-01-17 2548552]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 10.0\Reader\Reader_sl.exe" [2011-01-30 35736]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-11-15 932288]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2011-01-26 98304]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2010-12-13 281768]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\windows\system32\guard32.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpywareTerminator]
2011-02-14 10:39 2216960 ----a-w- c:\program files\Spyware Terminator\SpywareTerminatorShield.Exe
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Spyware Terminator\\SpywareTerminatorUpdate.exe"=
"c:\\Program Files\\QIP Infium\\infium.exe"=
"c:\\Program Files\\VideoLAN\\VLC\\vlc.exe"=
"d:\\Hry\\F1 2010\\F1_2010_game.exe"=
"c:\\Program Files\\Full Tilt Poker\\FullTiltPoker.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"5384:TCP"= 5384:TCP:xgkuygy
.
R0 a347bus;a347bus;c:\windows\system32\drivers\a347bus.sys [2/14/2011 12:00 PM 160640]
R0 a347scsi;a347scsi;c:\windows\system32\drivers\a347scsi.sys [2/14/2011 12:00 PM 5248]
R1 cmdHlp;COMODO Internet Security Helper Driver;c:\windows\system32\drivers\cmdhlp.sys [1/6/2011 5:37 PM 27576]
S1 cmdGuard;COMODO Internet Security Sandbox Driver;c:\windows\system32\drivers\cmdGuard.sys [1/6/2011 5:37 PM 239368]
S1 sp_rsdrv2;Spyware Terminator Driver 2;c:\windows\system32\drivers\sp_rsdrv2.sys [2/14/2011 11:39 AM 142592]
S2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [2/14/2011 11:20 AM 135336]
S2 ES lite Service;ES lite Service for program management.;c:\program files\Gigabyte\EasySaver\essvr.exe [2/14/2011 11:02 AM 68136]
S2 hdjeovbm;Manager Security;c:\windows\system32\svchost.exe -k netsvcs [8/4/2004 1:00 PM 14336]
.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
hdjeovbm
.
.
------- Supplementary Scan -------
.
TCP: {4B42AF88-2D47-429C-868C-44AA57D9A44A} = 156.154.70.25,156.154.71.25
FF - ProfilePath - c:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\qdw2dwfn.default\
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-03-10 11:02
Windows 5.1.2600 Service Pack 3 NTFS
.
detected NTDLL code modification:
ZwClose, ZwOpenFile
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
scanning hidden files ...
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\hdjeovbm]
"ServiceDll"="c:\windows\system32\sbvggv.dll"
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'winlogon.exe'(644)
c:\windows\system32\Ati2evxx.dll
c:\windows\system32\atiadlxx.dll
.
Completion time: 2011-03-10 11:02:59
ComboFix-quarantined-files.txt 2011-03-10 10:02
.
Pre-Run: 4 848 844 800 bytes free
Post-Run: 4 829 745 152 bytes free
.
- - End Of File - - A21B3E7497C7122866733834FCAEA647
ComboFix 11-03-09.03 - Administrator . 03. 2011 11:00:27.1.2 - x86 NETWORK
Microsoft Windows XP Professional 5.1.2600.3.1250.421.1033.18.3070.2827 [GMT 1:00]
Running from: c:\documents and settings\Administrator\Desktop\ComboFix.exe
AV: AntiVir Desktop *Enabled/Updated* {AD166499-45F9-482A-A743-FDD3350758C7}
FW: COMODO Firewall *Enabled* {043803A3-4F86-4ef6-AFC5-F6E02A79969B}
.
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
.
((((((((((((((((((((((((( Files Created from 2011-02-10 to 2011-03-10 )))))))))))))))))))))))))))))))
.
.
2011-03-08 16:23 . 2011-03-08 16:23 -------- d-----w- C:\rsit
2011-02-16 12:30 . 2011-02-16 12:30 -------- d-----w- C:\VritualRoot
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-01-06 16:37 . 2011-01-06 16:37 94784 ----a-w- c:\windows\system32\drivers\inspect.sys
2011-01-06 16:37 . 2011-01-06 16:37 27576 ----a-w- c:\windows\system32\drivers\cmdhlp.sys
2011-01-06 16:37 . 2011-01-06 16:37 239368 ----a-w- c:\windows\system32\drivers\cmdGuard.sys
2011-01-06 16:37 . 2011-01-06 16:37 15592 ----a-w- c:\windows\system32\drivers\cmderd.sys
2010-12-29 00:42 . 2010-12-29 00:42 285480 ----a-w- c:\windows\system32\guard32.dll
.
.
------- Sigcheck -------
.
[7] 2008-04-13 . 9F3A2F5AA6875C72BF062C712CFA2674 . 96512 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\atapi.sys
[-] 2008-04-13 23:10 . !HASH: COULD NOT OPEN FILE !!!!! . 96512 . . [------] . . c:\windows\system32\drivers\atapi.sys
[7] 2004-08-04 . CDFE4411A69C224BD1D11B2DA92DAC51 . 95360 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\atapi.sys
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDCPL"="RTHDCPL.EXE" [2009-01-13 18084864]
"ATICustomerCare"="c:\program files\ATI\ATICustomerCare\ATICustomerCare.exe" [2010-05-04 311296]
"COMODO Internet Security"="c:\program files\COMODO\COMODO Internet Security\cfp.exe" [2011-01-17 2548552]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 10.0\Reader\Reader_sl.exe" [2011-01-30 35736]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-11-15 932288]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2011-01-26 98304]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2010-12-13 281768]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\windows\system32\guard32.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpywareTerminator]
2011-02-14 10:39 2216960 ----a-w- c:\program files\Spyware Terminator\SpywareTerminatorShield.Exe
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Spyware Terminator\\SpywareTerminatorUpdate.exe"=
"c:\\Program Files\\QIP Infium\\infium.exe"=
"c:\\Program Files\\VideoLAN\\VLC\\vlc.exe"=
"d:\\Hry\\F1 2010\\F1_2010_game.exe"=
"c:\\Program Files\\Full Tilt Poker\\FullTiltPoker.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"5384:TCP"= 5384:TCP:xgkuygy
.
R0 a347bus;a347bus;c:\windows\system32\drivers\a347bus.sys [2/14/2011 12:00 PM 160640]
R0 a347scsi;a347scsi;c:\windows\system32\drivers\a347scsi.sys [2/14/2011 12:00 PM 5248]
R1 cmdHlp;COMODO Internet Security Helper Driver;c:\windows\system32\drivers\cmdhlp.sys [1/6/2011 5:37 PM 27576]
S1 cmdGuard;COMODO Internet Security Sandbox Driver;c:\windows\system32\drivers\cmdGuard.sys [1/6/2011 5:37 PM 239368]
S1 sp_rsdrv2;Spyware Terminator Driver 2;c:\windows\system32\drivers\sp_rsdrv2.sys [2/14/2011 11:39 AM 142592]
S2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [2/14/2011 11:20 AM 135336]
S2 ES lite Service;ES lite Service for program management.;c:\program files\Gigabyte\EasySaver\essvr.exe [2/14/2011 11:02 AM 68136]
S2 hdjeovbm;Manager Security;c:\windows\system32\svchost.exe -k netsvcs [8/4/2004 1:00 PM 14336]
.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
hdjeovbm
.
.
------- Supplementary Scan -------
.
TCP: {4B42AF88-2D47-429C-868C-44AA57D9A44A} = 156.154.70.25,156.154.71.25
FF - ProfilePath - c:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\qdw2dwfn.default\
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-03-10 11:02
Windows 5.1.2600 Service Pack 3 NTFS
.
detected NTDLL code modification:
ZwClose, ZwOpenFile
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
scanning hidden files ...
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\hdjeovbm]
"ServiceDll"="c:\windows\system32\sbvggv.dll"
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'winlogon.exe'(644)
c:\windows\system32\Ati2evxx.dll
c:\windows\system32\atiadlxx.dll
.
Completion time: 2011-03-10 11:02:59
ComboFix-quarantined-files.txt 2011-03-10 10:02
.
Pre-Run: 4 848 844 800 bytes free
Post-Run: 4 829 745 152 bytes free
.
- - End Of File - - A21B3E7497C7122866733834FCAEA647
-
Rudy
- Site Admin
- Příspěvky: 119426
- Registrován: 30 říj 2003 13:42
- Bydliště: Plzeň
- Kontaktovat uživatele:
Re: Preventivka
Otevřte poznámkový blok a zkopírujte do něj:
Uložte na plochu jako CFScript.txt. pak jej myší přetáhněte nad ikonu ComboFix a pusťte. CF se spustí a vykoná příkazy ze skriptu.Driver::
hdjeovbm
FCopy::
c:\windows\$NtServicePackUninstall$\atapi.sys | c:\windows\system32\drivers\atapi.sys
Collect::
c:\windows\system32\sbvggv.dll
Dotazy a logy vkládejte pouze do vašich threadů. Soukromé zprávy, icq a e-maily neslouží k řešení vašich problémů.
Podpořte, prosím, naše fórum : https://platba.viry.cz/payment/.
Navštivte:
e-mail: rudy(zavináč)forum.viry.cz
Varování: Před odvirováním PC si udělejte zálohy svých důležitých dat (pošta, kontakty, dokumenty, fotografie, videa, hudba apod.). Virus mimo svých "viditelných" aktivit může poškodit systém!
Po dořešení vašeho problému bude vlákno zamknuto. Stejně tak tehdy, pokud bude nečinné více než 14dnů. Pokud budete chtít vlákno aktivovat, napište mi na mail uvedený výše.
Podpořte, prosím, naše fórum : https://platba.viry.cz/payment/.
Navštivte:
e-mail: rudy(zavináč)forum.viry.cz
Varování: Před odvirováním PC si udělejte zálohy svých důležitých dat (pošta, kontakty, dokumenty, fotografie, videa, hudba apod.). Virus mimo svých "viditelných" aktivit může poškodit systém!
Po dořešení vašeho problému bude vlákno zamknuto. Stejně tak tehdy, pokud bude nečinné více než 14dnů. Pokud budete chtít vlákno aktivovat, napište mi na mail uvedený výše.
Re: Preventivka
Log po scripte.
ComboFix 11-03-12.01 - Administrator . 03. 2011 11:53:04.2.2 - x86 NETWORK
Microsoft Windows XP Professional 5.1.2600.3.1250.421.1033.18.3070.2821 [GMT 1:00]
Running from: c:\documents and settings\Administrator\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Administrator\Desktop\CFScript.txt
AV: AntiVir Desktop *Enabled/Updated* {AD166499-45F9-482A-A743-FDD3350758C7}
FW: COMODO Firewall *Enabled* {043803A3-4F86-4ef6-AFC5-F6E02A79969B}
.
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
.
--------------- FCopy ---------------
.
c:\windows\$NtServicePackUninstall$\atapi.sys --> c:\windows\system32\drivers\atapi.sys
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Legacy_HDJEOVBM
-------\Service_hdjeovbm
.
.
((((((((((((((((((((((((( Files Created from 2011-02-14 to 2011-03-14 )))))))))))))))))))))))))))))))
.
.
2011-03-08 16:23 . 2011-03-08 16:23 -------- d-----w- C:\rsit
2011-02-16 12:30 . 2011-02-16 12:30 -------- d-----w- C:\VritualRoot
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-01-06 16:37 . 2011-01-06 16:37 94784 ----a-w- c:\windows\system32\drivers\inspect.sys
2011-01-06 16:37 . 2011-01-06 16:37 27576 ----a-w- c:\windows\system32\drivers\cmdhlp.sys
2011-01-06 16:37 . 2011-01-06 16:37 239368 ----a-w- c:\windows\system32\drivers\cmdGuard.sys
2011-01-06 16:37 . 2011-01-06 16:37 15592 ----a-w- c:\windows\system32\drivers\cmderd.sys
2010-12-29 00:42 . 2010-12-29 00:42 285480 ----a-w- c:\windows\system32\guard32.dll
.
.
------- Sigcheck -------
.
[7] 2008-04-13 . 9F3A2F5AA6875C72BF062C712CFA2674 . 96512 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\atapi.sys
[7] 2004-08-04 . CDFE4411A69C224BD1D11B2DA92DAC51 . 95360 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\atapi.sys
[-] 2004-08-04 12:00 . !HASH: COULD NOT OPEN FILE !!!!! . 95360 . . [------] . . c:\windows\system32\drivers\atapi.sys
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"combofix"="c:\combofix\CF26193.cfxxe" [X]
"RTHDCPL"="RTHDCPL.EXE" [2009-01-13 18084864]
"ATICustomerCare"="c:\program files\ATI\ATICustomerCare\ATICustomerCare.exe" [2010-05-04 311296]
"COMODO Internet Security"="c:\program files\COMODO\COMODO Internet Security\cfp.exe" [2011-01-17 2548552]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 10.0\Reader\Reader_sl.exe" [2011-01-30 35736]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-11-15 932288]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2011-01-26 98304]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2010-12-13 281768]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\windows\system32\guard32.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpywareTerminator]
2011-02-14 10:39 2216960 ----a-w- c:\program files\Spyware Terminator\SpywareTerminatorShield.Exe
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Spyware Terminator\\SpywareTerminatorUpdate.exe"=
"c:\\Program Files\\QIP Infium\\infium.exe"=
"c:\\Program Files\\VideoLAN\\VLC\\vlc.exe"=
"d:\\Hry\\F1 2010\\F1_2010_game.exe"=
"c:\\Program Files\\Full Tilt Poker\\FullTiltPoker.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"5384:TCP"= 5384:TCP:xgkuygy
.
R0 a347bus;a347bus;c:\windows\system32\drivers\a347bus.sys [2/14/2011 12:00 PM 160640]
R0 a347scsi;a347scsi;c:\windows\system32\drivers\a347scsi.sys [2/14/2011 12:00 PM 5248]
R1 cmdHlp;COMODO Internet Security Helper Driver;c:\windows\system32\drivers\cmdhlp.sys [1/6/2011 5:37 PM 27576]
S1 cmdGuard;COMODO Internet Security Sandbox Driver;c:\windows\system32\drivers\cmdGuard.sys [1/6/2011 5:37 PM 239368]
S1 sp_rsdrv2;Spyware Terminator Driver 2;c:\windows\system32\drivers\sp_rsdrv2.sys [2/14/2011 11:39 AM 142592]
S2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [2/14/2011 11:20 AM 135336]
S2 ES lite Service;ES lite Service for program management.;c:\program files\Gigabyte\EasySaver\essvr.exe [2/14/2011 11:02 AM 68136]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://qip.ru
uSearch Page = hxxp://search.qip.ru
uDefault_Page_URL = hxxp://qip.ru
uDefault_Search_URL = hxxp://search.qip.ru
uSearch Bar = hxxp://search.qip.ru/ie
uSearchAssistant = hxxp://search.qip.ru/ie
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
TCP: {4B42AF88-2D47-429C-868C-44AA57D9A44A} = 156.154.70.25,156.154.71.25
FF - ProfilePath - c:\documents and settings\Blizz\Application Data\Mozilla\Firefox\Profiles\7oag4tmw.default\
FF - prefs.js: browser.search.selectedEngine - QIP Search
FF - prefs.js: browser.startup.homepage - www.google.sk
FF - prefs.js: keyword.URL - hxxp://search.qip.ru/search?from=FF&query=
FF - prefs.js: network.proxy.type - 0
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-03-14 11:55
Windows 5.1.2600 Service Pack 3 NTFS
.
detected NTDLL code modification:
ZwClose, ZwOpenFile
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
scanning hidden files ...
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'winlogon.exe'(848)
c:\windows\system32\Ati2evxx.dll
c:\windows\system32\atiadlxx.dll
.
- - - - - - - > 'lsass.exe'(904)
c:\windows\system32\guard32.dll
.
- - - - - - - > 'explorer.exe'(2632)
c:\windows\system32\guard32.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\Ati2evxx.exe
c:\windows\system32\Ati2evxx.exe
c:\program files\Avira\AntiVir Desktop\avguard.exe
c:\program files\Avira\AntiVir Desktop\avshadow.exe
c:\program files\Spyware Terminator\sp_rsser.exe
c:\windows\system32\wscntfy.exe
c:\windows\RTHDCPL.EXE
c:\windows\system32\imapi.exe
.
**************************************************************************
.
Completion time: 2011-03-14 11:57:31 - machine was rebooted
ComboFix-quarantined-files.txt 2011-03-14 10:57
ComboFix2.txt 2011-03-10 10:03
.
Pre-Run: 4 778 606 592 bytes free
Post-Run: 4 669 730 816 bytes free
.
- - End Of File - - 198E924C058FC2A083D75416430F13DE
ComboFix 11-03-12.01 - Administrator . 03. 2011 11:53:04.2.2 - x86 NETWORK
Microsoft Windows XP Professional 5.1.2600.3.1250.421.1033.18.3070.2821 [GMT 1:00]
Running from: c:\documents and settings\Administrator\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Administrator\Desktop\CFScript.txt
AV: AntiVir Desktop *Enabled/Updated* {AD166499-45F9-482A-A743-FDD3350758C7}
FW: COMODO Firewall *Enabled* {043803A3-4F86-4ef6-AFC5-F6E02A79969B}
.
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
.
--------------- FCopy ---------------
.
c:\windows\$NtServicePackUninstall$\atapi.sys --> c:\windows\system32\drivers\atapi.sys
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Legacy_HDJEOVBM
-------\Service_hdjeovbm
.
.
((((((((((((((((((((((((( Files Created from 2011-02-14 to 2011-03-14 )))))))))))))))))))))))))))))))
.
.
2011-03-08 16:23 . 2011-03-08 16:23 -------- d-----w- C:\rsit
2011-02-16 12:30 . 2011-02-16 12:30 -------- d-----w- C:\VritualRoot
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-01-06 16:37 . 2011-01-06 16:37 94784 ----a-w- c:\windows\system32\drivers\inspect.sys
2011-01-06 16:37 . 2011-01-06 16:37 27576 ----a-w- c:\windows\system32\drivers\cmdhlp.sys
2011-01-06 16:37 . 2011-01-06 16:37 239368 ----a-w- c:\windows\system32\drivers\cmdGuard.sys
2011-01-06 16:37 . 2011-01-06 16:37 15592 ----a-w- c:\windows\system32\drivers\cmderd.sys
2010-12-29 00:42 . 2010-12-29 00:42 285480 ----a-w- c:\windows\system32\guard32.dll
.
.
------- Sigcheck -------
.
[7] 2008-04-13 . 9F3A2F5AA6875C72BF062C712CFA2674 . 96512 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\atapi.sys
[7] 2004-08-04 . CDFE4411A69C224BD1D11B2DA92DAC51 . 95360 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\atapi.sys
[-] 2004-08-04 12:00 . !HASH: COULD NOT OPEN FILE !!!!! . 95360 . . [------] . . c:\windows\system32\drivers\atapi.sys
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"combofix"="c:\combofix\CF26193.cfxxe" [X]
"RTHDCPL"="RTHDCPL.EXE" [2009-01-13 18084864]
"ATICustomerCare"="c:\program files\ATI\ATICustomerCare\ATICustomerCare.exe" [2010-05-04 311296]
"COMODO Internet Security"="c:\program files\COMODO\COMODO Internet Security\cfp.exe" [2011-01-17 2548552]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 10.0\Reader\Reader_sl.exe" [2011-01-30 35736]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-11-15 932288]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2011-01-26 98304]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2010-12-13 281768]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\windows\system32\guard32.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpywareTerminator]
2011-02-14 10:39 2216960 ----a-w- c:\program files\Spyware Terminator\SpywareTerminatorShield.Exe
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Spyware Terminator\\SpywareTerminatorUpdate.exe"=
"c:\\Program Files\\QIP Infium\\infium.exe"=
"c:\\Program Files\\VideoLAN\\VLC\\vlc.exe"=
"d:\\Hry\\F1 2010\\F1_2010_game.exe"=
"c:\\Program Files\\Full Tilt Poker\\FullTiltPoker.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"5384:TCP"= 5384:TCP:xgkuygy
.
R0 a347bus;a347bus;c:\windows\system32\drivers\a347bus.sys [2/14/2011 12:00 PM 160640]
R0 a347scsi;a347scsi;c:\windows\system32\drivers\a347scsi.sys [2/14/2011 12:00 PM 5248]
R1 cmdHlp;COMODO Internet Security Helper Driver;c:\windows\system32\drivers\cmdhlp.sys [1/6/2011 5:37 PM 27576]
S1 cmdGuard;COMODO Internet Security Sandbox Driver;c:\windows\system32\drivers\cmdGuard.sys [1/6/2011 5:37 PM 239368]
S1 sp_rsdrv2;Spyware Terminator Driver 2;c:\windows\system32\drivers\sp_rsdrv2.sys [2/14/2011 11:39 AM 142592]
S2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [2/14/2011 11:20 AM 135336]
S2 ES lite Service;ES lite Service for program management.;c:\program files\Gigabyte\EasySaver\essvr.exe [2/14/2011 11:02 AM 68136]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://qip.ru
uSearch Page = hxxp://search.qip.ru
uDefault_Page_URL = hxxp://qip.ru
uDefault_Search_URL = hxxp://search.qip.ru
uSearch Bar = hxxp://search.qip.ru/ie
uSearchAssistant = hxxp://search.qip.ru/ie
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
TCP: {4B42AF88-2D47-429C-868C-44AA57D9A44A} = 156.154.70.25,156.154.71.25
FF - ProfilePath - c:\documents and settings\Blizz\Application Data\Mozilla\Firefox\Profiles\7oag4tmw.default\
FF - prefs.js: browser.search.selectedEngine - QIP Search
FF - prefs.js: browser.startup.homepage - www.google.sk
FF - prefs.js: keyword.URL - hxxp://search.qip.ru/search?from=FF&query=
FF - prefs.js: network.proxy.type - 0
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-03-14 11:55
Windows 5.1.2600 Service Pack 3 NTFS
.
detected NTDLL code modification:
ZwClose, ZwOpenFile
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
scanning hidden files ...
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'winlogon.exe'(848)
c:\windows\system32\Ati2evxx.dll
c:\windows\system32\atiadlxx.dll
.
- - - - - - - > 'lsass.exe'(904)
c:\windows\system32\guard32.dll
.
- - - - - - - > 'explorer.exe'(2632)
c:\windows\system32\guard32.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\Ati2evxx.exe
c:\windows\system32\Ati2evxx.exe
c:\program files\Avira\AntiVir Desktop\avguard.exe
c:\program files\Avira\AntiVir Desktop\avshadow.exe
c:\program files\Spyware Terminator\sp_rsser.exe
c:\windows\system32\wscntfy.exe
c:\windows\RTHDCPL.EXE
c:\windows\system32\imapi.exe
.
**************************************************************************
.
Completion time: 2011-03-14 11:57:31 - machine was rebooted
ComboFix-quarantined-files.txt 2011-03-14 10:57
ComboFix2.txt 2011-03-10 10:03
.
Pre-Run: 4 778 606 592 bytes free
Post-Run: 4 669 730 816 bytes free
.
- - End Of File - - 198E924C058FC2A083D75416430F13DE
-
Rudy
- Site Admin
- Příspěvky: 119426
- Registrován: 30 říj 2003 13:42
- Bydliště: Plzeň
- Kontaktovat uživatele:
Re: Preventivka
Ještě tam vidím problém s atapi.sys. Zkuste ještě jednou spustit CF tímto skriptem:
FCopy::
c:\windows\ServicePackFiles\i386\atapi.sys | c:\windows\system32\drivers\atapi.sys
Dotazy a logy vkládejte pouze do vašich threadů. Soukromé zprávy, icq a e-maily neslouží k řešení vašich problémů.
Podpořte, prosím, naše fórum : https://platba.viry.cz/payment/.
Navštivte:
e-mail: rudy(zavináč)forum.viry.cz
Varování: Před odvirováním PC si udělejte zálohy svých důležitých dat (pošta, kontakty, dokumenty, fotografie, videa, hudba apod.). Virus mimo svých "viditelných" aktivit může poškodit systém!
Po dořešení vašeho problému bude vlákno zamknuto. Stejně tak tehdy, pokud bude nečinné více než 14dnů. Pokud budete chtít vlákno aktivovat, napište mi na mail uvedený výše.
Podpořte, prosím, naše fórum : https://platba.viry.cz/payment/.
Navštivte:
e-mail: rudy(zavináč)forum.viry.cz
Varování: Před odvirováním PC si udělejte zálohy svých důležitých dat (pošta, kontakty, dokumenty, fotografie, videa, hudba apod.). Virus mimo svých "viditelných" aktivit může poškodit systém!
Po dořešení vašeho problému bude vlákno zamknuto. Stejně tak tehdy, pokud bude nečinné více než 14dnů. Pokud budete chtít vlákno aktivovat, napište mi na mail uvedený výše.
Re: Preventivka
ComboFix 11-03-14.01 - Administrator . 03. 2011 0:14.3.2 - x86 NETWORK
Microsoft Windows XP Professional 5.1.2600.3.1250.421.1033.18.3070.2826 [GMT 1:00]
Running from: c:\documents and settings\Administrator\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Administrator\Desktop\CFScript.txt
AV: AntiVir Desktop *Enabled/Updated* {AD166499-45F9-482A-A743-FDD3350758C7}
FW: COMODO Firewall *Enabled* {043803A3-4F86-4ef6-AFC5-F6E02A79969B}
.
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
.
--------------- FCopy ---------------
.
c:\windows\ServicePackFiles\i386\atapi.sys --> c:\windows\system32\drivers\atapi.sys
.
((((((((((((((((((((((((( Files Created from 2011-02-14 to 2011-03-14 )))))))))))))))))))))))))))))))
.
.
2011-02-16 12:30 . 2011-02-16 12:30 -------- d-----w- C:\VritualRoot
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-01-06 16:37 . 2011-01-06 16:37 94784 ----a-w- c:\windows\system32\drivers\inspect.sys
2011-01-06 16:37 . 2011-01-06 16:37 27576 ----a-w- c:\windows\system32\drivers\cmdhlp.sys
2011-01-06 16:37 . 2011-01-06 16:37 239368 ----a-w- c:\windows\system32\drivers\cmdGuard.sys
2011-01-06 16:37 . 2011-01-06 16:37 15592 ----a-w- c:\windows\system32\drivers\cmderd.sys
2010-12-29 00:42 . 2010-12-29 00:42 285480 ----a-w- c:\windows\system32\guard32.dll
.
.
((((((((((((((((((((((((((((( SnapShot@2011-03-10_10.02.17 )))))))))))))))))))))))))))))))))))))))))
.
- 2004-08-04 12:00 . 2011-03-10 10:01 67312 c:\windows\system32\perfc009.dat
+ 2004-08-04 12:00 . 2011-03-14 23:15 67312 c:\windows\system32\perfc009.dat
- 2011-02-14 10:01 . 2011-03-10 09:55 16608 c:\windows\gdrv.sys
+ 2011-02-14 10:01 . 2011-03-14 23:07 16608 c:\windows\gdrv.sys
+ 2004-08-04 12:00 . 2011-03-14 23:15 432356 c:\windows\system32\perfh009.dat
- 2004-08-04 12:00 . 2011-03-10 10:01 432356 c:\windows\system32\perfh009.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDCPL"="RTHDCPL.EXE" [2009-01-13 18084864]
"ATICustomerCare"="c:\program files\ATI\ATICustomerCare\ATICustomerCare.exe" [2010-05-04 311296]
"COMODO Internet Security"="c:\program files\COMODO\COMODO Internet Security\cfp.exe" [2011-01-17 2548552]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 10.0\Reader\Reader_sl.exe" [2011-01-30 35736]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-11-15 932288]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2011-01-26 98304]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2010-12-13 281768]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\windows\system32\guard32.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpywareTerminator]
2011-02-14 10:39 2216960 ----a-w- c:\program files\Spyware Terminator\SpywareTerminatorShield.Exe
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Spyware Terminator\\SpywareTerminatorUpdate.exe"=
"c:\\Program Files\\QIP Infium\\infium.exe"=
"c:\\Program Files\\VideoLAN\\VLC\\vlc.exe"=
"d:\\Hry\\F1 2010\\F1_2010_game.exe"=
"c:\\Program Files\\Full Tilt Poker\\FullTiltPoker.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"5384:TCP"= 5384:TCP:xgkuygy
.
R0 a347bus;a347bus;c:\windows\system32\drivers\a347bus.sys [2/14/2011 12:00 PM 160640]
R0 a347scsi;a347scsi;c:\windows\system32\drivers\a347scsi.sys [2/14/2011 12:00 PM 5248]
R1 cmdHlp;COMODO Internet Security Helper Driver;c:\windows\system32\drivers\cmdhlp.sys [1/6/2011 5:37 PM 27576]
S1 cmdGuard;COMODO Internet Security Sandbox Driver;c:\windows\system32\drivers\cmdGuard.sys [1/6/2011 5:37 PM 239368]
S1 sp_rsdrv2;Spyware Terminator Driver 2;c:\windows\system32\drivers\sp_rsdrv2.sys [2/14/2011 11:39 AM 142592]
S2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [2/14/2011 11:20 AM 135336]
S2 ES lite Service;ES lite Service for program management.;c:\program files\Gigabyte\EasySaver\essvr.exe [2/14/2011 11:02 AM 68136]
.
.
------- Supplementary Scan -------
.
TCP: {4B42AF88-2D47-429C-868C-44AA57D9A44A} = 156.154.70.25,156.154.71.25
FF - ProfilePath - c:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\qdw2dwfn.default\
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-03-15 00:16
Windows 5.1.2600 Service Pack 3 NTFS
.
detected NTDLL code modification:
ZwClose, ZwOpenFile
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
scanning hidden files ...
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'winlogon.exe'(648)
c:\windows\system32\Ati2evxx.dll
c:\windows\system32\atiadlxx.dll
.
Completion time: 2011-03-15 00:17:12
ComboFix-quarantined-files.txt 2011-03-14 23:17
ComboFix2.txt 2011-03-14 10:57
ComboFix3.txt 2011-03-10 10:03
.
Pre-Run: 4 599 672 832 bytes free
Post-Run: 4 588 756 992 bytes free
.
- - End Of File - - B2A6CC9705D2A11DBA9A20022A8E7C99
Microsoft Windows XP Professional 5.1.2600.3.1250.421.1033.18.3070.2826 [GMT 1:00]
Running from: c:\documents and settings\Administrator\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Administrator\Desktop\CFScript.txt
AV: AntiVir Desktop *Enabled/Updated* {AD166499-45F9-482A-A743-FDD3350758C7}
FW: COMODO Firewall *Enabled* {043803A3-4F86-4ef6-AFC5-F6E02A79969B}
.
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
.
--------------- FCopy ---------------
.
c:\windows\ServicePackFiles\i386\atapi.sys --> c:\windows\system32\drivers\atapi.sys
.
((((((((((((((((((((((((( Files Created from 2011-02-14 to 2011-03-14 )))))))))))))))))))))))))))))))
.
.
2011-02-16 12:30 . 2011-02-16 12:30 -------- d-----w- C:\VritualRoot
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-01-06 16:37 . 2011-01-06 16:37 94784 ----a-w- c:\windows\system32\drivers\inspect.sys
2011-01-06 16:37 . 2011-01-06 16:37 27576 ----a-w- c:\windows\system32\drivers\cmdhlp.sys
2011-01-06 16:37 . 2011-01-06 16:37 239368 ----a-w- c:\windows\system32\drivers\cmdGuard.sys
2011-01-06 16:37 . 2011-01-06 16:37 15592 ----a-w- c:\windows\system32\drivers\cmderd.sys
2010-12-29 00:42 . 2010-12-29 00:42 285480 ----a-w- c:\windows\system32\guard32.dll
.
.
((((((((((((((((((((((((((((( SnapShot@2011-03-10_10.02.17 )))))))))))))))))))))))))))))))))))))))))
.
- 2004-08-04 12:00 . 2011-03-10 10:01 67312 c:\windows\system32\perfc009.dat
+ 2004-08-04 12:00 . 2011-03-14 23:15 67312 c:\windows\system32\perfc009.dat
- 2011-02-14 10:01 . 2011-03-10 09:55 16608 c:\windows\gdrv.sys
+ 2011-02-14 10:01 . 2011-03-14 23:07 16608 c:\windows\gdrv.sys
+ 2004-08-04 12:00 . 2011-03-14 23:15 432356 c:\windows\system32\perfh009.dat
- 2004-08-04 12:00 . 2011-03-10 10:01 432356 c:\windows\system32\perfh009.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDCPL"="RTHDCPL.EXE" [2009-01-13 18084864]
"ATICustomerCare"="c:\program files\ATI\ATICustomerCare\ATICustomerCare.exe" [2010-05-04 311296]
"COMODO Internet Security"="c:\program files\COMODO\COMODO Internet Security\cfp.exe" [2011-01-17 2548552]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 10.0\Reader\Reader_sl.exe" [2011-01-30 35736]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-11-15 932288]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2011-01-26 98304]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2010-12-13 281768]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\windows\system32\guard32.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpywareTerminator]
2011-02-14 10:39 2216960 ----a-w- c:\program files\Spyware Terminator\SpywareTerminatorShield.Exe
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Spyware Terminator\\SpywareTerminatorUpdate.exe"=
"c:\\Program Files\\QIP Infium\\infium.exe"=
"c:\\Program Files\\VideoLAN\\VLC\\vlc.exe"=
"d:\\Hry\\F1 2010\\F1_2010_game.exe"=
"c:\\Program Files\\Full Tilt Poker\\FullTiltPoker.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"5384:TCP"= 5384:TCP:xgkuygy
.
R0 a347bus;a347bus;c:\windows\system32\drivers\a347bus.sys [2/14/2011 12:00 PM 160640]
R0 a347scsi;a347scsi;c:\windows\system32\drivers\a347scsi.sys [2/14/2011 12:00 PM 5248]
R1 cmdHlp;COMODO Internet Security Helper Driver;c:\windows\system32\drivers\cmdhlp.sys [1/6/2011 5:37 PM 27576]
S1 cmdGuard;COMODO Internet Security Sandbox Driver;c:\windows\system32\drivers\cmdGuard.sys [1/6/2011 5:37 PM 239368]
S1 sp_rsdrv2;Spyware Terminator Driver 2;c:\windows\system32\drivers\sp_rsdrv2.sys [2/14/2011 11:39 AM 142592]
S2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [2/14/2011 11:20 AM 135336]
S2 ES lite Service;ES lite Service for program management.;c:\program files\Gigabyte\EasySaver\essvr.exe [2/14/2011 11:02 AM 68136]
.
.
------- Supplementary Scan -------
.
TCP: {4B42AF88-2D47-429C-868C-44AA57D9A44A} = 156.154.70.25,156.154.71.25
FF - ProfilePath - c:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\qdw2dwfn.default\
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-03-15 00:16
Windows 5.1.2600 Service Pack 3 NTFS
.
detected NTDLL code modification:
ZwClose, ZwOpenFile
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
scanning hidden files ...
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'winlogon.exe'(648)
c:\windows\system32\Ati2evxx.dll
c:\windows\system32\atiadlxx.dll
.
Completion time: 2011-03-15 00:17:12
ComboFix-quarantined-files.txt 2011-03-14 23:17
ComboFix2.txt 2011-03-14 10:57
ComboFix3.txt 2011-03-10 10:03
.
Pre-Run: 4 599 672 832 bytes free
Post-Run: 4 588 756 992 bytes free
.
- - End Of File - - B2A6CC9705D2A11DBA9A20022A8E7C99
-
Rudy
- Site Admin
- Příspěvky: 119426
- Registrován: 30 říj 2003 13:42
- Bydliště: Plzeň
- Kontaktovat uživatele:
Re: Preventivka
Už se zadařilo. Log již vypadá OK.
Dotazy a logy vkládejte pouze do vašich threadů. Soukromé zprávy, icq a e-maily neslouží k řešení vašich problémů.
Podpořte, prosím, naše fórum : https://platba.viry.cz/payment/.
Navštivte:
e-mail: rudy(zavináč)forum.viry.cz
Varování: Před odvirováním PC si udělejte zálohy svých důležitých dat (pošta, kontakty, dokumenty, fotografie, videa, hudba apod.). Virus mimo svých "viditelných" aktivit může poškodit systém!
Po dořešení vašeho problému bude vlákno zamknuto. Stejně tak tehdy, pokud bude nečinné více než 14dnů. Pokud budete chtít vlákno aktivovat, napište mi na mail uvedený výše.
Podpořte, prosím, naše fórum : https://platba.viry.cz/payment/.
Navštivte:
e-mail: rudy(zavináč)forum.viry.cz
Varování: Před odvirováním PC si udělejte zálohy svých důležitých dat (pošta, kontakty, dokumenty, fotografie, videa, hudba apod.). Virus mimo svých "viditelných" aktivit může poškodit systém!
Po dořešení vašeho problému bude vlákno zamknuto. Stejně tak tehdy, pokud bude nečinné více než 14dnů. Pokud budete chtít vlákno aktivovat, napište mi na mail uvedený výše.
-
Rudy
- Site Admin
- Příspěvky: 119426
- Registrován: 30 říj 2003 13:42
- Bydliště: Plzeň
- Kontaktovat uživatele:
Re: Preventivka
Nemáte zač!
Dotazy a logy vkládejte pouze do vašich threadů. Soukromé zprávy, icq a e-maily neslouží k řešení vašich problémů.
Podpořte, prosím, naše fórum : https://platba.viry.cz/payment/.
Navštivte:
e-mail: rudy(zavináč)forum.viry.cz
Varování: Před odvirováním PC si udělejte zálohy svých důležitých dat (pošta, kontakty, dokumenty, fotografie, videa, hudba apod.). Virus mimo svých "viditelných" aktivit může poškodit systém!
Po dořešení vašeho problému bude vlákno zamknuto. Stejně tak tehdy, pokud bude nečinné více než 14dnů. Pokud budete chtít vlákno aktivovat, napište mi na mail uvedený výše.
Podpořte, prosím, naše fórum : https://platba.viry.cz/payment/.
Navštivte:
e-mail: rudy(zavináč)forum.viry.cz
Varování: Před odvirováním PC si udělejte zálohy svých důležitých dat (pošta, kontakty, dokumenty, fotografie, videa, hudba apod.). Virus mimo svých "viditelných" aktivit může poškodit systém!
Po dořešení vašeho problému bude vlákno zamknuto. Stejně tak tehdy, pokud bude nečinné více než 14dnů. Pokud budete chtít vlákno aktivovat, napište mi na mail uvedený výše.
Přispějete na provoz fóra?