VIRY.CZ

Logfile of random's system information tool 1.07 (written by random/random)
Run by Kovino at 2010-05-09 17:30:17
Microsoft Windows XP Professional Service Pack 3
System drive C: has 80 MB (1%) free of 13 GB
Total RAM: 1023 MB (63% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 17:30:24, on 9. 5. 2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16915)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\AhnRpta.exe
C:\WINDOWS\system32\sstray.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\program files\microcom\adsl deskporte usb\CnxDslTb.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\DNA\btdna.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\PROGRA~1\TVAV~1\TVAV~1\TV AV.exe
C:\Program Files\Mozilla Firefox\firefox.exe
D:\Download\RSIT.exe
C:\Program Files\trend micro\Kovino.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: ShoppingReport - {100EB1FD-D03E-47FD-81F3-EE91287F9465} - C:\Program Files\ShoppingReport\Bin\2.5.0\ShoppingReport.dll
O2 - BHO: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL
O4 - HKLM\..\Run: [Ptipbmf] rundll32.exe ptipbmf.dll,SetWriteCacheMode
O4 - HKLM\..\Run: [nForce Tray Options] sstray.exe /r
O4 - HKLM\..\Run: [TVTray] C:\PROGRA~1\TVAV~1\TVAV~1\TVTray.exe
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [CnxDslTaskBar] "c:\program files\microcom\adsl deskporte usb\CnxDslTb.exe" "Microcom\ADSL DeskPorte USB"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [cdoosoft] C:\DOCUME~1\Kovino\LOCALS~1\Temp\herss.exe
O4 - HKCU\..\Run: [BitTorrent DNA] "C:\Program Files\DNA\btdna.exe"
O4 - HKCU\..\Run: [nod32] C:\DOCUME~1\Kovino\LOCALS~1\Temp\nodqq.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: HP Photosmart Premier Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O8 - Extra context menu item: Download Using &BitSpirit - C:\Program Files\BitSpirit\bsurl.htm
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: ShopperReports - Compare product prices - {C5428486-50A0-4a02-9D20-520B59A9F9B2} - C:\Program Files\ShoppingReport\Bin\2.5.0\ShoppingReport.dll
O9 - Extra button: ShopperReports - Compare travel rates - {C5428486-50A0-4a02-9D20-520B59A9F9B3} - C:\Program Files\ShoppingReport\Bin\2.5.0\ShoppingReport.dll
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Application Driver Auto Removal Service (01) (appdrvrem01) - Protection Technology - C:\WINDOWS\System32\appdrvrem01.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: FIM Speedway GP3 Drivers Auto Removal (pr2aq6eb) (pr2aq6eb) - Techland Sp.z o.o. - C:\WINDOWS\system32\pr2aq6eb.exe
O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software GmbH - C:\WINDOWS\System32\TuneUpDefragService.exe

--
End of file - 6870 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\1-Click Maintenance.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{100EB1FD-D03E-47FD-81F3-EE91287F9465}]
ShoppingReport - C:\Program Files\ShoppingReport\Bin\2.5.0\ShoppingReport.dll [2008-02-06 1173024]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C}]
Megaupload Toolbar - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL [2007-07-31 1933256]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2009-03-09 35840]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2009-03-09 73728]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - Megaupload Toolbar - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL [2007-07-31 1933256]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"Ptipbmf"=ptipbmf.dll,SetWriteCacheMode []
"nForce Tray Options"=sstray.exe /r []
"TVTray"=C:\PROGRA~1\TVAV~1\TVAV~1\TVTray.exe [2004-09-10 245760]
"IMJPMIG8.1"=C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE [2006-02-28 208952]
"MSPY2002"=C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe [2006-02-28 59392]
"PHIME2002ASync"=C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE [2006-02-28 455168]
"PHIME2002A"=C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE [2006-02-28 455168]
"HP Software Update"=C:\Program Files\HP\HP Software Update\HPWuSchd2.exe [2006-02-19 49152]
"CnxDslTaskBar"=c:\program files\microcom\adsl deskporte usb\CnxDslTb.exe [2004-06-16 233472]
"NvCplDaemon"=C:\WINDOWS\system32\NvCpl.dll [2006-10-22 7700480]
"nwiz"=nwiz.exe /install []
"NvMediaCenter"=C:\WINDOWS\system32\NvMcTray.dll [2006-10-22 86016]
"QuickTime Task"=C:\Program Files\QuickTime\QTTask.exe [2008-09-06 413696]
"UserFaultCheck"=C:\WINDOWS\system32\dumprep 0 -u []

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"=C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]
"cdoosoft"=C:\DOCUME~1\Kovino\LOCALS~1\Temp\herss.exe [2010-04-12 117760]
"BitTorrent DNA"=C:\Program Files\DNA\btdna.exe [2010-02-15 323392]
"nod32"=C:\DOCUME~1\Kovino\LOCALS~1\Temp\nodqq.exe [2010-05-09 111616]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
HP Photosmart Premier Fast Start.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon]
C:\WINDOWS\system32\WgaLogon.dll [2009-03-10 239496]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{BB4C402F-882A-4526-8C08-51278EA437C1}"=C:\WINDOWS\system32\e8main0.dll [2008-04-14 66467]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDrives"=0
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=
"NoDrives"=
"NoDriveAutoRun"=
"HonorAutoRunSetting"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"C:\Program Files\Winamp Remote\bin\Orb.exe"="C:\Program Files\Winamp Remote\bin\Orb.exe:*:Enabled:Orb"
"C:\Program Files\Winamp Remote\bin\OrbTray.exe"="C:\Program Files\Winamp Remote\bin\OrbTray.exe:*:Enabled:OrbTray"
"C:\Program Files\Winamp Remote\bin\OrbStreamerClient.exe"="C:\Program Files\Winamp Remote\bin\OrbStreamerClient.exe:*:Enabled:Orb Stream Client"
"C:\Program Files\SopCast\SopCast.exe"="C:\Program Files\SopCast\SopCast.exe:*:Enabled:SopCast Main Application"
"C:\Program Files\SopCast\adv\SopAdver.exe"="C:\Program Files\SopCast\adv\SopAdver.exe:*:Enabled:SopCast Adver"
"C:\Program Files\LimeWire\LimeWire.exe"="C:\Program Files\LimeWire\LimeWire.exe:*:Enabled:LimeWire"
"C:\Program Files\mIRC\mirc.exe"="C:\Program Files\mIRC\mirc.exe:*:Enabled:mIRC"
"C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE"="C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook"
"C:\Program Files\Mozilla Firefox\firefox.exe"="C:\Program Files\Mozilla Firefox\firefox.exe:*:Enabled:Firefox"
"C:\Program Files\BitSpirit\BitSpirit.exe"="C:\Program Files\BitSpirit\BitSpirit.exe:*:Enabled:The powerful and easy-to-use BitTorrent Client"
"D:\Music\Jaromír NOHAVICA PRAHA LEDEN 2006\miranda\Mir4nda-IM-0.6.8-Pack-v1.8.2\miranda32.exe"="D:\Music\Jaromír NOHAVICA PRAHA LEDEN 2006\miranda\Mir4nda-IM-0.6.8-Pack-v1.8.2\miranda32.exe:*:Enabled:Miranda IM"
"D:\Gamesky\TmNationsForever\TmForever.exe"="D:\Gamesky\TmNationsForever\TmForever.exe:*:Enabled:TmForever"
"D:\Gamesky\FM2008\fm.exe"="D:\Gamesky\FM2008\fm.exe:*:Enabled:Football Manager 2008"
"C:\Program Files\Hamachi\hamachi.exe"="C:\Program Files\Hamachi\hamachi.exe:*:Enabled:Hamachi Client"
"C:\Program Files\Cyanide\GameCenter\GameCenter.exe"="C:\Program Files\Cyanide\GameCenter\GameCenter.exe:*:Enabled:GameCenter"
"D:\Gamesky\Pro Cycling Manager - Season 2008\PCM.exe"="D:\Gamesky\Pro Cycling Manager - Season 2008\PCM.exe:*:Enabled:Pro Cycling Manager - Season 2008"
"D:\Gamesky\Pro Cycling Manager - Season 2008\Autorun\Exe\Autorun.exe"="D:\Gamesky\Pro Cycling Manager - Season 2008\Autorun\Exe\Autorun.exe:*:Enabled:Pro Cycling Manager - Season 2008 - AutoRun"
"C:\Program Files\eMule\emule.exe"="C:\Program Files\eMule\emule.exe:*:Enabled:eMule"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"D:\Gamesky\moto\MotoGP 08\Launcher.exe"="D:\Gamesky\moto\MotoGP 08\Launcher.exe:*:Enabled:MotoGP 08"
"D:\Gamesky\fm 2009\fm.exe"="D:\Gamesky\fm 2009\fm.exe:*:Disabled:Football Manager 2009 Demo"
"D:\Gamesky\FM2009\fm.exe"="D:\Gamesky\FM2009\fm.exe:*:Enabled:Football Manager 2009"
"C:\Program Files\RayV\RayV\RayV.exe"="C:\Program Files\RayV\RayV\RayV.exe:*:Enabled:RayV"
"C:\Program Files\ICQ6.5\ICQ.exe"="C:\Program Files\ICQ6.5\ICQ.exe:*:Enabled:ICQ6"
"C:\Program Files\Java\jre6\bin\javaw.exe"="C:\Program Files\Java\jre6\bin\javaw.exe:*:Enabled:Java(TM) Platform SE binary"
"C:\Program Files\DNA\btdna.exe"="C:\Program Files\DNA\btdna.exe:*:Enabled:DNA"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{1c719636-9541-11de-bed6-0010dcfdfdcf}]
shell\AutoRun\command - J:\o.exe
shell\open\command - J:\o.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{396ca6d4-ac30-11dd-bca2-806d6172696f}]
shell\Open(0)\command - F:\Recycled\ctfmon.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{396ca6d6-ac30-11dd-bca2-806d6172696f}]
shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Recycled\ctfmon.exe
shell\Open(0)\command - I:\Recycled\ctfmon.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{63c5599a-2f25-11dd-a7c6-001333c17d08}]
shell\AutoRun\command - I:\chxnxyx.exe
shell\open\command - I:\chxnxyx.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{63c5599b-2f25-11dd-a7c6-001333c17d08}]
shell\AutoRun\command - J:\USBNB.exe


======List of files/folders created in the last 1 months======

2010-05-09 17:30:17 ----D---- C:\rsit
2010-05-09 17:23:52 ----RSH---- C:\9rfpp.exe
2010-05-06 10:12:33 ----RSH---- C:\i8ikdjwt.exe
2010-05-03 17:47:42 ----RSH---- C:\1thes92p.exe
2010-05-02 17:40:16 ----RSH---- C:\rpw.exe
2010-04-28 18:25:45 ----RSH---- C:\ca.exe
2010-04-26 18:32:32 ----RSH---- C:\wkimt.exe
2010-04-26 09:34:04 ----RSH---- C:\chxnxyx.exe
2010-04-25 14:49:23 ----RSH---- C:\hc3hvi0.exe

======List of files/folders modified in the last 1 months======

2010-05-09 17:30:24 ----D---- C:\Program Files\Trend Micro
2010-05-09 17:30:23 ----D---- C:\WINDOWS\Prefetch
2010-05-09 17:29:24 ----D---- C:\Program Files\Mozilla Firefox
2010-05-09 17:23:22 ----D---- C:\WINDOWS\temp
2010-05-09 17:23:16 ----D---- C:\WINDOWS
2010-05-09 17:23:16 ----D---- C:\Program Files\DNA
2010-05-09 17:23:12 ----D---- C:\Documents and Settings\Kovino\Application Data\DNA
2010-05-09 01:17:54 ----A---- C:\WINDOWS\SchedLgU.Txt
2010-04-30 07:07:59 ----A---- C:\WINDOWS\WINCMD.INI

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 AmdK7;AMD K7 Processor Driver; C:\WINDOWS\system32\DRIVERS\amdk7.sys [2008-04-13 37760]
R1 appdrv01;Application Driver (01); C:\WINDOWS\System32\Drivers\appdrv01.sys [2008-08-04 3468904]
R1 PQNTDrv;PQNTDrv; C:\WINDOWS\system32\drivers\PQNTDrv.sys [2002-09-16 4228]
R2 atksgt;atksgt; C:\WINDOWS\system32\DRIVERS\atksgt.sys [2008-01-09 278728]
R2 lirsgt;lirsgt; C:\WINDOWS\system32\DRIVERS\lirsgt.sys [2008-01-09 25416]
R3 Arp1394;1394 ARP Client Protocol; C:\WINDOWS\system32\DRIVERS\arp1394.sys [2008-04-13 60800]
R3 Cap7134;713x TV Card Capture; C:\WINDOWS\system32\DRIVERS\Cap7134.sys [2004-06-22 335520]
R3 Edspport;EDSP Port Driver; C:\WINDOWS\system32\DRIVERS\es56tpi.sys [2001-08-17 347550]
R3 hamachi;Hamachi Network Interface; C:\WINDOWS\system32\DRIVERS\hamachi.sys [2008-06-30 25280]
R3 HidUsb;Microsoft HID Class Driver; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-13 10368]
R3 mouhid;Mouse HID Driver; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-08-17 12160]
R3 NIC1394;1394 Net Driver; C:\WINDOWS\system32\DRIVERS\nic1394.sys [2008-04-13 61824]
R3 nv;nv; C:\WINDOWS\system32\DRIVERS\nv4_mini.sys [2006-10-22 3994624]
R3 nvax;Service for NVIDIA(R) nForce(TM) Audio Enumerator; C:\WINDOWS\system32\drivers\nvax.sys [2003-04-08 29696]
R3 NVENET;NVIDIA nForce MCP Networking Controller Driver; C:\WINDOWS\system32\DRIVERS\NVENET.sys [2002-11-27 80896]
R3 nvnforce;Service for NVIDIA(R) nForce(TM) Audio; C:\WINDOWS\system32\drivers\nvapu.sys [2003-04-08 282880]
R3 PhTVTune;TV AV WDM TVTuner (FM1216ME); C:\WINDOWS\system32\DRIVERS\PhTVTune.sys [2004-10-09 27808]
R3 usbehci;Microsoft USB 2.0 Enhanced Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2008-04-13 30208]
R3 usbhub;USB2 Enabled Hub; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2008-04-13 59520]
R3 usbohci;Microsoft USB Open Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbohci.sys [2008-04-13 17152]
S3 CCDECODE;Closed Caption Decoder; C:\WINDOWS\system32\DRIVERS\CCDECODE.sys [2008-04-13 17024]
S3 CnxEtP;Conexant AccessRunner USB ADSL Adapter Filter Driver; C:\WINDOWS\system32\DRIVERS\CnxEtP.sys [2004-06-16 131072]
S3 CnxEtU;Conexant AccessRunner USB ADSL Interface Device Driver; C:\WINDOWS\system32\DRIVERS\CnxEtU.sys [2004-06-16 614272]
S3 CnxTgNP;Conexant AccessRunner ADSL WAN PPPoE Adapter Driver; C:\WINDOWS\system32\DRIVERS\CnxTgNP.sys [2004-06-16 60416]
S3 HPZid412;IEEE-1284.4 Driver HPZid412; C:\WINDOWS\system32\DRIVERS\HPZid412.sys [2006-04-13 49664]
S3 HPZipr12;Print Class Driver for IEEE-1284.4 HPZipr12; C:\WINDOWS\system32\DRIVERS\HPZipr12.sys [2006-04-13 16496]
S3 HPZius12;USB to IEEE-1284.4 Translation Driver HPZius12; C:\WINDOWS\system32\DRIVERS\HPZius12.sys [2006-04-13 21568]
S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink Converter; C:\WINDOWS\system32\drivers\MSTEE.sys [2008-04-13 5504]
S3 NABTSFEC;NABTS/FEC VBI Codec; C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys [2008-04-13 85248]
S3 NdisIP;Microsoft TV/Video Connection; C:\WINDOWS\system32\DRIVERS\NdisIP.sys [2008-04-13 10880]
S3 RivaTuner32;RivaTuner32; \??\C:\Program Files\RivaTuner v2.05\RivaTuner32.sys []
S3 s116bus;Sony Ericsson Device 116 driver (WDM); C:\WINDOWS\system32\DRIVERS\s116bus.sys [2007-04-03 83336]
S3 s116mdfl;Sony Ericsson Device 116 USB WMC Modem Filter; C:\WINDOWS\system32\DRIVERS\s116mdfl.sys [2007-04-03 15112]
S3 s116mdm;Sony Ericsson Device 116 USB WMC Modem Driver; C:\WINDOWS\system32\DRIVERS\s116mdm.sys [2007-04-03 108680]
S3 s116mgmt;Sony Ericsson Device 116 USB WMC Device Management Drivers (WDM); C:\WINDOWS\system32\DRIVERS\s116mgmt.sys [2007-04-03 100488]
S3 s116nd5;Sony Ericsson Device 116 USB Ethernet Emulation SEMC116 (NDIS); C:\WINDOWS\system32\DRIVERS\s116nd5.sys [2007-04-03 23176]
S3 s116obex;Sony Ericsson Device 116 USB WMC OBEX Interface; C:\WINDOWS\system32\DRIVERS\s116obex.sys [2007-04-03 98696]
S3 s116unic;Sony Ericsson Device 116 USB Ethernet Emulation SEMC116 (WDM); C:\WINDOWS\system32\DRIVERS\s116unic.sys [2007-04-03 99080]
S3 SLIP;BDA Slip De-Framer; C:\WINDOWS\system32\DRIVERS\SLIP.sys [2008-04-13 11136]
S3 SONYPVU1;Sony USB Filter Driver (SONYPVU1); C:\WINDOWS\system32\DRIVERS\SONYPVU1.SYS [2001-08-17 7552]
S3 streamip;BDA IPSink; C:\WINDOWS\system32\DRIVERS\StreamIP.sys [2008-04-13 15232]
S3 usbccgp;Microsoft USB Generic Parent Driver; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-13 32128]
S3 usbprint;Microsoft USB PRINTER Class; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2008-04-13 25856]
S3 usbscan;USB Scanner Driver; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2008-04-13 15104]
S3 USBSTOR;USB Mass Storage Driver; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]
S3 WSTCODEC;World Standard Teletext Codec; C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS [2008-04-13 19200]
S3 WudfPf;Windows Driver Foundation - User-mode Driver Framework Platform Driver; C:\WINDOWS\system32\DRIVERS\WudfPf.sys [2006-09-28 77568]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-28 82944]
S4 IntelIde;IntelIde; C:\WINDOWS\system32\drivers\IntelIde.sys []

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2009-03-09 152984]
R2 NVSvc;NVIDIA Display Driver Service; C:\WINDOWS\system32\nvsvc32.exe [2006-10-22 159810]
R2 StarWindService;StarWind iSCSI Service; C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe [2005-04-02 217600]
R2 UxTuneUp;TuneUp Theme Extension; C:\WINDOWS\System32\svchost.exe [2008-04-14 14336]
S2 appdrvrem01;Application Driver Auto Removal Service (01); C:\WINDOWS\System32\appdrvrem01.exe [2008-08-04 304528]
S2 Pml Driver HPZ12;Pml Driver HPZ12; C:\WINDOWS\system32\HPZipm12.exe [2006-03-03 69632]
S2 pr2aq6eb;FIM Speedway GP3 Drivers Auto Removal (pr2aq6eb); C:\WINDOWS\system32\pr2aq6eb.exe [2008-04-03 415104]
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2005-09-23 29896]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2005-09-23 66240]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2006-10-26 441136]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 TuneUp.Defrag;TuneUp Drive Defrag Service; C:\WINDOWS\System32\TuneUpDefragService.exe [2008-01-09 306432]
S3 WMPNetworkSvc;Windows Media Player Network Sharing Service; C:\Program Files\Windows Media Player\WMPNetwk.exe [2006-10-18 913408]
S3 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]

-----------------EOF-----------------

Zdravim
1:-Stiahni na plochu UsbFix-pripoj USB-kluce-mp3.kameru,mobil,vsetko co pouzivas cez USB
-spust>>zvol Jazyk E-[enter]
-stlac 2-[enter]>po skane log vloz sem

2:Stiahnes na plochu TFC
zatvor vsetko co mas otvorene a spust-po skane restart

3:Stiahnes>>Malwarebytes' Anti-Malware stiahnut-nainstalovat -aktualizovat-
sprav komplet skan,vsetko co najde daj zmazat-,log vloz sem,

4: PROSIM CITAJTE POZORNE NAVODY!!!,

Stáhněte na plochu, ukončete všechna aktivní okna a spusťte>>
http://download.bleepingcomputer.com/sUBs/ComboFix.exe



Suhlasit instalacio Konzoly pre zotavenie (Recovery console)


- ComboFix je třeba spustit pod účtem s právy administrátora.
- Po spuštění se zobrazí podmínky užití, potvrďte je stiskem tlačítka Ano;

A este raz >ANO<

- Dále postupujte dle pokynů, během aplikování ComboFixu neklikejte do zobrazujícího modreho okna

- Po dokončení skenování, trvajícího maximálně 10-15 minut, by měl program vytvořit log - C:\ComboFix.txt, zkopírujte celý jeho obsah do svého threadu na forum
- Před použitím ComboFixu je treba vypnout všechny rezidentní bezpečnostní programy - antiviry, firewally, antispywary. NAVOD: http://www.bleepingcomputer.com/forums/topic114351.html
Mohou zasahovat do činnosti ComboFixu, což může způsobit, že nebude fungovat korektně.
V případě detekce antiviru u ComboFixu se jedná o falešný poplach.

############################## | UsbFix V6.112 |

User : Kovino (Administrators) # TUZEMSKO
Update on 09/05/2010 by El Desaparecido , C_XX & Chimay8
Start at: 6:55:11 | 10. 5. 2010
Website : http://pagesperso-orange.fr/NosTools/index.html
Contact : FindyKill.Contact@gmail.com

AMD Athlon(tm) XP 2500+
Microsoft Windows XP Professional (5.1.2600 32-bit) # Service Pack 3
Internet Explorer 7.0.5730.13
Windows Firewall Status : Enabled

A:\ -> 3 1/2 Inch Floppy Drive
C:\ -> Local Fixed Disk # 12,85 Go (7,05 Mo free) # NTFS
D:\ -> Local Fixed Disk # 63,48 Go (2,78 Go free) [FM2008] # NTFS
E:\ -> CD-ROM Disc
F:\ -> CD-ROM Disc
G:\ -> CD-ROM Disc # 582,42 Mo (0 Mo free) [HPGOF1] # CDFS
I:\ -> Removable Disk # 988,7 Mo (167,25 Mo free) # FAT
J:\ -> Removable Disk # 9,9 Mo (2,52 Mo free) # FAT

################## | Files # Infected Folders |

Deleted ! D:\srgo.exe
Deleted ! D:\t2hjo0.exe
Deleted ! D:\ucivd6xi.bat
Deleted ! D:\uqgvf.exe
Deleted ! D:\vk0w.exe
Deleted ! D:\vlvtdflx.exe
Deleted ! D:\w9uxx92.exe
Deleted ! D:\wcgswa.exe
Deleted ! D:\wfx062.exe
Deleted ! D:\wglb9q.exe
Deleted ! D:\wkimt.exe
Deleted ! D:\wrsf.exe
Deleted ! D:\ws.exe
Deleted ! D:\wu1n.exe
Deleted ! D:\x8sigm.exe
Deleted ! D:\xmor.exe
Deleted ! D:\y.exe
Deleted ! D:\y6cqb2is.exe
Deleted ! D:\ycvvj.exe
Deleted ! D:\yudald.bat
Deleted ! D:\Recycler\S-1-5-21-1993962763-1645522239-839522115-1003
Deleted ! D:\Recycler\S-1-5-21-1993962763-1645522239-839522115-500
Deleted ! D:\Recycler\S-1-5-21-515967899-1177238915-725345543-1003
Deleted ! D:\Recycler\S-1-5-21-790525478-606747145-682003330-1004
Deleted ! D:\Recycler\S-1-5-21-790525478-606747145-682003330-500
(!) Not deleted ! G:\autorun.inf
(!) Not deleted ! G:\msvcr71.dll
(!) Not deleted ! G:\autorun.exe
I:\autorun.inf -> Called file : "I:\9rfpp.exe" ( Found ! )
Deleted ! I:\9rfpp.exe
Deleted ! I:\autorun.inf
Deleted ! I:\affi8l.exe
Deleted ! I:\ca.exe
Deleted ! I:\chxnxyx.exe
Deleted ! I:\hc3hvi0.exe
Deleted ! I:\mi9al8rs.exe
Deleted ! I:\r3fhr.exe
(!) Not deleted ! J:\autorun.inf
(!) Not deleted ! J:\USBNB.exe

################## | Registry |

Deleted ! [HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "cdoosoft"
Deleted ! [HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "nod32"
Deleted ! [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks] "{BB4C402F-882A-4526-8C08-51278EA437C1}"
Deleted ! [HKCR\CLSID\{bb4c402f-882a-4526-8c08-51278ea437c1}]
Deleted ! [HKCR\CLSID\MADOWN]
Deleted ! [HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] "NoDrives"
Deleted ! [HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] "NoDrives"

################## | Mountpoints2 |

Deleted ! HKCU\...\Explorer\MountPoints2\{1c719636-9541-11de-bed6-0010dcfdfdcf}\Shell\AutoRun\Command
Deleted ! HKCU\...\Explorer\MountPoints2\{396ca6d4-ac30-11dd-bca2-806d6172696f}\Shell\Open(0)\Command
Deleted ! HKCU\...\Explorer\MountPoints2\{396ca6d6-ac30-11dd-bca2-806d6172696f}\Shell\AutoRun\Command

################## | Listing of the present files |

[28. 02. 2006 14:00|-ra------|260272] C:\$LDR$
[24. 01. 2008 00:21|-rahs----|223] C:\BOOT.BAK
[06. 08. 2001 21:49|-rahs----|279] C:\boot.ini
[23. 10. 2008 21:08|--a------|532024] C:\ComboFix.txt
[24. 11. 2008 16:55|--a------|281] C:\debugInstaller.txt
[07. 01. 2008 20:36|-rahs----|0] C:\IO.SYS
[07. 01. 2008 20:36|-rahs----|0] C:\MSDOS.SYS
[28. 02. 2006 14:00|-rahs----|47564] C:\NTDETECT.COM
[29. 09. 2008 10:33|-rahs----|250048] C:\ntldr
[?|?|?] C:\pagefile.sys
[17. 11. 2008 14:55|--a------|13030] C:\PDOXUSRS.NET
[31. 08. 2008 11:54|--a------|313858] C:\RealFootball2009_SE K750_2janci2.jar
[13. 11. 2008 16:28|--a------|58] C:\testlog.txt
[28. 02. 2006 14:00|-ra------|471971] C:\txtsetup.sif
[10. 05. 2010 07:01|--a------|3903] C:\UsbFix.txt
[15. 02. 2010 17:25|--a------|909312] D:\2 Věvoj infl cie.doc
[04. 03. 2010 13:17|--a------|41984] D:\3 Cie– pr ce.doc
[17. 03. 2009 19:48|--a------|20713] D:\auto.JPG
[01. 12. 2007 15:09|--a------|35840] D:\Ciele věchovy v.doc
[01. 11. 2005 18:18|--a------|82944] D:\diplomovka.doc
[07. 01. 2009 11:10|--a------|38912] D:\Document.doc
[03. 01. 2009 02:04|--a------|8254] D:\Document.rtf
[17. 03. 2010 18:02|-r-hs----|116224] D:\g2.bat
[16. 09. 2008 11:03|--a------|65536] D:\gmix.dat
[16. 09. 2008 11:03|--a------|65536] D:\greflect.dat
[06. 12. 2007 22:20|--a------|97280] D:\hospit cia 2 deĺ.doc
[05. 02. 2006 16:16|--a------|60416] D:\mama.doc
[18. 02. 2008 19:38|--a------|78868] D:\mf_104166911_a61856f867a3f9bf5d3172937dd818d5.jpg
[01. 02. 2010 07:34|--a------|367104] D:\MOJE OTµZKY TP.doc
[07. 01. 2010 18:03|--a------|127488] D:\na skusku.doc
[23. 04. 2000 21:29|--a------|650240] D:\navod-1.doc
[09. 01. 2008 15:18|--a------|27192] D:\Ot%C3%A1zky Psycho[2].doc
[08. 02. 2008 00:53|--a------|100631] D:\P1010032.JPG
[12. 07. 2007 10:47|--a------|982016] D:\prirucka.doc
[25. 04. 2010 14:51|--a------|1260352] D:\protokol.jpg
[26. 03. 2010 10:01|--a------|27648] D:\Protokol_silvia_novakova.doc
[20. 01. 2010 11:20|--a------|167936] D:\rimske_pravo_pc.doc
[09. 12. 2009 21:25|--a------|51200] D:\sfsfsf.doc
[22. 01. 2009 15:29|--a------|15395] D:\tahak statistika.docx
[27. 10. 2008 19:13|--a------|644608] D:\teo çt tu.doc
[29. 03. 2010 22:48|--ahs----|70144] D:\Thumbs.db
[18. 03. 2009 17:03|--a------|20992] D:\tralala.doc
[12. 01. 2010 18:56|--a------|226304] D:\TVFskuska.doc
[29. 03. 2010 22:48|--a------|55983] D:\untitled.JPG
[14. 02. 2009 13:26|--a------|84480] D:\Vypracovan‚ ot zky z TS, skuskove otazky.doc
[05. 02. 2010 12:33|--a------|133120] D:\věcuc z knihy na SDP.doc
[06. 01. 2005 20:45|--a------|22528] D:\ZTS Elektronika ES a.doc
[18. 01. 2010 16:52|--ah-----|162] D:\~$Fskuska.doc
[11. 10. 2005 20:04|-r-------|2048] G:\00000001.TMP
[11. 10. 2005 20:04|-r-------|317440] G:\00000002.TMP
[11. 10. 2005 20:09|-r-------|541403906] G:\0compressed.zip
[11. 10. 2005 20:05|-r-------|733184] G:\AutoRun.exe
[10. 10. 2005 22:32|-r-------|573440] G:\AutoRunGUI.dll
[11. 10. 2005 20:04|-r-------|1261769] G:\DIAG.EXE
[10. 10. 2005 23:21|-r-------|278528] G:\GofControls.exe
[10. 10. 2005 23:21|-r-------|77824] G:\GofInput.dll
[11. 10. 2005 20:10|-r-------|167] G:\autorun.inf
[11. 10. 2005 20:10|-r-------|112] G:\common_filelist.txt
[11. 10. 2005 20:05|-r-------|339968] G:\eauninstall.exe
[29. 09. 2005 17:41|-r-------|5694] G:\gof_icon.ico
[21. 02. 2003 14:42|-r-------|348160] G:\msvcr71.dll
[15. 02. 2010 14:23|--a------|312320] I:\1 Infl cia.doc
[22. 03. 2010 18:16|--a------|910336] I:\2 Věvoj infl cie.doc
[04. 03. 2010 12:17|--a------|41984] I:\3 Cie– pr ce.doc
[25. 04. 2010 14:51|--a------|1260352] I:\protokol.jpg
[30. 03. 2010 17:30|--a------|25600] I:\¦ivotopis.doc
[31. 03. 2010 09:49|--a------|26112] I:\zivotopis mirka.doc
[25. 04. 2010 14:57|--a------|2185216] I:\Cel pr ca.doc
[25. 04. 2010 14:58|--a------|854887] I:\Věvoj infl cie v SR.pdf
[30. 04. 2010 06:58|--a------|52736] I:\Licencna_zmluva_01.doc
[10. 05. 2010 06:54|--a------|1400] I:\BOOTEX.LOG
[26. 10. 2009 16:31|--a------|174881459] I:\anglicko.fm
[30. 11. 2009 22:02|--a------|81607689] I:\makroekon_mia.pdf
[14. 10. 2009 22:38|--a------|85543916] I:\Ekonomie - R.Holman.pdf
[19. 10. 2009 19:37|--a------|20738865] I:\Macroeconomics__nova__-third_edition_O._Blanchard.pdf
[22. 09. 2007 12:38|--a------|10235959] I:\Robert Holman - Ekonomie.pdf
[14. 10. 2009 11:49|--a------|2014208] I:\Zadanie_30419-31857.doc
[01. 10. 2009 13:20|--a------|1575936] I:\Zadanie_19927-23910.doc
[14. 10. 2009 22:25|--a------|599552] I:\Makroekonomie1.doc
[19. 10. 2009 12:35|--a------|91136] I:\Zadanie_1491-03854.doc
[14. 10. 2009 22:01|--a------|182698] I:\Zadanie_5062-08558.pdf
[23. 11. 2009 15:44|--a------|136192] I:\Zadanie_5074-08334.doc
[12. 10. 2009 08:05|--a------|70144] I:\Zadanie_17462-22612.doc
[11. 09. 2006 08:02|-ra------|41] J:\AUTORUN.INF
[11. 09. 2006 08:02|-ra------|7737344] J:\USBNB.exe

################## | Vaccination |

# C:\autorun.inf -> Autorun.inf created by UsbFix (El Desaparecido).
# D:\autorun.inf -> Autorun.inf created by UsbFix (El Desaparecido).
# I:\autorun.inf -> Autorun.inf created by UsbFix (El Desaparecido).

################## | ! End of report # UsbFix V6.112 ! |

pokracuj tak ako som napisal.