VIRY.CZ

a este aj toto

Ještě mrkneme na rootkity, tohle dělávala jedna mrška .

odinstalujte všechny virtuální jednotky (Daemon nebo alcohol)

Stáhněte SPTD http://www.duplexsecure.com/en/downloads
-vyberte verzi podle svého operačního systému. SPTD for Windows (32 bit) nebo (64b)
-uložte na plochu a spusťte
- zvolte možnost Uninstall
- restart PC


Stahněte http://www.jpshortstuff.247fixes.com/Defogger.exe
- spustte,
- potvrdte disabled
-log vložte zde



Stáhněte Gmer http://www.viry.cz/forum/viewtopic.php?f=29&t=62878
- rozbalte a spusťte
-proběhne sken, po skončení se otevře okno s výsledky, kliknete na Save a tím si uložíte log,který sem vložíte

-Podle návodu v odkazu proveďte druhý sken a log sem také vložte.

stáhněte MBR
http://www2.gmer.net/mbr/mbr.exe
-uložte ho na plochu


start-spustit
do okénka zkopírujte
ok

vytvoří se log s názvem mbr.log, vložte ho zde [/quote]

Dobre rano

motji píše:Ještě mrkneme na rootkity, tohle dělávala jedna mrška .

odinstalujte všechny virtuální jednotky (Daemon nebo alcohol)

stalo sa (Daemon Lite), v CCleaneri nebol, len priamo v priecinku programu v Program files cez uninstall.exe

Stáhněte SPTD http://www.duplexsecure.com/en/downloads
-vyberte verzi podle svého operačního systému. SPTD for Windows (32 bit) nebo (64b)
-uložte na plochu a spusťte
- zvolte možnost Uninstall
- restart PC

na uninstall sa nedalo kliknut, dal som install, restart a potom uninstall, restart


Stahněte http://www.jpshortstuff.247fixes.com/Defogger.exe
- spustte,
- potvrdte disabled
-log vložte zde

ziaden log mi to nevyplulo



Stáhněte Gmer http://www.viry.cz/forum/viewtopic.php?f=29&t=62878
- rozbalte a spusťte
-proběhne sken, po skončení se otevře okno s výsledky, kliknete na Save a tím si uložíte log,který sem vložíte

log1:

GMER 1.0.15.15530 - http://www.gmer.net
Rootkit quick scan 2010-11-13 22:11:17
Windows 5.1.2600 Service Pack 2 Harddisk1\DR1 -> \Device\Ide\IdeDeviceP3T0L0-10 ST380815AS rev.3.AAD
Running: gmer.exe; Driver: D:\DOCUME~1\maros\LOCALS~1\Temp\pxtdypow.sys


---- Devices - GMER 1.0.15 ----

AttachedDevice \FileSystem\Ntfs \Ntfs amon.sys (Amon monitor/Eset )

Device \Driver\Tcpip \Device\Ip vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)
Device \Driver\Tcpip \Device\Tcp vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)
Device \Driver\Tcpip \Device\Udp vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)
Device \Driver\Tcpip \Device\RawIp vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)

---- EOF - GMER 1.0.15 ----


-Podle návodu v odkazu proveďte druhý sken a log sem také vložte.

prvy krat mi po 2 hodinach vyhodilo modru obrazovku s "problem caused by the following file: pxtdypow.sys"
Log2:

GMER 1.0.15.15530 - http://www.gmer.net
Rootkit scan 2010-11-14 09:10:37
Windows 5.1.2600 Service Pack 2 Harddisk1\DR1 -> \Device\Ide\IdeDeviceP3T0L0-10 ST380815AS rev.3.AAD
Running: gmer.exe; Driver: D:\DOCUME~1\maros\LOCALS~1\Temp\pxtdypow.sys


---- System - GMER 1.0.15 ----

SSDT \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwConnectPort [0xB7702534]
SSDT \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwCreateFile [0xB76FC782]
SSDT \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwCreateKey [0xB771B6DC]
SSDT \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwCreatePort [0xB7702CC0]
SSDT \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwCreateProcess [0xB7715EB4]
SSDT \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwCreateProcessEx [0xB77162A2]
SSDT \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwCreateSection [0xB771F916]
SSDT \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwCreateWaitablePort [0xB7702DF6]
SSDT \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwDeleteFile [0xB76FD398]
SSDT \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwDeleteKey [0xB771CFE4]
SSDT \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwDeleteValueKey [0xB771C93C]
SSDT \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwDuplicateObject [0xB7714DF0]
SSDT \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwLoadKey [0xB771D93C]
SSDT \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwLoadKey2 [0xB771DB44]
SSDT \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwOpenFile [0xB76FCFAA]
SSDT \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwOpenProcess [0xB77181CE]
SSDT \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwOpenThread [0xB7717DF8]
SSDT \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwRenameKey [0xB771E8D2]
SSDT \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwReplaceKey [0xB771E208]
SSDT \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwRequestWaitReplyPort [0xB77020F4]
SSDT \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwRestoreKey [0xB771F2A4]
SSDT \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwSecureConnectPort [0xB77027DC]
SSDT \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwSetInformationFile [0xB76FD75C]
SSDT \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwSetSecurityObject [0xB771EE12]
SSDT \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwSetValueKey [0xB771C0C4]
SSDT \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwSystemDebugControl [0xB7716F0A]
SSDT \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwTerminateProcess [0xB7716C86]

---- Kernel code sections - GMER 1.0.15 ----

.text ntkrnlpa.exe!ZwCallbackReturn + 2BEC 805037EC 12 Bytes [C0, 2C, 70, B7, B4, 5E, 71, ...]
.text ntkrnlpa.exe!ZwCallbackReturn + 2E34 80503A34 8 Bytes CALL 6258F1AA
.text D:\WINDOWS\system32\DRIVERS\nv4_mini.sys section is writeable [0xBA1E8360, 0x24BB1D, 0xE8000020]
init D:\WINDOWS\system32\drivers\Senfilt.sys entry point in "init" section [0xB792CA80]

---- Kernel IAT/EAT - GMER 1.0.15 ----

IAT \SystemRoot\system32\DRIVERS\raspppoe.sys[NDIS.SYS!NdisRegisterProtocol] [B7707672] \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)
IAT \SystemRoot\system32\DRIVERS\raspppoe.sys[NDIS.SYS!NdisOpenAdapter] [B77074C8] \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)
IAT \SystemRoot\system32\DRIVERS\raspppoe.sys[NDIS.SYS!NdisCloseAdapter] [B7707CBA] \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)
IAT \SystemRoot\system32\DRIVERS\raspppoe.sys[NDIS.SYS!NdisDeregisterProtocol] [B7705C2A] \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)
IAT \SystemRoot\system32\DRIVERS\psched.sys[NDIS.SYS!NdisDeregisterProtocol] [B7705C2A] \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)
IAT \SystemRoot\system32\DRIVERS\psched.sys[NDIS.SYS!NdisRegisterProtocol] [B7707672] \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)
IAT \SystemRoot\system32\DRIVERS\psched.sys[NDIS.SYS!NdisOpenAdapter] [B77074C8] \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)
IAT \SystemRoot\system32\DRIVERS\psched.sys[NDIS.SYS!NdisCloseAdapter] [B7707CBA] \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)
IAT \SystemRoot\System32\Drivers\NDProxy.SYS[NDIS.SYS!NdisRegisterProtocol] [B7707672] \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)
IAT \SystemRoot\System32\Drivers\NDProxy.SYS[NDIS.SYS!NdisCloseAdapter] [B7707CBA] \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)
IAT \SystemRoot\System32\Drivers\NDProxy.SYS[NDIS.SYS!NdisOpenAdapter] [B77074C8] \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)
IAT \SystemRoot\System32\Drivers\NDProxy.SYS[NDIS.SYS!NdisDeregisterProtocol] [B7705C2A] \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)
IAT \SystemRoot\system32\DRIVERS\tcpip.sys[NDIS.SYS!NdisCloseAdapter] [B7707CBA] \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)
IAT \SystemRoot\system32\DRIVERS\tcpip.sys[NDIS.SYS!NdisRegisterProtocol] [B7707672] \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)
IAT \SystemRoot\system32\DRIVERS\tcpip.sys[NDIS.SYS!NdisOpenAdapter] [B77074C8] \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)
IAT \SystemRoot\system32\DRIVERS\wanarp.sys[NDIS.SYS!NdisDeregisterProtocol] [B7705C2A] \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)
IAT \SystemRoot\system32\DRIVERS\wanarp.sys[NDIS.SYS!NdisRegisterProtocol] [B7707672] \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)
IAT \SystemRoot\system32\DRIVERS\wanarp.sys[NDIS.SYS!NdisOpenAdapter] [B77074C8] \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)
IAT \SystemRoot\system32\DRIVERS\wanarp.sys[NDIS.SYS!NdisCloseAdapter] [B7707CBA] \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)
IAT \SystemRoot\system32\DRIVERS\ndisuio.sys[NDIS.SYS!NdisRegisterProtocol] [B7707672] \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)
IAT \SystemRoot\system32\DRIVERS\ndisuio.sys[NDIS.SYS!NdisDeregisterProtocol] [B7705C2A] \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)
IAT \SystemRoot\system32\DRIVERS\ndisuio.sys[NDIS.SYS!NdisCloseAdapter] [B7707CBA] \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)
IAT \SystemRoot\system32\DRIVERS\ndisuio.sys[NDIS.SYS!NdisOpenAdapter] [B77074C8] \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)

---- Devices - GMER 1.0.15 ----

AttachedDevice \FileSystem\Ntfs \Ntfs amon.sys (Amon monitor/Eset )

Device \Driver\Tcpip \Device\Ip vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)
Device \Driver\Tcpip \Device\Tcp vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)
Device \Driver\Tcpip \Device\Udp vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)
Device \Driver\Tcpip \Device\RawIp vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)
Device \Driver\Tcpip \Device\IPMULTICAST vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)

---- Registry - GMER 1.0.15 ----

Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@p0 D:\Program Files\DAEMON Tools Lite\
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0x4E 0x4F 0x0E 0xBE ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@a0 0x20 0x01 0x00 0x00 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@khjeh 0x47 0xFD 0xC4 0xF8 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40@khjeh 0x35 0xCC 0x40 0xC4 ...
Reg HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@p0 D:\Program Files\DAEMON Tools Lite\
Reg HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0
Reg HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0x4E 0x4F 0x0E 0xBE ...
Reg HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@a0 0x20 0x01 0x00 0x00 ...
Reg HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@khjeh 0x47 0xFD 0xC4 0xF8 ...
Reg HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40@khjeh 0x35 0xCC 0x40 0xC4 ...
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@DeviceNotSelectedTimeout 15
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@GDIProcessHandleQuota 10000
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@Spooler yes
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@swapdisk
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@TransmissionRetryTimeout 90
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@USERProcessHandleQuota 10000
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@RequireSignedAppInit_DLLs 1

---- EOF - GMER 1.0.15 ----


stáhněte MBR
http://www2.gmer.net/mbr/mbr.exe
-uložte ho na plochu


start-spustit
do okénka zkopírujte

Kód: Vybrat vše

"%userprofile%\plocha\mbr" -t

ok

vytvoří se log s názvem mbr.log, vložte ho zde

[/quote]

po spusteni mbr.exe sa mi log vytvoril, ale ten text "%userprofile%\plocha\mbr" -t sa nedal skopirovat - nevyhodilo sa mi ziadne okno do kt. by sa to dalo skopirovat, cez START/RUN/ctrl+v tiez nic
z mbr len toto:
Stealth MBR rootkit/Mebroot/Sinowal/TDL4 detector 0.4.2 by Gmer, http://www.gmer.net
Windows 5.1.2600 Disk: ST380815AS rev.3.AAD -> Harddisk1\DR1 -> \Device\Ide\IdeDeviceP3T0L0-10

device: opened successfully
user: MBR read successfully
kernel: MBR read successfully
user & kernel MBR OK

priebezne dakujeeeeem

Smažte z plochy mbr.txt.
Dáte start-spustit
zadáte ten příkaz - ok
A na ploše se vytvoří nový soubor MBR.txt, jeho obsah sem vložíte.


Jinak logy jsou v pořádku. Zkoušel jste přeinstalovat drivery od zvukovky?

hmm, neviem, hodil som to tam cele a nic

no skusim tie drivere... ale co ten conficker? preco tam vyskakuje?

To je hláška když zkoušíte ten příkaz?
Musíte mít Mbr.exe na ploše.
Zkuste zadat tento příkaz

"%userprofile%\desktop\mbr" -t

Jaká hláška o confickerovi

uz

Stealth MBR rootkit/Mebroot/Sinowal/TDL4 detector 0.4.2 by Gmer, http://www.gmer.net
Windows 5.1.2600 Disk: ST380815AS rev.3.AAD -> Harddisk1\DR1 -> \Device\Ide\IdeDeviceP3T0L0-10

device: opened successfully
user: MBR read successfully

Disk trace:
called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll atapi.sys pciide.sys
1 ntkrnlpa!IofCallDriver[0x804EEEB8] -> \Device\Harddisk1\DR1[0x8B32DAB8]
3 CLASSPNP[0xBA8E905B] -> ntkrnlpa!IofCallDriver[0x804EEEB8] -> \Device\0000006d[0x8B3EE9E8]
5 ACPI[0xBA77F620] -> ntkrnlpa!IofCallDriver[0x804EEEB8] -> \Device\Ide\IdeDeviceP3T0L0-10[0x8B3EBD98]
kernel: MBR read successfully
user & kernel MBR OK


...myslim tu hlasku na zaciatku tejto strany - infiltracia z NODu - ci to uz je fuč?

Poprosím o nový log ze Rsitu, té mršce se z Vašeho pc nechce . Firewall máte dobře nastavený?

no nainstaloval som Zone alarm firewall a nenastavoval som tam nic

log:

Logfile of random's system information tool 1.08 (written by random/random)
Run by maros at 2010-11-14 10:35:13
Microsoft Windows XP Professional Service Pack 2
System drive D: has 4 GB (16%) free of 22 GB
Total RAM: 3294 MB (72% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 10:35:30, on 14. 11. 2010
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\system32\ZoneLabs\vsmon.exe
D:\WINDOWS\Explorer.EXE
D:\WINDOWS\system32\spoolsv.exe
D:\Program Files\Google\Update\1.2.183.39\GoogleCrashHandler.exe
D:\PROGRA~1\ESRI\License\arcgis9x\lmgrd.exe
D:\Program Files\Bonjour\mDNSResponder.exe
D:\PROGRA~1\ESRI\License\arcgis9x\ARCGIS.exe
D:\Program Files\Java\jre6\bin\jqs.exe
D:\Program Files\Eset\nod32krn.exe
D:\WINDOWS\system32\nvsvc32.exe
D:\WINDOWS\system32\svchost.exe
D:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe
D:\Program Files\Analog Devices\Core\smax4pnp.exe
D:\WINDOWS\PixArt\PAC207\Monitor.exe
D:\Program Files\Eset\nod32kui.exe
D:\Program Files\Common Files\Real\Update_OB\realsched.exe
D:\ADVANC~1\wh_exec.exe
D:\Program Files\Common Files\Java\Java Update\jusched.exe
D:\WINDOWS\system32\RUNDLL32.EXE
D:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
D:\Program Files\Calibrize\CalibrizeResume.exe
D:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
D:\Program Files\Mozilla Firefox\firefox.exe
D:\Program Files\Winamp\winamp.exe
D:\Program Files\Mozilla Firefox\plugin-container.exe
D:\Program Files\Adobe\Adobe Photoshop CS3\Photoshop.exe
D:\Program Files\Lavalys\EVEREST Ultimate Edition\everest.exe
D:\Documents and Settings\maros\Desktop\RSIT(2).exe
D:\Program Files\trend micro\maros.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://google.sk/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - D:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - D:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: Google Gears Helper - {E0FEFE40-FBF9-42AE-BA58-794CA7E3FB53} - D:\Program Files\Google\Google Gears\Internet Explorer\0.5.36.0\gears.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - D:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - D:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAShCut.exe
O4 - HKLM\..\Run: [Acrobat Assistant 8.0] "D:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe"
O4 - HKLM\..\Run: [SoundMAXPnP] D:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [NeroFilterCheck] D:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [Monitor] D:\WINDOWS\PixArt\PAC207\Monitor.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE D:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [FineReader7NewsReaderPro] "D:\Program Files\ABBYY FineReader 7.0 Professional Edition\AbbyyNewsReader.exe"
O4 - HKLM\..\Run: [nod32kui] "D:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [TkBellExe] "D:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [WheelMouse] D:\ADVANC~1\wh_exec.exe
O4 - HKLM\..\Run: [Adobe ARM] "D:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "D:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "D:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE D:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [ZoneAlarm Client] "D:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKCU\..\Run: [CGFLoader] D:\Program Files\Calibrize\CalibrizeLoader.exe
O4 - HKCU\..\Run: [CalibrizeResume] D:\Program Files\Calibrize\CalibrizeResume.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - S-1-5-18 Startup: setup_9.0.0.722_13.11.2010_18-13.lnk = D:\Program Files\Virus Removal Tool\setup_9.0.0.722_13.11.2010_18-13\startup.exe (User 'SYSTEM')
O4 - .DEFAULT Startup: setup_9.0.0.722_13.11.2010_18-13.lnk = D:\Program Files\Virus Removal Tool\setup_9.0.0.722_13.11.2010_18-13\startup.exe (User 'Default user')
O4 - Startup: setup_9.0.0.722_13.11.2010_18-13.lnk = D:\Program Files\Virus Removal Tool\setup_9.0.0.722_13.11.2010_18-13\startup.exe
O8 - Extra context menu item: Append to existing PDF - res://D:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert link target to Adobe PDF - res://D:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://D:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://D:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://D:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://D:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://D:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://D:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: E&xportovať do programu Microsoft Excel - res://D:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {09C04DA7-5B76-4EBC-BBEE-B25EAC5965F5} - D:\Program Files\Google\Google Gears\Internet Explorer\0.5.36.0\gears.dll
O9 - Extra 'Tools' menuitem: &Gears Settings - {09C04DA7-5B76-4EBC-BBEE-B25EAC5965F5} - D:\Program Files\Google\Google Gears\Internet Explorer\0.5.36.0\gears.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - D:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - D:\WINDOWS\bdoscandel.exe
O9 - Extra button: Zdroje informácií - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/activescan ... stubie.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resourc ... oscan8.cab
O16 - DPF: {74DBCB52-F298-4110-951D-AD2FF67BC8AB} (NVIDIA Smart Scan) - http://www.nvidia.com/content/DriverDow ... rtScan.cab
O16 - DPF: {BDBDE413-7B1C-4C68-A8FF-C5B2B4090876} (F-Secure Online Scanner 3.3) - http://support.f-secure.com/ols/fscax.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - D:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - D:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - D:\WINDOWS\system32\browseui.dll
O23 - Service: ArcGIS License Manager - Unknown owner - D:\PROGRA~1\ESRI\License\arcgis9x\lmgrd.exe
O23 - Service: ATK Keyboard Service (ATKKeyboardService) - ASUSTeK COMPUTER INC. - D:\WINDOWS\ATKKBService.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - D:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - D:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Update Service (gupdate1c98246f88f9210) (gupdate1c98246f88f9210) - Google Inc. - D:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - D:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - D:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: NBService - Nero AG - D:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - D:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - D:\Program Files\Eset\nod32krn.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - D:\WINDOWS\system32\nvsvc32.exe
O23 - Service: ServiceLayer - Nokia. - D:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Check Point Software Technologies LTD - D:\WINDOWS\system32\ZoneLabs\vsmon.exe

--
End of file - 10091 bytes

======Scheduled tasks folder======

D:\WINDOWS\tasks\AppleSoftwareUpdate.job
D:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
D:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
Adobe PDF Reader Link Helper - D:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll [2010-09-23 61888]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE7CD045-E861-484f-8273-0445EE161910}]
Adobe PDF Conversion Toolbar Helper - D:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll [2010-09-23 320928]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - D:\Program Files\Java\jre6\bin\jp2ssv.dll [2010-09-15 41760]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E0FEFE40-FBF9-42AE-BA58-794CA7E3FB53}]
Google Gears Helper - D:\Program Files\Google\Google Gears\Internet Explorer\0.5.36.0\gears.dll [2010-02-23 2121728]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class - D:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2010-09-15 79648]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{47833539-D0C5-4125-9FA8-0819E2EAAC93} - Adobe PDF - D:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll [2010-09-23 320928]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"High Definition Audio Property Page Shortcut"=D:\WINDOWS\system32\HDAShCut.exe [2005-01-07 61952]
"Acrobat Assistant 8.0"=D:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe [2010-09-23 624056]
"SoundMAXPnP"=D:\Program Files\Analog Devices\Core\smax4pnp.exe [2005-05-20 925696]
"NeroFilterCheck"=D:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe [2007-03-01 153136]
"Monitor"=D:\WINDOWS\PixArt\PAC207\Monitor.exe [2006-11-03 319488]
"NvCplDaemon"=D:\WINDOWS\system32\NvCpl.dll [2006-10-22 7700480]
"nwiz"=nwiz.exe /install []
"FineReader7NewsReaderPro"=D:\Program Files\ABBYY FineReader 7.0 Professional Edition\AbbyyNewsReader.exe [2003-12-10 278528]
"nod32kui"=D:\Program Files\Eset\nod32kui.exe [2008-12-16 949376]
"TkBellExe"=D:\Program Files\Common Files\Real\Update_OB\realsched.exe [2008-12-19 185872]
"WheelMouse"=D:\ADVANC~1\wh_exec.exe [2007-03-11 86016]
"Adobe ARM"=D:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2010-09-21 932288]
"Adobe Reader Speed Launcher"=D:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe [2010-09-24 40368]
"SunJavaUpdateSched"=D:\Program Files\Common Files\Java\Java Update\jusched.exe [2010-05-14 248552]
"NvMediaCenter"=D:\WINDOWS\system32\NvMcTray.dll [2006-10-22 86016]
"ZoneAlarm Client"=D:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe [2010-09-02 1043968]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"CGFLoader"=D:\Program Files\Calibrize\CalibrizeLoader.exe [2007-11-26 1961984]
"CalibrizeResume"=D:\Program Files\Calibrize\CalibrizeResume.exe [2007-11-26 413696]

D:\Documents and Settings\maros\Start Menu\Programs\Startup
setup_9.0.0.722_13.11.2010_18-13.lnk - D:\Program Files\Virus Removal Tool\setup_9.0.0.722_13.11.2010_18-13\startup.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - D:\WINDOWS\system32\WPDShServiceObj.dll [2009-01-30 133632]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\PEVSystemStart]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\procexp90.Sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\PEVSystemStart]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\procexp90.Sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\vsmon]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{1a3e09be-1e45-494b-9174-d7385b45bbf5}]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=475
"NoDriveAutoRun"=67108863

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDrives"=0
"NoDriveTypeAutoRun"=475
"NoDriveAutoRun"=67108863

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"D:\Program Files\Bonjour\mDNSResponder.exe"="D:\Program Files\Bonjour\mDNSResponder.exe:*:Enabled:Bonjour"
"D:\Program Files\uTorrent\uTorrent.exe"="D:\Program Files\uTorrent\uTorrent.exe:*:Enabled:µTorrent"
"D:\WINDOWS\system32\dplaysvr.exe"="D:\WINDOWS\system32\dplaysvr.exe:*:Enabled:Microsoft DirectPlay Helper"
"M:\games\age\age2_x1.exe"="M:\games\age\age2_x1.exe:*:Enabled:Age of Empires II Expansion"
"D:\Program Files\totalcmd\TOTALCMD.EXE"="D:\Program Files\totalcmd\TOTALCMD.EXE:*:Enabled:Total Commander 32 bit international version, file manager replacement for Windows"
"D:\Program Files\Opera\opera.exe"="D:\Program Files\Opera\opera.exe:*:Enabled:Opera Internet Browser"
"D:\Program Files\Skype\Phone\Skype.exe"="D:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype. Take a deep breath "
"D:\WINDOWS\system32\ZoneLabs\vsmon.exe"="D:\WINDOWS\system32\ZoneLabs\vsmon.exe:*:Enabled:vsmon"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

======List of files/folders created in the last 1 months======

2010-11-13 17:35:29 ----A---- D:\WINDOWS\system32\drivers\44126332.sys
2010-11-13 17:35:29 ----A---- D:\WINDOWS\system32\drivers\44126331.sys
2010-11-13 17:35:29 ----A---- D:\WINDOWS\system32\drivers\4412633.sys
2010-11-13 17:35:27 ----D---- D:\Program Files\Virus Removal Tool
2010-11-13 17:11:31 ----D---- D:\rsit
2010-11-13 16:38:03 ----D---- D:\Documents and Settings\maros\Application Data\CheckPoint
2010-11-13 16:37:22 ----D---- D:\Program Files\Conduit
2010-11-13 16:37:01 ----D---- D:\Program Files\CheckPoint
2010-11-13 16:36:55 ----A---- D:\WINDOWS\system32\vsregexp.dll
2010-11-13 16:36:52 ----A---- D:\WINDOWS\system32\zlcommdb.dll
2010-11-13 16:36:52 ----A---- D:\WINDOWS\system32\zlcomm.dll
2010-11-13 16:36:48 ----A---- D:\WINDOWS\system32\zpeng25.dll
2010-11-13 16:36:48 ----A---- D:\WINDOWS\system32\vswmi.dll
2010-11-13 16:36:47 ----A---- D:\WINDOWS\system32\vsxml.dll
2010-11-13 16:36:46 ----D---- D:\WINDOWS\system32\ZoneLabs
2010-11-13 16:36:46 ----A---- D:\WINDOWS\system32\vspubapi.dll
2010-11-13 16:36:46 ----A---- D:\WINDOWS\system32\vsmonapi.dll
2010-11-13 16:36:45 ----A---- D:\WINDOWS\system32\vsdatant.sys
2010-11-13 16:35:57 ----A---- D:\WINDOWS\system32\vsutil.dll
2010-11-13 16:35:57 ----A---- D:\WINDOWS\system32\vsinit.dll
2010-11-13 16:35:57 ----A---- D:\WINDOWS\system32\vsdata.dll
2010-11-13 16:33:46 ----HDC---- D:\WINDOWS\$NtUninstallKB943232$
2010-11-13 16:33:38 ----D---- D:\Program Files\Zone Labs
2010-11-13 16:33:20 ----D---- D:\WINDOWS\Internet Logs
2010-11-13 14:03:14 ----D---- D:\Program Files\trend micro
2010-11-13 13:01:18 ----HDC---- D:\WINDOWS\$NtUninstallKB894391$
2010-11-13 12:52:05 ----ASH---- D:\hiberfil.sys
2010-11-13 12:40:21 ----D---- D:\WINDOWS\pss
2010-11-13 08:55:16 ----ASH---- D:\pagefile.sys
2010-11-12 17:18:10 ----HDC---- D:\WINDOWS\$NtUninstallKB923414$
2010-11-12 17:17:12 ----HDC---- D:\WINDOWS\$NtUninstallKB885250$
2010-11-12 16:29:11 ----D---- D:\Documents and Settings\All Users\Application Data\Panda Security
2010-11-12 16:29:07 ----D---- D:\Program Files\Panda USB Vaccine
2010-11-06 16:32:19 ----A---- D:\del.txt
2010-11-06 16:23:53 ----SHD---- D:\RECYCLER
2010-11-06 16:18:18 ----A---- D:\WINDOWS\system32\tmp.txt
2010-11-06 15:48:34 ----A---- D:\WINDOWS\NIRCMD.exe.mwt
2010-11-06 14:57:28 ----SHD---- D:\Config.Msi
2010-10-31 01:20:08 ----D---- D:\Documents and Settings\maros\Application Data\RSSRadio.local
2010-10-31 01:20:08 ----D---- D:\Documents and Settings\maros\Application Data\RSSRadio
2010-10-31 01:19:47 ----D---- D:\Program Files\Dorada Software
2010-10-31 01:08:28 ----D---- D:\Program Files\Winamp Detect
2010-10-25 13:25:23 ----A---- D:\WINDOWS\system32\javaws.exe
2010-10-25 13:25:23 ----A---- D:\WINDOWS\system32\javaw.exe
2010-10-25 13:25:23 ----A---- D:\WINDOWS\system32\java.exe
2010-10-17 11:54:53 ----D---- D:\Documents and Settings\All Users\Application Data\McAfee
2010-10-16 18:28:20 ----HDC---- D:\WINDOWS\$NtUninstallKB926239$
2010-10-16 18:28:15 ----N---- D:\WINDOWS\system32\spmsg.dll
2010-10-16 18:28:05 ----HDC---- D:\WINDOWS\$NtUninstallMSCompPackV1$
2010-10-16 18:27:55 ----A---- D:\WINDOWS\system32\wmpns.dll
2010-10-16 18:27:49 ----D---- D:\Program Files\Windows Media Connect 2
2010-10-16 18:27:39 ----HDC---- D:\WINDOWS\$NtUninstallwmp11$
2010-10-16 18:27:00 ----HDC---- D:\WINDOWS\$NtUninstallWMFDist11$
2010-10-16 18:26:36 ----D---- D:\WINDOWS\system32\LogFiles
2010-10-16 18:26:36 ----D---- D:\WINDOWS\system32\drivers\UMDF
2010-10-16 18:26:26 ----HDC---- D:\WINDOWS\$NtUninstallWudf01000$
2010-10-16 18:25:27 ----D---- D:\Documents and Settings\All Users\Application Data\Windows Genuine Advantage
2010-10-16 16:38:24 ----D---- D:\Documents and Settings\maros\Application Data\vlc

======List of files/folders modified in the last 1 months======

2010-11-14 10:35:24 ----D---- D:\WINDOWS\temp
2010-11-14 10:33:51 ----D---- D:\WINDOWS\Prefetch
2010-11-14 09:33:04 ----D---- D:\WINDOWS
2010-11-14 09:32:24 ----D---- D:\WINDOWS\system32\CatRoot2
2010-11-14 09:30:35 ----A---- D:\WINDOWS\SchedLgU.Txt
2010-11-14 09:11:20 ----D---- D:\Program Files\Mozilla Firefox
2010-11-14 00:11:03 ----D---- D:\Program Files
2010-11-14 00:11:02 ----D---- D:\WINDOWS\system32\drivers
2010-11-14 00:08:02 ----D---- D:\WINDOWS\Minidump
2010-11-13 23:41:52 ----A---- D:\WINDOWS\wincmd.ini
2010-11-13 22:46:54 ----HD---- D:\WINDOWS\inf
2010-11-13 20:32:31 ----D---- D:\WINDOWS\system32
2010-11-13 17:37:28 ----SHD---- D:\System Volume Information
2010-11-13 17:27:53 ----D---- D:\WINDOWS\system32\Restore
2010-11-13 17:02:52 ----D---- D:\Program Files\Common Files
2010-11-13 16:33:47 ----RSHDC---- D:\WINDOWS\system32\dllcache
2010-11-13 13:01:08 ----HD---- D:\WINDOWS\$hf_mig$
2010-11-13 12:54:05 ----A---- D:\WINDOWS\win.ini
2010-11-13 12:54:05 ----A---- D:\WINDOWS\system.ini
2010-11-13 00:00:43 ----D---- D:\WINDOWS\Debug
2010-11-12 16:20:39 ----D---- D:\WINDOWS\system32\CatRoot
2010-11-12 13:18:08 ----A---- D:\WINDOWS\NeroDigital.ini
2010-11-08 23:54:24 ----D---- D:\Documents and Settings\maros\Application Data\Skype
2010-11-08 23:31:30 ----D---- D:\Documents and Settings\maros\Application Data\skypePM
2010-11-08 14:29:36 ----D---- D:\Documents and Settings\maros\Application Data\Adobe
2010-11-06 16:00:04 ----D---- D:\WINDOWS\AppPatch
2010-11-06 14:58:47 ----SHD---- D:\WINDOWS\Installer
2010-11-02 16:47:16 ----A---- D:\WINDOWS\system32\MRT.exe
2010-11-01 17:57:59 ----D---- D:\WINDOWS\system32\0ico0
2010-10-31 10:38:53 ----AC---- D:\WINDOWS\system32\PerfStringBackup.INI
2010-10-31 01:57:30 ----SD---- D:\Documents and Settings\maros\Application Data\Microsoft
2010-10-31 01:22:53 ----D---- D:\Documents and Settings\maros\Application Data\Winamp
2010-10-31 01:08:48 ----D---- D:\Program Files\Winamp
2010-10-26 09:52:22 ----D---- D:\Program Files\Mozilla Sunbird
2010-10-25 13:25:21 ----D---- D:\Program Files\Java
2010-10-16 18:27:49 ----D---- D:\Program Files\Windows Media Player
2010-10-16 18:27:45 ----D---- D:\WINDOWS\Help
2010-10-16 09:52:56 ----D---- D:\Documents and Settings\maros\Application Data\uTorrent

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 44126332;44126332 Boot Guard Driver; D:\WINDOWS\system32\DRIVERS\44126332.sys [2009-10-22 37392]
R0 PxHelp20;PxHelp20; D:\WINDOWS\System32\Drivers\PxHelp20.sys [2008-07-31 43872]
R1 44126331;44126331; D:\WINDOWS\system32\DRIVERS\44126331.sys [2009-09-25 128016]
R1 AmdK8;AMD Processor Driver; D:\WINDOWS\system32\DRIVERS\AmdK8.sys [2005-03-09 36352]
R1 cdrbsdrv;cdrbsdrv; D:\WINDOWS\system32\drivers\cdrbsdrv.sys [2005-05-10 32256]
R1 EIO;EIO; \??\D:\WINDOWS\system32\drivers\EIO.sys []
R1 kbdhid;Keyboard HID Driver; D:\WINDOWS\system32\DRIVERS\kbdhid.sys [2004-08-04 14848]
R1 nod32drv;nod32drv; D:\WINDOWS\system32\drivers\nod32drv.sys [2008-12-16 15424]
R1 setup_9.0.0.722_13.11.2010_18-13drv;setup_9.0.0.722_13.11.2010_18-13drv; D:\WINDOWS\system32\DRIVERS\4412633.sys [2009-10-09 315408]
R1 StarOpen;StarOpen; D:\WINDOWS\system32\drivers\StarOpen.sys [2006-07-24 5632]
R1 vsdatant;vsdatant; D:\WINDOWS\System32\vsdatant.sys [2010-05-13 532224]
R1 WS2IFSL;Windows Socket 2.0 Non-IFS Service Provider Support Environment; D:\WINDOWS\System32\drivers\ws2ifsl.sys [2004-08-04 12032]
R2 AMON;AMON; D:\WINDOWS\system32\drivers\amon.sys [2008-12-16 512096]
R2 Sentinel;Sentinel; D:\WINDOWS\System32\Drivers\SENTINEL.SYS [2004-05-14 76288]
R3 ADIHdAudAddService;ADI UAA Function Driver for High Definition Audio Service; D:\WINDOWS\system32\drivers\ADIHdAud.sys [2005-10-05 141312]
R3 AEAudioService;AEAudio Service; D:\WINDOWS\system32\drivers\AEAudio.sys [2005-03-04 127872]
R3 Afc;PPdus ASPI Shell; D:\WINDOWS\system32\drivers\Afc.sys [2005-02-23 11776]
R3 asusgsb;ASUS Virtual Video Capture Device Driver; D:\WINDOWS\system32\drivers\asusgsb.sys [2007-07-12 12416]
R3 EverestDriver;Lavalys EVEREST Kernel Driver; \??\D:\Program Files\Lavalys\EVEREST Ultimate Edition\kerneld.wnt []
R3 HDAudBus;Microsoft UAA Bus Driver for High Definition Audio; D:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2005-01-07 138752]
R3 hidusb;Microsoft HID Class Driver; D:\WINDOWS\system32\DRIVERS\hidusb.sys [2004-08-04 9600]
R3 mouhid;Mouse HID Driver; D:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-08-17 12160]
R3 MTsensor;ATK0110 ACPI UTILITY; D:\WINDOWS\system32\DRIVERS\ASACPI.sys [2004-08-13 5810]
R3 MxlW2k;MxlW2k; D:\WINDOWS\system32\drivers\MxlW2k.sys [2008-07-24 28352]
R3 nv;nv; D:\WINDOWS\system32\DRIVERS\nv4_mini.sys [2006-10-22 3994624]
R3 NVENETFD;NVIDIA nForce Networking Controller Driver; D:\WINDOWS\system32\DRIVERS\NVENETFD.sys [2006-07-11 35072]
R3 nvnetbus;NVIDIA Network Bus Enumerator; D:\WINDOWS\system32\DRIVERS\nvnetbus.sys [2006-07-11 13184]
R3 pfc;Padus ASPI Shell; D:\WINDOWS\system32\drivers\pfc.sys [2008-04-13 9856]
R3 rtl8139;Realtek RTL8139(A/B/C)-based PCI Fast Ethernet Adapter NT Driver; D:\WINDOWS\system32\DRIVERS\RTL8139.SYS [2004-08-03 20992]
R3 SenFiltService;SenFilt Service; D:\WINDOWS\system32\drivers\Senfilt.sys [2005-08-11 393088]
R3 usbccgp;Microsoft USB Generic Parent Driver; D:\WINDOWS\system32\DRIVERS\usbccgp.sys [2004-08-04 31616]
R3 whfltr2k;WheelMouse USB Lower Filter Driver; D:\WINDOWS\system32\DRIVERS\whfltr2k.sys [2007-01-25 6784]
S3 CCDECODE;Closed Caption Decoder; D:\WINDOWS\system32\DRIVERS\CCDECODE.sys [2004-08-03 17024]
S3 DrvAgent32;DrvAgent32; \??\D:\WINDOWS\system32\Drivers\DrvAgent32.sys []
S3 HdAudAddService;ATI Function Driver for High Definition Audio Service; D:\WINDOWS\system32\drivers\AtiHdAud.sys [2006-12-28 84992]
S3 k750bus;Sony Ericsson 750 driver (WDM); D:\WINDOWS\system32\DRIVERS\k750bus.sys [2005-02-11 55216]
S3 k750mdfl;Sony Ericsson 750 USB WMC Modem Filter; D:\WINDOWS\system32\DRIVERS\k750mdfl.sys [2005-02-11 6576]
S3 k750mdm;Sony Ericsson 750 USB WMC Modem Drivers; D:\WINDOWS\system32\DRIVERS\k750mdm.sys [2005-02-11 89872]
S3 k750mgmt;Sony Ericsson 750 USB WMC Device Management Drivers; D:\WINDOWS\system32\DRIVERS\k750mgmt.sys [2005-02-11 81728]
S3 k750obex;Sony Ericsson 750 USB WMC OBEX Interface Drivers; D:\WINDOWS\system32\DRIVERS\k750obex.sys [2005-02-11 79488]
S3 mbr;mbr; \??\D:\DOCUME~1\maros\LOCALS~1\Temp\mbr.sys []
S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink Converter; D:\WINDOWS\system32\drivers\MSTEE.sys [2004-08-03 5504]
S3 NABTSFEC;NABTS/FEC VBI Codec; D:\WINDOWS\system32\DRIVERS\NABTSFEC.sys [2004-08-03 85376]
S3 NdisIP;Microsoft TV/Video Connection; D:\WINDOWS\system32\DRIVERS\NdisIP.sys [2004-08-03 10880]
S3 PAC207;Trust WB-1400T Webcam; D:\WINDOWS\system32\DRIVERS\PFC027.SYS [2007-05-14 508288]
S3 SBRE;SBRE; \??\D:\WINDOWS\system32\drivers\SBREdrv.sys []
S3 SLIP;BDA Slip De-Framer; D:\WINDOWS\system32\DRIVERS\SLIP.sys [2004-08-03 11136]
S3 ssm_bus;SAMSUNG Mobile USB Device II 1.0 driver (WDM); D:\WINDOWS\system32\DRIVERS\ssm_bus.sys [2007-05-02 83592]
S3 ssm_mdfl;SAMSUNG Mobile USB Modem II 1.0 Filter; D:\WINDOWS\system32\DRIVERS\ssm_mdfl.sys [2007-05-02 15112]
S3 ssm_mdm;SAMSUNG Mobile USB Port II 1.0 Drivers; D:\WINDOWS\system32\DRIVERS\ssm_mdm.sys [2007-05-02 109704]
S3 streamip;BDA IPSink; D:\WINDOWS\system32\DRIVERS\StreamIP.sys [2004-08-03 15360]
S3 usbaudio;USB Audio Driver (WDM); D:\WINDOWS\system32\drivers\usbaudio.sys [2004-08-03 59264]
S3 usbprint;Microsoft USB PRINTER Class; D:\WINDOWS\system32\DRIVERS\usbprint.sys [2004-08-03 25856]
S3 usbscan;USB Scanner Driver; D:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 15104]
S3 USBSTOR;USB Mass Storage Driver; D:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 26496]
S3 Video3D;ASUS Video3D Service; D:\WINDOWS\System32\Drivers\Video3D32.sys []
S3 VNUSB;VN Series Device; D:\WINDOWS\system32\DRIVERS\VNUSB.sys []
S3 WinDriver6;WinDriver6; D:\WINDOWS\system32\drivers\windrvr6.sys []
S3 WpdUsb;WpdUsb; D:\WINDOWS\System32\Drivers\wpdusb.sys [2009-01-30 38528]
S3 WSTCODEC;World Standard Teletext Codec; D:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS [2004-08-03 19328]
S3 WudfPf;Windows Driver Foundation - User-mode Driver Framework Platform Driver; D:\WINDOWS\system32\DRIVERS\WudfPf.sys [2006-09-28 77568]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; D:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-28 82944]
S4 sptd;sptd; D:\WINDOWS\System32\Drivers\sptd.sys []

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 ArcGIS License Manager;ArcGIS License Manager; D:\PROGRA~1\ESRI\License\arcgis9x\lmgrd.exe [1999-12-01 467968]
R2 Bonjour Service;##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762##; D:\Program Files\Bonjour\mDNSResponder.exe [2006-02-28 229376]
R2 JavaQuickStarterService;Java Quick Starter; D:\Program Files\Java\jre6\bin\jqs.exe [2010-09-15 153376]
R2 NOD32krn;NOD32 Kernel Service; D:\Program Files\Eset\nod32krn.exe [2008-12-16 552064]
R2 NVSvc;NVIDIA Display Driver Service; D:\WINDOWS\system32\nvsvc32.exe [2006-10-22 159810]
R2 vsmon;TrueVector Internet Monitor; D:\WINDOWS\system32\ZoneLabs\vsmon.exe [2010-09-02 2435592]
R3 FLEXnet Licensing Service;FLEXnet Licensing Service; D:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe [2008-04-11 654848]
S2 ATKKeyboardService;ATK Keyboard Service; D:\WINDOWS\ATKKBService.exe [2006-09-22 241664]
S2 gupdate1c98246f88f9210;Google Update Service (gupdate1c98246f88f9210); D:\Program Files\Google\Update\GoogleUpdate.exe [2009-01-29 133104]
S3 aspnet_state;ASP.NET State Service; D:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2005-09-23 29896]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; D:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2005-09-23 66240]
S3 IDriverT;InstallDriver Table Manager; D:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [2005-04-03 69632]
S3 NBService;NBService; D:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe [2007-06-29 800040]
S3 NMIndexingService;NMIndexingService; D:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe [2007-06-27 279848]
S3 odserv;Microsoft Office Diagnostics Service; D:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2006-10-26 441136]
S3 ose;Office Source Engine; D:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 ServiceLayer;ServiceLayer; D:\Program Files\PC Connectivity Solution\ServiceLayer.exe [2007-03-26 292864]
S3 WMPNetworkSvc;Služba Windows Media Player Network Sharing; D:\Program Files\Windows Media Player\WMPNetwk.exe [2009-02-04 913920]
S3 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; D:\WINDOWS\system32\svchost.exe [2004-08-04 14336]

-----------------EOF-----------------

V Zone alarmu hlídejte, co povolujete .
Já confickera nevidím, asi NOD jen blokoval utok. Máte do stejné sítě zapojený ještě jiný počítač?

zatial sa ma Zone alarm pytal iba na RSIT...
mam zapojeny pocitac na internatnej sieti, podotykam velmi cudnej sieti, problemy sa objavili vtedy ked som sa sem pripojil, napr. ked som cez sviatky ostal na internate, bolo na sieti mozno 5 pocitacov (normalne tak 400-500), tak sa ziadne problemy neobjavovali
(taky detail kt. som zabudol spomenut, pardon )

Tak mají na síti confickera .
Udělejte ještě jednou ten AVptool, pak dočistíme zbytky po combofixu a uvidíme. Hlavně se nepřipojujte bez antiviru a firewallu, měl by jste ho hned zpět.

dam vediet spravcovi siete? . . .ale inac, preco atakuje len mna? nikto okolo s tym nema problem...
hodim ten AVPtool, to je na par hodin . . . ale ten driver (Analog Devices AD1986A @ nVIDIA nForce 430 (MCP51) - High Definition Audio Controller PCI?) neviem najst (nemam pri sebe instalacne CDcka), neviete nahodou o nejakej stranke kde by sa to dalo stiahnut (zadarmo)?

http://downloadnew.org/software/analog- ... h-definit/
A jaký mají ostatní antivir? Je možné, že ho mají, aniž by to zpozorovali.

link funguje, len sa z neho neda stahovat, nevadi, to nejako poriesim

nerobil som nejaky globalny prieskum ale napr. vedla maju Avast, niektori maju Norton a pod. ale vacsinou sa nikomu nic neukazuje, prip. sa im to ukazalo 1x a odvtedy nic...