cavte.
mam tiez problem s olmarikom. snazil som sa to nieako odstranit ale uz som zufaly.
mozete mi s tym pomoct prosim Vas?
log z Combofix je tu
ComboFix 10-03-14.04 - martin 15.03.2010 8:55.2.1 - x86
Systém Microsoft Windows XP Professional 5.1.2600.2.1250.421.1033.18.1015.598 [GMT 1:00]
Running from: c:\documents and settings\martin\Desktop\ComboFix.exe
AV: ESET Smart Security 4.2 *On-access scanning disabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
FW: ESET personal firewall *disabled* {E5E70D32-0101-4340-86A3-A7B0F1C8FFE0}
.
((((((((((((((((((((((((( Files Created from 2010-02-15 to 2010-03-15 )))))))))))))))))))))))))))))))
.
2010-03-15 00:07 . 2010-03-15 00:07 -------- d-----w- c:\program files\ESET
2010-03-15 00:07 . 2010-03-15 00:07 -------- d-----w- c:\documents and settings\All Users\Application Data\ESET
2010-03-14 19:18 . 2010-03-14 21:03 -------- d-----w- c:\program files\Spyware Doctor
2010-03-14 16:28 . 2006-06-19 11:01 69632 ----a-w- c:\windows\system32\ztvcabinet.dll
2010-03-14 16:28 . 2006-05-25 13:52 162304 ----a-w- c:\windows\system32\ztvunrar36.dll
2010-03-14 16:28 . 2005-08-25 23:50 77312 ----a-w- c:\windows\system32\ztvunace26.dll
2010-03-14 16:28 . 2003-02-02 18:06 153088 ----a-w- c:\windows\system32\unrar3.dll
2010-03-14 16:28 . 2002-03-05 23:00 75264 ----a-w- c:\windows\system32\unacev2.dll
2010-03-14 16:10 . 2010-03-14 16:10 -------- d-s---w- c:\documents and settings\martin\UserData
2010-03-14 16:08 . 2010-03-14 16:08 -------- d-----w- c:\documents and settings\martin\Local Settings\Application Data\ESET
2010-03-14 16:08 . 2010-03-14 16:08 -------- d-----w- c:\documents and settings\martin\Application Data\ESET
2010-03-14 16:08 . 2010-03-14 16:08 -------- d-----w- c:\documents and settings\LocalService\Local Settings\Application Data\ESET
2010-03-13 09:46 . 2009-12-22 15:02 2729434 -c--a-w- c:\documents and settings\All Users\Application Data\{75E0B449-A5F7-4723-A8A0-97A4CCDB67A9}\Surfer(9.8.669)_Installer.exe
2010-03-13 09:46 . 2010-03-13 09:46 -------- dc-h--w- c:\documents and settings\All Users\Application Data\{75E0B449-A5F7-4723-A8A0-97A4CCDB67A9}
2010-03-13 09:44 . 2009-12-22 14:58 126976 -c--a-w- c:\documents and settings\All Users\Application Data\{75E0B449-A5F7-4723-A8A0-97A4CCDB67A9}\OFFLINE\52457949\6C5913D9\Scripter.exe
2010-03-13 09:44 . 2009-12-22 14:57 841216 -c--a-w- c:\documents and settings\All Users\Application Data\{75E0B449-A5F7-4723-A8A0-97A4CCDB67A9}\OFFLINE\D7FE144B\6C5913D9\InternetUpdate.exe
2010-03-13 09:44 . 2009-12-22 14:57 345600 -c--a-w- c:\documents and settings\All Users\Application Data\{75E0B449-A5F7-4723-A8A0-97A4CCDB67A9}\OFFLINE\DCF18A64\6C5913D9\GSCrash.exe
2010-03-13 09:27 . 2010-03-13 09:27 -------- d-----w- c:\documents and settings\martin\Application Data\Golden Software
2010-03-10 14:36 . 2010-03-10 14:36 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\Google
2010-03-10 14:31 . 2010-03-10 14:32 -------- d-----w- c:\documents and settings\martin\Local Settings\Application Data\Temp
2010-03-10 14:31 . 2010-03-10 14:31 -------- d-----w- c:\documents and settings\LocalService\Local Settings\Application Data\Google
2010-03-10 14:31 . 2010-03-13 07:30 -------- d-----w- c:\documents and settings\martin\Local Settings\Application Data\Google
2010-03-10 14:31 . 2010-03-10 14:33 -------- d-----w- c:\program files\Google
2010-03-03 18:48 . 2010-03-03 18:48 -------- d-----w- c:\documents and settings\martin\Application Data\QIP
2010-03-03 18:47 . 2010-03-03 18:47 -------- d-----w- c:\documents and settings\martin\Application Data\QipGuard
2010-03-03 18:47 . 2010-03-01 15:19 280440 ----a-w- c:\documents and settings\martin\Application Data\QipGuard\sqlite3.dll
2010-03-03 18:47 . 2010-03-01 15:19 20944 ----a-w- c:\documents and settings\martin\Application Data\QipGuard\chrome.dll
2010-03-03 18:47 . 2010-03-01 15:19 181712 ----a-w- c:\documents and settings\martin\Application Data\QipGuard\QipGuard.exe
2010-03-03 18:47 . 2010-03-01 15:19 127440 ----a-w- c:\documents and settings\martin\Application Data\Mozilla\Firefox\Profiles\m48halyg.default\extensions\{32a1fd71-835e-4b11-8e54-886fda0b4c89}\components\qippipe.dll
2010-03-03 18:47 . 2010-03-01 15:19 149968 ----a-w- c:\documents and settings\martin\Application Data\Microsoft\Internet Explorer\qipsearchbar.dll
2010-03-03 18:47 . 2010-03-03 18:47 -------- d-----w- c:\program files\QIP Infium
2010-03-01 22:19 . 2010-03-01 22:19 -------- d-----w- c:\documents and settings\martin\Local Settings\Application Data\Songbird2
2010-03-01 22:19 . 2010-03-01 22:19 -------- d-----w- c:\documents and settings\martin\Application Data\Songbird2
2010-03-01 22:19 . 2009-12-23 11:03 15664 ----a-w- c:\windows\system32\drivers\GEARAspiWDM.sys
2010-03-01 22:19 . 2009-12-23 11:03 109360 ----a-w- c:\windows\system32\GEARAspi.dll
2010-03-01 22:19 . 2010-03-14 18:57 -------- d-----w- c:\program files\Songbird
2010-03-01 22:16 . 2010-03-01 22:16 -------- d-----w- c:\documents and settings\martin\Local Settings\Application Data\DefaultDomain_Path_0nh3ysahfgk0wal0100x32ugq2by5jje
2010-02-28 08:37 . 2010-03-13 09:43 -------- d-----w- c:\program files\Golden Software
2010-02-26 05:41 . 2010-02-26 05:41 55232 ----a-w- c:\windows\system32\drivers\epfwtdi.sys
2010-02-26 05:41 . 2010-02-26 05:41 32584 ----a-w- c:\windows\system32\drivers\epfwndis.sys
2010-02-26 05:41 . 2010-02-26 05:41 134488 ----a-w- c:\windows\system32\drivers\epfw.sys
2010-02-26 05:41 . 2010-02-26 05:41 114984 ----a-w- c:\windows\system32\drivers\ehdrv.sys
2010-02-26 05:39 . 2010-02-26 05:39 139192 ----a-w- c:\windows\system32\drivers\eamon.sys
2010-02-23 21:08 . 2010-02-23 21:08 -------- d-----w- c:\program files\Veetle
2010-02-21 15:11 . 2004-04-12 11:37 174592 ----a-w- c:\windows\system32\lame_enc.dll
2010-02-21 14:32 . 2010-02-21 15:10 -------- d-----w- c:\program files\AMR Player
2010-02-21 14:25 . 2010-02-21 14:29 -------- d-----w- c:\program files\Mp3 File Editor
2010-02-21 14:19 . 2010-02-21 14:27 -------- d-----w- c:\program files\WAV to MP3 Encoder
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-03-15 07:46 . 2009-12-06 22:34 -------- d-----w- c:\documents and settings\martin\Application Data\uTorrent
2010-03-14 21:03 . 2010-01-10 23:02 -------- d---a-w- c:\documents and settings\All Users\Application Data\Temp
2010-03-14 18:36 . 2009-12-06 22:35 -------- d-----w- c:\program files\uTorrent
2010-03-14 13:45 . 2009-12-07 08:26 59 ----a-w- c:\windows\wpd99.drv
2010-03-14 13:45 . 2009-12-07 08:26 -------- d-----w- c:\documents and settings\All Users\Application Data\pdf995
2010-03-14 12:12 . 2009-12-05 16:52 -------- d-----w- c:\documents and settings\martin\Application Data\The Word
2010-03-14 10:04 . 2010-01-10 22:55 -------- d-----w- c:\documents and settings\martin\Application Data\vlc
2010-03-13 09:47 . 2009-12-05 13:26 25896 ----a-w- c:\documents and settings\martin\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-03-11 21:15 . 2009-12-05 16:50 -------- d-----w- c:\program files\wkokes_8_53
2010-03-11 21:07 . 2009-12-11 18:35 -------- d-----w- c:\documents and settings\martin\Application Data\gtk-2.0
2010-02-28 11:54 . 2010-01-10 22:55 -------- d-----w- c:\documents and settings\martin\Application Data\dvdcss
2010-02-21 14:28 . 2010-01-21 18:00 -------- d-----w- c:\program files\Solveig Multimedia
2010-02-12 09:01 . 2010-02-12 09:01 61440 ----a-w- c:\documents and settings\martin\Application Data\Sun\Java\Deployment\SystemCache\6.0\17\6d0ad391-6ff4cbed-n\decora-sse.dll
2010-02-12 09:01 . 2010-02-12 09:01 503808 ----a-w- c:\documents and settings\martin\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-6667c581-n\msvcp71.dll
2010-02-12 09:01 . 2010-02-12 09:01 499712 ----a-w- c:\documents and settings\martin\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-6667c581-n\jmc.dll
2010-02-12 09:01 . 2010-02-12 09:01 348160 ----a-w- c:\documents and settings\martin\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-6667c581-n\msvcr71.dll
2010-02-12 09:01 . 2010-02-12 09:01 12800 ----a-w- c:\documents and settings\martin\Application Data\Sun\Java\Deployment\SystemCache\6.0\17\6d0ad391-6ff4cbed-n\decora-d3d.dll
2010-02-11 16:48 . 2010-02-11 16:48 495616 ----a-w- c:\documents and settings\All Users\Application Data\YoYoGames\d3dx8.dll
2010-02-11 16:48 . 2010-02-11 16:48 -------- d-----w- c:\documents and settings\All Users\Application Data\YoYoGames
2010-02-11 16:48 . 2010-02-11 16:48 1598272 ----a-w- c:\documents and settings\All Users\Application Data\YoYoGames\yoyo61.exe
2010-02-11 16:44 . 2010-02-11 16:44 -------- d-----w- c:\program files\Common Files\Java
2010-02-11 16:42 . 2010-02-11 16:42 411368 ----a-w- c:\windows\system32\deploytk.dll
2010-02-11 16:42 . 2010-02-11 16:42 -------- d-----w- c:\program files\Java
2010-02-11 16:36 . 2010-02-11 16:36 171520 ----a-w- c:\windows\system32\cncs32.dll
2010-02-01 21:51 . 2010-02-01 21:51 -------- d-----w- c:\program files\Alarm Clock
2010-01-21 18:44 . 2010-01-21 18:44 -------- d-----w- c:\program files\Common Files\DeskShare Shared
2010-01-21 18:44 . 2010-01-21 18:44 -------- d-----w- c:\program files\Deskshare
2010-01-21 18:43 . 2009-12-05 12:24 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-01-21 17:42 . 2010-01-21 17:42 -------- d-----w- c:\documents and settings\All Users\Application Data\Pinnacle
2010-01-21 17:04 . 2010-01-21 16:46 -------- d-----w- c:\program files\Common Files\AVSMedia
2010-01-21 17:03 . 2010-01-21 16:55 -------- d-----w- c:\program files\Extra Video Effect Editor Free
2010-01-21 17:01 . 2010-01-10 23:02 53319 ----a-w- c:\documents and settings\All Users\Application Data\Temp\{A8516AC9-AAF1-47F9-9766-03E2D4CDBCF8}\PostBuild.exe
2010-01-21 16:47 . 2010-01-21 16:47 -------- d-----w- c:\documents and settings\martin\Application Data\AVSMedia
2010-01-21 16:47 . 2010-01-21 16:47 -------- d-----w- c:\documents and settings\All Users\Application Data\AVS4YOU
2010-01-21 16:46 . 2010-01-21 16:44 -------- d-----w- c:\documents and settings\martin\Application Data\GetRightToGo
2010-01-10 23:02 . 2010-01-10 23:03 505128 ----a-w- c:\windows\system32\msvcp71.dll
2010-01-10 23:02 . 2010-01-10 23:03 353576 ----a-w- c:\windows\system32\msvcr71.dll
2009-12-25 19:00 . 2009-12-25 19:00 95232 ----a-w- c:\documents and settings\All Users\Application Data\Installations\{9249D7E7-33E7-4CC8-BB0B-3DF3C3CB2568}\Installer\CommonCustomActions\pcswpcsi.exe
2009-12-25 19:00 . 2009-12-25 19:00 8192 ----a-w- c:\documents and settings\All Users\Application Data\Installations\{9249D7E7-33E7-4CC8-BB0B-3DF3C3CB2568}\Installer\CommonCustomActions\UninstCCD.exe
2009-12-25 19:00 . 2009-12-25 19:00 61440 ----a-w- c:\documents and settings\All Users\Application Data\Installations\{9249D7E7-33E7-4CC8-BB0B-3DF3C3CB2568}\Installer\CommonCustomActions\UninstPCSFEMsi.exe
2009-12-25 19:00 . 2009-12-25 19:00 10240 ----a-w- c:\documents and settings\All Users\Application Data\Installations\{9249D7E7-33E7-4CC8-BB0B-3DF3C3CB2568}\Installer\CommonCustomActions\UninstPCS.exe
2009-12-25 18:58 . 2009-12-25 19:00 33863976 ----a-w- c:\documents and settings\All Users\Application Data\Installations\{9249D7E7-33E7-4CC8-BB0B-3DF3C3CB2568}\Nokia_PC_Suite_7_1_40_1_slk_web.exe
2009-12-22 15:01 . 2010-03-13 09:45 4356608 -c--a-w- c:\documents and settings\All Users\Application Data\{75E0B449-A5F7-4723-A8A0-97A4CCDB67A9}\OFFLINE\29CB0F58\35859D85\Surfer.exe
2009-12-22 15:01 . 2010-03-13 09:45 126464 -c--a-w- c:\documents and settings\All Users\Application Data\{75E0B449-A5F7-4723-A8A0-97A4CCDB67A9}\OFFLINE\F848BBC1\35859D85\CoordLib.dll
2009-12-22 14:59 . 2010-03-13 09:45 44544 -c--a-w- c:\documents and settings\All Users\Application Data\{75E0B449-A5F7-4723-A8A0-97A4CCDB67A9}\OFFLINE\A94F2A19\6C5913D9\ioRaw.dll
2009-12-22 14:58 . 2010-03-13 09:45 15872 -c--a-w- c:\documents and settings\All Users\Application Data\{75E0B449-A5F7-4723-A8A0-97A4CCDB67A9}\OFFLINE\CD56626E\6C5913D9\ioZmap.dll
2009-12-22 14:58 . 2010-03-13 09:45 79872 -c--a-w- c:\documents and settings\All Users\Application Data\{75E0B449-A5F7-4723-A8A0-97A4CCDB67A9}\OFFLINE\32015E7A\6C5913D9\ioHdf.dll
2009-12-22 14:58 . 2010-03-13 09:45 16384 -c--a-w- c:\documents and settings\All Users\Application Data\{75E0B449-A5F7-4723-A8A0-97A4CCDB67A9}\OFFLINE\1ABFD8EF\6C5913D9\ioCps.dll
2009-12-22 14:58 . 2010-03-13 09:45 22016 -c--a-w- c:\documents and settings\All Users\Application Data\{75E0B449-A5F7-4723-A8A0-97A4CCDB67A9}\OFFLINE\71B4CA9F\6C5913D9\ioAsc.dll
2009-12-22 14:58 . 2010-03-13 09:45 40448 -c--a-w- c:\documents and settings\All Users\Application Data\{75E0B449-A5F7-4723-A8A0-97A4CCDB67A9}\OFFLINE\8D7B355A\6C5913D9\ioLib.dll
2009-12-22 14:58 . 2010-03-13 09:45 70144 -c--a-w- c:\documents and settings\All Users\Application Data\{75E0B449-A5F7-4723-A8A0-97A4CCDB67A9}\OFFLINE\76187FC2\6C5913D9\RendererGSIO.dll
2009-12-22 14:58 . 2010-03-13 09:45 63488 -c--a-w- c:\documents and settings\All Users\Application Data\{75E0B449-A5F7-4723-A8A0-97A4CCDB67A9}\OFFLINE\A823CA4E\6C5913D9\RendererGDI.dll
2009-12-22 14:58 . 2010-03-13 09:45 35840 -c--a-w- c:\documents and settings\All Users\Application Data\{75E0B449-A5F7-4723-A8A0-97A4CCDB67A9}\OFFLINE\FE7A93B\6C5913D9\RendererBitmap.dll
2009-12-22 14:58 . 2010-03-13 09:45 221696 -c--a-w- c:\documents and settings\All Users\Application Data\{75E0B449-A5F7-4723-A8A0-97A4CCDB67A9}\OFFLINE\14FBBA5\6C5913D9\GsDraw.dll
2009-12-22 14:58 . 2010-03-13 09:45 247808 -c--a-w- c:\documents and settings\All Users\Application Data\{75E0B449-A5F7-4723-A8A0-97A4CCDB67A9}\OFFLINE\775AA43F\6C5913D9\GSWks2.dll
2009-12-22 14:58 . 2010-03-13 09:45 249344 -c--a-w- c:\documents and settings\All Users\Application Data\{75E0B449-A5F7-4723-A8A0-97A4CCDB67A9}\OFFLINE\E215BCD4\6C5913D9\gsio.dll
2009-12-22 14:58 . 2010-03-13 09:45 29184 -c--a-w- c:\documents and settings\All Users\Application Data\{75E0B449-A5F7-4723-A8A0-97A4CCDB67A9}\OFFLINE\10F5070A\6C5913D9\GCSUI.dll
2009-12-22 14:58 . 2010-03-13 09:45 229376 -c--a-w- c:\documents and settings\All Users\Application Data\{75E0B449-A5F7-4723-A8A0-97A4CCDB67A9}\OFFLINE\9476E154\6C5913D9\GCSFileIO.dll
2009-12-22 14:57 . 2010-03-13 09:45 96256 -c--a-w- c:\documents and settings\All Users\Application Data\{75E0B449-A5F7-4723-A8A0-97A4CCDB67A9}\OFFLINE\42987655\6C5913D9\GCSLegacy.dll
2009-12-22 14:57 . 2010-03-13 09:45 869376 -c--a-w- c:\documents and settings\All Users\Application Data\{75E0B449-A5F7-4723-A8A0-97A4CCDB67A9}\OFFLINE\18DC62C3\6C5913D9\GCSCore.dll
2009-12-22 14:57 . 2010-03-13 09:45 70656 -c--a-w- c:\documents and settings\All Users\Application Data\{75E0B449-A5F7-4723-A8A0-97A4CCDB67A9}\OFFLINE\9FCD2F0C\6C5913D9\BitXform2.dll
2009-12-22 14:57 . 2010-03-13 09:45 184320 -c--a-w- c:\documents and settings\All Users\Application Data\{75E0B449-A5F7-4723-A8A0-97A4CCDB67A9}\OFFLINE\45FB74BF\6C5913D9\GBMLib2.dll
2009-12-22 14:56 . 2010-03-13 09:45 23552 -c--a-w- c:\documents and settings\All Users\Application Data\{75E0B449-A5F7-4723-A8A0-97A4CCDB67A9}\OFFLINE\CC65D28F\6C5913D9\GCodec.dll
2009-12-22 14:56 . 2010-03-13 09:45 856576 -c--a-w- c:\documents and settings\All Users\Application Data\{75E0B449-A5F7-4723-A8A0-97A4CCDB67A9}\OFFLINE\9355F110\6C5913D9\Shared.dll
2009-12-22 14:56 . 2010-03-13 09:45 856576 -c--a-w- c:\documents and settings\All Users\Application Data\{75E0B449-A5F7-4723-A8A0-97A4CCDB67A9}\OFFLINE\74EADC79\6C5913D9\Shared.dll
2009-12-22 14:56 . 2010-03-13 09:45 96768 -c--a-w- c:\documents and settings\All Users\Application Data\{75E0B449-A5F7-4723-A8A0-97A4CCDB67A9}\OFFLINE\E9D2A283\6C5913D9\GPixFilter.dll
2009-12-22 14:56 . 2010-03-13 09:45 68608 -c--a-w- c:\documents and settings\All Users\Application Data\{75E0B449-A5F7-4723-A8A0-97A4CCDB67A9}\OFFLINE\18D4A099\6C5913D9\GSExpr2.dll
2009-12-20 21:32 . 2010-03-01 22:22 394600 ----a-w- c:\documents and settings\martin\Application Data\Songbird2\Profiles\cgq1d2ot.default\extensions\
cd-rip@songbirdnest.com\lib\gwrks32.dll
2009-12-20 21:32 . 2010-03-01 22:22 3573096 ----a-w- c:\documents and settings\martin\Application Data\Songbird2\Profiles\cgq1d2ot.default\extensions\
cd-rip@songbirdnest.com\lib\gearaw32.dll
2009-12-20 21:32 . 2010-03-01 22:22 238952 ----a-w- c:\documents and settings\martin\Application Data\Songbird2\Profiles\cgq1d2ot.default\extensions\
cd-rip@songbirdnest.com\lib\gwlangen.dll
2009-12-20 21:32 . 2010-03-01 22:22 13312 ----a-w- c:\documents and settings\martin\Application Data\Songbird2\Profiles\cgq1d2ot.default\extensions\
cd-rip@songbirdnest.com\components\sbGearworksStub.dll
2009-12-20 21:32 . 2010-03-01 22:22 65536 ----a-w- c:\documents and settings\martin\Application Data\Songbird2\Profiles\cgq1d2ot.default\extensions\
cd-rip@songbirdnest.com\lib\sbGearworksCD.dll
2009-12-20 21:32 . 2010-03-01 22:22 724992 ----a-w- c:\documents and settings\martin\Application Data\Songbird2\Profiles\cgq1d2ot.default\extensions\
mtp@songbirdnest.com\components\sbMTPWin32.dll
2009-12-20 21:31 . 2010-03-01 22:22 561152 ----a-w- c:\documents and settings\martin\Application Data\Songbird2\Profiles\cgq1d2ot.default\extensions\
msc@songbirdnest.com\components\sbMSCDevice.dll
2009-12-20 21:30 . 2010-03-01 22:22 274432 ----a-w- c:\documents and settings\martin\Application Data\Songbird2\Profiles\cgq1d2ot.default\extensions\
windowsmedia@songbirdnest.com\platform\WINNT_x86-msvc\components\sbWindowsMediacore.dll
2009-12-20 21:30 . 2010-03-01 22:22 106496 ----a-w- c:\documents and settings\martin\Application Data\Songbird2\Profiles\cgq1d2ot.default\extensions\
quicktime@songbirdnest.com\platform\WINNT_x86-msvc\components\sbQuickTimeMediacore.dll
2009-12-20 21:30 . 2010-03-01 22:22 13312 ----a-w- c:\documents and settings\martin\Application Data\Songbird2\Profiles\cgq1d2ot.default\extensions\
gracenote@songbirdnest.com\components\sbGracenoteStub.dll
2009-12-20 21:30 . 2010-03-01 22:22 81408 ----a-w- c:\documents and settings\martin\Application Data\Songbird2\Profiles\cgq1d2ot.default\extensions\
gracenote@songbirdnest.com\lib\gnsdk_musicid_cd.dll
2009-12-20 21:30 . 2010-03-01 22:22 77824 ----a-w- c:\documents and settings\martin\Application Data\Songbird2\Profiles\cgq1d2ot.default\extensions\
gracenote@songbirdnest.com\lib\sbGracenote.dll
2009-12-20 21:30 . 2010-03-01 22:22 571904 ----a-w- c:\documents and settings\martin\Application Data\Songbird2\Profiles\cgq1d2ot.default\extensions\
gracenote@songbirdnest.com\lib\gnsdk_sdkmanager.dll
2009-12-20 21:30 . 2010-03-01 22:22 154624 ----a-w- c:\documents and settings\martin\Application Data\Songbird2\Profiles\cgq1d2ot.default\extensions\
gracenote@songbirdnest.com\lib\gnsdk_search.dll
2009-12-20 21:30 . 2010-03-01 22:22 114688 ----a-w- c:\documents and settings\martin\Application Data\Songbird2\Profiles\cgq1d2ot.default\extensions\
gracenote@songbirdnest.com\lib\gnsdk_link.dll
.
((((((((((((((((((((((((((((( SnapShot@2010-03-14_22.35.42 )))))))))))))))))))))))))))))))))))))))))
.
+ 2010-03-15 07:33 . 2010-03-15 07:33 16384 c:\windows\Temp\Perflib_Perfdata_20c.dat
+ 2006-02-28 12:00 . 2010-03-15 07:37 58930 c:\windows\system32\perfc009.dat
- 2006-02-28 12:00 . 2010-03-14 22:27 58930 c:\windows\system32\perfc009.dat
+ 2009-12-05 12:21 . 2010-03-15 07:33 32768 c:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
- 2009-12-05 12:21 . 2010-03-14 22:22 32768 c:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
- 2009-12-05 12:21 . 2010-03-14 22:22 32768 c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
+ 2009-12-05 12:21 . 2010-03-15 07:33 32768 c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
- 2009-12-05 12:21 . 2010-03-14 22:22 16384 c:\windows\system32\config\systemprofile\Cookies\index.dat
+ 2009-12-05 12:21 . 2010-03-15 07:33 16384 c:\windows\system32\config\systemprofile\Cookies\index.dat
+ 2010-03-15 00:08 . 2010-03-15 00:08 97360 c:\windows\Installer\{E78ABE2A-F41C-4D64-AE62-257D2D0A6A6C}\egui.exe
+ 2010-03-15 00:08 . 2010-03-15 00:08 10134 c:\windows\Installer\{E78ABE2A-F41C-4D64-AE62-257D2D0A6A6C}\callmsi.exe
+ 2006-02-28 12:00 . 2010-03-15 07:37 392630 c:\windows\system32\perfh009.dat
- 2006-02-28 12:00 . 2010-03-14 22:27 392630 c:\windows\system32\perfh009.dat
+ 2010-03-15 00:08 . 2010-03-15 00:08 961536 c:\windows\Installer\22f375.msi
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"uTorrent"="c:\program files\uTorrent\uTorrent.exe" [2010-03-14 319792]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"igfxtray"="c:\windows\system32\igfxtray.exe" [2006-06-06 94208]
"igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2006-06-06 77824]
"igfxpers"="c:\windows\system32\igfxpers.exe" [2006-06-06 118784]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2006-03-31 761946]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-01-11 246504]
"egui"="c:\program files\ESET\ESET Smart Security\egui.exe" [2010-02-26 2140880]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2006-02-28 15360]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2009-09-04 11:08 935288 ----a-r- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2009-10-03 03:08 35696 ----a-w- c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AGRSMMSG]
2005-12-12 14:00 88203 ----a-w- c:\windows\AGRSMMSG.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\hpWirelessAssistant]
2006-02-14 09:49 454656 ----a-w- c:\program files\HPQ\HP Wireless Assistant\HP Wireless Assistant.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PC Suite Tray]
2009-11-11 09:57 1451520 ----a-w- c:\program files\Nokia\Nokia PC Suite 7\PCSuite.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PWRISOVM.EXE]
2008-03-14 23:50 233472 ----a-w- c:\program files\PowerISO\PWRISOVM.EXE
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QIP Internet Guardian]
2010-03-01 15:19 181712 ----a-w- c:\documents and settings\martin\Application Data\QipGuard\QipGuard.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QlbCtrl]
2006-03-02 14:39 131072 ----a-w- c:\program files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2009-11-10 22:08 417792 ----a-w- c:\program files\QuickTime\QTTask.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMAX]
2005-05-06 13:06 716800 ----a-w- c:\program files\Analog Devices\SoundMAX\SMax4.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMAXPnP]
2005-05-20 07:11 925696 ----a-w- c:\program files\Analog Devices\Core\smax4pnp.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SynTPEnh]
2006-03-31 15:01 761946 ----a-w- c:\program files\Synaptics\SynTP\SynTPEnh.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\uTorrent]
2010-03-14 14:58 319792 ----a-w- c:\program files\uTorrent\uTorrent.exe
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [26.2.2010 6:41 114984]
R2 ekrn;ESET Service;c:\program files\ESET\ESET Smart Security\ekrn.exe [26.2.2010 6:41 810120]
S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [10.3.2010 15:31 135664]
.
Contents of the 'Scheduled Tasks' folder
2010-03-10 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34]
2010-03-15 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-03-10 14:31]
2010-03-15 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-03-10 14:31]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://qip.ru
uDefault_Search_URL = hxxp://search.qip.ru
uSearchAssistant = hxxp://search.qip.ru/ie
IE: E&xportovať do programu Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\martin\Application Data\Mozilla\Firefox\Profiles\m48halyg.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - google.com
FF - prefs.js: keyword.URL - hxxp://search.qip.ru/search?from=FF&query=
FF - component: c:\documents and settings\martin\Application Data\Mozilla\Firefox\Profiles\m48halyg.default\extensions\{32a1fd71-835e-4b11-8e54-886fda0b4c89}\components\qippipe.dll
FF - plugin: c:\documents and settings\martin\Application Data\Mozilla\Firefox\Profiles\m48halyg.default\extensions\
yyginstantplay@yoyogames.com\plugins\NPYYGInstantPlay.dll
FF - plugin: c:\documents and settings\martin\Local Settings\Application Data\Unity\WebPlayer\loader\npUnity3D32.dll
FF - plugin: c:\program files\Google\Google Earth\plugin\npgeplugin.dll
FF - plugin: c:\program files\Google\Update\1.2.183.17\npGoogleOneClick8.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - plugin: c:\program files\Veetle\Player\npvlc.dll
FF - plugin: c:\program files\Veetle\plugins\npVeetle.dll
---- FIREFOX POLICIES ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.debug", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("html5.enable", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "
http://www.firefox.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
c:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".sk");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
http://www.gmer.net
Rootkit scan 2010-03-15 09:00
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer,
http://www.gmer.net
device: opened successfully
user: MBR read successfully
called modules: ntkrnlpa.exe catchme.sys CLASSPNP.SYS disk.sys ACPI.sys hal.dll >>UNKNOWN [0x8649B618]<<
kernel: MBR read successfully
detected MBR rootkit hooks:
\Driver\Disk -> CLASSPNP.SYS @ 0xf75ebfc3
\Driver\ACPI -> ACPI.sys @ 0xf745ecb8
\Driver\atapi -> atapi.sys @ 0xf73d27b4
IoDeviceObjectType -> DeleteProcedure -> ntkrnlpa.exe @ 0x80577d44
ParseProcedure -> ntkrnlpa.exe @ 0x80576964
\Device\Harddisk0\DR0 -> DeleteProcedure -> ntkrnlpa.exe @ 0x80577d44
ParseProcedure -> ntkrnlpa.exe @ 0x80576964
NDIS: Broadcom 802.11b/g WLAN -> SendCompleteHandler -> NDIS.sys @ 0xf72dfba0
PacketIndicateHandler -> NDIS.sys @ 0xf72ecb21
SendHandler -> NDIS.sys @ 0xf72ca87b
user & kernel MBR OK
**************************************************************************
.
Completion time: 2010-03-15 09:02:14
ComboFix-quarantined-files.txt 2010-03-15 08:02
ComboFix2.txt 2010-03-14 22:37
Pre-Run: 1 085 095 936 bytes free
Post-Run: 1 056 632 832 bytes free
- - End Of File - - 71A622E7835D41247A846B940138D3B5
Přispějete na provoz fóra?