neviem co s tym,prosim pomozte

Zpráva

ringov · #1 Příspěvek od **ringov** » 08 dub 2011 11:17

prosim pomozte asi mam virus neviem, som laik .info.txt logfile of random's system information tool 1.08 2011-04-08 12:06:49

======Uninstall list======

-->C:\WINDOWS\IsUninst.exe -f"C:\Program Files\S3\P4M266\P4M266.isu"
-->rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf
3GP Video Converter 3-->D:\My Download Files\Nová složka\ImTOO 3GP Video Converter\3GP Video Converter 3\Uninstall.exe
7-Zip 4.65-->"C:\Program Files\7-Zip\Uninstall.exe"
Adobe Anchor Service CS3-->MsiExec.exe /I{90176341-0A8B-4CCC-A78D-F862228A6B95}
Adobe Asset Services CS3-->MsiExec.exe /I{6FF5DD7A-FE28-4439-B8CF-1E9AF4EA0A61}
Adobe Bridge CS3-->MsiExec.exe /I{9C9824D9-9000-4373-A6A5-D0E5D4831394}
Adobe Bridge Start Meeting-->MsiExec.exe /I{08B32819-6EEF-4057-AEDA-5AB681A36A23}
Adobe Camera Raw 4.0-->MsiExec.exe /I{B3BF6689-A81D-40D8-9A86-4AC4ACD9FC1C}
Adobe CMaps-->MsiExec.exe /I{A2B242BD-FF8D-4840-9DAA-9170EABEC59C}
Adobe Color Common Settings-->MsiExec.exe /I{DADD7B8A-BCB0-44F5-967A-ECB6B4F2ECD9}
Adobe Color EU Extra Settings-->MsiExec.exe /I{51846830-E7B2-4218-8968-B77F0FF475B8}
Adobe Color JA Extra Settings-->MsiExec.exe /I{DD7DB3C5-6FA3-4FA3-8A71-C2F2940EB029}
Adobe Color NA Recommended Settings-->MsiExec.exe /I{95655ED4-7CA5-46DF-907F-7144877A32E5}
Adobe Device Central CS3-->MsiExec.exe /I{8D2BA474-F406-4710-9AE4-D4F22D21F0DD}
Adobe ExtendScript Toolkit 2-->MsiExec.exe /I{C2D69781-F392-4118-A5A7-C7E9C38DBFC2}
Adobe Flash CS3 Professional-->C:\Program Files\Common Files\Adobe\Installers\c3c7fe8b09d497ab2b3fd91c9353390\Setup.exe
Adobe Flash CS3-->MsiExec.exe /I{6B52140A-F189-4945-BFFC-DB3F00B8C589}
Adobe Flash Player 10 ActiveX-->C:\WINDOWS\system32\Macromed\Flash\FlashUtil10o_ActiveX.exe -maintain activex
Adobe Flash Player 10 Plugin-->C:\WINDOWS\system32\Macromed\Flash\FlashUtil10o_Plugin.exe -maintain plugin
Adobe Flash Video Encoder-->MsiExec.exe /I{2EFFFC71-1E66-454E-A6E6-CEEC800B96D2}
Adobe Help Viewer CS3-->MsiExec.exe /I{04AF207D-9A77-465A-8B76-991F6AB66245}
Adobe Linguistics CS3-->MsiExec.exe /I{54793AA1-5001-42F4-ABB6-C364617C6078}
Adobe PDF Library Files-->MsiExec.exe /I{D2559B88-CC9D-4B48-81BB-F492BAA9C48C}
Adobe Reader 7.0 - Czech-->MsiExec.exe /I{AC76BA86-7AD7-1029-7B44-A70000000000}
Adobe Setup-->MsiExec.exe /I{FFC1ADE3-944B-4231-894E-3903C37271D2}
Adobe Type Support-->MsiExec.exe /I{8E6808E2-613D-4FCD-81A2-6C8FA8E03312}
Adobe Update Manager CS3-->MsiExec.exe /I{E69AE897-9E0B-485C-8552-7841F48D42D8}
Adobe Version Cue CS3 Client-->MsiExec.exe /I{D0DFF92A-492E-4C40-B862-A74A173C25C5}
Adobe WinSoft Linguistics Plugin-->MsiExec.exe /I{184CE391-7E0E-4C63-9935-D7A10EDFD3C6}
ArcSoft VideoImpression 2-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{244E21B9-164C-4EC1-AED8-9BD64161E66D}\setup.exe" -l0x9
Crawler Toolbar with Web Security Guard-->C:\PROGRA~1\Crawler\Toolbar\CToolbar.exe uninst
hp deskjet 656c series (Remove only)-->C:\Program Files\hp deskjet 656c series\hpfiui.exe -c -vdivid=HPF -vpnum=89 -vinstport=USB001 -vproduct=656c -huninstall
Java(TM) 6 Update 24-->MsiExec.exe /X{26A24AE4-039D-4CA4-87B4-2F83216024FF}
Microsoft .NET Framework 2.0 Client Service Pack 2-->MsiExec.exe /I{CAAFB8F9-F8D1-3D27-9AAA-6301A4429440}
Microsoft .NET Framework 3.0 Client Service Pack 2-->MsiExec.exe /I{1185566F-12ED-3EF0-89CC-38866DCE1EEE}
Microsoft .NET Framework 3.5 Client Service Pack 1-->MsiExec.exe /I{D617A4DC-C915-3F25-BE43-57E5FD99B441}
Microsoft .NET Framework Client Profile-->C:\AHCache\All Users\Microsoft.Net.Client.3.5\setup.exe /remove "Microsoft.Net.Client.3.5"
Microsoft Kernel-Mode Driver Framework Feature Pack 1.9-->"C:\WINDOWS\$NtUninstallWdf01009$\spuninst\spuninst.exe"
Microsoft Office XP Professional-->MsiExec.exe /I{9211041B-6000-11D3-8CFE-0050048383C9}
Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{837b34e3-7c30-493c-8f6a-2b0f04e2912c}
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17-->MsiExec.exe /X{9A25302D-30C0-39D9-BD6F-21E6EC160475}
Mozilla Firefox 4.0 (x86 sk)-->C:\Program Files\Mozilla Firefox\uninstall\helper.exe
NAVIGON Fresh 3.2.0-->C:\Program Files\NAVIGON\NAVIGON Fresh\uninst.exe
PDF Settings-->MsiExec.exe /I{AC5B0C19-D851-42F4-BDA0-410ECF7F70A5}
Realtek AC'97 Audio-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{FB08F381-6533-4108-B7DD-039E11FBC27E}\setup.exe" -l0x9 -removeonly
SearchPredict-->"C:\Program Files\SearchPredict\SPRemove.exe" temp
Skype™ 4.2-->MsiExec.exe /X{D103C4BA-F905-437A-8049-DB24763BBE36}
Spyware Terminator-->"C:\Program Files\Spyware Terminator\unins000.exe"
System Protect-->"C:\Program Files\System Protect\unins000.exe"
Trust Photo Tools-->MsiExec.exe /I{84975365-177A-42EB-A265-9C9B6DB1FEA1}
Trust WB-1400T Webcam-->C:\PROGRA~1\COMMON~1\INSTAL~1\Driver\9\INTEL3~1\IDriver.exe /M{30837A37-8F9F-4817-8B52-C501B67DC3BE} /l1033
Windows Imaging Component-->"C:\WINDOWS\$NtUninstallWIC$\spuninst\spuninst.exe"
Windows Installer 3.1 (KB893803)-->"C:\WINDOWS\$MSI31Uninstall_KB893803v2$\spuninst\spuninst.exe"
Windows Internet Explorer 8-->"C:\WINDOWS\ie8\spuninst\spuninst.exe"
Windows Media Format 11 runtime-->"C:\Program Files\Windows Media Player\wmsetsdk.exe" /UninstallAll
Windows Media Format 11 runtime-->"C:\WINDOWS\$NtUninstallWMFDist11$\spuninst\spuninst.exe"
Windows Media Player 11-->"C:\Program Files\Windows Media Player\Setup_wm.exe" /Uninstall
Windows Media Player 11-->"C:\WINDOWS\$NtUninstallwmp11$\spuninst\spuninst.exe"
WinRAR-->C:\Program Files\WinRAR\uninstall.exe

======Security center information======

AV: Spyware Terminator

======System event log======

Computer Name: TEREZIA
Event Code: 7023
Message: Služba Prohledávání počítačů byla ukončena s následující chybou:
Daná operace se vrátila, protože vypršel časový limit.

Record Number: 14977
Source Name: Service Control Manager
Time Written: 20110302073124.000000+060
Event Type: error
User:

Computer Name: TEREZIA
Event Code: 15005
Message: Nelze vytvořit vazbu k základnímu přenosu pro 0.0.0.0:2869. Seznam protokolu IP jen pro naslouchání (Listen-Only) pravděpodobně obsahuje odkaz na rozhraní, které v tomto počítači nemusí existovat. Číslo chyby se nachází v poli s daty.

Record Number: 14972
Source Name: HTTP
Time Written: 20110302072650.000000+060
Event Type: error
User:

Computer Name: TEREZIA
Event Code: 15005
Message: Nelze vytvořit vazbu k základnímu přenosu pro 0.0.0.0:2869. Seznam protokolu IP jen pro naslouchání (Listen-Only) pravděpodobně obsahuje odkaz na rozhraní, které v tomto počítači nemusí existovat. Číslo chyby se nachází v poli s daty.

Record Number: 14970
Source Name: HTTP
Time Written: 20110302072650.000000+060
Event Type: error
User:

Computer Name: TEREZIA
Event Code: 7026
Message: Zavedení následujícího ovladače pro spouštění počítače nebo systému se nezdařilo:
SASDIFSV
SASKUTIL

Record Number: 14950
Source Name: Service Control Manager
Time Written: 20110302072642.000000+060
Event Type: error
User:

Computer Name: TEREZIA
Event Code: 7009
Message: Vypršel časový limit (30000 milisekund) čekání na připojení služby AMService.

Record Number: 14948
Source Name: Service Control Manager
Time Written: 20110302072642.000000+060
Event Type: error
User:

=====Application event log=====

Computer Name: TEREZIA
Event Code: 8
Message: Načtení automatické aktualizace pořadového čísla kořenového seznamu jiného výrobce z: <http://www.download.windowsupdate.com/m ... ootseq.txt> se nezdařilo. Chyba: Takové síťové připojení neexistuje.

Record Number: 3239
Source Name: crypt32
Time Written: 20101018201437.000000+120
Event Type: error
User:

Computer Name: TEREZIA
Event Code: 11
Message: Extrakce kořenového seznamu jiného výrobce ze souboru CAB pro automatickou aktualizaci v: <http://www.download.windowsupdate.com/m ... ootstl.cab> se nezdařilo. Chyba: Při ověření se systémovými hodinami nebo časovým razítkem podepsaného souboru bylo zjištěno, že požadovaný certifikát je mimo lhůtu platnosti.

Record Number: 3238
Source Name: crypt32
Time Written: 20101018201437.000000+120
Event Type: error
User:

Computer Name: TEREZIA
Event Code: 8
Message: Načtení automatické aktualizace pořadového čísla kořenového seznamu jiného výrobce z: <http://www.download.windowsupdate.com/m ... ootseq.txt> se nezdařilo. Chyba: Spojení se serverem bylo nenormálně ukončeno.

Record Number: 3237
Source Name: crypt32
Time Written: 20101018201437.000000+120
Event Type: error
User:

Computer Name: TEREZIA
Event Code: 11
Message: Extrakce kořenového seznamu jiného výrobce ze souboru CAB pro automatickou aktualizaci v: <http://www.download.windowsupdate.com/m ... ootstl.cab> se nezdařilo. Chyba: Při ověření se systémovými hodinami nebo časovým razítkem podepsaného souboru bylo zjištěno, že požadovaný certifikát je mimo lhůtu platnosti.

Record Number: 3236
Source Name: crypt32
Time Written: 20101018201437.000000+120
Event Type: error
User:

Computer Name: TEREZIA
Event Code: 11
Message: Extrakce kořenového seznamu jiného výrobce ze souboru CAB pro automatickou aktualizaci v: <http://www.download.windowsupdate.com/m ... ootstl.cab> se nezdařilo. Chyba: Při ověření se systémovými hodinami nebo časovým razítkem podepsaného souboru bylo zjištěno, že požadovaný certifikát je mimo lhůtu platnosti.

Record Number: 3235
Source Name: crypt32
Time Written: 20101018201437.000000+120
Event Type: error
User:

======Environment variables======

"ComSpec"=%SystemRoot%\system32\cmd.exe
"Path"=%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\system32\wbem;C:\Program Files\PC Connectivity Solution
"windir"=%SystemRoot%
"OS"=Windows_NT
"PROCESSOR_ARCHITECTURE"=x86
"PROCESSOR_LEVEL"=6
"PROCESSOR_IDENTIFIER"=x86 Family 6 Model 3 Stepping 1, AuthenticAMD
"PROCESSOR_REVISION"=0301
"NUMBER_OF_PROCESSORS"=1
"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
"TEMP"=%SystemRoot%\TEMP
"TMP"=%SystemRoot%\TEMP
"FP_NO_HOST_CHECK"=NO

-----------------EOF-----------------
Logfile of random's system information tool 1.08 (written by random/random)
Run by Administrator at 2011-04-08 12:05:11
Systém Microsoft Windows XP Professional Service Pack 2
System drive C: has 2 GB (29%) free of 8 GB
Total RAM: 511 MB (43% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 12:06, on 8.4.2011
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Spyware Terminator\sp_rsser.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Spyware Terminator\SpywareTerminator.exe
C:\Program Files\System Protect\SysProtect_srv.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\PROGRA~1\Crawler\Toolbar\CToolbar.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
E:\RSIT.exe
C:\Program Files\trend micro\Administrator.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://pobox.sk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://www.crawler.com/search/ie.aspx?tb_id=60327
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,CustomizeSearch = http://dnl.crawler.com/support/sa_custo ... TbId=60327
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
R3 - URLSearchHook: &Crawler Toolbar Helper - {1CB20BF0-BBAE-40A7-93F4-6435FF3D0411} - C:\PROGRA~1\Crawler\Toolbar\ctbr.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: &Crawler Toolbar Helper - {1CB20BF0-BBAE-40A7-93F4-6435FF3D0411} - C:\PROGRA~1\Crawler\Toolbar\ctbr.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: &Crawler Toolbar - {4B3803EA-5230-4DC3-A7FC-33638F3D3542} - C:\PROGRA~1\Crawler\Toolbar\ctbr.dll
O4 - HKLM\..\Run: [SpywareTerminator] "C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: Add to AMV Convert Tool... - C:\Program Files\MP3 Player Utilities 4.00\AMVConverter\grab.html
O8 - Extra context menu item: Crawler Search - tbr:iemenu
O8 - Extra context menu item: Download with Star Downloader - E:\My Download Files\ACCELELATOR PLUS\Star Downloader\sdie.htm
O8 - Extra context menu item: E&xportovať do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: MediaManager tool grab multimedia file - C:\Program Files\MP3 Player Utilities 4.00\MediaManager\grab.html
O9 - Extra button: (no name) - AutorunsDisabled - (no file)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Protocol: tbr - {4D25FB7A-8902-4291-960E-9ADA051CFBBF} - C:\PROGRA~1\Crawler\Toolbar\ctbr.dll
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll
O22 - SharedTaskScheduler: Proces mezipaměti kategorií součástí - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll
O23 - Service: AMService - Unknown owner - C:\WINDOWS\TEMP\gerx\setup.exe (file missing)
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Secunia Update Agent - Unknown owner - C:\Program Files\Secunia\PSI\sua.exe (file missing)
O23 - Service: ServiceLayer - Unknown owner - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe (file missing)
O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - C:\Program Files\Spyware Terminator\sp_rsser.exe
O23 - Service: System Protect Deletion Prevention Service (SP_Service) - Xacti Corporation - C:\Program Files\System Protect\SysProtect_srv.exe

--
End of file - 5770 bytes

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
AcroIEHlprObj Class - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll [2004-12-14 63136]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1CB20BF0-BBAE-40A7-93F4-6435FF3D0411}]
&Crawler Toolbar Helper - C:\PROGRA~1\Crawler\Toolbar\ctbr.dll [2011-04-05 1232520]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2011-04-05 41760]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2011-04-05 79648]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{4B3803EA-5230-4DC3-A7FC-33638F3D3542} - &Crawler Toolbar - C:\PROGRA~1\Crawler\Toolbar\ctbr.dll [2011-04-05 1232520]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"SpywareTerminator"=C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe [2011-04-05 2216960]
"SunJavaUpdateSched"=C:\Program Files\Common Files\Java\Java Update\jusched.exe [2010-10-29 249064]
"SoundMan"=C:\WINDOWS\SOUNDMAN.EXE [2006-11-17 577536]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe [2004-08-17 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=323
"NoDriveAutoRun"=67108863
"NoDrives"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveAutoRun"=67108863
"NoDriveTypeAutoRun"=323
"NoDrives"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\Bonjour\mDNSResponder.exe"="C:\Program Files\Bonjour\mDNSResponder.exe:*:Enabled:Bonjour"
"C:\Program Files\Spyware Terminator\SpywareTerminatorUpdate.exe"="C:\Program Files\Spyware Terminator\SpywareTerminatorUpdate.exe:*:Enabled:Crawler Spyware Terminator"
"D:\hry\Nová složka (2)\age2_x1.exe"="D:\hry\Nová složka (2)\age2_x1.exe:*:Enabled:Age of Empires II Expansion"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

======List of files/folders created in the last 1 months======

2011-04-08 12:05:11 ----D---- C:\rsit
2011-04-08 10:50:47 ----A---- C:\WINDOWS\system32\drivers\sp_prot.sys
2011-04-08 10:50:41 ----D---- C:\Program Files\System Protect
2011-04-08 10:04:50 ----A---- C:\WINDOWS\system32\ChCfg.exe
2011-04-08 10:04:25 ----RA---- C:\WINDOWS\system32\drivers\alcxwdm.sys
2011-04-08 10:03:43 ----D---- C:\Program Files\Realtek AC97
2011-04-08 10:03:41 ----A---- C:\WINDOWS\system32\RTLCPL.exe
2011-04-08 10:03:37 ----A---- C:\WINDOWS\soundman.exe
2011-04-08 10:03:36 ----A---- C:\WINDOWS\system32\RtlCPAPI.dll
2011-04-08 10:03:32 ----A---- C:\WINDOWS\alcupd.exe
2011-04-08 10:03:32 ----A---- C:\WINDOWS\Alcrmv.exe
2011-04-07 12:37:38 ----SHD---- C:\RECYCLER
2011-04-07 12:33:14 ----A---- C:\ComboFix.txt
2011-04-07 11:48:26 ----D---- C:\Program Files\trend micro
2011-04-06 16:53:19 ----N---- C:\WINDOWS\cmaudio.ini
2011-04-06 16:53:19 ----D---- C:\Program Files\C-Media
2011-04-06 15:48:38 ----A---- C:\WINDOWS\system32\uxtuneup.dll
2011-04-06 15:24:35 ----ASH---- C:\pagefile.sys
2011-04-06 14:39:17 ----D---- C:\WINDOWS\temp
2011-04-06 08:49:29 ----SHD---- C:\Documents and Settings\All Users\Data aplikací\{24036256-BFDB-4CD3-BE8A-A3D6160F2E16}
2011-04-06 00:18:44 ----A---- C:\WINDOWS\system32\KillBox.exe
2011-04-06 00:05:19 ----D---- C:\Program Files\WinClamAVShield
2011-04-05 23:13:55 ----D---- C:\Program Files\Common Files\Java
2011-04-05 23:13:06 ----A---- C:\WINDOWS\system32\javaws.exe
2011-04-05 23:13:06 ----A---- C:\WINDOWS\system32\javaw.exe
2011-04-05 23:13:06 ----A---- C:\WINDOWS\system32\java.exe
2011-04-05 23:00:08 ----D---- C:\Program Files\Crawler
2011-04-05 22:59:59 ----A---- C:\WINDOWS\system32\drivers\sp_rsdrv2.sys
2011-04-05 22:59:57 ----D---- C:\Documents and Settings\Administrator\Data aplikací\Spyware Terminator
2011-04-05 22:59:45 ----D---- C:\Documents and Settings\All Users\Data aplikací\Spyware Terminator
2011-04-05 22:59:42 ----D---- C:\Program Files\Spyware Terminator
2011-04-05 22:50:52 ----D---- C:\Program Files\Secunia
2011-04-05 21:30:29 ----D---- C:\WINDOWS\WBEM
2011-04-05 21:28:55 ----HDC---- C:\WINDOWS\ie8
2011-04-05 21:28:55 ----D---- C:\WINDOWS\system32\cs-CZ
2011-04-04 17:15:57 ----HD---- C:\Program Files\WindowsUpdate
2011-04-04 15:56:13 ----D---- C:\WINDOWS\system32\SoftwareDistribution
2011-04-04 15:34:35 ----A---- C:\Boot.bak
2011-04-04 15:34:26 ----RASHD---- C:\cmdcons
2011-04-04 15:29:48 ----A---- C:\WINDOWS\zip.exe
2011-04-04 15:29:48 ----A---- C:\WINDOWS\SWXCACLS.exe
2011-04-04 15:29:48 ----A---- C:\WINDOWS\SWSC.exe
2011-04-04 15:29:48 ----A---- C:\WINDOWS\SWREG.exe
2011-04-04 15:29:48 ----A---- C:\WINDOWS\sed.exe
2011-04-04 15:29:48 ----A---- C:\WINDOWS\PEV.exe
2011-04-04 15:29:48 ----A---- C:\WINDOWS\NIRCMD.exe
2011-04-04 15:29:48 ----A---- C:\WINDOWS\MBR.exe
2011-04-04 15:29:48 ----A---- C:\WINDOWS\grep.exe
2011-04-04 15:29:15 ----D---- C:\WINDOWS\ERDNT
2011-04-04 15:28:09 ----D---- C:\Qoobox
2011-04-04 13:46:48 ----D---- C:\Program Files\ESET
2011-04-03 10:36:56 ----A---- C:\AILog.txt
2011-04-01 10:37:23 ----A---- C:\WINDOWS\WEBTRANS.INI
2011-04-01 10:36:28 ----A---- C:\WINDOWS\WEBWTR.INI
2011-04-01 10:36:15 ----D---- C:\WINDOWS\XXLGS

======List of files/folders modified in the last 1 months======

2011-04-08 10:50:47 ----D---- C:\WINDOWS\system32\drivers
2011-04-08 10:50:41 ----RD---- C:\Program Files
2011-04-08 10:06:48 ----D---- C:\WINDOWS
2011-04-08 10:05:22 ----A---- C:\WINDOWS\SchedLgU.Txt
2011-04-08 10:04:51 ----D---- C:\WINDOWS\system32
2011-04-08 10:04:31 ----RSHDC---- C:\WINDOWS\system32\dllcache
2011-04-08 10:04:16 ----HD---- C:\WINDOWS\inf
2011-04-08 10:03:31 ----HD---- C:\Program Files\InstallShield Installation Information
2011-04-08 10:02:59 ----D---- C:\Program Files\Common Files\InstallShield
2011-04-08 09:48:52 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2011-04-08 09:36:01 ----D---- C:\WINDOWS\system32\CatRoot2
2011-04-08 09:24:40 ----D---- C:\WINDOWS\SoftwareDistribution
2011-04-07 12:29:31 ----A---- C:\WINDOWS\system.ini
2011-04-07 12:24:55 ----D---- C:\WINDOWS\AppPatch
2011-04-07 12:24:50 ----D---- C:\Program Files\Common Files
2011-04-07 09:19:03 ----D---- C:\WINDOWS\system32\drivers\etc
2011-04-06 16:54:37 ----D---- C:\Config.Msi
2011-04-06 16:54:32 ----SHD---- C:\WINDOWS\Installer
2011-04-06 15:37:28 ----RASH---- C:\boot.ini
2011-04-06 15:37:28 ----A---- C:\WINDOWS\win.ini
2011-04-06 15:27:48 ----D---- C:\WINDOWS\system32\config
2011-04-06 15:07:19 ----D---- C:\WINDOWS\pss
2011-04-06 14:26:04 ----SHD---- C:\System Volume Information
2011-04-06 14:26:04 ----D---- C:\WINDOWS\system32\Restore
2011-04-06 13:06:38 ----D---- C:\Program Files\SearchPredict
2011-04-06 09:07:30 ----D---- C:\Documents and Settings\All Users\Data aplikací\TuneUp Software
2011-04-06 08:58:39 ----D---- C:\ProgramData
2011-04-06 08:55:12 ----D---- C:\Documents and Settings\Administrator\Data aplikací\TuneUp Software
2011-04-06 08:17:50 ----D---- C:\Documents and Settings
2011-04-06 00:19:49 ----SD---- C:\WINDOWS\Tasks
2011-04-05 23:11:04 ----A---- C:\WINDOWS\system32\deployJava1.dll
2011-04-05 21:52:02 ----D---- C:\Program Files\Mozilla Firefox
2011-04-05 21:32:51 ----D---- C:\WINDOWS\Help
2011-04-05 21:32:51 ----D---- C:\Program Files\Internet Explorer
2011-04-05 21:31:02 ----A---- C:\WINDOWS\imsins.BAK
2011-04-05 21:30:19 ----D---- C:\WINDOWS\Media
2011-04-04 15:29:56 ----D---- C:\WINDOWS\Prefetch
2011-04-03 09:13:20 ----D---- C:\WINDOWS\Minidump
2011-03-28 22:12:08 ----D---- C:\Documents and Settings\Administrator\Data aplikací\Skype
2011-03-28 21:13:19 ----D---- C:\Documents and Settings\Administrator\Data aplikací\skypePM

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 PxHelp20;PxHelp20; C:\WINDOWS\System32\Drivers\PxHelp20.sys [2007-03-08 43528]
R0 sisagp;Filtr SIS sběrnice AGP ; C:\WINDOWS\System32\DRIVERS\sisagp.sys [2004-08-03 41088]
R0 WudfPf;Windows Driver Foundation - User-mode Driver Framework Platform Driver; C:\WINDOWS\system32\DRIVERS\WudfPf.sys [2006-09-28 77568]
R1 sp_rsdrv2;Spyware Terminator Driver 2; \??\C:\WINDOWS\system32\drivers\sp_rsdrv2.sys []
R2 Fallback;Fallback; C:\WINDOWS\System32\DRIVERS\HSF_FALL.sys [2001-08-17 289887]
R2 Fsks;Fsks; C:\WINDOWS\System32\DRIVERS\HSF_FSKS.sys [2001-08-17 115807]
R2 K56;K56; C:\WINDOWS\System32\DRIVERS\HSF_K56K.sys [2001-08-17 391199]
R2 mdmxsdk;mdmxsdk; C:\WINDOWS\System32\DRIVERS\mdmxsdk.sys [2004-08-03 11868]
R2 SoftFax;SoftFax; C:\WINDOWS\System32\DRIVERS\HSF_FAXX.sys [2001-08-17 199711]
R2 SpeakerPhone;SpeakerPhone; C:\WINDOWS\System32\DRIVERS\HSF_SPKP.sys [2001-08-17 73279]
R2 Tones;Tones; C:\WINDOWS\System32\DRIVERS\HSF_TONE.sys [2001-08-17 50751]
R2 V124;V124; C:\WINDOWS\System32\DRIVERS\HSF_V124.sys [2001-08-17 488383]
R3 Afc;PPdus ASPI Shell; C:\WINDOWS\system32\drivers\Afc.sys [2005-02-23 11776]
R3 ALCXWDM;Service for Realtek AC97 Audio (WDM); C:\WINDOWS\system32\drivers\ALCXWDM.SYS [2006-12-29 4026112]
R3 basic2;basic2; C:\WINDOWS\System32\DRIVERS\HSF_BSC2.sys [2001-08-17 67167]
R3 hsf_msft;hsf_msft; C:\WINDOWS\System32\DRIVERS\HSF_MSFT.sys [2001-08-17 542879]
R3 PAC207;Trust WB-1400T Webcam; C:\WINDOWS\system32\DRIVERS\PFC027.SYS [2007-05-14 508288]
R3 Rksample;Rksample; C:\WINDOWS\System32\DRIVERS\HSF_SAMP.sys [2001-08-17 57471]
R3 rtl8139;Realtek RTL8139(A/B/C)-based PCI Fast Ethernet Adapter NT Driver; C:\WINDOWS\System32\DRIVERS\RTL8139.SYS [2004-08-03 20992]
R3 S3SAVAGE4M;S3SAVAGE4M; C:\WINDOWS\System32\DRIVERS\s3sav4m.sys [2001-08-17 77824]
R3 sp_prot;System Protect Filter Driver; \??\C:\WINDOWS\system32\drivers\sp_prot.sys []
S0 mfemhvrxogcp;mfemhvrxogcp; C:\WINDOWS\system32\drivers\mfemhvrxogcp.sys []
S1 SASDIFSV;SASDIFSV; \??\E:\My Download Files\antispywer\SASDIFSV.SYS []
S1 SASKUTIL;SASKUTIL; \??\E:\My Download Files\antispywer\SASKUTIL.sys []
S1 zmcadvafppwy5;zmcadvafppwy5; C:\WINDOWS\system32\drivers\zmcadvafppwy5.sys []
S3 ALCXSENS;Service for WDM 3D Audio Driver; C:\WINDOWS\system32\drivers\ALCXSENS.SYS []
S3 AmdLLD;AMD Low Level Device Driver; C:\WINDOWS\system32\DRIVERS\AmdLLD.sys []
S3 ATE_PROCMON;ATE_PROCMON; \??\D:\My Download Files\trojan\Anti Trojan Elite\ATEPMon.sys []
S3 catchme;catchme; \??\C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\catchme.sys []
S3 CCDECODE;Dekodér Closed Caption; C:\WINDOWS\system32\DRIVERS\CCDECODE.sys [2004-08-03 17024]
S3 GMSIPCI;GMSIPCI; \??\F:\INSTALL\GMSIPCI.SYS []
S3 HSF_DP;HSF_DP; C:\WINDOWS\System32\DRIVERS\HSFDPSP2.sys [2004-08-03 1041536]
S3 HSFHWBS2;HSFHWBS2; C:\WINDOWS\System32\DRIVERS\HSFBS2S2.sys [2004-08-03 220032]
S3 MODEMCSA;Unimodem Streaming Filter Device; C:\WINDOWS\system32\drivers\MODEMCSA.sys [2001-08-17 16128]
S3 ms_mpu401;Microsoft MPU-401 MIDI UART Driver; C:\WINDOWS\system32\drivers\msmpu401.sys [2001-08-18 2944]
S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink Converter; C:\WINDOWS\system32\drivers\MSTEE.sys [2004-08-03 5504]
S3 NABTSFEC;NABTS/FEC VBI Codec; C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys [2004-08-03 85376]
S3 NdisIP;Microsoft TV/Video Connection; C:\WINDOWS\system32\DRIVERS\NdisIP.sys [2004-08-03 10880]
S3 NTACCESS;NTACCESS; \??\F:\NTACCESS.sys []
S3 pccsmcfd;PCCS Mode Change Filter Driver; C:\WINDOWS\system32\DRIVERS\pccsmcfd.sys []
S3 SASENUM;SASENUM; \??\E:\My Download Files\antispywer\SASENUM.SYS []
S3 SetupNTGLM7X;SetupNTGLM7X; \??\F:\NTGLM7X.sys []
S3 SLIP;BDA Slip De-Framer; C:\WINDOWS\system32\DRIVERS\SLIP.sys [2004-08-03 11136]
S3 streamip;BDA IPSink; C:\WINDOWS\system32\DRIVERS\StreamIP.sys [2004-08-03 15360]
S3 usbprint;Třída USB Printer; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2004-08-03 25856]
S3 USBSTOR;Ovladač velkokapacitního paměťového zařízení USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 26496]
S3 WpdUsb;WpdUsb; C:\WINDOWS\System32\Drivers\wpdusb.sys [2006-10-18 38528]
S3 WSTCODEC;Dálnopisný kodek světového standardu; C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS [2004-08-03 19328]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-28 82944]
S4 WS2IFSL;Podpůrné prostředí zprostředkovatele služeb Windows Socket 2.0 bez podpory IFS; C:\WINDOWS\System32\drivers\ws2ifsl.sys [2001-10-25 12032]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 Bonjour Service;##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762##; C:\Program Files\Bonjour\mDNSResponder.exe [2006-02-28 229376]
R2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2011-04-05 153376]
R2 sp_rssrv;Spyware Terminator Realtime Shield Service; C:\Program Files\Spyware Terminator\sp_rsser.exe [2011-04-05 496128]
R2 SP_Service;System Protect Deletion Prevention Service; C:\Program Files\System Protect\SysProtect_srv.exe [2011-04-08 598528]
R2 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2004-08-17 14336]
S2 AMService;AMService; C:\WINDOWS\TEMP\gerx\setup.exe run []
S2 Secunia Update Agent;Secunia Update Agent; C:\Program Files\Secunia\PSI\sua.exe --start-service []
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-30 69632]
S3 FLEXnet Licensing Service;FLEXnet Licensing Service; C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe [2010-09-26 654848]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; C:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104]
S3 ServiceLayer;ServiceLayer; C:\Program Files\PC Connectivity Solution\ServiceLayer.exe []
S3 WMPNetworkSvc;Služba Windows Media Player Network Sharing; C:\Program Files\Windows Media Player\WMPNetwk.exe [2007-01-05 913920]

-----------------EOF-----------------

#2 Příspěvek od **motji** » 08 dub 2011 15:12

Hezké odpoledne

Co jste dělal s Kilboxem?
Poprosím o tento log C:\ComboFix.txt

ringov · #3 Příspěvek od **ringov** » 08 dub 2011 23:48

ComboFix 11-04-06.03 - Administrator 07.04.2011 12:20:34.6.1 - x86
Systém Microsoft Windows XP Professional 5.1.2600.2.1250.421.1029.18.511.219 [GMT 2:00]
Running from: c:\documents and settings\Administrator\Plocha\ComboFix.exe
.
.
((((((((((((((((((((((((( Files Created from 2011-03-07 to 2011-04-07 )))))))))))))))))))))))))))))))
.
.
2011-04-07 09:48 . 2011-04-07 09:48 -------- d-----w- c:\program files\trend micro
2011-04-07 09:48 . 2011-04-07 09:48 -------- d-----w- C:\rsit
2011-04-06 14:53 . 2011-04-06 14:53 -------- d-----w- c:\program files\C-Media
2011-04-06 14:05 . 2011-04-06 14:05 -------- d-sh--w- c:\documents and settings\NetworkService\IETldCache
2011-04-06 13:48 . 2010-12-14 12:39 29504 ----a-w- c:\windows\system32\uxtuneup.dll
2011-04-06 07:08 . 2011-04-06 07:08 -------- d-sh--w- c:\documents and settings\LocalService\IETldCache
2011-04-06 06:49 . 2011-04-06 06:49 -------- d-sh--w- c:\documents and settings\All Users\Data aplikací\{24036256-BFDB-4CD3-BE8A-A3D6160F2E16}
2011-04-05 22:18 . 2011-04-05 22:17 92672 ----a-w- c:\windows\system32\KillBox.exe
2011-04-05 22:05 . 2011-04-07 09:38 -------- d-----w- c:\program files\WinClamAVShield
2011-04-05 21:13 . 2011-04-05 21:13 -------- d-----w- c:\program files\Common Files\Java
2011-04-05 21:13 . 2011-04-05 21:11 73728 ----a-w- c:\windows\system32\javacpl.cpl
2011-04-05 21:00 . 2011-04-05 21:00 -------- d-----w- c:\program files\Crawler
2011-04-05 20:59 . 2011-04-05 20:59 142592 ----a-w- c:\windows\system32\drivers\sp_rsdrv2.sys
2011-04-05 20:59 . 2011-04-07 07:23 -------- d-----w- c:\documents and settings\Administrator\Data aplikací\Spyware Terminator
2011-04-05 20:59 . 2011-04-07 09:36 -------- d-----w- c:\documents and settings\All Users\Data aplikací\Spyware Terminator
2011-04-05 20:59 . 2011-04-07 09:54 -------- d-----w- c:\program files\Spyware Terminator
2011-04-05 20:51 . 2011-04-05 20:51 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Data aplikací\Secunia PSI
2011-04-05 20:50 . 2011-04-05 20:50 -------- d-----w- c:\program files\Secunia
2011-04-05 20:11 . 2011-04-05 20:11 -------- d-sh--w- c:\documents and settings\Administrator\PrivacIE
2011-04-05 19:52 . 2011-03-18 18:05 142296 ----a-w- c:\program files\Mozilla Firefox\components\browsercomps.dll
2011-04-05 19:52 . 2011-03-18 18:05 781272 ----a-w- c:\program files\Mozilla Firefox\mozsqlite3.dll
2011-04-05 19:52 . 2011-03-18 18:05 728024 ----a-w- c:\program files\Mozilla Firefox\libGLESv2.dll
2011-04-05 19:52 . 2011-03-18 18:05 1975768 ----a-w- c:\program files\Mozilla Firefox\D3DCompiler_42.dll
2011-04-05 19:52 . 2011-03-18 18:05 1893336 ----a-w- c:\program files\Mozilla Firefox\d3dx9_42.dll
2011-04-05 19:52 . 2011-03-18 18:05 1874904 ----a-w- c:\program files\Mozilla Firefox\mozjs.dll
2011-04-05 19:52 . 2011-03-18 18:05 15832 ----a-w- c:\program files\Mozilla Firefox\mozalloc.dll
2011-04-05 19:52 . 2011-03-18 18:05 142296 ----a-w- c:\program files\Mozilla Firefox\libEGL.dll
2011-04-05 19:33 . 2011-04-05 19:33 -------- d-sh--w- c:\documents and settings\Administrator\IETldCache
2011-04-05 19:28 . 2011-04-05 19:30 -------- d-----w- c:\windows\system32\cs-CZ
2011-04-05 19:28 . 2011-04-05 19:29 -------- dc-h--w- c:\windows\ie8
2011-04-04 11:46 . 2011-04-05 21:25 -------- d-----w- c:\program files\ESET
2011-04-01 08:36 . 2011-04-01 08:36 -------- d-----w- c:\windows\XXLGS
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-04-05 21:11 . 2010-08-02 15:22 472808 ----a-w- c:\windows\system32\deployJava1.dll
2011-03-06 17:06 . 2011-03-06 16:46 43520 ----a-w- c:\windows\system32\CmdLineExt03.dll
2011-03-06 17:01 . 2010-09-26 23:31 717296 ----a-w- c:\windows\system32\drivers\sptd.sys
2011-02-26 13:06 . 2011-02-26 13:06 172032 ----a-w- c:\windows\system32\AniGIF.ocx
2011-03-18 18:05 . 2011-04-05 19:52 142296 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((( SnapShot_2011-04-05_20.26.41 )))))))))))))))))))))))))))))))))))))))))
.
+ 2011-04-07 07:07 . 2011-04-07 07:07 16384 c:\windows\temp\Perflib_Perfdata_560.dat
- 2008-08-26 06:28 . 2011-03-21 11:04 2176 c:\windows\system32\d3d9caps.dat
+ 2008-08-26 06:28 . 2011-04-06 09:38 2176 c:\windows\system32\d3d9caps.dat
+ 2008-07-30 16:16 . 2011-04-06 13:27 224924 c:\windows\system32\Restore\rstrlog.dat
+ 2011-04-05 21:20 . 2011-04-05 21:20 235168 c:\windows\system32\Macromed\Flash\FlashUtil10o_Plugin.exe
+ 2011-04-05 20:59 . 2011-04-05 20:59 235168 c:\windows\system32\Macromed\Flash\FlashUtil10o_ActiveX.exe
+ 2011-04-05 20:59 . 2011-04-05 20:59 311456 c:\windows\system32\Macromed\Flash\FlashUtil10o_ActiveX.dll
+ 2011-04-05 21:13 . 2011-04-05 21:11 157472 c:\windows\system32\javaws.exe
+ 2011-04-05 21:13 . 2011-04-05 21:11 145184 c:\windows\system32\javaw.exe
- 2010-08-02 15:22 . 2010-08-02 15:22 145184 c:\windows\system32\javaw.exe
+ 2011-04-05 21:13 . 2011-04-05 21:11 145184 c:\windows\system32\java.exe
- 2010-08-02 15:22 . 2010-08-02 15:22 145184 c:\windows\system32\java.exe
+ 2011-04-05 21:13 . 2011-04-05 21:13 180224 c:\windows\Installer\556a25.msi
+ 2011-04-05 21:10 . 2011-04-05 21:10 677376 c:\windows\Installer\556a13.msi
+ 2010-01-27 01:07 . 2011-04-05 21:20 6053536 c:\windows\system32\Macromed\Flash\NPSWF32.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SpywareTerminator"="c:\progra~1\SPYWAR~1\SpywareTerminatorShield.exe" [2011-04-05 2216960]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-10-29 249064]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2004-08-17 15360]
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\Spyware Terminator\\SpywareTerminatorUpdate.exe"=
"d:\\hry\\Nová složka (2)\\age2_x1.exe"=
.
R1 sp_rsdrv2;Spyware Terminator Driver 2;c:\windows\system32\drivers\sp_rsdrv2.sys [5.4.2011 22:59 142592]
R3 PAC207;Trust WB-1400T Webcam;c:\windows\system32\drivers\PFC027.SYS [14.5.2007 10:26 508288]
R3 S3SAVAGE4M;S3SAVAGE4M;c:\windows\system32\drivers\s3sav4m.sys [7.7.2008 18:00 77824]
S0 mfemhvrxogcp;mfemhvrxogcp; [x]
S1 SASDIFSV;SASDIFSV;\??\e:\my download files\antispywer\SASDIFSV.SYS --> e:\my download files\antispywer\SASDIFSV.SYS [?]
S1 SASKUTIL;SASKUTIL;\??\e:\my download files\antispywer\SASKUTIL.sys --> e:\my download files\antispywer\SASKUTIL.sys [?]
S1 zmcadvafppwy5;zmcadvafppwy5;c:\windows\system32\drivers\zmcadvafppwy5.sys --> c:\windows\system32\drivers\zmcadvafppwy5.sys [?]
S2 AMService;AMService;c:\windows\TEMP\gerx\setup.exe run --> c:\windows\TEMP\gerx\setup.exe run [?]
S2 Secunia Update Agent;Secunia Update Agent;"c:\program files\Secunia\PSI\sua.exe" --start-service --> c:\program files\Secunia\PSI\sua.exe [?]
S3 ATE_PROCMON;ATE_PROCMON;\??\d:\my download files\trojan\Anti Trojan Elite\ATEPMon.sys --> d:\my download files\trojan\Anti Trojan Elite\ATEPMon.sys [?]
S3 SASENUM;SASENUM;\??\e:\my download files\antispywer\SASENUM.SYS --> e:\my download files\antispywer\SASENUM.SYS [?]
S3 SetupNTGLM7X;SetupNTGLM7X;\??\f:\ntglm7x.sys --> f:\NTGLM7X.sys [?]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://pobox.sk/
mWindow Title = Microsoft Internet Explorer
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyOverride = *.local
IE: Add to AMV Convert Tool... - c:\program files\MP3 Player Utilities 4.00\AMVConverter\grab.html
IE: Crawler Search - tbr:iemenu
IE: Download with Star Downloader - e:\my download files\ACCELELATOR PLUS\Star Downloader\sdie.htm
IE: E&xportovať do programu Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
IE: MediaManager tool grab multimedia file - c:\program files\MP3 Player Utilities 4.00\MediaManager\grab.html
Handler: tbr - {4D25FB7A-8902-4291-960E-9ADA051CFBBF} - c:\progra~1\Crawler\Toolbar\ctbr.dll
DPF: DirectAnimation Java Classes
DPF: Microsoft XML Parser for Java
FF - ProfilePath - c:\documents and settings\Administrator\Data aplikací\Mozilla\Firefox\Profiles\sa3oy8yh.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2463487&SearchSource=3&q={searchTerms}
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - pobox.sk
FF - prefs.js: keyword.URL - hxxp://www.crawler.com/search/dispatcher.aspx? ... 60076&qkw=
FF - user.js: network.http.max-persistent-connections-per-server - 4
FF - user.js: nglayout.initialpaint.delay - 600
FF - user.js: content.notify.interval - 600000
FF - user.js: content.max.tokenizing.time - 1800000
FF - user.js: content.switch.threshold - 600000
.
- - - - ORPHANS REMOVED - - - -
.
AddRemove-VLC media player - e:\vlc media\VLC\uninstall.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-04-07 12:29
Windows 5.1.2600 Service Pack 2 NTFS
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
scanning hidden files ...
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_USERS\S-1-5-21-1957994488-1677128483-854245398-500\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (Administrator)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,57,fe,94,e8,f9,a9,65,49,b0,f4,f4,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,57,fe,94,e8,f9,a9,65,49,b0,f4,f4,\
"6256FFB019F8FDFBD36745B06F4540E9AEAF222A25"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,57,fe,94,e8,f9,a9,65,49,b0,f4,f4,\
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10o_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10o_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'explorer.exe'(3948)
c:\windows\system32\msi.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
Completion time: 2011-04-07 12:33:13
ComboFix-quarantined-files.txt 2011-04-07 10:33
ComboFix2.txt 2011-04-07 07:22
ComboFix3.txt 2011-04-06 12:39
ComboFix4.txt 2011-04-06 11:28
ComboFix5.txt 2011-04-07 10:19
.
Pre-Run: 2 695 766 016
Post-Run: 2 688 671 744
.
Current=7 Default=7 Failed=6 LastKnownGood=2 Sets=1,2,4,5,6,7
- - End Of File - - A5FC473C6AB899AAC75F15404019C34F

#4 Příspěvek od **motji** » 09 dub 2011 07:14

Vy si pouštíte combofix jakna běžícím pásu, jak mám pak vědět, co smazal?
Něco pak domažeme, ale ještě mi sem vložte tento log.
ComboFix5.txt najdete ho ve složce qoobox na disku.
Co jste mazal tím Killboxem?

ringov · #5 Příspěvek od **ringov** » 09 dub 2011 07:50

neviem cosom vymazal s kilboxom,som laik prepacte ,da sa pomoct? dakujem. ComboFix 11-04-03.03 - Administrator 04.04.2011 15:36:48.1.1 - x86
Systém Microsoft Windows XP Professional 5.1.2600.2.1250.421.1029.18.511.43 [GMT 2:00]
Running from: c:\documents and settings\Administrator\Plocha\ComboFix.exe
AV: ESET Smart Security 4.0 *Enabled/Updated* {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
FW: ESET personal firewall *Enabled* {E5E70D32-0101-4340-86A3-A7B0F1C8FFE0}
* Resident AV is active
.
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\All Users\Dokumenty\Settings
c:\program files\ESET\MiNODLogin
c:\program files\ESET\MiNODLogin\gs\eset\ConstantesRegistro.class
c:\program files\ESET\MiNODLogin\gs\eset\ESETAntivirus.class
c:\program files\ESET\MiNODLogin\gs\idioma\idioma-cs.properties
c:\program files\ESET\MiNODLogin\gs\idioma\idioma-en.properties
c:\program files\ESET\MiNODLogin\gs\idioma\idioma-es.properties
c:\program files\ESET\MiNODLogin\gs\idioma\idioma-fr.properties
c:\program files\ESET\MiNODLogin\gs\idioma\idioma-pt.properties
c:\program files\ESET\MiNODLogin\gs\idioma\Idioma.class
c:\program files\ESET\MiNODLogin\gs\minodlogin\.cvsignore
c:\program files\ESET\MiNODLogin\gs\minodlogin\Aplicaci+-n+Źcono$1.class
c:\program files\ESET\MiNODLogin\gs\minodlogin\Aplicaci+-n+Źcono$2.class
c:\program files\ESET\MiNODLogin\gs\minodlogin\Aplicaci+-n+Źcono$3.class
c:\program files\ESET\MiNODLogin\gs\minodlogin\Aplicaci+-n+Źcono.class
c:\program files\ESET\MiNODLogin\gs\minodlogin\Aplicaci+-nSilenciosa.class
c:\program files\ESET\MiNODLogin\gs\minodlogin\ConstantesPrograma$1$1.class
c:\program files\ESET\MiNODLogin\gs\minodlogin\ConstantesPrograma$1.class
c:\program files\ESET\MiNODLogin\gs\minodlogin\ConstantesPrograma.class
c:\program files\ESET\MiNODLogin\gs\minodlogin\eset.ico
c:\program files\ESET\MiNODLogin\gs\minodlogin\eset0.png
c:\program files\ESET\MiNODLogin\gs\minodlogin\eset1.png
c:\program files\ESET\MiNODLogin\gs\minodlogin\eset10.png
c:\program files\ESET\MiNODLogin\gs\minodlogin\eset11.png
c:\program files\ESET\MiNODLogin\gs\minodlogin\eset2.png
c:\program files\ESET\MiNODLogin\gs\minodlogin\eset3.png
c:\program files\ESET\MiNODLogin\gs\minodlogin\eset4.png
c:\program files\ESET\MiNODLogin\gs\minodlogin\eset5.png
c:\program files\ESET\MiNODLogin\gs\minodlogin\eset6.png
c:\program files\ESET\MiNODLogin\gs\minodlogin\eset7.png
c:\program files\ESET\MiNODLogin\gs\minodlogin\eset8.png
c:\program files\ESET\MiNODLogin\gs\minodlogin\eset9.png
c:\program files\ESET\MiNODLogin\gs\minodlogin\estado_bueno.png
c:\program files\ESET\MiNODLogin\gs\minodlogin\estado_desconocido.png
c:\program files\ESET\MiNODLogin\gs\minodlogin\estado_malo.png
c:\program files\ESET\MiNODLogin\gs\minodlogin\estado_regular.png
c:\program files\ESET\MiNODLogin\gs\minodlogin\excepciones\+ëxito.class
c:\program files\ESET\MiNODLogin\gs\minodlogin\excepciones\+ëxitoLaLicenciaSigueSiendoV+ílida$1.class
c:\program files\ESET\MiNODLogin\gs\minodlogin\excepciones\+ëxitoLaLicenciaSigueSiendoV+ílida.class
c:\program files\ESET\MiNODLogin\gs\minodlogin\excepciones\+ëxitoLicenciaInstalada.class
c:\program files\ESET\MiNODLogin\gs\minodlogin\excepciones\+ëxitoNuevaVersi+-nDisponible.class
c:\program files\ESET\MiNODLogin\gs\minodlogin\excepciones\Error.class
c:\program files\ESET\MiNODLogin\gs\minodlogin\excepciones\ErrorAlConectar.class
c:\program files\ESET\MiNODLogin\gs\minodlogin\excepciones\ErrorAlInstalarLaLicencia$1.class
c:\program files\ESET\MiNODLogin\gs\minodlogin\excepciones\ErrorAlInstalarLaLicencia.class
c:\program files\ESET\MiNODLogin\gs\minodlogin\excepciones\ErrorDeAccesoAlRegistro.class
c:\program files\ESET\MiNODLogin\gs\minodlogin\excepciones\ErrorDeServidor.class
c:\program files\ESET\MiNODLogin\gs\minodlogin\excepciones\ErrorLicenciaNoCodificable.class
c:\program files\ESET\MiNODLogin\gs\minodlogin\excepciones\ErrorNoHayLicencias.class
c:\program files\ESET\MiNODLogin\gs\minodlogin\excepciones\ErrorNoHayLicenciasV+ílidas.class
c:\program files\ESET\MiNODLogin\gs\minodlogin\excepciones\ErrorSinConexi+-nAInternet.class
c:\program files\ESET\MiNODLogin\gs\minodlogin\excepciones\Mensaje.class
c:\program files\ESET\MiNODLogin\gs\minodlogin\explorador\Aplicaci+-nExplorador$1.class
c:\program files\ESET\MiNODLogin\gs\minodlogin\explorador\Aplicaci+-nExplorador$2$1.class
c:\program files\ESET\MiNODLogin\gs\minodlogin\explorador\Aplicaci+-nExplorador$2$2.class
c:\program files\ESET\MiNODLogin\gs\minodlogin\explorador\Aplicaci+-nExplorador$2$3.class
c:\program files\ESET\MiNODLogin\gs\minodlogin\explorador\Aplicaci+-nExplorador$2$4.class
c:\program files\ESET\MiNODLogin\gs\minodlogin\explorador\Aplicaci+-nExplorador$2.class
c:\program files\ESET\MiNODLogin\gs\minodlogin\explorador\Aplicaci+-nExplorador$3.class
c:\program files\ESET\MiNODLogin\gs\minodlogin\explorador\Aplicaci+-nExplorador$4.class
c:\program files\ESET\MiNODLogin\gs\minodlogin\explorador\Aplicaci+-nExplorador.class
c:\program files\ESET\MiNODLogin\gs\minodlogin\explorador\EstadoLicencia.class
c:\program files\ESET\MiNODLogin\gs\minodlogin\explorador\EstadoServidor.class
c:\program files\ESET\MiNODLogin\gs\minodlogin\explorador\Hoja.class
c:\program files\ESET\MiNODLogin\gs\minodlogin\explorador\ModeloLicencias$Ra+şz.class
c:\program files\ESET\MiNODLogin\gs\minodlogin\explorador\ModeloLicencias.class
c:\program files\ESET\MiNODLogin\gs\minodlogin\explorador\Nodo.class
c:\program files\ESET\MiNODLogin\gs\minodlogin\explorador\NodoLicencia.class
c:\program files\ESET\MiNODLogin\gs\minodlogin\explorador\NodoServidor.class
c:\program files\ESET\MiNODLogin\gs\minodlogin\Licencia$Codificador.class
c:\program files\ESET\MiNODLogin\gs\minodlogin\Licencia.class
c:\program files\ESET\MiNODLogin\gs\minodlogin\licencia.png
c:\program files\ESET\MiNODLogin\gs\minodlogin\MiNODLogin$1.class
c:\program files\ESET\MiNODLogin\gs\minodlogin\MiNODLogin$2.class
c:\program files\ESET\MiNODLogin\gs\minodlogin\MiNODLogin$3.class
c:\program files\ESET\MiNODLogin\gs\minodlogin\MiNODLogin.class
c:\program files\ESET\MiNODLogin\gs\minodlogin\MiNODLogin.ver
c:\program files\ESET\MiNODLogin\gs\minodlogin\Servidor.class
c:\program files\ESET\MiNODLogin\gs\minodlogin\servidor.png
c:\program files\ESET\MiNODLogin\gs\minodlogin\ServidorRSS.class
c:\program files\ESET\MiNODLogin\gs\minodlogin\ServidorXML.class
c:\program files\ESET\MiNODLogin\gs\soporte\DescriptorDeVersi+-n.class
c:\program files\ESET\MiNODLogin\gs\soporte\Funciones.class
c:\program files\ESET\MiNODLogin\gs\soporte\HashVectorSet.class
c:\program files\ESET\MiNODLogin\gs\soporte\IndexedSet.class
c:\program files\ESET\MiNODLogin\gs\soporte\MiNODLoginLib.class
c:\program files\ESET\MiNODLogin\gs\soporte\Versi+-n.class
c:\program files\ESET\MiNODLogin\gs\soporte\windows\registro\Registro.class
c:\program files\ESET\MiNODLogin\gs\soporte\windows\registro\TipoClaveRa+şz.class
c:\program files\ESET\MiNODLogin\gs\soporte\windows\registro\TipoValor.class
c:\program files\ESET\MiNODLogin\gs\soporte\windows\uac\UACElevador.class
c:\program files\ESET\MiNODLogin\javax\swing\AbstractTreeTableModel.class
c:\program files\ESET\MiNODLogin\javax\swing\DefaultTreeTableModel.class
c:\program files\ESET\MiNODLogin\javax\swing\JTreeTable$ListToTreeSelectionModelWrapper$ListSelectionHandler.class
c:\program files\ESET\MiNODLogin\javax\swing\JTreeTable$ListToTreeSelectionModelWrapper.class
c:\program files\ESET\MiNODLogin\javax\swing\JTreeTable$TreeTableCellEditor.class
c:\program files\ESET\MiNODLogin\javax\swing\JTreeTable$TreeTableCellRenderer$1.class
c:\program files\ESET\MiNODLogin\javax\swing\JTreeTable$TreeTableCellRenderer.class
c:\program files\ESET\MiNODLogin\javax\swing\JTreeTable$TreeTableTextField.class
c:\program files\ESET\MiNODLogin\javax\swing\JTreeTable.class
c:\program files\ESET\MiNODLogin\javax\swing\TreeModelAdapter.class
c:\program files\ESET\MiNODLogin\javax\swing\TreeTableModel.class
c:\program files\ESET\MiNODLogin\javax\swing\TreeTableModelAdapter$1.class
c:\program files\ESET\MiNODLogin\javax\swing\TreeTableModelAdapter$2.class
c:\program files\ESET\MiNODLogin\javax\swing\TreeTableModelAdapter$3.class
c:\program files\ESET\MiNODLogin\javax\swing\TreeTableModelAdapter.class
c:\program files\ESET\MiNODLogin\META-INF\MANIFEST.MF
c:\program files\ESET\MiNODLogin\MiNODLogin.exe
c:\program files\ESET\MiNODLogin\MiNODLogin.jar
c:\program files\ESET\MiNODLogin\MiNODLoginLib.dll
c:\program files\ESET\MiNODLogin\MiNODLoginUninst.exe
c:\program files\ESET\MiNODLogin\net\sf\image4j\codec\bmp\BMPDecoder.class
c:\program files\ESET\MiNODLogin\net\sf\image4j\codec\bmp\BMPImage.class
c:\program files\ESET\MiNODLogin\net\sf\image4j\codec\bmp\ColorEntry.class
c:\program files\ESET\MiNODLogin\net\sf\image4j\codec\bmp\InfoHeader.class
c:\program files\ESET\MiNODLogin\net\sf\image4j\codec\ico\ICODecoder.class
c:\program files\ESET\MiNODLogin\net\sf\image4j\codec\ico\ICOImage.class
c:\program files\ESET\MiNODLogin\net\sf\image4j\codec\ico\IconEntry.class
c:\program files\ESET\MiNODLogin\net\sf\image4j\io\LittleEndianInputStream.class
.
Infected copy of c:\windows\system32\DRIVERS\atapi.sys was found and disinfected
Restored copy from - c:\windows\ServicePackFiles\i386\atapi.sys
.
.
((((((((((((((((((((((((( Files Created from 2011-03-04 to 2011-04-04 )))))))))))))))))))))))))))))))
.
.
2011-04-04 11:46 . 2011-04-04 11:48 -------- d-----w- c:\program files\ESET
2011-04-01 08:36 . 2011-04-01 08:36 -------- d-----w- c:\windows\XXLGS
2011-03-07 08:41 . 2011-03-07 10:54 -------- d--h--w- c:\documents and settings\All Users\Data aplikací\~0
2011-03-07 08:26 . 2011-03-07 08:26 -------- d-----w- c:\documents and settings\Administrator\Data aplikací\Thinstall
2011-03-07 05:45 . 2011-03-07 05:45 -------- d-----w- c:\program files\7-Zip
2011-03-06 21:50 . 2011-03-06 21:50 -------- d-----w- c:\documents and settings\Administrator\Data aplikací\Malwarebytes
2011-03-06 21:50 . 2011-03-06 21:50 -------- d-----w- c:\documents and settings\All Users\Data aplikací\Malwarebytes
2011-03-06 21:35 . 2011-03-06 21:35 -------- d-----w- c:\documents and settings\All Users\Uniblue
2011-03-06 18:18 . 2011-03-06 18:19 -------- d-----w- c:\documents and settings\Administrator\Data aplikací\vlc
2011-03-06 18:09 . 2009-03-30 19:01 50688 ----a-w- c:\windows\system32\ff_acm.acm
2011-03-06 18:09 . 2009-03-30 19:01 60273 ----a-w- c:\windows\system32\pthreadGC2.dll
2011-03-06 16:46 . 2011-03-06 17:06 43520 ----a-w- c:\windows\system32\CmdLineExt03.dll
2011-03-06 15:06 . 2011-03-06 15:06 -------- d-----w- c:\documents and settings\TuneUp Utilities 2010
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-03-06 17:01 . 2010-09-26 23:31 717296 ----a-w- c:\windows\system32\drivers\sptd.sys
2011-02-26 13:06 . 2011-02-26 13:06 172032 ----a-w- c:\windows\system32\AniGIF.ocx
2011-02-26 06:07 . 2011-02-26 06:07 29184 ----a-w- c:\windows\system32\systemac.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{389943B0-C3A2-4E69-82CB-8596A84CB3DC}]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"egui"="c:\program files\ESET\ESET Smart Security\egui.exe" [2009-09-11 2054360]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2004-08-17 15360]
.
c:\documents and settings\All Users\Nabˇdka Start\Programy\Po spuçtŘnˇ\
Aktualizovat ESET licenci.lnk - c:\qoobox\Quarantine\C\Program Files\ESET\MiNODLogin\MiNODLogin.exe.vir [2009-8-22 125952]
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
.
R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [11.9.2009 7:23 108792]
R2 ekrn;ESET Service;c:\program files\ESET\ESET Smart Security\ekrn.exe [11.9.2009 7:24 735960]
R3 PAC207;Trust WB-1400T Webcam;c:\windows\system32\drivers\PFC027.SYS [14.5.2007 10:26 508288]
R3 S3SAVAGE4M;S3SAVAGE4M;c:\windows\system32\drivers\s3sav4m.sys [7.7.2008 18:00 77824]
S0 mfemhvrxogcp;mfemhvrxogcp; [x]
S1 SASDIFSV;SASDIFSV;\??\e:\my download files\antispywer\SASDIFSV.SYS --> e:\my download files\antispywer\SASDIFSV.SYS [?]
S1 SASKUTIL;SASKUTIL;\??\e:\my download files\antispywer\SASKUTIL.sys --> e:\my download files\antispywer\SASKUTIL.sys [?]
S1 zmcadvafppwy5;zmcadvafppwy5;c:\windows\system32\drivers\zmcadvafppwy5.sys --> c:\windows\system32\drivers\zmcadvafppwy5.sys [?]
S2 AMService;AMService;c:\windows\TEMP\gerx\setup.exe run --> c:\windows\TEMP\gerx\setup.exe run [?]
S3 ATE_PROCMON;ATE_PROCMON;\??\d:\my download files\trojan\Anti Trojan Elite\ATEPMon.sys --> d:\my download files\trojan\Anti Trojan Elite\ATEPMon.sys [?]
S3 SASENUM;SASENUM;\??\e:\my download files\antispywer\SASENUM.SYS --> e:\my download files\antispywer\SASENUM.SYS [?]
S3 SetupNTGLM7X;SetupNTGLM7X;\??\f:\ntglm7x.sys --> f:\NTGLM7X.sys [?]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://pobox.sk/
mWindow Title = Microsoft Internet Explorer
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyOverride = *.local
IE: Add to AMV Convert Tool... - c:\program files\MP3 Player Utilities 4.00\AMVConverter\grab.html
IE: Download with Star Downloader - e:\my download files\ACCELELATOR PLUS\Star Downloader\sdie.htm
IE: E&xportovať do programu Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
IE: MediaManager tool grab multimedia file - c:\program files\MP3 Player Utilities 4.00\MediaManager\grab.html
IE: {{7E6A20FB-153F-402c-A84B-1A64E1955D3D} - {7E6A20FB-153F-402c-A84B-1A64E1955D3D} - e:\preklad\TRANSLAT\WEBIE.DLL
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748450} - {CC963627-B1DC-40E0-B52A-CF21EE748450} - e:\preklad\TRANSLAT\WEBIE.DLL
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748451} - {CC963627-B1DC-40E0-B52A-CF21EE748451} - e:\preklad\TRANSLAT\WEBIE.DLL
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748452} - {CC963627-B1DC-40E0-B52A-CF21EE748452} - e:\preklad\TRANSLAT\WEBIE.DLL
DPF: DirectAnimation Java Classes
DPF: Microsoft XML Parser for Java
FF - ProfilePath - c:\documents and settings\Administrator\Data aplikací\Mozilla\Firefox\Profiles\sa3oy8yh.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2463487&SearchSource=3&q={searchTerms}
FF - prefs.js: browser.startup.homepage - pobox.sk
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: SearchPredict: searchpredict@speedbit.com - c:\program files\SearchPredict\PRFireFox
FF - user.js: network.http.max-persistent-connections-per-server - 4
FF - user.js: nglayout.initialpaint.delay - 600
FF - user.js: content.notify.interval - 600000
FF - user.js: content.max.tokenizing.time - 1800000
FF - user.js: content.switch.threshold - 600000
.
- - - - ORPHANS REMOVED - - - -
.
AddRemove-MiNODLogin - c:\program files\ESET\MiNODLogin\MiNODLoginUninst.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-04-04 15:52
Windows 5.1.2600 Service Pack 2 NTFS
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
scanning hidden files ...
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'explorer.exe'(2708)
c:\windows\system32\msi.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Java\jre6\bin\jqs.exe
.
**************************************************************************
.
Completion time: 2011-04-04 15:57:30 - machine was rebooted
ComboFix-quarantined-files.txt 2011-04-04 13:57
.
Pre-Run: 2 568 663 040
Post-Run: 2 620 608 512
.
WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /fastdetect /NoExecute=OptIn
.
Current=6 Default=6 Failed=3 LastKnownGood=7 Sets=1,3,4,5,6,7
- - End Of File - - FDC43843A5A124EEA5F13FE3D8A4CE7A
ComboFix 11-04-03.03 - Administrator 04.04.2011 16:21:40.2.1 - x86
Systém Microsoft Windows XP Professional 5.1.2600.2.1250.421.1029.18.511.123 [GMT 2:00]
Running from: c:\documents and settings\Administrator\Plocha\ComboFix.exe
AV: ESET Smart Security 4.0 *Disabled/Updated* {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
FW: ESET personal firewall *Enabled* {E5E70D32-0101-4340-86A3-A7B0F1C8FFE0}
.
.
((((((((((((((((((((((((( Files Created from 2011-03-04 to 2011-04-04 )))))))))))))))))))))))))))))))
.
.
2011-04-04 13:56 . 2011-04-04 13:56 -------- d-----w- c:\windows\LastGood
2011-04-04 11:46 . 2011-04-04 11:48 -------- d-----w- c:\program files\ESET
2011-04-01 08:36 . 2011-04-01 08:36 -------- d-----w- c:\windows\XXLGS
2011-03-07 08:41 . 2011-03-07 10:54 -------- d--h--w- c:\documents and settings\All Users\Data aplikací\~0
2011-03-07 08:26 . 2011-03-07 08:26 -------- d-----w- c:\documents and settings\Administrator\Data aplikací\Thinstall
2011-03-07 05:45 . 2011-03-07 05:45 -------- d-----w- c:\program files\7-Zip
2011-03-06 21:50 . 2011-03-06 21:50 -------- d-----w- c:\documents and settings\Administrator\Data aplikací\Malwarebytes
2011-03-06 21:50 . 2011-03-06 21:50 -------- d-----w- c:\documents and settings\All Users\Data aplikací\Malwarebytes
2011-03-06 21:35 . 2011-03-06 21:35 -------- d-----w- c:\documents and settings\All Users\Uniblue
2011-03-06 18:18 . 2011-03-06 18:19 -------- d-----w- c:\documents and settings\Administrator\Data aplikací\vlc
2011-03-06 18:09 . 2009-03-30 19:01 50688 ----a-w- c:\windows\system32\ff_acm.acm
2011-03-06 18:09 . 2009-03-30 19:01 60273 ----a-w- c:\windows\system32\pthreadGC2.dll
2011-03-06 16:46 . 2011-03-06 17:06 43520 ----a-w- c:\windows\system32\CmdLineExt03.dll
2011-03-06 15:06 . 2011-03-06 15:06 -------- d-----w- c:\documents and settings\TuneUp Utilities 2010
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-03-06 17:01 . 2010-09-26 23:31 717296 ----a-w- c:\windows\system32\drivers\sptd.sys
2011-02-26 13:06 . 2011-02-26 13:06 172032 ----a-w- c:\windows\system32\AniGIF.ocx
2011-02-26 06:07 . 2011-02-26 06:07 29184 ----a-w- c:\windows\system32\systemac.dll
.
.
((((((((((((((((((((((((((((( SnapShot@2011-04-04_13.52.31 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-08-06 17:24 . 2009-08-06 17:24 44768 c:\windows\system32\wups2.dll
+ 2008-07-07 14:11 . 2009-08-06 17:24 53472 c:\windows\system32\wuauclt.exe
+ 2011-04-04 13:56 . 2009-08-06 17:24 35552 c:\windows\system32\SoftwareDistribution\Setup\ServiceStartup\wups.dll\7.4.7600.226\wups.dll
+ 2001-10-25 12:00 . 2011-04-04 13:56 49198 c:\windows\system32\perfc009.dat
- 2001-10-25 12:00 . 2011-03-27 18:26 49198 c:\windows\system32\perfc009.dat
+ 2001-10-25 12:00 . 2011-04-04 13:56 56590 c:\windows\system32\perfc005.dat
- 2001-10-25 12:00 . 2011-03-27 18:26 56590 c:\windows\system32\perfc005.dat
+ 2008-07-07 14:11 . 2009-08-06 17:24 53472 c:\windows\system32\dllcache\wuauclt.exe
+ 2002-09-20 18:03 . 2009-08-06 17:24 96480 c:\windows\system32\dllcache\cdm.dll
+ 2002-09-20 18:03 . 2009-08-06 17:24 96480 c:\windows\system32\cdm.dll
+ 2011-04-04 13:56 . 2004-08-17 13:49 36864 c:\windows\LastGood\system32\wups.dll
+ 2011-04-04 13:56 . 2004-08-17 13:49 66560 c:\windows\LastGood\system32\cdm.dll
+ 2008-07-07 14:41 . 2009-08-06 17:24 209632 c:\windows\system32\wuweb.dll
+ 2008-07-07 14:41 . 2009-08-06 17:24 327896 c:\windows\system32\wucltui.dll
+ 2008-07-07 14:41 . 2009-08-06 17:23 575704 c:\windows\system32\wuapi.dll
+ 2001-10-25 12:00 . 2011-04-04 13:56 390094 c:\windows\system32\perfh009.dat
- 2001-10-25 12:00 . 2011-03-27 18:26 390094 c:\windows\system32\perfh009.dat
- 2001-10-25 12:00 . 2011-03-27 18:26 387954 c:\windows\system32\perfh005.dat
+ 2001-10-25 12:00 . 2011-04-04 13:56 387954 c:\windows\system32\perfh005.dat
+ 2008-07-07 14:41 . 2009-08-06 17:24 209632 c:\windows\system32\dllcache\wuweb.dll
+ 2008-07-07 14:41 . 2009-08-06 17:24 327896 c:\windows\system32\dllcache\wucltui.dll
+ 2008-07-07 14:41 . 2009-08-06 17:23 575704 c:\windows\system32\dllcache\wuapi.dll
+ 2011-04-04 13:56 . 2004-08-17 13:49 120320 c:\windows\LastGood\system32\wuweb.dll
+ 2011-04-04 13:56 . 2004-08-17 13:49 112640 c:\windows\LastGood\system32\wucltui.dll
+ 2011-04-04 13:56 . 2004-08-17 13:49 111104 c:\windows\LastGood\system32\wuauclt.exe
+ 2011-04-04 13:56 . 2004-08-17 13:49 431104 c:\windows\LastGood\system32\wuapi.dll
+ 2008-07-07 14:11 . 2009-08-06 17:23 1929952 c:\windows\system32\wuaueng.dll
+ 2008-07-07 14:11 . 2009-08-06 17:23 1929952 c:\windows\system32\dllcache\wuaueng.dll
+ 2011-04-04 13:56 . 2004-08-17 13:49 1134592 c:\windows\LastGood\system32\wuaueng.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{389943B0-C3A2-4E69-82CB-8596A84CB3DC}]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"egui"="c:\program files\ESET\ESET Smart Security\egui.exe" [2009-09-11 2054360]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2004-08-17 15360]
.
c:\documents and settings\All Users\Nabˇdka Start\Programy\Po spuçtŘnˇ\
Aktualizovat ESET licenci.lnk - c:\qoobox\Quarantine\C\Program Files\ESET\MiNODLogin\MiNODLogin.exe.vir [2009-8-22 125952]
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
.
R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [11.9.2009 7:23 108792]
R2 ekrn;ESET Service;c:\program files\ESET\ESET Smart Security\ekrn.exe [11.9.2009 7:24 735960]
R3 PAC207;Trust WB-1400T Webcam;c:\windows\system32\drivers\PFC027.SYS [14.5.2007 10:26 508288]
R3 S3SAVAGE4M;S3SAVAGE4M;c:\windows\system32\drivers\s3sav4m.sys [7.7.2008 18:00 77824]
S0 mfemhvrxogcp;mfemhvrxogcp; [x]
S1 SASDIFSV;SASDIFSV;\??\e:\my download files\antispywer\SASDIFSV.SYS --> e:\my download files\antispywer\SASDIFSV.SYS [?]
S1 SASKUTIL;SASKUTIL;\??\e:\my download files\antispywer\SASKUTIL.sys --> e:\my download files\antispywer\SASKUTIL.sys [?]
S1 zmcadvafppwy5;zmcadvafppwy5;c:\windows\system32\drivers\zmcadvafppwy5.sys --> c:\windows\system32\drivers\zmcadvafppwy5.sys [?]
S2 AMService;AMService;c:\windows\TEMP\gerx\setup.exe run --> c:\windows\TEMP\gerx\setup.exe run [?]
S3 ATE_PROCMON;ATE_PROCMON;\??\d:\my download files\trojan\Anti Trojan Elite\ATEPMon.sys --> d:\my download files\trojan\Anti Trojan Elite\ATEPMon.sys [?]
S3 SASENUM;SASENUM;\??\e:\my download files\antispywer\SASENUM.SYS --> e:\my download files\antispywer\SASENUM.SYS [?]
S3 SetupNTGLM7X;SetupNTGLM7X;\??\f:\ntglm7x.sys --> f:\NTGLM7X.sys [?]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://pobox.sk/
mWindow Title = Microsoft Internet Explorer
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyOverride = *.local
IE: Add to AMV Convert Tool... - c:\program files\MP3 Player Utilities 4.00\AMVConverter\grab.html
IE: Download with Star Downloader - e:\my download files\ACCELELATOR PLUS\Star Downloader\sdie.htm
IE: E&xportovať do programu Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
IE: MediaManager tool grab multimedia file - c:\program files\MP3 Player Utilities 4.00\MediaManager\grab.html
IE: {{7E6A20FB-153F-402c-A84B-1A64E1955D3D} - {7E6A20FB-153F-402c-A84B-1A64E1955D3D} - e:\preklad\TRANSLAT\WEBIE.DLL
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748450} - {CC963627-B1DC-40E0-B52A-CF21EE748450} - e:\preklad\TRANSLAT\WEBIE.DLL
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748451} - {CC963627-B1DC-40E0-B52A-CF21EE748451} - e:\preklad\TRANSLAT\WEBIE.DLL
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748452} - {CC963627-B1DC-40E0-B52A-CF21EE748452} - e:\preklad\TRANSLAT\WEBIE.DLL
DPF: DirectAnimation Java Classes
DPF: Microsoft XML Parser for Java
FF - ProfilePath - c:\documents and settings\Administrator\Data aplikací\Mozilla\Firefox\Profiles\sa3oy8yh.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2463487&SearchSource=3&q={searchTerms}
FF - prefs.js: browser.startup.homepage - pobox.sk
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: SearchPredict: searchpredict@speedbit.com - c:\program files\SearchPredict\PRFireFox
FF - user.js: network.http.max-persistent-connections-per-server - 4
FF - user.js: nglayout.initialpaint.delay - 600
FF - user.js: content.notify.interval - 600000
FF - user.js: content.max.tokenizing.time - 1800000
FF - user.js: content.switch.threshold - 600000
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-04-04 16:30
Windows 5.1.2600 Service Pack 2 NTFS
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
scanning hidden files ...
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'explorer.exe'(1992)
c:\windows\system32\msi.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
Completion time: 2011-04-04 16:33:38
ComboFix-quarantined-files.txt 2011-04-04 14:33
ComboFix2.txt 2011-04-04 13:57
.
Pre-Run: 2 630 848 512
Post-Run: 2 616 963 072
.
Current=6 Default=6 Failed=3 LastKnownGood=7 Sets=1,3,4,5,6,7
- - End Of File - - 817B80B813B841F73A2989F81925713D
ComboFix 11-04-03.03 - Administrator 05.04.2011 22:17:39.3.1 - x86
Systém Microsoft Windows XP Professional 5.1.2600.2.1250.421.1029.18.511.238 [GMT 2:00]
Running from: e:\nová složka\ComboFix.exe
AV: ESET Smart Security 4.0 *Disabled/Updated* {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
FW: ESET personal firewall *Enabled* {E5E70D32-0101-4340-86A3-A7B0F1C8FFE0}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\Administrator\Local Settings\Temporary Internet Files\REG.EXE
c:\documents and settings\Administrator\Local Settings\Temporary Internet Files\UN32.EXE
c:\documents and settings\Administrator\Local Settings\Temporary Internet Files\UN32.INI
.
.
((((((((((((((((((((((((( Files Created from 2011-03-05 to 2011-04-05 )))))))))))))))))))))))))))))))
.
.
2011-04-05 20:11 . 2011-04-05 20:11 -------- d-sh--w- c:\documents and settings\Administrator\PrivacIE
2011-04-05 19:52 . 2011-03-18 18:05 142296 ----a-w- c:\program files\Mozilla Firefox\components\browsercomps.dll
2011-04-05 19:52 . 2011-03-18 18:05 781272 ----a-w- c:\program files\Mozilla Firefox\mozsqlite3.dll
2011-04-05 19:52 . 2011-03-18 18:05 728024 ----a-w- c:\program files\Mozilla Firefox\libGLESv2.dll
2011-04-05 19:52 . 2011-03-18 18:05 1975768 ----a-w- c:\program files\Mozilla Firefox\D3DCompiler_42.dll
2011-04-05 19:52 . 2011-03-18 18:05 1893336 ----a-w- c:\program files\Mozilla Firefox\d3dx9_42.dll
2011-04-05 19:52 . 2011-03-18 18:05 1874904 ----a-w- c:\program files\Mozilla Firefox\mozjs.dll
2011-04-05 19:52 . 2011-03-18 18:05 15832 ----a-w- c:\program files\Mozilla Firefox\mozalloc.dll
2011-04-05 19:52 . 2011-03-18 18:05 142296 ----a-w- c:\program files\Mozilla Firefox\libEGL.dll
2011-04-05 19:33 . 2011-04-05 19:33 -------- d-sh--w- c:\documents and settings\Administrator\IETldCache
2011-04-05 19:28 . 2011-04-05 19:30 -------- d-----w- c:\windows\system32\cs-CZ
2011-04-05 19:28 . 2011-04-05 19:29 -------- dc-h--w- c:\windows\ie8
2011-04-04 11:46 . 2011-04-04 11:48 -------- d-----w- c:\program files\ESET
2011-04-01 08:36 . 2011-04-01 08:36 -------- d-----w- c:\windows\XXLGS
2011-03-07 08:41 . 2011-03-07 10:54 -------- d--h--w- c:\documents and settings\All Users\Data aplikací\~0
2011-03-07 08:26 . 2011-03-07 08:26 -------- d-----w- c:\documents and settings\Administrator\Data aplikací\Thinstall
2011-03-07 05:45 . 2011-03-07 05:45 -------- d-----w- c:\program files\7-Zip
2011-03-06 21:50 . 2011-03-06 21:50 -------- d-----w- c:\documents and settings\Administrator\Data aplikací\Malwarebytes
2011-03-06 21:50 . 2011-03-06 21:50 -------- d-----w- c:\documents and settings\All Users\Data aplikací\Malwarebytes
2011-03-06 21:35 . 2011-03-06 21:35 -------- d-----w- c:\documents and settings\All Users\Uniblue
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-03-06 17:06 . 2011-03-06 16:46 43520 ----a-w- c:\windows\system32\CmdLineExt03.dll
2011-03-06 17:01 . 2010-09-26 23:31 717296 ----a-w- c:\windows\system32\drivers\sptd.sys
2011-02-26 13:06 . 2011-02-26 13:06 172032 ----a-w- c:\windows\system32\AniGIF.ocx
2011-02-26 06:07 . 2011-02-26 06:07 29184 ----a-w- c:\windows\system32\systemac.dll
2011-03-18 18:05 . 2011-04-05 19:52 142296 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((( SnapShot@2011-04-04_13.52.31 )))))))))))))))))))))))))))))))))))))))))
.
+ 2011-04-05 19:33 . 2011-04-05 19:33 16384 c:\windows\Temp\Perflib_Perfdata_204.dat
+ 2009-08-06 17:24 . 2009-08-06 17:24 44768 c:\windows\system32\wups2.dll
+ 2008-07-07 14:41 . 2009-08-06 17:24 35552 c:\windows\system32\wups.dll
+ 2008-07-07 14:11 . 2009-08-06 17:24 53472 c:\windows\system32\wuauclt.exe
+ 2008-07-07 14:36 . 2009-01-07 16:20 26144 c:\windows\system32\spupdsvc.exe
- 2008-07-07 14:36 . 2008-11-07 17:55 26144 c:\windows\system32\spupdsvc.exe
+ 2011-03-02 08:24 . 2009-01-07 16:20 17952 c:\windows\system32\spmsg.dll
+ 2011-04-04 13:56 . 2009-08-06 17:24 35552 c:\windows\system32\SoftwareDistribution\Setup\ServiceStartup\wups.dll\7.4.7600.226\wups.dll
+ 2002-09-20 18:04 . 2009-03-08 02:31 46592 c:\windows\system32\pngfilt.dll
+ 2001-10-25 12:00 . 2011-04-05 18:02 49198 c:\windows\system32\perfc009.dat
- 2001-10-25 12:00 . 2011-03-27 18:26 49198 c:\windows\system32\perfc009.dat
- 2001-10-25 12:00 . 2011-03-27 18:26 56590 c:\windows\system32\perfc005.dat
+ 2001-10-25 12:00 . 2011-04-05 18:02 56590 c:\windows\system32\perfc005.dat
+ 2009-01-07 16:20 . 2009-01-07 16:20 23552 c:\windows\system32\normaliz.dll
+ 2009-01-07 16:20 . 2009-01-07 16:20 24576 c:\windows\system32\nlsdl.dll
+ 2002-09-20 18:01 . 2009-03-08 02:31 48128 c:\windows\system32\mshtmler.dll
+ 2002-09-20 18:04 . 2009-03-08 02:31 66560 c:\windows\system32\mshtmled.dll
+ 2001-10-25 12:00 . 2009-03-08 02:31 45568 c:\windows\system32\mshta.exe
+ 2009-03-08 02:31 . 2009-03-08 02:31 13312 c:\windows\system32\msfeedssync.exe
+ 2009-03-08 02:31 . 2009-03-08 02:31 55296 c:\windows\system32\msfeedsbs.dll
+ 2002-09-20 18:04 . 2009-03-08 02:34 43008 c:\windows\system32\licmgr10.dll
+ 2001-10-25 12:00 . 2009-03-08 02:33 25600 c:\windows\system32\jsproxy.dll
+ 2002-09-20 18:04 . 2009-03-08 02:32 94720 c:\windows\system32\inseng.dll
+ 2002-09-20 18:03 . 2009-03-08 02:31 34816 c:\windows\system32\imgutil.dll
+ 2009-03-08 02:32 . 2009-03-08 02:32 36864 c:\windows\system32\ieudinit.exe
+ 2002-09-20 18:03 . 2009-03-08 02:32 71680 c:\windows\system32\iesetup.dll
+ 2001-10-25 12:00 . 2009-03-08 02:32 55808 c:\windows\system32\iernonce.dll
+ 2009-01-07 16:20 . 2009-01-07 16:20 26112 c:\windows\system32\idndl.dll
+ 2009-03-08 02:31 . 2009-03-08 02:31 59904 c:\windows\system32\icardie.dll
+ 2008-07-07 14:41 . 2009-08-06 17:24 35552 c:\windows\system32\dllcache\wups.dll
+ 2008-07-07 14:11 . 2009-08-06 17:24 53472 c:\windows\system32\dllcache\wuauclt.exe
+ 2002-09-20 18:04 . 2009-03-08 02:31 46592 c:\windows\system32\dllcache\pngfilt.dll
+ 2002-09-20 18:01 . 2009-03-08 02:31 48128 c:\windows\system32\dllcache\mshtmler.dll
+ 2002-09-20 18:04 . 2009-03-08 02:31 66560 c:\windows\system32\dllcache\mshtmled.dll
+ 2001-10-25 12:00 . 2009-03-08 02:31 45568 c:\windows\system32\dllcache\mshta.exe
+ 2002-09-20 18:04 . 2009-03-08 02:34 43008 c:\windows\system32\dllcache\licmgr10.dll
+ 2001-10-25 12:00 . 2009-03-08 02:33 25600 c:\windows\system32\dllcache\jsproxy.dll
+ 2002-09-20 18:04 . 2009-03-08 02:32 94720 c:\windows\system32\dllcache\inseng.dll
+ 2002-09-20 18:03 . 2009-03-08 02:31 34816 c:\windows\system32\dllcache\imgutil.dll
+ 2002-09-20 18:03 . 2009-03-08 02:32 71680 c:\windows\system32\dllcache\iesetup.dll
+ 2001-10-25 12:00 . 2009-03-08 02:32 55808 c:\windows\system32\dllcache\iernonce.dll
+ 2009-03-08 02:24 . 2009-03-08 02:24 68608 c:\windows\system32\dllcache\hmmapi.dll
+ 2001-10-25 12:00 . 2009-03-08 02:33 18944 c:\windows\system32\dllcache\corpol.dll
+ 2002-09-20 18:03 . 2009-08-06 17:24 96480 c:\windows\system32\dllcache\cdm.dll
+ 2001-10-25 12:00 . 2009-03-08 02:32 72704 c:\windows\system32\dllcache\admparse.dll
+ 2001-10-25 12:00 . 2009-03-08 02:33 18944 c:\windows\system32\corpol.dll
+ 2002-09-20 18:03 . 2009-08-06 17:24 96480 c:\windows\system32\cdm.dll
+ 2001-10-25 12:00 . 2009-03-08 02:32 72704 c:\windows\system32\admparse.dll
+ 2011-04-05 19:29 . 2004-08-17 13:49 37888 c:\windows\ie8\url.dll
+ 2011-04-05 19:29 . 2009-03-08 14:57 58448 c:\windows\ie8\spuninst\iecustom.dll
+ 2011-04-05 19:28 . 2004-08-17 13:49 39424 c:\windows\ie8\pngfilt.dll
+ 2011-04-05 19:29 . 2004-08-17 13:49 96768 c:\windows\ie8\occache.dll
+ 2011-04-05 19:28 . 2004-08-17 13:48 56832 c:\windows\ie8\mshtmler.dll
+ 2011-04-05 19:28 . 2004-08-17 13:49 29184 c:\windows\ie8\mshta.exe
+ 2011-04-05 19:28 . 2004-08-17 13:49 22016 c:\windows\ie8\licmgr10.dll
+ 2011-04-05 19:28 . 2004-08-17 13:49 15872 c:\windows\ie8\jsproxy.dll
+ 2011-04-05 19:28 . 2004-08-17 13:49 96768 c:\windows\ie8\inseng.dll
+ 2011-04-05 19:28 . 2004-08-17 13:49 35840 c:\windows\ie8\imgutil.dll
+ 2011-04-05 19:28 . 2004-08-17 13:49 93184 c:\windows\ie8\iexplore.exe
+ 2011-04-05 19:28 . 2004-08-17 13:49 62976 c:\windows\ie8\iesetup.dll
+ 2011-04-05 19:28 . 2004-08-17 13:49 48640 c:\windows\ie8\iernonce.dll
+ 2011-04-05 19:28 . 2004-08-17 13:49 81920 c:\windows\ie8\ieencode.dll
+ 2011-04-05 19:28 . 2004-08-17 13:49 34304 c:\windows\ie8\ie4uinit.exe
+ 2011-04-05 19:28 . 2004-08-17 13:49 38912 c:\windows\ie8\hmmapi.dll
+ 2011-04-05 19:28 . 2004-08-17 13:49 35328 c:\windows\ie8\corpol.dll
+ 2011-04-05 19:28 . 2004-08-17 13:49 61440 c:\windows\ie8\admparse.dll
- 2009-11-01 15:59 . 2011-03-07 02:30 2064 c:\windows\system32\d3d8caps.dat
+ 2009-11-01 15:59 . 2011-04-04 14:40 2064 c:\windows\system32\d3d8caps.dat
+ 2009-01-07 16:21 . 2009-01-07 16:21 121856 c:\windows\system32\xmllite.dll
+ 2008-07-07 14:41 . 2009-08-06 17:24 209632 c:\windows\system32\wuweb.dll
+ 2008-07-07 14:41 . 2009-08-06 17:24 327896 c:\windows\system32\wucltui.dll
+ 2008-07-07 14:41 . 2009-08-06 17:23 575704 c:\windows\system32\wuapi.dll
+ 2002-09-20 18:05 . 2009-03-08 02:34 914944 c:\windows\system32\wininet.dll
+ 2009-03-08 02:34 . 2009-03-08 02:34 208384 c:\windows\system32\WinFXDocObj.exe
+ 2002-09-20 18:05 . 2009-03-08 02:34 236544 c:\windows\system32\webcheck.dll
+ 2002-09-20 18:04 . 2009-03-08 02:33 420352 c:\windows\system32\vbscript.dll
+ 2002-09-20 18:04 . 2009-03-08 02:34 105984 c:\windows\system32\url.dll
+ 2002-09-20 18:04 . 2009-01-07 16:20 474112 c:\windows\system32\shlwapi.dll
+ 2001-10-25 12:00 . 2011-04-05 18:02 390094 c:\windows\system32\perfh009.dat
- 2001-10-25 12:00 . 2011-03-27 18:26 390094 c:\windows\system32\perfh009.dat
- 2001-10-25 12:00 . 2011-03-27 18:26 387954 c:\windows\system32\perfh005.dat
+ 2001-10-25 12:00 . 2011-04-05 18:02 387954 c:\windows\system32\perfh005.dat
+ 2001-10-25 12:00 . 2009-03-08 02:34 109568 c:\windows\system32\occache.dll
+ 2002-09-20 18:04 . 2009-03-08 02:32 611840 c:\windows\system32\mstime.dll
+ 2002-09-20 18:04 . 2009-03-08 02:34 193536 c:\windows\system32\msrating.dll
+ 2001-10-25 12:00 . 2009-03-08 02:22 156160 c:\windows\system32\msls31.dll
+ 2009-03-08 02:32 . 2009-03-08 02:32 594432 c:\windows\system32\msfeeds.dll
+ 2009-01-07 16:20 . 2009-01-07 16:20 265720 c:\windows\system32\msdbg2.dll
+ 2001-10-25 12:00 . 2009-03-08 02:33 726528 c:\windows\system32\jscript.dll
+ 2009-03-08 02:22 . 2009-03-08 02:22 164352 c:\windows\system32\ieui.dll
+ 2002-09-20 18:03 . 2009-03-08 02:31 183808 c:\windows\system32\iepeers.dll
+ 2002-09-20 18:03 . 2009-03-08 12:09 391536 c:\windows\system32\iedkcs32.dll
+ 2009-03-08 02:11 . 2009-03-08 02:11 445952 c:\windows\system32\ieapfltr.dll
+ 2001-10-25 12:00 . 2009-03-08 02:32 163840 c:\windows\system32\ieakui.dll
+ 2002-09-20 18:03 . 2009-03-08 02:33 229376 c:\windows\system32\ieaksie.dll
+ 2002-09-20 18:03 . 2009-03-08 02:33 125952 c:\windows\system32\ieakeng.dll
+ 2002-09-20 18:05 . 2009-03-08 02:32 173056 c:\windows\system32\ie4uinit.exe
+ 2002-09-20 18:03 . 2009-03-08 02:31 216064 c:\windows\system32\dxtrans.dll
+ 2002-09-20 18:03 . 2009-03-08 02:31 348160 c:\windows\system32\dxtmsft.dll
+ 2008-07-07 14:41 . 2009-08-06 17:24 209632 c:\windows\system32\dllcache\wuweb.dll
+ 2008-07-07 14:41 . 2009-08-06 17:24 327896 c:\windows\system32\dllcache\wucltui.dll
+ 2008-07-07 14:41 . 2009-08-06 17:23 575704 c:\windows\system32\dllcache\wuapi.dll
+ 2009-03-08 02:34 . 2009-03-08 02:34 914944 c:\windows\system32\dllcache\wininet.dll
+ 2009-03-08 02:34 . 2009-03-08 02:34 236544 c:\windows\system32\dllcache\webcheck.dll
+ 2009-03-08 02:33 . 2009-03-08 02:33 759296 c:\windows\system32\dllcache\VGX.dll
+ 2002-09-20 18:04 . 2009-03-08 02:33 420352 c:\windows\system32\dllcache\vbscript.dll
+ 2009-03-08 02:34 . 2009-03-08 02:34 105984 c:\windows\system32\dllcache\url.dll
+ 2009-01-07 16:20 . 2009-01-07 16:20 134144 c:\windows\system32\dllcache\sqmapi.dll
+ 2009-01-07 16:20 . 2009-01-07 16:20 474112 c:\windows\system32\dllcache\shlwapi.dll
+ 2009-03-08 02:34 . 2009-03-08 02:34 109568 c:\windows\system32\dllcache\occache.dll
+ 2002-09-20 18:04 . 2009-03-08 02:32 611840 c:\windows\system32\dllcache\mstime.dll
+ 2002-09-20 18:04 . 2009-03-08 02:34 193536 c:\windows\system32\dllcache\msrating.dll
+ 2001-10-25 12:00 . 2009-03-08 02:22 156160 c:\windows\system32\dllcache\msls31.dll
+ 2001-10-25 12:00 . 2009-03-08 02:33 726528 c:\windows\system32\dllcache\jscript.dll
+ 2009-03-08 12:09 . 2009-03-08 12:09 638816 c:\windows\system32\dllcache\iexplore.exe
+ 2002-09-20 18:03 . 2009-03-08 02:31 183808 c:\windows\system32\dllcache\iepeers.dll
+ 2002-09-20 18:03 . 2009-03-08 12:09 391536 c:\windows\system32\dllcache\iedkcs32.dll
+ 2001-10-25 12:00 . 2009-03-08 02:32 163840 c:\windows\system32\dllcache\ieakui.dll
+ 2002-09-20 18:03 . 2009-03-08 02:33 229376 c:\windows\system32\dllcache\ieaksie.dll
+ 2002-09-20 18:03 . 2009-03-08 02:33 125952 c:\windows\system32\dllcache\ieakeng.dll
+ 2002-09-20 18:05 . 2009-03-08 02:32 173056 c:\windows\system32\dllcache\ie4uinit.exe
+ 2002-09-20 18:03 . 2009-03-08 02:31 216064 c:\windows\system32\dllcache\dxtrans.dll
+ 2002-09-20 18:03 . 2009-03-08 02:31 348160 c:\windows\system32\dllcache\dxtmsft.dll
+ 2009-03-08 02:32 . 2009-03-08 02:32 128512 c:\windows\system32\dllcache\advpack.dll
+ 2002-09-20 18:03 . 2009-03-08 02:32 128512 c:\windows\system32\advpack.dll
+ 2011-04-05 19:29 . 2004-08-17 13:49 657408 c:\windows\ie8\wininet.dll
+ 2011-04-05 19:29 . 2004-08-17 13:49 278528 c:\windows\ie8\webcheck.dll
+ 2011-04-05 19:29 . 2004-08-17 13:49 848384 c:\windows\ie8\vgx.dll
+ 2011-04-05 19:28 . 2004-08-17 13:49 417792 c:\windows\ie8\vbscript.dll
+ 2011-04-05 19:29 . 2004-08-17 13:49 601600 c:\windows\ie8\urlmon.dll
+ 2011-04-05 19:29 . 2009-01-07 16:20 390688 c:\windows\ie8\spuninst\updspapi.dll
+ 2011-04-05 19:29 . 2009-01-07 16:20 234016 c:\windows\ie8\spuninst\spuninst.exe
+ 2011-04-05 19:29 . 2004-08-17 13:49 473600 c:\windows\ie8\shlwapi.dll
+ 2011-04-05 19:28 . 2004-08-17 13:49 530432 c:\windows\ie8\mstime.dll
+ 2011-04-05 19:28 . 2004-08-17 13:49 146432 c:\windows\ie8\msrating.dll
+ 2011-04-05 19:28 . 2001-10-25 12:00 146432 c:\windows\ie8\msls31.dll
+ 2011-04-05 19:28 . 2004-08-17 13:49 448512 c:\windows\ie8\mshtmled.dll
+ 2011-04-05 19:28 . 2004-08-17 13:49 450560 c:\windows\ie8\jscript.dll
+ 2011-04-05 19:28 . 2004-08-17 13:49 249344 c:\windows\ie8\iepeers.dll
+ 2011-04-05 19:28 . 2004-08-17 13:49 323584 c:\windows\ie8\iedkcs32.dll
+ 2011-04-05 19:28 . 2001-10-25 12:00 225280 c:\windows\ie8\ieakui.dll
+ 2011-04-05 19:28 . 2004-08-17 13:49 219136 c:\windows\ie8\ieaksie.dll
+ 2011-04-05 19:28 . 2004-08-17 13:49 139264 c:\windows\ie8\ieakeng.dll
+ 2011-04-05 19:28 . 2004-08-17 13:49 201728 c:\windows\ie8\dxtrans.dll
+ 2011-04-05 19:28 . 2004-08-17 13:49 357888 c:\windows\ie8\dxtmsft.dll
+ 2011-04-05 19:29 . 2004-08-17 13:49 100352 c:\windows\ie8\advpack.dll
+ 2008-07-07 14:11 . 2009-08-06 17:23 1929952 c:\windows\system32\wuaueng.dll
+ 2002-09-20 18:04 . 2009-03-08 02:34 1206784 c:\windows\system32\urlmon.dll
+ 2002-09-20 18:04 . 2009-01-07 16:20 1497600 c:\windows\system32\shdocvw.dll
+ 2002-09-20 18:04 . 2009-03-08 02:41 5937152 c:\windows\system32\mshtml.dll
+ 2009-03-08 02:32 . 2009-03-08 02:32 1985024 c:\windows\system32\iertutil.dll
+ 2009-02-06 19:07 . 2009-02-06 19:07 3698584 c:\windows\system32\ieapfltr.dat
+ 2008-07-07 14:11 . 2009-08-06 17:23 1929952 c:\windows\system32\dllcache\wuaueng.dll
+ 2009-03-08 02:34 . 2009-03-08 02:34 1206784 c:\windows\system32\dllcache\urlmon.dll
+ 2009-01-07 16:20 . 2009-01-07 16:20 1497600 c:\windows\system32\dllcache\shdocvw.dll
+ 2009-03-08 02:41 . 2009-03-08 02:41 5937152 c:\windows\system32\dllcache\mshtml.dll
+ 2009-01-07 16:20 . 2009-01-07 16:20 1022976 c:\windows\system32\dllcache\browseui.dll
+ 2002-09-20 18:03 . 2009-01-07 16:20 1022976 c:\windows\system32\browseui.dll
+ 2011-04-05 19:29 . 2004-08-17 13:49 1483776 c:\windows\ie8\shdocvw.dll
+ 2011-04-05 19:29 . 2004-08-17 13:49 3003392 c:\windows\ie8\mshtml.dll
+ 2011-04-05 19:29 . 2004-08-17 13:49 1016832 c:\windows\ie8\browseui.dll
+ 2009-03-08 02:39 . 2009-03-08 02:39 11063808 c:\windows\system32\ieframe.dll
.
-- Snapshot reset to current date --
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{389943B0-C3A2-4E69-82CB-8596A84CB3DC}]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"egui"="c:\program files\ESET\ESET Smart Security\egui.exe" [2009-09-11 2054360]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2004-08-17 15360]
.
c:\documents and settings\All Users\Nabˇdka Start\Programy\Po spuçtŘnˇ\
Aktualizovat ESET licenci.lnk - c:\qoobox\Quarantine\C\Program Files\ESET\MiNODLogin\MiNODLogin.exe.vir [2009-8-22 125952]
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
.
R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [11.9.2009 7:23 108792]
R2 ekrn;ESET Service;c:\program files\ESET\ESET Smart Security\ekrn.exe [11.9.2009 7:24 735960]
R3 PAC207;Trust WB-1400T Webcam;c:\windows\system32\drivers\PFC027.SYS [14.5.2007 10:26 508288]
R3 S3SAVAGE4M;S3SAVAGE4M;c:\windows\system32\drivers\s3sav4m.sys [7.7.2008 18:00 77824]
S0 mfemhvrxogcp;mfemhvrxogcp; [x]
S1 SASDIFSV;SASDIFSV;\??\e:\my download files\antispywer\SASDIFSV.SYS --> e:\my download files\antispywer\SASDIFSV.SYS [?]
S1 SASKUTIL;SASKUTIL;\??\e:\my download files\antispywer\SASKUTIL.sys --> e:\my download files\antispywer\SASKUTIL.sys [?]
S1 zmcadvafppwy5;zmcadvafppwy5;c:\windows\system32\drivers\zmcadvafppwy5.sys --> c:\windows\system32\drivers\zmcadvafppwy5.sys [?]
S2 AMService;AMService;c:\windows\TEMP\gerx\setup.exe run --> c:\windows\TEMP\gerx\setup.exe run [?]
S3 ATE_PROCMON;ATE_PROCMON;\??\d:\my download files\trojan\Anti Trojan Elite\ATEPMon.sys --> d:\my download files\trojan\Anti Trojan Elite\ATEPMon.sys [?]
S3 SASENUM;SASENUM;\??\e:\my download files\antispywer\SASENUM.SYS --> e:\my download files\antispywer\SASENUM.SYS [?]
S3 SetupNTGLM7X;SetupNTGLM7X;\??\f:\ntglm7x.sys --> f:\NTGLM7X.sys [?]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://pobox.sk/
mWindow Title = Microsoft Internet Explorer
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyOverride = *.local
IE: Add to AMV Convert Tool... - c:\program files\MP3 Player Utilities 4.00\AMVConverter\grab.html
IE: Download with Star Downloader - e:\my download files\ACCELELATOR PLUS\Star Downloader\sdie.htm
IE: E&xportovať do programu Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
IE: MediaManager tool grab multimedia file - c:\program files\MP3 Player Utilities 4.00\MediaManager\grab.html
IE: {{7E6A20FB-153F-402c-A84B-1A64E1955D3D} - {7E6A20FB-153F-402c-A84B-1A64E1955D3D} - e:\preklad\TRANSLAT\WEBIE.DLL
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748450} - {CC963627-B1DC-40E0-B52A-CF21EE748450} - e:\preklad\TRANSLAT\WEBIE.DLL
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748451} - {CC963627-B1DC-40E0-B52A-CF21EE748451} - e:\preklad\TRANSLAT\WEBIE.DLL
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748452} - {CC963627-B1DC-40E0-B52A-CF21EE748452} - e:\preklad\TRANSLAT\WEBIE.DLL
DPF: DirectAnimation Java Classes
DPF: Microsoft XML Parser for Java
FF - ProfilePath - c:\documents and settings\Administrator\Data aplikací\Mozilla\Firefox\Profiles\sa3oy8yh.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2463487&SearchSource=3&q={searchTerms}
FF - prefs.js: browser.startup.homepage - pobox.sk
FF - user.js: network.http.max-persistent-connections-per-server - 4
FF - user.js: nglayout.initialpaint.delay - 600
FF - user.js: content.notify.interval - 600000
FF - user.js: content.max.tokenizing.time - 1800000
FF - user.js: content.switch.threshold - 600000
.
- - - - ORPHANS REMOVED - - - -
.
AddRemove-Web Translator - c:\documents and settings\Administrator\Local Settings\Temporary Internet Files\UN32.EXE
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-04-05 22:26
Windows 5.1.2600 Service Pack 2 NTFS
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
scanning hidden files ...
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_USERS\S-1-5-21-1957994488-1677128483-854245398-500\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (Administrator)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,57,fe,94,e8,f9,a9,65,49,b0,f4,f4,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,57,fe,94,e8,f9,a9,65,49,b0,f4,f4,\
.
Completion time: 2011-04-05 22:29:51
ComboFix-quarantined-files.txt 2011-04-05 20:29
ComboFix2.txt 2011-04-04 14:33
ComboFix3.txt 2011-04-04 13:57
.
Pre-Run: 2 492 968 960
Post-Run: 2 481 905 664
.
Current=6 Default=6 Failed=3 LastKnownGood=7 Sets=1,3,4,5,6,7
- - End Of File - - 28FB6F0F736F761A78C4DF8685A8E6BD

#6 Příspěvek od **motji** » 09 dub 2011 08:37

Pomoct se dá, ale když jste laik, nepoužívejte tyhle programy sám. Ani combofix, občas má nějaký bug, maže co nemá

. Navíc když ho použijete, já nevidím, co odstranil, vyléčil..koukám že u Vás se teda vyřádil

Dívám se, že jste použil kdejaký program. Antitrojan Elite odinstalujte, ten tu vůbec nedoporučujeme. Příště se raději rovnou obraťte na nás

.

Odinstalujte ten nelegální NOd a dáte si nějaký free antivir, Avast nebo Aviru.

Pokud nemáte, přesuňte Combofix na plochu
-otevřete si Poznámkový blok
-Do něj zkopírujte text z tohoto okénka

Kód: Vybrat vše

Driver::
mfemhvrxogcp
zmcadvafppwy5

Collect::
c:\windows\system32\drivers\zmcadvafppwy5.sys

Folder::
d:\my download files\trojan\Anti Trojan Elite

File::
c:\windows\system32\KillBox.exe

-uložte Vámi vytvořený TXT soubor jako CFScript.txt na plochu
-po uložení uchopte vámi vytvořený skript levým myšítkem a -přesuňte ho nad ikonu Combofixu, kde ho upustíte:

Obrázek

-po aplikaci na Vás vypadne další log,vložte ho sem

Upozornění : může se stát, že po aplikaci skriptu a restartu Windows nenaběhnou, v tom případě znovu restartujte a přitom mačkejte F8, pak zvolte Poslední známou funkční konfiguraci

ringov · #7 Příspěvek od **ringov** » 09 dub 2011 09:17

ComboFix 11-04-08.02 - Administrator 09.04.2011 9:54.7.1 - x86
Systém Microsoft Windows XP Professional 5.1.2600.2.1250.421.1029.18.511.222 [GMT 2:00]
Running from: c:\documents and settings\Administrator\Plocha\ComboFix.exe
Command switches used :: c:\documents and settings\Administrator\Plocha\CFScript.txt
.
FILE ::
"c:\windows\system32\KillBox.exe"
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\Administrator\Dokumenty\cc_20110408_134016.reg
.
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Service_mfemhvrxogcp
-------\Service_zmcadvafppwy5
-------\Legacy_ATE_PROCMON
-------\Service_ATE_PROCMON
.
.
((((((((((((((((((((((((( Files Created from 2011-03-09 to 2011-04-09 )))))))))))))))))))))))))))))))
.
.
2011-04-09 07:21 . 2011-04-09 07:37 -------- d-----w- c:\windows\system32\NtmsData
2011-04-09 05:25 . 2011-04-09 05:25 -------- d--h--w- c:\windows\system32\GroupPolicy
2011-04-09 04:46 . 2011-04-09 08:08 -------- d-----w- c:\windows\SxsCaPendDel
2011-04-08 13:15 . 2009-10-22 11:54 37392 ----a-w- c:\windows\system32\drivers\23914352.sys
2011-04-08 13:15 . 2009-10-09 21:31 315408 ----a-w- c:\windows\system32\drivers\2391435.sys
2011-04-08 13:15 . 2009-09-25 15:59 128016 ----a-w- c:\windows\system32\drivers\23914351.sys
2011-04-08 11:34 . 2011-04-08 11:34 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Data aplikací\Google
2011-04-08 11:30 . 2011-04-08 11:30 -------- d-----w- c:\program files\CCleaner
2011-04-08 11:29 . 2011-04-08 11:34 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Data aplikací\Temp
2011-04-08 11:29 . 2011-04-08 11:29 -------- d-----w- c:\documents and settings\LocalService\Local Settings\Data aplikací\Google
2011-04-08 11:29 . 2011-04-08 11:40 -------- d-----w- c:\program files\Google
2011-04-08 11:02 . 2010-12-20 16:09 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-04-08 11:02 . 2011-04-08 11:02 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2011-04-08 11:02 . 2010-12-20 16:08 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-04-08 10:05 . 2011-04-08 10:06 -------- d-----w- C:\rsit
2011-04-08 08:50 . 2011-04-08 08:50 12288 ----a-w- c:\windows\system32\drivers\sp_prot.sys
2011-04-08 08:50 . 2011-04-08 08:50 -------- d-----w- c:\program files\System Protect
2011-04-08 08:04 . 2006-08-01 13:02 49152 ----a-w- c:\windows\system32\ChCfg.exe
2011-04-08 08:04 . 2006-12-29 12:48 4026112 ----a-r- c:\windows\system32\drivers\alcxwdm.sys
2011-04-08 08:02 . 2011-04-08 08:02 331908 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\11\50\Intel32\setup.dll
2011-04-07 11:22 . 2011-04-07 11:22 -------- d-sh--w- c:\documents and settings\Administrator\IECompatCache
2011-04-07 09:48 . 2011-04-08 10:06 -------- d-----w- c:\program files\trend micro
2011-04-06 14:53 . 2011-04-06 14:53 -------- d-----w- c:\program files\C-Media
2011-04-06 14:05 . 2011-04-06 14:05 -------- d-sh--w- c:\documents and settings\NetworkService\IETldCache
2011-04-06 13:48 . 2010-12-14 12:39 29504 ----a-w- c:\windows\system32\uxtuneup.dll
2011-04-06 07:08 . 2011-04-06 07:08 -------- d-sh--w- c:\documents and settings\LocalService\IETldCache
2011-04-06 06:49 . 2011-04-06 06:49 -------- d-sh--w- c:\documents and settings\All Users\Data aplikací\{24036256-BFDB-4CD3-BE8A-A3D6160F2E16}
2011-04-05 22:18 . 2011-04-05 22:17 92672 ----a-w- c:\windows\system32\KillBox.exe
2011-04-05 22:05 . 2011-04-08 07:42 -------- d-----w- c:\program files\WinClamAVShield
2011-04-05 21:13 . 2011-04-05 21:13 -------- d-----w- c:\program files\Common Files\Java
2011-04-05 21:13 . 2011-04-05 21:11 73728 ----a-w- c:\windows\system32\javacpl.cpl
2011-04-05 21:00 . 2011-04-05 21:00 -------- d-----w- c:\program files\Crawler
2011-04-05 20:59 . 2011-04-05 20:59 142592 ----a-w- c:\windows\system32\drivers\sp_rsdrv2.sys
2011-04-05 20:59 . 2011-04-09 07:42 -------- d-----w- c:\documents and settings\Administrator\Data aplikací\Spyware Terminator
2011-04-05 20:59 . 2011-04-09 04:40 -------- d-----w- c:\documents and settings\All Users\Data aplikací\Spyware Terminator
2011-04-05 20:59 . 2011-04-08 22:10 -------- d-----w- c:\program files\Spyware Terminator
2011-04-05 20:51 . 2011-04-05 20:51 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Data aplikací\Secunia PSI
2011-04-05 20:50 . 2011-04-05 20:50 -------- d-----w- c:\program files\Secunia
2011-04-05 20:11 . 2011-04-05 20:11 -------- d-sh--w- c:\documents and settings\Administrator\PrivacIE
2011-04-05 19:52 . 2011-03-18 18:05 142296 ----a-w- c:\program files\Mozilla Firefox\components\browsercomps.dll
2011-04-05 19:52 . 2011-03-18 18:05 781272 ----a-w- c:\program files\Mozilla Firefox\mozsqlite3.dll
2011-04-05 19:52 . 2011-03-18 18:05 728024 ----a-w- c:\program files\Mozilla Firefox\libGLESv2.dll
2011-04-05 19:52 . 2011-03-18 18:05 1975768 ----a-w- c:\program files\Mozilla Firefox\D3DCompiler_42.dll
2011-04-05 19:52 . 2011-03-18 18:05 1893336 ----a-w- c:\program files\Mozilla Firefox\d3dx9_42.dll
2011-04-05 19:52 . 2011-03-18 18:05 1874904 ----a-w- c:\program files\Mozilla Firefox\mozjs.dll
2011-04-05 19:52 . 2011-03-18 18:05 15832 ----a-w- c:\program files\Mozilla Firefox\mozalloc.dll
2011-04-05 19:52 . 2011-03-18 18:05 142296 ----a-w- c:\program files\Mozilla Firefox\libEGL.dll
2011-04-05 19:33 . 2011-04-05 19:33 -------- d-sh--w- c:\documents and settings\Administrator\IETldCache
2011-04-05 19:28 . 2011-04-05 19:30 -------- d-----w- c:\windows\system32\cs-CZ
2011-04-05 19:28 . 2011-04-05 19:29 -------- dc-h--w- c:\windows\ie8
2011-04-04 11:46 . 2011-04-05 21:25 -------- d-----w- c:\program files\ESET
2011-04-01 08:36 . 2011-04-01 08:36 -------- d-----w- c:\windows\XXLGS
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-04-05 21:11 . 2010-08-02 15:22 472808 ----a-w- c:\windows\system32\deployJava1.dll
2011-03-06 17:06 . 2011-03-06 16:46 43520 ----a-w- c:\windows\system32\CmdLineExt03.dll
2011-03-06 17:01 . 2010-09-26 23:31 717296 ----a-w- c:\windows\system32\drivers\sptd.sys
2011-02-26 13:06 . 2011-02-26 13:06 172032 ----a-w- c:\windows\system32\AniGIF.ocx
2011-03-18 18:05 . 2011-04-05 19:52 142296 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((( SnapShot_2011-04-05_20.26.41 )))))))))))))))))))))))))))))))))))))))))
.
+ 2011-04-09 08:08 . 2011-04-09 08:08 16384 c:\windows\temp\Perflib_Perfdata_7dc.dat
+ 2011-04-09 04:06 . 2011-04-09 04:06 16384 c:\windows\temp\Perflib_Perfdata_704.dat
- 2001-10-25 12:00 . 2011-04-05 18:02 49198 c:\windows\system32\perfc009.dat
+ 2001-10-25 12:00 . 2011-04-08 07:48 49198 c:\windows\system32\perfc009.dat
+ 2001-10-25 12:00 . 2011-04-08 07:48 56590 c:\windows\system32\perfc005.dat
- 2001-10-25 12:00 . 2011-04-05 18:02 56590 c:\windows\system32\perfc005.dat
+ 2011-04-08 08:04 . 2006-08-01 13:02 49152 c:\windows\system32\ChCfg.exe
+ 2011-04-08 11:29 . 2011-04-08 11:29 22528 c:\windows\Installer\ba1f02.msi
+ 2008-08-26 06:28 . 2011-04-06 09:38 2176 c:\windows\system32\d3d9caps.dat
- 2008-08-26 06:28 . 2011-03-21 11:04 2176 c:\windows\system32\d3d9caps.dat
- 2009-11-01 15:59 . 2011-04-04 14:40 2064 c:\windows\system32\d3d8caps.dat
+ 2009-11-01 15:59 . 2011-04-07 11:40 2064 c:\windows\system32\d3d8caps.dat
+ 2011-04-08 08:03 . 2006-10-18 00:53 147456 c:\windows\system32\RtlCPAPI.dll
+ 2008-07-30 16:16 . 2011-04-06 13:27 224924 c:\windows\system32\Restore\rstrlog.dat
+ 2001-10-25 12:00 . 2011-04-08 07:48 390094 c:\windows\system32\perfh009.dat
- 2001-10-25 12:00 . 2011-04-05 18:02 390094 c:\windows\system32\perfh009.dat
- 2001-10-25 12:00 . 2011-04-05 18:02 387954 c:\windows\system32\perfh005.dat
+ 2001-10-25 12:00 . 2011-04-08 07:48 387954 c:\windows\system32\perfh005.dat
+ 2011-04-05 21:20 . 2011-04-05 21:20 235168 c:\windows\system32\Macromed\Flash\FlashUtil10o_Plugin.exe
+ 2011-04-05 21:13 . 2011-04-05 21:11 157472 c:\windows\system32\javaws.exe
+ 2011-04-05 21:13 . 2011-04-05 21:11 145184 c:\windows\system32\javaw.exe
- 2010-08-02 15:22 . 2010-08-02 15:22 145184 c:\windows\system32\javaw.exe
+ 2011-04-05 21:13 . 2011-04-05 21:11 145184 c:\windows\system32\java.exe
- 2010-08-02 15:22 . 2010-08-02 15:22 145184 c:\windows\system32\java.exe
+ 2008-07-17 16:52 . 2011-04-08 11:30 266240 c:\windows\system32\config\systemprofile\ntuser.dat
- 2008-07-17 16:52 . 2010-08-02 14:39 266240 c:\windows\system32\config\systemprofile\ntuser.dat
+ 2011-04-08 08:03 . 2006-11-17 03:42 577536 c:\windows\soundman.exe
+ 2011-04-05 21:13 . 2011-04-05 21:13 180224 c:\windows\Installer\556a25.msi
+ 2011-04-05 21:10 . 2011-04-05 21:10 677376 c:\windows\Installer\556a13.msi
+ 2011-04-08 08:03 . 2006-07-31 09:19 315392 c:\windows\alcupd.exe
+ 2011-04-08 08:03 . 2006-07-31 09:27 217088 c:\windows\Alcrmv.exe
+ 2010-01-27 01:07 . 2011-04-05 21:20 6053536 c:\windows\system32\Macromed\Flash\NPSWF32.dll
+ 2011-04-08 08:03 . 2006-12-08 13:20 10528768 c:\windows\system32\RTLCPL.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SpywareTerminator"="c:\progra~1\SPYWAR~1\SpywareTerminatorShield.exe" [2011-04-05 2216960]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2004-08-17 15360]
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
2004-08-17 13:49 15360 ----a-w- c:\windows\system32\ctfmon.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Malwarebytes' Anti-Malware]
2010-12-20 16:08 443728 ----a-w- c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan]
2006-11-17 03:42 577536 ----a-w- c:\windows\soundman.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2010-10-29 12:49 249064 ----a-w- c:\program files\Common Files\Java\Java Update\jusched.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\Spyware Terminator\\SpywareTerminatorUpdate.exe"=
"d:\\hry\\Nová složka (2)\\age2_x1.exe"=
.
R0 23914352;23914352 Boot Guard Driver;c:\windows\system32\drivers\23914352.sys [8.4.2011 15:15 37392]
R1 23914351;23914351;c:\windows\system32\drivers\23914351.sys [8.4.2011 15:15 128016]
R1 setup_9.0.0.722_08.04.2011_14-41drv;setup_9.0.0.722_08.04.2011_14-41drv;c:\windows\system32\drivers\2391435.sys [8.4.2011 15:15 315408]
R1 sp_rsdrv2;Spyware Terminator Driver 2;c:\windows\system32\drivers\sp_rsdrv2.sys [5.4.2011 22:59 142592]
R2 SP_Service;System Protect Deletion Prevention Service;c:\program files\System Protect\SysProtect_srv.exe [8.4.2011 10:50 598528]
R3 PAC207;Trust WB-1400T Webcam;c:\windows\system32\drivers\PFC027.SYS [14.5.2007 10:26 508288]
R3 S3SAVAGE4M;S3SAVAGE4M;c:\windows\system32\drivers\s3sav4m.sys [7.7.2008 18:00 77824]
R3 sp_prot;System Protect Filter Driver;c:\windows\system32\drivers\sp_prot.sys [8.4.2011 10:50 12288]
S1 SASDIFSV;SASDIFSV;\??\e:\my download files\antispywer\SASDIFSV.SYS --> e:\my download files\antispywer\SASDIFSV.SYS [?]
S1 SASKUTIL;SASKUTIL;\??\e:\my download files\antispywer\SASKUTIL.sys --> e:\my download files\antispywer\SASKUTIL.sys [?]
S2 AMService;AMService;c:\windows\TEMP\gerx\setup.exe run --> c:\windows\TEMP\gerx\setup.exe run [?]
S2 gupdate;Služba Google Update (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [8.4.2011 13:29 136176]
S3 SASENUM;SASENUM;\??\e:\my download files\antispywer\SASENUM.SYS --> e:\my download files\antispywer\SASENUM.SYS [?]
S3 SetupNTGLM7X;SetupNTGLM7X;\??\f:\ntglm7x.sys --> f:\NTGLM7X.sys [?]
.
Contents of the 'Scheduled Tasks' folder
.
2011-04-09 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-04-08 11:27]
.
2011-04-09 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-04-08 11:27]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://pobox.sk/
mWindow Title = Microsoft Internet Explorer
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyOverride = *.local
IE: Add to AMV Convert Tool... - c:\program files\MP3 Player Utilities 4.00\AMVConverter\grab.html
IE: Crawler Search - tbr:iemenu
IE: Download with Star Downloader - e:\my download files\ACCELELATOR PLUS\Star Downloader\sdie.htm
IE: E&xportovať do programu Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
IE: MediaManager tool grab multimedia file - c:\program files\MP3 Player Utilities 4.00\MediaManager\grab.html
Handler: tbr - {4D25FB7A-8902-4291-960E-9ADA051CFBBF} - c:\progra~1\Crawler\Toolbar\ctbr.dll
DPF: DirectAnimation Java Classes
DPF: Microsoft XML Parser for Java
FF - ProfilePath - c:\documents and settings\Administrator\Data aplikací\Mozilla\Firefox\Profiles\sa3oy8yh.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2463487&SearchSource=3&q={searchTerms}
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - pobox.sk
FF - prefs.js: keyword.URL - hxxp://www.crawler.com/search/dispatcher.aspx? ... 60076&qkw=
FF - user.js: network.http.max-persistent-connections-per-server - 4
FF - user.js: nglayout.initialpaint.delay - 600
FF - user.js: content.notify.interval - 600000
FF - user.js: content.max.tokenizing.time - 1800000
FF - user.js: content.switch.threshold - 600000
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-04-09 10:08
Windows 5.1.2600 Service Pack 2 NTFS
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
scanning hidden files ...
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_USERS\S-1-5-21-1957994488-1677128483-854245398-500\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (Administrator)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,57,fe,94,e8,f9,a9,65,49,b0,f4,f4,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,57,fe,94,e8,f9,a9,65,49,b0,f4,f4,\
"6256FFB019F8FDFBD36745B06F4540E9AEAF222A25"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,57,fe,94,e8,f9,a9,65,49,b0,f4,f4,\
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'explorer.exe'(3328)
c:\windows\system32\ieframe.dll
c:\windows\system32\msi.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Spyware Terminator\sp_rsser.exe
.
je to spravne? dukujem **************************************************************************
.
Completion time: 2011-04-09 10:13:49 - machine was rebooted
ComboFix-quarantined-files.txt 2011-04-09 08:13
ComboFix2.txt 2011-04-07 10:33
ComboFix3.txt 2011-04-07 07:22
ComboFix4.txt 2011-04-06 12:39
ComboFix5.txt 2011-04-09 07:52
.
Pre-Run: 2 245 050 368
Post-Run: 2 255 917 056
.
Current=7 Default=7 Failed=6 LastKnownGood=2 Sets=1,2,4,5,6,7
- - End Of File - - 48039D4B04AE9EBDB117400C3CF3FB62

#8 Příspěvek od **motji** » 09 dub 2011 09:23

chlape, když už Vám s tím pomáhám, tak nedělejte sám další skeny různýými programy, děláte mi v tom hokej

.
Našel ten Avptool něco? Jak se chová počítač?

ringov · #9 Příspěvek od **ringov** » 09 dub 2011 13:36

myslim ze naslo 3 virusi utomatická kontrola: dokončeno před <1 minuta (události: 438, objekty: 326823, čas: 03:15:53)
Výsledek: Zjištěno (události: 4)
9.4.2011 11:59 Soubor C:\Program Files\WinRAR\ Zip.SFX
9.4.2011 12:01 Soubor C:\Qoobox\Quarantine\C\Program Files\ESET\MiNODLogin\ MiNODLoginUninst.exe.vir
9.4.2011 01:25 Soubor E:\eset\ESET Smart Security 4 (32bit, 64bit) CZ +LICENCE.zip/ESET Smart Security 4 32bit, 64bit/ ESET Antivirus Licence Finder (MiNODLogin) 3.5.8.9.exe
9.4.2011 01:46 Soubor E:\System Volume Information\_restore{FC23D85B-19FA-41A3-A1E8-3F78EADE4914}\RP8\ A0002945.exe
Výsledek: Odstraněno (události: 4)
9.4.2011 12:02 Soubor C:\Program Files\WinRAR\ Zip.SFX
9.4.2011 12:02 Soubor C:\Qoobox\Quarantine\C\Program Files\ESET\MiNODLogin\ MiNODLoginUninst.exe.vir
9.4.2011 01:27 Soubor E:\eset\ESET Smart Security 4 (32bit, 64bit) CZ +LICENCE.zip/ESET Smart Security 4 32bit, 64bit/ ESET Antivirus Licence Finder (MiNODLogin) 3.5.8.9.exe
9.4.2011 01:48 Soubor E:\System Volume Information\_restore{FC23D85B-19FA-41A3-A1E8-3F78EADE4914}\RP8\ A0002945.exe
Výsledek: Chyba zpracování (události: 428)

#10 Příspěvek od **motji** » 09 dub 2011 19:24

Jak se chová počítač?

ringov · #11 Příspěvek od **ringov** » 09 dub 2011 21:39

sem tam mrzne,ale uz lepsie diky. este tu mam mbam-log na posudenie.Mam spyware terminator je to dobry antivirus? ma aj stit. Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Verzia databázy: 6314

Windows 5.1.2600 Service Pack 2
Internet Explorer 8.0.6001.18702

9.4.2011 22:34:15
mbam-log-2011-04-09 (22-34-15).txt

Typ kontroly: Úplná kontrola (C:\|D:\|E:\|)
Objektov kontrolovaných: 201731
Uplynutý čas: 2 hod, 26 min, 43 sek

Infikované služby pamäte: 0
Infikované moduly pamäte: 0
Infikované registračné kľúče: 0
Infikované registračné hodnoty: 0
Infikované položky registračných dát: 0
Infikované priečinky: 0
Infikované súbory: 1

Infikované služby pamäte:
(Škodlivé položky neboli zistené)

Infikované moduly pamäte:
(Škodlivé položky neboli zistené)

Infikované registračné kľúče:
(Škodlivé položky neboli zistené)

Infikované registračné hodnoty:
(Škodlivé položky neboli zistené)

Infikované položky registračných dát:
(Škodlivé položky neboli zistené)

Infikované priečinky:
(Škodlivé položky neboli zistené)

Infikované súbory:
d:\system volume information\_restore{fc23d85b-19fa-41a3-a1e8-3f78eade4914}\RP8\A0001790.exe (RiskWare.Tool.CK) -> Quarantined and deleted successfully.

#12 Příspěvek od **motji** » 09 dub 2011 21:45

Mrzne u čeho? poprosím o log ze rsitu

ringov · #13 Příspěvek od **ringov** » 09 dub 2011 21:54

mrzne napr.pri otvarani tento pocitac alebo hier. Logfile of random's system information tool 1.08 (written by random/random)
Run by Administrator at 2011-04-09 22:48:54
Systém Microsoft Windows XP Professional Service Pack 2
System drive C: has 2 GB (27%) free of 8 GB
Total RAM: 511 MB (23% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 10:49, on 9.4.2011
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Spyware Terminator\sp_rsser.exe
C:\PROGRA~1\SPYWAR~1\SpywareTerminatorShield.exe
C:\Program Files\System Protect\SysProtect_srv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\PROGRA~1\Crawler\Toolbar\CToolbar.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
E:\rsit\RSIT.exe
C:\Program Files\trend micro\Administrator.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://pobox.sk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://www.crawler.com/search/ie.aspx?tb_id=60327
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,CustomizeSearch = http://dnl.crawler.com/support/sa_custo ... TbId=60327
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
R3 - URLSearchHook: &Crawler Toolbar Helper - {1CB20BF0-BBAE-40A7-93F4-6435FF3D0411} - C:\PROGRA~1\Crawler\Toolbar\ctbr.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: &Crawler Toolbar Helper - {1CB20BF0-BBAE-40A7-93F4-6435FF3D0411} - C:\PROGRA~1\Crawler\Toolbar\ctbr.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: &Crawler Toolbar - {4B3803EA-5230-4DC3-A7FC-33638F3D3542} - C:\PROGRA~1\Crawler\Toolbar\ctbr.dll
O4 - HKLM\..\Run: [SpywareTerminator] "C:\PROGRA~1\SPYWAR~1\SpywareTerminatorShield.exe"
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: Add to AMV Convert Tool... - C:\Program Files\MP3 Player Utilities 4.00\AMVConverter\grab.html
O8 - Extra context menu item: Crawler Search - tbr:iemenu
O8 - Extra context menu item: Download with Star Downloader - E:\My Download Files\ACCELELATOR PLUS\Star Downloader\sdie.htm
O8 - Extra context menu item: E&xportovať do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: MediaManager tool grab multimedia file - C:\Program Files\MP3 Player Utilities 4.00\MediaManager\grab.html
O9 - Extra button: (no name) - AutorunsDisabled - (no file)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Protocol: tbr - {4D25FB7A-8902-4291-960E-9ADA051CFBBF} - C:\PROGRA~1\Crawler\Toolbar\ctbr.dll
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll
O22 - SharedTaskScheduler: Proces mezipaměti kategorií součástí - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll
O23 - Service: AMService - Unknown owner - C:\WINDOWS\TEMP\gerx\setup.exe (file missing)
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Služba Google Update (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: ServiceLayer - Unknown owner - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe (file missing)
O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - C:\Program Files\Spyware Terminator\sp_rsser.exe
O23 - Service: System Protect Deletion Prevention Service (SP_Service) - Xacti Corporation - C:\Program Files\System Protect\SysProtect_srv.exe

--
End of file - 5434 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
AcroIEHlprObj Class - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll [2004-12-14 63136]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1CB20BF0-BBAE-40A7-93F4-6435FF3D0411}]
&Crawler Toolbar Helper - C:\PROGRA~1\Crawler\Toolbar\ctbr.dll [2011-04-05 1232520]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2011-04-05 41760]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2011-04-05 79648]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{4B3803EA-5230-4DC3-A7FC-33638F3D3542} - &Crawler Toolbar - C:\PROGRA~1\Crawler\Toolbar\ctbr.dll [2011-04-05 1232520]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"SpywareTerminator"=C:\PROGRA~1\SPYWAR~1\SpywareTerminatorShield.exe [2011-04-05 2216960]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
C:\WINDOWS\system32\ctfmon.exe [2004-08-17 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Malwarebytes' Anti-Malware]
C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe [2010-12-20 443728]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan]
C:\WINDOWS\SOUNDMAN.EXE [2006-11-17 577536]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
C:\Program Files\Common Files\Java\Java Update\jusched.exe [2010-10-29 249064]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Administrator^Nabídka Start^Programy^Po spuštění^setup_9.0.0.722_09.04.2011_10-43.lnk]
E:\kasper\VIRUSR~1\SETUP_~1.20~\startup.exe [2009-10-01 72208]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=323
"NoDriveAutoRun"=67108863
"NoDrives"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveAutoRun"=67108863
"NoDriveTypeAutoRun"=323
"NoDrives"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\Bonjour\mDNSResponder.exe"="C:\Program Files\Bonjour\mDNSResponder.exe:*:Enabled:Bonjour"
"C:\Program Files\Spyware Terminator\SpywareTerminatorUpdate.exe"="C:\Program Files\Spyware Terminator\SpywareTerminatorUpdate.exe:*:Enabled:Crawler Spyware Terminator"
"D:\hry\Nová složka (2)\age2_x1.exe"="D:\hry\Nová složka (2)\age2_x1.exe:*:Enabled:Age of Empires II Expansion"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

======List of files/folders created in the last 1 months======

2011-04-09 14:59:55 ----SHD---- C:\RECYCLER
2011-04-09 11:02:09 ----A---- C:\WINDOWS\system32\drivers\85739342.sys
2011-04-09 11:02:09 ----A---- C:\WINDOWS\system32\drivers\85739341.sys
2011-04-09 11:02:09 ----A---- C:\WINDOWS\system32\drivers\8573934.sys
2011-04-09 10:13:52 ----A---- C:\ComboFix.txt
2011-04-09 09:21:29 ----D---- C:\WINDOWS\system32\NtmsData
2011-04-09 07:25:29 ----HD---- C:\WINDOWS\system32\GroupPolicy
2011-04-09 06:46:03 ----D---- C:\WINDOWS\SxsCaPendDel
2011-04-08 15:15:29 ----A---- C:\WINDOWS\system32\drivers\23914352.sys
2011-04-08 15:15:29 ----A---- C:\WINDOWS\system32\drivers\23914351.sys
2011-04-08 15:15:29 ----A---- C:\WINDOWS\system32\drivers\2391435.sys
2011-04-08 13:30:36 ----D---- C:\Program Files\CCleaner
2011-04-08 13:29:03 ----D---- C:\Program Files\Google
2011-04-08 13:02:34 ----A---- C:\WINDOWS\system32\drivers\mbamswissarmy.sys
2011-04-08 13:02:23 ----D---- C:\Program Files\Malwarebytes' Anti-Malware
2011-04-08 13:02:23 ----A---- C:\WINDOWS\system32\drivers\mbam.sys
2011-04-08 12:05:11 ----D---- C:\rsit
2011-04-08 10:50:47 ----A---- C:\WINDOWS\system32\drivers\sp_prot.sys
2011-04-08 10:50:41 ----D---- C:\Program Files\System Protect
2011-04-08 10:04:50 ----A---- C:\WINDOWS\system32\ChCfg.exe
2011-04-08 10:04:25 ----RA---- C:\WINDOWS\system32\drivers\alcxwdm.sys
2011-04-08 10:03:43 ----D---- C:\Program Files\Realtek AC97
2011-04-08 10:03:41 ----A---- C:\WINDOWS\system32\RTLCPL.exe
2011-04-08 10:03:37 ----A---- C:\WINDOWS\soundman.exe
2011-04-08 10:03:36 ----A---- C:\WINDOWS\system32\RtlCPAPI.dll
2011-04-08 10:03:32 ----A---- C:\WINDOWS\alcupd.exe
2011-04-08 10:03:32 ----A---- C:\WINDOWS\Alcrmv.exe
2011-04-07 11:48:26 ----D---- C:\Program Files\trend micro
2011-04-06 16:53:19 ----N---- C:\WINDOWS\cmaudio.ini
2011-04-06 16:53:19 ----D---- C:\Program Files\C-Media
2011-04-06 15:48:38 ----A---- C:\WINDOWS\system32\uxtuneup.dll
2011-04-06 15:24:35 ----ASH---- C:\pagefile.sys
2011-04-06 14:39:17 ----D---- C:\WINDOWS\temp
2011-04-06 08:49:29 ----SHD---- C:\Documents and Settings\All Users\Data aplikací\{24036256-BFDB-4CD3-BE8A-A3D6160F2E16}
2011-04-06 00:18:44 ----A---- C:\WINDOWS\system32\KillBox.exe
2011-04-06 00:05:19 ----D---- C:\Program Files\WinClamAVShield
2011-04-05 23:13:55 ----D---- C:\Program Files\Common Files\Java
2011-04-05 23:13:06 ----A---- C:\WINDOWS\system32\javaws.exe
2011-04-05 23:13:06 ----A---- C:\WINDOWS\system32\javaw.exe
2011-04-05 23:13:06 ----A---- C:\WINDOWS\system32\java.exe
2011-04-05 23:00:08 ----D---- C:\Program Files\Crawler
2011-04-05 22:59:59 ----A---- C:\WINDOWS\system32\drivers\sp_rsdrv2.sys
2011-04-05 22:59:57 ----D---- C:\Documents and Settings\Administrator\Data aplikací\Spyware Terminator
2011-04-05 22:59:45 ----D---- C:\Documents and Settings\All Users\Data aplikací\Spyware Terminator
2011-04-05 22:59:42 ----D---- C:\Program Files\Spyware Terminator
2011-04-05 22:50:52 ----D---- C:\Program Files\Secunia
2011-04-05 21:30:29 ----D---- C:\WINDOWS\WBEM
2011-04-05 21:28:55 ----HDC---- C:\WINDOWS\ie8
2011-04-05 21:28:55 ----D---- C:\WINDOWS\system32\cs-CZ
2011-04-04 17:15:57 ----HD---- C:\Program Files\WindowsUpdate
2011-04-04 15:56:13 ----D---- C:\WINDOWS\system32\SoftwareDistribution
2011-04-04 15:34:35 ----N---- C:\Boot.bak
2011-04-04 15:34:26 ----RASHD---- C:\cmdcons
2011-04-04 15:29:48 ----A---- C:\WINDOWS\zip.exe
2011-04-04 15:29:48 ----A---- C:\WINDOWS\SWXCACLS.exe
2011-04-04 15:29:48 ----A---- C:\WINDOWS\SWSC.exe
2011-04-04 15:29:48 ----A---- C:\WINDOWS\SWREG.exe
2011-04-04 15:29:48 ----A---- C:\WINDOWS\sed.exe
2011-04-04 15:29:48 ----A---- C:\WINDOWS\PEV.exe
2011-04-04 15:29:48 ----A---- C:\WINDOWS\NIRCMD.exe
2011-04-04 15:29:48 ----A---- C:\WINDOWS\MBR.exe
2011-04-04 15:29:48 ----A---- C:\WINDOWS\grep.exe
2011-04-04 15:29:15 ----D---- C:\WINDOWS\ERDNT
2011-04-04 15:28:09 ----D---- C:\Qoobox
2011-04-04 13:46:48 ----D---- C:\Program Files\ESET
2011-04-03 10:36:56 ----N---- C:\AILog.txt
2011-04-01 10:37:23 ----A---- C:\WINDOWS\WEBTRANS.INI
2011-04-01 10:36:28 ----A---- C:\WINDOWS\WEBWTR.INI
2011-04-01 10:36:15 ----D---- C:\WINDOWS\XXLGS

======List of files/folders modified in the last 1 months======

2011-04-09 22:49:11 ----D---- C:\WINDOWS\Prefetch
2011-04-09 22:43:58 ----D---- C:\WINDOWS
2011-04-09 22:43:10 ----D---- C:\WINDOWS\system32\drivers
2011-04-09 22:42:29 ----D---- C:\WINDOWS\system32\CatRoot2
2011-04-09 22:41:47 ----HDC---- C:\WINDOWS\$NtUninstallWudf01000$
2011-04-09 16:08:14 ----D---- C:\WINDOWS\pss
2011-04-09 16:07:30 ----D---- C:\Program Files\7-Zip
2011-04-09 12:02:00 ----D---- C:\Program Files\WinRAR
2011-04-09 11:13:32 ----SHD---- C:\System Volume Information
2011-04-09 11:02:44 ----HD---- C:\WINDOWS\inf
2011-04-09 10:08:54 ----A---- C:\WINDOWS\system.ini
2011-04-09 10:08:32 ----D---- C:\WINDOWS\system32\drivers\etc
2011-04-09 10:06:47 ----D---- C:\WINDOWS\system32\config
2011-04-09 10:00:18 ----D---- C:\WINDOWS\system32
2011-04-09 10:00:18 ----D---- C:\WINDOWS\AppPatch
2011-04-09 10:00:03 ----D---- C:\Program Files\Common Files
2011-04-09 09:52:36 ----N---- C:\WINDOWS\SchedLgU.Txt
2011-04-09 09:26:00 ----D---- C:\WINDOWS\repair
2011-04-09 09:25:30 ----D---- C:\WINDOWS\Registration
2011-04-09 09:21:27 ----SD---- C:\Documents and Settings\All Users\Data aplikací\Microsoft
2011-04-09 06:46:10 ----SHD---- C:\WINDOWS\Installer
2011-04-09 06:46:05 ----D---- C:\WINDOWS\WinSxS
2011-04-09 06:43:27 ----D---- C:\Config.Msi
2011-04-08 13:36:10 ----D---- C:\Documents and Settings\Administrator\Data aplikací\IDM
2011-04-08 13:36:01 ----D---- C:\WINDOWS\Minidump
2011-04-08 13:36:01 ----D---- C:\WINDOWS\Debug
2011-04-08 13:30:36 ----RD---- C:\Program Files
2011-04-08 13:29:17 ----SD---- C:\WINDOWS\Tasks
2011-04-08 12:56:16 ----RSHDC---- C:\WINDOWS\system32\dllcache
2011-04-08 10:03:31 ----HD---- C:\Program Files\InstallShield Installation Information
2011-04-08 10:02:59 ----D---- C:\Program Files\Common Files\InstallShield
2011-04-08 09:48:52 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2011-04-08 09:24:40 ----D---- C:\WINDOWS\SoftwareDistribution
2011-04-06 15:37:28 ----RSH---- C:\boot.ini
2011-04-06 15:37:28 ----A---- C:\WINDOWS\win.ini
2011-04-06 14:26:04 ----D---- C:\WINDOWS\system32\Restore
2011-04-06 13:06:38 ----D---- C:\Program Files\SearchPredict
2011-04-06 09:07:30 ----D---- C:\Documents and Settings\All Users\Data aplikací\TuneUp Software
2011-04-06 08:58:39 ----D---- C:\ProgramData
2011-04-06 08:55:12 ----D---- C:\Documents and Settings\Administrator\Data aplikací\TuneUp Software
2011-04-06 08:17:50 ----D---- C:\Documents and Settings
2011-04-05 23:11:04 ----A---- C:\WINDOWS\system32\deployJava1.dll
2011-04-05 21:52:02 ----D---- C:\Program Files\Mozilla Firefox
2011-04-05 21:32:51 ----D---- C:\WINDOWS\Help
2011-04-05 21:32:51 ----D---- C:\Program Files\Internet Explorer
2011-04-05 21:30:19 ----D---- C:\WINDOWS\Media
2011-03-28 22:12:08 ----D---- C:\Documents and Settings\Administrator\Data aplikací\Skype
2011-03-28 21:13:19 ----D---- C:\Documents and Settings\Administrator\Data aplikací\skypePM

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 23914352;23914352 Boot Guard Driver; C:\WINDOWS\system32\DRIVERS\23914352.sys [2009-10-22 37392]
R0 85739342;85739342 Boot Guard Driver; C:\WINDOWS\system32\DRIVERS\85739342.sys [2009-10-22 37392]
R0 PxHelp20;PxHelp20; C:\WINDOWS\System32\Drivers\PxHelp20.sys [2007-03-08 43528]
R0 sisagp;Filtr SIS sběrnice AGP ; C:\WINDOWS\System32\DRIVERS\sisagp.sys [2004-08-03 41088]
R0 WudfPf;Windows Driver Foundation - User-mode Driver Framework Platform Driver; C:\WINDOWS\system32\DRIVERS\WudfPf.sys [2006-09-28 77568]
R1 23914351;23914351; C:\WINDOWS\system32\DRIVERS\23914351.sys [2009-09-25 128016]
R1 85739341;85739341; C:\WINDOWS\system32\DRIVERS\85739341.sys [2009-09-25 128016]
R1 setup_9.0.0.722_08.04.2011_14-41drv;setup_9.0.0.722_08.04.2011_14-41drv; C:\WINDOWS\system32\DRIVERS\2391435.sys [2009-10-09 315408]
R1 setup_9.0.0.722_09.04.2011_10-43drv;setup_9.0.0.722_09.04.2011_10-43drv; C:\WINDOWS\system32\DRIVERS\8573934.sys [2009-10-09 315408]
R1 sp_rsdrv2;Spyware Terminator Driver 2; \??\C:\WINDOWS\system32\drivers\sp_rsdrv2.sys []
R2 Fallback;Fallback; C:\WINDOWS\System32\DRIVERS\HSF_FALL.sys [2001-08-17 289887]
R2 Fsks;Fsks; C:\WINDOWS\System32\DRIVERS\HSF_FSKS.sys [2001-08-17 115807]
R2 K56;K56; C:\WINDOWS\System32\DRIVERS\HSF_K56K.sys [2001-08-17 391199]
R2 mdmxsdk;mdmxsdk; C:\WINDOWS\System32\DRIVERS\mdmxsdk.sys [2004-08-03 11868]
R2 SoftFax;SoftFax; C:\WINDOWS\System32\DRIVERS\HSF_FAXX.sys [2001-08-17 199711]
R2 SpeakerPhone;SpeakerPhone; C:\WINDOWS\System32\DRIVERS\HSF_SPKP.sys [2001-08-17 73279]
R2 Tones;Tones; C:\WINDOWS\System32\DRIVERS\HSF_TONE.sys [2001-08-17 50751]
R2 V124;V124; C:\WINDOWS\System32\DRIVERS\HSF_V124.sys [2001-08-17 488383]
R3 Afc;PPdus ASPI Shell; C:\WINDOWS\system32\drivers\Afc.sys [2005-02-23 11776]
R3 ALCXWDM;Service for Realtek AC97 Audio (WDM); C:\WINDOWS\system32\drivers\ALCXWDM.SYS [2006-12-29 4026112]
R3 basic2;basic2; C:\WINDOWS\System32\DRIVERS\HSF_BSC2.sys [2001-08-17 67167]
R3 hsf_msft;hsf_msft; C:\WINDOWS\System32\DRIVERS\HSF_MSFT.sys [2001-08-17 542879]
R3 PAC207;Trust WB-1400T Webcam; C:\WINDOWS\system32\DRIVERS\PFC027.SYS [2007-05-14 508288]
R3 Rksample;Rksample; C:\WINDOWS\System32\DRIVERS\HSF_SAMP.sys [2001-08-17 57471]
R3 rtl8139;Realtek RTL8139(A/B/C)-based PCI Fast Ethernet Adapter NT Driver; C:\WINDOWS\System32\DRIVERS\RTL8139.SYS [2004-08-03 20992]
R3 S3SAVAGE4M;S3SAVAGE4M; C:\WINDOWS\System32\DRIVERS\s3sav4m.sys [2001-08-17 77824]
R3 sp_prot;System Protect Filter Driver; \??\C:\WINDOWS\system32\drivers\sp_prot.sys []
S1 SASDIFSV;SASDIFSV; \??\E:\My Download Files\antispywer\SASDIFSV.SYS []
S1 SASKUTIL;SASKUTIL; \??\E:\My Download Files\antispywer\SASKUTIL.sys []
S3 ALCXSENS;Service for WDM 3D Audio Driver; C:\WINDOWS\system32\drivers\ALCXSENS.SYS []
S3 AmdLLD;AMD Low Level Device Driver; C:\WINDOWS\system32\DRIVERS\AmdLLD.sys []
S3 catchme;catchme; \??\C:\ComboFix\catchme.sys []
S3 CCDECODE;Dekodér Closed Caption; C:\WINDOWS\system32\DRIVERS\CCDECODE.sys [2004-08-03 17024]
S3 GMSIPCI;GMSIPCI; \??\F:\INSTALL\GMSIPCI.SYS []
S3 HSF_DP;HSF_DP; C:\WINDOWS\System32\DRIVERS\HSFDPSP2.sys [2004-08-03 1041536]
S3 HSFHWBS2;HSFHWBS2; C:\WINDOWS\System32\DRIVERS\HSFBS2S2.sys [2004-08-03 220032]
S3 MBAMSwissArmy;MBAMSwissArmy; \??\C:\WINDOWS\system32\drivers\mbamswissarmy.sys []
S3 MODEMCSA;Unimodem Streaming Filter Device; C:\WINDOWS\system32\drivers\MODEMCSA.sys [2001-08-17 16128]
S3 ms_mpu401;Microsoft MPU-401 MIDI UART Driver; C:\WINDOWS\system32\drivers\msmpu401.sys [2001-08-18 2944]
S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink Converter; C:\WINDOWS\system32\drivers\MSTEE.sys [2004-08-03 5504]
S3 NABTSFEC;NABTS/FEC VBI Codec; C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys [2004-08-03 85376]
S3 NdisIP;Microsoft TV/Video Connection; C:\WINDOWS\system32\DRIVERS\NdisIP.sys [2004-08-03 10880]
S3 NTACCESS;NTACCESS; \??\F:\NTACCESS.sys []
S3 pccsmcfd;PCCS Mode Change Filter Driver; C:\WINDOWS\system32\DRIVERS\pccsmcfd.sys []
S3 SASENUM;SASENUM; \??\E:\My Download Files\antispywer\SASENUM.SYS []
S3 SetupNTGLM7X;SetupNTGLM7X; \??\F:\NTGLM7X.sys []
S3 SLIP;BDA Slip De-Framer; C:\WINDOWS\system32\DRIVERS\SLIP.sys [2004-08-03 11136]
S3 streamip;BDA IPSink; C:\WINDOWS\system32\DRIVERS\StreamIP.sys [2004-08-03 15360]
S3 usbprint;Třída USB Printer; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2004-08-03 25856]
S3 USBSTOR;Ovladač velkokapacitního paměťového zařízení USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 26496]
S3 utqwndey;AVZ Kernel Driver; \??\C:\WINDOWS\system32\Drivers\utqwndey.sys []
S3 WpdUsb;WpdUsb; C:\WINDOWS\System32\Drivers\wpdusb.sys [2006-10-18 38528]
S3 WSTCODEC;Dálnopisný kodek světového standardu; C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS [2004-08-03 19328]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-28 82944]
S4 WS2IFSL;Podpůrné prostředí zprostředkovatele služeb Windows Socket 2.0 bez podpory IFS; C:\WINDOWS\System32\drivers\ws2ifsl.sys [2001-10-25 12032]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 Bonjour Service;##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762##; C:\Program Files\Bonjour\mDNSResponder.exe [2006-02-28 229376]
R2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2011-04-05 153376]
R2 sp_rssrv;Spyware Terminator Realtime Shield Service; C:\Program Files\Spyware Terminator\sp_rsser.exe [2011-04-05 496128]
R2 SP_Service;System Protect Deletion Prevention Service; C:\Program Files\System Protect\SysProtect_srv.exe [2011-04-08 598528]
R2 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2004-08-17 14336]
S2 AMService;AMService; C:\WINDOWS\TEMP\gerx\setup.exe run []
S2 gupdate;Služba Google Update (gupdate); C:\Program Files\Google\Update\GoogleUpdate.exe [2011-04-08 136176]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-30 69632]
S3 FLEXnet Licensing Service;FLEXnet Licensing Service; C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe [2010-09-26 654848]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; C:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104]
S3 ServiceLayer;ServiceLayer; C:\Program Files\PC Connectivity Solution\ServiceLayer.exe []
S3 WMPNetworkSvc;Služba Windows Media Player Network Sharing; C:\Program Files\Windows Media Player\WMPNetwk.exe [2007-01-05 913920]

-----------------EOF-----------------

#14 Příspěvek od **motji** » 09 dub 2011 21:55

Stáhněte Gmer http://www.viry.cz/forum/viewtopic.php?f=29&t=62878
- rozbalte a spusťte
-proběhne sken, po skončení se otevře okno s výsledky, klikněte na Save a tím si uložíte log,který sem vložíte

-Podle návodu v odkazu provedete druhý sken a log sem také vložíte.

ringov · #15 Příspěvek od **ringov** » 09 dub 2011 22:04

GMER 1.0.15.15570 - http://www.gmer.net
Rootkit scan 2011-04-09 23:03:18
Windows 5.1.2600 Service Pack 2
Running: gmer.exe; Driver: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\pxrdipow.sys

---- System - GMER 1.0.15 ----

SSDT \??\C:\WINDOWS\system32\drivers\sp_rsdrv2.sys ZwClose [0xF74D488E]
SSDT \??\C:\WINDOWS\system32\drivers\sp_rsdrv2.sys ZwCreateFile [0xF74D40EC]
SSDT \??\C:\WINDOWS\system32\drivers\sp_rsdrv2.sys ZwCreateKey [0xF74D3DCE]
SSDT \??\C:\WINDOWS\system32\drivers\sp_rsdrv2.sys ZwCreateSection [0xF74D5938]
SSDT \??\C:\WINDOWS\system32\drivers\sp_rsdrv2.sys ZwDeleteKey [0xF74D3ED8]
SSDT \??\C:\WINDOWS\system32\drivers\sp_rsdrv2.sys ZwDeleteValueKey [0xF74D3FC2]
SSDT \??\C:\WINDOWS\system32\drivers\sp_rsdrv2.sys ZwLoadDriver [0xF74D4BBC]
SSDT \??\C:\WINDOWS\system32\drivers\sp_rsdrv2.sys ZwOpenFile [0xF74D43F4]
SSDT \??\C:\WINDOWS\system32\drivers\sp_rsdrv2.sys ZwSetInformationFile [0xF74D4526]
SSDT \??\C:\WINDOWS\system32\drivers\sp_rsdrv2.sys ZwSetValueKey [0xF74D3BFC]
SSDT \??\C:\WINDOWS\system32\drivers\sp_rsdrv2.sys ZwTerminateProcess [0xF74D4B04]
SSDT \??\C:\WINDOWS\system32\drivers\sp_rsdrv2.sys ZwWriteFile [0xF74D470C]

---- Kernel code sections - GMER 1.0.15 ----

? fegi.sys Systém nemůže nalézt uvedený soubor. !
pnidata C:\WINDOWS\System32\DRIVERS\secdrv.sys unknown last section [0xF0344F00, 0x24000, 0x48000000]

---- EOF - GMER 1.0.15 ---- GMER 1.0.15.15570 - http://www.gmer.net
Rootkit scan 2011-04-10 00:55:07
Windows 5.1.2600 Service Pack 2 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-4 MAXTOR_6L020J1 rev.AR1.0400
Running: gmer.exe; Driver: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\pxrdipow.sys

---- User code sections - GMER 1.0.15 ----

.text C:\Program Files\Mozilla Firefox\plugin-container.exe[2220] USER32.dll!SetWindowLongA 77D3DED3 5 Bytes JMP 10699777 C:\Program Files\Mozilla Firefox\xul.dll (Mozilla Foundation)
.text C:\Program Files\Mozilla Firefox\plugin-container.exe[2220] USER32.dll!SetWindowLongW 77D3DEF1 5 Bytes JMP 10699709 C:\Program Files\Mozilla Firefox\xul.dll (Mozilla Foundation)
.text C:\Program Files\Mozilla Firefox\plugin-container.exe[2220] USER32.dll!GetWindowInfo 77D3F122 1 Byte [E9]
.text C:\Program Files\Mozilla Firefox\plugin-container.exe[2220] USER32.dll!GetWindowInfo 77D3F122 5 Bytes JMP 104C7C37 C:\Program Files\Mozilla Firefox\xul.dll (Mozilla Foundation)
.text C:\Program Files\Mozilla Firefox\plugin-container.exe[2220] USER32.dll!TrackPopupMenu 77D84F16 5 Bytes JMP 104C823A C:\Program Files\Mozilla Firefox\xul.dll (Mozilla Foundation)
.text C:\Program Files\Mozilla Firefox\firefox.exe[3960] ntdll.dll!LdrLoadDll 7C9161CA 5 Bytes JMP 00401410 C:\Program Files\Mozilla Firefox\firefox.exe (Firefox/Mozilla Corporation)

---- Kernel code sections - GMER 1.0.15 ----

? fegi.sys Systém nemůže nalézt uvedený soubor. !
pnidata C:\WINDOWS\System32\DRIVERS\secdrv.sys unknown last section [0xF0344F00, 0x24000, 0x48000000]

---- System - GMER 1.0.15 ----

SSDT \??\C:\WINDOWS\system32\drivers\sp_rsdrv2.sys ZwClose [0xF74D488E]
SSDT \??\C:\WINDOWS\system32\drivers\sp_rsdrv2.sys ZwCreateFile [0xF74D40EC]
SSDT \??\C:\WINDOWS\system32\drivers\sp_rsdrv2.sys ZwCreateKey [0xF74D3DCE]
SSDT \??\C:\WINDOWS\system32\drivers\sp_rsdrv2.sys ZwCreateSection [0xF74D5938]
SSDT \??\C:\WINDOWS\system32\drivers\sp_rsdrv2.sys ZwDeleteKey [0xF74D3ED8]
SSDT \??\C:\WINDOWS\system32\drivers\sp_rsdrv2.sys ZwDeleteValueKey [0xF74D3FC2]
SSDT \??\C:\WINDOWS\system32\drivers\sp_rsdrv2.sys ZwLoadDriver [0xF74D4BBC]
SSDT \??\C:\WINDOWS\system32\drivers\sp_rsdrv2.sys ZwOpenFile [0xF74D43F4]
SSDT \??\C:\WINDOWS\system32\drivers\sp_rsdrv2.sys ZwSetInformationFile [0xF74D4526]
SSDT \??\C:\WINDOWS\system32\drivers\sp_rsdrv2.sys ZwSetValueKey [0xF74D3BFC]
SSDT \??\C:\WINDOWS\system32\drivers\sp_rsdrv2.sys ZwTerminateProcess [0xF74D4B04]
SSDT \??\C:\WINDOWS\system32\drivers\sp_rsdrv2.sys ZwWriteFile [0xF74D470C]

---- EOF - GMER 1.0.15 ----

VIRY.CZ

neviem co s tym,prosim pomozte

neviem co s tym,prosim pomozte

Re: neviem co s tym,prosim pomozte

Re: neviem co s tym,prosim pomozte

Re: neviem co s tym,prosim pomozte

Re: neviem co s tym,prosim pomozte

Re: neviem co s tym,prosim pomozte

Re: neviem co s tym,prosim pomozte

Re: neviem co s tym,prosim pomozte

Re: neviem co s tym,prosim pomozte

Re: neviem co s tym,prosim pomozte

Re: neviem co s tym,prosim pomozte

Re: neviem co s tym,prosim pomozte

Re: neviem co s tym,prosim pomozte

Re: neviem co s tym,prosim pomozte

Re: neviem co s tym,prosim pomozte