Problémy s nvcpl.dll

[Yutaka]

Dobrý večer, momentálně řeším problém s knihovnou nvcpl.dll. Pokaždé když se pokusím sputis nějákou hru se mi zobrazí hlášení o této knihovně. Zkoušel jsem reinstalovat grafiku ale problém přetrvává. Prosím o pomoc nebo radu. Děkuji

Logfile of random's system information tool 1.08 (written by random/random)
Run by T0m at 2011-04-22 21:01:37
Systém Microsoft Windows XP Professional Service Pack 3
System drive C: has 39 GB (79%) free of 50 GB
Total RAM: 3327 MB (78% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 21:03:28, on 22.4.2011
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\Program Files\COMODO\COMODO GeekBuddy\CLPSLS.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\ASUS\Six Engine\SixEngine.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\EXPERTool\TBPanel.exe
C:\Program Files\ICQ6Toolbar\ICQ Service.exe
C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\QipGuard\QipGuard.exe
C:\Program Files\Opera\opera.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\WINDOWS\System32\svchost.exe
C:\Documents and Settings\T0m\Local Settings\Data aplikací\Opera\Opera\temporary_downloads\RSIT.exe
C:\Program Files\trend micro\T0m.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://qip.ru
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://search.qip.ru
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://search.qip.ru/ie
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://search.qip.ru
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://seznam.cz/
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://search.qip.ru/ie
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
R3 - URLSearchHook: QIPBHO Class - {95289393-33EA-4F8D-B952-483415B9C955} - C:\Documents and Settings\T0m\Data aplikací\Microsoft\Internet Explorer\qipsearchbar.dll
R3 - URLSearchHook: ICQToolBar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll
R3 - URLSearchHook: (no name) - - (no file)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: QIPBHO - {95289393-33EA-4F8D-B952-483415B9C955} - C:\Documents and Settings\T0m\Data aplikací\Microsoft\Internet Explorer\qipsearchbar.dll
O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: ICQToolBar - {855F3B16-6D32-4FE6-8A56-BBB695989046} - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll
O3 - Toolbar: DAEMON Tools Toolbar - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [Six Engine] "C:\Program Files\ASUS\Six Engine\SixEngine.exe" -r
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [COMODO Internet Security] "C:\Program Files\COMODO\COMODO Internet Security\cfp.exe" -h
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\DTLite.exe" -autorun
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [GAINWARD] C:\Program Files\EXPERTool\TBPanel.exe /A
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: ICQ7.4 - {73C6DCFB-B606-47F3-BDFA-9A4FBF931E37} - C:\Program Files\ICQ7.4\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ7.4 - {73C6DCFB-B606-47F3-BDFA-9A4FBF931E37} - C:\Program Files\ICQ7.4\ICQ.exe
O9 - Extra button: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra 'Tools' menuitem: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: SearchList = st.kvados.cz,zak
O17 - HKLM\System\CS3\Services\Tcpip\Parameters: SearchList = st.kvados.cz,zak
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: SearchList = st.kvados.cz,zak
O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: C:\WINDOWS\system32\guard32.dll
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Proces mezipaměti kategorií součástí - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Avira AntiVir Scheduler (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
O23 - Service: COMODO livePCsupport Service (CLPSLS) - COMODO - C:\Program Files\COMODO\COMODO GeekBuddy\CLPSLS.exe
O23 - Service: COMODO Internet Security Helper Service (cmdAgent) - COMODO - C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe
O23 - Service: ICQ Service - Unknown owner - C:\Program Files\ICQ6Toolbar\ICQ Service.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: nProtect GameGuard Service (npggsvc) - Unknown owner - C:\WINDOWS\system32\GameMon.des.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: QipGuard - QIP.ru - C:\Program Files\QipGuard\QipGuard.exe

--
End of file - 8088 bytes

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{53707962-6F74-2D53-2644-206D7942484F}]
Spybot-S&D IE Protection - C:\PROGRA~1\SPYBOT~1\SDHelper.dll [2009-01-26 1879896]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{95289393-33EA-4F8D-B952-483415B9C955}]
QIPBHO Class - C:\Documents and Settings\T0m\Data aplikací\Microsoft\Internet Explorer\qipsearchbar.dll [2010-12-13 141184]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}]
Skype Plug-In - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll [2010-11-22 1242504]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2010-11-24 41760]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2010-11-24 79648]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{855F3B16-6D32-4FE6-8A56-BBB695989046} - ICQToolBar - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll [2010-09-06 1048888]
{32099AAC-C132-4136-9E9A-4E364A424E17} - DAEMON Tools Toolbar - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll [2011-01-20 988480]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"RTHDCPL"=C:\WINDOWS\RTHDCPL.EXE [2008-05-16 16862720]
"Alcmtr"=C:\WINDOWS\ALCMTR.EXE [2005-05-03 69632]
"Six Engine"=C:\Program Files\ASUS\Six Engine\SixEngine.exe [2008-06-03 5964800]
"avgnt"=C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [2010-08-02 281768]
"SunJavaUpdateSched"=C:\Program Files\Common Files\Java\Java Update\jusched.exe [2010-05-14 248552]
"COMODO Internet Security"=C:\Program Files\COMODO\COMODO Internet Security\cfp.exe [2010-12-29 2548040]
"nwiz"=nwiz.exe /install []
"NvMediaCenter"=C:\WINDOWS\system32\NvMcTray.dll [2008-10-21 86016]
"NvCplDaemon"=C:\WINDOWS\system32\NvCpl.dll [2008-10-21 13574144]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"=C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]
"SpybotSD TeaTimer"=C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe [2009-03-05 2260480]
"DAEMON Tools Lite"=C:\Program Files\DAEMON Tools Lite\DTLite.exe [2011-01-20 1305408]
"MSMSGS"=C:\Program Files\Messenger\msmsgs.exe [2008-04-14 1695232]
"GAINWARD"=C:\Program Files\EXPERTool\TBPanel.exe [2008-10-21 2177576]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\COMODO]
C:\Program Files\COMODO\COMODO GeekBuddy\CLPSLA.exe [2010-11-19 210648]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
C:\Program Files\Skype\Phone\Skype.exe [2011-01-03 15028104]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"wuauserv"=2
"wscsvc"=2
"TeamViewer6"=2
"OpenVPNService"=3
"MSIServer"=3
"FastUserSwitchingCompatibility"=3
"ERSvc"=2

C:\Documents and Settings\All Users\Nabídka Start\Programy\Po spuštění
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=" C:\WINDOWS\system32\guard32.dll"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\CLPSLS]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\CLPSLS]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\Opera\opera.exe"="C:\Program Files\Opera\opera.exe:*:Enabled:Opera Internet Browser"
"C:\Program Files\Java\jre6\bin\javaw.exe"="C:\Program Files\Java\jre6\bin\javaw.exe:*:Enabled:Java(TM) Platform SE binary"
"C:\Program Files\Miranda IM\miranda32.exe"="C:\Program Files\Miranda IM\miranda32.exe:*:Enabled:Miranda IM"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\Pando Networks\Media Booster\PMB.exe"="C:\Program Files\Pando Networks\Media Booster\PMB.exe:*:Enabled:Pando Media Booster"
"D:\League of legends\air\LolClient.exe"="D:\League of legends\air\LolClient.exe:*:Enabled:League of Legends Lobby"
"D:\League of legends\game\League of Legends.exe"="D:\League of legends\game\League of Legends.exe:*:Enabled:League of Legends Game Client"
"C:\Program Files\uTorrent\uTorrent.exe"="C:\Program Files\uTorrent\uTorrent.exe:*:Enabled:µTorrent"
"C:\Program Files\Skype\Phone\Skype.exe"="C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype"
"C:\Program Files\Skype\Plugin Manager\skypePM.exe"="C:\Program Files\Skype\Plugin Manager\skypePM.exe:*:Enabled:Skype Extras Manager"
"D:\lol.launcher.exe"="D:\lol.launcher.exe:*:Enabled:League of Legends Launcher"
"D:\air\LolClient.exe"="D:\air\LolClient.exe:*:Enabled:League of Legends Lobby"
"D:\game\League of Legends.exe"="D:\game\League of Legends.exe:*:Enabled:League of Legends Game Client"
"D:\Nová složka\air\LolClient.exe"="D:\Nová složka\air\LolClient.exe:*:Enabled:League of Legends Lobby"
"D:\Nová složka\game\League of Legends.exe"="D:\Nová složka\game\League of Legends.exe:*:Enabled:League of Legends Game Client"
"C:\Riot Games\League of Legends\air\LolClient.exe"="C:\Riot Games\League of Legends\air\LolClient.exe:*:Enabled:League of Legends Lobby"
"C:\Riot Games\League of Legends\game\League of Legends.exe"="C:\Riot Games\League of Legends\game\League of Legends.exe:*:Enabled:League of Legends Game Client"
"C:\Program Files\TeamViewer\Version6\TeamViewer.exe"="C:\Program Files\TeamViewer\Version6\TeamViewer.exe:*:Enabled:Teamviewer Remote Control Application"
"C:\Program Files\TeamViewer\Version6\TeamViewer_Service.exe"="C:\Program Files\TeamViewer\Version6\TeamViewer_Service.exe:*:Enabled:Teamviewer Remote Control Service"
"C:\Program Files\ICQ7.4\ICQ.exe"="C:\Program Files\ICQ7.4\ICQ.exe:*:Enabled:ICQ7.4"
"C:\Program Files\Messenger\msmsgs.exe"="C:\Program Files\Messenger\msmsgs.exe:*:Enabled:Windows Messenger"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\Pando Networks\Media Booster\PMB.exe"="C:\Program Files\Pando Networks\Media Booster\PMB.exe:*:Enabled:Pando Media Booster"
"C:\Program Files\ICQ7.4\ICQ.exe"="C:\Program Files\ICQ7.4\ICQ.exe:*:Enabled:ICQ7.4"

======List of files/folders created in the last 1 months======

2011-04-22 21:01:37 ----D---- C:\rsit
2011-04-22 21:01:37 ----D---- C:\Program Files\trend micro
2011-04-22 20:41:33 ----D---- C:\WINDOWS\CSC
2011-04-22 20:41:28 ----A---- C:\WINDOWS\ntbtlog.txt
2011-04-22 20:25:29 ----D---- C:\WINDOWS\nview
2011-04-22 20:25:28 ----D---- C:\WINDOWS\NV2241184.TMP
2011-04-22 18:52:09 ----A---- C:\WINDOWS\system32\npptNT2.sys
2011-04-22 18:11:32 ----A---- C:\WINDOWS\system32\readme.txt
2011-04-22 18:06:58 ----A---- C:\WINDOWS\system32\XAudio2_5.dll
2011-04-22 18:06:58 ----A---- C:\WINDOWS\system32\xactengine3_5.dll
2011-04-22 18:06:58 ----A---- C:\WINDOWS\system32\D3DCompiler_42.dll
2011-04-22 18:06:57 ----A---- C:\WINDOWS\system32\d3dx11_42.dll
2011-04-22 18:06:57 ----A---- C:\WINDOWS\system32\d3dcsx_42.dll
2011-04-22 18:06:56 ----A---- C:\WINDOWS\system32\d3dx10_42.dll
2011-04-22 18:06:55 ----A---- C:\WINDOWS\system32\D3DX9_42.dll
2011-04-22 18:06:55 ----A---- C:\WINDOWS\system32\D3DX9_41.dll
2011-04-22 18:06:55 ----A---- C:\WINDOWS\system32\d3dx10_41.dll
2011-04-22 18:06:55 ----A---- C:\WINDOWS\system32\D3DCompiler_41.dll
2011-04-22 18:06:54 ----A---- C:\WINDOWS\system32\XAudio2_4.dll
2011-04-22 18:06:54 ----A---- C:\WINDOWS\system32\XAPOFX1_3.dll
2011-04-22 18:06:54 ----A---- C:\WINDOWS\system32\xactengine3_4.dll
2011-04-22 18:06:54 ----A---- C:\WINDOWS\system32\X3DAudio1_6.dll
2011-04-22 18:06:53 ----A---- C:\WINDOWS\system32\D3DX9_40.dll
2011-04-22 18:06:53 ----A---- C:\WINDOWS\system32\d3dx10_40.dll
2011-04-22 18:06:53 ----A---- C:\WINDOWS\system32\D3DCompiler_40.dll
2011-04-22 18:06:52 ----A---- C:\WINDOWS\system32\XAudio2_3.dll
2011-04-22 18:06:52 ----A---- C:\WINDOWS\system32\XAPOFX1_2.dll
2011-04-22 18:06:52 ----A---- C:\WINDOWS\system32\xactengine3_3.dll
2011-04-22 18:06:52 ----A---- C:\WINDOWS\system32\X3DAudio1_5.dll
2011-04-11 18:04:11 ----D---- C:\WINDOWS\system32\appmgmt
2011-04-11 18:00:20 ----A---- C:\WINDOWS\system32\drivers\dtsoftbus01.sys
2011-04-11 18:00:08 ----D---- C:\Program Files\DAEMON Tools Toolbar
2011-04-11 18:00:05 ----D---- C:\Program Files\DAEMON Tools Lite
2011-04-11 17:59:10 ----D---- C:\Documents and Settings\T0m\Data aplikací\DAEMON Tools Lite
2011-04-11 17:59:10 ----D---- C:\Documents and Settings\All Users\Data aplikací\DAEMON Tools Lite
2011-03-30 16:03:30 ----D---- C:\Documents and Settings\T0m\Data aplikací\QIP
2011-03-30 16:03:19 ----D---- C:\Program Files\QipGuard
2011-03-30 16:03:19 ----D---- C:\Documents and Settings\T0m\Data aplikací\QipGuard
2011-03-30 16:03:04 ----D---- C:\Program Files\QIP 2010
2011-03-29 22:07:27 ----D---- C:\Program Files\ICQ6Toolbar
2011-03-29 22:07:24 ----D---- C:\Documents and Settings\T0m\Data aplikací\Mozilla
2011-03-29 22:07:24 ----D---- C:\Documents and Settings\All Users\Data aplikací\ICQ
2011-03-29 22:06:22 ----D---- C:\Program Files\ICQ7.4
2011-03-27 14:40:52 ----D---- C:\Program Files\Belarc
2011-03-27 10:19:06 ----D---- C:\Program Files\Spybot - Search & Destroy
2011-03-27 10:19:06 ----D---- C:\Documents and Settings\All Users\Data aplikací\Spybot - Search & Destroy

======List of files/folders modified in the last 1 months======

2011-04-22 21:01:37 ----RD---- C:\Program Files
2011-04-22 20:59:41 ----D---- C:\WINDOWS
2011-04-22 20:49:44 ----D---- C:\WINDOWS\system32\drivers
2011-04-22 20:44:51 ----D---- C:\WINDOWS\Temp
2011-04-22 20:44:24 ----D---- C:\WINDOWS\system32\CatRoot2
2011-04-22 20:43:24 ----RASH---- C:\boot.ini
2011-04-22 20:43:24 ----A---- C:\WINDOWS\win.ini
2011-04-22 20:43:24 ----A---- C:\WINDOWS\system.ini
2011-04-22 20:43:05 ----D---- C:\WINDOWS\system32
2011-04-22 20:34:13 ----A---- C:\WINDOWS\SchedLgU.Txt
2011-04-22 20:34:05 ----D---- C:\Documents and Settings\T0m\Data aplikací\ICQ
2011-04-22 20:29:20 ----D---- C:\WINDOWS\Prefetch
2011-04-22 20:26:00 ----D---- C:\WINDOWS\Help
2011-04-22 20:25:19 ----RSHDC---- C:\WINDOWS\system32\dllcache
2011-04-22 20:25:10 ----HD---- C:\WINDOWS\inf
2011-04-22 20:25:05 ----D---- C:\WINDOWS\system32\DirectX
2011-04-22 20:24:52 ----RSD---- C:\WINDOWS\assembly
2011-04-22 20:22:54 ----D---- C:\Program Files\EXPERTool
2011-04-22 20:17:35 ----D---- C:\Program Files\NVIDIA Corporation
2011-04-22 20:15:47 ----D---- C:\Documents and Settings\All Users\Data aplikací\NVIDIA Corporation
2011-04-22 20:08:54 ----D---- C:\WINDOWS\system32\NtmsData
2011-04-22 19:52:54 ----D---- C:\WINDOWS\Registration
2011-04-22 18:42:20 ----HD---- C:\Program Files\InstallShield Installation Information
2011-04-22 18:06:36 ----D---- C:\WINDOWS\Microsoft.NET
2011-04-19 20:59:06 ----SD---- C:\Documents and Settings\T0m\Data aplikací\Microsoft
2011-04-18 19:32:19 ----D---- C:\Documents and Settings\T0m\Data aplikací\Skype
2011-04-18 19:31:58 ----D---- C:\Documents and Settings\T0m\Data aplikací\skypePM
2011-04-16 09:44:52 ----D---- C:\Documents and Settings\T0m\Data aplikací\uTorrent
2011-04-14 16:58:46 ----D---- C:\Program Files\Opera
2011-04-02 10:00:21 ----D---- C:\Program Files\uTorrent
2011-03-27 11:14:50 ----D---- C:\Program Files\WinRAR
2011-03-27 10:54:33 ----D---- C:\WINDOWS\repair
2011-03-27 10:39:43 ----D---- C:\WINDOWS\system32\drivers\etc
2011-03-27 10:22:18 ----D---- C:\Program Files\Game

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 Inspect;COMODO Internet Security Firewall Driver; C:\WINDOWS\System32\DRIVERS\inspect.sys [2010-12-29 94656]
R0 mv61xx;mv61xx; C:\WINDOWS\system32\DRIVERS\mv61xx.sys [2008-06-24 150568]
R0 ohci1394;Hostitelský řadič IEEE 1394 dle standardu OHCI; C:\WINDOWS\system32\DRIVERS\ohci1394.sys [2008-04-14 61696]
R1 AsIO;AsIO; C:\WINDOWS\system32\drivers\AsIO.sys [2007-12-17 12400]
R1 avgio;avgio; \??\C:\Program Files\Avira\AntiVir Desktop\avgio.sys []
R1 avipbb;avipbb; C:\WINDOWS\system32\DRIVERS\avipbb.sys [2011-03-19 137656]
R1 cmdGuard;COMODO Internet Security Sandbox Driver; C:\WINDOWS\System32\DRIVERS\cmdguard.sys [2010-12-29 239368]
R1 cmdHlp;COMODO Internet Security Helper Driver; C:\WINDOWS\System32\DRIVERS\cmdhlp.sys [2010-12-29 27576]
R1 dtsoftbus01;DAEMON Tools Virtual Bus Driver; C:\WINDOWS\system32\DRIVERS\dtsoftbus01.sys [2011-04-11 218688]
R1 intelppm;Řadič procesoru Intel; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2008-04-14 40192]
R1 kbdhid;Ovladač klávesnice standardu HID; C:\WINDOWS\system32\DRIVERS\kbdhid.sys [2008-04-14 14592]
R1 ssmdrv;ssmdrv; C:\WINDOWS\system32\DRIVERS\ssmdrv.sys [2010-06-17 28520]
R2 avgntflt;avgntflt; C:\WINDOWS\system32\DRIVERS\avgntflt.sys [2011-01-04 61960]
R2 TBPanel;TBPanel; C:\WINDOWS\system32\drivers\TBPanel.sys [2007-03-16 12256]
R3 Arp1394;Protokol 1394 ARP Client; C:\WINDOWS\system32\DRIVERS\arp1394.sys [2008-04-14 60800]
R3 HDAudBus;Ovladač Microsoft UAA pro sběrnici High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2008-04-13 144384]
R3 hidusb;Ovladač třídy standardu HID; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-14 10368]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\WINDOWS\system32\drivers\RtkHDAud.sys [2008-05-20 4800000]
R3 L1e;Miniport Driver for Atheros AR8121/AR8113/AR8114 PCI-E Ethernet Controller; C:\WINDOWS\system32\DRIVERS\l1e51x86.sys [2008-06-25 36864]
R3 mouhid;Ovladač myši standardu HID; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-10-25 12160]
R3 MTsensor;ATK0110 ACPI UTILITY; C:\WINDOWS\system32\DRIVERS\ASACPI.sys [2004-08-13 5810]
R3 NIC1394;1394 Net Driver; C:\WINDOWS\system32\DRIVERS\nic1394.sys [2008-04-14 61824]
R3 nv;nv; C:\WINDOWS\system32\DRIVERS\nv4_mini.sys [2008-10-21 6133856]
R3 tap0901;TAP-Win32 Adapter V9; C:\WINDOWS\system32\DRIVERS\tap0901.sys [2010-11-08 26112]
R3 usbccgp;Obecný nadřazený ovladač Microsoft USB; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-14 32128]
R3 usbuhci;Ovladač Microsoft univerzálního hostitelského řadiče USB od společnosti Microsoft; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2008-04-14 20608]
S3 Cardex;Cardex; \??\C:\WINDOWS\system32\drivers\TBPANEL.SYS []
S3 GGSAFERDriver;GGSAFER Driver; \??\C:\Program Files\Garena\safedrv.sys []
S3 USBSTOR;Ovladač velkokapacitního paměťového zařízení USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-14 26368]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AntiVirService;Avira AntiVir Guard; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [2011-03-19 269480]
R2 AntiVirSchedulerService;Avira AntiVir Scheduler; C:\Program Files\Avira\AntiVir Desktop\sched.exe [2010-08-02 135336]
R2 CLPSLS;COMODO livePCsupport Service; C:\Program Files\COMODO\COMODO GeekBuddy\CLPSLS.exe [2010-11-19 151432]
R2 cmdAgent;COMODO Internet Security Helper Service; C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe [2010-12-29 1769216]
R2 ICQ Service;ICQ Service; C:\Program Files\ICQ6Toolbar\ICQ Service.exe [2010-09-06 247096]
R2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2010-11-12 153376]
R2 NVSvc;NVIDIA Display Driver Service; C:\WINDOWS\system32\nvsvc32.exe [2008-10-21 163908]
R2 QipGuard;QipGuard; C:\Program Files\QipGuard\QipGuard.exe [2010-12-13 187776]
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2005-09-23 29896]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2005-09-23 66240]
S3 npggsvc;nProtect GameGuard Service; C:\WINDOWS\system32\GameMon.des [2011-01-06 4192928]
S4 OpenVPNService;OpenVPN Service; C:\Program Files\OpenVPN\bin\openvpnserv.exe [2010-11-08 36352]
S4 TeamViewer6;TeamViewer 6; C:\Program Files\TeamViewer\Version6\TeamViewer_Service.exe [2011-03-18 2271608]

-----------------EOF-----------------

[Rudy]

Dejte log z ComboFix.

Stahnete a ulozte nejlepe na plochu ComboFix: http://download.bleepingcomputer.com/sUBs/ComboFix.exe

pote spustte aplikaci pod uctem s administratorskym opravnenim

hned po startu se zobrazi obrazovka s licencnimi podminkami, pokracujte kliknutim na tlacitko Ano.

v klidu si postavte na kafe (cela akce trva cca. 5-10 minut, nekdy i dele - dle toho, o jak rychly stroj se jedna a kolika soubory se skener bude muset prodirat), behem skenu se nepokousejte spoustet zadne jine aplikace ani nic jineho

behem skenovani nepropadejte panice, vas stroj muze byt restartovan (predevsim pri prvni aplikaci skeneru)

upozorneni: pokud pouzivate antispyware s rezidentnim stitem, prepnete jeho rezidentni stit do Install Mode, pripadne jej po dobu skenu uplne deaktivujte, protoze dochazi pri skenu a vymazu pripadneho malware k nezadoucim kolizim s rezidentem antispyware

[Yutaka]

Při instalaci combofixu neustále hlásí chyba instalace se nezdařila. Jsem pod admin účtem

[Rudy]

Zkuste to v nouz. režimu.

[Yutaka]

ComboFix 11-04-22.01 - T0m 22.04.2011 21:57:09.1.2 - x86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.420.1029.18.3327.2723 [GMT 2:00]
Spuštěný z: c:\documents and settings\T0m\Plocha\ComboFix.exe
AV: AntiVir Desktop *Enabled/Updated* {AD166499-45F9-482A-A743-FDD3350758C7}
FW: COMODO Firewall *Enabled* {043803A3-4F86-4ef6-AFC5-F6E02A79969B}
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\system32\ReadMe.txt
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2011-03-22 do 2011-04-22 )))))))))))))))))))))))))))))))
.
.
2011-04-22 19:14 . 2011-04-22 19:14 -------- d-----w- c:\documents and settings\T0m\Data aplikací\Malwarebytes
2011-04-22 19:14 . 2011-04-22 19:14 -------- d-----w- c:\documents and settings\All Users\Data aplikací\Malwarebytes
2011-04-22 19:14 . 2010-12-20 16:09 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-04-22 19:13 . 2011-04-22 19:14 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2011-04-22 19:13 . 2010-12-20 16:08 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-04-22 19:01 . 2011-04-22 19:03 -------- d-----w- C:\rsit
2011-04-22 19:01 . 2011-04-22 19:03 -------- d-----w- c:\program files\trend micro
2011-04-22 18:25 . 2011-04-22 18:25 -------- d-----w- c:\windows\nview
2011-04-22 18:25 . 2011-04-22 18:26 -------- d-----w- c:\windows\NV2241184.TMP
2011-04-22 16:52 . 2009-04-06 07:08 5174 ----a-w- c:\windows\system32\nppt9x.vxd
2011-04-22 16:52 . 2009-04-06 07:08 4682 ----a-w- c:\windows\system32\npptNT2.sys
2011-04-19 18:59 . 2011-04-19 18:59 -------- d-----w- c:\documents and settings\T0m\Local Settings\Data aplikací\Identities
2011-04-11 16:00 . 2011-04-11 16:00 218688 ----a-w- c:\windows\system32\drivers\dtsoftbus01.sys
2011-04-11 16:00 . 2011-04-11 16:00 -------- d-----w- c:\program files\DAEMON Tools Toolbar
2011-04-11 16:00 . 2011-04-11 16:00 -------- d-----w- c:\program files\DAEMON Tools Lite
2011-04-11 15:59 . 2011-04-11 16:01 -------- d-----w- c:\documents and settings\T0m\Data aplikací\DAEMON Tools Lite
2011-04-11 15:59 . 2011-04-11 15:59 -------- d-----w- c:\documents and settings\All Users\Data aplikací\DAEMON Tools Lite
2011-03-30 14:03 . 2011-03-30 14:03 -------- d-----w- c:\documents and settings\T0m\Data aplikací\QIP
2011-03-30 14:03 . 2011-03-30 14:03 -------- d-----w- c:\program files\QipGuard
2011-03-30 14:03 . 2011-03-30 14:03 -------- d-----w- c:\documents and settings\T0m\Data aplikací\QipGuard
2011-03-30 14:03 . 2010-12-13 14:06 141184 ----a-w- c:\documents and settings\T0m\Data aplikací\Microsoft\Internet Explorer\qipsearchbar.dll
2011-03-30 14:03 . 2011-04-22 16:01 -------- d-----w- c:\program files\QIP 2010
2011-03-29 20:07 . 2011-03-29 20:07 -------- d-----w- c:\program files\ICQ6Toolbar
2011-03-29 20:07 . 2011-03-29 20:07 -------- d-----w- c:\documents and settings\All Users\Data aplikací\ICQ
2011-03-29 20:06 . 2011-03-29 20:08 -------- d-----w- c:\program files\ICQ7.4
2011-03-27 12:40 . 2011-03-27 12:40 -------- d-----w- c:\program files\Belarc
2011-03-27 08:19 . 2011-04-22 18:15 -------- d-----w- c:\documents and settings\All Users\Data aplikací\Spybot - Search & Destroy
2011-03-27 08:19 . 2011-03-27 08:20 -------- d-----w- c:\program files\Spybot - Search & Destroy
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-03-19 05:59 . 2011-01-01 17:35 137656 ----a-w- c:\windows\system32\drivers\avipbb.sys
2011-03-17 14:35 . 2011-03-17 14:35 2829 ----a-w- c:\windows\War3Unin.pif
2011-03-17 14:35 . 2011-03-17 14:35 126976 ----a-w- c:\windows\War3Unin.exe
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\DTLite.exe" [2011-01-20 1305408]
"GAINWARD"="c:\program files\EXPERTool\TBPanel.exe" [2008-10-21 2177576]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDCPL"="RTHDCPL.EXE" [2008-05-16 16862720]
"Six Engine"="c:\program files\ASUS\Six Engine\SixEngine.exe" [2008-06-03 5964800]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2010-08-02 281768]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]
"COMODO Internet Security"="c:\program files\COMODO\COMODO Internet Security\cfp.exe" [2010-12-29 2548040]
"nwiz"="nwiz.exe" [2008-10-21 1630208]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-10-21 86016]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-10-21 13574144]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
.
c:\documents and settings\All Users\Nabˇdka Start\Programy\Po spuçtŘnˇ\
Microsoft Office.lnk - c:\program files\Microsoft Office\Office\OSA9.EXE [1999-2-17 65588]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\windows\system32\guard32.dll
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\CLPSLS]
@="Service"
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\COMODO]
2010-11-19 15:12 210648 ----a-w- c:\program files\COMODO\COMODO GeekBuddy\CLPSLA.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
2011-01-03 14:44 15028104 ----a-r- c:\program files\Skype\Phone\Skype.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"wuauserv"=2 (0x2)
"wscsvc"=2 (0x2)
"TeamViewer6"=2 (0x2)
"OpenVPNService"=3 (0x3)
"MSIServer"=3 (0x3)
"FastUserSwitchingCompatibility"=3 (0x3)
"ERSvc"=2 (0x2)
"NVSvc"=2 (0x2)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Opera\\opera.exe"=
"c:\\Program Files\\Java\\jre6\\bin\\javaw.exe"=
"c:\\Program Files\\Miranda IM\\miranda32.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Pando Networks\\Media Booster\\PMB.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Riot Games\\League of Legends\\air\\LolClient.exe"=
"c:\\Riot Games\\League of Legends\\game\\League of Legends.exe"=
"c:\\Program Files\\TeamViewer\\Version6\\TeamViewer.exe"=
"c:\\Program Files\\TeamViewer\\Version6\\TeamViewer_Service.exe"=
"c:\\Program Files\\ICQ7.4\\ICQ.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"58710:TCP"= 58710:TCP:Pando Media Booster
"58710:UDP"= 58710:UDP:Pando Media Booster
"8396:TCP"= 8396:TCP:League of Legends Launcher
"8396:UDP"= 8396:UDP:League of Legends Launcher
"6889:TCP"= 6889:TCP:League of Legends Launcher
"6889:UDP"= 6889:UDP:League of Legends Launcher
"3724:TCP"= 3724:TCP:SC
"6112:TCP"= 6112:TCP:sc
"6113:TCP"= 6113:TCP:sc
"6114:TCP"= 6114:TCP:sc
"4000:TCP"= 4000:TCP:sc
"6966:TCP"= 6966:TCP:League of Legends Launcher
"6966:UDP"= 6966:UDP:League of Legends Launcher
"6897:TCP"= 6897:TCP:League of Legends Launcher
"6897:UDP"= 6897:UDP:League of Legends Launcher
"8397:TCP"= 8397:TCP:League of Legends Launcher
"8397:UDP"= 8397:UDP:League of Legends Launcher
"6919:TCP"= 6919:TCP:League of Legends Launcher
"6919:UDP"= 6919:UDP:League of Legends Launcher
"6948:TCP"= 6948:TCP:League of Legends Launcher
"6948:UDP"= 6948:UDP:League of Legends Launcher
"6898:TCP"= 6898:TCP:League of Legends Launcher
"6898:UDP"= 6898:UDP:League of Legends Launcher
"6912:TCP"= 6912:TCP:League of Legends Launcher
"6912:UDP"= 6912:UDP:League of Legends Launcher
"6899:TCP"= 6899:TCP:League of Legends Launcher
"6899:UDP"= 6899:UDP:League of Legends Launcher
"6995:TCP"= 6995:TCP:League of Legends Launcher
"6995:UDP"= 6995:UDP:League of Legends Launcher
.
R0 mv61xx;mv61xx;c:\windows\system32\drivers\mv61xx.sys [24.6.2008 0:21 150568]
R1 cmdGuard;COMODO Internet Security Sandbox Driver;c:\windows\system32\drivers\cmdGuard.sys [29.12.2010 2:41 239368]
R1 cmdHlp;COMODO Internet Security Helper Driver;c:\windows\system32\drivers\cmdhlp.sys [29.12.2010 2:41 27576]
R1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\drivers\dtsoftbus01.sys [11.4.2011 18:00 218688]
R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [1.1.2011 19:35 135336]
R2 CLPSLS;COMODO livePCsupport Service;c:\program files\COMODO\COMODO GeekBuddy\CLPSLS.exe [19.11.2010 17:12 151432]
R2 ICQ Service;ICQ Service;c:\program files\ICQ6Toolbar\ICQ Service.exe [29.3.2011 22:07 247096]
R2 QipGuard;QipGuard;c:\program files\QipGuard\QipGuard.exe [30.3.2011 16:03 187776]
S3 GGSAFERDriver;GGSAFER Driver;\??\c:\program files\Garena\safedrv.sys --> c:\program files\Garena\safedrv.sys [?]
S3 npggsvc;nProtect GameGuard Service;c:\windows\system32\GameMon.des -service --> c:\windows\system32\GameMon.des -service [?]
S4 TeamViewer6;TeamViewer 6;c:\program files\TeamViewer\Version6\TeamViewer_Service.exe [7.1.2011 1:18 2271608]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://seznam.cz/
uDefault_Search_URL = hxxp://search.qip.ru
uSearchAssistant = hxxp://search.qip.ru/ie
IE: {{73C6DCFB-B606-47F3-BDFA-9A4FBF931E37} - c:\program files\ICQ7.4\ICQ.exe
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
.
AddRemove-QipGuard - c:\documents and settings\T0m\Data aplikací\QipGuard\QipGuard.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-04-22 21:59
Windows 5.1.2600 Service Pack 3 NTFS
.
detected NTDLL code modification:
ZwClose, ZwOpenFile
.
skenování skrytých procesů ...
.
skenování skrytých položek 'Po spuštění' ...
.
skenování skrytých souborů ...
.
sken byl úspešně dokončen
skryté soubory: 0
.
**************************************************************************
.
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\npggsvc]
"ImagePath"="c:\windows\system32\GameMon.des -service"
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10l_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10l_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
--------------------- Knihovny navázané na běžící procesy ---------------------
.
- - - - - - - > 'lsass.exe'(1036)
c:\windows\system32\MPR.dll
c:\windows\system32\guard32.dll
.
Celkový čas: 2011-04-22 22:00:54
ComboFix-quarantined-files.txt 2011-04-22 20:00
.
Před spuštěním: Volných bajtů: 41 161 523 200
Po spuštění: Volných bajtů: 41 133 842 432
.
WindowsXP-KB310994-SP2-Pro-BootDisk-CSY.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /fastdetect /NoExecute=OptOut
.
- - End Of File - - 97B1BDE04EBEAD6857260ABF21CE9224

[Rudy]

Ještě dočistíme. Otevřte poznámkový blok a zkopírujte do něj:

Collect::
c:\windows\NV2241184.TMP

Uložte na plochu jako CFScript.txt. Pak jej myší přetáhněte nad ikonu ComboFix a pusťte. CF se spustí a vykoná příkazy ze skriptu.



V případě, že by problém přetrval, pak kromě ovladače gr. karty, přeinstalujte i ovladač chipsetu, případně použijte jinou verzi ovladače.

[Yutaka]

CF začal řvát po restartu docela dost chyb. Přístup byl odepřen a něco v příkazovém řádku...

ComboFix 11-04-22.01 - T0m 23.04.2011 0:52.2.2 - x86 NETWORK
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.420.1029.18.3327.3060 [GMT 2:00]
Spuštěný z: c:\documents and settings\T0m\Plocha\ComboFix.exe
Použité ovládací přepínače :: c:\documents and settings\T0m\Plocha\CFScript.txt.txt
AV: AntiVir Desktop *Enabled/Updated* {AD166499-45F9-482A-A743-FDD3350758C7}
FW: COMODO Firewall *Enabled* {043803A3-4F86-4ef6-AFC5-F6E02A79969B}
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2011-03-22 do 2011-04-22 )))))))))))))))))))))))))))))))
.
.
2011-04-22 19:14 . 2011-04-22 19:14 -------- d-----w- c:\documents and settings\T0m\Data aplikací\Malwarebytes
2011-04-22 19:14 . 2011-04-22 19:14 -------- d-----w- c:\documents and settings\All Users\Data aplikací\Malwarebytes
2011-04-22 19:14 . 2010-12-20 16:09 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-04-22 19:13 . 2011-04-22 19:14 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2011-04-22 19:13 . 2010-12-20 16:08 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-04-22 19:01 . 2011-04-22 19:03 -------- d-----w- C:\rsit
2011-04-22 19:01 . 2011-04-22 19:03 -------- d-----w- c:\program files\trend micro
2011-04-22 18:25 . 2011-04-22 18:25 -------- d-----w- c:\windows\nview
2011-04-22 18:25 . 2011-04-22 18:26 -------- d-----w- c:\windows\NV2241184.TMP
2011-04-22 16:52 . 2009-04-06 07:08 5174 ----a-w- c:\windows\system32\nppt9x.vxd
2011-04-22 16:52 . 2009-04-06 07:08 4682 ----a-w- c:\windows\system32\npptNT2.sys
2011-04-19 18:59 . 2011-04-19 18:59 -------- d-----w- c:\documents and settings\T0m\Local Settings\Data aplikací\Identities
2011-04-11 16:00 . 2011-04-11 16:00 218688 ----a-w- c:\windows\system32\drivers\dtsoftbus01.sys
2011-04-11 16:00 . 2011-04-11 16:00 -------- d-----w- c:\program files\DAEMON Tools Toolbar
2011-04-11 16:00 . 2011-04-11 16:00 -------- d-----w- c:\program files\DAEMON Tools Lite
2011-04-11 15:59 . 2011-04-11 16:01 -------- d-----w- c:\documents and settings\T0m\Data aplikací\DAEMON Tools Lite
2011-04-11 15:59 . 2011-04-11 15:59 -------- d-----w- c:\documents and settings\All Users\Data aplikací\DAEMON Tools Lite
2011-03-30 14:03 . 2011-03-30 14:03 -------- d-----w- c:\documents and settings\T0m\Data aplikací\QIP
2011-03-30 14:03 . 2011-03-30 14:03 -------- d-----w- c:\program files\QipGuard
2011-03-30 14:03 . 2011-03-30 14:03 -------- d-----w- c:\documents and settings\T0m\Data aplikací\QipGuard
2011-03-30 14:03 . 2010-12-13 14:06 141184 ----a-w- c:\documents and settings\T0m\Data aplikací\Microsoft\Internet Explorer\qipsearchbar.dll
2011-03-30 14:03 . 2011-04-22 16:01 -------- d-----w- c:\program files\QIP 2010
2011-03-29 20:07 . 2011-03-29 20:07 -------- d-----w- c:\program files\ICQ6Toolbar
2011-03-29 20:07 . 2011-03-29 20:07 -------- d-----w- c:\documents and settings\All Users\Data aplikací\ICQ
2011-03-29 20:06 . 2011-03-29 20:08 -------- d-----w- c:\program files\ICQ7.4
2011-03-27 12:40 . 2011-03-27 12:40 -------- d-----w- c:\program files\Belarc
2011-03-27 08:19 . 2011-04-22 18:15 -------- d-----w- c:\documents and settings\All Users\Data aplikací\Spybot - Search & Destroy
2011-03-27 08:19 . 2011-03-27 08:20 -------- d-----w- c:\program files\Spybot - Search & Destroy
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-03-19 05:59 . 2011-01-01 17:35 137656 ----a-w- c:\windows\system32\drivers\avipbb.sys
2011-03-17 14:35 . 2011-03-17 14:35 2829 ----a-w- c:\windows\War3Unin.pif
2011-03-17 14:35 . 2011-03-17 14:35 126976 ----a-w- c:\windows\War3Unin.exe
.
.
((((((((((((((((((((((((((((( SnapShot@2011-04-22_19.59.41 )))))))))))))))))))))))))))))))))))))))))
.
+ 2011-04-22 22:56 . 2011-04-22 22:56 16384 c:\windows\temp\Perflib_Perfdata_2a8.dat
- 2001-10-25 14:00 . 2011-01-08 09:47 58732 c:\windows\system32\perfc009.dat
+ 2001-10-25 14:00 . 2011-04-22 22:57 58732 c:\windows\system32\perfc009.dat
- 2001-10-25 14:00 . 2011-01-08 09:47 68916 c:\windows\system32\perfc005.dat
+ 2001-10-25 14:00 . 2011-04-22 22:57 68916 c:\windows\system32\perfc005.dat
+ 2001-10-25 14:00 . 2011-04-22 22:57 392432 c:\windows\system32\perfh009.dat
- 2001-10-25 14:00 . 2011-01-08 09:47 392432 c:\windows\system32\perfh009.dat
- 2001-10-25 14:00 . 2011-01-08 09:47 389938 c:\windows\system32\perfh005.dat
+ 2001-10-25 14:00 . 2011-04-22 22:57 389938 c:\windows\system32\perfh005.dat
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\DTLite.exe" [2011-01-20 1305408]
"GAINWARD"="c:\program files\EXPERTool\TBPanel.exe" [2008-10-21 2177576]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDCPL"="RTHDCPL.EXE" [2008-05-16 16862720]
"Six Engine"="c:\program files\ASUS\Six Engine\SixEngine.exe" [2008-06-03 5964800]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2010-08-02 281768]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]
"COMODO Internet Security"="c:\program files\COMODO\COMODO Internet Security\cfp.exe" [2010-12-29 2548040]
"nwiz"="nwiz.exe" [2008-10-21 1630208]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-10-21 86016]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-10-21 13574144]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
.
c:\documents and settings\All Users\Nabˇdka Start\Programy\Po spuçtŘnˇ\
Microsoft Office.lnk - c:\program files\Microsoft Office\Office\OSA9.EXE [1999-2-17 65588]
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\CLPSLS]
@="Service"
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\COMODO]
2010-11-19 15:12 210648 ----a-w- c:\program files\COMODO\COMODO GeekBuddy\CLPSLA.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
2011-01-03 14:44 15028104 ----a-r- c:\program files\Skype\Phone\Skype.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"wuauserv"=2 (0x2)
"wscsvc"=2 (0x2)
"TeamViewer6"=2 (0x2)
"OpenVPNService"=3 (0x3)
"MSIServer"=3 (0x3)
"FastUserSwitchingCompatibility"=3 (0x3)
"ERSvc"=2 (0x2)
"NVSvc"=2 (0x2)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Opera\\opera.exe"=
"c:\\Program Files\\Java\\jre6\\bin\\javaw.exe"=
"c:\\Program Files\\Miranda IM\\miranda32.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Pando Networks\\Media Booster\\PMB.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Riot Games\\League of Legends\\air\\LolClient.exe"=
"c:\\Riot Games\\League of Legends\\game\\League of Legends.exe"=
"c:\\Program Files\\TeamViewer\\Version6\\TeamViewer.exe"=
"c:\\Program Files\\TeamViewer\\Version6\\TeamViewer_Service.exe"=
"c:\\Program Files\\ICQ7.4\\ICQ.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"58710:TCP"= 58710:TCP:Pando Media Booster
"58710:UDP"= 58710:UDP:Pando Media Booster
"8396:TCP"= 8396:TCP:League of Legends Launcher
"8396:UDP"= 8396:UDP:League of Legends Launcher
"6889:TCP"= 6889:TCP:League of Legends Launcher
"6889:UDP"= 6889:UDP:League of Legends Launcher
"3724:TCP"= 3724:TCP:SC
"6112:TCP"= 6112:TCP:sc
"6113:TCP"= 6113:TCP:sc
"6114:TCP"= 6114:TCP:sc
"4000:TCP"= 4000:TCP:sc
"6966:TCP"= 6966:TCP:League of Legends Launcher
"6966:UDP"= 6966:UDP:League of Legends Launcher
"6897:TCP"= 6897:TCP:League of Legends Launcher
"6897:UDP"= 6897:UDP:League of Legends Launcher
"8397:TCP"= 8397:TCP:League of Legends Launcher
"8397:UDP"= 8397:UDP:League of Legends Launcher
"6919:TCP"= 6919:TCP:League of Legends Launcher
"6919:UDP"= 6919:UDP:League of Legends Launcher
"6948:TCP"= 6948:TCP:League of Legends Launcher
"6948:UDP"= 6948:UDP:League of Legends Launcher
"6898:TCP"= 6898:TCP:League of Legends Launcher
"6898:UDP"= 6898:UDP:League of Legends Launcher
"6912:TCP"= 6912:TCP:League of Legends Launcher
"6912:UDP"= 6912:UDP:League of Legends Launcher
"6899:TCP"= 6899:TCP:League of Legends Launcher
"6899:UDP"= 6899:UDP:League of Legends Launcher
"6995:TCP"= 6995:TCP:League of Legends Launcher
"6995:UDP"= 6995:UDP:League of Legends Launcher
.
R0 mv61xx;mv61xx;c:\windows\system32\drivers\mv61xx.sys [24.6.2008 0:21 150568]
R1 cmdGuard;COMODO Internet Security Sandbox Driver;c:\windows\system32\drivers\cmdGuard.sys [29.12.2010 2:41 239368]
R1 cmdHlp;COMODO Internet Security Helper Driver;c:\windows\system32\drivers\cmdhlp.sys [29.12.2010 2:41 27576]
R1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\drivers\dtsoftbus01.sys [11.4.2011 18:00 218688]
R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [1.1.2011 19:35 135336]
R2 CLPSLS;COMODO livePCsupport Service;c:\program files\COMODO\COMODO GeekBuddy\CLPSLS.exe [19.11.2010 17:12 151432]
R2 ICQ Service;ICQ Service;c:\program files\ICQ6Toolbar\ICQ Service.exe [29.3.2011 22:07 247096]
R2 QipGuard;QipGuard;c:\program files\QipGuard\QipGuard.exe [30.3.2011 16:03 187776]
S3 GGSAFERDriver;GGSAFER Driver;\??\c:\program files\Garena\safedrv.sys --> c:\program files\Garena\safedrv.sys [?]
S3 npggsvc;nProtect GameGuard Service;c:\windows\system32\GameMon.des -service --> c:\windows\system32\GameMon.des -service [?]
S4 TeamViewer6;TeamViewer 6;c:\program files\TeamViewer\Version6\TeamViewer_Service.exe [7.1.2011 1:18 2271608]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://seznam.cz/
uDefault_Search_URL = hxxp://search.qip.ru
uSearchAssistant = hxxp://search.qip.ru/ie
IE: {{73C6DCFB-B606-47F3-BDFA-9A4FBF931E37} - c:\program files\ICQ7.4\ICQ.exe
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-04-23 00:57
Windows 5.1.2600 Service Pack 3 NTFS
.
detected NTDLL code modification:
ZwClose, ZwOpenFile
.
skenování skrytých procesů ...
.
skenování skrytých položek 'Po spuštění' ...
.
skenování skrytých souborů ...
.
sken byl úspešně dokončen
skryté soubory: 0
.
**************************************************************************
.
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\npggsvc]
"ImagePath"="c:\windows\system32\GameMon.des -service"
.
--------------------- Knihovny navázané na běžící procesy ---------------------
.
- - - - - - - > 'lsass.exe'(1040)
c:\windows\system32\MPR.dll
c:\windows\system32\guard32.dll
.
- - - - - - - > 'Explorer.EXE'(456)
c:\windows\system32\guard32.dll
c:\windows\system32\MPR.dll
.
Celkový čas: 2011-04-23 00:59:08 - počítač byl restartován
ComboFix-quarantined-files.txt 2011-04-22 22:59
ComboFix2.txt 2011-04-22 20:00
.
Před spuštěním: Volných bajtů: 41 185 947 648
Po spuštění: Volných bajtů: 41 117 384 704
.
- - End Of File - - 0DF1C1A55D12E464557431903F70E121

[Yutaka]

teď to prošlo bez problému.

ComboFix 11-04-22.03 - T0m 23.04.2011 7:36.3.2 - x86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.420.1029.18.3327.2851 [GMT 2:00]
Spuštěný z: c:\documents and settings\T0m\Plocha\ComboFix.exe
Použité ovládací přepínače :: c:\documents and settings\T0m\Plocha\CFScript.txt.txt
AV: AntiVir Desktop *Disabled/Updated* {AD166499-45F9-482A-A743-FDD3350758C7}
FW: COMODO Firewall *Enabled* {043803A3-4F86-4ef6-AFC5-F6E02A79969B}
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2011-03-23 do 2011-04-23 )))))))))))))))))))))))))))))))
.
.
2011-04-22 19:14 . 2011-04-22 19:14 -------- d-----w- c:\documents and settings\T0m\Data aplikací\Malwarebytes
2011-04-22 19:14 . 2011-04-22 19:14 -------- d-----w- c:\documents and settings\All Users\Data aplikací\Malwarebytes
2011-04-22 19:14 . 2010-12-20 16:09 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-04-22 19:13 . 2011-04-22 19:14 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2011-04-22 19:13 . 2010-12-20 16:08 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-04-22 19:01 . 2011-04-22 19:03 -------- d-----w- C:\rsit
2011-04-22 19:01 . 2011-04-22 19:03 -------- d-----w- c:\program files\trend micro
2011-04-22 18:25 . 2011-04-22 18:25 -------- d-----w- c:\windows\nview
2011-04-22 18:25 . 2011-04-22 18:26 -------- d-----w- c:\windows\NV2241184.TMP
2011-04-22 16:52 . 2009-04-06 07:08 5174 ----a-w- c:\windows\system32\nppt9x.vxd
2011-04-22 16:52 . 2009-04-06 07:08 4682 ----a-w- c:\windows\system32\npptNT2.sys
2011-04-19 18:59 . 2011-04-19 18:59 -------- d-----w- c:\documents and settings\T0m\Local Settings\Data aplikací\Identities
2011-04-11 16:00 . 2011-04-11 16:00 218688 ----a-w- c:\windows\system32\drivers\dtsoftbus01.sys
2011-04-11 16:00 . 2011-04-11 16:00 -------- d-----w- c:\program files\DAEMON Tools Toolbar
2011-04-11 16:00 . 2011-04-11 16:00 -------- d-----w- c:\program files\DAEMON Tools Lite
2011-04-11 15:59 . 2011-04-11 16:01 -------- d-----w- c:\documents and settings\T0m\Data aplikací\DAEMON Tools Lite
2011-04-11 15:59 . 2011-04-11 15:59 -------- d-----w- c:\documents and settings\All Users\Data aplikací\DAEMON Tools Lite
2011-03-30 14:03 . 2011-03-30 14:03 -------- d-----w- c:\documents and settings\T0m\Data aplikací\QIP
2011-03-30 14:03 . 2011-03-30 14:03 -------- d-----w- c:\program files\QipGuard
2011-03-30 14:03 . 2011-03-30 14:03 -------- d-----w- c:\documents and settings\T0m\Data aplikací\QipGuard
2011-03-30 14:03 . 2010-12-13 14:06 141184 ----a-w- c:\documents and settings\T0m\Data aplikací\Microsoft\Internet Explorer\qipsearchbar.dll
2011-03-30 14:03 . 2011-04-22 16:01 -------- d-----w- c:\program files\QIP 2010
2011-03-29 20:07 . 2011-03-29 20:07 -------- d-----w- c:\program files\ICQ6Toolbar
2011-03-29 20:07 . 2011-03-29 20:07 -------- d-----w- c:\documents and settings\All Users\Data aplikací\ICQ
2011-03-29 20:06 . 2011-03-29 20:08 -------- d-----w- c:\program files\ICQ7.4
2011-03-27 12:40 . 2011-03-27 12:40 -------- d-----w- c:\program files\Belarc
2011-03-27 08:19 . 2011-04-22 18:15 -------- d-----w- c:\documents and settings\All Users\Data aplikací\Spybot - Search & Destroy
2011-03-27 08:19 . 2011-03-27 08:20 -------- d-----w- c:\program files\Spybot - Search & Destroy
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-03-19 05:59 . 2011-01-01 17:35 137656 ----a-w- c:\windows\system32\drivers\avipbb.sys
2011-03-17 14:35 . 2011-03-17 14:35 2829 ----a-w- c:\windows\War3Unin.pif
2011-03-17 14:35 . 2011-03-17 14:35 126976 ----a-w- c:\windows\War3Unin.exe
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\DTLite.exe" [2011-01-20 1305408]
"GAINWARD"="c:\program files\EXPERTool\TBPanel.exe" [2008-10-21 2177576]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDCPL"="RTHDCPL.EXE" [2008-05-16 16862720]
"Six Engine"="c:\program files\ASUS\Six Engine\SixEngine.exe" [2008-06-03 5964800]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2010-08-02 281768]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]
"COMODO Internet Security"="c:\program files\COMODO\COMODO Internet Security\cfp.exe" [2010-12-29 2548040]
"nwiz"="nwiz.exe" [2008-10-21 1630208]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-10-21 86016]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-10-21 13574144]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
.
c:\documents and settings\All Users\Nabˇdka Start\Programy\Po spuçtŘnˇ\
Microsoft Office.lnk - c:\program files\Microsoft Office\Office\OSA9.EXE [1999-2-17 65588]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\windows\system32\guard32.dll
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\CLPSLS]
@="Service"
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\COMODO]
2010-11-19 15:12 210648 ----a-w- c:\program files\COMODO\COMODO GeekBuddy\CLPSLA.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
2011-01-03 14:44 15028104 ----a-r- c:\program files\Skype\Phone\Skype.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"wuauserv"=2 (0x2)
"wscsvc"=2 (0x2)
"TeamViewer6"=2 (0x2)
"OpenVPNService"=3 (0x3)
"MSIServer"=3 (0x3)
"FastUserSwitchingCompatibility"=3 (0x3)
"ERSvc"=2 (0x2)
"NVSvc"=2 (0x2)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Opera\\opera.exe"=
"c:\\Program Files\\Java\\jre6\\bin\\javaw.exe"=
"c:\\Program Files\\Miranda IM\\miranda32.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Pando Networks\\Media Booster\\PMB.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Riot Games\\League of Legends\\air\\LolClient.exe"=
"c:\\Riot Games\\League of Legends\\game\\League of Legends.exe"=
"c:\\Program Files\\TeamViewer\\Version6\\TeamViewer.exe"=
"c:\\Program Files\\TeamViewer\\Version6\\TeamViewer_Service.exe"=
"c:\\Program Files\\ICQ7.4\\ICQ.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"58710:TCP"= 58710:TCP:Pando Media Booster
"58710:UDP"= 58710:UDP:Pando Media Booster
"8396:TCP"= 8396:TCP:League of Legends Launcher
"8396:UDP"= 8396:UDP:League of Legends Launcher
"6889:TCP"= 6889:TCP:League of Legends Launcher
"6889:UDP"= 6889:UDP:League of Legends Launcher
"3724:TCP"= 3724:TCP:SC
"6112:TCP"= 6112:TCP:sc
"6113:TCP"= 6113:TCP:sc
"6114:TCP"= 6114:TCP:sc
"4000:TCP"= 4000:TCP:sc
"6966:TCP"= 6966:TCP:League of Legends Launcher
"6966:UDP"= 6966:UDP:League of Legends Launcher
"6897:TCP"= 6897:TCP:League of Legends Launcher
"6897:UDP"= 6897:UDP:League of Legends Launcher
"8397:TCP"= 8397:TCP:League of Legends Launcher
"8397:UDP"= 8397:UDP:League of Legends Launcher
"6919:TCP"= 6919:TCP:League of Legends Launcher
"6919:UDP"= 6919:UDP:League of Legends Launcher
"6948:TCP"= 6948:TCP:League of Legends Launcher
"6948:UDP"= 6948:UDP:League of Legends Launcher
"6898:TCP"= 6898:TCP:League of Legends Launcher
"6898:UDP"= 6898:UDP:League of Legends Launcher
"6912:TCP"= 6912:TCP:League of Legends Launcher
"6912:UDP"= 6912:UDP:League of Legends Launcher
"6899:TCP"= 6899:TCP:League of Legends Launcher
"6899:UDP"= 6899:UDP:League of Legends Launcher
"6995:TCP"= 6995:TCP:League of Legends Launcher
"6995:UDP"= 6995:UDP:League of Legends Launcher
.
R0 mv61xx;mv61xx;c:\windows\system32\drivers\mv61xx.sys [24.6.2008 0:21 150568]
R1 cmdGuard;COMODO Internet Security Sandbox Driver;c:\windows\system32\drivers\cmdGuard.sys [29.12.2010 2:41 239368]
R1 cmdHlp;COMODO Internet Security Helper Driver;c:\windows\system32\drivers\cmdhlp.sys [29.12.2010 2:41 27576]
R1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\drivers\dtsoftbus01.sys [11.4.2011 18:00 218688]
R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [1.1.2011 19:35 135336]
R2 CLPSLS;COMODO livePCsupport Service;c:\program files\COMODO\COMODO GeekBuddy\CLPSLS.exe [19.11.2010 17:12 151432]
R2 ICQ Service;ICQ Service;c:\program files\ICQ6Toolbar\ICQ Service.exe [29.3.2011 22:07 247096]
R2 QipGuard;QipGuard;c:\program files\QipGuard\QipGuard.exe [30.3.2011 16:03 187776]
S3 GGSAFERDriver;GGSAFER Driver;\??\c:\program files\Garena\safedrv.sys --> c:\program files\Garena\safedrv.sys [?]
S3 npggsvc;nProtect GameGuard Service;c:\windows\system32\GameMon.des -service --> c:\windows\system32\GameMon.des -service [?]
S4 TeamViewer6;TeamViewer 6;c:\program files\TeamViewer\Version6\TeamViewer_Service.exe [7.1.2011 1:18 2271608]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://seznam.cz/
uDefault_Search_URL = hxxp://search.qip.ru
uSearchAssistant = hxxp://search.qip.ru/ie
IE: {{73C6DCFB-B606-47F3-BDFA-9A4FBF931E37} - c:\program files\ICQ7.4\ICQ.exe
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-04-23 07:40
Windows 5.1.2600 Service Pack 3 NTFS
.
detected NTDLL code modification:
ZwClose, ZwOpenFile
.
skenování skrytých procesů ...
.
skenování skrytých položek 'Po spuštění' ...
.
skenování skrytých souborů ...
.
sken byl úspešně dokončen
skryté soubory: 0
.
**************************************************************************
.
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\npggsvc]
"ImagePath"="c:\windows\system32\GameMon.des -service"
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10l_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10l_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
--------------------- Knihovny navázané na běžící procesy ---------------------
.
- - - - - - - > 'lsass.exe'(1040)
c:\windows\system32\MPR.dll
c:\windows\system32\guard32.dll
.
- - - - - - - > 'explorer.exe'(3160)
c:\windows\system32\guard32.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\windows\RTHDCPL.EXE
c:\windows\system32\RUNDLL32.EXE
c:\program files\Avira\AntiVir Desktop\avguard.exe
c:\program files\Avira\AntiVir Desktop\avshadow.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\windows\system32\wbem\wmiapsrv.exe
c:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Celkový čas: 2011-04-23 07:42:47 - počítač byl restartován
ComboFix-quarantined-files.txt 2011-04-23 05:42
ComboFix2.txt 2011-04-22 22:59
ComboFix3.txt 2011-04-22 20:00
.
Před spuštěním: Volných bajtů: 41 103 147 008
Po spuštění: Volných bajtů: 41 102 729 216
.
- - End Of File - - 0AFEF11D3D43C17DFCB4322A6C86CECE

[Rudy]

Nebyl smazán . Zkuste Avenger: http://www.viry.cz/forum/viewtopic.php?f=11&t=19832 se skriptem:

Files to delete:
c:\windows\NV2241184.TMP

[Yutaka]

ogfile of The Avenger Version 2.0, (c) by Swandog46
http://swandog46.geekstogo.com

Platform: Windows XP

*******************

Script file opened successfully.
Script file read successfully.

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

Rootkit scan active.
No rootkits found!


Error: "c:\windows\NV2241184.TMP" is a folder, not a file!
Deletion of file "c:\windows\NV2241184.TMP" failed!
Status: 0xc00000ba (STATUS_FILE_IS_A_DIRECTORY)
--> use "Folders to delete:" instead of "Files to delete:" to delete a directory


Completed script processing.

*******************

Finished! Terminate.



//////////////////////////////////////////
Avenger Pre-Processor log
//////////////////////////////////////////

Platform: Windows XP (build 2600, Service Pack 3)
Sat Apr 23 14:51:30 2011

14:51:30: Error: Invalid script. A valid script must begin with a command directive.
Aborting execution!


//////////////////////////////////////////

[Rudy]

Pardon, zadal jsem chybně skript. Ten správný je:

Folders to delete:
c:\windows\NV2241184.TMP

[Yutaka]

Logfile of The Avenger Version 2.0, (c) by Swandog46
http://swandog46.geekstogo.com

Platform: Windows XP

*******************

Script file opened successfully.
Script file read successfully.

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

Rootkit scan active.
No rootkits found!


Error: "c:\windows\NV2241184.TMP" is a folder, not a file!
Deletion of file "c:\windows\NV2241184.TMP" failed!
Status: 0xc00000ba (STATUS_FILE_IS_A_DIRECTORY)
--> use "Folders to delete:" instead of "Files to delete:" to delete a directory


Completed script processing.

*******************

Finished! Terminate.



//////////////////////////////////////////
Avenger Pre-Processor log
//////////////////////////////////////////

Platform: Windows XP (build 2600, Service Pack 3)
Sat Apr 23 14:51:30 2011

14:51:30: Error: Invalid script. A valid script must begin with a command directive.
Aborting execution!


//////////////////////////////////////////


Logfile of The Avenger Version 2.0, (c) by Swandog46
http://swandog46.geekstogo.com

Platform: Windows XP

*******************

Script file opened successfully.
Script file read successfully.

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

Rootkit scan active.
No rootkits found!

Folder "c:\windows\NV2241184.TMP" deleted successfully.

Completed script processing.

*******************

Finished! Terminate.

[Rudy]

OK, smazáno. Nastala nějaká změna?